blob: f49ec56458c24a8f1cdbe117b4330a65754e5e48 [file] [log] [blame]
Jordy Rose910c4052011-09-02 06:44:22 +00001//==-- RetainCountChecker.cpp - Checks for leaks and other issues -*- C++ -*--//
Ted Kremenek2fff37e2008-03-06 00:08:09 +00002//
3// The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
Jordy Rose910c4052011-09-02 06:44:22 +000010// This file defines the methods for RetainCountChecker, which implements
11// a reference count checker for Core Foundation and Cocoa on (Mac OS X).
Ted Kremenek2fff37e2008-03-06 00:08:09 +000012//
13//===----------------------------------------------------------------------===//
14
Jordy Rose910c4052011-09-02 06:44:22 +000015#include "ClangSACheckers.h"
Mike Stump1eb44332009-09-09 15:08:12 +000016#include "clang/AST/DeclObjC.h"
Ted Kremenekb2771592011-03-30 17:41:19 +000017#include "clang/AST/DeclCXX.h"
Ted Kremenek0b526b42010-02-18 00:05:58 +000018#include "clang/Basic/LangOptions.h"
19#include "clang/Basic/SourceManager.h"
Jordy Rose910c4052011-09-02 06:44:22 +000020#include "clang/Analysis/DomainSpecific/CocoaConventions.h"
Ted Kremenek4c42bb72011-11-14 21:59:21 +000021#include "clang/AST/ParentMap.h"
Jordy Rose910c4052011-09-02 06:44:22 +000022#include "clang/StaticAnalyzer/Core/Checker.h"
23#include "clang/StaticAnalyzer/Core/CheckerManager.h"
Ted Kremenek9b663712011-02-10 01:03:03 +000024#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
25#include "clang/StaticAnalyzer/Core/BugReporter/PathDiagnostic.h"
Jordan Rosef540c542012-07-26 21:39:41 +000026#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
Jordy Rose910c4052011-09-02 06:44:22 +000027#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
Ted Kremenek18c66fd2011-08-15 22:09:50 +000028#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
Ted Kremenek9b663712011-02-10 01:03:03 +000029#include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h"
Ted Kremenek6b3a0f72008-03-11 06:39:11 +000030#include "llvm/ADT/DenseMap.h"
31#include "llvm/ADT/FoldingSet.h"
Ted Kremenek6d348932008-10-21 15:53:15 +000032#include "llvm/ADT/ImmutableList.h"
Ted Kremenek0b526b42010-02-18 00:05:58 +000033#include "llvm/ADT/ImmutableMap.h"
Benjamin Kramer8fe83e12012-02-04 13:45:25 +000034#include "llvm/ADT/SmallString.h"
Ted Kremenek6ed9afc2008-05-16 18:33:44 +000035#include "llvm/ADT/STLExtras.h"
Ted Kremenek0b526b42010-02-18 00:05:58 +000036#include "llvm/ADT/StringExtras.h"
Chris Lattner5f9e2722011-07-23 10:55:15 +000037#include <cstdarg>
Ted Kremenek2fff37e2008-03-06 00:08:09 +000038
39using namespace clang;
Ted Kremenek9ef65372010-12-23 07:20:52 +000040using namespace ento;
Ted Kremeneka64e89b2010-01-27 06:13:48 +000041using llvm::StrInStrNoCase;
Ted Kremenek4c79e552008-11-05 16:54:44 +000042
Ted Kremenekd775c662010-05-21 21:57:00 +000043namespace {
Jordy Rose910c4052011-09-02 06:44:22 +000044/// Wrapper around different kinds of node builder, so that helper functions
45/// can have a common interface.
Francois Pichetea097852011-01-11 10:41:37 +000046class GenericNodeBuilderRefCount {
Anna Zaks4eff8232011-10-05 23:44:11 +000047 CheckerContext *C;
Ted Kremenekca804532011-08-12 23:04:46 +000048 const ProgramPointTag *tag;
Ted Kremenek9d9d3a62009-05-08 23:09:42 +000049public:
Anna Zaks4eff8232011-10-05 23:44:11 +000050 GenericNodeBuilderRefCount(CheckerContext &c,
Anna Zaksaf498a22011-10-25 19:56:48 +000051 const ProgramPointTag *t = 0)
Anna Zaks6a93bd52011-10-25 19:57:11 +000052 : C(&c), tag(t){}
Zhongxing Xu031ccc02009-08-06 12:48:26 +000053
Ted Kremenek8bef8232012-01-26 21:29:00 +000054 ExplodedNode *MakeNode(ProgramStateRef state, ExplodedNode *Pred,
Anna Zaksf05aac82011-10-18 23:05:58 +000055 bool MarkAsSink = false) {
Anna Zaks0bd6b112011-10-26 21:06:34 +000056 return C->addTransition(state, Pred, tag, MarkAsSink);
Ted Kremenek9d9d3a62009-05-08 23:09:42 +000057 }
58};
59} // end anonymous namespace
60
Ted Kremenek05cbe1a2008-04-09 23:49:11 +000061//===----------------------------------------------------------------------===//
Ted Kremenek553cf182008-06-25 21:21:56 +000062// Primitives used for constructing summaries for function/method calls.
Ted Kremenek05cbe1a2008-04-09 23:49:11 +000063//===----------------------------------------------------------------------===//
64
Ted Kremenek553cf182008-06-25 21:21:56 +000065/// ArgEffect is used to summarize a function/method call's effect on a
66/// particular argument.
Jordy Rosebd85b132011-08-24 19:10:50 +000067enum ArgEffect { DoNothing, Autorelease, Dealloc, DecRef, DecRefMsg,
John McCallf85e1932011-06-15 23:02:42 +000068 DecRefBridgedTransfered,
Jordan Rose4531b7d2012-07-02 19:27:43 +000069 DecRefAndStopTracking, DecRefMsgAndStopTracking,
Jordy Rosebd85b132011-08-24 19:10:50 +000070 IncRefMsg, IncRef, MakeCollectable, MayEscape,
Jordan Rose29299c62012-06-27 00:51:18 +000071 NewAutoreleasePool, StopTracking };
Ted Kremenek553cf182008-06-25 21:21:56 +000072
Ted Kremenek6b3a0f72008-03-11 06:39:11 +000073namespace llvm {
Ted Kremenekb77449c2009-05-03 05:20:50 +000074template <> struct FoldingSetTrait<ArgEffect> {
75static inline void Profile(const ArgEffect X, FoldingSetNodeID& ID) {
76 ID.AddInteger((unsigned) X);
77}
Ted Kremenek553cf182008-06-25 21:21:56 +000078};
Ted Kremenek6b3a0f72008-03-11 06:39:11 +000079} // end llvm namespace
80
Ted Kremenekb77449c2009-05-03 05:20:50 +000081/// ArgEffects summarizes the effects of a function/method call on all of
82/// its arguments.
83typedef llvm::ImmutableMap<unsigned,ArgEffect> ArgEffects;
84
Ted Kremenek6b3a0f72008-03-11 06:39:11 +000085namespace {
Ted Kremenek553cf182008-06-25 21:21:56 +000086
87/// RetEffect is used to summarize a function/method call's behavior with
Mike Stump1eb44332009-09-09 15:08:12 +000088/// respect to its return value.
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +000089class RetEffect {
Ted Kremenek6b3a0f72008-03-11 06:39:11 +000090public:
Jordy Rose76c506f2011-08-21 21:58:18 +000091 enum Kind { NoRet, OwnedSymbol, OwnedAllocatedSymbol,
John McCallf85e1932011-06-15 23:02:42 +000092 NotOwnedSymbol, GCNotOwnedSymbol, ARCNotOwnedSymbol,
Ted Kremenek78a35a32009-05-12 20:06:54 +000093 OwnedWhenTrackedReceiver };
Mike Stump1eb44332009-09-09 15:08:12 +000094
95 enum ObjKind { CF, ObjC, AnyObj };
Ted Kremenek2d1652e2009-01-28 05:56:51 +000096
Ted Kremenek6b3a0f72008-03-11 06:39:11 +000097private:
Ted Kremenek2d1652e2009-01-28 05:56:51 +000098 Kind K;
99 ObjKind O;
Ted Kremenek2d1652e2009-01-28 05:56:51 +0000100
Jordy Rose76c506f2011-08-21 21:58:18 +0000101 RetEffect(Kind k, ObjKind o = AnyObj) : K(k), O(o) {}
Mike Stump1eb44332009-09-09 15:08:12 +0000102
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000103public:
Ted Kremenek2d1652e2009-01-28 05:56:51 +0000104 Kind getKind() const { return K; }
105
106 ObjKind getObjKind() const { return O; }
Mike Stump1eb44332009-09-09 15:08:12 +0000107
Ted Kremeneka8833552009-04-29 23:03:22 +0000108 bool isOwned() const {
Ted Kremenek78a35a32009-05-12 20:06:54 +0000109 return K == OwnedSymbol || K == OwnedAllocatedSymbol ||
110 K == OwnedWhenTrackedReceiver;
Ted Kremeneka8833552009-04-29 23:03:22 +0000111 }
Mike Stump1eb44332009-09-09 15:08:12 +0000112
Jordy Rose4df54fe2011-08-23 04:27:15 +0000113 bool operator==(const RetEffect &Other) const {
114 return K == Other.K && O == Other.O;
115 }
116
Ted Kremenek78a35a32009-05-12 20:06:54 +0000117 static RetEffect MakeOwnedWhenTrackedReceiver() {
118 return RetEffect(OwnedWhenTrackedReceiver, ObjC);
119 }
Mike Stump1eb44332009-09-09 15:08:12 +0000120
Ted Kremenek2d1652e2009-01-28 05:56:51 +0000121 static RetEffect MakeOwned(ObjKind o, bool isAllocated = false) {
122 return RetEffect(isAllocated ? OwnedAllocatedSymbol : OwnedSymbol, o);
Mike Stump1eb44332009-09-09 15:08:12 +0000123 }
Ted Kremenek2d1652e2009-01-28 05:56:51 +0000124 static RetEffect MakeNotOwned(ObjKind o) {
125 return RetEffect(NotOwnedSymbol, o);
Ted Kremeneke798e7c2009-04-27 19:14:45 +0000126 }
127 static RetEffect MakeGCNotOwned() {
128 return RetEffect(GCNotOwnedSymbol, ObjC);
129 }
John McCallf85e1932011-06-15 23:02:42 +0000130 static RetEffect MakeARCNotOwned() {
131 return RetEffect(ARCNotOwnedSymbol, ObjC);
132 }
Ted Kremenek553cf182008-06-25 21:21:56 +0000133 static RetEffect MakeNoRet() {
134 return RetEffect(NoRet);
Ted Kremeneka7344702008-06-23 18:02:52 +0000135 }
Jordy Roseef945882012-03-18 01:26:10 +0000136
137 void Profile(llvm::FoldingSetNodeID& ID) const {
138 ID.AddInteger((unsigned) K);
139 ID.AddInteger((unsigned) O);
140 }
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000141};
Mike Stump1eb44332009-09-09 15:08:12 +0000142
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000143//===----------------------------------------------------------------------===//
144// Reference-counting logic (typestate + counts).
145//===----------------------------------------------------------------------===//
Mike Stump1eb44332009-09-09 15:08:12 +0000146
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +0000147class RefVal {
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000148public:
149 enum Kind {
150 Owned = 0, // Owning reference.
151 NotOwned, // Reference is not owned by still valid (not freed).
152 Released, // Object has been released.
153 ReturnedOwned, // Returned object passes ownership to caller.
154 ReturnedNotOwned, // Return object does not pass ownership to caller.
155 ERROR_START,
156 ErrorDeallocNotOwned, // -dealloc called on non-owned object.
157 ErrorDeallocGC, // Calling -dealloc with GC enabled.
158 ErrorUseAfterRelease, // Object used after released.
159 ErrorReleaseNotOwned, // Release of an object that was not owned.
160 ERROR_LEAK_START,
161 ErrorLeak, // A memory leak due to excessive reference counts.
162 ErrorLeakReturned, // A memory leak due to the returning method not having
163 // the correct naming conventions.
164 ErrorGCLeakReturned,
165 ErrorOverAutorelease,
166 ErrorReturnedNotOwned
167 };
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000168
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000169private:
170 Kind kind;
171 RetEffect::ObjKind okind;
172 unsigned Cnt;
173 unsigned ACnt;
174 QualType T;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000175
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000176 RefVal(Kind k, RetEffect::ObjKind o, unsigned cnt, unsigned acnt, QualType t)
177 : kind(k), okind(o), Cnt(cnt), ACnt(acnt), T(t) {}
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000178
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000179public:
180 Kind getKind() const { return kind; }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000181
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000182 RetEffect::ObjKind getObjKind() const { return okind; }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000183
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000184 unsigned getCount() const { return Cnt; }
185 unsigned getAutoreleaseCount() const { return ACnt; }
186 unsigned getCombinedCounts() const { return Cnt + ACnt; }
187 void clearCounts() { Cnt = 0; ACnt = 0; }
188 void setCount(unsigned i) { Cnt = i; }
189 void setAutoreleaseCount(unsigned i) { ACnt = i; }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000190
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000191 QualType getType() const { return T; }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000192
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000193 bool isOwned() const {
194 return getKind() == Owned;
195 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000196
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000197 bool isNotOwned() const {
198 return getKind() == NotOwned;
199 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000200
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000201 bool isReturnedOwned() const {
202 return getKind() == ReturnedOwned;
203 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000204
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000205 bool isReturnedNotOwned() const {
206 return getKind() == ReturnedNotOwned;
207 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000208
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000209 static RefVal makeOwned(RetEffect::ObjKind o, QualType t,
210 unsigned Count = 1) {
211 return RefVal(Owned, o, Count, 0, t);
212 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000213
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000214 static RefVal makeNotOwned(RetEffect::ObjKind o, QualType t,
215 unsigned Count = 0) {
216 return RefVal(NotOwned, o, Count, 0, t);
217 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000218
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000219 // Comparison, profiling, and pretty-printing.
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000220
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000221 bool operator==(const RefVal& X) const {
222 return kind == X.kind && Cnt == X.Cnt && T == X.T && ACnt == X.ACnt;
223 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000224
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000225 RefVal operator-(size_t i) const {
226 return RefVal(getKind(), getObjKind(), getCount() - i,
227 getAutoreleaseCount(), getType());
228 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000229
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000230 RefVal operator+(size_t i) const {
231 return RefVal(getKind(), getObjKind(), getCount() + i,
232 getAutoreleaseCount(), getType());
233 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000234
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000235 RefVal operator^(Kind k) const {
236 return RefVal(k, getObjKind(), getCount(), getAutoreleaseCount(),
237 getType());
238 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000239
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000240 RefVal autorelease() const {
241 return RefVal(getKind(), getObjKind(), getCount(), getAutoreleaseCount()+1,
242 getType());
243 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000244
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000245 void Profile(llvm::FoldingSetNodeID& ID) const {
246 ID.AddInteger((unsigned) kind);
247 ID.AddInteger(Cnt);
248 ID.AddInteger(ACnt);
249 ID.Add(T);
250 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000251
Ted Kremenek9c378f72011-08-12 23:37:29 +0000252 void print(raw_ostream &Out) const;
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000253};
254
Ted Kremenek9c378f72011-08-12 23:37:29 +0000255void RefVal::print(raw_ostream &Out) const {
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000256 if (!T.isNull())
Jordy Rosedbd658e2011-08-28 19:11:56 +0000257 Out << "Tracked " << T.getAsString() << '/';
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000258
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000259 switch (getKind()) {
Jordy Rose910c4052011-09-02 06:44:22 +0000260 default: llvm_unreachable("Invalid RefVal kind");
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000261 case Owned: {
262 Out << "Owned";
263 unsigned cnt = getCount();
264 if (cnt) Out << " (+ " << cnt << ")";
265 break;
266 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000267
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000268 case NotOwned: {
269 Out << "NotOwned";
270 unsigned cnt = getCount();
271 if (cnt) Out << " (+ " << cnt << ")";
272 break;
273 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000274
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000275 case ReturnedOwned: {
276 Out << "ReturnedOwned";
277 unsigned cnt = getCount();
278 if (cnt) Out << " (+ " << cnt << ")";
279 break;
280 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000281
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000282 case ReturnedNotOwned: {
283 Out << "ReturnedNotOwned";
284 unsigned cnt = getCount();
285 if (cnt) Out << " (+ " << cnt << ")";
286 break;
287 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000288
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000289 case Released:
290 Out << "Released";
291 break;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000292
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000293 case ErrorDeallocGC:
294 Out << "-dealloc (GC)";
295 break;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000296
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000297 case ErrorDeallocNotOwned:
298 Out << "-dealloc (not-owned)";
299 break;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000300
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000301 case ErrorLeak:
302 Out << "Leaked";
303 break;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000304
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000305 case ErrorLeakReturned:
306 Out << "Leaked (Bad naming)";
307 break;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000308
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000309 case ErrorGCLeakReturned:
310 Out << "Leaked (GC-ed at return)";
311 break;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000312
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000313 case ErrorUseAfterRelease:
314 Out << "Use-After-Release [ERROR]";
315 break;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000316
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000317 case ErrorReleaseNotOwned:
318 Out << "Release of Not-Owned [ERROR]";
319 break;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000320
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000321 case RefVal::ErrorOverAutorelease:
322 Out << "Over autoreleased";
323 break;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000324
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000325 case RefVal::ErrorReturnedNotOwned:
326 Out << "Non-owned object returned instead of owned";
327 break;
328 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000329
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000330 if (ACnt) {
331 Out << " [ARC +" << ACnt << ']';
332 }
333}
334} //end anonymous namespace
335
336//===----------------------------------------------------------------------===//
337// RefBindings - State used to track object reference counts.
338//===----------------------------------------------------------------------===//
339
340typedef llvm::ImmutableMap<SymbolRef, RefVal> RefBindings;
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000341
342namespace clang {
Ted Kremenek9ef65372010-12-23 07:20:52 +0000343namespace ento {
Ted Kremenek18c66fd2011-08-15 22:09:50 +0000344template<>
345struct ProgramStateTrait<RefBindings>
346 : public ProgramStatePartialTrait<RefBindings> {
347 static void *GDMIndex() {
348 static int RefBIndex = 0;
349 return &RefBIndex;
350 }
351};
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000352}
Argyrios Kyrtzidis5a4f98f2010-12-22 18:53:20 +0000353}
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000354
Anna Zaks8d6b43c2012-08-14 00:36:15 +0000355static inline const RefVal *getRefBinding(ProgramStateRef State,
356 SymbolRef Sym) {
357 return State->get<RefBindings>(Sym);
358}
359
360static inline ProgramStateRef setRefBinding(ProgramStateRef State,
361 SymbolRef Sym, RefVal Val) {
362 return State->set<RefBindings>(Sym, Val);
363}
364
365static ProgramStateRef removeRefBinding(ProgramStateRef State, SymbolRef Sym) {
366 return State->remove<RefBindings>(Sym);
367}
368
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000369//===----------------------------------------------------------------------===//
Jordy Rose910c4052011-09-02 06:44:22 +0000370// Function/Method behavior summaries.
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000371//===----------------------------------------------------------------------===//
372
373namespace {
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +0000374class RetainSummary {
Jordy Roseef945882012-03-18 01:26:10 +0000375 /// Args - a map of (index, ArgEffect) pairs, where index
Ted Kremenek1bffd742008-05-06 15:44:25 +0000376 /// specifies the argument (starting from 0). This can be sparsely
377 /// populated; arguments with no entry in Args use 'DefaultArgEffect'.
Ted Kremenekb77449c2009-05-03 05:20:50 +0000378 ArgEffects Args;
Mike Stump1eb44332009-09-09 15:08:12 +0000379
Ted Kremenek1bffd742008-05-06 15:44:25 +0000380 /// DefaultArgEffect - The default ArgEffect to apply to arguments that
381 /// do not have an entry in Args.
Ted Kremenek0507f7e2012-01-04 00:35:45 +0000382 ArgEffect DefaultArgEffect;
Mike Stump1eb44332009-09-09 15:08:12 +0000383
Ted Kremenek553cf182008-06-25 21:21:56 +0000384 /// Receiver - If this summary applies to an Objective-C message expression,
385 /// this is the effect applied to the state of the receiver.
Ted Kremenek0507f7e2012-01-04 00:35:45 +0000386 ArgEffect Receiver;
Mike Stump1eb44332009-09-09 15:08:12 +0000387
Ted Kremenek553cf182008-06-25 21:21:56 +0000388 /// Ret - The effect on the return value. Used to indicate if the
Jordy Rose76c506f2011-08-21 21:58:18 +0000389 /// function/method call returns a new tracked symbol.
Ted Kremenek0507f7e2012-01-04 00:35:45 +0000390 RetEffect Ret;
Mike Stump1eb44332009-09-09 15:08:12 +0000391
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000392public:
Ted Kremenekb77449c2009-05-03 05:20:50 +0000393 RetainSummary(ArgEffects A, RetEffect R, ArgEffect defaultEff,
Jordy Rosee62e87b2011-08-20 20:55:40 +0000394 ArgEffect ReceiverEff)
395 : Args(A), DefaultArgEffect(defaultEff), Receiver(ReceiverEff), Ret(R) {}
Mike Stump1eb44332009-09-09 15:08:12 +0000396
Ted Kremenek553cf182008-06-25 21:21:56 +0000397 /// getArg - Return the argument effect on the argument specified by
398 /// idx (starting from 0).
Ted Kremenek1ac08d62008-03-11 17:48:22 +0000399 ArgEffect getArg(unsigned idx) const {
Ted Kremenekb77449c2009-05-03 05:20:50 +0000400 if (const ArgEffect *AE = Args.lookup(idx))
401 return *AE;
Mike Stump1eb44332009-09-09 15:08:12 +0000402
Ted Kremenek1bffd742008-05-06 15:44:25 +0000403 return DefaultArgEffect;
Ted Kremenek1ac08d62008-03-11 17:48:22 +0000404 }
Ted Kremenek11fe1752011-01-27 18:43:03 +0000405
406 void addArg(ArgEffects::Factory &af, unsigned idx, ArgEffect e) {
407 Args = af.add(Args, idx, e);
408 }
Mike Stump1eb44332009-09-09 15:08:12 +0000409
Ted Kremenek885c27b2009-05-04 05:31:22 +0000410 /// setDefaultArgEffect - Set the default argument effect.
411 void setDefaultArgEffect(ArgEffect E) {
412 DefaultArgEffect = E;
413 }
Mike Stump1eb44332009-09-09 15:08:12 +0000414
Ted Kremenek553cf182008-06-25 21:21:56 +0000415 /// getRetEffect - Returns the effect on the return value of the call.
Ted Kremenekb77449c2009-05-03 05:20:50 +0000416 RetEffect getRetEffect() const { return Ret; }
Mike Stump1eb44332009-09-09 15:08:12 +0000417
Ted Kremenek885c27b2009-05-04 05:31:22 +0000418 /// setRetEffect - Set the effect of the return value of the call.
419 void setRetEffect(RetEffect E) { Ret = E; }
Mike Stump1eb44332009-09-09 15:08:12 +0000420
Ted Kremenek12b94342011-01-27 06:54:14 +0000421
422 /// Sets the effect on the receiver of the message.
423 void setReceiverEffect(ArgEffect e) { Receiver = e; }
424
Ted Kremenek553cf182008-06-25 21:21:56 +0000425 /// getReceiverEffect - Returns the effect on the receiver of the call.
426 /// This is only meaningful if the summary applies to an ObjCMessageExpr*.
Ted Kremenekb77449c2009-05-03 05:20:50 +0000427 ArgEffect getReceiverEffect() const { return Receiver; }
Jordy Rose4df54fe2011-08-23 04:27:15 +0000428
429 /// Test if two retain summaries are identical. Note that merely equivalent
430 /// summaries are not necessarily identical (for example, if an explicit
431 /// argument effect matches the default effect).
432 bool operator==(const RetainSummary &Other) const {
433 return Args == Other.Args && DefaultArgEffect == Other.DefaultArgEffect &&
434 Receiver == Other.Receiver && Ret == Other.Ret;
435 }
Jordy Roseef945882012-03-18 01:26:10 +0000436
437 /// Profile this summary for inclusion in a FoldingSet.
438 void Profile(llvm::FoldingSetNodeID& ID) const {
439 ID.Add(Args);
440 ID.Add(DefaultArgEffect);
441 ID.Add(Receiver);
442 ID.Add(Ret);
443 }
444
445 /// A retain summary is simple if it has no ArgEffects other than the default.
446 bool isSimple() const {
447 return Args.isEmpty();
448 }
Jordan Rose4531b7d2012-07-02 19:27:43 +0000449
450private:
451 ArgEffects getArgEffects() const { return Args; }
452 ArgEffect getDefaultArgEffect() const { return DefaultArgEffect; }
453
454 friend class RetainSummaryManager;
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000455};
Ted Kremenek4f22a782008-06-23 23:30:29 +0000456} // end anonymous namespace
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000457
Ted Kremenek553cf182008-06-25 21:21:56 +0000458//===----------------------------------------------------------------------===//
459// Data structures for constructing summaries.
460//===----------------------------------------------------------------------===//
Ted Kremenek53301ba2008-06-24 03:49:48 +0000461
Ted Kremenek553cf182008-06-25 21:21:56 +0000462namespace {
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +0000463class ObjCSummaryKey {
Ted Kremenek553cf182008-06-25 21:21:56 +0000464 IdentifierInfo* II;
465 Selector S;
Mike Stump1eb44332009-09-09 15:08:12 +0000466public:
Ted Kremenek553cf182008-06-25 21:21:56 +0000467 ObjCSummaryKey(IdentifierInfo* ii, Selector s)
468 : II(ii), S(s) {}
469
Ted Kremenek9c378f72011-08-12 23:37:29 +0000470 ObjCSummaryKey(const ObjCInterfaceDecl *d, Selector s)
Ted Kremenek553cf182008-06-25 21:21:56 +0000471 : II(d ? d->getIdentifier() : 0), S(s) {}
Ted Kremenek70b6a832009-05-13 18:16:01 +0000472
Ted Kremenek553cf182008-06-25 21:21:56 +0000473 ObjCSummaryKey(Selector s)
474 : II(0), S(s) {}
Mike Stump1eb44332009-09-09 15:08:12 +0000475
Ted Kremenek0507f7e2012-01-04 00:35:45 +0000476 IdentifierInfo *getIdentifier() const { return II; }
Ted Kremenek553cf182008-06-25 21:21:56 +0000477 Selector getSelector() const { return S; }
478};
Ted Kremenek4f22a782008-06-23 23:30:29 +0000479}
480
481namespace llvm {
Ted Kremenek553cf182008-06-25 21:21:56 +0000482template <> struct DenseMapInfo<ObjCSummaryKey> {
483 static inline ObjCSummaryKey getEmptyKey() {
484 return ObjCSummaryKey(DenseMapInfo<IdentifierInfo*>::getEmptyKey(),
485 DenseMapInfo<Selector>::getEmptyKey());
486 }
Mike Stump1eb44332009-09-09 15:08:12 +0000487
Ted Kremenek553cf182008-06-25 21:21:56 +0000488 static inline ObjCSummaryKey getTombstoneKey() {
489 return ObjCSummaryKey(DenseMapInfo<IdentifierInfo*>::getTombstoneKey(),
Mike Stump1eb44332009-09-09 15:08:12 +0000490 DenseMapInfo<Selector>::getTombstoneKey());
Ted Kremenek553cf182008-06-25 21:21:56 +0000491 }
Mike Stump1eb44332009-09-09 15:08:12 +0000492
Ted Kremenek553cf182008-06-25 21:21:56 +0000493 static unsigned getHashValue(const ObjCSummaryKey &V) {
Benjamin Kramer28b23072012-05-27 13:28:44 +0000494 typedef std::pair<IdentifierInfo*, Selector> PairTy;
495 return DenseMapInfo<PairTy>::getHashValue(PairTy(V.getIdentifier(),
496 V.getSelector()));
Ted Kremenek553cf182008-06-25 21:21:56 +0000497 }
Mike Stump1eb44332009-09-09 15:08:12 +0000498
Ted Kremenek553cf182008-06-25 21:21:56 +0000499 static bool isEqual(const ObjCSummaryKey& LHS, const ObjCSummaryKey& RHS) {
Benjamin Kramer28b23072012-05-27 13:28:44 +0000500 return LHS.getIdentifier() == RHS.getIdentifier() &&
501 LHS.getSelector() == RHS.getSelector();
Ted Kremenek553cf182008-06-25 21:21:56 +0000502 }
Mike Stump1eb44332009-09-09 15:08:12 +0000503
Ted Kremenek553cf182008-06-25 21:21:56 +0000504};
Chris Lattner06159e82009-12-15 07:26:51 +0000505template <>
506struct isPodLike<ObjCSummaryKey> { static const bool value = true; };
Ted Kremenek4f22a782008-06-23 23:30:29 +0000507} // end llvm namespace
Mike Stump1eb44332009-09-09 15:08:12 +0000508
Ted Kremenek4f22a782008-06-23 23:30:29 +0000509namespace {
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +0000510class ObjCSummaryCache {
Ted Kremenek93edbc52011-10-05 23:54:29 +0000511 typedef llvm::DenseMap<ObjCSummaryKey, const RetainSummary *> MapTy;
Ted Kremenek553cf182008-06-25 21:21:56 +0000512 MapTy M;
513public:
514 ObjCSummaryCache() {}
Mike Stump1eb44332009-09-09 15:08:12 +0000515
Ted Kremenek93edbc52011-10-05 23:54:29 +0000516 const RetainSummary * find(const ObjCInterfaceDecl *D, Selector S) {
Ted Kremenek553cf182008-06-25 21:21:56 +0000517 // Do a lookup with the (D,S) pair. If we find a match return
518 // the iterator.
519 ObjCSummaryKey K(D, S);
520 MapTy::iterator I = M.find(K);
Mike Stump1eb44332009-09-09 15:08:12 +0000521
Jordan Rose4531b7d2012-07-02 19:27:43 +0000522 if (I != M.end())
Ted Kremenek614cc542009-07-21 23:27:57 +0000523 return I->second;
Jordan Rose4531b7d2012-07-02 19:27:43 +0000524 if (!D)
525 return NULL;
Mike Stump1eb44332009-09-09 15:08:12 +0000526
Ted Kremenek553cf182008-06-25 21:21:56 +0000527 // Walk the super chain. If we find a hit with a parent, we'll end
528 // up returning that summary. We actually allow that key (null,S), as
529 // we cache summaries for the null ObjCInterfaceDecl* to allow us to
530 // generate initial summaries without having to worry about NSObject
531 // being declared.
532 // FIXME: We may change this at some point.
Ted Kremenek9c378f72011-08-12 23:37:29 +0000533 for (ObjCInterfaceDecl *C=D->getSuperClass() ;; C=C->getSuperClass()) {
Ted Kremenek553cf182008-06-25 21:21:56 +0000534 if ((I = M.find(ObjCSummaryKey(C, S))) != M.end())
535 break;
Mike Stump1eb44332009-09-09 15:08:12 +0000536
Ted Kremenek553cf182008-06-25 21:21:56 +0000537 if (!C)
Ted Kremenek614cc542009-07-21 23:27:57 +0000538 return NULL;
Ted Kremenek553cf182008-06-25 21:21:56 +0000539 }
Mike Stump1eb44332009-09-09 15:08:12 +0000540
541 // Cache the summary with original key to make the next lookup faster
Ted Kremenek553cf182008-06-25 21:21:56 +0000542 // and return the iterator.
