1// RetainCountDiagnostics.cpp - Checks for leaks and other issues -*- C++ -*--//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file defines diagnostics for RetainCountChecker, which implements
10// a reference count checker for Core Foundation and Cocoa on (Mac OS X).
11//
12//===----------------------------------------------------------------------===//
13
14#include "RetainCountDiagnostics.h"
15#include "RetainCountChecker.h"
16#include "llvm/ADT/STLExtras.h"
17#include "llvm/ADT/SmallVector.h"
18#include <optional>
19
20using namespace clang;
21using namespace ento;
22using namespace retaincountchecker;
23
24static bool isNumericLiteralExpression(const Expr *E) {
25 // FIXME: This set of cases was copied from SemaExprObjC.
26 return isa<IntegerLiteral, CharacterLiteral, FloatingLiteral,
27 ObjCBoolLiteralExpr, CXXBoolLiteralExpr>(Val: E);
28}
29
30/// If type represents a pointer to CXXRecordDecl,
31/// and is not a typedef, return the decl name.
32/// Otherwise, return the serialization of type.
33static std::string getPrettyTypeName(QualType QT) {
34 QualType PT = QT->getPointeeType();
35 if (!PT.isNull() && !QT->getAs<TypedefType>())
36 if (const auto *RD = PT->getAsCXXRecordDecl())
37 return std::string(RD->getName());
38 return QT.getAsString();
39}
40
41/// Write information about the type state change to @c os,
42/// return whether the note should be generated.
43static bool shouldGenerateNote(llvm::raw_string_ostream &os,
44 const RefVal *PrevT,
45 const RefVal &CurrV,
46 bool DeallocSent) {
47 // Get the previous type state.
48 RefVal PrevV = *PrevT;
49
50 // Specially handle -dealloc.
51 if (DeallocSent) {
52 // Determine if the object's reference count was pushed to zero.
53 assert(!PrevV.hasSameState(CurrV) && "The state should have changed.");
54 // We may not have transitioned to 'release' if we hit an error.
55 // This case is handled elsewhere.
56 if (CurrV.getKind() == RefVal::Released) {
57 assert(CurrV.getCombinedCounts() == 0);
58 os << "Object released by directly sending the '-dealloc' message";
59 return true;
60 }
61 }
62
63 // Determine if the typestate has changed.
64 if (!PrevV.hasSameState(X: CurrV))
65 switch (CurrV.getKind()) {
66 case RefVal::Owned:
67 case RefVal::NotOwned:
68 if (PrevV.getCount() == CurrV.getCount()) {
69 // Did an autorelease message get sent?
70 if (PrevV.getAutoreleaseCount() == CurrV.getAutoreleaseCount())
71 return false;
72
73 assert(PrevV.getAutoreleaseCount() < CurrV.getAutoreleaseCount());
74 os << "Object autoreleased";
75 return true;
76 }
77
78 if (PrevV.getCount() > CurrV.getCount())
79 os << "Reference count decremented.";
80 else
81 os << "Reference count incremented.";
82
83 if (unsigned Count = CurrV.getCount())
84 os << " The object now has a +" << Count << " retain count.";
85
86 return true;
87
88 case RefVal::Released:
89 if (CurrV.getIvarAccessHistory() ==
90 RefVal::IvarAccessHistory::ReleasedAfterDirectAccess &&
91 CurrV.getIvarAccessHistory() != PrevV.getIvarAccessHistory()) {
92 os << "Strong instance variable relinquished. ";
93 }
94 os << "Object released.";
95 return true;
96
97 case RefVal::ReturnedOwned:
98 // Autoreleases can be applied after marking a node ReturnedOwned.
99 if (CurrV.getAutoreleaseCount())
100 return false;
101
102 os << "Object returned to caller as an owning reference (single "
103 "retain count transferred to caller)";
104 return true;
105
106 case RefVal::ReturnedNotOwned:
107 os << "Object returned to caller with a +0 retain count";
108 return true;
109
110 default:
111 return false;
112 }
113 return true;
114}
115
116/// Finds argument index of the out paramter in the call @c S
117/// corresponding to the symbol @c Sym.
118/// If none found, returns std::nullopt.
