clang 18.0.0git
RetainCountChecker.h
Go to the documentation of this file.
1//==--- RetainCountChecker.h - Checks for leaks and other issues -*- C++ -*--//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file defines the methods for RetainCountChecker, which implements
10// a reference count checker for Core Foundation and Cocoa on (Mac OS X).
11//
12//===----------------------------------------------------------------------===//
13
14#ifndef LLVM_CLANG_LIB_STATICANALYZER_CHECKERS_RETAINCOUNTCHECKER_H
15#define LLVM_CLANG_LIB_STATICANALYZER_CHECKERS_RETAINCOUNTCHECKER_H
16
19#include "clang/AST/Attr.h"
20#include "clang/AST/DeclCXX.h"
21#include "clang/AST/DeclObjC.h"
22#include "clang/AST/ParentMap.h"
36#include "llvm/ADT/DenseMap.h"
37#include "llvm/ADT/FoldingSet.h"
38#include "llvm/ADT/ImmutableList.h"
39#include "llvm/ADT/ImmutableMap.h"
40#include "llvm/ADT/STLExtras.h"
41#include "llvm/ADT/SmallString.h"
42#include "llvm/ADT/StringExtras.h"
43#include <cstdarg>
44#include <utility>
45
46namespace clang {
47namespace ento {
48namespace retaincountchecker {
49
50/// Metadata on reference.
51class RefVal {
52public:
53 enum Kind {
54 Owned = 0, // Owning reference.
55 NotOwned, // Reference is not owned by still valid (not freed).
56 Released, // Object has been released.
57 ReturnedOwned, // Returned object passes ownership to caller.
58 ReturnedNotOwned, // Return object does not pass ownership to caller.
60 ErrorDeallocNotOwned, // -dealloc called on non-owned object.
61 ErrorUseAfterRelease, // Object used after released.
62 ErrorReleaseNotOwned, // Release of an object that was not owned.
64 ErrorLeak, // A memory leak due to excessive reference counts.
65 ErrorLeakReturned, // A memory leak due to the returning method not having
66 // the correct naming conventions.
69 };
70
71 /// Tracks how an object referenced by an ivar has been used.
72 ///
73 /// This accounts for us not knowing if an arbitrary ivar is supposed to be
74 /// stored at +0 or +1.
75 enum class IvarAccessHistory {
76 None,
79 };
80
81private:
82 /// The number of outstanding retains.
83 unsigned Cnt;
84 /// The number of outstanding autoreleases.
85 unsigned ACnt;
86 /// The (static) type of the object at the time we started tracking it.
87 QualType T;
88
89 /// The current state of the object.
90 ///
91 /// See the RefVal::Kind enum for possible values.
92 unsigned RawKind : 5;
93
94 /// The kind of object being tracked (CF or ObjC or OSObject), if known.
95 ///
96 /// See the ObjKind enum for possible values.
97 unsigned RawObjectKind : 3;
98
99 /// True if the current state and/or retain count may turn out to not be the
100 /// best possible approximation of the reference counting state.
101 ///
102 /// If true, the checker may decide to throw away ("override") this state
103 /// in favor of something else when it sees the object being used in new ways.
104 ///
105 /// This setting should not be propagated to state derived from this state.
106 /// Once we start deriving new states, it would be inconsistent to override
107 /// them.
108 unsigned RawIvarAccessHistory : 2;
109
110 RefVal(Kind k, ObjKind o, unsigned cnt, unsigned acnt, QualType t,
111 IvarAccessHistory IvarAccess)
112 : Cnt(cnt), ACnt(acnt), T(t), RawKind(static_cast<unsigned>(k)),
113 RawObjectKind(static_cast<unsigned>(o)),
114 RawIvarAccessHistory(static_cast<unsigned>(IvarAccess)) {
115 assert(getKind() == k && "not enough bits for the kind");
116 assert(getObjKind() == o && "not enough bits for the object kind");
117 assert(getIvarAccessHistory() == IvarAccess && "not enough bits");
118 }
119
120public:
121 Kind getKind() const { return static_cast<Kind>(RawKind); }
122
124 return static_cast<ObjKind>(RawObjectKind);
125 }
126
127 unsigned getCount() const { return Cnt; }
128 unsigned getAutoreleaseCount() const { return ACnt; }
129 unsigned getCombinedCounts() const { return Cnt + ACnt; }
130 void clearCounts() {
131 Cnt = 0;
132 ACnt = 0;
133 }
134 void setCount(unsigned i) {
135 Cnt = i;
136 }
137 void setAutoreleaseCount(unsigned i) {
138 ACnt = i;
139 }
140
141 QualType getType() const { return T; }
142
143 /// Returns what the analyzer knows about direct accesses to a particular
144 /// instance variable.
