1// RetainCountDiagnostics.cpp - Checks for leaks and other issues -*- C++ -*--//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file defines diagnostics for RetainCountChecker, which implements
10// a reference count checker for Core Foundation and Cocoa on (Mac OS X).
11//
12//===----------------------------------------------------------------------===//
13
14#include "RetainCountDiagnostics.h"
15#include "RetainCountChecker.h"
16#include "llvm/ADT/STLExtras.h"
17#include "llvm/ADT/SmallVector.h"
18#include <optional>
19
20using namespace clang;
21using namespace ento;
22using namespace retaincountchecker;
23
24StringRef RefCountBug::bugTypeToName(RefCountBug::RefCountBugKind BT) {
25 switch (BT) {
26 case UseAfterRelease:
27 return "Use-after-release";
28 case ReleaseNotOwned:
29 return "Bad release";
30 case DeallocNotOwned:
31 return "-dealloc sent to non-exclusively owned object";
32 case FreeNotOwned:
33 return "freeing non-exclusively owned object";
34 case OverAutorelease:
35 return "Object autoreleased too many times";
36 case ReturnNotOwnedForOwned:
37 return "Method should return an owned object";
38 case LeakWithinFunction:
39 return "Leak";
40 case LeakAtReturn:
41 return "Leak of returned object";
42 }
43 llvm_unreachable("Unknown RefCountBugKind");
44}
45
46StringRef RefCountBug::getDescription() const {
47 switch (BT) {
48 case UseAfterRelease:
49 return "Reference-counted object is used after it is released";
50 case ReleaseNotOwned:
51 return "Incorrect decrement of the reference count of an object that is "
52 "not owned at this point by the caller";
53 case DeallocNotOwned:
54 return "-dealloc sent to object that may be referenced elsewhere";
55 case FreeNotOwned:
56 return "'free' called on an object that may be referenced elsewhere";
57 case OverAutorelease:
58 return "Object autoreleased too many times";
59 case ReturnNotOwnedForOwned:
60 return "Object with a +0 retain count returned to caller where a +1 "
61 "(owning) retain count is expected";
62 case LeakWithinFunction:
63 case LeakAtReturn:
64 return "";
65 }
66 llvm_unreachable("Unknown RefCountBugKind");
67}
68
69RefCountBug::RefCountBug(CheckerNameRef Checker, RefCountBugKind BT)
70 : BugType(Checker, bugTypeToName(BT), categories::MemoryRefCount,
71 /*SuppressOnSink=*/BT == LeakWithinFunction ||
72 BT == LeakAtReturn),
73 BT(BT) {}
74
75static bool isNumericLiteralExpression(const Expr *E) {
76 // FIXME: This set of cases was copied from SemaExprObjC.
77 return isa<IntegerLiteral, CharacterLiteral, FloatingLiteral,
78 ObjCBoolLiteralExpr, CXXBoolLiteralExpr>(Val: E);
79}
80
81/// If type represents a pointer to CXXRecordDecl,
82/// and is not a typedef, return the decl name.
83/// Otherwise, return the serialization of type.
84static std::string getPrettyTypeName(QualType QT) {
85 QualType PT = QT->getPointeeType();
86 if (!PT.isNull() && !QT->getAs<TypedefType>())
87 if (const auto *RD = PT->getAsCXXRecordDecl())
88 return std::string(RD->getName());
89 return QT.getAsString();
90}
91
92/// Write information about the type state change to @c os,
93/// return whether the note should be generated.
94static bool shouldGenerateNote(llvm::raw_string_ostream &os,
95 const RefVal *PrevT,
96 const RefVal &CurrV,
97 bool DeallocSent) {
98 // Get the previous type state.
99 RefVal PrevV = *PrevT;
100
101 // Specially handle -dealloc.
102 if (DeallocSent) {
103 // Determine if the object's reference count was pushed to zero.
104 assert(!PrevV.hasSameState(CurrV) && "The state should have changed.");
105 // We may not have transitioned to 'release' if we hit an error.
106 // This case is handled elsewhere.
107 if (CurrV.getKind() == RefVal::Released) {
108 assert(CurrV.getCombinedCounts() == 0);
109 os << "Object released by directly sending the '-dealloc' message";
110 return true;
111 }
112 }
113
114 // Determine if the typestate has changed.
115 if (!PrevV.hasSameState(X: CurrV))
116 switch (CurrV.getKind()) {
117 case RefVal::Owned:
118 case RefVal::NotOwned:
119 if (PrevV.getCount() == CurrV.getCount()) {
120 // Did an autorelease message get sent?
121 if (PrevV.getAutoreleaseCount() == CurrV.getAutoreleaseCount())
122 return false;
123
124 assert(PrevV.getAutoreleaseCount() < CurrV.getAutoreleaseCount());
125 os << "Object autoreleased";
126 return true;
127 }
128
129 if (PrevV.getCount() > CurrV.getCount())
130 os << "Reference count decremented.";
131 else
132 os << "Reference count incremented.";
133
134 if (unsigned Count = CurrV.getCount())
135 os << " The object now has a +" << Count << " retain count.";
136
137 return true;
138
139 case RefVal::Released:
140 if (CurrV.getIvarAccessHistory() ==
141 RefVal::IvarAccessHistory::ReleasedAfterDirectAccess &&
142 CurrV.getIvarAccessHistory() != PrevV.getIvarAccessHistory()) {
143 os << "Strong instance variable relinquished. ";
144 }
145 os << "Object released.";
146 return true;
147
148 case RefVal::ReturnedOwned:
149 // Autoreleases can be applied after marking a node ReturnedOwned.