119static std::optional<unsigned>
120findArgIdxOfSymbol(ProgramStateRef CurrSt, const StackFrame *SF, SymbolRef &Sym,
121 std::optional<CallEventRef<>> CE) {
122 if (!CE)
123 return std::nullopt;
124
125 for (unsigned Idx = 0; Idx < (*CE)->getNumArgs(); Idx++)
126 if (const MemRegion *MR = (*CE)->getArgSVal(Index: Idx).getAsRegion())
127 if (const auto *TR = dyn_cast<TypedValueRegion>(Val: MR))
128 if (CurrSt->getSVal(R: MR, T: TR->getValueType()).getAsSymbol() == Sym)
129 return Idx;
130
131 return std::nullopt;
132}
133
134static std::optional<std::string> findMetaClassAlloc(const Expr *Callee) {
135 if (const auto *ME = dyn_cast<MemberExpr>(Val: Callee)) {
136 if (ME->getMemberDecl()->getNameAsString() != "alloc")
137 return std::nullopt;
138 const Expr *This = ME->getBase()->IgnoreParenImpCasts();
139 if (const auto *DRE = dyn_cast<DeclRefExpr>(Val: This)) {
140 const ValueDecl *VD = DRE->getDecl();
141 if (VD->getNameAsString() != "metaClass")
142 return std::nullopt;
143
144 if (const auto *RD = dyn_cast<CXXRecordDecl>(Val: VD->getDeclContext()))
145 return RD->getNameAsString();
146
147 }
148 }
149 return std::nullopt;
150}
151
152static std::string findAllocatedObjectName(const Stmt *S, QualType QT) {
153 if (const auto *CE = dyn_cast<CallExpr>(Val: S))
154 if (auto Out = findMetaClassAlloc(Callee: CE->getCallee()))
155 return *Out;
156 return getPrettyTypeName(QT);
157}
158
159static void generateDiagnosticsForCallLike(ProgramStateRef CurrSt,
160 const StackFrame *SF,
161 const RefVal &CurrV, SymbolRef &Sym,
162 const Stmt *S,
163 llvm::raw_string_ostream &os) {
164 CallEventManager &Mgr = CurrSt->getStateManager().getCallEventManager();
165 if (const CallExpr *CE = dyn_cast<CallExpr>(Val: S)) {
166 // Get the name of the callee (if it is available)
167 // from the tracked SVal.
168 SVal X = CurrSt->getSValAsScalarOrLoc(E: CE->getCallee(), SF);
169 const FunctionDecl *FD = X.getAsFunctionDecl();
170
171 // If failed, try to get it from AST.
172 if (!FD)
173 FD = dyn_cast<FunctionDecl>(Val: CE->getCalleeDecl());
174
175 if (const auto *MD = dyn_cast<CXXMethodDecl>(Val: CE->getCalleeDecl())) {
176 os << "Call to method '" << MD->getQualifiedNameAsString() << '\'';
177 } else if (FD) {
178 os << "Call to function '" << FD->getQualifiedNameAsString() << '\'';
179 } else {
180 os << "function call";
181 }
182 } else if (isa<CXXNewExpr>(Val: S)) {
183 os << "Operator 'new'";
184 } else {
185 assert(isa<ObjCMessageExpr>(S));
186 CallEventRef<ObjCMethodCall> Call = Mgr.getObjCMethodCall(
187 E: cast<ObjCMessageExpr>(Val: S), State: CurrSt, SF, ElemRef: {nullptr, 0});
188
189 switch (Call->getMessageKind()) {
190 case OCM_Message:
191 os << "Method";
192 break;
193 case OCM_PropertyAccess:
194 os << "Property";
195 break;
196 case OCM_Subscript:
197 os << "Subscript";
198 break;
199 }
200 }
201
202 std::optional<CallEventRef<>> CE = Mgr.getCall(S, State: CurrSt, SF, ElemRef: {nullptr, 0});
203 auto Idx = findArgIdxOfSymbol(CurrSt, SF, Sym, CE);
204
205 // If index is not found, we assume that the symbol was returned.
206 if (!Idx) {
207 os << " returns ";
208 } else {
209 os << " writes ";
210 }
211
212 if (CurrV.getObjKind() == ObjKind::CF) {
213 os << "a Core Foundation object of type '" << Sym->getType() << "' with a ";
214 } else if (CurrV.getObjKind() == ObjKind::OS) {
215 os << "an OSObject of type '" << findAllocatedObjectName(S, QT: Sym->getType())
216 << "' with a ";
217 } else if (CurrV.getObjKind() == ObjKind::Generalized) {
218 os << "an object of type '" << Sym->getType() << "' with a ";
219 } else {
220 assert(CurrV.getObjKind() == ObjKind::ObjC);
221 QualType T = Sym->getType();
222 if (!isa<ObjCObjectPointerType>(Val: T)) {
223 os << "an Objective-C object with a ";
224 } else {
225 const ObjCObjectPointerType *PT = cast<ObjCObjectPointerType>(Val&: T);
226 os << "an instance of " << PT->getPointeeType() << " with a ";
227 }
228 }
229
230 if (CurrV.isOwned()) {
231 os << "+1 retain count";
232 } else {
233 assert(CurrV.isNotOwned());
234 os << "+0 retain count";
235 }
236
237 if (Idx) {
238 os << " into an out parameter '";
239 const ParmVarDecl *PVD = (*CE)->parameters()[*Idx];
