RetainCountChecker.cpp revision 2104374e29e2cca55c3c0bce41fa77d92527a695 
1//==-- RetainCountChecker.cpp - Checks for leaks and other issues -*- C++ -*--//
2//
3//                     The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10//  This file defines the methods for RetainCountChecker, which implements
11//  a reference count checker for Core Foundation and Cocoa on (Mac OS X).
12//
13//===----------------------------------------------------------------------===//
14
15#include "ClangSACheckers.h"
16#include "clang/AST/Attr.h"
17#include "clang/AST/DeclCXX.h"
18#include "clang/AST/DeclObjC.h"
19#include "clang/AST/ParentMap.h"
20#include "clang/Analysis/DomainSpecific/CocoaConventions.h"
21#include "clang/Basic/LangOptions.h"
22#include "clang/Basic/SourceManager.h"
23#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
24#include "clang/StaticAnalyzer/Core/BugReporter/PathDiagnostic.h"
25#include "clang/StaticAnalyzer/Core/Checker.h"
26#include "clang/StaticAnalyzer/Core/CheckerManager.h"
27#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
28#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
29#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
30#include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h"
31#include "clang/StaticAnalyzer/Checkers/ObjCRetainCount.h"
32#include "llvm/ADT/DenseMap.h"
33#include "llvm/ADT/FoldingSet.h"
34#include "llvm/ADT/ImmutableList.h"
35#include "llvm/ADT/ImmutableMap.h"
36#include "llvm/ADT/STLExtras.h"
37#include "llvm/ADT/SmallString.h"
38#include "llvm/ADT/StringExtras.h"
39#include <cstdarg>
40
41#include "AllocationDiagnostics.h"
42
43using namespace clang;
44using namespace ento;
45using namespace objc_retain;
46using llvm::StrInStrNoCase;
47
48//===----------------------------------------------------------------------===//
49// Adapters for FoldingSet.
50//===----------------------------------------------------------------------===//
51
52namespace llvm {
53template <> struct FoldingSetTrait<ArgEffect> {
54static inline void Profile(const ArgEffect X, FoldingSetNodeID &ID) {
55  ID.AddInteger((unsigned) X);
56}
57};
58template <> struct FoldingSetTrait<RetEffect> {
59  static inline void Profile(const RetEffect &X, FoldingSetNodeID &ID) {
60    ID.AddInteger((unsigned) X.getKind());
61    ID.AddInteger((unsigned) X.getObjKind());
62}
63};
64} // end llvm namespace
65
66//===----------------------------------------------------------------------===//
67// Reference-counting logic (typestate + counts).
68//===----------------------------------------------------------------------===//
69
70/// ArgEffects summarizes the effects of a function/method call on all of
71/// its arguments.
72typedef llvm::ImmutableMap<unsigned,ArgEffect> ArgEffects;
73
74namespace {
75class RefVal {
76public:
77  enum Kind {
78    Owned = 0, // Owning reference.
79    NotOwned,  // Reference is not owned by still valid (not freed).
80    Released,  // Object has been released.
81    ReturnedOwned, // Returned object passes ownership to caller.
82    ReturnedNotOwned, // Return object does not pass ownership to caller.
83    ERROR_START,
84    ErrorDeallocNotOwned, // -dealloc called on non-owned object.
85    ErrorDeallocGC, // Calling -dealloc with GC enabled.
86    ErrorUseAfterRelease, // Object used after released.
87    ErrorReleaseNotOwned, // Release of an object that was not owned.
88    ERROR_LEAK_START,
89    ErrorLeak,  // A memory leak due to excessive reference counts.
90    ErrorLeakReturned, // A memory leak due to the returning method not having
91                       // the correct naming conventions.
92    ErrorGCLeakReturned,
93    ErrorOverAutorelease,
94    ErrorReturnedNotOwned
95  };
96
97private:
98  Kind kind;
99  RetEffect::ObjKind okind;
100  unsigned Cnt;
101  unsigned ACnt;
102  QualType T;
103
104  RefVal(Kind k, RetEffect::ObjKind o, unsigned cnt, unsigned acnt, QualType t)
105  : kind(k), okind(o), Cnt(cnt), ACnt(acnt), T(t) {}
106
107public:
108  Kind getKind() const { return kind; }
109
110  RetEffect::ObjKind getObjKind() const { return okind; }
111
112  unsigned getCount() const { return Cnt; }
113  unsigned getAutoreleaseCount() const { return ACnt; }
114  unsigned getCombinedCounts() const { return Cnt + ACnt; }
115  void clearCounts() { Cnt = 0; ACnt = 0; }
116  void setCount(unsigned i) { Cnt = i; }
117  void setAutoreleaseCount(unsigned i) { ACnt = i; }
118
119  QualType getType() const { return T; }
120
121  bool isOwned() const {
122    return getKind() == Owned;
123  }
124
125  bool isNotOwned() const {
126    return getKind() == NotOwned;
127  }
128
129  bool isReturnedOwned() const {
130    return getKind() == ReturnedOwned;
131  }
132
133  bool isReturnedNotOwned() const {
134    return getKind() == ReturnedNotOwned;
135  }
136
137  static RefVal makeOwned(RetEffect::ObjKind o, QualType t,
138                          unsigned Count = 1) {
139    return RefVal(Owned, o, Count, 0, t);
140  }
141
142  static RefVal makeNotOwned(RetEffect::ObjKind o, QualType t,
143                             unsigned Count = 0) {
144    return RefVal(NotOwned, o, Count, 0, t);
145  }
146
147  // Comparison, profiling, and pretty-printing.
148
149  bool operator==(const RefVal& X) const {
150    return kind == X.kind && Cnt == X.Cnt && T == X.T && ACnt == X.ACnt;
151  }
152
153  RefVal operator-(size_t i) const {
154    return RefVal(getKind(), getObjKind(), getCount() - i,
155                  getAutoreleaseCount(), getType());
156  }
157
158  RefVal operator+(size_t i) const {
159    return RefVal(getKind(), getObjKind(), getCount() + i,
160                  getAutoreleaseCount(), getType());
161  }
162
163  RefVal operator^(Kind k) const {
164    return RefVal(k, getObjKind(), getCount(), getAutoreleaseCount(),
165                  getType());
166  }
167
168  RefVal autorelease() const {
169    return RefVal(getKind(), getObjKind(), getCount(), getAutoreleaseCount()+1,
170                  getType());
171  }
172
173  void Profile(llvm::FoldingSetNodeID& ID) const {
174    ID.AddInteger((unsigned) kind);
175    ID.AddInteger(Cnt);
176    ID.AddInteger(ACnt);
177    ID.Add(T);
178  }
179
180  void print(raw_ostream &Out) const;
181};
182
183void RefVal::print(raw_ostream &Out) const {
184  if (!T.isNull())
185    Out << "Tracked " << T.getAsString() << '/';
186
187  switch (getKind()) {
188    default: llvm_unreachable("Invalid RefVal kind");
189    case Owned: {
190      Out << "Owned";
191      unsigned cnt = getCount();
192      if (cnt) Out << " (+ " << cnt << ")";
193      break;
194    }
195
196    case NotOwned: {
197      Out << "NotOwned";
198      unsigned cnt = getCount();
199      if (cnt) Out << " (+ " << cnt << ")";
200      break;
201    }
202
203    case ReturnedOwned: {
204      Out << "ReturnedOwned";
205      unsigned cnt = getCount();
206      if (cnt) Out << " (+ " << cnt << ")";
207      break;
208    }
209
210    case ReturnedNotOwned: {
211      Out << "ReturnedNotOwned";
212      unsigned cnt = getCount();
213      if (cnt) Out << " (+ " << cnt << ")";
214      break;
215    }
216
217    case Released:
218      Out << "Released";
219      break;
220
221    case ErrorDeallocGC:
222      Out << "-dealloc (GC)";
223      break;
224
225    case ErrorDeallocNotOwned:
226      Out << "-dealloc (not-owned)";
227      break;
228
229    case ErrorLeak:
230      Out << "Leaked";
231      break;
232
233    case ErrorLeakReturned:
234      Out << "Leaked (Bad naming)";
235      break;
236
237    case ErrorGCLeakReturned:
238      Out << "Leaked (GC-ed at return)";
239      break;
240
241    case ErrorUseAfterRelease:
242      Out << "Use-After-Release [ERROR]";
243      break;
244
245    case ErrorReleaseNotOwned:
246      Out << "Release of Not-Owned [ERROR]";
247      break;
248
249    case RefVal::ErrorOverAutorelease:
250      Out << "Over-autoreleased";
251      break;
252
253    case RefVal::ErrorReturnedNotOwned:
254      Out << "Non-owned object returned instead of owned";
255      break;
256  }
257
258  if (ACnt) {
259    Out << " [ARC +" << ACnt << ']';
260  }
261}
262} //end anonymous namespace
263
264//===----------------------------------------------------------------------===//
265// RefBindings - State used to track object reference counts.