150 if (CurrV.getAutoreleaseCount())
151 return false;
152
153 os << "Object returned to caller as an owning reference (single "
154 "retain count transferred to caller)";
155 return true;
156
157 case RefVal::ReturnedNotOwned:
158 os << "Object returned to caller with a +0 retain count";
159 return true;
160
161 default:
162 return false;
163 }
164 return true;
165}
166
167/// Finds argument index of the out paramter in the call @c S
168/// corresponding to the symbol @c Sym.
169/// If none found, returns std::nullopt.
170static std::optional<unsigned>
171findArgIdxOfSymbol(ProgramStateRef CurrSt, const LocationContext *LCtx,
172 SymbolRef &Sym, std::optional<CallEventRef<>> CE) {
173 if (!CE)
174 return std::nullopt;
175
176 for (unsigned Idx = 0; Idx < (*CE)->getNumArgs(); Idx++)
177 if (const MemRegion *MR = (*CE)->getArgSVal(Index: Idx).getAsRegion())
178 if (const auto *TR = dyn_cast<TypedValueRegion>(Val: MR))
179 if (CurrSt->getSVal(R: MR, T: TR->getValueType()).getAsSymbol() == Sym)
180 return Idx;
181
182 return std::nullopt;
183}
184
185static std::optional<std::string> findMetaClassAlloc(const Expr *Callee) {
186 if (const auto *ME = dyn_cast<MemberExpr>(Val: Callee)) {
187 if (ME->getMemberDecl()->getNameAsString() != "alloc")
188 return std::nullopt;
189 const Expr *This = ME->getBase()->IgnoreParenImpCasts();
190 if (const auto *DRE = dyn_cast<DeclRefExpr>(Val: This)) {
191 const ValueDecl *VD = DRE->getDecl();
192 if (VD->getNameAsString() != "metaClass")
193 return std::nullopt;
194
195 if (const auto *RD = dyn_cast<CXXRecordDecl>(Val: VD->getDeclContext()))
196 return RD->getNameAsString();
197
198 }
199 }
200 return std::nullopt;
201}
202
203static std::string findAllocatedObjectName(const Stmt *S, QualType QT) {
204 if (const auto *CE = dyn_cast<CallExpr>(Val: S))
205 if (auto Out = findMetaClassAlloc(Callee: CE->getCallee()))
206 return *Out;
207 return getPrettyTypeName(QT);
208}
209
210static void generateDiagnosticsForCallLike(ProgramStateRef CurrSt,
211 const LocationContext *LCtx,
212 const RefVal &CurrV, SymbolRef &Sym,
213 const Stmt *S,
214 llvm::raw_string_ostream &os) {
215 CallEventManager &Mgr = CurrSt->getStateManager().getCallEventManager();
216 if (const CallExpr *CE = dyn_cast<CallExpr>(Val: S)) {
217 // Get the name of the callee (if it is available)
218 // from the tracked SVal.
219 SVal X = CurrSt->getSValAsScalarOrLoc(S: CE->getCallee(), LCtx);
220 const FunctionDecl *FD = X.getAsFunctionDecl();
221
222 // If failed, try to get it from AST.
223 if (!FD)
224 FD = dyn_cast<FunctionDecl>(Val: CE->getCalleeDecl());
225
226 if (const auto *MD = dyn_cast<CXXMethodDecl>(Val: CE->getCalleeDecl())) {
227 os << "Call to method '" << MD->getQualifiedNameAsString() << '\'';
228 } else if (FD) {
229 os << "Call to function '" << FD->getQualifiedNameAsString() << '\'';
230 } else {
231 os << "function call";
232 }
233 } else if (isa<CXXNewExpr>(Val: S)) {
234 os << "Operator 'new'";
235 } else {
236 assert(isa<ObjCMessageExpr>(S));
237 CallEventRef<ObjCMethodCall> Call = Mgr.getObjCMethodCall(
238 E: cast<ObjCMessageExpr>(Val: S), State: CurrSt, LCtx, ElemRef: {nullptr, 0});
239
240 switch (Call->getMessageKind()) {
241 case OCM_Message:
242 os << "Method";
243 break;
244 case OCM_PropertyAccess:
245 os << "Property";
246 break;
247 case OCM_Subscript:
248 os << "Subscript";
249 break;
250 }
251 }
252
253 std::optional<CallEventRef<>> CE = Mgr.getCall(S, State: CurrSt, LC: LCtx, ElemRef: {nullptr, 0});
254 auto Idx = findArgIdxOfSymbol(CurrSt, LCtx, Sym, CE);
255
256 // If index is not found, we assume that the symbol was returned.