240 PVD->getNameForDiagnostic(OS&: os, Policy: PVD->getASTContext().getPrintingPolicy(),
241 /*Qualified=*/false);
242 os << "'";
243
244 QualType RT = (*CE)->getResultType();
245 if (!RT.isNull() && !RT->isVoidType()) {
246 SVal RV = (*CE)->getReturnValue();
247 if (CurrSt->isNull(V: RV).isConstrainedTrue()) {
248 os << " (assuming the call returns zero)";
249 } else if (CurrSt->isNonNull(V: RV).isConstrainedTrue()) {
250 os << " (assuming the call returns non-zero)";
251 }
252
253 }
254 }
255}
256
257namespace clang {
258namespace ento {
259namespace retaincountchecker {
260
261class RefCountReportVisitor : public BugReporterVisitor {
262protected:
263 SymbolRef Sym;
264 bool IsReleaseUnowned;
265
266public:
267 RefCountReportVisitor(SymbolRef S, bool IRU)
268 : Sym(S), IsReleaseUnowned(IRU) {}
269
270 void Profile(llvm::FoldingSetNodeID &ID) const override {
271 static int x = 0;
272 ID.AddPointer(Ptr: &x);
273 ID.AddPointer(Ptr: Sym);
274 }
275
276 PathDiagnosticPieceRef VisitNode(const ExplodedNode *N,
277 BugReporterContext &BRC,
278 PathSensitiveBugReport &BR) override;
279
280 PathDiagnosticPieceRef getEndPath(const ExplodedNode *N,
281 BugReporterContext &BRC,
282 PathSensitiveBugReport &BR) override;
283};
284
285class RefLeakReportVisitor : public RefCountReportVisitor {
286public:
287 RefLeakReportVisitor(SymbolRef Sym, const MemRegion *LastBinding)
288 : RefCountReportVisitor(Sym, /*IsReleaseUnowned=*/false),
289 LastBinding(LastBinding) {}
290
291 PathDiagnosticPieceRef getEndPath(const ExplodedNode *N,
292 BugReporterContext &BRC,
293 PathSensitiveBugReport &BR) override;
294
295private:
296 const MemRegion *LastBinding;
297};
298
299} // end namespace retaincountchecker
300} // end namespace ento
301} // end namespace clang
302
303
304/// Find the first node with the parent stack frame.
305static const ExplodedNode *getCalleeNode(const ExplodedNode *Pred) {
306 const StackFrame *SF = Pred->getStackFrame();
307 if (SF->inTopFrame())
308 return nullptr;
309 const StackFrame *PSF = SF->getParent();
310 if (!PSF)
311 return nullptr;
312
313 const ExplodedNode *N = Pred;
314 while (N && N->getStackFrame() != PSF) {
315 N = N->getFirstPred();
316 }
317 return N;
318}
319
320
321/// Insert a diagnostic piece at function exit
322/// if a function parameter is annotated as "os_consumed",
323/// but it does not actually consume the reference.
324static std::shared_ptr<PathDiagnosticEventPiece>
325annotateConsumedSummaryMismatch(const ExplodedNode *N,
326 CallExitBegin &CallExitLoc,
327 const SourceManager &SM,
328 CallEventManager &CEMgr) {
329
330 const ExplodedNode *CN = getCalleeNode(Pred: N);
331 if (!CN)
332 return nullptr;
333
334 CallEventRef<> Call = CEMgr.getCaller(CalleeSF: N->getStackFrame(), State: N->getState());
335
336 std::string sbuf;
337 llvm::raw_string_ostream os(sbuf);
338 ArrayRef<const ParmVarDecl *> Parameters = Call->parameters();
339 for (unsigned I=0; I < Call->getNumArgs() && I < Parameters.size(); ++I) {
340 const ParmVarDecl *PVD = Parameters[I];
341
342 if (!PVD->hasAttr<OSConsumedAttr>())
343 continue;
344
345 if (SymbolRef SR = Call->getArgSVal(Index: I).getAsLocSymbol()) {
346 const RefVal *CountBeforeCall = getRefBinding(State: CN->getState(), Sym: SR);
347 const RefVal *CountAtExit = getRefBinding(State: N->getState(), Sym: SR);
348
349 if (!CountBeforeCall || !CountAtExit)
350 continue;
351
352 unsigned CountBefore = CountBeforeCall->getCount();
353 unsigned CountAfter = CountAtExit->getCount();
354
355 bool AsExpected = CountBefore > 0 && CountAfter == CountBefore - 1;
356 if (!AsExpected) {
357 os << "Parameter '";
358 PVD->getNameForDiagnostic(OS&: os, Policy: PVD->getASTContext().getPrintingPolicy(),
359 /*Qualified=*/false);
360 os << "' is marked as consuming, but the function did not consume "
361 << "the reference\n";
362 }
363 }
364 }
365
366 if (sbuf.empty())
367 return nullptr;
368
369 PathDiagnosticLocation L = PathDiagnosticLocation::create(P: CallExitLoc, SMng: SM);
370 return std::make_shared<PathDiagnosticEventPiece>(args&: L, args&: sbuf);
371}
372
373/// Annotate the parameter at the analysis entry point.
