1//=======- RetainPtrCtorAdoptChecker.cpp -------------------------*- C++ -*-==//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8
9#include "ASTUtils.h"
10#include "PtrTypesSemantics.h"
11#include "clang/AST/RecursiveASTVisitor.h"
12#include "clang/Analysis/DomainSpecific/CocoaConventions.h"
13#include "clang/Analysis/RetainSummaryManager.h"
14#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
15#include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
16#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
17#include "clang/StaticAnalyzer/Core/Checker.h"
18#include "llvm/ADT/DenseSet.h"
19#include <optional>
20
21using namespace clang;
22using namespace ento;
23
24namespace {
25
26class RetainPtrCtorAdoptChecker
27 : public Checker<check::ASTDecl<TranslationUnitDecl>> {
28private:
29 BugType Bug;
30 mutable BugReporter *BR = nullptr;
31 mutable std::unique_ptr<RetainSummaryManager> Summaries;
32 mutable llvm::DenseSet<const ValueDecl *> CreateOrCopyOutArguments;
33 mutable llvm::DenseSet<const Expr *> CreateOrCopyFnCall;
34 mutable RetainTypeChecker RTC;
35
36public:
37 RetainPtrCtorAdoptChecker()
38 : Bug(this, "Correct use of RetainPtr, adoptNS, and adoptCF",
39 "WebKit coding guidelines") {}
40
41 void checkASTDecl(const TranslationUnitDecl *TUD, AnalysisManager &MGR,
42 BugReporter &BRArg) const {
43 BR = &BRArg;
44
45 // The calls to checkAST* from AnalysisConsumer don't
46 // visit template instantiations or lambda classes. We
47 // want to visit those, so we make our own RecursiveASTVisitor.
48 struct LocalVisitor : public RecursiveASTVisitor<LocalVisitor> {
49 const RetainPtrCtorAdoptChecker *Checker;
50 Decl *DeclWithIssue{nullptr};
51
52 using Base = RecursiveASTVisitor<LocalVisitor>;
53
54 explicit LocalVisitor(const RetainPtrCtorAdoptChecker *Checker)
55 : Checker(Checker) {
56 assert(Checker);
57 }
58
59 bool shouldVisitTemplateInstantiations() const { return true; }
60 bool shouldVisitImplicitCode() const { return false; }
61
62 bool TraverseDecl(Decl *D) {
63 llvm::SaveAndRestore SavedDecl(DeclWithIssue);
64 if (D && (isa<FunctionDecl>(Val: D) || isa<ObjCMethodDecl>(Val: D)))
65 DeclWithIssue = D;
66 return Base::TraverseDecl(D);
67 }
68
69 bool TraverseClassTemplateDecl(ClassTemplateDecl *CTD) {
70 if (isRetainPtrOrOSPtr(Name: safeGetName(ASTNode: CTD)))
71 return true; // Skip the contents of RetainPtr.
