head 1.1; branch 1.1.1; access; symbols netbsd-11-0-RC5:1.1.1.9 netbsd-11-0-RC4:1.1.1.9 netbsd-11-0-RC3:1.1.1.9 netbsd-11-0-RC2:1.1.1.9 netbsd-11-0-RC1:1.1.1.9 perseant-exfatfs-base-20250801:1.1.1.9 netbsd-11:1.1.1.9.0.10 netbsd-11-base:1.1.1.9 netbsd-10-1-RELEASE:1.1.1.9 perseant-exfatfs-base-20240630:1.1.1.9 perseant-exfatfs:1.1.1.9.0.8 perseant-exfatfs-base:1.1.1.9 netbsd-8-3-RELEASE:1.1.1.7 netbsd-9-4-RELEASE:1.1.1.8 netbsd-10-0-RELEASE:1.1.1.9 netbsd-10-0-RC6:1.1.1.9 netbsd-10-0-RC5:1.1.1.9 netbsd-10-0-RC4:1.1.1.9 netbsd-10-0-RC3:1.1.1.9 netbsd-10-0-RC2:1.1.1.9 netbsd-10-0-RC1:1.1.1.9 netbsd-10:1.1.1.9.0.6 netbsd-10-base:1.1.1.9 netbsd-9-3-RELEASE:1.1.1.8 cjep_sun2x:1.1.1.9.0.4 cjep_sun2x-base:1.1.1.9 cjep_staticlib_x-base1:1.1.1.9 netbsd-9-2-RELEASE:1.1.1.8 cjep_staticlib_x:1.1.1.9.0.2 cjep_staticlib_x-base:1.1.1.9 netbsd-9-1-RELEASE:1.1.1.8 phil-wifi-20200421:1.1.1.9 phil-wifi-20200411:1.1.1.9 phil-wifi-20200406:1.1.1.9 netbsd-8-2-RELEASE:1.1.1.7 netbsd-9-0-RELEASE:1.1.1.8 netbsd-9-0-RC2:1.1.1.8 netbsd-9-0-RC1:1.1.1.8 netbsd-9:1.1.1.8.0.2 netbsd-9-base:1.1.1.8 phil-wifi-20190609:1.1.1.8 netbsd-8-1-RELEASE:1.1.1.7 netbsd-8-1-RC1:1.1.1.7 pgoyette-compat-merge-20190127:1.1.1.7.12.1 pgoyette-compat-20190127:1.1.1.8 pgoyette-compat-20190118:1.1.1.8 pgoyette-compat-1226:1.1.1.8 pgoyette-compat-1126:1.1.1.8 pgoyette-compat-1020:1.1.1.8 pgoyette-compat-0930:1.1.1.8 pgoyette-compat-0906:1.1.1.8 netbsd-7-2-RELEASE:1.1.1.4.2.1 pgoyette-compat-0728:1.1.1.8 clang-337282:1.1.1.8 netbsd-8-0-RELEASE:1.1.1.7 phil-wifi:1.1.1.7.0.14 phil-wifi-base:1.1.1.7 pgoyette-compat-0625:1.1.1.7 netbsd-8-0-RC2:1.1.1.7 pgoyette-compat-0521:1.1.1.7 pgoyette-compat-0502:1.1.1.7 pgoyette-compat-0422:1.1.1.7 netbsd-8-0-RC1:1.1.1.7 pgoyette-compat-0415:1.1.1.7 pgoyette-compat-0407:1.1.1.7 pgoyette-compat-0330:1.1.1.7 pgoyette-compat-0322:1.1.1.7 pgoyette-compat-0315:1.1.1.7 netbsd-7-1-2-RELEASE:1.1.1.4.2.1 pgoyette-compat:1.1.1.7.0.12 pgoyette-compat-base:1.1.1.7 netbsd-7-1-1-RELEASE:1.1.1.4.2.1 clang-319952:1.1.1.7 matt-nb8-mediatek:1.1.1.7.0.10 matt-nb8-mediatek-base:1.1.1.7 clang-309604:1.1.1.7 perseant-stdc-iso10646:1.1.1.7.0.8 perseant-stdc-iso10646-base:1.1.1.7 netbsd-8:1.1.1.7.0.6 netbsd-8-base:1.1.1.7 prg-localcount2-base3:1.1.1.7 prg-localcount2-base2:1.1.1.7 prg-localcount2-base1:1.1.1.7 prg-localcount2:1.1.1.7.0.4 prg-localcount2-base:1.1.1.7 pgoyette-localcount-20170426:1.1.1.7 bouyer-socketcan-base1:1.1.1.7 pgoyette-localcount-20170320:1.1.1.7 netbsd-7-1:1.1.1.4.2.1.0.6 netbsd-7-1-RELEASE:1.1.1.4.2.1 netbsd-7-1-RC2:1.1.1.4.2.1 clang-294123:1.1.1.7 netbsd-7-nhusb-base-20170116:1.1.1.4.2.1 bouyer-socketcan:1.1.1.7.0.2 bouyer-socketcan-base:1.1.1.7 clang-291444:1.1.1.7 pgoyette-localcount-20170107:1.1.1.6 netbsd-7-1-RC1:1.1.1.4.2.1 pgoyette-localcount-20161104:1.1.1.6 netbsd-7-0-2-RELEASE:1.1.1.4.2.1 localcount-20160914:1.1.1.6 netbsd-7-nhusb:1.1.1.4.2.1.0.4 netbsd-7-nhusb-base:1.1.1.4.2.1 clang-280599:1.1.1.6 pgoyette-localcount-20160806:1.1.1.6 pgoyette-localcount-20160726:1.1.1.6 pgoyette-localcount:1.1.1.6.0.2 pgoyette-localcount-base:1.1.1.6 netbsd-7-0-1-RELEASE:1.1.1.4.2.1 clang-261930:1.1.1.6 netbsd-7-0:1.1.1.4.2.1.0.2 netbsd-7-0-RELEASE:1.1.1.4.2.1 netbsd-7-0-RC3:1.1.1.4.2.1 netbsd-7-0-RC2:1.1.1.4.2.1 netbsd-7-0-RC1:1.1.1.4.2.1 clang-237755:1.1.1.5 clang-232565:1.1.1.5 clang-227398:1.1.1.5 tls-maxphys-base:1.1.1.4 tls-maxphys:1.1.1.4.0.4 netbsd-7:1.1.1.4.0.2 netbsd-7-base:1.1.1.4 clang-215315:1.1.1.4 clang-209886:1.1.1.4 yamt-pagecache:1.1.1.3.0.4 yamt-pagecache-base9:1.1.1.3 tls-earlyentropy:1.1.1.3.0.2 tls-earlyentropy-base:1.1.1.4 riastradh-xf86-video-intel-2-7-1-pre-2-21-15:1.1.1.3 riastradh-drm2-base3:1.1.1.3 clang-202566:1.1.1.3 clang-201163:1.1.1.2 clang-199312:1.1.1.2 clang-198450:1.1.1.2 clang-196603:1.1.1.1 clang-195771:1.1.1.1 LLVM:1.1.1; locks; strict; comment @// @; 1.1 date 2013.11.28.14.14.52; author joerg; state Exp; branches 1.1.1.1; next ; commitid ow8OybrawrB1f3fx; 1.1.1.1 date 2013.11.28.14.14.52; author joerg; state Exp; branches; next 1.1.1.2; commitid ow8OybrawrB1f3fx; 1.1.1.2 date 2014.01.05.15.39.31; author joerg; state Exp; branches; next 1.1.1.3; commitid wh3aCSIWykURqWjx; 1.1.1.3 date 2014.03.04.19.54.57; author joerg; state Exp; branches 1.1.1.3.2.1 1.1.1.3.4.1; next 1.1.1.4; commitid 29z1hJonZISIXprx; 1.1.1.4 date 2014.05.30.18.14.44; author joerg; state Exp; branches 1.1.1.4.2.1 1.1.1.4.4.1; next 1.1.1.5; commitid 8q0kdlBlCn09GACx; 1.1.1.5 date 2015.01.29.19.57.30; author joerg; state Exp; branches; next 1.1.1.6; commitid mlISSizlPKvepX7y; 1.1.1.6 date 2016.02.27.22.12.06; author joerg; state Exp; branches 1.1.1.6.2.1; next 1.1.1.7; commitid tIimz3oDlh1NpBWy; 1.1.1.7 date 2017.01.11.10.35.37; author joerg; state Exp; branches 1.1.1.7.12.1 1.1.1.7.14.1; next 1.1.1.8; commitid CNnUNfII1jgNmxBz; 1.1.1.8 date 2018.07.17.18.31.07; author joerg; state Exp; branches; next 1.1.1.9; commitid wDzL46ALjrCZgwKA; 1.1.1.9 date 2019.11.13.22.19.28; author joerg; state dead; branches; next ; commitid QD8YATxuNG34YJKB; 1.1.1.3.2.1 date 2014.08.10.07.08.10; author tls; state Exp; branches; next ; commitid t01A1TLTYxkpGMLx; 1.1.1.3.4.1 date 2014.03.04.19.54.57; author yamt; state dead; branches; next 1.1.1.3.4.2; commitid WSrDtL5nYAUyiyBx; 1.1.1.3.4.2 date 2014.05.22.16.18.30; author yamt; state Exp; branches; next ; commitid WSrDtL5nYAUyiyBx; 1.1.1.4.2.1 date 2015.06.04.20.04.30; author snj; state Exp; branches; next ; commitid yRnjq9fueSo6n9oy; 1.1.1.4.4.1 date 2014.05.30.18.14.44; author tls; state dead; branches; next 1.1.1.4.4.2; commitid jTnpym9Qu0o4R1Nx; 1.1.1.4.4.2 date 2014.08.19.23.47.31; author tls; state Exp; branches; next ; commitid jTnpym9Qu0o4R1Nx; 1.1.1.6.2.1 date 2017.03.20.06.52.42; author pgoyette; state Exp; branches; next ; commitid jjw7cAwgyKq7RfKz; 1.1.1.7.12.1 date 2018.07.28.04.33.23; author pgoyette; state Exp; branches; next ; commitid 1UP1xAIUxv1ZgRLA; 1.1.1.7.14.1 date 2019.06.10.21.45.28; author christos; state Exp; branches; next 1.1.1.7.14.2; commitid jtc8rnCzWiEEHGqB; 1.1.1.7.14.2 date 2020.04.13.07.46.38; author martin; state dead; branches; next ; commitid X01YhRUPVUDaec4C; desc @@ 1.1 log @Initial revision @ text @//==- CheckObjCDealloc.cpp - Check ObjC -dealloc implementation --*- C++ -*-==// // // The LLVM Compiler Infrastructure // // This file is distributed under the University of Illinois Open Source // License. See LICENSE.TXT for details. // //===----------------------------------------------------------------------===// // // This file defines a CheckObjCDealloc, a checker that // analyzes an Objective-C class's implementation to determine if it // correctly implements -dealloc. // //===----------------------------------------------------------------------===// #include "ClangSACheckers.h" #include "clang/AST/Attr.h" #include "clang/AST/DeclObjC.h" #include "clang/AST/Expr.h" #include "clang/AST/ExprObjC.h" #include "clang/Basic/LangOptions.h" #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h" #include "clang/StaticAnalyzer/Core/BugReporter/PathDiagnostic.h" #include "clang/StaticAnalyzer/Core/Checker.h" #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h" #include "llvm/Support/raw_ostream.h" using namespace clang; using namespace ento; static bool scan_dealloc(Stmt *S, Selector Dealloc) { if (ObjCMessageExpr *ME = dyn_cast(S)) if (ME->getSelector() == Dealloc) { switch (ME->getReceiverKind()) { case ObjCMessageExpr::Instance: return false; case ObjCMessageExpr::SuperInstance: return true; case ObjCMessageExpr::Class: break; case ObjCMessageExpr::SuperClass: break; } } // Recurse to children. for (Stmt::child_iterator I = S->child_begin(), E= S->child_end(); I!=E; ++I) if (*I && scan_dealloc(*I, Dealloc)) return true; return false; } static bool scan_ivar_release(Stmt *S, ObjCIvarDecl *ID, const ObjCPropertyDecl *PD, Selector Release, IdentifierInfo* SelfII, ASTContext &Ctx) { // [mMyIvar release] if (ObjCMessageExpr *ME = dyn_cast(S)) if (ME->getSelector() == Release) if (ME->getInstanceReceiver()) if (Expr *Receiver = ME->getInstanceReceiver()->IgnoreParenCasts()) if (ObjCIvarRefExpr *E = dyn_cast(Receiver)) if (E->getDecl() == ID) return true; // [self setMyIvar:nil]; if (ObjCMessageExpr *ME = dyn_cast(S)) if (ME->getInstanceReceiver()) if (Expr *Receiver = ME->getInstanceReceiver()->IgnoreParenCasts()) if (DeclRefExpr *E = dyn_cast(Receiver)) if (E->getDecl()->getIdentifier() == SelfII) if (ME->getMethodDecl() == PD->getSetterMethodDecl() && ME->getNumArgs() == 1 && ME->getArg(0)->isNullPointerConstant(Ctx, Expr::NPC_ValueDependentIsNull)) return true; // self.myIvar = nil; if (BinaryOperator* BO = dyn_cast(S)) if (BO->isAssignmentOp()) if (ObjCPropertyRefExpr *PRE = dyn_cast(BO->getLHS()->IgnoreParenCasts())) if (PRE->isExplicitProperty() && PRE->getExplicitProperty() == PD) if (BO->getRHS()->isNullPointerConstant(Ctx, Expr::NPC_ValueDependentIsNull)) { // This is only a 'release' if the property kind is not // 'assign'. return PD->getSetterKind() != ObjCPropertyDecl::Assign; } // Recurse to children. for (Stmt::child_iterator I = S->child_begin(), E= S->child_end(); I!=E; ++I) if (*I && scan_ivar_release(*I, ID, PD, Release, SelfII, Ctx)) return true; return false; } static void checkObjCDealloc(const ObjCImplementationDecl *D, const LangOptions& LOpts, BugReporter& BR) { assert (LOpts.getGC() != LangOptions::GCOnly); ASTContext &Ctx = BR.getContext(); const ObjCInterfaceDecl *ID = D->getClassInterface(); // Does the class contain any ivars that are pointers (or id<...>)? // If not, skip the check entirely. // NOTE: This is motivated by PR 2517: // http://llvm.org/bugs/show_bug.cgi?id=2517 bool containsPointerIvar = false; for (ObjCInterfaceDecl::ivar_iterator I=ID->ivar_begin(), E=ID->ivar_end(); I!=E; ++I) { ObjCIvarDecl *ID = *I; QualType T = ID->getType(); if (!T->isObjCObjectPointerType() || ID->getAttr() || // Skip IBOutlets. ID->getAttr()) // Skip IBOutletCollections. continue; containsPointerIvar = true; break; } if (!containsPointerIvar) return; // Determine if the class subclasses NSObject. IdentifierInfo* NSObjectII = &Ctx.Idents.get("NSObject"); IdentifierInfo* SenTestCaseII = &Ctx.Idents.get("SenTestCase"); for ( ; ID ; ID = ID->getSuperClass()) { IdentifierInfo *II = ID->getIdentifier(); if (II == NSObjectII) break; // FIXME: For now, ignore classes that subclass SenTestCase, as these don't // need to implement -dealloc. They implement tear down in another way, // which we should try and catch later. // http://llvm.org/bugs/show_bug.cgi?id=3187 if (II == SenTestCaseII) return; } if (!ID) return; // Get the "dealloc" selector. IdentifierInfo* II = &Ctx.Idents.get("dealloc"); Selector S = Ctx.Selectors.getSelector(0, &II); ObjCMethodDecl *MD = 0; // Scan the instance methods for "dealloc". for (ObjCImplementationDecl::instmeth_iterator I = D->instmeth_begin(), E = D->instmeth_end(); I!=E; ++I) { if ((*I)->getSelector() == S) { MD = *I; break; } } PathDiagnosticLocation DLoc = PathDiagnosticLocation::createBegin(D, BR.getSourceManager()); if (!MD) { // No dealloc found. const char* name = LOpts.getGC() == LangOptions::NonGC ? "missing -dealloc" : "missing -dealloc (Hybrid MM, non-GC)"; std::string buf; llvm::raw_string_ostream os(buf); os << "Objective-C class '" << *D << "' lacks a 'dealloc' instance method"; BR.EmitBasicReport(D, name, categories::CoreFoundationObjectiveC, os.str(), DLoc); return; } // dealloc found. Scan for missing [super dealloc]. if (MD->getBody() && !scan_dealloc(MD->getBody(), S)) { const char* name = LOpts.getGC() == LangOptions::NonGC ? "missing [super dealloc]" : "missing [super dealloc] (Hybrid MM, non-GC)"; std::string buf; llvm::raw_string_ostream os(buf); os << "The 'dealloc' instance method in Objective-C class '" << *D << "' does not send a 'dealloc' message to its super class" " (missing [super dealloc])"; BR.EmitBasicReport(MD, name, categories::CoreFoundationObjectiveC, os.str(), DLoc); return; } // Get the "release" selector. IdentifierInfo* RII = &Ctx.Idents.get("release"); Selector RS = Ctx.Selectors.getSelector(0, &RII); // Get the "self" identifier IdentifierInfo* SelfII = &Ctx.Idents.get("self"); // Scan for missing and extra releases of ivars used by implementations // of synthesized properties for (ObjCImplementationDecl::propimpl_iterator I = D->propimpl_begin(), E = D->propimpl_end(); I!