374static std::shared_ptr<PathDiagnosticEventPiece>
375annotateStartParameter(const ExplodedNode *N, SymbolRef Sym,
376 const SourceManager &SM) {
377 auto PP = N->getLocationAs<BlockEdge>();
378 if (!PP)
379 return nullptr;
380
381 const CFGBlock *Src = PP->getSrc();
382 const RefVal *CurrT = getRefBinding(State: N->getState(), Sym);
383
384 if (&Src->getParent()->getEntry() != Src || !CurrT ||
385 getRefBinding(State: N->getFirstPred()->getState(), Sym))
386 return nullptr;
387
388 const auto *VR = cast<VarRegion>(Val: cast<SymbolRegionValue>(Val: Sym)->getRegion());
389 const auto *PVD = cast<ParmVarDecl>(Val: VR->getDecl());
390 PathDiagnosticLocation L = PathDiagnosticLocation(PVD, SM);
391
392 std::string s;
393 llvm::raw_string_ostream os(s);
394 os << "Parameter '" << PVD->getDeclName() << "' starts at +";
395 if (CurrT->getCount() == 1) {
396 os << "1, as it is marked as consuming";
397 } else {
398 assert(CurrT->getCount() == 0);
399 os << "0";
400 }
401 return std::make_shared<PathDiagnosticEventPiece>(args&: L, args&: s);
402}
403
404PathDiagnosticPieceRef
405RefCountReportVisitor::VisitNode(const ExplodedNode *N, BugReporterContext &BRC,
406 PathSensitiveBugReport &BR) {
407 const SourceManager &SM = BRC.getSourceManager();
408 CallEventManager &CEMgr = BRC.getStateManager().getCallEventManager();
409 if (auto CE = N->getLocationAs<CallExitBegin>())
410 if (auto PD = annotateConsumedSummaryMismatch(N, CallExitLoc&: *CE, SM, CEMgr))
411 return PD;
412
413 if (auto PD = annotateStartParameter(N, Sym, SM))
414 return PD;
415
416 // FIXME: We will eventually need to handle non-statement-based events
417 // (__attribute__((cleanup))).
418 if (!N->getLocation().getAs<StmtPoint>())
419 return nullptr;
420
421 // Check if the type state has changed.
422 const ExplodedNode *PrevNode = N->getFirstPred();
423 ProgramStateRef PrevSt = PrevNode->getState();
424 ProgramStateRef CurrSt = N->getState();
425 const StackFrame *SF = N->getStackFrame();
426
427 const RefVal* CurrT = getRefBinding(State: CurrSt, Sym);
428 if (!CurrT)
429 return nullptr;
430
431 const RefVal &CurrV = *CurrT;
432 const RefVal *PrevT = getRefBinding(State: PrevSt, Sym);
433
434 // Create a string buffer to constain all the useful things we want
435 // to tell the user.
436 std::string sbuf;
437 llvm::raw_string_ostream os(sbuf);
438
439 if (PrevT && IsReleaseUnowned && CurrV.isNotOwned() && PrevT->isOwned()) {
440 os << "Object is now not exclusively owned";
441 auto Pos = PathDiagnosticLocation::create(P: N->getLocation(), SMng: SM);
442 return std::make_shared<PathDiagnosticEventPiece>(args&: Pos, args&: sbuf);
443 }
444
445 // This is the allocation site since the previous node had no bindings
446 // for this symbol.
447 if (!PrevT) {
448 const Stmt *S = N->getLocation().castAs<StmtPoint>().getStmt();
449
450 if (isa<ObjCIvarRefExpr>(Val: S) && isSynthesizedAccessor(SF)) {
451 S = SF->getCallSite();
452 }
453
454 if (isa<ObjCArrayLiteral>(Val: S)) {
455 os << "NSArray literal is an object with a +0 retain count";
456 } else if (isa<ObjCDictionaryLiteral>(Val: S)) {
457 os << "NSDictionary literal is an object with a +0 retain count";
458 } else if (const ObjCBoxedExpr *BL = dyn_cast<ObjCBoxedExpr>(Val: S)) {
459 if (isNumericLiteralExpression(E: BL->getSubExpr()))
460 os << "NSNumber literal is an object with a +0 retain count";
461 else {
462 const ObjCInterfaceDecl *BoxClass = nullptr;
463 if (const ObjCMethodDecl *Method = BL->getBoxingMethod())
464 BoxClass = Method->getClassInterface();
465
466 // We should always be able to find the boxing class interface,
467 // but consider this future-proofing.
