2008-07-03 12:29:21 +08:00
|
|
|
//==- CheckObjCDealloc.cpp - Check ObjC -dealloc implementation --*- C++ -*-==//
|
|
|
|
//
|
|
|
|
// The LLVM Compiler Infrastructure
|
|
|
|
//
|
|
|
|
// This file is distributed under the University of Illinois Open Source
|
|
|
|
// License. See LICENSE.TXT for details.
|
|
|
|
//
|
|
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
//
|
2016-02-26 05:15:16 +08:00
|
|
|
// This checker analyzes Objective-C -dealloc methods and their callees
|
|
|
|
// to warn about improper releasing of instance variables that back synthesized
|
|
|
|
// properties. It warns about missing releases in the following cases:
|
|
|
|
// - When a class has a synthesized instance variable for a 'retain' or 'copy'
|
|
|
|
// property and lacks a -dealloc method in its implementation.
|
|
|
|
// - When a class has a synthesized instance variable for a 'retain'/'copy'
|
|
|
|
// property but the ivar is not released in -dealloc by either -release
|
|
|
|
// or by nilling out the property.
|
|
|
|
//
|
|
|
|
// It warns about extra releases in -dealloc (but not in callees) when a
|
|
|
|
// synthesized instance variable is released in the following cases:
|
|
|
|
// - When the property is 'assign' and is not 'readonly'.
|
|
|
|
// - When the property is 'weak'.
|
|
|
|
//
|
|
|
|
// This checker only warns for instance variables synthesized to back
|
|
|
|
// properties. Handling the more general case would require inferring whether
|
|
|
|
// an instance variable is stored retained or not. For synthesized properties,
|
|
|
|
// this is specified in the property declaration itself.
|
2008-07-03 12:29:21 +08:00
|
|
|
//
|
|
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
|
2011-02-18 05:39:33 +08:00
|
|
|
#include "ClangSACheckers.h"
|
2012-12-01 23:09:41 +08:00
|
|
|
#include "clang/AST/Attr.h"
|
2008-07-03 12:29:21 +08:00
|
|
|
#include "clang/AST/DeclObjC.h"
|
2012-12-01 23:09:41 +08:00
|
|
|
#include "clang/AST/Expr.h"
|
|
|
|
#include "clang/AST/ExprObjC.h"
|
2008-07-03 22:35:01 +08:00
|
|
|
#include "clang/Basic/LangOptions.h"
|
2016-10-13 07:57:05 +08:00
|
|
|
#include "clang/Basic/TargetInfo.h"
|
2012-12-04 17:13:33 +08:00
|
|
|
#include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
|
2016-02-26 05:15:16 +08:00
|
|
|
#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
|
2012-12-04 17:13:33 +08:00
|
|
|
#include "clang/StaticAnalyzer/Core/BugReporter/PathDiagnostic.h"
|
|
|
|
#include "clang/StaticAnalyzer/Core/Checker.h"
|
|
|
|
#include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
|
2016-02-26 05:15:16 +08:00
|
|
|
#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
|
|
|
|
#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
|
|
|
|
#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
|
|
|
|
#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
|
|
|
|
#include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h"
|
2008-10-29 12:30:28 +08:00
|
|
|
#include "llvm/Support/raw_ostream.h"
|
2008-07-03 12:29:21 +08:00
|
|
|
|
|
|
|
using namespace clang;
|
2010-12-23 15:20:52 +08:00
|
|
|
using namespace ento;
|
2008-07-03 12:29:21 +08:00
|
|
|
|
2016-02-26 05:15:16 +08:00
|
|
|
/// Indicates whether an instance variable is required to be released in
|
|
|
|
/// -dealloc.
|
|
|
|
enum class ReleaseRequirement {
|
|
|
|
/// The instance variable must be released, either by calling
|
|
|
|
/// -release on it directly or by nilling it out with a property setter.
|
|
|
|
MustRelease,
|
2016-02-12 06:13:20 +08:00
|
|
|
|
2016-02-26 05:15:16 +08:00
|
|
|
/// The instance variable must not be directly released with -release.
|
|
|
|
MustNotReleaseDirectly,
|
2008-10-29 12:30:28 +08:00
|
|
|
|
2016-02-26 05:15:16 +08:00
|
|
|
/// The requirement for the instance variable could not be determined.
|
|
|
|
Unknown
|
|
|
|
};
|
2008-10-29 12:30:28 +08:00
|
|
|
|
2016-02-26 05:15:16 +08:00
|
|
|
/// Returns true if the property implementation is synthesized and the
|
|
|
|
/// type of the property is retainable.
|
2016-01-27 09:41:58 +08:00
|
|
|
static bool isSynthesizedRetainableProperty(const ObjCPropertyImplDecl *I,
|
|
|
|
const ObjCIvarDecl **ID,
|
|
|
|
const ObjCPropertyDecl **PD) {
|
|
|
|
|
|
|
|
if (I->getPropertyImplementation() != ObjCPropertyImplDecl::Synthesize)
|
|
|
|
return false;
|
|
|
|
|
|
|
|
(*ID) = I->getPropertyIvarDecl();
|
|
|
|
if (!(*ID))
|
|
|
|
return false;
|
|
|
|
|
|
|
|
QualType T = (*ID)->getType();
|
|
|
|
if (!T->isObjCRetainableType())
|
|
|
|
return false;
|
|
|
|
|
|
|
|
(*PD) = I->getPropertyDecl();
|
|
|
|
// Shouldn't be able to synthesize a property that doesn't exist.
|
|
|
|
assert(*PD);
|
|
|
|
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2016-02-26 05:15:16 +08:00
|
|
|
namespace {
|
|
|
|
|
|
|
|
class ObjCDeallocChecker
|
|
|
|
: public Checker<check::ASTDecl<ObjCImplementationDecl>,
|
|
|
|
check::PreObjCMessage, check::PostObjCMessage,
|
2016-03-01 07:57:10 +08:00
|
|
|
check::PreCall,
|
2016-02-26 05:15:16 +08:00
|
|
|
check::BeginFunction, check::EndFunction,
|
2016-03-01 05:44:08 +08:00
|
|
|
eval::Assume,
|
2016-02-26 05:15:16 +08:00
|
|
|
check::PointerEscape,
|
|
|
|
check::PreStmt<ReturnStmt>> {
|
|
|
|
|
2016-06-23 01:03:10 +08:00
|
|
|
mutable IdentifierInfo *NSObjectII, *SenTestCaseII, *XCTestCaseII,
|
|
|
|
*Block_releaseII, *CIFilterII;
|
|
|
|
|
2016-02-26 05:15:16 +08:00
|
|
|
mutable Selector DeallocSel, ReleaseSel;
|
|
|
|
|
|
|
|
std::unique_ptr<BugType> MissingReleaseBugType;
|
|
|
|
std::unique_ptr<BugType> ExtraReleaseBugType;
|
2016-03-05 02:09:58 +08:00
|
|
|
std::unique_ptr<BugType> MistakenDeallocBugType;
|
2016-02-26 05:15:16 +08:00
|
|
|
|
|
|
|
public:
|
|
|
|
ObjCDeallocChecker();
|
|
|
|
|
|
|
|
void checkASTDecl(const ObjCImplementationDecl *D, AnalysisManager& Mgr,
|
|
|
|
BugReporter &BR) const;
|
|
|
|
void checkBeginFunction(CheckerContext &Ctx) const;
|
|
|
|
void checkPreObjCMessage(const ObjCMethodCall &M, CheckerContext &C) const;
|
2016-03-01 07:57:10 +08:00
|
|
|
void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
|
2016-02-26 05:15:16 +08:00
