123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545 |
- //==-- RetainCountChecker.cpp - Checks for leaks and other issues -*- C++ -*--//
- //
- // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
- // See https://llvm.org/LICENSE.txt for license information.
- // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
- //
- //===----------------------------------------------------------------------===//
- //
- // This file defines the methods for RetainCountChecker, which implements
- // a reference count checker for Core Foundation and Cocoa on (Mac OS X).
- //
- //===----------------------------------------------------------------------===//
- #include "RetainCountChecker.h"
- #include "clang/StaticAnalyzer/Core/Checker.h"
- #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
- using namespace clang;
- using namespace ento;
- using namespace retaincountchecker;
- REGISTER_MAP_WITH_PROGRAMSTATE(RefBindings, SymbolRef, RefVal)
- namespace clang {
- namespace ento {
- namespace retaincountchecker {
- const RefVal *getRefBinding(ProgramStateRef State, SymbolRef Sym) {
- return State->get<RefBindings>(Sym);
- }
- } // end namespace retaincountchecker
- } // end namespace ento
- } // end namespace clang
- static ProgramStateRef setRefBinding(ProgramStateRef State, SymbolRef Sym,
- RefVal Val) {
- assert(Sym != nullptr);
- return State->set<RefBindings>(Sym, Val);
- }
- static ProgramStateRef removeRefBinding(ProgramStateRef State, SymbolRef Sym) {
- return State->remove<RefBindings>(Sym);
- }
- void RefVal::print(raw_ostream &Out) const {
- if (!T.isNull())
- Out << "Tracked " << T.getAsString() << " | ";
- switch (getKind()) {
- default: llvm_unreachable("Invalid RefVal kind");
- case Owned: {
- Out << "Owned";
- unsigned cnt = getCount();
- if (cnt) Out << " (+ " << cnt << ")";
- break;
- }
- case NotOwned: {
- Out << "NotOwned";
- unsigned cnt = getCount();
- if (cnt) Out << " (+ " << cnt << ")";
- break;
- }
- case ReturnedOwned: {
- Out << "ReturnedOwned";
- unsigned cnt = getCount();
- if (cnt) Out << " (+ " << cnt << ")";
- break;
- }
- case ReturnedNotOwned: {
- Out << "ReturnedNotOwned";
- unsigned cnt = getCount();
- if (cnt) Out << " (+ " << cnt << ")";
- break;
- }
- case Released:
- Out << "Released";
- break;
- case ErrorDeallocNotOwned:
- Out << "-dealloc (not-owned)";
- break;
- case ErrorLeak:
- Out << "Leaked";
- break;
- case ErrorLeakReturned:
- Out << "Leaked (Bad naming)";
- break;
- case ErrorUseAfterRelease:
- Out << "Use-After-Release [ERROR]";
- break;
- case ErrorReleaseNotOwned:
- Out << "Release of Not-Owned [ERROR]";
- break;
- case RefVal::ErrorOverAutorelease:
- Out << "Over-autoreleased";
- break;
- case RefVal::ErrorReturnedNotOwned:
- Out << "Non-owned object returned instead of owned";
- break;
- }
- switch (getIvarAccessHistory()) {
- case IvarAccessHistory::None:
- break;
- case IvarAccessHistory::AccessedDirectly:
- Out << " [direct ivar access]";
- break;
- case IvarAccessHistory::ReleasedAfterDirectAccess:
- Out << " [released after direct ivar access]";
- }
- if (ACnt) {
- Out << " [autorelease -" << ACnt << ']';
- }
- }
- namespace {
- class StopTrackingCallback final : public SymbolVisitor {
- ProgramStateRef state;
- public:
- StopTrackingCallback(ProgramStateRef st) : state(std::move(st)) {}
- ProgramStateRef getState() const { return state; }
- bool VisitSymbol(SymbolRef sym) override {
- state = removeRefBinding(state, sym);
- return true;
- }
- };
- } // end anonymous namespace
- //===----------------------------------------------------------------------===//
- // Handle statements that may have an effect on refcounts.
- //===----------------------------------------------------------------------===//
- void RetainCountChecker::checkPostStmt(const BlockExpr *BE,
- CheckerContext &C) const {
- // Scan the BlockDecRefExprs for any object the retain count checker
- // may be tracking.
- if (!BE->getBlockDecl()->hasCaptures())
- return;
- ProgramStateRef state = C.getState();
- auto *R = cast<BlockDataRegion>(C.getSVal(BE).getAsRegion());
- BlockDataRegion::referenced_vars_iterator I = R->referenced_vars_begin(),
- E = R->referenced_vars_end();
- if (I == E)
- return;
- // FIXME: For now we invalidate the tracking of all symbols passed to blocks
- // via captured variables, even though captured variables result in a copy
- // and in implicit increment/decrement of a retain count.
- SmallVector<const MemRegion*, 10> Regions;
- const LocationContext *LC = C.getLocationContext();
- MemRegionManager &MemMgr = C.getSValBuilder().getRegionManager();
- for ( ; I != E; ++I) {
- const VarRegion *VR = I.getCapturedRegion();
- if (VR->getSuperRegion() == R) {
- VR = MemMgr.getVarRegion(VR->getDecl(), LC);
- }
- Regions.push_back(VR);
- }
- state = state->scanReachableSymbols<StopTrackingCallback>(Regions).getState();
- C.addTransition(state);
- }
- void RetainCountChecker::checkPostStmt(const CastExpr *CE,
- CheckerContext &C) const {
- const ObjCBridgedCastExpr *BE = dyn_cast<ObjCBridgedCastExpr>(CE);
- if (!BE)
- return;
- QualType QT = CE->getType();
- ObjKind K;
- if (QT->isObjCObjectPointerType()) {
- K = ObjKind::ObjC;
- } else {
- K = ObjKind::CF;
- }
- ArgEffect AE = ArgEffect(IncRef, K);
- switch (BE->getBridgeKind()) {
- case OBC_Bridge:
- // Do nothing.
- return;
- case OBC_BridgeRetained:
- AE = AE.withKind(IncRef);
- break;
- case OBC_BridgeTransfer:
- AE = AE.withKind(DecRefBridgedTransferred);
- break;
- }
- ProgramStateRef state = C.getState();
- SymbolRef Sym = C.getSVal(CE).getAsLocSymbol();
- if (!Sym)
- return;
- const RefVal* T = getRefBinding(state, Sym);
- if (!T)
- return;
- RefVal::Kind hasErr = (RefVal::Kind) 0;
- state = updateSymbol(state, Sym, *T, AE, hasErr, C);
- if (hasErr) {
- // FIXME: If we get an error during a bridge cast, should we report it?