Ted Kremenek93edbc52011-10-05 23:54:29 +0000543 const RetainSummary *Summ = I->second;
Ted Kremenek614cc542009-07-21 23:27:57 +0000544 M[K] = Summ;
545 return Summ;
Ted Kremenek553cf182008-06-25 21:21:56 +0000546 }
Mike Stump1eb44332009-09-09 15:08:12 +0000547
Ted Kremenek0507f7e2012-01-04 00:35:45 +0000548 const RetainSummary *find(IdentifierInfo* II, Selector S) {
Ted Kremenek553cf182008-06-25 21:21:56 +0000549 // FIXME: Class method lookup. Right now we dont' have a good way
550 // of going between IdentifierInfo* and the class hierarchy.
Ted Kremenek614cc542009-07-21 23:27:57 +0000551 MapTy::iterator I = M.find(ObjCSummaryKey(II, S));
Mike Stump1eb44332009-09-09 15:08:12 +0000552
Ted Kremenek614cc542009-07-21 23:27:57 +0000553 if (I == M.end())
554 I = M.find(ObjCSummaryKey(S));
Mike Stump1eb44332009-09-09 15:08:12 +0000555
Ted Kremenek614cc542009-07-21 23:27:57 +0000556 return I == M.end() ? NULL : I->second;
Ted Kremenek553cf182008-06-25 21:21:56 +0000557 }
Mike Stump1eb44332009-09-09 15:08:12 +0000558
Ted Kremenek93edbc52011-10-05 23:54:29 +0000559 const RetainSummary *& operator[](ObjCSummaryKey K) {
Ted Kremenek553cf182008-06-25 21:21:56 +0000560 return M[K];
561 }
Mike Stump1eb44332009-09-09 15:08:12 +0000562
Ted Kremenek93edbc52011-10-05 23:54:29 +0000563 const RetainSummary *& operator[](Selector S) {
Ted Kremenek553cf182008-06-25 21:21:56 +0000564 return M[ ObjCSummaryKey(S) ];
565 }
Mike Stump1eb44332009-09-09 15:08:12 +0000566};
Ted Kremenek553cf182008-06-25 21:21:56 +0000567} // end anonymous namespace
568
569//===----------------------------------------------------------------------===//
570// Data structures for managing collections of summaries.
571//===----------------------------------------------------------------------===//
572
573namespace {
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +0000574class RetainSummaryManager {
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000575
576 //==-----------------------------------------------------------------==//
577 // Typedefs.
578 //==-----------------------------------------------------------------==//
Mike Stump1eb44332009-09-09 15:08:12 +0000579
Ted Kremenek93edbc52011-10-05 23:54:29 +0000580 typedef llvm::DenseMap<const FunctionDecl*, const RetainSummary *>
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000581 FuncSummariesTy;
Mike Stump1eb44332009-09-09 15:08:12 +0000582
Ted Kremenek4f22a782008-06-23 23:30:29 +0000583 typedef ObjCSummaryCache ObjCMethodSummariesTy;
Mike Stump1eb44332009-09-09 15:08:12 +0000584
Jordy Roseef945882012-03-18 01:26:10 +0000585 typedef llvm::FoldingSetNodeWrapper<RetainSummary> CachedSummaryNode;
586
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000587 //==-----------------------------------------------------------------==//
588 // Data.
589 //==-----------------------------------------------------------------==//
Mike Stump1eb44332009-09-09 15:08:12 +0000590
Ted Kremenek553cf182008-06-25 21:21:56 +0000591 /// Ctx - The ASTContext object for the analyzed ASTs.
Ted Kremenek9c378f72011-08-12 23:37:29 +0000592 ASTContext &Ctx;
Ted Kremenek179064e2008-07-01 17:21:27 +0000593
Ted Kremenek553cf182008-06-25 21:21:56 +0000594 /// GCEnabled - Records whether or not the analyzed code runs in GC mode.
Ted Kremenek377e2302008-04-29 05:33:51 +0000595 const bool GCEnabled;
Mike Stump1eb44332009-09-09 15:08:12 +0000596
John McCallf85e1932011-06-15 23:02:42 +0000597 /// Records whether or not the analyzed code runs in ARC mode.
598 const bool ARCEnabled;
599
Ted Kremenek553cf182008-06-25 21:21:56 +0000600 /// FuncSummaries - A map from FunctionDecls to summaries.
Mike Stump1eb44332009-09-09 15:08:12 +0000601 FuncSummariesTy FuncSummaries;
602
Ted Kremenek553cf182008-06-25 21:21:56 +0000603 /// ObjCClassMethodSummaries - A map from selectors (for instance methods)
604 /// to summaries.
Ted Kremenek1f180c32008-06-23 22:21:20 +0000605 ObjCMethodSummariesTy ObjCClassMethodSummaries;
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000606
Ted Kremenek553cf182008-06-25 21:21:56 +0000607 /// ObjCMethodSummaries - A map from selectors to summaries.
Ted Kremenek1f180c32008-06-23 22:21:20 +0000608 ObjCMethodSummariesTy ObjCMethodSummaries;
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000609
Ted Kremenek553cf182008-06-25 21:21:56 +0000610 /// BPAlloc - A BumpPtrAllocator used for allocating summaries, ArgEffects,
611 /// and all other data used by the checker.
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000612 llvm::BumpPtrAllocator BPAlloc;
Mike Stump1eb44332009-09-09 15:08:12 +0000613
Ted Kremenekb77449c2009-05-03 05:20:50 +0000614 /// AF - A factory for ArgEffects objects.
Mike Stump1eb44332009-09-09 15:08:12 +0000615 ArgEffects::Factory AF;
616
Ted Kremenek553cf182008-06-25 21:21:56 +0000617 /// ScratchArgs - A holding buffer for construct ArgEffects.
Ted Kremenek0507f7e2012-01-04 00:35:45 +0000618 ArgEffects ScratchArgs;
Mike Stump1eb44332009-09-09 15:08:12 +0000619
Ted Kremenekec315332009-05-07 23:40:42 +0000620 /// ObjCAllocRetE - Default return effect for methods returning Objective-C
621 /// objects.
622 RetEffect ObjCAllocRetE;
Ted Kremenek547d4952009-06-05 23:18:01 +0000623
Mike Stump1eb44332009-09-09 15:08:12 +0000624 /// ObjCInitRetE - Default return effect for init methods returning
Ted Kremenekac02f202009-08-20 05:13:36 +0000625 /// Objective-C objects.
Ted Kremenek547d4952009-06-05 23:18:01 +0000626 RetEffect ObjCInitRetE;
Mike Stump1eb44332009-09-09 15:08:12 +0000627
Jordy Roseef945882012-03-18 01:26:10 +0000628 /// SimpleSummaries - Used for uniquing summaries that don't have special
629 /// effects.
630 llvm::FoldingSet<CachedSummaryNode> SimpleSummaries;
Mike Stump1eb44332009-09-09 15:08:12 +0000631
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000632 //==-----------------------------------------------------------------==//
633 // Methods.
634 //==-----------------------------------------------------------------==//
Mike Stump1eb44332009-09-09 15:08:12 +0000635
Ted Kremenek553cf182008-06-25 21:21:56 +0000636 /// getArgEffects - Returns a persistent ArgEffects object based on the
637 /// data in ScratchArgs.
Ted Kremenekb77449c2009-05-03 05:20:50 +0000638 ArgEffects getArgEffects();
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000639
Mike Stump1eb44332009-09-09 15:08:12 +0000640 enum UnaryFuncKind { cfretain, cfrelease, cfmakecollectable };
Ted Kremenek93edbc52011-10-05 23:54:29 +0000641
Ted Kremenek0507f7e2012-01-04 00:35:45 +0000642 const RetainSummary *getUnarySummary(const FunctionType* FT,
Ted Kremenek93edbc52011-10-05 23:54:29 +0000643 UnaryFuncKind func);
Mike Stump1eb44332009-09-09 15:08:12 +0000644
Ted Kremenek0507f7e2012-01-04 00:35:45 +0000645 const RetainSummary *getCFSummaryCreateRule(const FunctionDecl *FD);
646 const RetainSummary *getCFSummaryGetRule(const FunctionDecl *FD);
647 const RetainSummary *getCFCreateGetRuleSummary(const FunctionDecl *FD);
Mike Stump1eb44332009-09-09 15:08:12 +0000648
Jordy Roseef945882012-03-18 01:26:10 +0000649 const RetainSummary *getPersistentSummary(const RetainSummary &OldSumm);
Ted Kremenek706522f2008-10-29 04:07:07 +0000650
Jordy Roseef945882012-03-18 01:26:10 +0000651 const RetainSummary *getPersistentSummary(RetEffect RetEff,
Ted Kremenek93edbc52011-10-05 23:54:29 +0000652 ArgEffect ReceiverEff = DoNothing,
653 ArgEffect DefaultEff = MayEscape) {
Jordy Roseef945882012-03-18 01:26:10 +0000654 RetainSummary Summ(getArgEffects(), RetEff, DefaultEff, ReceiverEff);
655 return getPersistentSummary(Summ);
656 }
657
Ted Kremenekc91fdf62012-05-08 00:12:09 +0000658 const RetainSummary *getDoNothingSummary() {
659 return getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
660 }
661
Jordy Roseef945882012-03-18 01:26:10 +0000662 const RetainSummary *getDefaultSummary() {
663 return getPersistentSummary(RetEffect::MakeNoRet(),
664 DoNothing, MayEscape);
Ted Kremenek9c32d082008-05-06 00:30:21 +0000665 }
Mike Stump1eb44332009-09-09 15:08:12 +0000666
Ted Kremenek93edbc52011-10-05 23:54:29 +0000667 const RetainSummary *getPersistentStopSummary() {
Jordy Roseef945882012-03-18 01:26:10 +0000668 return getPersistentSummary(RetEffect::MakeNoRet(),
669 StopTracking, StopTracking);
Mike Stump1eb44332009-09-09 15:08:12 +0000670 }
Ted Kremenekb3095252008-05-06 04:20:12 +0000671
Ted Kremenek1f180c32008-06-23 22:21:20 +0000672 void InitializeClassMethodSummaries();
673 void InitializeMethodSummaries();
Ted Kremenek896cd9d2008-10-23 01:56:15 +0000674private:
Ted Kremenek93edbc52011-10-05 23:54:29 +0000675 void addNSObjectClsMethSummary(Selector S, const RetainSummary *Summ) {
Ted Kremenek553cf182008-06-25 21:21:56 +0000676 ObjCClassMethodSummaries[S] = Summ;
677 }
Mike Stump1eb44332009-09-09 15:08:12 +0000678
Ted Kremenek93edbc52011-10-05 23:54:29 +0000679 void addNSObjectMethSummary(Selector S, const RetainSummary *Summ) {
Ted Kremenek553cf182008-06-25 21:21:56 +0000680 ObjCMethodSummaries[S] = Summ;
681 }
Ted Kremenek3aa7ecd2009-03-04 23:30:42 +0000682
Ted Kremeneka9797122012-02-18 21:37:48 +0000683 void addClassMethSummary(const char* Cls, const char* name,
684 const RetainSummary *Summ, bool isNullary = true) {
Ted Kremenek3aa7ecd2009-03-04 23:30:42 +0000685 IdentifierInfo* ClsII = &Ctx.Idents.get(Cls);
Ted Kremeneka9797122012-02-18 21:37:48 +0000686 Selector S = isNullary ? GetNullarySelector(name, Ctx)
687 : GetUnarySelector(name, Ctx);
Ted Kremenek3aa7ecd2009-03-04 23:30:42 +0000688 ObjCClassMethodSummaries[ObjCSummaryKey(ClsII, S)] = Summ;
689 }
Mike Stump1eb44332009-09-09 15:08:12 +0000690
Ted Kremenek6c4becb2009-02-25 02:54:57 +0000691 void addInstMethSummary(const char* Cls, const char* nullaryName,
Ted Kremenek93edbc52011-10-05 23:54:29 +0000692 const RetainSummary *Summ) {
Ted Kremenek6c4becb2009-02-25 02:54:57 +0000693 IdentifierInfo* ClsII = &Ctx.Idents.get(Cls);
694 Selector S = GetNullarySelector(nullaryName, Ctx);
695 ObjCMethodSummaries[ObjCSummaryKey(ClsII, S)] = Summ;
696 }
Mike Stump1eb44332009-09-09 15:08:12 +0000697
Ted Kremenekde4d5332009-04-24 17:50:11 +0000698 Selector generateSelector(va_list argp) {
Chris Lattner5f9e2722011-07-23 10:55:15 +0000699 SmallVector<IdentifierInfo*, 10> II;
Ted Kremenekde4d5332009-04-24 17:50:11 +0000700
Ted Kremenek9e476de2008-08-12 18:30:56 +0000701 while (const char* s = va_arg(argp, const char*))
702 II.push_back(&Ctx.Idents.get(s));
Ted Kremenekde4d5332009-04-24 17:50:11 +0000703
Mike Stump1eb44332009-09-09 15:08:12 +0000704 return Ctx.Selectors.getSelector(II.size(), &II[0]);
Ted Kremenekde4d5332009-04-24 17:50:11 +0000705 }
Mike Stump1eb44332009-09-09 15:08:12 +0000706
Ted Kremenekde4d5332009-04-24 17:50:11 +0000707 void addMethodSummary(IdentifierInfo *ClsII, ObjCMethodSummariesTy& Summaries,
Ted Kremenek93edbc52011-10-05 23:54:29 +0000708 const RetainSummary * Summ, va_list argp) {
Ted Kremenekde4d5332009-04-24 17:50:11 +0000709 Selector S = generateSelector(argp);
710 Summaries[ObjCSummaryKey(ClsII, S)] = Summ;
Ted Kremenek70a733e2008-07-18 17:24:20 +0000711 }
Mike Stump1eb44332009-09-09 15:08:12 +0000712
Ted Kremenek93edbc52011-10-05 23:54:29 +0000713 void addInstMethSummary(const char* Cls, const RetainSummary * Summ, ...) {
Ted Kremenekaf9dc272008-08-12 18:48:50 +0000714 va_list argp;
715 va_start(argp, Summ);
Ted Kremenekde4d5332009-04-24 17:50:11 +0000716 addMethodSummary(&Ctx.Idents.get(Cls), ObjCMethodSummaries, Summ, argp);
Mike Stump1eb44332009-09-09 15:08:12 +0000717 va_end(argp);
Ted Kremenekaf9dc272008-08-12 18:48:50 +0000718 }
Mike Stump1eb44332009-09-09 15:08:12 +0000719
Ted Kremenek93edbc52011-10-05 23:54:29 +0000720 void addClsMethSummary(const char* Cls, const RetainSummary * Summ, ...) {
Ted Kremenekde4d5332009-04-24 17:50:11 +0000721 va_list argp;
722 va_start(argp, Summ);
723 addMethodSummary(&Ctx.Idents.get(Cls),ObjCClassMethodSummaries, Summ, argp);
724 va_end(argp);
725 }
Mike Stump1eb44332009-09-09 15:08:12 +0000726
Ted Kremenek93edbc52011-10-05 23:54:29 +0000727 void addClsMethSummary(IdentifierInfo *II, const RetainSummary * Summ, ...) {
Ted Kremenekde4d5332009-04-24 17:50:11 +0000728 va_list argp;
729 va_start(argp, Summ);
730 addMethodSummary(II, ObjCClassMethodSummaries, Summ, argp);
731 va_end(argp);
732 }
733
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000734public:
Mike Stump1eb44332009-09-09 15:08:12 +0000735
Ted Kremenek9c378f72011-08-12 23:37:29 +0000736 RetainSummaryManager(ASTContext &ctx, bool gcenabled, bool usesARC)
Ted Kremenek179064e2008-07-01 17:21:27 +0000737 : Ctx(ctx),
John McCallf85e1932011-06-15 23:02:42 +0000738 GCEnabled(gcenabled),
739 ARCEnabled(usesARC),
740 AF(BPAlloc), ScratchArgs(AF.getEmptyMap()),
741 ObjCAllocRetE(gcenabled
742 ? RetEffect::MakeGCNotOwned()
743 : (usesARC ? RetEffect::MakeARCNotOwned()
744 : RetEffect::MakeOwned(RetEffect::ObjC, true))),
745 ObjCInitRetE(gcenabled
746 ? RetEffect::MakeGCNotOwned()
747 : (usesARC ? RetEffect::MakeARCNotOwned()
Jordy Roseef945882012-03-18 01:26:10 +0000748 : RetEffect::MakeOwnedWhenTrackedReceiver())) {
Ted Kremenek553cf182008-06-25 21:21:56 +0000749 InitializeClassMethodSummaries();
750 InitializeMethodSummaries();
751 }
Mike Stump1eb44332009-09-09 15:08:12 +0000752
Jordan Rose4531b7d2012-07-02 19:27:43 +0000753 const RetainSummary *getSummary(const CallEvent &Call,
754 ProgramStateRef State = 0);
Mike Stump1eb44332009-09-09 15:08:12 +0000755
Jordan Rose4531b7d2012-07-02 19:27:43 +0000756 const RetainSummary *getFunctionSummary(const FunctionDecl *FD);
757
758 const RetainSummary *getMethodSummary(Selector S, const ObjCInterfaceDecl *ID,
Jordy Rosef3aae582012-03-17 21:13:07 +0000759 const ObjCMethodDecl *MD,
760 QualType RetTy,
761 ObjCMethodSummariesTy &CachedSummaries);
762
Jordan Rosecde8cdb2012-07-02 19:27:56 +0000763 const RetainSummary *getInstanceMethodSummary(const ObjCMethodCall &M,
Jordan Rose4531b7d2012-07-02 19:27:43 +0000764 ProgramStateRef State);
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000765
Jordan Rosecde8cdb2012-07-02 19:27:56 +0000766 const RetainSummary *getClassMethodSummary(const ObjCMethodCall &M) {
Jordan Rose4531b7d2012-07-02 19:27:43 +0000767 assert(!M.isInstanceMessage());
768 const ObjCInterfaceDecl *Class = M.getReceiverInterface();
Mike Stump1eb44332009-09-09 15:08:12 +0000769
Jordan Rose4531b7d2012-07-02 19:27:43 +0000770 return getMethodSummary(M.getSelector(), Class, M.getDecl(),
771 M.getResultType(), ObjCClassMethodSummaries);
Ted Kremenekfcd7c6f2009-04-29 00:42:39 +0000772 }
Ted Kremenek552333c2009-04-29 17:17:48 +0000773
774 /// getMethodSummary - This version of getMethodSummary is used to query
775 /// the summary for the current method being analyzed.
Ted Kremenek93edbc52011-10-05 23:54:29 +0000776 const RetainSummary *getMethodSummary(const ObjCMethodDecl *MD) {
Ted Kremeneka8833552009-04-29 23:03:22 +0000777 const ObjCInterfaceDecl *ID = MD->getClassInterface();
Ted Kremenek70a65762009-04-30 05:41:14 +0000778 Selector S = MD->getSelector();
Ted Kremenek552333c2009-04-29 17:17:48 +0000779 QualType ResultTy = MD->getResultType();
Mike Stump1eb44332009-09-09 15:08:12 +0000780
Jordy Rosef3aae582012-03-17 21:13:07 +0000781 ObjCMethodSummariesTy *CachedSummaries;
Ted Kremenek552333c2009-04-29 17:17:48 +0000782 if (MD->isInstanceMethod())
Jordy Rosef3aae582012-03-17 21:13:07 +0000783 CachedSummaries = &ObjCMethodSummaries;
Ted Kremenek552333c2009-04-29 17:17:48 +0000784 else
Jordy Rosef3aae582012-03-17 21:13:07 +0000785 CachedSummaries = &ObjCClassMethodSummaries;
786
Jordan Rose4531b7d2012-07-02 19:27:43 +0000787 return getMethodSummary(S, ID, MD, ResultTy, *CachedSummaries);
Ted Kremenek552333c2009-04-29 17:17:48 +0000788 }
Mike Stump1eb44332009-09-09 15:08:12 +0000789
Jordy Rosef3aae582012-03-17 21:13:07 +0000790 const RetainSummary *getStandardMethodSummary(const ObjCMethodDecl *MD,
Jordan Rose4531b7d2012-07-02 19:27:43 +0000791 Selector S, QualType RetTy);
Ted Kremeneka8833552009-04-29 23:03:22 +0000792
Ted Kremenek93edbc52011-10-05 23:54:29 +0000793 void updateSummaryFromAnnotations(const RetainSummary *&Summ,
Ted Kremenek4dd8fb42009-05-09 02:58:13 +0000794 const ObjCMethodDecl *MD);
795
Ted Kremenek93edbc52011-10-05 23:54:29 +0000796 void updateSummaryFromAnnotations(const RetainSummary *&Summ,
Ted Kremenek4dd8fb42009-05-09 02:58:13 +0000797 const FunctionDecl *FD);
798
Jordan Rose4531b7d2012-07-02 19:27:43 +0000799 void updateSummaryForCall(const RetainSummary *&Summ,
800 const CallEvent &Call);
801
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000802 bool isGCEnabled() const { return GCEnabled; }
Mike Stump1eb44332009-09-09 15:08:12 +0000803
John McCallf85e1932011-06-15 23:02:42 +0000804 bool isARCEnabled() const { return ARCEnabled; }
805
806 bool isARCorGCEnabled() const { return GCEnabled || ARCEnabled; }
Jordan Rose4531b7d2012-07-02 19:27:43 +0000807
808 RetEffect getObjAllocRetEffect() const { return ObjCAllocRetE; }
809
810 friend class RetainSummaryTemplate;
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000811};
Mike Stump1eb44332009-09-09 15:08:12 +0000812
Jordy Rose0fe62f82011-08-24 09:02:37 +0000813// Used to avoid allocating long-term (BPAlloc'd) memory for default retain
814// summaries. If a function or method looks like it has a default summary, but
815// it has annotations, the annotations are added to the stack-based template
816// and then copied into managed memory.
817class RetainSummaryTemplate {
818 RetainSummaryManager &Manager;
Ted Kremenek93edbc52011-10-05 23:54:29 +0000819 const RetainSummary *&RealSummary;
Jordy Rose0fe62f82011-08-24 09:02:37 +0000820 RetainSummary ScratchSummary;
821 bool Accessed;
822public:
Jordan Rose4531b7d2012-07-02 19:27:43 +0000823 RetainSummaryTemplate(const RetainSummary *&real, RetainSummaryManager &mgr)
824 : Manager(mgr), RealSummary(real), ScratchSummary(*real), Accessed(false) {}
Jordy Rose0fe62f82011-08-24 09:02:37 +0000825
826 ~RetainSummaryTemplate() {
Ted Kremenek93edbc52011-10-05 23:54:29 +0000827 if (Accessed)
Jordy Roseef945882012-03-18 01:26:10 +0000828 RealSummary = Manager.getPersistentSummary(ScratchSummary);
Jordy Rose0fe62f82011-08-24 09:02:37 +0000829 }
830
831 RetainSummary &operator*() {
832 Accessed = true;
Ted Kremenek93edbc52011-10-05 23:54:29 +0000833 return ScratchSummary;
Jordy Rose0fe62f82011-08-24 09:02:37 +0000834 }
835
836 RetainSummary *operator->() {
837 Accessed = true;
Ted Kremenek93edbc52011-10-05 23:54:29 +0000838 return &ScratchSummary;
Jordy Rose0fe62f82011-08-24 09:02:37 +0000839 }
840};
841
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000842} // end anonymous namespace
843
844//===----------------------------------------------------------------------===//
845// Implementation of checker data structures.
846//===----------------------------------------------------------------------===//
847
Ted Kremenekb77449c2009-05-03 05:20:50 +0000848ArgEffects RetainSummaryManager::getArgEffects() {
849 ArgEffects AE = ScratchArgs;
Ted Kremenek3baf6722010-11-24 00:54:37 +0000850 ScratchArgs = AF.getEmptyMap();
Ted Kremenekb77449c2009-05-03 05:20:50 +0000851 return AE;
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000852}
853
Ted Kremenek93edbc52011-10-05 23:54:29 +0000854const RetainSummary *
Jordy Roseef945882012-03-18 01:26:10 +0000855RetainSummaryManager::getPersistentSummary(const RetainSummary &OldSumm) {
856 // Unique "simple" summaries -- those without ArgEffects.
857 if (OldSumm.isSimple()) {
858 llvm::FoldingSetNodeID ID;
859 OldSumm.Profile(ID);
860
861 void *Pos;
862 CachedSummaryNode *N = SimpleSummaries.FindNodeOrInsertPos(ID, Pos);
863
864 if (!N) {
865 N = (CachedSummaryNode *) BPAlloc.Allocate<CachedSummaryNode>();
866 new (N) CachedSummaryNode(OldSumm);
867 SimpleSummaries.InsertNode(N, Pos);
868 }
869
870 return &N->getValue();
871 }
872
Ted Kremenek93edbc52011-10-05 23:54:29 +0000873 RetainSummary *Summ = (RetainSummary *) BPAlloc.Allocate<RetainSummary>();
Jordy Roseef945882012-03-18 01:26:10 +0000874 new (Summ) RetainSummary(OldSumm);
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000875 return Summ;
876}
877
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000878//===----------------------------------------------------------------------===//
879// Summary creation for functions (largely uses of Core Foundation).
880//===----------------------------------------------------------------------===//
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000881
Ted Kremenek9c378f72011-08-12 23:37:29 +0000882static bool isRetain(const FunctionDecl *FD, StringRef FName) {
Benjamin Kramerb6f3c702010-02-08 18:38:55 +0000883 return FName.endswith("Retain");
Ted Kremenek12619382009-01-12 21:45:02 +0000884}
885
Ted Kremenek9c378f72011-08-12 23:37:29 +0000886static bool isRelease(const FunctionDecl *FD, StringRef FName) {
Benjamin Kramerb6f3c702010-02-08 18:38:55 +0000887 return FName.endswith("Release");
Ted Kremenek12619382009-01-12 21:45:02 +0000888}
889
Jordy Rose76c506f2011-08-21 21:58:18 +0000890static bool isMakeCollectable(const FunctionDecl *FD, StringRef FName) {
891 // FIXME: Remove FunctionDecl parameter.
892 // FIXME: Is it really okay if MakeCollectable isn't a suffix?
893 return FName.find("MakeCollectable") != StringRef::npos;
894}
895
Jordan Rose4531b7d2012-07-02 19:27:43 +0000896static ArgEffect getStopTrackingEquivalent(ArgEffect E) {
897 switch (E) {
898 case DoNothing:
899 case Autorelease:
900 case DecRefBridgedTransfered:
901 case IncRef:
902 case IncRefMsg:
903 case MakeCollectable:
904 case MayEscape:
905 case NewAutoreleasePool:
906 case StopTracking:
907 return StopTracking;
908 case DecRef:
909 case DecRefAndStopTracking:
910 return DecRefAndStopTracking;
911 case DecRefMsg:
912 case DecRefMsgAndStopTracking:
913 return DecRefMsgAndStopTracking;
914 case Dealloc:
915 return Dealloc;
916 }
917
918 llvm_unreachable("Unknown ArgEffect kind");
919}
920
921void RetainSummaryManager::updateSummaryForCall(const RetainSummary *&S,
922 const CallEvent &Call) {
923 if (Call.hasNonZeroCallbackArg()) {
924 ArgEffect RecEffect = getStopTrackingEquivalent(S->getReceiverEffect());
925 ArgEffect DefEffect = getStopTrackingEquivalent(S->getDefaultArgEffect());
926
927 ArgEffects CustomArgEffects = S->getArgEffects();
928 for (ArgEffects::iterator I = CustomArgEffects.begin(),
929 E = CustomArgEffects.end();
930 I != E; ++I) {
931 ArgEffect Translated = getStopTrackingEquivalent(I->second);
932 if (Translated != DefEffect)
933 ScratchArgs = AF.add(ScratchArgs, I->first, Translated);
934 }
935
936 RetEffect RE = RetEffect::MakeNoRet();
937
938 // Special cases where the callback argument CANNOT free the return value.
939 // This can generally only happen if we know that the callback will only be
940 // called when the return value is already being deallocated.
941 if (const FunctionCall *FC = dyn_cast<FunctionCall>(&Call)) {
942 IdentifierInfo *Name = FC->getDecl()->getIdentifier();
943
944 // This callback frees the associated buffer.
945 if (Name->isStr("CGBitmapContextCreateWithData"))
946 RE = S->getRetEffect();
947 }
948
949 S = getPersistentSummary(RE, RecEffect, DefEffect);
950 }
951}
952
Anna Zaks58822c42012-05-04 22:18:39 +0000953const RetainSummary *
Jordan Rose4531b7d2012-07-02 19:27:43 +0000954RetainSummaryManager::getSummary(const CallEvent &Call,
955 ProgramStateRef State) {
956 const RetainSummary *Summ;
957 switch (Call.getKind()) {
958 case CE_Function:
959 Summ = getFunctionSummary(cast<FunctionCall>(Call).getDecl());
960 break;
961 case CE_CXXMember:
Jordan Rosefdaa3382012-07-03 22:55:57 +0000962 case CE_CXXMemberOperator:
Jordan Rose4531b7d2012-07-02 19:27:43 +0000963 case CE_Block:
964 case CE_CXXConstructor:
Jordan Rose8d276d32012-07-10 22:07:47 +0000965 case CE_CXXDestructor:
Jordan Rose70cbf3c2012-07-02 22:21:47 +0000966 case CE_CXXAllocator:
Jordan Rose4531b7d2012-07-02 19:27:43 +0000967 // FIXME: These calls are currently unsupported.
968 return getPersistentStopSummary();
Jordan Rose8919e682012-07-18 21:59:51 +0000969 case CE_ObjCMessage: {
Jordan Rosecde8cdb2012-07-02 19:27:56 +0000970 const ObjCMethodCall &Msg = cast<ObjCMethodCall>(Call);
Jordan Rose4531b7d2012-07-02 19:27:43 +0000971 if (Msg.isInstanceMessage())
972 Summ = getInstanceMethodSummary(Msg, State);
973 else
974 Summ = getClassMethodSummary(Msg);
975 break;
976 }
977 }
978
979 updateSummaryForCall(Summ, Call);
980
981 assert(Summ && "Unknown call type?");
982 return Summ;
983}
984
985const RetainSummary *
986RetainSummaryManager::getFunctionSummary(const FunctionDecl *FD) {
987 // If we don't know what function we're calling, use our default summary.
988 if (!FD)
989 return getDefaultSummary();
990
Ted Kremenek891d5cc2008-04-24 17:22:33 +0000991 // Look up a summary in our cache of FunctionDecls -> Summaries.
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000992 FuncSummariesTy::iterator I = FuncSummaries.find(FD);
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000993 if (I != FuncSummaries.end())
Ted Kremenek891d5cc2008-04-24 17:22:33 +0000994 return I->second;
995
Ted Kremeneke401a0c2009-05-04 15:34:07 +0000996 // No summary? Generate one.
