2013-02-02 03:50:01 +08:00
|
|
|
// Like the compiler, the static analyzer treats some functions differently if
|
|
|
|
// they come from a system header -- for example, it is assumed that system
|
|
|
|
// functions do not arbitrarily free() their parameters, and that some bugs
|
|
|
|
// found in system headers cannot be fixed by the user and should be
|
|
|
|
// suppressed.
|
2012-01-05 07:54:01 +08:00
|
|
|
#pragma clang system_header
|
|
|
|
|
2013-04-16 04:39:45 +08:00
|
|
|
#ifdef __cplusplus
|
|
|
|
#define restrict /*restrict*/
|
|
|
|
#endif
|
|
|
|
|
2012-01-05 07:54:01 +08:00
|
|
|
typedef struct _FILE FILE;
|
|
|
|
extern FILE *stdin;
|
2012-03-01 02:42:47 +08:00
|
|
|
extern FILE *stdout;
|
|
|
|
extern FILE *stderr;
|
|
|
|
// Include a variant of standard streams that occur in the pre-processed file.
|
|
|
|
extern FILE *__stdinp;
|
|
|
|
extern FILE *__stdoutp;
|
|
|
|
extern FILE *__stderrp;
|
|
|
|
|
2013-04-16 04:39:37 +08:00
|
|
|
int scanf(const char *restrict format, ...);
|
2012-03-01 02:42:47 +08:00
|
|
|
int fscanf(FILE *restrict, const char *restrict, ...);
|
2013-04-16 04:39:37 +08:00
|
|
|
int printf(const char *restrict format, ...);
|
|
|
|
int fprintf(FILE *restrict, const char *restrict, ...);
|
|
|
|
int getchar(void);
|
2012-01-05 07:54:01 +08:00
|
|
|
|
|
|
|
// Note, on some platforms errno macro gets replaced with a function call.
|
|
|
|
extern int errno;
|
|
|
|
|
2012-09-20 19:03:56 +08:00
|
|
|
typedef __typeof(sizeof(int)) size_t;
|
|
|
|
|
|
|
|
size_t strlen(const char *);
|
2012-02-12 07:46:36 +08:00
|
|
|
|
2012-03-01 02:42:47 +08:00
|
|
|
char *strcpy(char *restrict, const char *restrict);
|
2013-11-17 17:18:48 +08:00
|
|
|
void *memcpy(void *dst, const void *src, size_t n);
|
2012-02-12 07:46:36 +08:00
|
|
|
|
2012-02-23 09:05:27 +08:00
|
|
|
typedef unsigned long __darwin_pthread_key_t;
|
|
|
|
typedef __darwin_pthread_key_t pthread_key_t;
|
2012-03-01 02:42:47 +08:00
|
|
|
int pthread_setspecific(pthread_key_t, const void *);
|
|
|
|
|
|
|
|
typedef long long __int64_t;
|
|
|
|
typedef __int64_t __darwin_off_t;
|
|
|
|
typedef __darwin_off_t fpos_t;
|
|
|
|
|
|
|
|
void setbuf(FILE * restrict, char * restrict);
|
|
|
|
int setvbuf(FILE * restrict, char * restrict, int, size_t);
|
|
|
|
|
2013-04-16 04:39:37 +08:00
|
|
|
FILE *fopen(const char * restrict, const char * restrict);
|
|
|
|
int fclose(FILE *);
|
2012-03-01 02:42:47 +08:00
|
|
|
FILE *funopen(const void *,
|
|
|
|
int (*)(void *, char *, int),
|
|
|
|
int (*)(void *, const char *, int),
|
|
|
|
fpos_t (*)(void *, fpos_t, int),
|
|
|
|
int (*)(void *));
|
|
|
|
|
2012-05-04 07:50:28 +08:00
|
|
|
int sqlite3_bind_text_my(int, const char*, int n, void(*)(void*));
|
2012-05-04 07:50:33 +08:00
|
|
|
|
|
|
|
typedef void (*freeCallback) (void*);
|
|
|
|
typedef struct {
|
|
|
|
int i;
|
|
|
|
freeCallback fc;
|
|
|
|
} StWithCallback;
|
|
|
|
|
|
|
|
int dealocateMemWhenDoneByVal(void*, StWithCallback);
|
|
|
|
int dealocateMemWhenDoneByRef(StWithCallback*, const void*);
|
2012-06-16 08:09:20 +08:00
|
|
|
|
|
|
|
typedef struct CGContext *CGContextRef;
|
|
|
|
CGContextRef CGBitmapContextCreate(void *data/*, size_t width, size_t height,
|
|
|
|
size_t bitsPerComponent, size_t bytesPerRow,
|
|
|
|
CGColorSpaceRef space,
|
|
|
|
CGBitmapInfo bitmapInfo*/);
|
|
|
|
void *CGBitmapContextGetData(CGContextRef context);
|
2012-06-21 07:35:57 +08:00
|
|
|
|
|
|
|
// Include xpc.
