17 using namespace clang;
20 using llvm::StrInStrNoCase;
29 return State->get<RefBindings>(Sym);
38 assert(Sym !=
nullptr);
39 return State->set<RefBindings>(Sym, Val);
43 return State->remove<RefBindings>(Sym);
48 Out <<
"Tracked " << T.getAsString() <<
" | ";
51 default: llvm_unreachable(
"Invalid RefVal kind");
54 unsigned cnt = getCount();
55 if (cnt) Out <<
" (+ " << cnt <<
")";
61 unsigned cnt = getCount();
62 if (cnt) Out <<
" (+ " << cnt <<
")";
67 Out <<
"ReturnedOwned";
68 unsigned cnt = getCount();
69 if (cnt) Out <<
" (+ " << cnt <<
")";
73 case ReturnedNotOwned: {
74 Out <<
"ReturnedNotOwned";
75 unsigned cnt = getCount();
76 if (cnt) Out <<
" (+ " << cnt <<
")";
84 case ErrorDeallocNotOwned:
85 Out <<
"-dealloc (not-owned)";
92 case ErrorLeakReturned:
93 Out <<
"Leaked (Bad naming)";
96 case ErrorUseAfterRelease:
97 Out <<
"Use-After-Release [ERROR]";
100 case ErrorReleaseNotOwned:
101 Out <<
"Release of Not-Owned [ERROR]";
105 Out <<
"Over-autoreleased";
109 Out <<
"Non-owned object returned instead of owned";
113 switch (getIvarAccessHistory()) {
116 case IvarAccessHistory::AccessedDirectly:
117 Out <<
" [direct ivar access]";
119 case IvarAccessHistory::ReleasedAfterDirectAccess:
120 Out <<
" [released after direct ivar access]";
124 Out <<
" [autorelease -" << ACnt <<
']';
135 bool VisitSymbol(
SymbolRef sym)
override {
158 E = R->referenced_vars_end();
170 for ( ; I != E; ++I) {
171 const VarRegion *VR = I.getCapturedRegion();
175 Regions.push_back(VR);
178 state = state->scanReachableSymbols<StopTrackingCallback>(Regions).getState();
219 state = updateSymbol(state, Sym, *T, AE, hasErr, C);
230 const Expr *Ex)
const {
238 state = updateSymbol(state, sym, *T,
241 processNonLeakError(state, Child->getSourceRange(), hasErr, sym, C);
262 processObjCLiterals(C, AL);
268 processObjCLiterals(C, DL);
292 SymbolRef Sym = State->getSVal(*IVarLoc).getAsSymbol();
339 if (
const auto *MC = dyn_cast<ObjCMethodCall>(&Call)) {
343 return MC->getMethodFamily() ==
OMF_init && MC->isReceiverSelfOrSuper() &&
352 const static RetainSummary *
getSummary(RetainSummaryManager &Summaries,
357 CE ? *AnyCall::forExpr(CE)
358 : AnyCall(cast<CXXDestructorDecl>(Call.
getDecl()));
365 RetainSummaryManager &Summaries = getSummaryManager(C);
369 if (
const auto *MC = dyn_cast<ObjCMethodCall>(&Call)) {
370 if (MC->isInstanceMessage()) {
371 SVal ReceiverV = MC->getReceiverSVal();
374 ReceiverType = T->getType();
378 const RetainSummary *Summ =
getSummary(Summaries, Call, ReceiverType);
381 processSummaryOfInlined(*Summ, Call, C);
384 checkSummary(*Summ, Call, C);
401 if (PT->isObjCQualifiedIdType() || PT->isObjCIdType() ||
402 PT->isObjCClassType()) {
437 const RefVal *TrackedValue) {
454 for (
unsigned idx = 0, e = CallOrMsg.
