17 using namespace clang;
20 using llvm::StrInStrNoCase;
29 return State->get<RefBindings>(Sym);
34 assert(Sym !=
nullptr);
35 return State->set<RefBindings>(Sym, Val);
39 return State->remove<RefBindings>(Sym);
48 return "Reference-counted object is used after it is released";
57 return "Incorrect decrement of the reference count of an object that is " 58 "not owned at this point by the caller";
65 :
RefCountBug(checker,
"-dealloc sent to non-exclusively owned object") {}
68 return "-dealloc sent to object that may be referenced elsewhere";
75 :
RefCountBug(checker,
"Object autoreleased too many times") {}
78 return "Object autoreleased too many times";
85 :
RefCountBug(checker,
"Method should return an owned object") {}
88 return "Object with a +0 retain count returned to caller where a +1 " 89 "(owning) retain count is expected";
97 setSuppressOnSink(
true);
102 bool isLeak()
const override {
return true; }
111 Out <<
"Tracked " << T.getAsString() <<
" | ";
114 default: llvm_unreachable(
"Invalid RefVal kind");
117 unsigned cnt = getCount();
118 if (cnt) Out <<
" (+ " << cnt <<
")";
124 unsigned cnt = getCount();
125 if (cnt) Out <<
" (+ " << cnt <<
")";
129 case ReturnedOwned: {
130 Out <<
"ReturnedOwned";
131 unsigned cnt = getCount();
132 if (cnt) Out <<
" (+ " << cnt <<
")";
136 case ReturnedNotOwned: {
137 Out <<
"ReturnedNotOwned";
138 unsigned cnt = getCount();
139 if (cnt) Out <<
" (+ " << cnt <<
")";
147 case ErrorDeallocNotOwned:
148 Out <<
"-dealloc (not-owned)";
155 case ErrorLeakReturned:
156 Out <<
"Leaked (Bad naming)";
159 case ErrorUseAfterRelease:
160 Out <<
"Use-After-Release [ERROR]";
163 case ErrorReleaseNotOwned:
164 Out <<
"Release of Not-Owned [ERROR]";
168 Out <<
"Over-autoreleased";
172 Out <<
"Non-owned object returned instead of owned";
176 switch (getIvarAccessHistory()) {
179 case IvarAccessHistory::AccessedDirectly:
180 Out <<
" [direct ivar access]";
182 case IvarAccessHistory::ReleasedAfterDirectAccess:
183 Out <<
" [released after direct ivar access]";
187 Out <<
" [autorelease -" << ACnt <<
']';
198 bool VisitSymbol(
SymbolRef sym)
override {
199 state = state->remove<RefBindings>(sym);
221 E = R->referenced_vars_end();
233 for ( ; I != E; ++I) {
234 const VarRegion *VR = I.getCapturedRegion();
238 Regions.push_back(VR);
241 state = state->scanReachableSymbols<StopTrackingCallback>(Regions).getState();
274 state = updateSymbol(state, Sym, *T, AE, hasErr, C);
285 const Expr *Ex)
const {
293 state = updateSymbol(state, sym, *T,
296 processNonLeakError(state, Child->getSourceRange(), hasErr, sym, C);
317 processObjCLiterals(C, AL);
323 processObjCLiterals(C, DL);
347 SymbolRef Sym = State->getSVal(*IVarLoc).getAsSymbol();
395 RetainSummaryManager &Summaries = getSummaryManager(C);
399 if (
const auto *MC = dyn_cast<ObjCMethodCall>(&Call)) {
400 if (MC->isInstanceMessage()) {
401 SVal ReceiverV = MC->getReceiverSVal();
404 ReceiverType = T->getType();
408 const RetainSummary *Summ = Summaries.getSummary(Call, ReceiverType);
411 processSummaryOfInlined(*Summ, Call, C);
414 checkSummary(*Summ, Call, C);
419 if (!leakWithinFunction)
420 leakWithinFunction.reset(
new Leak(
this,
"Leak"));
421 return leakWithinFunction.get();
427 leakAtReturn.reset(
new Leak(
this,
"Leak of returned object"));
428 return leakAtReturn.get();
445 if (PT->isObjCQualifiedIdType() || PT->isObjCIdType() ||
446 PT->isObjCClassType()) {
481 const RefVal *TrackedValue) {
498 for (
unsigned idx = 0, e = CallOrMsg.
