//==--- RetainCountChecker.h - Checks for leaks and other issues -*- C++ -*--//

//

// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.

// See https://llvm.org/LICENSE.txt for license information.

// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception

//

//===----------------------------------------------------------------------===//

//

//  This file defines the methods for RetainCountChecker, which implements

//  a reference count checker for Core Foundation and Cocoa on (Mac OS X).

//

//===----------------------------------------------------------------------===//

#ifndef LLVM_CLANG_LIB_STATICANALYZER_CHECKERS_RETAINCOUNTCHECKER_H

#define LLVM_CLANG_LIB_STATICANALYZER_CHECKERS_RETAINCOUNTCHECKER_H

#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"

#include "RetainCountDiagnostics.h"

#include "clang/AST/Attr.h"

#include "clang/AST/DeclCXX.h"

#include "clang/AST/DeclObjC.h"

#include "clang/AST/ParentMap.h"

#include "clang/Analysis/DomainSpecific/CocoaConventions.h"

#include "clang/Analysis/PathDiagnostic.h"

#include "clang/Analysis/RetainSummaryManager.h"

#include "clang/Basic/LangOptions.h"

#include "clang/Basic/SourceManager.h"

#include "clang/Analysis/SelectorExtras.h"

#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"

#include "clang/StaticAnalyzer/Core/Checker.h"

#include "clang/StaticAnalyzer/Core/CheckerManager.h"

#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"

#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"

#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"

#include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h"

#include "llvm/ADT/DenseMap.h"

#include "llvm/ADT/FoldingSet.h"

#include "llvm/ADT/ImmutableList.h"

#include "llvm/ADT/ImmutableMap.h"

#include "llvm/ADT/STLExtras.h"

#include "llvm/ADT/SmallString.h"

#include "llvm/ADT/StringExtras.h"

#include <cstdarg>

#include <utility>

namespace clang {

namespace ento {

namespace retaincountchecker {

/// Metadata on reference.

class RefVal {

public:

  enum Kind {

    Owned = 0, // Owning reference.

    NotOwned,  // Reference is not owned by still valid (not freed).

    Released,  // Object has been released.

    ReturnedOwned, // Returned object passes ownership to caller.

    ReturnedNotOwned, // Return object does not pass ownership to caller.

    ERROR_START,

    ErrorDeallocNotOwned, // -dealloc called on non-owned object.

    ErrorUseAfterRelease, // Object used after released.

    ErrorReleaseNotOwned, // Release of an object that was not owned.

    ERROR_LEAK_START,

    ErrorLeak,  // A memory leak due to excessive reference counts.

    ErrorLeakReturned, // A memory leak due to the returning method not having

                       // the correct naming conventions.

    ErrorOverAutorelease,

    ErrorReturnedNotOwned

  };

  /// Tracks how an object referenced by an ivar has been used.

  ///

  /// This accounts for us not knowing if an arbitrary ivar is supposed to be

  /// stored at +0 or +1.

  enum class IvarAccessHistory {

    None,

    AccessedDirectly,

    ReleasedAfterDirectAccess

  };

private:

  /// The number of outstanding retains.

  unsigned Cnt;

  /// The number of outstanding autoreleases.

  unsigned ACnt;

  /// The (static) type of the object at the time we started tracking it.

  QualType T;

  /// The current state of the object.

  ///

  /// See the RefVal::Kind enum for possible values.

  unsigned RawKind : 5;

  /// The kind of object being tracked (CF or ObjC or OSObject), if known.

  ///

  /// See the ObjKind enum for possible values.

  unsigned RawObjectKind : 3;

  /// True if the current state and/or retain count may turn out to not be the

  /// best possible approximation of the reference counting state.

  ///

  /// If true, the checker may decide to throw away ("override") this state

  /// in favor of something else when it sees the object being used in new ways.

  ///

  /// This setting should not be propagated to state derived from this state.

