clang  6.0.0svn
RetainCountChecker.cpp
Go to the documentation of this file.
1 //==-- RetainCountChecker.cpp - Checks for leaks and other issues -*- C++ -*--//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This file defines the methods for RetainCountChecker, which implements
11 // a reference count checker for Core Foundation and Cocoa on (Mac OS X).
12 //
13 //===----------------------------------------------------------------------===//
14 
15 #include "AllocationDiagnostics.h"
16 #include "ClangSACheckers.h"
17 #include "SelectorExtras.h"
18 #include "clang/AST/Attr.h"
19 #include "clang/AST/DeclCXX.h"
20 #include "clang/AST/DeclObjC.h"
21 #include "clang/AST/ParentMap.h"
34 #include "llvm/ADT/DenseMap.h"
35 #include "llvm/ADT/FoldingSet.h"
36 #include "llvm/ADT/ImmutableList.h"
37 #include "llvm/ADT/ImmutableMap.h"
38 #include "llvm/ADT/STLExtras.h"
39 #include "llvm/ADT/SmallString.h"
40 #include "llvm/ADT/StringExtras.h"
41 #include <cstdarg>
42 #include <utility>
43 
44 using namespace clang;
45 using namespace ento;
46 using namespace objc_retain;
47 using llvm::StrInStrNoCase;
48 
49 //===----------------------------------------------------------------------===//
50 // Adapters for FoldingSet.
51 //===----------------------------------------------------------------------===//
52 
53 namespace llvm {
54 template <> struct FoldingSetTrait<ArgEffect> {
55 static inline void Profile(const ArgEffect X, FoldingSetNodeID &ID) {
56  ID.AddInteger((unsigned) X);
57 }
58 };
59 template <> struct FoldingSetTrait<RetEffect> {
60  static inline void Profile(const RetEffect &X, FoldingSetNodeID &ID) {
61  ID.AddInteger((unsigned) X.getKind());
62  ID.AddInteger((unsigned) X.getObjKind());
63 }
64 };
65 } // end llvm namespace
66 
67 //===----------------------------------------------------------------------===//
68 // Reference-counting logic (typestate + counts).
69 //===----------------------------------------------------------------------===//
70 
71 /// ArgEffects summarizes the effects of a function/method call on all of
72 /// its arguments.
74 
75 namespace {
76 class RefVal {
77 public:
78  enum Kind {
79  Owned = 0, // Owning reference.
80  NotOwned, // Reference is not owned by still valid (not freed).
81  Released, // Object has been released.
82  ReturnedOwned, // Returned object passes ownership to caller.
83  ReturnedNotOwned, // Return object does not pass ownership to caller.
84  ERROR_START,
85  ErrorDeallocNotOwned, // -dealloc called on non-owned object.
86  ErrorDeallocGC, // Calling -dealloc with GC enabled.
87  ErrorUseAfterRelease, // Object used after released.
88  ErrorReleaseNotOwned, // Release of an object that was not owned.
89  ERROR_LEAK_START,
90  ErrorLeak, // A memory leak due to excessive reference counts.
91  ErrorLeakReturned, // A memory leak due to the returning method not having
92  // the correct naming conventions.
93  ErrorGCLeakReturned,
94  ErrorOverAutorelease,
95  ErrorReturnedNotOwned
96  };
97 
98  /// Tracks how an object referenced by an ivar has been used.
99  ///
100  /// This accounts for us not knowing if an arbitrary ivar is supposed to be
101  /// stored at +0 or +1.
102  enum class IvarAccessHistory {
103  None,
104  AccessedDirectly,
105  ReleasedAfterDirectAccess
106  };
107 
108 private:
109  /// The number of outstanding retains.
110  unsigned Cnt;
111  /// The number of outstanding autoreleases.
112  unsigned ACnt;
113  /// The (static) type of the object at the time we started tracking it.
114  QualType T;
115 
116  /// The current state of the object.
117  ///
118  /// See the RefVal::Kind enum for possible values.
119  unsigned RawKind : 5;
120 
121  /// The kind of object being tracked (CF or ObjC), if known.
122  ///
123  /// See the RetEffect::ObjKind enum for possible values.
124  unsigned RawObjectKind : 2;
125 
126  /// True if the current state and/or retain count may turn out to not be the
127  /// best possible approximation of the reference counting state.
128  ///
129  /// If true, the checker may decide to throw away ("override") this state
130  /// in favor of something else when it sees the object being used in new ways.
131  ///
132  /// This setting should not be propagated to state derived from this state.
133  /// Once we start deriving new states, it would be inconsistent to override
134  /// them.
135  unsigned RawIvarAccessHistory : 2;
136 
137  RefVal(Kind k, RetEffect::ObjKind o, unsigned cnt, unsigned acnt, QualType t,
138  IvarAccessHistory IvarAccess)
139  : Cnt(cnt), ACnt(acnt), T(t), RawKind(static_cast<unsigned>(k)),
140  RawObjectKind(static_cast<unsigned>(o)),
141  RawIvarAccessHistory(static_cast<unsigned>(IvarAccess)) {
142  assert(getKind() == k && "not enough bits for the kind");
143  assert(getObjKind() == o && "not enough bits for the object kind");
144  assert(getIvarAccessHistory() == IvarAccess && "not enough bits");
145  }
146 
147 public:
148  Kind getKind() const { return static_cast<Kind>(RawKind); }
149 
150  RetEffect::ObjKind getObjKind() const {
151  return static_cast<RetEffect::ObjKind>(RawObjectKind);
152  }
153 
154  unsigned getCount() const { return Cnt; }
155  unsigned getAutoreleaseCount() const { return ACnt; }
156  unsigned getCombinedCounts() const { return Cnt + ACnt; }
157  void clearCounts() {
158  Cnt = 0;
159  ACnt = 0;
160  }
161  void setCount(unsigned i) {
162  Cnt = i;
163  }
164  void setAutoreleaseCount(unsigned i) {
165  ACnt = i;
166  }
167 
168  QualType getType() const { return T; }
169 
170  /// Returns what the analyzer knows about direct accesses to a particular
171  /// instance variable.
172  ///
173  /// If the object with this refcount wasn't originally from an Objective-C
174  /// ivar region, this should always return IvarAccessHistory::None.
175  IvarAccessHistory getIvarAccessHistory() const {
176  return static_cast<IvarAccessHistory>(RawIvarAccessHistory);
177  }
178 
179  bool isOwned() const {
180  return getKind() == Owned;
181  }
182 
183  bool isNotOwned() const {
184  return getKind() == NotOwned;
185  }
186 
187  bool isReturnedOwned() const {
188  return getKind() == ReturnedOwned;
189  }
190 
191  bool isReturnedNotOwned() const {
192  return getKind() == ReturnedNotOwned;
193  }
194 
195  /// Create a state for an object whose lifetime is the responsibility of the
196  /// current function, at least partially.
197  ///
198  /// Most commonly, this is an owned object with a retain count of +1.
199  static RefVal makeOwned(RetEffect::ObjKind o, QualType t,
200  unsigned Count = 1) {
201  return RefVal(Owned, o, Count, 0, t, IvarAccessHistory::None);
202  }
203 
204  /// Create a state for an object whose lifetime is not the responsibility of
205  /// the current function.
206  ///
207  /// Most commonly, this is an unowned object with a retain count of +0.
208  static RefVal makeNotOwned(RetEffect::ObjKind o, QualType t,
209  unsigned Count = 0) {
210  return RefVal(NotOwned, o, Count, 0, t, IvarAccessHistory::None);
211  }
212 
213  RefVal operator-(size_t i) const {
214  return RefVal(getKind(), getObjKind(), getCount() - i,
215  getAutoreleaseCount(), getType(), getIvarAccessHistory());
216  }
217 
218  RefVal operator+(size_t i) const {
219  return RefVal(getKind(), getObjKind(), getCount() + i,
220  getAutoreleaseCount(), getType(), getIvarAccessHistory());
221  }
222 
223  RefVal operator^(Kind k) const {
224  return RefVal(k, getObjKind(), getCount(), getAutoreleaseCount(),
225  getType(), getIvarAccessHistory());
226  }
227 
228  RefVal autorelease() const {
229  return RefVal(getKind(), getObjKind(), getCount(), getAutoreleaseCount()+1,
230  getType(), getIvarAccessHistory());
231  }
232 
233  RefVal withIvarAccess() const {
234  assert(getIvarAccessHistory() == IvarAccessHistory::None);
235  return RefVal(getKind(), getObjKind(), getCount(), getAutoreleaseCount(),
236  getType(), IvarAccessHistory::AccessedDirectly);
237  }
238 
239  RefVal releaseViaIvar() const {
240  assert(getIvarAccessHistory() == IvarAccessHistory::AccessedDirectly);
241  return RefVal(getKind(), getObjKind(), getCount(), getAutoreleaseCount(),
242  getType(), IvarAccessHistory::ReleasedAfterDirectAccess);
243  }
244 
245  // Comparison, profiling, and pretty-printing.
246 
247  bool hasSameState(const RefVal &X) const {
248  return getKind() == X.getKind() && Cnt == X.Cnt && ACnt == X.ACnt &&
249  getIvarAccessHistory() == X.getIvarAccessHistory();
250  }
251 
252  bool operator==(const RefVal& X) const {
253  return T == X.T && hasSameState(X) && getObjKind() == X.getObjKind();
254  }
255 
256  void Profile(llvm::FoldingSetNodeID& ID) const {
257  ID.Add(T);
258  ID.AddInteger(RawKind);
259  ID.AddInteger(Cnt);
260  ID.AddInteger(ACnt);
261  ID.AddInteger(RawObjectKind);
262  ID.AddInteger(RawIvarAccessHistory);
263  }
264 
265  void print(raw_ostream &Out) const;
266 };
267 
268 void RefVal::print(raw_ostream &Out) const {
269  if (!T.isNull())
270  Out << "Tracked " << T.getAsString() << '/';
271 
272  switch (getKind()) {
273  default: llvm_unreachable("Invalid RefVal kind");
274  case Owned: {
275  Out << "Owned";
276  unsigned cnt = getCount();
277  if (cnt) Out << " (+ " << cnt << ")";
278  break;
279  }
280 
281  case NotOwned: {
282  Out << "NotOwned";
283  unsigned cnt = getCount();
284  if (cnt) Out << " (+ " << cnt << ")";
285  break;
286  }
287 
288  case ReturnedOwned: {
289  Out << "ReturnedOwned";
290  unsigned cnt = getCount();
291  if (cnt) Out << " (+ " << cnt << ")";
292  break;
293  }
294 
295  case ReturnedNotOwned: {
296  Out << "ReturnedNotOwned";
297  unsigned cnt = getCount();
298  if (cnt) Out << " (+ " << cnt << ")";
299  break;
300  }
301 
302  case Released:
303  Out << "Released";
304  break;
305 
306  case ErrorDeallocGC:
307  Out << "-dealloc (GC)";
308  break;
309 
310  case ErrorDeallocNotOwned:
311  Out << "-dealloc (not-owned)";
312  break;
313 
314  case ErrorLeak:
315  Out << "Leaked";
316  break;
317 
318  case ErrorLeakReturned:
319  Out << "Leaked (Bad naming)";
320  break;
321 
322  case ErrorGCLeakReturned:
323  Out << "Leaked (GC-ed at return)";
324  break;
325 
326  case ErrorUseAfterRelease:
327  Out << "Use-After-Release [ERROR]";
328  break;
329 
330  case ErrorReleaseNotOwned:
331  Out << "Release of Not-Owned [ERROR]";
332  break;
333 
334  case RefVal::ErrorOverAutorelease:
335  Out << "Over-autoreleased";
336  break;
337 
338  case RefVal::ErrorReturnedNotOwned:
339  Out << "Non-owned object returned instead of owned";
340  break;
341  }
342 
343  switch (getIvarAccessHistory()) {
345  break;
346  case IvarAccessHistory::AccessedDirectly:
347  Out << " [direct ivar access]";
348  break;
349  case IvarAccessHistory::ReleasedAfterDirectAccess:
350  Out << " [released after direct ivar access]";
351  }
352 
353  if (ACnt) {
354  Out << " [autorelease -" << ACnt << ']';
355  }
356 }
357 } //end anonymous namespace
358 
359 //===----------------------------------------------------------------------===//
360 // RefBindings - State used to track object reference counts.
361 //===----------------------------------------------------------------------===//
362 
363 REGISTER_MAP_WITH_PROGRAMSTATE(RefBindings, SymbolRef, RefVal)
364 
365 static inline const RefVal *getRefBinding(ProgramStateRef State,
366  SymbolRef Sym) {
367  return State->get<RefBindings>(Sym);
368 }
369 
371  SymbolRef Sym, RefVal Val) {
372  return State->set<RefBindings>(Sym, Val);
373 }
374 
376  return State->remove<RefBindings>(Sym);
377 }
378 
379 //===----------------------------------------------------------------------===//
380 // Function/Method behavior summaries.
381 //===----------------------------------------------------------------------===//
382 
383 namespace {
384 class RetainSummary {
385  /// Args - a map of (index, ArgEffect) pairs, where index
386  /// specifies the argument (starting from 0). This can be sparsely
387  /// populated; arguments with no entry in Args use 'DefaultArgEffect'.
388  ArgEffects Args;
389 
390  /// DefaultArgEffect - The default ArgEffect to apply to arguments that
391  /// do not have an entry in Args.
392  ArgEffect DefaultArgEffect;
393 
394  /// Receiver - If this summary applies to an Objective-C message expression,
395  /// this is the effect applied to the state of the receiver.
396  ArgEffect Receiver;
397 
398  /// Ret - The effect on the return value. Used to indicate if the
399  /// function/method call returns a new tracked symbol.
400  RetEffect Ret;
401 
402 public:
403  RetainSummary(ArgEffects A, RetEffect R, ArgEffect defaultEff,
404  ArgEffect ReceiverEff)
405  : Args(A), DefaultArgEffect(defaultEff), Receiver(ReceiverEff), Ret(R) {}
406 
407  /// getArg - Return the argument effect on the argument specified by
408  /// idx (starting from 0).
409  ArgEffect getArg(unsigned idx) const {
410  if (const ArgEffect *AE = Args.lookup(idx))
411  return *AE;
412 
413  return DefaultArgEffect;
414  }
415 
416  void addArg(ArgEffects::Factory &af, unsigned idx, ArgEffect e) {
417  Args = af.add(Args, idx, e);
418  }
419 
420  /// setDefaultArgEffect - Set the default argument effect.
421  void setDefaultArgEffect(ArgEffect E) {
422  DefaultArgEffect = E;
423  }
424 
425  /// getRetEffect - Returns the effect on the return value of the call.
426  RetEffect getRetEffect() const { return Ret; }
427 
428  /// setRetEffect - Set the effect of the return value of the call.
429  void setRetEffect(RetEffect E) { Ret = E; }
430 
431 
432  /// Sets the effect on the receiver of the message.
433  void setReceiverEffect(ArgEffect e) { Receiver = e; }
434 
435  /// getReceiverEffect - Returns the effect on the receiver of the call.
436  /// This is only meaningful if the summary applies to an ObjCMessageExpr*.
437  ArgEffect getReceiverEffect() const { return Receiver; }
438 
439  /// Test if two retain summaries are identical. Note that merely equivalent
440  /// summaries are not necessarily identical (for example, if an explicit
441  /// argument effect matches the default effect).
442  bool operator==(const RetainSummary &Other) const {
443  return Args == Other.Args && DefaultArgEffect == Other.DefaultArgEffect &&
444  Receiver == Other.Receiver && Ret == Other.Ret;
445  }
446 
447  /// Profile this summary for inclusion in a FoldingSet.
448  void Profile(llvm::FoldingSetNodeID& ID) const {
449  ID.Add(Args);
450  ID.Add(DefaultArgEffect);
451  ID.Add(Receiver);
452  ID.Add(Ret);
453  }
454 
455  /// A retain summary is simple if it has no ArgEffects other than the default.
456  bool isSimple() const {
457  return Args.isEmpty();
458  }
459 
460 private:
461  ArgEffects getArgEffects() const { return Args; }
462  ArgEffect getDefaultArgEffect() const { return DefaultArgEffect; }
463 
464  friend class RetainSummaryManager;
465  friend class RetainCountChecker;
466 };
467 } // end anonymous namespace
468 
469 //===----------------------------------------------------------------------===//
470 // Data structures for constructing summaries.
471 //===----------------------------------------------------------------------===//
472 
473 namespace {
474 class ObjCSummaryKey {
475  IdentifierInfo* II;
476  Selector S;
477 public:
478  ObjCSummaryKey(IdentifierInfo* ii, Selector s)
479  : II(ii), S(s) {}
480 
481  ObjCSummaryKey(const ObjCInterfaceDecl *d, Selector s)
482  : II(d ? d->getIdentifier() : nullptr), S(s) {}
483 
484  ObjCSummaryKey(Selector s)
485  : II(nullptr), S(s) {}
486 
487  IdentifierInfo *getIdentifier() const { return II; }
488  Selector getSelector() const { return S; }
489 };
490 } // end anonymous namespace
491 
492 namespace llvm {
493 template <> struct DenseMapInfo<ObjCSummaryKey> {
494  static inline ObjCSummaryKey getEmptyKey() {
495  return ObjCSummaryKey(DenseMapInfo<IdentifierInfo*>::getEmptyKey(),
497  }
498 
499  static inline ObjCSummaryKey getTombstoneKey() {
500  return ObjCSummaryKey(DenseMapInfo<IdentifierInfo*>::getTombstoneKey(),
502  }
503 
504  static unsigned getHashValue(const ObjCSummaryKey &V) {
505  typedef std::pair<IdentifierInfo*, Selector> PairTy;
506  return DenseMapInfo<PairTy>::getHashValue(PairTy(V.getIdentifier(),
507  V.getSelector()));
508  }
509 
510  static bool isEqual(const ObjCSummaryKey& LHS, const ObjCSummaryKey& RHS) {
511  return LHS.getIdentifier() == RHS.getIdentifier() &&
512  LHS.getSelector() == RHS.getSelector();
513  }
514 
515 };
516 } // end llvm namespace
517 
518 namespace {
519 class ObjCSummaryCache {
520  typedef llvm::DenseMap<ObjCSummaryKey, const RetainSummary *> MapTy;
521  MapTy M;
522 public:
523  ObjCSummaryCache() {}
524 
525  const RetainSummary * find(const ObjCInterfaceDecl *D, Selector S) {
526  // Do a lookup with the (D,S) pair. If we find a match return
527  // the iterator.
528  ObjCSummaryKey K(D, S);
529  MapTy::iterator I = M.find(K);
530 
531  if (I != M.end())
532  return I->second;
533  if (!D)
534  return nullptr;
535 
536  // Walk the super chain. If we find a hit with a parent, we'll end
537  // up returning that summary. We actually allow that key (null,S), as
538  // we cache summaries for the null ObjCInterfaceDecl* to allow us to
539  // generate initial summaries without having to worry about NSObject
540  // being declared.
541  // FIXME: We may change this at some point.
542  for (ObjCInterfaceDecl *C=D->getSuperClass() ;; C=C->getSuperClass()) {
543  if ((I = M.find(ObjCSummaryKey(C, S))) != M.end())
544  break;
545 
546  if (!C)
547  return nullptr;
548  }
549 
550  // Cache the summary with original key to make the next lookup faster
551  // and return the iterator.
552  const RetainSummary *Summ = I->second;
553  M[K] = Summ;
554  return Summ;
555  }
556 
557  const RetainSummary *find(IdentifierInfo* II, Selector S) {
558  // FIXME: Class method lookup. Right now we dont' have a good way
559  // of going between IdentifierInfo* and the class hierarchy.
560  MapTy::iterator I = M.find(ObjCSummaryKey(II, S));
561 
562  if (I == M.end())
563  I = M.find(ObjCSummaryKey(S));
564 
565  return I == M.end() ? nullptr : I->second;
566  }
567 
568  const RetainSummary *& operator[](ObjCSummaryKey K) {
569  return M[K];
570  }
571 
572  const RetainSummary *& operator[](Selector S) {
573  return M[ ObjCSummaryKey(S) ];
574  }
575 };
576 } // end anonymous namespace
577 
578 //===----------------------------------------------------------------------===//
579 // Data structures for managing collections of summaries.
580 //===----------------------------------------------------------------------===//
581 
582 namespace {
583 class RetainSummaryManager {
584 
585  //==-----------------------------------------------------------------==//
586  // Typedefs.
587  //==-----------------------------------------------------------------==//
588 
589  typedef llvm::DenseMap<const FunctionDecl*, const RetainSummary *>
590  FuncSummariesTy;
591 
592  typedef ObjCSummaryCache ObjCMethodSummariesTy;
593 
594  typedef llvm::FoldingSetNodeWrapper<RetainSummary> CachedSummaryNode;
595 
596  //==-----------------------------------------------------------------==//
597  // Data.
598  //==-----------------------------------------------------------------==//
599 
600  /// Ctx - The ASTContext object for the analyzed ASTs.
601  ASTContext &Ctx;
602 
603  /// GCEnabled - Records whether or not the analyzed code runs in GC mode.
604  const bool GCEnabled;
605 
606  /// Records whether or not the analyzed code runs in ARC mode.
607  const bool ARCEnabled;
608 
609  /// FuncSummaries - A map from FunctionDecls to summaries.
610  FuncSummariesTy FuncSummaries;
611 
612  /// ObjCClassMethodSummaries - A map from selectors (for instance methods)
613  /// to summaries.
614  ObjCMethodSummariesTy ObjCClassMethodSummaries;
615 
616  /// ObjCMethodSummaries - A map from selectors to summaries.
617  ObjCMethodSummariesTy ObjCMethodSummaries;
618 
619  /// BPAlloc - A BumpPtrAllocator used for allocating summaries, ArgEffects,
620  /// and all other data used by the checker.
621  llvm::BumpPtrAllocator BPAlloc;
622 
623  /// AF - A factory for ArgEffects objects.
624  ArgEffects::Factory AF;
625 
626  /// ScratchArgs - A holding buffer for construct ArgEffects.
627  ArgEffects ScratchArgs;
628 
629  /// ObjCAllocRetE - Default return effect for methods returning Objective-C
630  /// objects.
631  RetEffect ObjCAllocRetE;
632 
633  /// ObjCInitRetE - Default return effect for init methods returning
634  /// Objective-C objects.
635  RetEffect ObjCInitRetE;
636 
637  /// SimpleSummaries - Used for uniquing summaries that don't have special
638  /// effects.
639  llvm::FoldingSet<CachedSummaryNode> SimpleSummaries;
640 
641  //==-----------------------------------------------------------------==//
642  // Methods.
643  //==-----------------------------------------------------------------==//
644 
645  /// getArgEffects - Returns a persistent ArgEffects object based on the
646  /// data in ScratchArgs.
