Coverage Report

Created: 2020-02-15 09:57

/Users/buildslave/jenkins/workspace/coverage/llvm-project/clang/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountChecker.cpp
Line
Count
Source (jump to first uncovered line)
1
//==-- RetainCountChecker.cpp - Checks for leaks and other issues -*- C++ -*--//
2
//
3
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4
// See https://llvm.org/LICENSE.txt for license information.
5
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6
//
7
//===----------------------------------------------------------------------===//
8
//
9
//  This file defines the methods for RetainCountChecker, which implements
10
//  a reference count checker for Core Foundation and Cocoa on (Mac OS X).
11
//
12
//===----------------------------------------------------------------------===//
13
14
#include "RetainCountChecker.h"
15
#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
16
17
using namespace clang;
18
using namespace ento;
19
using namespace retaincountchecker;
20
using llvm::StrInStrNoCase;
21
22
REGISTER_MAP_WITH_PROGRAMSTATE(RefBindings, SymbolRef, RefVal)
23
24
namespace clang {
25
namespace ento {
26
namespace retaincountchecker {
27
28
57.6k
const RefVal *getRefBinding(ProgramStateRef State, SymbolRef Sym) {
29
57.6k
  return State->get<RefBindings>(Sym);
30
57.6k
}
31
32
} // end namespace retaincountchecker
33
} // end namespace ento
34
} // end namespace clang
35
36
static ProgramStateRef setRefBinding(ProgramStateRef State, SymbolRef Sym,
37
4.13k
                                     RefVal Val) {
38
4.13k
  assert(Sym != nullptr);
39
4.13k
  return State->set<RefBindings>(Sym, Val);
40
4.13k
}
41
42
6.14k
static ProgramStateRef removeRefBinding(ProgramStateRef State, SymbolRef Sym) {
43
6.14k
  return State->remove<RefBindings>(Sym);
44
6.14k
}
45
46
0
void RefVal::print(raw_ostream &Out) const {
47
0
  if (!T.isNull())
48
0
    Out << "Tracked " << T.getAsString() << " | ";
49
0
50
0
  switch (getKind()) {
51
0
    default: llvm_unreachable("Invalid RefVal kind");
52
0
    case Owned: {
53
0
      Out << "Owned";
54
0
      unsigned cnt = getCount();
55
0
      if (cnt) Out << " (+ " << cnt << ")";
56
0
      break;
57
0
    }
58
0
59
0
    case NotOwned: {
60
0
      Out << "NotOwned";
61
0
      unsigned cnt = getCount();
62
0
      if (cnt) Out << " (+ " << cnt << ")";
63
0
      break;
64
0
    }
65
0
66
0
    case ReturnedOwned: {
67
0
      Out << "ReturnedOwned";
68
0
      unsigned cnt = getCount();
69
0
      if (cnt) Out << " (+ " << cnt << ")";
70
0
      break;
71
0
    }
72
0
73
0
    case ReturnedNotOwned: {
74
0
      Out << "ReturnedNotOwned";
75
0
      unsigned cnt = getCount();
76
0
      if (cnt) Out << " (+ " << cnt << ")";
77
0
      break;
78
0
    }
79
0
80
0
    case Released:
81
0
      Out << "Released";
82
0
      break;
83
0
84
0
    case ErrorDeallocNotOwned:
85
0
      Out << "-dealloc (not-owned)";
86
0
      break;
87
0
88
0
    case ErrorLeak:
89
0
      Out << "Leaked";
90
0
      break;
91
0
92
0
    case ErrorLeakReturned:
93
0
      Out << "Leaked (Bad naming)";
94
0
      break;
95
0
96
0
    case ErrorUseAfterRelease:
97
0
      Out << "Use-After-Release [ERROR]";
98
0
      break;
99
0
100
0
    case ErrorReleaseNotOwned:
101
0
      Out << "Release of Not-Owned [ERROR]";
102
0
      break;
103
0
104
0
    case RefVal::ErrorOverAutorelease:
105
0
      Out << "Over-autoreleased";
106
0
      break;
107
0
108
0
    case RefVal::ErrorReturnedNotOwned:
109
0
      Out << "Non-owned object returned instead of owned";
110
0
      break;
111
0
  }
112
0
113
0
  switch (getIvarAccessHistory()) {
114
0
  case IvarAccessHistory::None:
115
0
    break;
116
0
  case IvarAccessHistory::AccessedDirectly:
117
0
    Out << " [direct ivar access]";
118
0
    break;
119
0
  case IvarAccessHistory::ReleasedAfterDirectAccess:
120
0
    Out << " [released after direct ivar access]";
121
0
  }
122
0
123
0
  if (ACnt) {
124
0
    Out << " [autorelease -" << ACnt << ']';
125
0
  }
126
0
}
127
128
namespace {
129
class StopTrackingCallback final : public SymbolVisitor {
130
  ProgramStateRef state;
131
public:
132
332
  StopTrackingCallback(ProgramStateRef st) : state(std::move(st)) {}
133
332
  ProgramStateRef getState() const { return state; }
134
135
196
  bool VisitSymbol(SymbolRef sym) override {
136
196
    state = removeRefBinding(state, sym);
137
196
    return true;
138
196
  }
139
};
140
} // end anonymous namespace
141
142
//===----------------------------------------------------------------------===//
143
// Handle statements that may have an effect on refcounts.
144
//===----------------------------------------------------------------------===//
145
146
void RetainCountChecker::checkPostStmt(const BlockExpr *BE,
147
61
                                       CheckerContext &C) const {
148
61
149
61
  // Scan the BlockDecRefExprs for any object the retain count checker
150
61
  // may be tracking.
151
61
  if (!BE->getBlockDecl()->hasCaptures())
152
37
    return;
153
24
154
24
  ProgramStateRef state = C.getState();
155
24
  auto *R = cast<BlockDataRegion>(C.getSVal(BE).getAsRegion());
156
24
157
24
  BlockDataRegion::referenced_vars_iterator I = R->referenced_vars_begin(),
158
24
                                            E = R->referenced_vars_end();
159
24
160
24
  if (I == E)
161
0
    return;
162
24
163
24
  // FIXME: For now we invalidate the tracking of all symbols passed to blocks
164
24
  // via captured variables, even though captured variables result in a copy
165
24
  // and in implicit increment/decrement of a retain count.
166
24
  SmallVector<const MemRegion*, 10> Regions;
167
24
  const LocationContext *LC = C.getLocationContext();
168
24
  MemRegionManager &MemMgr = C.getSValBuilder().getRegionManager();
169
24
170
52
  for ( ; I != E; 
++I28
) {
171
28
    const VarRegion *VR = I.getCapturedRegion();
172
28
    if (VR->getSuperRegion() == R) {
173
18
      VR = MemMgr.getVarRegion(VR->getDecl(), LC);
174
18
    }
175
28
    Regions.push_back(VR);
176
28
  }
177
24
178
24
  state = state->scanReachableSymbols<StopTrackingCallback>(Regions).getState();
179
24
  C.addTransition(state);
180
24
}
181
182
void RetainCountChecker::checkPostStmt(const CastExpr *CE,
183
9.86k
                                       CheckerContext &C) const {
184
9.86k
  const ObjCBridgedCastExpr *BE = dyn_cast<ObjCBridgedCastExpr>(CE);
185
9.86k
  if (!BE)
186
9.84k
    return;
187
19
188
19
  QualType QT = CE->getType();
189
19
  ObjKind K;
190
19
  if (QT->isObjCObjectPointerType()) {
191
10
    K = ObjKind::ObjC;
192
10
  } else {
193
9
    K = ObjKind::CF;
194
9
  }
195
19
196
19
  ArgEffect AE = ArgEffect(IncRef, K);
197
19
198
19
  switch (BE->getBridgeKind()) {
199
11
    case OBC_Bridge:
200
11
      // Do nothing.
201
11
      return;
202
3
    case OBC_BridgeRetained:
203
3
      AE = AE.withKind(IncRef);
204
3
      break;
205
5
    case OBC_BridgeTransfer:
206
5
      AE = AE.withKind(DecRefBridgedTransferred);
207
5
      break;
208
8
  }
209
8
210
8
  ProgramStateRef state = C.getState();
211
8
  SymbolRef Sym = C.getSVal(CE).getAsLocSymbol();
212
8
  if (!Sym)
213
0
    return;
214
8
  const RefVal* T = getRefBinding(state, Sym);
215
8
  if (!T)
216
3
    return;
217
5
218
5
  RefVal::Kind hasErr = (RefVal::Kind) 0;
219
5
  state = updateSymbol(state, Sym, *T, AE, hasErr, C);
220
5
221
5
  if (hasErr) {
222
0
    // FIXME: If we get an error during a bridge cast, should we report it?