145 ///
146 /// If the object with this refcount wasn't originally from an Objective-C
147 /// ivar region, this should always return IvarAccessHistory::None.
149 return static_cast<IvarAccessHistory>(RawIvarAccessHistory);
150 }
151
152 bool isOwned() const {
153 return getKind() == Owned;
154 }
155
156 bool isNotOwned() const {
157 return getKind() == NotOwned;
158 }
159
160 bool isReturnedOwned() const {
161 return getKind() == ReturnedOwned;
162 }
163
164 bool isReturnedNotOwned() const {
165 return getKind() == ReturnedNotOwned;
166 }
167
168 /// Create a state for an object whose lifetime is the responsibility of the
169 /// current function, at least partially.
170 ///
171 /// Most commonly, this is an owned object with a retain count of +1.
173 return RefVal(Owned, o, /*Count=*/1, 0, t, IvarAccessHistory::None);
174 }
175
176 /// Create a state for an object whose lifetime is not the responsibility of
177 /// the current function.
178 ///
179 /// Most commonly, this is an unowned object with a retain count of +0.
181 return RefVal(NotOwned, o, /*Count=*/0, 0, t, IvarAccessHistory::None);
182 }
183
184 RefVal operator-(size_t i) const {
185 return RefVal(getKind(), getObjKind(), getCount() - i,
187 }
188
189 RefVal operator+(size_t i) const {
190 return RefVal(getKind(), getObjKind(), getCount() + i,
192 }
193
197 }
198
202 }
203
208 }
209
214 }
215
216 // Comparison, profiling, and pretty-printing.
217 bool hasSameState(const RefVal &X) const {
218 return getKind() == X.getKind() && Cnt == X.Cnt && ACnt == X.ACnt &&
219 getIvarAccessHistory() == X.getIvarAccessHistory();
220 }
221
222 bool operator==(const RefVal& X) const {
223 return T == X.T && hasSameState(X) && getObjKind() == X.getObjKind();
224 }
225
226 void Profile(llvm::FoldingSetNodeID& ID) const {
227 ID.Add(T);
228 ID.AddInteger(RawKind);
229 ID.AddInteger(Cnt);
230 ID.AddInteger(ACnt);
231 ID.AddInteger(RawObjectKind);
232 ID.AddInteger(RawIvarAccessHistory);
233 }
234
235 void print(raw_ostream &Out) const;
236};
237
239 : public Checker< check::Bind,
240 check::DeadSymbols,
241 check::BeginFunction,
242 check::EndFunction,
243 check::PostStmt<BlockExpr>,
244 check::PostStmt<CastExpr>,
245 check::PostStmt<ObjCArrayLiteral>,
246 check::PostStmt<ObjCDictionaryLiteral>,
247 check::PostStmt<ObjCBoxedExpr>,
248 check::PostStmt<ObjCIvarRefExpr>,
249 check::PostCall,
250 check::RegionChanges,
251 eval::Assume,
252 eval::Call > {
253
254public:
255 std::unique_ptr<RefCountBug> UseAfterRelease;
256 std::unique_ptr<RefCountBug> ReleaseNotOwned;
257 std::unique_ptr<RefCountBug> DeallocNotOwned;
258 std::unique_ptr<RefCountBug> FreeNotOwned;
259 std::unique_ptr<RefCountBug> OverAutorelease;
260 std::unique_ptr<RefCountBug> ReturnNotOwnedForOwned;
261 std::unique_ptr<RefCountBug> LeakWithinFunction;
262 std::unique_ptr<RefCountBug> LeakAtReturn;
263
264 mutable std::unique_ptr<RetainSummaryManager> Summaries;
265
266 static std::unique_ptr<CheckerProgramPointTag> DeallocSentTag;
267 static std::unique_ptr<CheckerProgramPointTag> CastFailTag;
268
269 /// Track Objective-C and CoreFoundation objects.
271
272 /// Track sublcasses of OSObject.
273 bool TrackOSObjects = false;
274
275 /// Track initial parameters (for the entry point) for NS/CF objects.