257 if (!Idx) {
258 os << " returns ";
259 } else {
260 os << " writes ";
261 }
262
263 if (CurrV.getObjKind() == ObjKind::CF) {
264 os << "a Core Foundation object of type '" << Sym->getType() << "' with a ";
265 } else if (CurrV.getObjKind() == ObjKind::OS) {
266 os << "an OSObject of type '" << findAllocatedObjectName(S, QT: Sym->getType())
267 << "' with a ";
268 } else if (CurrV.getObjKind() == ObjKind::Generalized) {
269 os << "an object of type '" << Sym->getType() << "' with a ";
270 } else {
271 assert(CurrV.getObjKind() == ObjKind::ObjC);
272 QualType T = Sym->getType();
273 if (!isa<ObjCObjectPointerType>(Val: T)) {
274 os << "an Objective-C object with a ";
275 } else {
276 const ObjCObjectPointerType *PT = cast<ObjCObjectPointerType>(Val&: T);
277 os << "an instance of " << PT->getPointeeType() << " with a ";
278 }
279 }
280
281 if (CurrV.isOwned()) {
282 os << "+1 retain count";
283 } else {
284 assert(CurrV.isNotOwned());
285 os << "+0 retain count";
286 }
287
288 if (Idx) {
289 os << " into an out parameter '";
290 const ParmVarDecl *PVD = (*CE)->parameters()[*Idx];
291 PVD->getNameForDiagnostic(OS&: os, Policy: PVD->getASTContext().getPrintingPolicy(),
292 /*Qualified=*/false);
293 os << "'";
294
295 QualType RT = (*CE)->getResultType();
296 if (!RT.isNull() && !RT->isVoidType()) {
297 SVal RV = (*CE)->getReturnValue();
298 if (CurrSt->isNull(V: RV).isConstrainedTrue()) {
299 os << " (assuming the call returns zero)";
300 } else if (CurrSt->isNonNull(V: RV).isConstrainedTrue()) {
301 os << " (assuming the call returns non-zero)";
302 }
303
304 }
305 }
306}
307
308namespace clang {
309namespace ento {
310namespace retaincountchecker {
311
312class RefCountReportVisitor : public BugReporterVisitor {
313protected:
314 SymbolRef Sym;
315
316public:
317 RefCountReportVisitor(SymbolRef sym) : Sym(sym) {}
318
319 void Profile(llvm::FoldingSetNodeID &ID) const override {
320 static int x = 0;
321 ID.AddPointer(Ptr: &x);
322 ID.AddPointer(Ptr: Sym);
323 }
324
325 PathDiagnosticPieceRef VisitNode(const ExplodedNode *N,
326 BugReporterContext &BRC,
327 PathSensitiveBugReport &BR) override;
328
329 PathDiagnosticPieceRef getEndPath(BugReporterContext &BRC,
330 const ExplodedNode *N,
331 PathSensitiveBugReport &BR) override;
332};
333
334class RefLeakReportVisitor : public RefCountReportVisitor {
335public:
336 RefLeakReportVisitor(SymbolRef Sym, const MemRegion *LastBinding)
337 : RefCountReportVisitor(Sym), LastBinding(LastBinding) {}
338
339 PathDiagnosticPieceRef getEndPath(BugReporterContext &BRC,
340 const ExplodedNode *N,
341 PathSensitiveBugReport &BR) override;
342
343private:
344 const MemRegion *LastBinding;
345};
346
347} // end namespace retaincountchecker
348} // end namespace ento
349} // end namespace clang
350
351
352/// Find the first node with the parent stack frame.
353static const ExplodedNode *getCalleeNode(const ExplodedNode *Pred) {
354 const StackFrameContext *SC = Pred->getStackFrame();
355 if (SC->inTopFrame())
356 return nullptr;
357 const StackFrameContext *PC = SC->getParent()->getStackFrame();
358 if (!PC)
359 return nullptr;
360
361 const ExplodedNode *N = Pred;
362 while (N && N->getStackFrame() != PC) {
363 N = N->getFirstPred();
364 }
365 return N;
366}
367
368
369/// Insert a diagnostic piece at function exit
370/// if a function parameter is annotated as "os_consumed",
371/// but it does not actually consume the reference.
372static std::shared_ptr<PathDiagnosticEventPiece>
373annotateConsumedSummaryMismatch(const ExplodedNode *N,
374 CallExitBegin &CallExitLoc,
375 const SourceManager &SM,
376 CallEventManager &CEMgr) {
377
378 const ExplodedNode *CN = getCalleeNode(Pred: N);
379 if (!CN)
380 return nullptr;
381
382 CallEventRef<> Call = CEMgr.getCaller(CalleeCtx: N->getStackFrame(), State: N->getState());
383
384 std::string sbuf;
385 llvm::raw_string_ostream os(sbuf);
386 ArrayRef<const ParmVarDecl *> Parameters = Call->parameters();
387 for (unsigned I=0; I < Call->getNumArgs() && I < Parameters.size(); ++I) {
388 const ParmVarDecl *PVD = Parameters[I];
389
390 if (!PVD->hasAttr<OSConsumedAttr>())
391 continue;
392
393 if (SymbolRef SR = Call->getArgSVal(Index: I).getAsLocSymbol()) {
394 const RefVal *CountBeforeCall = getRefBinding(State: CN->getState(), Sym: SR);
395 const RefVal *CountAtExit = getRefBinding(State: N->getState(), Sym: SR);
396
397 if (!CountBeforeCall || !CountAtExit)
398 continue;
399
400 unsigned CountBefore = CountBeforeCall->getCount();
401 unsigned CountAfter = CountAtExit->getCount();
402
403 bool AsExpected = CountBefore > 0 && CountAfter == CountBefore - 1;
404 if (!AsExpected) {
405 os << "Parameter '";
406 PVD->getNameForDiagnostic(OS&: os, Policy: PVD->getASTContext().getPrintingPolicy(),
407 /*Qualified=*/false);
408 os << "' is marked as consuming, but the function did not consume "
409 << "the reference\n";
410 }
411 }
412 }
413
414 if (sbuf.empty())
415 return nullptr;
416
417 PathDiagnosticLocation L = PathDiagnosticLocation::create(P: CallExitLoc, SMng: SM);
418 return std::make_shared<PathDiagnosticEventPiece>(args&: L, args&: sbuf);
419}
420
421/// Annotate the parameter at the analysis entry point.