468 if (BoxClass) {
469 os << *BoxClass << " b";
470 } else {
471 os << "B";
472 }
473
474 os << "oxed expression produces an object with a +0 retain count";
475 }
476 } else if (isa<ObjCIvarRefExpr>(Val: S)) {
477 os << "Object loaded from instance variable";
478 } else {
479 generateDiagnosticsForCallLike(CurrSt, SF, CurrV, Sym, S, os);
480 }
481
482 PathDiagnosticLocation Pos(S, SM, N->getStackFrame());
483 return std::make_shared<PathDiagnosticEventPiece>(args&: Pos, args&: sbuf);
484 }
485
486 // Gather up the effects that were performed on the object at this
487 // program point
488 bool DeallocSent = false;
489
490 const ProgramPointTag *Tag = N->getLocation().getTag();
491
492 if (Tag == &RetainCountChecker::getCastFailTag()) {
493 os << "Assuming dynamic cast returns null due to type mismatch";
494 }
495
496 if (Tag == &RetainCountChecker::getDeallocSentTag()) {
497 // We only have summaries attached to nodes after evaluating CallExpr and
498 // ObjCMessageExprs.
499 const Stmt *S = N->getLocation().castAs<StmtPoint>().getStmt();
500
501 if (const CallExpr *CE = dyn_cast<CallExpr>(Val: S)) {
502 // Iterate through the parameter expressions and see if the symbol
503 // was ever passed as an argument.
504 for (auto AI = CE->arg_begin(), AE = CE->arg_end(); AI != AE; ++AI) {
505
506 // Retrieve the value of the argument. Is it the symbol
507 // we are interested in?
508 if (CurrSt->getSValAsScalarOrLoc(E: *AI, SF).getAsLocSymbol() != Sym)
509 continue;
510
511 // We have an argument. Get the effect!
512 DeallocSent = true;
513 }
514 } else if (const ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(Val: S)) {
515 if (const Expr *R = ME->getInstanceReceiver()) {
516 if (CurrSt->getSValAsScalarOrLoc(E: R, SF).getAsLocSymbol() == Sym) {
517 // The symbol we are tracking is the receiver.
518 DeallocSent = true;
519 }
520 }
521 }
522 }
523
524 if (!shouldGenerateNote(os, PrevT, CurrV, DeallocSent))
525 return nullptr;
526
527 if (sbuf.empty())
528 return nullptr; // We have nothing to say!
529
530 const Stmt *S = N->getLocation().castAs<StmtPoint>().getStmt();
531 PathDiagnosticLocation Pos(S, BRC.getSourceManager(), N->getStackFrame());
532 auto P = std::make_shared<PathDiagnosticEventPiece>(args&: Pos, args&: sbuf);
533
534 // Add the range by scanning the children of the statement for any bindings
535 // to Sym.
536 for (const Stmt *Child : S->children())
537 if (const Expr *Exp = dyn_cast_or_null<Expr>(Val: Child))
538 if (CurrSt->getSValAsScalarOrLoc(E: Exp, SF).getAsLocSymbol() == Sym) {
539 P->addRange(R: Exp->getSourceRange());
540 break;
541 }
542
543 return std::move(P);
544}
545
546static std::optional<std::string> describeRegion(const MemRegion *MR) {
547 if (const auto *VR = dyn_cast_or_null<VarRegion>(Val: MR))
548 return std::string(VR->getDecl()->getName());
549 // Once we support more storage locations for bindings,
550 // this would need to be improved.
551 return std::nullopt;
552}
553
554using Bindings = llvm::SmallVector<std::pair<const MemRegion *, SVal>, 4>;
555
556namespace {
557class VarBindingsCollector : public StoreManager::BindingsHandler {
558 SymbolRef Sym;
559 Bindings &Result;
560
561public:
562 VarBindingsCollector(SymbolRef Sym, Bindings &ToFill)
563 : Sym(Sym), Result(ToFill) {}
564
565 bool HandleBinding(StoreManager &SMgr, Store Store, const MemRegion *R,
566 SVal Val) override {
567 SymbolRef SymV = Val.getAsLocSymbol();
568 if (!SymV || SymV != Sym)
569 return true;
570
571 if (isa<NonParamVarRegion>(Val: R))
572 Result.emplace_back(Args&: R, Args&: Val);
573
574 return true;
575 }
576};
577} // namespace
578
579static Bindings getAllVarBindingsForSymbol(ProgramStateManager &Manager,
580 const ExplodedNode *Node,
581 SymbolRef Sym) {
582 Bindings Result;
583 VarBindingsCollector Collector{Sym, Result};
584 while (Result.empty() && Node) {
585 Manager.iterBindings(state: Node->getState(), F&: Collector);
586 Node = Node->getFirstPred();
587 }
588
589 return Result;
590}
591
592namespace {
593// Find the first node in the current function context that referred to the
594// tracked symbol and the memory location that value was stored to. Note, the
595// value is only reported if the allocation occurred in the same function as
596// the leak. The function can also return a stack frame, which should be
597// treated as interesting.