647  ArgEffects getArgEffects();
648 
649  enum UnaryFuncKind { cfretain, cfrelease, cfautorelease, cfmakecollectable };
650 
651  const RetainSummary *getUnarySummary(const FunctionType* FT,
652  UnaryFuncKind func);
653 
654  const RetainSummary *getCFSummaryCreateRule(const FunctionDecl *FD);
655  const RetainSummary *getCFSummaryGetRule(const FunctionDecl *FD);
656  const RetainSummary *getCFCreateGetRuleSummary(const FunctionDecl *FD);
657 
658  const RetainSummary *getPersistentSummary(const RetainSummary &OldSumm);
659 
660  const RetainSummary *getPersistentSummary(RetEffect RetEff,
661  ArgEffect ReceiverEff = DoNothing,
662  ArgEffect DefaultEff = MayEscape) {
663  RetainSummary Summ(getArgEffects(), RetEff, DefaultEff, ReceiverEff);
664  return getPersistentSummary(Summ);
665  }
666 
667  const RetainSummary *getDoNothingSummary() {
668  return getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
669  }
670 
671  const RetainSummary *getDefaultSummary() {
672  return getPersistentSummary(RetEffect::MakeNoRet(),
674  }
675 
676  const RetainSummary *getPersistentStopSummary() {
677  return getPersistentSummary(RetEffect::MakeNoRet(),
679  }
680 
681  void InitializeClassMethodSummaries();
682  void InitializeMethodSummaries();
683 private:
684  void addNSObjectClsMethSummary(Selector S, const RetainSummary *Summ) {
685  ObjCClassMethodSummaries[S] = Summ;
686  }
687 
688  void addNSObjectMethSummary(Selector S, const RetainSummary *Summ) {
689  ObjCMethodSummaries[S] = Summ;
690  }
691 
692  void addClassMethSummary(const char* Cls, const char* name,
693  const RetainSummary *Summ, bool isNullary = true) {
694  IdentifierInfo* ClsII = &Ctx.Idents.get(Cls);
695  Selector S = isNullary ? GetNullarySelector(name, Ctx)
696  : GetUnarySelector(name, Ctx);
697  ObjCClassMethodSummaries[ObjCSummaryKey(ClsII, S)] = Summ;
698  }
699 
700  void addInstMethSummary(const char* Cls, const char* nullaryName,
701  const RetainSummary *Summ) {
702  IdentifierInfo* ClsII = &Ctx.Idents.get(Cls);
703  Selector S = GetNullarySelector(nullaryName, Ctx);
704  ObjCMethodSummaries[ObjCSummaryKey(ClsII, S)] = Summ;
705  }
706 
707  template <typename... Keywords>
708  void addMethodSummary(IdentifierInfo *ClsII, ObjCMethodSummariesTy &Summaries,
709  const RetainSummary *Summ, Keywords *... Kws) {
710  Selector S = getKeywordSelector(Ctx, Kws...);
711  Summaries[ObjCSummaryKey(ClsII, S)] = Summ;
712  }
713 
714  template <typename... Keywords>
715  void addInstMethSummary(const char *Cls, const RetainSummary *Summ,
716  Keywords *... Kws) {
717  addMethodSummary(&Ctx.Idents.get(Cls), ObjCMethodSummaries, Summ, Kws...);
718  }
719 
720  template <typename... Keywords>
721  void addClsMethSummary(const char *Cls, const RetainSummary *Summ,
722  Keywords *... Kws) {
723  addMethodSummary(&Ctx.Idents.get(Cls), ObjCClassMethodSummaries, Summ,
724  Kws...);
725  }
726 
727  template <typename... Keywords>
728  void addClsMethSummary(IdentifierInfo *II, const RetainSummary *Summ,
729  Keywords *... Kws) {
730  addMethodSummary(II, ObjCClassMethodSummaries, Summ, Kws...);
731  }
732 
733 public:
734 
735  RetainSummaryManager(ASTContext &ctx, bool gcenabled, bool usesARC)
736  : Ctx(ctx),
737  GCEnabled(gcenabled),
738  ARCEnabled(usesARC),
739  AF(BPAlloc), ScratchArgs(AF.getEmptyMap()),
740  ObjCAllocRetE(gcenabled
744  ObjCInitRetE(gcenabled
746  : (usesARC ? RetEffect::MakeNotOwned(RetEffect::ObjC)
748  InitializeClassMethodSummaries();
749  InitializeMethodSummaries();
750  }
751 
752  const RetainSummary *getSummary(const CallEvent &Call,
753  ProgramStateRef State = nullptr);
754 
755  const RetainSummary *getFunctionSummary(const FunctionDecl *FD);
756 
757  const RetainSummary *getMethodSummary(Selector S, const ObjCInterfaceDecl *ID,
758  const ObjCMethodDecl *MD,
759  QualType RetTy,
760  ObjCMethodSummariesTy &CachedSummaries);
761 
762  const RetainSummary *getInstanceMethodSummary(const ObjCMethodCall &M,
764 
765  const RetainSummary *getClassMethodSummary(const ObjCMethodCall &M) {
766  assert(!M.isInstanceMessage());
767  const ObjCInterfaceDecl *Class = M.getReceiverInterface();
768 
769  return getMethodSummary(M.getSelector(), Class, M.getDecl(),
770  M.getResultType(), ObjCClassMethodSummaries);
771  }
772 
773  /// getMethodSummary - This version of getMethodSummary is used to query
774  /// the summary for the current method being analyzed.
775  const RetainSummary *getMethodSummary(const ObjCMethodDecl *MD) {
776  const ObjCInterfaceDecl *ID = MD->getClassInterface();
777  Selector S = MD->getSelector();
778  QualType ResultTy = MD->getReturnType();
779 
780  ObjCMethodSummariesTy *CachedSummaries;
781  if (MD->isInstanceMethod())
782  CachedSummaries = &ObjCMethodSummaries;
783  else
784  CachedSummaries = &ObjCClassMethodSummaries;
785 
786  return getMethodSummary(S, ID, MD, ResultTy, *CachedSummaries);
787  }
788 
789  const RetainSummary *getStandardMethodSummary(const ObjCMethodDecl *MD,
790  Selector S, QualType RetTy);
791 
792  /// Determine if there is a special return effect for this function or method.
793  Optional<RetEffect> getRetEffectFromAnnotations(QualType RetTy,
794  const Decl *D);
795 
796  void updateSummaryFromAnnotations(const RetainSummary *&Summ,
797  const ObjCMethodDecl *MD);
798 
799  void updateSummaryFromAnnotations(const RetainSummary *&Summ,
800  const FunctionDecl *FD);
801 
802  void updateSummaryForCall(const RetainSummary *&Summ,
803  const CallEvent &Call);
804 
805  bool isGCEnabled() const { return GCEnabled; }
806 
807  bool isARCEnabled() const { return ARCEnabled; }
808 
809  bool isARCorGCEnabled() const { return GCEnabled || ARCEnabled; }
810 
811  RetEffect getObjAllocRetEffect() const { return ObjCAllocRetE; }
812 
813  friend class RetainSummaryTemplate;
814 };
815 
816 // Used to avoid allocating long-term (BPAlloc'd) memory for default retain
817 // summaries. If a function or method looks like it has a default summary, but
818 // it has annotations, the annotations are added to the stack-based template
819 // and then copied into managed memory.
820 class RetainSummaryTemplate {
821  RetainSummaryManager &Manager;
822  const RetainSummary *&RealSummary;
823  RetainSummary ScratchSummary;
824  bool Accessed;
825 public:
826  RetainSummaryTemplate(const RetainSummary *&real, RetainSummaryManager &mgr)
827  : Manager(mgr), RealSummary(real), ScratchSummary(*real), Accessed(false) {}
828 
829  ~RetainSummaryTemplate() {
830  if (Accessed)
831  RealSummary = Manager.getPersistentSummary(ScratchSummary);
832  }
833 
834  RetainSummary &operator*() {
835  Accessed = true;
836  return ScratchSummary;
837  }
838 
839  RetainSummary *operator->() {
840  Accessed = true;
841  return &ScratchSummary;
842  }
843 };
844 
845 } // end anonymous namespace
846 
847 //===----------------------------------------------------------------------===//
848 // Implementation of checker data structures.
849 //===----------------------------------------------------------------------===//
850 
851 ArgEffects RetainSummaryManager::getArgEffects() {
852  ArgEffects AE = ScratchArgs;
853  ScratchArgs = AF.getEmptyMap();
854  return AE;
855 }
856 
857 const RetainSummary *
858 RetainSummaryManager::getPersistentSummary(const RetainSummary &OldSumm) {
859  // Unique "simple" summaries -- those without ArgEffects.
860  if (OldSumm.isSimple()) {
861  llvm::FoldingSetNodeID ID;
862  OldSumm.Profile(ID);
863 
864  void *Pos;
865  CachedSummaryNode *N = SimpleSummaries.FindNodeOrInsertPos(ID, Pos);
866 
867  if (!N) {
868  N = (CachedSummaryNode *) BPAlloc.Allocate<CachedSummaryNode>();
869  new (N) CachedSummaryNode(OldSumm);
870  SimpleSummaries.InsertNode(N, Pos);
871  }
872 
873  return &N->getValue();
874  }
875 
876  RetainSummary *Summ = (RetainSummary *) BPAlloc.Allocate<RetainSummary>();
877  new (Summ) RetainSummary(OldSumm);
878  return Summ;
879 }
880 
881 //===----------------------------------------------------------------------===//
882 // Summary creation for functions (largely uses of Core Foundation).
883 //===----------------------------------------------------------------------===//
884 
885 static bool isRetain(const FunctionDecl *FD, StringRef FName) {
886  return FName.endswith("Retain");
887 }
888 
889 static bool isRelease(const FunctionDecl *FD, StringRef FName) {
890  return FName.endswith("Release");
891 }
892 
893 static bool isAutorelease(const FunctionDecl *FD, StringRef FName) {
894  return FName.endswith("Autorelease");
895 }
896 
897 static bool isMakeCollectable(const FunctionDecl *FD, StringRef FName) {
898  // FIXME: Remove FunctionDecl parameter.
899  // FIXME: Is it really okay if MakeCollectable isn't a suffix?
900  return FName.find("MakeCollectable") != StringRef::npos;
901 }
902 
904  switch (E) {
905  case DoNothing:
906  case Autorelease:
908  case IncRef:
909  case IncRefMsg:
910  case MakeCollectable:
913  case MayEscape:
914  case StopTracking:
915  case StopTrackingHard:
916  return StopTrackingHard;
917  case DecRef:
920  case DecRefMsg:
923  case Dealloc:
924  return Dealloc;
925  }
926 
927  llvm_unreachable("Unknown ArgEffect kind");
928 }
929 
930 void RetainSummaryManager::updateSummaryForCall(const RetainSummary *&S,
931  const CallEvent &Call) {
932  if (Call.hasNonZeroCallbackArg()) {
933  ArgEffect RecEffect =
934  getStopTrackingHardEquivalent(S->getReceiverEffect());
935  ArgEffect DefEffect =
936  getStopTrackingHardEquivalent(S->getDefaultArgEffect());
937 
938  ArgEffects CustomArgEffects = S->getArgEffects();
939  for (ArgEffects::iterator I = CustomArgEffects.begin(),
940  E = CustomArgEffects.end();
941  I != E; ++I) {
942  ArgEffect Translated = getStopTrackingHardEquivalent(I->second);
943  if (Translated != DefEffect)
944  ScratchArgs = AF.add(ScratchArgs, I->first, Translated);
945  }
946 
948 
949  // Special cases where the callback argument CANNOT free the return value.
950  // This can generally only happen if we know that the callback will only be
951  // called when the return value is already being deallocated.
952  if (const SimpleFunctionCall *FC = dyn_cast<SimpleFunctionCall>(&Call)) {
953  if (IdentifierInfo *Name = FC->getDecl()->getIdentifier()) {
954  // When the CGBitmapContext is deallocated, the callback here will free
955  // the associated data buffer.
956  // The callback in dispatch_data_create frees the buffer, but not
957  // the data object.
958  if (Name->isStr("CGBitmapContextCreateWithData") ||
959  Name->isStr("dispatch_data_create"))
960  RE = S->getRetEffect();
961  }
962  }
963 
964  S = getPersistentSummary(RE, RecEffect, DefEffect);
965  }
966 
967  // Special case '[super init];' and '[self init];'
968  //
969  // Even though calling '[super init]' without assigning the result to self
970  // and checking if the parent returns 'nil' is a bad pattern, it is common.
971  // Additionally, our Self Init checker already warns about it. To avoid
972  // overwhelming the user with messages from both checkers, we model the case
973  // of '[super init]' in cases when it is not consumed by another expression
974  // as if the call preserves the value of 'self'; essentially, assuming it can
975  // never fail and return 'nil'.
976  // Note, we don't want to just stop tracking the value since we want the
977  // RetainCount checker to report leaks and use-after-free if SelfInit checker
978  // is turned off.
979  if (const ObjCMethodCall *MC = dyn_cast<ObjCMethodCall>(&Call)) {
980  if (MC->getMethodFamily() == OMF_init && MC->isReceiverSelfOrSuper()) {
981 
982  // Check if the message is not consumed, we know it will not be used in
983  // an assignment, ex: "self = [super init]".
984  const Expr *ME = MC->getOriginExpr();
985  const LocationContext *LCtx = MC->getLocationContext();
987  if (!PM.isConsumedExpr(ME)) {
988  RetainSummaryTemplate ModifiableSummaryTemplate(S, *this);
989  ModifiableSummaryTemplate->setReceiverEffect(DoNothing);
990  ModifiableSummaryTemplate->setRetEffect(RetEffect::MakeNoRet());
991  }
992  }
993  }
994 }
995 
996 const RetainSummary *
997 RetainSummaryManager::getSummary(const CallEvent &Call,
999  const RetainSummary *Summ;
1000  switch (Call.getKind()) {
1001  case CE_Function:
1002  Summ = getFunctionSummary(cast<SimpleFunctionCall>(Call).getDecl());
1003  break;
1004  case CE_CXXMember:
1005  case CE_CXXMemberOperator:
1006  case CE_Block:
1007  case CE_CXXConstructor:
1008  case CE_CXXDestructor:
1009  case CE_CXXAllocator:
1010  // FIXME: These calls are currently unsupported.
1011  return getPersistentStopSummary();
1012  case CE_ObjCMessage: {
1013  const ObjCMethodCall &Msg = cast<ObjCMethodCall>(Call);
1014  if (Msg.isInstanceMessage())
1015  Summ = getInstanceMethodSummary(Msg, State);
1016  else
1017  Summ = getClassMethodSummary(Msg);
1018  break;
1019  }
1020  }
1021 
1022  updateSummaryForCall(Summ, Call);
1023 
1024  assert(Summ && "Unknown call type?");
1025  return Summ;
1026 }
1027 
1028 const RetainSummary *
1029 RetainSummaryManager::getFunctionSummary(const FunctionDecl *FD) {
1030  // If we don't know what function we're calling, use our default summary.
1031  if (!FD)
1032  return getDefaultSummary();
1033 
1034  // Look up a summary in our cache of FunctionDecls -> Summaries.
1035  FuncSummariesTy::iterator I = FuncSummaries.find(FD);
1036  if (I != FuncSummaries.end())
1037  return I->second;
1038 
1039  // No summary? Generate one.
1040  const RetainSummary *S = nullptr;
1041  bool AllowAnnotations = true;
1042 
1043  do {
1044  // We generate "stop" summaries for implicitly defined functions.
1045  if (FD->isImplicit()) {
1046  S = getPersistentStopSummary();
1047  break;
1048  }
1049 
1050  // [PR 3337] Use 'getAs<FunctionType>' to strip away any typedefs on the
1051  // function's type.
1052  const FunctionType* FT = FD->getType()->getAs<FunctionType>();
1053  const IdentifierInfo *II = FD->getIdentifier();
1054  if (!II)
1055  break;
1056 
1057  StringRef FName = II->getName();
1058 
1059  // Strip away preceding '_'. Doing this here will effect all the checks
1060  // down below.
1061  FName = FName.substr(FName.find_first_not_of('_'));
1062 
1063  // Inspect the result type.
1064  QualType RetTy = FT->getReturnType();
1065  std::string RetTyName = RetTy.getAsString();
1066 
1067  // FIXME: This should all be refactored into a chain of "summary lookup"
1068  // filters.
1069  assert(ScratchArgs.isEmpty());
1070 
1071  if (FName == "pthread_create" || FName == "pthread_setspecific") {
1072  // Part of: <rdar://problem/7299394> and <rdar://problem/11282706>.
1073  // This will be addressed better with IPA.
1074  S = getPersistentStopSummary();
1075  } else if (FName == "NSMakeCollectable") {
1076  // Handle: id NSMakeCollectable(CFTypeRef)
1077  S = (RetTy->isObjCIdType())
1078  ? getUnarySummary(FT, cfmakecollectable)
1079  : getPersistentStopSummary();
1080  // The headers on OS X 10.8 use cf_consumed/ns_returns_retained,
1081  // but we can fully model NSMakeCollectable ourselves.
1082  AllowAnnotations = false;
1083  } else if (FName == "CFPlugInInstanceCreate") {
1084  S = getPersistentSummary(RetEffect::MakeNoRet());
1085  } else if (FName == "IORegistryEntrySearchCFProperty"
1086  || (RetTyName == "CFMutableDictionaryRef" && (
1087  FName == "IOBSDNameMatching" ||
1088  FName == "IOServiceMatching" ||
1089  FName == "IOServiceNameMatching" ||
1090  FName == "IORegistryEntryIDMatching" ||
1091  FName == "IOOpenFirmwarePathMatching"
1092  ))) {
1093  // Part of <rdar://problem/6961230>. (IOKit)
1094  // This should be addressed using a API table.
1095  S = getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF),
1096  DoNothing, DoNothing);
1097  } else if (FName == "IOServiceGetMatchingService" ||
1098  FName == "IOServiceGetMatchingServices") {
1099  // FIXES: <rdar://problem/6326900>
1100  // This should be addressed using a API table. This strcmp is also
1101  // a little gross, but there is no need to super optimize here.
1102  ScratchArgs = AF.add(ScratchArgs, 1, DecRef);
1103  S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
1104  } else if (FName == "IOServiceAddNotification" ||
1105  FName == "IOServiceAddMatchingNotification") {
1106  // Part of <rdar://problem/6961230>. (IOKit)
1107  // This should be addressed using a API table.
1108  ScratchArgs = AF.add(ScratchArgs, 2, DecRef);
1109  S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
1110  } else if (FName == "CVPixelBufferCreateWithBytes") {
1111  // FIXES: <rdar://problem/7283567>
1112  // Eventually this can be improved by recognizing that the pixel
1113  // buffer passed to CVPixelBufferCreateWithBytes is released via
1114  // a callback and doing full IPA to make sure this is done correctly.
1115  // FIXME: This function has an out parameter that returns an
1116  // allocated object.
1117  ScratchArgs = AF.add(ScratchArgs, 7, StopTracking);
1118  S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
1119  } else if (FName == "CGBitmapContextCreateWithData") {
1120  // FIXES: <rdar://problem/7358899>
1121  // Eventually this can be improved by recognizing that 'releaseInfo'
1122  // passed to CGBitmapContextCreateWithData is released via
1123  // a callback and doing full IPA to make sure this is done correctly.
1124  ScratchArgs = AF.add(ScratchArgs, 8, StopTracking);
1125  S = getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF),
1126  DoNothing, DoNothing);
1127  } else if (FName == "CVPixelBufferCreateWithPlanarBytes") {
1128  // FIXES: <rdar://problem/7283567>
1129  // Eventually this can be improved by recognizing that the pixel
1130  // buffer passed to CVPixelBufferCreateWithPlanarBytes is released
1131  // via a callback and doing full IPA to make sure this is done
1132  // correctly.
1133  ScratchArgs = AF.add(ScratchArgs, 12, StopTracking);
1134  S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
1135  } else if (FName == "VTCompressionSessionEncodeFrame") {
1136  // The context argument passed to VTCompressionSessionEncodeFrame()
1137  // is passed to the callback specified when creating the session
1138  // (e.g. with VTCompressionSessionCreate()) which can release it.
1139  // To account for this possibility, conservatively stop tracking
1140  // the context.
1141  ScratchArgs = AF.add(ScratchArgs, 5, StopTracking);
1142  S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
1143  } else if (FName == "dispatch_set_context" ||
1144  FName == "xpc_connection_set_context") {
1145  // <rdar://problem/11059275> - The analyzer currently doesn't have
1146  // a good way to reason about the finalizer function for libdispatch.
1147  // If we pass a context object that is memory managed, stop tracking it.
1148  // <rdar://problem/13783514> - Same problem, but for XPC.
1149  // FIXME: this hack should possibly go away once we can handle
1150  // libdispatch and XPC finalizers.
1151  ScratchArgs = AF.add(ScratchArgs, 1, StopTracking);
1152  S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
1153  } else if (FName.startswith("NSLog")) {
1154  S = getDoNothingSummary();
1155  } else if (FName.startswith("NS") &&
1156  (FName.find("Insert") != StringRef::npos)) {
1157  // Whitelist NSXXInsertXX, for example NSMapInsertIfAbsent, since they can
1158  // be deallocated by NSMapRemove. (radar://11152419)
1159  ScratchArgs = AF.add(ScratchArgs, 1, StopTracking);
1160  ScratchArgs = AF.add(ScratchArgs, 2, StopTracking);
1161  S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
1162  }
1163 
1164  // Did we get a summary?
1165  if (S)
1166  break;
1167 
1168  if (RetTy->isPointerType()) {
1169  // For CoreFoundation ('CF') types.
1170  if (cocoa::isRefType(RetTy, "CF", FName)) {
1171  if (isRetain(FD, FName)) {
1172  S = getUnarySummary(FT, cfretain);
1173  // CFRetain isn't supposed to be annotated. However, this may as well
1174  // be a user-made "safe" CFRetain function that is incorrectly
1175  // annotated as cf_returns_retained due to lack of better options.
1176  // We want to ignore such annotation.
1177  AllowAnnotations = false;
1178  } else if (isAutorelease(FD, FName)) {
1179  S = getUnarySummary(FT, cfautorelease);
1180  // The headers use cf_consumed, but we can fully model CFAutorelease
1181  // ourselves.
1182  AllowAnnotations = false;
1183  } else if (isMakeCollectable(FD, FName)) {
1184  S = getUnarySummary(FT, cfmakecollectable);
1185  AllowAnnotations = false;
1186  } else {
1187  S = getCFCreateGetRuleSummary(FD);
1188  }
1189 
1190  break;
1191  }
1192 
1193  // For CoreGraphics ('CG') and CoreVideo ('CV') types.
1194  if (cocoa::isRefType(RetTy, "CG", FName) ||
1195  cocoa::isRefType(RetTy, "CV", FName)) {
1196  if (isRetain(FD, FName))
1197  S = getUnarySummary(FT, cfretain);
1198  else
1199  S = getCFCreateGetRuleSummary(FD);
1200 
1201  break;
1202  }
1203 
1204  // For the Disk Arbitration API (DiskArbitration/DADisk.h)
1205  if (cocoa::isRefType(RetTy, "DADisk") ||
1206  cocoa::isRefType(RetTy, "DADissenter") ||
1207  cocoa::isRefType(RetTy, "DASessionRef")) {
1208  S = getCFCreateGetRuleSummary(FD);
1209  break;
1210  }
1211 
1212  if (FD->hasAttr<CFAuditedTransferAttr>()) {
1213  S = getCFCreateGetRuleSummary(FD);
1214  break;
1215  }
1216 
1217  break;
1218  }
1219 
1220  // Check for release functions, the only kind of functions that we care
1221  // about that don't return a pointer type.
1222  if (FName.size() >= 2 &&
1223  FName[0] == 'C' && (FName[1] == 'F' || FName[1] == 'G')) {
1224  // Test for 'CGCF'.
1225  FName = FName.substr(FName.startswith("CGCF") ? 4 : 2);
1226 
1227  if (isRelease(FD, FName))
1228  S = getUnarySummary(FT, cfrelease);
1229  else {
1230  assert (ScratchArgs.isEmpty());
1231  // Remaining CoreFoundation and CoreGraphics functions.
1232  // We use to assume that they all strictly followed the ownership idiom
1233  // and that ownership cannot be transferred. While this is technically
1234  // correct, many methods allow a tracked object to escape. For example:
1235  //
1236  // CFMutableDictionaryRef x = CFDictionaryCreateMutable(...);
1237  // CFDictionaryAddValue(y, key, x);
1238  // CFRelease(x);
1239  // ... it is okay to use 'x' since 'y' has a reference to it
1240  //
1241  // We handle this and similar cases with the follow heuristic. If the
1242  // function name contains "InsertValue", "SetValue", "AddValue",
1243  // "AppendValue", or "SetAttribute", then we assume that arguments may
1244  // "escape." This means that something else holds on to the object,
1245  // allowing it be used even after its local retain count drops to 0.