getNumArgs(); idx != e; ++idx) {
505 ShouldRemoveBinding =
true;
507 if (ShouldRemoveBinding)
513 if (
const auto *MsgInvocation = dyn_cast<ObjCMethodCall>(&CallOrMsg)) {
514 if (
SymbolRef Sym = MsgInvocation->getReceiverSVal().getAsLocSymbol()) {
550 bool SplitNecessary =
false;
551 for (
auto &
P : Summ.getArgEffects())
554 SplitNecessary =
true;
559 if (SplitNecessary) {
561 AssumeNonZeroReturn = AssumeNonZeroReturn->assume(*DL,
true);
562 AssumeZeroReturn = AssumeZeroReturn->assume(*DL,
false);
566 for (
unsigned idx = 0, e = CE.
getNumArgs(); idx != e; ++idx) {
570 auto *ArgRegion = dyn_cast_or_null<TypedValueRegion>(ArgVal.
getAsRegion());
574 QualType PointeeTy = ArgRegion->getValueType();
575 SVal PointeeVal = State->getSVal(ArgRegion);
594 AssumeNonZeroReturn = makeNotOwnedParameter(AssumeNonZeroReturn);
595 AssumeZeroReturn = makeNotOwnedParameter(AssumeZeroReturn);
598 AssumeNonZeroReturn = makeOwnedParameter(AssumeNonZeroReturn);
599 AssumeZeroReturn = makeOwnedParameter(AssumeZeroReturn);
602 AssumeNonZeroReturn = makeOwnedParameter(AssumeNonZeroReturn);
605 AssumeZeroReturn = makeOwnedParameter(AssumeZeroReturn);
612 if (SplitNecessary) {
613 return {AssumeNonZeroReturn, AssumeZeroReturn};
615 assert(AssumeZeroReturn == AssumeNonZeroReturn);
616 return {AssumeZeroReturn};
633 bool DeallocSent =
false;
635 for (
unsigned idx = 0, e = CallOrMsg.
getNumArgs(); idx != e; ++idx) {
645 state = updateSymbol(state, Sym, *T, Effect, hasErr, C);
658 bool ReceiverIsTracked =
false;
660 if (
const auto *MsgInvocation = dyn_cast<ObjCMethodCall>(&CallOrMsg)) {
661 if (
SymbolRef Sym = MsgInvocation->getReceiverSVal().getAsLocSymbol()) {
663 ReceiverIsTracked =
true;
664 state = updateSymbol(state, Sym, *T,
665 Summ.getReceiverEffect(), hasErr, C);
667 ErrorRange = MsgInvocation->getOriginExpr()->getReceiverRange();
669 }
else if (Summ.getReceiverEffect().getKind() ==
Dealloc) {
674 }
else if (
const auto *MCall = dyn_cast<CXXMemberCall>(&CallOrMsg)) {
675 if (
SymbolRef Sym = MCall->getCXXThisVal().getAsLocSymbol()) {
677 state = updateSymbol(state, Sym, *T, Summ.getThisEffect(),
680 ErrorRange = MCall->getOriginExpr()->getSourceRange();
690 processNonLeakError(state, ErrorRange, hasErr, ErrorSym, C);
698 if (ReceiverIsTracked)
699 RE = getSummaryManager(C).getObjAllocRetEffect();
761 llvm_unreachable(
"Applies to pointer-to-pointer parameters, which should " 762 "not have ref state.");
767 llvm_unreachable(
"Invalid RefVal state for an explicit dealloc.");
803 llvm_unreachable(
"Invalid RefVal state for a retain.");
817 llvm_unreachable(
"Invalid RefVal state for a release.");
880 llvm_unreachable(
"Unhandled error.");
882 if (!useAfterRelease)
884 BT = useAfterRelease.get();
887 if (!releaseNotOwned)
889 BT = releaseNotOwned.get();
892 if (!deallocNotOwned)
894 BT = deallocNotOwned.get();
899 auto report = llvm::make_unique<RefCountReport>(
901 report->addRange(ErrorRange);
916 RetainSummaryManager &SmrMgr = getSummaryManager(C);
921 bool hasTrustedImplementationAnnotation =
false;
925 using BehaviorSummary = RetainSummaryManager::BehaviorSummary;
927 SmrMgr.canEval(CE, FD, hasTrustedImplementationAnnotation);
934 if (BSmr == BehaviorSummary::Identity ||
935 BSmr == BehaviorSummary::IdentityOrZero) {
936 SVal RetVal = state->getSVal(CE->
getArg(0), LCtx);
942 (hasTrustedImplementationAnnotation && !ResultTy.