=E; ++I) { // We can only check the synthesized properties if (I->getPropertyImplementation() != ObjCPropertyImplDecl::Synthesize) continue; ObjCIvarDecl *ID = I->getPropertyIvarDecl(); if (!ID) continue; QualType T = ID->getType(); if (!T->isObjCObjectPointerType()) // Skip non-pointer ivars continue; const ObjCPropertyDecl *PD = I->getPropertyDecl(); if (!PD) continue; // ivars cannot be set via read-only properties, so we'll skip them if (PD->isReadOnly()) continue; // ivar must be released if and only if the kind of setter was not 'assign' bool requiresRelease = PD->getSetterKind() != ObjCPropertyDecl::Assign; if (scan_ivar_release(MD->getBody(), ID, PD, RS, SelfII, Ctx) != requiresRelease) { const char *name = 0; std::string buf; llvm::raw_string_ostream os(buf); if (requiresRelease) { name = LOpts.getGC() == LangOptions::NonGC ? "missing ivar release (leak)" : "missing ivar release (Hybrid MM, non-GC)"; os << "The '" << *ID << "' instance variable was retained by a synthesized property but " "wasn't released in 'dealloc'"; } else { name = LOpts.getGC() == LangOptions::NonGC ? "extra ivar release (use-after-release)" : "extra ivar release (Hybrid MM, non-GC)"; os << "The '" << *ID << "' instance variable was not retained by a synthesized property " "but was released in 'dealloc'"; } PathDiagnosticLocation SDLoc = PathDiagnosticLocation::createBegin(*I, BR.getSourceManager()); BR.EmitBasicReport(MD, name, categories::CoreFoundationObjectiveC, os.str(), SDLoc); } } } //===----------------------------------------------------------------------===// // ObjCDeallocChecker //===----------------------------------------------------------------------===// namespace { class ObjCDeallocChecker : public Checker< check::ASTDecl > { public: void checkASTDecl(const ObjCImplementationDecl *D, AnalysisManager& mgr, BugReporter &BR) const { if (mgr.getLangOpts().getGC() == LangOptions::GCOnly) return; checkObjCDealloc(cast(D), mgr.getLangOpts(), BR); } }; } void ento::registerObjCDeallocChecker(CheckerManager &mgr) { mgr.registerChecker(); } @ 1.1.1.1 log @Import Clang 3.4rc1 r195771. @ text @@ 1.1.1.2 log @Import clang 3.5svn r198450. @ text @d122 2 a123 2 ID->hasAttr() || // Skip IBOutlets. ID->hasAttr()) // Skip IBOutletCollections. @ 1.1.1.3 log @Import Clang 3.5svn r202566. @ text @d100 2 a101 3 static void checkObjCDealloc(const CheckerBase *Checker, const ObjCImplementationDecl *D, const LangOptions &LOpts, BugReporter &BR) { d183 1 a183 1 BR.EmitBasicReport(D, Checker, name, categories::CoreFoundationObjectiveC, d201 1 a201 1 BR.EmitBasicReport(MD, Checker, name, categories::CoreFoundationObjectiveC, d267 2 a268 2 BR.EmitBasicReport(MD, Checker, name, categories::CoreFoundationObjectiveC, os.str(), SDLoc); d285 1 a285 2 checkObjCDealloc(this, cast(D), mgr.getLangOpts(), BR); @ 1.1.1.3.2.1 log @Rebase. @ text @d116 5 a120 2 for (const auto *Ivar : ID->ivars()) { QualType T = Ivar->getType(); d123 2 a124 2 Ivar->hasAttr() || // Skip IBOutlets. Ivar->hasAttr()) // Skip IBOutletCollections. d159 1 a159 1 const ObjCMethodDecl *MD = nullptr; d162 5 a166 3 for (const auto *I : D->instance_methods()) { if (I->getSelector() == S) { MD = I; d216 3 a218 1 for (const auto *I : D->property_impls()) { d243 1 a243 1 const char *name = nullptr; d266 1 a266 1 PathDiagnosticLocation::createBegin(I, BR.getSourceManager()); @ 1.1.1.4 log @Import Clang 3.5svn r209886. @ text @d116 5 a120 2 for (const auto *Ivar : ID->ivars()) { QualType T = Ivar->getType(); d123 2 a124 2 Ivar->hasAttr() || // Skip IBOutlets. Ivar->hasAttr()) // Skip IBOutletCollections. d159 1 a159 1 const ObjCMethodDecl *MD = nullptr; d162 5 a166 3 for (const auto *I : D->instance_methods()) { if (I->getSelector() == S) { MD = I; d216 3 a218 1 for (const auto *I : D->property_impls()) { d243 1 a243 1 const char *name = nullptr; d266 1 a266 1 PathDiagnosticLocation::createBegin(I, BR.getSourceManager()); @ 1.1.1.4.2.1 log @Update LLVM to 3.6.1, requested by joerg in ticket 824. @ text @d31 21 d184 18 @ 1.1.1.5 log @Import Clang 3.6RC1 r227398. @ text @d31 21 d184 18 @ 1.1.1.6 log @Import Clang 3.8.0rc3 r261930. @ text @d54 1 a54 1 ME->getArg(0)->isNullPointerConstant(Ctx, d64 1 a64 1 if (BO->getRHS()->isNullPointerConstant(Ctx, d72 2 a73 2 for (Stmt *SubStmt : S->children()) if (SubStmt && scan_ivar_release(SubStmt, ID, PD, Release, SelfII, Ctx)) @ 1.1.1.6.2.1 log @Sync with HEAD @ text @d10 3 a12 18 // This checker analyzes Objective-C -dealloc methods and their callees // to warn about improper releasing of instance variables that back synthesized // properties. It warns about missing releases in the following cases: // - When a class has a synthesized instance variable for a 'retain' or 'copy' // property and lacks a -dealloc method in its implementation. // - When a class has a synthesized instance variable for a 'retain'/'copy' // property but the ivar is not released in -dealloc by either -release // or by nilling out the property. // // It warns about extra releases in -dealloc (but not in callees) when a // synthesized instance variable is released in the following cases: // - When the property is 'assign' and is not 'readonly'. // - When the property is 'weak'. // // This checker only warns for instance variables synthesized to back // properties. Handling the more general case would require inferring whether // an instance variable is stored retained or not. For synthesized properties, // this is specified in the property declaration itself. a21 1 #include "clang/Basic/TargetInfo.h" a22 1 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" a25 5 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h" #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h" #include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h" d31 44 a74 6 /// Indicates whether an instance variable is required to be released in /// -dealloc. enum class ReleaseRequirement { /// The instance variable must be released, either by calling /// -release on it directly or by nilling it out with a property setter. MustRelease, d76 1 a76 29 /// The instance variable must not be directly released with -release. MustNotReleaseDirectly, /// The requirement for the instance variable could not be determined. Unknown }; /// Returns true if the property implementation is synthesized and the /// type of the property is retainable. static bool isSynthesizedRetainableProperty(const ObjCPropertyImplDecl *I, const ObjCIvarDecl **ID, const ObjCPropertyDecl **PD) { if (I->getPropertyImplementation() != ObjCPropertyImplDecl::Synthesize) return false; (*ID) = I->getPropertyIvarDecl(); if (!(*ID)) return false; QualType T = (*ID)->getType(); if (!T->isObjCRetainableType()) return false; (*PD) = I->getPropertyDecl(); // Shouldn't be able to synthesize a property that doesn't exist. assert(*PD); return true; d79 3 a81 1 namespace { d83 1 a83 17 class ObjCDeallocChecker : public Checker, check::PreObjCMessage, check::PostObjCMessage, check::PreCall, check::BeginFunction, check::EndFunction, eval::Assume, check::PointerEscape, check::PreStmt> { mutable IdentifierInfo *NSObjectII, *SenTestCaseII, *XCTestCaseII, *Block_releaseII, *CIFilterII; mutable Selector DeallocSel, ReleaseSel; std::unique_ptr MissingReleaseBugType; std::unique_ptr ExtraReleaseBugType; std::unique_ptr MistakenDeallocBugType; d85 2 a86 2 public: ObjCDeallocChecker(); d88 4 a91 6 void checkASTDecl(const ObjCImplementationDecl *D, AnalysisManager& Mgr, BugReporter &BR) const; void checkBeginFunction(CheckerContext &Ctx) const; void checkPreObjCMessage(const ObjCMethodCall &M, CheckerContext &C) const; void checkPreCall(const CallEvent &Call, CheckerContext &C) const; void checkPostObjCMessage(const ObjCMethodCall &M, CheckerContext &C) const; d93 1 a93 2 ProgramStateRef evalAssume(ProgramStateRef State, SVal Cond, bool Assumption) const; d95 2 a96 6 ProgramStateRef checkPointerEscape(ProgramStateRef State, const InvalidatedSymbols &Escaped, const CallEvent *Call, PointerEscapeKind Kind) const; void checkPreStmt(const ReturnStmt *RS, CheckerContext &C) const; void checkEndFunction(CheckerContext &Ctx) const; d98 4 a101 2 private: void diagnoseMissingReleases(CheckerContext &C) const; d103 3 a105 2 bool diagnoseExtraRelease(SymbolRef ReleasedValue, const ObjCMethodCall &M, CheckerContext &C) const; d107 2 a108 3 bool diagnoseMistakenDealloc(SymbolRef DeallocedValue, const ObjCMethodCall &M, CheckerContext &C) const; d110 3 a112 2 SymbolRef getValueReleasedByNillingOut(const ObjCMethodCall &M, CheckerContext &C) const; a113 2 const ObjCIvarRegion *getIvarRegionForIvarSymbol(SymbolRef IvarSym) const; SymbolRef getInstanceSymbolFromIvarSymbol(SymbolRef IvarSym) const; d115 2 a116 3 const ObjCPropertyImplDecl* findPropertyOnDeallocatingInstance(SymbolRef IvarSym, CheckerContext &C) const; d118 2 a119 2 ReleaseRequirement getDeallocReleaseRequirement(const ObjCPropertyImplDecl *PropImpl) const; d121 6 a126 70 bool isInInstanceDealloc(const CheckerContext &C, SVal &SelfValOut) const; bool isInInstanceDealloc(const CheckerContext &C, const LocationContext *LCtx, SVal &SelfValOut) const; bool instanceDeallocIsOnStack(const CheckerContext &C, SVal &InstanceValOut) const; bool isSuperDeallocMessage(const ObjCMethodCall &M) const; const ObjCImplDecl *getContainingObjCImpl(const LocationContext *LCtx) const; const ObjCPropertyDecl * findShadowedPropertyDecl(const ObjCPropertyImplDecl *PropImpl) const; void transitionToReleaseValue(CheckerContext &C, SymbolRef Value) const; ProgramStateRef removeValueRequiringRelease(ProgramStateRef State, SymbolRef InstanceSym, SymbolRef ValueSym) const; void initIdentifierInfoAndSelectors(ASTContext &Ctx) const; bool classHasSeparateTeardown(const ObjCInterfaceDecl *ID) const; bool isReleasedByCIFilterDealloc(const ObjCPropertyImplDecl *PropImpl) const; bool isNibLoadedIvarWithoutRetain(const ObjCPropertyImplDecl *PropImpl) const; }; } // End anonymous namespace. typedef llvm::ImmutableSet SymbolSet; /// Maps from the symbol for a class instance to the set of /// symbols remaining that must be released in -dealloc. REGISTER_MAP_WITH_PROGRAMSTATE(UnreleasedIvarMap, SymbolRef, SymbolSet) namespace clang { namespace ento { template<> struct ProgramStateTrait : public ProgramStatePartialTrait { static void *GDMIndex() { static int index = 0; return &index; } }; } } /// An AST check that diagnose when the class requires a -dealloc method and /// is missing one. void ObjCDeallocChecker::checkASTDecl(const ObjCImplementationDecl *D, AnalysisManager &Mgr, BugReporter &BR) const { assert(Mgr.getLangOpts().getGC() != LangOptions::GCOnly); assert(!Mgr.getLangOpts().ObjCAutoRefCount); initIdentifierInfoAndSelectors(Mgr.getASTContext()); const ObjCInterfaceDecl *ID = D->getClassInterface(); // If the class is known to have a lifecycle with a separate teardown method // then it may not require a -dealloc method. if (classHasSeparateTeardown(ID)) return; // Does the class contain any synthesized properties that are retainable? // If not, skip the check entirely. const ObjCPropertyImplDecl *PropImplRequiringRelease = nullptr; bool HasOthers = false; for (const auto *I : D->property_impls()) { if (getDeallocReleaseRequirement(I) == ReleaseRequirement::MustRelease) { if (!PropImplRequiringRelease) PropImplRequiringRelease = I; else { HasOthers = true; break; } } d129 1 a129 1 if (!PropImplRequiringRelease) d132 3 d139 1 a139 1 if (I->getSelector() == DeallocSel) { d145 3 a148 52 const char* Name = "Missing -dealloc"; std::string Buf; llvm::raw_string_ostream OS(Buf); OS << "'" << *D << "' lacks a 'dealloc' instance method but " << "must release '" << *PropImplRequiringRelease->getPropertyIvarDecl() << "'"; if (HasOthers) OS << " and others"; PathDiagnosticLocation DLoc = PathDiagnosticLocation::createBegin(D, BR.getSourceManager()); BR.EmitBasicReport(D, this, Name, categories::CoreFoundationObjectiveC, OS.str(), DLoc); return; } } /// If this is the beginning of -dealloc, mark the values initially stored in /// instance variables that must be released by the end of -dealloc /// as unreleased in the state. void ObjCDeallocChecker::checkBeginFunction( CheckerContext &C) const { initIdentifierInfoAndSelectors(C.getASTContext()); // Only do this if the current method is -dealloc. SVal SelfVal; if (!isInInstanceDealloc(C, SelfVal)) return; SymbolRef SelfSymbol = SelfVal.getAsSymbol(); const LocationContext *LCtx = C.getLocationContext(); ProgramStateRef InitialState = C.getState(); ProgramStateRef State = InitialState; SymbolSet::Factory &F = State->getStateManager().get_context(); // Symbols that must be released by the end of the -dealloc; SymbolSet RequiredReleases = F.getEmptySet(); // If we're an inlined -dealloc, we should add our symbols to the existing // set from our subclass. if (const SymbolSet *CurrSet = State->get(SelfSymbol)) RequiredReleases = *CurrSet; for (auto *PropImpl : getContainingObjCImpl(LCtx)->property_impls()) { ReleaseRequirement Requirement = getDeallocReleaseRequirement(PropImpl); if (Requirement != ReleaseRequirement::MustRelease) continue; d150 3 a152 13 SVal LVal = State->getLValue(PropImpl->getPropertyIvarDecl(), SelfVal); Optional LValLoc = LVal.getAs(); if (!LValLoc) continue; SVal InitialVal = State->getSVal(LValLoc.getValue()); SymbolRef Symbol = InitialVal.getAsSymbol(); if (!Symbol || !isa(Symbol)) continue; // Mark the value as requiring a release. RequiredReleases = F.add(RequiredReleases, Symbol); } d154 3 a156 3 if (!RequiredReleases.isEmpty()) { State = State->set(SelfSymbol, RequiredReleases); } d158 2 a159 31 if (State != InitialState) { C.addTransition(State); } } /// Given a symbol for an ivar, return the ivar region it was loaded from. /// Returns nullptr if the instance symbol cannot be found. const ObjCIvarRegion * ObjCDeallocChecker::getIvarRegionForIvarSymbol(SymbolRef IvarSym) const { return dyn_cast_or_null(IvarSym->getOriginRegion()); } /// Given a symbol for an ivar, return a symbol for the instance containing /// the ivar. Returns nullptr if the instance symbol cannot be found. SymbolRef ObjCDeallocChecker::getInstanceSymbolFromIvarSymbol(SymbolRef IvarSym) const { const ObjCIvarRegion *IvarRegion = getIvarRegionForIvarSymbol(IvarSym); if (!IvarRegion) return nullptr; return IvarRegion->getSymbolicBase()->getSymbol(); } /// If we are in -dealloc or -dealloc is on the stack, handle the call if it is /// a release or a nilling-out property setter. void ObjCDeallocChecker::checkPreObjCMessage( const ObjCMethodCall &M, CheckerContext &C) const { // Only run if -dealloc is on the stack. SVal DeallocedInstance; if (!instanceDeallocIsOnStack(C, DeallocedInstance)) a160 19 SymbolRef ReleasedValue = nullptr; if (M.getSelector() == ReleaseSel) { ReleasedValue = M.getReceiverSVal().getAsSymbol(); } else if (M.getSelector() == DeallocSel && !M.isReceiverSelfOrSuper()) { if (diagnoseMistakenDealloc(M.getReceiverSVal().getAsSymbol(), M, C)) return; } if (ReleasedValue) { // An instance variable symbol was released with -release: // [_property release]; if (diagnoseExtraRelease(ReleasedValue,M, C)) return; } else { // An instance variable symbol was released nilling out its property: // self.property = nil; ReleasedValue = getValueReleasedByNillingOut(M, C); d163 3 a165 2 if (!ReleasedValue) return; d167 2 a168 2 transitionToReleaseValue(C, ReleasedValue); } d170 5 a174 116 /// If we are in -dealloc or -dealloc is on the stack, handle the call if it is /// call to Block_release(). void ObjCDeallocChecker::checkPreCall(const CallEvent &Call, CheckerContext &C) const { const IdentifierInfo *II = Call.getCalleeIdentifier(); if (II != Block_releaseII) return; if (Call.getNumArgs() != 1) return; SymbolRef ReleasedValue = Call.getArgSVal(0).getAsSymbol(); if (!ReleasedValue) return; transitionToReleaseValue(C, ReleasedValue); } /// If the message was a call to '[super dealloc]', diagnose any missing /// releases. void ObjCDeallocChecker::checkPostObjCMessage( const ObjCMethodCall &M, CheckerContext &C) const { // We perform this check post-message so that if the super -dealloc // calls a helper method and that this class overrides, any ivars released in // the helper method will be recorded before checking. if (isSuperDeallocMessage(M)) diagnoseMissingReleases(C); } /// Check for missing releases even when -dealloc does not call /// '[super dealloc]'. void ObjCDeallocChecker::checkEndFunction( CheckerContext &C) const { diagnoseMissingReleases(C); } /// Check for missing releases on early return. void ObjCDeallocChecker::checkPreStmt( const ReturnStmt *RS, CheckerContext &C) const { diagnoseMissingReleases(C); } /// When a symbol is assumed to be nil, remove it from the set of symbols /// require to be nil. ProgramStateRef ObjCDeallocChecker::evalAssume(ProgramStateRef State, SVal Cond, bool Assumption) const { if (State->get().isEmpty()) return State; auto *CondBSE = dyn_cast_or_null(Cond.getAsSymExpr()); if (!CondBSE) return State; BinaryOperator::Opcode OpCode = CondBSE->getOpcode(); if (Assumption) { if (OpCode != BO_EQ) return State; } else { if (OpCode != BO_NE) return State; } SymbolRef NullSymbol = nullptr; if (auto *SIE = dyn_cast(CondBSE)) { const llvm::APInt &RHS = SIE->getRHS(); if (RHS != 0) return State; NullSymbol = SIE->getLHS(); } else if (auto *SIE = dyn_cast(CondBSE)) { const llvm::APInt &LHS = SIE->getLHS(); if (LHS != 0) return State; NullSymbol = SIE->getRHS(); } else { return State; } SymbolRef InstanceSymbol = getInstanceSymbolFromIvarSymbol(NullSymbol); if (!InstanceSymbol) return State; State = removeValueRequiringRelease(State, InstanceSymbol, NullSymbol); return State; } /// If a symbol escapes conservatively assume unseen code released it. ProgramStateRef ObjCDeallocChecker::checkPointerEscape( ProgramStateRef State, const InvalidatedSymbols &Escaped, const CallEvent *Call, PointerEscapeKind Kind) const { if (State->get().isEmpty()) return State; // Don't treat calls to '[super dealloc]' as escaping for the purposes // of this checker. Because the checker diagnoses missing releases in the // post-message handler for '[super dealloc], escaping here would cause // the checker to never warn. auto *OMC = dyn_cast_or_null(Call); if (OMC && isSuperDeallocMessage(*OMC)) return State; for (const auto &Sym : Escaped) { if (!Call || (Call && !Call->isInSystemHeader())) { // If Sym is a symbol for an object with instance variables that // must be released, remove these obligations when the object escapes // unless via a call to a system function. System functions are // very unlikely to release instance variables on objects passed to them, // and are frequently called on 'self' in -dealloc (e.g., to remove // observers) -- we want to avoid false negatives from escaping on // them. State = State->remove(Sym); } SymbolRef InstanceSymbol = getInstanceSymbolFromIvarSymbol(Sym); if (!InstanceSymbol) d177 2 a178 40 State = removeValueRequiringRelease(State, InstanceSymbol, Sym); } return State; } /// Report any unreleased instance variables for the current instance being /// dealloced. void ObjCDeallocChecker::diagnoseMissingReleases(CheckerContext &C) const { ProgramStateRef State = C.getState(); SVal SelfVal; if (!isInInstanceDealloc(C, SelfVal)) return; const MemRegion *SelfRegion = SelfVal.castAs().getRegion(); const LocationContext *LCtx = C.getLocationContext(); ExplodedNode *ErrNode = nullptr; SymbolRef SelfSym = SelfVal.getAsSymbol(); if (!SelfSym) return; const SymbolSet *OldUnreleased = State->get(SelfSym); if (!OldUnreleased) return; SymbolSet NewUnreleased = *OldUnreleased; SymbolSet::Factory &F = State->getStateManager().get_context(); ProgramStateRef InitialState = State; for (auto *IvarSymbol : *OldUnreleased) { const TypedValueRegion *TVR = cast(IvarSymbol)->getRegion(); const ObjCIvarRegion *IvarRegion = cast(TVR); // Don't warn if the ivar is not for this instance. if (SelfRegion != IvarRegion->getSuperRegion()) d181 2 a182 5 const ObjCIvarDecl *IvarDecl = IvarRegion->getDecl(); // Prevent an inlined call to -dealloc in a super class from warning // about the values the subclass's -dealloc should release. if (IvarDecl->getContainingInterface() != cast(LCtx->getDecl())->getClassInterface()) d185 2 a186 8 // Prevents diagnosing multiple times for the same instance variable // at, for example, both a return and at the end of of the function. NewUnreleased = F.remove(NewUnreleased, IvarSymbol); if (State->getStateManager() .getConstraintManager() .isNull(State, IvarSymbol) .isConstrainedTrue()) { a187 261 } // A missing release manifests as a leak, so treat as a non-fatal error. if (!ErrNode) ErrNode = C.generateNonFatalErrorNode(); // If we've already reached this node on another path, return without // diagnosing. if (!ErrNode) return; std::string Buf; llvm::raw_string_ostream OS(Buf); const ObjCInterfaceDecl *Interface = IvarDecl->getContainingInterface(); // If the class is known to have a lifecycle with teardown that is // separate from -dealloc, do not warn about missing releases. We // suppress here (rather than not tracking for instance variables in // such classes) because these classes are rare. if (classHasSeparateTeardown(Interface)) return; ObjCImplDecl *ImplDecl = Interface->getImplementation(); const ObjCPropertyImplDecl *PropImpl = ImplDecl->FindPropertyImplIvarDecl(IvarDecl->getIdentifier()); const ObjCPropertyDecl *PropDecl = PropImpl->getPropertyDecl(); assert(PropDecl->getSetterKind() == ObjCPropertyDecl::Copy || PropDecl->getSetterKind() == ObjCPropertyDecl::Retain); OS << "The '" << *IvarDecl << "' ivar in '" << *ImplDecl << "' was "; if (PropDecl->getSetterKind() == ObjCPropertyDecl::Retain) OS << "retained"; else OS << "copied"; OS << " by a synthesized property but not released" " before '[super dealloc]'"; std::unique_ptr BR( new BugReport(*MissingReleaseBugType, OS.str(), ErrNode)); C.emitReport(std::move(BR)); } if (NewUnreleased.isEmpty()) { State = State->remove(SelfSym); } else { State = State->set(SelfSym, NewUnreleased); } if (ErrNode) { C.addTransition(State, ErrNode); } else if (State != InitialState) { C.addTransition(State); } // Make sure that after checking in the top-most frame the list of // tracked ivars is empty. This is intended to detect accidental leaks in // the UnreleasedIvarMap program state. assert(!LCtx->inTopFrame() || State->get().isEmpty()); } /// Given a symbol, determine whether the symbol refers to an ivar on /// the top-most deallocating instance. If so, find the property for that /// ivar, if one exists. Otherwise return null. const ObjCPropertyImplDecl * ObjCDeallocChecker::findPropertyOnDeallocatingInstance( SymbolRef IvarSym, CheckerContext &C) const { SVal DeallocedInstance; if (!isInInstanceDealloc(C, DeallocedInstance)) return nullptr; // Try to get the region from which the ivar value was loaded. auto *IvarRegion = getIvarRegionForIvarSymbol(IvarSym); if (!IvarRegion) return nullptr; // Don't try to find the property if the ivar was not loaded from the // given instance. if (DeallocedInstance.castAs().getRegion() != IvarRegion->getSuperRegion()) return nullptr; const LocationContext *LCtx = C.getLocationContext(); const ObjCIvarDecl *IvarDecl = IvarRegion->getDecl(); const ObjCImplDecl *Container = getContainingObjCImpl(LCtx); const ObjCPropertyImplDecl *PropImpl = Container->FindPropertyImplIvarDecl(IvarDecl->getIdentifier()); return PropImpl; } /// Emits a warning if the current context is -dealloc and ReleasedValue /// must not be directly released in a -dealloc. Returns true if a diagnostic /// was emitted. bool ObjCDeallocChecker::diagnoseExtraRelease(SymbolRef ReleasedValue, const ObjCMethodCall &M, CheckerContext &C) const { // Try to get the region from which the the released value was loaded. // Note that, unlike diagnosing for missing releases, here we don't track // values that must not be released in the state. This is because even if // these values escape, it is still an error under the rules of MRR to // release them in -dealloc. const ObjCPropertyImplDecl *PropImpl = findPropertyOnDeallocatingInstance(ReleasedValue, C); if (!PropImpl) return false; // If the ivar belongs to a property that must not be released directly // in dealloc, emit a warning. if (getDeallocReleaseRequirement(PropImpl) != ReleaseRequirement::MustNotReleaseDirectly) { return false; } // If the property is readwrite but it shadows a read-only property in its // external interface, treat the property a read-only. If the outside // world cannot write to a property then the internal implementation is free // to make its own convention about whether the value is stored retained // or not. We look up the shadow here rather than in // getDeallocReleaseRequirement() because doing so can be expensive. const ObjCPropertyDecl *PropDecl = findShadowedPropertyDecl(PropImpl); if (PropDecl) { if (PropDecl->isReadOnly()) return false; } else { PropDecl = PropImpl->getPropertyDecl(); } ExplodedNode *ErrNode = C.generateNonFatalErrorNode(); if (!ErrNode) return false; std::string Buf; llvm::raw_string_ostream OS(Buf); assert(PropDecl->getSetterKind() == ObjCPropertyDecl::Weak || (PropDecl->getSetterKind() == ObjCPropertyDecl::Assign && !PropDecl->isReadOnly()) || isReleasedByCIFilterDealloc(PropImpl) ); const ObjCImplDecl *Container = getContainingObjCImpl(C.getLocationContext()); OS << "The '" << *PropImpl->getPropertyIvarDecl() << "' ivar in '" << *Container; if (isReleasedByCIFilterDealloc(PropImpl)) { OS << "' will be released by '-[CIFilter dealloc]' but also released here"; } else { OS << "' was synthesized for "; if (PropDecl->getSetterKind() == ObjCPropertyDecl::Weak) OS << "a weak"; else OS << "an assign, readwrite"; OS << " property but was released in 'dealloc'"; } std::unique_ptr BR( new