72 return Base::TraverseClassTemplateDecl(D: CTD);
73 }
74
75 bool VisitTypedefDecl(TypedefDecl *TD) {
76 Checker->RTC.visitTypedef(TD);
77 return true;
78 }
79
80 bool VisitCallExpr(const CallExpr *CE) {
81 Checker->visitCallExpr(CE, DeclWithIssue);
82 return true;
83 }
84
85 bool VisitCXXConstructExpr(const CXXConstructExpr *CE) {
86 Checker->visitConstructExpr(CE, DeclWithIssue);
87 return true;
88 }
89
90 bool VisitObjCMessageExpr(const ObjCMessageExpr *ObjCMsgExpr) {
91 Checker->visitObjCMessageExpr(ObjCMsgExpr, DeclWithIssue);
92 return true;
93 }
94
95 bool VisitReturnStmt(const ReturnStmt *RS) {
96 Checker->visitReturnStmt(RS, DeclWithIssue);
97 return true;
98 }
99
100 bool VisitVarDecl(const VarDecl *VD) {
101 Checker->visitVarDecl(VD);
102 return true;
103 }
104
105 bool VisitBinaryOperator(const BinaryOperator *BO) {
106 Checker->visitBinaryOperator(BO);
107 return true;
108 }
109 };
110
111 LocalVisitor visitor(this);
112 Summaries = std::make_unique<RetainSummaryManager>(
113 args&: TUD->getASTContext(), args: true /* trackObjCAndCFObjects */,
114 args: false /* trackOSObjects */);
115 RTC.visitTranslationUnitDecl(TUD);
116 visitor.TraverseDecl(D: const_cast<TranslationUnitDecl *>(TUD));
117 }
118
119 bool isAdoptFn(const Decl *FnDecl) const {
120 return isAdoptFnName(Name: safeGetName(ASTNode: FnDecl));
121 }
122
123 bool isAdoptFnName(const std::string &Name) const {
124 return isAdoptNS(Name) || Name == "adoptCF" || Name == "adoptCFArc" ||
125 Name == "adoptOSObject" || Name == "adoptOSObjectArc";
126 }
127
128 bool isAdoptNS(const std::string &Name) const {
129 return Name == "adoptNS" || Name == "adoptNSArc";
130 }
131
132 void visitCallExpr(const CallExpr *CE, const Decl *DeclWithIssue) const {
133 assert(BR && "expected nonnull BugReporter");
134 if (BR->getSourceManager().isInSystemHeader(Loc: CE->getExprLoc()))
135 return;
136
137 std::string FnName;
138 if (auto *F = CE->getDirectCallee()) {
139 FnName = safeGetName(ASTNode: F);
140 if (isAdoptFnName(Name: FnName))
141 checkAdoptCall(CE, FnName, DeclWithIssue);
142 else {
143 checkCreateOrCopyFunction(CE, DeclWithIssue);
144 checkBridgingRelease(CE, Callee: F, DeclWithIssue);
145 }
146 return;
147 }
148
149 auto *CalleeExpr = CE->getCallee();
150 if (!CalleeExpr)
151 return;
152 CalleeExpr = CalleeExpr->IgnoreParenCasts();
153 if (auto *UnresolvedExpr = dyn_cast<UnresolvedLookupExpr>(Val: CalleeExpr)) {
154 auto Name = UnresolvedExpr->getName();
155 if (!Name.isIdentifier())
156 return;
157 FnName = Name.getAsString();
158 if (isAdoptFnName(Name: FnName))
159 checkAdoptCall(CE, FnName, DeclWithIssue);
160 }
161 checkCreateOrCopyFunction(CE, DeclWithIssue);
162 }
163
164 void checkAdoptCall(const CallExpr *CE, const std::string &FnName,
165 const Decl *DeclWithIssue) const {
166 if (!CE->getNumArgs())
167 return;
168
169 auto *Arg = CE->getArg(Arg: 0)->IgnoreParenCasts();
170 auto Result = isOwned(E: Arg);
171 if (Result == IsOwnedResult::Unknown)
172 Result = IsOwnedResult::NotOwned;
173
174 const Expr *Inner = nullptr;
175 if (isAllocInit(E: Arg, InnerExpr: &Inner) || isCreateOrCopy(E: Arg)) {
176 if (Inner)