|
|
|
void checkPostObjCMessage(const ObjCMethodCall &M, CheckerContext &C) const;
|
|
|
|
|
2016-03-01 05:44:08 +08:00
|
|
|
ProgramStateRef evalAssume(ProgramStateRef State, SVal Cond,
|
|
|
|
bool Assumption) const;
|
|
|
|
|
2016-02-26 05:15:16 +08:00
|
|
|
ProgramStateRef checkPointerEscape(ProgramStateRef State,
|
|
|
|
const InvalidatedSymbols &Escaped,
|
|
|
|
const CallEvent *Call,
|
|
|
|
PointerEscapeKind Kind) const;
|
|
|
|
void checkPreStmt(const ReturnStmt *RS, CheckerContext &C) const;
|
|
|
|
void checkEndFunction(CheckerContext &Ctx) const;
|
|
|
|
|
|
|
|
private:
|
|
|
|
void diagnoseMissingReleases(CheckerContext &C) const;
|
|
|
|
|
|
|
|
bool diagnoseExtraRelease(SymbolRef ReleasedValue, const ObjCMethodCall &M,
|
|
|
|
CheckerContext &C) const;
|
|
|
|
|
2016-03-05 02:09:58 +08:00
|
|
|
bool diagnoseMistakenDealloc(SymbolRef DeallocedValue,
|
|
|
|
const ObjCMethodCall &M,
|
|
|
|
CheckerContext &C) const;
|
|
|
|
|
2016-02-26 05:15:16 +08:00
|
|
|
SymbolRef getValueReleasedByNillingOut(const ObjCMethodCall &M,
|
|
|
|
CheckerContext &C) const;
|
|
|
|
|
2016-03-01 05:44:08 +08:00
|
|
|
const ObjCIvarRegion *getIvarRegionForIvarSymbol(SymbolRef IvarSym) const;
|
2016-02-26 05:15:16 +08:00
|
|
|
SymbolRef getInstanceSymbolFromIvarSymbol(SymbolRef IvarSym) const;
|
|
|
|
|
2016-03-05 02:09:58 +08:00
|
|
|
const ObjCPropertyImplDecl*
|
|
|
|
findPropertyOnDeallocatingInstance(SymbolRef IvarSym,
|
|
|
|
CheckerContext &C) const;
|
|
|
|
|
2016-02-26 05:15:16 +08:00
|
|
|
ReleaseRequirement
|
|
|
|
getDeallocReleaseRequirement(const ObjCPropertyImplDecl *PropImpl) const;
|
|
|
|
|
|
|
|
bool isInInstanceDealloc(const CheckerContext &C, SVal &SelfValOut) const;
|
|
|
|
bool isInInstanceDealloc(const CheckerContext &C, const LocationContext *LCtx,
|
|
|
|
SVal &SelfValOut) const;
|
|
|
|
bool instanceDeallocIsOnStack(const CheckerContext &C,
|
|
|
|
SVal &InstanceValOut) const;
|
|
|
|
|
|
|
|
bool isSuperDeallocMessage(const ObjCMethodCall &M) const;
|
|
|
|
|
|
|
|
const ObjCImplDecl *getContainingObjCImpl(const LocationContext *LCtx) const;
|
|
|
|
|
|
|
|
const ObjCPropertyDecl *
|
|
|
|
findShadowedPropertyDecl(const ObjCPropertyImplDecl *PropImpl) const;
|
|
|
|
|
2016-03-01 07:57:10 +08:00
|
|
|
void transitionToReleaseValue(CheckerContext &C, SymbolRef Value) const;
|
2016-02-26 05:15:16 +08:00
|
|
|
ProgramStateRef removeValueRequiringRelease(ProgramStateRef State,
|
|
|
|
SymbolRef InstanceSym,
|
|
|
|
SymbolRef ValueSym) const;
|
|
|
|
|
|
|
|
void initIdentifierInfoAndSelectors(ASTContext &Ctx) const;
|
|
|
|
|
|
|
|
bool classHasSeparateTeardown(const ObjCInterfaceDecl *ID) const;
|
2016-03-26 05:18:22 +08:00
|
|
|
|
|
|
|
bool isReleasedByCIFilterDealloc(const ObjCPropertyImplDecl *PropImpl) const;
|
2016-10-13 07:57:05 +08:00
|
|
|
bool isNibLoadedIvarWithoutRetain(const ObjCPropertyImplDecl *PropImpl) const;
|
2016-02-26 05:15:16 +08:00
|
|
|
};
|
|
|
|
} // End anonymous namespace.
|
|
|
|
|
|
|
|
typedef llvm::ImmutableSet<SymbolRef> SymbolSet;
|
|
|
|
|
|
|
|
/// Maps from the symbol for a class instance to the set of
|
|
|
|
/// symbols remaining that must be released in -dealloc.
|
|
|
|
REGISTER_MAP_WITH_PROGRAMSTATE(UnreleasedIvarMap, SymbolRef, SymbolSet)
|
2016-01-27 09:41:58 +08:00
|
|
|
|
2016-02-26 05:15:16 +08:00
|
|
|
namespace clang {
|
|
|
|
namespace ento {
|
|
|
|
template<> struct ProgramStateTrait<SymbolSet>
|
|
|
|
: public ProgramStatePartialTrait<SymbolSet> {
|
|
|
|
static void *GDMIndex() { static int index = 0; return &index; }
|
|
|
|
};
|
|
|
|
}
|
|
|
|
}
|
2008-07-03 12:29:21 +08:00
|
|
|
|
2016-02-26 05:15:16 +08:00
|
|
|
/// An AST check that diagnose when the class requires a -dealloc method and
|
|
|
|
/// is missing one.
|
|
|
|
void ObjCDeallocChecker::checkASTDecl(const ObjCImplementationDecl *D,
|
|
|
|
AnalysisManager &Mgr,
|
|
|
|
BugReporter &BR) const {
|
|
|
|
assert(Mgr.getLangOpts().getGC() != LangOptions::GCOnly);
|
|
|
|
assert(!Mgr.getLangOpts().ObjCAutoRefCount);
|
|
|
|
initIdentifierInfoAndSelectors(Mgr.getASTContext());
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2011-08-13 07:37:29 +08:00
|
|
|
const ObjCInterfaceDecl *ID = D->getClassInterface();
|
2016-03-01 08:39:04 +08:00
|
|
|
// If the class is known to have a lifecycle with a separate teardown method
|
|
|
|
// then it may not require a -dealloc method.
|
|
|
|
if (classHasSeparateTeardown(ID))
|
|
|
|
return;
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2016-01-27 09:41:58 +08:00
|
|
|
// Does the class contain any synthesized properties that are retainable?
|
2008-07-07 14:36:08 +08:00
|
|
|
// If not, skip the check entirely.
|
2016-03-01 08:39:04 +08:00
|
|
|
const ObjCPropertyImplDecl *PropImplRequiringRelease = nullptr;
|
|
|
|
bool HasOthers = false;
|
2016-01-27 09:41:58 +08:00
|
|
|
for (const auto *I : D->property_impls()) {
|
2016-02-26 05:15:16 +08:00
|
|
|
if (getDeallocReleaseRequirement(I) == ReleaseRequirement::MustRelease) {
|
2016-03-01 08:39:04 +08:00
|
|
|
if (!PropImplRequiringRelease)
|
|
|
|
PropImplRequiringRelease = I;
|
|
|
|
else {
|
|
|
|
HasOthers = true;
|
|
|
|
break;
|
|
|
|
}
|
2016-01-27 09:41:58 +08:00
|
|
|
}
|
2008-07-07 14:36:08 +08:00
|
|
|
}
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2016-03-01 08:39:04 +08:00
|
|
|
if (!PropImplRequiringRelease)
|
2008-07-03 12:29:21 +08:00
|
|
|
return;
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2014-05-27 10:45:47 +08:00
|
|
|
const ObjCMethodDecl *MD = nullptr;
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2008-07-03 12:29:21 +08:00
|
|
|
// Scan the instance methods for "dealloc".
|
2014-03-14 03:50:17 +08:00
|
|
|
for (const auto *I : D->instance_methods()) {
|
2016-02-26 05:15:16 +08:00
|
|
|
if (I->getSelector() == DeallocSel) {
|
2014-03-14 03:50:17 +08:00
|
|
|
MD = I;
|
2008-07-03 12:29:21 +08:00
|
|
|
break;
|
2009-09-09 23:08:12 +08:00
|
|
|
}
|
2008-07-03 12:29:21 +08:00
|
|
|
}
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2008-07-03 12:29:21 +08:00
|
|
|
if (!MD) { // No dealloc found.