422static std::shared_ptr<PathDiagnosticEventPiece>
423annotateStartParameter(const ExplodedNode *N, SymbolRef Sym,
424 const SourceManager &SM) {
425 auto PP = N->getLocationAs<BlockEdge>();
426 if (!PP)
427 return nullptr;
428
429 const CFGBlock *Src = PP->getSrc();
430 const RefVal *CurrT = getRefBinding(State: N->getState(), Sym);
431
432 if (&Src->getParent()->getEntry() != Src || !CurrT ||
433 getRefBinding(State: N->getFirstPred()->getState(), Sym))
434 return nullptr;
435
436 const auto *VR = cast<VarRegion>(Val: cast<SymbolRegionValue>(Val: Sym)->getRegion());
437 const auto *PVD = cast<ParmVarDecl>(Val: VR->getDecl());
438 PathDiagnosticLocation L = PathDiagnosticLocation(PVD, SM);
439
440 std::string s;
441 llvm::raw_string_ostream os(s);
442 os << "Parameter '" << PVD->getDeclName() << "' starts at +";
443 if (CurrT->getCount() == 1) {
444 os << "1, as it is marked as consuming";
445 } else {
446 assert(CurrT->getCount() == 0);
447 os << "0";
448 }
449 return std::make_shared<PathDiagnosticEventPiece>(args&: L, args&: s);
450}
451
452PathDiagnosticPieceRef
453RefCountReportVisitor::VisitNode(const ExplodedNode *N, BugReporterContext &BRC,
454 PathSensitiveBugReport &BR) {
455
456 const auto &BT = static_cast<const RefCountBug&>(BR.getBugType());
457
458 bool IsFreeUnowned = BT.getBugType() == RefCountBug::FreeNotOwned ||
459 BT.getBugType() == RefCountBug::DeallocNotOwned;
460
461 const SourceManager &SM = BRC.getSourceManager();
462 CallEventManager &CEMgr = BRC.getStateManager().getCallEventManager();
463 if (auto CE = N->getLocationAs<CallExitBegin>())
464 if (auto PD = annotateConsumedSummaryMismatch(N, CallExitLoc&: *CE, SM, CEMgr))
465 return PD;
466
467 if (auto PD = annotateStartParameter(N, Sym, SM))
468 return PD;
469
470 // FIXME: We will eventually need to handle non-statement-based events
471 // (__attribute__((cleanup))).
472 if (!N->getLocation().getAs<StmtPoint>())
473 return nullptr;
474
475 // Check if the type state has changed.
476 const ExplodedNode *PrevNode = N->getFirstPred();
477 ProgramStateRef PrevSt = PrevNode->getState();
478 ProgramStateRef CurrSt = N->getState();
479 const LocationContext *LCtx = N->getLocationContext();
480
481 const RefVal* CurrT = getRefBinding(State: CurrSt, Sym);
482 if (!CurrT)
483 return nullptr;
484
485 const RefVal &CurrV = *CurrT;
486 const RefVal *PrevT = getRefBinding(State: PrevSt, Sym);
487
488 // Create a string buffer to constain all the useful things we want
489 // to tell the user.
490 std::string sbuf;
491 llvm::raw_string_ostream os(sbuf);
492
493 if (PrevT && IsFreeUnowned && CurrV.isNotOwned() && PrevT->isOwned()) {
494 os << "Object is now not exclusively owned";
495 auto Pos = PathDiagnosticLocation::create(P: N->getLocation(), SMng: SM);
496 return std::make_shared<PathDiagnosticEventPiece>(args&: Pos, args&: sbuf);
497 }
498
499 // This is the allocation site since the previous node had no bindings
500 // for this symbol.