223
0
    return;
224
0
  }
225
5
226
5
  C.addTransition(state);
227
5
}
228
229
void RetainCountChecker::processObjCLiterals(CheckerContext &C,
230
34
                                             const Expr *Ex) const {
231
34
  ProgramStateRef state = C.getState();
232
34
  const ExplodedNode *pred = C.getPredecessor();
233
34
  for (const Stmt *Child : Ex->children()) {
234
25
    SVal V = pred->getSVal(Child);
235
25
    if (SymbolRef sym = V.getAsSymbol())
236
21
      if (const RefVal* T = getRefBinding(state, sym)) {
237
13
        RefVal::Kind hasErr = (RefVal::Kind) 0;
238
13
        state = updateSymbol(state, sym, *T,
239
13
                             ArgEffect(MayEscape, ObjKind::ObjC), hasErr, C);
240
13
        if (hasErr) {
241
0
          processNonLeakError(state, Child->getSourceRange(), hasErr, sym, C);
242
0
          return;
243
0
        }
244
13
      }
245
25
  }
246
34
247
34
  // Return the object as autoreleased.
248
34
  //  RetEffect RE = RetEffect::MakeNotOwned(ObjKind::ObjC);
249
34
  if (SymbolRef sym =
250
34
        state->getSVal(Ex, pred->getLocationContext()).getAsSymbol()) {
251
34
    QualType ResultTy = Ex->getType();
252
34
    state = setRefBinding(state, sym,
253
34
                          RefVal::makeNotOwned(ObjKind::ObjC, ResultTy));
254
34
  }
255
34
256
34
  C.addTransition(state);
257
34
}
258
259
void RetainCountChecker::checkPostStmt(const ObjCArrayLiteral *AL,
260
29
                                       CheckerContext &C) const {
261
29
  // Apply the 'MayEscape' to all values.
262
29
  processObjCLiterals(C, AL);
263
29
}
264
265
void RetainCountChecker::checkPostStmt(const ObjCDictionaryLiteral *DL,
266
5
                                       CheckerContext &C) const {
267
5
  // Apply the 'MayEscape' to all keys and values.
268
5
  processObjCLiterals(C, DL);
269
5
}
270
271
void RetainCountChecker::checkPostStmt(const ObjCBoxedExpr *Ex,
272
25
                                       CheckerContext &C) const {
273
25
  const ExplodedNode *Pred = C.getPredecessor();
274
25
  ProgramStateRef State = Pred->getState();
275
25
276
25
  if (SymbolRef Sym = Pred->getSVal(Ex).getAsSymbol()) {
277
25
    QualType ResultTy = Ex->getType();
278
25
    State = setRefBinding(State, Sym,
279
25
                          RefVal::makeNotOwned(ObjKind::ObjC, ResultTy));
280
25
  }
281
25
282
25
  C.addTransition(State);
283
25
}
284
285
void RetainCountChecker::checkPostStmt(const ObjCIvarRefExpr *IRE,
286
478
                                       CheckerContext &C) const {
287
478
  Optional<Loc> IVarLoc = C.getSVal(IRE).getAs<Loc>();
288
478
  if (!IVarLoc)
289
0
    return;
290
478
291
478
  ProgramStateRef State = C.getState();
292
478
  SymbolRef Sym = State->getSVal(*IVarLoc).getAsSymbol();
293
478
  if (!Sym || 
!dyn_cast_or_null<ObjCIvarRegion>(Sym->getOriginRegion())425
)
294
81
    return;
295
397
296
397
  // Accessing an ivar directly is unusual. If we've done that, be more
297
397
  // forgiving about what the surrounding code is allowed to do.
298
397
299
397
  QualType Ty = Sym->getType();
300
397
  ObjKind Kind;
301
397
  if (Ty->isObjCRetainableType())
302
262
    Kind = ObjKind::ObjC;
303
135
  else if (coreFoundation::isCFObjectRef(Ty))
304
15
    Kind = ObjKind::CF;
305
120
  else
306
120
    return;
307
277
308
277
  // If the value is already known to be nil, don't bother tracking it.
309
277
  ConstraintManager &CMgr = State->getConstraintManager();
310
277
  if (CMgr.isNull(State, Sym).isConstrainedTrue())
311
16
    return;
312
261
313
261
  if (const RefVal *RV = getRefBinding(State, Sym)) {
314
129
    // If we've seen this symbol before, or we're only seeing it now because
315
129
    // of something the analyzer has synthesized, don't do anything.
316
129
    if (RV->getIvarAccessHistory() != RefVal::IvarAccessHistory::None ||
317
129
        
isSynthesizedAccessor(C.getStackFrame())27
) {
318
120
      return;
319
120
    }
320
9
321
9
    // Note that this value has been loaded from an ivar.
322
9
    C.addTransition(setRefBinding(State, Sym, RV->withIvarAccess()));
323
9
    return;
324
9
  }
325
132
326
132
  RefVal PlusZero = RefVal::makeNotOwned(Kind, Ty);
327
132
328
132
  // In a synthesized accessor, the effective retain count is +0.
329
132
  if (isSynthesizedAccessor(C.getStackFrame())) {
330
32
    C.addTransition(setRefBinding(State, Sym, PlusZero));
331
32
    return;
332
32
  }
333
100
334
100
  State = setRefBinding(State, Sym, PlusZero.withIvarAccess());
335
100
  C.addTransition(State);
336
100
}
337
338
4.27k
static bool isReceiverUnconsumedSelf(const CallEvent &Call) {
339
4.27k
  if (const auto *MC = dyn_cast<ObjCMethodCall>(&Call)) {
340
2.23k
341
2.23k
    // Check if the message is not consumed, we know it will not be used in
342
2.23k
    // an assignment, ex: "self = [super init]".
343
2.23k
    return MC->getMethodFamily() == OMF_init && 
MC->isReceiverSelfOrSuper()498
&&
344
2.23k
           !Call.getLocationContext()
345
62
                ->getAnalysisDeclContext()
346
62
                ->getParentMap()
347
62
                .isConsumedExpr(Call.getOriginExpr());
348
2.23k
  }
349
2.03k
  return false;
350
2.03k
}
351
352
const static RetainSummary *getSummary(RetainSummaryManager &Summaries,
353
                                       const CallEvent &Call,
354
4.27k
                                       QualType ReceiverType) {
355
4.27k
  const Expr *CE = Call.getOriginExpr();
356
4.27k
  AnyCall C =
357
4.27k
      CE ? 
*AnyCall::forExpr(CE)4.26k
358
4.27k
         : 
AnyCall(cast<CXXDestructorDecl>(Call.getDecl()))11
;
359
4.27k
  return Summaries.getSummary(C, Call.hasNonZeroCallbackArg(),
360
4.27k
                              isReceiverUnconsumedSelf(Call), ReceiverType);
361
4.27k
}
362
363
void RetainCountChecker::checkPostCall(const CallEvent &Call,
364
4.27k
                                       CheckerContext &C) const {
365
4.27k
  RetainSummaryManager &Summaries = getSummaryManager(C);
366
4.27k
367
4.27k
  // Leave null if no receiver.
368
4.27k
  QualType ReceiverType;
369
4.27k
  if (const auto *MC = dyn_cast<ObjCMethodCall>(&Call)) {
370
2.23k
    if (MC->isInstanceMessage()) {
371
1.66k
      SVal ReceiverV = MC->getReceiverSVal();
372
1.66k
      if (SymbolRef Sym = ReceiverV.getAsLocSymbol())
373
1.66k
        if (const RefVal *T = getRefBinding(C.getState(), Sym))
374
1.15k
          ReceiverType = T->getType();
375
1.66k
    }
376
2.23k
  }
377
4.27k
378
4.27k
  const RetainSummary *Summ = getSummary(Summaries, Call, ReceiverType);
379
4.27k
380
4.27k
  if (C.wasInlined) {
381
653
    processSummaryOfInlined(*Summ, Call, C);
382
653
    return;
383
653
  }
384
3.61k
  checkSummary(*Summ, Call, C);
385
3.61k
}
386
387
/// GetReturnType - Used to get the return type of a message expression or
388
///  function call with the intention of affixing that type to a tracked symbol.
389
///  While the return type can be queried directly from RetEx, when
390
///  invoking class methods we augment to the return type to be that of
391
///  a pointer to the class (as opposed it just being id).
392
// FIXME: We may be able to do this with related result types instead.
393
// This function is probably overestimating.
394
247
static QualType GetReturnType(const Expr *RetE, ASTContext &Ctx) {
395
247
  QualType RetTy = RetE->getType();
396
247
  // If RetE is not a message expression just return its type.
397
247
  // If RetE is a message expression, return its types if it is something
398
247
  /// more specific than id.
399
247
  if (const ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(RetE))
400
180
    if (const ObjCObjectPointerType *PT = RetTy->getAs<ObjCObjectPointerType>())
401
180
      if (PT->isObjCQualifiedIdType() || PT->isObjCIdType() ||
402
180
          
PT->isObjCClassType()102
) {
403
79
        // At this point we know the return type of the message expression is
404
79
        // id, id<...>, or Class. If we have an ObjCInterfaceDecl, we know this
405
79
        // is a call to a class method whose type we can resolve.  In such
406
79
        // cases, promote the return type to XXX* (where XXX is the class).
