;
21using namespaceretaincountchecker;
27namespaceretaincountchecker {
30 returnState->get<RefBindings>(Sym);
39assert(Sym !=
nullptr);
40 returnState->set<RefBindings>(Sym, Val);
44 returnState->remove<RefBindings>(Sym);
49Out <<
"Tracked "<< T <<
" | ";
52 default: llvm_unreachable(
"Invalid RefVal kind");
56 if(cnt) Out <<
" (+ "<< cnt <<
")";
63 if(cnt) Out <<
" (+ "<< cnt <<
")";
68Out <<
"ReturnedOwned";
70 if(cnt) Out <<
" (+ "<< cnt <<
")";
75Out <<
"ReturnedNotOwned";
77 if(cnt) Out <<
" (+ "<< cnt <<
")";
86Out <<
"-dealloc (not-owned)";
94Out <<
"Leaked (Bad naming)";
98Out <<
"Use-After-Release [ERROR]";
102Out <<
"Release of Not-Owned [ERROR]";
106Out <<
"Over-autoreleased";
110Out <<
"Non-owned object returned instead of owned";
118Out <<
" [direct ivar access]";
121Out <<
" [released after direct ivar access]";
125Out <<
" [autorelease -"<< ACnt <<
']';
136 boolVisitSymbol(
SymbolRefsym)
override{
156 auto*R = cast<BlockDataRegion>(
C.getSVal(BE).getAsRegion());
158 autoReferencedVars = R->referenced_vars();
159 if(ReferencedVars.empty())
169 for(
autoVar : ReferencedVars) {
170 const VarRegion*VR = Var.getCapturedRegion();
174Regions.push_back(VR);
177state = state->scanReachableSymbols<StopTrackingCallback>(Regions).getState();
178 C.addTransition(state);
210 SymbolRefSym =
C.getSVal(CE).getAsLocSymbol();
225 C.addTransition(state);
229 const Expr*Ex)
const{
255 C.addTransition(state);
281 C.addTransition(State);
286std::optional<Loc> IVarLoc =
C.getSVal(IRE).getAs<
Loc>();
291 SymbolRefSym = State->getSVal(*IVarLoc).getAsSymbol();
292 if(!Sym || !isa_and_nonnull<ObjCIvarRegion>(Sym->
getOriginRegion()))
321 C.addTransition(
setRefBinding(State, Sym, RV->withIvarAccess()));
334 C.addTransition(State);
338 if(
const auto*MC = dyn_cast<ObjCMethodCall>(&
Call)) {
342 returnMC->getMethodFamily() ==
OMF_init&& MC->isReceiverSelfOrSuper() &&
343!
Call.getLocationContext()
344->getAnalysisDeclContext()
346.isConsumedExpr(
Call.getOriginExpr());
354 const Expr*CE =
Call.getOriginExpr();
357:
AnyCall(cast<CXXDestructorDecl>(
Call.getDecl()));
368 if(
const auto*MC = dyn_cast<ObjCMethodCall>(&
Call)) {
369 if(MC->isInstanceMessage()) {
370 SValReceiverV = MC->getReceiverSVal();
373ReceiverType =
T->getType();
379 if(
C.wasInlined) {
400 if(PT->isObjCQualifiedIdType() || PT->isObjCIdType() ||
401PT->isObjCClassType()) {
436 const RefVal*TrackedValue) {
453 for(
unsignedidx = 0, e = CallOrMsg.
getNumArgs(); idx != e; ++idx) {
460ShouldRemoveBinding =
true;
462 if(ShouldRemoveBinding)
468 if(
const auto*MsgInvocation = dyn_cast<ObjCMethodCall>(&CallOrMsg)) {
469 if(
SymbolRefSym = MsgInvocation->getReceiverSVal().getAsLocSymbol()) {
484 C.addTransition(state);
488 const auto*TR = dyn_cast<TypedValueRegion>(
489cast<SubRegion>(MR)->getSuperRegion());
508 const auto*VR = dyn_cast<VarRegion>(R);
513 const VarDecl*VD = VR->getDecl();
514 if(!VD->
hasAttr<CleanupAttr>())
529 boolSplitNecessary =
false;
533SplitNecessary =
true;
538 if(SplitNecessary) {
545AssumeNonZeroReturn = AssumeNonZeroReturn->assume(*DL,
true);
546AssumeZeroReturn = AssumeZeroReturn->assume(*DL,
false);
550 for(
unsignedidx = 0, e = CE.