Ted Kremenek93edbc52011-10-05 23:54:29 +0000997 const RetainSummary *S = 0;
Jordan Rose15d18e12012-08-06 21:28:02 +0000998 bool AllowAnnotations = true;
Mike Stump1eb44332009-09-09 15:08:12 +0000999
Ted Kremenek37d785b2008-07-15 16:50:12 +00001000 do {
Ted Kremenek12619382009-01-12 21:45:02 +00001001 // We generate "stop" summaries for implicitly defined functions.
1002 if (FD->isImplicit()) {
1003 S = getPersistentStopSummary();
1004 break;
Ted Kremenek37d785b2008-07-15 16:50:12 +00001005 }
Mike Stump1eb44332009-09-09 15:08:12 +00001006
John McCall183700f2009-09-21 23:43:11 +00001007 // [PR 3337] Use 'getAs<FunctionType>' to strip away any typedefs on the
Ted Kremenek99890652009-01-16 18:40:33 +00001008 // function's type.
John McCall183700f2009-09-21 23:43:11 +00001009 const FunctionType* FT = FD->getType()->getAs<FunctionType>();
Ted Kremenek48c6d182009-12-16 06:06:43 +00001010 const IdentifierInfo *II = FD->getIdentifier();
1011 if (!II)
1012 break;
Benjamin Kramerb6f3c702010-02-08 18:38:55 +00001013
1014 StringRef FName = II->getName();
Mike Stump1eb44332009-09-09 15:08:12 +00001015
Ted Kremenekbf0a4dd2009-03-05 22:11:14 +00001016 // Strip away preceding '_'. Doing this here will effect all the checks
1017 // down below.
Benjamin Kramerb6f3c702010-02-08 18:38:55 +00001018 FName = FName.substr(FName.find_first_not_of('_'));
Mike Stump1eb44332009-09-09 15:08:12 +00001019
Ted Kremenek12619382009-01-12 21:45:02 +00001020 // Inspect the result type.
1021 QualType RetTy = FT->getResultType();
Mike Stump1eb44332009-09-09 15:08:12 +00001022
Ted Kremenek12619382009-01-12 21:45:02 +00001023 // FIXME: This should all be refactored into a chain of "summary lookup"
1024 // filters.
Ted Kremenek008636a2009-10-14 00:27:24 +00001025 assert(ScratchArgs.isEmpty());
Ted Kremenek39d88b02009-06-15 20:36:07 +00001026
Ted Kremenekbefc6d22012-04-26 04:32:23 +00001027 if (FName == "pthread_create" || FName == "pthread_setspecific") {
1028 // Part of: <rdar://problem/7299394> and <rdar://problem/11282706>.
1029 // This will be addressed better with IPA.
Benjamin Kramerb6f3c702010-02-08 18:38:55 +00001030 S = getPersistentStopSummary();
1031 } else if (FName == "NSMakeCollectable") {
1032 // Handle: id NSMakeCollectable(CFTypeRef)
1033 S = (RetTy->isObjCIdType())
1034 ? getUnarySummary(FT, cfmakecollectable)
1035 : getPersistentStopSummary();
Jordan Rose15d18e12012-08-06 21:28:02 +00001036 // The headers on OS X 10.8 use cf_consumed/ns_returns_retained,
1037 // but we can fully model NSMakeCollectable ourselves.
1038 AllowAnnotations = false;
Benjamin Kramerb6f3c702010-02-08 18:38:55 +00001039 } else if (FName == "IOBSDNameMatching" ||
1040 FName == "IOServiceMatching" ||
1041 FName == "IOServiceNameMatching" ||
Ted Kremenek537dd3a2012-05-01 05:28:27 +00001042 FName == "IORegistryEntrySearchCFProperty" ||
Benjamin Kramerb6f3c702010-02-08 18:38:55 +00001043 FName == "IORegistryEntryIDMatching" ||
1044 FName == "IOOpenFirmwarePathMatching") {
1045 // Part of <rdar://problem/6961230>. (IOKit)
1046 // This should be addressed using a API table.
1047 S = getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF, true),
1048 DoNothing, DoNothing);
1049 } else if (FName == "IOServiceGetMatchingService" ||
1050 FName == "IOServiceGetMatchingServices") {
1051 // FIXES: <rdar://problem/6326900>
1052 // This should be addressed using a API table. This strcmp is also
1053 // a little gross, but there is no need to super optimize here.
Ted Kremenek3baf6722010-11-24 00:54:37 +00001054 ScratchArgs = AF.add(ScratchArgs, 1, DecRef);
Benjamin Kramerb6f3c702010-02-08 18:38:55 +00001055 S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
1056 } else if (FName == "IOServiceAddNotification" ||
1057 FName == "IOServiceAddMatchingNotification") {
1058 // Part of <rdar://problem/6961230>. (IOKit)
1059 // This should be addressed using a API table.
Ted Kremenek3baf6722010-11-24 00:54:37 +00001060 ScratchArgs = AF.add(ScratchArgs, 2, DecRef);
Benjamin Kramerb6f3c702010-02-08 18:38:55 +00001061 S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
1062 } else if (FName == "CVPixelBufferCreateWithBytes") {
1063 // FIXES: <rdar://problem/7283567>
1064 // Eventually this can be improved by recognizing that the pixel
1065 // buffer passed to CVPixelBufferCreateWithBytes is released via
1066 // a callback and doing full IPA to make sure this is done correctly.
1067 // FIXME: This function has an out parameter that returns an
1068 // allocated object.
Ted Kremenek3baf6722010-11-24 00:54:37 +00001069 ScratchArgs = AF.add(ScratchArgs, 7, StopTracking);
Benjamin Kramerb6f3c702010-02-08 18:38:55 +00001070 S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
1071 } else if (FName == "CGBitmapContextCreateWithData") {
1072 // FIXES: <rdar://problem/7358899>
1073 // Eventually this can be improved by recognizing that 'releaseInfo'
1074 // passed to CGBitmapContextCreateWithData is released via
1075 // a callback and doing full IPA to make sure this is done correctly.
Ted Kremenek3baf6722010-11-24 00:54:37 +00001076 ScratchArgs = AF.add(ScratchArgs, 8, StopTracking);
Benjamin Kramerb6f3c702010-02-08 18:38:55 +00001077 S = getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF, true),
1078 DoNothing, DoNothing);
1079 } else if (FName == "CVPixelBufferCreateWithPlanarBytes") {
1080 // FIXES: <rdar://problem/7283567>
1081 // Eventually this can be improved by recognizing that the pixel
1082 // buffer passed to CVPixelBufferCreateWithPlanarBytes is released
1083 // via a callback and doing full IPA to make sure this is done
1084 // correctly.
Ted Kremenek3baf6722010-11-24 00:54:37 +00001085 ScratchArgs = AF.add(ScratchArgs, 12, StopTracking);
Benjamin Kramerb6f3c702010-02-08 18:38:55 +00001086 S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
Ted Kremenek06911d42012-03-22 06:29:41 +00001087 } else if (FName == "dispatch_set_context") {
1088 // <rdar://problem/11059275> - The analyzer currently doesn't have
1089 // a good way to reason about the finalizer function for libdispatch.
1090 // If we pass a context object that is memory managed, stop tracking it.
1091 // FIXME: this hack should possibly go away once we can handle
1092 // libdispatch finalizers.
1093 ScratchArgs = AF.add(ScratchArgs, 1, StopTracking);
1094 S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
Ted Kremenekc91fdf62012-05-08 00:12:09 +00001095 } else if (FName.startswith("NSLog")) {
1096 S = getDoNothingSummary();
Anna Zaks62a5c342012-03-30 05:48:16 +00001097 } else if (FName.startswith("NS") &&
1098 (FName.find("Insert") != StringRef::npos)) {
1099 // Whitelist NSXXInsertXX, for example NSMapInsertIfAbsent, since they can
1100 // be deallocated by NSMapRemove. (radar://11152419)
1101 ScratchArgs = AF.add(ScratchArgs, 1, StopTracking);
1102 ScratchArgs = AF.add(ScratchArgs, 2, StopTracking);
1103 S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
Ted Kremenekb04cb592009-06-11 18:17:24 +00001104 }
Mike Stump1eb44332009-09-09 15:08:12 +00001105
Ted Kremenekb04cb592009-06-11 18:17:24 +00001106 // Did we get a summary?
1107 if (S)
1108 break;
Ted Kremenek61991902009-03-17 22:43:44 +00001109
1110 // Enable this code once the semantics of NSDeallocateObject are resolved
1111 // for GC. <rdar://problem/6619988>
1112#if 0
1113 // Handle: NSDeallocateObject(id anObject);
1114 // This method does allow 'nil' (although we don't check it now).
Mike Stump1eb44332009-09-09 15:08:12 +00001115 if (strcmp(FName, "NSDeallocateObject") == 0) {
Ted Kremenek61991902009-03-17 22:43:44 +00001116 return RetTy == Ctx.VoidTy
1117 ? getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, Dealloc)
1118 : getPersistentStopSummary();
1119 }
1120#endif
Ted Kremenek12619382009-01-12 21:45:02 +00001121
1122 if (RetTy->isPointerType()) {
1123 // For CoreFoundation ('CF') types.
Ted Kremenek78acdbf2010-01-27 18:00:17 +00001124 if (cocoa::isRefType(RetTy, "CF", FName)) {
Ted Kremenek12619382009-01-12 21:45:02 +00001125 if (isRetain(FD, FName))
1126 S = getUnarySummary(FT, cfretain);
Jordy Rose76c506f2011-08-21 21:58:18 +00001127 else if (isMakeCollectable(FD, FName))
Ted Kremenek12619382009-01-12 21:45:02 +00001128 S = getUnarySummary(FT, cfmakecollectable);
Mike Stump1eb44332009-09-09 15:08:12 +00001129 else
John McCall7df2ff42011-10-01 00:48:56 +00001130 S = getCFCreateGetRuleSummary(FD);
Ted Kremenek12619382009-01-12 21:45:02 +00001131
1132 break;
1133 }
1134
1135 // For CoreGraphics ('CG') types.
Ted Kremenek78acdbf2010-01-27 18:00:17 +00001136 if (cocoa::isRefType(RetTy, "CG", FName)) {
Ted Kremenek12619382009-01-12 21:45:02 +00001137 if (isRetain(FD, FName))
1138 S = getUnarySummary(FT, cfretain);
1139 else
John McCall7df2ff42011-10-01 00:48:56 +00001140 S = getCFCreateGetRuleSummary(FD);
Ted Kremenek12619382009-01-12 21:45:02 +00001141
1142 break;
1143 }
1144
1145 // For the Disk Arbitration API (DiskArbitration/DADisk.h)
Ted Kremenek78acdbf2010-01-27 18:00:17 +00001146 if (cocoa::isRefType(RetTy, "DADisk") ||
1147 cocoa::isRefType(RetTy, "DADissenter") ||
1148 cocoa::isRefType(RetTy, "DASessionRef")) {
John McCall7df2ff42011-10-01 00:48:56 +00001149 S = getCFCreateGetRuleSummary(FD);
Ted Kremenek12619382009-01-12 21:45:02 +00001150 break;
1151 }
Mike Stump1eb44332009-09-09 15:08:12 +00001152
Ted Kremenek12619382009-01-12 21:45:02 +00001153 break;
1154 }
1155
1156 // Check for release functions, the only kind of functions that we care
1157 // about that don't return a pointer type.
1158 if (FName[0] == 'C' && (FName[1] == 'F' || FName[1] == 'G')) {
Ted Kremeneke7d03122010-02-08 16:45:01 +00001159 // Test for 'CGCF'.
Benjamin Kramerb6f3c702010-02-08 18:38:55 +00001160 FName = FName.substr(FName.startswith("CGCF") ? 4 : 2);
Ted Kremeneke7d03122010-02-08 16:45:01 +00001161
Ted Kremenekbf0a4dd2009-03-05 22:11:14 +00001162 if (isRelease(FD, FName))
Ted Kremenek12619382009-01-12 21:45:02 +00001163 S = getUnarySummary(FT, cfrelease);
1164 else {
Ted Kremenekb77449c2009-05-03 05:20:50 +00001165 assert (ScratchArgs.isEmpty());
Ted Kremenek68189282009-01-29 22:45:13 +00001166 // Remaining CoreFoundation and CoreGraphics functions.
1167 // We use to assume that they all strictly followed the ownership idiom
1168 // and that ownership cannot be transferred. While this is technically
1169 // correct, many methods allow a tracked object to escape. For example:
1170 //
Mike Stump1eb44332009-09-09 15:08:12 +00001171 // CFMutableDictionaryRef x = CFDictionaryCreateMutable(...);
Ted Kremenek68189282009-01-29 22:45:13 +00001172 // CFDictionaryAddValue(y, key, x);
Mike Stump1eb44332009-09-09 15:08:12 +00001173 // CFRelease(x);
Ted Kremenek68189282009-01-29 22:45:13 +00001174 // ... it is okay to use 'x' since 'y' has a reference to it
1175 //
1176 // We handle this and similar cases with the follow heuristic. If the
Ted Kremenekc4843812009-08-20 00:57:22 +00001177 // function name contains "InsertValue", "SetValue", "AddValue",
1178 // "AppendValue", or "SetAttribute", then we assume that arguments may
1179 // "escape." This means that something else holds on to the object,
1180 // allowing it be used even after its local retain count drops to 0.
Benjamin Kramere45c1492010-01-11 19:46:28 +00001181 ArgEffect E = (StrInStrNoCase(FName, "InsertValue") != StringRef::npos||
1182 StrInStrNoCase(FName, "AddValue") != StringRef::npos ||
1183 StrInStrNoCase(FName, "SetValue") != StringRef::npos ||
1184 StrInStrNoCase(FName, "AppendValue") != StringRef::npos||
Benjamin Kramerc027e542010-01-11 20:15:06 +00001185 StrInStrNoCase(FName, "SetAttribute") != StringRef::npos)
Ted Kremenek68189282009-01-29 22:45:13 +00001186 ? MayEscape : DoNothing;
Mike Stump1eb44332009-09-09 15:08:12 +00001187
Ted Kremenek68189282009-01-29 22:45:13 +00001188 S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, E);
Ted Kremenek12619382009-01-12 21:45:02 +00001189 }
1190 }
Ted Kremenek37d785b2008-07-15 16:50:12 +00001191 }
1192 while (0);
Mike Stump1eb44332009-09-09 15:08:12 +00001193
Jordan Rose4531b7d2012-07-02 19:27:43 +00001194 // If we got all the way here without any luck, use a default summary.
1195 if (!S)
1196 S = getDefaultSummary();
1197
Ted Kremenek4dd8fb42009-05-09 02:58:13 +00001198 // Annotations override defaults.
Jordan Rose15d18e12012-08-06 21:28:02 +00001199 if (AllowAnnotations)
1200 updateSummaryFromAnnotations(S, FD);
Mike Stump1eb44332009-09-09 15:08:12 +00001201
Ted Kremenekd3dbcf42008-05-05 22:11:16 +00001202 FuncSummaries[FD] = S;
Mike Stump1eb44332009-09-09 15:08:12 +00001203 return S;
Ted Kremenek2fff37e2008-03-06 00:08:09 +00001204}
1205
Ted Kremenek93edbc52011-10-05 23:54:29 +00001206const RetainSummary *
John McCall7df2ff42011-10-01 00:48:56 +00001207RetainSummaryManager::getCFCreateGetRuleSummary(const FunctionDecl *FD) {
1208 if (coreFoundation::followsCreateRule(FD))
Ted Kremenek86ad3bc2008-05-05 16:51:50 +00001209 return getCFSummaryCreateRule(FD);
Mike Stump1eb44332009-09-09 15:08:12 +00001210
Ted Kremenekd368d712011-05-25 06:19:45 +00001211 return getCFSummaryGetRule(FD);
Ted Kremenek86ad3bc2008-05-05 16:51:50 +00001212}
1213
Ted Kremenek93edbc52011-10-05 23:54:29 +00001214const RetainSummary *
Ted Kremenek6ad315a2009-02-23 16:51:39 +00001215RetainSummaryManager::getUnarySummary(const FunctionType* FT,
1216 UnaryFuncKind func) {
1217
Ted Kremenek12619382009-01-12 21:45:02 +00001218 // Sanity check that this is *really* a unary function. This can
1219 // happen if people do weird things.
Douglas Gregor72564e72009-02-26 23:50:07 +00001220 const FunctionProtoType* FTP = dyn_cast<FunctionProtoType>(FT);
Ted Kremenek12619382009-01-12 21:45:02 +00001221 if (!FTP || FTP->getNumArgs() != 1)
1222 return getPersistentStopSummary();
Mike Stump1eb44332009-09-09 15:08:12 +00001223
Ted Kremenekb77449c2009-05-03 05:20:50 +00001224 assert (ScratchArgs.isEmpty());
Mike Stump1eb44332009-09-09 15:08:12 +00001225
Jordy Rose76c506f2011-08-21 21:58:18 +00001226 ArgEffect Effect;
Ted Kremenek377e2302008-04-29 05:33:51 +00001227 switch (func) {
Jordy Rose76c506f2011-08-21 21:58:18 +00001228 case cfretain: Effect = IncRef; break;
1229 case cfrelease: Effect = DecRef; break;
1230 case cfmakecollectable: Effect = MakeCollectable; break;
Ted Kremenek940b1d82008-04-10 23:44:06 +00001231 }
Jordy Rose76c506f2011-08-21 21:58:18 +00001232
1233 ScratchArgs = AF.add(ScratchArgs, 0, Effect);
1234 return getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
Ted Kremenek00a3a5f2008-03-12 01:21:45 +00001235}
1236
Ted Kremenek93edbc52011-10-05 23:54:29 +00001237const RetainSummary *
Ted Kremenek9c378f72011-08-12 23:37:29 +00001238RetainSummaryManager::getCFSummaryCreateRule(const FunctionDecl *FD) {
Ted Kremenekb77449c2009-05-03 05:20:50 +00001239 assert (ScratchArgs.isEmpty());
Mike Stump1eb44332009-09-09 15:08:12 +00001240
Ted Kremenek2d1652e2009-01-28 05:56:51 +00001241 return getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF, true));
Ted Kremenek00a3a5f2008-03-12 01:21:45 +00001242}
1243
Ted Kremenek93edbc52011-10-05 23:54:29 +00001244const RetainSummary *
Ted Kremenek9c378f72011-08-12 23:37:29 +00001245RetainSummaryManager::getCFSummaryGetRule(const FunctionDecl *FD) {
Mike Stump1eb44332009-09-09 15:08:12 +00001246 assert (ScratchArgs.isEmpty());
Ted Kremenek2d1652e2009-01-28 05:56:51 +00001247 return getPersistentSummary(RetEffect::MakeNotOwned(RetEffect::CF),
1248 DoNothing, DoNothing);
Ted Kremenek00a3a5f2008-03-12 01:21:45 +00001249}
1250
Ted Kremenek6b3a0f72008-03-11 06:39:11 +00001251//===----------------------------------------------------------------------===//
Ted Kremenekd3dbcf42008-05-05 22:11:16 +00001252// Summary creation for Selectors.
1253//===----------------------------------------------------------------------===//
1254
Ted Kremenek4dd8fb42009-05-09 02:58:13 +00001255void
Ted Kremenek93edbc52011-10-05 23:54:29 +00001256RetainSummaryManager::updateSummaryFromAnnotations(const RetainSummary *&Summ,
Ted Kremenek4dd8fb42009-05-09 02:58:13 +00001257 const FunctionDecl *FD) {
1258 if (!FD)
1259 return;
1260
Jordan Rose4531b7d2012-07-02 19:27:43 +00001261 assert(Summ && "Must have a summary to add annotations to.");
1262 RetainSummaryTemplate Template(Summ, *this);
Jordy Rose4df54fe2011-08-23 04:27:15 +00001263
Ted Kremenek11fe1752011-01-27 18:43:03 +00001264 // Effects on the parameters.
1265 unsigned parm_idx = 0;
1266 for (FunctionDecl::param_const_iterator pi = FD->param_begin(),
John McCall98b8f162011-04-06 09:02:12 +00001267 pe = FD->param_end(); pi != pe; ++pi, ++parm_idx) {
Ted Kremenek11fe1752011-01-27 18:43:03 +00001268 const ParmVarDecl *pd = *pi;
1269 if (pd->getAttr<NSConsumedAttr>()) {
Jordy Rose4df54fe2011-08-23 04:27:15 +00001270 if (!GCEnabled) {
Jordy Rose0fe62f82011-08-24 09:02:37 +00001271 Template->addArg(AF, parm_idx, DecRef);
Jordy Rose4df54fe2011-08-23 04:27:15 +00001272 }
1273 } else if (pd->getAttr<CFConsumedAttr>()) {
Jordy Rose0fe62f82011-08-24 09:02:37 +00001274 Template->addArg(AF, parm_idx, DecRef);
Ted Kremenek11fe1752011-01-27 18:43:03 +00001275 }
1276 }
1277
Ted Kremenekb04cb592009-06-11 18:17:24 +00001278 QualType RetTy = FD->getResultType();
Mike Stump1eb44332009-09-09 15:08:12 +00001279
Ted Kremenek4dd8fb42009-05-09 02:58:13 +00001280 // Determine if there is a special return effect for this method.
Ted Kremenek78acdbf2010-01-27 18:00:17 +00001281 if (cocoa::isCocoaObjectRef(RetTy)) {
Argyrios Kyrtzidis40b598e2009-06-30 02:34:44 +00001282 if (FD->getAttr<NSReturnsRetainedAttr>()) {
Jordy Rose0fe62f82011-08-24 09:02:37 +00001283 Template->setRetEffect(ObjCAllocRetE);
Ted Kremenek4dd8fb42009-05-09 02:58:13 +00001284 }
Argyrios Kyrtzidis40b598e2009-06-30 02:34:44 +00001285 else if (FD->getAttr<CFReturnsRetainedAttr>()) {
Jordy Rose0fe62f82011-08-24 09:02:37 +00001286 Template->setRetEffect(RetEffect::MakeOwned(RetEffect::CF, true));
Ted Kremenekb04cb592009-06-11 18:17:24 +00001287 }
Ted Kremenek60411112010-02-18 00:06:12 +00001288 else if (FD->getAttr<NSReturnsNotRetainedAttr>()) {
Jordy Rose0fe62f82011-08-24 09:02:37 +00001289 Template->setRetEffect(RetEffect::MakeNotOwned(RetEffect::ObjC));
Ted Kremenek60411112010-02-18 00:06:12 +00001290 }
1291 else if (FD->getAttr<CFReturnsNotRetainedAttr>()) {
Jordy Rose0fe62f82011-08-24 09:02:37 +00001292 Template->setRetEffect(RetEffect::MakeNotOwned(RetEffect::CF));
Jordy Rose4df54fe2011-08-23 04:27:15 +00001293 }
1294 } else if (RetTy->getAs<PointerType>()) {
1295 if (FD->getAttr<CFReturnsRetainedAttr>()) {
Jordy Rose0fe62f82011-08-24 09:02:37 +00001296 Template->setRetEffect(RetEffect::MakeOwned(RetEffect::CF, true));
Jordy Rose4df54fe2011-08-23 04:27:15 +00001297 }
1298 else if (FD->getAttr<CFReturnsNotRetainedAttr>()) {
Jordy Rose0fe62f82011-08-24 09:02:37 +00001299 Template->setRetEffect(RetEffect::MakeNotOwned(RetEffect::CF));
Ted Kremenek60411112010-02-18 00:06:12 +00001300 }
Ted Kremenekb04cb592009-06-11 18:17:24 +00001301 }
Ted Kremenek4dd8fb42009-05-09 02:58:13 +00001302}
1303
1304void
Ted Kremenek93edbc52011-10-05 23:54:29 +00001305RetainSummaryManager::updateSummaryFromAnnotations(const RetainSummary *&Summ,
1306 const ObjCMethodDecl *MD) {
Ted Kremenek4dd8fb42009-05-09 02:58:13 +00001307 if (!MD)
1308 return;
1309
Jordan Rose4531b7d2012-07-02 19:27:43 +00001310 assert(Summ && "Must have a valid summary to add annotations to");
1311 RetainSummaryTemplate Template(Summ, *this);
Ted Kremenek6d4b76d2009-07-06 18:30:43 +00001312 bool isTrackedLoc = false;
Mike Stump1eb44332009-09-09 15:08:12 +00001313
Ted Kremenek12b94342011-01-27 06:54:14 +00001314 // Effects on the receiver.
1315 if (MD->getAttr<NSConsumesSelfAttr>()) {
Ted Kremenek11fe1752011-01-27 18:43:03 +00001316 if (!GCEnabled)
Jordy Rose0fe62f82011-08-24 09:02:37 +00001317 Template->setReceiverEffect(DecRefMsg);
Ted Kremenek11fe1752011-01-27 18:43:03 +00001318 }
1319
1320 // Effects on the parameters.
1321 unsigned parm_idx = 0;
Argyrios Kyrtzidis491306a2011-10-03 06:37:04 +00001322 for (ObjCMethodDecl::param_const_iterator
1323 pi=MD->param_begin(), pe=MD->param_end();
Ted Kremenek11fe1752011-01-27 18:43:03 +00001324 pi != pe; ++pi, ++parm_idx) {
1325 const ParmVarDecl *pd = *pi;
1326 if (pd->getAttr<NSConsumedAttr>()) {
1327 if (!GCEnabled)
Jordy Rose0fe62f82011-08-24 09:02:37 +00001328 Template->addArg(AF, parm_idx, DecRef);
Ted Kremenek11fe1752011-01-27 18:43:03 +00001329 }
1330 else if(pd->getAttr<CFConsumedAttr>()) {
Jordy Rose0fe62f82011-08-24 09:02:37 +00001331 Template->addArg(AF, parm_idx, DecRef);
Ted Kremenek11fe1752011-01-27 18:43:03 +00001332 }
Ted Kremenek12b94342011-01-27 06:54:14 +00001333 }
1334
Ted Kremenek4dd8fb42009-05-09 02:58:13 +00001335 // Determine if there is a special return effect for this method.
Ted Kremenek78acdbf2010-01-27 18:00:17 +00001336 if (cocoa::isCocoaObjectRef(MD->getResultType())) {
Argyrios Kyrtzidis40b598e2009-06-30 02:34:44 +00001337 if (MD->getAttr<NSReturnsRetainedAttr>()) {
Jordy Rose0fe62f82011-08-24 09:02:37 +00001338 Template->setRetEffect(ObjCAllocRetE);
Ted Kremenek6d4b76d2009-07-06 18:30:43 +00001339 return;
Ted Kremenek4dd8fb42009-05-09 02:58:13 +00001340 }
Ted Kremenek60411112010-02-18 00:06:12 +00001341 if (MD->getAttr<NSReturnsNotRetainedAttr>()) {
Jordy Rose0fe62f82011-08-24 09:02:37 +00001342 Template->setRetEffect(RetEffect::MakeNotOwned(RetEffect::ObjC));
Ted Kremenek60411112010-02-18 00:06:12 +00001343 return;
1344 }
Mike Stump1eb44332009-09-09 15:08:12 +00001345
Ted Kremenek6d4b76d2009-07-06 18:30:43 +00001346 isTrackedLoc = true;
Jordy Rose0fe62f82011-08-24 09:02:37 +00001347 } else {
Ted Kremenek6217b802009-07-29 21:53:49 +00001348 isTrackedLoc = MD->getResultType()->getAs<PointerType>() != NULL;
Jordy Rose0fe62f82011-08-24 09:02:37 +00001349 }
Mike Stump1eb44332009-09-09 15:08:12 +00001350
Ted Kremenek60411112010-02-18 00:06:12 +00001351 if (isTrackedLoc) {
1352 if (MD->getAttr<CFReturnsRetainedAttr>())
Jordy Rose0fe62f82011-08-24 09:02:37 +00001353 Template->setRetEffect(RetEffect::MakeOwned(RetEffect::CF, true));
Ted Kremenek60411112010-02-18 00:06:12 +00001354 else if (MD->getAttr<CFReturnsNotRetainedAttr>())
Jordy Rose0fe62f82011-08-24 09:02:37 +00001355 Template->setRetEffect(RetEffect::MakeNotOwned(RetEffect::CF));
Ted Kremenek60411112010-02-18 00:06:12 +00001356 }
Ted Kremenek4dd8fb42009-05-09 02:58:13 +00001357}
1358
Ted Kremenek93edbc52011-10-05 23:54:29 +00001359const RetainSummary *
Jordy Rosef3aae582012-03-17 21:13:07 +00001360RetainSummaryManager::getStandardMethodSummary(const ObjCMethodDecl *MD,
1361 Selector S, QualType RetTy) {
Ted Kremenek8ee885b2009-04-24 21:56:17 +00001362
Ted Kremenekfcd7c6f2009-04-29 00:42:39 +00001363 if (MD) {
Ted Kremenek376d1e72009-04-24 18:00:17 +00001364 // Scan the method decl for 'void*' arguments. These should be treated
1365 // as 'StopTracking' because they are often used with delegates.
1366 // Delegates are a frequent form of false positives with the retain
1367 // count checker.
1368 unsigned i = 0;
Argyrios Kyrtzidis491306a2011-10-03 06:37:04 +00001369 for (ObjCMethodDecl::param_const_iterator I = MD->param_begin(),
Ted Kremenek376d1e72009-04-24 18:00:17 +00001370 E = MD->param_end(); I != E; ++I, ++i)
Argyrios Kyrtzidis491306a2011-10-03 06:37:04 +00001371 if (const ParmVarDecl *PD = *I) {
Ted Kremenek376d1e72009-04-24 18:00:17 +00001372 QualType Ty = Ctx.getCanonicalType(PD->getType());
Douglas Gregora4923eb2009-11-16 21:35:15 +00001373 if (Ty.getLocalUnqualifiedType() == Ctx.VoidPtrTy)
Ted Kremenek3baf6722010-11-24 00:54:37 +00001374 ScratchArgs = AF.add(ScratchArgs, i, StopTracking);
Ted Kremenek376d1e72009-04-24 18:00:17 +00001375 }
1376 }
Mike Stump1eb44332009-09-09 15:08:12 +00001377
Jordy Rosee921b1a2012-03-17 19:53:04 +00001378 // Any special effects?
Ted Kremenek8ee885b2009-04-24 21:56:17 +00001379 ArgEffect ReceiverEff = DoNothing;
Jordy Rosee921b1a2012-03-17 19:53:04 +00001380 RetEffect ResultEff = RetEffect::MakeNoRet();
1381
1382 // Check the method family, and apply any default annotations.
1383 switch (MD ? MD->getMethodFamily() : S.getMethodFamily()) {
1384 case OMF_None:
1385 case OMF_performSelector:
1386 // Assume all Objective-C methods follow Cocoa Memory Management rules.
1387 // FIXME: Does the non-threaded performSelector family really belong here?
1388 // The selector could be, say, @selector(copy).