1246  ArgEffect E = (StrInStrNoCase(FName, "InsertValue") != StringRef::npos||
1247  StrInStrNoCase(FName, "AddValue") != StringRef::npos ||
1248  StrInStrNoCase(FName, "SetValue") != StringRef::npos ||
1249  StrInStrNoCase(FName, "AppendValue") != StringRef::npos||
1250  StrInStrNoCase(FName, "SetAttribute") != StringRef::npos)
1251  ? MayEscape : DoNothing;
1252 
1253  S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, E);
1254  }
1255  }
1256  }
1257  while (0);
1258 
1259  // If we got all the way here without any luck, use a default summary.
1260  if (!S)
1261  S = getDefaultSummary();
1262 
1263  // Annotations override defaults.
1264  if (AllowAnnotations)
1265  updateSummaryFromAnnotations(S, FD);
1266 
1267  FuncSummaries[FD] = S;
1268  return S;
1269 }
1270 
1271 const RetainSummary *
1272 RetainSummaryManager::getCFCreateGetRuleSummary(const FunctionDecl *FD) {
1274  return getCFSummaryCreateRule(FD);
1275 
1276  return getCFSummaryGetRule(FD);
1277 }
1278 
1279 const RetainSummary *
1280 RetainSummaryManager::getUnarySummary(const FunctionType* FT,
1281  UnaryFuncKind func) {
1282 
1283  // Sanity check that this is *really* a unary function. This can
1284  // happen if people do weird things.
1285  const FunctionProtoType* FTP = dyn_cast<FunctionProtoType>(FT);
1286  if (!FTP || FTP->getNumParams() != 1)
1287  return getPersistentStopSummary();
1288 
1289  assert (ScratchArgs.isEmpty());
1290 
1291  ArgEffect Effect;
1292  switch (func) {
1293  case cfretain: Effect = IncRef; break;
1294  case cfrelease: Effect = DecRef; break;
1295  case cfautorelease: Effect = Autorelease; break;
1296  case cfmakecollectable: Effect = MakeCollectable; break;
1297  }
1298 
1299  ScratchArgs = AF.add(ScratchArgs, 0, Effect);
1300  return getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
1301 }
1302 
1303 const RetainSummary *
1304 RetainSummaryManager::getCFSummaryCreateRule(const FunctionDecl *FD) {
1305  assert (ScratchArgs.isEmpty());
1306 
1307  return getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF));
1308 }
1309 
1310 const RetainSummary *
1311 RetainSummaryManager::getCFSummaryGetRule(const FunctionDecl *FD) {
1312  assert (ScratchArgs.isEmpty());
1313  return getPersistentSummary(RetEffect::MakeNotOwned(RetEffect::CF),
1314  DoNothing, DoNothing);
1315 }
1316 
1317 /// Returns true if the declaration 'D' is annotated with 'rcAnnotation'.
1318 static bool hasRCAnnotation(const Decl *D, StringRef rcAnnotation) {
1319  for (const auto *Ann : D->specific_attrs<AnnotateAttr>()) {
1320  if (Ann->getAnnotation() == rcAnnotation)
1321  return true;
1322  }
1323  return false;
1324 }
1325 
1326 /// Returns true if the function declaration 'FD' contains
1327 /// 'rc_ownership_trusted_implementation' annotate attribute.
1329  return hasRCAnnotation(FD, "rc_ownership_trusted_implementation");
1330 }
1331 
1333  if (Ty.getAsString().substr(0, 4) == "isl_")
1334  return true;
1335  else
1336  return false;
1337 }
1338 
1339 //===----------------------------------------------------------------------===//
1340 // Summary creation for Selectors.
1341 //===----------------------------------------------------------------------===//
1342 
1344 RetainSummaryManager::getRetEffectFromAnnotations(QualType RetTy,
1345  const Decl *D) {
1346  if (cocoa::isCocoaObjectRef(RetTy)) {
1347  if (D->hasAttr<NSReturnsRetainedAttr>())
1348  return ObjCAllocRetE;
1349 
1350  if (D->hasAttr<NSReturnsNotRetainedAttr>() ||
1351  D->hasAttr<NSReturnsAutoreleasedAttr>())
1353 
1354  } else if (!RetTy->isPointerType()) {
1355  return None;
1356  }
1357 
1358  if (D->hasAttr<CFReturnsRetainedAttr>())
1360  else if (hasRCAnnotation(D, "rc_ownership_returns_retained"))
1362 
1363  if (D->hasAttr<CFReturnsNotRetainedAttr>())
1365 
1366  return None;
1367 }
1368 
1369 void
1370 RetainSummaryManager::updateSummaryFromAnnotations(const RetainSummary *&Summ,
1371  const FunctionDecl *FD) {
1372  if (!FD)
1373  return;
1374 
1375  assert(Summ && "Must have a summary to add annotations to.");
1376  RetainSummaryTemplate Template(Summ, *this);
1377 
1378  // Effects on the parameters.
1379  unsigned parm_idx = 0;
1381  pe = FD->param_end(); pi != pe; ++pi, ++parm_idx) {
1382  const ParmVarDecl *pd = *pi;
1383  if (pd->hasAttr<NSConsumedAttr>())
1384  Template->addArg(AF, parm_idx, DecRefMsg);
1385  else if (pd->hasAttr<CFConsumedAttr>() ||
1386  hasRCAnnotation(pd, "rc_ownership_consumed"))
1387  Template->addArg(AF, parm_idx, DecRef);
1388  else if (pd->hasAttr<CFReturnsRetainedAttr>() ||
1389  hasRCAnnotation(pd, "rc_ownership_returns_retained")) {
1390  QualType PointeeTy = pd->getType()->getPointeeType();
1391  if (!PointeeTy.isNull())
1392  if (coreFoundation::isCFObjectRef(PointeeTy))
1393  Template->addArg(AF, parm_idx, RetainedOutParameter);
1394  } else if (pd->hasAttr<CFReturnsNotRetainedAttr>()) {
1395  QualType PointeeTy = pd->getType()->getPointeeType();
1396  if (!PointeeTy.isNull())
1397  if (coreFoundation::isCFObjectRef(PointeeTy))
1398  Template->addArg(AF, parm_idx, UnretainedOutParameter);
1399  }
1400  }
1401 
1402  QualType RetTy = FD->getReturnType();
1403  if (Optional<RetEffect> RetE = getRetEffectFromAnnotations(RetTy, FD))
1404  Template->setRetEffect(*RetE);
1405 }
1406 
1407 void
1408 RetainSummaryManager::updateSummaryFromAnnotations(const RetainSummary *&Summ,
1409  const ObjCMethodDecl *MD) {
1410  if (!MD)
1411  return;
1412 
1413  assert(Summ && "Must have a valid summary to add annotations to");
1414  RetainSummaryTemplate Template(Summ, *this);
1415 
1416  // Effects on the receiver.
1417  if (MD->hasAttr<NSConsumesSelfAttr>())
1418  Template->setReceiverEffect(DecRefMsg);
1419 
1420  // Effects on the parameters.
1421  unsigned parm_idx = 0;
1423  pi=MD->param_begin(), pe=MD->param_end();
1424  pi != pe; ++pi, ++parm_idx) {
1425  const ParmVarDecl *pd = *pi;
1426  if (pd->hasAttr<NSConsumedAttr>())
1427  Template->addArg(AF, parm_idx, DecRefMsg);
1428  else if (pd->hasAttr<CFConsumedAttr>()) {
1429  Template->addArg(AF, parm_idx, DecRef);
1430  } else if (pd->hasAttr<CFReturnsRetainedAttr>()) {
1431  QualType PointeeTy = pd->getType()->getPointeeType();
1432  if (!PointeeTy.isNull())
1433  if (coreFoundation::isCFObjectRef(PointeeTy))
1434  Template->addArg(AF, parm_idx, RetainedOutParameter);
1435  } else if (pd->hasAttr<CFReturnsNotRetainedAttr>()) {
1436  QualType PointeeTy = pd->getType()->getPointeeType();
1437  if (!PointeeTy.isNull())
1438  if (coreFoundation::isCFObjectRef(PointeeTy))
1439  Template->addArg(AF, parm_idx, UnretainedOutParameter);
1440  }
1441  }
1442 
1443  QualType RetTy = MD->getReturnType();
1444  if (Optional<RetEffect> RetE = getRetEffectFromAnnotations(RetTy, MD))
1445  Template->setRetEffect(*RetE);
1446 }
1447 
1448 const RetainSummary *
1449 RetainSummaryManager::getStandardMethodSummary(const ObjCMethodDecl *MD,
1450  Selector S, QualType RetTy) {
1451  // Any special effects?
1452  ArgEffect ReceiverEff = DoNothing;
1453  RetEffect ResultEff = RetEffect::MakeNoRet();
1454 
1455  // Check the method family, and apply any default annotations.
1456  switch (MD ? MD->getMethodFamily() : S.getMethodFamily()) {
1457  case OMF_None:
1458  case OMF_initialize:
1459  case OMF_performSelector:
1460  // Assume all Objective-C methods follow Cocoa Memory Management rules.
1461  // FIXME: Does the non-threaded performSelector family really belong here?
1462  // The selector could be, say, @selector(copy).
1463  if (cocoa::isCocoaObjectRef(RetTy))
1465  else if (coreFoundation::isCFObjectRef(RetTy)) {
1466  // ObjCMethodDecl currently doesn't consider CF objects as valid return
1467  // values for alloc, new, copy, or mutableCopy, so we have to
1468  // double-check with the selector. This is ugly, but there aren't that
1469  // many Objective-C methods that return CF objects, right?
1470  if (MD) {
1471  switch (S.getMethodFamily()) {
1472  case OMF_alloc:
1473  case OMF_new:
1474  case OMF_copy:
1475  case OMF_mutableCopy:
1476  ResultEff = RetEffect::MakeOwned(RetEffect::CF);
1477  break;
1478  default:
1480  break;
1481  }
1482  } else {
1484  }
1485  }
1486  break;
1487  case OMF_init:
1488  ResultEff = ObjCInitRetE;
1489  ReceiverEff = DecRefMsg;
1490  break;
1491  case OMF_alloc:
1492  case OMF_new:
1493  case OMF_copy:
1494  case OMF_mutableCopy:
1495  if (cocoa::isCocoaObjectRef(RetTy))
1496  ResultEff = ObjCAllocRetE;
1497  else if (coreFoundation::isCFObjectRef(RetTy))
1498  ResultEff = RetEffect::MakeOwned(RetEffect::CF);
1499  break;
1500  case OMF_autorelease:
1501  ReceiverEff = Autorelease;
1502  break;
1503  case OMF_retain:
1504  ReceiverEff = IncRefMsg;
1505  break;
1506  case OMF_release:
1507  ReceiverEff = DecRefMsg;
1508  break;
1509  case OMF_dealloc:
1510  ReceiverEff = Dealloc;
1511  break;
1512  case OMF_self:
1513  // -self is handled specially by the ExprEngine to propagate the receiver.
1514  break;
1515  case OMF_retainCount:
1516  case OMF_finalize:
1517  // These methods don't return objects.
1518  break;
1519  }
1520 
1521  // If one of the arguments in the selector has the keyword 'delegate' we
1522  // should stop tracking the reference count for the receiver. This is
1523  // because the reference count is quite possibly handled by a delegate
1524  // method.
1525  if (S.isKeywordSelector()) {
1526  for (unsigned i = 0, e = S.getNumArgs(); i != e; ++i) {
1527  StringRef Slot = S.getNameForSlot(i);
1528  if (Slot.substr(Slot.size() - 8).equals_lower("delegate")) {
1529  if (ResultEff == ObjCInitRetE)
1530  ResultEff = RetEffect::MakeNoRetHard();
1531  else
1532  ReceiverEff = StopTrackingHard;
1533  }
1534  }
1535  }
1536 
1537  if (ScratchArgs.isEmpty() && ReceiverEff == DoNothing &&
1538  ResultEff.getKind() == RetEffect::NoRet)
1539  return getDefaultSummary();
1540 
1541  return getPersistentSummary(ResultEff, ReceiverEff, MayEscape);
1542 }
1543 
1544 const RetainSummary *
1545 RetainSummaryManager::getInstanceMethodSummary(const ObjCMethodCall &Msg,
1546  ProgramStateRef State) {
1547  const ObjCInterfaceDecl *ReceiverClass = nullptr;
1548 
1549  // We do better tracking of the type of the object than the core ExprEngine.
1550  // See if we have its type in our private state.
1551  // FIXME: Eventually replace the use of state->get<RefBindings> with
1552  // a generic API for reasoning about the Objective-C types of symbolic
1553  // objects.
1554  SVal ReceiverV = Msg.getReceiverSVal();
1555  if (SymbolRef Sym = ReceiverV.getAsLocSymbol())
1556  if (const RefVal *T = getRefBinding(State, Sym))
1557  if (const ObjCObjectPointerType *PT =
1558  T->getType()->getAs<ObjCObjectPointerType>())
1559  ReceiverClass = PT->getInterfaceDecl();
1560 
1561  // If we don't know what kind of object this is, fall back to its static type.
1562  if (!ReceiverClass)
1563  ReceiverClass = Msg.getReceiverInterface();
1564 
1565  // FIXME: The receiver could be a reference to a class, meaning that
1566  // we should use the class method.
1567  // id x = [NSObject class];
1568  // [x performSelector:... withObject:... afterDelay:...];
1569  Selector S = Msg.getSelector();
1570  const ObjCMethodDecl *Method = Msg.getDecl();
1571  if (!Method && ReceiverClass)
1572  Method = ReceiverClass->getInstanceMethod(S);
1573 
1574  return getMethodSummary(S, ReceiverClass, Method, Msg.getResultType(),
1575  ObjCMethodSummaries);
1576 }
1577 
1578 const RetainSummary *
1579 RetainSummaryManager::getMethodSummary(Selector S, const ObjCInterfaceDecl *ID,
1580  const ObjCMethodDecl *MD, QualType RetTy,
1581  ObjCMethodSummariesTy &CachedSummaries) {
1582 
1583  // Look up a summary in our summary cache.
1584  const RetainSummary *Summ = CachedSummaries.find(ID, S);
1585 
1586  if (!Summ) {
1587  Summ = getStandardMethodSummary(MD, S, RetTy);
1588 
1589  // Annotations override defaults.
1590  updateSummaryFromAnnotations(Summ, MD);
1591 
1592  // Memoize the summary.
1593  CachedSummaries[ObjCSummaryKey(ID, S)] = Summ;
1594  }
1595 
1596  return Summ;
1597 }
1598 
1599 void RetainSummaryManager::InitializeClassMethodSummaries() {
1600  assert(ScratchArgs.isEmpty());
1601  // Create the [NSAssertionHandler currentHander] summary.
1602  addClassMethSummary("NSAssertionHandler", "currentHandler",
1603  getPersistentSummary(RetEffect::MakeNotOwned(RetEffect::ObjC)));
1604 
1605  // Create the [NSAutoreleasePool addObject:] summary.
1606  ScratchArgs = AF.add(ScratchArgs, 0, Autorelease);
1607  addClassMethSummary("NSAutoreleasePool", "addObject",
1608  getPersistentSummary(RetEffect::MakeNoRet(),
1610 }
1611 
1612 void RetainSummaryManager::InitializeMethodSummaries() {
1613 
1614  assert (ScratchArgs.isEmpty());
1615 
1616  // Create the "init" selector. It just acts as a pass-through for the
1617  // receiver.
1618  const RetainSummary *InitSumm = getPersistentSummary(ObjCInitRetE, DecRefMsg);
1619  addNSObjectMethSummary(GetNullarySelector("init", Ctx), InitSumm);
1620 
1621  // awakeAfterUsingCoder: behaves basically like an 'init' method. It
1622  // claims the receiver and returns a retained object.
1623  addNSObjectMethSummary(GetUnarySelector("awakeAfterUsingCoder", Ctx),
1624  InitSumm);
1625 
1626  // The next methods are allocators.
1627  const RetainSummary *AllocSumm = getPersistentSummary(ObjCAllocRetE);
1628  const RetainSummary *CFAllocSumm =
1629  getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF));
1630 
1631  // Create the "retain" selector.
1632  RetEffect NoRet = RetEffect::MakeNoRet();
1633  const RetainSummary *Summ = getPersistentSummary(NoRet, IncRefMsg);
1634  addNSObjectMethSummary(GetNullarySelector("retain", Ctx), Summ);
1635 
1636  // Create the "release" selector.
1637  Summ = getPersistentSummary(NoRet, DecRefMsg);
1638  addNSObjectMethSummary(GetNullarySelector("release", Ctx), Summ);
1639 
1640  // Create the -dealloc summary.
1641  Summ = getPersistentSummary(NoRet, Dealloc);
1642  addNSObjectMethSummary(GetNullarySelector("dealloc", Ctx), Summ);
1643 
1644  // Create the "autorelease" selector.
1645  Summ = getPersistentSummary(NoRet, Autorelease);
1646  addNSObjectMethSummary(GetNullarySelector("autorelease", Ctx), Summ);
1647 
1648  // For NSWindow, allocated objects are (initially) self-owned.
1649  // FIXME: For now we opt for false negatives with NSWindow, as these objects
1650  // self-own themselves. However, they only do this once they are displayed.
1651  // Thus, we need to track an NSWindow's display status.
1652  // This is tracked in <rdar://problem/6062711>.
1653  // See also http://llvm.org/bugs/show_bug.cgi?id=3714.
1654  const RetainSummary *NoTrackYet = getPersistentSummary(RetEffect::MakeNoRet(),
1655  StopTracking,
1656  StopTracking);
1657 
1658  addClassMethSummary("NSWindow", "alloc", NoTrackYet);
1659 
1660  // For NSPanel (which subclasses NSWindow), allocated objects are not
1661  // self-owned.
1662  // FIXME: For now we don't track NSPanels. object for the same reason
1663  // as for NSWindow objects.
1664  addClassMethSummary("NSPanel", "alloc", NoTrackYet);
1665 
1666  // For NSNull, objects returned by +null are singletons that ignore
1667  // retain/release semantics. Just don't track them.
1668  // <rdar://problem/12858915>
1669  addClassMethSummary("NSNull", "null", NoTrackYet);
1670 
1671  // Don't track allocated autorelease pools, as it is okay to prematurely
1672  // exit a method.
1673  addClassMethSummary("NSAutoreleasePool", "alloc", NoTrackYet);
1674  addClassMethSummary("NSAutoreleasePool", "allocWithZone", NoTrackYet, false);
1675  addClassMethSummary("NSAutoreleasePool", "new", NoTrackYet);
1676 
1677  // Create summaries QCRenderer/QCView -createSnapShotImageOfType:
1678  addInstMethSummary("QCRenderer", AllocSumm, "createSnapshotImageOfType");
1679  addInstMethSummary("QCView", AllocSumm, "createSnapshotImageOfType");
1680 
1681  // Create summaries for CIContext, 'createCGImage' and
1682  // 'createCGLayerWithSize'. These objects are CF objects, and are not
1683  // automatically garbage collected.
1684  addInstMethSummary("CIContext", CFAllocSumm, "createCGImage", "fromRect");
1685  addInstMethSummary("CIContext", CFAllocSumm, "createCGImage", "fromRect",
1686  "format", "colorSpace");
1687  addInstMethSummary("CIContext", CFAllocSumm, "createCGLayerWithSize", "info");
1688 }
1689 
1690 //===----------------------------------------------------------------------===//
1691 // Error reporting.
1692 //===----------------------------------------------------------------------===//
1693 namespace {
1694  typedef llvm::DenseMap<const ExplodedNode *, const RetainSummary *>
1695  SummaryLogTy;
1696 
1697  //===-------------===//
1698  // Bug Descriptions. //
1699  //===-------------===//
1700 
1701  class CFRefBug : public BugType {
1702  protected:
1703  CFRefBug(const CheckerBase *checker, StringRef name)
1705 
1706  public:
1707 
1708  // FIXME: Eventually remove.
1709  virtual const char *getDescription() const = 0;
1710 
1711  virtual bool isLeak() const { return false; }
1712  };
1713 
1714  class UseAfterRelease : public CFRefBug {
1715  public:
1716  UseAfterRelease(const CheckerBase *checker)
1717  : CFRefBug(checker, "Use-after-release") {}
1718 
1719  const char *getDescription() const override {
1720  return "Reference-counted object is used after it is released";
1721  }
1722  };
1723 
1724  class BadRelease : public CFRefBug {
1725  public:
1726  BadRelease(const CheckerBase *checker) : CFRefBug(checker, "Bad release") {}
1727 
1728  const char *getDescription() const override {
1729  return "Incorrect decrement of the reference count of an object that is "
1730  "not owned at this point by the caller";
1731  }
1732  };
1733 
1734  class DeallocGC : public CFRefBug {
1735  public:
1736  DeallocGC(const CheckerBase *checker)
1737  : CFRefBug(checker, "-dealloc called while using garbage collection") {}
1738 
1739  const char *getDescription() const override {
1740  return "-dealloc called while using garbage collection";
1741  }
1742  };
1743 
1744  class DeallocNotOwned : public CFRefBug {
1745  public:
1746  DeallocNotOwned(const CheckerBase *checker)
1747  : CFRefBug(checker, "-dealloc sent to non-exclusively owned object") {}
1748 
1749  const char *getDescription() const override {
1750  return "-dealloc sent to object that may be referenced elsewhere";
1751  }
1752  };
1753 
1754  class OverAutorelease : public CFRefBug {
1755  public:
1756  OverAutorelease(const CheckerBase *checker)
1757  : CFRefBug(checker, "Object autoreleased too many times") {}
1758 
1759  const char *getDescription() const override {
1760  return "Object autoreleased too many times";
1761  }
1762  };
1763 
1764  class ReturnedNotOwnedForOwned : public CFRefBug {
1765  public:
1766  ReturnedNotOwnedForOwned(const CheckerBase *checker)
1767  : CFRefBug(checker, "Method should return an owned object") {}
1768 
1769  const char *getDescription() const override {
1770  return "Object with a +0 retain count returned to caller where a +1 "
1771  "(owning) retain count is expected";
1772  }
1773  };
1774 
1775  class Leak : public CFRefBug {
1776  public:
1777  Leak(const CheckerBase *checker, StringRef name) : CFRefBug(checker, name) {
1778  // Leaks should not be reported if they are post-dominated by a sink.
