Go to the documentation of this file.
18 using namespace clang;
20 using namespace retaincountchecker;
26 namespace retaincountchecker {
29 return State->get<RefBindings>(Sym);
38 assert(Sym !=
nullptr);
39 return State->set<RefBindings>(Sym, Val);
43 return State->remove<RefBindings>(Sym);
48 Out <<
"Tracked " << T <<
" | ";
51 default: llvm_unreachable(
"Invalid RefVal kind");
55 if (cnt) Out <<
" (+ " << cnt <<
")";
62 if (cnt) Out <<
" (+ " << cnt <<
")";
67 Out <<
"ReturnedOwned";
69 if (cnt) Out <<
" (+ " << cnt <<
")";
74 Out <<
"ReturnedNotOwned";
76 if (cnt) Out <<
" (+ " << cnt <<
")";
85 Out <<
"-dealloc (not-owned)";
93 Out <<
"Leaked (Bad naming)";
97 Out <<
"Use-After-Release [ERROR]";
101 Out <<
"Release of Not-Owned [ERROR]";
105 Out <<
"Over-autoreleased";
109 Out <<
"Non-owned object returned instead of owned";
117 Out <<
" [direct ivar access]";
120 Out <<
" [released after direct ivar access]";
124 Out <<
" [autorelease -" << ACnt <<
']';
135 bool VisitSymbol(
SymbolRef sym)
override {
155 auto *R = cast<BlockDataRegion>(C.getSVal(BE).getAsRegion());
158 E = R->referenced_vars_end();
170 for ( ; I != E; ++I) {
175 Regions.push_back(VR);
178 state =
state->scanReachableSymbols<StopTrackingCallback>(Regions).getState();
179 C.addTransition(
state);
211 SymbolRef Sym = C.getSVal(CE).getAsLocSymbol();
226 C.addTransition(
state);
230 const Expr *Ex)
const {
256 C.addTransition(
state);
282 C.addTransition(
State);
335 C.addTransition(
State);
339 if (
const auto *MC = dyn_cast<ObjCMethodCall>(&Call)) {
343 return MC->getMethodFamily() ==
OMF_init && MC->isReceiverSelfOrSuper() &&
344 !Call.getLocationContext()
345 ->getAnalysisDeclContext()
347 .isConsumedExpr(Call.getOriginExpr());
355 const Expr *CE = Call.getOriginExpr();
358 :
AnyCall(cast<CXXDestructorDecl>(Call.getDecl()));
359 return Summaries.
getSummary(C, Call.hasNonZeroCallbackArg(),
369 if (
const auto *MC = dyn_cast<ObjCMethodCall>(&Call)) {
370 if (MC->isInstanceMessage()) {
371 SVal ReceiverV = MC->getReceiverSVal();
374 ReceiverType = T->getType();
401 if (PT->isObjCQualifiedIdType() || PT->isObjCIdType() ||
402 PT->isObjCClassType()) {
437 const RefVal *TrackedValue) {
454 for (
unsigned idx = 0, e = CallOrMsg.
getNumArgs(); idx != e; ++idx) {
461 ShouldRemoveBinding =
true;
463 if (ShouldRemoveBinding)
469 if (
const auto *MsgInvocation = dyn_cast<ObjCMethodCall>(&CallOrMsg)) {
470 if (
SymbolRef Sym = MsgInvocation->getReceiverSVal().getAsLocSymbol()) {
485 C.addTransition(
state);
489 const auto *TR = dyn_cast<TypedValueRegion>(
490 cast<SubRegion>(MR)->getSuperRegion());
509 const auto *VR = dyn_cast<VarRegion>(R);
514 const VarDecl *VD = VR->getDecl();
515 if (!VD->
hasAttr<CleanupAttr>())
530 bool SplitNecessary =
false;
534 SplitNecessary =
true;
539 if (SplitNecessary) {
546 AssumeNonZeroReturn = AssumeNonZeroReturn->assume(*DL,
true);
547 AssumeZeroReturn = AssumeZeroReturn->assume(*DL,
false);
551 for (
unsigned idx = 0, e = CE.
getNumArgs(); idx != e; ++idx) {
555 auto *ArgRegion = dyn_cast_or_null<TypedValueRegion>(ArgVal.