isNull())) {
947 state = state->BindExpr(CE, LCtx, RetVal,
false);
949 if (BSmr == BehaviorSummary::IdentityOrZero) {
954 NullOutputState = NullOutputState->BindExpr(
962 state = state->assume(*L,
true);
1042 state = handleAutoreleaseCounts(state, Pred, &AutoreleaseTag, C, Sym, X, S);
1054 RetainSummaryManager &Summaries = getSummaryManager(C);
1060 const RetainSummary *Summ = Summaries.getMethodSummary(MD);
1061 RE = Summ->getRetEffect();
1062 }
else if (
const FunctionDecl *FD = dyn_cast<FunctionDecl>(CD)) {
1063 if (!isa<CXXMethodDecl>(FD)) {
1064 const RetainSummary *Summ = Summaries.getFunctionSummary(FD);
1065 RE = Summ->getRetEffect();
1069 return checkReturnWithRetEffect(S, C, Pred, RE, X, Sym, state);
1103 auto R = llvm::make_unique<RefLeakReport>(
1104 *getLeakAtReturnBug(LOpts), LOpts, N, Sym, C);
1124 ReturnNotOwnedTag(
this,
"ReturnNotOwnedForOwned");
1128 if (!returnNotOwnedForOwned)
1131 auto R = llvm::make_unique<RefCountReport>(
1149 bool escapes =
true;
1164 if (
const auto *LVR = dyn_cast_or_null<VarRegion>(loc.
getAsRegion())) {
1165 const VarDecl *VD = LVR->getDecl();
1166 if (VD->
hasAttr<CleanupAttr>()) {
1179 state = state->scanReachableSymbols<StopTrackingCallback>(val).getState();
1185 bool Assumption)
const {
1192 RefBindingsTy B = state->get<RefBindings>();
1197 bool changed =
false;
1198 RefBindingsTy::Factory &RefBFactory = state->get_context<RefBindings>();
1200 for (RefBindingsTy::iterator I = B.begin(), E = B.end(); I != E; ++I) {
1206 B = RefBFactory.remove(B, I.getKey());
1211 state = state->set<RefBindings>(B);
1226 llvm::SmallPtrSet<SymbolRef, 8> WhitelistedSymbols;
1228 E = ExplicitRegions.end(); I != E; ++I) {
1230 WhitelistedSymbols.insert(SR->getSymbol());
1234 llvm::make_range(invalidated->begin(), invalidated->end())) {
1235 if (WhitelistedSymbols.count(sym))
1304 llvm::raw_svector_ostream os(sbuf);
1305 os <<
"Object was autoreleased ";
1310 os <<
"has a +" << V.
getCount() <<
" retain count";
1312 if (!overAutorelease)
1316 auto R = llvm::make_unique<RefCountReport>(*overAutorelease, LOpts, N, Sym,
1348 Leaked.push_back(sid);
1362 I = Leaked.begin(), E = Leaked.end(); I != E; ++I) {
1365 RefCountBug *BT = Pred ? getLeakWithinFunctionBug(LOpts)
1366 : getLeakAtReturnBug(LOpts);
1367 assert(BT &&
"BugType not initialized.");
1370 llvm::make_unique<RefLeakReport>(*BT, LOpts, N, *I, Ctx));
1378 return StringRef(Ty.