|
2016-02-26 05:15:16 +08:00
|
|
|
const char* Name = "Missing -dealloc";
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2016-02-26 05:15:16 +08:00
|
|
|
std::string Buf;
|
|
|
|
llvm::raw_string_ostream OS(Buf);
|
2016-03-01 08:39:04 +08:00
|
|
|
OS << "'" << *D << "' lacks a 'dealloc' instance method but "
|
|
|
|
<< "must release '" << *PropImplRequiringRelease->getPropertyIvarDecl()
|
|
|
|
<< "'";
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2016-03-01 08:39:04 +08:00
|
|
|
if (HasOthers)
|
|
|
|
OS << " and others";
|
2016-01-27 09:41:58 +08:00
|
|
|
PathDiagnosticLocation DLoc =
|
|
|
|
PathDiagnosticLocation::createBegin(D, BR.getSourceManager());
|
|
|
|
|
2016-02-26 05:15:16 +08:00
|
|
|
BR.EmitBasicReport(D, this, Name, categories::CoreFoundationObjectiveC,
|
|
|
|
OS.str(), DLoc);
|
2016-02-26 02:55:24 +08:00
|
|
|
return;
|
|
|
|
}
|
2016-02-26 05:15:16 +08:00
|
|
|
}
|
2016-02-26 02:55:24 +08:00
|
|
|
|
2016-02-26 05:15:16 +08:00
|
|
|
/// If this is the beginning of -dealloc, mark the values initially stored in
|
|
|
|
/// instance variables that must be released by the end of -dealloc
|
|
|
|
/// as unreleased in the state.
|
|
|
|
void ObjCDeallocChecker::checkBeginFunction(
|
|
|
|
CheckerContext &C) const {
|
|
|
|
initIdentifierInfoAndSelectors(C.getASTContext());
|
2016-02-26 02:55:24 +08:00
|
|
|
|
2016-02-26 05:15:16 +08:00
|
|
|
// Only do this if the current method is -dealloc.
|
|
|
|
SVal SelfVal;
|
|
|
|
if (!isInInstanceDealloc(C, SelfVal))
|
|
|
|
return;
|
2016-02-26 02:55:24 +08:00
|
|
|
|
2016-02-26 05:15:16 +08:00
|
|
|
SymbolRef SelfSymbol = SelfVal.getAsSymbol();
|
|
|
|
|
|
|
|
const LocationContext *LCtx = C.getLocationContext();
|
|
|
|
ProgramStateRef InitialState = C.getState();
|
|
|
|
|
|
|
|
ProgramStateRef State = InitialState;
|
|
|
|
|
|
|
|
SymbolSet::Factory &F = State->getStateManager().get_context<SymbolSet>();
|
|
|
|
|
|
|
|
// Symbols that must be released by the end of the -dealloc;
|
|
|
|
SymbolSet RequiredReleases = F.getEmptySet();
|
|
|
|
|
|
|
|
// If we're an inlined -dealloc, we should add our symbols to the existing
|
|
|
|
// set from our subclass.
|
|
|
|
if (const SymbolSet *CurrSet = State->get<UnreleasedIvarMap>(SelfSymbol))
|
|
|
|
RequiredReleases = *CurrSet;
|
|
|
|
|
|
|
|
for (auto *PropImpl : getContainingObjCImpl(LCtx)->property_impls()) {
|
|
|
|
ReleaseRequirement Requirement = getDeallocReleaseRequirement(PropImpl);
|
|
|
|
if (Requirement != ReleaseRequirement::MustRelease)
|
2016-02-26 02:55:24 +08:00
|
|
|
continue;
|
|
|
|
|
2016-02-26 05:15:16 +08:00
|
|
|
SVal LVal = State->getLValue(PropImpl->getPropertyIvarDecl(), SelfVal);
|
|
|
|
Optional<Loc> LValLoc = LVal.getAs<Loc>();
|
|
|
|
if (!LValLoc)
|
|
|
|
continue;
|
|
|
|
|
|
|
|
SVal InitialVal = State->getSVal(LValLoc.getValue());
|
|
|
|
SymbolRef Symbol = InitialVal.getAsSymbol();
|
|
|
|
if (!Symbol || !isa<SymbolRegionValue>(Symbol))
|
|
|
|
continue;
|
|
|
|
|
|
|
|
// Mark the value as requiring a release.
|
|
|
|
RequiredReleases = F.add(RequiredReleases, Symbol);
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!RequiredReleases.isEmpty()) {
|
|
|
|
State = State->set<UnreleasedIvarMap>(SelfSymbol, RequiredReleases);
|
|
|
|
}
|
|
|
|
|
|
|
|
if (State != InitialState) {
|
|
|
|
C.addTransition(State);
|
2016-02-26 02:55:24 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-03-01 05:44:08 +08:00
|
|
|
/// Given a symbol for an ivar, return the ivar region it was loaded from.
|
|
|
|
/// Returns nullptr if the instance symbol cannot be found.
|
|
|
|
const ObjCIvarRegion *
|
|
|
|
ObjCDeallocChecker::getIvarRegionForIvarSymbol(SymbolRef IvarSym) const {
|
2016-07-14 02:07:26 +08:00
|
|
|
return dyn_cast_or_null<ObjCIvarRegion>(IvarSym->getOriginRegion());
|
2016-03-01 05:44:08 +08:00
|
|
|
}
|
|
|
|
|
2016-02-26 05:15:16 +08:00
|
|
|
/// Given a symbol for an ivar, return a symbol for the instance containing
|
|
|
|
/// the ivar. Returns nullptr if the instance symbol cannot be found.
|
|
|
|
SymbolRef
|
|
|
|
ObjCDeallocChecker::getInstanceSymbolFromIvarSymbol(SymbolRef IvarSym) const {
|
|
|
|
|
2016-03-01 05:44:08 +08:00
|
|
|
const ObjCIvarRegion *IvarRegion = getIvarRegionForIvarSymbol(IvarSym);
|
|
|
|
if (!IvarRegion)
|
|
|
|
return nullptr;
|
2016-02-26 02:55:24 +08:00
|
|
|
|
2016-03-01 05:44:08 +08:00
|
|
|
return IvarRegion->getSymbolicBase()->getSymbol();
|
2016-02-26 05:15:16 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
/// If we are in -dealloc or -dealloc is on the stack, handle the call if it is
|
|
|
|
/// a release or a nilling-out property setter.
|
|
|
|
void ObjCDeallocChecker::checkPreObjCMessage(
|
|
|
|
const ObjCMethodCall &M, CheckerContext &C) const {
|
|
|
|
// Only run if -dealloc is on the stack.
|
|
|
|
SVal DeallocedInstance;
|
|
|
|
if (!instanceDeallocIsOnStack(C, DeallocedInstance))
|
|
|
|
return;
|
|
|
|
|
2016-03-05 02:09:58 +08:00
|
|
|
SymbolRef ReleasedValue = nullptr;
|
|
|
|
|
|
|
|
if (M.getSelector() == ReleaseSel) {
|
|
|
|
ReleasedValue = M.getReceiverSVal().getAsSymbol();
|
|
|
|
} else if (M.getSelector() == DeallocSel && !M.isReceiverSelfOrSuper()) {
|
|
|
|
if (diagnoseMistakenDealloc(M.getReceiverSVal().getAsSymbol(), M, C))
|
|
|
|
return;
|
|
|
|
}
|
2016-02-26 05:15:16 +08:00
|
|
|
|
|
|
|
if (ReleasedValue) {
|
|
|
|
// An instance variable symbol was released with -release:
|
|
|
|
// [_property release];
|
|
|
|
if (diagnoseExtraRelease(ReleasedValue,M, C))
|
2016-02-26 03:13:43 +08:00
|
|
|
return;
|
2016-02-26 05:15:16 +08:00
|
|
|
} else {
|
|
|
|
// An instance variable symbol was released nilling out its property:
|
|
|
|
// self.property = nil;
|
|
|
|
ReleasedValue = getValueReleasedByNillingOut(M, C);
|
2016-02-26 02:55:24 +08:00
|
|
|
}
|
2016-02-26 05:15:16 +08:00
|
|
|
|
|
|
|
if (!ReleasedValue)
|
|
|
|
return;
|
|
|
|
|
2016-03-01 07:57:10 +08:00
|
|
|
transitionToReleaseValue(C, ReleasedValue);
|
|
|
|
}
|
|
|
|
|
|
|
|
/// If we are in -dealloc or -dealloc is on the stack, handle the call if it is
|
|
|
|
/// call to Block_release().
|
|
|
|
void ObjCDeallocChecker::checkPreCall(const CallEvent &Call,
|
|
|
|
CheckerContext &C) const {
|
|
|
|
const IdentifierInfo *II = Call.getCalleeIdentifier();
|
|
|
|
if (II != Block_releaseII)
|
2016-02-26 05:15:16 +08:00
|
|
|
return;
|
|
|
|
|
2016-03-01 07:57:10 +08:00
|
|
|
if (Call.getNumArgs() != 1)
|
|
|
|
return;
|
2016-02-26 05:15:16 +08:00
|
|
|
|
2016-03-01 07:57:10 +08:00
|
|
|
SymbolRef ReleasedValue = Call.getArgSVal(0).getAsSymbol();
|
|
|
|
if (!ReleasedValue)
|
|
|
|
return;
|
2016-02-26 05:15:16 +08:00
|
|
|
|
2016-03-01 07:57:10 +08:00
|
|
|
transitionToReleaseValue(C, ReleasedValue);
|
|
|
|
}
|
2016-02-26 05:15:16 +08:00
|
|
|
/// If the message was a call to '[super dealloc]', diagnose any missing
|
|
|
|
/// releases.