getNumArgs(); idx != e; ++idx) {
461 ShouldRemoveBinding =
true;
463 if (ShouldRemoveBinding)
469 if (
const auto *MsgInvocation = dyn_cast<ObjCMethodCall>(&CallOrMsg)) {
470 if (
SymbolRef Sym = MsgInvocation->getReceiverSVal().getAsLocSymbol()) {
490 cast<SubRegion>(MR)->getSuperRegion());
491 return TR && RetainSummaryManager::isKnownSmartPointer(TR->getValueType());
514 const VarDecl *VD = VR->getDecl();
515 if (!VD->
hasAttr<CleanupAttr>())
530 bool SplitNecessary =
false;
531 for (
auto &
P : Summ.getArgEffects())
534 SplitNecessary =
true;
539 if (SplitNecessary) {
546 AssumeNonZeroReturn = AssumeNonZeroReturn->assume(*DL,
true);
547 AssumeZeroReturn = AssumeZeroReturn->assume(*DL,
false);
551 for (
unsigned idx = 0, e = CE.
getNumArgs(); idx != e; ++idx) {
555 auto *ArgRegion = dyn_cast_or_null<TypedValueRegion>(ArgVal.
getAsRegion());
559 QualType PointeeTy = ArgRegion->getValueType();
560 SVal PointeeVal = State->getSVal(ArgRegion);
579 AssumeNonZeroReturn = makeNotOwnedParameter(AssumeNonZeroReturn);
580 AssumeZeroReturn = makeNotOwnedParameter(AssumeZeroReturn);
583 AssumeNonZeroReturn = makeOwnedParameter(AssumeNonZeroReturn);
584 AssumeZeroReturn = makeOwnedParameter(AssumeZeroReturn);
587 AssumeNonZeroReturn = makeOwnedParameter(AssumeNonZeroReturn);
590 AssumeZeroReturn = makeOwnedParameter(AssumeZeroReturn);
597 if (SplitNecessary) {
598 return {AssumeNonZeroReturn, AssumeZeroReturn};
600 assert(AssumeZeroReturn == AssumeNonZeroReturn);
601 return {AssumeZeroReturn};
617 bool DeallocSent =
false;
619 for (
unsigned idx = 0, e = CallOrMsg.
getNumArgs(); idx != e; ++idx) {
629 state = updateSymbol(state, Sym, *T, Effect, hasErr, C);
642 bool ReceiverIsTracked =
false;
644 if (
const auto *MsgInvocation = dyn_cast<ObjCMethodCall>(&CallOrMsg)) {
645 if (
SymbolRef Sym = MsgInvocation->getReceiverSVal().getAsLocSymbol()) {
647 ReceiverIsTracked =
true;
648 state = updateSymbol(state, Sym, *T,
649 Summ.getReceiverEffect(), hasErr, C);
651 ErrorRange = MsgInvocation->getOriginExpr()->getReceiverRange();
653 }
else if (Summ.getReceiverEffect().getKind() ==
Dealloc) {
658 }
else if (
const auto *MCall = dyn_cast<CXXMemberCall>(&CallOrMsg)) {
659 if (
SymbolRef Sym = MCall->getCXXThisVal().getAsLocSymbol()) {
661 state = updateSymbol(state, Sym, *T, Summ.getThisEffect(),
664 ErrorRange = MCall->getOriginExpr()->getSourceRange();
674 processNonLeakError(state, ErrorRange, hasErr, ErrorSym, C);
682 if (ReceiverIsTracked)
683 RE = getSummaryManager(C).getObjAllocRetEffect();
745 llvm_unreachable(
"Applies to pointer-to-pointer parameters, which should " 746 "not have ref state.");
751 llvm_unreachable(
"Invalid RefVal state for an explicit dealloc.");
787 llvm_unreachable(
"Invalid RefVal state for a retain.");
801 llvm_unreachable(
"Invalid RefVal state for a release.");
847 return useAfterRelease;
849 return releaseNotOwned;
853 return deallocNotOwned;
855 llvm_unreachable(
"Unhandled error.");
878 auto report = std::make_unique<RefCountReport>(
879 errorKindToBugKind(ErrorKind, Sym),
881 report->addRange(ErrorRange);
892 const auto *FD = dyn_cast_or_null<FunctionDecl>(Call.
getDecl());
896 const auto *CE = dyn_cast_or_null<CallExpr>(Call.