getNumArgs(); idx != e; ++idx) {
554 auto*ArgRegion = dyn_cast_or_null<TypedValueRegion>(ArgVal.
getAsRegion());
558 QualTypePointeeTy = ArgRegion->getValueType();
559 SValPointeeVal = State->getSVal(ArgRegion);
578AssumeNonZeroReturn = makeNotOwnedParameter(AssumeNonZeroReturn);
579AssumeZeroReturn = makeNotOwnedParameter(AssumeZeroReturn);
582AssumeNonZeroReturn = makeOwnedParameter(AssumeNonZeroReturn);
583AssumeZeroReturn = makeOwnedParameter(AssumeZeroReturn);
586AssumeNonZeroReturn = makeOwnedParameter(AssumeNonZeroReturn);
589AssumeZeroReturn = makeOwnedParameter(AssumeZeroReturn);
596 if(SplitNecessary) {
597 return{AssumeNonZeroReturn, AssumeZeroReturn};
599assert(AssumeZeroReturn == AssumeNonZeroReturn);
600 return{AssumeZeroReturn};
616 boolDeallocSent =
false;
618 for(
unsignedidx = 0, e = CallOrMsg.
getNumArgs(); idx != e; ++idx) {
641 boolReceiverIsTracked =
false;
643 if(
const auto*MsgInvocation = dyn_cast<ObjCMethodCall>(&CallOrMsg)) {
644 if(
SymbolRefSym = MsgInvocation->getReceiverSVal().getAsLocSymbol()) {
646ReceiverIsTracked =
true;
650ErrorRange = MsgInvocation->getOriginExpr()->getReceiverRange();
657}
else if(
const auto*MCall = dyn_cast<CXXMemberCall>(&CallOrMsg)) {
658 if(
SymbolRefSym = MCall->getCXXThisVal().getAsLocSymbol()) {
663ErrorRange = MCall->getOriginExpr()->getSourceRange();
681 if(ReceiverIsTracked)
705 C.addTransition(St);
715 boolIgnoreRetainMsg = (
bool)
C.getASTContext().getLangOpts().ObjCAutoRefCount;
735hasErr =
V.getKind();
744llvm_unreachable(
"Applies to pointer-to-pointer parameters, which should " 745 "not have ref state.");
748 switch(
V.getKind()) {
750llvm_unreachable(
"Invalid RefVal state for an explicit dealloc.");
758hasErr =
V.getKind();
776 V=
V.autorelease();
784 switch(
V.getKind()) {
786llvm_unreachable(
"Invalid RefVal state for a retain.");
797 switch(
V.getKind()) {
800llvm_unreachable(
"Invalid RefVal state for a release.");
803assert(
V.getCount() > 0);
804 if(
V.getCount() == 1) {
806 V.getIvarAccessHistory() ==
819 if(
V.getCount() > 0) {
823}
else if(
V.getIvarAccessHistory() ==
832hasErr =
V.getKind();
854llvm_unreachable(
"Unhandled error.");
877 autoreport = std::make_unique<RefCountReport>(
879 C.getASTContext().getLangOpts(), N, Sym);
880report->addRange(ErrorRange);
881 C.emitReport(std::move(report));
891 const auto*FD = dyn_cast_or_null<FunctionDecl>(
Call.getDecl());
895 const auto*CE = dyn_cast_or_null<CallExpr>(
Call.getOriginExpr());
904 boolhasTrustedImplementationAnnotation =
false;
909std::optional<BehaviorSummary> BSmr =
910SmrMgr.
canEval(CE, FD, hasTrustedImplementationAnnotation);
917 if(BSmr == BehaviorSummary::Identity ||
918BSmr == BehaviorSummary::IdentityOrZero ||
919BSmr == BehaviorSummary::IdentityThis) {
921 const Expr*BindReturnTo =
922(BSmr == BehaviorSummary::IdentityThis)
923? cast<CXXMemberCallExpr>(CE)->getImplicitObjectArgument()
925 SValRetVal = state->getSVal(BindReturnTo, LCtx);
932(hasTrustedImplementationAnnotation && !ResultTy.
isNull())) {
939state = state->BindExpr(CE, LCtx, RetVal,
false);
941 if(BSmr == BehaviorSummary::IdentityOrZero) {
946NullOutputState = NullOutputState->BindExpr(
947CE, LCtx,
C.getSValBuilder().makeNullWithType(ResultTy),
954state = state->assume(*L,
true);
959 C.addTransition(state);
972 if(!