getAsString()).startswith(
"isl_");
1385 RetainSummaryManager &SmrMgr = getSummaryManager(Ctx);
1389 if (!FD || SmrMgr.isTrustedReferenceCountImplementation(FD))
1393 const RetainSummary *FunctionSummary = SmrMgr.getFunctionSummary(FD);
1394 ArgEffects CalleeSideArgEffects = FunctionSummary->getArgEffects();
1396 for (
unsigned idx = 0, e = FD->
getNumParams(); idx != e; ++idx) {
1398 SymbolRef Sym = state->getSVal(state->getRegion(Param, LCtx)).getAsSymbol();
1401 const ArgEffect *AE = CalleeSideArgEffects.lookup(idx);
1425 RefBindingsTy B = state->get<RefBindings>();
1429 if (LCtx->getAnalysisDeclContext()->isBodyAutosynthesized()) {
1430 assert(!LCtx->inTopFrame());
1434 for (RefBindingsTy::iterator I = B.begin(), E = B.end(); I != E; ++I) {
1435 state = handleAutoreleaseCounts(state, Pred,
nullptr, Ctx,
1436 I->first, I->second);
1445 if (LCtx->getParent())
1448 B = state->get<RefBindings>();
1451 for (RefBindingsTy::iterator I = B.begin(), E = B.end(); I != E; ++I)
1452 state = handleSymbolDeath(state, I->first, I->second, Leaked);
1454 processLeaks(state, Leaked, Ctx, Pred);
1462 RefBindingsTy B = state->get<RefBindings>();
1466 for (
const auto &I: state->get<RefBindings>()) {
1468 if (SymReaper.
isDead(Sym)) {
1470 const RefVal &V = I.second;
1471 state = handleAutoreleaseCounts(state, Pred, &Tag, C, Sym, V);
1477 state = handleSymbolDeath(state, Sym, *
getRefBinding(state, Sym), Leaked);
1481 if (Leaked.empty()) {
1486 Pred = processLeaks(state, Leaked, C, Pred);
1494 RefBindingsTy::Factory &F = state->get_context<RefBindings>();
1495 B = state->get<RefBindings>();
1500 B = F.remove(B, *I);
1502 state = state->set<RefBindings>(B);
1507 const char *NL,
const char *Sep)
const {
1509 RefBindingsTy B = State->get<RefBindings>();
1516 for (RefBindingsTy::iterator I = B.begin(), E = B.end(); I != E; ++I) {
1517 Out << I->first <<
" : ";
1518 I->second.print(Out);
1537 auto I = Options.
Config.find(
"osx.cocoa.RetainCount:CheckOSObject");
1538 if (I != Options.
Config.end())
1539 return I->getValue() ==
"false";
1543 void ento::registerOSObjectRetainCountChecker(
CheckerManager &Mgr) {
1546 Chk->TrackOSObjects =
true;
Indicates that the tracked object is a generalized object.
Indicates that the tracked object is a CF object.
const BlockDecl * getBlockDecl() const
ProgramStateRef handleAutoreleaseCounts(ProgramStateRef state, ExplodedNode *Pred, const ProgramPointTag *Tag, CheckerContext &Ctx, SymbolRef Sym, RefVal V, const ReturnStmt *S=nullptr) const
Represents a function declaration or definition.
ObjKind
Determines the object kind of a tracked object.
ReturnedNotOwnedForOwned(const CheckerBase *checker)
A (possibly-)qualified type.
MemRegion - The root abstract class for all memory regions.
ExplodedNode * generateErrorNode(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generate a transition to a node that will be used to report an error.
bool isReturnedOwned() const
Expr * getArg(unsigned Arg)
getArg - Return the specified argument.
bool hasCaptures() const
True if this block (or its nested blocks) captures anything of local storage from its enclosing scope...
ProgramStateRef handleSymbolDeath(ProgramStateRef state, SymbolRef sid, RefVal V, SmallVectorImpl< SymbolRef > &Leaked) const
bool isDead(SymbolRef sym)
Returns whether or not a symbol has been confirmed dead.
ProgramStateRef setRefBinding(ProgramStateRef State, SymbolRef Sym, RefVal Val)
The argument has its reference count decreased by 1 to model a transferred bridge cast under ARC...
bool evalCall(const CallExpr *CE, CheckerContext &C) const
Stmt - This represents one statement.
QualType getPointeeType() const
If this is a pointer, ObjC object pointer, or block pointer, this returns the respective pointee...
Bridging via __bridge, which does nothing but reinterpret the bits.
All typestate tracking of the object ceases.