getOriginExpr());
900 RetainSummaryManager &SmrMgr = getSummaryManager(C);
905 bool hasTrustedImplementationAnnotation =
false;
909 using BehaviorSummary = RetainSummaryManager::BehaviorSummary;
911 SmrMgr.canEval(CE, FD, hasTrustedImplementationAnnotation);
918 if (BSmr == BehaviorSummary::Identity ||
919 BSmr == BehaviorSummary::IdentityOrZero ||
920 BSmr == BehaviorSummary::IdentityThis) {
922 const Expr *BindReturnTo =
923 (BSmr == BehaviorSummary::IdentityThis)
924 ? cast<CXXMemberCallExpr>(CE)->getImplicitObjectArgument()
926 SVal RetVal = state->getSVal(BindReturnTo, LCtx);
933 (hasTrustedImplementationAnnotation && !ResultTy.
isNull())) {
940 state = state->BindExpr(CE, LCtx, RetVal,
false);
942 if (BSmr == BehaviorSummary::IdentityOrZero) {
947 NullOutputState = NullOutputState->BindExpr(
954 state = state->assume(*L,
true);
986 .getAsLocSymbol(
true);
1036 state = handleAutoreleaseCounts(state, Pred, &AutoreleaseTag, C, Sym, X, S);
1048 RetainSummaryManager &Summaries = getSummaryManager(C);
1054 const RetainSummary *Summ = Summaries.getSummary(AnyCall(MD));
1055 RE = Summ->getRetEffect();
1056 }
else if (
const FunctionDecl *FD = dyn_cast<FunctionDecl>(CD)) {
1057 if (!isa<CXXMethodDecl>(FD)) {
1058 const RetainSummary *Summ = Summaries.getSummary(AnyCall(FD));
1059 RE = Summ->getRetEffect();
1063 return checkReturnWithRetEffect(S, C, Pred, RE, X, Sym, state);
1098 std::make_unique<RefLeakReport>(leakAtReturn, LOpts, N, Sym, C);
1118 ReturnNotOwnedTag(
this,
"ReturnNotOwnedForOwned");
1122 auto R = std::make_unique<RefCountReport>(
1145 state = state->scanReachableSymbols<StopTrackingCallback>(val).getState();
1152 bool Assumption)
const {
1159 RefBindingsTy B = state->get<RefBindings>();
1164 bool changed =
false;
1165 RefBindingsTy::Factory &RefBFactory = state->get_context<RefBindings>();
1173 B = RefBFactory.remove(B, I.first);
1178 state = state->set<RefBindings>(B);
1191 llvm::SmallPtrSet<SymbolRef, 8> WhitelistedSymbols;
1193 for (
const MemRegion *I : ExplicitRegions)
1195 WhitelistedSymbols.insert(SR->getSymbol());
1198 if (WhitelistedSymbols.count(sym))
1267 llvm::raw_svector_ostream os(sbuf);
1268 os <<
"Object was autoreleased ";
1273 os <<
"has a +" << V.
getCount() <<
" retain count";
1276 auto R = std::make_unique<RefCountReport>(overAutorelease, LOpts, N, Sym,
1308 Leaked.push_back(sid);
1323 const RefCountBug &BT = Pred ? leakWithinFunction : leakAtReturn;
1324 Ctx.
emitReport(std::make_unique<RefLeakReport>(BT, LOpts, N, L, Ctx));
1335 RetainSummaryManager &SmrMgr = getSummaryManager(Ctx);
1340 if (!C || SmrMgr.isTrustedReferenceCountImplementation(D))
1344 const RetainSummary *FunctionSummary = SmrMgr.getSummary(*C);
1345 ArgEffects CalleeSideArgEffects = FunctionSummary->getArgEffects();
1347 for (
unsigned idx = 0, e = C->param_size(); idx != e; ++idx) {
1349 SymbolRef Sym = state->getSVal(state->getRegion(Param, LCtx)).getAsSymbol();
1352 const ArgEffect *AE = CalleeSideArgEffects.lookup(idx);
1377 RefBindingsTy B = state->get<RefBindings>();
1381 if (LCtx->getAnalysisDeclContext()->isBodyAutosynthesized()) {
1382 assert(!LCtx->inTopFrame());
1387 state = handleAutoreleaseCounts(state, Pred,
nullptr, Ctx,
1397 if (LCtx->getParent())
1400 B = state->get<RefBindings>();
1404 state = handleSymbolDeath(state, I.first, I.second, Leaked);
1406 processLeaks(state, Leaked, Ctx, Pred);
1417 for (
const auto &I: state->get<RefBindings>()) {
1419 if (SymReaper.