1779  setSuppressOnSink(true);
1780  }
1781 
1782  const char *getDescription() const override { return ""; }
1783 
1784  bool isLeak() const override { return true; }
1785  };
1786 
1787  //===---------===//
1788  // Bug Reports. //
1789  //===---------===//
1790 
1791  class CFRefReportVisitor : public BugReporterVisitorImpl<CFRefReportVisitor> {
1792  protected:
1793  SymbolRef Sym;
1794  const SummaryLogTy &SummaryLog;
1795  bool GCEnabled;
1796 
1797  public:
1798  CFRefReportVisitor(SymbolRef sym, bool gcEnabled, const SummaryLogTy &log)
1799  : Sym(sym), SummaryLog(log), GCEnabled(gcEnabled) {}
1800 
1801  void Profile(llvm::FoldingSetNodeID &ID) const override {
1802  static int x = 0;
1803  ID.AddPointer(&x);
1804  ID.AddPointer(Sym);
1805  }
1806 
1807  std::shared_ptr<PathDiagnosticPiece> VisitNode(const ExplodedNode *N,
1808  const ExplodedNode *PrevN,
1809  BugReporterContext &BRC,
1810  BugReport &BR) override;
1811 
1812  std::unique_ptr<PathDiagnosticPiece> getEndPath(BugReporterContext &BRC,
1813  const ExplodedNode *N,
1814  BugReport &BR) override;
1815  };
1816 
1817  class CFRefLeakReportVisitor : public CFRefReportVisitor {
1818  public:
1819  CFRefLeakReportVisitor(SymbolRef sym, bool GCEnabled,
1820  const SummaryLogTy &log)
1821  : CFRefReportVisitor(sym, GCEnabled, log) {}
1822 
1823  std::unique_ptr<PathDiagnosticPiece> getEndPath(BugReporterContext &BRC,
1824  const ExplodedNode *N,
1825  BugReport &BR) override;
1826 
1827  std::unique_ptr<BugReporterVisitor> clone() const override {
1828  // The curiously-recurring template pattern only works for one level of
1829  // subclassing. Rather than make a new template base for
1830  // CFRefReportVisitor, we simply override clone() to do the right thing.
1831  // This could be trouble someday if BugReporterVisitorImpl is ever
1832  // used for something else besides a convenient implementation of clone().
1833  return llvm::make_unique<CFRefLeakReportVisitor>(*this);
1834  }
1835  };
1836 
1837  class CFRefReport : public BugReport {
1838  void addGCModeDescription(const LangOptions &LOpts, bool GCEnabled);
1839 
1840  public:
1841  CFRefReport(CFRefBug &D, const LangOptions &LOpts, bool GCEnabled,
1842  const SummaryLogTy &Log, ExplodedNode *n, SymbolRef sym,
1843  bool registerVisitor = true)
1844  : BugReport(D, D.getDescription(), n) {
1845  if (registerVisitor)
1846  addVisitor(llvm::make_unique<CFRefReportVisitor>(sym, GCEnabled, Log));
1847  addGCModeDescription(LOpts, GCEnabled);
1848  }
1849 
1850  CFRefReport(CFRefBug &D, const LangOptions &LOpts, bool GCEnabled,
1851  const SummaryLogTy &Log, ExplodedNode *n, SymbolRef sym,
1852  StringRef endText)
1853  : BugReport(D, D.getDescription(), endText, n) {
1854  addVisitor(llvm::make_unique<CFRefReportVisitor>(sym, GCEnabled, Log));
1855  addGCModeDescription(LOpts, GCEnabled);
1856  }
1857 
1858  llvm::iterator_range<ranges_iterator> getRanges() override {
1859  const CFRefBug& BugTy = static_cast<CFRefBug&>(getBugType());
1860  if (!BugTy.isLeak())
1861  return BugReport::getRanges();
1862  return llvm::make_range(ranges_iterator(), ranges_iterator());
1863  }
1864  };
1865 
1866  class CFRefLeakReport : public CFRefReport {
1867  const MemRegion* AllocBinding;
1868  const Stmt *AllocStmt;
1869 
1870  // Finds the function declaration where a leak warning for the parameter 'sym' should be raised.
1871  void deriveParamLocation(CheckerContext &Ctx, SymbolRef sym);
1872  // Finds the location where a leak warning for 'sym' should be raised.
1873  void deriveAllocLocation(CheckerContext &Ctx, SymbolRef sym);
1874  // Produces description of a leak warning which is printed on the console.
1875  void createDescription(CheckerContext &Ctx, bool GCEnabled, bool IncludeAllocationLine);
1876 
1877  public:
1878  CFRefLeakReport(CFRefBug &D, const LangOptions &LOpts, bool GCEnabled,
1879  const SummaryLogTy &Log, ExplodedNode *n, SymbolRef sym,
1880  CheckerContext &Ctx,
1881  bool IncludeAllocationLine);
1882 
1883  PathDiagnosticLocation getLocation(const SourceManager &SM) const override {
1884  assert(Location.isValid());
1885  return Location;
1886  }
1887  };
1888 } // end anonymous namespace
1889 
1890 void CFRefReport::addGCModeDescription(const LangOptions &LOpts,
1891  bool GCEnabled) {
1892  const char *GCModeDescription = nullptr;
1893 
1894  switch (LOpts.getGC()) {
1895  case LangOptions::GCOnly:
1896  assert(GCEnabled);
1897  GCModeDescription = "Code is compiled to only use garbage collection";
1898  break;
1899 
1900  case LangOptions::NonGC:
1901  assert(!GCEnabled);
1902  GCModeDescription = "Code is compiled to use reference counts";
1903  break;
1904 
1905  case LangOptions::HybridGC:
1906  if (GCEnabled) {
1907  GCModeDescription = "Code is compiled to use either garbage collection "
1908  "(GC) or reference counts (non-GC). The bug occurs "
1909  "with GC enabled";
1910  break;
1911  } else {
1912  GCModeDescription = "Code is compiled to use either garbage collection "
1913  "(GC) or reference counts (non-GC). The bug occurs "
1914  "in non-GC mode";
1915  break;
1916  }
1917  }
1918 
1919  assert(GCModeDescription && "invalid/unknown GC mode");
1920  addExtraText(GCModeDescription);
1921 }
1922 
1923 static bool isNumericLiteralExpression(const Expr *E) {
1924  // FIXME: This set of cases was copied from SemaExprObjC.
1925  return isa<IntegerLiteral>(E) ||
1926  isa<CharacterLiteral>(E) ||
1927  isa<FloatingLiteral>(E) ||
1928  isa<ObjCBoolLiteralExpr>(E) ||
1929  isa<CXXBoolLiteralExpr>(E);
1930 }
1931 
1932 /// Returns true if this stack frame is for an Objective-C method that is a
1933 /// property getter or setter whose body has been synthesized by the analyzer.
1934 static bool isSynthesizedAccessor(const StackFrameContext *SFC) {
1935  auto Method = dyn_cast_or_null<ObjCMethodDecl>(SFC->getDecl());
1936  if (!Method || !Method->isPropertyAccessor())
1937  return false;
1938 
1940 }
1941 
1942 std::shared_ptr<PathDiagnosticPiece>
1943 CFRefReportVisitor::VisitNode(const ExplodedNode *N, const ExplodedNode *PrevN,
1944  BugReporterContext &BRC, BugReport &BR) {
1945  // FIXME: We will eventually need to handle non-statement-based events
1946  // (__attribute__((cleanup))).
1947  if (!N->getLocation().getAs<StmtPoint>())
1948  return nullptr;
1949 
1950  // Check if the type state has changed.
1951  ProgramStateRef PrevSt = PrevN->getState();
1952  ProgramStateRef CurrSt = N->getState();
1953  const LocationContext *LCtx = N->getLocationContext();
1954 
1955  const RefVal* CurrT = getRefBinding(CurrSt, Sym);
1956  if (!CurrT) return nullptr;
1957 
1958  const RefVal &CurrV = *CurrT;
1959  const RefVal *PrevT = getRefBinding(PrevSt, Sym);
1960 
1961  // Create a string buffer to constain all the useful things we want
1962  // to tell the user.
1963  std::string sbuf;
1964  llvm::raw_string_ostream os(sbuf);
1965 
1966  // This is the allocation site since the previous node had no bindings
1967  // for this symbol.
1968  if (!PrevT) {
1969  const Stmt *S = N->getLocation().castAs<StmtPoint>().getStmt();
1970 
1971  if (isa<ObjCIvarRefExpr>(S) &&
1973  S = LCtx->getCurrentStackFrame()->getCallSite();
1974  }
1975 
1976  if (isa<ObjCArrayLiteral>(S)) {
1977  os << "NSArray literal is an object with a +0 retain count";
1978  }
1979  else if (isa<ObjCDictionaryLiteral>(S)) {
1980  os << "NSDictionary literal is an object with a +0 retain count";
1981  }
1982  else if (const ObjCBoxedExpr *BL = dyn_cast<ObjCBoxedExpr>(S)) {
1983  if (isNumericLiteralExpression(BL->getSubExpr()))
1984  os << "NSNumber literal is an object with a +0 retain count";
1985  else {
1986  const ObjCInterfaceDecl *BoxClass = nullptr;
1987  if (const ObjCMethodDecl *Method = BL->getBoxingMethod())
1988  BoxClass = Method->getClassInterface();
1989 
1990  // We should always be able to find the boxing class interface,
1991  // but consider this future-proofing.
1992  if (BoxClass)
1993  os << *BoxClass << " b";
1994  else
1995  os << "B";
1996 
1997  os << "oxed expression produces an object with a +0 retain count";
1998  }
1999  }
2000  else if (isa<ObjCIvarRefExpr>(S)) {
2001  os << "Object loaded from instance variable";
2002  }
2003  else {
2004  if (const CallExpr *CE = dyn_cast<CallExpr>(S)) {
2005  // Get the name of the callee (if it is available).
2006  SVal X = CurrSt->getSValAsScalarOrLoc(CE->getCallee(), LCtx);
2007  if (const FunctionDecl *FD = X.getAsFunctionDecl())
2008  os << "Call to function '" << *FD << '\'';
2009  else
2010  os << "function call";
2011  }
2012  else {
2013  assert(isa<ObjCMessageExpr>(S));
2014  CallEventManager &Mgr = CurrSt->getStateManager().getCallEventManager();
2016  = Mgr.getObjCMethodCall(cast<ObjCMessageExpr>(S), CurrSt, LCtx);
2017 
2018  switch (Call->getMessageKind()) {
2019  case OCM_Message:
2020  os << "Method";
2021  break;
2022  case OCM_PropertyAccess:
2023  os << "Property";
2024  break;
2025  case OCM_Subscript:
2026  os << "Subscript";
2027  break;
2028  }
2029  }
2030 
2031  if (CurrV.getObjKind() == RetEffect::CF) {
2032  os << " returns a Core Foundation object of type "
2033  << Sym->getType().getAsString() << " with a ";
2034  } else if (CurrV.getObjKind() == RetEffect::Generalized) {
2035  os << " returns an object of type " << Sym->getType().getAsString()
2036  << " with a ";
2037  } else {
2038  assert (CurrV.getObjKind() == RetEffect::ObjC);
2039  QualType T = Sym->getType();
2040  if (!isa<ObjCObjectPointerType>(T)) {
2041  os << " returns an Objective-C object with a ";
2042  } else {
2043  const ObjCObjectPointerType *PT = cast<ObjCObjectPointerType>(T);
2044  os << " returns an instance of "
2045  << PT->getPointeeType().getAsString() << " with a ";
2046  }
2047  }
2048 
2049  if (CurrV.isOwned()) {
2050  os << "+1 retain count";
2051 
2052  if (GCEnabled) {
2053  assert(CurrV.getObjKind() == RetEffect::CF);
2054  os << ". "
2055  "Core Foundation objects are not automatically garbage collected.";
2056  }
2057  }
2058  else {
2059  assert (CurrV.isNotOwned());
2060  os << "+0 retain count";
2061  }
2062  }
2063 
2065  N->getLocationContext());
2066  return std::make_shared<PathDiagnosticEventPiece>(Pos, os.str());
2067  }
2068 
2069  // Gather up the effects that were performed on the object at this
2070  // program point
2071  SmallVector<ArgEffect, 2> AEffects;
2072 
2073  const ExplodedNode *OrigNode = BRC.getNodeResolver().getOriginalNode(N);
2074  if (const RetainSummary *Summ = SummaryLog.lookup(OrigNode)) {
2075  // We only have summaries attached to nodes after evaluating CallExpr and
2076  // ObjCMessageExprs.
2077  const Stmt *S = N->getLocation().castAs<StmtPoint>().getStmt();
2078 
2079  if (const CallExpr *CE = dyn_cast<CallExpr>(S)) {
2080  // Iterate through the parameter expressions and see if the symbol
2081  // was ever passed as an argument.
2082  unsigned i = 0;
2083 
2084  for (CallExpr::const_arg_iterator AI=CE->arg_begin(), AE=CE->arg_end();
2085  AI!=AE; ++AI, ++i) {
2086 
2087  // Retrieve the value of the argument. Is it the symbol
2088  // we are interested in?
2089  if (CurrSt->getSValAsScalarOrLoc(*AI, LCtx).getAsLocSymbol() != Sym)
2090  continue;
2091 
2092  // We have an argument. Get the effect!
2093  AEffects.push_back(Summ->getArg(i));
2094  }
2095  }
2096  else if (const ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(S)) {
2097  if (const Expr *receiver = ME->getInstanceReceiver())
2098  if (CurrSt->getSValAsScalarOrLoc(receiver, LCtx)
2099  .getAsLocSymbol() == Sym) {
2100  // The symbol we are tracking is the receiver.
2101  AEffects.push_back(Summ->getReceiverEffect());
2102  }
2103  }
2104  }
2105 
2106  do {
2107  // Get the previous type state.
2108  RefVal PrevV = *PrevT;
2109 
2110  // Specially handle -dealloc.
2111  if (!GCEnabled && std::find(AEffects.begin(), AEffects.end(), Dealloc) !=
2112  AEffects.end()) {
2113  // Determine if the object's reference count was pushed to zero.
2114  assert(!PrevV.hasSameState(CurrV) && "The state should have changed.");
2115  // We may not have transitioned to 'release' if we hit an error.
2116  // This case is handled elsewhere.
2117  if (CurrV.getKind() == RefVal::Released) {
2118  assert(CurrV.getCombinedCounts() == 0);
2119  os << "Object released by directly sending the '-dealloc' message";
2120  break;
2121  }
2122  }
2123 
2124  // Specially handle CFMakeCollectable and friends.
2125  if (std::find(AEffects.begin(), AEffects.end(), MakeCollectable) !=
2126  AEffects.end()) {
2127  // Get the name of the function.
2128  const Stmt *S = N->getLocation().castAs<StmtPoint>().getStmt();
2129  SVal X =
2130  CurrSt->getSValAsScalarOrLoc(cast<CallExpr>(S)->getCallee(), LCtx);
2131  const FunctionDecl *FD = X.getAsFunctionDecl();
2132 
2133  if (GCEnabled) {
2134  // Determine if the object's reference count was pushed to zero.
2135  assert(!PrevV.hasSameState(CurrV) && "The state should have changed.");
2136 
2137  os << "In GC mode a call to '" << *FD
2138  << "' decrements an object's retain count and registers the "
2139  "object with the garbage collector. ";
2140 
2141  if (CurrV.getKind() == RefVal::Released) {
2142  assert(CurrV.getCount() == 0);
2143  os << "Since it now has a 0 retain count the object can be "
2144  "automatically collected by the garbage collector.";
2145  }
2146  else
2147  os << "An object must have a 0 retain count to be garbage collected. "
2148  "After this call its retain count is +" << CurrV.getCount()
2149  << '.';
2150  }
2151  else
2152  os << "When GC is not enabled a call to '" << *FD
2153  << "' has no effect on its argument.";
2154 
2155  // Nothing more to say.
2156  break;
2157  }
2158 
2159  // Determine if the typestate has changed.
2160  if (!PrevV.hasSameState(CurrV))
2161  switch (CurrV.getKind()) {
2162  case RefVal::Owned:
2163  case RefVal::NotOwned:
2164  if (PrevV.getCount() == CurrV.getCount()) {
2165  // Did an autorelease message get sent?
2166  if (PrevV.getAutoreleaseCount() == CurrV.getAutoreleaseCount())
2167  return nullptr;
2168 
2169  assert(PrevV.getAutoreleaseCount() < CurrV.getAutoreleaseCount());
2170  os << "Object autoreleased";
2171  break;
2172  }
2173 
2174  if (PrevV.getCount() > CurrV.getCount())
2175  os << "Reference count decremented.";
2176  else
2177  os << "Reference count incremented.";
2178 
2179  if (unsigned Count = CurrV.getCount())
2180  os << " The object now has a +" << Count << " retain count.";
2181 
2182  if (PrevV.getKind() == RefVal::Released) {
2183  assert(GCEnabled && CurrV.getCount() > 0);
2184  os << " The object is not eligible for garbage collection until "
2185  "the retain count reaches 0 again.";
2186  }
2187 
2188  break;
2189 
2190  case RefVal::Released:
2191  if (CurrV.getIvarAccessHistory() ==
2192  RefVal::IvarAccessHistory::ReleasedAfterDirectAccess &&
2193  CurrV.getIvarAccessHistory() != PrevV.getIvarAccessHistory()) {
2194  os << "Strong instance variable relinquished. ";
2195  }
2196  os << "Object released.";
2197  break;
2198 
2199  case RefVal::ReturnedOwned:
2200  // Autoreleases can be applied after marking a node ReturnedOwned.
2201  if (CurrV.getAutoreleaseCount())
2202  return nullptr;
2203 
2204  os << "Object returned to caller as an owning reference (single "
2205  "retain count transferred to caller)";
2206  break;
2207 
2208  case RefVal::ReturnedNotOwned:
2209  os << "Object returned to caller with a +0 retain count";
2210  break;
2211 
2212  default:
2213  return nullptr;
2214  }
2215 
2216  // Emit any remaining diagnostics for the argument effects (if any).
2217  for (SmallVectorImpl<ArgEffect>::iterator I=AEffects.begin(),
2218  E=AEffects.end(); I != E; ++I) {
2219 
2220  // A bunch of things have alternate behavior under GC.
2221  if (GCEnabled)
2222  switch (*I) {
2223  default: break;
2224  case Autorelease:
2225  os << "In GC mode an 'autorelease' has no effect.";
2226  continue;
2227  case IncRefMsg:
2228  os << "In GC mode the 'retain' message has no effect.";
2229  continue;
2230  case DecRefMsg:
2231  os << "In GC mode the 'release' message has no effect.";
2232  continue;
2233  }
2234  }
2235  } while (0);
2236 
2237  if (os.str().empty())
2238  return nullptr; // We have nothing to say!
2239 
2240  const Stmt *S = N->getLocation().castAs<StmtPoint>().getStmt();
2242  N->getLocationContext());
2243  auto P = std::make_shared<PathDiagnosticEventPiece>(Pos, os.str());
2244 
2245  // Add the range by scanning the children of the statement for any bindings
2246  // to Sym.
2247  for (const Stmt *Child : S->children())
2248  if (const Expr *Exp = dyn_cast_or_null<Expr>(Child))
2249  if (CurrSt->getSValAsScalarOrLoc(Exp, LCtx).getAsLocSymbol() == Sym) {
2250  P->addRange(Exp->getSourceRange());
2251  break;
2252  }
2253 
2254  return std::move(P);
2255 }
2256 
2257 namespace {
2258 // Find the first node in the current function context that referred to the
2259 // tracked symbol and the memory location that value was stored to. Note, the
2260 // value is only reported if the allocation occurred in the same function as
2261 // the leak. The function can also return a location context, which should be
2262 // treated as interesting.
2263 struct AllocationInfo {
2264  const ExplodedNode* N;
2265  const MemRegion *R;
2266  const LocationContext *InterestingMethodContext;
2267  AllocationInfo(const ExplodedNode *InN,
2268  const MemRegion *InR,
2269  const LocationContext *InInterestingMethodContext) :
2270  N(InN), R(InR), InterestingMethodContext(InInterestingMethodContext) {}
2271 };
2272 } // end anonymous namespace
2273 
2274 static AllocationInfo
2276  SymbolRef Sym) {
2277  const ExplodedNode *AllocationNode = N;
2278  const ExplodedNode *AllocationNodeInCurrentOrParentContext = N;
2279  const MemRegion *FirstBinding = nullptr;
2280  const LocationContext *LeakContext = N->getLocationContext();
2281 
2282  // The location context of the init method called on the leaked object, if
2283  // available.
2284  const LocationContext *InitMethodContext = nullptr;
2285 
2286  while (N) {
2287  ProgramStateRef St = N->getState();
2288  const LocationContext *NContext = N->getLocationContext();
2289 
2290  if (!getRefBinding(St, Sym))
2291  break;
2292 
2294  StateMgr.iterBindings(St, FB);
2295 
2296  if (FB) {
2297  const MemRegion *R = FB.getRegion();
2298  const VarRegion *VR = R->getBaseRegion()->getAs<VarRegion>();
2299  // Do not show local variables belonging to a function other than
2300  // where the error is reported.
2301  if (!VR || VR->getStackFrame() == LeakContext->getCurrentStackFrame())
2302  FirstBinding = R;
2303  }
2304 
2305  // AllocationNode is the last node in which the symbol was tracked.
2306  AllocationNode = N;
2307 
2308  // AllocationNodeInCurrentContext, is the last node in the current or
2309  // parent context in which the symbol was tracked.
2310  //
2311  // Note that the allocation site might be in the parent conext. For example,
2312  // the case where an allocation happens in a block that captures a reference
2313  // to it and that reference is overwritten/dropped by another call to
2314  // the block.
2315  if (NContext == LeakContext || NContext->isParentOf(LeakContext))
2316  AllocationNodeInCurrentOrParentContext = N;
2317 
2318  // Find the last init that was called on the given symbol and store the
2319  // init method's location context.
2320  if (!InitMethodContext)
2321  if (Optional<CallEnter> CEP = N->getLocation().getAs<CallEnter>()) {
2322  const Stmt *CE = CEP->getCallExpr();
2323  if (const ObjCMessageExpr *ME = dyn_cast_or_null<ObjCMessageExpr>(CE)) {
2324  const Stmt *RecExpr = ME->getInstanceReceiver();
2325  if (RecExpr) {
2326  SVal RecV = St->getSVal(RecExpr, NContext);
2327  if (ME->getMethodFamily() == OMF_init && RecV.getAsSymbol() == Sym)
2328  InitMethodContext = CEP->getCalleeContext();
2329  }
2330  }
2331  }
2332 
2333  N = N->pred_empty() ? nullptr : *(N->pred_begin());
2334  }
2335 
2336  // If we are reporting a leak of the object that was allocated with alloc,
2337  // mark its init method as interesting.
2338  const LocationContext *InterestingMethodContext = nullptr;
2339  if (InitMethodContext) {
2340  const ProgramPoint AllocPP = AllocationNode->getLocation();
2341  if (Optional<StmtPoint> SP = AllocPP.getAs<StmtPoint>())
2342  if (const ObjCMessageExpr *ME = SP->getStmtAs<ObjCMessageExpr>())
2343  if (ME->getMethodFamily() == OMF_alloc)
2344  InterestingMethodContext = InitMethodContext;
2345  }
2346 
2347  // If allocation happened in a function different from the leak node context,
2348  // do not report the binding.
2349  assert(N && "Could not find allocation node");
2350  if (N->getLocationContext() != LeakContext) {
2351  FirstBinding = nullptr;
2352  }
2353 
2354  return AllocationInfo(AllocationNodeInCurrentOrParentContext,
2355  FirstBinding,
2356  InterestingMethodContext);
2357 }
2358 
2359 std::unique_ptr<PathDiagnosticPiece>
2360 CFRefReportVisitor::getEndPath(BugReporterContext &BRC,
2361  const ExplodedNode *EndN, BugReport &BR) {
2362  BR.markInteresting(Sym);
2363  return BugReporterVisitor::getDefaultEndPath(BRC, EndN, BR);
2364 }
2365 
2366 std::unique_ptr<PathDiagnosticPiece>
2367 CFRefLeakReportVisitor::getEndPath(BugReporterContext &BRC,
2368  const ExplodedNode *EndN, BugReport &BR) {
2369 
2370  // Tell the BugReporterContext to report cases when the tracked symbol is
2371  // assigned to different variables, etc.
2372  BR.markInteresting(Sym);
2373 
2374  // We are reporting a leak. Walk up the graph to get to the first node where
2375  // the symbol appeared, and also get the first VarDecl that tracked object
2376  // is stored to.
