#include "RetainCountChecker.h"
#include "clang/StaticAnalyzer/Core/Checker.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
#include <optional>

Namespaces
namespace	clang
	The JSON file list parser is used to communicate input to InstallAPI.

namespace	clang::ento

namespace	clang::ento::retaincountchecker

Macros
#define	INIT_BUGTYPE(KIND)

#define	LAZY_INIT_BUGTYPE(KIND)

Functions
const RefVal *	clang::ento::retaincountchecker::getRefBinding (ProgramStateRef State, SymbolRef Sym)

static ProgramStateRef	setRefBinding (ProgramStateRef State, SymbolRef Sym, RefVal Val)

static ProgramStateRef	removeRefBinding (ProgramStateRef State, SymbolRef Sym)

static bool	isReceiverUnconsumedSelf (const CallEvent &Call)

static const RetainSummary *	getSummary (RetainSummaryManager &Summaries, const CallEvent &Call, QualType ReceiverType)

static QualType	GetReturnType (const Expr *RetE, ASTContext &Ctx)
	GetReturnType - Used to get the return type of a message expression or function call with the intention of affixing that type to a tracked symbol.

static std::optional< RefVal >	refValFromRetEffect (RetEffect RE, QualType ResultTy)

static bool	isPointerToObject (QualType QT)

static bool	shouldEscapeOSArgumentOnCall (const CallEvent &CE, unsigned ArgIdx, const RefVal *TrackedValue)
	Whether the tracked value should be escaped on a given call.

static bool	isSmartPtrField (const MemRegion *MR)

static bool	shouldEscapeRegion (const MemRegion *R)
	A value escapes in these possible cases:

static SmallVector< ProgramStateRef, 2 >	updateOutParameters (ProgramStateRef State, const RetainSummary &Summ, const CallEvent &CE)

Macro Definition Documentation

◆ INIT_BUGTYPE

#define INIT_BUGTYPE ( KIND )

Value:

Chk->KIND = std::make_unique<RefCountBug>(Mgr.getCurrentCheckerName(), \

RefCountBug::KIND);

◆ LAZY_INIT_BUGTYPE

#define LAZY_INIT_BUGTYPE ( KIND )

Value:

  if (!Chk->KIND)                                                              \
    Chk->KIND = std::make_unique<RefCountBug>(Mgr.getCurrentCheckerName(),     \
                                              RefCountBug::KIND);

Function Documentation

◆ GetReturnType()

static QualType GetReturnType	(	const Expr *	RetE,
		ASTContext &	Ctx
	)

static

GetReturnType - Used to get the return type of a message expression or function call with the intention of affixing that type to a tracked symbol.

While the return type can be queried directly from RetEx, when invoking class methods we augment to the return type to be that of a pointer to the class (as opposed it just being id).

more specific than id.

Definition at line 393 of file RetainCountChecker.cpp.

References clang::Type::getAs(), clang::ASTContext::getObjCInterfaceType(), clang::ASTContext::getObjCObjectPointerType(), and clang::Expr::getType().

◆ getSummary()

static const RetainSummary * getSummary	(	RetainSummaryManager &	Summaries,
		const CallEvent &	Call,
		QualType	ReceiverType
	)

static

Definition at line 351 of file RetainCountChecker.cpp.

References clang::C, clang::Call, clang::AnyCall::forExpr(), clang::ento::RetainSummaryManager::getSummary(), and isReceiverUnconsumedSelf().

Referenced by clang::ento::retaincountchecker::RetainCountChecker::checkPostCall().

◆ isPointerToObject()

static bool isPointerToObject ( QualType QT )

static

Definition at line 425 of file RetainCountChecker.cpp.

References clang::Type::getAsCXXRecordDecl(), clang::Type::getPointeeType(), and clang::QualType::isNull().

Referenced by shouldEscapeOSArgumentOnCall().

◆ isReceiverUnconsumedSelf()

static bool isReceiverUnconsumedSelf ( const CallEvent & Call )

static

Definition at line 337 of file RetainCountChecker.cpp.

References clang::Call, and clang::OMF_init.

Referenced by getSummary().

◆ isSmartPtrField()

static bool isSmartPtrField ( const MemRegion * MR )

static

Definition at line 487 of file RetainCountChecker.cpp.

References clang::ento::RetainSummaryManager::isKnownSmartPointer().

Referenced by shouldEscapeRegion().

◆ refValFromRetEffect()

static std::optional< RefVal > refValFromRetEffect	(	RetEffect	RE,
		QualType	ResultTy
	)

static

Definition at line 414 of file RetainCountChecker.cpp.