407
79
        const ObjCInterfaceDecl *D = ME->getReceiverInterface();
408
79
        return !D ? 
RetTy12
:
409
79
                    
Ctx.getObjCObjectPointerType(Ctx.getObjCInterfaceType(D))67
;
410
79
      }
411
168
412
168
  return RetTy;
413
168
}
414
415
static Optional<RefVal> refValFromRetEffect(RetEffect RE,
416
2.34k
                                            QualType ResultTy) {
417
2.34k
  if (RE.isOwned()) {
418
1.29k
    return RefVal::makeOwned(RE.getObjKind(), ResultTy);
419
1.29k
  } else 
if (1.05k
RE.notOwned()1.05k
) {
420
247
    return RefVal::makeNotOwned(RE.getObjKind(), ResultTy);
421
247
  }
422
806
423
806
  return None;
424
806
}
425
426
39
static bool isPointerToObject(QualType QT) {
427
39
  QualType PT = QT->getPointeeType();
428
39
  if (!PT.isNull())
429
39
    if (PT->getAsCXXRecordDecl())
430
34
      return true;
431
5
  return false;
432
5
}
433
434
/// Whether the tracked value should be escaped on a given call.
435
/// OSObjects are escaped when passed to void * / etc.
436
static bool shouldEscapeOSArgumentOnCall(const CallEvent &CE, unsigned ArgIdx,
437
624
                                       const RefVal *TrackedValue) {
438
624
  if (TrackedValue->getObjKind() != ObjKind::OS)
439
584
    return false;
440
40
  if (ArgIdx >= CE.parameters().size())
441
1
    return false;
442
39
  return !isPointerToObject(CE.parameters()[ArgIdx]->getType());
443
39
}
444
445
// We don't always get the exact modeling of the function with regards to the
446
// retain count checker even when the function is inlined. For example, we need
447
// to stop tracking the symbols which were marked with StopTrackingHard.
448
void RetainCountChecker::processSummaryOfInlined(const RetainSummary &Summ,
449
                                                 const CallEvent &CallOrMsg,
450
653
                                                 CheckerContext &C) const {
451
653
  ProgramStateRef state = C.getState();
452
653
453
653
  // Evaluate the effect of the arguments.
454
1.06k
  for (unsigned idx = 0, e = CallOrMsg.getNumArgs(); idx != e; 
++idx408
) {
455
408
    SVal V = CallOrMsg.getArgSVal(idx);
456
408
457
408
    if (SymbolRef Sym = V.getAsLocSymbol()) {
458
190
      bool ShouldRemoveBinding = Summ.getArg(idx).getKind() == StopTrackingHard;
459
190
      if (const RefVal *T = getRefBinding(state, Sym))
460
62
        if (shouldEscapeOSArgumentOnCall(CallOrMsg, idx, T))
461
1
          ShouldRemoveBinding = true;
462
190
463
190
      if (ShouldRemoveBinding)
464
7
        state = removeRefBinding(state, Sym);
465
190
    }
466
408
  }
467
653
468
653
  // Evaluate the effect on the message receiver.
469
653
  if (const auto *MsgInvocation = dyn_cast<ObjCMethodCall>(&CallOrMsg)) {
470
299
    if (SymbolRef Sym = MsgInvocation->getReceiverSVal().getAsLocSymbol()) {
471
281
      if (Summ.getReceiverEffect().getKind() == StopTrackingHard) {
472
1
        state = removeRefBinding(state, Sym);
473
1
      }
474
281
    }
475
299
  }
476
653
477
653
  // Consult the summary for the return value.
478
653
  RetEffect RE = Summ.getRetEffect();
479
653
480
653
  if (SymbolRef Sym = CallOrMsg.getReturnValue().getAsSymbol()) {
481
222
    if (RE.getKind() == RetEffect::NoRetHard)
482
2
      state = removeRefBinding(state, Sym);
483
222
  }
484
653
485
653
  C.addTransition(state);
486
653
}
487
488
2.11k
static bool isSmartPtrField(const MemRegion *MR) {
489
2.11k
  const auto *TR = dyn_cast<TypedValueRegion>(
490
2.11k
    cast<SubRegion>(MR)->getSuperRegion());
491
2.11k
  return TR && 
RetainSummaryManager::isKnownSmartPointer(TR->getValueType())78
;
492
2.11k
}
493
494
495
/// A value escapes in these possible cases:
496
///
497
/// - binding to something that is not a memory region.
498
/// - binding to a memregion that does not have stack storage
499
/// - binding to a variable that has a destructor attached using CleanupAttr
500
///
501
/// We do not currently model what happens when a symbol is
502
/// assigned to a struct field, unless it is a known smart pointer
503
/// implementation, about which we know that it is inlined.
504
/// FIXME: This could definitely be improved upon.
505
2.11k
static bool shouldEscapeRegion(const MemRegion *R) {
506
2.11k
  if (isSmartPtrField(R))
507
3
    return false;
508
2.10k
509
2.10k
  const auto *VR = dyn_cast<VarRegion>(R);
510
2.10k
511
2.10k
  if (!R->hasStackStorage() || 
!VR1.80k
)
512
392
    return true;
513
1.71k
514
1.71k
  const VarDecl *VD = VR->getDecl();
515
1.71k
  if (!VD->hasAttr<CleanupAttr>())
516
1.71k
    return false; // CleanupAttr attaches destructors, which cause escaping.
517
7
  return true;
518
7
}
519
520
static SmallVector<ProgramStateRef, 2>
521
updateOutParameters(ProgramStateRef State, const RetainSummary &Summ,
522
3.49k
                    const CallEvent &CE) {
523
3.49k
524
3.49k
  SVal L = CE.getReturnValue();
525
3.49k
526
3.49k
  // Splitting is required to support out parameters,
527
3.49k
  // as out parameters might be created only on the "success" branch.
528
3.49k
  // We want to avoid eagerly splitting unless out parameters are actually
529
3.49k
  // needed.
530
3.49k
  bool SplitNecessary = false;
531
3.49k
  for (auto &P : Summ.getArgEffects())
532
1.10k
    if (P.second.getKind() == RetainedOutParameterOnNonZero ||
533
1.10k
        
P.second.getKind() == RetainedOutParameterOnZero1.09k
)
534
15
      SplitNecessary = true;
535
3.49k
536
3.49k
  ProgramStateRef AssumeNonZeroReturn = State;
537
3.49k
  ProgramStateRef AssumeZeroReturn = State;
538
3.49k
539
3.49k
  if (SplitNecessary) {
540
13
    if (!CE.getResultType()->isScalarType()) {
541
1
      // Structures cannot be assumed. This probably deserves
542
1
      // a compiler warning for invalid annotations.
543
1
      return {State};
544
1
    }
545
12
    if (auto DL = L.getAs<DefinedOrUnknownSVal>()) {
546
12
      AssumeNonZeroReturn = AssumeNonZeroReturn->assume(*DL, true);
547
12
      AssumeZeroReturn = AssumeZeroReturn->assume(*DL, false);
548
12
    }
549
12
  }
550
3.49k
551
5.92k
  
for (unsigned idx = 0, e = CE.getNumArgs(); 3.49k
idx != e;
++idx2.43k
) {
552
2.43k
    SVal ArgVal = CE.getArgSVal(idx);
553
2.43k
    ArgEffect AE = Summ.getArg(idx);
554
2.43k
555
2.43k
    auto *ArgRegion = dyn_cast_or_null<TypedValueRegion>(ArgVal.getAsRegion());
556
2.43k
    if (!ArgRegion)
557
2.00k
      continue;
558
433
559
433
    QualType PointeeTy = ArgRegion->getValueType();
560
433
    SVal PointeeVal = State->getSVal(ArgRegion);
561
433
    SymbolRef Pointee = PointeeVal.getAsLocSymbol();
562
433
    if (!Pointee)
563
288
      continue;
564
145
565
145
    if (shouldEscapeRegion(ArgRegion))
566
91
      continue;
567
54
568
54
    auto makeNotOwnedParameter = [&](ProgramStateRef St) {
569
16
      return setRefBinding(St, Pointee,
570
16
                           RefVal::makeNotOwned(AE.getObjKind(), PointeeTy));
571
16
    };
572
54
    auto makeOwnedParameter = [&](ProgramStateRef St) {
573
25
      return setRefBinding(St, Pointee,
574
25
                           RefVal::makeOwned(ObjKind::OS, PointeeTy));
575
25
    };
576
54
577
54
    switch (AE.getKind()) {
578
8
    case UnretainedOutParameter:
579
8
      AssumeNonZeroReturn = makeNotOwnedParameter(AssumeNonZeroReturn);
580
8
      AssumeZeroReturn = makeNotOwnedParameter(AssumeZeroReturn);
581
8
      break;
582
6
    case RetainedOutParameter:
583
6
      AssumeNonZeroReturn = makeOwnedParameter(AssumeNonZeroReturn);
584
6
      AssumeZeroReturn = makeOwnedParameter(AssumeZeroReturn);
585
6
      break;
586
9
    case RetainedOutParameterOnNonZero:
587
9
      AssumeNonZeroReturn = makeOwnedParameter(AssumeNonZeroReturn);
588
9
      break;
589
4
    case RetainedOutParameterOnZero:
590
4
      AssumeZeroReturn = makeOwnedParameter(AssumeZeroReturn);
591
4
      break;
592
27
    default:
593
27
      break;
594
54
    }
595
54
  }
596
3.49k
597
3.49k
  if (SplitNecessary) {
598
12
    return {AssumeNonZeroReturn, AssumeZeroReturn};
599
3.48k
  } else {
600
3.48k
    assert(AssumeZeroReturn == AssumeNonZeroReturn);
601
3.48k
    return {AssumeZeroReturn};
602
3.48k
  }
603
3.49k
}
604
605
void RetainCountChecker::checkSummary(const RetainSummary &Summ,
606
                                      const CallEvent &CallOrMsg,
607
3.61k
                                      CheckerContext &C) const {
608
3.61k
  ProgramStateRef state = C.getState();
609
3.61k
610
3.61k
  // Evaluate the effect of the arguments.