BugReport(*ExtraReleaseBugType, OS.str(), ErrNode)); BR->addRange(M.getOriginExpr()->getSourceRange()); C.emitReport(std::move(BR)); return true; } /// Emits a warning if the current context is -dealloc and DeallocedValue /// must not be directly dealloced in a -dealloc. Returns true if a diagnostic /// was emitted. bool ObjCDeallocChecker::diagnoseMistakenDealloc(SymbolRef DeallocedValue, const ObjCMethodCall &M, CheckerContext &C) const { // Find the property backing the instance variable that M // is dealloc'ing. const ObjCPropertyImplDecl *PropImpl = findPropertyOnDeallocatingInstance(DeallocedValue, C); if (!PropImpl) return false; if (getDeallocReleaseRequirement(PropImpl) != ReleaseRequirement::MustRelease) { return false; } ExplodedNode *ErrNode = C.generateErrorNode(); if (!ErrNode) return false; std::string Buf; llvm::raw_string_ostream OS(Buf); OS << "'" << *PropImpl->getPropertyIvarDecl() << "' should be released rather than deallocated"; std::unique_ptr BR( new BugReport(*MistakenDeallocBugType, OS.str(), ErrNode)); BR->addRange(M.getOriginExpr()->getSourceRange()); C.emitReport(std::move(BR)); return true; } ObjCDeallocChecker::ObjCDeallocChecker() : NSObjectII(nullptr), SenTestCaseII(nullptr), XCTestCaseII(nullptr), CIFilterII(nullptr) { MissingReleaseBugType.reset( new BugType(this, "Missing ivar release (leak)", categories::MemoryCoreFoundationObjectiveC)); ExtraReleaseBugType.reset( new BugType(this, "Extra ivar release", categories::MemoryCoreFoundationObjectiveC)); MistakenDeallocBugType.reset( new BugType(this, "Mistaken dealloc", categories::MemoryCoreFoundationObjectiveC)); } void ObjCDeallocChecker::initIdentifierInfoAndSelectors( ASTContext &Ctx) const { if (NSObjectII) return; NSObjectII = &Ctx.Idents.get("NSObject"); SenTestCaseII = &Ctx.Idents.get("SenTestCase"); XCTestCaseII = &Ctx.Idents.get("XCTestCase"); Block_releaseII = &Ctx.Idents.get("_Block_release"); CIFilterII = &Ctx.Idents.get("CIFilter"); IdentifierInfo *DeallocII = &Ctx.Idents.get("dealloc"); IdentifierInfo *ReleaseII = &Ctx.Idents.get("release"); DeallocSel = Ctx.Selectors.getSelector(0, &DeallocII); ReleaseSel = Ctx.Selectors.getSelector(0, &ReleaseII); } /// Returns true if M is a call to '[super dealloc]'. bool ObjCDeallocChecker::isSuperDeallocMessage( const ObjCMethodCall &M) const { if (M.getOriginExpr()->getReceiverKind() != ObjCMessageExpr::SuperInstance) return false; return M.getSelector() == DeallocSel; } /// Returns the ObjCImplDecl containing the method declaration in LCtx. const ObjCImplDecl * ObjCDeallocChecker::getContainingObjCImpl(const LocationContext *LCtx) const { auto *MD = cast(LCtx->getDecl()); return cast(MD->getDeclContext()); } d189 2 a190 21 /// Returns the property that shadowed by PropImpl if one exists and /// nullptr otherwise. const ObjCPropertyDecl *ObjCDeallocChecker::findShadowedPropertyDecl( const ObjCPropertyImplDecl *PropImpl) const { const ObjCPropertyDecl *PropDecl = PropImpl->getPropertyDecl(); // Only readwrite properties can shadow. if (PropDecl->isReadOnly()) return nullptr; auto *CatDecl = dyn_cast(PropDecl->getDeclContext()); // Only class extensions can contain shadowing properties. if (!CatDecl || !CatDecl->IsClassExtension()) return nullptr; IdentifierInfo *ID = PropDecl->getIdentifier(); DeclContext::lookup_result R = CatDecl->getClassInterface()->lookup(ID); for (DeclContext::lookup_iterator I = R.begin(), E = R.end(); I != E; ++I) { auto *ShadowedPropDecl = dyn_cast(*I); if (!ShadowedPropDecl) d193 7 a199 5 if (ShadowedPropDecl->isInstanceProperty()) { assert(ShadowedPropDecl->isReadOnly()); return ShadowedPropDecl; } } d201 4 a204 2 return nullptr; } d206 7 a212 8 /// Add a transition noting the release of the given value. void ObjCDeallocChecker::transitionToReleaseValue(CheckerContext &C, SymbolRef Value) const { assert(Value); SymbolRef InstanceSym = getInstanceSymbolFromIvarSymbol(Value); if (!InstanceSym) return; ProgramStateRef InitialState = C.getState(); d214 4 a217 2 ProgramStateRef ReleasedState = removeValueRequiringRelease(InitialState, InstanceSym, Value); d219 2 a220 4 if (ReleasedState != InitialState) { C.addTransition(ReleasedState); } } d222 2 a223 22 /// Remove the Value requiring a release from the tracked set for /// Instance and return the resultant state. ProgramStateRef ObjCDeallocChecker::removeValueRequiringRelease( ProgramStateRef State, SymbolRef Instance, SymbolRef Value) const { assert(Instance); assert(Value); const ObjCIvarRegion *RemovedRegion = getIvarRegionForIvarSymbol(Value); if (!RemovedRegion) return State; const SymbolSet *Unreleased = State->get(Instance); if (!Unreleased) return State; // Mark the value as no longer requiring a release. SymbolSet::Factory &F = State->getStateManager().get_context(); SymbolSet NewUnreleased = *Unreleased; for (auto &Sym : *Unreleased) { const ObjCIvarRegion *UnreleasedRegion = getIvarRegionForIvarSymbol(Sym); assert(UnreleasedRegion); if (RemovedRegion->getDecl() == UnreleasedRegion->getDecl()) { NewUnreleased = F.remove(NewUnreleased, Sym); a225 6 if (NewUnreleased.isEmpty()) { return State->remove(Instance); } return State->set(Instance, NewUnreleased); d228 3 a230 33 /// Determines whether the instance variable for \p PropImpl must or must not be /// released in -dealloc or whether it cannot be determined. ReleaseRequirement ObjCDeallocChecker::getDeallocReleaseRequirement( const ObjCPropertyImplDecl *PropImpl) const { const ObjCIvarDecl *IvarDecl; const ObjCPropertyDecl *PropDecl; if (!isSynthesizedRetainableProperty(PropImpl, &IvarDecl, &PropDecl)) return ReleaseRequirement::Unknown; ObjCPropertyDecl::SetterKind SK = PropDecl->getSetterKind(); switch (SK) { // Retain and copy setters retain/copy their values before storing and so // the value in their instance variables must be released in -dealloc. case ObjCPropertyDecl::Retain: case ObjCPropertyDecl::Copy: if (isReleasedByCIFilterDealloc(PropImpl)) return ReleaseRequirement::MustNotReleaseDirectly; if (isNibLoadedIvarWithoutRetain(PropImpl)) return ReleaseRequirement::Unknown; return ReleaseRequirement::MustRelease; case ObjCPropertyDecl::Weak: return ReleaseRequirement::MustNotReleaseDirectly; case ObjCPropertyDecl::Assign: // It is common for the ivars for read-only assign properties to // always be stored retained, so their release requirement cannot be // be determined. if (PropDecl->isReadOnly()) return ReleaseRequirement::Unknown; d232 10 a241 1 return ReleaseRequirement::MustNotReleaseDirectly; d243 1 a243 69 llvm_unreachable("Unrecognized setter kind"); } /// Returns the released value if M is a call a setter that releases /// and nils out its underlying instance variable. SymbolRef ObjCDeallocChecker::getValueReleasedByNillingOut(const ObjCMethodCall &M, CheckerContext &C) const { SVal ReceiverVal = M.getReceiverSVal(); if (!ReceiverVal.isValid()) return nullptr; if (M.getNumArgs() == 0) return nullptr; if (!M.getArgExpr(0)->getType()->isObjCRetainableType()) return nullptr; // Is the first argument nil? SVal Arg = M.getArgSVal(0); ProgramStateRef notNilState, nilState; std::tie(notNilState, nilState) = M.getState()->assume(Arg.castAs()); if (!(nilState && !notNilState)) return nullptr; const ObjCPropertyDecl *Prop = M.getAccessedProperty(); if (!Prop) return nullptr; ObjCIvarDecl *PropIvarDecl = Prop->getPropertyIvarDecl(); if (!PropIvarDecl) return nullptr; ProgramStateRef State = C.getState(); SVal LVal = State->getLValue(PropIvarDecl, ReceiverVal); Optional LValLoc = LVal.getAs(); if (!LValLoc) return nullptr; SVal CurrentValInIvar = State->getSVal(LValLoc.getValue()); return CurrentValInIvar.getAsSymbol(); } /// Returns true if the current context is a call to -dealloc and false /// otherwise. If true, it also sets SelfValOut to the value of /// 'self'. bool ObjCDeallocChecker::isInInstanceDealloc(const CheckerContext &C, SVal &SelfValOut) const { return isInInstanceDealloc(C, C.getLocationContext(), SelfValOut); } /// Returns true if LCtx is a call to -dealloc and false /// otherwise. If true, it also sets SelfValOut to the value of /// 'self'. bool ObjCDeallocChecker::isInInstanceDealloc(const CheckerContext &C, const LocationContext *LCtx, SVal &SelfValOut) const { auto *MD = dyn_cast(LCtx->getDecl()); if (!MD || !MD->isInstanceMethod() || MD->getSelector() != DeallocSel) return false; const ImplicitParamDecl *SelfDecl = LCtx->getSelfDecl(); assert(SelfDecl && "No self in -dealloc?"); ProgramStateRef State = C.getState(); SelfValOut = State->getSVal(State->getRegion(SelfDecl, LCtx)); return true; d246 2 a247 104 /// Returns true if there is a call to -dealloc anywhere on the stack and false /// otherwise. If true, it also sets InstanceValOut to the value of /// 'self' in the frame for -dealloc. bool ObjCDeallocChecker::instanceDeallocIsOnStack(const CheckerContext &C, SVal &InstanceValOut) const { const LocationContext *LCtx = C.getLocationContext(); while (LCtx) { if (isInInstanceDealloc(C, LCtx, InstanceValOut)) return true; LCtx = LCtx->getParent(); } return false; } /// Returns true if the ID is a class in which which is known to have /// a separate teardown lifecycle. In this case, -dealloc warnings /// about missing releases should be suppressed. bool ObjCDeallocChecker::classHasSeparateTeardown( const ObjCInterfaceDecl *ID) const { // Suppress if the class is not a subclass of NSObject. for ( ; ID ; ID = ID->getSuperClass()) { IdentifierInfo *II = ID->getIdentifier(); if (II == NSObjectII) return false; // FIXME: For now, ignore classes that subclass SenTestCase and XCTestCase, // as these don't need to implement -dealloc. They implement tear down in // another way, which we should try and catch later. // http://llvm.org/bugs/show_bug.cgi?id=3187 if (II == XCTestCaseII || II == SenTestCaseII) return true; } return true; } /// The -dealloc method in CIFilter highly unusual in that is will release /// instance variables belonging to its *subclasses* if the variable name /// starts with "input" or backs a property whose name starts with "input". /// Subclasses should not release these ivars in their own -dealloc method -- /// doing so could result in an over release. /// /// This method returns true if the property will be released by /// -[CIFilter dealloc]. bool ObjCDeallocChecker::isReleasedByCIFilterDealloc( const ObjCPropertyImplDecl *PropImpl) const { assert(PropImpl->getPropertyIvarDecl()); StringRef PropName = PropImpl->getPropertyDecl()->getName(); StringRef IvarName = PropImpl->getPropertyIvarDecl()->getName(); const char *ReleasePrefix = "input"; if (!(PropName.startswith(ReleasePrefix) || IvarName.startswith(ReleasePrefix))) { return false; } const ObjCInterfaceDecl *ID = PropImpl->getPropertyIvarDecl()->getContainingInterface(); for ( ; ID ; ID = ID->getSuperClass()) { IdentifierInfo *II = ID->getIdentifier(); if (II == CIFilterII) return true; } return false; } /// Returns whether the ivar backing the property is an IBOutlet that /// has its value set by nib loading code without retaining the value. /// /// On macOS, if there is no setter, the nib-loading code sets the ivar /// directly, without retaining the value, /// /// On iOS and its derivatives, the nib-loading code will call /// -setValue:forKey:, which retains the value before directly setting the ivar. bool ObjCDeallocChecker::isNibLoadedIvarWithoutRetain( const ObjCPropertyImplDecl *PropImpl) const { const ObjCIvarDecl *IvarDecl = PropImpl->getPropertyIvarDecl(); if (!IvarDecl->hasAttr()) return false; const llvm::Triple &Target = IvarDecl->getASTContext().getTargetInfo().getTriple(); if (!Target.isMacOSX()) return false; if (PropImpl->getPropertyDecl()->getSetterMethodDecl()) return false; return true; } void ento::registerObjCDeallocChecker(CheckerManager &Mgr) { const LangOptions &LangOpts = Mgr.getLangOpts(); // These checker only makes sense under MRR. if (LangOpts.getGC() == LangOptions::GCOnly || LangOpts.ObjCAutoRefCount) return; Mgr.registerChecker(); @ 1.1.1.7 log @Import Clang pre-4.0.0 r291444. @ text @d10 3 a12 18 // This checker analyzes Objective-C -dealloc methods and their callees // to warn about improper releasing of instance variables that back synthesized // properties. It warns about missing releases in the following cases: // - When a class has a synthesized instance variable for a 'retain' or 'copy' // property and lacks a -dealloc method in its implementation. // - When a class has a synthesized instance variable for a 'retain'/'copy' // property but the ivar is not released in -dealloc by either -release // or by nilling out the property. // // It warns about extra releases in -dealloc (but not in callees) when a // synthesized instance variable is released in the following cases: // - When the property is 'assign' and is not 'readonly'. // - When the property is 'weak'. // // This checker only warns for instance variables synthesized to back // properties. Handling the more general case would require inferring whether // an instance variable is stored retained or not. For synthesized properties, // this is specified in the property declaration itself. a21 1 #include "clang/Basic/TargetInfo.h" a22 1 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" a25 5 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h" #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h" #include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h" d31 44 a74 6 /// Indicates whether an instance variable is required to be released in /// -dealloc. enum class ReleaseRequirement { /// The instance variable must be released, either by calling /// -release on it directly or by nilling it out with a property setter. MustRelease, d76 1 a76 29 /// The instance variable must not be directly released with -release. MustNotReleaseDirectly, /// The requirement for the instance variable could not be determined. Unknown }; /// Returns true if the property implementation is synthesized and the /// type of the property is retainable. static bool isSynthesizedRetainableProperty(const ObjCPropertyImplDecl *I, const ObjCIvarDecl **ID, const ObjCPropertyDecl **PD) { if (I->getPropertyImplementation() != ObjCPropertyImplDecl::Synthesize) return false; (*ID) = I->getPropertyIvarDecl(); if (!