References clang::ento::RetEffect::getObjKind(), clang::ento::RetEffect::isOwned(), clang::ento::retaincountchecker::RefVal::makeNotOwned(), clang::ento::retaincountchecker::RefVal::makeOwned(), and clang::ento::RetEffect::notOwned().

Referenced by clang::ento::retaincountchecker::RetainCountChecker::checkSummary().

◆ removeRefBinding()

static ProgramStateRef removeRefBinding	(	ProgramStateRef	State,
		SymbolRef	Sym
	)

static

Definition at line 43 of file RetainCountChecker.cpp.

Referenced by clang::ento::retaincountchecker::RetainCountChecker::checkRegionChanges(), clang::ento::retaincountchecker::RetainCountChecker::handleSymbolDeath(), clang::ento::retaincountchecker::RetainCountChecker::processSummaryOfInlined(), and clang::ento::retaincountchecker::RetainCountChecker::updateSymbol().

◆ setRefBinding()

static ProgramStateRef setRefBinding	(	ProgramStateRef	State,
		SymbolRef	Sym,
		RefVal	Val
	)

static

Definition at line 37 of file RetainCountChecker.cpp.

◆ shouldEscapeOSArgumentOnCall()

static bool shouldEscapeOSArgumentOnCall	(	const CallEvent &	CE,
		unsigned	ArgIdx,
		const RefVal *	TrackedValue
	)

static

Whether the tracked value should be escaped on a given call.

OSObjects are escaped when passed to void * / etc.

Definition at line 435 of file RetainCountChecker.cpp.

References clang::ento::retaincountchecker::RefVal::getObjKind(), isPointerToObject(), clang::ento::OS, and clang::ento::CallEvent::parameters().

Referenced by clang::ento::retaincountchecker::RetainCountChecker::checkSummary(), and clang::ento::retaincountchecker::RetainCountChecker::processSummaryOfInlined().

◆ shouldEscapeRegion()

static bool shouldEscapeRegion ( const MemRegion * R )

static

A value escapes in these possible cases:

binding to something that is not a memory region.
binding to a memregion that does not have stack storage
binding to a variable that has a destructor attached using CleanupAttr

We do not currently model what happens when a symbol is assigned to a struct field, unless it is a known smart pointer implementation, about which we know that it is inlined. FIXME: This could definitely be improved upon.

Definition at line 504 of file RetainCountChecker.cpp.

References clang::Decl::hasAttr(), clang::ento::MemRegion::hasStackStorage(), and isSmartPtrField().

Referenced by clang::ento::retaincountchecker::RetainCountChecker::checkBind(), and updateOutParameters().

◆ updateOutParameters()

static SmallVector< ProgramStateRef, 2 > updateOutParameters	(	ProgramStateRef	State,
		const RetainSummary &	Summ,
		const CallEvent &	CE
	)

static

Definition at line 520 of file RetainCountChecker.cpp.

References clang::ento::RetainSummary::getArg(), clang::ento::RetainSummary::getArgEffects(), clang::ento::CallEvent::getArgSVal(), clang::ento::SVal::getAs(), clang::ento::SVal::getAsLocSymbol(), clang::ento::SVal::getAsRegion(), clang::ento::ArgEffect::getKind(), clang::ento::CallEvent::getNumArgs(), clang::ento::ArgEffect::getObjKind(), clang::ento::CallEvent::getResultType(), clang::ento::CallEvent::getReturnValue(), clang::Type::isScalarType(), clang::ento::retaincountchecker::RefVal::makeNotOwned(), clang::ento::retaincountchecker::RefVal::makeOwned(), clang::ento::OS, P, clang::ento::RetainedOutParameter, clang::ento::RetainedOutParameterOnNonZero, clang::ento::RetainedOutParameterOnZero, setRefBinding(), shouldEscapeRegion(), and clang::ento::UnretainedOutParameter.

Referenced by clang::ento::retaincountchecker::RetainCountChecker::checkSummary().

Namespaces

Macros

Functions

Macro Definition Documentation

◆ INIT_BUGTYPE

◆ LAZY_INIT_BUGTYPE

Function Documentation

◆ GetReturnType()

◆ getSummary()

◆ isPointerToObject()

◆ isReceiverUnconsumedSelf()

◆ isSmartPtrField()

◆ refValFromRetEffect()

◆ removeRefBinding()

◆ setRefBinding()

◆ shouldEscapeOSArgumentOnCall()

◆ shouldEscapeRegion()

◆ updateOutParameters()