598struct AllocationInfo {
599 const ExplodedNode* N;
600 const MemRegion *R;
601 const StackFrame *InterestingMethodStackFrame;
602 AllocationInfo(const ExplodedNode *InN, const MemRegion *InR,
603 const StackFrame *InterestingMethodStackFrame)
604 : N(InN), R(InR),
605 InterestingMethodStackFrame(InterestingMethodStackFrame) {}
606};
607} // end anonymous namespace
608
609static AllocationInfo GetAllocationSite(ProgramStateManager &StateMgr,
610 const ExplodedNode *N, SymbolRef Sym) {
611 const ExplodedNode *AllocationNode = N;
612 const ExplodedNode *AllocationNodeInCurrentOrParentContext = N;
613 const MemRegion *FirstBinding = nullptr;
614 const StackFrame *LeakStackFrame = N->getStackFrame();
615
616 // The stack frame of the init method called on the leaked object, if
617 // available.
618 const StackFrame *InitMethodStackFrame = nullptr;
619
620 while (N) {
621 ProgramStateRef St = N->getState();
622 const StackFrame *NStackFrame = N->getStackFrame();
623
624 if (!getRefBinding(State: St, Sym))
625 break;
626
627 StoreManager::FindUniqueBinding FB(Sym);
628 StateMgr.iterBindings(state: St, F&: FB);
629
630 if (FB) {
631 const MemRegion *R = FB.getRegion();
632 // Do not show local variables belonging to a function other than
633 // where the error is reported.
634 if (const auto *MR = R->getMemorySpaceAs<StackSpaceRegion>(State: St))
635 if (MR->getStackFrame() == LeakStackFrame)
636 FirstBinding = R;
637 }
638
639 // AllocationNode is the last node in which the symbol was tracked.
640 AllocationNode = N;
641
642 // AllocationNodeInCurrentContext, is the last node in the current or
643 // parent context in which the symbol was tracked.
644 //
645 // Note that the allocation site might be in the parent context. For example,
646 // the case where an allocation happens in a block that captures a reference
647 // to it and that reference is overwritten/dropped by another call to
648 // the block.
649 if (NStackFrame == LeakStackFrame ||
650 NStackFrame->isParentOf(SF: LeakStackFrame))
651 AllocationNodeInCurrentOrParentContext = N;
652
653 // Find the last init that was called on the given symbol and store the
654 // init method's stack frame.
655 if (!InitMethodStackFrame)
656 if (auto CEP = N->getLocation().getAs<CallEnter>()) {
657 const Stmt *CE = CEP->getCallExpr();
658 if (const auto *ME = dyn_cast_or_null<ObjCMessageExpr>(Val: CE)) {
659 if (const Expr *RecExpr = ME->getInstanceReceiver()) {
660 SVal RecV = St->getSVal(E: RecExpr, SF: NStackFrame);
661 if (ME->getMethodFamily() == OMF_init && RecV.getAsSymbol() == Sym)
662 InitMethodStackFrame = CEP->getCalleeStackFrame();
663 }
664 }
665 }
666
667 N = N->getFirstPred();
668 }
669
670 // If we are reporting a leak of the object that was allocated with alloc,
671 // mark its init method as interesting.
672 const StackFrame *InterestingMethodStackFrame = nullptr;
673 if (InitMethodStackFrame) {
674 const ProgramPoint AllocPP = AllocationNode->getLocation();
675 if (std::optional<StmtPoint> SP = AllocPP.getAs<StmtPoint>())
676 if (const ObjCMessageExpr *ME = SP->getStmtAs<ObjCMessageExpr>())
677 if (ME->getMethodFamily() == OMF_alloc)
678 InterestingMethodStackFrame = InitMethodStackFrame;
679 }
680
681 // If allocation happened in a function different from the leak node context,
682 // do not report the binding.
683 assert(N && "Could not find allocation node");
684
685 if (AllocationNodeInCurrentOrParentContext &&
686 AllocationNodeInCurrentOrParentContext->getStackFrame() != LeakStackFrame)
687 FirstBinding = nullptr;
688
689 return AllocationInfo(AllocationNodeInCurrentOrParentContext, FirstBinding,
690 InterestingMethodStackFrame);
691}
692
693PathDiagnosticPieceRef
694RefCountReportVisitor::getEndPath(const ExplodedNode *EndN,
695 BugReporterContext &BRC,
696 PathSensitiveBugReport &BR) {
697 BR.markInteresting(sym: Sym);
698 return BugReporterVisitor::getDefaultEndPath(BRC, N: EndN, BR);
699}
700
701PathDiagnosticPieceRef
702RefLeakReportVisitor::getEndPath(const ExplodedNode *EndN,
703 BugReporterContext &BRC,
704 PathSensitiveBugReport &BR) {
705
706 // Tell the BugReporterContext to report cases when the tracked symbol is
707 // assigned to different variables, etc.
708 BR.markInteresting(sym: Sym);
709
710 PathDiagnosticLocation L = cast<RefLeakReport>(Val&: BR).getEndOfPath();
711
712 std::string sbuf;
713 llvm::raw_string_ostream os(sbuf);
714
715 os << "Object leaked: ";
716
717 std::optional<std::string> RegionDescription = describeRegion(MR: LastBinding);
718 if (RegionDescription) {
719 os << "object allocated and stored into '" << *RegionDescription << '\'';
720 } else {
721 os << "allocated object of type '" << getPrettyTypeName(QT: Sym->getType())
722 << "'";
723 }
724
725 // Get the retain count.