2377  AllocationInfo AllocI =
2378  GetAllocationSite(BRC.getStateManager(), EndN, Sym);
2379 
2380  const MemRegion* FirstBinding = AllocI.R;
2381  BR.markInteresting(AllocI.InterestingMethodContext);
2382 
2384 
2385  // Compute an actual location for the leak. Sometimes a leak doesn't
2386  // occur at an actual statement (e.g., transition between blocks; end
2387  // of function) so we need to walk the graph and compute a real location.
2388  const ExplodedNode *LeakN = EndN;
2390 
2391  std::string sbuf;
2392  llvm::raw_string_ostream os(sbuf);
2393 
2394  os << "Object leaked: ";
2395 
2396  if (FirstBinding) {
2397  os << "object allocated and stored into '"
2398  << FirstBinding->getString() << '\'';
2399  }
2400  else
2401  os << "allocated object";
2402 
2403  // Get the retain count.
2404  const RefVal* RV = getRefBinding(EndN->getState(), Sym);
2405  assert(RV);
2406 
2407  if (RV->getKind() == RefVal::ErrorLeakReturned) {
2408  // FIXME: Per comments in rdar://6320065, "create" only applies to CF
2409  // objects. Only "copy", "alloc", "retain" and "new" transfer ownership
2410  // to the caller for NS objects.
2411  const Decl *D = &EndN->getCodeDecl();
2412 
2413  os << (isa<ObjCMethodDecl>(D) ? " is returned from a method "
2414  : " is returned from a function ");
2415 
2416  if (D->hasAttr<CFReturnsNotRetainedAttr>())
2417  os << "that is annotated as CF_RETURNS_NOT_RETAINED";
2418  else if (D->hasAttr<NSReturnsNotRetainedAttr>())
2419  os << "that is annotated as NS_RETURNS_NOT_RETAINED";
2420  else {
2421  if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(D)) {
2422  if (BRC.getASTContext().getLangOpts().ObjCAutoRefCount) {
2423  os << "managed by Automatic Reference Counting";
2424  } else {
2425  os << "whose name ('" << MD->getSelector().getAsString()
2426  << "') does not start with "
2427  "'copy', 'mutableCopy', 'alloc' or 'new'."
2428  " This violates the naming convention rules"
2429  " given in the Memory Management Guide for Cocoa";
2430  }
2431  }
2432  else {
2433  const FunctionDecl *FD = cast<FunctionDecl>(D);
2434  os << "whose name ('" << *FD
2435  << "') does not contain 'Copy' or 'Create'. This violates the naming"
2436  " convention rules given in the Memory Management Guide for Core"
2437  " Foundation";
2438  }
2439  }
2440  }
2441  else if (RV->getKind() == RefVal::ErrorGCLeakReturned) {
2442  const ObjCMethodDecl &MD = cast<ObjCMethodDecl>(EndN->getCodeDecl());
2443  os << " and returned from method '" << MD.getSelector().getAsString()
2444  << "' is potentially leaked when using garbage collection. Callers "
2445  "of this method do not expect a returned object with a +1 retain "
2446  "count since they expect the object to be managed by the garbage "
2447  "collector";
2448  }
2449  else
2450  os << " is not referenced later in this execution path and has a retain "
2451  "count of +" << RV->getCount();
2452 
2453  return llvm::make_unique<PathDiagnosticEventPiece>(L, os.str());
2454 }
2455 
2456 void CFRefLeakReport::deriveParamLocation(CheckerContext &Ctx, SymbolRef sym) {
2457  const SourceManager& SMgr = Ctx.getSourceManager();
2458 
2459  if (!sym->getOriginRegion())
2460  return;
2461 
2462  auto *Region = dyn_cast<DeclRegion>(sym->getOriginRegion());
2463  if (Region) {
2464  const Decl *PDecl = Region->getDecl();
2465  if (PDecl && isa<ParmVarDecl>(PDecl)) {
2466  PathDiagnosticLocation ParamLocation = PathDiagnosticLocation::create(PDecl, SMgr);
2467  Location = ParamLocation;
2468  UniqueingLocation = ParamLocation;
2469  UniqueingDecl = Ctx.getLocationContext()->getDecl();
2470  }
2471  }
2472 }
2473 
2474 void CFRefLeakReport::deriveAllocLocation(CheckerContext &Ctx,SymbolRef sym) {
2475  // Most bug reports are cached at the location where they occurred.
2476  // With leaks, we want to unique them by the location where they were
2477  // allocated, and only report a single path. To do this, we need to find
2478  // the allocation site of a piece of tracked memory, which we do via a
2479  // call to GetAllocationSite. This will walk the ExplodedGraph backwards.
2480  // Note that this is *not* the trimmed graph; we are guaranteed, however,
2481  // that all ancestor nodes that represent the allocation site have the
2482  // same SourceLocation.
2483  const ExplodedNode *AllocNode = nullptr;
2484 
2485  const SourceManager& SMgr = Ctx.getSourceManager();
2486 
2487  AllocationInfo AllocI =
2488  GetAllocationSite(Ctx.getStateManager(), getErrorNode(), sym);
2489 
2490  AllocNode = AllocI.N;
2491  AllocBinding = AllocI.R;
2492  markInteresting(AllocI.InterestingMethodContext);
2493 
2494  // Get the SourceLocation for the allocation site.
2495  // FIXME: This will crash the analyzer if an allocation comes from an
2496  // implicit call (ex: a destructor call).
2497  // (Currently there are no such allocations in Cocoa, though.)
2498  AllocStmt = PathDiagnosticLocation::getStmt(AllocNode);
2499 
2500  if (!AllocStmt) {
2501  AllocBinding = nullptr;
2502  return;
2503  }
2504 
2505  PathDiagnosticLocation AllocLocation =
2506  PathDiagnosticLocation::createBegin(AllocStmt, SMgr,
2507  AllocNode->getLocationContext());
2508  Location = AllocLocation;
2509 
2510  // Set uniqieing info, which will be used for unique the bug reports. The
2511  // leaks should be uniqued on the allocation site.
2512  UniqueingLocation = AllocLocation;
2513  UniqueingDecl = AllocNode->getLocationContext()->getDecl();
2514 }
2515 
2516 void CFRefLeakReport::createDescription(CheckerContext &Ctx, bool GCEnabled, bool IncludeAllocationLine) {
2517  assert(Location.isValid() && UniqueingDecl && UniqueingLocation.isValid());
2518  Description.clear();
2519  llvm::raw_string_ostream os(Description);
2520  os << "Potential leak ";
2521  if (GCEnabled)
2522  os << "(when using garbage collection) ";
2523  os << "of an object";
2524 
2525  if (AllocBinding) {
2526  os << " stored into '" << AllocBinding->getString() << '\'';
2527  if (IncludeAllocationLine) {
2528  FullSourceLoc SL(AllocStmt->getLocStart(), Ctx.getSourceManager());
2529  os << " (allocated on line " << SL.getSpellingLineNumber() << ")";
2530  }
2531  }
2532 }
2533 
2534 CFRefLeakReport::CFRefLeakReport(CFRefBug &D, const LangOptions &LOpts,
2535  bool GCEnabled, const SummaryLogTy &Log,
2536  ExplodedNode *n, SymbolRef sym,
2537  CheckerContext &Ctx,
2538  bool IncludeAllocationLine)
2539  : CFRefReport(D, LOpts, GCEnabled, Log, n, sym, false) {
2540 
2541  deriveAllocLocation(Ctx, sym);
2542  if (!AllocBinding)
2543  deriveParamLocation(Ctx, sym);
2544 
2545  createDescription(Ctx, GCEnabled, IncludeAllocationLine);
2546 
2547  addVisitor(llvm::make_unique<CFRefLeakReportVisitor>(sym, GCEnabled, Log));
2548 }
2549 
2550 //===----------------------------------------------------------------------===//
2551 // Main checker logic.
2552 //===----------------------------------------------------------------------===//
2553 
2554 namespace {
2555 class RetainCountChecker
2556  : public Checker< check::Bind,
2557  check::DeadSymbols,
2558  check::EndAnalysis,
2559  check::BeginFunction,
2560  check::EndFunction,
2561  check::PostStmt<BlockExpr>,
2562  check::PostStmt<CastExpr>,
2563  check::PostStmt<ObjCArrayLiteral>,
2564  check::PostStmt<ObjCDictionaryLiteral>,
2565  check::PostStmt<ObjCBoxedExpr>,
2566  check::PostStmt<ObjCIvarRefExpr>,
2567  check::PostCall,
2568  check::PreStmt<ReturnStmt>,
2569  check::RegionChanges,
2570  eval::Assume,
2571  eval::Call > {
2572  mutable std::unique_ptr<CFRefBug> useAfterRelease, releaseNotOwned;
2573  mutable std::unique_ptr<CFRefBug> deallocGC, deallocNotOwned;
2574  mutable std::unique_ptr<CFRefBug> overAutorelease, returnNotOwnedForOwned;
2575  mutable std::unique_ptr<CFRefBug> leakWithinFunction, leakAtReturn;
2576  mutable std::unique_ptr<CFRefBug> leakWithinFunctionGC, leakAtReturnGC;
2577 
2578  typedef llvm::DenseMap<SymbolRef, const CheckerProgramPointTag *> SymbolTagMap;
2579 
2580  // This map is only used to ensure proper deletion of any allocated tags.
2581  mutable SymbolTagMap DeadSymbolTags;
2582 
2583  mutable std::unique_ptr<RetainSummaryManager> Summaries;
2584  mutable std::unique_ptr<RetainSummaryManager> SummariesGC;
2585  mutable SummaryLogTy SummaryLog;
2586  mutable bool ShouldResetSummaryLog;
2587 
2588  /// Optional setting to indicate if leak reports should include
2589  /// the allocation line.
2590  mutable bool IncludeAllocationLine;
2591 
2592 public:
2593  RetainCountChecker(AnalyzerOptions &AO)
2594  : ShouldResetSummaryLog(false),
2595  IncludeAllocationLine(shouldIncludeAllocationSiteInLeakDiagnostics(AO)) {}
2596 
2597  ~RetainCountChecker() override { DeleteContainerSeconds(DeadSymbolTags); }
2598 
2599  void checkEndAnalysis(ExplodedGraph &G, BugReporter &BR,
2600  ExprEngine &Eng) const {
2601  // FIXME: This is a hack to make sure the summary log gets cleared between
2602  // analyses of different code bodies.
2603  //
2604  // Why is this necessary? Because a checker's lifetime is tied to a
2605  // translation unit, but an ExplodedGraph's lifetime is just a code body.
2606  // Once in a blue moon, a new ExplodedNode will have the same address as an
2607  // old one with an associated summary, and the bug report visitor gets very
2608  // confused. (To make things worse, the summary lifetime is currently also
2609  // tied to a code body, so we get a crash instead of incorrect results.)
2610  //
2611  // Why is this a bad solution? Because if the lifetime of the ExplodedGraph
2612  // changes, things will start going wrong again. Really the lifetime of this
2613  // log needs to be tied to either the specific nodes in it or the entire
2614  // ExplodedGraph, not to a specific part of the code being analyzed.
2615  //
2616  // (Also, having stateful local data means that the same checker can't be
2617  // used from multiple threads, but a lot of checkers have incorrect
2618  // assumptions about that anyway. So that wasn't a priority at the time of
2619  // this fix.)
2620  //
2621  // This happens at the end of analysis, but bug reports are emitted /after/
2622  // this point. So we can't just clear the summary log now. Instead, we mark
2623  // that the next time we access the summary log, it should be cleared.
2624 
2625  // If we never reset the summary log during /this/ code body analysis,
2626  // there were no new summaries. There might still have been summaries from
2627  // the /last/ analysis, so clear them out to make sure the bug report
2628  // visitors don't get confused.
2629  if (ShouldResetSummaryLog)
2630  SummaryLog.clear();
2631 
2632  ShouldResetSummaryLog = !SummaryLog.empty();
2633  }
2634 
2635  CFRefBug *getLeakWithinFunctionBug(const LangOptions &LOpts,
2636  bool GCEnabled) const {
2637  if (GCEnabled) {
2638  if (!leakWithinFunctionGC)
2639  leakWithinFunctionGC.reset(new Leak(this, "Leak of object when using "
2640  "garbage collection"));
2641  return leakWithinFunctionGC.get();
2642  } else {
2643  if (!leakWithinFunction) {
2644  if (LOpts.getGC() == LangOptions::HybridGC) {
2645  leakWithinFunction.reset(new Leak(this,
2646  "Leak of object when not using "
2647  "garbage collection (GC) in "
2648  "dual GC/non-GC code"));
2649  } else {
2650  leakWithinFunction.reset(new Leak(this, "Leak"));
2651  }
2652  }
2653  return leakWithinFunction.get();
2654  }
2655  }
2656 
2657  CFRefBug *getLeakAtReturnBug(const LangOptions &LOpts, bool GCEnabled) const {
2658  if (GCEnabled) {
2659  if (!leakAtReturnGC)
2660  leakAtReturnGC.reset(new Leak(this,
2661  "Leak of returned object when using "
2662  "garbage collection"));
2663  return leakAtReturnGC.get();
2664  } else {
2665  if (!leakAtReturn) {
2666  if (LOpts.getGC() == LangOptions::HybridGC) {
2667  leakAtReturn.reset(new Leak(this,
2668  "Leak of returned object when not using "
2669  "garbage collection (GC) in dual "
2670  "GC/non-GC code"));
2671  } else {
2672  leakAtReturn.reset(new Leak(this, "Leak of returned object"));
2673  }
2674  }
2675  return leakAtReturn.get();
2676  }
2677  }
2678 
2679  RetainSummaryManager &getSummaryManager(ASTContext &Ctx,
2680  bool GCEnabled) const {
2681  // FIXME: We don't support ARC being turned on and off during one analysis.
2682  // (nor, for that matter, do we support changing ASTContexts)
2683  bool ARCEnabled = (bool)Ctx.getLangOpts().ObjCAutoRefCount;
2684  if (GCEnabled) {
2685  if (!SummariesGC)
2686  SummariesGC.reset(new RetainSummaryManager(Ctx, true, ARCEnabled));
2687  else
2688  assert(SummariesGC->isARCEnabled() == ARCEnabled);
2689  return *SummariesGC;
2690  } else {
2691  if (!Summaries)
2692  Summaries.reset(new RetainSummaryManager(Ctx, false, ARCEnabled));
2693  else
2694  assert(Summaries->isARCEnabled() == ARCEnabled);
2695  return *Summaries;
2696  }
2697  }
2698 
2699  RetainSummaryManager &getSummaryManager(CheckerContext &C) const {
2700  return getSummaryManager(C.getASTContext(), C.isObjCGCEnabled());
2701  }
2702 
2703  void printState(raw_ostream &Out, ProgramStateRef State,
2704  const char *NL, const char *Sep) const override;
2705 
2706  void checkBind(SVal loc, SVal val, const Stmt *S, CheckerContext &C) const;
2707  void checkPostStmt(const BlockExpr *BE, CheckerContext &C) const;
2708  void checkPostStmt(const CastExpr *CE, CheckerContext &C) const;
2709 
2710  void checkPostStmt(const ObjCArrayLiteral *AL, CheckerContext &C) const;
2711  void checkPostStmt(const ObjCDictionaryLiteral *DL, CheckerContext &C) const;
2712  void checkPostStmt(const ObjCBoxedExpr *BE, CheckerContext &C) const;
2713 
2714  void checkPostStmt(const ObjCIvarRefExpr *IRE, CheckerContext &C) const;
2715 
2716  void checkPostCall(const CallEvent &Call, CheckerContext &C) const;
2717 
2718  void checkSummary(const RetainSummary &Summ, const CallEvent &Call,
2719  CheckerContext &C) const;
2720 
2721  void processSummaryOfInlined(const RetainSummary &Summ,
2722  const CallEvent &Call,
2723  CheckerContext &C) const;
2724 
2725  bool evalCall(const CallExpr *CE, CheckerContext &C) const;
2726 
2727  ProgramStateRef evalAssume(ProgramStateRef state, SVal Cond,
2728  bool Assumption) const;
2729 
2731  checkRegionChanges(ProgramStateRef state,
2732  const InvalidatedSymbols *invalidated,
2733  ArrayRef<const MemRegion *> ExplicitRegions,
2735  const LocationContext* LCtx,
2736  const CallEvent *Call) const;
2737 
2738  void checkPreStmt(const ReturnStmt *S, CheckerContext &C) const;
2739  void checkReturnWithRetEffect(const ReturnStmt *S, CheckerContext &C,
2740  ExplodedNode *Pred, RetEffect RE, RefVal X,
2741  SymbolRef Sym, ProgramStateRef state) const;
2742 
2743  void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const;
2744  void checkBeginFunction(CheckerContext &C) const;
2745  void checkEndFunction(CheckerContext &C) const;
2746 
2747  ProgramStateRef updateSymbol(ProgramStateRef state, SymbolRef sym,
2748  RefVal V, ArgEffect E, RefVal::Kind &hasErr,
2749  CheckerContext &C) const;
2750 
2751  void processNonLeakError(ProgramStateRef St, SourceRange ErrorRange,
2752  RefVal::Kind ErrorKind, SymbolRef Sym,
2753  CheckerContext &C) const;
2754 
2755  void processObjCLiterals(CheckerContext &C, const Expr *Ex) const;
2756 
2757  const ProgramPointTag *getDeadSymbolTag(SymbolRef sym) const;
2758 
2759  ProgramStateRef handleSymbolDeath(ProgramStateRef state,
2760  SymbolRef sid, RefVal V,
2761  SmallVectorImpl<SymbolRef> &Leaked) const;
2762 
2764  handleAutoreleaseCounts(ProgramStateRef state, ExplodedNode *Pred,
2765  const ProgramPointTag *Tag, CheckerContext &Ctx,
2766  SymbolRef Sym, RefVal V) const;
2767 
2768  ExplodedNode *processLeaks(ProgramStateRef state,
2770  CheckerContext &Ctx,
2771  ExplodedNode *Pred = nullptr) const;
2772 };
2773 } // end anonymous namespace
2774 
2775 namespace {
2776 class StopTrackingCallback final : public SymbolVisitor {
2778 public:
2779  StopTrackingCallback(ProgramStateRef st) : state(std::move(st)) {}
2780  ProgramStateRef getState() const { return state; }
2781 
2782  bool VisitSymbol(SymbolRef sym) override {
2783  state = state->remove<RefBindings>(sym);
2784  return true;
2785  }
2786 };
2787 } // end anonymous namespace
2788 
2789 //===----------------------------------------------------------------------===//
2790 // Handle statements that may have an effect on refcounts.
2791 //===----------------------------------------------------------------------===//
2792 
2793 void RetainCountChecker::checkPostStmt(const BlockExpr *BE,
2794  CheckerContext &C) const {
2795 
2796  // Scan the BlockDecRefExprs for any object the retain count checker
2797  // may be tracking.
2798  if (!BE->getBlockDecl()->hasCaptures())
2799  return;
2800 
2802  const BlockDataRegion *R =
2803  cast<BlockDataRegion>(state->getSVal(BE,
2804  C.getLocationContext()).getAsRegion());
2805 
2807  E = R->referenced_vars_end();
2808 
2809  if (I == E)
2810  return;
2811 
2812  // FIXME: For now we invalidate the tracking of all symbols passed to blocks
2813  // via captured variables, even though captured variables result in a copy
2814  // and in implicit increment/decrement of a retain count.
2816  const LocationContext *LC = C.getLocationContext();
2818 
2819  for ( ; I != E; ++I) {
2820  const VarRegion *VR = I.getCapturedRegion();
2821  if (VR->getSuperRegion() == R) {
2822  VR = MemMgr.getVarRegion(VR->getDecl(), LC);
2823  }
2824  Regions.push_back(VR);
2825  }
2826 
2827  state =
2828  state->scanReachableSymbols<StopTrackingCallback>(Regions.data(),
2829  Regions.data() + Regions.size()).getState();
2830  C.addTransition(state);
2831 }
2832 
2833 void RetainCountChecker::checkPostStmt(const CastExpr *CE,
2834  CheckerContext &C) const {
2835  const ObjCBridgedCastExpr *BE = dyn_cast<ObjCBridgedCastExpr>(CE);
2836  if (!BE)
2837  return;
2838 
2839  ArgEffect AE = IncRef;
2840 
2841  switch (BE->getBridgeKind()) {
2842  case clang::OBC_Bridge:
2843  // Do nothing.
2844  return;
2846  AE = IncRef;
2847  break;
2850  break;
2851  }
2852 
2854  SymbolRef Sym = state->getSVal(CE, C.getLocationContext()).getAsLocSymbol();
2855  if (!Sym)
2856  return;
2857  const RefVal* T = getRefBinding(state, Sym);
2858  if (!T)
2859  return;
2860 
2861  RefVal::Kind hasErr = (RefVal::Kind) 0;
2862  state = updateSymbol(state, Sym, *T, AE, hasErr, C);
2863 
2864  if (hasErr) {
2865  // FIXME: If we get an error during a bridge cast, should we report it?
2866  return;
2867  }
2868 
2869  C.addTransition(state);
2870 }
2871 
2872 void RetainCountChecker::processObjCLiterals(CheckerContext &C,
2873  const Expr *Ex) const {
2875  const ExplodedNode *pred = C.getPredecessor();
2876  for (const Stmt *Child : Ex->children()) {
2877  SVal V = state->getSVal(Child, pred->getLocationContext());
2878  if (SymbolRef sym = V.getAsSymbol())
2879  if (const RefVal* T = getRefBinding(state, sym)) {
2880  RefVal::Kind hasErr = (RefVal::Kind) 0;
2881  state = updateSymbol(state, sym, *T, MayEscape, hasErr, C);
2882  if (hasErr) {
2883  processNonLeakError(state, Child->getSourceRange(), hasErr, sym, C);
2884  return;
2885  }
2886  }
2887  }
2888 
2889  // Return the object as autoreleased.
2890  // RetEffect RE = RetEffect::MakeNotOwned(RetEffect::ObjC);
2891  if (SymbolRef sym =
2892  state->getSVal(Ex, pred->getLocationContext()).getAsSymbol()) {
2893  QualType ResultTy = Ex->getType();
2894  state = setRefBinding(state, sym,
2895  RefVal::makeNotOwned(RetEffect::ObjC, ResultTy));
2896  }
2897 
2898  C.addTransition(state);
2899 }
2900 
2901 void RetainCountChecker::checkPostStmt(const ObjCArrayLiteral *AL,
2902  CheckerContext &C) const {
2903  // Apply the 'MayEscape' to all values.
2904  processObjCLiterals(C, AL);
2905 }
2906 
2907 void RetainCountChecker::checkPostStmt(const ObjCDictionaryLiteral *DL,
2908  CheckerContext &C) const {
2909  // Apply the 'MayEscape' to all keys and values.
2910  processObjCLiterals(C, DL);
2911 }
2912 
2913 void RetainCountChecker::checkPostStmt(const ObjCBoxedExpr *Ex,
2914  CheckerContext &C) const {
2915  const ExplodedNode *Pred = C.getPredecessor();
2916  const LocationContext *LCtx = Pred->getLocationContext();
2917  ProgramStateRef State = Pred->getState();
2918 
2919  if (SymbolRef Sym = State->getSVal(Ex, LCtx).getAsSymbol()) {
2920  QualType ResultTy = Ex->getType();
2921  State = setRefBinding(State, Sym,
2922  RefVal::makeNotOwned(RetEffect::ObjC, ResultTy));
2923  }
2924 
2925  C.addTransition(State);
2926 }
2927 
2928 void RetainCountChecker::checkPostStmt(const ObjCIvarRefExpr *IRE,
2929  CheckerContext &C) const {
2930  Optional<Loc> IVarLoc = C.getSVal(IRE).getAs<Loc>();
2931  if (!IVarLoc)
2932  return;
2933 
2934  ProgramStateRef State = C.getState();
2935  SymbolRef Sym = State->getSVal(*IVarLoc).getAsSymbol();
2936  if (!Sym || !dyn_cast_or_null<ObjCIvarRegion>(Sym->getOriginRegion()))
2937  return;
2938 
2939  // Accessing an ivar directly is unusual. If we've done that, be more
2940  // forgiving about what the surrounding code is allowed to do.