277
279
281 if (!Summaries)
282 Summaries.reset(
284 return *Summaries;
285 }
286
288 return getSummaryManager(C.getASTContext());
289 }
290
291 void printState(raw_ostream &Out, ProgramStateRef State,
292 const char *NL, const char *Sep) const override;
293
294 void checkBind(SVal loc, SVal val, const Stmt *S, CheckerContext &C) const;
295 void checkPostStmt(const BlockExpr *BE, CheckerContext &C) const;
296 void checkPostStmt(const CastExpr *CE, CheckerContext &C) const;
297
298 void checkPostStmt(const ObjCArrayLiteral *AL, CheckerContext &C) const;
299 void checkPostStmt(const ObjCDictionaryLiteral *DL, CheckerContext &C) const;
300 void checkPostStmt(const ObjCBoxedExpr *BE, CheckerContext &C) const;
301
302 void checkPostStmt(const ObjCIvarRefExpr *IRE, CheckerContext &C) const;
303
304 void checkPostCall(const CallEvent &Call, CheckerContext &C) const;
305
306 void checkSummary(const RetainSummary &Summ, const CallEvent &Call,
307 CheckerContext &C) const;
308
309 void processSummaryOfInlined(const RetainSummary &Summ,
310 const CallEvent &Call,
311 CheckerContext &C) const;
312
313 bool evalCall(const CallEvent &Call, CheckerContext &C) const;
314
316 bool Assumption) const;
317
320 const InvalidatedSymbols *invalidated,
321 ArrayRef<const MemRegion *> ExplicitRegions,
323 const LocationContext* LCtx,
324 const CallEvent *Call) const;
325
327 ExplodedNode *Pred, RetEffect RE, RefVal X,
328 SymbolRef Sym, ProgramStateRef state) const;
329
330 void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const;
332 void checkEndFunction(const ReturnStmt *RS, CheckerContext &C) const;
333
335 RefVal V, ArgEffect E, RefVal::Kind &hasErr,
336 CheckerContext &C) const;
337
339 SymbolRef Sym) const;
340
342 RefVal::Kind ErrorKind, SymbolRef Sym,
343 CheckerContext &C) const;
344
345 void processObjCLiterals(CheckerContext &C, const Expr *Ex) const;
346
348 SymbolRef sid, RefVal V,
349 SmallVectorImpl<SymbolRef> &Leaked) const;
350
353 const ProgramPointTag *Tag, CheckerContext &Ctx,
354 SymbolRef Sym,
355 RefVal V,
356 const ReturnStmt *S=nullptr) const;
357
360 CheckerContext &Ctx,
361 ExplodedNode *Pred = nullptr) const;
362
364 return *DeallocSentTag;
365 }
366
368
369private:
370 /// Perform the necessary checks and state adjustments at the end of the
371 /// function.
372 /// \p S Return statement, may be null.
373 ExplodedNode * processReturn(const ReturnStmt *S, CheckerContext &C) const;
374};
375
376//===----------------------------------------------------------------------===//
377// RefBindings - State used to track object reference counts.
378//===----------------------------------------------------------------------===//
379
380const RefVal *getRefBinding(ProgramStateRef State, SymbolRef Sym);
381
382/// Returns true if this stack frame is for an Objective-C method that is a
383/// property getter or setter whose body has been synthesized by the analyzer.
385 auto Method = dyn_cast_or_null<ObjCMethodDecl>(SFC->getDecl());
386 if (!Method || !Method->isPropertyAccessor())
387 return false;
388
390}
391
392} // end namespace retaincountchecker
393} // end namespace ento
394} // end namespace clang
395
396#endif
#define V(N, I)
Definition: ASTContext.h:3233
Defines the C++ Decl subclasses, other than those for templates (found in DeclTemplate....
#define X(type, name)
Definition: Value.h:142
Defines the clang::LangOptions interface.
Defines the SourceManager interface.
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:182
BlockExpr - Adaptor class for mixing a BlockDecl with expressions.
Definition: Expr.h:6167
CastExpr - Base class for type casts, including both implicit casts (ImplicitCastExpr) and explicit c...
Definition: Expr.h:3502
This represents one expression.
Definition: Expr.h:110
It wraps the AnalysisDeclContext to represent both the call stack with the help of StackFrameContext ...
const Decl * getDecl() const
LLVM_ATTRIBUTE_RETURNS_NONNULL AnalysisDeclContext * getAnalysisDeclContext() const
ObjCArrayLiteral - used for objective-c array containers; as in: @["Hello", NSApp,...
Definition: ExprObjC.h:191
ObjCBoxedExpr - used for generalized expression boxing.
Definition: ExprObjC.h:127
ObjCDictionaryLiteral - AST node to represent objective-c dictionary literals; as in:"name" : NSUserN...
Definition: ExprObjC.h:309
ObjCIvarRefExpr - A reference to an ObjC instance variable.
Definition: ExprObjC.h:548
ProgramPoints can be "tagged" as representing points specific to a given analysis entity.
Definition: ProgramPoint.h:38
A (possibly-)qualified type.
Definition: Type.h:736
ReturnStmt - This represents a return, optionally of an expression: return; return 4;.
Definition: Stmt.h:2840
A trivial tuple used to represent a source range.
It represents a stack frame of the call stack (based on CallEvent).
Stmt - This represents one statement.