1389 if (cocoa::isCocoaObjectRef(RetTy))
1390 ResultEff = RetEffect::MakeNotOwned(RetEffect::ObjC);
1391 else if (coreFoundation::isCFObjectRef(RetTy)) {
1392 // ObjCMethodDecl currently doesn't consider CF objects as valid return
1393 // values for alloc, new, copy, or mutableCopy, so we have to
1394 // double-check with the selector. This is ugly, but there aren't that
1395 // many Objective-C methods that return CF objects, right?
1396 if (MD) {
1397 switch (S.getMethodFamily()) {
1398 case OMF_alloc:
1399 case OMF_new:
1400 case OMF_copy:
1401 case OMF_mutableCopy:
1402 ResultEff = RetEffect::MakeOwned(RetEffect::CF, true);
1403 break;
1404 default:
1405 ResultEff = RetEffect::MakeNotOwned(RetEffect::CF);
1406 break;
1407 }
1408 } else {
1409 ResultEff = RetEffect::MakeNotOwned(RetEffect::CF);
1410 }
1411 }
1412 break;
1413 case OMF_init:
1414 ResultEff = ObjCInitRetE;
1415 ReceiverEff = DecRefMsg;
1416 break;
1417 case OMF_alloc:
1418 case OMF_new:
1419 case OMF_copy:
1420 case OMF_mutableCopy:
1421 if (cocoa::isCocoaObjectRef(RetTy))
1422 ResultEff = ObjCAllocRetE;
1423 else if (coreFoundation::isCFObjectRef(RetTy))
1424 ResultEff = RetEffect::MakeOwned(RetEffect::CF, true);
1425 break;
1426 case OMF_autorelease:
1427 ReceiverEff = Autorelease;
1428 break;
1429 case OMF_retain:
1430 ReceiverEff = IncRefMsg;
1431 break;
1432 case OMF_release:
1433 ReceiverEff = DecRefMsg;
1434 break;
1435 case OMF_dealloc:
1436 ReceiverEff = Dealloc;
1437 break;
1438 case OMF_self:
1439 // -self is handled specially by the ExprEngine to propagate the receiver.
1440 break;
1441 case OMF_retainCount:
1442 case OMF_finalize:
1443 // These methods don't return objects.
1444 break;
1445 }
Mike Stump1eb44332009-09-09 15:08:12 +00001446
Ted Kremenek8ee885b2009-04-24 21:56:17 +00001447 // If one of the arguments in the selector has the keyword 'delegate' we
1448 // should stop tracking the reference count for the receiver. This is
1449 // because the reference count is quite possibly handled by a delegate
1450 // method.
1451 if (S.isKeywordSelector()) {
Jordan Rose50571a92012-06-15 18:19:52 +00001452 for (unsigned i = 0, e = S.getNumArgs(); i != e; ++i) {
1453 StringRef Slot = S.getNameForSlot(i);
1454 if (Slot.substr(Slot.size() - 8).equals_lower("delegate")) {
1455 if (ResultEff == ObjCInitRetE)
1456 ResultEff = RetEffect::MakeNoRet();
1457 else
1458 ReceiverEff = StopTracking;
1459 }
1460 }
Ted Kremenek8ee885b2009-04-24 21:56:17 +00001461 }
Mike Stump1eb44332009-09-09 15:08:12 +00001462
Jordy Rosee921b1a2012-03-17 19:53:04 +00001463 if (ScratchArgs.isEmpty() && ReceiverEff == DoNothing &&
1464 ResultEff.getKind() == RetEffect::NoRet)
Ted Kremenek93edbc52011-10-05 23:54:29 +00001465 return getDefaultSummary();
Mike Stump1eb44332009-09-09 15:08:12 +00001466
Jordy Rosee921b1a2012-03-17 19:53:04 +00001467 return getPersistentSummary(ResultEff, ReceiverEff, MayEscape);
Ted Kremenek250b1fa2009-04-23 23:08:22 +00001468}
1469
Ted Kremenek93edbc52011-10-05 23:54:29 +00001470const RetainSummary *
Jordan Rosecde8cdb2012-07-02 19:27:56 +00001471RetainSummaryManager::getInstanceMethodSummary(const ObjCMethodCall &Msg,
Jordan Rose4531b7d2012-07-02 19:27:43 +00001472 ProgramStateRef State) {
1473 const ObjCInterfaceDecl *ReceiverClass = 0;
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +00001474
Jordan Rose4531b7d2012-07-02 19:27:43 +00001475 // We do better tracking of the type of the object than the core ExprEngine.
1476 // See if we have its type in our private state.
1477 // FIXME: Eventually replace the use of state->get<RefBindings> with
1478 // a generic API for reasoning about the Objective-C types of symbolic
1479 // objects.
1480 SVal ReceiverV = Msg.getReceiverSVal();
1481 if (SymbolRef Sym = ReceiverV.getAsLocSymbol())
Anna Zaks8d6b43c2012-08-14 00:36:15 +00001482 if (const RefVal *T = getRefBinding(State, Sym))
Douglas Gregor04badcf2010-04-21 00:45:42 +00001483 if (const ObjCObjectPointerType *PT =
Jordan Rose4531b7d2012-07-02 19:27:43 +00001484 T->getType()->getAs<ObjCObjectPointerType>())
1485 ReceiverClass = PT->getInterfaceDecl();
1486
1487 // If we don't know what kind of object this is, fall back to its static type.
1488 if (!ReceiverClass)
1489 ReceiverClass = Msg.getReceiverInterface();
Douglas Gregor04badcf2010-04-21 00:45:42 +00001490
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +00001491 // FIXME: The receiver could be a reference to a class, meaning that
1492 // we should use the class method.
Jordan Rose4531b7d2012-07-02 19:27:43 +00001493 // id x = [NSObject class];
1494 // [x performSelector:... withObject:... afterDelay:...];
1495 Selector S = Msg.getSelector();
1496 const ObjCMethodDecl *Method = Msg.getDecl();
1497 if (!Method && ReceiverClass)
1498 Method = ReceiverClass->getInstanceMethod(S);
1499
1500 return getMethodSummary(S, ReceiverClass, Method, Msg.getResultType(),
1501 ObjCMethodSummaries);
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +00001502}
1503
Ted Kremenek93edbc52011-10-05 23:54:29 +00001504const RetainSummary *
Jordan Rose4531b7d2012-07-02 19:27:43 +00001505RetainSummaryManager::getMethodSummary(Selector S, const ObjCInterfaceDecl *ID,
Jordy Rosef3aae582012-03-17 21:13:07 +00001506 const ObjCMethodDecl *MD, QualType RetTy,
1507 ObjCMethodSummariesTy &CachedSummaries) {
Ted Kremenek1bffd742008-05-06 15:44:25 +00001508
Ted Kremenek8711c032009-04-29 05:04:30 +00001509 // Look up a summary in our summary cache.
Jordan Rose4531b7d2012-07-02 19:27:43 +00001510 const RetainSummary *Summ = CachedSummaries.find(ID, S);
Mike Stump1eb44332009-09-09 15:08:12 +00001511
Ted Kremenek614cc542009-07-21 23:27:57 +00001512 if (!Summ) {
Jordy Rosef3aae582012-03-17 21:13:07 +00001513 Summ = getStandardMethodSummary(MD, S, RetTy);
Mike Stump1eb44332009-09-09 15:08:12 +00001514
Ted Kremenek614cc542009-07-21 23:27:57 +00001515 // Annotations override defaults.
Jordy Rose4df54fe2011-08-23 04:27:15 +00001516 updateSummaryFromAnnotations(Summ, MD);
Mike Stump1eb44332009-09-09 15:08:12 +00001517
Ted Kremenek614cc542009-07-21 23:27:57 +00001518 // Memoize the summary.
Jordan Rose4531b7d2012-07-02 19:27:43 +00001519 CachedSummaries[ObjCSummaryKey(ID, S)] = Summ;
Ted Kremenek614cc542009-07-21 23:27:57 +00001520 }
Mike Stump1eb44332009-09-09 15:08:12 +00001521
Ted Kremeneke87450e2009-04-23 19:11:35 +00001522 return Summ;
Ted Kremenekc8395602008-05-06 21:26:51 +00001523}
1524
Mike Stump1eb44332009-09-09 15:08:12 +00001525void RetainSummaryManager::InitializeClassMethodSummaries() {
Ted Kremenekec315332009-05-07 23:40:42 +00001526 assert(ScratchArgs.isEmpty());
Mike Stump1eb44332009-09-09 15:08:12 +00001527 // Create the [NSAssertionHandler currentHander] summary.
Ted Kremenek6fe2b7a2009-10-15 22:25:12 +00001528 addClassMethSummary("NSAssertionHandler", "currentHandler",
Ted Kremenek2d1652e2009-01-28 05:56:51 +00001529 getPersistentSummary(RetEffect::MakeNotOwned(RetEffect::ObjC)));
Mike Stump1eb44332009-09-09 15:08:12 +00001530
Ted Kremenek6d348932008-10-21 15:53:15 +00001531 // Create the [NSAutoreleasePool addObject:] summary.
Ted Kremenek3baf6722010-11-24 00:54:37 +00001532 ScratchArgs = AF.add(ScratchArgs, 0, Autorelease);
Ted Kremenek6fe2b7a2009-10-15 22:25:12 +00001533 addClassMethSummary("NSAutoreleasePool", "addObject",
1534 getPersistentSummary(RetEffect::MakeNoRet(),
1535 DoNothing, Autorelease));
Ted Kremenek9c32d082008-05-06 00:30:21 +00001536}
1537
Ted Kremenek1f180c32008-06-23 22:21:20 +00001538void RetainSummaryManager::InitializeMethodSummaries() {
Mike Stump1eb44332009-09-09 15:08:12 +00001539
1540 assert (ScratchArgs.isEmpty());
1541
Ted Kremenekc8395602008-05-06 21:26:51 +00001542 // Create the "init" selector. It just acts as a pass-through for the
1543 // receiver.
Ted Kremenek93edbc52011-10-05 23:54:29 +00001544 const RetainSummary *InitSumm = getPersistentSummary(ObjCInitRetE, DecRefMsg);
Ted Kremenekac02f202009-08-20 05:13:36 +00001545 addNSObjectMethSummary(GetNullarySelector("init", Ctx), InitSumm);
1546
1547 // awakeAfterUsingCoder: behaves basically like an 'init' method. It
1548 // claims the receiver and returns a retained object.
1549 addNSObjectMethSummary(GetUnarySelector("awakeAfterUsingCoder", Ctx),
1550 InitSumm);
Mike Stump1eb44332009-09-09 15:08:12 +00001551
Ted Kremenekc8395602008-05-06 21:26:51 +00001552 // The next methods are allocators.
Ted Kremenek93edbc52011-10-05 23:54:29 +00001553 const RetainSummary *AllocSumm = getPersistentSummary(ObjCAllocRetE);
1554 const RetainSummary *CFAllocSumm =
Ted Kremeneka834fb42009-08-28 19:52:12 +00001555 getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF, true));
Mike Stump1eb44332009-09-09 15:08:12 +00001556
Ted Kremenek3c0cea32008-05-06 02:26:56 +00001557 // Create the "retain" selector.
Jordy Rose500abad2011-08-21 19:41:36 +00001558 RetEffect NoRet = RetEffect::MakeNoRet();
Ted Kremenek93edbc52011-10-05 23:54:29 +00001559 const RetainSummary *Summ = getPersistentSummary(NoRet, IncRefMsg);
Ted Kremenek553cf182008-06-25 21:21:56 +00001560 addNSObjectMethSummary(GetNullarySelector("retain", Ctx), Summ);
Mike Stump1eb44332009-09-09 15:08:12 +00001561
Ted Kremenek3c0cea32008-05-06 02:26:56 +00001562 // Create the "release" selector.
Jordy Rose500abad2011-08-21 19:41:36 +00001563 Summ = getPersistentSummary(NoRet, DecRefMsg);
Ted Kremenek553cf182008-06-25 21:21:56 +00001564 addNSObjectMethSummary(GetNullarySelector("release", Ctx), Summ);
Mike Stump1eb44332009-09-09 15:08:12 +00001565
Ted Kremenek299e8152008-05-07 21:17:39 +00001566 // Create the "drain" selector.
Jordy Rose500abad2011-08-21 19:41:36 +00001567 Summ = getPersistentSummary(NoRet, isGCEnabled() ? DoNothing : DecRef);
Ted Kremenek553cf182008-06-25 21:21:56 +00001568 addNSObjectMethSummary(GetNullarySelector("drain", Ctx), Summ);
Mike Stump1eb44332009-09-09 15:08:12 +00001569
Ted Kremenekf95e9fc2009-03-17 19:42:23 +00001570 // Create the -dealloc summary.
Jordy Rose500abad2011-08-21 19:41:36 +00001571 Summ = getPersistentSummary(NoRet, Dealloc);
Ted Kremenekf95e9fc2009-03-17 19:42:23 +00001572 addNSObjectMethSummary(GetNullarySelector("dealloc", Ctx), Summ);
Ted Kremenek3c0cea32008-05-06 02:26:56 +00001573
1574 // Create the "autorelease" selector.
Jordy Rose500abad2011-08-21 19:41:36 +00001575 Summ = getPersistentSummary(NoRet, Autorelease);
Ted Kremenek553cf182008-06-25 21:21:56 +00001576 addNSObjectMethSummary(GetNullarySelector("autorelease", Ctx), Summ);
Mike Stump1eb44332009-09-09 15:08:12 +00001577
Ted Kremenekf9a8e2e2009-02-23 17:45:03 +00001578 // Specially handle NSAutoreleasePool.
Ted Kremenek6c4becb2009-02-25 02:54:57 +00001579 addInstMethSummary("NSAutoreleasePool", "init",
Jordy Rose500abad2011-08-21 19:41:36 +00001580 getPersistentSummary(NoRet, NewAutoreleasePool));
Mike Stump1eb44332009-09-09 15:08:12 +00001581
1582 // For NSWindow, allocated objects are (initially) self-owned.
Ted Kremenek89e202d2009-02-23 02:51:29 +00001583 // FIXME: For now we opt for false negatives with NSWindow, as these objects
1584 // self-own themselves. However, they only do this once they are displayed.
1585 // Thus, we need to track an NSWindow's display status.
1586 // This is tracked in <rdar://problem/6062711>.
Ted Kremenek3aa7ecd2009-03-04 23:30:42 +00001587 // See also http://llvm.org/bugs/show_bug.cgi?id=3714.
Ted Kremenek93edbc52011-10-05 23:54:29 +00001588 const RetainSummary *NoTrackYet = getPersistentSummary(RetEffect::MakeNoRet(),
Ted Kremenek78a35a32009-05-12 20:06:54 +00001589 StopTracking,
1590 StopTracking);
Mike Stump1eb44332009-09-09 15:08:12 +00001591
Ted Kremenek99d02692009-04-03 19:02:51 +00001592 addClassMethSummary("NSWindow", "alloc", NoTrackYet);
1593
Ted Kremenek3aa7ecd2009-03-04 23:30:42 +00001594#if 0
Ted Kremenek78a35a32009-05-12 20:06:54 +00001595 addInstMethSummary("NSWindow", NoTrackYet, "initWithContentRect",
Ted Kremenekaf9dc272008-08-12 18:48:50 +00001596 "styleMask", "backing", "defer", NULL);
Mike Stump1eb44332009-09-09 15:08:12 +00001597
Ted Kremenek78a35a32009-05-12 20:06:54 +00001598 addInstMethSummary("NSWindow", NoTrackYet, "initWithContentRect",
Ted Kremenekaf9dc272008-08-12 18:48:50 +00001599 "styleMask", "backing", "defer", "screen", NULL);
Ted Kremenek3aa7ecd2009-03-04 23:30:42 +00001600#endif
Mike Stump1eb44332009-09-09 15:08:12 +00001601
Ted Kremenekaf9dc272008-08-12 18:48:50 +00001602 // For NSPanel (which subclasses NSWindow), allocated objects are not
1603 // self-owned.
Ted Kremenek99d02692009-04-03 19:02:51 +00001604 // FIXME: For now we don't track NSPanels. object for the same reason
1605 // as for NSWindow objects.
1606 addClassMethSummary("NSPanel", "alloc", NoTrackYet);
Mike Stump1eb44332009-09-09 15:08:12 +00001607
Ted Kremenek78a35a32009-05-12 20:06:54 +00001608#if 0
1609 addInstMethSummary("NSPanel", NoTrackYet, "initWithContentRect",
Ted Kremenekaf9dc272008-08-12 18:48:50 +00001610 "styleMask", "backing", "defer", NULL);
Mike Stump1eb44332009-09-09 15:08:12 +00001611
Ted Kremenek78a35a32009-05-12 20:06:54 +00001612 addInstMethSummary("NSPanel", NoTrackYet, "initWithContentRect",
Ted Kremenekaf9dc272008-08-12 18:48:50 +00001613 "styleMask", "backing", "defer", "screen", NULL);
Ted Kremenek78a35a32009-05-12 20:06:54 +00001614#endif
Mike Stump1eb44332009-09-09 15:08:12 +00001615
Ted Kremenekba67f6a2009-05-18 23:14:34 +00001616 // Don't track allocated autorelease pools yet, as it is okay to prematurely
1617 // exit a method.
1618 addClassMethSummary("NSAutoreleasePool", "alloc", NoTrackYet);
Ted Kremeneka9797122012-02-18 21:37:48 +00001619 addClassMethSummary("NSAutoreleasePool", "allocWithZone", NoTrackYet, false);
Ted Kremenek553cf182008-06-25 21:21:56 +00001620
Ted Kremenek767d6492009-05-20 22:39:57 +00001621 // Create summaries QCRenderer/QCView -createSnapShotImageOfType:
1622 addInstMethSummary("QCRenderer", AllocSumm,
1623 "createSnapshotImageOfType", NULL);
1624 addInstMethSummary("QCView", AllocSumm,
1625 "createSnapshotImageOfType", NULL);
1626
Ted Kremenek211a9c62009-06-15 20:58:58 +00001627 // Create summaries for CIContext, 'createCGImage' and
Ted Kremeneka834fb42009-08-28 19:52:12 +00001628 // 'createCGLayerWithSize'. These objects are CF objects, and are not
1629 // automatically garbage collected.
1630 addInstMethSummary("CIContext", CFAllocSumm,
Ted Kremenek767d6492009-05-20 22:39:57 +00001631 "createCGImage", "fromRect", NULL);
Ted Kremeneka834fb42009-08-28 19:52:12 +00001632 addInstMethSummary("CIContext", CFAllocSumm,
Mike Stump1eb44332009-09-09 15:08:12 +00001633 "createCGImage", "fromRect", "format", "colorSpace", NULL);
Ted Kremeneka834fb42009-08-28 19:52:12 +00001634 addInstMethSummary("CIContext", CFAllocSumm, "createCGLayerWithSize",
Ted Kremenek211a9c62009-06-15 20:58:58 +00001635 "info", NULL);
Ted Kremenekb3c3c282008-05-06 00:38:54 +00001636}
1637
Ted Kremenekd3dbcf42008-05-05 22:11:16 +00001638//===----------------------------------------------------------------------===//
Ted Kremenekc887d132009-04-29 18:50:19 +00001639// Error reporting.
1640//===----------------------------------------------------------------------===//
Ted Kremenekc887d132009-04-29 18:50:19 +00001641namespace {
Jordy Roseec9ef852011-08-23 20:55:48 +00001642 typedef llvm::DenseMap<const ExplodedNode *, const RetainSummary *>
1643 SummaryLogTy;
1644
Ted Kremenekc887d132009-04-29 18:50:19 +00001645 //===-------------===//
1646 // Bug Descriptions. //
Mike Stump1eb44332009-09-09 15:08:12 +00001647 //===-------------===//
1648
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00001649 class CFRefBug : public BugType {
Ted Kremenekc887d132009-04-29 18:50:19 +00001650 protected:
Jordy Rose35c86952011-08-24 05:47:39 +00001651 CFRefBug(StringRef name)
Ted Kremenek6fd45052012-04-05 20:43:28 +00001652 : BugType(name, categories::MemoryCoreFoundationObjectiveC) {}
Ted Kremenekc887d132009-04-29 18:50:19 +00001653 public:
Mike Stump1eb44332009-09-09 15:08:12 +00001654
Ted Kremenekc887d132009-04-29 18:50:19 +00001655 // FIXME: Eventually remove.
Jordy Rose35c86952011-08-24 05:47:39 +00001656 virtual const char *getDescription() const = 0;
Mike Stump1eb44332009-09-09 15:08:12 +00001657
Ted Kremenekc887d132009-04-29 18:50:19 +00001658 virtual bool isLeak() const { return false; }
1659 };
Mike Stump1eb44332009-09-09 15:08:12 +00001660
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00001661 class UseAfterRelease : public CFRefBug {
Ted Kremenekc887d132009-04-29 18:50:19 +00001662 public:
Jordy Rose35c86952011-08-24 05:47:39 +00001663 UseAfterRelease() : CFRefBug("Use-after-release") {}
Mike Stump1eb44332009-09-09 15:08:12 +00001664
Jordy Rose35c86952011-08-24 05:47:39 +00001665 const char *getDescription() const {
Ted Kremenekc887d132009-04-29 18:50:19 +00001666 return "Reference-counted object is used after it is released";
Mike Stump1eb44332009-09-09 15:08:12 +00001667 }
Ted Kremenekc887d132009-04-29 18:50:19 +00001668 };
Mike Stump1eb44332009-09-09 15:08:12 +00001669
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00001670 class BadRelease : public CFRefBug {
Ted Kremenekc887d132009-04-29 18:50:19 +00001671 public:
Jordy Rose35c86952011-08-24 05:47:39 +00001672 BadRelease() : CFRefBug("Bad release") {}
Mike Stump1eb44332009-09-09 15:08:12 +00001673
Jordy Rose35c86952011-08-24 05:47:39 +00001674 const char *getDescription() const {
Ted Kremenekbb206fd2009-10-01 17:31:50 +00001675 return "Incorrect decrement of the reference count of an object that is "
1676 "not owned at this point by the caller";
Ted Kremenekc887d132009-04-29 18:50:19 +00001677 }
1678 };
Mike Stump1eb44332009-09-09 15:08:12 +00001679
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00001680 class DeallocGC : public CFRefBug {
Ted Kremenekc887d132009-04-29 18:50:19 +00001681 public:
Jordy Rose35c86952011-08-24 05:47:39 +00001682 DeallocGC()
1683 : CFRefBug("-dealloc called while using garbage collection") {}
Mike Stump1eb44332009-09-09 15:08:12 +00001684
Ted Kremenekc887d132009-04-29 18:50:19 +00001685 const char *getDescription() const {
Ted Kremenek369de562009-05-09 00:10:05 +00001686 return "-dealloc called while using garbage collection";
Ted Kremenekc887d132009-04-29 18:50:19 +00001687 }
1688 };
Mike Stump1eb44332009-09-09 15:08:12 +00001689
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00001690 class DeallocNotOwned : public CFRefBug {
Ted Kremenekc887d132009-04-29 18:50:19 +00001691 public:
Jordy Rose35c86952011-08-24 05:47:39 +00001692 DeallocNotOwned()
1693 : CFRefBug("-dealloc sent to non-exclusively owned object") {}
Mike Stump1eb44332009-09-09 15:08:12 +00001694
Ted Kremenekc887d132009-04-29 18:50:19 +00001695 const char *getDescription() const {
1696 return "-dealloc sent to object that may be referenced elsewhere";
1697 }
Mike Stump1eb44332009-09-09 15:08:12 +00001698 };
1699
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00001700 class OverAutorelease : public CFRefBug {
Ted Kremenek369de562009-05-09 00:10:05 +00001701 public:
Jordy Rose35c86952011-08-24 05:47:39 +00001702 OverAutorelease()
1703 : CFRefBug("Object sent -autorelease too many times") {}
Mike Stump1eb44332009-09-09 15:08:12 +00001704
Ted Kremenek369de562009-05-09 00:10:05 +00001705 const char *getDescription() const {
Ted Kremenekeaedfea2009-05-10 05:11:21 +00001706 return "Object sent -autorelease too many times";
Ted Kremenek369de562009-05-09 00:10:05 +00001707 }
1708 };
Mike Stump1eb44332009-09-09 15:08:12 +00001709
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00001710 class ReturnedNotOwnedForOwned : public CFRefBug {
Ted Kremeneke8720ce2009-05-10 06:25:57 +00001711 public:
Jordy Rose35c86952011-08-24 05:47:39 +00001712 ReturnedNotOwnedForOwned()
1713 : CFRefBug("Method should return an owned object") {}
Mike Stump1eb44332009-09-09 15:08:12 +00001714
Ted Kremeneke8720ce2009-05-10 06:25:57 +00001715 const char *getDescription() const {
Jordy Rose5b5402b2011-07-15 22:17:54 +00001716 return "Object with a +0 retain count returned to caller where a +1 "
Ted Kremeneke8720ce2009-05-10 06:25:57 +00001717 "(owning) retain count is expected";
1718 }
1719 };
Mike Stump1eb44332009-09-09 15:08:12 +00001720
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00001721 class Leak : public CFRefBug {
Benjamin Kramerfacde172012-06-06 17:32:50 +00001722 public:
1723 Leak(StringRef name)
1724 : CFRefBug(name) {
Jordy Rosedb92bb62011-08-25 01:14:38 +00001725 // Leaks should not be reported if they are post-dominated by a sink.
1726 setSuppressOnSink(true);
1727 }
Mike Stump1eb44332009-09-09 15:08:12 +00001728
Jordy Rose35c86952011-08-24 05:47:39 +00001729 const char *getDescription() const { return ""; }
Mike Stump1eb44332009-09-09 15:08:12 +00001730
Ted Kremenekc887d132009-04-29 18:50:19 +00001731 bool isLeak() const { return true; }
1732 };
Mike Stump1eb44332009-09-09 15:08:12 +00001733
Ted Kremenekc887d132009-04-29 18:50:19 +00001734 //===---------===//
1735 // Bug Reports. //
1736 //===---------===//
Mike Stump1eb44332009-09-09 15:08:12 +00001737
Jordy Rose01153492012-03-24 02:45:35 +00001738 class CFRefReportVisitor : public BugReporterVisitorImpl<CFRefReportVisitor> {
Anna Zaks23f395e2011-08-20 01:27:22 +00001739 protected:
Anna Zaksdc757b02011-08-19 23:21:56 +00001740 SymbolRef Sym;
Jordy Roseec9ef852011-08-23 20:55:48 +00001741 const SummaryLogTy &SummaryLog;
Jordy Rose35c86952011-08-24 05:47:39 +00001742 bool GCEnabled;
Anna Zaks23f395e2011-08-20 01:27:22 +00001743
Anna Zaksdc757b02011-08-19 23:21:56 +00001744 public:
Jordy Rose35c86952011-08-24 05:47:39 +00001745 CFRefReportVisitor(SymbolRef sym, bool gcEnabled, const SummaryLogTy &log)
1746 : Sym(sym), SummaryLog(log), GCEnabled(gcEnabled) {}
Anna Zaksdc757b02011-08-19 23:21:56 +00001747
Anna Zaks23f395e2011-08-20 01:27:22 +00001748 virtual void Profile(llvm::FoldingSetNodeID &ID) const {
Anna Zaksdc757b02011-08-19 23:21:56 +00001749 static int x = 0;
1750 ID.AddPointer(&x);
1751 ID.AddPointer(Sym);
1752 }
1753
Anna Zaks23f395e2011-08-20 01:27:22 +00001754 virtual PathDiagnosticPiece *VisitNode(const ExplodedNode *N,
1755 const ExplodedNode *PrevN,
1756 BugReporterContext &BRC,
1757 BugReport &BR);
1758
1759 virtual PathDiagnosticPiece *getEndPath(BugReporterContext &BRC,
1760 const ExplodedNode *N,
1761 BugReport &BR);
1762 };
1763
1764 class CFRefLeakReportVisitor : public CFRefReportVisitor {
1765 public:
Jordy Rose35c86952011-08-24 05:47:39 +00001766 CFRefLeakReportVisitor(SymbolRef sym, bool GCEnabled,
Jordy Roseec9ef852011-08-23 20:55:48 +00001767 const SummaryLogTy &log)
Jordy Rose35c86952011-08-24 05:47:39 +00001768 : CFRefReportVisitor(sym, GCEnabled, log) {}
Anna Zaks23f395e2011-08-20 01:27:22 +00001769
1770 PathDiagnosticPiece *getEndPath(BugReporterContext &BRC,
1771 const ExplodedNode *N,
1772 BugReport &BR);
Jordy Rose01153492012-03-24 02:45:35 +00001773
1774 virtual BugReporterVisitor *clone() const {
1775 // The curiously-recurring template pattern only works for one level of
1776 // subclassing. Rather than make a new template base for
1777 // CFRefReportVisitor, we simply override clone() to do the right thing.
1778 // This could be trouble someday if BugReporterVisitorImpl is ever
1779 // used for something else besides a convenient implementation of clone().