getAsRegion());
559 QualType PointeeTy = ArgRegion->getValueType();
560 SVal PointeeVal =
State->getSVal(ArgRegion);
579 AssumeNonZeroReturn = makeNotOwnedParameter(AssumeNonZeroReturn);
580 AssumeZeroReturn = makeNotOwnedParameter(AssumeZeroReturn);
583 AssumeNonZeroReturn = makeOwnedParameter(AssumeNonZeroReturn);
584 AssumeZeroReturn = makeOwnedParameter(AssumeZeroReturn);
587 AssumeNonZeroReturn = makeOwnedParameter(AssumeNonZeroReturn);
590 AssumeZeroReturn = makeOwnedParameter(AssumeZeroReturn);
597 if (SplitNecessary) {
598 return {AssumeNonZeroReturn, AssumeZeroReturn};
600 assert(AssumeZeroReturn == AssumeNonZeroReturn);
601 return {AssumeZeroReturn};
617 bool DeallocSent =
false;
619 for (
unsigned idx = 0, e = CallOrMsg.
getNumArgs(); idx != e; ++idx) {
642 bool ReceiverIsTracked =
false;
644 if (
const auto *MsgInvocation = dyn_cast<ObjCMethodCall>(&CallOrMsg)) {
645 if (
SymbolRef Sym = MsgInvocation->getReceiverSVal().getAsLocSymbol()) {
647 ReceiverIsTracked =
true;
651 ErrorRange = MsgInvocation->getOriginExpr()->getReceiverRange();
658 }
else if (
const auto *MCall = dyn_cast<CXXMemberCall>(&CallOrMsg)) {
659 if (
SymbolRef Sym = MCall->getCXXThisVal().getAsLocSymbol()) {
664 ErrorRange = MCall->getOriginExpr()->getSourceRange();
682 if (ReceiverIsTracked)
716 bool IgnoreRetainMsg = (
bool)C.getASTContext().getLangOpts().ObjCAutoRefCount;
736 hasErr =
V.getKind();
745 llvm_unreachable(
"Applies to pointer-to-pointer parameters, which should "
746 "not have ref state.");
749 switch (
V.getKind()) {
751 llvm_unreachable(
"Invalid RefVal state for an explicit dealloc.");
759 hasErr =
V.getKind();
785 switch (
V.getKind()) {
787 llvm_unreachable(
"Invalid RefVal state for a retain.");
798 switch (
V.getKind()) {
801 llvm_unreachable(
"Invalid RefVal state for a release.");
804 assert(
V.getCount() > 0);
805 if (
V.getCount() == 1) {
807 V.getIvarAccessHistory() ==
820 if (
V.getCount() > 0) {
824 }
else if (
V.getIvarAccessHistory() ==
833 hasErr =
V.getKind();
855 llvm_unreachable(
"Unhandled error.");
878 auto report = std::make_unique<RefCountReport>(
880 C.getASTContext().getLangOpts(), N, Sym);
881 report->addRange(ErrorRange);
882 C.emitReport(std::move(report));
892 const auto *FD = dyn_cast_or_null<FunctionDecl>(Call.getDecl());
896 const auto *CE = dyn_cast_or_null<CallExpr>(Call.getOriginExpr());
901 QualType ResultTy = Call.getResultType();
905 bool hasTrustedImplementationAnnotation =
false;
911 SmrMgr.
canEval(CE, FD, hasTrustedImplementationAnnotation);
918 if (BSmr == BehaviorSummary::Identity ||
919 BSmr == BehaviorSummary::IdentityOrZero ||
920 BSmr == BehaviorSummary::IdentityThis) {
922 const Expr *BindReturnTo =
923 (BSmr == BehaviorSummary::IdentityThis)
924 ? cast<CXXMemberCallExpr>(CE)->getImplicitObjectArgument()
926 SVal RetVal =
state->getSVal(BindReturnTo, LCtx);
933 (hasTrustedImplementationAnnotation && !ResultTy.