isDead(Sym)) {
1422 state = handleAutoreleaseCounts(state, Pred, &Tag, C, Sym, V);
1428 state = handleSymbolDeath(state, Sym, *
getRefBinding(state, Sym), Leaked);
1432 if (Leaked.empty()) {
1437 Pred = processLeaks(state, Leaked, C, Pred);
1445 RefBindingsTy::Factory &F = state->get_context<RefBindings>();
1446 RefBindingsTy B = state->get<RefBindings>();
1451 state = state->set<RefBindings>(B);
1456 const char *NL,
const char *Sep)
const {
1458 RefBindingsTy B = State->get<RefBindings>();
1466 Out << I.first <<
" : ";
1467 I.second.print(Out);
1480 bool ento::shouldRegisterRetainCountBase(
const LangOptions &LO) {
1491 auto I = Options.
Config.find(
1492 (StringRef(
"osx.cocoa.RetainCount:") + Postfix).str());
1493 if (I != Options.
Config.end())
1494 return I->getValue() ==
Value;
1499 auto *Chk = Mgr.
getChecker<RetainCountChecker>();
1500 Chk->TrackObjCAndCFObjects =
true;
1502 "TrackNSCFStartParam",
1506 bool ento::shouldRegisterRetainCountChecker(
const LangOptions &LO) {
1510 void ento::registerOSObjectRetainCountChecker(
CheckerManager &Mgr) {
1511 auto *Chk = Mgr.
getChecker<RetainCountChecker>();
1515 Chk->TrackOSObjects =
true;
1518 bool ento::shouldRegisterOSObjectRetainCountChecker(
const LangOptions &LO) {
Indicates that the tracked object is a generalized object.
Indicates that the tracked object is a CF object.
const BlockDecl * getBlockDecl() const
ProgramStateRef handleAutoreleaseCounts(ProgramStateRef state, ExplodedNode *Pred, const ProgramPointTag *Tag, CheckerContext &Ctx, SymbolRef Sym, RefVal V, const ReturnStmt *S=nullptr) const
Represents a function declaration or definition.
TypedValueRegion - An abstract class representing regions having a typed value.
ObjKind
Determines the object kind of a tracked object.
A (possibly-)qualified type.
MemRegion - The root abstract class for all memory regions.
ExplodedNode * generateErrorNode(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generate a transition to a node that will be used to report an error.
bool isReturnedOwned() const
bool hasCaptures() const
True if this block (or its nested blocks) captures anything of local storage from its enclosing scope...
ProgramStateRef handleSymbolDeath(ProgramStateRef state, SymbolRef sid, RefVal V, SmallVectorImpl< SymbolRef > &Leaked) const
bool isDead(SymbolRef sym)
Returns whether or not a symbol has been confirmed dead.
The argument has its reference count decreased by 1 to model a transferred bridge cast under ARC...
Stmt - This represents one statement.
QualType getPointeeType() const
If this is a pointer, ObjC object pointer, or block pointer, this returns the respective pointee...
Bridging via __bridge, which does nothing but reinterpret the bits.
static ProgramStateRef removeRefBinding(ProgramStateRef State, SymbolRef Sym)
All typestate tracking of the object ceases.
ObjKind getObjKind() const
ExplodedNode * addTransition(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generates a new transition in the program state graph (ExplodedGraph).
Decl - This represents one declaration (or definition), e.g.