501 if (!PrevT) {
502 const Stmt *S = N->getLocation().castAs<StmtPoint>().getStmt();
503
504 if (isa<ObjCIvarRefExpr>(Val: S) &&
505 isSynthesizedAccessor(SFC: LCtx->getStackFrame())) {
506 S = LCtx->getStackFrame()->getCallSite();
507 }
508
509 if (isa<ObjCArrayLiteral>(Val: S)) {
510 os << "NSArray literal is an object with a +0 retain count";
511 } else if (isa<ObjCDictionaryLiteral>(Val: S)) {
512 os << "NSDictionary literal is an object with a +0 retain count";
513 } else if (const ObjCBoxedExpr *BL = dyn_cast<ObjCBoxedExpr>(Val: S)) {
514 if (isNumericLiteralExpression(E: BL->getSubExpr()))
515 os << "NSNumber literal is an object with a +0 retain count";
516 else {
517 const ObjCInterfaceDecl *BoxClass = nullptr;
518 if (const ObjCMethodDecl *Method = BL->getBoxingMethod())
519 BoxClass = Method->getClassInterface();
520
521 // We should always be able to find the boxing class interface,
522 // but consider this future-proofing.
523 if (BoxClass) {
524 os << *BoxClass << " b";
525 } else {
526 os << "B";
527 }
528
529 os << "oxed expression produces an object with a +0 retain count";
530 }
531 } else if (isa<ObjCIvarRefExpr>(Val: S)) {
532 os << "Object loaded from instance variable";
533 } else {
534 generateDiagnosticsForCallLike(CurrSt, LCtx, CurrV, Sym, S, os);
535 }
536
537 PathDiagnosticLocation Pos(S, SM, N->getLocationContext());
538 return std::make_shared<PathDiagnosticEventPiece>(args&: Pos, args&: sbuf);
539 }
540
541 // Gather up the effects that were performed on the object at this
542 // program point
543 bool DeallocSent = false;
544
545 const ProgramPointTag *Tag = N->getLocation().getTag();
546
547 if (Tag == &RetainCountChecker::getCastFailTag()) {
548 os << "Assuming dynamic cast returns null due to type mismatch";
549 }
550
551 if (Tag == &RetainCountChecker::getDeallocSentTag()) {
552 // We only have summaries attached to nodes after evaluating CallExpr and
553 // ObjCMessageExprs.
554 const Stmt *S = N->getLocation().castAs<StmtPoint>().getStmt();
555
556 if (const CallExpr *CE = dyn_cast<CallExpr>(Val: S)) {
557 // Iterate through the parameter expressions and see if the symbol
558 // was ever passed as an argument.
559 unsigned i = 0;
560
561 for (auto AI=CE->arg_begin(), AE=CE->arg_end(); AI!=AE; ++AI, ++i) {
562
563 // Retrieve the value of the argument. Is it the symbol
564 // we are interested in?
565 if (CurrSt->getSValAsScalarOrLoc(S: *AI, LCtx).getAsLocSymbol() != Sym)
566 continue;
567
568 // We have an argument. Get the effect!
569 DeallocSent = true;
570 }
571 } else if (const ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(Val: S)) {
572 if (const Expr *receiver = ME->getInstanceReceiver()) {
573 if (CurrSt->getSValAsScalarOrLoc(S: receiver, LCtx)
574 .getAsLocSymbol() == Sym) {
575 // The symbol we are tracking is the receiver.
576 DeallocSent = true;
577 }
578 }
579 }
580 }
581
582 if (!shouldGenerateNote(os, PrevT, CurrV, DeallocSent))
583 return nullptr;
584
585 if (sbuf.empty())
586 return nullptr; // We have nothing to say!
587
588 const Stmt *S = N->getLocation().castAs<StmtPoint>().getStmt();
589 PathDiagnosticLocation Pos(S, BRC.getSourceManager(),
590 N->getLocationContext());
591 auto P = std::make_shared<PathDiagnosticEventPiece>(args&: Pos, args&: sbuf);
592
593 // Add the range by scanning the children of the statement for any bindings
594 // to Sym.
595 for (const Stmt *Child : S->children())
596 if (const Expr *Exp = dyn_cast_or_null<Expr>(Val: Child))
597 if (CurrSt->getSValAsScalarOrLoc(S: Exp, LCtx).getAsLocSymbol() == Sym) {
598 P->addRange(R: Exp->getSourceRange());
599 break;
600 }
601
602 return std::move(P);
603}
604
605static std::optional<std::string> describeRegion(const MemRegion *MR) {
606 if (const auto *VR = dyn_cast_or_null<VarRegion>(Val: MR))
607 return std::string(VR->getDecl()->getName());
608 // Once we support more storage locations for bindings,
609 // this would need to be improved.
610 return std::nullopt;
611}
612
613using Bindings = llvm::SmallVector<std::pair<const MemRegion *, SVal>, 4>;
614
615namespace {
616class VarBindingsCollector : public StoreManager::BindingsHandler {
617 SymbolRef Sym;
618 Bindings &Result;
619
620public:
621 VarBindingsCollector(SymbolRef Sym, Bindings &ToFill)
622 : Sym(Sym), Result(ToFill) {}
623
624 bool HandleBinding(StoreManager &SMgr, Store Store, const MemRegion *R,
625 SVal Val) override {
626 SymbolRef SymV = Val.getAsLocSymbol();
627 if (!SymV || SymV != Sym)
628 return true;
629
630 if (isa<NonParamVarRegion>(Val: R))
631 Result.emplace_back(Args&: R, Args&: Val);
632
633 return true;
634 }
635};
636} // namespace
637
638static Bindings getAllVarBindingsForSymbol(ProgramStateManager &Manager,
639 const ExplodedNode *Node,
640 SymbolRef Sym) {
641 Bindings Result;
642 VarBindingsCollector Collector{Sym, Result};
643 while (Result.empty() && Node) {
644 Manager.iterBindings(state: Node->getState(), F&: Collector);
645 Node = Node->getFirstPred();
646 }
647
648 return Result;
649}
650
651namespace {
652// Find the first node in the current function context that referred to the
653// tracked symbol and the memory location that value was stored to. Note, the
654// value is only reported if the allocation occurred in the same function as
655// the leak. The function can also return a location context, which should be
656// treated as interesting.