isNull())) {
940 state =
state->BindExpr(CE, LCtx, RetVal,
false);
942 if (BSmr == BehaviorSummary::IdentityOrZero) {
947 NullOutputState = NullOutputState->BindExpr(
948 CE, LCtx, C.getSValBuilder().makeNullWithType(ResultTy),
960 C.addTransition(
state);
979 const Expr *RetE = S->getRetValue();
986 SymbolRef Sym =
state->getSValAsScalarOrLoc(RetE, C.getLocationContext())
987 .getAsLocSymbol(
true);
999 switch (
X.getKind()) {
1001 unsigned cnt =
X.getCount();
1003 X.setCount(cnt - 1);
1009 unsigned cnt =
X.getCount();
1011 X.setCount(cnt - 1);
1025 Pred =
C.addTransition(
state);
1057 }
else if (
const FunctionDecl *FD = dyn_cast<FunctionDecl>(CD)) {
1058 if (!isa<CXXMethodDecl>(FD)) {
1083 if (
X.isReturnedOwned() &&
X.getCount() == 0) {
1097 const LangOptions &LOpts = C.getASTContext().getLangOpts();
1099 std::make_unique<RefLeakReport>(*
LeakAtReturn, LOpts, N, Sym, C);
1100 C.emitReport(std::move(R));
1105 }
else if (
X.isReturnedNotOwned()) {
1107 if (
X.getIvarAccessHistory() ==
1119 ReturnNotOwnedTag(
this,
"ReturnNotOwnedForOwned");
1123 auto R = std::make_unique<RefCountReport>(
1125 C.emitReport(std::move(R));
1146 state =
state->scanReachableSymbols<StopTrackingCallback>(val).getState();
1147 C.addTransition(
state);
1153 bool Assumption)
const {
1160 RefBindingsTy B =
state->get<RefBindings>();
1165 bool changed =
false;
1166 RefBindingsTy::Factory &RefBFactory =
state->get_context<RefBindings>();
1174 B = RefBFactory.remove(B, I.first);
1194 for (
const MemRegion *I : ExplicitRegions)
1196 AllowedSymbols.insert(SR->getSymbol());
1199 if (AllowedSymbols.count(sym))
1215 unsigned ACnt =
V.getAutoreleaseCount();
1221 unsigned Cnt =
V.getCount();
1232 V =
V.releaseViaIvar();
1245 V.setCount(
V.getCount() - ACnt);
1246 V.setAutoreleaseCount(0);
1268 llvm::raw_svector_ostream os(sbuf);
1269 os <<
"Object was autoreleased ";
1270 if (
V.getAutoreleaseCount() > 1)
1271 os <<
V.getAutoreleaseCount() <<
" times but the object ";
1274 os <<
"has a +" <<
V.getCount() <<
" retain count";
1277 auto R = std::make_unique<RefCountReport>(*
OverAutorelease, LOpts, N, Sym,
1299 else if (
V.isOwned())
1301 else if (
V.isNotOwned() ||
V.isReturnedOwned())
1302 hasLeak = (
V.getCount() > 0);
1309 Leaked.push_back(sid);
1325 Ctx.
emitReport(std::make_unique<RefLeakReport>(BT, LOpts, N, L, Ctx));
1348 for (
unsigned idx = 0, e = C->param_size(); idx != e; ++idx) {
1353 const ArgEffect *AE = CalleeSideArgEffects.lookup(idx);
1378 RefBindingsTy B =
state->get<RefBindings>();
1382 if (LCtx->getAnalysisDeclContext()->isBodyAutosynthesized()) {
1383 assert(!LCtx->inTopFrame());
1398 if (LCtx->getParent())
1401 B =
state->get<RefBindings>();
1418 for (
const auto &I:
state->get<RefBindings>()) {
1420 if (SymReaper.
isDead(Sym)) {
1433 if (Leaked.empty()) {
1434 C.addTransition(
state);
1446 RefBindingsTy::Factory &F =
state->get_context<RefBindings>();
1447 RefBindingsTy B =
state->get<RefBindings>();
1453 C.addTransition(
state, Pred);
1457 const char *NL,
const char *Sep)
const {
1459 RefBindingsTy B =
State->get<RefBindings>();
1467 Out << I.first <<
" : ";
1468 I.second.print(Out);
1483 std::make_unique<CheckerProgramPointTag>(Chk,
"DeallocSent");
1485 std::make_unique<CheckerProgramPointTag>(Chk,
"DynamicCastFail");
1488 bool ento::shouldRegisterRetainCountBase(
const CheckerManager &mgr) {
1492 auto *Chk = Mgr.