611
3.61k
  RefVal::Kind hasErr = (RefVal::Kind) 0;
612
3.61k
  SourceRange ErrorRange;
613
3.61k
  SymbolRef ErrorSym = nullptr;
614
3.61k
615
3.61k
  // Helper tag for providing diagnostics: indicate whether dealloc was sent
616
3.61k
  // at this location.
617
3.61k
  bool DeallocSent = false;
618
3.61k
619
6.06k
  for (unsigned idx = 0, e = CallOrMsg.getNumArgs(); idx != e; 
++idx2.45k
) {
620
2.51k
    SVal V = CallOrMsg.getArgSVal(idx);
621
2.51k
622
2.51k
    ArgEffect Effect = Summ.getArg(idx);
623
2.51k
    if (SymbolRef Sym = V.getAsLocSymbol()) {
624
1.05k
      if (const RefVal *T = getRefBinding(state, Sym)) {
625
562
626
562
        if (shouldEscapeOSArgumentOnCall(CallOrMsg, idx, T))
627
4
          Effect = ArgEffect(StopTrackingHard, ObjKind::OS);
628
562
629
562
        state = updateSymbol(state, Sym, *T, Effect, hasErr, C);
630
562
        if (hasErr) {
631
60
          ErrorRange = CallOrMsg.getArgSourceRange(idx);
632
60
          ErrorSym = Sym;
633
60
          break;
634
502
        } else if (Effect.getKind() == Dealloc) {
635
0
          DeallocSent = true;
636
0
        }
637
562
      }
638
1.05k
    }
639
2.51k
  }
640
3.61k
641
3.61k
  // Evaluate the effect on the message receiver / `this` argument.
642
3.61k
  bool ReceiverIsTracked = false;
643
3.61k
  if (!hasErr) {
644
3.55k
    if (const auto *MsgInvocation = dyn_cast<ObjCMethodCall>(&CallOrMsg)) {
645
1.93k
      if (SymbolRef Sym = MsgInvocation->getReceiverSVal().getAsLocSymbol()) {
646
1.38k
        if (const RefVal *T = getRefBinding(state, Sym)) {
647
1.09k
          ReceiverIsTracked = true;
648
1.09k
          state = updateSymbol(state, Sym, *T,
649
1.09k
                               Summ.getReceiverEffect(), hasErr, C);
650
1.09k
          if (hasErr) {
651
57
            ErrorRange = MsgInvocation->getOriginExpr()->getReceiverRange();
652
57
            ErrorSym = Sym;
653
1.04k
          } else if (Summ.getReceiverEffect().getKind() == Dealloc) {
654
8
            DeallocSent = true;
655
8
          }
656
1.09k
        }
657
1.38k
      }
658
1.93k
    } else 
if (const auto *1.62k
MCall1.62k
= dyn_cast<CXXMemberCall>(&CallOrMsg)) {
659
107
      if (SymbolRef Sym = MCall->getCXXThisVal().getAsLocSymbol()) {
660
105
        if (const RefVal *T = getRefBinding(state, Sym)) {
661
83
          state = updateSymbol(state, Sym, *T, Summ.getThisEffect(),
662
83
                               hasErr, C);
663
83
          if (hasErr) {
664
7
            ErrorRange = MCall->getOriginExpr()->getSourceRange();
665
7
            ErrorSym = Sym;
666
7
          }
667
83
        }
668
105
      }
669
107
    }
670
3.55k
  }
671
3.61k
672
3.61k
  // Process any errors.
673
3.61k
  if (hasErr) {
674
124
    processNonLeakError(state, ErrorRange, hasErr, ErrorSym, C);
675
124
    return;
676
124
  }
677
3.49k
678
3.49k
  // Consult the summary for the return value.
679
3.49k
  RetEffect RE = Summ.getRetEffect();
680
3.49k
681
3.49k
  if (RE.getKind() == RetEffect::OwnedWhenTrackedReceiver) {
682
428
    if (ReceiverIsTracked)
683
384
      RE = getSummaryManager(C).getObjAllocRetEffect();
684
44
    else
685
44
      RE = RetEffect::MakeNoRet();
686
428
  }
687
3.49k
688
3.49k
  if (SymbolRef Sym = CallOrMsg.getReturnValue().getAsSymbol()) {
689
2.34k
    QualType ResultTy = CallOrMsg.getResultType();
690
2.34k
    if (RE.notOwned()) {
691
247
      const Expr *Ex = CallOrMsg.getOriginExpr();
692
247
      assert(Ex);
693
247
      ResultTy = GetReturnType(Ex, C.getASTContext());
694
247
    }
695
2.34k
    if (Optional<RefVal> updatedRefVal = refValFromRetEffect(RE, ResultTy))
696
1.53k
      state = setRefBinding(state, Sym, *updatedRefVal);
697
2.34k
  }
698
3.49k
699
3.49k
  SmallVector<ProgramStateRef, 2> Out =
700
3.49k
      updateOutParameters(state, Summ, CallOrMsg);
701
3.49k
702
3.50k
  for (ProgramStateRef St : Out) {
703
3.50k
    if (DeallocSent) {
704
8
      C.addTransition(St, C.getPredecessor(), &DeallocSentTag);
705
3.49k
    } else {
706
3.49k
      C.addTransition(St);
707
3.49k
    }
708
3.50k
  }
709
3.49k
}
710
711
ProgramStateRef RetainCountChecker::updateSymbol(ProgramStateRef state,
712
                                                 SymbolRef sym, RefVal V,
713
                                                 ArgEffect AE,
714
                                                 RefVal::Kind &hasErr,
715
1.76k
                                                 CheckerContext &C) const {
716
1.76k
  bool IgnoreRetainMsg = (bool)C.getASTContext().getLangOpts().ObjCAutoRefCount;
717
1.76k
  if (AE.getObjKind() == ObjKind::ObjC && 
IgnoreRetainMsg1.11k
) {
718
27
    switch (AE.getKind()) {
719
14
    default:
720
14
      break;
721
0
    case IncRef:
722
0
      AE = AE.withKind(DoNothing);
723
0
      break;
724
13
    case DecRef:
725
13
      AE = AE.withKind(DoNothing);
726
13
      break;
727
0
    case DecRefAndStopTrackingHard:
728
0
      AE = AE.withKind(StopTracking);
729
0
      break;
730
1.76k
    }
731
1.76k
  }
732
1.76k
733
1.76k
  // Handle all use-after-releases.
734
1.76k
  if (V.getKind() == RefVal::Released) {
735
72
    V = V ^ RefVal::ErrorUseAfterRelease;
736
72
    hasErr = V.getKind();
737
72
    return setRefBinding(state, sym, V);
738
72
  }
739
1.69k
740
1.69k
  switch (AE.getKind()) {
741
0
    case UnretainedOutParameter:
742
0
    case RetainedOutParameter:
743
0
    case RetainedOutParameterOnZero:
744
0
    case RetainedOutParameterOnNonZero:
745
0
      llvm_unreachable("Applies to pointer-to-pointer parameters, which should "
746
0
                       "not have ref state.");
747
0
748
11
    case Dealloc: // NB. we only need to add a note in a non-error case.
749
11
      switch (V.getKind()) {
750
0
        default:
751
0
          llvm_unreachable("Invalid RefVal state for an explicit dealloc.");
752
10
        case RefVal::Owned:
753
10
          // The object immediately transitions to the released state.
754
10
          V = V ^ RefVal::Released;
755
10
          V.clearCounts();
756
10
          return setRefBinding(state, sym, V);
757
1
        case RefVal::NotOwned:
758
1
          V = V ^ RefVal::ErrorDeallocNotOwned;
759
1
          hasErr = V.getKind();
760
1
          break;
761
1
      }
762
1
      break;
763
1
764
151
    case MayEscape:
765
151
      if (V.getKind() == RefVal::Owned) {
766
83
        V = V ^ RefVal::NotOwned;
767
83
        break;
768
83
      }
769
68
770
68
      LLVM_FALLTHROUGH;
771
68
772
282
    case DoNothing:
773
282
      return state;
774
68
775
159
    case Autorelease:
776
159
      // Update the autorelease counts.
