Go to the documentation of this file.
14 #ifndef LLVM_CLANG_LIB_STATICANALYZER_CHECKERS_RETAINCOUNTCHECKER_H
15 #define LLVM_CLANG_LIB_STATICANALYZER_CHECKERS_RETAINCOUNTCHECKER_H
36 #include "llvm/ADT/DenseMap.h"
37 #include "llvm/ADT/FoldingSet.h"
38 #include "llvm/ADT/ImmutableList.h"
39 #include "llvm/ADT/ImmutableMap.h"
40 #include "llvm/ADT/STLExtras.h"
41 #include "llvm/ADT/SmallString.h"
42 #include "llvm/ADT/StringExtras.h"
48 namespace retaincountchecker {
97 unsigned RawObjectKind : 3;
108 unsigned RawIvarAccessHistory : 2;
112 : Cnt(cnt), ACnt(acnt), T(t), RawKind(static_cast<
unsigned>(k)),
113 RawObjectKind(static_cast<
unsigned>(o)),
114 RawIvarAccessHistory(static_cast<
unsigned>(IvarAccess)) {
115 assert(
getKind() == k &&
"not enough bits for the kind");
116 assert(
getObjKind() == o &&
"not enough bits for the object kind");
124 return static_cast<ObjKind>(RawObjectKind);
218 return getKind() ==
X.getKind() && Cnt ==
X.Cnt && ACnt ==
X.ACnt &&
228 ID.AddInteger(RawKind);
231 ID.AddInteger(RawObjectKind);
232 ID.AddInteger(RawIvarAccessHistory);
235 void print(raw_ostream &Out)
const;
241 check::BeginFunction,
243 check::PostStmt<BlockExpr>,
244 check::PostStmt<CastExpr>,
245 check::PostStmt<ObjCArrayLiteral>,
246 check::PostStmt<ObjCDictionaryLiteral>,
247 check::PostStmt<ObjCBoxedExpr>,
248 check::PostStmt<ObjCIvarRefExpr>,
250 check::RegionChanges,
264 mutable std::unique_ptr<RetainSummaryManager>
Summaries;
292 const char *NL,
const char *Sep)
const override;
316 bool Assumption)
const;
385 auto Method = dyn_cast_or_null<ObjCMethodDecl>(SFC->
getDecl());
386 if (!Method || !Method->isPropertyAccessor())
void processNonLeakError(ProgramStateRef St, SourceRange ErrorRange, RefVal::Kind ErrorKind, SymbolRef Sym, CheckerContext &C) const
RefVal operator-(size_t i) const
ObjCBoxedExpr - used for generalized expression boxing.
static std::unique_ptr< CheckerProgramPointTag > DeallocSentTag
It wraps the AnalysisDeclContext to represent both the call stack with the help of StackFrameContext ...
A trivial tuple used to represent a source range.
bool isBodyAutosynthesized() const
unsigned getCombinedCounts() const
static const CheckerProgramPointTag & getDeallocSentTag()
ObjKind
Determines the object kind of a tracked object.
unsigned getAutoreleaseCount() const
ProgramPoints can be "tagged" as representing points specific to a given analysis entity.
A (possibly-)qualified type.
void checkSummary(const RetainSummary &Summ, const CallEvent &Call, CheckerContext &C) const
IvarAccessHistory
Tracks how an object referenced by an ivar has been used.
RefVal operator^(Kind k) const
static RefVal makeNotOwned(ObjKind o, QualType t)
Create a state for an object whose lifetime is not the responsibility of the current function.
It represents a stack frame of the call stack (based on CallEvent).
std::unique_ptr< RefCountBug > OverAutorelease
void checkPostStmt(const BlockExpr *BE, CheckerContext &C) const
void printState(raw_ostream &Out, ProgramStateRef State, const char *NL, const char *Sep) const override
See CheckerManager::runCheckersForPrintState.
const RefVal * getRefBinding(ProgramStateRef State, SymbolRef Sym)
ObjCArrayLiteral - used for objective-c array containers; as in: @["Hello", NSApp,...
void checkEndFunction(const ReturnStmt *RS, CheckerContext &C) const
void processObjCLiterals(CheckerContext &C, const Expr *Ex) const
void processSummaryOfInlined(const RetainSummary &Summ, const CallEvent &Call, CheckerContext &C) const
RefVal operator+(size_t i) const
void checkBind(SVal loc, SVal val, const Stmt *S, CheckerContext &C) const
AnalysisDeclContext * getAnalysisDeclContext() const
bool hasSameState(const RefVal &X) const
unsigned getCount() const
const RefCountBug & errorKindToBugKind(RefVal::Kind ErrorKind, SymbolRef Sym) const
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
ObjCDictionaryLiteral - AST node to represent objective-c dictionary literals; as in:"name" : NSUserN...