getChecker<RetainCountChecker>();
1493 Chk->TrackObjCAndCFObjects =
true;
1497 #define INIT_BUGTYPE(KIND) \
1498 Chk->KIND = std::make_unique<RefCountBug>(Mgr.getCurrentCheckerName(), \
1512 bool ento::shouldRegisterRetainCountChecker(
const CheckerManager &mgr) {
1516 void ento::registerOSObjectRetainCountChecker(
CheckerManager &Mgr) {
1517 auto *Chk = Mgr.
getChecker<RetainCountChecker>();
1518 Chk->TrackOSObjects =
true;
1529 #define LAZY_INIT_BUGTYPE(KIND) \
1531 Chk->KIND = std::make_unique<RefCountBug>(Mgr.getCurrentCheckerName(), \
1541 #undef LAZY_INIT_BUGTYPE
1544 bool ento::shouldRegisterOSObjectRetainCountChecker(
const CheckerManager &mgr) {
void processNonLeakError(ProgramStateRef St, SourceRange ErrorRange, RefVal::Kind ErrorKind, SymbolRef Sym, CheckerContext &C) const
Represents an ObjC class declaration.
bool isTrustedReferenceCountImplementation(const Decl *FD)
ObjCBoxedExpr - used for generalized expression boxing.
@ RetainedOutParameter
The argument is a pointer to a retain-counted object; on exit, the new value of the pointer is a +1 v...
@ CF
Indicates that the tracked object is a CF object.
static std::unique_ptr< CheckerProgramPointTag > DeallocSentTag
const LocationContext * getLocationContext() const
It wraps the AnalysisDeclContext to represent both the call stack with the help of StackFrameContext ...
bool isObjCRetainableType() const
A trivial tuple used to represent a source range.
CHECKER * registerChecker(AT &&... Args)
Used to register checkers.
llvm::ImmutableMap< unsigned, ArgEffect > ArgEffects
ArgEffects summarizes the effects of a function/method call on all of its arguments.
static QualType GetReturnType(const Expr *RetE, ASTContext &Ctx)
GetReturnType - Used to get the return type of a message expression or function call with the intenti...
static const CheckerProgramPointTag & getDeallocSentTag()
const MemRegion * getAsRegion() const
ObjKind
Determines the object kind of a tracked object.
CheckerNameRef getCurrentCheckerName() const
ProgramPoints can be "tagged" as representing points specific to a given analysis entity.
virtual const Expr * getOriginExpr() const
Returns the expression whose value will be the result of this call.
const MemRegion * StripCasts(bool StripBaseAndDerivedCasts=true) const
const LocationContext * getLocationContext() const
ArgEffectKind getKind() const
A (possibly-)qualified type.
bool isScalarType() const
void checkSummary(const RetainSummary &Summ, const CallEvent &Call, CheckerContext &C) const
static bool shouldEscapeOSArgumentOnCall(const CallEvent &CE, unsigned ArgIdx, const RefVal *TrackedValue)
Whether the tracked value should be escaped on a given call.
An Objective-C "bridged" cast expression, which casts between Objective-C pointers and C pointers,...
const AnalyzerOptions & getAnalyzerOptions() const
@ OBC_BridgeRetained
Bridging via __bridge_retain, which makes an ARC object available as a +1 C pointer.
static Optional< AnyCall > forDecl(const Decl *D)
If D is a callable (Objective-C method or a function), return a constructed AnyCall object.
Represents a parameter to a function.
static RefVal makeNotOwned(ObjKind o, QualType t)
Create a state for an object whose lifetime is not the responsibility of the current function.
std::unique_ptr< RefCountBug > OverAutorelease
static RetEffect MakeNoRet()
@ DecRefAndStopTrackingHard
Performs the combined functionality of DecRef and StopTrackingHard.
@ OwnedWhenTrackedReceiver
Indicates that the return value is an owned object when the receiver is also a tracked object.
void checkPostStmt(const BlockExpr *BE, CheckerContext &C) const
static ProgramStateRef setRefBinding(ProgramStateRef State, SymbolRef Sym, RefVal Val)
const VarRegion * getVarRegion(const VarDecl *VD, const LocationContext *LC)
getVarRegion - Retrieve or create the memory region associated with a specified VarDecl and LocationC...
const ProgramStateRef & getState() const
void printState(raw_ostream &Out, ProgramStateRef State, const char *NL, const char *Sep) const override
See CheckerManager::runCheckersForPrintState.
static bool isReceiverUnconsumedSelf(const CallEvent &Call)
const RefVal * getRefBinding(ProgramStateRef State, SymbolRef Sym)
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type.