|
|
|
|
void ObjCDeallocChecker::checkPostObjCMessage(
|
|
|
|
const ObjCMethodCall &M, CheckerContext &C) const {
|
|
|
|
// We perform this check post-message so that if the super -dealloc
|
|
|
|
// calls a helper method and that this class overrides, any ivars released in
|
|
|
|
// the helper method will be recorded before checking.
|
|
|
|
if (isSuperDeallocMessage(M))
|
|
|
|
diagnoseMissingReleases(C);
|
|
|
|
}
|
|
|
|
|
|
|
|
/// Check for missing releases even when -dealloc does not call
|
|
|
|
/// '[super dealloc]'.
|
|
|
|
void ObjCDeallocChecker::checkEndFunction(
|
|
|
|
CheckerContext &C) const {
|
|
|
|
diagnoseMissingReleases(C);
|
|
|
|
}
|
|
|
|
|
|
|
|
/// Check for missing releases on early return.
|
|
|
|
void ObjCDeallocChecker::checkPreStmt(
|
|
|
|
const ReturnStmt *RS, CheckerContext &C) const {
|
|
|
|
diagnoseMissingReleases(C);
|
|
|
|
}
|
|
|
|
|
2016-03-01 05:44:08 +08:00
|
|
|
/// When a symbol is assumed to be nil, remove it from the set of symbols
|
|
|
|
/// require to be nil.
|
|
|
|
ProgramStateRef ObjCDeallocChecker::evalAssume(ProgramStateRef State, SVal Cond,
|
|
|
|
bool Assumption) const {
|
|
|
|
if (State->get<UnreleasedIvarMap>().isEmpty())
|
|
|
|
return State;
|
|
|
|
|
|
|
|
auto *CondBSE = dyn_cast_or_null<BinarySymExpr>(Cond.getAsSymExpr());
|
|
|
|
if (!CondBSE)
|
|
|
|
return State;
|
|
|
|
|
|
|
|
BinaryOperator::Opcode OpCode = CondBSE->getOpcode();
|
|
|
|
if (Assumption) {
|
|
|
|
if (OpCode != BO_EQ)
|
|
|
|
return State;
|
|
|
|
} else {
|
|
|
|
if (OpCode != BO_NE)
|
|
|
|
return State;
|
|
|
|
}
|
|
|
|
|
|
|
|
SymbolRef NullSymbol = nullptr;
|
|
|
|
if (auto *SIE = dyn_cast<SymIntExpr>(CondBSE)) {
|
|
|
|
const llvm::APInt &RHS = SIE->getRHS();
|
|
|
|
if (RHS != 0)
|
|
|
|
return State;
|
|
|
|
NullSymbol = SIE->getLHS();
|
|
|
|
} else if (auto *SIE = dyn_cast<IntSymExpr>(CondBSE)) {
|
|
|
|
const llvm::APInt &LHS = SIE->getLHS();
|
|
|
|
if (LHS != 0)
|
|
|
|
return State;
|
|
|
|
NullSymbol = SIE->getRHS();
|
|
|
|
} else {
|
|
|
|
return State;
|
|
|
|
}
|
|
|
|
|
|
|
|
SymbolRef InstanceSymbol = getInstanceSymbolFromIvarSymbol(NullSymbol);
|
|
|
|
if (!InstanceSymbol)
|
|
|
|
return State;
|
|
|
|
|
|
|
|
State = removeValueRequiringRelease(State, InstanceSymbol, NullSymbol);
|
|
|
|
|
|
|
|
return State;
|
|
|
|
}
|
|
|
|
|
2016-02-26 05:15:16 +08:00
|
|
|
/// If a symbol escapes conservatively assume unseen code released it.
|
|
|
|
ProgramStateRef ObjCDeallocChecker::checkPointerEscape(
|
|
|
|
ProgramStateRef State, const InvalidatedSymbols &Escaped,
|
|
|
|
const CallEvent *Call, PointerEscapeKind Kind) const {
|
|
|
|
|
2016-03-01 05:44:08 +08:00
|
|
|
if (State->get<UnreleasedIvarMap>().isEmpty())
|
|
|
|
return State;
|
|
|
|
|
2016-02-26 05:15:16 +08:00
|
|
|
// Don't treat calls to '[super dealloc]' as escaping for the purposes
|
|
|
|
// of this checker. Because the checker diagnoses missing releases in the
|
|
|
|
// post-message handler for '[super dealloc], escaping here would cause
|
|
|
|
// the checker to never warn.
|
|
|
|
auto *OMC = dyn_cast_or_null<ObjCMethodCall>(Call);
|
|
|
|
if (OMC && isSuperDeallocMessage(*OMC))
|
|
|
|
return State;
|
|
|
|
|
|
|
|
for (const auto &Sym : Escaped) {
|
2016-03-01 05:44:08 +08:00
|
|
|
if (!Call || (Call && !Call->isInSystemHeader())) {
|
|
|
|
// If Sym is a symbol for an object with instance variables that
|
|
|
|
// must be released, remove these obligations when the object escapes
|
|
|
|
// unless via a call to a system function. System functions are
|
|
|
|
// very unlikely to release instance variables on objects passed to them,
|
|
|
|
// and are frequently called on 'self' in -dealloc (e.g., to remove
|
|
|
|
// observers) -- we want to avoid false negatives from escaping on
|
|
|
|
// them.
|
|
|
|
State = State->remove<UnreleasedIvarMap>(Sym);
|
|
|
|
}
|
|
|
|
|
2016-02-26 05:15:16 +08:00
|
|
|
|
|
|
|
SymbolRef InstanceSymbol = getInstanceSymbolFromIvarSymbol(Sym);
|
|
|
|
if (!InstanceSymbol)
|
|
|
|
continue;
|
|
|
|
|
|
|
|
State = removeValueRequiringRelease(State, InstanceSymbol, Sym);
|
|
|
|
}
|
|
|
|
|
|
|
|
return State;
|
|
|
|
}
|
|
|
|
|
|
|
|
/// Report any unreleased instance variables for the current instance being
|
|
|
|
/// dealloced.
|
|
|
|
void ObjCDeallocChecker::diagnoseMissingReleases(CheckerContext &C) const {
|
|
|
|
ProgramStateRef State = C.getState();
|
|
|
|
|
|
|
|
SVal SelfVal;
|
|
|
|
if (!isInInstanceDealloc(C, SelfVal))
|
|
|
|
return;
|
|
|
|
|
|
|
|
const MemRegion *SelfRegion = SelfVal.castAs<loc::MemRegionVal>().getRegion();
|
|
|
|
const LocationContext *LCtx = C.getLocationContext();
|
|
|
|
|
|
|
|
ExplodedNode *ErrNode = nullptr;
|
|
|
|
|
|
|
|
SymbolRef SelfSym = SelfVal.getAsSymbol();
|
|
|
|
if (!SelfSym)
|
|
|
|
return;
|
|
|
|
|
|
|
|
const SymbolSet *OldUnreleased = State->get<UnreleasedIvarMap>(SelfSym);
|
|
|
|
if (!OldUnreleased)
|
|
|
|
return;
|
|
|
|
|
|
|
|
SymbolSet NewUnreleased = *OldUnreleased;
|
|
|
|
SymbolSet::Factory &F = State->getStateManager().get_context<SymbolSet>();
|
|
|
|
|
|
|
|
ProgramStateRef InitialState = State;
|
|
|
|
|
|
|
|
for (auto *IvarSymbol : *OldUnreleased) {
|
|
|
|
const TypedValueRegion *TVR =
|
|
|
|
cast<SymbolRegionValue>(IvarSymbol)->getRegion();
|
|
|
|
const ObjCIvarRegion *IvarRegion = cast<ObjCIvarRegion>(TVR);
|
|
|
|
|
|
|
|
// Don't warn if the ivar is not for this instance.