657struct AllocationInfo {
658 const ExplodedNode* N;
659 const MemRegion *R;
660 const LocationContext *InterestingMethodContext;
661 AllocationInfo(const ExplodedNode *InN,
662 const MemRegion *InR,
663 const LocationContext *InInterestingMethodContext) :
664 N(InN), R(InR), InterestingMethodContext(InInterestingMethodContext) {}
665};
666} // end anonymous namespace
667
668static AllocationInfo GetAllocationSite(ProgramStateManager &StateMgr,
669 const ExplodedNode *N, SymbolRef Sym) {
670 const ExplodedNode *AllocationNode = N;
671 const ExplodedNode *AllocationNodeInCurrentOrParentContext = N;
672 const MemRegion *FirstBinding = nullptr;
673 const LocationContext *LeakContext = N->getLocationContext();
674
675 // The location context of the init method called on the leaked object, if
676 // available.
677 const LocationContext *InitMethodContext = nullptr;
678
679 while (N) {
680 ProgramStateRef St = N->getState();
681 const LocationContext *NContext = N->getLocationContext();
682
683 if (!getRefBinding(State: St, Sym))
684 break;
685
686 StoreManager::FindUniqueBinding FB(Sym);
687 StateMgr.iterBindings(state: St, F&: FB);
688
689 if (FB) {
690 const MemRegion *R = FB.getRegion();
691 // Do not show local variables belonging to a function other than
692 // where the error is reported.
693 if (const auto *MR = R->getMemorySpaceAs<StackSpaceRegion>(State: St))
694 if (MR->getStackFrame() == LeakContext->getStackFrame())
695 FirstBinding = R;
696 }
697
698 // AllocationNode is the last node in which the symbol was tracked.
699 AllocationNode = N;
700
701 // AllocationNodeInCurrentContext, is the last node in the current or
702 // parent context in which the symbol was tracked.
703 //
704 // Note that the allocation site might be in the parent context. For example,
705 // the case where an allocation happens in a block that captures a reference
706 // to it and that reference is overwritten/dropped by another call to
707 // the block.
708 if (NContext == LeakContext || NContext->isParentOf(LC: LeakContext))
709 AllocationNodeInCurrentOrParentContext = N;
710
711 // Find the last init that was called on the given symbol and store the
712 // init method's location context.
713 if (!InitMethodContext)
714 if (auto CEP = N->getLocation().getAs<CallEnter>()) {
715 const Stmt *CE = CEP->getCallExpr();
716 if (const auto *ME = dyn_cast_or_null<ObjCMessageExpr>(Val: CE)) {
717 const Stmt *RecExpr = ME->getInstanceReceiver();
718 if (RecExpr) {
719 SVal RecV = St->getSVal(Ex: RecExpr, LCtx: NContext);
720 if (ME->getMethodFamily() == OMF_init && RecV.getAsSymbol() == Sym)
721 InitMethodContext = CEP->getCalleeContext();
722 }
723 }
724 }
725
726 N = N->getFirstPred();
727 }
728
729 // If we are reporting a leak of the object that was allocated with alloc,
730 // mark its init method as interesting.
731 const LocationContext *InterestingMethodContext = nullptr;
732 if (InitMethodContext) {
733 const ProgramPoint AllocPP = AllocationNode->getLocation();
734 if (std::optional<StmtPoint> SP = AllocPP.getAs<StmtPoint>())
735 if (const ObjCMessageExpr *ME = SP->getStmtAs<ObjCMessageExpr>())
736 if (ME->getMethodFamily() == OMF_alloc)
737 InterestingMethodContext = InitMethodContext;
738 }
739
740 // If allocation happened in a function different from the leak node context,
741 // do not report the binding.
742 assert(N && "Could not find allocation node");
743
744 if (AllocationNodeInCurrentOrParentContext &&
745 AllocationNodeInCurrentOrParentContext->getLocationContext() !=
746 LeakContext)
747 FirstBinding = nullptr;
748
749 return AllocationInfo(AllocationNodeInCurrentOrParentContext, FirstBinding,
750 InterestingMethodContext);
751}
752
753PathDiagnosticPieceRef
754RefCountReportVisitor::getEndPath(BugReporterContext &BRC,
755 const ExplodedNode *EndN,
756 PathSensitiveBugReport &BR) {
757 BR.markInteresting(sym: Sym);
758 return BugReporterVisitor::getDefaultEndPath(BRC, N: EndN, BR);
759}
760
761PathDiagnosticPieceRef
762RefLeakReportVisitor::getEndPath(BugReporterContext &BRC,
763 const ExplodedNode *EndN,
764 PathSensitiveBugReport &BR) {
765
766 // Tell the BugReporterContext to report cases when the tracked symbol is
767 // assigned to different variables, etc.