UseAfterRelease(const CheckerBase *checker)
ObjKind getObjKind() const
ExplodedNode * addTransition(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generates a new transition in the program state graph (ExplodedGraph).
Decl - This represents one declaration (or definition), e.g.
The argument has its reference count increased by 1.
static SmallVector< ProgramStateRef, 2 > updateOutParameters(ProgramStateRef State, const RetainSummary &Summ, const CallEvent &CE)
void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const
The argument is treated as if an -autorelease message had been sent to the referenced object...
const ProgramStateRef & getState() const
Indicates that no retain count information is tracked for the return value.
static bool isPointerToObject(QualType QT)
RefCountBug * getLeakAtReturnBug(const LangOptions &LOpts) const
const Expr * getOriginExpr() const
Returns the expression whose value will be the result of this call.
static RetEffect MakeNoRet()
Represents a variable declaration or definition.
SymbolRef getAsLocSymbol(bool IncludeBaseRegions=false) const
If this SVal is a location and wraps a symbol, return that SymbolRef.
const T * getAs() const
Member-template getAs<specific type>'.
RefVal withIvarAccess() const
const FunctionDecl * getCalleeDecl(const CallExpr *CE) const
Get the declaration of the called function (path-sensitive).
const Decl & getCodeDecl() const
ObjCMethodDecl - Represents an instance or class method declaration.
ExplodedNode * getPredecessor()
Returns the previous node in the exploded graph, which includes the state of the program before the c...
ObjKind getObjKind() const
virtual const MemRegion * getOriginRegion() const
Find the region from which this symbol originates.
SVal getSVal(const Stmt *S) const
Get the value of arbitrary expressions at this point in the path.
Represents a parameter to a function.
const bool wasInlined
If we are post visiting a call, this flag will be set if the call was inlined.
unsigned getCount() const
RefCountBug * getLeakWithinFunctionBug(const LangOptions &LOpts) const
const MemRegion * getSuperRegion() const
ConditionTruthVal isNull(ProgramStateRef State, SymbolRef Sym)
Convenience method to query the state to see if a symbol is null or not null, or if neither assumptio...
MemRegionManager & getRegionManager()
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
RefVal releaseViaIvar() const
void processNonLeakError(ProgramStateRef St, SourceRange ErrorRange, RefVal::Kind ErrorKind, SymbolRef Sym, CheckerContext &C) const
Keeps track of the various options that can be enabled, which controls the dialect of C or C++ that i...
ObjCArrayLiteral - used for objective-c array containers; as in: @["Hello", NSApp, [NSNumber numberWithInt:42]];.
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
The argument has its reference count decreased by 1.
The argument is a pointer to a retain-counted object; on exit, the new value of the pointer is a +0 v...
void checkPostCall(const CallEvent &Call, CheckerContext &C) const
Indicates that the return value is an owned object when the receiver is also a tracked object...
const LocationContext * getLocationContext() const
The argument is a pointer to a retain-counted object; on exit, the new value of the pointer is a +1 v...
const char * getDescription() const override
void setCount(unsigned i)
SVal getReturnValue() const
Returns the return value of the call.
const char * getDescription() const override
CastExpr - Base class for type casts, including both implicit casts (ImplicitCastExpr) and explicit c...
const char * getDescription() const override
Represents an ObjC class declaration.
Bridging via __bridge_transfer, which transfers ownership of an Objective-C pointer into ARC...
static bool shouldEscapeOSArgumentOnCall(const CallEvent &CE, unsigned ArgIdx, const RefVal *TrackedValue)
Whether the tracked value should be escaped on a given call.
virtual QualType getType() const =0
virtual ArrayRef< ParmVarDecl * > parameters() const =0
Return call's formal parameters.
SymbolRef getAsSymbol(bool IncludeBaseRegions=false) const
If this SVal wraps a symbol return that SymbolRef.
const char * getDescription() const override
bool isConstrainedTrue() const
Return true if the constraint is perfectly constrained to 'true'.
void checkBind(SVal loc, SVal val, const Stmt *S, CheckerContext &C) const
CXXRecordDecl * getAsCXXRecordDecl() const
Retrieves the CXXRecordDecl that this type refers to, either because the type is a RecordType or beca...
bool isSynthesizedAccessor(const StackFrameContext *SFC)
Returns true if this stack frame is for an Objective-C method that is a property getter or setter who...