|
|
|
|
if (SelfRegion != IvarRegion->getSuperRegion())
|
|
|
|
continue;
|
|
|
|
|
2016-07-29 01:18:33 +08:00
|
|
|
const ObjCIvarDecl *IvarDecl = IvarRegion->getDecl();
|
2016-02-26 05:15:16 +08:00
|
|
|
// Prevent an inlined call to -dealloc in a super class from warning
|
|
|
|
// about the values the subclass's -dealloc should release.
|
2016-03-01 05:44:08 +08:00
|
|
|
if (IvarDecl->getContainingInterface() !=
|
2016-02-26 05:15:16 +08:00
|
|
|
cast<ObjCMethodDecl>(LCtx->getDecl())->getClassInterface())
|
|
|
|
continue;
|
|
|
|
|
|
|
|
// Prevents diagnosing multiple times for the same instance variable
|
|
|
|
// at, for example, both a return and at the end of of the function.
|
|
|
|
NewUnreleased = F.remove(NewUnreleased, IvarSymbol);
|
|
|
|
|
|
|
|
if (State->getStateManager()
|
|
|
|
.getConstraintManager()
|
|
|
|
.isNull(State, IvarSymbol)
|
|
|
|
.isConstrainedTrue()) {
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
|
|
|
|
// A missing release manifests as a leak, so treat as a non-fatal error.
|
|
|
|
if (!ErrNode)
|
|
|
|
ErrNode = C.generateNonFatalErrorNode();
|
|
|
|
// If we've already reached this node on another path, return without
|
|
|
|
// diagnosing.
|
|
|
|
if (!ErrNode)
|
|
|
|
return;
|
|
|
|
|
|
|
|
std::string Buf;
|
|
|
|
llvm::raw_string_ostream OS(Buf);
|
|
|
|
|
|
|
|
const ObjCInterfaceDecl *Interface = IvarDecl->getContainingInterface();
|
|
|
|
// If the class is known to have a lifecycle with teardown that is
|
|
|
|
// separate from -dealloc, do not warn about missing releases. We
|
|
|
|
// suppress here (rather than not tracking for instance variables in
|
|
|
|
// such classes) because these classes are rare.
|
|
|
|
if (classHasSeparateTeardown(Interface))
|
|
|
|
return;
|
|
|
|
|
|
|
|
ObjCImplDecl *ImplDecl = Interface->getImplementation();
|
|
|
|
|
|
|
|
const ObjCPropertyImplDecl *PropImpl =
|
|
|
|
ImplDecl->FindPropertyImplIvarDecl(IvarDecl->getIdentifier());
|
|
|
|
|
|
|
|
const ObjCPropertyDecl *PropDecl = PropImpl->getPropertyDecl();
|
|
|
|
|
|
|
|
assert(PropDecl->getSetterKind() == ObjCPropertyDecl::Copy ||
|
|
|
|
PropDecl->getSetterKind() == ObjCPropertyDecl::Retain);
|
|
|
|
|
|
|
|
OS << "The '" << *IvarDecl << "' ivar in '" << *ImplDecl
|
|
|
|
<< "' was ";
|
|
|
|
|
|
|
|
if (PropDecl->getSetterKind() == ObjCPropertyDecl::Retain)
|
|
|
|
OS << "retained";
|
|
|
|
else
|
|
|
|
OS << "copied";
|
|
|
|
|
|
|
|
OS << " by a synthesized property but not released"
|
|
|
|
" before '[super dealloc]'";
|
|
|
|
|
|
|
|
std::unique_ptr<BugReport> BR(
|
|
|
|
new BugReport(*MissingReleaseBugType, OS.str(), ErrNode));
|
|
|
|
|
|
|
|
C.emitReport(std::move(BR));
|
|
|
|
}
|
|
|
|
|
|
|
|
if (NewUnreleased.isEmpty()) {
|
|
|
|
State = State->remove<UnreleasedIvarMap>(SelfSym);
|
|
|
|
} else {
|
|
|
|
State = State->set<UnreleasedIvarMap>(SelfSym, NewUnreleased);
|
|
|
|
}
|
|
|
|
|
|
|
|
if (ErrNode) {
|
|
|
|
C.addTransition(State, ErrNode);
|
|
|
|
} else if (State != InitialState) {
|
|
|
|
C.addTransition(State);
|
|
|
|
}
|
|
|
|
|
|
|
|
// Make sure that after checking in the top-most frame the list of
|
|
|
|
// tracked ivars is empty. This is intended to detect accidental leaks in
|
|
|
|
// the UnreleasedIvarMap program state.
|
|
|
|
assert(!LCtx->inTopFrame() || State->get<UnreleasedIvarMap>().isEmpty());
|
|
|
|
}
|
|
|
|
|
2016-03-05 02:09:58 +08:00
|
|
|
/// Given a symbol, determine whether the symbol refers to an ivar on
|
|
|
|
/// the top-most deallocating instance. If so, find the property for that
|
|
|
|
/// ivar, if one exists. Otherwise return null.
|
|
|
|
const ObjCPropertyImplDecl *
|
|
|
|
ObjCDeallocChecker::findPropertyOnDeallocatingInstance(
|
|
|
|
SymbolRef IvarSym, CheckerContext &C) const {
|
|
|
|
SVal DeallocedInstance;
|
|
|
|
if (!isInInstanceDealloc(C, DeallocedInstance))
|
|
|
|
return nullptr;
|
|
|
|
|
|
|
|
// Try to get the region from which the ivar value was loaded.
|
|
|
|
auto *IvarRegion = getIvarRegionForIvarSymbol(IvarSym);
|
|
|
|
if (!IvarRegion)
|
|
|
|
return nullptr;
|
|
|
|
|
|
|
|
// Don't try to find the property if the ivar was not loaded from the
|
|
|
|
// given instance.
|
|
|
|
if (DeallocedInstance.castAs<loc::MemRegionVal>().getRegion() !=
|
|
|
|
IvarRegion->getSuperRegion())
|
|
|
|
return nullptr;
|
|
|
|
|
|
|
|
const LocationContext *LCtx = C.getLocationContext();
|
|
|
|
const ObjCIvarDecl *IvarDecl = IvarRegion->getDecl();
|
|
|
|
|
|
|
|
const ObjCImplDecl *Container = getContainingObjCImpl(LCtx);
|
|
|
|
const ObjCPropertyImplDecl *PropImpl =
|
|
|
|
Container->FindPropertyImplIvarDecl(IvarDecl->getIdentifier());
|
|
|
|
return PropImpl;
|
|
|
|
}
|
|
|
|
|
2016-02-26 11:41:31 +08:00
|
|
|
/// Emits a warning if the current context is -dealloc and ReleasedValue
|
2016-02-26 05:15:16 +08:00
|
|
|
/// must not be directly released in a -dealloc. Returns true if a diagnostic
|
|
|
|
/// was emitted.
|
|
|
|
bool ObjCDeallocChecker::diagnoseExtraRelease(SymbolRef ReleasedValue,
|
|
|
|
const ObjCMethodCall &M,
|
|
|
|
CheckerContext &C) const {
|
|
|
|
// Try to get the region from which the the released value was loaded.
|
|
|
|
// Note that, unlike diagnosing for missing releases, here we don't track
|
|
|
|
// values that must not be released in the state. This is because even if
|
|
|
|
// these values escape, it is still an error under the rules of MRR to
|
|
|
|
// release them in -dealloc.
|
2016-03-05 02:09:58 +08:00
|
|
|
const ObjCPropertyImplDecl *PropImpl =
|
|
|
|
findPropertyOnDeallocatingInstance(ReleasedValue, C);
|
2016-02-26 05:15:16 +08:00
|
|
|
|
2016-03-05 02:09:58 +08:00
|
|
|
if (!PropImpl)
|
2016-02-26 05:15:16 +08:00
|
|
|
return false;
|
|
|
|
|
|
|
|
// If the ivar belongs to a property that must not be released directly
|
|
|
|
// in dealloc, emit a warning.
|
|
|
|
if (getDeallocReleaseRequirement(PropImpl) !=
|
|
|
|
ReleaseRequirement::MustNotReleaseDirectly) {
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
// If the property is readwrite but it shadows a read-only property in its
|
|
|
|
// external interface, treat the property a read-only. If the outside
|
|
|
|
// world cannot write to a property then the internal implementation is free
|
|
|
|
// to make its own convention about whether the value is stored retained
|
|
|
|
// or not. We look up the shadow here rather than in
|
|
|
|
// getDeallocReleaseRequirement() because doing so can be expensive.