C.inTopFrame())
978 const Expr*RetE = S->getRetValue();
985 SymbolRefSym = state->getSValAsScalarOrLoc(RetE,
C.getLocationContext())
986.getAsLocSymbol(
true);
998 switch(
X.getKind()) {
1000 unsignedcnt =
X.getCount();
1002 X.setCount(cnt - 1);
1008 unsignedcnt =
X.getCount();
1010 X.setCount(cnt - 1);
1024Pred =
C.addTransition(state);
1056}
else if(
const FunctionDecl*FD = dyn_cast<FunctionDecl>(CD)) {
1057 if(!isa<CXXMethodDecl>(FD)) {
1082 if(
X.isReturnedOwned() &&
X.getCount() == 0) {
1094 ExplodedNode*N =
C.addTransition(state, Pred, &ReturnOwnLeakTag);
1096 const LangOptions&LOpts =
C.getASTContext().getLangOpts();
1098std::make_unique<RefLeakReport>(*
LeakAtReturn, LOpts, N, Sym,
C);
1099 C.emitReport(std::move(R));
1104}
else if(
X.isReturnedNotOwned()) {
1106 if(
X.getIvarAccessHistory() ==
1118ReturnNotOwnedTag(
this,
"ReturnNotOwnedForOwned");
1120 ExplodedNode*N =
C.addTransition(state, Pred, &ReturnNotOwnedTag);
1122 autoR = std::make_unique<RefCountReport>(
1124 C.emitReport(std::move(R));
1145state = state->scanReachableSymbols<StopTrackingCallback>(val).getState();
1146 C.addTransition(state);
1152 boolAssumption)
const{
1159RefBindingsTy B = state->get<RefBindings>();
1164 boolchanged =
false;
1165RefBindingsTy::Factory &RefBFactory = state->get_context<RefBindings>();
1168 for(
auto&I : B) {
1173B = RefBFactory.remove(B, I.first);
1178state = state->set<RefBindings>(B);
1193 for(
const MemRegion*I : ExplicitRegions)
1195AllowedSymbols.insert(SR->getSymbol());
1198 if(AllowedSymbols.count(sym))
1214 unsignedACnt =
V.getAutoreleaseCount();
1220 unsignedCnt =
V.getCount();
1231 V=
V.releaseViaIvar();
1244 V.setCount(
V.getCount() - ACnt);
1245 V.setAutoreleaseCount(0);
1267llvm::raw_svector_ostream os(sbuf);
1268os <<
"Object was autoreleased ";
1269 if(
V.getAutoreleaseCount() > 1)
1270os <<
V.getAutoreleaseCount() <<
" times but the object ";
1273os <<
"has a +"<<
V.getCount() <<
" retain count";
1276 autoR = std::make_unique<RefCountReport>(*
OverAutorelease, LOpts, N, Sym,
1278Ctx.emitReport(std::move(R));
1298 else if(
V.isOwned())
1300 else if(
V.isNotOwned() ||
V.isReturnedOwned())
1301hasLeak = (
V.getCount() > 0);
1308Leaked.push_back(sid);
1324Ctx.emitReport(std::make_unique<RefLeakReport>(BT, LOpts, N, L, Ctx));
1332 if(!Ctx.inTopFrame())
1347 for(
unsignedidx = 0, e =
C->param_size(); idx != e; ++idx) {
1349 SymbolRefSym = state->getSVal(state->getRegion(Param, LCtx)).getAsSymbol();
1352 const ArgEffect*AE = CalleeSideArgEffects.lookup(idx);
1364Ctx.addTransition(state);
1377RefBindingsTy B = state->get<RefBindings>();
1381 if(LCtx->getAnalysisDeclContext()->isBodyAutosynthesized()) {
1382assert(!LCtx->inTopFrame());
1386 for(
auto&I : B) {
1397 if(LCtx->getParent())
1400B = state->get<RefBindings>();
1417 for(
const auto&I: state->get<RefBindings>()) {
1419 if(SymReaper.