266//===----------------------------------------------------------------------===//
267
268REGISTER_MAP_WITH_PROGRAMSTATE(RefBindings, SymbolRef, RefVal)
269
270static inline const RefVal *getRefBinding(ProgramStateRef State,
271                                          SymbolRef Sym) {
272  return State->get<RefBindings>(Sym);
273}
274
275static inline ProgramStateRef setRefBinding(ProgramStateRef State,
276                                            SymbolRef Sym, RefVal Val) {
277  return State->set<RefBindings>(Sym, Val);
278}
279
280static ProgramStateRef removeRefBinding(ProgramStateRef State, SymbolRef Sym) {
281  return State->remove<RefBindings>(Sym);
282}
283
284//===----------------------------------------------------------------------===//
285// Function/Method behavior summaries.
286//===----------------------------------------------------------------------===//
287
288namespace {
289class RetainSummary {
290  /// Args - a map of (index, ArgEffect) pairs, where index
291  ///  specifies the argument (starting from 0).  This can be sparsely
292  ///  populated; arguments with no entry in Args use 'DefaultArgEffect'.
293  ArgEffects Args;
294
295  /// DefaultArgEffect - The default ArgEffect to apply to arguments that
296  ///  do not have an entry in Args.
297  ArgEffect DefaultArgEffect;
298
299  /// Receiver - If this summary applies to an Objective-C message expression,
300  ///  this is the effect applied to the state of the receiver.
301  ArgEffect Receiver;
302
303  /// Ret - The effect on the return value.  Used to indicate if the
304  ///  function/method call returns a new tracked symbol.
305  RetEffect Ret;
306
307public:
308  RetainSummary(ArgEffects A, RetEffect R, ArgEffect defaultEff,
309                ArgEffect ReceiverEff)
310    : Args(A), DefaultArgEffect(defaultEff), Receiver(ReceiverEff), Ret(R) {}
311
312  /// getArg - Return the argument effect on the argument specified by
313  ///  idx (starting from 0).
314  ArgEffect getArg(unsigned idx) const {
315    if (const ArgEffect *AE = Args.lookup(idx))
316      return *AE;
317
318    return DefaultArgEffect;
319  }
320
321  void addArg(ArgEffects::Factory &af, unsigned idx, ArgEffect e) {
322    Args = af.add(Args, idx, e);
323  }
324
325  /// setDefaultArgEffect - Set the default argument effect.
326  void setDefaultArgEffect(ArgEffect E) {
327    DefaultArgEffect = E;
328  }
329
330  /// getRetEffect - Returns the effect on the return value of the call.
331  RetEffect getRetEffect() const { return Ret; }
332
333  /// setRetEffect - Set the effect of the return value of the call.
334  void setRetEffect(RetEffect E) { Ret = E; }
335
336
337  /// Sets the effect on the receiver of the message.
338  void setReceiverEffect(ArgEffect e) { Receiver = e; }
339
340  /// getReceiverEffect - Returns the effect on the receiver of the call.
341  ///  This is only meaningful if the summary applies to an ObjCMessageExpr*.
342  ArgEffect getReceiverEffect() const { return Receiver; }
343
344  /// Test if two retain summaries are identical. Note that merely equivalent
345  /// summaries are not necessarily identical (for example, if an explicit
346  /// argument effect matches the default effect).
347  bool operator==(const RetainSummary &Other) const {
348    return Args == Other.Args && DefaultArgEffect == Other.DefaultArgEffect &&
349           Receiver == Other.Receiver && Ret == Other.Ret;
350  }
351
352  /// Profile this summary for inclusion in a FoldingSet.
353  void Profile(llvm::FoldingSetNodeID& ID) const {
354    ID.Add(Args);
355    ID.Add(DefaultArgEffect);
356    ID.Add(Receiver);
357    ID.Add(Ret);
358  }
359
360  /// A retain summary is simple if it has no ArgEffects other than the default.
361  bool isSimple() const {
362    return Args.isEmpty();
363  }
364
365private:
366  ArgEffects getArgEffects() const { return Args; }
367  ArgEffect getDefaultArgEffect() const { return DefaultArgEffect; }
368
369  friend class RetainSummaryManager;
370};
371} // end anonymous namespace
372
373//===----------------------------------------------------------------------===//
374// Data structures for constructing summaries.
375//===----------------------------------------------------------------------===//
376
377namespace {
378class ObjCSummaryKey {
379  IdentifierInfo* II;
380  Selector S;
381public:
382  ObjCSummaryKey(IdentifierInfo* ii, Selector s)
383    : II(ii), S(s) {}
384
385  ObjCSummaryKey(const ObjCInterfaceDecl *d, Selector s)
386    : II(d ? d->getIdentifier() : 0), S(s) {}
387
388  ObjCSummaryKey(Selector s)
389    : II(0), S(s) {}
390
391  IdentifierInfo *getIdentifier() const { return II; }
392  Selector getSelector() const { return S; }
393};
394}
395
396namespace llvm {
397template <> struct DenseMapInfo<ObjCSummaryKey> {
398  static inline ObjCSummaryKey getEmptyKey() {
399    return ObjCSummaryKey(DenseMapInfo<IdentifierInfo*>::getEmptyKey(),
400                          DenseMapInfo<Selector>::getEmptyKey());
401  }
402
403  static inline ObjCSummaryKey getTombstoneKey() {
404    return ObjCSummaryKey(DenseMapInfo<IdentifierInfo*>::getTombstoneKey(),
405                          DenseMapInfo<Selector>::getTombstoneKey());
406  }
407
408  static unsigned getHashValue(const ObjCSummaryKey &V) {
409    typedef std::pair<IdentifierInfo*, Selector> PairTy;
410    return DenseMapInfo<PairTy>::getHashValue(PairTy(V.getIdentifier(),
411                                                     V.getSelector()));
412  }
413
414  static bool isEqual(const ObjCSummaryKey& LHS, const ObjCSummaryKey& RHS) {
415    return LHS.getIdentifier() == RHS.getIdentifier() &&
416           LHS.getSelector() == RHS.getSelector();
417  }
418
419};
420template <>
421struct isPodLike<ObjCSummaryKey> { static const bool value = true; };
422} // end llvm namespace
423
424namespace {
425class ObjCSummaryCache {
426  typedef llvm::DenseMap<ObjCSummaryKey, const RetainSummary *> MapTy;
427  MapTy M;
428public:
429  ObjCSummaryCache() {}
430
431  const RetainSummary * find(const ObjCInterfaceDecl *D, Selector S) {
432    // Do a lookup with the (D,S) pair.  If we find a match return
433    // the iterator.
434    ObjCSummaryKey K(D, S);
435    MapTy::iterator I = M.find(K);
436
437    if (I != M.end())
438      return I->second;
439    if (!D)
440      return NULL;
441
442    // Walk the super chain.  If we find a hit with a parent, we'll end
443    // up returning that summary.  We actually allow that key (null,S), as
444    // we cache summaries for the null ObjCInterfaceDecl* to allow us to
445    // generate initial summaries without having to worry about NSObject
446    // being declared.
447    // FIXME: We may change this at some point.
448    for (ObjCInterfaceDecl *C=D->getSuperClass() ;; C=C->getSuperClass()) {
449      if ((I = M.find(ObjCSummaryKey(C, S))) != M.end())
450        break;
451
452      if (!C)
453        return NULL;
454    }
455
456    // Cache the summary with original key to make the next lookup faster
457    // and return the iterator.