The argument has its reference count increased by 1.
static SmallVector< ProgramStateRef, 2 > updateOutParameters(ProgramStateRef State, const RetainSummary &Summ, const CallEvent &CE)
void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const
The argument is treated as if an -autorelease message had been sent to the referenced object...
const ProgramStateRef & getState() const
Indicates that no retain count information is tracked for the return value.
static bool isSmartPtrField(const MemRegion *MR)
static bool isPointerToObject(QualType QT)
const Expr * getOriginExpr() const
Returns the expression whose value will be the result of this call.
bool isConsumedExpr(Expr *E) const
static RetEffect MakeNoRet()
Represents a variable declaration or definition.
SymbolRef getAsLocSymbol(bool IncludeBaseRegions=false) const
If this SVal is a location and wraps a symbol, return that SymbolRef.
const T * getAs() const
Member-template getAs<specific type>'.
RefVal withIvarAccess() const
const Decl & getCodeDecl() const
ObjCMethodDecl - Represents an instance or class method declaration.
ExplodedNode * getPredecessor()
Returns the previous node in the exploded graph, which includes the state of the program before the c...
ObjKind getObjKind() const
virtual const MemRegion * getOriginRegion() const
Find the region from which this symbol originates.
SVal getSVal(const Stmt *S) const
Get the value of arbitrary expressions at this point in the path.
Represents a parameter to a function.
const bool wasInlined
If we are post visiting a call, this flag will be set if the call was inlined.
unsigned getCount() const
const MemRegion * getSuperRegion() const
ConditionTruthVal isNull(ProgramStateRef State, SymbolRef Sym)
Convenience method to query the state to see if a symbol is null or not null, or if neither assumptio...
MemRegionManager & getRegionManager()
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
RefVal releaseViaIvar() const
void processNonLeakError(ProgramStateRef St, SourceRange ErrorRange, RefVal::Kind ErrorKind, SymbolRef Sym, CheckerContext &C) const
Keeps track of the various options that can be enabled, which controls the dialect of C or C++ that i...
ObjCArrayLiteral - used for objective-c array containers; as in: @["Hello", NSApp, [NSNumber numberWithInt:42]];.
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
The argument has its reference count decreased by 1.
The argument is a pointer to a retain-counted object; on exit, the new value of the pointer is a +0 v...
static bool getOption(AnalyzerOptions &Options, StringRef Postfix, StringRef Value)
void checkPostCall(const CallEvent &Call, CheckerContext &C) const
bool hasNonZeroCallbackArg() const
Returns true if any of the arguments appear to represent callbacks.
Indicates that the return value is an owned object when the receiver is also a tracked object...
const LocationContext * getLocationContext() const
The argument is a pointer to a retain-counted object; on exit, the new value of the pointer is a +1 v...
void setCount(unsigned i)
SVal getReturnValue() const
Returns the return value of the call.
CastExpr - Base class for type casts, including both implicit casts (ImplicitCastExpr) and explicit c...
bool isScalarType() const
Represents an ObjC class declaration.
Bridging via __bridge_transfer, which transfers ownership of an Objective-C pointer into ARC...
static bool shouldEscapeOSArgumentOnCall(const CallEvent &CE, unsigned ArgIdx, const RefVal *TrackedValue)
Whether the tracked value should be escaped on a given call.
virtual QualType getType() const =0
virtual ArrayRef< ParmVarDecl * > parameters() const =0
Return call's formal parameters.
static bool isReceiverUnconsumedSelf(const CallEvent &Call)
SymbolRef getAsSymbol(bool IncludeBaseRegions=false) const
If this SVal wraps a symbol return that SymbolRef.
bool isConstrainedTrue() const
Return true if the constraint is perfectly constrained to 'true'.
void checkBind(SVal loc, SVal val, const Stmt *S, CheckerContext &C) const
CXXRecordDecl * getAsCXXRecordDecl() const
Retrieves the CXXRecordDecl that this type refers to, either because the type is a RecordType or beca...
bool isSynthesizedAccessor(const StackFrameContext *SFC)
Returns true if this stack frame is for an Objective-C method that is a property getter or setter who...
static const RetainSummary * getSummary(RetainSummaryManager &Summaries, const CallEvent &Call, QualType ReceiverType)
IvarAccessHistory getIvarAccessHistory() const
Returns what the analyzer knows about direct accesses to a particular instance variable.
const RegionTy * getAs() const
SymbolicRegion - A special, "non-concrete" region.
const LocationContext * getLocationContext() const
The context in which the call is being evaluated.