(*ID)) return false; QualType T = (*ID)->getType(); if (!T->isObjCRetainableType()) return false; (*PD) = I->getPropertyDecl(); // Shouldn't be able to synthesize a property that doesn't exist. assert(*PD); return true; d79 3 a81 1 namespace { d83 1 a83 17 class ObjCDeallocChecker : public Checker, check::PreObjCMessage, check::PostObjCMessage, check::PreCall, check::BeginFunction, check::EndFunction, eval::Assume, check::PointerEscape, check::PreStmt> { mutable IdentifierInfo *NSObjectII, *SenTestCaseII, *XCTestCaseII, *Block_releaseII, *CIFilterII; mutable Selector DeallocSel, ReleaseSel; std::unique_ptr MissingReleaseBugType; std::unique_ptr ExtraReleaseBugType; std::unique_ptr MistakenDeallocBugType; d85 2 a86 2 public: ObjCDeallocChecker(); d88 4 a91 6 void checkASTDecl(const ObjCImplementationDecl *D, AnalysisManager& Mgr, BugReporter &BR) const; void checkBeginFunction(CheckerContext &Ctx) const; void checkPreObjCMessage(const ObjCMethodCall &M, CheckerContext &C) const; void checkPreCall(const CallEvent &Call, CheckerContext &C) const; void checkPostObjCMessage(const ObjCMethodCall &M, CheckerContext &C) const; d93 1 a93 2 ProgramStateRef evalAssume(ProgramStateRef State, SVal Cond, bool Assumption) const; d95 2 a96 6 ProgramStateRef checkPointerEscape(ProgramStateRef State, const InvalidatedSymbols &Escaped, const CallEvent *Call, PointerEscapeKind Kind) const; void checkPreStmt(const ReturnStmt *RS, CheckerContext &C) const; void checkEndFunction(CheckerContext &Ctx) const; d98 4 a101 2 private: void diagnoseMissingReleases(CheckerContext &C) const; d103 3 a105 2 bool diagnoseExtraRelease(SymbolRef ReleasedValue, const ObjCMethodCall &M, CheckerContext &C) const; d107 2 a108 3 bool diagnoseMistakenDealloc(SymbolRef DeallocedValue, const ObjCMethodCall &M, CheckerContext &C) const; d110 3 a112 2 SymbolRef getValueReleasedByNillingOut(const ObjCMethodCall &M, CheckerContext &C) const; a113 2 const ObjCIvarRegion *getIvarRegionForIvarSymbol(SymbolRef IvarSym) const; SymbolRef getInstanceSymbolFromIvarSymbol(SymbolRef IvarSym) const; d115 2 a116 3 const ObjCPropertyImplDecl* findPropertyOnDeallocatingInstance(SymbolRef IvarSym, CheckerContext &C) const; d118 2 a119 2 ReleaseRequirement getDeallocReleaseRequirement(const ObjCPropertyImplDecl *PropImpl) const; d121 6 a126 70 bool isInInstanceDealloc(const CheckerContext &C, SVal &SelfValOut) const; bool isInInstanceDealloc(const CheckerContext &C, const LocationContext *LCtx, SVal &SelfValOut) const; bool instanceDeallocIsOnStack(const CheckerContext &C, SVal &InstanceValOut) const; bool isSuperDeallocMessage(const ObjCMethodCall &M) const; const ObjCImplDecl *getContainingObjCImpl(const LocationContext *LCtx) const; const ObjCPropertyDecl * findShadowedPropertyDecl(const ObjCPropertyImplDecl *PropImpl) const; void transitionToReleaseValue(CheckerContext &C, SymbolRef Value) const; ProgramStateRef removeValueRequiringRelease(ProgramStateRef State, SymbolRef InstanceSym, SymbolRef ValueSym) const; void initIdentifierInfoAndSelectors(ASTContext &Ctx) const; bool classHasSeparateTeardown(const ObjCInterfaceDecl *ID) const; bool isReleasedByCIFilterDealloc(const ObjCPropertyImplDecl *PropImpl) const; bool isNibLoadedIvarWithoutRetain(const ObjCPropertyImplDecl *PropImpl) const; }; } // End anonymous namespace. typedef llvm::ImmutableSet SymbolSet; /// Maps from the symbol for a class instance to the set of /// symbols remaining that must be released in -dealloc. REGISTER_MAP_WITH_PROGRAMSTATE(UnreleasedIvarMap, SymbolRef, SymbolSet) namespace clang { namespace ento { template<> struct ProgramStateTrait : public ProgramStatePartialTrait { static void *GDMIndex() { static int index = 0; return &index; } }; } } /// An AST check that diagnose when the class requires a -dealloc method and /// is missing one. void ObjCDeallocChecker::checkASTDecl(const ObjCImplementationDecl *D, AnalysisManager &Mgr, BugReporter &BR) const { assert(Mgr.getLangOpts().getGC() != LangOptions::GCOnly); assert(!Mgr.getLangOpts().ObjCAutoRefCount); initIdentifierInfoAndSelectors(Mgr.getASTContext()); const ObjCInterfaceDecl *ID = D->getClassInterface(); // If the class is known to have a lifecycle with a separate teardown method // then it may not require a -dealloc method. if (classHasSeparateTeardown(ID)) return; // Does the class contain any synthesized properties that are retainable? // If not, skip the check entirely. const ObjCPropertyImplDecl *PropImplRequiringRelease = nullptr; bool HasOthers = false; for (const auto *I : D->property_impls()) { if (getDeallocReleaseRequirement(I) == ReleaseRequirement::MustRelease) { if (!PropImplRequiringRelease) PropImplRequiringRelease = I; else { HasOthers = true; break; } } d129 1 a129 1 if (!PropImplRequiringRelease) d132 3 d139 1 a139 1 if (I->getSelector() == DeallocSel) { d145 3 a148 52 const char* Name = "Missing -dealloc"; std::string Buf; llvm::raw_string_ostream OS(Buf); OS << "'" << *D << "' lacks a 'dealloc' instance method but " << "must release '" << *PropImplRequiringRelease->getPropertyIvarDecl() << "'"; if (HasOthers) OS << " and others"; PathDiagnosticLocation DLoc = PathDiagnosticLocation::createBegin(D, BR.getSourceManager()); BR.EmitBasicReport(D, this, Name, categories::CoreFoundationObjectiveC, OS.str(), DLoc); return; } } /// If this is the beginning of -dealloc, mark the values initially stored in /// instance variables that must be released by the end of -dealloc /// as unreleased in the state. void ObjCDeallocChecker::checkBeginFunction( CheckerContext &C) const { initIdentifierInfoAndSelectors(C.getASTContext()); // Only do this if the current method is -dealloc. SVal SelfVal; if (!isInInstanceDealloc(C, SelfVal)) return; SymbolRef SelfSymbol = SelfVal.getAsSymbol(); const LocationContext *LCtx = C.getLocationContext(); ProgramStateRef InitialState = C.getState(); ProgramStateRef State = InitialState; SymbolSet::Factory &F = State->getStateManager().get_context(); // Symbols that must be released by the end of the -dealloc; SymbolSet RequiredReleases = F.getEmptySet(); // If we're an inlined -dealloc, we should add our symbols to the existing // set from our subclass. if (const SymbolSet *CurrSet = State->get(SelfSymbol)) RequiredReleases = *CurrSet; for (auto *PropImpl : getContainingObjCImpl(LCtx)->property_impls()) { ReleaseRequirement Requirement = getDeallocReleaseRequirement(PropImpl); if (Requirement != ReleaseRequirement::MustRelease) continue; d150 3 a152 13 SVal LVal = State->getLValue(PropImpl->getPropertyIvarDecl(), SelfVal); Optional LValLoc = LVal.getAs(); if (!LValLoc) continue; SVal InitialVal = State->getSVal(LValLoc.getValue()); SymbolRef Symbol = InitialVal.getAsSymbol(); if (!Symbol || !isa(Symbol)) continue; // Mark the value as requiring a release. RequiredReleases = F.add(RequiredReleases, Symbol); } d154 3 a156 3 if (!RequiredReleases.isEmpty()) { State = State->set(SelfSymbol, RequiredReleases); } d158 2 a159 31 if (State != InitialState) { C.addTransition(State); } } /// Given a symbol for an ivar, return the ivar region it was loaded from. /// Returns nullptr if the instance symbol cannot be found. const ObjCIvarRegion * ObjCDeallocChecker::getIvarRegionForIvarSymbol(SymbolRef IvarSym) const { return dyn_cast_or_null(IvarSym->getOriginRegion()); } /// Given a symbol for an ivar, return a symbol for the instance containing /// the ivar. Returns nullptr if the instance symbol cannot be found. SymbolRef ObjCDeallocChecker::getInstanceSymbolFromIvarSymbol(SymbolRef IvarSym) const { const ObjCIvarRegion *IvarRegion = getIvarRegionForIvarSymbol(IvarSym); if (!IvarRegion) return nullptr; return IvarRegion->getSymbolicBase()->getSymbol(); } /// If we are in -dealloc or -dealloc is on the stack, handle the call if it is /// a release or a nilling-out property setter. void ObjCDeallocChecker::checkPreObjCMessage( const ObjCMethodCall &M, CheckerContext &C) const { // Only run if -dealloc is on the stack. SVal DeallocedInstance; if (!instanceDeallocIsOnStack(C, DeallocedInstance)) a160 19 SymbolRef ReleasedValue = nullptr; if (M.getSelector() == ReleaseSel) { ReleasedValue = M.getReceiverSVal().getAsSymbol(); } else if (M.getSelector() == DeallocSel && !M.isReceiverSelfOrSuper()) { if (diagnoseMistakenDealloc(M.getReceiverSVal().getAsSymbol(), M, C)) return; } if (ReleasedValue) { // An instance variable symbol was released with -release: // [_property release]; if (diagnoseExtraRelease(ReleasedValue,M, C)) return; } else { // An instance variable symbol was released nilling out its property: // self.property = nil; ReleasedValue = getValueReleasedByNillingOut(M, C); d163 3 a165 2 if (!ReleasedValue) return; d167 2 a168 2 transitionToReleaseValue(C, ReleasedValue); } d170 5 a174 116 /// If we are in -dealloc or -dealloc is on the stack, handle the call if it is /// call to Block_release(). void ObjCDeallocChecker::checkPreCall(const CallEvent &Call, CheckerContext &C) const { const IdentifierInfo *II = Call.getCalleeIdentifier(); if (II != Block_releaseII) return; if (Call.getNumArgs() != 1) return; SymbolRef ReleasedValue = Call.getArgSVal(0).getAsSymbol(); if (!ReleasedValue) return; transitionToReleaseValue(C, ReleasedValue); } /// If the message was a call to '[super dealloc]', diagnose any missing /// releases. void ObjCDeallocChecker::checkPostObjCMessage( const ObjCMethodCall &M, CheckerContext &C) const { // We perform this check post-message so that if the super -dealloc // calls a helper method and that this class overrides, any ivars released in // the helper method will be recorded before checking. if (isSuperDeallocMessage(M)) diagnoseMissingReleases(C); } /// Check for missing releases even when -dealloc does not call /// '[super dealloc]'. void ObjCDeallocChecker::checkEndFunction( CheckerContext &C) const { diagnoseMissingReleases(C); } /// Check for missing releases on early return. void ObjCDeallocChecker::checkPreStmt( const ReturnStmt *RS, CheckerContext &C) const { diagnoseMissingReleases(C); } /// When a symbol is assumed to be nil, remove it from the set of symbols /// require to be nil. ProgramStateRef ObjCDeallocChecker::evalAssume(ProgramStateRef State, SVal Cond, bool Assumption) const { if (State->get().isEmpty()) return State; auto *CondBSE = dyn_cast_or_null(Cond.getAsSymExpr()); if (!CondBSE) return State; BinaryOperator::Opcode OpCode = CondBSE->getOpcode(); if (Assumption) { if (OpCode != BO_EQ) return State; } else { if (OpCode != BO_NE) return State; } SymbolRef NullSymbol = nullptr; if (auto *SIE = dyn_cast(CondBSE)) { const llvm::APInt &RHS = SIE->getRHS(); if (RHS != 0) return State; NullSymbol = SIE->getLHS(); } else if (auto *SIE = dyn_cast(CondBSE)) { const llvm::APInt &LHS = SIE->getLHS(); if (LHS != 0) return State; NullSymbol = SIE->getRHS(); } else { return State; } SymbolRef InstanceSymbol = getInstanceSymbolFromIvarSymbol(NullSymbol); if (!InstanceSymbol) return State; State = removeValueRequiringRelease(State, InstanceSymbol, NullSymbol); return State; } /// If a symbol escapes conservatively assume unseen code released it. ProgramStateRef ObjCDeallocChecker::checkPointerEscape( ProgramStateRef State, const