458    const RetainSummary *Summ = I->second;
459    M[K] = Summ;
460    return Summ;
461  }
462
463  const RetainSummary *find(IdentifierInfo* II, Selector S) {
464    // FIXME: Class method lookup.  Right now we dont' have a good way
465    // of going between IdentifierInfo* and the class hierarchy.
466    MapTy::iterator I = M.find(ObjCSummaryKey(II, S));
467
468    if (I == M.end())
469      I = M.find(ObjCSummaryKey(S));
470
471    return I == M.end() ? NULL : I->second;
472  }
473
474  const RetainSummary *& operator[](ObjCSummaryKey K) {
475    return M[K];
476  }
477
478  const RetainSummary *& operator[](Selector S) {
479    return M[ ObjCSummaryKey(S) ];
480  }
481};
482} // end anonymous namespace
483
484//===----------------------------------------------------------------------===//
485// Data structures for managing collections of summaries.
486//===----------------------------------------------------------------------===//
487
488namespace {
489class RetainSummaryManager {
490
491  //==-----------------------------------------------------------------==//
492  //  Typedefs.
493  //==-----------------------------------------------------------------==//
494
495  typedef llvm::DenseMap<const FunctionDecl*, const RetainSummary *>
496          FuncSummariesTy;
497
498  typedef ObjCSummaryCache ObjCMethodSummariesTy;
499
500  typedef llvm::FoldingSetNodeWrapper<RetainSummary> CachedSummaryNode;
501
502  //==-----------------------------------------------------------------==//
503  //  Data.
504  //==-----------------------------------------------------------------==//
505
506  /// Ctx - The ASTContext object for the analyzed ASTs.
507  ASTContext &Ctx;
508
509  /// GCEnabled - Records whether or not the analyzed code runs in GC mode.
510  const bool GCEnabled;
511
512  /// Records whether or not the analyzed code runs in ARC mode.
513  const bool ARCEnabled;
514
515  /// FuncSummaries - A map from FunctionDecls to summaries.
516  FuncSummariesTy FuncSummaries;
517
518  /// ObjCClassMethodSummaries - A map from selectors (for instance methods)
519  ///  to summaries.
520  ObjCMethodSummariesTy ObjCClassMethodSummaries;
521
522  /// ObjCMethodSummaries - A map from selectors to summaries.
523  ObjCMethodSummariesTy ObjCMethodSummaries;
524
525  /// BPAlloc - A BumpPtrAllocator used for allocating summaries, ArgEffects,
526  ///  and all other data used by the checker.
527  llvm::BumpPtrAllocator BPAlloc;
528
529  /// AF - A factory for ArgEffects objects.
530  ArgEffects::Factory AF;
531
532  /// ScratchArgs - A holding buffer for construct ArgEffects.
533  ArgEffects ScratchArgs;
534
535  /// ObjCAllocRetE - Default return effect for methods returning Objective-C
536  ///  objects.
537  RetEffect ObjCAllocRetE;
538
539  /// ObjCInitRetE - Default return effect for init methods returning
540  ///   Objective-C objects.
541  RetEffect ObjCInitRetE;
542
543  /// SimpleSummaries - Used for uniquing summaries that don't have special
544  /// effects.
545  llvm::FoldingSet<CachedSummaryNode> SimpleSummaries;
546
547  //==-----------------------------------------------------------------==//
548  //  Methods.
549  //==-----------------------------------------------------------------==//
550
551  /// getArgEffects - Returns a persistent ArgEffects object based on the
552  ///  data in ScratchArgs.
553  ArgEffects getArgEffects();
554
555  enum UnaryFuncKind { cfretain, cfrelease, cfmakecollectable };
556
557  const RetainSummary *getUnarySummary(const FunctionType* FT,
558                                       UnaryFuncKind func);
559
560  const RetainSummary *getCFSummaryCreateRule(const FunctionDecl *FD);
561  const RetainSummary *getCFSummaryGetRule(const FunctionDecl *FD);
562  const RetainSummary *getCFCreateGetRuleSummary(const FunctionDecl *FD);
563
564  const RetainSummary *getPersistentSummary(const RetainSummary &OldSumm);
565
566  const RetainSummary *getPersistentSummary(RetEffect RetEff,
567                                            ArgEffect ReceiverEff = DoNothing,
568                                            ArgEffect DefaultEff = MayEscape) {
569    RetainSummary Summ(getArgEffects(), RetEff, DefaultEff, ReceiverEff);
570    return getPersistentSummary(Summ);
571  }
572
573  const RetainSummary *getDoNothingSummary() {
574    return getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
575  }
576
577  const RetainSummary *getDefaultSummary() {
578    return getPersistentSummary(RetEffect::MakeNoRet(),
579                                DoNothing, MayEscape);
580  }
581
582  const RetainSummary *getPersistentStopSummary() {
583    return getPersistentSummary(RetEffect::MakeNoRet(),
584                                StopTracking, StopTracking);
585  }
586
587  void InitializeClassMethodSummaries();
588  void InitializeMethodSummaries();
589private:
590  void addNSObjectClsMethSummary(Selector S, const RetainSummary *Summ) {
591    ObjCClassMethodSummaries[S] = Summ;
592  }
593
594  void addNSObjectMethSummary(Selector S, const RetainSummary *Summ) {
595    ObjCMethodSummaries[S] = Summ;
596  }
597
598  void addClassMethSummary(const char* Cls, const char* name,
599                           const RetainSummary *Summ, bool isNullary = true) {
600    IdentifierInfo* ClsII = &Ctx.Idents.get(Cls);
601    Selector S = isNullary ? GetNullarySelector(name, Ctx)
602                           : GetUnarySelector(name, Ctx);
603    ObjCClassMethodSummaries[ObjCSummaryKey(ClsII, S)]  = Summ;
604  }
605
606  void addInstMethSummary(const char* Cls, const char* nullaryName,
607                          const RetainSummary *Summ) {
608    IdentifierInfo* ClsII = &Ctx.Idents.get(Cls);
609    Selector S = GetNullarySelector(nullaryName, Ctx);
610    ObjCMethodSummaries[ObjCSummaryKey(ClsII, S)]  = Summ;
611  }
612
613  Selector generateSelector(va_list argp) {
614    SmallVector<IdentifierInfo*, 10> II;
615
616    while (const char* s = va_arg(argp, const char*))
617      II.push_back(&Ctx.Idents.get(s));
618
619    return Ctx.Selectors.getSelector(II.size(), &II[0]);
620  }
621
622  void addMethodSummary(IdentifierInfo *ClsII, ObjCMethodSummariesTy& Summaries,
623                        const RetainSummary * Summ, va_list argp) {
624    Selector S = generateSelector(argp);
625    Summaries[ObjCSummaryKey(ClsII, S)] = Summ;
626  }
627
628  void addInstMethSummary(const char* Cls, const RetainSummary * Summ, ...) {
629    va_list argp;
630    va_start(argp, Summ);
631    addMethodSummary(&Ctx.Idents.get(Cls), ObjCMethodSummaries, Summ, argp);
632    va_end(argp);
633  }
634
635  void addClsMethSummary(const char* Cls, const RetainSummary * Summ, ...) {
636    va_list argp;
637    va_start(argp, Summ);
638    addMethodSummary(&Ctx.Idents.get(Cls),ObjCClassMethodSummaries, Summ, argp);
639    va_end(argp);
640  }
641
642  void addClsMethSummary(IdentifierInfo *II, const RetainSummary * Summ, ...) {
643    va_list argp;
644    va_start(argp, Summ);
645    addMethodSummary(II, ObjCClassMethodSummaries, Summ, argp);
646    va_end(argp);
647  }
648
649public:
650
651  RetainSummaryManager(ASTContext &ctx, bool gcenabled, bool usesARC)
652   : Ctx(ctx),
653     GCEnabled(gcenabled),
654     ARCEnabled(usesARC),
655     AF(BPAlloc), ScratchArgs(AF.getEmptyMap()),
656     ObjCAllocRetE(gcenabled
657                    ? RetEffect::MakeGCNotOwned()
658                    : (usesARC ? RetEffect::MakeARCNotOwned()
659                               : RetEffect::MakeOwned(RetEffect::ObjC, true))),
660     ObjCInitRetE(gcenabled
661                    ? RetEffect::MakeGCNotOwned()
662                    : (usesARC ? RetEffect::MakeARCNotOwned()
663                               : RetEffect::MakeOwnedWhenTrackedReceiver())) {
664    InitializeClassMethodSummaries();
665    InitializeMethodSummaries();
666  }
667
668  const RetainSummary *getSummary(const CallEvent &Call,
669                                  ProgramStateRef State = 0);
670
671  const RetainSummary *getFunctionSummary(const FunctionDecl *FD);
672
673  const RetainSummary *getMethodSummary(Selector S, const ObjCInterfaceDecl *ID,
674                                        const ObjCMethodDecl *MD,
675                                        QualType RetTy,
676                                        ObjCMethodSummariesTy &CachedSummaries);
677
678  const RetainSummary *getInstanceMethodSummary(const ObjCMethodCall &M,
679                                                ProgramStateRef State);
680
681  const RetainSummary *getClassMethodSummary(const ObjCMethodCall &M) {
682    assert(!M.isInstanceMessage());
683    const ObjCInterfaceDecl *Class = M.getReceiverInterface();
684
685    return getMethodSummary(M.getSelector(), Class, M.getDecl(),
686                            M.getResultType(), ObjCClassMethodSummaries);
687  }
688
689  /// getMethodSummary - This version of getMethodSummary is used to query
690  ///  the summary for the current method being analyzed.