726 const RefVal *RV = getRefBinding(State: EndN->getState(), Sym);
727 assert(RV);
728
729 if (RV->getKind() == RefVal::ErrorLeakReturned) {
730 const Decl *D = &EndN->getCodeDecl();
731
732 os << (isa<ObjCMethodDecl>(Val: D) ? " is returned from a method "
733 : " is returned from a function ");
734
735 if (D->hasAttr<CFReturnsNotRetainedAttr>()) {
736 os << "that is annotated as CF_RETURNS_NOT_RETAINED";
737 } else if (D->hasAttr<NSReturnsNotRetainedAttr>()) {
738 os << "that is annotated as NS_RETURNS_NOT_RETAINED";
739 } else if (D->hasAttr<OSReturnsNotRetainedAttr>()) {
740 os << "that is annotated as OS_RETURNS_NOT_RETAINED";
741 } else {
742 if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(Val: D)) {
743 if (BRC.getASTContext().getLangOpts().ObjCAutoRefCount) {
744 os << "managed by Automatic Reference Counting";
745 } else {
746 os << "whose name ('" << MD->getSelector().getAsString()
747 << "') does not start with "
748 "'copy', 'mutableCopy', 'alloc' or 'new'."
749 " This violates the naming convention rules"
750 " given in the Memory Management Guide for Cocoa";
751 }
752 } else {
753 const FunctionDecl *FD = cast<FunctionDecl>(Val: D);
754 ObjKind K = RV->getObjKind();
755 if (K == ObjKind::ObjC || K == ObjKind::CF) {
756 os << "whose name ('" << *FD
757 << "') does not contain 'Copy' or 'Create'. This violates the "
758 "naming convention rules given in the Memory Management Guide "
759 "for Core Foundation";
760 } else if (RV->getObjKind() == ObjKind::OS) {
761 std::string FuncName = FD->getNameAsString();
762 os << "whose name ('" << FuncName << "') starts with '"
763 << StringRef(FuncName).substr(Start: 0, N: 3) << "'";
764 }
765 }
766 }
767 } else {
768 os << " is not referenced later in this execution path and has a retain "
769 "count of +"
770 << RV->getCount();
771 }
772
773 return std::make_shared<PathDiagnosticEventPiece>(args&: L, args&: sbuf);
774}
775
776RefCountReport::RefCountReport(const RefCountBug &D, const LangOptions &LOpts,
777 ExplodedNode *n, SymbolRef sym, bool isLeak,
778 bool IsReleaseUnowned)
779 : PathSensitiveBugReport(D, D.getReportMessage(), n), Sym(sym),
780 isLeak(isLeak) {
781 if (!isLeak)
782 addVisitor<RefCountReportVisitor>(ConstructorArgs&: sym, ConstructorArgs&: IsReleaseUnowned);
783}
784
785RefCountReport::RefCountReport(const RefCountBug &D, const LangOptions &LOpts,
786 ExplodedNode *n, SymbolRef sym,
787 StringRef endText)
788 : PathSensitiveBugReport(D, D.getReportMessage(), endText, n) {
789
790 addVisitor<RefCountReportVisitor>(ConstructorArgs&: sym, /*IsReleaseUnowned=*/ConstructorArgs: false);
791}
792
793void RefLeakReport::deriveParamLocation(CheckerContext &Ctx) {
794 const SourceManager &SMgr = Ctx.getSourceManager();
795
796 if (!Sym->getOriginRegion())
797 return;
798
799 auto *Region = dyn_cast<DeclRegion>(Val: Sym->getOriginRegion());
800 if (Region) {
801 const Decl *PDecl = Region->getDecl();
802 if (isa_and_nonnull<ParmVarDecl>(Val: PDecl)) {
803 PathDiagnosticLocation ParamLocation =
804 PathDiagnosticLocation::create(D: PDecl, SM: SMgr);
805 Location = ParamLocation;
806 UniqueingLocation = ParamLocation;
807 UniqueingDecl = Ctx.getStackFrame()->getDecl();
808 }
809 }
810}
811
812void RefLeakReport::deriveAllocLocation(CheckerContext &Ctx) {
813 // Most bug reports are cached at the location where they occurred.
814 // With leaks, we want to unique them by the location where they were
815 // allocated, and only report a single path. To do this, we need to find
816 // the allocation site of a piece of tracked memory, which we do via a
817 // call to GetAllocationSite. This will walk the ExplodedGraph backwards.
818 // Note that this is *not* the trimmed graph; we are guaranteed, however,
819 // that all ancestor nodes that represent the allocation site have the
820 // same SourceLocation.