2941 
2942  QualType Ty = Sym->getType();
2944  if (Ty->isObjCRetainableType())
2945  Kind = RetEffect::ObjC;
2946  else if (coreFoundation::isCFObjectRef(Ty))
2947  Kind = RetEffect::CF;
2948  else
2949  return;
2950 
2951  // If the value is already known to be nil, don't bother tracking it.
2952  ConstraintManager &CMgr = State->getConstraintManager();
2953  if (CMgr.isNull(State, Sym).isConstrainedTrue())
2954  return;
2955 
2956  if (const RefVal *RV = getRefBinding(State, Sym)) {
2957  // If we've seen this symbol before, or we're only seeing it now because
2958  // of something the analyzer has synthesized, don't do anything.
2959  if (RV->getIvarAccessHistory() != RefVal::IvarAccessHistory::None ||
2961  return;
2962  }
2963 
2964  // Note that this value has been loaded from an ivar.
2965  C.addTransition(setRefBinding(State, Sym, RV->withIvarAccess()));
2966  return;
2967  }
2968 
2969  RefVal PlusZero = RefVal::makeNotOwned(Kind, Ty);
2970 
2971  // In a synthesized accessor, the effective retain count is +0.
2973  C.addTransition(setRefBinding(State, Sym, PlusZero));
2974  return;
2975  }
2976 
2977  State = setRefBinding(State, Sym, PlusZero.withIvarAccess());
2978  C.addTransition(State);
2979 }
2980 
2981 void RetainCountChecker::checkPostCall(const CallEvent &Call,
2982  CheckerContext &C) const {
2983  RetainSummaryManager &Summaries = getSummaryManager(C);
2984  const RetainSummary *Summ = Summaries.getSummary(Call, C.getState());
2985 
2986  if (C.wasInlined) {
2987  processSummaryOfInlined(*Summ, Call, C);
2988  return;
2989  }
2990  checkSummary(*Summ, Call, C);
2991 }
2992 
2993 /// GetReturnType - Used to get the return type of a message expression or
2994 /// function call with the intention of affixing that type to a tracked symbol.
2995 /// While the return type can be queried directly from RetEx, when
2996 /// invoking class methods we augment to the return type to be that of
2997 /// a pointer to the class (as opposed it just being id).
2998 // FIXME: We may be able to do this with related result types instead.
2999 // This function is probably overestimating.
3000 static QualType GetReturnType(const Expr *RetE, ASTContext &Ctx) {
3001  QualType RetTy = RetE->getType();
3002  // If RetE is not a message expression just return its type.
3003  // If RetE is a message expression, return its types if it is something
3004  /// more specific than id.
3005  if (const ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(RetE))
3006  if (const ObjCObjectPointerType *PT = RetTy->getAs<ObjCObjectPointerType>())
3007  if (PT->isObjCQualifiedIdType() || PT->isObjCIdType() ||
3008  PT->isObjCClassType()) {
3009  // At this point we know the return type of the message expression is
3010  // id, id<...>, or Class. If we have an ObjCInterfaceDecl, we know this
3011  // is a call to a class method whose type we can resolve. In such
3012  // cases, promote the return type to XXX* (where XXX is the class).
3013  const ObjCInterfaceDecl *D = ME->getReceiverInterface();
3014  return !D ? RetTy :
3016  }
3017 
3018  return RetTy;
3019 }
3020 
3021 // We don't always get the exact modeling of the function with regards to the
3022 // retain count checker even when the function is inlined. For example, we need
3023 // to stop tracking the symbols which were marked with StopTrackingHard.
3024 void RetainCountChecker::processSummaryOfInlined(const RetainSummary &Summ,
3025  const CallEvent &CallOrMsg,
3026  CheckerContext &C) const {
3028 
3029  // Evaluate the effect of the arguments.
3030  for (unsigned idx = 0, e = CallOrMsg.getNumArgs(); idx != e; ++idx) {
3031  if (Summ.getArg(idx) == StopTrackingHard) {
3032  SVal V = CallOrMsg.getArgSVal(idx);
3033  if (SymbolRef Sym = V.getAsLocSymbol()) {
3034  state = removeRefBinding(state, Sym);
3035  }
3036  }
3037  }
3038 
3039  // Evaluate the effect on the message receiver.
3040  const ObjCMethodCall *MsgInvocation = dyn_cast<ObjCMethodCall>(&CallOrMsg);
3041  if (MsgInvocation) {
3042  if (SymbolRef Sym = MsgInvocation->getReceiverSVal().getAsLocSymbol()) {
3043  if (Summ.getReceiverEffect() == StopTrackingHard) {
3044  state = removeRefBinding(state, Sym);
3045  }
3046  }
3047  }
3048 
3049  // Consult the summary for the return value.
3050  RetEffect RE = Summ.getRetEffect();
3051  if (RE.getKind() == RetEffect::NoRetHard) {
3052  SymbolRef Sym = CallOrMsg.getReturnValue().getAsSymbol();
3053  if (Sym)
3054  state = removeRefBinding(state, Sym);
3055  }
3056 
3057  C.addTransition(state);
3058 }
3059 
3061  SVal ArgVal,
3062  ArgEffect Effect) {
3063  auto *ArgRegion = dyn_cast_or_null<TypedValueRegion>(ArgVal.getAsRegion());
3064  if (!ArgRegion)
3065  return State;
3066 
3067  QualType PointeeTy = ArgRegion->getValueType();
3068  if (!coreFoundation::isCFObjectRef(PointeeTy))
3069  return State;
3070 
3071  SVal PointeeVal = State->getSVal(ArgRegion);
3072  SymbolRef Pointee = PointeeVal.getAsLocSymbol();
3073  if (!Pointee)
3074  return State;
3075 
3076  switch (Effect) {
3078  State = setRefBinding(State, Pointee,
3079  RefVal::makeNotOwned(RetEffect::CF, PointeeTy));
3080  break;
3081  case RetainedOutParameter:
3082  // Do nothing. Retained out parameters will either point to a +1 reference
3083  // or NULL, but the way you check for failure differs depending on the API.
3084  // Consequently, we don't have a good way to track them yet.
3085  break;
3086 
3087  default:
3088  llvm_unreachable("only for out parameters");
3089  }
3090 
3091  return State;
3092 }
3093 
3094 void RetainCountChecker::checkSummary(const RetainSummary &Summ,
3095  const CallEvent &CallOrMsg,
3096  CheckerContext &C) const {
3098 
3099  // Evaluate the effect of the arguments.
3100  RefVal::Kind hasErr = (RefVal::Kind) 0;
3101  SourceRange ErrorRange;
3102  SymbolRef ErrorSym = nullptr;
3103 
3104  for (unsigned idx = 0, e = CallOrMsg.getNumArgs(); idx != e; ++idx) {
3105  SVal V = CallOrMsg.getArgSVal(idx);
3106 
3107  ArgEffect Effect = Summ.getArg(idx);
3108  if (Effect == RetainedOutParameter || Effect == UnretainedOutParameter) {
3109  state = updateOutParameter(state, V, Effect);
3110  } else if (SymbolRef Sym = V.getAsLocSymbol()) {
3111  if (const RefVal *T = getRefBinding(state, Sym)) {
3112  state = updateSymbol(state, Sym, *T, Effect, hasErr, C);
3113  if (hasErr) {
3114  ErrorRange = CallOrMsg.getArgSourceRange(idx);
3115  ErrorSym = Sym;
3116  break;
3117  }
3118  }
3119  }
3120  }
3121 
3122  // Evaluate the effect on the message receiver.
3123  bool ReceiverIsTracked = false;
3124  if (!hasErr) {
3125  const ObjCMethodCall *MsgInvocation = dyn_cast<ObjCMethodCall>(&CallOrMsg);
3126  if (MsgInvocation) {
3127  if (SymbolRef Sym = MsgInvocation->getReceiverSVal().getAsLocSymbol()) {
3128  if (const RefVal *T = getRefBinding(state, Sym)) {
3129  ReceiverIsTracked = true;
3130  state = updateSymbol(state, Sym, *T, Summ.getReceiverEffect(),
3131  hasErr, C);
3132  if (hasErr) {
3133  ErrorRange = MsgInvocation->getOriginExpr()->getReceiverRange();
3134  ErrorSym = Sym;
3135  }
3136  }
3137  }
3138  }
3139  }
3140 
3141  // Process any errors.
3142  if (hasErr) {
3143  processNonLeakError(state, ErrorRange, hasErr, ErrorSym, C);
3144  return;
3145  }
3146 
3147  // Consult the summary for the return value.
3148  RetEffect RE = Summ.getRetEffect();
3149 
3151  if (ReceiverIsTracked)
3152  RE = getSummaryManager(C).getObjAllocRetEffect();
3153  else
3154  RE = RetEffect::MakeNoRet();
3155  }
3156 
3157  switch (RE.getKind()) {
3158  default:
3159  llvm_unreachable("Unhandled RetEffect.");
3160 
3161  case RetEffect::NoRet:
3162  case RetEffect::NoRetHard:
3163  // No work necessary.
3164  break;
3165 
3166  case RetEffect::OwnedSymbol: {
3167  SymbolRef Sym = CallOrMsg.getReturnValue().getAsSymbol();
3168  if (!Sym)
3169  break;
3170 
3171  // Use the result type from the CallEvent as it automatically adjusts
3172  // for methods/functions that return references.
3173  QualType ResultTy = CallOrMsg.getResultType();
3174  state = setRefBinding(state, Sym, RefVal::makeOwned(RE.getObjKind(),
3175  ResultTy));
3176 
3177  // FIXME: Add a flag to the checker where allocations are assumed to
3178  // *not* fail.
3179  break;
3180  }
3181 
3184  const Expr *Ex = CallOrMsg.getOriginExpr();
3185  SymbolRef Sym = CallOrMsg.getReturnValue().getAsSymbol();
3186  if (!Sym)
3187  break;
3188  assert(Ex);
3189  // Use GetReturnType in order to give [NSFoo alloc] the type NSFoo *.
3190  QualType ResultTy = GetReturnType(Ex, C.getASTContext());
3191  state = setRefBinding(state, Sym, RefVal::makeNotOwned(RE.getObjKind(),
3192  ResultTy));
3193  break;
3194  }
3195  }
3196 
3197  // This check is actually necessary; otherwise the statement builder thinks
3198  // we've hit a previously-found path.
3199  // Normally addTransition takes care of this, but we want the node pointer.
3200  ExplodedNode *NewNode;
3201  if (state == C.getState()) {
3202  NewNode = C.getPredecessor();
3203  } else {
3204  NewNode = C.addTransition(state);
3205  }
3206 
3207  // Annotate the node with summary we used.
3208  if (NewNode) {
3209  // FIXME: This is ugly. See checkEndAnalysis for why it's necessary.
3210  if (ShouldResetSummaryLog) {
3211  SummaryLog.clear();
3212  ShouldResetSummaryLog = false;
3213  }
3214  SummaryLog[NewNode] = &Summ;
3215  }
3216 }
3217 
3219 RetainCountChecker::updateSymbol(ProgramStateRef state, SymbolRef sym,
3220  RefVal V, ArgEffect E, RefVal::Kind &hasErr,
3221  CheckerContext &C) const {
3222  // In GC mode [... release] and [... retain] do nothing.
3223  // In ARC mode they shouldn't exist at all, but we just ignore them.
3224  bool IgnoreRetainMsg = C.isObjCGCEnabled();
3225  if (!IgnoreRetainMsg)
3226  IgnoreRetainMsg = (bool)C.getASTContext().getLangOpts().ObjCAutoRefCount;
3227 
3228  switch (E) {
3229  default:
3230  break;
3231  case IncRefMsg:
3232  E = IgnoreRetainMsg ? DoNothing : IncRef;
3233  break;
3234  case DecRefMsg:
3235  E = IgnoreRetainMsg ? DoNothing : DecRef;
3236  break;
3238  E = IgnoreRetainMsg ? StopTracking : DecRefAndStopTrackingHard;
3239  break;
3240  case MakeCollectable:
3241  E = C.isObjCGCEnabled() ? DecRef : DoNothing;
3242  break;
3243  }
3244 
3245  // Handle all use-after-releases.
3246  if (!C.isObjCGCEnabled() && V.getKind() == RefVal::Released) {
3247  V = V ^ RefVal::ErrorUseAfterRelease;
3248  hasErr = V.getKind();
3249  return setRefBinding(state, sym, V);
3250  }
3251 
3252  switch (E) {
3253  case DecRefMsg:
3254  case IncRefMsg:
3255  case MakeCollectable:
3257  llvm_unreachable("DecRefMsg/IncRefMsg/MakeCollectable already converted");
3258 
3260  case RetainedOutParameter:
3261  llvm_unreachable("Applies to pointer-to-pointer parameters, which should "
3262  "not have ref state.");
3263 
3264  case Dealloc:
3265  // Any use of -dealloc in GC is *bad*.
3266  if (C.isObjCGCEnabled()) {
3267  V = V ^ RefVal::ErrorDeallocGC;
3268  hasErr = V.getKind();
3269  break;
3270  }
3271 
3272  switch (V.getKind()) {
3273  default:
3274  llvm_unreachable("Invalid RefVal state for an explicit dealloc.");
3275  case RefVal::Owned:
3276  // The object immediately transitions to the released state.
3277  V = V ^ RefVal::Released;
3278  V.clearCounts();
3279  return setRefBinding(state, sym, V);
3280  case RefVal::NotOwned:
3281  V = V ^ RefVal::ErrorDeallocNotOwned;
3282  hasErr = V.getKind();
3283  break;
3284  }
3285  break;
3286 
3287  case MayEscape:
3288  if (V.getKind() == RefVal::Owned) {
3289  V = V ^ RefVal::NotOwned;
3290  break;
3291  }
3292 
3293  // Fall-through.
3294 
3295  case DoNothing:
3296  return state;
3297 
3298  case Autorelease:
3299  if (C.isObjCGCEnabled())
3300  return state;
3301  // Update the autorelease counts.
3302  V = V.autorelease();
3303  break;
3304 
3305  case StopTracking:
3306  case StopTrackingHard:
3307  return removeRefBinding(state, sym);
3308 
3309  case IncRef:
3310  switch (V.getKind()) {
3311  default:
3312  llvm_unreachable("Invalid RefVal state for a retain.");
3313  case RefVal::Owned:
3314  case RefVal::NotOwned:
3315  V = V + 1;
3316  break;
3317  case RefVal::Released:
3318  // Non-GC cases are handled above.
3319  assert(C.isObjCGCEnabled());
3320  V = (V ^ RefVal::Owned) + 1;
3321  break;
3322  }
3323  break;
3324 
3325  case DecRef:
3328  switch (V.getKind()) {
3329  default:
3330  // case 'RefVal::Released' handled above.
3331  llvm_unreachable("Invalid RefVal state for a release.");
3332 
3333  case RefVal::Owned:
3334  assert(V.getCount() > 0);
3335  if (V.getCount() == 1) {
3336  if (E == DecRefBridgedTransferred ||
3337  V.getIvarAccessHistory() ==
3338  RefVal::IvarAccessHistory::AccessedDirectly)
3339  V = V ^ RefVal::NotOwned;
3340  else
3341  V = V ^ RefVal::Released;
3342  } else if (E == DecRefAndStopTrackingHard) {
3343  return removeRefBinding(state, sym);
3344  }
3345 
3346  V = V - 1;
3347  break;
3348 
3349  case RefVal::NotOwned:
3350  if (V.getCount() > 0) {
3351  if (E == DecRefAndStopTrackingHard)
3352  return removeRefBinding(state, sym);
3353  V = V - 1;
3354  } else if (V.getIvarAccessHistory() ==
3355  RefVal::IvarAccessHistory::AccessedDirectly) {
3356  // Assume that the instance variable was holding on the object at
3357  // +1, and we just didn't know.
3358  if (E == DecRefAndStopTrackingHard)
3359  return removeRefBinding(state, sym);
3360  V = V.releaseViaIvar() ^ RefVal::Released;
3361  } else {
3362  V = V ^ RefVal::ErrorReleaseNotOwned;
3363  hasErr = V.getKind();
3364  }
3365  break;
3366 
3367  case RefVal::Released:
3368  // Non-GC cases are handled above.
3369  assert(C.isObjCGCEnabled());
3370  V = V ^ RefVal::ErrorUseAfterRelease;
3371  hasErr = V.getKind();
3372  break;
3373  }
3374  break;
3375  }
3376  return setRefBinding(state, sym, V);
3377 }
3378 
3379 void RetainCountChecker::processNonLeakError(ProgramStateRef St,
3380  SourceRange ErrorRange,
3381  RefVal::Kind ErrorKind,
3382  SymbolRef Sym,
3383  CheckerContext &C) const {
3384  // HACK: Ignore retain-count issues on values accessed through ivars,
3385  // because of cases like this:
3386  // [_contentView retain];
3387  // [_contentView removeFromSuperview];
3388  // [self addSubview:_contentView]; // invalidates 'self'
3389  // [_contentView release];
3390  if (const RefVal *RV = getRefBinding(St, Sym))
3391  if (RV->getIvarAccessHistory() != RefVal::IvarAccessHistory::None)
3392  return;
3393 
3394  ExplodedNode *N = C.generateErrorNode(St);
3395  if (!N)
3396  return;
3397 
3398  CFRefBug *BT;
3399  switch (ErrorKind) {
3400  default:
3401  llvm_unreachable("Unhandled error.");
3402  case RefVal::ErrorUseAfterRelease:
3403  if (!useAfterRelease)
3404  useAfterRelease.reset(new UseAfterRelease(this));
3405  BT = useAfterRelease.get();
3406  break;
3407  case RefVal::ErrorReleaseNotOwned:
3408  if (!releaseNotOwned)
3409  releaseNotOwned.reset(new BadRelease(this));
3410  BT = releaseNotOwned.get();
3411  break;
3412  case RefVal::ErrorDeallocGC:
3413  if (!deallocGC)
3414  deallocGC.reset(new DeallocGC(this));
3415  BT = deallocGC.get();
3416  break;
3417  case RefVal::ErrorDeallocNotOwned:
3418  if (!deallocNotOwned)
3419  deallocNotOwned.reset(new DeallocNotOwned(this));
3420  BT = deallocNotOwned.get();
3421  break;
3422  }
3423 
3424  assert(BT);
3425  auto report = std::unique_ptr<BugReport>(
3426  new CFRefReport(*BT, C.getASTContext().getLangOpts(), C.isObjCGCEnabled(),
3427  SummaryLog, N, Sym));
3428  report->addRange(ErrorRange);
3429  C.emitReport(std::move(report));
3430 }
3431 
3432 //===----------------------------------------------------------------------===//
3433 // Handle the return values of retain-count-related functions.
3434 //===----------------------------------------------------------------------===//
3435 
3436 bool RetainCountChecker::evalCall(const CallExpr *CE, CheckerContext &C) const {
3437  // Get the callee. We're only interested in simple C functions.
3438  ProgramStateRef state = C.getState();
3439  const FunctionDecl *FD = C.getCalleeDecl(CE);
3440  if (!FD)
3441  return false;
3442 
3443  IdentifierInfo *II = FD->getIdentifier();
3444  if (!II)
3445  return false;
3446 
3447  // For now, we're only handling the functions that return aliases of their
3448  // arguments: CFRetain and CFMakeCollectable (and their families).
3449  // Eventually we should add other functions we can model entirely,
3450  // such as CFRelease, which don't invalidate their arguments or globals.
3451  if (CE->getNumArgs() != 1)
3452  return false;
3453 
3454  // Get the name of the function.
3455  StringRef FName = II->getName();
3456  FName = FName.substr(FName.find_first_not_of('_'));
3457 
3458  // See if it's one of the specific functions we know how to eval.
3459  bool canEval = false;
3460  // See if the function has 'rc_ownership_trusted_implementation'
3461  // annotate attribute. If it does, we will not inline it.
3462  bool hasTrustedImplementationAnnotation = false;
3463 
3464  QualType ResultTy = CE->getCallReturnType(C.getASTContext());
3465  if (ResultTy->isObjCIdType()) {
3466  // Handle: id NSMakeCollectable(CFTypeRef)
3467  canEval = II->isStr("NSMakeCollectable");
3468  } else if (ResultTy->isPointerType()) {
3469  // Handle: (CF|CG|CV)Retain
3470  // CFAutorelease
3471  // CFMakeCollectable
3472  // It's okay to be a little sloppy here (CGMakeCollectable doesn't exist).
3473  if (cocoa::isRefType(ResultTy, "CF", FName) ||
3474  cocoa::isRefType(ResultTy, "CG", FName) ||
3475  cocoa::isRefType(ResultTy, "CV", FName)) {
3476  canEval = isRetain(FD, FName) || isAutorelease(FD, FName) ||
3477  isMakeCollectable(FD, FName);
3478  } else {
3479  if (FD->getDefinition()) {
3481  hasTrustedImplementationAnnotation = canEval;
3482  }
3483  }
3484  }
3485 
3486  if (!canEval)
3487  return false;
3488 
3489  // Bind the return value.
3490  const LocationContext *LCtx = C.getLocationContext();
3491  SVal RetVal = state->getSVal(CE->getArg(0), LCtx);
3492  if (RetVal.isUnknown() ||
3493  (hasTrustedImplementationAnnotation && !ResultTy.isNull())) {
3494  // If the receiver is unknown or the function has
3495  // 'rc_ownership_trusted_implementation' annotate attribute, conjure a
3496  // return value.
3497  SValBuilder &SVB = C.getSValBuilder();
3498  RetVal = SVB.conjureSymbolVal(nullptr, CE, LCtx, ResultTy, C.blockCount());
3499  }
3500  state = state->BindExpr(CE, LCtx, RetVal, false);
3501 
3502  // FIXME: This should not be necessary, but otherwise the argument seems to be
3503  // considered alive during the next statement.
3504  if (const MemRegion *ArgRegion = RetVal.getAsRegion()) {
3505  // Save the refcount status of the argument.
3506  SymbolRef Sym = RetVal.getAsLocSymbol();
3507  const RefVal *Binding = nullptr;
3508  if (Sym)
3509  Binding = getRefBinding(state, Sym);
3510 
3511  // Invalidate the argument region.
3512  state = state->invalidateRegions(
3513  ArgRegion, CE, C.blockCount(), LCtx,
3514  /*CausesPointerEscape*/ hasTrustedImplementationAnnotation);
3515 
3516  // Restore the refcount status of the argument.
3517  if (Binding)
3518  state = setRefBinding(state, Sym, *Binding);
3519  }
3520 
3521  C.addTransition(state);
3522  return true;
3523 }
3524 
3525 //===----------------------------------------------------------------------===//
3526 // Handle return statements.
3527 //===----------------------------------------------------------------------===//
3528 
3529 void RetainCountChecker::checkPreStmt(const ReturnStmt *S,
3530  CheckerContext &C) const {
3531 
3532  // Only adjust the reference count if this is the top-level call frame,
3533  // and not the result of inlining. In the future, we should do
3534  // better checking even for inlined calls, and see if they match
3535  // with their expected semantics (e.g., the method should return a retained
3536  // object, etc.).