  /// Once we start deriving new states, it would be inconsistent to override

  /// them.

  unsigned RawIvarAccessHistory : 2;

  RefVal(Kind k, ObjKind o, unsigned cnt, unsigned acnt, QualType t,

         IvarAccessHistory IvarAccess)

    : Cnt(cnt), ACnt(acnt), T(t), RawKind(static_cast<unsigned>(k)),

      RawObjectKind(static_cast<unsigned>(o)),

      RawIvarAccessHistory(static_cast<unsigned>(IvarAccess)) {

    assert(getKind() == k && "not enough bits for the kind");

    assert(getObjKind() == o && "not enough bits for the object kind");

    assert(getIvarAccessHistory() == IvarAccess && "not enough bits");

  }

public:

  Kind getKind() const { return static_cast<Kind>(RawKind); }

  ObjKind getObjKind() const {

    return static_cast<ObjKind>(RawObjectKind);

  }

  unsigned getCount() const { return Cnt; }

  unsigned getAutoreleaseCount() const { return ACnt; }

  unsigned getCombinedCounts() const { return Cnt + ACnt; }

  void clearCounts() {

    Cnt = 0;

    ACnt = 0;

  }

  void setCount(unsigned i) {

    Cnt = i;

  }

  void setAutoreleaseCount(unsigned i) {

    ACnt = i;

  }

  QualType getType() const { return T; }

  /// Returns what the analyzer knows about direct accesses to a particular

  /// instance variable.

  ///

  /// If the object with this refcount wasn't originally from an Objective-C

  /// ivar region, this should always return IvarAccessHistory::None.

  IvarAccessHistory getIvarAccessHistory() const {

    return static_cast<IvarAccessHistory>(RawIvarAccessHistory);

  }

  bool isOwned() const {

    return getKind() == Owned;

  }

  bool isNotOwned() const {

    return getKind() == NotOwned;

  }

  bool isReturnedOwned() const {

    return getKind() == ReturnedOwned;

  }

  bool isReturnedNotOwned() const {

    return getKind() == ReturnedNotOwned;

  }

  /// Create a state for an object whose lifetime is the responsibility of the

  /// current function, at least partially.

  ///

  /// Most commonly, this is an owned object with a retain count of +1.

  static RefVal makeOwned(ObjKind o, QualType t) {

    return RefVal(Owned, o, /*Count=*/1, 0, t, IvarAccessHistory::None);

  }

  /// Create a state for an object whose lifetime is not the responsibility of

  /// the current function.

  ///

  /// Most commonly, this is an unowned object with a retain count of +0.

  static RefVal makeNotOwned(ObjKind o, QualType t) {

    return RefVal(NotOwned, o, /*Count=*/0, 0, t, IvarAccessHistory::None);

  }

  RefVal operator-(size_t i) const {

    return RefVal(getKind(), getObjKind(), getCount() - i,

                  getAutoreleaseCount(), getType(), getIvarAccessHistory());

  }

  RefVal operator+(size_t i) const {

    return RefVal(getKind(), getObjKind(), getCount() + i,

                  getAutoreleaseCount(), getType(), getIvarAccessHistory());

  }

  RefVal operator^(Kind k) const {

    return RefVal(k, getObjKind(), getCount(), getAutoreleaseCount(),

                  getType(), getIvarAccessHistory());

  }

  RefVal autorelease() const {

    return RefVal(getKind(), getObjKind(), getCount(), getAutoreleaseCount()+1,

                  getType(), getIvarAccessHistory());

  }

  RefVal withIvarAccess() const {

    assert(getIvarAccessHistory() == IvarAccessHistory::None);

    return RefVal(getKind(), getObjKind(), getCount(), getAutoreleaseCount(),

                  getType(), IvarAccessHistory::AccessedDirectly);