1780 return new CFRefLeakReportVisitor(*this);
1781 }
Anna Zaksdc757b02011-08-19 23:21:56 +00001782 };
1783
Anna Zakse172e8b2011-08-17 23:00:25 +00001784 class CFRefReport : public BugReport {
Jordy Rose20589562011-08-24 22:39:09 +00001785 void addGCModeDescription(const LangOptions &LOpts, bool GCEnabled);
Jordy Rose35c86952011-08-24 05:47:39 +00001786
Ted Kremenekc887d132009-04-29 18:50:19 +00001787 public:
Jordy Rose20589562011-08-24 22:39:09 +00001788 CFRefReport(CFRefBug &D, const LangOptions &LOpts, bool GCEnabled,
1789 const SummaryLogTy &Log, ExplodedNode *n, SymbolRef sym,
1790 bool registerVisitor = true)
Anna Zaksedf4dae2011-08-22 18:54:07 +00001791 : BugReport(D, D.getDescription(), n) {
Anna Zaks23f395e2011-08-20 01:27:22 +00001792 if (registerVisitor)
Jordy Rose20589562011-08-24 22:39:09 +00001793 addVisitor(new CFRefReportVisitor(sym, GCEnabled, Log));
1794 addGCModeDescription(LOpts, GCEnabled);
Anna Zaksdc757b02011-08-19 23:21:56 +00001795 }
Ted Kremenekeaedfea2009-05-10 05:11:21 +00001796
Jordy Rose20589562011-08-24 22:39:09 +00001797 CFRefReport(CFRefBug &D, const LangOptions &LOpts, bool GCEnabled,
1798 const SummaryLogTy &Log, ExplodedNode *n, SymbolRef sym,
1799 StringRef endText)
Anna Zaksedf4dae2011-08-22 18:54:07 +00001800 : BugReport(D, D.getDescription(), endText, n) {
Jordy Rose20589562011-08-24 22:39:09 +00001801 addVisitor(new CFRefReportVisitor(sym, GCEnabled, Log));
1802 addGCModeDescription(LOpts, GCEnabled);
Anna Zaksdc757b02011-08-19 23:21:56 +00001803 }
Mike Stump1eb44332009-09-09 15:08:12 +00001804
Anna Zakse172e8b2011-08-17 23:00:25 +00001805 virtual std::pair<ranges_iterator, ranges_iterator> getRanges() {
Anna Zaksedf4dae2011-08-22 18:54:07 +00001806 const CFRefBug& BugTy = static_cast<CFRefBug&>(getBugType());
1807 if (!BugTy.isLeak())
Anna Zakse172e8b2011-08-17 23:00:25 +00001808 return BugReport::getRanges();
Ted Kremenekc887d132009-04-29 18:50:19 +00001809 else
Argyrios Kyrtzidis640ccf02010-12-04 01:12:15 +00001810 return std::make_pair(ranges_iterator(), ranges_iterator());
Ted Kremenekc887d132009-04-29 18:50:19 +00001811 }
Ted Kremenekc887d132009-04-29 18:50:19 +00001812 };
Ted Kremenekeaedfea2009-05-10 05:11:21 +00001813
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00001814 class CFRefLeakReport : public CFRefReport {
Ted Kremenekc887d132009-04-29 18:50:19 +00001815 const MemRegion* AllocBinding;
Anna Zaks23f395e2011-08-20 01:27:22 +00001816
Ted Kremenekc887d132009-04-29 18:50:19 +00001817 public:
Jordy Rose20589562011-08-24 22:39:09 +00001818 CFRefLeakReport(CFRefBug &D, const LangOptions &LOpts, bool GCEnabled,
1819 const SummaryLogTy &Log, ExplodedNode *n, SymbolRef sym,
Anna Zaks6a93bd52011-10-25 19:57:11 +00001820 CheckerContext &Ctx);
Mike Stump1eb44332009-09-09 15:08:12 +00001821
Anna Zaks590dd8e2011-09-20 21:38:35 +00001822 PathDiagnosticLocation getLocation(const SourceManager &SM) const {
1823 assert(Location.isValid());
1824 return Location;
1825 }
Mike Stump1eb44332009-09-09 15:08:12 +00001826 };
Ted Kremenekc887d132009-04-29 18:50:19 +00001827} // end anonymous namespace
1828
Jordy Rose20589562011-08-24 22:39:09 +00001829void CFRefReport::addGCModeDescription(const LangOptions &LOpts,
1830 bool GCEnabled) {
Jordy Rosef95b19d2011-08-24 20:38:42 +00001831 const char *GCModeDescription = 0;
Mike Stump1eb44332009-09-09 15:08:12 +00001832
Douglas Gregore289d812011-09-13 17:21:33 +00001833 switch (LOpts.getGC()) {
Anna Zaks7f2531c2011-08-22 20:31:28 +00001834 case LangOptions::GCOnly:
Jordy Rose20589562011-08-24 22:39:09 +00001835 assert(GCEnabled);
Jordy Rose35c86952011-08-24 05:47:39 +00001836 GCModeDescription = "Code is compiled to only use garbage collection";
1837 break;
Mike Stump1eb44332009-09-09 15:08:12 +00001838
Anna Zaks7f2531c2011-08-22 20:31:28 +00001839 case LangOptions::NonGC:
Jordy Rose20589562011-08-24 22:39:09 +00001840 assert(!GCEnabled);
Jordy Rose35c86952011-08-24 05:47:39 +00001841 GCModeDescription = "Code is compiled to use reference counts";
1842 break;
Mike Stump1eb44332009-09-09 15:08:12 +00001843
Anna Zaks7f2531c2011-08-22 20:31:28 +00001844 case LangOptions::HybridGC:
Jordy Rose20589562011-08-24 22:39:09 +00001845 if (GCEnabled) {
Jordy Rose35c86952011-08-24 05:47:39 +00001846 GCModeDescription = "Code is compiled to use either garbage collection "
1847 "(GC) or reference counts (non-GC). The bug occurs "
1848 "with GC enabled";
1849 break;
1850 } else {
1851 GCModeDescription = "Code is compiled to use either garbage collection "
1852 "(GC) or reference counts (non-GC). The bug occurs "
1853 "in non-GC mode";
1854 break;
Anna Zaks7f2531c2011-08-22 20:31:28 +00001855 }
Ted Kremenekc887d132009-04-29 18:50:19 +00001856 }
Jordy Rose35c86952011-08-24 05:47:39 +00001857
Jordy Rosef95b19d2011-08-24 20:38:42 +00001858 assert(GCModeDescription && "invalid/unknown GC mode");
Jordy Rose35c86952011-08-24 05:47:39 +00001859 addExtraText(GCModeDescription);
Ted Kremenekc887d132009-04-29 18:50:19 +00001860}
1861
Jordy Rose910c4052011-09-02 06:44:22 +00001862// FIXME: This should be a method on SmallVector.
Chris Lattner5f9e2722011-07-23 10:55:15 +00001863static inline bool contains(const SmallVectorImpl<ArgEffect>& V,
Ted Kremenekc887d132009-04-29 18:50:19 +00001864 ArgEffect X) {
Chris Lattner5f9e2722011-07-23 10:55:15 +00001865 for (SmallVectorImpl<ArgEffect>::const_iterator I=V.begin(), E=V.end();
Ted Kremenekc887d132009-04-29 18:50:19 +00001866 I!=E; ++I)
1867 if (*I == X) return true;
Mike Stump1eb44332009-09-09 15:08:12 +00001868
Ted Kremenekc887d132009-04-29 18:50:19 +00001869 return false;
1870}
1871
Jordy Rose70fdbc32012-05-12 05:10:43 +00001872static bool isNumericLiteralExpression(const Expr *E) {
1873 // FIXME: This set of cases was copied from SemaExprObjC.
1874 return isa<IntegerLiteral>(E) ||
1875 isa<CharacterLiteral>(E) ||
1876 isa<FloatingLiteral>(E) ||
1877 isa<ObjCBoolLiteralExpr>(E) ||
1878 isa<CXXBoolLiteralExpr>(E);
1879}
1880
Anna Zaksdc757b02011-08-19 23:21:56 +00001881PathDiagnosticPiece *CFRefReportVisitor::VisitNode(const ExplodedNode *N,
1882 const ExplodedNode *PrevN,
1883 BugReporterContext &BRC,
1884 BugReport &BR) {
Jordan Rose28038f32012-07-10 22:07:42 +00001885 // FIXME: We will eventually need to handle non-statement-based events
1886 // (__attribute__((cleanup))).
Jordy Rosef53e8c72011-08-23 19:43:16 +00001887 if (!isa<StmtPoint>(N->getLocation()))
Ted Kremenek2033a952009-05-13 07:12:33 +00001888 return NULL;
Mike Stump1eb44332009-09-09 15:08:12 +00001889
Ted Kremenek8966bc12009-05-06 21:39:49 +00001890 // Check if the type state has changed.
Ted Kremenek8bef8232012-01-26 21:29:00 +00001891 ProgramStateRef PrevSt = PrevN->getState();
1892 ProgramStateRef CurrSt = N->getState();
Ted Kremenek5eca4822012-01-06 22:09:28 +00001893 const LocationContext *LCtx = N->getLocationContext();
Mike Stump1eb44332009-09-09 15:08:12 +00001894
Anna Zaks8d6b43c2012-08-14 00:36:15 +00001895 const RefVal* CurrT = getRefBinding(CurrSt, Sym);
Ted Kremenekc887d132009-04-29 18:50:19 +00001896 if (!CurrT) return NULL;
Mike Stump1eb44332009-09-09 15:08:12 +00001897
Ted Kremenekb65be702009-06-18 01:23:53 +00001898 const RefVal &CurrV = *CurrT;
Anna Zaks8d6b43c2012-08-14 00:36:15 +00001899 const RefVal *PrevT = getRefBinding(PrevSt, Sym);
Mike Stump1eb44332009-09-09 15:08:12 +00001900
Ted Kremenekc887d132009-04-29 18:50:19 +00001901 // Create a string buffer to constain all the useful things we want
1902 // to tell the user.
1903 std::string sbuf;
1904 llvm::raw_string_ostream os(sbuf);
Mike Stump1eb44332009-09-09 15:08:12 +00001905
Ted Kremenekc887d132009-04-29 18:50:19 +00001906 // This is the allocation site since the previous node had no bindings
1907 // for this symbol.
1908 if (!PrevT) {
Jordy Rosef53e8c72011-08-23 19:43:16 +00001909 const Stmt *S = cast<StmtPoint>(N->getLocation()).getStmt();
Mike Stump1eb44332009-09-09 15:08:12 +00001910
Ted Kremenek1a45a5f2012-03-06 20:06:12 +00001911 if (isa<ObjCArrayLiteral>(S)) {
1912 os << "NSArray literal is an object with a +0 retain count";
Mike Stump1eb44332009-09-09 15:08:12 +00001913 }
Ted Kremenek1a45a5f2012-03-06 20:06:12 +00001914 else if (isa<ObjCDictionaryLiteral>(S)) {
1915 os << "NSDictionary literal is an object with a +0 retain count";
Ted Kremenekc887d132009-04-29 18:50:19 +00001916 }
Jordy Rose70fdbc32012-05-12 05:10:43 +00001917 else if (const ObjCBoxedExpr *BL = dyn_cast<ObjCBoxedExpr>(S)) {
1918 if (isNumericLiteralExpression(BL->getSubExpr()))
1919 os << "NSNumber literal is an object with a +0 retain count";
1920 else {
1921 const ObjCInterfaceDecl *BoxClass = 0;
1922 if (const ObjCMethodDecl *Method = BL->getBoxingMethod())
1923 BoxClass = Method->getClassInterface();
1924
1925 // We should always be able to find the boxing class interface,
1926 // but consider this future-proofing.
1927 if (BoxClass)
1928 os << *BoxClass << " b";
1929 else
1930 os << "B";
1931
1932 os << "oxed expression produces an object with a +0 retain count";
1933 }
1934 }
Ted Kremenek1a45a5f2012-03-06 20:06:12 +00001935 else {
1936 if (const CallExpr *CE = dyn_cast<CallExpr>(S)) {
1937 // Get the name of the callee (if it is available).
1938 SVal X = CurrSt->getSValAsScalarOrLoc(CE->getCallee(), LCtx);
1939 if (const FunctionDecl *FD = X.getAsFunctionDecl())
1940 os << "Call to function '" << *FD << '\'';
1941 else
1942 os << "function call";
Ted Kremenekc887d132009-04-29 18:50:19 +00001943 }
Ted Kremenek1a45a5f2012-03-06 20:06:12 +00001944 else {
Jordan Rose8919e682012-07-18 21:59:51 +00001945 assert(isa<ObjCMessageExpr>(S));
Jordan Rosed563d3f2012-07-30 20:22:09 +00001946 CallEventManager &Mgr = CurrSt->getStateManager().getCallEventManager();
1947 CallEventRef<ObjCMethodCall> Call
1948 = Mgr.getObjCMethodCall(cast<ObjCMessageExpr>(S), CurrSt, LCtx);
1949
1950 switch (Call->getMessageKind()) {
Jordan Rose8919e682012-07-18 21:59:51 +00001951 case OCM_Message:
1952 os << "Method";
1953 break;
1954 case OCM_PropertyAccess:
1955 os << "Property";
1956 break;
1957 case OCM_Subscript:
1958 os << "Subscript";
1959 break;
1960 }
Ted Kremenek1a45a5f2012-03-06 20:06:12 +00001961 }
1962
1963 if (CurrV.getObjKind() == RetEffect::CF) {
1964 os << " returns a Core Foundation object with a ";
1965 }
1966 else {
1967 assert (CurrV.getObjKind() == RetEffect::ObjC);
1968 os << " returns an Objective-C object with a ";
1969 }
1970
1971 if (CurrV.isOwned()) {
1972 os << "+1 retain count";
1973
1974 if (GCEnabled) {
1975 assert(CurrV.getObjKind() == RetEffect::CF);
1976 os << ". "
1977 "Core Foundation objects are not automatically garbage collected.";
1978 }
1979 }
1980 else {
1981 assert (CurrV.isNotOwned());
1982 os << "+0 retain count";
1983 }
Ted Kremenekc887d132009-04-29 18:50:19 +00001984 }
Mike Stump1eb44332009-09-09 15:08:12 +00001985
Anna Zaks220ac8c2011-09-15 01:08:34 +00001986 PathDiagnosticLocation Pos(S, BRC.getSourceManager(),
1987 N->getLocationContext());
Ted Kremenekc887d132009-04-29 18:50:19 +00001988 return new PathDiagnosticEventPiece(Pos, os.str());
1989 }
Mike Stump1eb44332009-09-09 15:08:12 +00001990
Ted Kremenekc887d132009-04-29 18:50:19 +00001991 // Gather up the effects that were performed on the object at this
1992 // program point
Chris Lattner5f9e2722011-07-23 10:55:15 +00001993 SmallVector<ArgEffect, 2> AEffects;
Mike Stump1eb44332009-09-09 15:08:12 +00001994
Jordy Roseec9ef852011-08-23 20:55:48 +00001995 const ExplodedNode *OrigNode = BRC.getNodeResolver().getOriginalNode(N);
1996 if (const RetainSummary *Summ = SummaryLog.lookup(OrigNode)) {
Ted Kremenekc887d132009-04-29 18:50:19 +00001997 // We only have summaries attached to nodes after evaluating CallExpr and
1998 // ObjCMessageExprs.
Jordy Rosef53e8c72011-08-23 19:43:16 +00001999 const Stmt *S = cast<StmtPoint>(N->getLocation()).getStmt();
Mike Stump1eb44332009-09-09 15:08:12 +00002000
Ted Kremenek5f85e172009-07-22 22:35:28 +00002001 if (const CallExpr *CE = dyn_cast<CallExpr>(S)) {
Ted Kremenekc887d132009-04-29 18:50:19 +00002002 // Iterate through the parameter expressions and see if the symbol
2003 // was ever passed as an argument.
2004 unsigned i = 0;
Mike Stump1eb44332009-09-09 15:08:12 +00002005
Ted Kremenek5f85e172009-07-22 22:35:28 +00002006 for (CallExpr::const_arg_iterator AI=CE->arg_begin(), AE=CE->arg_end();
Ted Kremenekc887d132009-04-29 18:50:19 +00002007 AI!=AE; ++AI, ++i) {
Mike Stump1eb44332009-09-09 15:08:12 +00002008
Ted Kremenekc887d132009-04-29 18:50:19 +00002009 // Retrieve the value of the argument. Is it the symbol
2010 // we are interested in?
Ted Kremenek5eca4822012-01-06 22:09:28 +00002011 if (CurrSt->getSValAsScalarOrLoc(*AI, LCtx).getAsLocSymbol() != Sym)
Ted Kremenekc887d132009-04-29 18:50:19 +00002012 continue;
Mike Stump1eb44332009-09-09 15:08:12 +00002013
Ted Kremenekc887d132009-04-29 18:50:19 +00002014 // We have an argument. Get the effect!
2015 AEffects.push_back(Summ->getArg(i));
2016 }
2017 }
Mike Stump1eb44332009-09-09 15:08:12 +00002018 else if (const ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(S)) {
Douglas Gregor04badcf2010-04-21 00:45:42 +00002019 if (const Expr *receiver = ME->getInstanceReceiver())
Ted Kremenek5eca4822012-01-06 22:09:28 +00002020 if (CurrSt->getSValAsScalarOrLoc(receiver, LCtx)
2021 .getAsLocSymbol() == Sym) {
Ted Kremenekc887d132009-04-29 18:50:19 +00002022 // The symbol we are tracking is the receiver.
2023 AEffects.push_back(Summ->getReceiverEffect());
2024 }
2025 }
2026 }
Mike Stump1eb44332009-09-09 15:08:12 +00002027
Ted Kremenekc887d132009-04-29 18:50:19 +00002028 do {
2029 // Get the previous type state.
2030 RefVal PrevV = *PrevT;
Mike Stump1eb44332009-09-09 15:08:12 +00002031
Ted Kremenekc887d132009-04-29 18:50:19 +00002032 // Specially handle -dealloc.
Jordy Rose35c86952011-08-24 05:47:39 +00002033 if (!GCEnabled && contains(AEffects, Dealloc)) {
Ted Kremenekc887d132009-04-29 18:50:19 +00002034 // Determine if the object's reference count was pushed to zero.
2035 assert(!(PrevV == CurrV) && "The typestate *must* have changed.");
2036 // We may not have transitioned to 'release' if we hit an error.
2037 // This case is handled elsewhere.
2038 if (CurrV.getKind() == RefVal::Released) {
Ted Kremenekf21332e2009-05-08 20:01:42 +00002039 assert(CurrV.getCombinedCounts() == 0);
Ted Kremenekc887d132009-04-29 18:50:19 +00002040 os << "Object released by directly sending the '-dealloc' message";
2041 break;
2042 }
2043 }
Mike Stump1eb44332009-09-09 15:08:12 +00002044
Ted Kremenekc887d132009-04-29 18:50:19 +00002045 // Specially handle CFMakeCollectable and friends.
2046 if (contains(AEffects, MakeCollectable)) {
2047 // Get the name of the function.
Jordy Rosef53e8c72011-08-23 19:43:16 +00002048 const Stmt *S = cast<StmtPoint>(N->getLocation()).getStmt();
Ted Kremenek5eca4822012-01-06 22:09:28 +00002049 SVal X =
2050 CurrSt->getSValAsScalarOrLoc(cast<CallExpr>(S)->getCallee(), LCtx);
Ted Kremenek9c378f72011-08-12 23:37:29 +00002051 const FunctionDecl *FD = X.getAsFunctionDecl();
Mike Stump1eb44332009-09-09 15:08:12 +00002052
Jordy Rose35c86952011-08-24 05:47:39 +00002053 if (GCEnabled) {
Ted Kremenekc887d132009-04-29 18:50:19 +00002054 // Determine if the object's reference count was pushed to zero.
2055 assert(!(PrevV == CurrV) && "The typestate *must* have changed.");
Mike Stump1eb44332009-09-09 15:08:12 +00002056
Benjamin Kramerb8989f22011-10-14 18:45:37 +00002057 os << "In GC mode a call to '" << *FD
Ted Kremenekc887d132009-04-29 18:50:19 +00002058 << "' decrements an object's retain count and registers the "
2059 "object with the garbage collector. ";
Mike Stump1eb44332009-09-09 15:08:12 +00002060
Ted Kremenekc887d132009-04-29 18:50:19 +00002061 if (CurrV.getKind() == RefVal::Released) {
2062 assert(CurrV.getCount() == 0);
2063 os << "Since it now has a 0 retain count the object can be "
2064 "automatically collected by the garbage collector.";
2065 }
2066 else
2067 os << "An object must have a 0 retain count to be garbage collected. "
2068 "After this call its retain count is +" << CurrV.getCount()
2069 << '.';
2070 }
Mike Stump1eb44332009-09-09 15:08:12 +00002071 else
Benjamin Kramerb8989f22011-10-14 18:45:37 +00002072 os << "When GC is not enabled a call to '" << *FD
Ted Kremenekc887d132009-04-29 18:50:19 +00002073 << "' has no effect on its argument.";
Mike Stump1eb44332009-09-09 15:08:12 +00002074
Ted Kremenekc887d132009-04-29 18:50:19 +00002075 // Nothing more to say.
2076 break;
2077 }
Mike Stump1eb44332009-09-09 15:08:12 +00002078
2079 // Determine if the typestate has changed.
Ted Kremenekc887d132009-04-29 18:50:19 +00002080 if (!(PrevV == CurrV))
2081 switch (CurrV.getKind()) {
2082 case RefVal::Owned:
2083 case RefVal::NotOwned:
Mike Stump1eb44332009-09-09 15:08:12 +00002084
Ted Kremenekf21332e2009-05-08 20:01:42 +00002085 if (PrevV.getCount() == CurrV.getCount()) {
2086 // Did an autorelease message get sent?
2087 if (PrevV.getAutoreleaseCount() == CurrV.getAutoreleaseCount())
2088 return 0;
Mike Stump1eb44332009-09-09 15:08:12 +00002089
Zhongxing Xu264e9372009-05-12 10:10:00 +00002090 assert(PrevV.getAutoreleaseCount() < CurrV.getAutoreleaseCount());
Ted Kremenekeaedfea2009-05-10 05:11:21 +00002091 os << "Object sent -autorelease message";
Ted Kremenekf21332e2009-05-08 20:01:42 +00002092 break;
2093 }
Mike Stump1eb44332009-09-09 15:08:12 +00002094
Ted Kremenekc887d132009-04-29 18:50:19 +00002095 if (PrevV.getCount() > CurrV.getCount())
2096 os << "Reference count decremented.";
2097 else
2098 os << "Reference count incremented.";
Mike Stump1eb44332009-09-09 15:08:12 +00002099
Ted Kremenekc887d132009-04-29 18:50:19 +00002100 if (unsigned Count = CurrV.getCount())
2101 os << " The object now has a +" << Count << " retain count.";
Mike Stump1eb44332009-09-09 15:08:12 +00002102
Ted Kremenekc887d132009-04-29 18:50:19 +00002103 if (PrevV.getKind() == RefVal::Released) {
Jordy Rose35c86952011-08-24 05:47:39 +00002104 assert(GCEnabled && CurrV.getCount() > 0);
Jordy Rose74b7b2b2012-03-17 05:49:15 +00002105 os << " The object is not eligible for garbage collection until "
2106 "the retain count reaches 0 again.";
Ted Kremenekc887d132009-04-29 18:50:19 +00002107 }
Mike Stump1eb44332009-09-09 15:08:12 +00002108
Ted Kremenekc887d132009-04-29 18:50:19 +00002109 break;
Mike Stump1eb44332009-09-09 15:08:12 +00002110
Ted Kremenekc887d132009-04-29 18:50:19 +00002111 case RefVal::Released:
2112 os << "Object released.";
2113 break;
Mike Stump1eb44332009-09-09 15:08:12 +00002114
Ted Kremenekc887d132009-04-29 18:50:19 +00002115 case RefVal::ReturnedOwned:
Jordy Rose74b7b2b2012-03-17 05:49:15 +00002116 // Autoreleases can be applied after marking a node ReturnedOwned.
2117 if (CurrV.getAutoreleaseCount())
2118 return NULL;
2119
2120 os << "Object returned to caller as an owning reference (single "
2121 "retain count transferred to caller)";
Ted Kremenekc887d132009-04-29 18:50:19 +00002122 break;
Mike Stump1eb44332009-09-09 15:08:12 +00002123
Ted Kremenekc887d132009-04-29 18:50:19 +00002124 case RefVal::ReturnedNotOwned:
Ted Kremenekf1365462011-05-26 18:45:44 +00002125 os << "Object returned to caller with a +0 retain count";
Ted Kremenekc887d132009-04-29 18:50:19 +00002126 break;
Mike Stump1eb44332009-09-09 15:08:12 +00002127
Ted Kremenekc887d132009-04-29 18:50:19 +00002128 default:
2129 return NULL;
2130 }
Mike Stump1eb44332009-09-09 15:08:12 +00002131
Ted Kremenekc887d132009-04-29 18:50:19 +00002132 // Emit any remaining diagnostics for the argument effects (if any).
Chris Lattner5f9e2722011-07-23 10:55:15 +00002133 for (SmallVectorImpl<ArgEffect>::iterator I=AEffects.begin(),
Ted Kremenekc887d132009-04-29 18:50:19 +00002134 E=AEffects.end(); I != E; ++I) {
Mike Stump1eb44332009-09-09 15:08:12 +00002135
Ted Kremenekc887d132009-04-29 18:50:19 +00002136 // A bunch of things have alternate behavior under GC.
Jordy Rose35c86952011-08-24 05:47:39 +00002137 if (GCEnabled)
Ted Kremenekc887d132009-04-29 18:50:19 +00002138 switch (*I) {
2139 default: break;
2140 case Autorelease:
2141 os << "In GC mode an 'autorelease' has no effect.";
2142 continue;
2143 case IncRefMsg:
2144 os << "In GC mode the 'retain' message has no effect.";
2145 continue;
2146 case DecRefMsg:
2147 os << "In GC mode the 'release' message has no effect.";
2148 continue;
2149 }
2150 }
Mike Stump1eb44332009-09-09 15:08:12 +00002151 } while (0);
2152
Ted Kremenekc887d132009-04-29 18:50:19 +00002153 if (os.str().empty())
2154 return 0; // We have nothing to say!
Ted Kremenek2033a952009-05-13 07:12:33 +00002155
Jordy Rosef53e8c72011-08-23 19:43:16 +00002156 const Stmt *S = cast<StmtPoint>(N->getLocation()).getStmt();
Anna Zaks220ac8c2011-09-15 01:08:34 +00002157 PathDiagnosticLocation Pos(S, BRC.getSourceManager(),
2158 N->getLocationContext());
Ted Kremenek9c378f72011-08-12 23:37:29 +00002159 PathDiagnosticPiece *P = new PathDiagnosticEventPiece(Pos, os.str());
Mike Stump1eb44332009-09-09 15:08:12 +00002160
Ted Kremenekc887d132009-04-29 18:50:19 +00002161 // Add the range by scanning the children of the statement for any bindings
2162 // to Sym.
Mike Stump1eb44332009-09-09 15:08:12 +00002163 for (Stmt::const_child_iterator I = S->child_begin(), E = S->child_end();
Ted Kremenek5f85e172009-07-22 22:35:28 +00002164 I!=E; ++I)
Ted Kremenek9c378f72011-08-12 23:37:29 +00002165 if (const Expr *Exp = dyn_cast_or_null<Expr>(*I))
Ted Kremenek5eca4822012-01-06 22:09:28 +00002166 if (CurrSt->getSValAsScalarOrLoc(Exp, LCtx).getAsLocSymbol() == Sym) {
Ted Kremenekc887d132009-04-29 18:50:19 +00002167 P->addRange(Exp->getSourceRange());
2168 break;
2169 }
Mike Stump1eb44332009-09-09 15:08:12 +00002170
Ted Kremenekc887d132009-04-29 18:50:19 +00002171 return P;
2172}
2173
Anna Zakse7e01682012-02-28 22:39:22 +00002174// Find the first node in the current function context that referred to the
2175// tracked symbol and the memory location that value was stored to. Note, the
2176// value is only reported if the allocation occurred in the same function as
2177// the leak.
Zhongxing Xuc5619d92009-08-06 01:32:16 +00002178static std::pair<const ExplodedNode*,const MemRegion*>
Ted Kremenek18c66fd2011-08-15 22:09:50 +00002179GetAllocationSite(ProgramStateManager& StateMgr, const ExplodedNode *N,
Ted Kremenekc887d132009-04-29 18:50:19 +00002180 SymbolRef Sym) {
Ted Kremenek9c378f72011-08-12 23:37:29 +00002181 const ExplodedNode *Last = N;
Mike Stump1eb44332009-09-09 15:08:12 +00002182 const MemRegion* FirstBinding = 0;
Anna Zakse7e01682012-02-28 22:39:22 +00002183 const LocationContext *LeakContext = N->getLocationContext();
Mike Stump1eb44332009-09-09 15:08:12 +00002184
Ted Kremenekc887d132009-04-29 18:50:19 +00002185 while (N) {
Ted Kremenek8bef8232012-01-26 21:29:00 +00002186 ProgramStateRef St = N->getState();
Mike Stump1eb44332009-09-09 15:08:12 +00002187
Anna Zaks8d6b43c2012-08-14 00:36:15 +00002188 if (!getRefBinding(St, Sym))
Ted Kremenekc887d132009-04-29 18:50:19 +00002189 break;
Mike Stump1eb44332009-09-09 15:08:12 +00002190
Anna Zaks27b867e2012-03-21 19:45:01 +00002191 StoreManager::FindUniqueBinding FB(Sym);
Mike Stump1eb44332009-09-09 15:08:12 +00002192 StateMgr.iterBindings(St, FB);
2193 if (FB) FirstBinding = FB.getRegion();
2194
Anna Zakse7e01682012-02-28 22:39:22 +00002195 // Allocation node, is the last node in the current context in which the
2196 // symbol was tracked.
2197 if (N->getLocationContext() == LeakContext)
2198 Last = N;
2199
Mike Stump1eb44332009-09-09 15:08:12 +00002200 N = N->pred_empty() ? NULL : *(N->pred_begin());
Ted Kremenekc887d132009-04-29 18:50:19 +00002201 }
Mike Stump1eb44332009-09-09 15:08:12 +00002202
Anna Zakse7e01682012-02-28 22:39:22 +00002203 // If allocation happened in a function different from the leak node context,
2204 // do not report the binding.
2205 if (N->getLocationContext() != LeakContext) {
2206 FirstBinding = 0;
2207 }
2208
Ted Kremenekc887d132009-04-29 18:50:19 +00002209 return std::make_pair(Last, FirstBinding);
2210}
2211
2212PathDiagnosticPiece*
Anna Zaks23f395e2011-08-20 01:27:22 +00002213CFRefReportVisitor::getEndPath(BugReporterContext &BRC,
2214 const ExplodedNode *EndN,
2215 BugReport &BR) {
Ted Kremenek76aadc32012-03-09 01:13:14 +00002216 BR.markInteresting(Sym);
Anna Zaks23f395e2011-08-20 01:27:22 +00002217 return BugReporterVisitor::getDefaultEndPath(BRC, EndN, BR);
Ted Kremenekc887d132009-04-29 18:50:19 +00002218}
2219
2220PathDiagnosticPiece*
Anna Zaks23f395e2011-08-20 01:27:22 +00002221CFRefLeakReportVisitor::getEndPath(BugReporterContext &BRC,
2222 const ExplodedNode *EndN,
2223 BugReport &BR) {
Mike Stump1eb44332009-09-09 15:08:12 +00002224
Ted Kremenek8966bc12009-05-06 21:39:49 +00002225 // Tell the BugReporterContext to report cases when the tracked symbol is
Ted Kremenekc887d132009-04-29 18:50:19 +00002226 // assigned to different variables, etc.
Ted Kremenek76aadc32012-03-09 01:13:14 +00002227 BR.markInteresting(Sym);
Mike Stump1eb44332009-09-09 15:08:12 +00002228
Ted Kremenekc887d132009-04-29 18:50:19 +00002229 // We are reporting a leak. Walk up the graph to get to the first node where
2230 // the symbol appeared, and also get the first VarDecl that tracked object
2231 // is stored to.
Ted Kremenek9c378f72011-08-12 23:37:29 +00002232 const ExplodedNode *AllocNode = 0;
Ted Kremenekc887d132009-04-29 18:50:19 +00002233 const MemRegion* FirstBinding = 0;
Mike Stump1eb44332009-09-09 15:08:12 +00002234
Ted Kremenekc887d132009-04-29 18:50:19 +00002235 llvm::tie(AllocNode, FirstBinding) =
Ted Kremenekf04dced2009-05-08 23:32:51 +00002236 GetAllocationSite(BRC.getStateManager(), EndN, Sym);
Mike Stump1eb44332009-09-09 15:08:12 +00002237
Anna Zaks4fdf97b2011-09-15 18:56:07 +00002238 SourceManager& SM = BRC.getSourceManager();
Mike Stump1eb44332009-09-09 15:08:12 +00002239
Ted Kremenekc887d132009-04-29 18:50:19 +00002240 // Compute an actual location for the leak. Sometimes a leak doesn't
2241 // occur at an actual statement (e.g., transition between blocks; end
2242 // of function) so we need to walk the graph and compute a real location.