InvalidatedSymbols &Escaped, const CallEvent *Call, PointerEscapeKind Kind) const { if (State->get().isEmpty()) return State; // Don't treat calls to '[super dealloc]' as escaping for the purposes // of this checker. Because the checker diagnoses missing releases in the // post-message handler for '[super dealloc], escaping here would cause // the checker to never warn. auto *OMC = dyn_cast_or_null(Call); if (OMC && isSuperDeallocMessage(*OMC)) return State; for (const auto &Sym : Escaped) { if (!Call || (Call && !Call->isInSystemHeader())) { // If Sym is a symbol for an object with instance variables that // must be released, remove these obligations when the object escapes // unless via a call to a system function. System functions are // very unlikely to release instance variables on objects passed to them, // and are frequently called on 'self' in -dealloc (e.g., to remove // observers) -- we want to avoid false negatives from escaping on // them. State = State->remove(Sym); } SymbolRef InstanceSymbol = getInstanceSymbolFromIvarSymbol(Sym); if (!InstanceSymbol) d177 2 a178 40 State = removeValueRequiringRelease(State, InstanceSymbol, Sym); } return State; } /// Report any unreleased instance variables for the current instance being /// dealloced. void ObjCDeallocChecker::diagnoseMissingReleases(CheckerContext &C) const { ProgramStateRef State = C.getState(); SVal SelfVal; if (!isInInstanceDealloc(C, SelfVal)) return; const MemRegion *SelfRegion = SelfVal.castAs().getRegion(); const LocationContext *LCtx = C.getLocationContext(); ExplodedNode *ErrNode = nullptr; SymbolRef SelfSym = SelfVal.getAsSymbol(); if (!SelfSym) return; const SymbolSet *OldUnreleased = State->get(SelfSym); if (!OldUnreleased) return; SymbolSet NewUnreleased = *OldUnreleased; SymbolSet::Factory &F = State->getStateManager().get_context(); ProgramStateRef InitialState = State; for (auto *IvarSymbol : *OldUnreleased) { const TypedValueRegion *TVR = cast(IvarSymbol)->getRegion(); const ObjCIvarRegion *IvarRegion = cast(TVR); // Don't warn if the ivar is not for this instance. if (SelfRegion != IvarRegion->getSuperRegion()) d181 2 a182 5 const ObjCIvarDecl *IvarDecl = IvarRegion->getDecl(); // Prevent an inlined call to -dealloc in a super class from warning // about the values the subclass's -dealloc should release. if (IvarDecl->getContainingInterface() != cast(LCtx->getDecl())->getClassInterface()) d185 2 a186 8 // Prevents diagnosing multiple times for the same instance variable // at, for example, both a return and at the end of of the function. NewUnreleased = F.remove(NewUnreleased, IvarSymbol); if (State->getStateManager() .getConstraintManager() .isNull(State, IvarSymbol) .isConstrainedTrue()) { a187 261 } // A missing release manifests as a leak, so treat as a non-fatal error. if (!ErrNode) ErrNode = C.generateNonFatalErrorNode(); // If we've already reached this node on another path, return without // diagnosing. if (!ErrNode) return; std::string Buf; llvm::raw_string_ostream OS(Buf); const ObjCInterfaceDecl *Interface = IvarDecl->getContainingInterface(); // If the class is known to have a lifecycle with teardown that is // separate from -dealloc, do not warn about missing releases. We // suppress here (rather than not tracking for instance variables in // such classes) because these classes are rare. if (classHasSeparateTeardown(Interface)) return; ObjCImplDecl *ImplDecl = Interface->getImplementation(); const ObjCPropertyImplDecl *PropImpl = ImplDecl->FindPropertyImplIvarDecl(IvarDecl->getIdentifier()); const ObjCPropertyDecl *PropDecl = PropImpl->getPropertyDecl(); assert(PropDecl->getSetterKind() == ObjCPropertyDecl::Copy || PropDecl->getSetterKind() == ObjCPropertyDecl::Retain); OS << "The '" << *IvarDecl << "' ivar in '" << *ImplDecl << "' was "; if (PropDecl->getSetterKind() == ObjCPropertyDecl::Retain) OS << "retained"; else OS << "copied"; OS << " by a synthesized property but not released" " before '[super dealloc]'"; std::unique_ptr BR( new BugReport(*MissingReleaseBugType, OS.str(), ErrNode)); C.emitReport(std::move(BR)); } if (NewUnreleased.isEmpty()) { State = State->remove(SelfSym); } else { State = State->set(SelfSym, NewUnreleased); } if (ErrNode) { C.addTransition(State, ErrNode); } else if (State != InitialState) { C.addTransition(State); } // Make sure that after checking in the top-most frame the list of // tracked ivars is empty. This is intended to detect accidental leaks in // the UnreleasedIvarMap program state. assert(!LCtx->inTopFrame() || State->get().isEmpty()); } /// Given a symbol, determine whether the symbol refers to an ivar on /// the top-most deallocating instance. If so, find the property for that /// ivar, if one exists. Otherwise return null. const ObjCPropertyImplDecl * ObjCDeallocChecker::findPropertyOnDeallocatingInstance( SymbolRef IvarSym, CheckerContext &C) const { SVal DeallocedInstance; if (!isInInstanceDealloc(C, DeallocedInstance)) return nullptr; // Try to get the region from which the ivar value was loaded. auto *IvarRegion = getIvarRegionForIvarSymbol(IvarSym); if (!IvarRegion) return nullptr; // Don't try to find the property if the ivar was not loaded from the // given instance. if (DeallocedInstance.castAs().getRegion() != IvarRegion->getSuperRegion()) return nullptr; const LocationContext *LCtx = C.getLocationContext(); const ObjCIvarDecl *IvarDecl = IvarRegion->getDecl(); const ObjCImplDecl *Container = getContainingObjCImpl(LCtx); const ObjCPropertyImplDecl *PropImpl = Container->FindPropertyImplIvarDecl(IvarDecl->getIdentifier()); return PropImpl; } /// Emits a warning if the current context is -dealloc and ReleasedValue /// must not be directly released in a -dealloc. Returns true if a diagnostic /// was emitted. bool ObjCDeallocChecker::diagnoseExtraRelease(SymbolRef ReleasedValue, const ObjCMethodCall &M, CheckerContext &C) const { // Try to get the region from which the the released value was loaded. // Note that, unlike diagnosing for missing releases, here we don't track // values that must not be released in the state. This is because even if // these values escape, it is still an error under the rules of MRR to // release them in -dealloc. const ObjCPropertyImplDecl *PropImpl = findPropertyOnDeallocatingInstance(ReleasedValue, C); if (!PropImpl) return false; // If the ivar belongs to a property that must not be released directly // in dealloc, emit a warning. if (getDeallocReleaseRequirement(PropImpl) != ReleaseRequirement::MustNotReleaseDirectly) { return false; } // If the property is readwrite but it shadows a read-only property in its // external interface, treat the property a read-only. If the outside // world cannot write to a property then the internal implementation is free // to make its own convention about whether the value is stored retained // or not. We look up the shadow here rather than in // getDeallocReleaseRequirement() because doing so can be expensive. const ObjCPropertyDecl *PropDecl = findShadowedPropertyDecl(PropImpl); if (PropDecl) { if (PropDecl->isReadOnly()) return false; } else { PropDecl = PropImpl->getPropertyDecl(); } ExplodedNode *ErrNode = C.generateNonFatalErrorNode(); if (!ErrNode) return false; std::string Buf; llvm::raw_string_ostream OS(Buf); assert(PropDecl->getSetterKind() == ObjCPropertyDecl::Weak || (PropDecl->getSetterKind() == ObjCPropertyDecl::Assign && !PropDecl->isReadOnly()) || isReleasedByCIFilterDealloc(PropImpl) ); const ObjCImplDecl *Container = getContainingObjCImpl(C.getLocationContext()); OS << "The '" << *PropImpl->getPropertyIvarDecl() << "' ivar in '" << *Container; if (isReleasedByCIFilterDealloc(PropImpl)) { OS << "' will be released by '-[CIFilter dealloc]' but also released here"; } else { OS << "' was synthesized for "; if (PropDecl->getSetterKind() == ObjCPropertyDecl::Weak) OS << "a weak"; else OS << "an assign, readwrite"; OS << " property but was released in 'dealloc'"; } std::unique_ptr BR( new BugReport(*ExtraReleaseBugType, OS.str(), ErrNode)); BR->addRange(M.getOriginExpr()->getSourceRange()); C.emitReport(std::move(BR)); return true; } /// Emits a warning if the current context is -dealloc and DeallocedValue /// must not be directly dealloced in a -dealloc. Returns true if a diagnostic /// was emitted. bool ObjCDeallocChecker::diagnoseMistakenDealloc(SymbolRef DeallocedValue, const ObjCMethodCall &M, CheckerContext &C) const { // Find the property backing the instance variable that M // is dealloc'ing. const ObjCPropertyImplDecl *PropImpl = findPropertyOnDeallocatingInstance(DeallocedValue, C); if (!PropImpl) return false; if (getDeallocReleaseRequirement(PropImpl) != ReleaseRequirement::MustRelease) { return false; } ExplodedNode *ErrNode = C.generateErrorNode(); if (!ErrNode) return false; std::string Buf; llvm::raw_string_ostream OS(Buf); OS << "'" << *PropImpl->getPropertyIvarDecl() << "' should be released rather than deallocated"; std::unique_ptr BR( new BugReport(*MistakenDeallocBugType, OS.str(), ErrNode)); BR->addRange(M.getOriginExpr()->getSourceRange()); C.emitReport(std::move(BR)); return true; } ObjCDeallocChecker::ObjCDeallocChecker() : NSObjectII(nullptr), SenTestCaseII(nullptr), XCTestCaseII(nullptr), CIFilterII(nullptr) { MissingReleaseBugType.reset( new BugType(this, "Missing ivar release (leak)", categories::MemoryCoreFoundationObjectiveC)); ExtraReleaseBugType.reset( new BugType(this, "Extra ivar release", categories::MemoryCoreFoundationObjectiveC)); MistakenDeallocBugType.reset( new BugType(this, "Mistaken dealloc", categories::MemoryCoreFoundationObjectiveC)); } void ObjCDeallocChecker::initIdentifierInfoAndSelectors( ASTContext &Ctx) const { if (NSObjectII) return; NSObjectII = &Ctx.Idents.get("NSObject"); SenTestCaseII = &Ctx.Idents.get("SenTestCase"); XCTestCaseII = &Ctx.Idents.get("XCTestCase"); Block_releaseII = &Ctx.Idents.get("_Block_release"); CIFilterII = &Ctx.Idents.get("CIFilter"); IdentifierInfo *DeallocII = &Ctx.Idents.get("dealloc"); IdentifierInfo *ReleaseII = &Ctx.Idents.get("release"); DeallocSel = Ctx.Selectors.getSelector(0, &DeallocII); ReleaseSel = Ctx.Selectors.getSelector(0, &ReleaseII); } /// Returns true if M is a call to '[super dealloc]'. bool ObjCDeallocChecker::isSuperDeallocMessage( const ObjCMethodCall &M) const { if (M.getOriginExpr()->getReceiverKind() != ObjCMessageExpr::SuperInstance) return false; return M.getSelector() == DeallocSel; } /// Returns the ObjCImplDecl containing the method declaration in LCtx. const ObjCImplDecl * ObjCDeallocChecker::getContainingObjCImpl(const LocationContext *LCtx) const { auto *MD = cast(LCtx->getDecl()); return cast(MD->getDeclContext()); } d189 2 a190 21 /// Returns the property that shadowed by PropImpl if one exists and /// nullptr otherwise. const ObjCPropertyDecl *ObjCDeallocChecker::findShadowedPropertyDecl( const ObjCPropertyImplDecl *PropImpl) const { const ObjCPropertyDecl *PropDecl = PropImpl->getPropertyDecl(); // Only readwrite properties can shadow. if (PropDecl->isReadOnly()) return nullptr; auto *CatDecl = dyn_cast(PropDecl->getDeclContext()); // Only class extensions can contain shadowing properties. if (!CatDecl || !CatDecl->IsClassExtension()) return nullptr; IdentifierInfo *ID = PropDecl->getIdentifier(); DeclContext::lookup_result R = CatDecl->getClassInterface()->lookup(ID); for (DeclContext::lookup_iterator I = R.begin(), E = R.end(); I != E; ++I) { auto *ShadowedPropDecl = dyn_cast(*I); if (!ShadowedPropDecl) d193 7 a199 5 if (ShadowedPropDecl->isInstanceProperty()) { assert(ShadowedPropDecl->isReadOnly()); return ShadowedPropDecl; } } d201 4 a204 2 return nullptr; } d206 7 a212 8 /// Add a transition noting the release of the given value. void ObjCDeallocChecker::transitionToReleaseValue(CheckerContext &C, SymbolRef Value) const { assert(Value); SymbolRef InstanceSym = getInstanceSymbolFromIvarSymbol(Value); if (!InstanceSym) return; ProgramStateRef InitialState = C.getState(); d214 4 a217 2 ProgramStateRef ReleasedState = removeValueRequiringRelease(InitialState, InstanceSym, Value); d219 2 a220 4 if (ReleasedState != InitialState) { C.addTransition(ReleasedState); } } d222 2 a223 22 /// Remove the Value requiring a release from the tracked set for /// Instance and return the resultant state. ProgramStateRef ObjCDeallocChecker::removeValueRequiringRelease( ProgramStateRef State, SymbolRef Instance, SymbolRef Value) const { assert(Instance); assert(Value); const ObjCIvarRegion *RemovedRegion = getIvarRegionForIvarSymbol(Value); if (!RemovedRegion) return State; const SymbolSet *Unreleased = State->get(Instance); if (!Unreleased) return State; // Mark the value as no longer requiring a release. SymbolSet::Factory &F = State->getStateManager().get_context(); SymbolSet NewUnreleased = *Unreleased; for (auto &Sym : *Unreleased) { const ObjCIvarRegion *UnreleasedRegion = getIvarRegionForIvarSymbol(Sym); assert(UnreleasedRegion); if (RemovedRegion->getDecl() == UnreleasedRegion->getDecl()) { NewUnreleased = F.remove(NewUnreleased, Sym); a225 6 if (NewUnreleased.isEmpty()) { return State->remove(Instance); } return State->set(Instance, NewUnreleased); d228 3 a230 33 /// Determines whether the instance variable for \p PropImpl must or must not be /// released in -dealloc or whether it cannot be determined. ReleaseRequirement ObjCDeallocChecker::getDeallocReleaseRequirement( const ObjCPropertyImplDecl *PropImpl) const { const ObjCIvarDecl *IvarDecl; const ObjCPropertyDecl *PropDecl; if (!isSynthesizedRetainableProperty(PropImpl, &IvarDecl, &PropDecl)) return ReleaseRequirement::Unknown; ObjCPropertyDecl::SetterKind SK = PropDecl->getSetterKind(); switch (SK) { // Retain and copy setters retain/copy their values before storing and so // the value in their instance variables must be released in -dealloc. case ObjCPropertyDecl::Retain: case ObjCPropertyDecl::Copy: if (isReleasedByCIFilterDealloc(PropImpl)) return ReleaseRequirement::MustNotReleaseDirectly; if (isNibLoadedIvarWithoutRetain(PropImpl)) return ReleaseRequirement::Unknown; return ReleaseRequirement::MustRelease; case ObjCPropertyDecl::Weak: return ReleaseRequirement::MustNotReleaseDirectly; case ObjCPropertyDecl::Assign: // It is common for the ivars for read-only assign properties to // always be stored retained, so their release requirement cannot be // be determined. if (PropDecl->isReadOnly()) return ReleaseRequirement::Unknown; d232 10 a241 1 return ReleaseRequirement::MustNotReleaseDirectly; d243 1 a243 69 llvm_unreachable("Unrecognized setter kind"); } /// Returns the released value if M is a call a setter that releases /// and nils out its underlying instance variable. SymbolRef ObjCDeallocChecker::getValueReleasedByNillingOut(const ObjCMethodCall &M, CheckerContext &C) const { SVal ReceiverVal = M.getReceiverSVal(); if (!ReceiverVal.isValid()) return nullptr; if (M.getNumArgs() == 0) return nullptr; if (!M.getArgExpr(0)->getType()->isObjCRetainableType()) return nullptr; // Is the first argument nil? SVal Arg = M.getArgSVal(0); ProgramStateRef notNilState, nilState; std::tie(notNilState, nilState) = M.getState()->assume(Arg.castAs()); if (!(nilState && !notNilState)) return nullptr; const ObjCPropertyDecl *Prop = M.getAccessedProperty(); if (!Prop) return nullptr; ObjCIvarDecl *PropIvarDecl = Prop->getPropertyIvarDecl(); if (!PropIvarDecl) return nullptr; ProgramStateRef State = C.getState(); SVal LVal = State->getLValue(PropIvarDecl, ReceiverVal); Optional LValLoc = LVal.getAs(); if (!LValLoc) return nullptr; SVal CurrentValInIvar = State->getSVal(LValLoc.getValue()); return CurrentValInIvar.getAsSymbol(); } /// Returns true if the current context is a call to -dealloc and false /// otherwise. If true, it also sets SelfValOut to the value of /// 'self'. bool ObjCDeallocChecker::isInInstanceDealloc(const CheckerContext &C, SVal &SelfValOut) const { return isInInstanceDealloc(C, C.getLocationContext(), SelfValOut); } /// Returns true if LCtx is a call to -dealloc and false /// otherwise. If true, it also sets SelfValOut to the value of /// 'self'. bool ObjCDeallocChecker::isInInstanceDealloc(const CheckerContext &C, const LocationContext *LCtx, SVal &SelfValOut) const { auto *MD = dyn_cast(LCtx->getDecl()); if (!MD || !MD->isInstanceMethod() || MD->getSelector() != DeallocSel) return false; const ImplicitParamDecl *SelfDecl = LCtx->getSelfDecl(); assert(SelfDecl && "No self in -dealloc?"); ProgramStateRef State = C.getState(); SelfValOut = State->getSVal(State->getRegion(SelfDecl, LCtx)); return true; d246 2 a247 104 /// Returns true if there is a call to -dealloc anywhere on the stack and false /// otherwise. If true, it also sets InstanceValOut to the value of /// 'self' in the frame for -dealloc. bool ObjCDeallocChecker::instanceDeallocIsOnStack(const CheckerContext &C, SVal &InstanceValOut) const { const LocationContext *LCtx = C.getLocationContext(); while (LCtx) { if (isInInstanceDealloc(C, LCtx, InstanceValOut)) return true; LCtx = LCtx->getParent(); } return false; } /// Returns true if the ID is a class in which which is known to have /// a separate teardown lifecycle. In this case, -dealloc warnings /// about missing releases should be suppressed. bool ObjCDeallocChecker::classHasSeparateTeardown( const ObjCInterfaceDecl *ID) const { // Suppress if the class is not a subclass of NSObject. for ( ; ID ; ID = ID->getSuperClass()) { IdentifierInfo *II = ID->getIdentifier(); if (II == NSObjectII) return false; // FIXME: For now, ignore classes that subclass SenTestCase and XCTestCase, // as these don't need to implement -dealloc. They implement tear down in // another way, which we should try and catch later. // http://llvm.org/bugs/show_bug.cgi?id=3187 if (II == XCTestCaseII || II == SenTestCaseII) return true; } return true; } /// The -dealloc method in CIFilter highly unusual in that is will release /// instance variables belonging to its *subclasses* if the variable name /// starts with "input" or backs a property whose name starts with "input". /// Subclasses should not release these ivars in their own -dealloc method -- /// doing so could result in an over release. /// /// This method returns true if the property will be released by /// -[CIFilter dealloc]. bool ObjCDeallocChecker::isReleasedByCIFilterDealloc( const ObjCPropertyImplDecl *PropImpl) const { assert(PropImpl->getPropertyIvarDecl()); StringRef PropName = PropImpl->getPropertyDecl()->getName(); StringRef IvarName = PropImpl->getPropertyIvarDecl()->getName(); const char *ReleasePrefix = "input"; if (!(PropName.startswith(ReleasePrefix) || IvarName.startswith(ReleasePrefix))) { return false; } const ObjCInterfaceDecl *ID = PropImpl->getPropertyIvarDecl()->getContainingInterface(); for ( ; ID ; ID = ID->getSuperClass()) { IdentifierInfo *II = ID->getIdentifier(); if (II == CIFilterII) return true; } return false; } /// Returns whether the ivar backing the property is an IBOutlet that /// has its value set by nib loading code without retaining the value. /// /// On macOS, if there is no setter, the nib-loading code sets the ivar /// directly, without retaining the value, /// /// On iOS and its derivatives, the nib-loading code will call /// -setValue:forKey:, which retains the value before directly setting the ivar. bool ObjCDeallocChecker::isNibLoadedIvarWithoutRetain( const ObjCPropertyImplDecl *PropImpl) const { const ObjCIvarDecl *IvarDecl = PropImpl->getPropertyIvarDecl(); if (!IvarDecl->hasAttr()) return false; const llvm::Triple &Target = IvarDecl->getASTContext().getTargetInfo().getTriple(); if (!Target.isMacOSX()) return false; if (PropImpl->getPropertyDecl()->getSetterMethodDecl()) return false; return true; } void ento::registerObjCDeallocChecker(CheckerManager &Mgr) { const LangOptions &LangOpts = Mgr.getLangOpts(); // These checker only makes sense under MRR. if (LangOpts.getGC() == LangOptions::GCOnly || LangOpts.ObjCAutoRefCount) return; Mgr.registerChecker(); @ 1.1.1.7.14.1 log @Sync with HEAD @ text @d129 1 a129 1 void checkEndFunction(const ReturnStmt *RS, CheckerContext &Ctx) const; d401 1 a401 1 const ReturnStmt *RS, CheckerContext &C) const { d538 1 a538 1 // at, for example, both a return and at the end of the function. d648 1 a648 1 // Try to get the region from which the released value was loaded. @ 1.1.1.7.14.2 log @Mostly merge changes from HEAD upto 20200411 @ text @@ 1.1.1.7.12.1 log @Sync with HEAD @ text @d129 1 a129 1 void checkEndFunction(const ReturnStmt *RS, CheckerContext &Ctx) const; d401 1 a401 1 const ReturnStmt *RS, CheckerContext &C) const { d538 1 a538 1 // at, for example, both a return and at the end of the function. d648 1 a648 1 // Try to get the region from which the released value was loaded. @ 1.1.1.8 log @Import clang r337282 from trunk @ text @d129 1 a129 1 void checkEndFunction(const ReturnStmt *RS, CheckerContext &Ctx) const; d401 1 a401 1 const ReturnStmt *RS, CheckerContext &C) const { d538 1 a538 1 // at, for example, both a return and at the end of the function. d648 1 a648 1 // Try to get the region from which the released value was loaded. @ 1.1.1.9 log @Mark old LLVM instance as dead. @ text @@ 1.1.1.4.4.1 log @file CheckObjCDealloc.cpp was added on branch tls-maxphys on 2014-08-19 23:47:31 +0000 @ text @d1 287 @ 1.1.1.4.4.2 log @Rebase to HEAD as of a few days ago. @ text @a0 287 //==- CheckObjCDealloc.cpp - Check ObjC -dealloc implementation --*- C++ -*-==// // // The LLVM Compiler Infrastructure // // This file is distributed under the University of Illinois Open Source // License. See LICENSE.TXT for details. // //===----------------------------------------------------------------------===// // // This file defines a CheckObjCDealloc, a checker that // analyzes an Objective-C class's implementation to determine if it // correctly implements -dealloc. // //===----------------------------------------------------------------------===// #include "ClangSACheckers.h" #include "clang/AST/Attr.h" #include "clang/AST/DeclObjC.h" #include "clang/AST/Expr.h" #include "clang/AST/ExprObjC.h" #include "clang/Basic/LangOptions.h" #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h" #include "clang/StaticAnalyzer/Core/BugReporter/PathDiagnostic.h" #include "clang/StaticAnalyzer/Core/Checker.h" #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h" #include "llvm/Support/raw_ostream.h" using namespace clang; using namespace ento; static bool scan_dealloc(Stmt *S, Selector Dealloc) { if (ObjCMessageExpr *ME = dyn_cast(S)) if (ME->getSelector() == Dealloc) { switch (ME->getReceiverKind()) { case ObjCMessageExpr::Instance: return false; case ObjCMessageExpr::SuperInstance: return true; case ObjCMessageExpr::Class: break; case ObjCMessageExpr::SuperClass: break; } } // Recurse to children. for (Stmt::child_iterator I = S->child_begin(), E= S->child_end(); I!=E; ++I) if (*I && scan_dealloc(*I, Dealloc)) return true; return false; } static bool scan_ivar_release(Stmt *S, ObjCIvarDecl *ID, const ObjCPropertyDecl *PD, Selector Release, IdentifierInfo* SelfII, ASTContext &Ctx) { // [mMyIvar release] if (ObjCMessageExpr *ME = dyn_cast(S)) if (ME->getSelector() == Release) if (ME->getInstanceReceiver()) if (Expr *Receiver = ME->getInstanceReceiver()->IgnoreParenCasts()) if (ObjCIvarRefExpr *E = dyn_cast(Receiver)) if (E->getDecl() == ID) return true; // [self setMyIvar:nil]; if (ObjCMessageExpr *ME = dyn_cast(S)) if (ME->getInstanceReceiver()) if (Expr *Receiver = ME->getInstanceReceiver()->IgnoreParenCasts()) if (DeclRefExpr *E = dyn_cast(Receiver)) if (E->getDecl()->getIdentifier() == SelfII) if (ME->getMethodDecl() == PD->getSetterMethodDecl() && ME->getNumArgs() == 1 && ME->getArg(0)->isNullPointerConstant(Ctx, Expr::NPC_ValueDependentIsNull)) return true; // self.myIvar = nil; if (BinaryOperator* BO = dyn_cast(S)) if (BO->isAssignmentOp()) if (ObjCPropertyRefExpr *PRE = dyn_cast(BO->getLHS()->IgnoreParenCasts())) if (PRE->isExplicitProperty() && PRE->getExplicitProperty() == PD) if (BO->getRHS()->isNullPointerConstant(Ctx, Expr::NPC_ValueDependentIsNull)) { // This is only a 'release' if the property kind is not // 'assign'. return PD->getSetterKind() != ObjCPropertyDecl::Assign; } // Recurse to children. for (Stmt::child_iterator I = S->child_begin(), E= S->child_end(); I!=E; ++I) if (*I && scan_ivar_release(*I, ID, PD, Release, SelfII, Ctx)) return true; return false; } static void checkObjCDealloc(const CheckerBase *Checker, const ObjCImplementationDecl *D, const LangOptions &LOpts, BugReporter &BR) { assert (LOpts.getGC() != LangOptions::GCOnly); ASTContext &Ctx = BR.getContext(); const ObjCInterfaceDecl *ID = D->getClassInterface(); // Does the class contain any ivars that are pointers (or id<...