  }

  RefVal releaseViaIvar() const {

    assert(getIvarAccessHistory() == IvarAccessHistory::AccessedDirectly);

    return RefVal(getKind(), getObjKind(), getCount(), getAutoreleaseCount(),

                  getType(), IvarAccessHistory::ReleasedAfterDirectAccess);

  }

  // Comparison, profiling, and pretty-printing.

  bool hasSameState(const RefVal &X) const {

    return getKind() == X.getKind() && 
Cnt == X.Cnt15.9k
 && 
ACnt == X.ACnt15.8k
 &&

           
getIvarAccessHistory() == X.getIvarAccessHistory()15.7k
;

  }

  bool operator==(const RefVal& X) const {

    return T == X.T && hasSameState(X) && getObjKind() == X.getObjKind();

  }

  void Profile(llvm::FoldingSetNodeID& ID) const {

    ID.Add(T);

    ID.AddInteger(RawKind);

    ID.AddInteger(Cnt);

    ID.AddInteger(ACnt);

    ID.AddInteger(RawObjectKind);

    ID.AddInteger(RawIvarAccessHistory);

  }

  void print(raw_ostream &Out) const;

};

class RetainCountChecker

  : public Checker< check::Bind,

                    check::DeadSymbols,

                    check::BeginFunction,

                    check::EndFunction,

                    check::PostStmt<BlockExpr>,

                    check::PostStmt<CastExpr>,

                    check::PostStmt<ObjCArrayLiteral>,

                    check::PostStmt<ObjCDictionaryLiteral>,

                    check::PostStmt<ObjCBoxedExpr>,

                    check::PostStmt<ObjCIvarRefExpr>,

                    check::PostCall,

                    check::RegionChanges,

                    eval::Assume,

                    eval::Call > {

public:

  std::unique_ptr<RefCountBug> UseAfterRelease;

  std::unique_ptr<RefCountBug> ReleaseNotOwned;

  std::unique_ptr<RefCountBug> DeallocNotOwned;

  std::unique_ptr<RefCountBug> FreeNotOwned;

  std::unique_ptr<RefCountBug> OverAutorelease;

  std::unique_ptr<RefCountBug> ReturnNotOwnedForOwned;

  std::unique_ptr<RefCountBug> LeakWithinFunction;

  std::unique_ptr<RefCountBug> LeakAtReturn;

  mutable std::unique_ptr<RetainSummaryManager> Summaries;

  static std::unique_ptr<CheckerProgramPointTag> DeallocSentTag;

  static std::unique_ptr<CheckerProgramPointTag> CastFailTag;

  /// Track Objective-C and CoreFoundation objects.

  bool TrackObjCAndCFObjects = false;

  /// Track sublcasses of OSObject.

  bool TrackOSObjects = false;

  /// Track initial parameters (for the entry point) for NS/CF objects.

  bool TrackNSCFStartParam = false;

  RetainCountChecker() {};

  RetainSummaryManager &getSummaryManager(ASTContext &Ctx) const {

    if (!Summaries)

      Summaries.reset(

          new RetainSummaryManager(Ctx, TrackObjCAndCFObjects, TrackOSObjects));

    return *Summaries;

  }

  RetainSummaryManager &getSummaryManager(CheckerContext &C) const {

    return getSummaryManager(C.getASTContext());

  }

  void printState(raw_ostream &Out, ProgramStateRef State,

                  const char *NL, const char *Sep) const override;

  void checkBind(SVal loc, SVal val, const Stmt *S, CheckerContext &C) const;

  void checkPostStmt(const BlockExpr *BE, CheckerContext &C) const;

  void checkPostStmt(const CastExpr *CE, CheckerContext &C) const;

  void checkPostStmt(const ObjCArrayLiteral *AL, CheckerContext &C) const;

  void checkPostStmt(const ObjCDictionaryLiteral *DL, CheckerContext &C) const;

  void checkPostStmt(const ObjCBoxedExpr *BE, CheckerContext &C) const;

  void checkPostStmt(const ObjCIvarRefExpr *IRE, CheckerContext &C) const;

  void checkPostCall(const CallEvent &Call, CheckerContext &C) const;

  void checkSummary(const RetainSummary &Summ, const CallEvent &Call,

                    CheckerContext &C) const;

  void processSummaryOfInlined(const RetainSummary &Summ,

                               const CallEvent &Call,

                               CheckerContext &C) const;

  bool evalCall(const CallEvent &Call, CheckerContext &C) const;