- return;
- }
- C.addTransition(state);
- }
- void RetainCountChecker::processObjCLiterals(CheckerContext &C,
- const Expr *Ex) const {
- ProgramStateRef state = C.getState();
- const ExplodedNode *pred = C.getPredecessor();
- for (const Stmt *Child : Ex->children()) {
- SVal V = pred->getSVal(Child);
- if (SymbolRef sym = V.getAsSymbol())
- if (const RefVal* T = getRefBinding(state, sym)) {
- RefVal::Kind hasErr = (RefVal::Kind) 0;
- state = updateSymbol(state, sym, *T,
- ArgEffect(MayEscape, ObjKind::ObjC), hasErr, C);
- if (hasErr) {
- processNonLeakError(state, Child->getSourceRange(), hasErr, sym, C);
- return;
- }
- }
- }
- // Return the object as autoreleased.
- // RetEffect RE = RetEffect::MakeNotOwned(ObjKind::ObjC);
- if (SymbolRef sym =
- state->getSVal(Ex, pred->getLocationContext()).getAsSymbol()) {
- QualType ResultTy = Ex->getType();
- state = setRefBinding(state, sym,
- RefVal::makeNotOwned(ObjKind::ObjC, ResultTy));
- }
- C.addTransition(state);
- }
- void RetainCountChecker::checkPostStmt(const ObjCArrayLiteral *AL,
- CheckerContext &C) const {
- // Apply the 'MayEscape' to all values.
- processObjCLiterals(C, AL);
- }
- void RetainCountChecker::checkPostStmt(const ObjCDictionaryLiteral *DL,
- CheckerContext &C) const {
- // Apply the 'MayEscape' to all keys and values.
- processObjCLiterals(C, DL);
- }
- void RetainCountChecker::checkPostStmt(const ObjCBoxedExpr *Ex,
- CheckerContext &C) const {
- const ExplodedNode *Pred = C.getPredecessor();
- ProgramStateRef State = Pred->getState();
- if (SymbolRef Sym = Pred->getSVal(Ex).getAsSymbol()) {
- QualType ResultTy = Ex->getType();
- State = setRefBinding(State, Sym,
- RefVal::makeNotOwned(ObjKind::ObjC, ResultTy));
- }
- C.addTransition(State);
- }
- void RetainCountChecker::checkPostStmt(const ObjCIvarRefExpr *IRE,
- CheckerContext &C) const {
- Optional<Loc> IVarLoc = C.getSVal(IRE).getAs<Loc>();
- if (!IVarLoc)
- return;
- ProgramStateRef State = C.getState();
- SymbolRef Sym = State->getSVal(*IVarLoc).getAsSymbol();
- if (!Sym || !isa_and_nonnull<ObjCIvarRegion>(Sym->getOriginRegion()))
- return;
- // Accessing an ivar directly is unusual. If we've done that, be more
- // forgiving about what the surrounding code is allowed to do.
- QualType Ty = Sym->getType();
- ObjKind Kind;
- if (Ty->isObjCRetainableType())
- Kind = ObjKind::ObjC;
- else if (coreFoundation::isCFObjectRef(Ty))
- Kind = ObjKind::CF;
- else
- return;
- // If the value is already known to be nil, don't bother tracking it.
- ConstraintManager &CMgr = State->getConstraintManager();
- if (CMgr.isNull(State, Sym).isConstrainedTrue())
- return;
- if (const RefVal *RV = getRefBinding(State, Sym)) {
- // If we've seen this symbol before, or we're only seeing it now because
- // of something the analyzer has synthesized, don't do anything.
- if (RV->getIvarAccessHistory() != RefVal::IvarAccessHistory::None ||
- isSynthesizedAccessor(C.getStackFrame())) {
- return;
- }
- // Note that this value has been loaded from an ivar.
- C.addTransition(setRefBinding(State, Sym, RV->withIvarAccess()));
- return;
- }
- RefVal PlusZero = RefVal::makeNotOwned(Kind, Ty);
- // In a synthesized accessor, the effective retain count is +0.
- if (isSynthesizedAccessor(C.getStackFrame())) {
- C.addTransition(setRefBinding(State, Sym, PlusZero));
- return;
- }
- State = setRefBinding(State, Sym, PlusZero.withIvarAccess());
- C.addTransition(State);
- }
- static bool isReceiverUnconsumedSelf(const CallEvent &Call) {
- if (const auto *MC = dyn_cast<ObjCMethodCall>(&Call)) {
- // Check if the message is not consumed, we know it will not be used in
- // an assignment, ex: "self = [super init]".
- return MC->getMethodFamily() == OMF_init && MC->isReceiverSelfOrSuper() &&
- !Call.getLocationContext()
- ->getAnalysisDeclContext()
- ->getParentMap()
- .isConsumedExpr(Call.getOriginExpr());
- }
- return false;
- }
- const static RetainSummary *getSummary(RetainSummaryManager &Summaries,
- const CallEvent &Call,
- QualType ReceiverType) {
- const Expr *CE = Call.getOriginExpr();
- AnyCall C =
- CE ? *AnyCall::forExpr(CE)
- : AnyCall(cast<CXXDestructorDecl>(Call.getDecl()));
- return Summaries.getSummary(C, Call.hasNonZeroCallbackArg(),
- isReceiverUnconsumedSelf(Call), ReceiverType);
- }
- void RetainCountChecker::checkPostCall(const CallEvent &Call,
- CheckerContext &C) const {
- RetainSummaryManager &Summaries = getSummaryManager(C);
- // Leave null if no receiver.
- QualType ReceiverType;
- if (const auto *MC = dyn_cast<ObjCMethodCall>(&Call)) {
- if (MC->isInstanceMessage()) {
- SVal ReceiverV = MC->getReceiverSVal();
- if (SymbolRef Sym = ReceiverV.getAsLocSymbol())
- if (const RefVal *T = getRefBinding(C.getState(), Sym))
- ReceiverType = T->getType();
- }
- }
- const RetainSummary *Summ = getSummary(Summaries, Call, ReceiverType);
- if (C.wasInlined) {
- processSummaryOfInlined(*Summ, Call, C);
- return;
- }
- checkSummary(*Summ, Call, C);
- }
- /// GetReturnType - Used to get the return type of a message expression or
- /// function call with the intention of affixing that type to a tracked symbol.
- /// While the return type can be queried directly from RetEx, when
- /// invoking class methods we augment to the return type to be that of
- /// a pointer to the class (as opposed it just being id).
- // FIXME: We may be able to do this with related result types instead.
- // This function is probably overestimating.
- static QualType GetReturnType(const Expr *RetE, ASTContext &Ctx) {
- QualType RetTy = RetE->getType();
- // If RetE is not a message expression just return its type.
- // If RetE is a message expression, return its types if it is something
- /// more specific than id.
- if (const ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(RetE))
- if (const ObjCObjectPointerType *PT = RetTy->getAs<ObjCObjectPointerType>())
- if (PT->isObjCQualifiedIdType() || PT->isObjCIdType() ||
- PT->isObjCClassType()) {
- // At this point we know the return type of the message expression is
- // id, id<...>, or Class. If we have an ObjCInterfaceDecl, we know this
- // is a call to a class method whose type we can resolve. In such
- // cases, promote the return type to XXX* (where XXX is the class).