IvarAccessHistory getIvarAccessHistory() const
Returns what the analyzer knows about direct accesses to a particular instance variable.
const RegionTy * getAs() const
SymbolicRegion - A special, "non-concrete" region.
The argument is treated as potentially escaping, meaning that even when its reference count hits 0 it...
void checkBeginFunction(CheckerContext &C) const
void checkPostStmt(const BlockExpr *BE, CheckerContext &C) const
This represents one expression.
void setAutoreleaseCount(unsigned i)
static bool shouldEscapeRegion(const MemRegion *R)
bool TrackObjCAndCFObjects
Track Objective-C and CoreFoundation objects.
bool isObjCRetainableType() const
BlockExpr - Adaptor class for mixing a BlockDecl with expressions.
OverAutorelease(const CheckerBase *checker)
ObjCDictionaryLiteral - AST node to represent objective-c dictionary literals; as in:"name" : NSUserN...
void printState(raw_ostream &Out, ProgramStateRef State, const char *NL, const char *Sep) const override
See CheckerManager::runCheckersForPrintState.
The argument is treated as if the referenced object was deallocated.
ReturnStmt - This represents a return, optionally of an expression: return; return 4;...
bool isCFObjectRef(QualType T)
bool isReturnedNotOwned() const
ExplodedNode * checkReturnWithRetEffect(const ReturnStmt *S, CheckerContext &C, ExplodedNode *Pred, RetEffect RE, RefVal X, SymbolRef Sym, ProgramStateRef state) const
An expression that sends a message to the given Objective-C object or class.
void processObjCLiterals(CheckerContext &C, const Expr *Ex) const
QualType getObjCInterfaceType(const ObjCInterfaceDecl *Decl, ObjCInterfaceDecl *PrevDecl=nullptr) const
getObjCInterfaceType - Return the unique reference to the type for the specified ObjC interface decl...
ObjCBridgeCastKind getBridgeKind() const
Determine which kind of bridge is being performed via this cast.
bool isNull() const
Return true if this QualType doesn't point to a type yet.
ProgramStateRef updateSymbol(ProgramStateRef state, SymbolRef sym, RefVal V, ArgEffect E, RefVal::Kind &hasErr, CheckerContext &C) const
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type...
const VarDecl * getDecl() const
void emitReport(std::unique_ptr< BugReport > R)
Emit the diagnostics report.
static bool isISLObjectRef(QualType Ty)
void print(raw_ostream &Out) const
ArgEffectKind getKind() const
DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag, const Expr *expr, const LocationContext *LCtx, unsigned count)
Create a new symbol with a unique 'name'.
CHECKER * registerChecker(AT &&... Args)
Used to register checkers.
ExplodedNode * generateSink(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
Generate a sink node.
Leak(const CheckerBase *checker, StringRef name)
#define REGISTER_MAP_WITH_PROGRAMSTATE(Name, Key, Value)
Declares an immutable map of type NameTy, suitable for placement into the ProgramState.
DeallocNotOwned(const CheckerBase *checker)
ProgramPoints can be "tagged" as representing points specific to a given analysis entity...
Indicates that the tracked object is an Objective-C object.
const MemRegion * getAsRegion() const
ConfigTable Config
A key-value table of use-specified configuration values.
ProgramStateRef evalAssume(ProgramStateRef state, SVal Cond, bool Assumption) const
unsigned getAutoreleaseCount() const
const ParmVarDecl * getParamDecl(unsigned i) const
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
Performs the combined functionality of DecRef and StopTrackingHard.
ProgramStateRef removeRefBinding(ProgramStateRef State, SymbolRef Sym)
A class responsible for cleaning up unused symbols.
SVal getSVal(const Stmt *S) const
Get the value of an arbitrary expression at this node.
ObjCBoxedExpr - used for generalized expression boxing.
static bool hasPrevCheckOSObjectOptionDisabled(AnalyzerOptions &Options)
unsigned blockCount() const
Returns the number of times the current block has been visited along the analyzed path...
An Objective-C "bridged" cast expression, which casts between Objective-C pointers and C pointers...