  ProgramStateRef evalAssume(ProgramStateRef state, SVal Cond,

                                 bool Assumption) const;

  ProgramStateRef

  checkRegionChanges(ProgramStateRef state,

                     const InvalidatedSymbols *invalidated,

                     ArrayRef<const MemRegion *> ExplicitRegions,

                     ArrayRef<const MemRegion *> Regions,

                     const LocationContext* LCtx,

                     const CallEvent *Call) const;

  ExplodedNode* checkReturnWithRetEffect(const ReturnStmt *S, CheckerContext &C,

                                ExplodedNode *Pred, RetEffect RE, RefVal X,

                                SymbolRef Sym, ProgramStateRef state) const;

  void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const;

  void checkBeginFunction(CheckerContext &C) const;

  void checkEndFunction(const ReturnStmt *RS, CheckerContext &C) const;

  ProgramStateRef updateSymbol(ProgramStateRef state, SymbolRef sym,

                               RefVal V, ArgEffect E, RefVal::Kind &hasErr,

                               CheckerContext &C) const;

  const RefCountBug &errorKindToBugKind(RefVal::Kind ErrorKind,

                                        SymbolRef Sym) const;

  void processNonLeakError(ProgramStateRef St, SourceRange ErrorRange,

                           RefVal::Kind ErrorKind, SymbolRef Sym,

                           CheckerContext &C) const;

  void processObjCLiterals(CheckerContext &C, const Expr *Ex) const;

  ProgramStateRef handleSymbolDeath(ProgramStateRef state,

                                    SymbolRef sid, RefVal V,

                                    SmallVectorImpl<SymbolRef> &Leaked) const;

  ProgramStateRef

  handleAutoreleaseCounts(ProgramStateRef state, ExplodedNode *Pred,

                          const ProgramPointTag *Tag, CheckerContext &Ctx,

                          SymbolRef Sym,

                          RefVal V,

                          const ReturnStmt *S=nullptr) const;

  ExplodedNode *processLeaks(ProgramStateRef state,

                             SmallVectorImpl<SymbolRef> &Leaked,

                             CheckerContext &Ctx,

                             ExplodedNode *Pred = nullptr) const;

  static const CheckerProgramPointTag &getDeallocSentTag() {

    return *DeallocSentTag;

  }

  static const CheckerProgramPointTag &getCastFailTag() { return *CastFailTag; }

private:

  /// Perform the necessary checks and state adjustments at the end of the

  /// function.

  /// \p S Return statement, may be null.

  ExplodedNode * processReturn(const ReturnStmt *S, CheckerContext &C) const;

};

//===----------------------------------------------------------------------===//

// RefBindings - State used to track object reference counts.

//===----------------------------------------------------------------------===//

const RefVal *getRefBinding(ProgramStateRef State, SymbolRef Sym);

/// Returns true if this stack frame is for an Objective-C method that is a

/// property getter or setter whose body has been synthesized by the analyzer.

inline bool isSynthesizedAccessor(const StackFrameContext *SFC) {

  auto Method = dyn_cast_or_null<ObjCMethodDecl>(SFC->getDecl());

  if (!Method || !Method->isPropertyAccessor())

    return false;

  return SFC->getAnalysisDeclContext()->isBodyAutosynthesized();

}

} // end namespace retaincountchecker

} // end namespace ento

} // end namespace clang

#endif