- const ObjCInterfaceDecl *D = ME->getReceiverInterface();
- return !D ? RetTy :
- Ctx.getObjCObjectPointerType(Ctx.getObjCInterfaceType(D));
- }
- return RetTy;
- }
- static Optional<RefVal> refValFromRetEffect(RetEffect RE,
- QualType ResultTy) {
- if (RE.isOwned()) {
- return RefVal::makeOwned(RE.getObjKind(), ResultTy);
- } else if (RE.notOwned()) {
- return RefVal::makeNotOwned(RE.getObjKind(), ResultTy);
- }
- return None;
- }
- static bool isPointerToObject(QualType QT) {
- QualType PT = QT->getPointeeType();
- if (!PT.isNull())
- if (PT->getAsCXXRecordDecl())
- return true;
- return false;
- }
- /// Whether the tracked value should be escaped on a given call.
- /// OSObjects are escaped when passed to void * / etc.
- static bool shouldEscapeOSArgumentOnCall(const CallEvent &CE, unsigned ArgIdx,
- const RefVal *TrackedValue) {
- if (TrackedValue->getObjKind() != ObjKind::OS)
- return false;
- if (ArgIdx >= CE.parameters().size())
- return false;
- return !isPointerToObject(CE.parameters()[ArgIdx]->getType());
- }
- // We don't always get the exact modeling of the function with regards to the
- // retain count checker even when the function is inlined. For example, we need
- // to stop tracking the symbols which were marked with StopTrackingHard.
- void RetainCountChecker::processSummaryOfInlined(const RetainSummary &Summ,
- const CallEvent &CallOrMsg,
- CheckerContext &C) const {
- ProgramStateRef state = C.getState();
- // Evaluate the effect of the arguments.
- for (unsigned idx = 0, e = CallOrMsg.getNumArgs(); idx != e; ++idx) {
- SVal V = CallOrMsg.getArgSVal(idx);
- if (SymbolRef Sym = V.getAsLocSymbol()) {
- bool ShouldRemoveBinding = Summ.getArg(idx).getKind() == StopTrackingHard;
- if (const RefVal *T = getRefBinding(state, Sym))
- if (shouldEscapeOSArgumentOnCall(CallOrMsg, idx, T))
- ShouldRemoveBinding = true;
- if (ShouldRemoveBinding)
- state = removeRefBinding(state, Sym);
- }
- }
- // Evaluate the effect on the message receiver.
- if (const auto *MsgInvocation = dyn_cast<ObjCMethodCall>(&CallOrMsg)) {
- if (SymbolRef Sym = MsgInvocation->getReceiverSVal().getAsLocSymbol()) {
- if (Summ.getReceiverEffect().getKind() == StopTrackingHard) {
- state = removeRefBinding(state, Sym);
- }
- }
- }
- // Consult the summary for the return value.
- RetEffect RE = Summ.getRetEffect();
- if (SymbolRef Sym = CallOrMsg.getReturnValue().getAsSymbol()) {
- if (RE.getKind() == RetEffect::NoRetHard)
- state = removeRefBinding(state, Sym);
- }
- C.addTransition(state);
- }
- static bool isSmartPtrField(const MemRegion *MR) {
- const auto *TR = dyn_cast<TypedValueRegion>(
- cast<SubRegion>(MR)->getSuperRegion());
- return TR && RetainSummaryManager::isKnownSmartPointer(TR->getValueType());
- }
- /// A value escapes in these possible cases:
- ///
- /// - binding to something that is not a memory region.
- /// - binding to a memregion that does not have stack storage
- /// - binding to a variable that has a destructor attached using CleanupAttr
- ///
- /// We do not currently model what happens when a symbol is
- /// assigned to a struct field, unless it is a known smart pointer
- /// implementation, about which we know that it is inlined.
- /// FIXME: This could definitely be improved upon.
- static bool shouldEscapeRegion(const MemRegion *R) {
- if (isSmartPtrField(R))
- return false;
- const auto *VR = dyn_cast<VarRegion>(R);
- if (!R->hasStackStorage() || !VR)
- return true;
- const VarDecl *VD = VR->getDecl();
- if (!VD->hasAttr<CleanupAttr>())
- return false; // CleanupAttr attaches destructors, which cause escaping.
- return true;
- }
- static SmallVector<ProgramStateRef, 2>
- updateOutParameters(ProgramStateRef State, const RetainSummary &Summ,
- const CallEvent &CE) {
- SVal L = CE.getReturnValue();
- // Splitting is required to support out parameters,
- // as out parameters might be created only on the "success" branch.
- // We want to avoid eagerly splitting unless out parameters are actually
- // needed.
- bool SplitNecessary = false;
- for (auto &P : Summ.getArgEffects())
- if (P.second.getKind() == RetainedOutParameterOnNonZero ||
- P.second.getKind() == RetainedOutParameterOnZero)
- SplitNecessary = true;
- ProgramStateRef AssumeNonZeroReturn = State;
- ProgramStateRef AssumeZeroReturn = State;
- if (SplitNecessary) {
- if (!CE.getResultType()->isScalarType()) {
- // Structures cannot be assumed. This probably deserves
- // a compiler warning for invalid annotations.
- return {State};
- }
- if (auto DL = L.getAs<DefinedOrUnknownSVal>()) {
- AssumeNonZeroReturn = AssumeNonZeroReturn->assume(*DL, true);
- AssumeZeroReturn = AssumeZeroReturn->assume(*DL, false);
- }
- }
- for (unsigned idx = 0, e = CE.getNumArgs(); idx != e; ++idx) {
- SVal ArgVal = CE.getArgSVal(idx);
- ArgEffect AE = Summ.getArg(idx);
- auto *ArgRegion = dyn_cast_or_null<TypedValueRegion>(ArgVal.getAsRegion());
- if (!ArgRegion)
- continue;
- QualType PointeeTy = ArgRegion->getValueType();
- SVal PointeeVal = State->getSVal(ArgRegion);
- SymbolRef Pointee = PointeeVal.getAsLocSymbol();
- if (!Pointee)
- continue;
- if (shouldEscapeRegion(ArgRegion))
- continue;
- auto makeNotOwnedParameter = [&](ProgramStateRef St) {
- return setRefBinding(St, Pointee,
- RefVal::makeNotOwned(AE.getObjKind(), PointeeTy));
- };
- auto makeOwnedParameter = [&](ProgramStateRef St) {
- return setRefBinding(St, Pointee,
- RefVal::makeOwned(ObjKind::OS, PointeeTy));
- };
- switch (AE.getKind()) {
- case UnretainedOutParameter:
- AssumeNonZeroReturn = makeNotOwnedParameter(AssumeNonZeroReturn);
- AssumeZeroReturn = makeNotOwnedParameter(AssumeZeroReturn);
- break;
- case RetainedOutParameter:
- AssumeNonZeroReturn = makeOwnedParameter(AssumeNonZeroReturn);
- AssumeZeroReturn = makeOwnedParameter(AssumeZeroReturn);
- break;
- case RetainedOutParameterOnNonZero:
- AssumeNonZeroReturn = makeOwnedParameter(AssumeNonZeroReturn);
- break;
- case RetainedOutParameterOnZero:
- AssumeZeroReturn = makeOwnedParameter(AssumeZeroReturn);
- break;
- default:
- break;
- }
- }
- if (SplitNecessary) {
- return {AssumeNonZeroReturn, AssumeZeroReturn};
- } else {
- assert(AssumeZeroReturn == AssumeNonZeroReturn);
- return {AssumeZeroReturn};
- }
- }
- void RetainCountChecker::checkSummary(const RetainSummary &Summ,
- const CallEvent &CallOrMsg,
- CheckerContext &C) const {
- ProgramStateRef state = C.getState();
- // Evaluate the effect of the arguments.