isDead(Sym)) {
1432 if(Leaked.empty()) {
1433 C.addTransition(state);
1445RefBindingsTy::Factory &F = state->get_context<RefBindings>();
1446RefBindingsTy B = state->get<RefBindings>();
1451state = state->set<RefBindings>(B);
1452 C.addTransition(state, Pred);
1456 const char*NL,
const char*Sep)
const{
1458RefBindingsTy B = State->get<RefBindings>();
1465 for(
auto&I : B) {
1466Out << I.first <<
" : ";
1467I.second.print(Out);
1482std::make_unique<CheckerProgramPointTag>(Chk,
"DeallocSent");
1484std::make_unique<CheckerProgramPointTag>(Chk,
"DynamicCastFail");
1487boolento::shouldRegisterRetainCountBase(
const CheckerManager&mgr) {
1496#define INIT_BUGTYPE(KIND) \ 1497 Chk->KIND = std::make_unique<RefCountBug>(Mgr.getCurrentCheckerName(), \ 1511boolento::shouldRegisterRetainCountChecker(
const CheckerManager&mgr) {
1515voidento::registerOSObjectRetainCountChecker(
CheckerManager&Mgr) {
1528#define LAZY_INIT_BUGTYPE(KIND) \ 1530 Chk->KIND = std::make_unique<RefCountBug>(Mgr.getCurrentCheckerName(), \ 1540#undef LAZY_INIT_BUGTYPE 1543boolento::shouldRegisterOSObjectRetainCountChecker(
const CheckerManager&mgr) {
static CanQualType GetReturnType(QualType RetTy)
Returns the "extra-canonicalized" return type, which discards qualifiers on the return type.
#define REGISTER_MAP_WITH_PROGRAMSTATE(Name, Key, Value)
Declares an immutable map of type NameTy, suitable for placement into the ProgramState.
#define LAZY_INIT_BUGTYPE(KIND)
static const RetainSummary * getSummary(RetainSummaryManager &Summaries, const CallEvent &Call, QualType ReceiverType)
static std::optional< RefVal > refValFromRetEffect(RetEffect RE, QualType ResultTy)
static ProgramStateRef setRefBinding(ProgramStateRef State, SymbolRef Sym, RefVal Val)
static bool isReceiverUnconsumedSelf(const CallEvent &Call)
static SmallVector< ProgramStateRef, 2 > updateOutParameters(ProgramStateRef State, const RetainSummary &Summ, const CallEvent &CE)
static ProgramStateRef removeRefBinding(ProgramStateRef State, SymbolRef Sym)
#define INIT_BUGTYPE(KIND)
static bool isPointerToObject(QualType QT)
static bool isSmartPtrField(const MemRegion *MR)
static bool shouldEscapeOSArgumentOnCall(const CallEvent &CE, unsigned ArgIdx, const RefVal *TrackedValue)
Whether the tracked value should be escaped on a given call.
static bool shouldEscapeRegion(const MemRegion *R)
A value escapes in these possible cases:
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
QualType getObjCInterfaceType(const ObjCInterfaceDecl *Decl, ObjCInterfaceDecl *PrevDecl=nullptr) const
getObjCInterfaceType - Return the unique reference to the type for the specified ObjC interface decl.
const LangOptions & getLangOpts() const
QualType getObjCObjectPointerType(QualType OIT) const
Return a ObjCObjectPointerType type for the given ObjCObjectType.
bool getCheckerBooleanOption(StringRef CheckerName, StringRef OptionName, bool SearchInParents=false) const
Interprets an option's string value as a boolean.
An instance of this class corresponds to a call.
static std::optional< AnyCall > forDecl(const Decl *D)
If D is a callable (Objective-C method or a function), return a constructed AnyCall object.
static std::optional< AnyCall > forExpr(const Expr *E)
If E is a generic call (to ObjC method /function/block/etc), return a constructed AnyCall object.
bool hasCaptures() const
True if this block (or its nested blocks) captures anything of local storage from its enclosing scope...
BlockExpr - Adaptor class for mixing a BlockDecl with expressions.
const BlockDecl * getBlockDecl() const
CastExpr - Base class for type casts, including both implicit casts (ImplicitCastExpr) and explicit c...
Decl - This represents one declaration (or definition), e.g.
This represents one expression.
Represents a function declaration or definition.
Keeps track of the various options that can be enabled, which controls the dialect of C or C++ that i...