Ted Kremenek9c378f72011-08-12 23:37:29 +00002243 const ExplodedNode *LeakN = EndN;
Anna Zaks4fdf97b2011-09-15 18:56:07 +00002244 PathDiagnosticLocation L = PathDiagnosticLocation::createEndOfPath(LeakN, SM);
Mike Stump1eb44332009-09-09 15:08:12 +00002245
Ted Kremenekc887d132009-04-29 18:50:19 +00002246 std::string sbuf;
2247 llvm::raw_string_ostream os(sbuf);
Mike Stump1eb44332009-09-09 15:08:12 +00002248
Ted Kremenekf1365462011-05-26 18:45:44 +00002249 os << "Object leaked: ";
Mike Stump1eb44332009-09-09 15:08:12 +00002250
Ted Kremenekf1365462011-05-26 18:45:44 +00002251 if (FirstBinding) {
2252 os << "object allocated and stored into '"
2253 << FirstBinding->getString() << '\'';
2254 }
2255 else
2256 os << "allocated object";
Mike Stump1eb44332009-09-09 15:08:12 +00002257
Ted Kremenekc887d132009-04-29 18:50:19 +00002258 // Get the retain count.
Anna Zaks8d6b43c2012-08-14 00:36:15 +00002259 const RefVal* RV = getRefBinding(EndN->getState(), Sym);
Mike Stump1eb44332009-09-09 15:08:12 +00002260
Ted Kremenekc887d132009-04-29 18:50:19 +00002261 if (RV->getKind() == RefVal::ErrorLeakReturned) {
2262 // FIXME: Per comments in rdar://6320065, "create" only applies to CF
Jordy Rose5b5402b2011-07-15 22:17:54 +00002263 // objects. Only "copy", "alloc", "retain" and "new" transfer ownership
Ted Kremenekc887d132009-04-29 18:50:19 +00002264 // to the caller for NS objects.
Ted Kremenekd368d712011-05-25 06:19:45 +00002265 const Decl *D = &EndN->getCodeDecl();
2266 if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(D)) {
2267 os << " is returned from a method whose name ('"
2268 << MD->getSelector().getAsString()
2269 << "') does not start with 'copy', 'mutableCopy', 'alloc' or 'new'."
Jordy Rose5b5402b2011-07-15 22:17:54 +00002270 " This violates the naming convention rules"
Ted Kremenekf1365462011-05-26 18:45:44 +00002271 " given in the Memory Management Guide for Cocoa";
Ted Kremenekd368d712011-05-25 06:19:45 +00002272 }
2273 else {
2274 const FunctionDecl *FD = cast<FunctionDecl>(D);
Ted Kremenekb7dcddf2011-12-22 06:35:52 +00002275 os << " is returned from a function whose name ('"
Benjamin Kramera59d20b2012-02-07 11:57:57 +00002276 << *FD
Ted Kremenekd368d712011-05-25 06:19:45 +00002277 << "') does not contain 'Copy' or 'Create'. This violates the naming"
Ted Kremenekb7dcddf2011-12-22 06:35:52 +00002278 " convention rules given in the Memory Management Guide for Core"
Ted Kremenekf1365462011-05-26 18:45:44 +00002279 " Foundation";
Ted Kremenekd368d712011-05-25 06:19:45 +00002280 }
Ted Kremenekc887d132009-04-29 18:50:19 +00002281 }
Ted Kremeneke8720ce2009-05-10 06:25:57 +00002282 else if (RV->getKind() == RefVal::ErrorGCLeakReturned) {
Ted Kremenek9c378f72011-08-12 23:37:29 +00002283 ObjCMethodDecl &MD = cast<ObjCMethodDecl>(EndN->getCodeDecl());
Ted Kremeneke8720ce2009-05-10 06:25:57 +00002284 os << " and returned from method '" << MD.getSelector().getAsString()
Ted Kremenek82f2be52009-05-10 16:52:15 +00002285 << "' is potentially leaked when using garbage collection. Callers "
2286 "of this method do not expect a returned object with a +1 retain "
2287 "count since they expect the object to be managed by the garbage "
2288 "collector";
Ted Kremeneke8720ce2009-05-10 06:25:57 +00002289 }
Ted Kremenekc887d132009-04-29 18:50:19 +00002290 else
Ted Kremenekabf517c2010-10-15 22:50:23 +00002291 os << " is not referenced later in this execution path and has a retain "
Ted Kremenekf1365462011-05-26 18:45:44 +00002292 "count of +" << RV->getCount();
Mike Stump1eb44332009-09-09 15:08:12 +00002293
Ted Kremenekc887d132009-04-29 18:50:19 +00002294 return new PathDiagnosticEventPiece(L, os.str());
2295}
2296
Jordy Rose20589562011-08-24 22:39:09 +00002297CFRefLeakReport::CFRefLeakReport(CFRefBug &D, const LangOptions &LOpts,
2298 bool GCEnabled, const SummaryLogTy &Log,
2299 ExplodedNode *n, SymbolRef sym,
Anna Zaks6a93bd52011-10-25 19:57:11 +00002300 CheckerContext &Ctx)
Jordy Rose20589562011-08-24 22:39:09 +00002301: CFRefReport(D, LOpts, GCEnabled, Log, n, sym, false) {
Mike Stump1eb44332009-09-09 15:08:12 +00002302
Chris Lattnerfc8f0e12011-04-15 05:22:18 +00002303 // Most bug reports are cached at the location where they occurred.
Ted Kremenekc887d132009-04-29 18:50:19 +00002304 // With leaks, we want to unique them by the location where they were
2305 // allocated, and only report a single path. To do this, we need to find
2306 // the allocation site of a piece of tracked memory, which we do via a
2307 // call to GetAllocationSite. This will walk the ExplodedGraph backwards.
2308 // Note that this is *not* the trimmed graph; we are guaranteed, however,
2309 // that all ancestor nodes that represent the allocation site have the
2310 // same SourceLocation.
Ted Kremenek9c378f72011-08-12 23:37:29 +00002311 const ExplodedNode *AllocNode = 0;
Mike Stump1eb44332009-09-09 15:08:12 +00002312
Anna Zaks6a93bd52011-10-25 19:57:11 +00002313 const SourceManager& SMgr = Ctx.getSourceManager();
Anna Zaks590dd8e2011-09-20 21:38:35 +00002314
Ted Kremenekc887d132009-04-29 18:50:19 +00002315 llvm::tie(AllocNode, AllocBinding) = // Set AllocBinding.
Anna Zaks6a93bd52011-10-25 19:57:11 +00002316 GetAllocationSite(Ctx.getStateManager(), getErrorNode(), sym);
Mike Stump1eb44332009-09-09 15:08:12 +00002317
Ted Kremenekc887d132009-04-29 18:50:19 +00002318 // Get the SourceLocation for the allocation site.
Jordan Rose852aa0d2012-07-10 22:07:52 +00002319 // FIXME: This will crash the analyzer if an allocation comes from an
2320 // implicit call. (Currently there are no such allocations in Cocoa, though.)
2321 const Stmt *AllocStmt;
Ted Kremenekc887d132009-04-29 18:50:19 +00002322 ProgramPoint P = AllocNode->getLocation();
Jordan Rose852aa0d2012-07-10 22:07:52 +00002323 if (CallExitEnd *Exit = dyn_cast<CallExitEnd>(&P))
2324 AllocStmt = Exit->getCalleeContext()->getCallSite();
2325 else
2326 AllocStmt = cast<PostStmt>(P).getStmt();
2327 assert(AllocStmt && "All allocations must come from explicit calls");
Anna Zaks590dd8e2011-09-20 21:38:35 +00002328 Location = PathDiagnosticLocation::createBegin(AllocStmt, SMgr,
2329 n->getLocationContext());
Ted Kremenekc887d132009-04-29 18:50:19 +00002330 // Fill in the description of the bug.
2331 Description.clear();
2332 llvm::raw_string_ostream os(Description);
Ted Kremenekdd924e22009-05-02 19:05:19 +00002333 os << "Potential leak ";
Jordy Rose20589562011-08-24 22:39:09 +00002334 if (GCEnabled)
Ted Kremenekdd924e22009-05-02 19:05:19 +00002335 os << "(when using garbage collection) ";
Anna Zaks212000e2012-02-28 21:49:08 +00002336 os << "of an object";
Mike Stump1eb44332009-09-09 15:08:12 +00002337
Ted Kremenekc887d132009-04-29 18:50:19 +00002338 // FIXME: AllocBinding doesn't get populated for RegionStore yet.
2339 if (AllocBinding)
Anna Zaks212000e2012-02-28 21:49:08 +00002340 os << " stored into '" << AllocBinding->getString() << '\'';
Anna Zaksdc757b02011-08-19 23:21:56 +00002341
Jordy Rose20589562011-08-24 22:39:09 +00002342 addVisitor(new CFRefLeakReportVisitor(sym, GCEnabled, Log));
Ted Kremenekc887d132009-04-29 18:50:19 +00002343}
2344
2345//===----------------------------------------------------------------------===//
2346// Main checker logic.
2347//===----------------------------------------------------------------------===//
2348
Ted Kremenekd593eb92009-11-25 22:17:44 +00002349namespace {
Jordy Rose910c4052011-09-02 06:44:22 +00002350class RetainCountChecker
Jordy Rose9c083b72011-08-24 18:56:32 +00002351 : public Checker< check::Bind,
Jordy Rose38f17d62011-08-23 19:01:07 +00002352 check::DeadSymbols,
Jordy Rose9c083b72011-08-24 18:56:32 +00002353 check::EndAnalysis,
Jordy Rose38f17d62011-08-23 19:01:07 +00002354 check::EndPath,
Jordy Rose67044292011-08-17 21:27:39 +00002355 check::PostStmt<BlockExpr>,
John McCallf85e1932011-06-15 23:02:42 +00002356 check::PostStmt<CastExpr>,
Ted Kremenek1a45a5f2012-03-06 20:06:12 +00002357 check::PostStmt<ObjCArrayLiteral>,
2358 check::PostStmt<ObjCDictionaryLiteral>,
Jordy Rose70fdbc32012-05-12 05:10:43 +00002359 check::PostStmt<ObjCBoxedExpr>,
Jordan Rosefe6a0112012-07-02 19:28:21 +00002360 check::PostCall,
Jordy Rosef53e8c72011-08-23 19:43:16 +00002361 check::PreStmt<ReturnStmt>,
Jordy Rose67044292011-08-17 21:27:39 +00002362 check::RegionChanges,
Jordy Rose76c506f2011-08-21 21:58:18 +00002363 eval::Assume,
2364 eval::Call > {
Dylan Noblesmith6f42b622012-02-05 02:12:40 +00002365 mutable OwningPtr<CFRefBug> useAfterRelease, releaseNotOwned;
2366 mutable OwningPtr<CFRefBug> deallocGC, deallocNotOwned;
2367 mutable OwningPtr<CFRefBug> overAutorelease, returnNotOwnedForOwned;
2368 mutable OwningPtr<CFRefBug> leakWithinFunction, leakAtReturn;
2369 mutable OwningPtr<CFRefBug> leakWithinFunctionGC, leakAtReturnGC;
Jordy Rose38f17d62011-08-23 19:01:07 +00002370
2371 typedef llvm::DenseMap<SymbolRef, const SimpleProgramPointTag *> SymbolTagMap;
2372
2373 // This map is only used to ensure proper deletion of any allocated tags.
2374 mutable SymbolTagMap DeadSymbolTags;
2375
Dylan Noblesmith6f42b622012-02-05 02:12:40 +00002376 mutable OwningPtr<RetainSummaryManager> Summaries;
2377 mutable OwningPtr<RetainSummaryManager> SummariesGC;
Jordy Rose9c083b72011-08-24 18:56:32 +00002378 mutable SummaryLogTy SummaryLog;
2379 mutable bool ShouldResetSummaryLog;
2380
Jordy Rose2f9a66d2011-08-20 21:17:59 +00002381public:
Jordy Rose910c4052011-09-02 06:44:22 +00002382 RetainCountChecker() : ShouldResetSummaryLog(false) {}
Jordy Rose38f17d62011-08-23 19:01:07 +00002383
Jordy Rose910c4052011-09-02 06:44:22 +00002384 virtual ~RetainCountChecker() {
Jordy Rose38f17d62011-08-23 19:01:07 +00002385 DeleteContainerSeconds(DeadSymbolTags);
2386 }
2387
Jordy Rose9c083b72011-08-24 18:56:32 +00002388 void checkEndAnalysis(ExplodedGraph &G, BugReporter &BR,
2389 ExprEngine &Eng) const {
2390 // FIXME: This is a hack to make sure the summary log gets cleared between
2391 // analyses of different code bodies.
2392 //
2393 // Why is this necessary? Because a checker's lifetime is tied to a
2394 // translation unit, but an ExplodedGraph's lifetime is just a code body.
2395 // Once in a blue moon, a new ExplodedNode will have the same address as an
2396 // old one with an associated summary, and the bug report visitor gets very
2397 // confused. (To make things worse, the summary lifetime is currently also
2398 // tied to a code body, so we get a crash instead of incorrect results.)
Jordy Rose1ab51c72011-08-24 09:27:24 +00002399 //
2400 // Why is this a bad solution? Because if the lifetime of the ExplodedGraph
2401 // changes, things will start going wrong again. Really the lifetime of this
2402 // log needs to be tied to either the specific nodes in it or the entire
2403 // ExplodedGraph, not to a specific part of the code being analyzed.
2404 //
Jordy Rose9c083b72011-08-24 18:56:32 +00002405 // (Also, having stateful local data means that the same checker can't be
2406 // used from multiple threads, but a lot of checkers have incorrect
2407 // assumptions about that anyway. So that wasn't a priority at the time of
2408 // this fix.)
Jordy Rose1ab51c72011-08-24 09:27:24 +00002409 //
Jordy Rose9c083b72011-08-24 18:56:32 +00002410 // This happens at the end of analysis, but bug reports are emitted /after/
2411 // this point. So we can't just clear the summary log now. Instead, we mark
2412 // that the next time we access the summary log, it should be cleared.
2413
2414 // If we never reset the summary log during /this/ code body analysis,
2415 // there were no new summaries. There might still have been summaries from
2416 // the /last/ analysis, so clear them out to make sure the bug report
2417 // visitors don't get confused.
2418 if (ShouldResetSummaryLog)
2419 SummaryLog.clear();
2420
2421 ShouldResetSummaryLog = !SummaryLog.empty();
Jordy Rose1ab51c72011-08-24 09:27:24 +00002422 }
2423
Jordy Rose17a38e22011-09-02 05:55:19 +00002424 CFRefBug *getLeakWithinFunctionBug(const LangOptions &LOpts,
2425 bool GCEnabled) const {
2426 if (GCEnabled) {
Jordy Rosedb92bb62011-08-25 01:14:38 +00002427 if (!leakWithinFunctionGC)
Benjamin Kramerfacde172012-06-06 17:32:50 +00002428 leakWithinFunctionGC.reset(new Leak("Leak of object when using "
2429 "garbage collection"));
Jordy Rose17a38e22011-09-02 05:55:19 +00002430 return leakWithinFunctionGC.get();
Jordy Rosedb92bb62011-08-25 01:14:38 +00002431 } else {
2432 if (!leakWithinFunction) {
Douglas Gregore289d812011-09-13 17:21:33 +00002433 if (LOpts.getGC() == LangOptions::HybridGC) {
Benjamin Kramerfacde172012-06-06 17:32:50 +00002434 leakWithinFunction.reset(new Leak("Leak of object when not using "
2435 "garbage collection (GC) in "
2436 "dual GC/non-GC code"));
Jordy Rosedb92bb62011-08-25 01:14:38 +00002437 } else {
Benjamin Kramerfacde172012-06-06 17:32:50 +00002438 leakWithinFunction.reset(new Leak("Leak"));
Jordy Rosedb92bb62011-08-25 01:14:38 +00002439 }
2440 }
Jordy Rose17a38e22011-09-02 05:55:19 +00002441 return leakWithinFunction.get();
Jordy Rosedb92bb62011-08-25 01:14:38 +00002442 }
2443 }
2444
Jordy Rose17a38e22011-09-02 05:55:19 +00002445 CFRefBug *getLeakAtReturnBug(const LangOptions &LOpts, bool GCEnabled) const {
2446 if (GCEnabled) {
Jordy Rosedb92bb62011-08-25 01:14:38 +00002447 if (!leakAtReturnGC)
Benjamin Kramerfacde172012-06-06 17:32:50 +00002448 leakAtReturnGC.reset(new Leak("Leak of returned object when using "
2449 "garbage collection"));
Jordy Rose17a38e22011-09-02 05:55:19 +00002450 return leakAtReturnGC.get();
Jordy Rosedb92bb62011-08-25 01:14:38 +00002451 } else {
2452 if (!leakAtReturn) {
Douglas Gregore289d812011-09-13 17:21:33 +00002453 if (LOpts.getGC() == LangOptions::HybridGC) {
Benjamin Kramerfacde172012-06-06 17:32:50 +00002454 leakAtReturn.reset(new Leak("Leak of returned object when not using "
2455 "garbage collection (GC) in dual "
2456 "GC/non-GC code"));
Jordy Rosedb92bb62011-08-25 01:14:38 +00002457 } else {
Benjamin Kramerfacde172012-06-06 17:32:50 +00002458 leakAtReturn.reset(new Leak("Leak of returned object"));
Jordy Rosedb92bb62011-08-25 01:14:38 +00002459 }
2460 }
Jordy Rose17a38e22011-09-02 05:55:19 +00002461 return leakAtReturn.get();
Jordy Rosedb92bb62011-08-25 01:14:38 +00002462 }
2463 }
2464
Jordy Rose17a38e22011-09-02 05:55:19 +00002465 RetainSummaryManager &getSummaryManager(ASTContext &Ctx,
2466 bool GCEnabled) const {
2467 // FIXME: We don't support ARC being turned on and off during one analysis.
2468 // (nor, for that matter, do we support changing ASTContexts)
David Blaikie4e4d0842012-03-11 07:00:24 +00002469 bool ARCEnabled = (bool)Ctx.getLangOpts().ObjCAutoRefCount;
Jordy Rose17a38e22011-09-02 05:55:19 +00002470 if (GCEnabled) {
2471 if (!SummariesGC)
Jordy Roseb6cfc092011-08-25 00:10:37 +00002472 SummariesGC.reset(new RetainSummaryManager(Ctx, true, ARCEnabled));
Jordy Rose17a38e22011-09-02 05:55:19 +00002473 else
2474 assert(SummariesGC->isARCEnabled() == ARCEnabled);
Jordy Roseb6cfc092011-08-25 00:10:37 +00002475 return *SummariesGC;
2476 } else {
Jordy Rose17a38e22011-09-02 05:55:19 +00002477 if (!Summaries)
Jordy Roseb6cfc092011-08-25 00:10:37 +00002478 Summaries.reset(new RetainSummaryManager(Ctx, false, ARCEnabled));
Jordy Rose17a38e22011-09-02 05:55:19 +00002479 else
2480 assert(Summaries->isARCEnabled() == ARCEnabled);
Jordy Roseb6cfc092011-08-25 00:10:37 +00002481 return *Summaries;
2482 }
2483 }
2484
Jordy Rose17a38e22011-09-02 05:55:19 +00002485 RetainSummaryManager &getSummaryManager(CheckerContext &C) const {
2486 return getSummaryManager(C.getASTContext(), C.isObjCGCEnabled());
2487 }
2488
Ted Kremenek8bef8232012-01-26 21:29:00 +00002489 void printState(raw_ostream &Out, ProgramStateRef State,
Jordy Rosedbd658e2011-08-28 19:11:56 +00002490 const char *NL, const char *Sep) const;
2491
Anna Zaks390909c2011-10-06 00:43:15 +00002492 void checkBind(SVal loc, SVal val, const Stmt *S, CheckerContext &C) const;
Jordy Roseab027fd2011-08-20 21:16:58 +00002493 void checkPostStmt(const BlockExpr *BE, CheckerContext &C) const;
2494 void checkPostStmt(const CastExpr *CE, CheckerContext &C) const;
John McCallf85e1932011-06-15 23:02:42 +00002495
Ted Kremenek1a45a5f2012-03-06 20:06:12 +00002496 void checkPostStmt(const ObjCArrayLiteral *AL, CheckerContext &C) const;
2497 void checkPostStmt(const ObjCDictionaryLiteral *DL, CheckerContext &C) const;
Jordy Rose70fdbc32012-05-12 05:10:43 +00002498 void checkPostStmt(const ObjCBoxedExpr *BE, CheckerContext &C) const;
2499
Jordan Rosefe6a0112012-07-02 19:28:21 +00002500 void checkPostCall(const CallEvent &Call, CheckerContext &C) const;
Ted Kremenek1a45a5f2012-03-06 20:06:12 +00002501
Jordan Rose4531b7d2012-07-02 19:27:43 +00002502 void checkSummary(const RetainSummary &Summ, const CallEvent &Call,
Jordy Rosee38dd952011-08-28 05:16:28 +00002503 CheckerContext &C) const;
Jordy Rose294396b2011-08-22 23:48:23 +00002504
Jordy Rose76c506f2011-08-21 21:58:18 +00002505 bool evalCall(const CallExpr *CE, CheckerContext &C) const;
2506
Ted Kremenek8bef8232012-01-26 21:29:00 +00002507 ProgramStateRef evalAssume(ProgramStateRef state, SVal Cond,
Jordy Roseab027fd2011-08-20 21:16:58 +00002508 bool Assumption) const;
Jordy Rose67044292011-08-17 21:27:39 +00002509
Ted Kremenek8bef8232012-01-26 21:29:00 +00002510 ProgramStateRef
2511 checkRegionChanges(ProgramStateRef state,
Jordy Rose537716a2011-08-27 22:51:26 +00002512 const StoreManager::InvalidatedSymbols *invalidated,
2513 ArrayRef<const MemRegion *> ExplicitRegions,
Anna Zaks66c40402012-02-14 21:55:24 +00002514 ArrayRef<const MemRegion *> Regions,
Jordan Rose740d4902012-07-02 19:27:35 +00002515 const CallEvent *Call) const;
Jordy Roseab027fd2011-08-20 21:16:58 +00002516
Ted Kremenek8bef8232012-01-26 21:29:00 +00002517 bool wantsRegionChangeUpdate(ProgramStateRef state) const {
Jordy Rose2f9a66d2011-08-20 21:17:59 +00002518 return true;
Jordy Roseab027fd2011-08-20 21:16:58 +00002519 }
Jordy Rose294396b2011-08-22 23:48:23 +00002520
Jordy Rosef53e8c72011-08-23 19:43:16 +00002521 void checkPreStmt(const ReturnStmt *S, CheckerContext &C) const;
2522 void checkReturnWithRetEffect(const ReturnStmt *S, CheckerContext &C,
2523 ExplodedNode *Pred, RetEffect RE, RefVal X,
Ted Kremenek8bef8232012-01-26 21:29:00 +00002524 SymbolRef Sym, ProgramStateRef state) const;
Jordy Rosef53e8c72011-08-23 19:43:16 +00002525
Jordy Rose38f17d62011-08-23 19:01:07 +00002526 void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const;
Anna Zaksaf498a22011-10-25 19:56:48 +00002527 void checkEndPath(CheckerContext &C) const;
Jordy Rose38f17d62011-08-23 19:01:07 +00002528
Ted Kremenek8bef8232012-01-26 21:29:00 +00002529 ProgramStateRef updateSymbol(ProgramStateRef state, SymbolRef sym,
Jordy Rose17a38e22011-09-02 05:55:19 +00002530 RefVal V, ArgEffect E, RefVal::Kind &hasErr,
2531 CheckerContext &C) const;
Jordy Rosee0a5d322011-08-23 20:27:16 +00002532
Ted Kremenek8bef8232012-01-26 21:29:00 +00002533 void processNonLeakError(ProgramStateRef St, SourceRange ErrorRange,
Jordy Rose294396b2011-08-22 23:48:23 +00002534 RefVal::Kind ErrorKind, SymbolRef Sym,
2535 CheckerContext &C) const;
Ted Kremenek1a45a5f2012-03-06 20:06:12 +00002536
2537 void processObjCLiterals(CheckerContext &C, const Expr *Ex) const;
Jordy Rose294396b2011-08-22 23:48:23 +00002538
Jordy Rose38f17d62011-08-23 19:01:07 +00002539 const ProgramPointTag *getDeadSymbolTag(SymbolRef sym) const;
2540
Ted Kremenek8bef8232012-01-26 21:29:00 +00002541 ProgramStateRef handleSymbolDeath(ProgramStateRef state,
Anna Zaks8d6b43c2012-08-14 00:36:15 +00002542 SymbolRef sid, RefVal V,
2543 SmallVectorImpl<SymbolRef> &Leaked) const;
Jordy Rose38f17d62011-08-23 19:01:07 +00002544
Ted Kremenek8bef8232012-01-26 21:29:00 +00002545 std::pair<ExplodedNode *, ProgramStateRef >
2546 handleAutoreleaseCounts(ProgramStateRef state,
Jordy Rose8d228632011-08-23 20:07:14 +00002547 GenericNodeBuilderRefCount Bd, ExplodedNode *Pred,
Anna Zaks6a93bd52011-10-25 19:57:11 +00002548 CheckerContext &Ctx, SymbolRef Sym, RefVal V) const;
Jordy Rose8d228632011-08-23 20:07:14 +00002549
Ted Kremenek8bef8232012-01-26 21:29:00 +00002550 ExplodedNode *processLeaks(ProgramStateRef state,
Jordy Rose38f17d62011-08-23 19:01:07 +00002551 SmallVectorImpl<SymbolRef> &Leaked,
2552 GenericNodeBuilderRefCount &Builder,
Anna Zaks6a93bd52011-10-25 19:57:11 +00002553 CheckerContext &Ctx,
Jordy Rose38f17d62011-08-23 19:01:07 +00002554 ExplodedNode *Pred = 0) const;
Ted Kremenekd593eb92009-11-25 22:17:44 +00002555};
2556} // end anonymous namespace
2557
Jordy Rose67044292011-08-17 21:27:39 +00002558namespace {
2559class StopTrackingCallback : public SymbolVisitor {
Ted Kremenek8bef8232012-01-26 21:29:00 +00002560 ProgramStateRef state;
Jordy Rose67044292011-08-17 21:27:39 +00002561public:
Ted Kremenek8bef8232012-01-26 21:29:00 +00002562 StopTrackingCallback(ProgramStateRef st) : state(st) {}
2563 ProgramStateRef getState() const { return state; }
Jordy Rose67044292011-08-17 21:27:39 +00002564
2565 bool VisitSymbol(SymbolRef sym) {
2566 state = state->remove<RefBindings>(sym);
2567 return true;
2568 }
2569};
2570} // end anonymous namespace
2571
Jordy Rose910c4052011-09-02 06:44:22 +00002572//===----------------------------------------------------------------------===//
2573// Handle statements that may have an effect on refcounts.
2574//===----------------------------------------------------------------------===//
Jordy Rose67044292011-08-17 21:27:39 +00002575
Jordy Rose910c4052011-09-02 06:44:22 +00002576void RetainCountChecker::checkPostStmt(const BlockExpr *BE,
2577 CheckerContext &C) const {
Jordy Rose67044292011-08-17 21:27:39 +00002578
Jordy Rose910c4052011-09-02 06:44:22 +00002579 // Scan the BlockDecRefExprs for any object the retain count checker
Ted Kremenekdcee3ce2010-07-01 20:16:50 +00002580 // may be tracking.
John McCall469a1eb2011-02-02 13:00:07 +00002581 if (!BE->getBlockDecl()->hasCaptures())
Ted Kremenek38cc6bc2009-11-26 02:38:19 +00002582 return;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +00002583
Ted Kremenek8bef8232012-01-26 21:29:00 +00002584 ProgramStateRef state = C.getState();
Ted Kremenek38cc6bc2009-11-26 02:38:19 +00002585 const BlockDataRegion *R =
Ted Kremenek5eca4822012-01-06 22:09:28 +00002586 cast<BlockDataRegion>(state->getSVal(BE,
2587 C.getLocationContext()).getAsRegion());
Ted Kremenekdcee3ce2010-07-01 20:16:50 +00002588
Ted Kremenek38cc6bc2009-11-26 02:38:19 +00002589 BlockDataRegion::referenced_vars_iterator I = R->referenced_vars_begin(),
2590 E = R->referenced_vars_end();
Ted Kremenekdcee3ce2010-07-01 20:16:50 +00002591
Ted Kremenek38cc6bc2009-11-26 02:38:19 +00002592 if (I == E)
2593 return;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +00002594
Ted Kremenek67d12872009-12-07 22:05:27 +00002595 // FIXME: For now we invalidate the tracking of all symbols passed to blocks
2596 // via captured variables, even though captured variables result in a copy
2597 // and in implicit increment/decrement of a retain count.
Chris Lattner5f9e2722011-07-23 10:55:15 +00002598 SmallVector<const MemRegion*, 10> Regions;
Anna Zaks39ac1872011-10-26 21:06:44 +00002599 const LocationContext *LC = C.getLocationContext();
Ted Kremenekc8413fd2010-12-02 07:49:45 +00002600 MemRegionManager &MemMgr = C.getSValBuilder().getRegionManager();
Ted Kremenekdcee3ce2010-07-01 20:16:50 +00002601
Ted Kremenek67d12872009-12-07 22:05:27 +00002602 for ( ; I != E; ++I) {
2603 const VarRegion *VR = *I;
2604 if (VR->getSuperRegion() == R) {
2605 VR = MemMgr.getVarRegion(VR->getDecl(), LC);
2606 }
2607 Regions.push_back(VR);
2608 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +00002609
Ted Kremenek67d12872009-12-07 22:05:27 +00002610 state =
2611 state->scanReachableSymbols<StopTrackingCallback>(Regions.data(),
2612 Regions.data() + Regions.size()).getState();
Anna Zaks0bd6b112011-10-26 21:06:34 +00002613 C.addTransition(state);
Ted Kremenek38cc6bc2009-11-26 02:38:19 +00002614}
2615
Jordy Rose910c4052011-09-02 06:44:22 +00002616void RetainCountChecker::checkPostStmt(const CastExpr *CE,
2617 CheckerContext &C) const {
John McCallf85e1932011-06-15 23:02:42 +00002618 const ObjCBridgedCastExpr *BE = dyn_cast<ObjCBridgedCastExpr>(CE);
2619 if (!BE)
2620 return;
2621
John McCall71c482c2011-06-17 06:50:50 +00002622 ArgEffect AE = IncRef;
John McCallf85e1932011-06-15 23:02:42 +00002623
2624 switch (BE->getBridgeKind()) {
2625 case clang::OBC_Bridge:
2626 // Do nothing.