Dataflow Directional Tag Classes.
ASTContext & getASTContext()
virtual SourceRange getArgSourceRange(unsigned Index) const
Returns the source range for errors associated with this argument.
const VarRegion * getVarRegion(const VarDecl *D, const LocationContext *LC)
getVarRegion - Retrieve or create the memory region associated with a specified VarDecl and LocationC...
static Optional< RefVal > refValFromRetEffect(RetEffect RE, QualType ResultTy)
ProgramStateRef checkRegionChanges(ProgramStateRef state, const InvalidatedSymbols *invalidated, ArrayRef< const MemRegion *> ExplicitRegions, ArrayRef< const MemRegion *> Regions, const LocationContext *LCtx, const CallEvent *Call) const
ExplodedNode * processLeaks(ProgramStateRef state, SmallVectorImpl< SymbolRef > &Leaked, CheckerContext &Ctx, ExplodedNode *Pred=nullptr) const
static std::string getAsString(SplitQualType split, const PrintingPolicy &Policy)
RefVal autorelease() const
const MemRegion * StripCasts(bool StripBaseAndDerivedCasts=true) const
static RefVal makeOwned(ObjKind o, QualType t)
Create a state for an object whose lifetime is the responsibility of the current function, at least partially.
QualType getCallReturnType(const ASTContext &Ctx) const
getCallReturnType - Get the return type of the call expr.
Represents an abstract call to a function or method along a particular path.
Bridging via __bridge_retain, which makes an ARC object available as a +1 C pointer.
AnalyzerOptions & getAnalyzerOptions()
const Decl * getDecl() const
Represents a pointer to an Objective C object.
const StackFrameContext * getStackFrame() const
Indicates that the tracking object is a descendant of a referenced-counted OSObject, used in the Darwin kernel.
const ProgramStateRef & getState() const
void checkEndFunction(const ReturnStmt *RS, CheckerContext &C) const
const RefVal * getRefBinding(ProgramStateRef State, SymbolRef Sym)
bool hasStackStorage() const
Stores options for the analyzer from the command line.
ObjCIvarRefExpr - A reference to an ObjC instance variable.
QualType getResultType() const
Returns the result type, adjusted for references.
X
Add a minimal nested name specifier fixit hint to allow lookup of a tag name from an outer enclosing ...
ArgEffect withKind(ArgEffectKind NewK)
All typestate tracking of the object ceases.
static RefVal makeNotOwned(ObjKind o, QualType t)
Create a state for an object whose lifetime is not the responsibility of the current function...
virtual unsigned getNumArgs() const =0
Returns the number of arguments (explicit and implicit).
The argument is a pointer to a retain-counted object; on exit, the new value of the pointer is a +1 v...
void checkSummary(const RetainSummary &Summ, const CallEvent &Call, CheckerContext &C) const
SValBuilder & getSValBuilder()
CallExpr - Represents a function call (C99 6.5.2.2, C++ [expr.call]).
static Decl::Kind getKind(const Decl *D)
const char * getDescription() const override
The argument is a pointer to a retain-counted object; on exit, the new value of the pointer is a +1 v...
virtual SVal getArgSVal(unsigned Index) const
Returns the value of a given argument at the time of the call.
void processSummaryOfInlined(const RetainSummary &Summ, const CallEvent &Call, CheckerContext &C) const
BadRelease(const CheckerBase *checker)
A trivial tuple used to represent a source range.
An ArgEffect summarizes the retain count behavior on an argument or receiver to a function or method...
Tag that can use a checker name as a message provider (see SimpleProgramPointTag).
QualType getObjCObjectPointerType(QualType OIT) const
Return a ObjCObjectPointerType type for the given ObjCObjectType.
bool inTopFrame() const
Return true if the current LocationContext has no caller context.
const char * getDescription() const override
bool isLeak() const override
const LocationContext * getLocationContext() const
unsigned getNumParams() const
Return the number of parameters this function must have based on its FunctionType.
const LangOptions & getLangOpts() const
static QualType GetReturnType(const Expr *RetE, ASTContext &Ctx)
GetReturnType - Used to get the return type of a message expression or function call with the intenti...
RetEffect summarizes a call's retain/release behavior with respect to its return value.