177 CreateOrCopyFnCall.insert(V: Inner);
178 CreateOrCopyFnCall.insert(V: Arg); // Avoid double reporting.
179 return;
180 }
181 if (Result == IsOwnedResult::Owned || Result == IsOwnedResult::Skip ||
182 isNullPtr(E: Arg)) {
183 CreateOrCopyFnCall.insert(V: Arg);
184 return;
185 }
186
187 if (auto *DRE = dyn_cast<DeclRefExpr>(Val: Arg)) {
188 if (CreateOrCopyOutArguments.contains(V: DRE->getDecl()))
189 return;
190 }
191 if (RTC.isARCEnabled() && isAdoptFnName(Name: FnName))
192 reportUseAfterFree(Name: FnName, CE, DeclWithIssue, condition: "when ARC is disabled");
193 else
194 reportUseAfterFree(Name: FnName, CE, DeclWithIssue);
195 }
196
197 void visitObjCMessageExpr(const ObjCMessageExpr *ObjCMsgExpr,
198 const Decl *DeclWithIssue) const {
199 if (BR->getSourceManager().isInSystemHeader(Loc: ObjCMsgExpr->getExprLoc()))
200 return;
201
202 auto Selector = ObjCMsgExpr->getSelector();
203 if (Selector.getAsString() == "autorelease") {
204 auto *Receiver = ObjCMsgExpr->getInstanceReceiver()->IgnoreParenCasts();
205 if (!Receiver)
206 return;
207 ObjCMsgExpr = dyn_cast<ObjCMessageExpr>(Val: Receiver);
208 if (!ObjCMsgExpr)
209 return;
210 const Expr *Inner = nullptr;
211 if (!isAllocInit(E: ObjCMsgExpr, InnerExpr: &Inner))
212 return;
213 CreateOrCopyFnCall.insert(V: ObjCMsgExpr);
214 if (Inner)
215 CreateOrCopyFnCall.insert(V: Inner);
216 return;
217 }
218
219 const Expr *Inner = nullptr;
220 if (!isAllocInit(E: ObjCMsgExpr, InnerExpr: &Inner))
221 return;
222 if (RTC.isARCEnabled())
223 return; // ARC never leaks.
224 if (CreateOrCopyFnCall.contains(V: ObjCMsgExpr))
225 return;
226 if (Inner)
227 CreateOrCopyFnCall.insert(V: Inner); // Avoid double reporting.
228 reportLeak(E: ObjCMsgExpr, DeclWithIssue);
229 }
230
231 void checkCreateOrCopyFunction(const CallExpr *CE,
232 const Decl *DeclWithIssue) const {
233 unsigned ArgCount = CE->getNumArgs();
234 auto *CalleeDecl = CE->getCalleeDecl();
235 auto *FnDecl = CalleeDecl ? CalleeDecl->getAsFunction() : nullptr;
236 for (unsigned ArgIndex = 0; ArgIndex < ArgCount; ++ArgIndex) {
237 auto *Arg = CE->getArg(Arg: ArgIndex)->IgnoreParenCasts();
238 auto *Unary = dyn_cast<UnaryOperator>(Val: Arg);
239 if (!Unary)
240 continue;
241 if (Unary->getOpcode() != UO_AddrOf)
242 continue;
243 auto *SubExpr = Unary->getSubExpr();
244 if (!SubExpr)
245 continue;
246 auto *DRE = dyn_cast<DeclRefExpr>(Val: SubExpr->IgnoreParenCasts());
247 if (!DRE)
248 continue;
249 auto *Decl = DRE->getDecl();
250 if (!Decl)
251 continue;
252 if (FnDecl && ArgIndex < FnDecl->getNumParams()) {
253 // Manually check attributes on argumenet since RetainSummaryManager
254 // basically ignores CF_RETRUNS_RETAINED on out arguments.
255 auto *ParamDecl = FnDecl->getParamDecl(i: ArgIndex);
256 if (ParamDecl->hasAttr<CFReturnsRetainedAttr>())
257 CreateOrCopyOutArguments.insert(V: Decl);
258 } else {
259 // No callee or a variadic argument.
260 // Conservatively assume it's an out argument.