768 BR.markInteresting(sym: Sym);
769
770 PathDiagnosticLocation L = cast<RefLeakReport>(Val&: BR).getEndOfPath();
771
772 std::string sbuf;
773 llvm::raw_string_ostream os(sbuf);
774
775 os << "Object leaked: ";
776
777 std::optional<std::string> RegionDescription = describeRegion(MR: LastBinding);
778 if (RegionDescription) {
779 os << "object allocated and stored into '" << *RegionDescription << '\'';
780 } else {
781 os << "allocated object of type '" << getPrettyTypeName(QT: Sym->getType())
782 << "'";
783 }
784
785 // Get the retain count.
786 const RefVal *RV = getRefBinding(State: EndN->getState(), Sym);
787 assert(RV);
788
789 if (RV->getKind() == RefVal::ErrorLeakReturned) {
790 const Decl *D = &EndN->getCodeDecl();
791
792 os << (isa<ObjCMethodDecl>(Val: D) ? " is returned from a method "
793 : " is returned from a function ");
794
795 if (D->hasAttr<CFReturnsNotRetainedAttr>()) {
796 os << "that is annotated as CF_RETURNS_NOT_RETAINED";
797 } else if (D->hasAttr<NSReturnsNotRetainedAttr>()) {
798 os << "that is annotated as NS_RETURNS_NOT_RETAINED";
799 } else if (D->hasAttr<OSReturnsNotRetainedAttr>()) {
800 os << "that is annotated as OS_RETURNS_NOT_RETAINED";
801 } else {
802 if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(Val: D)) {
803 if (BRC.getASTContext().getLangOpts().ObjCAutoRefCount) {
804 os << "managed by Automatic Reference Counting";
805 } else {
806 os << "whose name ('" << MD->getSelector().getAsString()
807 << "') does not start with "
808 "'copy', 'mutableCopy', 'alloc' or 'new'."
809 " This violates the naming convention rules"
810 " given in the Memory Management Guide for Cocoa";
811 }
812 } else {
813 const FunctionDecl *FD = cast<FunctionDecl>(Val: D);
814 ObjKind K = RV->getObjKind();
815 if (K == ObjKind::ObjC || K == ObjKind::CF) {
816 os << "whose name ('" << *FD
817 << "') does not contain 'Copy' or 'Create'. This violates the "
818 "naming"
819 " convention rules given in the Memory Management Guide for "
820 "Core"
821 " Foundation";
822 } else if (RV->getObjKind() == ObjKind::OS) {
823 std::string FuncName = FD->getNameAsString();
824 os << "whose name ('" << FuncName << "') starts with '"
825 << StringRef(FuncName).substr(Start: 0, N: 3) << "'";
826 }
827 }
828 }
829 } else {
830 os << " is not referenced later in this execution path and has a retain "
831 "count of +"
832 << RV->getCount();
833 }
834
835 return std::make_shared<PathDiagnosticEventPiece>(args&: L, args&: sbuf);
836}
837
838RefCountReport::RefCountReport(const RefCountBug &D, const LangOptions &LOpts,
839 ExplodedNode *n, SymbolRef sym, bool isLeak)
840 : PathSensitiveBugReport(D, D.getDescription(), n), Sym(sym),
841 isLeak(isLeak) {
842 if (!isLeak)
843 addVisitor<RefCountReportVisitor>(ConstructorArgs&: sym);
844}
845
846RefCountReport::RefCountReport(const RefCountBug &D, const LangOptions &LOpts,
847 ExplodedNode *n, SymbolRef sym,
848 StringRef endText)
849 : PathSensitiveBugReport(D, D.getDescription(), endText, n) {
850
851 addVisitor<RefCountReportVisitor>(ConstructorArgs&: sym);
852}
853
854void RefLeakReport::deriveParamLocation(CheckerContext &Ctx) {
855 const SourceManager &SMgr = Ctx.getSourceManager();
856
857 if (!Sym->getOriginRegion())
858 return;
859
860 auto *Region = dyn_cast<DeclRegion>(Val: Sym->getOriginRegion());
861 if (Region) {
862 const Decl *PDecl = Region->getDecl();
863 if (isa_and_nonnull<ParmVarDecl>(Val: PDecl)) {
864 PathDiagnosticLocation ParamLocation =
865 PathDiagnosticLocation::create(D: PDecl, SM: SMgr);
866 Location = ParamLocation;
867 UniqueingLocation = ParamLocation;
868 UniqueingDecl = Ctx.getLocationContext()->getDecl();
869 }
870 }
871}
872
873void RefLeakReport::deriveAllocLocation(CheckerContext &Ctx) {
874 // Most bug reports are cached at the location where they occurred.
875 // With leaks, we want to unique them by the location where they were
876 // allocated, and only report a single path. To do this, we need to find
877 // the allocation site of a piece of tracked memory, which we do via a
878 // call to GetAllocationSite. This will walk the ExplodedGraph backwards.