777
159
      V = V.autorelease();
778
159
      break;
779
68
780
68
    case StopTracking:
781
52
    case StopTrackingHard:
782
52
      return removeRefBinding(state, sym);
783
52
784
226
    case IncRef:
785
226
      switch (V.getKind()) {
786
0
        default:
787
0
          llvm_unreachable("Invalid RefVal state for a retain.");
788
226
        case RefVal::Owned:
789
226
        case RefVal::NotOwned:
790
226
          V = V + 1;
791
226
          break;
792
226
      }
793
226
      break;
794
226
795
877
    case DecRef:
796
877
    case DecRefBridgedTransferred:
797
877
    case DecRefAndStopTrackingHard:
798
877
      switch (V.getKind()) {
799
0
        default:
800
0
          // case 'RefVal::Released' handled above.
801
0
          llvm_unreachable("Invalid RefVal state for a release.");
802
0
803
664
        case RefVal::Owned:
804
664
          assert(V.getCount() > 0);
805
664
          if (V.getCount() == 1) {
806
624
            if (AE.getKind() == DecRefBridgedTransferred ||
807
624
                V.getIvarAccessHistory() ==
808
620
                  RefVal::IvarAccessHistory::AccessedDirectly)
809
4
              V = V ^ RefVal::NotOwned;
810
620
            else
811
620
              V = V ^ RefVal::Released;
812
624
          } else 
if (40
AE.getKind() == DecRefAndStopTrackingHard40
) {
813
0
            return removeRefBinding(state, sym);
814
0
          }
815
664
816
664
          V = V - 1;
817
664
          break;
818
664
819
664
        case RefVal::NotOwned:
820
213
          if (V.getCount() > 0) {
821
124
            if (AE.getKind() == DecRefAndStopTrackingHard)
822
6
              return removeRefBinding(state, sym);
823
118
            V = V - 1;
824
118
          } else 
if (89
V.getIvarAccessHistory() ==
825
89
                       RefVal::IvarAccessHistory::AccessedDirectly) {
826
38
            // Assume that the instance variable was holding on the object at
827
38
            // +1, and we just didn't know.
828
38
            if (AE.getKind() == DecRefAndStopTrackingHard)
829
0
              return removeRefBinding(state, sym);
830
38
            V = V.releaseViaIvar() ^ RefVal::Released;
831
51
          } else {
832
51
            V = V ^ RefVal::ErrorReleaseNotOwned;
833
51
            hasErr = V.getKind();
834
51
          }
835
213
          
break207
;
836
871
      }
837
871
      break;
838
1.34k
  }
839
1.34k
  return setRefBinding(state, sym, V);
840
1.34k
}
841
842
const RefCountBug &
843
RetainCountChecker::errorKindToBugKind(RefVal::Kind ErrorKind,
844
112
                                       SymbolRef Sym) const {
845
112
  switch (ErrorKind) {
846
60
    case RefVal::ErrorUseAfterRelease:
847
60
      return useAfterRelease;
848
51
    case RefVal::ErrorReleaseNotOwned:
849
51
      return releaseNotOwned;
850
1
    case RefVal::ErrorDeallocNotOwned:
851
1
      if (Sym->getType()->getPointeeCXXRecordDecl())
852
1
        return freeNotOwned;
853
0
      return deallocNotOwned;
854
0
    default:
855
0
      llvm_unreachable("Unhandled error.");
856
112
  }
857
112
}
858
859
void RetainCountChecker::processNonLeakError(ProgramStateRef St,
860
                                             SourceRange ErrorRange,
861
                                             RefVal::Kind ErrorKind,
862
                                             SymbolRef Sym,
863
124
                                             CheckerContext &C) const {
864
124
  // HACK: Ignore retain-count issues on values accessed through ivars,
865
124
  // because of cases like this:
866
124
  //   [_contentView retain];
867
124
  //   [_contentView removeFromSuperview];
868
124
  //   [self addSubview:_contentView]; // invalidates 'self'
869
124
  //   [_contentView release];
870
124
  if (const RefVal *RV = getRefBinding(St, Sym))
871
124
    if (RV->getIvarAccessHistory() != RefVal::IvarAccessHistory::None)
872
12
      return;
873
112
874
112
  ExplodedNode *N = C.generateErrorNode(St);
875
112
  if (!N)
876
0
    return;
877
112
878
112
  auto report = std::make_unique<RefCountReport>(
879
112
      errorKindToBugKind(ErrorKind, Sym),
880
112
      C.getASTContext().getLangOpts(), N, Sym);
881
112
  report->addRange(ErrorRange);
882
112
  C.emitReport(std::move(report));
883
112
}
884
885
//===----------------------------------------------------------------------===//
886
// Handle the return values of retain-count-related functions.
887
//===----------------------------------------------------------------------===//
888
889
bool RetainCountChecker::evalCall(const CallEvent &Call,
890
1.86k
                                  CheckerContext &C) const {
891
1.86k
  ProgramStateRef state = C.getState();
892
1.86k
  const auto *FD = dyn_cast_or_null<FunctionDecl>(Call.getDecl());
893
1.86k
  if (!FD)
894
37
    return false;
895
1.83k
896
1.83k
  const auto *CE = dyn_cast_or_null<CallExpr>(Call.getOriginExpr());
897
1.83k
  if (!CE)
898
0
    return false;
899
1.83k
900
1.83k
  RetainSummaryManager &SmrMgr = getSummaryManager(C);
901
1.83k
  QualType ResultTy = Call.getResultType();
902
1.83k
903
1.83k
  // See if the function has 'rc_ownership_trusted_implementation'
904
1.83k
  // annotate attribute. If it does, we will not inline it.
905
1.83k
  bool hasTrustedImplementationAnnotation = false;
906
1.83k
907
1.83k
  const LocationContext *LCtx = C.getLocationContext();
908
1.83k
909
1.83k
  using BehaviorSummary = RetainSummaryManager::BehaviorSummary;
910
1.83k
  Optional<BehaviorSummary> BSmr =
911
1.83k
      SmrMgr.canEval(CE, FD, hasTrustedImplementationAnnotation);
912
1.83k
913
1.83k
  // See if it's one of the specific functions we know how to eval.
914
1.83k
  if (!BSmr)
915
1.61k
    return false;
916
214
917
214
  // Bind the return value.
918
214
  if (BSmr == BehaviorSummary::Identity ||
919
214
      
BSmr == BehaviorSummary::IdentityOrZero65
||
920
214
      
BSmr == BehaviorSummary::IdentityThis58
) {
921
157
922
157
    const Expr *BindReturnTo =
923
157
        (BSmr == BehaviorSummary::IdentityThis)
924
157
            ? 
cast<CXXMemberCallExpr>(CE)->getImplicitObjectArgument()1
925
157
            : 
CE->getArg(0)156
;
926
157
    SVal RetVal = state->getSVal(BindReturnTo, LCtx);
927
157
928
157
    // If the receiver is unknown or the function has
929
157
    // 'rc_ownership_trusted_implementation' annotate attribute, conjure a
930
157
    // return value.
931
157
    // FIXME: this branch is very strange.
932
157
    if (RetVal.isUnknown() ||
933
157
        (hasTrustedImplementationAnnotation && 
!ResultTy.isNull()10
)) {
934
10
      SValBuilder &SVB = C.getSValBuilder();
935
10
      RetVal =
936
10
          SVB.conjureSymbolVal(nullptr, CE, LCtx, ResultTy, C.blockCount());
937
10
    }
938
157
939
157
    // Bind the value.
940
157
    state = state->BindExpr(CE, LCtx, RetVal, /*Invalidate=*/false);
941
157
942
157
    if (BSmr == BehaviorSummary::IdentityOrZero) {
943
7
      // Add a branch where the output is zero.
944
7
      ProgramStateRef NullOutputState = C.getState();
945
7
946
7
      // Assume that output is zero on the other branch.
947
7
      NullOutputState = NullOutputState->BindExpr(
948
7
          CE, LCtx, C.getSValBuilder().makeNull(), /*Invalidate=*/false);
949
7
      C.addTransition(NullOutputState, &CastFailTag);
950
7
951
7
      // And on the original branch assume that both input and
952
7
      // output are non-zero.
953
7
      if (auto L = RetVal.getAs<DefinedOrUnknownSVal>())
954
7
        state = state->assume(*L, /*assumption=*/true);
955
7
956
7
    }
957
157
  }
958
214
959
214
  C.addTransition(state);
960
214
  return true;
961
214
}
962
963
ExplodedNode * RetainCountChecker::processReturn(const ReturnStmt *S,
964
2.03k
                                                 CheckerContext &C) const {
965
2.03k
  ExplodedNode *Pred = C.getPredecessor();
966
2.03k
967
2.03k
  // Only adjust the reference count if this is the top-level call frame,
968
2.03k
  // and not the result of inlining.  In the future, we should do
969
2.03k
  // better checking even for inlined calls, and see if they match
970
2.03k
  // with their expected semantics (e.g., the method should return a retained
971
2.03k
  // object, etc.).