|
|
|
|
typedef struct _xpc_connection_s * xpc_connection_t;
|
|
|
|
typedef void (*xpc_finalizer_t)(void *value);
|
|
|
|
void xpc_connection_set_context(xpc_connection_t connection, void *context);
|
|
|
|
void xpc_connection_set_finalizer_f(xpc_connection_t connection, xpc_finalizer_t finalizer);
|
|
|
|
void xpc_connection_resume(xpc_connection_t connection);
|
2013-02-08 07:05:43 +08:00
|
|
|
|
[analyzer] Indirect invalidation counts as an escape for leak checkers.
Consider this example:
char *p = malloc(sizeof(char));
systemFunction(&p);
free(p);
In this case, when we call systemFunction, we know (because it's a system
function) that it won't free 'p'. However, we /don't/ know whether or not
it will /change/ 'p', so the analyzer is forced to invalidate 'p', wiping
out any bindings it contains. But now the malloc'd region looks like a
leak, since there are no more bindings pointing to it, and we'll get a
spurious leak warning.
The fix for this is to notice when something is becoming inaccessible due
to invalidation (i.e. an imperfect model, as opposed to being explicitly
overwritten) and stop tracking it at that point. Currently, the best way
to determine this for a call is the "indirect escape" pointer-escape kind.
In practice, all the patch does is take the "system functions don't free
memory" special case and limit it to direct parameters, i.e. just the
arguments to a call and not other regions accessible to them. This is a
conservative change that should only cause us to escape regions more
eagerly, which means fewer leak warnings.
This isn't perfect for several reasons, the main one being that this
example is treated the same as the one above:
char **p = malloc(sizeof(char *));
systemFunction(p + 1);
// leak
Currently, "addresses accessible by offsets of the starting region" and
"addresses accessible through bindings of the starting region" are both
considered "indirect" regions, hence this uniform treatment.
Another issue is our longstanding problem of not distinguishing const and
non-const bindings; if in the first example systemFunction's parameter were
a char * const *, we should know that the function will not overwrite 'p',
and thus we can safely report the leak.
<rdar://problem/13758386>
llvm-svn: 181607
2013-05-11 01:07:16 +08:00
|
|
|
//The following are fake system header functions for generic testing.
|
2013-02-08 07:05:43 +08:00
|
|
|
void fakeSystemHeaderCallInt(int *);
|
[analyzer] Indirect invalidation counts as an escape for leak checkers.
Consider this example:
char *p = malloc(sizeof(char));
systemFunction(&p);
free(p);
In this case, when we call systemFunction, we know (because it's a system
function) that it won't free 'p'. However, we /don't/ know whether or not
it will /change/ 'p', so the analyzer is forced to invalidate 'p', wiping
out any bindings it contains. But now the malloc'd region looks like a
leak, since there are no more bindings pointing to it, and we'll get a
spurious leak warning.
The fix for this is to notice when something is becoming inaccessible due
to invalidation (i.e. an imperfect model, as opposed to being explicitly
overwritten) and stop tracking it at that point. Currently, the best way
to determine this for a call is the "indirect escape" pointer-escape kind.
In practice, all the patch does is take the "system functions don't free
memory" special case and limit it to direct parameters, i.e. just the
arguments to a call and not other regions accessible to them. This is a
conservative change that should only cause us to escape regions more
eagerly, which means fewer leak warnings.
This isn't perfect for several reasons, the main one being that this
example is treated the same as the one above:
char **p = malloc(sizeof(char *));
systemFunction(p + 1);
// leak
Currently, "addresses accessible by offsets of the starting region" and
"addresses accessible through bindings of the starting region" are both
considered "indirect" regions, hence this uniform treatment.
Another issue is our longstanding problem of not distinguishing const and
non-const bindings; if in the first example systemFunction's parameter were
a char * const *, we should know that the function will not overwrite 'p',
and thus we can safely report the leak.
<rdar://problem/13758386>
llvm-svn: 181607
2013-05-11 01:07:16 +08:00
|
|
|
void fakeSystemHeaderCallIntPtr(int **);
|
2013-02-08 07:05:43 +08:00
|
|
|
|
|
|
|
typedef struct __SomeStruct {
|
|
|
|
char * p;
|
|
|
|
} SomeStruct;
|
|
|
|
void fakeSystemHeaderCall(SomeStruct *);
|