691  const RetainSummary *getMethodSummary(const ObjCMethodDecl *MD) {
692    const ObjCInterfaceDecl *ID = MD->getClassInterface();
693    Selector S = MD->getSelector();
694    QualType ResultTy = MD->getResultType();
695
696    ObjCMethodSummariesTy *CachedSummaries;
697    if (MD->isInstanceMethod())
698      CachedSummaries = &ObjCMethodSummaries;
699    else
700      CachedSummaries = &ObjCClassMethodSummaries;
701
702    return getMethodSummary(S, ID, MD, ResultTy, *CachedSummaries);
703  }
704
705  const RetainSummary *getStandardMethodSummary(const ObjCMethodDecl *MD,
706                                                Selector S, QualType RetTy);
707
708  /// Determine if there is a special return effect for this function or method.
709  Optional<RetEffect> getRetEffectFromAnnotations(QualType RetTy,
710                                                  const Decl *D);
711
712  void updateSummaryFromAnnotations(const RetainSummary *&Summ,
713                                    const ObjCMethodDecl *MD);
714
715  void updateSummaryFromAnnotations(const RetainSummary *&Summ,
716                                    const FunctionDecl *FD);
717
718  void updateSummaryForCall(const RetainSummary *&Summ,
719                            const CallEvent &Call);
720
721  bool isGCEnabled() const { return GCEnabled; }
722
723  bool isARCEnabled() const { return ARCEnabled; }
724
725  bool isARCorGCEnabled() const { return GCEnabled || ARCEnabled; }
726
727  RetEffect getObjAllocRetEffect() const { return ObjCAllocRetE; }
728
729  friend class RetainSummaryTemplate;
730};
731
732// Used to avoid allocating long-term (BPAlloc'd) memory for default retain
733// summaries. If a function or method looks like it has a default summary, but
734// it has annotations, the annotations are added to the stack-based template
735// and then copied into managed memory.
736class RetainSummaryTemplate {
737  RetainSummaryManager &Manager;
738  const RetainSummary *&RealSummary;
739  RetainSummary ScratchSummary;
740  bool Accessed;
741public:
742  RetainSummaryTemplate(const RetainSummary *&real, RetainSummaryManager &mgr)
743    : Manager(mgr), RealSummary(real), ScratchSummary(*real), Accessed(false) {}
744
745  ~RetainSummaryTemplate() {
746    if (Accessed)
747      RealSummary = Manager.getPersistentSummary(ScratchSummary);
748  }
749
750  RetainSummary &operator*() {
751    Accessed = true;
752    return ScratchSummary;
753  }
754
755  RetainSummary *operator->() {
756    Accessed = true;
757    return &ScratchSummary;
758  }
759};
760
761} // end anonymous namespace
762
763//===----------------------------------------------------------------------===//
764// Implementation of checker data structures.
765//===----------------------------------------------------------------------===//
766
767ArgEffects RetainSummaryManager::getArgEffects() {
768  ArgEffects AE = ScratchArgs;
769  ScratchArgs = AF.getEmptyMap();
770  return AE;
771}
772
773const RetainSummary *
774RetainSummaryManager::getPersistentSummary(const RetainSummary &OldSumm) {
775  // Unique "simple" summaries -- those without ArgEffects.
776  if (OldSumm.isSimple()) {
777    llvm::FoldingSetNodeID ID;
778    OldSumm.Profile(ID);
779
780    void *Pos;
781    CachedSummaryNode *N = SimpleSummaries.FindNodeOrInsertPos(ID, Pos);
782
783    if (!N) {
784      N = (CachedSummaryNode *) BPAlloc.Allocate<CachedSummaryNode>();
785      new (N) CachedSummaryNode(OldSumm);
786      SimpleSummaries.InsertNode(N, Pos);
787    }
788
789    return &N->getValue();
790  }
791
792  RetainSummary *Summ = (RetainSummary *) BPAlloc.Allocate<RetainSummary>();
793  new (Summ) RetainSummary(OldSumm);
794  return Summ;
795}
796
797//===----------------------------------------------------------------------===//
798// Summary creation for functions (largely uses of Core Foundation).
799//===----------------------------------------------------------------------===//
800
801static bool isRetain(const FunctionDecl *FD, StringRef FName) {
802  return FName.endswith("Retain");
803}
804
805static bool isRelease(const FunctionDecl *FD, StringRef FName) {
806  return FName.endswith("Release");
807}
808
809static bool isMakeCollectable(const FunctionDecl *FD, StringRef FName) {
810  // FIXME: Remove FunctionDecl parameter.
811  // FIXME: Is it really okay if MakeCollectable isn't a suffix?
812  return FName.find("MakeCollectable") != StringRef::npos;
813}
814
815static ArgEffect getStopTrackingHardEquivalent(ArgEffect E) {
816  switch (E) {
817  case DoNothing:
818  case Autorelease:
819  case DecRefBridgedTransfered:
820  case IncRef:
821  case IncRefMsg:
822  case MakeCollectable:
823  case MayEscape:
824  case StopTracking:
825  case StopTrackingHard:
826    return StopTrackingHard;
827  case DecRef:
828  case DecRefAndStopTrackingHard:
829    return DecRefAndStopTrackingHard;
830  case DecRefMsg:
831  case DecRefMsgAndStopTrackingHard:
832    return DecRefMsgAndStopTrackingHard;
833  case Dealloc:
834    return Dealloc;
835  }
836
837  llvm_unreachable("Unknown ArgEffect kind");
838}
839
840void RetainSummaryManager::updateSummaryForCall(const RetainSummary *&S,
841                                                const CallEvent &Call) {
842  if (Call.hasNonZeroCallbackArg()) {
843    ArgEffect RecEffect =
844      getStopTrackingHardEquivalent(S->getReceiverEffect());
845    ArgEffect DefEffect =
846      getStopTrackingHardEquivalent(S->getDefaultArgEffect());
847
848    ArgEffects CustomArgEffects = S->getArgEffects();
849    for (ArgEffects::iterator I = CustomArgEffects.begin(),
850                              E = CustomArgEffects.end();
851         I != E; ++I) {
852      ArgEffect Translated = getStopTrackingHardEquivalent(I->second);
853      if (Translated != DefEffect)
854        ScratchArgs = AF.add(ScratchArgs, I->first, Translated);
855    }
856
857    RetEffect RE = RetEffect::MakeNoRetHard();
858
859    // Special cases where the callback argument CANNOT free the return value.
860    // This can generally only happen if we know that the callback will only be
861    // called when the return value is already being deallocated.
862    if (const FunctionCall *FC = dyn_cast<FunctionCall>(&Call)) {
863      if (IdentifierInfo *Name = FC->getDecl()->getIdentifier()) {
864        // When the CGBitmapContext is deallocated, the callback here will free
865        // the associated data buffer.