|
|
|
|
const ObjCPropertyDecl *PropDecl = findShadowedPropertyDecl(PropImpl);
|
|
|
|
if (PropDecl) {
|
|
|
|
if (PropDecl->isReadOnly())
|
|
|
|
return false;
|
|
|
|
} else {
|
|
|
|
PropDecl = PropImpl->getPropertyDecl();
|
|
|
|
}
|
|
|
|
|
|
|
|
ExplodedNode *ErrNode = C.generateNonFatalErrorNode();
|
|
|
|
if (!ErrNode)
|
|
|
|
return false;
|
|
|
|
|
|
|
|
std::string Buf;
|
|
|
|
llvm::raw_string_ostream OS(Buf);
|
|
|
|
|
|
|
|
assert(PropDecl->getSetterKind() == ObjCPropertyDecl::Weak ||
|
|
|
|
(PropDecl->getSetterKind() == ObjCPropertyDecl::Assign &&
|
2016-03-26 05:18:22 +08:00
|
|
|
!PropDecl->isReadOnly()) ||
|
|
|
|
isReleasedByCIFilterDealloc(PropImpl)
|
|
|
|
);
|
2016-02-26 05:15:16 +08:00
|
|
|
|
2016-03-05 02:09:58 +08:00
|
|
|
const ObjCImplDecl *Container = getContainingObjCImpl(C.getLocationContext());
|
2016-10-16 08:30:08 +08:00
|
|
|
OS << "The '" << *PropImpl->getPropertyIvarDecl()
|
|
|
|
<< "' ivar in '" << *Container;
|
2016-02-26 05:15:16 +08:00
|
|
|
|
|
|
|
|
2016-10-16 08:30:08 +08:00
|
|
|
if (isReleasedByCIFilterDealloc(PropImpl)) {
|
2016-03-26 05:18:22 +08:00
|
|
|
OS << "' will be released by '-[CIFilter dealloc]' but also released here";
|
|
|
|
} else {
|
|
|
|
OS << "' was synthesized for ";
|
|
|
|
|
|
|
|
if (PropDecl->getSetterKind() == ObjCPropertyDecl::Weak)
|
|
|
|
OS << "a weak";
|
|
|
|
else
|
|
|
|
OS << "an assign, readwrite";
|
|
|
|
|
|
|
|
OS << " property but was released in 'dealloc'";
|
|
|
|
}
|
2016-02-26 05:15:16 +08:00
|
|
|
|
|
|
|
std::unique_ptr<BugReport> BR(
|
|
|
|
new BugReport(*ExtraReleaseBugType, OS.str(), ErrNode));
|
|
|
|
BR->addRange(M.getOriginExpr()->getSourceRange());
|
|
|
|
|
|
|
|
C.emitReport(std::move(BR));
|
|
|
|
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2016-03-05 02:09:58 +08:00
|
|
|
/// Emits a warning if the current context is -dealloc and DeallocedValue
|
|
|
|
/// must not be directly dealloced in a -dealloc. Returns true if a diagnostic
|
|
|
|
/// was emitted.
|
|
|
|
bool ObjCDeallocChecker::diagnoseMistakenDealloc(SymbolRef DeallocedValue,
|
|
|
|
const ObjCMethodCall &M,
|
|
|
|
CheckerContext &C) const {
|
|
|
|
|
|
|
|
// Find the property backing the instance variable that M
|
|
|
|
// is dealloc'ing.
|
|
|
|
const ObjCPropertyImplDecl *PropImpl =
|
|
|
|
findPropertyOnDeallocatingInstance(DeallocedValue, C);
|
|
|
|
if (!PropImpl)
|
|
|
|
return false;
|
|
|
|
|
|
|
|
if (getDeallocReleaseRequirement(PropImpl) !=
|
|
|
|
ReleaseRequirement::MustRelease) {
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
ExplodedNode *ErrNode = C.generateErrorNode();
|
|
|
|
if (!ErrNode)
|
|
|
|
return false;
|
|
|
|
|
|
|
|
std::string Buf;
|
|
|
|
llvm::raw_string_ostream OS(Buf);
|
|
|
|
|
|
|
|
OS << "'" << *PropImpl->getPropertyIvarDecl()
|
|
|
|
<< "' should be released rather than deallocated";
|
|
|
|
|
|
|
|
std::unique_ptr<BugReport> BR(
|
|
|
|
new BugReport(*MistakenDeallocBugType, OS.str(), ErrNode));
|
|
|
|
BR->addRange(M.getOriginExpr()->getSourceRange());
|
|
|
|
|
|
|
|
C.emitReport(std::move(BR));
|
|
|
|
|
|
|
|
return true;
|
|
|
|
}
|
2016-02-26 05:15:16 +08:00
|
|
|
|
2016-06-23 01:03:10 +08:00
|
|
|
ObjCDeallocChecker::ObjCDeallocChecker()
|
|
|
|
: NSObjectII(nullptr), SenTestCaseII(nullptr), XCTestCaseII(nullptr),
|
|
|
|
CIFilterII(nullptr) {
|
2016-02-26 05:15:16 +08:00
|
|
|
|
|
|
|
MissingReleaseBugType.reset(
|
|
|
|
new BugType(this, "Missing ivar release (leak)",
|
|
|
|
categories::MemoryCoreFoundationObjectiveC));
|
|
|
|
|
|
|
|
ExtraReleaseBugType.reset(
|
|
|
|
new BugType(this, "Extra ivar release",
|
|
|
|
categories::MemoryCoreFoundationObjectiveC));
|
2016-03-05 02:09:58 +08:00
|
|
|
|
|
|
|
MistakenDeallocBugType.reset(
|
|
|
|
new BugType(this, "Mistaken dealloc",
|
|
|
|
categories::MemoryCoreFoundationObjectiveC));
|
2016-02-26 05:15:16 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
void ObjCDeallocChecker::initIdentifierInfoAndSelectors(
|
|
|
|
ASTContext &Ctx) const {
|
|
|
|
if (NSObjectII)
|
|
|
|
return;
|
|
|
|
|
|
|
|
NSObjectII = &Ctx.Idents.get("NSObject");
|
|
|
|
SenTestCaseII = &Ctx.Idents.get("SenTestCase");
|
2016-06-23 01:03:10 +08:00
|
|
|
XCTestCaseII = &Ctx.Idents.get("XCTestCase");
|
2016-03-01 07:57:10 +08:00
|
|
|
Block_releaseII = &Ctx.Idents.get("_Block_release");
|
2016-03-26 05:18:22 +08:00
|
|
|
CIFilterII = &Ctx.Idents.get("CIFilter");
|
2016-02-26 05:15:16 +08:00
|
|
|
|
|
|
|
IdentifierInfo *DeallocII = &Ctx.Idents.get("dealloc");
|
|
|
|
IdentifierInfo *ReleaseII = &Ctx.Idents.get("release");
|
|
|
|
DeallocSel = Ctx.Selectors.getSelector(0, &DeallocII);
|
|
|
|
ReleaseSel = Ctx.Selectors.getSelector(0, &ReleaseII);
|
|
|
|
}
|
|
|
|
|
2016-02-26 11:41:31 +08:00
|
|
|
/// Returns true if M is a call to '[super dealloc]'.
|
2016-02-26 05:15:16 +08:00
|
|
|
bool ObjCDeallocChecker::isSuperDeallocMessage(
|
|
|
|
const ObjCMethodCall &M) const {
|
|
|
|
if (M.getOriginExpr()->getReceiverKind() != ObjCMessageExpr::SuperInstance)
|
|
|
|
return false;
|
|
|
|
|
|
|
|
return M.getSelector() == DeallocSel;
|
2016-02-26 02:55:24 +08:00
|
|
|
}
|
|
|
|
|
2016-02-26 11:15:13 +08:00
|
|
|
/// Returns the ObjCImplDecl containing the method declaration in LCtx.
|
2016-02-26 05:15:16 +08:00
|
|
|
const ObjCImplDecl *
|
|
|
|
ObjCDeallocChecker::getContainingObjCImpl(const LocationContext *LCtx) const {
|
|
|
|
auto *MD = cast<ObjCMethodDecl>(LCtx->getDecl());
|
|
|
|
return cast<ObjCImplDecl>(MD->getDeclContext());
|
|
|
|
}
|
|
|
|
|
2016-02-26 11:41:31 +08:00
|
|
|
/// Returns the property that shadowed by PropImpl if one exists and
|
2016-02-26 05:15:16 +08:00
|
|
|
/// nullptr otherwise.