- RefVal::Kind hasErr = (RefVal::Kind) 0;
- SourceRange ErrorRange;
- SymbolRef ErrorSym = nullptr;
- // Helper tag for providing diagnostics: indicate whether dealloc was sent
- // at this location.
- bool DeallocSent = false;
- for (unsigned idx = 0, e = CallOrMsg.getNumArgs(); idx != e; ++idx) {
- SVal V = CallOrMsg.getArgSVal(idx);
- ArgEffect Effect = Summ.getArg(idx);
- if (SymbolRef Sym = V.getAsLocSymbol()) {
- if (const RefVal *T = getRefBinding(state, Sym)) {
- if (shouldEscapeOSArgumentOnCall(CallOrMsg, idx, T))
- Effect = ArgEffect(StopTrackingHard, ObjKind::OS);
- state = updateSymbol(state, Sym, *T, Effect, hasErr, C);
- if (hasErr) {
- ErrorRange = CallOrMsg.getArgSourceRange(idx);
- ErrorSym = Sym;
- break;
- } else if (Effect.getKind() == Dealloc) {
- DeallocSent = true;
- }
- }
- }
- }
- // Evaluate the effect on the message receiver / `this` argument.
- bool ReceiverIsTracked = false;
- if (!hasErr) {
- if (const auto *MsgInvocation = dyn_cast<ObjCMethodCall>(&CallOrMsg)) {
- if (SymbolRef Sym = MsgInvocation->getReceiverSVal().getAsLocSymbol()) {
- if (const RefVal *T = getRefBinding(state, Sym)) {
- ReceiverIsTracked = true;
- state = updateSymbol(state, Sym, *T,
- Summ.getReceiverEffect(), hasErr, C);
- if (hasErr) {
- ErrorRange = MsgInvocation->getOriginExpr()->getReceiverRange();
- ErrorSym = Sym;
- } else if (Summ.getReceiverEffect().getKind() == Dealloc) {
- DeallocSent = true;
- }
- }
- }
- } else if (const auto *MCall = dyn_cast<CXXMemberCall>(&CallOrMsg)) {
- if (SymbolRef Sym = MCall->getCXXThisVal().getAsLocSymbol()) {
- if (const RefVal *T = getRefBinding(state, Sym)) {
- state = updateSymbol(state, Sym, *T, Summ.getThisEffect(),
- hasErr, C);
- if (hasErr) {
- ErrorRange = MCall->getOriginExpr()->getSourceRange();
- ErrorSym = Sym;
- }
- }
- }
- }
- }
- // Process any errors.
- if (hasErr) {
- processNonLeakError(state, ErrorRange, hasErr, ErrorSym, C);
- return;
- }
- // Consult the summary for the return value.
- RetEffect RE = Summ.getRetEffect();
- if (RE.getKind() == RetEffect::OwnedWhenTrackedReceiver) {
- if (ReceiverIsTracked)
- RE = getSummaryManager(C).getObjAllocRetEffect();
- else
- RE = RetEffect::MakeNoRet();
- }
- if (SymbolRef Sym = CallOrMsg.getReturnValue().getAsSymbol()) {
- QualType ResultTy = CallOrMsg.getResultType();
- if (RE.notOwned()) {
- const Expr *Ex = CallOrMsg.getOriginExpr();
- assert(Ex);
- ResultTy = GetReturnType(Ex, C.getASTContext());
- }
- if (Optional<RefVal> updatedRefVal = refValFromRetEffect(RE, ResultTy))
- state = setRefBinding(state, Sym, *updatedRefVal);
- }
- SmallVector<ProgramStateRef, 2> Out =
- updateOutParameters(state, Summ, CallOrMsg);
- for (ProgramStateRef St : Out) {
- if (DeallocSent) {
- C.addTransition(St, C.getPredecessor(), &getDeallocSentTag());
- } else {
- C.addTransition(St);
- }
- }
- }
- ProgramStateRef RetainCountChecker::updateSymbol(ProgramStateRef state,
- SymbolRef sym, RefVal V,
- ArgEffect AE,
- RefVal::Kind &hasErr,
- CheckerContext &C) const {
- bool IgnoreRetainMsg = (bool)C.getASTContext().getLangOpts().ObjCAutoRefCount;
- if (AE.getObjKind() == ObjKind::ObjC && IgnoreRetainMsg) {
- switch (AE.getKind()) {
- default:
- break;
- case IncRef:
- AE = AE.withKind(DoNothing);
- break;
- case DecRef:
- AE = AE.withKind(DoNothing);
- break;
- case DecRefAndStopTrackingHard:
- AE = AE.withKind(StopTracking);
- break;
- }
- }
- // Handle all use-after-releases.
- if (V.getKind() == RefVal::Released) {
- V = V ^ RefVal::ErrorUseAfterRelease;
- hasErr = V.getKind();
- return setRefBinding(state, sym, V);
- }
- switch (AE.getKind()) {
- case UnretainedOutParameter:
- case RetainedOutParameter:
- case RetainedOutParameterOnZero:
- case RetainedOutParameterOnNonZero:
- llvm_unreachable("Applies to pointer-to-pointer parameters, which should "
- "not have ref state.");
- case Dealloc: // NB. we only need to add a note in a non-error case.
- switch (V.getKind()) {
- default:
- llvm_unreachable("Invalid RefVal state for an explicit dealloc.");
- case RefVal::Owned:
- // The object immediately transitions to the released state.
- V = V ^ RefVal::Released;
- V.clearCounts();
- return setRefBinding(state, sym, V);
- case RefVal::NotOwned:
- V = V ^ RefVal::ErrorDeallocNotOwned;
- hasErr = V.getKind();
- break;
- }
- break;
- case MayEscape:
- if (V.getKind() == RefVal::Owned) {
- V = V ^ RefVal::NotOwned;
- break;
- }
- LLVM_FALLTHROUGH;
- case DoNothing:
- return state;
- case Autorelease:
- // Update the autorelease counts.