866        if (Name->isStr("CGBitmapContextCreateWithData"))
867          RE = S->getRetEffect();
868      }
869    }
870
871    S = getPersistentSummary(RE, RecEffect, DefEffect);
872  }
873
874  // Special case '[super init];' and '[self init];'
875  //
876  // Even though calling '[super init]' without assigning the result to self
877  // and checking if the parent returns 'nil' is a bad pattern, it is common.
878  // Additionally, our Self Init checker already warns about it. To avoid
879  // overwhelming the user with messages from both checkers, we model the case
880  // of '[super init]' in cases when it is not consumed by another expression
881  // as if the call preserves the value of 'self'; essentially, assuming it can
882  // never fail and return 'nil'.
883  // Note, we don't want to just stop tracking the value since we want the
884  // RetainCount checker to report leaks and use-after-free if SelfInit checker
885  // is turned off.
886  if (const ObjCMethodCall *MC = dyn_cast<ObjCMethodCall>(&Call)) {
887    if (MC->getMethodFamily() == OMF_init && MC->isReceiverSelfOrSuper()) {
888
889      // Check if the message is not consumed, we know it will not be used in
890      // an assignment, ex: "self = [super init]".
891      const Expr *ME = MC->getOriginExpr();
892      const LocationContext *LCtx = MC->getLocationContext();
893      ParentMap &PM = LCtx->getAnalysisDeclContext()->getParentMap();
894      if (!PM.isConsumedExpr(ME)) {
895        RetainSummaryTemplate ModifiableSummaryTemplate(S, *this);
896        ModifiableSummaryTemplate->setReceiverEffect(DoNothing);
897        ModifiableSummaryTemplate->setRetEffect(RetEffect::MakeNoRet());
898      }
899    }
900
901  }
902}
903
904const RetainSummary *
905RetainSummaryManager::getSummary(const CallEvent &Call,
906                                 ProgramStateRef State) {
907  const RetainSummary *Summ;
908  switch (Call.getKind()) {
909  case CE_Function:
910    Summ = getFunctionSummary(cast<FunctionCall>(Call).getDecl());
911    break;
912  case CE_CXXMember:
913  case CE_CXXMemberOperator:
914  case CE_Block:
915  case CE_CXXConstructor:
916  case CE_CXXDestructor:
917  case CE_CXXAllocator:
918    // FIXME: These calls are currently unsupported.
919    return getPersistentStopSummary();
920  case CE_ObjCMessage: {
921    const ObjCMethodCall &Msg = cast<ObjCMethodCall>(Call);
922    if (Msg.isInstanceMessage())
923      Summ = getInstanceMethodSummary(Msg, State);
924    else
925      Summ = getClassMethodSummary(Msg);
926    break;
927  }
928  }
929
930  updateSummaryForCall(Summ, Call);
931
932  assert(Summ && "Unknown call type?");
933  return Summ;
934}
935
936const RetainSummary *
937RetainSummaryManager::getFunctionSummary(const FunctionDecl *FD) {
938  // If we don't know what function we're calling, use our default summary.
939  if (!FD)
940    return getDefaultSummary();
941
942  // Look up a summary in our cache of FunctionDecls -> Summaries.
943  FuncSummariesTy::iterator I = FuncSummaries.find(FD);
944  if (I != FuncSummaries.end())
945    return I->second;
946
947  // No summary?  Generate one.
948  const RetainSummary *S = 0;
949  bool AllowAnnotations = true;
950
951  do {
952    // We generate "stop" summaries for implicitly defined functions.
953    if (FD->isImplicit()) {
954      S = getPersistentStopSummary();
955      break;
956    }
957
958    // [PR 3337] Use 'getAs<FunctionType>' to strip away any typedefs on the
959    // function's type.
960    const FunctionType* FT = FD->getType()->getAs<FunctionType>();
961    const IdentifierInfo *II = FD->getIdentifier();
962    if (!II)
963      break;
964
965    StringRef FName = II->getName();
966
967    // Strip away preceding '_'.  Doing this here will effect all the checks
968    // down below.
969    FName = FName.substr(FName.find_first_not_of('_'));
970
971    // Inspect the result type.
972    QualType RetTy = FT->getResultType();
973
974    // FIXME: This should all be refactored into a chain of "summary lookup"
975    //  filters.
976    assert(ScratchArgs.isEmpty());
977
978    if (FName == "pthread_create" || FName == "pthread_setspecific") {
979      // Part of: <rdar://problem/7299394> and <rdar://problem/11282706>.
980      // This will be addressed better with IPA.
981      S = getPersistentStopSummary();
982    } else if (FName == "NSMakeCollectable") {
983      // Handle: id NSMakeCollectable(CFTypeRef)
984      S = (RetTy->isObjCIdType())
985          ? getUnarySummary(FT, cfmakecollectable)
986          : getPersistentStopSummary();
987      // The headers on OS X 10.8 use cf_consumed/ns_returns_retained,
988      // but we can fully model NSMakeCollectable ourselves.
989      AllowAnnotations = false;
990    } else if (FName == "CFPlugInInstanceCreate") {
991      S = getPersistentSummary(RetEffect::MakeNoRet());
992    } else if (FName == "IOBSDNameMatching" ||
993               FName == "IOServiceMatching" ||
994               FName == "IOServiceNameMatching" ||
995               FName == "IORegistryEntrySearchCFProperty" ||
996               FName == "IORegistryEntryIDMatching" ||
997               FName == "IOOpenFirmwarePathMatching") {
998      // Part of <rdar://problem/6961230>. (IOKit)
999      // This should be addressed using a API table.
1000      S = getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF, true),
1001                               DoNothing, DoNothing);
1002    } else if (FName == "IOServiceGetMatchingService" ||
1003               FName == "IOServiceGetMatchingServices") {
1004      // FIXES: <rdar://problem/6326900>
1005      // This should be addressed using a API table.  This strcmp is also
1006      // a little gross, but there is no need to super optimize here.
1007      ScratchArgs = AF.add(ScratchArgs, 1, DecRef);
1008      S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
1009    } else if (FName == "IOServiceAddNotification" ||
1010               FName == "IOServiceAddMatchingNotification") {
1011      // Part of <rdar://problem/6961230>. (IOKit)
1012      // This should be addressed using a API table.
1013      ScratchArgs = AF.add(ScratchArgs, 2, DecRef);
1014      S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
1015    } else if (FName == "CVPixelBufferCreateWithBytes") {
1016      // FIXES: <rdar://problem/7283567>
1017      // Eventually this can be improved by recognizing that the pixel
1018      // buffer passed to CVPixelBufferCreateWithBytes is released via
1019      // a callback and doing full IPA to make sure this is done correctly.
1020      // FIXME: This function has an out parameter that returns an
1021      // allocated object.
1022      ScratchArgs = AF.add(ScratchArgs, 7, StopTracking);
1023      S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
1024    } else if (FName == "CGBitmapContextCreateWithData") {
1025      // FIXES: <rdar://problem/7358899>
1026      // Eventually this can be improved by recognizing that 'releaseInfo'
1027      // passed to CGBitmapContextCreateWithData is released via
1028      // a callback and doing full IPA to make sure this is done correctly.
1029      ScratchArgs = AF.add(ScratchArgs, 8, StopTracking);
1030      S = getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF, true),
1031                               DoNothing, DoNothing);
1032    } else if (FName == "CVPixelBufferCreateWithPlanarBytes") {
1033      // FIXES: <rdar://problem/7283567>
1034      // Eventually this can be improved by recognizing that the pixel
1035      // buffer passed to CVPixelBufferCreateWithPlanarBytes is released
1036      // via a callback and doing full IPA to make sure this is done
1037      // correctly.
1038      ScratchArgs = AF.add(ScratchArgs, 12, StopTracking);
1039      S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
1040    } else if (FName == "dispatch_set_context" ||
1041               FName == "xpc_connection_set_context") {
1042      // <rdar://problem/11059275> - The analyzer currently doesn't have
1043      // a good way to reason about the finalizer function for libdispatch.
1044      // If we pass a context object that is memory managed, stop tracking it.
1045      // <rdar://problem/13783514> - Same problem, but for XPC.