>)? // If not, skip the check entirely. // NOTE: This is motivated by PR 2517: // http://llvm.org/bugs/show_bug.cgi?id=2517 bool containsPointerIvar = false; for (const auto *Ivar : ID->ivars()) { QualType T = Ivar->getType(); if (!T->isObjCObjectPointerType() || Ivar->hasAttr() || // Skip IBOutlets. Ivar->hasAttr()) // Skip IBOutletCollections. continue; containsPointerIvar = true; break; } if (!containsPointerIvar) return; // Determine if the class subclasses NSObject. IdentifierInfo* NSObjectII = &Ctx.Idents.get("NSObject"); IdentifierInfo* SenTestCaseII = &Ctx.Idents.get("SenTestCase"); for ( ; ID ; ID = ID->getSuperClass()) { IdentifierInfo *II = ID->getIdentifier(); if (II == NSObjectII) break; // FIXME: For now, ignore classes that subclass SenTestCase, as these don't // need to implement -dealloc. They implement tear down in another way, // which we should try and catch later. // http://llvm.org/bugs/show_bug.cgi?id=3187 if (II == SenTestCaseII) return; } if (!ID) return; // Get the "dealloc" selector. IdentifierInfo* II = &Ctx.Idents.get("dealloc"); Selector S = Ctx.Selectors.getSelector(0, &II); const ObjCMethodDecl *MD = nullptr; // Scan the instance methods for "dealloc". for (const auto *I : D->instance_methods()) { if (I->getSelector() == S) { MD = I; break; } } PathDiagnosticLocation DLoc = PathDiagnosticLocation::createBegin(D, BR.getSourceManager()); if (!MD) { // No dealloc found. const char* name = LOpts.getGC() == LangOptions::NonGC ? "missing -dealloc" : "missing -dealloc (Hybrid MM, non-GC)"; std::string buf; llvm::raw_string_ostream os(buf); os << "Objective-C class '" << *D << "' lacks a 'dealloc' instance method"; BR.EmitBasicReport(D, Checker, name, categories::CoreFoundationObjectiveC, os.str(), DLoc); return; } // dealloc found. Scan for missing [super dealloc]. if (MD->getBody() && !scan_dealloc(MD->getBody(), S)) { const char* name = LOpts.getGC() == LangOptions::NonGC ? "missing [super dealloc]" : "missing [super dealloc] (Hybrid MM, non-GC)"; std::string buf; llvm::raw_string_ostream os(buf); os << "The 'dealloc' instance method in Objective-C class '" << *D << "' does not send a 'dealloc' message to its super class" " (missing [super dealloc])"; BR.EmitBasicReport(MD, Checker, name, categories::CoreFoundationObjectiveC, os.str(), DLoc); return; } // Get the "release" selector. IdentifierInfo* RII = &Ctx.Idents.get("release"); Selector RS = Ctx.Selectors.getSelector(0, &RII); // Get the "self" identifier IdentifierInfo* SelfII = &Ctx.Idents.get("self"); // Scan for missing and extra releases of ivars used by implementations // of synthesized properties for (const auto *I : D->property_impls()) { // We can only check the synthesized properties if (I->getPropertyImplementation() != ObjCPropertyImplDecl::Synthesize) continue; ObjCIvarDecl *ID = I->getPropertyIvarDecl(); if (!ID) continue; QualType T = ID->getType(); if (!T->isObjCObjectPointerType()) // Skip non-pointer ivars continue; const ObjCPropertyDecl *PD = I->getPropertyDecl(); if (!PD) continue; // ivars cannot be set via read-only properties, so we'll skip them if (PD->isReadOnly()) continue; // ivar must be released if and only if the kind of setter was not 'assign' bool requiresRelease = PD->getSetterKind() != ObjCPropertyDecl::Assign; if (scan_ivar_release(MD->getBody(), ID, PD, RS, SelfII, Ctx) != requiresRelease) { const char *name = nullptr; std::string buf; llvm::raw_string_ostream os(buf); if (requiresRelease) { name = LOpts.getGC() == LangOptions::NonGC ? "missing ivar release (leak)" : "missing ivar release (Hybrid MM, non-GC)"; os << "The '" << *ID << "' instance variable was retained by a synthesized property but " "wasn't released in 'dealloc'"; } else { name = LOpts.getGC() == LangOptions::NonGC ? "extra ivar release (use-after-release)" : "extra ivar release (Hybrid MM, non-GC)"; os << "The '" << *ID << "' instance variable was not retained by a synthesized property " "but was released in 'dealloc'"; } PathDiagnosticLocation SDLoc = PathDiagnosticLocation::createBegin(I, BR.getSourceManager()); BR.EmitBasicReport(MD, Checker, name, categories::CoreFoundationObjectiveC, os.str(), SDLoc); } } } //===----------------------------------------------------------------------===// // ObjCDeallocChecker //===----------------------------------------------------------------------===// namespace { class ObjCDeallocChecker : public Checker< check::ASTDecl > { public: void checkASTDecl(const ObjCImplementationDecl *D, AnalysisManager& mgr, BugReporter &BR) const { if (mgr.getLangOpts().getGC() == LangOptions::GCOnly) return; checkObjCDealloc(this, cast(D), mgr.getLangOpts(), BR); } }; } void ento::registerObjCDeallocChecker(CheckerManager &mgr) { mgr.registerChecker(); } @ 1.1.1.3.4.1 log @file CheckObjCDealloc.cpp was added on branch yamt-pagecache on 2014-05-22 16:18:30 +0000 @ text @d1 294 @ 1.1.1.3.4.2 log @sync with head. for a reference, the tree before this commit was tagged as yamt-pagecache-tag8. this commit was splitted into small chunks to avoid a limitation of cvs. ("Protocol error: too many arguments") @ text @a0 294 //==- CheckObjCDealloc.cpp - Check ObjC -dealloc implementation --*- C++ -*-==// // // The LLVM Compiler Infrastructure // // This file is distributed under the University of Illinois Open Source // License. See LICENSE.TXT for details. // //===----------------------------------------------------------------------===// // // This file defines a CheckObjCDealloc, a checker that // analyzes an Objective-C class's implementation to determine if it // correctly implements -dealloc. // //===----------------------------------------------------------------------===// #include "ClangSACheckers.h" #include "clang/AST/Attr.h" #include "clang/AST/DeclObjC.h" #include "clang/AST/Expr.h" #include "clang/AST/ExprObjC.h" #include "clang/Basic/LangOptions.h" #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h" #include "clang/StaticAnalyzer/Core/BugReporter/PathDiagnostic.h" #include "clang/StaticAnalyzer/Core/Checker.h" #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h" #include "llvm/Support/raw_ostream.h" using namespace clang; using namespace ento; static bool scan_dealloc(Stmt *S, Selector Dealloc) { if (ObjCMessageExpr *ME = dyn_cast(S)) if (ME->getSelector() == Dealloc) { switch (ME->getReceiverKind()) { case ObjCMessageExpr::Instance: return false; case ObjCMessageExpr::SuperInstance: return true; case ObjCMessageExpr::Class: break; case ObjCMessageExpr::SuperClass: break; } } // Recurse to children. for (Stmt::child_iterator I = S->child_begin(), E= S->child_end(); I!=E; ++I) if (*I && scan_dealloc(*I, Dealloc)) return true; return false; } static bool scan_ivar_release(Stmt *S, ObjCIvarDecl *ID, const ObjCPropertyDecl *PD, Selector Release, IdentifierInfo* SelfII, ASTContext &Ctx) { // [mMyIvar release] if (ObjCMessageExpr *ME = dyn_cast(S)) if (ME->getSelector() == Release) if (ME->getInstanceReceiver()) if (Expr *Receiver = ME->getInstanceReceiver()->IgnoreParenCasts()) if (ObjCIvarRefExpr *E = dyn_cast(Receiver)) if (E->getDecl() == ID) return true; // [self setMyIvar:nil]; if (ObjCMessageExpr *ME = dyn_cast(S)) if (ME->getInstanceReceiver()) if (Expr *Receiver = ME->getInstanceReceiver()->IgnoreParenCasts()) if (DeclRefExpr *E = dyn_cast(Receiver)) if (E->getDecl()->getIdentifier() == SelfII) if (ME->getMethodDecl() == PD->getSetterMethodDecl() && ME->getNumArgs() == 1 && ME->getArg(0)->isNullPointerConstant(Ctx, Expr::NPC_ValueDependentIsNull)) return true; // self.myIvar = nil; if (BinaryOperator* BO = dyn_cast(S)) if (BO->isAssignmentOp()) if (ObjCPropertyRefExpr *PRE = dyn_cast(BO->getLHS()->IgnoreParenCasts())) if (PRE->isExplicitProperty() && PRE->getExplicitProperty() == PD) if (BO->getRHS()->isNullPointerConstant(Ctx, Expr::NPC_ValueDependentIsNull)) { // This is only a 'release' if the property kind is not // 'assign'. return PD->getSetterKind() != ObjCPropertyDecl::Assign; } // Recurse to children. for (Stmt::child_iterator I = S->child_begin(), E= S->child_end(); I!=E; ++I) if (*I && scan_ivar_release(*I, ID, PD, Release, SelfII, Ctx)) return true; return false; } static void checkObjCDealloc(const CheckerBase *Checker, const ObjCImplementationDecl *D, const LangOptions &LOpts, BugReporter &BR) { assert (LOpts.getGC() != LangOptions::GCOnly); ASTContext &Ctx = BR.getContext(); const ObjCInterfaceDecl *ID = D->getClassInterface(); // Does the class contain any ivars that are pointers (or id<...>)? // If not, skip the check entirely. // NOTE: This is motivated by PR 2517: // http://llvm.org/bugs/show_bug.cgi?id=2517 bool containsPointerIvar = false; for (ObjCInterfaceDecl::ivar_iterator I=ID->ivar_begin(), E=ID->ivar_end(); I!=E; ++I) { ObjCIvarDecl *ID = *I; QualType T = ID->getType(); if (!T->isObjCObjectPointerType() || ID->hasAttr() || // Skip IBOutlets. ID->hasAttr()) // Skip IBOutletCollections. continue; containsPointerIvar = true; break; } if (!containsPointerIvar) return; // Determine if the class subclasses NSObject. IdentifierInfo* NSObjectII = &Ctx.Idents.get("NSObject"); IdentifierInfo* SenTestCaseII = &Ctx.Idents.get("SenTestCase"); for ( ; ID ; ID = ID->getSuperClass()) { IdentifierInfo *II = ID->getIdentifier(); if (II == NSObjectII) break; // FIXME: For now, ignore classes that subclass SenTestCase, as these don't // need to implement -dealloc. They implement tear down in another way, // which we should try and catch later. // http://llvm.org/bugs/show_bug.cgi?id=3187 if (II == SenTestCaseII) return; } if (!ID) return; // Get the "dealloc" selector. IdentifierInfo* II = &Ctx.Idents.get("dealloc"); Selector S = Ctx.Selectors.getSelector(0, &II); ObjCMethodDecl *MD = 0; // Scan the instance methods for "dealloc". for (ObjCImplementationDecl::instmeth_iterator I = D->instmeth_begin(), E = D->instmeth_end(); I!=E; ++I) { if ((*I)->getSelector() == S) { MD = *I; break; } } PathDiagnosticLocation DLoc = PathDiagnosticLocation::createBegin(D, BR.getSourceManager()); if (!MD) { // No dealloc found. const char* name = LOpts.getGC() == LangOptions::NonGC ? "missing -dealloc" : "missing -dealloc (Hybrid MM, non-GC)"; std::string buf; llvm::raw_string_ostream os(buf); os << "Objective-C class '" << *D << "' lacks a 'dealloc' instance method"; BR.EmitBasicReport(D, Checker, name, categories::CoreFoundationObjectiveC, os.str(), DLoc); return; } // dealloc found. Scan for missing [super dealloc]. if (MD->getBody() && !scan_dealloc(MD->getBody(), S)) { const char* name = LOpts.getGC() == LangOptions::NonGC ? "missing [super dealloc]" : "missing [super dealloc] (Hybrid MM, non-GC)"; std::string buf; llvm::raw_string_ostream os(buf); os << "The 'dealloc' instance method in Objective-C class '" << *D << "' does not send a 'dealloc' message to its super class" " (missing [super dealloc])"; BR.EmitBasicReport(MD, Checker, name, categories::CoreFoundationObjectiveC, os.str(), DLoc); return; } // Get the "release" selector. IdentifierInfo* RII = &Ctx.Idents.get("release"); Selector RS = Ctx.Selectors.getSelector(0, &RII); // Get the "self" identifier IdentifierInfo* SelfII = &Ctx.Idents.get("self"); // Scan for missing and extra releases of ivars used by implementations // of synthesized properties for (ObjCImplementationDecl::propimpl_iterator I = D->propimpl_begin(), E = D->propimpl_end(); I!=E; ++I) { // We can only check the synthesized properties if (I->getPropertyImplementation() != ObjCPropertyImplDecl::Synthesize) continue; ObjCIvarDecl *ID = I->getPropertyIvarDecl(); if (!ID) continue; QualType T = ID->getType(); if (!T->isObjCObjectPointerType()) // Skip non-pointer ivars continue; const ObjCPropertyDecl *PD = I->getPropertyDecl(); if (!PD) continue; // ivars cannot be set via read-only properties, so we'll skip them if (PD->isReadOnly()) continue; // ivar must be released if and only if the kind of setter was not 'assign' bool requiresRelease = PD->getSetterKind() != ObjCPropertyDecl::Assign; if (scan_ivar_release(MD->getBody(), ID, PD, RS, SelfII, Ctx) != requiresRelease) { const char *name = 0; std::string buf; llvm::raw_string_ostream os(buf); if (requiresRelease) { name = LOpts.getGC() == LangOptions::NonGC ? "missing ivar release (leak)" : "missing ivar release (Hybrid MM, non-GC)"; os << "The '" << *ID << "' instance variable was retained by a synthesized property but " "wasn't released in 'dealloc'"; } else { name = LOpts.getGC() == LangOptions::NonGC ? "extra ivar release (use-after-release)" : "extra ivar release (Hybrid MM, non-GC)"; os << "The '" << *ID << "' instance variable was not retained by a synthesized property " "but was released in 'dealloc'"; } PathDiagnosticLocation SDLoc = PathDiagnosticLocation::createBegin(*I, BR.getSourceManager()); BR.EmitBasicReport(MD, Checker, name, categories::CoreFoundationObjectiveC, os.str(), SDLoc); } } } //===----------------------------------------------------------------------===// // ObjCDeallocChecker //===----------------------------------------------------------------------===// namespace { class ObjCDeallocChecker : public Checker< check::ASTDecl > { public: void checkASTDecl(const ObjCImplementationDecl *D, AnalysisManager& mgr, BugReporter &BR) const { if (mgr.getLangOpts().getGC() == LangOptions::GCOnly) return; checkObjCDealloc(this, cast(D), mgr.getLangOpts(), BR); } }; } void ento::registerObjCDeallocChecker(CheckerManager &mgr) { mgr.registerChecker(); } @