261 if (RTC.isUnretained(Decl->getType()))
262 CreateOrCopyOutArguments.insert(V: Decl);
263 }
264 }
265 auto Summary = Summaries->getSummary(C: AnyCall(CE));
266 switch (Summary->getRetEffect().getKind()) {
267 case RetEffect::OwnedSymbol:
268 case RetEffect::OwnedWhenTrackedReceiver:
269 if (!CreateOrCopyFnCall.contains(V: CE))
270 reportLeak(E: CE, DeclWithIssue);
271 break;
272 default:
273 break;
274 }
275 }
276
277 void checkBridgingRelease(const CallExpr *CE, const FunctionDecl *Callee,
278 const Decl *DeclWithIssue) const {
279 if (safeGetName(ASTNode: Callee) != "CFBridgingRelease" || CE->getNumArgs() != 1)
280 return;
281
282 auto *Arg = CE->getArg(Arg: 0)->IgnoreParenCasts();
283 auto *InnerCE = dyn_cast<CallExpr>(Val: Arg);
284 if (!InnerCE)
285 return;
286
287 auto *InnerF = InnerCE->getDirectCallee();
288 if (!InnerF || !isCreateOrCopyFunction(FnDecl: InnerF))
289 return;
290
291 CreateOrCopyFnCall.insert(V: InnerCE);
292 }
293
294 void visitConstructExpr(const CXXConstructExpr *CE,
295 const Decl *DeclWithIssue) const {
296 assert(BR && "expected nonnull BugReporter");
297 if (BR->getSourceManager().isInSystemHeader(Loc: CE->getExprLoc()))
298 return;
299
300 auto *Ctor = CE->getConstructor();
301 if (!Ctor)
302 return;
303
304 auto *Cls = Ctor->getParent();
305 if (!Cls)
306 return;
307
308 if (!isRetainPtrOrOSPtr(Name: safeGetName(ASTNode: Cls)) || !CE->getNumArgs())
309 return;
310
311 // Ignore RetainPtr construction inside adoptNS, adoptCF, and retainPtr.
312 if (isAdoptFn(FnDecl: DeclWithIssue) || safeGetName(ASTNode: DeclWithIssue) == "retainPtr")
313 return;
314
315 std::string Name = "RetainPtr constructor";
316 auto *Arg = CE->getArg(Arg: 0)->IgnoreParenCasts();
317 auto Result = isOwned(E: Arg);
318
319 if (isCreateOrCopy(E: Arg))
320 CreateOrCopyFnCall.insert(V: Arg); // Avoid double reporting.
321
322 const Expr *Inner = nullptr;
323 if (isAllocInit(E: Arg, InnerExpr: &Inner)) {
324 CreateOrCopyFnCall.insert(V: Arg);
325 if (Inner)
326 CreateOrCopyFnCall.insert(V: Inner);
327 }
328
329 if (Result == IsOwnedResult::Skip)
330 return;
331
332 if (Result == IsOwnedResult::Unknown)
333 Result = IsOwnedResult::NotOwned;
334 if (Result == IsOwnedResult::Owned)
335 reportLeak(Name, CE, DeclWithIssue);
336 else if (RTC.isARCEnabled() && isAllocInit(E: Arg))
337 reportLeak(Name, CE, DeclWithIssue, condition: "when ARC is disabled");
338 else if (isCreateOrCopy(E: Arg))
339 reportLeak(Name, CE, DeclWithIssue);
340 }
341
342 void visitVarDecl(const VarDecl *VD) const {
343 auto *Init = VD->getInit();
344 if (!Init || !RTC.isARCEnabled())
345 return;
346 Init = Init->IgnoreParenCasts();
347 const Expr *Inner = nullptr;
348 if (isAllocInit(E: Init, InnerExpr: &Inner)) {
349 CreateOrCopyFnCall.insert(V: Init);
350 if (Inner)
351 CreateOrCopyFnCall.insert(V: Inner);
352 }
353 }
354
355 void visitBinaryOperator(const BinaryOperator *BO) const {
356 if (!BO->isAssignmentOp())
357 return;
358 auto *LHS = BO->getLHS();
359 auto *RHS = BO->getRHS()->IgnoreParenCasts();
360 if (isa<ObjCIvarRefExpr>(Val: LHS)) {
361 const Expr *Inner = nullptr;
362 if (isAllocInit(E: RHS, InnerExpr: &Inner)) {
363 CreateOrCopyFnCall.insert(V: RHS);
364 if (Inner)
365 CreateOrCopyFnCall.insert(V: Inner);
366 }
367 return;
368 }
369 auto *UO = dyn_cast<UnaryOperator>(Val: LHS);
370 if (!UO)
371 return;
372 auto OpCode = UO->getOpcode();
373 if (OpCode != UO_Deref)
374 return;
375 auto *DerefTarget = UO->getSubExpr();
376 if (!DerefTarget)
377 return;
378 DerefTarget = DerefTarget->IgnoreParenCasts();