2627 return;
2628 case clang::OBC_BridgeRetained:
2629 AE = IncRef;
2630 break;
2631 case clang::OBC_BridgeTransfer:
2632 AE = DecRefBridgedTransfered;
2633 break;
2634 }
2635
Ted Kremenek8bef8232012-01-26 21:29:00 +00002636 ProgramStateRef state = C.getState();
Ted Kremenek5eca4822012-01-06 22:09:28 +00002637 SymbolRef Sym = state->getSVal(CE, C.getLocationContext()).getAsLocSymbol();
John McCallf85e1932011-06-15 23:02:42 +00002638 if (!Sym)
2639 return;
Anna Zaks8d6b43c2012-08-14 00:36:15 +00002640 const RefVal* T = getRefBinding(state, Sym);
John McCallf85e1932011-06-15 23:02:42 +00002641 if (!T)
2642 return;
2643
John McCallf85e1932011-06-15 23:02:42 +00002644 RefVal::Kind hasErr = (RefVal::Kind) 0;
Jordy Rose17a38e22011-09-02 05:55:19 +00002645 state = updateSymbol(state, Sym, *T, AE, hasErr, C);
John McCallf85e1932011-06-15 23:02:42 +00002646
2647 if (hasErr) {
Jordy Rosee0a5d322011-08-23 20:27:16 +00002648 // FIXME: If we get an error during a bridge cast, should we report it?
2649 // Should we assert that there is no error?
John McCallf85e1932011-06-15 23:02:42 +00002650 return;
2651 }
2652
Anna Zaks0bd6b112011-10-26 21:06:34 +00002653 C.addTransition(state);
John McCallf85e1932011-06-15 23:02:42 +00002654}
2655
Ted Kremenek1a45a5f2012-03-06 20:06:12 +00002656void RetainCountChecker::processObjCLiterals(CheckerContext &C,
2657 const Expr *Ex) const {
2658 ProgramStateRef state = C.getState();
2659 const ExplodedNode *pred = C.getPredecessor();
2660 for (Stmt::const_child_iterator it = Ex->child_begin(), et = Ex->child_end() ;
2661 it != et ; ++it) {
2662 const Stmt *child = *it;
2663 SVal V = state->getSVal(child, pred->getLocationContext());
2664 if (SymbolRef sym = V.getAsSymbol())
Anna Zaks8d6b43c2012-08-14 00:36:15 +00002665 if (const RefVal* T = getRefBinding(state, sym)) {
Ted Kremenek1a45a5f2012-03-06 20:06:12 +00002666 RefVal::Kind hasErr = (RefVal::Kind) 0;
2667 state = updateSymbol(state, sym, *T, MayEscape, hasErr, C);
2668 if (hasErr) {
2669 processNonLeakError(state, child->getSourceRange(), hasErr, sym, C);
2670 return;
2671 }
2672 }
2673 }
2674
2675 // Return the object as autoreleased.
2676 // RetEffect RE = RetEffect::MakeNotOwned(RetEffect::ObjC);
2677 if (SymbolRef sym =
2678 state->getSVal(Ex, pred->getLocationContext()).getAsSymbol()) {
2679 QualType ResultTy = Ex->getType();
Anna Zaks8d6b43c2012-08-14 00:36:15 +00002680 state = setRefBinding(state, sym,
2681 RefVal::makeNotOwned(RetEffect::ObjC, ResultTy));
Ted Kremenek1a45a5f2012-03-06 20:06:12 +00002682 }
2683
2684 C.addTransition(state);
2685}
2686
2687void RetainCountChecker::checkPostStmt(const ObjCArrayLiteral *AL,
2688 CheckerContext &C) const {
2689 // Apply the 'MayEscape' to all values.
2690 processObjCLiterals(C, AL);
2691}
2692
2693void RetainCountChecker::checkPostStmt(const ObjCDictionaryLiteral *DL,
2694 CheckerContext &C) const {
2695 // Apply the 'MayEscape' to all keys and values.
2696 processObjCLiterals(C, DL);
2697}
2698
Jordy Rose70fdbc32012-05-12 05:10:43 +00002699void RetainCountChecker::checkPostStmt(const ObjCBoxedExpr *Ex,
2700 CheckerContext &C) const {
2701 const ExplodedNode *Pred = C.getPredecessor();
2702 const LocationContext *LCtx = Pred->getLocationContext();
2703 ProgramStateRef State = Pred->getState();
2704
2705 if (SymbolRef Sym = State->getSVal(Ex, LCtx).getAsSymbol()) {
2706 QualType ResultTy = Ex->getType();
Anna Zaks8d6b43c2012-08-14 00:36:15 +00002707 State = setRefBinding(State, Sym,
2708 RefVal::makeNotOwned(RetEffect::ObjC, ResultTy));
Jordy Rose70fdbc32012-05-12 05:10:43 +00002709 }
2710
2711 C.addTransition(State);
2712}
2713
Jordan Rosefe6a0112012-07-02 19:28:21 +00002714void RetainCountChecker::checkPostCall(const CallEvent &Call,
2715 CheckerContext &C) const {
2716 if (C.wasInlined)
2717 return;
Jordy Roseb6cfc092011-08-25 00:10:37 +00002718
Jordan Rosefe6a0112012-07-02 19:28:21 +00002719 RetainSummaryManager &Summaries = getSummaryManager(C);
2720 const RetainSummary *Summ = Summaries.getSummary(Call, C.getState());
2721 checkSummary(*Summ, Call, C);
Jordy Rose294396b2011-08-22 23:48:23 +00002722}
2723
Jordy Rose910c4052011-09-02 06:44:22 +00002724/// GetReturnType - Used to get the return type of a message expression or
2725/// function call with the intention of affixing that type to a tracked symbol.
Sylvestre Ledrubed28ac2012-07-23 08:59:39 +00002726/// While the return type can be queried directly from RetEx, when
Jordy Rose910c4052011-09-02 06:44:22 +00002727/// invoking class methods we augment to the return type to be that of
2728/// a pointer to the class (as opposed it just being id).
2729// FIXME: We may be able to do this with related result types instead.
2730// This function is probably overestimating.
2731static QualType GetReturnType(const Expr *RetE, ASTContext &Ctx) {
2732 QualType RetTy = RetE->getType();
2733 // If RetE is not a message expression just return its type.
2734 // If RetE is a message expression, return its types if it is something
2735 /// more specific than id.
2736 if (const ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(RetE))
2737 if (const ObjCObjectPointerType *PT = RetTy->getAs<ObjCObjectPointerType>())
2738 if (PT->isObjCQualifiedIdType() || PT->isObjCIdType() ||
2739 PT->isObjCClassType()) {
2740 // At this point we know the return type of the message expression is
2741 // id, id<...>, or Class. If we have an ObjCInterfaceDecl, we know this
2742 // is a call to a class method whose type we can resolve. In such
2743 // cases, promote the return type to XXX* (where XXX is the class).
2744 const ObjCInterfaceDecl *D = ME->getReceiverInterface();
2745 return !D ? RetTy :
2746 Ctx.getObjCObjectPointerType(Ctx.getObjCInterfaceType(D));
2747 }
2748
2749 return RetTy;
2750}
2751
2752void RetainCountChecker::checkSummary(const RetainSummary &Summ,
Jordan Rose4531b7d2012-07-02 19:27:43 +00002753 const CallEvent &CallOrMsg,
Jordy Rose910c4052011-09-02 06:44:22 +00002754 CheckerContext &C) const {
Ted Kremenek8bef8232012-01-26 21:29:00 +00002755 ProgramStateRef state = C.getState();
Jordy Rose294396b2011-08-22 23:48:23 +00002756
2757 // Evaluate the effect of the arguments.
2758 RefVal::Kind hasErr = (RefVal::Kind) 0;
2759 SourceRange ErrorRange;
2760 SymbolRef ErrorSym = 0;
2761
2762 for (unsigned idx = 0, e = CallOrMsg.getNumArgs(); idx != e; ++idx) {
Jordy Rose537716a2011-08-27 22:51:26 +00002763 SVal V = CallOrMsg.getArgSVal(idx);
Jordy Rose294396b2011-08-22 23:48:23 +00002764
2765 if (SymbolRef Sym = V.getAsLocSymbol()) {
Anna Zaks8d6b43c2012-08-14 00:36:15 +00002766 if (const RefVal *T = getRefBinding(state, Sym)) {
Jordy Rose17a38e22011-09-02 05:55:19 +00002767 state = updateSymbol(state, Sym, *T, Summ.getArg(idx), hasErr, C);
Jordy Rose294396b2011-08-22 23:48:23 +00002768 if (hasErr) {
2769 ErrorRange = CallOrMsg.getArgSourceRange(idx);
2770 ErrorSym = Sym;
2771 break;
2772 }
2773 }
2774 }
2775 }
2776
2777 // Evaluate the effect on the message receiver.
2778 bool ReceiverIsTracked = false;
Jordan Rose4531b7d2012-07-02 19:27:43 +00002779 if (!hasErr) {
Jordan Rosecde8cdb2012-07-02 19:27:56 +00002780 const ObjCMethodCall *MsgInvocation = dyn_cast<ObjCMethodCall>(&CallOrMsg);
Jordan Rose4531b7d2012-07-02 19:27:43 +00002781 if (MsgInvocation) {
2782 if (SymbolRef Sym = MsgInvocation->getReceiverSVal().getAsLocSymbol()) {
Anna Zaks8d6b43c2012-08-14 00:36:15 +00002783 if (const RefVal *T = getRefBinding(state, Sym)) {
Jordan Rose4531b7d2012-07-02 19:27:43 +00002784 ReceiverIsTracked = true;
2785 state = updateSymbol(state, Sym, *T, Summ.getReceiverEffect(),
2786 hasErr, C);
2787 if (hasErr) {
Jordan Rose8919e682012-07-18 21:59:51 +00002788 ErrorRange = MsgInvocation->getOriginExpr()->getReceiverRange();
Jordan Rose4531b7d2012-07-02 19:27:43 +00002789 ErrorSym = Sym;
2790 }
Jordy Rose294396b2011-08-22 23:48:23 +00002791 }
2792 }
2793 }
2794 }
2795
2796 // Process any errors.
2797 if (hasErr) {
2798 processNonLeakError(state, ErrorRange, hasErr, ErrorSym, C);
2799 return;
2800 }
2801
2802 // Consult the summary for the return value.
2803 RetEffect RE = Summ.getRetEffect();
2804
2805 if (RE.getKind() == RetEffect::OwnedWhenTrackedReceiver) {
Jordy Roseb6cfc092011-08-25 00:10:37 +00002806 if (ReceiverIsTracked)
Jordy Rose17a38e22011-09-02 05:55:19 +00002807 RE = getSummaryManager(C).getObjAllocRetEffect();
Jordy Roseb6cfc092011-08-25 00:10:37 +00002808 else
Jordy Rose294396b2011-08-22 23:48:23 +00002809 RE = RetEffect::MakeNoRet();
2810 }
2811
2812 switch (RE.getKind()) {
2813 default:
David Blaikie7530c032012-01-17 06:56:22 +00002814 llvm_unreachable("Unhandled RetEffect.");
Jordy Rose294396b2011-08-22 23:48:23 +00002815
2816 case RetEffect::NoRet:
2817 // No work necessary.
2818 break;
2819
2820 case RetEffect::OwnedAllocatedSymbol:
2821 case RetEffect::OwnedSymbol: {
Ted Kremenek5eca4822012-01-06 22:09:28 +00002822 SymbolRef Sym = state->getSVal(CallOrMsg.getOriginExpr(),
2823 C.getLocationContext()).getAsSymbol();
Jordy Rose294396b2011-08-22 23:48:23 +00002824 if (!Sym)
2825 break;
2826
Jordan Rose4531b7d2012-07-02 19:27:43 +00002827 // Use the result type from the CallEvent as it automatically adjusts
Jordy Rose294396b2011-08-22 23:48:23 +00002828 // for methods/functions that return references.
Jordan Rose4531b7d2012-07-02 19:27:43 +00002829 QualType ResultTy = CallOrMsg.getResultType();
Anna Zaks8d6b43c2012-08-14 00:36:15 +00002830 state = setRefBinding(state, Sym, RefVal::makeOwned(RE.getObjKind(),
2831 ResultTy));
Jordy Rose294396b2011-08-22 23:48:23 +00002832
2833 // FIXME: Add a flag to the checker where allocations are assumed to
2834 // *not* fail. (The code below is out-of-date, though.)
2835#if 0
2836 if (RE.getKind() == RetEffect::OwnedAllocatedSymbol) {
2837 bool isFeasible;
2838 state = state.assume(loc::SymbolVal(Sym), true, isFeasible);
2839 assert(isFeasible && "Cannot assume fresh symbol is non-null.");
2840 }
2841#endif
2842
2843 break;
2844 }
2845
2846 case RetEffect::GCNotOwnedSymbol:
2847 case RetEffect::ARCNotOwnedSymbol:
2848 case RetEffect::NotOwnedSymbol: {
2849 const Expr *Ex = CallOrMsg.getOriginExpr();
Ted Kremenek5eca4822012-01-06 22:09:28 +00002850 SymbolRef Sym = state->getSVal(Ex, C.getLocationContext()).getAsSymbol();
Jordy Rose294396b2011-08-22 23:48:23 +00002851 if (!Sym)
2852 break;
2853
2854 // Use GetReturnType in order to give [NSFoo alloc] the type NSFoo *.
2855 QualType ResultTy = GetReturnType(Ex, C.getASTContext());
Anna Zaks8d6b43c2012-08-14 00:36:15 +00002856 state = setRefBinding(state, Sym, RefVal::makeNotOwned(RE.getObjKind(),
2857 ResultTy));
Jordy Rose294396b2011-08-22 23:48:23 +00002858 break;
2859 }
2860 }
2861
2862 // This check is actually necessary; otherwise the statement builder thinks
2863 // we've hit a previously-found path.
2864 // Normally addTransition takes care of this, but we want the node pointer.
2865 ExplodedNode *NewNode;
2866 if (state == C.getState()) {
2867 NewNode = C.getPredecessor();
2868 } else {
Anna Zaks0bd6b112011-10-26 21:06:34 +00002869 NewNode = C.addTransition(state);
Jordy Rose294396b2011-08-22 23:48:23 +00002870 }
2871
Jordy Rose9c083b72011-08-24 18:56:32 +00002872 // Annotate the node with summary we used.
2873 if (NewNode) {
2874 // FIXME: This is ugly. See checkEndAnalysis for why it's necessary.
2875 if (ShouldResetSummaryLog) {
2876 SummaryLog.clear();
2877 ShouldResetSummaryLog = false;
2878 }
Jordy Roseec9ef852011-08-23 20:55:48 +00002879 SummaryLog[NewNode] = &Summ;
Jordy Rose9c083b72011-08-24 18:56:32 +00002880 }
Jordy Rose294396b2011-08-22 23:48:23 +00002881}
2882
Jordy Rosee0a5d322011-08-23 20:27:16 +00002883
Ted Kremenek8bef8232012-01-26 21:29:00 +00002884ProgramStateRef
2885RetainCountChecker::updateSymbol(ProgramStateRef state, SymbolRef sym,
Jordy Rose910c4052011-09-02 06:44:22 +00002886 RefVal V, ArgEffect E, RefVal::Kind &hasErr,
2887 CheckerContext &C) const {
Jordy Rosee0a5d322011-08-23 20:27:16 +00002888 // In GC mode [... release] and [... retain] do nothing.
Jordy Rose910c4052011-09-02 06:44:22 +00002889 // In ARC mode they shouldn't exist at all, but we just ignore them.
Jordy Rose17a38e22011-09-02 05:55:19 +00002890 bool IgnoreRetainMsg = C.isObjCGCEnabled();
2891 if (!IgnoreRetainMsg)
David Blaikie4e4d0842012-03-11 07:00:24 +00002892 IgnoreRetainMsg = (bool)C.getASTContext().getLangOpts().ObjCAutoRefCount;
Jordy Rose17a38e22011-09-02 05:55:19 +00002893
Jordy Rosee0a5d322011-08-23 20:27:16 +00002894 switch (E) {
Jordan Rose4531b7d2012-07-02 19:27:43 +00002895 default:
2896 break;
2897 case IncRefMsg:
2898 E = IgnoreRetainMsg ? DoNothing : IncRef;
2899 break;
2900 case DecRefMsg:
2901 E = IgnoreRetainMsg ? DoNothing : DecRef;
2902 break;
2903 case DecRefMsgAndStopTracking:
2904 E = IgnoreRetainMsg ? StopTracking : DecRefAndStopTracking;
2905 break;
2906 case MakeCollectable:
2907 E = C.isObjCGCEnabled() ? DecRef : DoNothing;
2908 break;
2909 case NewAutoreleasePool:
2910 E = C.isObjCGCEnabled() ? DoNothing : NewAutoreleasePool;
2911 break;
Jordy Rosee0a5d322011-08-23 20:27:16 +00002912 }
2913
2914 // Handle all use-after-releases.
Jordy Rose17a38e22011-09-02 05:55:19 +00002915 if (!C.isObjCGCEnabled() && V.getKind() == RefVal::Released) {
Jordy Rosee0a5d322011-08-23 20:27:16 +00002916 V = V ^ RefVal::ErrorUseAfterRelease;
2917 hasErr = V.getKind();
Anna Zaks8d6b43c2012-08-14 00:36:15 +00002918 return setRefBinding(state, sym, V);
Jordy Rosee0a5d322011-08-23 20:27:16 +00002919 }
2920
2921 switch (E) {
2922 case DecRefMsg:
2923 case IncRefMsg:
2924 case MakeCollectable:
Jordan Rose4531b7d2012-07-02 19:27:43 +00002925 case DecRefMsgAndStopTracking:
Jordy Rosee0a5d322011-08-23 20:27:16 +00002926 llvm_unreachable("DecRefMsg/IncRefMsg/MakeCollectable already converted");
Jordy Rosee0a5d322011-08-23 20:27:16 +00002927
2928 case Dealloc:
2929 // Any use of -dealloc in GC is *bad*.
Jordy Rose17a38e22011-09-02 05:55:19 +00002930 if (C.isObjCGCEnabled()) {
Jordy Rosee0a5d322011-08-23 20:27:16 +00002931 V = V ^ RefVal::ErrorDeallocGC;
2932 hasErr = V.getKind();
2933 break;
2934 }
2935
2936 switch (V.getKind()) {
2937 default:
2938 llvm_unreachable("Invalid RefVal state for an explicit dealloc.");
Jordy Rosee0a5d322011-08-23 20:27:16 +00002939 case RefVal::Owned:
2940 // The object immediately transitions to the released state.
2941 V = V ^ RefVal::Released;
2942 V.clearCounts();
Anna Zaks8d6b43c2012-08-14 00:36:15 +00002943 return setRefBinding(state, sym, V);
Jordy Rosee0a5d322011-08-23 20:27:16 +00002944 case RefVal::NotOwned:
2945 V = V ^ RefVal::ErrorDeallocNotOwned;
2946 hasErr = V.getKind();
2947 break;
2948 }
2949 break;
2950
2951 case NewAutoreleasePool:
Jordy Rose17a38e22011-09-02 05:55:19 +00002952 assert(!C.isObjCGCEnabled());
Anna Zaksc95bb762012-08-14 00:36:17 +00002953 return state;
Jordy Rosee0a5d322011-08-23 20:27:16 +00002954
2955 case MayEscape:
2956 if (V.getKind() == RefVal::Owned) {
2957 V = V ^ RefVal::NotOwned;
2958 break;
2959 }
2960
2961 // Fall-through.
2962
Jordy Rosee0a5d322011-08-23 20:27:16 +00002963 case DoNothing:
2964 return state;
2965
2966 case Autorelease:
Jordy Rose17a38e22011-09-02 05:55:19 +00002967 if (C.isObjCGCEnabled())
Jordy Rosee0a5d322011-08-23 20:27:16 +00002968 return state;
Jordy Rosee0a5d322011-08-23 20:27:16 +00002969 // Update the autorelease counts.
Jordy Rosee0a5d322011-08-23 20:27:16 +00002970 V = V.autorelease();
2971 break;
2972
2973 case StopTracking:
Anna Zaks8d6b43c2012-08-14 00:36:15 +00002974 return removeRefBinding(state, sym);
Jordy Rosee0a5d322011-08-23 20:27:16 +00002975
2976 case IncRef:
2977 switch (V.getKind()) {
2978 default:
2979 llvm_unreachable("Invalid RefVal state for a retain.");
Jordy Rosee0a5d322011-08-23 20:27:16 +00002980 case RefVal::Owned:
2981 case RefVal::NotOwned:
2982 V = V + 1;
2983 break;
2984 case RefVal::Released:
2985 // Non-GC cases are handled above.
Jordy Rose17a38e22011-09-02 05:55:19 +00002986 assert(C.isObjCGCEnabled());
Jordy Rosee0a5d322011-08-23 20:27:16 +00002987 V = (V ^ RefVal::Owned) + 1;
2988 break;
2989 }
2990 break;
2991
Jordy Rosee0a5d322011-08-23 20:27:16 +00002992 case DecRef:
2993 case DecRefBridgedTransfered:
Jordan Rose4531b7d2012-07-02 19:27:43 +00002994 case DecRefAndStopTracking:
Jordy Rosee0a5d322011-08-23 20:27:16 +00002995 switch (V.getKind()) {
2996 default:
2997 // case 'RefVal::Released' handled above.
2998 llvm_unreachable("Invalid RefVal state for a release.");
Jordy Rosee0a5d322011-08-23 20:27:16 +00002999
3000 case RefVal::Owned:
3001 assert(V.getCount() > 0);
3002 if (V.getCount() == 1)
3003 V = V ^ (E == DecRefBridgedTransfered ?
3004 RefVal::NotOwned : RefVal::Released);
Jordan Rose4531b7d2012-07-02 19:27:43 +00003005 else if (E == DecRefAndStopTracking)
Anna Zaks8d6b43c2012-08-14 00:36:15 +00003006 return removeRefBinding(state, sym);
Jordan Rose4531b7d2012-07-02 19:27:43 +00003007
Jordy Rosee0a5d322011-08-23 20:27:16 +00003008 V = V - 1;
3009 break;
3010
3011 case RefVal::NotOwned:
Jordan Rose4531b7d2012-07-02 19:27:43 +00003012 if (V.getCount() > 0) {
3013 if (E == DecRefAndStopTracking)
Anna Zaks8d6b43c2012-08-14 00:36:15 +00003014 return removeRefBinding(state, sym);
Jordy Rosee0a5d322011-08-23 20:27:16 +00003015 V = V - 1;
Jordan Rose4531b7d2012-07-02 19:27:43 +00003016 } else {
Jordy Rosee0a5d322011-08-23 20:27:16 +00003017 V = V ^ RefVal::ErrorReleaseNotOwned;
3018 hasErr = V.getKind();
3019 }
3020 break;
3021
3022 case RefVal::Released:
3023 // Non-GC cases are handled above.
Jordy Rose17a38e22011-09-02 05:55:19 +00003024 assert(C.isObjCGCEnabled());
Jordy Rosee0a5d322011-08-23 20:27:16 +00003025 V = V ^ RefVal::ErrorUseAfterRelease;
3026 hasErr = V.getKind();
3027 break;
3028 }
3029 break;
3030 }
Anna Zaks8d6b43c2012-08-14 00:36:15 +00003031 return setRefBinding(state, sym, V);
Jordy Rosee0a5d322011-08-23 20:27:16 +00003032}
3033
Ted Kremenek8bef8232012-01-26 21:29:00 +00003034void RetainCountChecker::processNonLeakError(ProgramStateRef St,
Jordy Rose910c4052011-09-02 06:44:22 +00003035 SourceRange ErrorRange,
3036 RefVal::Kind ErrorKind,
3037 SymbolRef Sym,
3038 CheckerContext &C) const {
Jordy Rose294396b2011-08-22 23:48:23 +00003039 ExplodedNode *N = C.generateSink(St);
3040 if (!N)
3041 return;
3042
Jordy Rose294396b2011-08-22 23:48:23 +00003043 CFRefBug *BT;
3044 switch (ErrorKind) {
3045 default:
3046 llvm_unreachable("Unhandled error.");
Jordy Rose294396b2011-08-22 23:48:23 +00003047 case RefVal::ErrorUseAfterRelease:
Jordy Rosed6334e12011-08-25 00:34:03 +00003048 if (!useAfterRelease)
3049 useAfterRelease.reset(new UseAfterRelease());
3050 BT = &*useAfterRelease;
Jordy Rose294396b2011-08-22 23:48:23 +00003051 break;
3052 case RefVal::ErrorReleaseNotOwned:
Jordy Rosed6334e12011-08-25 00:34:03 +00003053 if (!releaseNotOwned)
3054 releaseNotOwned.reset(new BadRelease());
3055 BT = &*releaseNotOwned;
Jordy Rose294396b2011-08-22 23:48:23 +00003056 break;
3057 case RefVal::ErrorDeallocGC:
Jordy Rosed6334e12011-08-25 00:34:03 +00003058 if (!deallocGC)
3059 deallocGC.reset(new DeallocGC());
3060 BT = &*deallocGC;
Jordy Rose294396b2011-08-22 23:48:23 +00003061 break;
3062 case RefVal::ErrorDeallocNotOwned:
Jordy Rosed6334e12011-08-25 00:34:03 +00003063 if (!deallocNotOwned)
3064 deallocNotOwned.reset(new DeallocNotOwned());
3065 BT = &*deallocNotOwned;
Jordy Rose294396b2011-08-22 23:48:23 +00003066 break;
3067 }
3068
Jordy Rosed6334e12011-08-25 00:34:03 +00003069 assert(BT);
David Blaikie4e4d0842012-03-11 07:00:24 +00003070 CFRefReport *report = new CFRefReport(*BT, C.getASTContext().getLangOpts(),
Jordy Rose17a38e22011-09-02 05:55:19 +00003071 C.isObjCGCEnabled(), SummaryLog,
3072 N, Sym);
Jordy Rose294396b2011-08-22 23:48:23 +00003073 report->addRange(ErrorRange);
3074 C.EmitReport(report);
3075}
3076
Jordy Rose910c4052011-09-02 06:44:22 +00003077//===----------------------------------------------------------------------===//
3078// Handle the return values of retain-count-related functions.
3079//===----------------------------------------------------------------------===//
3080
3081bool RetainCountChecker::evalCall(const CallExpr *CE, CheckerContext &C) const {
Jordy Rose76c506f2011-08-21 21:58:18 +00003082 // Get the callee. We're only interested in simple C functions.
Ted Kremenek8bef8232012-01-26 21:29:00 +00003083 ProgramStateRef state = C.getState();
Anna Zaksb805c8f2011-12-01 05:57:37 +00003084 const FunctionDecl *FD = C.getCalleeDecl(CE);
Jordy Rose76c506f2011-08-21 21:58:18 +00003085 if (!FD)
3086 return false;
3087
3088 IdentifierInfo *II = FD->getIdentifier();
3089 if (!II)
3090 return false;
3091
3092 // For now, we're only handling the functions that return aliases of their
3093 // arguments: CFRetain and CFMakeCollectable (and their families).
3094 // Eventually we should add other functions we can model entirely,
3095 // such as CFRelease, which don't invalidate their arguments or globals.
3096 if (CE->getNumArgs() != 1)
3097 return false;
3098
3099 // Get the name of the function.
3100 StringRef FName = II->getName();
3101 FName = FName.substr(FName.find_first_not_of('_'));
3102
3103 // See if it's one of the specific functions we know how to eval.
3104 bool canEval = false;
3105
Anna Zaksb805c8f2011-12-01 05:57:37 +00003106 QualType ResultTy = CE->getCallReturnType();
Jordy Rose76c506f2011-08-21 21:58:18 +00003107 if (ResultTy->isObjCIdType()) {
3108 // Handle: id NSMakeCollectable(CFTypeRef)
3109 canEval = II->isStr("NSMakeCollectable");
3110 } else if (ResultTy->isPointerType()) {
3111 // Handle: (CF|CG)Retain
3112 // CFMakeCollectable
3113 // It's okay to be a little sloppy here (CGMakeCollectable doesn't exist).
3114 if (cocoa::isRefType(ResultTy, "CF", FName) ||
3115 cocoa::isRefType(ResultTy, "CG", FName)) {
3116 canEval = isRetain(FD, FName) || isMakeCollectable(FD, FName);
3117 }
3118 }
3119
3120 if (!canEval)
3121 return false;
3122
3123 // Bind the return value.
Ted Kremenek5eca4822012-01-06 22:09:28 +00003124 const LocationContext *LCtx = C.getLocationContext();
3125 SVal RetVal = state->getSVal(CE->getArg(0), LCtx);
Jordy Rose76c506f2011-08-21 21:58:18 +00003126 if (RetVal.isUnknown()) {
3127 // If the receiver is unknown, conjure a return value.
3128 SValBuilder &SVB = C.getSValBuilder();
Anna Zaks5d0ea6d2011-10-04 20:43:05 +00003129 unsigned Count = C.getCurrentBlockCount();
Benjamin Kramer7373ead2012-07-18 19:08:44 +00003130 RetVal = SVB.getConjuredSymbolVal(0, CE, LCtx, ResultTy, Count);
Jordy Rose76c506f2011-08-21 21:58:18 +00003131 }
Ted Kremenek5eca4822012-01-06 22:09:28 +00003132 state = state->BindExpr(CE, LCtx, RetVal, false);
Jordy Rose76c506f2011-08-21 21:58:18 +00003133
Jordy Rose294396b2011-08-22 23:48:23 +00003134 // FIXME: This should not be necessary, but otherwise the argument seems to be
3135 // considered alive during the next statement.
3136 if (const MemRegion *ArgRegion = RetVal.getAsRegion()) {
3137 // Save the refcount status of the argument.
3138 SymbolRef Sym = RetVal.getAsLocSymbol();
Anna Zaks8d6b43c2012-08-14 00:36:15 +00003139 const RefVal *Binding = 0;
Jordy Rose294396b2011-08-22 23:48:23 +00003140 if (Sym)
Anna Zaks8d6b43c2012-08-14 00:36:15 +00003141 Binding = getRefBinding(state, Sym);
Jordy Rose76c506f2011-08-21 21:58:18 +00003142
Jordy Rose294396b2011-08-22 23:48:23 +00003143 // Invalidate the argument region.
Anna Zaks5d0ea6d2011-10-04 20:43:05 +00003144 unsigned Count = C.getCurrentBlockCount();
Ted Kremenek3133f792012-02-17 23:13:45 +00003145 state = state->invalidateRegions(ArgRegion, CE, Count, LCtx);
Jordy Rose76c506f2011-08-21 21:58:18 +00003146
Jordy Rose294396b2011-08-22 23:48:23 +00003147 // Restore the refcount status of the argument.
3148 if (Binding)
Anna Zaks8d6b43c2012-08-14 00:36:15 +00003149 state = setRefBinding(state, Sym, *Binding);
Jordy Rose294396b2011-08-22 23:48:23 +00003150 }
3151
Anna Zaks0bd6b112011-10-26 21:06:34 +00003152 C.addTransition(state);
Jordy Rose76c506f2011-08-21 21:58:18 +00003153 return true;
3154}
3155
Jordy Rose910c4052011-09-02 06:44:22 +00003156//===----------------------------------------------------------------------===//
3157// Handle return statements.
3158//===----------------------------------------------------------------------===//
Jordy Rosef53e8c72011-08-23 19:43:16 +00003159
Ted Kremeneke5715782012-02-25 02:09:09 +00003160// Return true if the current LocationContext has no caller context.