The argument is treated as potentially escaping, meaning that even when its reference count hits 0 it...
void checkBeginFunction(CheckerContext &C) const
void checkPostStmt(const BlockExpr *BE, CheckerContext &C) const
This represents one expression.
void setAutoreleaseCount(unsigned i)
static bool shouldEscapeRegion(const MemRegion *R)
A value escapes in these possible cases:
const CXXRecordDecl * getPointeeCXXRecordDecl() const
If this is a pointer or reference to a RecordType, return the CXXRecordDecl that the type refers to...
bool isObjCRetainableType() const
BlockExpr - Adaptor class for mixing a BlockDecl with expressions.
ObjCDictionaryLiteral - AST node to represent objective-c dictionary literals; as in:"name" : NSUserN...
void printState(raw_ostream &Out, ProgramStateRef State, const char *NL, const char *Sep) const override
See CheckerManager::runCheckersForPrintState.
virtual const Decl * getDecl() const
Returns the declaration of the function or method that will be called.
The argument is treated as if the referenced object was deallocated.
ReturnStmt - This represents a return, optionally of an expression: return; return 4;...
bool isCFObjectRef(QualType T)
bool isReturnedNotOwned() const
ExplodedNode * checkReturnWithRetEffect(const ReturnStmt *S, CheckerContext &C, ExplodedNode *Pred, RetEffect RE, RefVal X, SymbolRef Sym, ProgramStateRef state) const
An expression that sends a message to the given Objective-C object or class.
void processObjCLiterals(CheckerContext &C, const Expr *Ex) const
QualType getObjCInterfaceType(const ObjCInterfaceDecl *Decl, ObjCInterfaceDecl *PrevDecl=nullptr) const
getObjCInterfaceType - Return the unique reference to the type for the specified ObjC interface decl...
ObjCBridgeCastKind getBridgeKind() const
Determine which kind of bridge is being performed via this cast.
bool isNull() const
Return true if this QualType doesn't point to a type yet.
ProgramStateRef updateSymbol(ProgramStateRef state, SymbolRef sym, RefVal V, ArgEffect E, RefVal::Kind &hasErr, CheckerContext &C) const
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type...
const VarDecl * getDecl() const
void emitReport(std::unique_ptr< BugReport > R)
Emit the diagnostics report.
void print(raw_ostream &Out) const
ArgEffectKind getKind() const
DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag, const Expr *expr, const LocationContext *LCtx, unsigned count)
Create a new symbol with a unique 'name'.
CHECKER * registerChecker(AT &&... Args)
Used to register checkers.
ExplodedNode * generateSink(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
Generate a sink node.
#define REGISTER_MAP_WITH_PROGRAMSTATE(Name, Key, Value)
Declares an immutable map of type NameTy, suitable for placement into the ProgramState.
ProgramPoints can be "tagged" as representing points specific to a given analysis entity...
Indicates that the tracked object is an Objective-C object.
const MemRegion * getAsRegion() const
ConfigTable Config
A key-value table of use-specified configuration values.
ProgramStateRef evalAssume(ProgramStateRef state, SVal Cond, bool Assumption) const
unsigned getAutoreleaseCount() const
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
Performs the combined functionality of DecRef and StopTrackingHard.
bool isObjCObjectPointerType() const
A class responsible for cleaning up unused symbols.
SVal getSVal(const Stmt *S) const
Get the value of an arbitrary expression at this node.
ObjCBoxedExpr - used for generalized expression boxing.
unsigned blockCount() const
Returns the number of times the current block has been visited along the analyzed path...
An Objective-C "bridged" cast expression, which casts between Objective-C pointers and C pointers...
static ProgramStateRef setRefBinding(ProgramStateRef State, SymbolRef Sym, RefVal Val)
Dataflow Directional Tag Classes.