379 auto *DRE = dyn_cast<DeclRefExpr>(Val: DerefTarget);
380 if (!DRE)
381 return;
382 auto *Decl = DRE->getDecl();
383 if (!Decl)
384 return;
385 if (!isa<ParmVarDecl>(Val: Decl) || !isCreateOrCopy(E: RHS))
386 return;
387 if (Decl->hasAttr<CFReturnsRetainedAttr>())
388 CreateOrCopyFnCall.insert(V: RHS);
389 }
390
391 void visitReturnStmt(const ReturnStmt *RS, const Decl *DeclWithIssue) const {
392 if (!DeclWithIssue)
393 return;
394 auto *RetValue = RS->getRetValue();
395 if (!RetValue)
396 return;
397 RetValue = RetValue->IgnoreParenCasts();
398 std::optional<bool> retainsRet;
399 if (auto *FnDecl = dyn_cast<FunctionDecl>(Val: DeclWithIssue))
400 retainsRet = retainsReturnValue(FnDecl);
401 else if (auto *MethodDecl = dyn_cast<ObjCMethodDecl>(Val: DeclWithIssue))
402 retainsRet = retainsReturnValue(FnDecl: MethodDecl);
403 else
404 return;
405 if (!retainsRet || !*retainsRet) {
406 // Under ARC, returning [[X alloc] init] doesn't leak X.
407 if (RTC.isUnretained(RetValue->getType()))
408 return;
409 }
410 if (retainsRet && *retainsRet) {
411 CreateOrCopyFnCall.insert(V: RetValue);
412 return;
413 }
414 if (auto *CE = dyn_cast<CallExpr>(Val: RetValue)) {
415 auto *Callee = CE->getDirectCallee();
416 if (!Callee || !isCreateOrCopyFunction(FnDecl: Callee))
417 return;
418 CreateOrCopyFnCall.insert(V: CE);
419 return;
420 }
421 const Expr *Inner = nullptr;
422 if (isAllocInit(E: RetValue, InnerExpr: &Inner)) {
423 CreateOrCopyFnCall.insert(V: RetValue);
424 if (Inner)
425 CreateOrCopyFnCall.insert(V: Inner);
426 }
427 }
428
429 template <typename CallableType>
430 std::optional<bool> retainsReturnValue(const CallableType *FnDecl) const {
431 auto Summary = Summaries->getSummary(C: AnyCall(FnDecl));
432 auto RetEffect = Summary->getRetEffect();
433 switch (RetEffect.getKind()) {
434 case RetEffect::NoRet:
435 return std::nullopt;
436 case RetEffect::OwnedSymbol:
437 return true;
438 case RetEffect::NotOwnedSymbol:
439 return false;
440 case RetEffect::OwnedWhenTrackedReceiver:
441 return std::nullopt;
442 case RetEffect::NoRetHard:
443 return std::nullopt;
444 }
445 return std::nullopt;
446 }
447
448 bool isCreateOrCopy(const Expr *E) const {
449 auto *CE = dyn_cast<CallExpr>(Val: E);
450 if (!CE)
451 return false;
452 auto *Callee = CE->getDirectCallee();
453 if (!Callee)
454 return false;
455 return isCreateOrCopyFunction(FnDecl: Callee);
456 }
457
458 bool isCreateOrCopyFunction(const FunctionDecl *FnDecl) const {
459 auto CalleeName = safeGetName(ASTNode: FnDecl);
460 return CalleeName.find(s: "Create") != std::string::npos ||
461 CalleeName.find(s: "Copy") != std::string::npos;
462 }
463
464 enum class IsOwnedResult { Unknown, Skip, Owned, NotOwned };
465 IsOwnedResult isOwned(const Expr *E) const {
466 while (1) {
467 if (auto *POE = dyn_cast<PseudoObjectExpr>(Val: E)) {
468 if (unsigned SemanticExprCount = POE->getNumSemanticExprs()) {
469 E = POE->getSemanticExpr(index: SemanticExprCount - 1);
470 continue;
471 }
472 }
473 if (isNullPtr(E))
474 return IsOwnedResult::NotOwned;
475 if (auto *DRE = dyn_cast<DeclRefExpr>(Val: E)) {
476 auto QT = DRE->getType();
477 if (isRetainPtrOrOSPtrType(T: QT))
478 return IsOwnedResult::NotOwned;
479 QT = QT.getCanonicalType();
480 if (RTC.isUnretained(QT, ignoreARC: true /* ignoreARC */))
481 return IsOwnedResult::NotOwned;
482 auto *PointeeType = QT->getPointeeType().getTypePtrOrNull();
483 if (PointeeType && PointeeType->isVoidType())
484 return IsOwnedResult::NotOwned; // Assume reading void* as +0.