1046      // FIXME: this hack should possibly go away once we can handle
1047      // libdispatch and XPC finalizers.
1048      ScratchArgs = AF.add(ScratchArgs, 1, StopTracking);
1049      S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
1050    } else if (FName.startswith("NSLog")) {
1051      S = getDoNothingSummary();
1052    } else if (FName.startswith("NS") &&
1053                (FName.find("Insert") != StringRef::npos)) {
1054      // Whitelist NSXXInsertXX, for example NSMapInsertIfAbsent, since they can
1055      // be deallocated by NSMapRemove. (radar://11152419)
1056      ScratchArgs = AF.add(ScratchArgs, 1, StopTracking);
1057      ScratchArgs = AF.add(ScratchArgs, 2, StopTracking);
1058      S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
1059    }
1060
1061    // Did we get a summary?
1062    if (S)
1063      break;
1064
1065    if (RetTy->isPointerType()) {
1066      // For CoreFoundation ('CF') types.
1067      if (cocoa::isRefType(RetTy, "CF", FName)) {
1068        if (isRetain(FD, FName))
1069          S = getUnarySummary(FT, cfretain);
1070        else if (isMakeCollectable(FD, FName))
1071          S = getUnarySummary(FT, cfmakecollectable);
1072        else
1073          S = getCFCreateGetRuleSummary(FD);
1074
1075        break;
1076      }
1077
1078      // For CoreGraphics ('CG') types.
1079      if (cocoa::isRefType(RetTy, "CG", FName)) {
1080        if (isRetain(FD, FName))
1081          S = getUnarySummary(FT, cfretain);
1082        else
1083          S = getCFCreateGetRuleSummary(FD);
1084
1085        break;
1086      }
1087
1088      // For the Disk Arbitration API (DiskArbitration/DADisk.h)
1089      if (cocoa::isRefType(RetTy, "DADisk") ||
1090          cocoa::isRefType(RetTy, "DADissenter") ||
1091          cocoa::isRefType(RetTy, "DASessionRef")) {
1092        S = getCFCreateGetRuleSummary(FD);
1093        break;
1094      }
1095
1096      if (FD->getAttr<CFAuditedTransferAttr>()) {
1097        S = getCFCreateGetRuleSummary(FD);
1098        break;
1099      }
1100
1101      break;
1102    }
1103
1104    // Check for release functions, the only kind of functions that we care
1105    // about that don't return a pointer type.
1106    if (FName[0] == 'C' && (FName[1] == 'F' || FName[1] == 'G')) {
1107      // Test for 'CGCF'.
1108      FName = FName.substr(FName.startswith("CGCF") ? 4 : 2);
1109
1110      if (isRelease(FD, FName))
1111        S = getUnarySummary(FT, cfrelease);
1112      else {
1113        assert (ScratchArgs.isEmpty());
1114        // Remaining CoreFoundation and CoreGraphics functions.
1115        // We use to assume that they all strictly followed the ownership idiom
1116        // and that ownership cannot be transferred.  While this is technically
1117        // correct, many methods allow a tracked object to escape.  For example:
1118        //
1119        //   CFMutableDictionaryRef x = CFDictionaryCreateMutable(...);
1120        //   CFDictionaryAddValue(y, key, x);
1121        //   CFRelease(x);
1122        //   ... it is okay to use 'x' since 'y' has a reference to it
1123        //
1124        // We handle this and similar cases with the follow heuristic.  If the
1125        // function name contains "InsertValue", "SetValue", "AddValue",
1126        // "AppendValue", or "SetAttribute", then we assume that arguments may
1127        // "escape."  This means that something else holds on to the object,
1128        // allowing it be used even after its local retain count drops to 0.
1129        ArgEffect E = (StrInStrNoCase(FName, "InsertValue") != StringRef::npos||
1130                       StrInStrNoCase(FName, "AddValue") != StringRef::npos ||
1131                       StrInStrNoCase(FName, "SetValue") != StringRef::npos ||
1132                       StrInStrNoCase(FName, "AppendValue") != StringRef::npos||
1133                       StrInStrNoCase(FName, "SetAttribute") != StringRef::npos)
1134                      ? MayEscape : DoNothing;
1135
1136        S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, E);
1137      }
1138    }
1139  }
1140  while (0);
1141
1142  // If we got all the way here without any luck, use a default summary.
1143  if (!S)
1144    S = getDefaultSummary();
1145
1146  // Annotations override defaults.
1147  if (AllowAnnotations)
1148    updateSummaryFromAnnotations(S, FD);
1149
1150  FuncSummaries[FD] = S;
1151  return S;
1152}
1153
1154const RetainSummary *
1155RetainSummaryManager::getCFCreateGetRuleSummary(const FunctionDecl *FD) {
1156  if (coreFoundation::followsCreateRule(FD))
1157    return getCFSummaryCreateRule(FD);
1158
1159  return getCFSummaryGetRule(FD);
1160}
1161
1162const RetainSummary *
1163RetainSummaryManager::getUnarySummary(const FunctionType* FT,
1164                                      UnaryFuncKind func) {
1165
1166  // Sanity check that this is *really* a unary function.  This can
1167  // happen if people do weird things.
1168  const FunctionProtoType* FTP = dyn_cast<FunctionProtoType>(FT);
1169  if (!FTP || FTP->getNumArgs() != 1)
1170    return getPersistentStopSummary();
1171
1172  assert (ScratchArgs.isEmpty());
1173
1174  ArgEffect Effect;
1175  switch (func) {
1176    case cfretain: Effect = IncRef; break;
1177    case cfrelease: Effect = DecRef; break;
1178    case cfmakecollectable: Effect = MakeCollectable; break;
1179  }
1180
1181  ScratchArgs = AF.add(ScratchArgs, 0, Effect);
1182  return getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
1183}
1184
1185const RetainSummary *
1186RetainSummaryManager::getCFSummaryCreateRule(const FunctionDecl *FD) {
1187  assert (ScratchArgs.isEmpty());
1188
1189  return getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF, true));
1190}
1191
1192const RetainSummary *
1193RetainSummaryManager::getCFSummaryGetRule(const FunctionDecl *FD) {
1194  assert (ScratchArgs.isEmpty());
1195  return getPersistentSummary(RetEffect::MakeNotOwned(RetEffect::CF),
1196                              DoNothing, DoNothing);
1197}
1198
1199//===----------------------------------------------------------------------===//
1200// Summary creation for Selectors.
1201//===----------------------------------------------------------------------===//
1202
1203Optional<RetEffect>
1204RetainSummaryManager::getRetEffectFromAnnotations(QualType RetTy,
1205                                                  const Decl *D) {
1206  if (cocoa::isCocoaObjectRef(RetTy)) {
1207    if (D->getAttr<NSReturnsRetainedAttr>())
1208      return ObjCAllocRetE;
1209
1210    if (D->getAttr<NSReturnsNotRetainedAttr>() ||
1211        D->getAttr<NSReturnsAutoreleasedAttr>())
1212      return RetEffect::MakeNotOwned(RetEffect::ObjC);
1213
1214  } else if (!RetTy->isPointerType()) {
1215    return None;
1216  }
1217
1218  if (D->getAttr<CFReturnsRetainedAttr>())
1219    return RetEffect::MakeOwned(RetEffect::CF, true);
1220
1221  if (D->getAttr<CFReturnsNotRetainedAttr>())
1222    return RetEffect::MakeNotOwned(RetEffect::CF);
1223
1224  return None;
1225}
1226
1227void
1228RetainSummaryManager::updateSummaryFromAnnotations(const RetainSummary *&Summ,
1229                                                   const FunctionDecl *FD) {
1230  if (!FD)
1231    return;
1232
1233  assert(Summ && "Must have a summary to add annotations to.");
1234  RetainSummaryTemplate Template(Summ, *this);
1235
1236  // Effects on the parameters.