IvarAccessHistory getIvarAccessHistory() const
Returns what the analyzer knows about direct accesses to a particular instance variable.
RetainSummaryManager & getSummaryManager(ASTContext &Ctx) const
ProgramStateRef evalAssume(ProgramStateRef state, SVal Cond, bool Assumption) const
bool evalCall(const CallEvent &Call, CheckerContext &C) const
std::unique_ptr< RefCountBug > DeallocNotOwned
void setAutoreleaseCount(unsigned i)
A class responsible for cleaning up unused symbols.
RefVal autorelease() const
and static some checkers Checker The latter are built on top of the former via the Checker and CheckerVisitor and attempts to isolate them from much of the gore of the internal analysis the analyzer is basically a source code simulator that traces out possible paths of execution The state of the and the combination of state and program point is a node in an exploded which has the entry program point and initial state
static RefVal makeOwned(ObjKind o, QualType t)
Create a state for an object whose lifetime is the responsibility of the current function,...
std::unique_ptr< RefCountBug > UseAfterRelease
bool isSynthesizedAccessor(const StackFrameContext *SFC)
Returns true if this stack frame is for an Objective-C method that is a property getter or setter who...
@ ReleasedAfterDirectAccess
std::unique_ptr< RefCountBug > LeakWithinFunction
static std::unique_ptr< CheckerProgramPointTag > CastFailTag
void Profile(llvm::FoldingSetNodeID &ID) const
void setCount(unsigned i)
BlockExpr - Adaptor class for mixing a BlockDecl with expressions.
RefVal releaseViaIvar() const
Summary for a function with respect to ownership changes.
ExplodedNode * checkReturnWithRetEffect(const ReturnStmt *S, CheckerContext &C, ExplodedNode *Pred, RetEffect RE, RefVal X, SymbolRef Sym, ProgramStateRef state) const
std::unique_ptr< RefCountBug > ReturnNotOwnedForOwned
std::unique_ptr< RetainSummaryManager > Summaries
std::unique_ptr< RefCountBug > LeakAtReturn
Tag that can use a checker name as a message provider (see SimpleProgramPointTag).
RetainSummaryManager & getSummaryManager(CheckerContext &C) const
void checkBeginFunction(CheckerContext &C) const
An ArgEffect summarizes the retain count behavior on an argument or receiver to a function or method.
Stmt - This represents one statement.
Represents an abstract call to a function or method along a particular path.
bool TrackOSObjects
Track sublcasses of OSObject.
ObjKind getObjKind() const
void print(raw_ostream &Out) const
bool isReturnedOwned() const
RetEffect summarizes a call's retain/release behavior with respect to its return value.
void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
RefVal withIvarAccess() const
ProgramStateRef handleSymbolDeath(ProgramStateRef state, SymbolRef sid, RefVal V, SmallVectorImpl< SymbolRef > &Leaked) const
ProgramStateRef updateSymbol(ProgramStateRef state, SymbolRef sym, RefVal V, ArgEffect E, RefVal::Kind &hasErr, CheckerContext &C) const
This represents one expression.
ProgramStateRef checkRegionChanges(ProgramStateRef state, const InvalidatedSymbols *invalidated, ArrayRef< const MemRegion * > ExplicitRegions, ArrayRef< const MemRegion * > Regions, const LocationContext *LCtx, const CallEvent *Call) const
ExplodedNode * processLeaks(ProgramStateRef state, SmallVectorImpl< SymbolRef > &Leaked, CheckerContext &Ctx, ExplodedNode *Pred=nullptr) const
bool TrackNSCFStartParam
Track initial parameters (for the entry point) for NS/CF objects.
CastExpr - Base class for type casts, including both implicit casts (ImplicitCastExpr) and explicit c...
ProgramStateRef handleAutoreleaseCounts(ProgramStateRef state, ExplodedNode *Pred, const ProgramPointTag *Tag, CheckerContext &Ctx, SymbolRef Sym, RefVal V, const ReturnStmt *S=nullptr) const
void checkPostCall(const CallEvent &Call, CheckerContext &C) const
const Decl * getDecl() const
bool operator==(const RefVal &X) const
std::unique_ptr< RefCountBug > ReleaseNotOwned
static const CheckerProgramPointTag & getCastFailTag()
ObjCIvarRefExpr - A reference to an ObjC instance variable.
std::unique_ptr< RefCountBug > FreeNotOwned
ReturnStmt - This represents a return, optionally of an expression: return; return 4;.
bool TrackObjCAndCFObjects
Track Objective-C and CoreFoundation objects.
bool isReturnedNotOwned() const