- V = V.autorelease();
- break;
- case StopTracking:
- case StopTrackingHard:
- return removeRefBinding(state, sym);
- case IncRef:
- switch (V.getKind()) {
- default:
- llvm_unreachable("Invalid RefVal state for a retain.");
- case RefVal::Owned:
- case RefVal::NotOwned:
- V = V + 1;
- break;
- }
- break;
- case DecRef:
- case DecRefBridgedTransferred:
- case DecRefAndStopTrackingHard:
- switch (V.getKind()) {
- default:
- // case 'RefVal::Released' handled above.
- llvm_unreachable("Invalid RefVal state for a release.");
- case RefVal::Owned:
- assert(V.getCount() > 0);
- if (V.getCount() == 1) {
- if (AE.getKind() == DecRefBridgedTransferred ||
- V.getIvarAccessHistory() ==
- RefVal::IvarAccessHistory::AccessedDirectly)
- V = V ^ RefVal::NotOwned;
- else
- V = V ^ RefVal::Released;
- } else if (AE.getKind() == DecRefAndStopTrackingHard) {
- return removeRefBinding(state, sym);
- }
- V = V - 1;
- break;
- case RefVal::NotOwned:
- if (V.getCount() > 0) {
- if (AE.getKind() == DecRefAndStopTrackingHard)
- return removeRefBinding(state, sym);
- V = V - 1;
- } else if (V.getIvarAccessHistory() ==
- RefVal::IvarAccessHistory::AccessedDirectly) {
- // Assume that the instance variable was holding on the object at
- // +1, and we just didn't know.
- if (AE.getKind() == DecRefAndStopTrackingHard)
- return removeRefBinding(state, sym);
- V = V.releaseViaIvar() ^ RefVal::Released;
- } else {
- V = V ^ RefVal::ErrorReleaseNotOwned;
- hasErr = V.getKind();
- }
- break;
- }
- break;
- }
- return setRefBinding(state, sym, V);
- }
- const RefCountBug &
- RetainCountChecker::errorKindToBugKind(RefVal::Kind ErrorKind,
- SymbolRef Sym) const {
- switch (ErrorKind) {
- case RefVal::ErrorUseAfterRelease:
- return *UseAfterRelease;
- case RefVal::ErrorReleaseNotOwned:
- return *ReleaseNotOwned;
- case RefVal::ErrorDeallocNotOwned:
- if (Sym->getType()->getPointeeCXXRecordDecl())
- return *FreeNotOwned;
- return *DeallocNotOwned;
- default:
- llvm_unreachable("Unhandled error.");
- }
- }
- void RetainCountChecker::processNonLeakError(ProgramStateRef St,
- SourceRange ErrorRange,
- RefVal::Kind ErrorKind,
- SymbolRef Sym,
- CheckerContext &C) const {
- // HACK: Ignore retain-count issues on values accessed through ivars,
- // because of cases like this:
- // [_contentView retain];
- // [_contentView removeFromSuperview];
- // [self addSubview:_contentView]; // invalidates 'self'
- // [_contentView release];
- if (const RefVal *RV = getRefBinding(St, Sym))
- if (RV->getIvarAccessHistory() != RefVal::IvarAccessHistory::None)
- return;
- ExplodedNode *N = C.generateErrorNode(St);
- if (!N)
- return;
- auto report = std::make_unique<RefCountReport>(
- errorKindToBugKind(ErrorKind, Sym),
- C.getASTContext().getLangOpts(), N, Sym);
- report->addRange(ErrorRange);
- C.emitReport(std::move(report));
- }
- //===----------------------------------------------------------------------===//
- // Handle the return values of retain-count-related functions.
- //===----------------------------------------------------------------------===//
- bool RetainCountChecker::evalCall(const CallEvent &Call,
- CheckerContext &C) const {
- ProgramStateRef state = C.getState();
- const auto *FD = dyn_cast_or_null<FunctionDecl>(Call.getDecl());
- if (!FD)
- return false;
- const auto *CE = dyn_cast_or_null<CallExpr>(Call.getOriginExpr());
- if (!CE)
- return false;
- RetainSummaryManager &SmrMgr = getSummaryManager(C);
- QualType ResultTy = Call.getResultType();
- // See if the function has 'rc_ownership_trusted_implementation'
- // annotate attribute. If it does, we will not inline it.
- bool hasTrustedImplementationAnnotation = false;
- const LocationContext *LCtx = C.getLocationContext();
- using BehaviorSummary = RetainSummaryManager::BehaviorSummary;
- Optional<BehaviorSummary> BSmr =
- SmrMgr.canEval(CE, FD, hasTrustedImplementationAnnotation);
- // See if it's one of the specific functions we know how to eval.
- if (!BSmr)
- return false;
- // Bind the return value.
- if (BSmr == BehaviorSummary::Identity ||
- BSmr == BehaviorSummary::IdentityOrZero ||
- BSmr == BehaviorSummary::IdentityThis) {
- const Expr *BindReturnTo =
- (BSmr == BehaviorSummary::IdentityThis)
- ? cast<CXXMemberCallExpr>(CE)->getImplicitObjectArgument()
- : CE->getArg(0);
- SVal RetVal = state->getSVal(BindReturnTo, LCtx);
- // If the receiver is unknown or the function has
- // 'rc_ownership_trusted_implementation' annotate attribute, conjure a
- // return value.
- // FIXME: this branch is very strange.
- if (RetVal.isUnknown() ||
- (hasTrustedImplementationAnnotation && !ResultTy.isNull())) {
- SValBuilder &SVB = C.getSValBuilder();
- RetVal =
- SVB.conjureSymbolVal(nullptr, CE, LCtx, ResultTy, C.blockCount());
- }
- // Bind the value.
- state = state->BindExpr(CE, LCtx, RetVal, /*Invalidate=*/false);
- if (BSmr == BehaviorSummary::IdentityOrZero) {
- // Add a branch where the output is zero.
- ProgramStateRef NullOutputState = C.getState();
- // Assume that output is zero on the other branch.
- NullOutputState = NullOutputState->BindExpr(
- CE, LCtx, C.getSValBuilder().makeNull(), /*Invalidate=*/false);
- C.addTransition(NullOutputState, &getCastFailTag());
- // And on the original branch assume that both input and
- // output are non-zero.
- if (auto L = RetVal.getAs<DefinedOrUnknownSVal>())
- state = state->assume(*L, /*assumption=*/true);
- }
- }
- C.addTransition(state);
- return true;
- }
- ExplodedNode * RetainCountChecker::processReturn(const ReturnStmt *S,
- CheckerContext &C) const {
- ExplodedNode *Pred = C.getPredecessor();
- // Only adjust the reference count if this is the top-level call frame,
- // and not the result of inlining. In the future, we should do
- // better checking even for inlined calls, and see if they match
- // with their expected semantics (e.g., the method should return a retained
- // object, etc.).