ObjCArrayLiteral - used for objective-c array containers; as in: @["Hello", NSApp,...
@ Autorelease
The argument is treated as if an -autorelease message had been sent to the referenced object.
void checkEndFunction(const ReturnStmt *RS, CheckerContext &C) const
MemRegion - The root abstract class for all memory regions.
void processObjCLiterals(CheckerContext &C, const Expr *Ex) const
#define REGISTER_MAP_WITH_PROGRAMSTATE(Name, Key, Value)
Declares an immutable map of type NameTy, suitable for placement into the ProgramState.
SymbolRef getAsLocSymbol(bool IncludeBaseRegions=false) const
If this SVal is a location and wraps a symbol, return that SymbolRef.
bool isDead(SymbolRef sym)
Returns whether or not a symbol has been confirmed dead.
SVal getReturnValue() const
Returns the return value of the call.
const ProgramStateRef & getState() const
virtual ArrayRef< ParmVarDecl * > parameters() const =0
Return call's formal parameters.
void processSummaryOfInlined(const RetainSummary &Summ, const CallEvent &Call, CheckerContext &C) const
virtual SourceRange getArgSourceRange(unsigned Index) const
Returns the source range for errors associated with this argument.
An instance of this class corresponds to a call.
Optional< BehaviorSummary > canEval(const CallExpr *CE, const FunctionDecl *FD, bool &hasTrustedImplementationAnnotation)
void checkBind(SVal loc, SVal val, const Stmt *S, CheckerContext &C) const
const RetainSummary * getSummary(AnyCall C, bool HasNonZeroCallbackArg=false, bool IsReceiverUnconsumedSelf=false, QualType ReceiverType={})
virtual QualType getType() const =0
ObjKind getObjKind() const
static bool isSmartPtrField(const MemRegion *MR)
@ DoNothing
There is no effect.
@ MayEscape
The argument is treated as potentially escaping, meaning that even when its reference count hits 0 it...
virtual const MemRegion * getOriginRegion() const
Find the region from which this symbol originates.
static bool isPointerToObject(QualType QT)
unsigned getCount() const
const BlockDecl * getBlockDecl() const
const RefCountBug & errorKindToBugKind(RefVal::Kind ErrorKind, SymbolRef Sym) const
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
ObjCDictionaryLiteral - AST node to represent objective-c dictionary literals; as in:"name" : NSUserN...
IvarAccessHistory getIvarAccessHistory() const
Returns what the analyzer knows about direct accesses to a particular instance variable.
const T * getAs() const
Member-template getAs<specific type>'.
RetainSummaryManager & getSummaryManager(ASTContext &Ctx) const
RetEffect getRetEffect() const
getRetEffect - Returns the effect on the return value of the call.
ProgramStateRef evalAssume(ProgramStateRef state, SVal Cond, bool Assumption) const
QualType getObjCInterfaceType(const ObjCInterfaceDecl *Decl, ObjCInterfaceDecl *PrevDecl=nullptr) const
getObjCInterfaceType - Return the unique reference to the type for the specified ObjC interface decl.
const CXXRecordDecl * getPointeeCXXRecordDecl() const
If this is a pointer or reference to a RecordType, return the CXXRecordDecl that the type refers to.
ArgEffect getReceiverEffect() const
getReceiverEffect - Returns the effect on the receiver of the call.
ExplodedNode * addTransition(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generates a new transition in the program state graph (ExplodedGraph).
bool evalCall(const CallEvent &Call, CheckerContext &C) const
#define LAZY_INIT_BUGTYPE(KIND)
static bool shouldEscapeRegion(const MemRegion *R)
A value escapes in these possible cases:
ArgEffect getThisEffect() const
Represents a variable declaration or definition.
void emitReport(std::unique_ptr< BugReport > R)
Emit the diagnostics report.