It wraps the AnalysisDeclContext to represent both the call stack with the help of StackFrameContext ...
const Decl * getDecl() const
ObjCArrayLiteral - used for objective-c array containers; as in: @["Hello", NSApp,...
ObjCBoxedExpr - used for generalized expression boxing.
An Objective-C "bridged" cast expression, which casts between Objective-C pointers and C pointers,...
ObjCBridgeCastKind getBridgeKind() const
Determine which kind of bridge is being performed via this cast.
ObjCDictionaryLiteral - AST node to represent objective-c dictionary literals; as in:"name" : NSUserN...
Represents an ObjC class declaration.
ObjCIvarRefExpr - A reference to an ObjC instance variable.
An expression that sends a message to the given Objective-C object or class.
ObjCMethodDecl - Represents an instance or class method declaration.
Represents a pointer to an Objective C object.
Represents a parameter to a function.
ProgramPoints can be "tagged" as representing points specific to a given analysis entity.
A (possibly-)qualified type.
bool isNull() const
Return true if this QualType doesn't point to a type yet.
ReturnStmt - This represents a return, optionally of an expression: return; return 4;.
A trivial tuple used to represent a source range.
Stmt - This represents one statement.
CXXRecordDecl * getAsCXXRecordDecl() const
Retrieves the CXXRecordDecl that this type refers to, either because the type is a RecordType or beca...
bool isScalarType() const
const CXXRecordDecl * getPointeeCXXRecordDecl() const
If this is a pointer or reference to a RecordType, return the CXXRecordDecl that the type refers to.
QualType getPointeeType() const
If this is a pointer, ObjC object pointer, or block pointer, this returns the respective pointee.
bool isObjCObjectPointerType() const
const T * getAs() const
Member-template getAs<specific type>'.
bool isObjCRetainableType() const
Represents a variable declaration or definition.
An ArgEffect summarizes the retain count behavior on an argument or receiver to a function or method.
ArgEffect withKind(ArgEffectKind NewK)
ObjKind getObjKind() const
ArgEffectKind getKind() const
Represents an abstract call to a function or method along a particular path.
virtual SourceRange getArgSourceRange(unsigned Index) const
Returns the source range for errors associated with this argument.
virtual const Expr * getOriginExpr() const
Returns the expression whose value will be the result of this call.
QualType getResultType() const
Returns the result type, adjusted for references.
virtual SVal getArgSVal(unsigned Index) const
Returns the value of a given argument at the time of the call.
virtual unsigned getNumArgs() const =0
Returns the number of arguments (explicit and implicit).
SVal getReturnValue() const
Returns the return value of the call.
virtual ArrayRef< ParmVarDecl * > parameters() const =0
Return call's formal parameters.
const AnalyzerOptions & getAnalyzerOptions() const
CHECKER * registerChecker(AT &&... Args)
Used to register checkers.
CheckerNameRef getCurrentCheckerName() const
Tag that can use a checker name as a message provider (see SimpleProgramPointTag).
bool isConstrainedTrue() const
Return true if the constraint is perfectly constrained to 'true'.
ConditionTruthVal isNull(ProgramStateRef State, SymbolRef Sym)
Convenience method to query the state to see if a symbol is null or not null, or if neither assumptio...
const ProgramStateRef & getState() const
SVal getSVal(const Stmt *S) const
Get the value of an arbitrary expression at this node.
const LocationContext * getLocationContext() const
const Decl & getCodeDecl() const
const VarRegion * getVarRegion(const VarDecl *VD, const LocationContext *LC)
getVarRegion - Retrieve or create the memory region associated with a specified VarDecl and LocationC...
MemRegion - The root abstract class for all memory regions.
bool hasStackStorage() const
LLVM_ATTRIBUTE_RETURNS_NONNULL const MemRegion * StripCasts(bool StripBaseAndDerivedCasts=true) const
const RegionTy * getAs() const
RetEffect summarizes a call's retain/release behavior with respect to its return value.
ObjKind getObjKind() const
@ OwnedWhenTrackedReceiver
Indicates that the return value is an owned object when the receiver is also a tracked object.