- if (!C.inTopFrame())
- return Pred;
- if (!S)
- return Pred;
- const Expr *RetE = S->getRetValue();
- if (!RetE)
- return Pred;
- ProgramStateRef state = C.getState();
- // We need to dig down to the symbolic base here because various
- // custom allocators do sometimes return the symbol with an offset.
- SymbolRef Sym = state->getSValAsScalarOrLoc(RetE, C.getLocationContext())
- .getAsLocSymbol(/*IncludeBaseRegions=*/true);
- if (!Sym)
- return Pred;
- // Get the reference count binding (if any).
- const RefVal *T = getRefBinding(state, Sym);
- if (!T)
- return Pred;
- // Change the reference count.
- RefVal X = *T;
- switch (X.getKind()) {
- case RefVal::Owned: {
- unsigned cnt = X.getCount();
- assert(cnt > 0);
- X.setCount(cnt - 1);
- X = X ^ RefVal::ReturnedOwned;
- break;
- }
- case RefVal::NotOwned: {
- unsigned cnt = X.getCount();
- if (cnt) {
- X.setCount(cnt - 1);
- X = X ^ RefVal::ReturnedOwned;
- } else {
- X = X ^ RefVal::ReturnedNotOwned;
- }
- break;
- }
- default:
- return Pred;
- }
- // Update the binding.
- state = setRefBinding(state, Sym, X);
- Pred = C.addTransition(state);
- // At this point we have updated the state properly.
- // Everything after this is merely checking to see if the return value has
- // been over- or under-retained.
- // Did we cache out?
- if (!Pred)
- return nullptr;
- // Update the autorelease counts.
- static CheckerProgramPointTag AutoreleaseTag(this, "Autorelease");
- state = handleAutoreleaseCounts(state, Pred, &AutoreleaseTag, C, Sym, X, S);
- // Have we generated a sink node?
- if (!state)
- return nullptr;
- // Get the updated binding.
- T = getRefBinding(state, Sym);
- assert(T);
- X = *T;
- // Consult the summary of the enclosing method.
- RetainSummaryManager &Summaries = getSummaryManager(C);
- const Decl *CD = &Pred->getCodeDecl();
- RetEffect RE = RetEffect::MakeNoRet();
- // FIXME: What is the convention for blocks? Is there one?
- if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(CD)) {
- const RetainSummary *Summ = Summaries.getSummary(AnyCall(MD));
- RE = Summ->getRetEffect();
- } else if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(CD)) {
- if (!isa<CXXMethodDecl>(FD)) {
- const RetainSummary *Summ = Summaries.getSummary(AnyCall(FD));
- RE = Summ->getRetEffect();
- }
- }
- return checkReturnWithRetEffect(S, C, Pred, RE, X, Sym, state);
- }
- ExplodedNode * RetainCountChecker::checkReturnWithRetEffect(const ReturnStmt *S,
- CheckerContext &C,
- ExplodedNode *Pred,
- RetEffect RE, RefVal X,
- SymbolRef Sym,
- ProgramStateRef state) const {
- // HACK: Ignore retain-count issues on values accessed through ivars,
- // because of cases like this:
- // [_contentView retain];
- // [_contentView removeFromSuperview];
- // [self addSubview:_contentView]; // invalidates 'self'
- // [_contentView release];
- if (X.getIvarAccessHistory() != RefVal::IvarAccessHistory::None)
- return Pred;
- // Any leaks or other errors?
- if (X.isReturnedOwned() && X.getCount() == 0) {
- if (RE.getKind() != RetEffect::NoRet) {
- if (!RE.isOwned()) {
- // The returning type is a CF, we expect the enclosing method should
- // return ownership.
- X = X ^ RefVal::ErrorLeakReturned;
- // Generate an error node.
- state = setRefBinding(state, Sym, X);
- static CheckerProgramPointTag ReturnOwnLeakTag(this, "ReturnsOwnLeak");
- ExplodedNode *N = C.addTransition(state, Pred, &ReturnOwnLeakTag);
- if (N) {
- const LangOptions &LOpts = C.getASTContext().getLangOpts();
- auto R =
- std::make_unique<RefLeakReport>(*LeakAtReturn, LOpts, N, Sym, C);
- C.emitReport(std::move(R));
- }
- return N;
- }
- }
- } else if (X.isReturnedNotOwned()) {
- if (RE.isOwned()) {
- if (X.getIvarAccessHistory() ==
- RefVal::IvarAccessHistory::AccessedDirectly) {
- // Assume the method was trying to transfer a +1 reference from a
- // strong ivar to the caller.
- state = setRefBinding(state, Sym,
- X.releaseViaIvar() ^ RefVal::ReturnedOwned);
- } else {
- // Trying to return a not owned object to a caller expecting an
- // owned object.
- state = setRefBinding(state, Sym, X ^ RefVal::ErrorReturnedNotOwned);
- static CheckerProgramPointTag
- ReturnNotOwnedTag(this, "ReturnNotOwnedForOwned");
- ExplodedNode *N = C.addTransition(state, Pred, &ReturnNotOwnedTag);
- if (N) {
- auto R = std::make_unique<RefCountReport>(
- *ReturnNotOwnedForOwned, C.getASTContext().getLangOpts(), N, Sym);
- C.emitReport(std::move(R));
- }
- return N;
- }
- }
- }
- return Pred;
- }
- //===----------------------------------------------------------------------===//
- // Check various ways a symbol can be invalidated.
- //===----------------------------------------------------------------------===//
- void RetainCountChecker::checkBind(SVal loc, SVal val, const Stmt *S,
- CheckerContext &C) const {
- ProgramStateRef state = C.getState();
- const MemRegion *MR = loc.getAsRegion();
- // Find all symbols referenced by 'val' that we are tracking
- // and stop tracking them.
- if (MR && shouldEscapeRegion(MR)) {
- state = state->scanReachableSymbols<StopTrackingCallback>(val).getState();
- C.addTransition(state);
- }
- }
- ProgramStateRef RetainCountChecker::evalAssume(ProgramStateRef state,
- SVal Cond,
- bool Assumption) const {
- // FIXME: We may add to the interface of evalAssume the list of symbols
- // whose assumptions have changed. For now we just iterate through the
- // bindings and check if any of the tracked symbols are NULL. This isn't
- // too bad since the number of symbols we will track in practice are
- // probably small and evalAssume is only called at branches and a few
- // other places.
- RefBindingsTy B = state->get<RefBindings>();
- if (B.isEmpty())
- return state;
- bool changed = false;
- RefBindingsTy::Factory &RefBFactory = state->get_context<RefBindings>();
- ConstraintManager &CMgr = state->getConstraintManager();
- for (auto &I : B) {
- // Check if the symbol is null stop tracking the symbol.