3161static bool inTopFrame(CheckerContext &C) {
3162 const LocationContext *LC = C.getLocationContext();
3163 return LC->getParent() == 0;
3164}
3165
Jordy Rose910c4052011-09-02 06:44:22 +00003166void RetainCountChecker::checkPreStmt(const ReturnStmt *S,
3167 CheckerContext &C) const {
Ted Kremeneke5715782012-02-25 02:09:09 +00003168
3169 // Only adjust the reference count if this is the top-level call frame,
3170 // and not the result of inlining. In the future, we should do
3171 // better checking even for inlined calls, and see if they match
3172 // with their expected semantics (e.g., the method should return a retained
3173 // object, etc.).
3174 if (!inTopFrame(C))
3175 return;
3176
Jordy Rosef53e8c72011-08-23 19:43:16 +00003177 const Expr *RetE = S->getRetValue();
3178 if (!RetE)
3179 return;
3180
Ted Kremenek8bef8232012-01-26 21:29:00 +00003181 ProgramStateRef state = C.getState();
Ted Kremenek5eca4822012-01-06 22:09:28 +00003182 SymbolRef Sym =
3183 state->getSValAsScalarOrLoc(RetE, C.getLocationContext()).getAsLocSymbol();
Jordy Rosef53e8c72011-08-23 19:43:16 +00003184 if (!Sym)
3185 return;
3186
3187 // Get the reference count binding (if any).
Anna Zaks8d6b43c2012-08-14 00:36:15 +00003188 const RefVal *T = getRefBinding(state, Sym);
Jordy Rosef53e8c72011-08-23 19:43:16 +00003189 if (!T)
3190 return;
3191
3192 // Change the reference count.
3193 RefVal X = *T;
3194
3195 switch (X.getKind()) {
3196 case RefVal::Owned: {
3197 unsigned cnt = X.getCount();
3198 assert(cnt > 0);
3199 X.setCount(cnt - 1);
3200 X = X ^ RefVal::ReturnedOwned;
3201 break;
3202 }
3203
3204 case RefVal::NotOwned: {
3205 unsigned cnt = X.getCount();
3206 if (cnt) {
3207 X.setCount(cnt - 1);
3208 X = X ^ RefVal::ReturnedOwned;
3209 }
3210 else {
3211 X = X ^ RefVal::ReturnedNotOwned;
3212 }
3213 break;
3214 }
3215
3216 default:
3217 return;
3218 }
3219
3220 // Update the binding.
Anna Zaks8d6b43c2012-08-14 00:36:15 +00003221 state = setRefBinding(state, Sym, X);
Anna Zaks0bd6b112011-10-26 21:06:34 +00003222 ExplodedNode *Pred = C.addTransition(state);
Jordy Rosef53e8c72011-08-23 19:43:16 +00003223
3224 // At this point we have updated the state properly.
3225 // Everything after this is merely checking to see if the return value has
3226 // been over- or under-retained.
3227
3228 // Did we cache out?
3229 if (!Pred)
3230 return;
3231
Jordy Rosef53e8c72011-08-23 19:43:16 +00003232 // Update the autorelease counts.
3233 static SimpleProgramPointTag
Jordy Rose910c4052011-09-02 06:44:22 +00003234 AutoreleaseTag("RetainCountChecker : Autorelease");
Anna Zaks4eff8232011-10-05 23:44:11 +00003235 GenericNodeBuilderRefCount Bd(C, &AutoreleaseTag);
Anna Zaks6a93bd52011-10-25 19:57:11 +00003236 llvm::tie(Pred, state) = handleAutoreleaseCounts(state, Bd, Pred, C, Sym, X);
Jordy Rosef53e8c72011-08-23 19:43:16 +00003237
3238 // Did we cache out?
Jordy Rose8d228632011-08-23 20:07:14 +00003239 if (!Pred)
Jordy Rosef53e8c72011-08-23 19:43:16 +00003240 return;
3241
3242 // Get the updated binding.
Anna Zaks8d6b43c2012-08-14 00:36:15 +00003243 T = getRefBinding(state, Sym);
Jordy Rosef53e8c72011-08-23 19:43:16 +00003244 assert(T);
3245 X = *T;
3246
3247 // Consult the summary of the enclosing method.
Jordy Rose17a38e22011-09-02 05:55:19 +00003248 RetainSummaryManager &Summaries = getSummaryManager(C);
Jordy Rosef53e8c72011-08-23 19:43:16 +00003249 const Decl *CD = &Pred->getCodeDecl();
Jordan Rose4531b7d2012-07-02 19:27:43 +00003250 RetEffect RE = RetEffect::MakeNoRet();
Jordy Rosef53e8c72011-08-23 19:43:16 +00003251
Jordan Rose4531b7d2012-07-02 19:27:43 +00003252 // FIXME: What is the convention for blocks? Is there one?
Jordy Rosef53e8c72011-08-23 19:43:16 +00003253 if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(CD)) {
Jordy Roseb6cfc092011-08-25 00:10:37 +00003254 const RetainSummary *Summ = Summaries.getMethodSummary(MD);
Jordan Rose4531b7d2012-07-02 19:27:43 +00003255 RE = Summ->getRetEffect();
3256 } else if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(CD)) {
3257 if (!isa<CXXMethodDecl>(FD)) {
3258 const RetainSummary *Summ = Summaries.getFunctionSummary(FD);
3259 RE = Summ->getRetEffect();
3260 }
Jordy Rosef53e8c72011-08-23 19:43:16 +00003261 }
3262
Jordan Rose4531b7d2012-07-02 19:27:43 +00003263 checkReturnWithRetEffect(S, C, Pred, RE, X, Sym, state);
Jordy Rosef53e8c72011-08-23 19:43:16 +00003264}
3265
Jordy Rose910c4052011-09-02 06:44:22 +00003266void RetainCountChecker::checkReturnWithRetEffect(const ReturnStmt *S,
3267 CheckerContext &C,
3268 ExplodedNode *Pred,
3269 RetEffect RE, RefVal X,
3270 SymbolRef Sym,
Ted Kremenek8bef8232012-01-26 21:29:00 +00003271 ProgramStateRef state) const {
Jordy Rosef53e8c72011-08-23 19:43:16 +00003272 // Any leaks or other errors?
3273 if (X.isReturnedOwned() && X.getCount() == 0) {
3274 if (RE.getKind() != RetEffect::NoRet) {
3275 bool hasError = false;
Jordy Rose17a38e22011-09-02 05:55:19 +00003276 if (C.isObjCGCEnabled() && RE.getObjKind() == RetEffect::ObjC) {
Jordy Rosef53e8c72011-08-23 19:43:16 +00003277 // Things are more complicated with garbage collection. If the
3278 // returned object is suppose to be an Objective-C object, we have
3279 // a leak (as the caller expects a GC'ed object) because no
3280 // method should return ownership unless it returns a CF object.
3281 hasError = true;
3282 X = X ^ RefVal::ErrorGCLeakReturned;
3283 }
3284 else if (!RE.isOwned()) {
3285 // Either we are using GC and the returned object is a CF type
3286 // or we aren't using GC. In either case, we expect that the
3287 // enclosing method is expected to return ownership.
3288 hasError = true;
3289 X = X ^ RefVal::ErrorLeakReturned;
3290 }
3291
3292 if (hasError) {
3293 // Generate an error node.
Anna Zaks8d6b43c2012-08-14 00:36:15 +00003294 state = setRefBinding(state, Sym, X);
Jordy Rosef53e8c72011-08-23 19:43:16 +00003295
3296 static SimpleProgramPointTag
Jordy Rose910c4052011-09-02 06:44:22 +00003297 ReturnOwnLeakTag("RetainCountChecker : ReturnsOwnLeak");
Anna Zaks0bd6b112011-10-26 21:06:34 +00003298 ExplodedNode *N = C.addTransition(state, Pred, &ReturnOwnLeakTag);
Jordy Rosef53e8c72011-08-23 19:43:16 +00003299 if (N) {
David Blaikie4e4d0842012-03-11 07:00:24 +00003300 const LangOptions &LOpts = C.getASTContext().getLangOpts();
Jordy Rose17a38e22011-09-02 05:55:19 +00003301 bool GCEnabled = C.isObjCGCEnabled();
Jordy Rosef53e8c72011-08-23 19:43:16 +00003302 CFRefReport *report =
Jordy Rose17a38e22011-09-02 05:55:19 +00003303 new CFRefLeakReport(*getLeakAtReturnBug(LOpts, GCEnabled),
3304 LOpts, GCEnabled, SummaryLog,
Anna Zaks6a93bd52011-10-25 19:57:11 +00003305 N, Sym, C);
Jordy Rosef53e8c72011-08-23 19:43:16 +00003306 C.EmitReport(report);
3307 }
3308 }
3309 }
3310 } else if (X.isReturnedNotOwned()) {
3311 if (RE.isOwned()) {
3312 // Trying to return a not owned object to a caller expecting an
3313 // owned object.
Anna Zaks8d6b43c2012-08-14 00:36:15 +00003314 state = setRefBinding(state, Sym, X ^ RefVal::ErrorReturnedNotOwned);
Jordy Rosef53e8c72011-08-23 19:43:16 +00003315
3316 static SimpleProgramPointTag
Jordy Rose910c4052011-09-02 06:44:22 +00003317 ReturnNotOwnedTag("RetainCountChecker : ReturnNotOwnedForOwned");
Anna Zaks0bd6b112011-10-26 21:06:34 +00003318 ExplodedNode *N = C.addTransition(state, Pred, &ReturnNotOwnedTag);
Jordy Rosef53e8c72011-08-23 19:43:16 +00003319 if (N) {
Jordy Rosed6334e12011-08-25 00:34:03 +00003320 if (!returnNotOwnedForOwned)
3321 returnNotOwnedForOwned.reset(new ReturnedNotOwnedForOwned());
3322
Jordy Rosef53e8c72011-08-23 19:43:16 +00003323 CFRefReport *report =
Jordy Rosed6334e12011-08-25 00:34:03 +00003324 new CFRefReport(*returnNotOwnedForOwned,
David Blaikie4e4d0842012-03-11 07:00:24 +00003325 C.getASTContext().getLangOpts(),
Jordy Rose17a38e22011-09-02 05:55:19 +00003326 C.isObjCGCEnabled(), SummaryLog, N, Sym);
Jordy Rosef53e8c72011-08-23 19:43:16 +00003327 C.EmitReport(report);
3328 }
3329 }
3330 }
3331}
3332
Jordy Rose8d228632011-08-23 20:07:14 +00003333//===----------------------------------------------------------------------===//
Jordy Rose910c4052011-09-02 06:44:22 +00003334// Check various ways a symbol can be invalidated.
3335//===----------------------------------------------------------------------===//
3336
Anna Zaks390909c2011-10-06 00:43:15 +00003337void RetainCountChecker::checkBind(SVal loc, SVal val, const Stmt *S,
Jordy Rose910c4052011-09-02 06:44:22 +00003338 CheckerContext &C) const {
3339 // Are we storing to something that causes the value to "escape"?
3340 bool escapes = true;
3341
3342 // A value escapes in three possible cases (this may change):
3343 //
3344 // (1) we are binding to something that is not a memory region.
3345 // (2) we are binding to a memregion that does not have stack storage
3346 // (3) we are binding to a memregion with stack storage that the store
3347 // does not understand.
Ted Kremenek8bef8232012-01-26 21:29:00 +00003348 ProgramStateRef state = C.getState();
Jordy Rose910c4052011-09-02 06:44:22 +00003349
3350 if (loc::MemRegionVal *regionLoc = dyn_cast<loc::MemRegionVal>(&loc)) {
3351 escapes = !regionLoc->getRegion()->hasStackStorage();
3352
3353 if (!escapes) {
3354 // To test (3), generate a new state with the binding added. If it is
3355 // the same state, then it escapes (since the store cannot represent
3356 // the binding).
Anna Zakse7958da2012-05-02 00:15:40 +00003357 // Do this only if we know that the store is not supposed to generate the
3358 // same state.
3359 SVal StoredVal = state->getSVal(regionLoc->getRegion());
3360 if (StoredVal != val)
3361 escapes = (state == (state->bindLoc(*regionLoc, val)));
Jordy Rose910c4052011-09-02 06:44:22 +00003362 }
Ted Kremenekde5b4fb2012-03-27 01:12:45 +00003363 if (!escapes) {
3364 // Case 4: We do not currently model what happens when a symbol is
3365 // assigned to a struct field, so be conservative here and let the symbol
3366 // go. TODO: This could definitely be improved upon.
3367 escapes = !isa<VarRegion>(regionLoc->getRegion());
3368 }
Jordy Rose910c4052011-09-02 06:44:22 +00003369 }
3370
3371 // If our store can represent the binding and we aren't storing to something
3372 // that doesn't have local storage then just return and have the simulation
3373 // state continue as is.
3374 if (!escapes)
3375 return;
3376
3377 // Otherwise, find all symbols referenced by 'val' that we are tracking
3378 // and stop tracking them.
3379 state = state->scanReachableSymbols<StopTrackingCallback>(val).getState();
Anna Zaks0bd6b112011-10-26 21:06:34 +00003380 C.addTransition(state);
Jordy Rose910c4052011-09-02 06:44:22 +00003381}
3382
Ted Kremenek8bef8232012-01-26 21:29:00 +00003383ProgramStateRef RetainCountChecker::evalAssume(ProgramStateRef state,
Jordy Rose910c4052011-09-02 06:44:22 +00003384 SVal Cond,
3385 bool Assumption) const {
3386
3387 // FIXME: We may add to the interface of evalAssume the list of symbols
3388 // whose assumptions have changed. For now we just iterate through the
3389 // bindings and check if any of the tracked symbols are NULL. This isn't
3390 // too bad since the number of symbols we will track in practice are
3391 // probably small and evalAssume is only called at branches and a few
3392 // other places.
3393 RefBindings B = state->get<RefBindings>();
3394
3395 if (B.isEmpty())
3396 return state;
3397
3398 bool changed = false;
3399 RefBindings::Factory &RefBFactory = state->get_context<RefBindings>();
3400
3401 for (RefBindings::iterator I = B.begin(), E = B.end(); I != E; ++I) {
3402 // Check if the symbol is null (or equal to any constant).
3403 // If this is the case, stop tracking the symbol.
3404 if (state->getSymVal(I.getKey())) {
3405 changed = true;
3406 B = RefBFactory.remove(B, I.getKey());
3407 }
3408 }
3409
3410 if (changed)
3411 state = state->set<RefBindings>(B);
3412
3413 return state;
3414}
3415
Ted Kremenek8bef8232012-01-26 21:29:00 +00003416ProgramStateRef
3417RetainCountChecker::checkRegionChanges(ProgramStateRef state,
Jordy Rose910c4052011-09-02 06:44:22 +00003418 const StoreManager::InvalidatedSymbols *invalidated,
3419 ArrayRef<const MemRegion *> ExplicitRegions,
Anna Zaks66c40402012-02-14 21:55:24 +00003420 ArrayRef<const MemRegion *> Regions,
Jordan Rose740d4902012-07-02 19:27:35 +00003421 const CallEvent *Call) const {
Jordy Rose910c4052011-09-02 06:44:22 +00003422 if (!invalidated)
3423 return state;
3424
3425 llvm::SmallPtrSet<SymbolRef, 8> WhitelistedSymbols;
3426 for (ArrayRef<const MemRegion *>::iterator I = ExplicitRegions.begin(),
3427 E = ExplicitRegions.end(); I != E; ++I) {
3428 if (const SymbolicRegion *SR = (*I)->StripCasts()->getAs<SymbolicRegion>())
3429 WhitelistedSymbols.insert(SR->getSymbol());
3430 }
3431
3432 for (StoreManager::InvalidatedSymbols::const_iterator I=invalidated->begin(),
3433 E = invalidated->end(); I!=E; ++I) {
3434 SymbolRef sym = *I;
3435 if (WhitelistedSymbols.count(sym))
3436 continue;
3437 // Remove any existing reference-count binding.
Anna Zaks8d6b43c2012-08-14 00:36:15 +00003438 state = removeRefBinding(state, sym);
Jordy Rose910c4052011-09-02 06:44:22 +00003439 }
3440 return state;
3441}
3442
3443//===----------------------------------------------------------------------===//
Jordy Rose8d228632011-08-23 20:07:14 +00003444// Handle dead symbols and end-of-path.
3445//===----------------------------------------------------------------------===//
3446
Ted Kremenek8bef8232012-01-26 21:29:00 +00003447std::pair<ExplodedNode *, ProgramStateRef >
3448RetainCountChecker::handleAutoreleaseCounts(ProgramStateRef state,
Jordy Rose910c4052011-09-02 06:44:22 +00003449 GenericNodeBuilderRefCount Bd,
Anna Zaks6a93bd52011-10-25 19:57:11 +00003450 ExplodedNode *Pred,
3451 CheckerContext &Ctx,
Jordy Rose910c4052011-09-02 06:44:22 +00003452 SymbolRef Sym, RefVal V) const {
Jordy Rose8d228632011-08-23 20:07:14 +00003453 unsigned ACnt = V.getAutoreleaseCount();
3454
3455 // No autorelease counts? Nothing to be done.
3456 if (!ACnt)
3457 return std::make_pair(Pred, state);
3458
Anna Zaks6a93bd52011-10-25 19:57:11 +00003459 assert(!Ctx.isObjCGCEnabled() && "Autorelease counts in GC mode?");
Jordy Rose8d228632011-08-23 20:07:14 +00003460 unsigned Cnt = V.getCount();
3461
3462 // FIXME: Handle sending 'autorelease' to already released object.
3463
3464 if (V.getKind() == RefVal::ReturnedOwned)
3465 ++Cnt;
3466
3467 if (ACnt <= Cnt) {
3468 if (ACnt == Cnt) {
3469 V.clearCounts();
3470 if (V.getKind() == RefVal::ReturnedOwned)
3471 V = V ^ RefVal::ReturnedNotOwned;
3472 else
3473 V = V ^ RefVal::NotOwned;
3474 } else {
3475 V.setCount(Cnt - ACnt);
3476 V.setAutoreleaseCount(0);
3477 }
Anna Zaks8d6b43c2012-08-14 00:36:15 +00003478 state = setRefBinding(state, Sym, V);
Jordy Rose8d228632011-08-23 20:07:14 +00003479 ExplodedNode *N = Bd.MakeNode(state, Pred);
3480 if (N == 0)
3481 state = 0;
3482 return std::make_pair(N, state);
3483 }
3484
3485 // Woah! More autorelease counts then retain counts left.
3486 // Emit hard error.
3487 V = V ^ RefVal::ErrorOverAutorelease;
Anna Zaks8d6b43c2012-08-14 00:36:15 +00003488 state = setRefBinding(state, Sym, V);
Jordy Rose8d228632011-08-23 20:07:14 +00003489
Anna Zaksf05aac82011-10-18 23:05:58 +00003490 if (ExplodedNode *N = Bd.MakeNode(state, Pred, true)) {
Dylan Noblesmithf7ccbad2012-02-05 02:13:05 +00003491 SmallString<128> sbuf;
Jordy Rose8d228632011-08-23 20:07:14 +00003492 llvm::raw_svector_ostream os(sbuf);
3493 os << "Object over-autoreleased: object was sent -autorelease ";
3494 if (V.getAutoreleaseCount() > 1)
3495 os << V.getAutoreleaseCount() << " times ";
3496 os << "but the object has a +" << V.getCount() << " retain count";
3497
Jordy Rosed6334e12011-08-25 00:34:03 +00003498 if (!overAutorelease)
3499 overAutorelease.reset(new OverAutorelease());
3500
David Blaikie4e4d0842012-03-11 07:00:24 +00003501 const LangOptions &LOpts = Ctx.getASTContext().getLangOpts();
Jordy Rose8d228632011-08-23 20:07:14 +00003502 CFRefReport *report =
Jordy Rosed6334e12011-08-25 00:34:03 +00003503 new CFRefReport(*overAutorelease, LOpts, /* GCEnabled = */ false,
3504 SummaryLog, N, Sym, os.str());
Anna Zaks6a93bd52011-10-25 19:57:11 +00003505 Ctx.EmitReport(report);
Jordy Rose8d228632011-08-23 20:07:14 +00003506 }
3507
Ted Kremenek8bef8232012-01-26 21:29:00 +00003508 return std::make_pair((ExplodedNode *)0, (ProgramStateRef )0);
Jordy Rose8d228632011-08-23 20:07:14 +00003509}
Jordy Rose38f17d62011-08-23 19:01:07 +00003510
Ted Kremenek8bef8232012-01-26 21:29:00 +00003511ProgramStateRef
3512RetainCountChecker::handleSymbolDeath(ProgramStateRef state,
Jordy Rose910c4052011-09-02 06:44:22 +00003513 SymbolRef sid, RefVal V,
Jordy Rose38f17d62011-08-23 19:01:07 +00003514 SmallVectorImpl<SymbolRef> &Leaked) const {
Jordy Rose53376122011-08-24 04:48:19 +00003515 bool hasLeak = false;
Jordy Rose38f17d62011-08-23 19:01:07 +00003516 if (V.isOwned())
3517 hasLeak = true;
3518 else if (V.isNotOwned() || V.isReturnedOwned())
3519 hasLeak = (V.getCount() > 0);
3520
3521 if (!hasLeak)
Anna Zaks8d6b43c2012-08-14 00:36:15 +00003522 return removeRefBinding(state, sid);
Jordy Rose38f17d62011-08-23 19:01:07 +00003523
3524 Leaked.push_back(sid);
Anna Zaks8d6b43c2012-08-14 00:36:15 +00003525 return setRefBinding(state, sid, V ^ RefVal::ErrorLeak);
Jordy Rose38f17d62011-08-23 19:01:07 +00003526}
3527
3528ExplodedNode *
Ted Kremenek8bef8232012-01-26 21:29:00 +00003529RetainCountChecker::processLeaks(ProgramStateRef state,
Jordy Rose910c4052011-09-02 06:44:22 +00003530 SmallVectorImpl<SymbolRef> &Leaked,
3531 GenericNodeBuilderRefCount &Builder,
Anna Zaks6a93bd52011-10-25 19:57:11 +00003532 CheckerContext &Ctx,
3533 ExplodedNode *Pred) const {
Jordy Rose38f17d62011-08-23 19:01:07 +00003534 if (Leaked.empty())
3535 return Pred;
3536
3537 // Generate an intermediate node representing the leak point.
3538 ExplodedNode *N = Builder.MakeNode(state, Pred);
3539
3540 if (N) {
3541 for (SmallVectorImpl<SymbolRef>::iterator
3542 I = Leaked.begin(), E = Leaked.end(); I != E; ++I) {
3543
David Blaikie4e4d0842012-03-11 07:00:24 +00003544 const LangOptions &LOpts = Ctx.getASTContext().getLangOpts();
Anna Zaks6a93bd52011-10-25 19:57:11 +00003545 bool GCEnabled = Ctx.isObjCGCEnabled();
Jordy Rose17a38e22011-09-02 05:55:19 +00003546 CFRefBug *BT = Pred ? getLeakWithinFunctionBug(LOpts, GCEnabled)
3547 : getLeakAtReturnBug(LOpts, GCEnabled);
Jordy Rose38f17d62011-08-23 19:01:07 +00003548 assert(BT && "BugType not initialized.");
Jordy Rose20589562011-08-24 22:39:09 +00003549
Jordy Rose17a38e22011-09-02 05:55:19 +00003550 CFRefLeakReport *report = new CFRefLeakReport(*BT, LOpts, GCEnabled,
Anna Zaks6a93bd52011-10-25 19:57:11 +00003551 SummaryLog, N, *I, Ctx);
3552 Ctx.EmitReport(report);
Jordy Rose38f17d62011-08-23 19:01:07 +00003553 }
3554 }
3555
3556 return N;
3557}
3558
Anna Zaksaf498a22011-10-25 19:56:48 +00003559void RetainCountChecker::checkEndPath(CheckerContext &Ctx) const {
Ted Kremenek8bef8232012-01-26 21:29:00 +00003560 ProgramStateRef state = Ctx.getState();
Anna Zaksaf498a22011-10-25 19:56:48 +00003561 GenericNodeBuilderRefCount Bd(Ctx);
Jordy Rose38f17d62011-08-23 19:01:07 +00003562 RefBindings B = state->get<RefBindings>();
Anna Zaksaf498a22011-10-25 19:56:48 +00003563 ExplodedNode *Pred = Ctx.getPredecessor();
Jordy Rose38f17d62011-08-23 19:01:07 +00003564
3565 for (RefBindings::iterator I = B.begin(), E = B.end(); I != E; ++I) {
Anna Zaks6a93bd52011-10-25 19:57:11 +00003566 llvm::tie(Pred, state) = handleAutoreleaseCounts(state, Bd, Pred, Ctx,
Jordy Rose8d228632011-08-23 20:07:14 +00003567 I->first, I->second);
3568 if (!state)
Jordy Rose38f17d62011-08-23 19:01:07 +00003569 return;
3570 }
3571
Ted Kremenek0cf3d472012-02-07 00:24:33 +00003572 // If the current LocationContext has a parent, don't check for leaks.
3573 // We will do that later.
Anna Zaks8d6b43c2012-08-14 00:36:15 +00003574 // FIXME: we should instead check for imbalances of the retain/releases,
Ted Kremenek0cf3d472012-02-07 00:24:33 +00003575 // and suggest annotations.
3576 if (Ctx.getLocationContext()->getParent())
3577 return;
3578
Jordy Rose38f17d62011-08-23 19:01:07 +00003579 B = state->get<RefBindings>();
3580 SmallVector<SymbolRef, 10> Leaked;
3581
3582 for (RefBindings::iterator I = B.begin(), E = B.end(); I != E; ++I)
Jordy Rose8d228632011-08-23 20:07:14 +00003583 state = handleSymbolDeath(state, I->first, I->second, Leaked);
Jordy Rose38f17d62011-08-23 19:01:07 +00003584
Anna Zaks6a93bd52011-10-25 19:57:11 +00003585 processLeaks(state, Leaked, Bd, Ctx, Pred);
Jordy Rose38f17d62011-08-23 19:01:07 +00003586}
3587
3588const ProgramPointTag *
Jordy Rose910c4052011-09-02 06:44:22 +00003589RetainCountChecker::getDeadSymbolTag(SymbolRef sym) const {
Jordy Rose38f17d62011-08-23 19:01:07 +00003590 const SimpleProgramPointTag *&tag = DeadSymbolTags[sym];
3591 if (!tag) {
Dylan Noblesmithf7ccbad2012-02-05 02:13:05 +00003592 SmallString<64> buf;
Jordy Rose38f17d62011-08-23 19:01:07 +00003593 llvm::raw_svector_ostream out(buf);
Anna Zaksf62ceec2011-12-05 18:58:11 +00003594 out << "RetainCountChecker : Dead Symbol : ";
3595 sym->dumpToStream(out);
Jordy Rose38f17d62011-08-23 19:01:07 +00003596 tag = new SimpleProgramPointTag(out.str());
3597 }
3598 return tag;
3599}
3600
Jordy Rose910c4052011-09-02 06:44:22 +00003601void RetainCountChecker::checkDeadSymbols(SymbolReaper &SymReaper,
3602 CheckerContext &C) const {
Jordy Rose38f17d62011-08-23 19:01:07 +00003603 ExplodedNode *Pred = C.getPredecessor();
3604
Ted Kremenek8bef8232012-01-26 21:29:00 +00003605 ProgramStateRef state = C.getState();
Jordy Rose38f17d62011-08-23 19:01:07 +00003606 RefBindings B = state->get<RefBindings>();
3607
3608 // Update counts from autorelease pools
3609 for (SymbolReaper::dead_iterator I = SymReaper.dead_begin(),
3610 E = SymReaper.dead_end(); I != E; ++I) {
3611 SymbolRef Sym = *I;
3612 if (const RefVal *T = B.lookup(Sym)){
3613 // Use the symbol as the tag.
3614 // FIXME: This might not be as unique as we would like.
Anna Zaks4eff8232011-10-05 23:44:11 +00003615 GenericNodeBuilderRefCount Bd(C, getDeadSymbolTag(Sym));
Anna Zaks6a93bd52011-10-25 19:57:11 +00003616 llvm::tie(Pred, state) = handleAutoreleaseCounts(state, Bd, Pred, C,
Jordy Rose8d228632011-08-23 20:07:14 +00003617 Sym, *T);
3618 if (!state)
Jordy Rose38f17d62011-08-23 19:01:07 +00003619 return;
3620 }
3621 }
3622
3623 B = state->get<RefBindings>();
3624 SmallVector<SymbolRef, 10> Leaked;
3625
3626 for (SymbolReaper::dead_iterator I = SymReaper.dead_begin(),
3627 E = SymReaper.dead_end(); I != E; ++I) {
3628 if (const RefVal *T = B.lookup(*I))
3629 state = handleSymbolDeath(state, *I, *T, Leaked);
3630 }
3631
3632 {
Anna Zaks4eff8232011-10-05 23:44:11 +00003633 GenericNodeBuilderRefCount Bd(C, this);
Anna Zaks6a93bd52011-10-25 19:57:11 +00003634 Pred = processLeaks(state, Leaked, Bd, C, Pred);
Jordy Rose38f17d62011-08-23 19:01:07 +00003635 }
3636
3637 // Did we cache out?
3638 if (!Pred)
3639 return;
3640
3641 // Now generate a new node that nukes the old bindings.
3642 RefBindings::Factory &F = state->get_context<RefBindings>();
3643
3644 for (SymbolReaper::dead_iterator I = SymReaper.dead_begin(),
3645 E = SymReaper.dead_end(); I != E; ++I)
3646 B = F.remove(B, *I);
3647
3648 state = state->set<RefBindings>(B);
Anna Zaks0bd6b112011-10-26 21:06:34 +00003649 C.addTransition(state, Pred);
Jordy Rose38f17d62011-08-23 19:01:07 +00003650}
3651
Ted Kremenek8bef8232012-01-26 21:29:00 +00003652void RetainCountChecker::printState(raw_ostream &Out, ProgramStateRef State,
Jordy Rose910c4052011-09-02 06:44:22 +00003653 const char *NL, const char *Sep) const {
Jordy Rosedbd658e2011-08-28 19:11:56 +00003654
3655 RefBindings B = State->get<RefBindings>();
3656
3657 if (!B.isEmpty())
3658 Out << Sep << NL;
3659
3660 for (RefBindings::iterator I = B.begin(), E = B.end(); I != E; ++I) {
3661 Out << I->first << " : ";
3662 I->second.print(Out);
3663 Out << NL;
3664 }
Jordy Rosedbd658e2011-08-28 19:11:56 +00003665}
3666
3667//===----------------------------------------------------------------------===//
Jordy Rose910c4052011-09-02 06:44:22 +00003668// Checker registration.
Ted Kremenek6b3a0f72008-03-11 06:39:11 +00003669//===----------------------------------------------------------------------===//
3670
Jordy Rose17a38e22011-09-02 05:55:19 +00003671void ento::registerRetainCountChecker(CheckerManager &Mgr) {
Jordy Rose910c4052011-09-02 06:44:22 +00003672 Mgr.registerChecker<RetainCountChecker>();
Jordy Rose17a38e22011-09-02 05:55:19 +00003673}
3674