485 }
486 if (auto *TE = dyn_cast<CXXBindTemporaryExpr>(Val: E)) {
487 E = TE->getSubExpr();
488 continue;
489 }
490 if (auto *ObjCMsgExpr = dyn_cast<ObjCMessageExpr>(Val: E)) {
491 auto Summary = Summaries->getSummary(C: AnyCall(ObjCMsgExpr));
492 auto RetEffect = Summary->getRetEffect();
493 switch (RetEffect.getKind()) {
494 case RetEffect::NoRet:
495 return IsOwnedResult::Unknown;
496 case RetEffect::OwnedSymbol:
497 return IsOwnedResult::Owned;
498 case RetEffect::NotOwnedSymbol:
499 return IsOwnedResult::NotOwned;
500 case RetEffect::OwnedWhenTrackedReceiver:
501 if (auto *Receiver = ObjCMsgExpr->getInstanceReceiver()) {
502 E = Receiver->IgnoreParenCasts();
503 continue;
504 }
505 return IsOwnedResult::Unknown;
506 case RetEffect::NoRetHard:
507 return IsOwnedResult::Unknown;
508 }
509 }
510 if (auto *CXXCE = dyn_cast<CXXMemberCallExpr>(Val: E)) {
511 if (auto *MD = CXXCE->getMethodDecl()) {
512 auto *Cls = MD->getParent();
513 if (auto *CD = dyn_cast<CXXConversionDecl>(Val: MD)) {
514 auto QT = CD->getConversionType().getCanonicalType();
515 auto *ResultType = QT.getTypePtrOrNull();
516 if (isRetainPtrOrOSPtr(Name: safeGetName(ASTNode: Cls)) && ResultType &&
517 (ResultType->isPointerType() || ResultType->isReferenceType() ||
518 ResultType->isObjCObjectPointerType()))
519 return IsOwnedResult::NotOwned;
520 }
521 if (safeGetName(ASTNode: MD) == "leakRef" &&
522 isRetainPtrOrOSPtr(Name: safeGetName(ASTNode: Cls)))
523 return IsOwnedResult::Owned;
524 }
525 }
526 if (auto *CE = dyn_cast<CallExpr>(Val: E)) {
527 if (auto *Callee = CE->getDirectCallee()) {
528 if (isAdoptFn(FnDecl: Callee))
529 return IsOwnedResult::NotOwned;
530 auto Name = safeGetName(ASTNode: Callee);
531 if (Name == "__builtin___CFStringMakeConstantString")
532 return IsOwnedResult::NotOwned;
533 if ((Name == "checked_cf_cast" || Name == "dynamic_cf_cast" ||
534 Name == "checked_objc_cast" || Name == "dynamic_objc_cast") &&
535 CE->getNumArgs() == 1) {
536 E = CE->getArg(Arg: 0)->IgnoreParenCasts();
537 continue;
538 }
539 auto RetType = Callee->getReturnType();
540 if (isRetainPtrOrOSPtrType(T: RetType))
541 return IsOwnedResult::NotOwned;
542 if (isCreateOrCopyFunction(FnDecl: Callee)) {
543 CreateOrCopyFnCall.insert(V: CE);
544 return IsOwnedResult::Owned;
545 }
546 } else if (auto *CalleeExpr = CE->getCallee()) {
547 if (isa<CXXDependentScopeMemberExpr>(Val: CalleeExpr))
548 return IsOwnedResult::Skip; // Wait for instantiation.