879 // Note that this is *not* the trimmed graph; we are guaranteed, however,
880 // that all ancestor nodes that represent the allocation site have the
881 // same SourceLocation.
882 const ExplodedNode *AllocNode = nullptr;
883
884 const SourceManager &SMgr = Ctx.getSourceManager();
885
886 AllocationInfo AllocI =
887 GetAllocationSite(StateMgr&: Ctx.getStateManager(), N: getErrorNode(), Sym);
888
889 AllocNode = AllocI.N;
890 AllocFirstBinding = AllocI.R;
891 markInteresting(LC: AllocI.InterestingMethodContext);
892
893 // Get the SourceLocation for the allocation site.
894 // FIXME: This will crash the analyzer if an allocation comes from an
895 // implicit call (ex: a destructor call).
896 // (Currently there are no such allocations in Cocoa, though.)
897 AllocStmt = AllocNode->getStmtForDiagnostics();
898
899 if (!AllocStmt) {
900 AllocFirstBinding = nullptr;
901 return;
902 }
903
904 PathDiagnosticLocation AllocLocation = PathDiagnosticLocation::createBegin(
905 S: AllocStmt, SM: SMgr, LAC: AllocNode->getLocationContext());
906 Location = AllocLocation;
907
908 // Set uniqieing info, which will be used for unique the bug reports. The
909 // leaks should be uniqued on the allocation site.
910 UniqueingLocation = AllocLocation;
911 UniqueingDecl = AllocNode->getLocationContext()->getDecl();
912}
913
914void RefLeakReport::createDescription(CheckerContext &Ctx) {
915 assert(Location.isValid() && UniqueingDecl && UniqueingLocation.isValid());
916 Description.clear();
917 llvm::raw_string_ostream os(Description);
918 os << "Potential leak of an object";
919
920 std::optional<std::string> RegionDescription =
921 describeRegion(MR: AllocBindingToReport);
922 if (RegionDescription) {
923 os << " stored into '" << *RegionDescription << '\'';
924 } else {
925
926 // If we can't figure out the name, just supply the type information.
927 os << " of type '" << getPrettyTypeName(QT: Sym->getType()) << "'";
928 }
929}
930
931void RefLeakReport::findBindingToReport(CheckerContext &Ctx,
932 ExplodedNode *Node) {
933 if (!AllocFirstBinding)
934 // If we don't have any bindings, we won't be able to find any
935 // better binding to report.
936 return;
937
938 // If the original region still contains the leaking symbol...
939 if (Node->getState()->getSVal(R: AllocFirstBinding).getAsSymbol() == Sym) {
940 // ...it is the best binding to report.
941 AllocBindingToReport = AllocFirstBinding;
942 return;
943 }
944
945 // At this point, we know that the original region doesn't contain the leaking
946 // when the actual leak happens. It means that it can be confusing for the
947 // user to see such description in the message.
948 //
949 // Let's consider the following example:
950 // Object *Original = allocate(...);
951 // Object *New = Original;
952 // Original = allocate(...);
953 // Original->release();
954 //
955 // Complaining about a leaking object "stored into Original" might cause a
956 // rightful confusion because 'Original' is actually released.
957 // We should complain about 'New' instead.
958 Bindings AllVarBindings =
959 getAllVarBindingsForSymbol(Manager&: Ctx.getStateManager(), Node, Sym);
960
961 // While looking for the last var bindings, we can still find
962 // `AllocFirstBinding` to be one of them. In situations like this,
963 // it would still be the easiest case to explain to our users.
964 if (!AllVarBindings.empty() &&
965 !llvm::is_contained(Range: llvm::make_first_range(c&: AllVarBindings),
966 Element: AllocFirstBinding)) {
967 // Let's pick one of them at random (if there is something to pick from).
968 AllocBindingToReport = AllVarBindings[0].first;
969
970 // Because 'AllocBindingToReport' is not the same as
971 // 'AllocFirstBinding', we need to explain how the leaking object
972 // got from one to another.
973 //
974 // NOTE: We use the actual SVal stored in AllocBindingToReport here because
975 // trackStoredValue compares SVal's and it can get trickier for
976 // something like derived regions if we want to construct SVal from
977 // Sym. Instead, we take the value that is definitely stored in that
978 // region, thus guaranteeing that trackStoredValue will work.
979 bugreporter::trackStoredValue(V: AllVarBindings[0].second,
980 R: AllocBindingToReport, Report&: *this);
981 } else {
982 AllocBindingToReport = AllocFirstBinding;
983 }
984}
985
986RefLeakReport::RefLeakReport(const RefCountBug &D, const LangOptions &LOpts,
987 ExplodedNode *N, SymbolRef Sym,
988 CheckerContext &Ctx)
989 : RefCountReport(D, LOpts, N, Sym, /*isLeak=*/true) {
990
991 deriveAllocLocation(Ctx);
992 findBindingToReport(Ctx, Node: N);
993
994 if (!AllocFirstBinding)
995 deriveParamLocation(Ctx);
996
997 createDescription(Ctx);
998
999 addVisitor<RefLeakReportVisitor>(ConstructorArgs&: Sym, ConstructorArgs&: AllocBindingToReport);
1000}
1001