Definition: Stmt.h:72
An ArgEffect summarizes the retain count behavior on an argument or receiver to a function or method.
Represents an abstract call to a function or method along a particular path.
Definition: CallEvent.h:153
Tag that can use a checker name as a message provider (see SimpleProgramPointTag).
Definition: Checker.h:509
RetEffect summarizes a call's retain/release behavior with respect to its return value.
Summary for a function with respect to ownership changes.
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
Definition: SVals.h:73
Symbolic value.
Definition: SymExpr.h:30
A class responsible for cleaning up unused symbols.
bool operator==(const RefVal &X) const
IvarAccessHistory
Tracks how an object referenced by an ivar has been used.
IvarAccessHistory getIvarAccessHistory() const
Returns what the analyzer knows about direct accesses to a particular instance variable.
bool hasSameState(const RefVal &X) const
static RefVal makeOwned(ObjKind o, QualType t)
Create a state for an object whose lifetime is the responsibility of the current function,...
void Profile(llvm::FoldingSetNodeID &ID) const
static RefVal makeNotOwned(ObjKind o, QualType t)
Create a state for an object whose lifetime is not the responsibility of the current function.
void checkPostStmt(const BlockExpr *BE, CheckerContext &C) const
void checkSummary(const RetainSummary &Summ, const CallEvent &Call, CheckerContext &C) const
ProgramStateRef handleSymbolDeath(ProgramStateRef state, SymbolRef sid, RefVal V, SmallVectorImpl< SymbolRef > &Leaked) const
static std::unique_ptr< CheckerProgramPointTag > CastFailTag
bool TrackObjCAndCFObjects
Track Objective-C and CoreFoundation objects.
ProgramStateRef evalAssume(ProgramStateRef state, SVal Cond, bool Assumption) const
static std::unique_ptr< CheckerProgramPointTag > DeallocSentTag
static const CheckerProgramPointTag & getCastFailTag()
void processNonLeakError(ProgramStateRef St, SourceRange ErrorRange, RefVal::Kind ErrorKind, SymbolRef Sym, CheckerContext &C) const
const RefCountBug & errorKindToBugKind(RefVal::Kind ErrorKind, SymbolRef Sym) const
void checkBind(SVal loc, SVal val, const Stmt *S, CheckerContext &C) const
ExplodedNode * checkReturnWithRetEffect(const ReturnStmt *S, CheckerContext &C, ExplodedNode *Pred, RetEffect RE, RefVal X, SymbolRef Sym, ProgramStateRef state) const
ProgramStateRef handleAutoreleaseCounts(ProgramStateRef state, ExplodedNode *Pred, const ProgramPointTag *Tag, CheckerContext &Ctx, SymbolRef Sym, RefVal V, const ReturnStmt *S=nullptr) const
ExplodedNode * processLeaks(ProgramStateRef state, SmallVectorImpl< SymbolRef > &Leaked, CheckerContext &Ctx, ExplodedNode *Pred=nullptr) const
ProgramStateRef updateSymbol(ProgramStateRef state, SymbolRef sym, RefVal V, ArgEffect E, RefVal::Kind &hasErr, CheckerContext &C) const
void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const
static const CheckerProgramPointTag & getDeallocSentTag()
std::unique_ptr< RetainSummaryManager > Summaries
void printState(raw_ostream &Out, ProgramStateRef State, const char *NL, const char *Sep) const override
See CheckerManager::runCheckersForPrintState.
bool evalCall(const CallEvent &Call, CheckerContext &C) const
void checkPostCall(const CallEvent &Call, CheckerContext &C) const
ProgramStateRef checkRegionChanges(ProgramStateRef state, const InvalidatedSymbols *invalidated, ArrayRef< const MemRegion * > ExplicitRegions, ArrayRef< const MemRegion * > Regions, const LocationContext *LCtx, const CallEvent *Call) const
void processObjCLiterals(CheckerContext &C, const Expr *Ex) const
void checkEndFunction(const ReturnStmt *RS, CheckerContext &C) const
RetainSummaryManager & getSummaryManager(CheckerContext &C) const
void processSummaryOfInlined(const RetainSummary &Summ, const CallEvent &Call, CheckerContext &C) const
RetainSummaryManager & getSummaryManager(ASTContext &Ctx) const
bool TrackNSCFStartParam
Track initial parameters (for the entry point) for NS/CF objects.
const RefVal * getRefBinding(ProgramStateRef State, SymbolRef Sym)
bool isSynthesizedAccessor(const StackFrameContext *SFC)
Returns true if this stack frame is for an Objective-C method that is a property getter or setter who...
ObjKind
Determines the object kind of a tracked object.
@ C
Languages that the frontend can parse and compile.