821 const ExplodedNode *AllocNode = nullptr;
822
823 const SourceManager &SMgr = Ctx.getSourceManager();
824
825 AllocationInfo AllocI =
826 GetAllocationSite(StateMgr&: Ctx.getStateManager(), N: getErrorNode(), Sym);
827
828 AllocNode = AllocI.N;
829 AllocFirstBinding = AllocI.R;
830 markInteresting(SF: AllocI.InterestingMethodStackFrame);
831
832 // Get the SourceLocation for the allocation site.
833 // FIXME: This will crash the analyzer if an allocation comes from an
834 // implicit call (ex: a destructor call).
835 // (Currently there are no such allocations in Cocoa, though.)
836 AllocStmt = AllocNode->getStmtForDiagnostics();
837
838 if (!AllocStmt) {
839 AllocFirstBinding = nullptr;
840 return;
841 }
842
843 PathDiagnosticLocation AllocLocation = PathDiagnosticLocation::createBegin(
844 S: AllocStmt, SM: SMgr, SFAC: AllocNode->getStackFrame());
845 Location = AllocLocation;
846
847 // Set uniqieing info, which will be used for unique the bug reports. The
848 // leaks should be uniqued on the allocation site.
849 UniqueingLocation = AllocLocation;
850 UniqueingDecl = AllocNode->getStackFrame()->getDecl();
851}
852
853void RefLeakReport::createDescription(CheckerContext &Ctx) {
854 assert(Location.isValid() && UniqueingDecl && UniqueingLocation.isValid());
855 Description.clear();
856 llvm::raw_string_ostream os(Description);
857 os << "Potential leak of an object";
858
859 std::optional<std::string> RegionDescription =
860 describeRegion(MR: AllocBindingToReport);
861 if (RegionDescription) {
862 os << " stored into '" << *RegionDescription << '\'';
863 } else {
864
865 // If we can't figure out the name, just supply the type information.
866 os << " of type '" << getPrettyTypeName(QT: Sym->getType()) << "'";
867 }
868}
869
870void RefLeakReport::findBindingToReport(CheckerContext &Ctx,
871 ExplodedNode *Node) {
872 if (!AllocFirstBinding)
873 // If we don't have any bindings, we won't be able to find any
874 // better binding to report.
875 return;
876
877 // If the original region still contains the leaking symbol...
878 if (Node->getState()->getSVal(R: AllocFirstBinding).getAsSymbol() == Sym) {
879 // ...it is the best binding to report.
880 AllocBindingToReport = AllocFirstBinding;
881 return;
882 }
883
884 // At this point, we know that the original region doesn't contain the leaking
885 // when the actual leak happens. It means that it can be confusing for the
886 // user to see such description in the message.
887 //
888 // Let's consider the following example:
889 // Object *Original = allocate(...);
890 // Object *New = Original;
891 // Original = allocate(...);
892 // Original->release();
893 //
894 // Complaining about a leaking object "stored into Original" might cause a
895 // rightful confusion because 'Original' is actually released.
896 // We should complain about 'New' instead.
897 Bindings AllVarBindings =
898 getAllVarBindingsForSymbol(Manager&: Ctx.getStateManager(), Node, Sym);
899
900 // While looking for the last var bindings, we can still find
901 // `AllocFirstBinding` to be one of them. In situations like this,
902 // it would still be the easiest case to explain to our users.
903 if (!AllVarBindings.empty() &&
904 !llvm::is_contained(Range: llvm::make_first_range(c&: AllVarBindings),
905 Element: AllocFirstBinding)) {
906 // Let's pick one of them at random (if there is something to pick from).
907 AllocBindingToReport = AllVarBindings[0].first;
908
909 // Because 'AllocBindingToReport' is not the same as
910 // 'AllocFirstBinding', we need to explain how the leaking object
911 // got from one to another.
912 //
913 // NOTE: We use the actual SVal stored in AllocBindingToReport here because
914 // trackStoredValue compares SVal's and it can get trickier for
915 // something like derived regions if we want to construct SVal from
916 // Sym. Instead, we take the value that is definitely stored in that
917 // region, thus guaranteeing that trackStoredValue will work.
918 bugreporter::trackStoredValue(V: AllVarBindings[0].second,
919 R: AllocBindingToReport, Report&: *this);
920 } else {
921 AllocBindingToReport = AllocFirstBinding;
922 }
923}
924
925RefLeakReport::RefLeakReport(const RefCountBug &D, const LangOptions &LOpts,
926 ExplodedNode *N, SymbolRef Sym,
927 CheckerContext &Ctx)
928 : RefCountReport(D, LOpts, N, Sym, /*isLeak=*/true) {
929
930 deriveAllocLocation(Ctx);
931 findBindingToReport(Ctx, Node: N);
932
933 if (!AllocFirstBinding)
934 deriveParamLocation(Ctx);
935
936 createDescription(Ctx);
937
938 addVisitor<RefLeakReportVisitor>(ConstructorArgs&: Sym, ConstructorArgs&: AllocBindingToReport);
939}
940