972
2.03k
  if (!C.inTopFrame())
973
653
    return Pred;
974
1.38k
975
1.38k
  if (!S)
976
847
    return Pred;
977
537
978
537
  const Expr *RetE = S->getRetValue();
979
537
  if (!RetE)
980
56
    return Pred;
981
481
982
481
  ProgramStateRef state = C.getState();
983
481
  // We need to dig down to the symbolic base here because various
984
481
  // custom allocators do sometimes return the symbol with an offset.
985
481
  SymbolRef Sym = state->getSValAsScalarOrLoc(RetE, C.getLocationContext())
986
481
                      .getAsLocSymbol(/*IncludeBaseRegions=*/true);
987
481
  if (!Sym)
988
156
    return Pred;
989
325
990
325
  // Get the reference count binding (if any).
991
325
  const RefVal *T = getRefBinding(state, Sym);
992
325
  if (!T)
993
79
    return Pred;
994
246
995
246
  // Change the reference count.
996
246
  RefVal X = *T;
997
246
998
246
  switch (X.getKind()) {
999
192
    case RefVal::Owned: {
1000
192
      unsigned cnt = X.getCount();
1001
192
      assert(cnt > 0);
1002
192
      X.setCount(cnt - 1);
1003
192
      X = X ^ RefVal::ReturnedOwned;
1004
192
      break;
1005
0
    }
1006
0
1007
51
    case RefVal::NotOwned: {
1008
51
      unsigned cnt = X.getCount();
1009
51
      if (cnt) {
1010
7
        X.setCount(cnt - 1);
1011
7
        X = X ^ RefVal::ReturnedOwned;
1012
44
      } else {
1013
44
        X = X ^ RefVal::ReturnedNotOwned;
1014
44
      }
1015
51
      break;
1016
0
    }
1017
0
1018
3
    default:
1019
3
      return Pred;
1020
243
  }
1021
243
1022
243
  // Update the binding.
1023
243
  state = setRefBinding(state, Sym, X);
1024
243
  Pred = C.addTransition(state);
1025
243
1026
243
  // At this point we have updated the state properly.
1027
243
  // Everything after this is merely checking to see if the return value has
1028
243
  // been over- or under-retained.
1029
243
1030
243
  // Did we cache out?
1031
243
  if (!Pred)
1032
0
    return nullptr;
1033
243
1034
243
  // Update the autorelease counts.
1035
243
  static CheckerProgramPointTag AutoreleaseTag(this, "Autorelease");
1036
243
  state = handleAutoreleaseCounts(state, Pred, &AutoreleaseTag, C, Sym, X, S);
1037
243
1038
243
  // Have we generated a sink node?
1039
243
  if (!state)
1040
12
    return nullptr;
1041
231
1042
231
  // Get the updated binding.
1043
231
  T = getRefBinding(state, Sym);
1044
231
  assert(T);
1045
231
  X = *T;
1046
231
1047
231
  // Consult the summary of the enclosing method.
1048
231
  RetainSummaryManager &Summaries = getSummaryManager(C);
1049
231
  const Decl *CD = &Pred->getCodeDecl();
1050
231
  RetEffect RE = RetEffect::MakeNoRet();
1051
231
1052
231
  // FIXME: What is the convention for blocks? Is there one?
1053
231
  if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(CD)) {
1054
131
    const RetainSummary *Summ = Summaries.getSummary(AnyCall(MD));
1055
131
    RE = Summ->getRetEffect();
1056
131
  } else 
if (const FunctionDecl *100
FD100
= dyn_cast<FunctionDecl>(CD)) {
1057
100
    if (!isa<CXXMethodDecl>(FD)) {
1058
99
      const RetainSummary *Summ = Summaries.getSummary(AnyCall(FD));
1059
99
      RE = Summ->getRetEffect();
1060
99
    }
1061
100
  }
1062
231
1063
231
  return checkReturnWithRetEffect(S, C, Pred, RE, X, Sym, state);
1064
231
}
1065
1066
ExplodedNode * RetainCountChecker::checkReturnWithRetEffect(const ReturnStmt *S,
1067
                                                  CheckerContext &C,
1068
                                                  ExplodedNode *Pred,
1069
                                                  RetEffect RE, RefVal X,
1070
                                                  SymbolRef Sym,
1071
231
                                                  ProgramStateRef state) const {
1072
231
  // HACK: Ignore retain-count issues on values accessed through ivars,
1073
231
  // because of cases like this:
1074
231
  //   [_contentView retain];
1075
231
  //   [_contentView removeFromSuperview];
1076
231
  //   [self addSubview:_contentView]; // invalidates 'self'
1077
231
  //   [_contentView release];
1078
231
  if (X.getIvarAccessHistory() != RefVal::IvarAccessHistory::None)
1079
14
    return Pred;
1080
217
1081
217
  // Any leaks or other errors?
1082
217
  if (X.isReturnedOwned() && 
X.getCount() == 0150
) {
1083
140
    if (RE.getKind() != RetEffect::NoRet) {
1084
125
      if (!RE.isOwned()) {
1085
53
1086
53
        // The returning type is a CF, we expect the enclosing method should
1087
53
        // return ownership.
1088
53
        X = X ^ RefVal::ErrorLeakReturned;
1089
53
1090
53
        // Generate an error node.
1091
53
        state = setRefBinding(state, Sym, X);
1092
53
1093
53
        static CheckerProgramPointTag ReturnOwnLeakTag(this, "ReturnsOwnLeak");
1094
53
        ExplodedNode *N = C.addTransition(state, Pred, &ReturnOwnLeakTag);
1095
53
        if (N) {
1096
53
          const LangOptions &LOpts = C.getASTContext().getLangOpts();
1097
53
          auto R =
1098
53
              std::make_unique<RefLeakReport>(leakAtReturn, LOpts, N, Sym, C);
1099
53
          C.emitReport(std::move(R));
1100
53
        }
1101
53
        return N;
1102
53
      }
1103
77
    }
1104
77
  } else if (X.isReturnedNotOwned()) {
1105
67
    if (RE.isOwned()) {
1106
25
      if (X.getIvarAccessHistory() ==
1107
25
            RefVal::IvarAccessHistory::AccessedDirectly) {
1108
0
        // Assume the method was trying to transfer a +1 reference from a
1109
0
        // strong ivar to the caller.
1110
0
        state = setRefBinding(state, Sym,
1111
0
                              X.releaseViaIvar() ^ RefVal::ReturnedOwned);
1112
25
      } else {
1113
25
        // Trying to return a not owned object to a caller expecting an
1114
25
        // owned object.
1115
25
        state = setRefBinding(state, Sym, X ^ RefVal::ErrorReturnedNotOwned);
1116
25
1117
25
        static CheckerProgramPointTag
1118
25
            ReturnNotOwnedTag(this, "ReturnNotOwnedForOwned");
1119
25
1120
25
        ExplodedNode *N = C.addTransition(state, Pred, &ReturnNotOwnedTag);
1121
25
        if (N) {
1122
25
          auto R = std::make_unique<RefCountReport>(
1123
25
              returnNotOwnedForOwned, C.getASTContext().getLangOpts(), N, Sym);
1124
25
          C.emitReport(std::move(R));
1125
25
        }
1126
25
        return N;
1127
25
      }
1128
139
    }
1129
67
  }
1130
139
  return Pred;
1131
139
}
1132
1133
//===----------------------------------------------------------------------===//
1134
// Check various ways a symbol can be invalidated.
1135
//===----------------------------------------------------------------------===//
1136
1137
void RetainCountChecker::checkBind(SVal loc, SVal val, const Stmt *S,
1138
1.96k
                                   CheckerContext &C) const {
1139
1.96k
  ProgramStateRef state = C.getState();
1140
1.96k
  const MemRegion *MR = loc.getAsRegion();
1141
1.96k
1142
1.96k
  // Find all symbols referenced by 'val' that we are tracking
1143
1.96k
  // and stop tracking them.
1144
1.96k
  if (MR && shouldEscapeRegion(MR)) {
1145
308
    state = state->scanReachableSymbols<StopTrackingCallback>(val).getState();
1146
308
    C.addTransition(state);
1147
308
  }
1148
1.96k
}
1149
1150
ProgramStateRef RetainCountChecker::evalAssume(ProgramStateRef state,
1151
                                               SVal Cond,
1152
13.1k
                                               bool Assumption) const {
1153
13.1k
  // FIXME: We may add to the interface of evalAssume the list of symbols
1154
13.1k
  //  whose assumptions have changed.  For now we just iterate through the
1155
13.1k
  //  bindings and check if any of the tracked symbols are NULL.  This isn't
1156
13.1k
  //  too bad since the number of symbols we will track in practice are
1157
13.1k
  //  probably small and evalAssume is only called at branches and a few
1158
13.1k
  //  other places.