3537  if (!C.inTopFrame())
3538  return;
3539 
3540  const Expr *RetE = S->getRetValue();
3541  if (!RetE)
3542  return;
3543 
3544  ProgramStateRef state = C.getState();
3545  SymbolRef Sym =
3546  state->getSValAsScalarOrLoc(RetE, C.getLocationContext()).getAsLocSymbol();
3547  if (!Sym)
3548  return;
3549 
3550  // Get the reference count binding (if any).
3551  const RefVal *T = getRefBinding(state, Sym);
3552  if (!T)
3553  return;
3554 
3555  // Change the reference count.
3556  RefVal X = *T;
3557 
3558  switch (X.getKind()) {
3559  case RefVal::Owned: {
3560  unsigned cnt = X.getCount();
3561  assert(cnt > 0);
3562  X.setCount(cnt - 1);
3563  X = X ^ RefVal::ReturnedOwned;
3564  break;
3565  }
3566 
3567  case RefVal::NotOwned: {
3568  unsigned cnt = X.getCount();
3569  if (cnt) {
3570  X.setCount(cnt - 1);
3571  X = X ^ RefVal::ReturnedOwned;
3572  }
3573  else {
3574  X = X ^ RefVal::ReturnedNotOwned;
3575  }
3576  break;
3577  }
3578 
3579  default:
3580  return;
3581  }
3582 
3583  // Update the binding.
3584  state = setRefBinding(state, Sym, X);
3585  ExplodedNode *Pred = C.addTransition(state);
3586 
3587  // At this point we have updated the state properly.
3588  // Everything after this is merely checking to see if the return value has
3589  // been over- or under-retained.
3590 
3591  // Did we cache out?
3592  if (!Pred)
3593  return;
3594 
3595  // Update the autorelease counts.
3596  static CheckerProgramPointTag AutoreleaseTag(this, "Autorelease");
3597  state = handleAutoreleaseCounts(state, Pred, &AutoreleaseTag, C, Sym, X);
3598 
3599  // Did we cache out?
3600  if (!state)
3601  return;
3602 
3603  // Get the updated binding.
3604  T = getRefBinding(state, Sym);
3605  assert(T);
3606  X = *T;
3607 
3608  // Consult the summary of the enclosing method.
3609  RetainSummaryManager &Summaries = getSummaryManager(C);
3610  const Decl *CD = &Pred->getCodeDecl();
3612 
3613  // FIXME: What is the convention for blocks? Is there one?
3614  if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(CD)) {
3615  const RetainSummary *Summ = Summaries.getMethodSummary(MD);
3616  RE = Summ->getRetEffect();
3617  } else if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(CD)) {
3618  if (!isa<CXXMethodDecl>(FD)) {
3619  const RetainSummary *Summ = Summaries.getFunctionSummary(FD);
3620  RE = Summ->getRetEffect();
3621  }
3622  }
3623 
3624  checkReturnWithRetEffect(S, C, Pred, RE, X, Sym, state);
3625 }
3626 
3627 void RetainCountChecker::checkReturnWithRetEffect(const ReturnStmt *S,
3628  CheckerContext &C,
3629  ExplodedNode *Pred,
3630  RetEffect RE, RefVal X,
3631  SymbolRef Sym,
3632  ProgramStateRef state) const {
3633  // HACK: Ignore retain-count issues on values accessed through ivars,
3634  // because of cases like this:
3635  // [_contentView retain];
3636  // [_contentView removeFromSuperview];
3637  // [self addSubview:_contentView]; // invalidates 'self'
3638  // [_contentView release];
3639  if (X.getIvarAccessHistory() != RefVal::IvarAccessHistory::None)
3640  return;
3641 
3642  // Any leaks or other errors?
3643  if (X.isReturnedOwned() && X.getCount() == 0) {
3644  if (RE.getKind() != RetEffect::NoRet) {
3645  bool hasError = false;
3646  if (C.isObjCGCEnabled() && RE.getObjKind() == RetEffect::ObjC) {
3647  // Things are more complicated with garbage collection. If the
3648  // returned object is suppose to be an Objective-C object, we have
3649  // a leak (as the caller expects a GC'ed object) because no
3650  // method should return ownership unless it returns a CF object.
3651  hasError = true;
3652  X = X ^ RefVal::ErrorGCLeakReturned;
3653  }
3654  else if (!RE.isOwned()) {
3655  // Either we are using GC and the returned object is a CF type
3656  // or we aren't using GC. In either case, we expect that the
3657  // enclosing method is expected to return ownership.
3658  hasError = true;
3659  X = X ^ RefVal::ErrorLeakReturned;
3660  }
3661 
3662  if (hasError) {
3663  // Generate an error node.
3664  state = setRefBinding(state, Sym, X);
3665 
3666  static CheckerProgramPointTag ReturnOwnLeakTag(this, "ReturnsOwnLeak");
3667  ExplodedNode *N = C.addTransition(state, Pred, &ReturnOwnLeakTag);
3668  if (N) {
3669  const LangOptions &LOpts = C.getASTContext().getLangOpts();
3670  bool GCEnabled = C.isObjCGCEnabled();
3671  C.emitReport(std::unique_ptr<BugReport>(new CFRefLeakReport(
3672  *getLeakAtReturnBug(LOpts, GCEnabled), LOpts, GCEnabled,
3673  SummaryLog, N, Sym, C, IncludeAllocationLine)));
3674  }
3675  }
3676  }
3677  } else if (X.isReturnedNotOwned()) {
3678  if (RE.isOwned()) {
3679  if (X.getIvarAccessHistory() ==
3680  RefVal::IvarAccessHistory::AccessedDirectly) {
3681  // Assume the method was trying to transfer a +1 reference from a
3682  // strong ivar to the caller.
3683  state = setRefBinding(state, Sym,
3684  X.releaseViaIvar() ^ RefVal::ReturnedOwned);
3685  } else {
3686  // Trying to return a not owned object to a caller expecting an
3687  // owned object.
3688  state = setRefBinding(state, Sym, X ^ RefVal::ErrorReturnedNotOwned);
3689 
3690  static CheckerProgramPointTag
3691  ReturnNotOwnedTag(this, "ReturnNotOwnedForOwned");
3692 
3693  ExplodedNode *N = C.addTransition(state, Pred, &ReturnNotOwnedTag);
3694  if (N) {
3695  if (!returnNotOwnedForOwned)
3696  returnNotOwnedForOwned.reset(new ReturnedNotOwnedForOwned(this));
3697 
3698  C.emitReport(std::unique_ptr<BugReport>(new CFRefReport(
3699  *returnNotOwnedForOwned, C.getASTContext().getLangOpts(),
3700  C.isObjCGCEnabled(), SummaryLog, N, Sym)));
3701  }
3702  }
3703  }
3704  }
3705 }
3706 
3707 //===----------------------------------------------------------------------===//
3708 // Check various ways a symbol can be invalidated.
3709 //===----------------------------------------------------------------------===//
3710 
3711 void RetainCountChecker::checkBind(SVal loc, SVal val, const Stmt *S,
3712  CheckerContext &C) const {
3713  // Are we storing to something that causes the value to "escape"?
3714  bool escapes = true;
3715 
3716  // A value escapes in three possible cases (this may change):
3717  //
3718  // (1) we are binding to something that is not a memory region.
3719  // (2) we are binding to a memregion that does not have stack storage
3720  // (3) we are binding to a memregion with stack storage that the store
3721  // does not understand.
3722  ProgramStateRef state = C.getState();
3723 
3724  if (Optional<loc::MemRegionVal> regionLoc = loc.getAs<loc::MemRegionVal>()) {
3725  escapes = !regionLoc->getRegion()->hasStackStorage();
3726 
3727  if (!escapes) {
3728  // To test (3), generate a new state with the binding added. If it is
3729  // the same state, then it escapes (since the store cannot represent
3730  // the binding).
3731  // Do this only if we know that the store is not supposed to generate the
3732  // same state.
3733  SVal StoredVal = state->getSVal(regionLoc->getRegion());
3734  if (StoredVal != val)
3735  escapes = (state == (state->bindLoc(*regionLoc, val, C.getLocationContext())));
3736  }
3737  if (!escapes) {
3738  // Case 4: We do not currently model what happens when a symbol is
3739  // assigned to a struct field, so be conservative here and let the symbol
3740  // go. TODO: This could definitely be improved upon.
3741  escapes = !isa<VarRegion>(regionLoc->getRegion());
3742  }
3743  }
3744 
3745  // If we are storing the value into an auto function scope variable annotated
3746  // with (__attribute__((cleanup))), stop tracking the value to avoid leak
3747  // false positives.
3748  if (const VarRegion *LVR = dyn_cast_or_null<VarRegion>(loc.getAsRegion())) {
3749  const VarDecl *VD = LVR->getDecl();
3750  if (VD->hasAttr<CleanupAttr>()) {
3751  escapes = true;
3752  }
3753  }
3754 
3755  // If our store can represent the binding and we aren't storing to something
3756  // that doesn't have local storage then just return and have the simulation
3757  // state continue as is.
3758  if (!escapes)
3759  return;
3760 
3761  // Otherwise, find all symbols referenced by 'val' that we are tracking
3762  // and stop tracking them.
3763  state = state->scanReachableSymbols<StopTrackingCallback>(val).getState();
3764  C.addTransition(state);
3765 }
3766 
3767 ProgramStateRef RetainCountChecker::evalAssume(ProgramStateRef state,
3768  SVal Cond,
3769  bool Assumption) const {
3770  // FIXME: We may add to the interface of evalAssume the list of symbols
3771  // whose assumptions have changed. For now we just iterate through the
3772  // bindings and check if any of the tracked symbols are NULL. This isn't
3773  // too bad since the number of symbols we will track in practice are
3774  // probably small and evalAssume is only called at branches and a few
3775  // other places.
3776  RefBindingsTy B = state->get<RefBindings>();
3777 
3778  if (B.isEmpty())
3779  return state;
3780 
3781  bool changed = false;
3782  RefBindingsTy::Factory &RefBFactory = state->get_context<RefBindings>();
3783 
3784  for (RefBindingsTy::iterator I = B.begin(), E = B.end(); I != E; ++I) {
3785  // Check if the symbol is null stop tracking the symbol.
3786  ConstraintManager &CMgr = state->getConstraintManager();
3787  ConditionTruthVal AllocFailed = CMgr.isNull(state, I.getKey());
3788  if (AllocFailed.isConstrainedTrue()) {
3789  changed = true;
3790  B = RefBFactory.remove(B, I.getKey());
3791  }
3792  }
3793 
3794  if (changed)
3795  state = state->set<RefBindings>(B);
3796 
3797  return state;
3798 }
3799 
3801 RetainCountChecker::checkRegionChanges(ProgramStateRef state,
3802  const InvalidatedSymbols *invalidated,
3803  ArrayRef<const MemRegion *> ExplicitRegions,
3805  const LocationContext *LCtx,
3806  const CallEvent *Call) const {
3807  if (!invalidated)
3808  return state;
3809 
3810  llvm::SmallPtrSet<SymbolRef, 8> WhitelistedSymbols;
3811  for (ArrayRef<const MemRegion *>::iterator I = ExplicitRegions.begin(),
3812  E = ExplicitRegions.end(); I != E; ++I) {
3813  if (const SymbolicRegion *SR = (*I)->StripCasts()->getAs<SymbolicRegion>())
3814  WhitelistedSymbols.insert(SR->getSymbol());
3815  }
3816 
3817  for (InvalidatedSymbols::const_iterator I=invalidated->begin(),
3818  E = invalidated->end(); I!=E; ++I) {
3819  SymbolRef sym = *I;
3820  if (WhitelistedSymbols.count(sym))
3821  continue;
3822  // Remove any existing reference-count binding.
3823  state = removeRefBinding(state, sym);
3824  }
3825  return state;
3826 }
3827 
3828 //===----------------------------------------------------------------------===//
3829 // Handle dead symbols and end-of-path.
3830 //===----------------------------------------------------------------------===//
3831 
3833 RetainCountChecker::handleAutoreleaseCounts(ProgramStateRef state,
3834  ExplodedNode *Pred,
3835  const ProgramPointTag *Tag,
3836  CheckerContext &Ctx,
3837  SymbolRef Sym, RefVal V) const {
3838  unsigned ACnt = V.getAutoreleaseCount();
3839 
3840  // No autorelease counts? Nothing to be done.
3841  if (!ACnt)
3842  return state;
3843 
3844  assert(!Ctx.isObjCGCEnabled() && "Autorelease counts in GC mode?");
3845  unsigned Cnt = V.getCount();
3846 
3847  // FIXME: Handle sending 'autorelease' to already released object.
3848 
3849  if (V.getKind() == RefVal::ReturnedOwned)
3850  ++Cnt;
3851 
3852  // If we would over-release here, but we know the value came from an ivar,
3853  // assume it was a strong ivar that's just been relinquished.
3854  if (ACnt > Cnt &&
3855  V.getIvarAccessHistory() == RefVal::IvarAccessHistory::AccessedDirectly) {
3856  V = V.releaseViaIvar();
3857  --ACnt;
3858  }
3859 
3860  if (ACnt <= Cnt) {
3861  if (ACnt == Cnt) {
3862  V.clearCounts();
3863  if (V.getKind() == RefVal::ReturnedOwned)
3864  V = V ^ RefVal::ReturnedNotOwned;
3865  else
3866  V = V ^ RefVal::NotOwned;
3867  } else {
3868  V.setCount(V.getCount() - ACnt);
3869  V.setAutoreleaseCount(0);
3870  }
3871  return setRefBinding(state, Sym, V);
3872  }
3873 
3874  // HACK: Ignore retain-count issues on values accessed through ivars,
3875  // because of cases like this:
3876  // [_contentView retain];
3877  // [_contentView removeFromSuperview];
3878  // [self addSubview:_contentView]; // invalidates 'self'
3879  // [_contentView release];
3880  if (V.getIvarAccessHistory() != RefVal::IvarAccessHistory::None)
3881  return state;
3882 
3883  // Woah! More autorelease counts then retain counts left.
3884  // Emit hard error.
3885  V = V ^ RefVal::ErrorOverAutorelease;
3886  state = setRefBinding(state, Sym, V);
3887 
3888  ExplodedNode *N = Ctx.generateSink(state, Pred, Tag);
3889  if (N) {
3890  SmallString<128> sbuf;
3891  llvm::raw_svector_ostream os(sbuf);
3892  os << "Object was autoreleased ";
3893  if (V.getAutoreleaseCount() > 1)
3894  os << V.getAutoreleaseCount() << " times but the object ";
3895  else
3896  os << "but ";
3897  os << "has a +" << V.getCount() << " retain count";
3898 
3899  if (!overAutorelease)
3900  overAutorelease.reset(new OverAutorelease(this));
3901 
3902  const LangOptions &LOpts = Ctx.getASTContext().getLangOpts();
3903  Ctx.emitReport(std::unique_ptr<BugReport>(
3904  new CFRefReport(*overAutorelease, LOpts, /* GCEnabled = */ false,
3905  SummaryLog, N, Sym, os.str())));
3906  }
3907 
3908  return nullptr;
3909 }
3910 
3912 RetainCountChecker::handleSymbolDeath(ProgramStateRef state,
3913  SymbolRef sid, RefVal V,
3914  SmallVectorImpl<SymbolRef> &Leaked) const {
3915  bool hasLeak;
3916 
3917  // HACK: Ignore retain-count issues on values accessed through ivars,
3918  // because of cases like this:
3919  // [_contentView retain];
3920  // [_contentView removeFromSuperview];
3921  // [self addSubview:_contentView]; // invalidates 'self'
3922  // [_contentView release];
3923  if (V.getIvarAccessHistory() != RefVal::IvarAccessHistory::None)
3924  hasLeak = false;
3925  else if (V.isOwned())
3926  hasLeak = true;
3927  else if (V.isNotOwned() || V.isReturnedOwned())
3928  hasLeak = (V.getCount() > 0);
3929  else
3930  hasLeak = false;
3931 
3932  if (!hasLeak)
3933  return removeRefBinding(state, sid);
3934 
3935  Leaked.push_back(sid);
3936  return setRefBinding(state, sid, V ^ RefVal::ErrorLeak);
3937 }
3938 
3939 ExplodedNode *
3940 RetainCountChecker::processLeaks(ProgramStateRef state,
3942  CheckerContext &Ctx,
3943  ExplodedNode *Pred) const {
3944  // Generate an intermediate node representing the leak point.
3945  ExplodedNode *N = Ctx.addTransition(state, Pred);
3946 
3947  if (N) {
3949  I = Leaked.begin(), E = Leaked.end(); I != E; ++I) {
3950 
3951  const LangOptions &LOpts = Ctx.getASTContext().getLangOpts();
3952  bool GCEnabled = Ctx.isObjCGCEnabled();
3953  CFRefBug *BT = Pred ? getLeakWithinFunctionBug(LOpts, GCEnabled)
3954  : getLeakAtReturnBug(LOpts, GCEnabled);
3955  assert(BT && "BugType not initialized.");
3956 
3957  Ctx.emitReport(std::unique_ptr<BugReport>(
3958  new CFRefLeakReport(*BT, LOpts, GCEnabled, SummaryLog, N, *I, Ctx,
3959  IncludeAllocationLine)));
3960  }
3961  }
3962 
3963  return N;
3964 }
3965 
3966 void RetainCountChecker::checkBeginFunction(CheckerContext &Ctx) const {
3967  if (!Ctx.inTopFrame())
3968  return;
3969 
3970  const LocationContext *LCtx = Ctx.getLocationContext();
3971  const FunctionDecl *FD = dyn_cast<FunctionDecl>(LCtx->getDecl());
3972 
3974  return;
3975 
3976  ProgramStateRef state = Ctx.getState();
3977 
3978  const RetainSummary *FunctionSummary = getSummaryManager(Ctx).getFunctionSummary(FD);
3979  ArgEffects CalleeSideArgEffects = FunctionSummary->getArgEffects();
3980 
3981  for (unsigned idx = 0, e = FD->getNumParams(); idx != e; ++idx) {
3982  const ParmVarDecl *Param = FD->getParamDecl(idx);
3983  SymbolRef Sym = state->getSVal(state->getRegion(Param, LCtx)).getAsSymbol();
3984 
3985  QualType Ty = Param->getType();
3986  const ArgEffect *AE = CalleeSideArgEffects.lookup(idx);
3987  if (AE && *AE == DecRef && isGeneralizedObjectRef(Ty))
3988  state = setRefBinding(state, Sym, RefVal::makeOwned(RetEffect::ObjKind::Generalized, Ty));
3989  else if (isGeneralizedObjectRef(Ty))
3990  state = setRefBinding(state, Sym, RefVal::makeNotOwned(RetEffect::ObjKind::Generalized, Ty));
3991  }
3992 
3993  Ctx.addTransition(state);
3994 }
3995 
3996 void RetainCountChecker::checkEndFunction(CheckerContext &Ctx) const {
3997  ProgramStateRef state = Ctx.getState();
3998  RefBindingsTy B = state->get<RefBindings>();
3999  ExplodedNode *Pred = Ctx.getPredecessor();
4000 
4001  // Don't process anything within synthesized bodies.
4002  const LocationContext *LCtx = Pred->getLocationContext();
4004  assert(!LCtx->inTopFrame());
4005  return;
4006  }
4007 
4008  for (RefBindingsTy::iterator I = B.begin(), E = B.end(); I != E; ++I) {
4009  state = handleAutoreleaseCounts(state, Pred, /*Tag=*/nullptr, Ctx,
4010  I->first, I->second);
4011  if (!state)
4012  return;
4013  }
4014 
4015  // If the current LocationContext has a parent, don't check for leaks.
4016  // We will do that later.
4017  // FIXME: we should instead check for imbalances of the retain/releases,
4018  // and suggest annotations.
4019  if (LCtx->getParent())
4020  return;
4021 
4022  B = state->get<RefBindings>();
4024 
4025  for (RefBindingsTy::iterator I = B.begin(), E = B.end(); I != E; ++I)
4026  state = handleSymbolDeath(state, I->first, I->second, Leaked);
4027 
4028  processLeaks(state, Leaked, Ctx, Pred);
4029 }
4030 
4031 const ProgramPointTag *
4032 RetainCountChecker::getDeadSymbolTag(SymbolRef sym) const {
4033  const CheckerProgramPointTag *&tag = DeadSymbolTags[sym];
4034  if (!tag) {
4035  SmallString<64> buf;
4036  llvm::raw_svector_ostream out(buf);
4037  out << "Dead Symbol : ";
4038  sym->dumpToStream(out);
4039  tag = new CheckerProgramPointTag(this, out.str());
4040  }
4041  return tag;
4042 }
4043 
4044 void RetainCountChecker::checkDeadSymbols(SymbolReaper &SymReaper,
4045  CheckerContext &C) const {
4046  ExplodedNode *Pred = C.getPredecessor();
4047 
4048  ProgramStateRef state = C.getState();
4049  RefBindingsTy B = state->get<RefBindings>();
4051 
4052  // Update counts from autorelease pools
4053  for (SymbolReaper::dead_iterator I = SymReaper.dead_begin(),
4054  E = SymReaper.dead_end(); I != E; ++I) {
4055  SymbolRef Sym = *I;
4056  if (const RefVal *T = B.lookup(Sym)){
4057  // Use the symbol as the tag.
4058  // FIXME: This might not be as unique as we would like.
4059  const ProgramPointTag *Tag = getDeadSymbolTag(Sym);
4060  state = handleAutoreleaseCounts(state, Pred, Tag, C, Sym, *T);
4061  if (!state)
4062  return;
4063 
4064  // Fetch the new reference count from the state, and use it to handle
4065  // this symbol.
4066  state = handleSymbolDeath(state, *I, *getRefBinding(state, Sym), Leaked);
4067  }
4068  }
4069 
4070  if (Leaked.empty()) {
4071  C.addTransition(state);
4072  return;
4073  }
4074 
4075  Pred = processLeaks(state, Leaked, C, Pred);
4076 
4077  // Did we cache out?
4078  if (!Pred)
4079  return;
4080 
4081  // Now generate a new node that nukes the old bindings.
4082  // The only bindings left at this point are the leaked symbols.
4083  RefBindingsTy::Factory &F = state->get_context<RefBindings>();
4084  B = state->get<RefBindings>();
4085 
4086  for (SmallVectorImpl<SymbolRef>::iterator I = Leaked.begin(),
4087  E = Leaked.end();
4088  I != E; ++I)
4089  B = F.remove(B, *I);
4090 
4091  state = state->set<RefBindings>(B);
4092  C.addTransition(state, Pred);
4093 }
4094 
4095 void RetainCountChecker::printState(raw_ostream &Out, ProgramStateRef State,
4096  const char *NL, const char *Sep) const {
4097 
4098  RefBindingsTy B = State->get<RefBindings>();
4099 
4100  if (B.isEmpty())
4101  return;
4102 
4103  Out << Sep << NL;
4104 
4105  for (RefBindingsTy::iterator I = B.begin(), E = B.end(); I != E; ++I) {
4106  Out << I->first << " : ";
4107  I->second.print(Out);
4108  Out << NL;
4109  }
4110 }
4111 
4112 //===----------------------------------------------------------------------===//
4113 // Checker registration.
4114 //===----------------------------------------------------------------------===//
4115 
4116 void ento::registerRetainCountChecker(CheckerManager &Mgr) {
4117  Mgr.registerChecker<RetainCountChecker>(Mgr.getAnalyzerOptions());
4118 }
4119 
4120 //===----------------------------------------------------------------------===//
4121 // Implementation of the CallEffects API.
4122 //===----------------------------------------------------------------------===//
4123 
4124 namespace clang {
4125 namespace ento {
4126 namespace objc_retain {
4127 
4128 // This is a bit gross, but it allows us to populate CallEffects without
4129 // creating a bunch of accessors. This kind is very localized, so the
4130 // damage of this macro is limited.