- ConditionTruthVal AllocFailed = CMgr.isNull(state, I.first);
- if (AllocFailed.isConstrainedTrue()) {
- changed = true;
- B = RefBFactory.remove(B, I.first);
- }
- }
- if (changed)
- state = state->set<RefBindings>(B);
- return state;
- }
- ProgramStateRef RetainCountChecker::checkRegionChanges(
- ProgramStateRef state, const InvalidatedSymbols *invalidated,
- ArrayRef<const MemRegion *> ExplicitRegions,
- ArrayRef<const MemRegion *> Regions, const LocationContext *LCtx,
- const CallEvent *Call) const {
- if (!invalidated)
- return state;
- llvm::SmallPtrSet<SymbolRef, 8> AllowedSymbols;
- for (const MemRegion *I : ExplicitRegions)
- if (const SymbolicRegion *SR = I->StripCasts()->getAs<SymbolicRegion>())
- AllowedSymbols.insert(SR->getSymbol());
- for (SymbolRef sym : *invalidated) {
- if (AllowedSymbols.count(sym))
- continue;
- // Remove any existing reference-count binding.
- state = removeRefBinding(state, sym);
- }
- return state;
- }
- ProgramStateRef
- RetainCountChecker::handleAutoreleaseCounts(ProgramStateRef state,
- ExplodedNode *Pred,
- const ProgramPointTag *Tag,
- CheckerContext &Ctx,
- SymbolRef Sym,
- RefVal V,
- const ReturnStmt *S) const {
- unsigned ACnt = V.getAutoreleaseCount();
- // No autorelease counts? Nothing to be done.
- if (!ACnt)
- return state;
- unsigned Cnt = V.getCount();
- // FIXME: Handle sending 'autorelease' to already released object.
- if (V.getKind() == RefVal::ReturnedOwned)
- ++Cnt;
- // If we would over-release here, but we know the value came from an ivar,
- // assume it was a strong ivar that's just been relinquished.
- if (ACnt > Cnt &&
- V.getIvarAccessHistory() == RefVal::IvarAccessHistory::AccessedDirectly) {
- V = V.releaseViaIvar();
- --ACnt;
- }
- if (ACnt <= Cnt) {
- if (ACnt == Cnt) {
- V.clearCounts();
- if (V.getKind() == RefVal::ReturnedOwned) {
- V = V ^ RefVal::ReturnedNotOwned;
- } else {
- V = V ^ RefVal::NotOwned;
- }
- } else {
- V.setCount(V.getCount() - ACnt);
- V.setAutoreleaseCount(0);
- }
- return setRefBinding(state, Sym, V);
- }
- // HACK: Ignore retain-count issues on values accessed through ivars,
- // because of cases like this:
- // [_contentView retain];
- // [_contentView removeFromSuperview];
- // [self addSubview:_contentView]; // invalidates 'self'
- // [_contentView release];
- if (V.getIvarAccessHistory() != RefVal::IvarAccessHistory::None)
- return state;
- // Woah! More autorelease counts then retain counts left.
- // Emit hard error.
- V = V ^ RefVal::ErrorOverAutorelease;
- state = setRefBinding(state, Sym, V);
- ExplodedNode *N = Ctx.generateSink(state, Pred, Tag);
- if (N) {
- SmallString<128> sbuf;
- llvm::raw_svector_ostream os(sbuf);
- os << "Object was autoreleased ";
- if (V.getAutoreleaseCount() > 1)
- os << V.getAutoreleaseCount() << " times but the object ";
- else
- os << "but ";
- os << "has a +" << V.getCount() << " retain count";
- const LangOptions &LOpts = Ctx.getASTContext().getLangOpts();
- auto R = std::make_unique<RefCountReport>(*OverAutorelease, LOpts, N, Sym,
- os.str());
- Ctx.emitReport(std::move(R));
- }
- return nullptr;
- }
- ProgramStateRef
- RetainCountChecker::handleSymbolDeath(ProgramStateRef state,
- SymbolRef sid, RefVal V,
- SmallVectorImpl<SymbolRef> &Leaked) const {
- bool hasLeak;
- // HACK: Ignore retain-count issues on values accessed through ivars,
- // because of cases like this:
- // [_contentView retain];
- // [_contentView removeFromSuperview];
- // [self addSubview:_contentView]; // invalidates 'self'
- // [_contentView release];
- if (V.getIvarAccessHistory() != RefVal::IvarAccessHistory::None)
- hasLeak = false;
- else if (V.isOwned())
- hasLeak = true;
- else if (V.isNotOwned() || V.isReturnedOwned())
- hasLeak = (V.getCount() > 0);
- else
- hasLeak = false;
- if (!hasLeak)
- return removeRefBinding(state, sid);
- Leaked.push_back(sid);
- return setRefBinding(state, sid, V ^ RefVal::ErrorLeak);
- }
- ExplodedNode *
- RetainCountChecker::processLeaks(ProgramStateRef state,
- SmallVectorImpl<SymbolRef> &Leaked,
- CheckerContext &Ctx,
- ExplodedNode *Pred) const {
- // Generate an intermediate node representing the leak point.
- ExplodedNode *N = Ctx.addTransition(state, Pred);
- const LangOptions &LOpts = Ctx.getASTContext().getLangOpts();
- if (N) {
- for (SymbolRef L : Leaked) {
- const RefCountBug &BT = Pred ? *LeakWithinFunction : *LeakAtReturn;
- Ctx.emitReport(std::make_unique<RefLeakReport>(BT, LOpts, N, L, Ctx));
- }
- }
- return N;
- }
- void RetainCountChecker::checkBeginFunction(CheckerContext &Ctx) const {
- if (!Ctx.inTopFrame())
- return;
- RetainSummaryManager &SmrMgr = getSummaryManager(Ctx);
- const LocationContext *LCtx = Ctx.getLocationContext();
- const Decl *D = LCtx->getDecl();
- Optional<AnyCall> C = AnyCall::forDecl(D);
- if (!C || SmrMgr.isTrustedReferenceCountImplementation(D))
- return;
- ProgramStateRef state = Ctx.getState();
- const RetainSummary *FunctionSummary = SmrMgr.getSummary(*C);
- ArgEffects CalleeSideArgEffects = FunctionSummary->getArgEffects();
- for (unsigned idx = 0, e = C->param_size(); idx != e; ++idx) {
- const ParmVarDecl *Param = C->parameters()[idx];
- SymbolRef Sym = state->getSVal(state->getRegion(Param, LCtx)).getAsSymbol();
- QualType Ty = Param->getType();
- const ArgEffect *AE = CalleeSideArgEffects.lookup(idx);
- if (AE) {
- ObjKind K = AE->getObjKind();
- if (K == ObjKind::Generalized || K == ObjKind::OS ||
- (TrackNSCFStartParam && (K == ObjKind::ObjC || K == ObjKind::CF))) {
- RefVal NewVal = AE->getKind() == DecRef ? RefVal::makeOwned(K, Ty)
- : RefVal::makeNotOwned(K, Ty);
- state = setRefBinding(state, Sym, NewVal);
- }
- }
- }
- Ctx.addTransition(state);
- }
- void RetainCountChecker::checkEndFunction(const ReturnStmt *RS,
- CheckerContext &Ctx) const {
- ExplodedNode *Pred = processReturn(RS, Ctx);
- // Created state cached out.