|
|
|
|
const ObjCPropertyDecl *ObjCDeallocChecker::findShadowedPropertyDecl(
|
|
|
|
const ObjCPropertyImplDecl *PropImpl) const {
|
|
|
|
const ObjCPropertyDecl *PropDecl = PropImpl->getPropertyDecl();
|
|
|
|
|
|
|
|
// Only readwrite properties can shadow.
|
|
|
|
if (PropDecl->isReadOnly())
|
|
|
|
return nullptr;
|
|
|
|
|
|
|
|
auto *CatDecl = dyn_cast<ObjCCategoryDecl>(PropDecl->getDeclContext());
|
|
|
|
|
|
|
|
// Only class extensions can contain shadowing properties.
|
|
|
|
if (!CatDecl || !CatDecl->IsClassExtension())
|
|
|
|
return nullptr;
|
|
|
|
|
|
|
|
IdentifierInfo *ID = PropDecl->getIdentifier();
|
|
|
|
DeclContext::lookup_result R = CatDecl->getClassInterface()->lookup(ID);
|
|
|
|
for (DeclContext::lookup_iterator I = R.begin(), E = R.end(); I != E; ++I) {
|
|
|
|
auto *ShadowedPropDecl = dyn_cast<ObjCPropertyDecl>(*I);
|
|
|
|
if (!ShadowedPropDecl)
|
|
|
|
continue;
|
|
|
|
|
|
|
|
if (ShadowedPropDecl->isInstanceProperty()) {
|
|
|
|
assert(ShadowedPropDecl->isReadOnly());
|
|
|
|
return ShadowedPropDecl;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return nullptr;
|
|
|
|
}
|
|
|
|
|
2016-03-01 07:57:10 +08:00
|
|
|
/// Add a transition noting the release of the given value.
|
|
|
|
void ObjCDeallocChecker::transitionToReleaseValue(CheckerContext &C,
|
|
|
|
SymbolRef Value) const {
|
|
|
|
assert(Value);
|
|
|
|
SymbolRef InstanceSym = getInstanceSymbolFromIvarSymbol(Value);
|
|
|
|
if (!InstanceSym)
|
|
|
|
return;
|
|
|
|
ProgramStateRef InitialState = C.getState();
|
|
|
|
|
|
|
|
ProgramStateRef ReleasedState =
|
|
|
|
removeValueRequiringRelease(InitialState, InstanceSym, Value);
|
|
|
|
|
|
|
|
if (ReleasedState != InitialState) {
|
|
|
|
C.addTransition(ReleasedState);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-02-26 11:41:31 +08:00
|
|
|
/// Remove the Value requiring a release from the tracked set for
|
|
|
|
/// Instance and return the resultant state.
|
2016-02-26 05:15:16 +08:00
|
|
|
ProgramStateRef ObjCDeallocChecker::removeValueRequiringRelease(
|
|
|
|
ProgramStateRef State, SymbolRef Instance, SymbolRef Value) const {
|
|
|
|
assert(Instance);
|
|
|
|
assert(Value);
|
2016-03-01 05:44:08 +08:00
|
|
|
const ObjCIvarRegion *RemovedRegion = getIvarRegionForIvarSymbol(Value);
|
|
|
|
if (!RemovedRegion)
|
|
|
|
return State;
|
2016-02-26 05:15:16 +08:00
|
|
|
|
|
|
|
const SymbolSet *Unreleased = State->get<UnreleasedIvarMap>(Instance);
|
|
|
|
if (!Unreleased)
|
|
|
|
return State;
|
|
|
|
|
|
|
|
// Mark the value as no longer requiring a release.
|
|
|
|
SymbolSet::Factory &F = State->getStateManager().get_context<SymbolSet>();
|
2016-03-01 05:44:08 +08:00
|
|
|
SymbolSet NewUnreleased = *Unreleased;
|
|
|
|
for (auto &Sym : *Unreleased) {
|
|
|
|
const ObjCIvarRegion *UnreleasedRegion = getIvarRegionForIvarSymbol(Sym);
|
|
|
|
assert(UnreleasedRegion);
|
|
|
|
if (RemovedRegion->getDecl() == UnreleasedRegion->getDecl()) {
|
|
|
|
NewUnreleased = F.remove(NewUnreleased, Sym);
|
|
|
|
}
|
|
|
|
}
|
2016-02-26 05:15:16 +08:00
|
|
|
|
|
|
|
if (NewUnreleased.isEmpty()) {
|
|
|
|
return State->remove<UnreleasedIvarMap>(Instance);
|
|
|
|
}
|
|
|
|
|
|
|
|
return State->set<UnreleasedIvarMap>(Instance, NewUnreleased);
|
|
|
|
}
|
|
|
|
|
|
|
|
/// Determines whether the instance variable for \p PropImpl must or must not be
|
|
|
|
/// released in -dealloc or whether it cannot be determined.
|
|
|
|
ReleaseRequirement ObjCDeallocChecker::getDeallocReleaseRequirement(
|
|
|
|
const ObjCPropertyImplDecl *PropImpl) const {
|
|
|
|
const ObjCIvarDecl *IvarDecl;
|
|
|
|
const ObjCPropertyDecl *PropDecl;
|
|
|
|
if (!isSynthesizedRetainableProperty(PropImpl, &IvarDecl, &PropDecl))
|
|
|
|
return ReleaseRequirement::Unknown;
|
|
|
|
|
|
|
|
ObjCPropertyDecl::SetterKind SK = PropDecl->getSetterKind();
|
|
|
|
|
|
|
|
switch (SK) {
|
|
|
|
// Retain and copy setters retain/copy their values before storing and so
|
|
|
|
// the value in their instance variables must be released in -dealloc.
|
|
|
|
case ObjCPropertyDecl::Retain:
|
|
|
|
case ObjCPropertyDecl::Copy:
|
2016-03-26 05:18:22 +08:00
|
|
|
if (isReleasedByCIFilterDealloc(PropImpl))
|
|
|
|
return ReleaseRequirement::MustNotReleaseDirectly;
|
|
|
|
|
2016-10-13 07:57:05 +08:00
|
|
|
if (isNibLoadedIvarWithoutRetain(PropImpl))
|
|
|
|
return ReleaseRequirement::Unknown;
|
|
|
|
|
2016-02-26 05:15:16 +08:00
|
|
|
return ReleaseRequirement::MustRelease;
|
|
|
|
|
|
|
|
case ObjCPropertyDecl::Weak:
|
|
|
|
return ReleaseRequirement::MustNotReleaseDirectly;
|
|
|
|
|
|
|
|
case ObjCPropertyDecl::Assign:
|
|
|
|
// It is common for the ivars for read-only assign properties to
|
|
|
|
// always be stored retained, so their release requirement cannot be
|
|
|
|
// be determined.
|
|
|
|
if (PropDecl->isReadOnly())
|
|
|
|
return ReleaseRequirement::Unknown;
|
|
|
|
|
|
|
|
return ReleaseRequirement::MustNotReleaseDirectly;
|
|
|
|
}
|
|
|
|
llvm_unreachable("Unrecognized setter kind");
|
|
|
|
}
|
|
|
|
|
2016-02-26 11:41:31 +08:00
|
|
|
/// Returns the released value if M is a call a setter that releases
|
2016-02-26 05:15:16 +08:00
|
|
|
/// and nils out its underlying instance variable.
|
|
|
|
SymbolRef
|
|
|
|
ObjCDeallocChecker::getValueReleasedByNillingOut(const ObjCMethodCall &M,
|
|
|
|
CheckerContext &C) const {
|
|
|
|
SVal ReceiverVal = M.getReceiverSVal();
|
|
|
|
if (!ReceiverVal.isValid())
|
|
|
|
return nullptr;
|
|
|
|
|
|
|
|
if (M.getNumArgs() == 0)
|
|
|
|
return nullptr;
|
2016-03-04 05:38:39 +08:00
|
|
|
|
|
|
|
if (!M.getArgExpr(0)->getType()->isObjCRetainableType())
|
|
|
|
return nullptr;
|
|
|
|
|
|
|
|
// Is the first argument nil?