ASTContext & getASTContext()
virtual SourceRange getArgSourceRange(unsigned Index) const
Returns the source range for errors associated with this argument.
const VarRegion * getVarRegion(const VarDecl *D, const LocationContext *LC)
getVarRegion - Retrieve or create the memory region associated with a specified VarDecl and LocationC...
static Optional< RefVal > refValFromRetEffect(RetEffect RE, QualType ResultTy)
ProgramStateRef checkRegionChanges(ProgramStateRef state, const InvalidatedSymbols *invalidated, ArrayRef< const MemRegion *> ExplicitRegions, ArrayRef< const MemRegion *> Regions, const LocationContext *LCtx, const CallEvent *Call) const
ExplodedNode * processLeaks(ProgramStateRef state, SmallVectorImpl< SymbolRef > &Leaked, CheckerContext &Ctx, ExplodedNode *Pred=nullptr) const
RefVal autorelease() const
const MemRegion * StripCasts(bool StripBaseAndDerivedCasts=true) const
static RefVal makeOwned(ObjKind o, QualType t)
Create a state for an object whose lifetime is the responsibility of the current function, at least partially.
Represents an abstract call to a function or method along a particular path.
Bridging via __bridge_retain, which makes an ARC object available as a +1 C pointer.
AnalyzerOptions & getAnalyzerOptions()
const Decl * getDecl() const
Represents a pointer to an Objective C object.
const StackFrameContext * getStackFrame() const
Indicates that the tracking object is a descendant of a referenced-counted OSObject, used in the Darwin kernel.
const ProgramStateRef & getState() const
void checkEndFunction(const ReturnStmt *RS, CheckerContext &C) const
const RefVal * getRefBinding(ProgramStateRef State, SymbolRef Sym)
bool hasStackStorage() const
Stores options for the analyzer from the command line.
ObjCIvarRefExpr - A reference to an ObjC instance variable.
QualType getResultType() const
Returns the result type, adjusted for references.
X
Add a minimal nested name specifier fixit hint to allow lookup of a tag name from an outer enclosing ...
ArgEffect withKind(ArgEffectKind NewK)
All typestate tracking of the object ceases.
static RefVal makeNotOwned(ObjKind o, QualType t)
Create a state for an object whose lifetime is not the responsibility of the current function...
virtual unsigned getNumArgs() const =0
Returns the number of arguments (explicit and implicit).
The argument is a pointer to a retain-counted object; on exit, the new value of the pointer is a +1 v...
void checkSummary(const RetainSummary &Summ, const CallEvent &Call, CheckerContext &C) const
SValBuilder & getSValBuilder()
const RefCountBug & errorKindToBugKind(RefVal::Kind ErrorKind, SymbolRef Sym) const
static Decl::Kind getKind(const Decl *D)
The argument is a pointer to a retain-counted object; on exit, the new value of the pointer is a +1 v...
bool evalCall(const CallEvent &Call, CheckerContext &C) const
virtual SVal getArgSVal(unsigned Index) const
Returns the value of a given argument at the time of the call.
ParentMap & getParentMap()
void processSummaryOfInlined(const RetainSummary &Summ, const CallEvent &Call, CheckerContext &C) const
A trivial tuple used to represent a source range.
An ArgEffect summarizes the retain count behavior on an argument or receiver to a function or method...
Tag that can use a checker name as a message provider (see SimpleProgramPointTag).
QualType getObjCObjectPointerType(QualType OIT) const
Return a ObjCObjectPointerType type for the given ObjCObjectType.
bool inTopFrame() const
Return true if the current LocationContext has no caller context.
AnalysisDeclContext * getAnalysisDeclContext() const
const LocationContext * getLocationContext() const
const LangOptions & getLangOpts() const
static QualType GetReturnType(const Expr *RetE, ASTContext &Ctx)
GetReturnType - Used to get the return type of a message expression or function call with the intenti...
RetEffect summarizes a call's retain/release behavior with respect to its return value.