1159
13.1k
  RefBindingsTy B = state->get<RefBindings>();
1160
13.1k
1161
13.1k
  if (B.isEmpty())
1162
6.11k
    return state;
1163
7.04k
1164
7.04k
  bool changed = false;
1165
7.04k
  RefBindingsTy::Factory &RefBFactory = state->get_context<RefBindings>();
1166
7.04k
  ConstraintManager &CMgr = state->getConstraintManager();
1167
7.04k
1168
8.83k
  for (auto &I : B) {
1169
8.83k
    // Check if the symbol is null stop tracking the symbol.
1170
8.83k
    ConditionTruthVal AllocFailed = CMgr.isNull(state, I.first);
1171
8.83k
    if (AllocFailed.isConstrainedTrue()) {
1172
1.08k
      changed = true;
1173
1.08k
      B = RefBFactory.remove(B, I.first);
1174
1.08k
    }
1175
8.83k
  }
1176
7.04k
1177
7.04k
  if (changed)
1178
1.08k
    state = state->set<RefBindings>(B);
1179
7.04k
1180
7.04k
  return state;
1181
7.04k
}
1182
1183
ProgramStateRef RetainCountChecker::checkRegionChanges(
1184
    ProgramStateRef state, const InvalidatedSymbols *invalidated,
1185
    ArrayRef<const MemRegion *> ExplicitRegions,
1186
    ArrayRef<const MemRegion *> Regions, const LocationContext *LCtx,
1187
5.63k
    const CallEvent *Call) const {
1188
5.63k
  if (!invalidated)
1189
2.42k
    return state;
1190
3.20k
1191
3.20k
  llvm::SmallPtrSet<SymbolRef, 8> WhitelistedSymbols;
1192
3.20k
1193
3.20k
  for (const MemRegion *I : ExplicitRegions)
1194
2.68k
    if (const SymbolicRegion *SR = I->StripCasts()->getAs<SymbolicRegion>())
1195
2.28k
      WhitelistedSymbols.insert(SR->getSymbol());
1196
3.20k
1197
6.94k
  for (SymbolRef sym : *invalidated) {
1198
6.94k
    if (WhitelistedSymbols.count(sym))
1199
2.28k
      continue;
1200
4.65k
    // Remove any existing reference-count binding.
1201
4.65k
    state = removeRefBinding(state, sym);
1202
4.65k
  }
1203
3.20k
  return state;
1204
3.20k
}
1205
1206
ProgramStateRef
1207
RetainCountChecker::handleAutoreleaseCounts(ProgramStateRef state,
1208
                                            ExplodedNode *Pred,
1209
                                            const ProgramPointTag *Tag,
1210
                                            CheckerContext &Ctx,
1211
                                            SymbolRef Sym,
1212
                                            RefVal V,
1213
2.15k
                                            const ReturnStmt *S) const {
1214
2.15k
  unsigned ACnt = V.getAutoreleaseCount();
1215
2.15k
1216
2.15k
  // No autorelease counts?  Nothing to be done.
1217
2.15k
  if (!ACnt)
1218
1.98k
    return state;
1219
166
1220
166
  unsigned Cnt = V.getCount();
1221
166
1222
166
  // FIXME: Handle sending 'autorelease' to already released object.
1223
166
1224
166
  if (V.getKind() == RefVal::ReturnedOwned)
1225
86
    ++Cnt;
1226
166
1227
166
  // If we would over-release here, but we know the value came from an ivar,
1228
166
  // assume it was a strong ivar that's just been relinquished.
1229
166
  if (ACnt > Cnt &&
1230
166
      
V.getIvarAccessHistory() == RefVal::IvarAccessHistory::AccessedDirectly42
) {
1231
10
    V = V.releaseViaIvar();
1232
10
    --ACnt;
1233
10
  }
1234
166
1235
166
  if (ACnt <= Cnt) {
1236
128
    if (ACnt == Cnt) {
1237
108
      V.clearCounts();
1238
108
      if (V.getKind() == RefVal::ReturnedOwned) {
1239
75
        V = V ^ RefVal::ReturnedNotOwned;
1240
75
      } else {
1241
33
        V = V ^ RefVal::NotOwned;
1242
33
      }
1243
108
    } else {
1244
20
      V.setCount(V.getCount() - ACnt);
1245
20
      V.setAutoreleaseCount(0);
1246
20
    }
1247
128
    return setRefBinding(state, Sym, V);
1248
128
  }
1249
38
1250
38
  // HACK: Ignore retain-count issues on values accessed through ivars,
1251
38
  // because of cases like this:
1252
38
  //   [_contentView retain];
1253
38
  //   [_contentView removeFromSuperview];
1254
38
  //   [self addSubview:_contentView]; // invalidates 'self'
1255
38
  //   [_contentView release];
1256
38
  if (V.getIvarAccessHistory() != RefVal::IvarAccessHistory::None)
1257
6
    return state;
1258
32
1259
32
  // Woah!  More autorelease counts then retain counts left.
1260
32
  // Emit hard error.
1261
32
  V = V ^ RefVal::ErrorOverAutorelease;
1262
32
  state = setRefBinding(state, Sym, V);
1263
32
1264
32
  ExplodedNode *N = Ctx.generateSink(state, Pred, Tag);
1265
32
  if (N) {
1266
32
    SmallString<128> sbuf;
1267
32
    llvm::raw_svector_ostream os(sbuf);
1268
32
    os << "Object was autoreleased ";
1269
32
    if (V.getAutoreleaseCount() > 1)
1270
17
      os << V.getAutoreleaseCount() << " times but the object ";
1271
15
    else
1272
15
      os << "but ";
1273
32
    os << "has a +" << V.getCount() << " retain count";
1274
32
1275
32
    const LangOptions &LOpts = Ctx.getASTContext().getLangOpts();
1276
32
    auto R = std::make_unique<RefCountReport>(overAutorelease, LOpts, N, Sym,
1277
32
                                               os.str());
1278
32
    Ctx.emitReport(std::move(R));
1279
32
  }
1280
32
1281
32
  return nullptr;
1282
32
}
1283
1284
ProgramStateRef
1285
RetainCountChecker::handleSymbolDeath(ProgramStateRef state,
1286
                                      SymbolRef sid, RefVal V,
1287
1.58k
                                    SmallVectorImpl<SymbolRef> &Leaked) const {
1288
1.58k
  bool hasLeak;
1289
1.58k
1290
1.58k
  // HACK: Ignore retain-count issues on values accessed through ivars,
1291
1.58k
  // because of cases like this:
1292
1.58k
  //   [_contentView retain];
1293
1.58k
  //   [_contentView removeFromSuperview];
1294
1.58k
  //   [self addSubview:_contentView]; // invalidates 'self'
1295
1.58k
  //   [_contentView release];
1296
1.58k
  if (V.getIvarAccessHistory() != RefVal::IvarAccessHistory::None)
1297
112
    hasLeak = false;
1298
1.47k
  else if (V.isOwned())
1299
291
    hasLeak = true;
1300
1.18k
  else if (V.isNotOwned() || 
V.isReturnedOwned()799
)
1301
482
    hasLeak = (V.getCount() > 0);
1302
702
  else
1303
702
    hasLeak = false;
1304
1.58k
1305
1.58k
  if (!hasLeak)
1306
1.22k
    return removeRefBinding(state, sid);
1307
367
1308
367
  Leaked.push_back(sid);
1309
367
  return setRefBinding(state, sid, V ^ RefVal::ErrorLeak);
1310
367
}
1311
1312
ExplodedNode *
1313
RetainCountChecker::processLeaks(ProgramStateRef state,
1314
                                 SmallVectorImpl<SymbolRef> &Leaked,
1315
                                 CheckerContext &Ctx,
1316
1.71k
                                 ExplodedNode *Pred) const {
1317
1.71k
  // Generate an intermediate node representing the leak point.