549 if (isa<UnresolvedLookupExpr>(Val: CalleeExpr))
550 return IsOwnedResult::Skip; // Wait for instantiation.
551 }
552 auto Summary = Summaries->getSummary(C: AnyCall(CE));
553 auto RetEffect = Summary->getRetEffect();
554 switch (RetEffect.getKind()) {
555 case RetEffect::NoRet:
556 return IsOwnedResult::Unknown;
557 case RetEffect::OwnedSymbol:
558 return IsOwnedResult::Owned;
559 case RetEffect::NotOwnedSymbol:
560 return IsOwnedResult::NotOwned;
561 case RetEffect::OwnedWhenTrackedReceiver:
562 return IsOwnedResult::Unknown;
563 case RetEffect::NoRetHard:
564 return IsOwnedResult::Unknown;
565 }
566 }
567 break;
568 }
569 return IsOwnedResult::Unknown;
570 }
571
572 void reportUseAfterFree(const std::string &Name, const CallExpr *CE,
573 const Decl *DeclWithIssue,
574 const char *condition = nullptr) const {
575 SmallString<100> Buf;
576 llvm::raw_svector_ostream Os(Buf);
577
578 Os << "Incorrect use of " << Name
579 << ". The argument is +0 and results in an use-after-free";
580 if (condition)
581 Os << " " << condition;
582 Os << ".";
583
584 assert(BR && "expected nonnull BugReporter");
585 PathDiagnosticLocation BSLoc(CE->getSourceRange().getBegin(),
586 BR->getSourceManager());
587 auto Report = std::make_unique<BasicBugReport>(args: Bug, args: Os.str(), args&: BSLoc);
588 Report->addRange(R: CE->getSourceRange());
589 Report->setDeclWithIssue(DeclWithIssue);
590 BR->emitReport(R: std::move(Report));
591 }
592
593 void reportLeak(std::string &Name, const CXXConstructExpr *CE,
594 const Decl *DeclWithIssue,
595 const char *condition = nullptr) const {
596 SmallString<100> Buf;
597 llvm::raw_svector_ostream Os(Buf);
598
599 Os << "Incorrect use of " << Name
600 << ". The argument is +1 and results in a memory leak";
601 if (condition)
602 Os << " " << condition;
603 Os << ".";
604
605 assert(BR && "expected nonnull BugReporter");
606 PathDiagnosticLocation BSLoc(CE->getSourceRange().getBegin(),
607 BR->getSourceManager());
608 auto Report = std::make_unique<BasicBugReport>(args: Bug, args: Os.str(), args&: BSLoc);
609 Report->addRange(R: CE->getSourceRange());
610 Report->setDeclWithIssue(DeclWithIssue);
611 BR->emitReport(R: std::move(Report));
612 }
613
614 template <typename ExprType>
615 void reportLeak(const ExprType *E, const Decl *DeclWithIssue) const {
616 SmallString<100> Buf;
617 llvm::raw_svector_ostream Os(Buf);
618
619 Os << "The return value is +1 and results in a memory leak.";
620
621 PathDiagnosticLocation BSLoc(E->getSourceRange().getBegin(),
622 BR->getSourceManager());
623 auto Report = std::make_unique<BasicBugReport>(args: Bug, args: Os.str(), args&: BSLoc);
624 Report->addRange(R: E->getSourceRange());
625 Report->setDeclWithIssue(DeclWithIssue);
626 BR->emitReport(R: std::move(Report));
627 }
628};
629} // namespace
630
631void ento::registerRetainPtrCtorAdoptChecker(CheckerManager &Mgr) {
632 Mgr.registerChecker<RetainPtrCtorAdoptChecker>();
633}
634
635bool ento::shouldRegisterRetainPtrCtorAdoptChecker(const CheckerManager &mgr) {
636 return true;
637}
638