QualType getPointeeType() const
If this is a pointer, ObjC object pointer, or block pointer, this returns the respective pointee.
std::unique_ptr< RefCountBug > DeallocNotOwned
A class responsible for cleaning up unused symbols.
CXXRecordDecl * getAsCXXRecordDecl() const
Retrieves the CXXRecordDecl that this type refers to, either because the type is a RecordType or beca...
bool inTopFrame() const
Return true if the current LocationContext has no caller context.
@ StopTracking
All typestate tracking of the object ceases.
static Optional< AnyCall > forExpr(const Expr *E)
If E is a generic call (to ObjC method /function/block/etc), return a constructed AnyCall object.
An expression that sends a message to the given Objective-C object or class.
SymbolicRegion - A special, "non-concrete" region.
const MemRegion * getSuperRegion() const
and static some checkers Checker The latter are built on top of the former via the Checker and CheckerVisitor and attempts to isolate them from much of the gore of the internal analysis the analyzer is basically a source code simulator that traces out possible paths of execution The state of the and the combination of state and program point is a node in an exploded which has the entry program point and initial state
static ProgramStateRef removeRefBinding(ProgramStateRef State, SymbolRef Sym)
static RefVal makeOwned(ObjKind o, QualType t)
Create a state for an object whose lifetime is the responsibility of the current function,...
bool isObjCObjectPointerType() const
bool isConstrainedTrue() const
Return true if the constraint is perfectly constrained to 'true'.
@ Dealloc
The argument is treated as if the referenced object was deallocated.
bool hasCaptures() const
True if this block (or its nested blocks) captures anything of local storage from its enclosing scope...
const RegionTy * getAs() const
Represents a pointer to an Objective C object.
std::unique_ptr< RefCountBug > UseAfterRelease
bool isSynthesizedAccessor(const StackFrameContext *SFC)
Returns true if this stack frame is for an Objective-C method that is a property getter or setter who...
@ ReleasedAfterDirectAccess
static bool isKnownSmartPointer(QualType QT)
bool hasStackStorage() const
std::unique_ptr< RefCountBug > LeakWithinFunction
static std::unique_ptr< CheckerProgramPointTag > CastFailTag
@ DecRef
The argument has its reference count decreased by 1.
ASTContext & getASTContext()
@ OBC_BridgeTransfer
Bridging via __bridge_transfer, which transfers ownership of an Objective-C pointer into ARC.
bool isNull() const
Return true if this QualType doesn't point to a type yet.
BlockExpr - Adaptor class for mixing a BlockDecl with expressions.
@ Generalized
Indicates that the tracked object is a generalized object.
Decl - This represents one declaration (or definition), e.g.
bool isCFObjectRef(QualType T)
@ ObjC
Indicates that the tracked object is an Objective-C object.
@ StopTrackingHard
All typestate tracking of the object ceases.
Summary for a function with respect to ownership changes.
virtual unsigned getNumArgs() const =0
Returns the number of arguments (explicit and implicit).
static Optional< RefVal > refValFromRetEffect(RetEffect RE, QualType ResultTy)
@ RetainedOutParameterOnNonZero
The argument is a pointer to a retain-counted object; on exit, the new value of the pointer is a +1 v...
ExplodedNode * checkReturnWithRetEffect(const ReturnStmt *S, CheckerContext &C, ExplodedNode *Pred, RetEffect RE, RefVal X, SymbolRef Sym, ProgramStateRef state) const
@ UnretainedOutParameter
The argument is a pointer to a retain-counted object; on exit, the new value of the pointer is a +0 v...
Keeps track of the various options that can be enabled, which controls the dialect of C or C++ that i...
QualType getResultType() const
Returns the result type, adjusted for references.
ArgEffects getArgEffects() const
bool getCheckerBooleanOption(StringRef CheckerName, StringRef OptionName, bool SearchInParents=false) const
Interprets an option's string value as a boolean.
std::unique_ptr< RefCountBug > ReturnNotOwnedForOwned
ObjCMethodDecl - Represents an instance or class method declaration.
ArgEffect withKind(ArgEffectKind NewK)
std::unique_ptr< RetainSummaryManager > Summaries
std::unique_ptr< RefCountBug > LeakAtReturn
@ RetainedOutParameterOnZero
The argument is a pointer to a retain-counted object; on exit, the new value of the pointer is a +1 v...