4131 #define createCallEffect(D, KIND)\
4132  ASTContext &Ctx = D->getASTContext();\
4133  LangOptions L = Ctx.getLangOpts();\
4134  RetainSummaryManager M(Ctx, L.GCOnly, L.ObjCAutoRefCount);\
4135  const RetainSummary *S = M.get ## KIND ## Summary(D);\
4136  CallEffects CE(S->getRetEffect());\
4137  CE.Receiver = S->getReceiverEffect();\
4138  unsigned N = D->param_size();\
4139  for (unsigned i = 0; i < N; ++i) {\
4140  CE.Args.push_back(S->getArg(i));\
4141  }
4142 
4144  createCallEffect(MD, Method);
4145  return CE;
4146 }
4147 
4149  createCallEffect(FD, Function);
4150  return CE;
4151 }
4152 
4153 #undef createCallEffect
4154 
4155 } // end namespace objc_retain
4156 } // end namespace ento
4157 } // end namespace clang
const BlockDecl * getBlockDecl() const
Definition: Expr.h:4999
FunctionDecl * getDefinition()
Get the definition for this declaration.
Definition: Decl.h:1940
SVal getReceiverSVal() const
Returns the value of the receiver at the time of this call.
Definition: CallEvent.cpp:748
FunctionDecl - An instance of this class is created to represent a function declaration or definition...
Definition: Decl.h:1698
Smart pointer class that efficiently represents Objective-C method names.
if(T->getSizeExpr()) TRY_TO(TraverseStmt(T -> getSizeExpr()))
A (possibly-)qualified type.
Definition: Type.h:614
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:79
ExplodedNode * generateErrorNode(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generate a transition to a node that will be used to report an error.
static RetEffect MakeOwnedWhenTrackedReceiver()
Expr * getArg(unsigned Arg)
getArg - Return the specified argument.
Definition: Expr.h:2339
bool hasCaptures() const
hasCaptures - True if this block (or its nested blocks) captures anything of local storage from its e...
Definition: Decl.h:3807
ObjCInterfaceDecl * getClassInterface()
Definition: DeclObjC.cpp:1089
bool operator==(CanQual< T > x, CanQual< U > y)
DominatorTree GraphTraits specialization so the DominatorTree can be iterable by generic graph iterat...
Definition: Dominators.h:26
Stmt - This represents one statement.
Definition: Stmt.h:66
unsigned getNumArgs() const
getNumArgs - Return the number of actual arguments to this call.
Definition: Expr.h:2327
FunctionType - C99 6.7.5.3 - Function Declarators.
Definition: Type.h:2970
Bridging via __bridge, which does nothing but reinterpret the bits.
QualType getPointeeType() const
If this is a pointer, ObjC object pointer, or block pointer, this returns the respective pointee...
Definition: Type.cpp:435
static ProgramStateRef removeRefBinding(ProgramStateRef State, SymbolRef Sym)
Defines the SourceManager interface.
The argument acts as if has been passed to CFMakeCollectable, which transfers the object to the Garba...
ExplodedNode * addTransition(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generates a new transition in the program state graph (ExplodedGraph).
Decl - This represents one declaration (or definition), e.g.
Definition: DeclBase.h:86
Represents a point when we begin processing an inlined call.
Definition: ProgramPoint.h:585
Manages the lifetime of CallEvent objects.
Definition: CallEvent.h:982
The argument has its reference count decreased by 1.
StringRef P
Indicates that the tracked object is an Objective-C object.
bool isCocoaObjectRef(QualType T)
llvm::DenseMap< Stmt *, Stmt * > MapTy
Definition: ParentMap.cpp:22
Indicates that the tracked object is a generalized object.
const ProgramStateRef & getState() const
ArrayRef< ParmVarDecl * >::const_iterator param_const_iterator
Definition: Decl.h:2173
param_const_iterator param_end() const
Definition: DeclObjC.h:357
const Expr * getOriginExpr() const
Returns the expression whose value will be the result of this call.
Definition: CallEvent.h:225
bool isConsumedExpr(Expr *E) const
Definition: ParentMap.cpp:159
VarDecl - An instance of this class is created to represent a variable declaration or definition...
Definition: Decl.h:807
SymbolRef getAsLocSymbol(bool IncludeBaseRegions=false) const
If this SVal is a location and wraps a symbol, return that SymbolRef.
Definition: SVals.cpp:74
QualType getReturnType() const
Definition: Decl.h:2205
unsigned getNumParams() const
Definition: Type.h:3399
const T * getAs() const
Member-template getAs<specific type>&#39;.
Definition: Type.h:6105
The argument is a pointer to a retain-counted object; on exit, the new value of the pointer is a +1 v...
const FunctionDecl * getCalleeDecl(const CallExpr *CE) const
Get the declaration of the called function (path-sensitive).
const Decl & getCodeDecl() const
ObjCMethodDecl - Represents an instance or class method declaration.
Definition: DeclObjC.h:113
ExplodedNode * getPredecessor()
Returns the previous node in the exploded graph, which includes the state of the program before the c...
virtual const MemRegion * getOriginRegion() const
Find the region from which this symbol originates.
Definition: SymExpr.h:98
SVal getSVal(const Stmt *S) const
Get the value of arbitrary expressions at this point in the path.
ParmVarDecl - Represents a parameter to a function.
Definition: Decl.h:1514
const bool wasInlined
If we are post visiting a call, this flag will be set if the call was inlined.
const char *const MemoryCoreFoundationObjectiveC
Symbolic value.
Definition: SymExpr.h:29
bool isParentOf(const LocationContext *LC) const
IdentifierInfo * getIdentifier() const
getIdentifier - Get the identifier that names this declaration, if there is one.
Definition: Decl.h:265
const MemRegion * getSuperRegion() const
Definition: MemRegion.h:430
ConditionTruthVal isNull(ProgramStateRef State, SymbolRef Sym)
Convenience method to query the state to see if a symbol is null or not null, or if neither assumptio...
One of these records is kept for each identifier that is lexed.
MemRegionManager & getRegionManager()
Definition: SValBuilder.h:150
bool isStr(const char(&Str)[StrLen]) const
Return true if this is the identifier for the specified string.
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:128
static Selector getKeywordSelector(ASTContext &Ctx, IdentifierInfos *... IIs)
LineState State
bool isObjCIdType() const
Definition: Type.h:5871
This class provides a convenience implementation for clone() using the Curiously-Recurring Template P...
The argument is treated as if an -autorelease message had been sent to the referenced object...
unsigned getSpellingLineNumber(bool *Invalid=nullptr) const
const Expr * getRetValue() const
Definition: Stmt.cpp:925
const ObjCInterfaceDecl * getReceiverInterface() const
Get the interface for the receiver.
Definition: CallEvent.h:928
clang::CharUnits operator*(clang::CharUnits::QuantityType Scale, const clang::CharUnits &CU)
Definition: CharUnits.h:208
Keeps track of the various options that can be enabled, which controls the dialect of C or C++ that i...
Definition: LangOptions.h:48
ObjCArrayLiteral - used for objective-c array containers; as in: @["Hello", NSApp, [NSNumber numberWithInt:42]];.
Definition: ExprObjC.h:144
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
IdentifierTable & Idents
Definition: ASTContext.h:515
static bool isRetain(const FunctionDecl *FD, StringRef FName)
static AllocationInfo GetAllocationSite(ProgramStateManager &StateMgr, const ExplodedNode *N, SymbolRef Sym)
virtual llvm::iterator_range< ranges_iterator > getRanges()
Get the SourceRanges associated with the report.
static bool isEqual(const ObjCSummaryKey &LHS, const ObjCSummaryKey &RHS)
ObjCMethodFamily getMethodFamily() const
Determines the family of this method.
Definition: DeclObjC.cpp:931
bool followsCreateRule(const FunctionDecl *FD)
BlockDataRegion - A region that represents a block instance.
Definition: MemRegion.h:656
Represents any expression that calls an Objective-C method.
Definition: CallEvent.h:870
virtual Kind getKind() const =0
Returns the kind of call this is.
bool hasNonZeroCallbackArg() const
Returns true if any of the arguments appear to represent callbacks.
Definition: CallEvent.cpp:113
static void Profile(const ArgEffect X, FoldingSetNodeID &ID)
ProgramStateManager & getStateManager()
The argument has its reference count increased by 1.
virtual void dumpToStream(raw_ostream &os) const
Definition: SymExpr.h:58
const StackFrameContext * getCurrentStackFrame() const
child_range children()
Definition: Stmt.cpp:226
const LocationContext * getLocationContext() const
virtual bool inTopFrame() const
Return true if the current LocationContext has no caller context.
Selector GetNullarySelector(StringRef name, ASTContext &Ctx)
Utility function for constructing a nullary selector.
Definition: ASTContext.h:2782
const LocationContext * getParent() const
bool isUnknown() const
Definition: SVals.h:125
std::string getAsString() const
Definition: Type.h:944
SVal getReturnValue() const
Returns the return value of the call.
Definition: CallEvent.cpp:242
static PathDiagnosticLocation create(const Decl *D, const SourceManager &SM)
Create a location corresponding to the given declaration.
CastExpr - Base class for type casts, including both implicit casts (ImplicitCastExpr) and explicit c...
Definition: Expr.h:2779
referenced_vars_iterator referenced_vars_end() const
Definition: MemRegion.cpp:1458
Represents an ObjC class declaration.
Definition: DeclObjC.h:1108
Bridging via __bridge_transfer, which transfers ownership of an Objective-C pointer into ARC...
static bool isNumericLiteralExpression(const Expr *E)
QualType getReturnType() const
Definition: DeclObjC.h:330
virtual BugReport::NodeResolver & getNodeResolver()=0
virtual QualType getType() const =0
param_iterator param_begin()
Definition: Decl.h:2176
SymbolRef getAsSymbol(bool IncludeBaseRegions=false) const
If this SVal wraps a symbol return that SymbolRef.
Definition: SVals.cpp:116
bool hasAttr() const
Definition: DeclBase.h:535
ArgEffect
An ArgEffect summarizes the retain count behavior on an argument or receiver to a function or method...
bool isConstrainedTrue() const
Return true if the constraint is perfectly constrained to &#39;true&#39;.
Const iterator for iterating over Stmt * arrays that contain only Expr *.
Definition: Stmt.h:346
const ParmVarDecl *const * param_const_iterator
Definition: DeclObjC.h:349
Indicates that the returned value is an owned (+1) symbol.
Represents a prototype with parameter type info, e.g.
Definition: Type.h:3176
const Stmt * getCallSite() const
Indicates that the return value is an owned object when the receiver is also a tracked object...
static bool hasRCAnnotation(const Decl *D, StringRef rcAnnotation)
Returns true if the declaration &#39;D&#39; is annotated with &#39;rcAnnotation&#39;.
The argument is treated as potentially escaping, meaning that even when its reference count hits 0 it...
llvm::ImmutableMap< unsigned, ArgEffect > ArgEffects
ArgEffects summarizes the effects of a function/method call on all of its arguments.
#define REGISTER_MAP_WITH_PROGRAMSTATE(Name, Key, Value)
Declares an immutable map of type NameTy, suitable for placement into the ProgramState.
const RegionTy * getAs() const
Definition: MemRegion.h:1174
SymbolicRegion - A special, "non-concrete" region.
Definition: MemRegion.h:742
Expr - This represents one expression.
Definition: Expr.h:119
Defines the clang::LangOptions interface.
Indicates that the tracked object is a CF object.
const FunctionProtoType * T
Indicates that the object is not owned and controlled by the Garbage collector.
bool isObjCRetainableType() const
Definition: Type.cpp:3934
BlockExpr - Adaptor class for mixing a BlockDecl with expressions.
Definition: Expr.h:4984
bool isImplicit() const
isImplicit - Indicates whether the declaration was implicitly generated by the implementation.
Definition: DeclBase.h:551
bool shouldIncludeAllocationSiteInLeakDiagnostics(AnalyzerOptions &AOpts)
Returns true if leak diagnostics should directly reference the allocatin site (where possible)...
SymbolSetTy::const_iterator dead_iterator
static CallEffects getEffect(const ObjCMethodDecl *MD)
Return the CallEfect for a given Objective-C method.
#define bool
Definition: stdbool.h:31
StringRef getNameForSlot(unsigned argIndex) const
Retrieve the name at a given position in the selector.
ObjCDictionaryLiteral - AST node to represent objective-c dictionary literals; as in:"name" : NSUserN...
Definition: ExprObjC.h:257
ObjCInterfaceDecl * getSuperClass() const
Definition: DeclObjC.cpp:314
static bool isRelease(const FunctionDecl *FD, StringRef FName)
ObjKind
Determines the object kind of a tracked object.
QualType getType() const
Definition: Expr.h:140
static bool isAutorelease(const FunctionDecl *FD, StringRef FName)
ReturnStmt - This represents a return, optionally of an expression: return; return 4;...
Definition: Stmt.h:1413
An expression that sends a message to the given Objective-C object or class.
Definition: ExprObjC.h:860
QualType getObjCInterfaceType(const ObjCInterfaceDecl *Decl, ObjCInterfaceDecl *PrevDecl=nullptr) const
getObjCInterfaceType - Return the unique reference to the type for the specified ObjC interface decl...
bool isBodyAutosynthesized() const
Checks if the body of the Decl is generated by the BodyFarm.
bool isInstanceMethod() const
Definition: DeclObjC.h:416
unsigned getNumArgs() const
void markInteresting(SymbolRef sym)
Selector getSelector() const
Definition: DeclObjC.h:328
ObjCBridgeCastKind getBridgeKind() const
Determine which kind of bridge is being performed via this cast.
Definition: ExprObjC.h:1546
CallEventRef< ObjCMethodCall > getObjCMethodCall(const ObjCMessageExpr *E, ProgramStateRef State, const LocationContext *LCtx)
Definition: CallEvent.h:1045
bool isNull() const
Return true if this QualType doesn&#39;t point to a type yet.
Definition: Type.h:681
Represents a C function or static C++ member function call.
Definition: CallEvent.h:457
const SourceManager & SM
Definition: Format.cpp:1327
static StringRef getIdentifier(const Token &Tok)
static bool isSynthesizedAccessor(const StackFrameContext *SFC)
Returns true if this stack frame is for an Objective-C method that is a property getter or setter who...
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type...
Definition: SVals.h:100
const VarDecl * getDecl() const
Definition: MemRegion.h:935
static RetEffect MakeNotOwned(ObjKind o)
void emitReport(std::unique_ptr< BugReport > R)
Emit the diagnostics report.
BugReporter is a utility class for generating PathDiagnostics for analysis.
Definition: BugReporter.h:403
static const Stmt * getStmt(const ExplodedNode *N)
Given an exploded node, retrieve the statement that should be used for the diagnostic location...
const MemRegion * StripCasts(bool StripBaseCasts=true) const
Definition: MemRegion.cpp:1117
#define log(__x)
Definition: tgmath.h:476
static PathDiagnosticLocation createBegin(const Decl *D, const SourceManager &SM)
Create a location for the beginning of the declaration.
std::string getAsString() const
Derive the full selector name (e.g.
static std::unique_ptr< PathDiagnosticPiece > getDefaultEndPath(BugReporterContext &BRC, const ExplodedNode *N, BugReport &BR)
Generates the default final diagnostic piece.
Kind
CHECKER * registerChecker()
Used to register checkers.
The argument has its reference count increased by 1.
ObjCMethodFamily getMethodFamily() const
Derive the conventional family of this method.
DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag, const Expr *expr, const LocationContext *LCtx, unsigned count)
Create a new symbol with a unique &#39;name&#39;.
QualType getReturnType() const
Definition: Type.h:3112
IdentifierInfo & get(StringRef Name)
Return the identifier token info for the specified named identifier.
ExplodedNode * generateSink(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
Generate a sink node.
The argument has its reference count decreased by 1 to model a transferred bridge cast under ARC...
T castAs() const
Convert to the specified ProgramPoint type, asserting that this ProgramPoint is of the desired type...
Definition: ProgramPoint.h:140
ProgramPoints can be "tagged" as representing points specific to a given analysis entity...
Definition: ProgramPoint.h:40
const MemRegion * getAsRegion() const
Definition: SVals.cpp:140
static ProgramStateRef updateOutParameter(ProgramStateRef State, SVal ArgVal, ArgEffect Effect)
static const RefVal * getRefBinding(ProgramStateRef State, SymbolRef Sym)
static void Profile(const RetEffect &X, FoldingSetNodeID &ID)
const ParmVarDecl * getParamDecl(unsigned i) const
Definition: Decl.h:2187
ProgramPoint getLocation() const
getLocation - Returns the edge associated with the given node.
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
Definition: SVals.h:63
static bool isGeneralizedObjectRef(QualType Ty)
const StackFrameContext * getStackFrame() const
Definition: MemRegion.cpp:130
A class responsible for cleaning up unused symbols.
referenced_vars_iterator referenced_vars_begin() const
Definition: MemRegion.cpp:1441
ObjCBoxedExpr - used for generalized expression boxing.
Definition: ExprObjC.h:94
const ObjCMethodDecl * getDecl() const override
Definition: CallEvent.h:896
unsigned blockCount() const
Returns the number of times the current block has been visited along the analyzed path...
StringRef getName() const
Return the actual identifier string.
virtual const ObjCMessageExpr * getOriginExpr() const
Definition: CallEvent.h:893
An Objective-C "bridged" cast expression, which casts between Objective-C pointers and C pointers...
Definition: ExprObjC.h:1519
Selector getSelector() const
Definition: CallEvent.h:912
static ProgramStateRef setRefBinding(ProgramStateRef State, SymbolRef Sym, RefVal Val)
All typestate tracking of the object ceases.
Dataflow Directional Tag Classes.
bool isRefType(QualType RetTy, StringRef Prefix, StringRef Name=StringRef())
virtual SourceRange getArgSourceRange(unsigned Index) const
Returns the source range for errors associated with this argument.
Definition: CallEvent.cpp:235
The argument is treated as if an -dealloc message had been sent to the referenced object...
const VarRegion * getVarRegion(const VarDecl *D, const LocationContext *LC)
getVarRegion - Retrieve or create the memory region associated with a specified VarDecl and LocationC...
Definition: MemRegion.cpp:781
Performs the combined functionality of DecRef and StopTrackingHard.
bool isKeywordSelector() const
static bool isTrustedReferenceCountImplementation(const FunctionDecl *FD)
Returns true if the function declaration &#39;FD&#39; contains &#39;rc_ownership_trusted_implementation&#39; annotate...
QualType getCallReturnType(const ASTContext &Ctx) const
getCallReturnType - Get the return type of the call expr.
Definition: Expr.cpp:1337
Represents an abstract call to a function or method along a particular path.
Definition: CallEvent.h:140
Bridging via __bridge_retain, which makes an ARC object available as a +1 C pointer.
AnalyzerOptions & getAnalyzerOptions()
RetEffect summarizes a call&#39;s retain/release behavior with respect to its return value.
const Decl * getDecl() const
dead_iterator dead_begin() const
param_iterator param_end()
Definition: Decl.h:2177
static ArgEffect getStopTrackingHardEquivalent(ArgEffect E)
SourceRange getReceiverRange() const
Source range of the receiver.
Definition: ExprObjC.cpp:290
Represents a pointer to an Objective C object.
Definition: Type.h:5280
bool isInstanceMessage() const
Definition: CallEvent.h:906
const StackFrameContext * getStackFrame() const
const FunctionDecl * getAsFunctionDecl() const
getAsFunctionDecl - If this SVal is a MemRegionVal and wraps a CodeTextRegion wrapping a FunctionDecl...
Definition: SVals.cpp:52
#define createCallEffect(D, KIND)
const ProgramStateRef & getState() const
Performs the combined functionality of DecRefMsg and StopTrackingHard.
ProgramStateManager & getStateManager()
Definition: BugReporter.h:553
param_const_iterator param_begin() const
Definition: DeclObjC.h:354
dead_iterator dead_end() const
The argument is a pointer to a retain-counted object; on exit, the new value of the pointer is a +0 v...
static bool isMakeCollectable(const FunctionDecl *FD, StringRef FName)
ObjCIvarRefExpr - A reference to an ObjC instance variable.
Definition: ExprObjC.h:479
llvm::iterator_range< specific_attr_iterator< T > > specific_attrs() const
Definition: DeclBase.h:517
QualType getResultType() const
Returns the result type, adjusted for references.
Definition: CallEvent.cpp:31
X
Add a minimal nested name specifier fixit hint to allow lookup of a tag name from an outer enclosing ...
Definition: SemaDecl.cpp:13194
No particular method family.
Defines the C++ Decl subclasses, other than those for templates (found in DeclTemplate.h) and friends (in DeclFriend.h).
Indicates that no retain count information is tracked for the return value.
Selector GetUnarySelector(StringRef name, ASTContext &Ctx)
Utility function for constructing an unary selector.
Definition: ASTContext.h:2788
pred_iterator pred_begin()
SourceManager & getSourceManager()
virtual unsigned getNumArgs() const =0
Returns the number of arguments (explicit and implicit).
static PathDiagnosticLocation createEndOfPath(const ExplodedNode *N, const SourceManager &SM)
Create a location corresponding to the next valid ExplodedNode as end of path location.
static RetEffect MakeOwned(ObjKind o)
const MemRegion * getBaseRegion() const
Definition: MemRegion.cpp:1091
SValBuilder & getSValBuilder()
CallExpr - Represents a function call (C99 6.5.2.2, C++ [expr.call]).
Definition: Expr.h:2270
A SourceLocation and its associated SourceManager.
static Decl::Kind getKind(const Decl *D)
Definition: DeclBase.cpp:915
virtual const ExplodedNode * getOriginalNode(const ExplodedNode *N)=0
bool isPointerType() const
Definition: Type.h:5772
All typestate tracking of the object ceases.
void iterBindings(ProgramStateRef state, StoreManager::BindingsHandler &F)
Definition: ProgramState.h:549
The argument has its reference count decreased by 1.
Encapsulates the retain count semantics on the arguments, return value, and receiver (if any) of a fu...
virtual SVal getArgSVal(unsigned Index) const
Returns the value of a given argument at the time of the call.
Definition: CallEvent.cpp:228
QualType getType() const
Definition: Decl.h:639
A trivial tuple used to represent a source range.
Tag that can use a checker name as a message provider (see SimpleProgramPointTag).
Definition: Checker.h:493
QualType getObjCObjectPointerType(QualType OIT) const
Return a ObjCObjectPointerType type for the given ObjCObjectType.
Optional< T > getAs() const
Convert to the specified ProgramPoint type, returning None if this ProgramPoint is not of the desired...
Definition: ProgramPoint.h:151
This class provides an interface through which checkers can create individual bug reports...
Definition: BugReporter.h:55
bool inTopFrame() const
Return true if the current LocationContext has no caller context.
static unsigned getHashValue(const ObjCSummaryKey &V)
ObjCMethodDecl * getInstanceMethod(Selector Sel, bool AllowHidden=false) const
Definition: DeclObjC.h:1025
AnalysisDeclContext * getAnalysisDeclContext() const
const LocationContext * getLocationContext() const
unsigned getNumParams() const
getNumParams - Return the number of parameters this function must have based on its FunctionType...
Definition: Decl.cpp:2899
Indicates that the returned value is an object with retain count semantics but that it is not owned (...
const LangOptions & getLangOpts() const
Definition: ASTContext.h:661
This class handles loading and caching of source files into memory.
SourceManager & getSourceManager()
Definition: BugReporter.h:565
static QualType GetReturnType(const Expr *RetE, ASTContext &Ctx)
GetReturnType - Used to get the return type of a message expression or function call with the intenti...
QualType getPointeeType() const
Gets the type pointed to by this ObjC pointer.
Definition: Type.h:5295