1237  unsigned parm_idx = 0;
1238  for (FunctionDecl::param_const_iterator pi = FD->param_begin(),
1239         pe = FD->param_end(); pi != pe; ++pi, ++parm_idx) {
1240    const ParmVarDecl *pd = *pi;
1241    if (pd->getAttr<NSConsumedAttr>())
1242      Template->addArg(AF, parm_idx, DecRefMsg);
1243    else if (pd->getAttr<CFConsumedAttr>())
1244      Template->addArg(AF, parm_idx, DecRef);
1245  }
1246
1247  QualType RetTy = FD->getResultType();
1248  if (Optional<RetEffect> RetE = getRetEffectFromAnnotations(RetTy, FD))
1249    Template->setRetEffect(*RetE);
1250}
1251
1252void
1253RetainSummaryManager::updateSummaryFromAnnotations(const RetainSummary *&Summ,
1254                                                   const ObjCMethodDecl *MD) {
1255  if (!MD)
1256    return;
1257
1258  assert(Summ && "Must have a valid summary to add annotations to");
1259  RetainSummaryTemplate Template(Summ, *this);
1260
1261  // Effects on the receiver.
1262  if (MD->getAttr<NSConsumesSelfAttr>())
1263    Template->setReceiverEffect(DecRefMsg);
1264
1265  // Effects on the parameters.
1266  unsigned parm_idx = 0;
1267  for (ObjCMethodDecl::param_const_iterator
1268         pi=MD->param_begin(), pe=MD->param_end();
1269       pi != pe; ++pi, ++parm_idx) {
1270    const ParmVarDecl *pd = *pi;
1271    if (pd->getAttr<NSConsumedAttr>())
1272      Template->addArg(AF, parm_idx, DecRefMsg);
1273    else if (pd->getAttr<CFConsumedAttr>()) {
1274      Template->addArg(AF, parm_idx, DecRef);
1275    }
1276  }
1277
1278  QualType RetTy = MD->getResultType();
1279  if (Optional<RetEffect> RetE = getRetEffectFromAnnotations(RetTy, MD))
1280    Template->setRetEffect(*RetE);
1281}
1282
1283const RetainSummary *
1284RetainSummaryManager::getStandardMethodSummary(const ObjCMethodDecl *MD,
1285                                               Selector S, QualType RetTy) {
1286  // Any special effects?
1287  ArgEffect ReceiverEff = DoNothing;
1288  RetEffect ResultEff = RetEffect::MakeNoRet();
1289
1290  // Check the method family, and apply any default annotations.
1291  switch (MD ? MD->getMethodFamily() : S.getMethodFamily()) {
1292    case OMF_None:
1293    case OMF_performSelector:
1294      // Assume all Objective-C methods follow Cocoa Memory Management rules.
1295      // FIXME: Does the non-threaded performSelector family really belong here?
1296      // The selector could be, say, @selector(copy).
1297      if (cocoa::isCocoaObjectRef(RetTy))
1298        ResultEff = RetEffect::MakeNotOwned(RetEffect::ObjC);
1299      else if (coreFoundation::isCFObjectRef(RetTy)) {
1300        // ObjCMethodDecl currently doesn't consider CF objects as valid return
1301        // values for alloc, new, copy, or mutableCopy, so we have to
1302        // double-check with the selector. This is ugly, but there aren't that
1303        // many Objective-C methods that return CF objects, right?
1304        if (MD) {
1305          switch (S.getMethodFamily()) {
1306          case OMF_alloc:
1307          case OMF_new:
1308          case OMF_copy:
1309          case OMF_mutableCopy:
1310            ResultEff = RetEffect::MakeOwned(RetEffect::CF, true);
1311            break;
1312          default:
1313            ResultEff = RetEffect::MakeNotOwned(RetEffect::CF);
1314            break;
1315          }
1316        } else {
1317          ResultEff = RetEffect::MakeNotOwned(RetEffect::CF);
1318        }
1319      }
1320      break;
1321    case OMF_init:
1322      ResultEff = ObjCInitRetE;
1323      ReceiverEff = DecRefMsg;
1324      break;
1325    case OMF_alloc:
1326    case OMF_new:
1327    case OMF_copy:
1328    case OMF_mutableCopy:
1329      if (cocoa::isCocoaObjectRef(RetTy))
1330        ResultEff = ObjCAllocRetE;
1331      else if (coreFoundation::isCFObjectRef(RetTy))
1332        ResultEff = RetEffect::MakeOwned(RetEffect::CF, true);
1333      break;
1334    case OMF_autorelease:
1335      ReceiverEff = Autorelease;
1336      break;
1337    case OMF_retain:
1338      ReceiverEff = IncRefMsg;
1339      break;
1340    case OMF_release:
1341      ReceiverEff = DecRefMsg;
1342      break;
1343    case OMF_dealloc:
1344      ReceiverEff = Dealloc;
1345      break;
1346    case OMF_self:
1347      // -self is handled specially by the ExprEngine to propagate the receiver.
1348      break;
1349    case OMF_retainCount:
1350    case OMF_finalize:
1351      // These methods don't return objects.
1352      break;
1353  }
1354
1355  // If one of the arguments in the selector has the keyword 'delegate' we
1356  // should stop tracking the reference count for the receiver.  This is
1357  // because the reference count is quite possibly handled by a delegate
1358  // method.
1359  if (S.isKeywordSelector()) {
1360    for (unsigned i = 0, e = S.getNumArgs(); i != e; ++i) {
1361      StringRef Slot = S.getNameForSlot(i);
1362      if (Slot.substr(Slot.size() - 8).equals_lower("delegate")) {
1363        if (ResultEff == ObjCInitRetE)
1364          ResultEff = RetEffect::MakeNoRetHard();
1365        else
1366          ReceiverEff = StopTrackingHard;
1367      }
1368    }
1369  }
1370
1371  if (ScratchArgs.isEmpty() && ReceiverEff == DoNothing &&
1372      ResultEff.getKind() == RetEffect::NoRet)
1373    return getDefaultSummary();
1374
1375  return getPersistentSummary(ResultEff, ReceiverEff, MayEscape);
1376}
1377
1378const RetainSummary *
1379RetainSummaryManager::getInstanceMethodSummary(const ObjCMethodCall &Msg,
1380                                               ProgramStateRef State) {
1381  const ObjCInterfaceDecl *ReceiverClass = 0;
1382
1383  // We do better tracking of the type of the object than the core ExprEngine.
1384  // See if we have its type in our private state.
1385  // FIXME: Eventually replace the use of state->get<RefBindings> with
1386  // a generic API for reasoning about the Objective-C types of symbolic
1387  // objects.
1388  SVal ReceiverV = Msg.getReceiverSVal();
1389  if (SymbolRef Sym = ReceiverV.getAsLocSymbol())
1390    if (const RefVal *T = getRefBinding(State, Sym))
1391      if (const ObjCObjectPointerType *PT =
1392            T->getType()->getAs<ObjCObjectPointerType>())
1393        ReceiverClass = PT->getInterfaceDecl();
1394
1395  // If we don't know what kind of object this is, fall back to its static type.
1396  if (!ReceiverClass)
1397    ReceiverClass = Msg.getReceiverInterface();
1398
1399  // FIXME: The receiver could be a reference to a class, meaning that
1400  //  we should use the class method.
1401  // id x = [NSObject class];
1402  // [x performSelector:... withObject:... afterDelay:...];
1403  Selector S = Msg.getSelector();
1404  const ObjCMethodDecl *Method = Msg.getDecl();
1405  if (!Method && ReceiverClass)
1406    Method = ReceiverClass->getInstanceMethod(S);
1407
1408  return getMethodSummary(S, ReceiverClass, Method, Msg.getResultType(),
1409                          ObjCMethodSummaries);
1410}
1411
1412const RetainSummary *
1413RetainSummaryManager::getMethodSummary(Selector S, const ObjCInterfaceDecl *ID,
1414                                       const ObjCMethodDecl *MD, QualType RetTy,
1415                                       ObjCMethodSummariesTy &CachedSummaries) {
1416
1417  // Look up a summary in our summary cache.
1418  const RetainSummary *Summ = CachedSummaries.find(ID, S);
1419
1420  if (!Summ) {
1421    Summ = getStandardMethodSummary(MD, S, RetTy);
1422
1423    // Annotations override defaults.
1424    updateSummaryFromAnnotations(Summ, MD);
1425
1426    // Memoize the summary.