|
2016-02-26 05:15:16 +08:00
|
|
|
SVal Arg = M.getArgSVal(0);
|
|
|
|
ProgramStateRef notNilState, nilState;
|
|
|
|
std::tie(notNilState, nilState) =
|
|
|
|
M.getState()->assume(Arg.castAs<DefinedOrUnknownSVal>());
|
|
|
|
if (!(nilState && !notNilState))
|
|
|
|
return nullptr;
|
|
|
|
|
|
|
|
const ObjCPropertyDecl *Prop = M.getAccessedProperty();
|
|
|
|
if (!Prop)
|
|
|
|
return nullptr;
|
|
|
|
|
|
|
|
ObjCIvarDecl *PropIvarDecl = Prop->getPropertyIvarDecl();
|
|
|
|
if (!PropIvarDecl)
|
|
|
|
return nullptr;
|
|
|
|
|
|
|
|
ProgramStateRef State = C.getState();
|
|
|
|
|
|
|
|
SVal LVal = State->getLValue(PropIvarDecl, ReceiverVal);
|
|
|
|
Optional<Loc> LValLoc = LVal.getAs<Loc>();
|
|
|
|
if (!LValLoc)
|
|
|
|
return nullptr;
|
|
|
|
|
|
|
|
SVal CurrentValInIvar = State->getSVal(LValLoc.getValue());
|
|
|
|
return CurrentValInIvar.getAsSymbol();
|
|
|
|
}
|
|
|
|
|
|
|
|
/// Returns true if the current context is a call to -dealloc and false
|
2016-02-26 11:41:31 +08:00
|
|
|
/// otherwise. If true, it also sets SelfValOut to the value of
|
2016-02-26 05:15:16 +08:00
|
|
|
/// 'self'.
|
|
|
|
bool ObjCDeallocChecker::isInInstanceDealloc(const CheckerContext &C,
|
|
|
|
SVal &SelfValOut) const {
|
|
|
|
return isInInstanceDealloc(C, C.getLocationContext(), SelfValOut);
|
|
|
|
}
|
|
|
|
|
2016-02-26 11:41:31 +08:00
|
|
|
/// Returns true if LCtx is a call to -dealloc and false
|
|
|
|
/// otherwise. If true, it also sets SelfValOut to the value of
|
2016-02-26 05:15:16 +08:00
|
|
|
/// 'self'.
|
|
|
|
bool ObjCDeallocChecker::isInInstanceDealloc(const CheckerContext &C,
|
|
|
|
const LocationContext *LCtx,
|
|
|
|
SVal &SelfValOut) const {
|
|
|
|
auto *MD = dyn_cast<ObjCMethodDecl>(LCtx->getDecl());
|
|
|
|
if (!MD || !MD->isInstanceMethod() || MD->getSelector() != DeallocSel)
|
|
|
|
return false;
|
|
|
|
|
|
|
|
const ImplicitParamDecl *SelfDecl = LCtx->getSelfDecl();
|
|
|
|
assert(SelfDecl && "No self in -dealloc?");
|
|
|
|
|
|
|
|
ProgramStateRef State = C.getState();
|
|
|
|
SelfValOut = State->getSVal(State->getRegion(SelfDecl, LCtx));
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
|
|
|
/// Returns true if there is a call to -dealloc anywhere on the stack and false
|
2016-02-26 11:41:31 +08:00
|
|
|
/// otherwise. If true, it also sets InstanceValOut to the value of
|
2016-02-26 05:15:16 +08:00
|
|
|
/// 'self' in the frame for -dealloc.
|
|
|
|
bool ObjCDeallocChecker::instanceDeallocIsOnStack(const CheckerContext &C,
|
|
|
|
SVal &InstanceValOut) const {
|
|
|
|
const LocationContext *LCtx = C.getLocationContext();
|
|
|
|
|
|
|
|
while (LCtx) {
|
|
|
|
if (isInInstanceDealloc(C, LCtx, InstanceValOut))
|
|
|
|
return true;
|
|
|
|
|
|
|
|
LCtx = LCtx->getParent();
|
|
|
|
}
|
|
|
|
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
2016-02-26 11:41:31 +08:00
|
|
|
/// Returns true if the ID is a class in which which is known to have
|
2016-02-26 05:15:16 +08:00
|
|
|
/// a separate teardown lifecycle. In this case, -dealloc warnings
|
|
|
|
/// about missing releases should be suppressed.
|
|
|
|
bool ObjCDeallocChecker::classHasSeparateTeardown(
|
|
|
|
const ObjCInterfaceDecl *ID) const {
|
|
|
|
// Suppress if the class is not a subclass of NSObject.
|
|
|
|
for ( ; ID ; ID = ID->getSuperClass()) {
|
|
|
|
IdentifierInfo *II = ID->getIdentifier();
|
|
|
|
|
|
|
|
if (II == NSObjectII)
|
|
|
|
return false;
|
|
|
|
|
2016-06-23 01:03:10 +08:00
|
|
|
// FIXME: For now, ignore classes that subclass SenTestCase and XCTestCase,
|
|
|
|
// as these don't need to implement -dealloc. They implement tear down in
|
|
|
|
// another way, which we should try and catch later.
|
2016-02-26 05:15:16 +08:00
|
|
|
// http://llvm.org/bugs/show_bug.cgi?id=3187
|
2016-06-23 01:03:10 +08:00
|
|
|
if (II == XCTestCaseII || II == SenTestCaseII)
|
2016-02-26 05:15:16 +08:00
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2016-03-26 05:18:22 +08:00
|
|
|
/// The -dealloc method in CIFilter highly unusual in that is will release
|
|
|
|
/// instance variables belonging to its *subclasses* if the variable name
|
|
|
|
/// starts with "input" or backs a property whose name starts with "input".
|
|
|
|
/// Subclasses should not release these ivars in their own -dealloc method --
|
|
|
|
/// doing so could result in an over release.
|
|
|
|
///
|
|
|
|
/// This method returns true if the property will be released by
|
|
|
|
/// -[CIFilter dealloc].
|
|
|
|
bool ObjCDeallocChecker::isReleasedByCIFilterDealloc(
|
|
|
|
const ObjCPropertyImplDecl *PropImpl) const {
|
|
|
|
assert(PropImpl->getPropertyIvarDecl());
|
|
|
|
StringRef PropName = PropImpl->getPropertyDecl()->getName();
|
|
|
|
StringRef IvarName = PropImpl->getPropertyIvarDecl()->getName();
|
|
|
|
|
|
|
|
const char *ReleasePrefix = "input";
|
|
|
|
if (!(PropName.startswith(ReleasePrefix) ||
|
|
|
|
IvarName.startswith(ReleasePrefix))) {
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
const ObjCInterfaceDecl *ID =
|
|
|
|
PropImpl->getPropertyIvarDecl()->getContainingInterface();
|
|
|
|
for ( ; ID ; ID = ID->getSuperClass()) {
|
|
|
|
IdentifierInfo *II = ID->getIdentifier();
|
|
|
|
if (II == CIFilterII)
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
2016-10-13 07:57:05 +08:00
|
|
|
/// Returns whether the ivar backing the property is an IBOutlet that
|
|
|
|
/// has its value set by nib loading code without retaining the value.
|
|
|
|
///
|
|
|
|
/// On macOS, if there is no setter, the nib-loading code sets the ivar
|
|
|
|
/// directly, without retaining the value,
|
|
|
|
///
|
|
|
|
/// On iOS and its derivatives, the nib-loading code will call
|
|
|
|
/// -setValue:forKey:, which retains the value before directly setting the ivar.
|
|
|
|
bool ObjCDeallocChecker::isNibLoadedIvarWithoutRetain(
|
|
|
|
const ObjCPropertyImplDecl *PropImpl) const {
|
|
|
|
const ObjCIvarDecl *IvarDecl = PropImpl->getPropertyIvarDecl();
|
|
|
|
if (!IvarDecl->hasAttr<IBOutletAttr>())
|
|
|
|
return false;
|
|
|
|
|
|
|
|
const llvm::Triple &Target =
|
|
|
|
IvarDecl->getASTContext().getTargetInfo().getTriple();
|
|
|
|
|
|
|
|
if (!Target.isMacOSX())
|
|
|
|
return false;
|
|
|
|
|
|
|
|
if (PropImpl->getPropertyDecl()->getSetterMethodDecl())
|
|
|
|
return false;
|
|
|
|
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2016-02-26 05:15:16 +08:00
|
|
|
void ento::registerObjCDeallocChecker(CheckerManager &Mgr) {
|
|
|
|
const LangOptions &LangOpts = Mgr.getLangOpts();
|
|
|
|
// These checker only makes sense under MRR.
|
|
|
|
if (LangOpts.getGC() == LangOptions::GCOnly || LangOpts.ObjCAutoRefCount)
|
|
|
|
return;
|
|
|
|
|
|
|
|
Mgr.registerChecker<ObjCDeallocChecker>();
|
2011-02-18 05:39:33 +08:00
|
|
|
}
|