1318
1.71k
  ExplodedNode *N = Ctx.addTransition(state, Pred);
1319
1.71k
  const LangOptions &LOpts = Ctx.getASTContext().getLangOpts();
1320
1.71k
1321
1.71k
  if (N) {
1322
1.71k
    for (SymbolRef L : Leaked) {
1323
367
      const RefCountBug &BT = Pred ? leakWithinFunction : 
leakAtReturn0
;
1324
367
      Ctx.emitReport(std::make_unique<RefLeakReport>(BT, LOpts, N, L, Ctx));
1325
367
    }
1326
1.71k
  }
1327
1.71k
1328
1.71k
  return N;
1329
1.71k
}
1330
1331
2.01k
void RetainCountChecker::checkBeginFunction(CheckerContext &Ctx) const {
1332
2.01k
  if (!Ctx.inTopFrame())
1333
595
    return;
1334
1.41k
1335
1.41k
  RetainSummaryManager &SmrMgr = getSummaryManager(Ctx);
1336
1.41k
  const LocationContext *LCtx = Ctx.getLocationContext();
1337
1.41k
  const Decl *D = LCtx->getDecl();
1338
1.41k
  Optional<AnyCall> C = AnyCall::forDecl(D);
1339
1.41k
1340
1.41k
  if (!C || 
SmrMgr.isTrustedReferenceCountImplementation(D)1.37k
)
1341
38
    return;
1342
1.37k
1343
1.37k
  ProgramStateRef state = Ctx.getState();
1344
1.37k
  const RetainSummary *FunctionSummary = SmrMgr.getSummary(*C);
1345
1.37k
  ArgEffects CalleeSideArgEffects = FunctionSummary->getArgEffects();
1346
1.37k
1347
2.18k
  for (unsigned idx = 0, e = C->param_size(); idx != e; 
++idx808
) {
1348
808
    const ParmVarDecl *Param = C->parameters()[idx];
1349
808
    SymbolRef Sym = state->getSVal(state->getRegion(Param, LCtx)).getAsSymbol();
1350
808
1351
808
    QualType Ty = Param->getType();
1352
808
    const ArgEffect *AE = CalleeSideArgEffects.lookup(idx);
1353
808
    if (AE) {
1354
325
      ObjKind K = AE->getObjKind();
1355
325
      if (K == ObjKind::Generalized || 
K == ObjKind::OS311
||
1356
325
          
(287
TrackNSCFStartParam287
&&
(43
K == ObjKind::ObjC43
||
K == ObjKind::CF27
))) {
1357
81
        RefVal NewVal = AE->getKind() == DecRef ? 
RefVal::makeOwned(K, Ty)15
1358
81
                                                : 
RefVal::makeNotOwned(K, Ty)66
;
1359
81
        state = setRefBinding(state, Sym, NewVal);
1360
81
      }
1361
325
    }
1362
808
  }
1363
1.37k
1364
1.37k
  Ctx.addTransition(state);
1365
1.37k
}
1366
1367
void RetainCountChecker::checkEndFunction(const ReturnStmt *RS,
1368
2.03k
                                          CheckerContext &Ctx) const {
1369
2.03k
  ExplodedNode *Pred = processReturn(RS, Ctx);
1370
2.03k
1371
2.03k
  // Created state cached out.
1372
2.03k
  if (!Pred) {
1373
12
    return;
1374
12
  }
1375
2.02k
1376
2.02k
  ProgramStateRef state = Pred->getState();
1377
2.02k
  RefBindingsTy B = state->get<RefBindings>();
1378
2.02k
1379
2.02k
  // Don't process anything within synthesized bodies.
1380
2.02k
  const LocationContext *LCtx = Pred->getLocationContext();
1381
2.02k
  if (LCtx->getAnalysisDeclContext()->isBodyAutosynthesized()) {
1382
246
    assert(!LCtx->inTopFrame());
1383
246
    return;
1384
246
  }
1385
1.77k
1386
1.77k
  for (auto &I : B) {
1387
543
    state = handleAutoreleaseCounts(state, Pred, /*Tag=*/nullptr, Ctx,
1388
543
                                    I.first, I.second);
1389
543
    if (!state)
1390
0
      return;
1391
543
  }
1392
1.77k
1393
1.77k
  // If the current LocationContext has a parent, don't check for leaks.
1394
1.77k
  // We will do that later.
1395
1.77k
  // FIXME: we should instead check for imbalances of the retain/releases,
1396
1.77k
  // and suggest annotations.
1397
1.77k
  if (LCtx->getParent())
1398
407
    return;
1399
1.37k
1400
1.37k
  B = state->get<RefBindings>();
1401
1.37k
  SmallVector<SymbolRef, 10> Leaked;
1402
1.37k
1403
1.37k
  for (auto &I : B)
1404
243
    state = handleSymbolDeath(state, I.first, I.second, Leaked);
1405
1.37k
1406
1.37k
  processLeaks(state, Leaked, Ctx, Pred);
1407
1.37k
}
1408
1409
void RetainCountChecker::checkDeadSymbols(SymbolReaper &SymReaper,
1410
12.4k
                                          CheckerContext &C) const {
1411
12.4k
  ExplodedNode *Pred = C.getPredecessor();
1412
12.4k
1413
12.4k
  ProgramStateRef state = C.getState();
1414
12.4k
  SmallVector<SymbolRef, 10> Leaked;
1415
12.4k
1416
12.4k
  // Update counts from autorelease pools
1417
12.4k
  for (const auto &I: state->get<RefBindings>()) {
1418
7.50k
    SymbolRef Sym = I.first;
1419
7.50k
    if (SymReaper.isDead(Sym)) {
1420
1.36k
      static CheckerProgramPointTag Tag(this, "DeadSymbolAutorelease");
1421
1.36k
      const RefVal &V = I.second;
1422
1.36k
      state = handleAutoreleaseCounts(state, Pred, &Tag, C, Sym, V);
1423
1.36k
      if (!state)
1424
20
        return;
1425
1.34k
1426
1.34k
      // Fetch the new reference count from the state, and use it to handle
1427
1.34k
      // this symbol.
1428
1.34k
      state = handleSymbolDeath(state, Sym, *getRefBinding(state, Sym), Leaked);
1429
1.34k
    }
1430
7.50k
  }
1431
12.4k
1432
12.4k
  
if (12.4k
Leaked.empty()12.4k
) {
1433
12.0k
    C.addTransition(state);
1434
12.0k
    return;
1435
12.0k
  }
1436
346
1437
346
  Pred = processLeaks(state, Leaked, C, Pred);
1438
346
1439
346
  // Did we cache out?
1440
346
  if (!Pred)
1441
0
    return;
1442
346
1443
346
  // Now generate a new node that nukes the old bindings.
1444
346
  // The only bindings left at this point are the leaked symbols.
1445
346
  RefBindingsTy::Factory &F = state->get_context<RefBindings>();
1446
346
  RefBindingsTy B = state->get<RefBindings>();
1447
346
1448
346
  for (SymbolRef L : Leaked)
1449
356
    B = F.remove(B, L);
1450
346
1451
346
  state = state->set<RefBindings>(B);
1452
346
  C.addTransition(state, Pred);
1453
346
}
1454
1455
void RetainCountChecker::printState(raw_ostream &Out, ProgramStateRef State,
1456
0
                                    const char *NL, const char *Sep) const {
1457
0
1458
0
  RefBindingsTy B = State->get<RefBindings>();
1459
0
1460
0
  if (B.isEmpty())
1461
0
    return;
1462
0
1463
0
  Out << Sep << NL;
1464
0
1465
0
  for (auto &I : B) {
1466
0
    Out << I.first << " : ";
1467
0
    I.second.print(Out);
1468
0
    Out << NL;
1469
0
  }
1470
0
}
1471
1472
//===----------------------------------------------------------------------===//
1473
// Checker registration.
1474
//===----------------------------------------------------------------------===//
1475
1476
79
void ento::registerRetainCountBase(CheckerManager &Mgr) {
1477
79
  Mgr.registerChecker<RetainCountChecker>();
1478
79
}
1479
1480
33
bool ento::shouldRegisterRetainCountBase(const LangOptions &LO) {
1481
33
  return true;
1482
33
}
1483
1484
// FIXME: remove this, hack for backwards compatibility:
1485
// it should be possible to enable the NS/CF retain count checker as
1486
// osx.cocoa.RetainCount, and it should be possible to disable
1487
// osx.OSObjectRetainCount using osx.cocoa.RetainCount:CheckOSObject=false.
1488
static bool getOption(AnalyzerOptions &Options,
1489
                      StringRef Postfix,
1490
109
                      StringRef Value) {
1491
109
  auto I = Options.Config.find(
1492
109
    (StringRef("osx.cocoa.RetainCount:") + Postfix).str());
1493
109
  if (I != Options.Config.end())
1494
109
    return I->getValue() == Value;
1495
0
  return false;
1496
0
}
1497
1498
78
void ento::registerRetainCountChecker(CheckerManager &Mgr) {
1499
78
  auto *Chk = Mgr.getChecker<RetainCountChecker>();
1500
78
  Chk->TrackObjCAndCFObjects = true;
1501
78
  Chk->TrackNSCFStartParam = getOption(Mgr.getAnalyzerOptions(),
1502
78
                                       "TrackNSCFStartParam",
1503
78
                                       "true");
1504
78
}
1505
1506
80
bool ento::shouldRegisterRetainCountChecker(const LangOptions &LO) {
1507
80
  return true;
1508
80
}
1509
1510
31
void ento::registerOSObjectRetainCountChecker(CheckerManager &Mgr) {
1511
31
  auto *Chk = Mgr.getChecker<RetainCountChecker>();
1512
31
  if (!getOption(Mgr.getAnalyzerOptions(),
1513
31
                 "CheckOSObject",
1514
31
                 "false"))
1515
30
    Chk->TrackOSObjects = true;
1516
31
}
1517
1518
31
bool ento::shouldRegisterOSObjectRetainCountChecker(const LangOptions &LO) {
1519
31
  return true;
1520
31
}