@ NoRet
Indicates that no retain count information is tracked for the return value.
static RetEffect MakeNoRet()
bool isTrustedReferenceCountImplementation(const Decl *FD)
std::optional< BehaviorSummary > canEval(const CallExpr *CE, const FunctionDecl *FD, bool &hasTrustedImplementationAnnotation)
static bool isKnownSmartPointer(QualType QT)
const RetainSummary * getSummary(AnyCall C, bool HasNonZeroCallbackArg=false, bool IsReceiverUnconsumedSelf=false, QualType ReceiverType={})
RetEffect getObjAllocRetEffect() const
Summary for a function with respect to ownership changes.
ArgEffect getThisEffect() const
ArgEffect getReceiverEffect() const
getReceiverEffect - Returns the effect on the receiver of the call.
RetEffect getRetEffect() const
getRetEffect - Returns the effect on the return value of the call.
ArgEffects getArgEffects() const
ArgEffect getArg(unsigned idx) const
getArg - Return the argument effect on the argument specified by idx (starting from 0).
DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag, const Expr *expr, const LocationContext *LCtx, unsigned count)
Create a new symbol with a unique 'name'.
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
SymbolRef getAsSymbol(bool IncludeBaseRegions=false) const
If this SVal wraps a symbol return that SymbolRef.
std::optional< T > getAs() const
Convert to the specified SVal type, returning std::nullopt if this SVal is not of the desired type.
SymbolRef getAsLocSymbol(bool IncludeBaseRegions=false) const
If this SVal is a location and wraps a symbol, return that SymbolRef.
const MemRegion * getAsRegion() const
LLVM_ATTRIBUTE_RETURNS_NONNULL const MemRegion * getSuperRegion() const
virtual const MemRegion * getOriginRegion() const
Find the region from which this symbol originates.
virtual QualType getType() const =0
A class responsible for cleaning up unused symbols.
bool isDead(SymbolRef sym)
Returns whether or not a symbol has been confirmed dead.
SymbolicRegion - A special, "non-concrete" region.
const VarDecl * getDecl() const override=0
unsigned getCount() const
@ ReleasedAfterDirectAccess
IvarAccessHistory getIvarAccessHistory() const
Returns what the analyzer knows about direct accesses to a particular instance variable.
void print(raw_ostream &Out) const
RefVal withIvarAccess() const
static RefVal makeOwned(ObjKind o, QualType t)
Create a state for an object whose lifetime is the responsibility of the current function,...
ObjKind getObjKind() const
static RefVal makeNotOwned(ObjKind o, QualType t)
Create a state for an object whose lifetime is not the responsibility of the current function.
std::unique_ptr< RefCountBug > LeakAtReturn
void checkPostStmt(const BlockExpr *BE, CheckerContext &C) const
void checkSummary(const RetainSummary &Summ, const CallEvent &Call, CheckerContext &C) const
ProgramStateRef handleSymbolDeath(ProgramStateRef state, SymbolRef sid, RefVal V, SmallVectorImpl< SymbolRef > &Leaked) const
static std::unique_ptr< CheckerProgramPointTag > CastFailTag
bool TrackObjCAndCFObjects
Track Objective-C and CoreFoundation objects.
ProgramStateRef evalAssume(ProgramStateRef state, SVal Cond, bool Assumption) const
static std::unique_ptr< CheckerProgramPointTag > DeallocSentTag
static const CheckerProgramPointTag & getCastFailTag()
void processNonLeakError(ProgramStateRef St, SourceRange ErrorRange, RefVal::Kind ErrorKind, SymbolRef Sym, CheckerContext &C) const
const RefCountBug & errorKindToBugKind(RefVal::Kind ErrorKind, SymbolRef Sym) const
std::unique_ptr< RefCountBug > ReleaseNotOwned
std::unique_ptr< RefCountBug > DeallocNotOwned
void checkBind(SVal loc, SVal val, const Stmt *S, CheckerContext &C) const
ExplodedNode * checkReturnWithRetEffect(const ReturnStmt *S, CheckerContext &C, ExplodedNode *Pred, RetEffect RE, RefVal X, SymbolRef Sym, ProgramStateRef state) const
ProgramStateRef handleAutoreleaseCounts(ProgramStateRef state, ExplodedNode *Pred, const ProgramPointTag *Tag, CheckerContext &Ctx, SymbolRef Sym, RefVal V, const ReturnStmt *S=nullptr) const
std::unique_ptr< RefCountBug > OverAutorelease
ExplodedNode * processLeaks(ProgramStateRef state, SmallVectorImpl< SymbolRef > &Leaked, CheckerContext &Ctx, ExplodedNode *Pred=nullptr) const
ProgramStateRef updateSymbol(ProgramStateRef state, SymbolRef sym, RefVal V, ArgEffect E, RefVal::Kind &hasErr, CheckerContext &C) const
void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const
static const CheckerProgramPointTag & getDeallocSentTag()
std::unique_ptr< RetainSummaryManager > Summaries
void printState(raw_ostream &Out, ProgramStateRef State, const char *NL, const char *Sep) const override
See CheckerManager::runCheckersForPrintState.