Tag that can use a checker name as a message provider (see SimpleProgramPointTag).
@ NoRet
Indicates that no retain count information is tracked for the return value.
ObjKind getObjKind() const
void checkBeginFunction(CheckerContext &C) const
An ArgEffect summarizes the retain count behavior on an argument or receiver to a function or method.
RetEffect getObjAllocRetEffect() const
Stmt - This represents one statement.
ExplodedNode * generateSink(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
Generate a sink node.
Represents an abstract call to a function or method along a particular path.
SVal getSVal(const Stmt *S) const
Get the value of an arbitrary expression at this node.
void print(raw_ostream &Out) const
virtual SVal getArgSVal(unsigned Index) const
Returns the value of a given argument at the time of the call.
RetEffect summarizes a call's retain/release behavior with respect to its return value.
void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
ArgEffect getArg(unsigned idx) const
getArg - Return the argument effect on the argument specified by idx (starting from 0).
@ IncRef
The argument has its reference count increased by 1.
@ DecRefBridgedTransferred
The argument has its reference count decreased by 1 to model a transferred bridge cast under ARC.
RefVal withIvarAccess() const
ProgramStateRef handleSymbolDeath(ProgramStateRef state, SymbolRef sid, RefVal V, SmallVectorImpl< SymbolRef > &Leaked) const
ObjCBridgeCastKind getBridgeKind() const
Determine which kind of bridge is being performed via this cast.
const Decl & getCodeDecl() const
ProgramStateRef updateSymbol(ProgramStateRef state, SymbolRef sym, RefVal V, ArgEffect E, RefVal::Kind &hasErr, CheckerContext &C) const
This represents one expression.
ProgramStateRef checkRegionChanges(ProgramStateRef state, const InvalidatedSymbols *invalidated, ArrayRef< const MemRegion * > ExplicitRegions, ArrayRef< const MemRegion * > Regions, const LocationContext *LCtx, const CallEvent *Call) const
SymbolRef getAsSymbol(bool IncludeBaseRegions=false) const
If this SVal wraps a symbol return that SymbolRef.
DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag, const Expr *expr, const LocationContext *LCtx, unsigned count)
Create a new symbol with a unique 'name'.
ExplodedNode * processLeaks(ProgramStateRef state, SmallVectorImpl< SymbolRef > &Leaked, CheckerContext &Ctx, ExplodedNode *Pred=nullptr) const
static SmallVector< ProgramStateRef, 2 > updateOutParameters(ProgramStateRef State, const RetainSummary &Summ, const CallEvent &CE)
QualType getObjCObjectPointerType(QualType OIT) const
Return a ObjCObjectPointerType type for the given ObjCObjectType.
bool TrackNSCFStartParam
Track initial parameters (for the entry point) for NS/CF objects.
CastExpr - Base class for type casts, including both implicit casts (ImplicitCastExpr) and explicit c...
ProgramStateRef handleAutoreleaseCounts(ProgramStateRef state, ExplodedNode *Pred, const ProgramPointTag *Tag, CheckerContext &Ctx, SymbolRef Sym, RefVal V, const ReturnStmt *S=nullptr) const
void checkPostCall(const CallEvent &Call, CheckerContext &C) const
const Decl * getDecl() const
Represents a function declaration or definition.
@ OBC_Bridge
Bridging via __bridge, which does nothing but reinterpret the bits.
ConditionTruthVal isNull(ProgramStateRef State, SymbolRef Sym)
Convenience method to query the state to see if a symbol is null or not null, or if neither assumptio...
std::unique_ptr< RefCountBug > ReleaseNotOwned
const VarDecl * getDecl() const override=0
static const CheckerProgramPointTag & getCastFailTag()
ObjCIvarRefExpr - A reference to an ObjC instance variable.
const LangOptions & getLangOpts() const
std::unique_ptr< RefCountBug > FreeNotOwned
#define INIT_BUGTYPE(KIND)
@ OS
Indicates that the tracking object is a descendant of a referenced-counted OSObject,...
ReturnStmt - This represents a return, optionally of an expression: return; return 4;.
const VarRegion * getCapturedRegion() const
const static RetainSummary * getSummary(RetainSummaryManager &Summaries, const CallEvent &Call, QualType ReceiverType)