- if (!Pred) {
- return;
- }
- ProgramStateRef state = Pred->getState();
- RefBindingsTy B = state->get<RefBindings>();
- // Don't process anything within synthesized bodies.
- const LocationContext *LCtx = Pred->getLocationContext();
- if (LCtx->getAnalysisDeclContext()->isBodyAutosynthesized()) {
- assert(!LCtx->inTopFrame());
- return;
- }
- for (auto &I : B) {
- state = handleAutoreleaseCounts(state, Pred, /*Tag=*/nullptr, Ctx,
- I.first, I.second);
- if (!state)
- return;
- }
- // If the current LocationContext has a parent, don't check for leaks.
- // We will do that later.
- // FIXME: we should instead check for imbalances of the retain/releases,
- // and suggest annotations.
- if (LCtx->getParent())
- return;
- B = state->get<RefBindings>();
- SmallVector<SymbolRef, 10> Leaked;
- for (auto &I : B)
- state = handleSymbolDeath(state, I.first, I.second, Leaked);
- processLeaks(state, Leaked, Ctx, Pred);
- }
- void RetainCountChecker::checkDeadSymbols(SymbolReaper &SymReaper,
- CheckerContext &C) const {
- ExplodedNode *Pred = C.getPredecessor();
- ProgramStateRef state = C.getState();
- SmallVector<SymbolRef, 10> Leaked;
- // Update counts from autorelease pools
- for (const auto &I: state->get<RefBindings>()) {
- SymbolRef Sym = I.first;
- if (SymReaper.isDead(Sym)) {
- static CheckerProgramPointTag Tag(this, "DeadSymbolAutorelease");
- const RefVal &V = I.second;
- state = handleAutoreleaseCounts(state, Pred, &Tag, C, Sym, V);
- if (!state)
- return;
- // Fetch the new reference count from the state, and use it to handle
- // this symbol.
- state = handleSymbolDeath(state, Sym, *getRefBinding(state, Sym), Leaked);
- }
- }
- if (Leaked.empty()) {
- C.addTransition(state);
- return;
- }
- Pred = processLeaks(state, Leaked, C, Pred);
- // Did we cache out?
- if (!Pred)
- return;
- // Now generate a new node that nukes the old bindings.
- // The only bindings left at this point are the leaked symbols.
- RefBindingsTy::Factory &F = state->get_context<RefBindings>();
- RefBindingsTy B = state->get<RefBindings>();
- for (SymbolRef L : Leaked)
- B = F.remove(B, L);
- state = state->set<RefBindings>(B);
- C.addTransition(state, Pred);
- }
- void RetainCountChecker::printState(raw_ostream &Out, ProgramStateRef State,
- const char *NL, const char *Sep) const {
- RefBindingsTy B = State->get<RefBindings>();
- if (B.isEmpty())
- return;
- Out << Sep << NL;
- for (auto &I : B) {
- Out << I.first << " : ";
- I.second.print(Out);
- Out << NL;
- }
- }
- //===----------------------------------------------------------------------===//
- // Checker registration.
- //===----------------------------------------------------------------------===//
- std::unique_ptr<CheckerProgramPointTag> RetainCountChecker::DeallocSentTag;
- std::unique_ptr<CheckerProgramPointTag> RetainCountChecker::CastFailTag;
- void ento::registerRetainCountBase(CheckerManager &Mgr) {
- auto *Chk = Mgr.registerChecker<RetainCountChecker>();
- Chk->DeallocSentTag =
- std::make_unique<CheckerProgramPointTag>(Chk, "DeallocSent");
- Chk->CastFailTag =
- std::make_unique<CheckerProgramPointTag>(Chk, "DynamicCastFail");
- }
- bool ento::shouldRegisterRetainCountBase(const CheckerManager &mgr) {
- return true;
- }
- void ento::registerRetainCountChecker(CheckerManager &Mgr) {
- auto *Chk = Mgr.getChecker<RetainCountChecker>();
- Chk->TrackObjCAndCFObjects = true;
- Chk->TrackNSCFStartParam = Mgr.getAnalyzerOptions().getCheckerBooleanOption(
- Mgr.getCurrentCheckerName(), "TrackNSCFStartParam");
- #define INIT_BUGTYPE(KIND) \
- Chk->KIND = std::make_unique<RefCountBug>(Mgr.getCurrentCheckerName(), \
- RefCountBug::KIND);
- // TODO: Ideally, we should have a checker for each of these bug types.
- INIT_BUGTYPE(UseAfterRelease)
- INIT_BUGTYPE(ReleaseNotOwned)
- INIT_BUGTYPE(DeallocNotOwned)
- INIT_BUGTYPE(FreeNotOwned)
- INIT_BUGTYPE(OverAutorelease)
- INIT_BUGTYPE(ReturnNotOwnedForOwned)
- INIT_BUGTYPE(LeakWithinFunction)
- INIT_BUGTYPE(LeakAtReturn)
- #undef INIT_BUGTYPE
- }
- bool ento::shouldRegisterRetainCountChecker(const CheckerManager &mgr) {
- return true;
- }
- void ento::registerOSObjectRetainCountChecker(CheckerManager &Mgr) {
- auto *Chk = Mgr.getChecker<RetainCountChecker>();
- Chk->TrackOSObjects = true;
- // FIXME: We want bug reports to always have the same checker name associated
- // with them, yet here, if RetainCountChecker is disabled but
- // OSObjectRetainCountChecker is enabled, the checker names will be different.
- // This hack will make it so that the checker name depends on which checker is
- // enabled rather than on the registration order.
- // For the most part, we want **non-hidden checkers** to be associated with
- // diagnostics, and **hidden checker options** with the fine-tuning of
- // modeling. Following this logic, OSObjectRetainCountChecker should be the
- // latter, but we can't just remove it for backward compatibility reasons.
- #define LAZY_INIT_BUGTYPE(KIND) \
- if (!Chk->KIND) \
- Chk->KIND = std::make_unique<RefCountBug>(Mgr.getCurrentCheckerName(), \
- RefCountBug::KIND);
- LAZY_INIT_BUGTYPE(UseAfterRelease)
- LAZY_INIT_BUGTYPE(ReleaseNotOwned)
- LAZY_INIT_BUGTYPE(DeallocNotOwned)
- LAZY_INIT_BUGTYPE(FreeNotOwned)
- LAZY_INIT_BUGTYPE(OverAutorelease)
- LAZY_INIT_BUGTYPE(ReturnNotOwnedForOwned)
- LAZY_INIT_BUGTYPE(LeakWithinFunction)
- LAZY_INIT_BUGTYPE(LeakAtReturn)
- #undef LAZY_INIT_BUGTYPE
- }
- bool ento::shouldRegisterOSObjectRetainCountChecker(const CheckerManager &mgr) {
- return true;
- }
|