bool evalCall(const CallEvent &Call, CheckerContext &C) const
void checkBeginFunction(CheckerContext &C) const
bool TrackOSObjects
Track sublcasses of OSObject.
void checkPostCall(const CallEvent &Call, CheckerContext &C) const
std::unique_ptr< RefCountBug > FreeNotOwned
std::unique_ptr< RefCountBug > LeakWithinFunction
ProgramStateRef checkRegionChanges(ProgramStateRef state, const InvalidatedSymbols *invalidated, ArrayRef< const MemRegion * > ExplicitRegions, ArrayRef< const MemRegion * > Regions, const LocationContext *LCtx, const CallEvent *Call) const
void processObjCLiterals(CheckerContext &C, const Expr *Ex) const
void checkEndFunction(const ReturnStmt *RS, CheckerContext &C) const
void processSummaryOfInlined(const RetainSummary &Summ, const CallEvent &Call, CheckerContext &C) const
std::unique_ptr< RefCountBug > ReturnNotOwnedForOwned
RetainSummaryManager & getSummaryManager(ASTContext &Ctx) const
bool TrackNSCFStartParam
Track initial parameters (for the entry point) for NS/CF objects.
std::unique_ptr< RefCountBug > UseAfterRelease
bool isCFObjectRef(QualType T)
const RefVal * getRefBinding(ProgramStateRef State, SymbolRef Sym)
bool isSynthesizedAccessor(const StackFrameContext *SFC)
Returns true if this stack frame is for an Objective-C method that is a property getter or setter who...
llvm::ImmutableMap< unsigned, ArgEffect > ArgEffects
ArgEffects summarizes the effects of a function/method call on all of its arguments.
ObjKind
Determines the object kind of a tracked object.
@ OS
Indicates that the tracking object is a descendant of a referenced-counted OSObject,...
@ Generalized
Indicates that the tracked object is a generalized object.
@ CF
Indicates that the tracked object is a CF object.
@ ObjC
Indicates that the tracked object is an Objective-C object.
llvm::DenseSet< SymbolRef > InvalidatedSymbols
@ IncRef
The argument has its reference count increased by 1.
@ UnretainedOutParameter
The argument is a pointer to a retain-counted object; on exit, the new value of the pointer is a +0 v...
@ DoNothing
There is no effect.
@ RetainedOutParameter
The argument is a pointer to a retain-counted object; on exit, the new value of the pointer is a +1 v...
@ RetainedOutParameterOnZero
The argument is a pointer to a retain-counted object; on exit, the new value of the pointer is a +1 v...
@ MayEscape
The argument is treated as potentially escaping, meaning that even when its reference count hits 0 it...
@ StopTracking
All typestate tracking of the object ceases.
@ Dealloc
The argument is treated as if the referenced object was deallocated.
@ Autorelease
The argument is treated as if an -autorelease message had been sent to the referenced object.
@ RetainedOutParameterOnNonZero
The argument is a pointer to a retain-counted object; on exit, the new value of the pointer is a +1 v...
@ DecRef
The argument has its reference count decreased by 1.
@ StopTrackingHard
All typestate tracking of the object ceases.
@ DecRefAndStopTrackingHard
Performs the combined functionality of DecRef and StopTrackingHard.
@ DecRefBridgedTransferred
The argument has its reference count decreased by 1 to model a transferred bridge cast under ARC.
The JSON file list parser is used to communicate input to InstallAPI.
@ OBC_Bridge
Bridging via __bridge, which does nothing but reinterpret the bits.
@ OBC_BridgeTransfer
Bridging via __bridge_transfer, which transfers ownership of an Objective-C pointer into ARC.
@ OBC_BridgeRetained
Bridging via __bridge_retain, which makes an ARC object available as a +1 C pointer.
const FunctionProtoType * T
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4