1427    CachedSummaries[ObjCSummaryKey(ID, S)] = Summ;
1428  }
1429
1430  return Summ;
1431}
1432
1433void RetainSummaryManager::InitializeClassMethodSummaries() {
1434  assert(ScratchArgs.isEmpty());
1435  // Create the [NSAssertionHandler currentHander] summary.
1436  addClassMethSummary("NSAssertionHandler", "currentHandler",
1437                getPersistentSummary(RetEffect::MakeNotOwned(RetEffect::ObjC)));
1438
1439  // Create the [NSAutoreleasePool addObject:] summary.
1440  ScratchArgs = AF.add(ScratchArgs, 0, Autorelease);
1441  addClassMethSummary("NSAutoreleasePool", "addObject",
1442                      getPersistentSummary(RetEffect::MakeNoRet(),
1443                                           DoNothing, Autorelease));
1444}
1445
1446void RetainSummaryManager::InitializeMethodSummaries() {
1447
1448  assert (ScratchArgs.isEmpty());
1449
1450  // Create the "init" selector.  It just acts as a pass-through for the
1451  // receiver.
1452  const RetainSummary *InitSumm = getPersistentSummary(ObjCInitRetE, DecRefMsg);
1453  addNSObjectMethSummary(GetNullarySelector("init", Ctx), InitSumm);
1454
1455  // awakeAfterUsingCoder: behaves basically like an 'init' method.  It
1456  // claims the receiver and returns a retained object.
1457  addNSObjectMethSummary(GetUnarySelector("awakeAfterUsingCoder", Ctx),
1458                         InitSumm);
1459
1460  // The next methods are allocators.
1461  const RetainSummary *AllocSumm = getPersistentSummary(ObjCAllocRetE);
1462  const RetainSummary *CFAllocSumm =
1463    getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF, true));
1464
1465  // Create the "retain" selector.
1466  RetEffect NoRet = RetEffect::MakeNoRet();
1467  const RetainSummary *Summ = getPersistentSummary(NoRet, IncRefMsg);
1468  addNSObjectMethSummary(GetNullarySelector("retain", Ctx), Summ);
1469
1470  // Create the "release" selector.
1471  Summ = getPersistentSummary(NoRet, DecRefMsg);
1472  addNSObjectMethSummary(GetNullarySelector("release", Ctx), Summ);
1473
1474  // Create the -dealloc summary.
1475  Summ = getPersistentSummary(NoRet, Dealloc);
1476  addNSObjectMethSummary(GetNullarySelector("dealloc", Ctx), Summ);
1477
1478  // Create the "autorelease" selector.
1479  Summ = getPersistentSummary(NoRet, Autorelease);
1480  addNSObjectMethSummary(GetNullarySelector("autorelease", Ctx), Summ);
1481
1482  // For NSWindow, allocated objects are (initially) self-owned.
1483  // FIXME: For now we opt for false negatives with NSWindow, as these objects
1484  //  self-own themselves.  However, they only do this once they are displayed.
1485  //  Thus, we need to track an NSWindow's display status.
1486  //  This is tracked in <rdar://problem/6062711>.
1487  //  See also http://llvm.org/bugs/show_bug.cgi?id=3714.
1488  const RetainSummary *NoTrackYet = getPersistentSummary(RetEffect::MakeNoRet(),
1489                                                   StopTracking,
1490                                                   StopTracking);
1491
1492  addClassMethSummary("NSWindow", "alloc", NoTrackYet);
1493
1494  // For NSPanel (which subclasses NSWindow), allocated objects are not
1495  //  self-owned.
1496  // FIXME: For now we don't track NSPanels. object for the same reason
1497  //   as for NSWindow objects.
1498  addClassMethSummary("NSPanel", "alloc", NoTrackYet);
1499
1500  // Don't track allocated autorelease pools, as it is okay to prematurely
1501  // exit a method.
1502  addClassMethSummary("NSAutoreleasePool", "alloc", NoTrackYet);
1503  addClassMethSummary("NSAutoreleasePool", "allocWithZone", NoTrackYet, false);
1504  addClassMethSummary("NSAutoreleasePool", "new", NoTrackYet);
1505
1506  // Create summaries QCRenderer/QCView -createSnapShotImageOfType:
1507  addInstMethSummary("QCRenderer", AllocSumm,
1508                     "createSnapshotImageOfType", NULL);
1509  addInstMethSummary("QCView", AllocSumm,
1510                     "createSnapshotImageOfType", NULL);
1511
1512  // Create summaries for CIContext, 'createCGImage' and
1513  // 'createCGLayerWithSize'.  These objects are CF objects, and are not
1514  // automatically garbage collected.
1515  addInstMethSummary("CIContext", CFAllocSumm,
1516                     "createCGImage", "fromRect", NULL);
1517  addInstMethSummary("CIContext", CFAllocSumm,
1518                     "createCGImage", "fromRect", "format", "colorSpace", NULL);
1519  addInstMethSummary("CIContext", CFAllocSumm, "createCGLayerWithSize",
1520           "info", NULL);
1521}
1522
1523//===----------------------------------------------------------------------===//
1524// Error reporting.
1525//===----------------------------------------------------------------------===//
1526namespace {
1527  typedef llvm::DenseMap<const ExplodedNode *, const RetainSummary *>
1528    SummaryLogTy;
1529
1530  //===-------------===//
1531  // Bug Descriptions. //
1532  //===-------------===//
1533
1534  class CFRefBug : public BugType {
1535  protected:
1536    CFRefBug(StringRef name)
1537    : BugType(name, categories::MemoryCoreFoundationObjectiveC) {}
1538  public:
1539
1540    // FIXME: Eventually remove.
1541    virtual const char *getDescription() const = 0;
1542
1543    virtual bool isLeak() const { return false; }
1544  };
1545
1546  class UseAfterRelease : public CFRefBug {
1547  public:
1548    UseAfterRelease() : CFRefBug("Use-after-release") {}
1549
1550    const char *getDescription() const {
1551      return "Reference-counted object is used after it is released";
1552    }
1553  };
1554
1555  class BadRelease : public CFRefBug {
1556  public:
1557    BadRelease() : CFRefBug("Bad release") {}
1558
1559    const char *getDescription() const {
1560      return "Incorrect decrement of the reference count of an object that is "
1561             "not owned at this point by the caller";
1562    }
1563  };
1564
1565  class DeallocGC : public CFRefBug {
1566  public:
1567    DeallocGC()
1568    : CFRefBug("-dealloc called while using garbage collection") {}
1569
1570    const char *getDescription() const {
1571      return "-dealloc called while using garbage collection";
1572    }
1573  };
1574
1575  class DeallocNotOwned : public CFRefBug {
1576  public:
1577    DeallocNotOwned()
1578    : CFRefBug("-dealloc sent to non-exclusively owned object") {}
1579
1580    const char *getDescription() const {
1581      return "-dealloc sent to object that may be referenced elsewhere";
1582    }
1583  };
1584
1585  class OverAutorelease : public CFRefBug {
1586  public:
1587    OverAutorelease()
1588    : CFRefBug("Object autoreleased too many times") {}
1589
1590    const char *getDescription() const {
1591      return "Object autoreleased too many times";
1592    }
1593  };
1594
1595  class ReturnedNotOwnedForOwned : public CFRefBug {
1596  public:
1597    ReturnedNotOwnedForOwned()
1598    : CFRefBug("Method should return an owned object") {}
1599
1600    const char *getDescription() const {
1601      return "Object with a +0 retain count returned to caller where a +1 "
1602             "(owning) retain count is expected";
1603    }
1604  };
1605
1606  class Leak : public CFRefBug {
1607  public:
1608    Leak(StringRef name)
1609    : CFRefBug(name) {
1610      // Leaks should not be reported if they are post-dominated by a sink.
1611      setSuppressOnSink(true);
1612    }
1613
1614    const char *getDescription() const { return ""; }
1615
1616    bool isLeak() const { return true; }
1617  };
1618
1619  //===---------===//
1620  // Bug Reports.  //
1621  //===---------===//
1622
1623  class CFRefReportVisitor : public BugReporterVisitorImpl<CFRefReportVisitor> {
1624  protected:
1625    SymbolRef Sym;
1626    const SummaryLogTy &SummaryLog;
1627    bool GCEnabled;
1628
1629  public:
1630    CFRefReportVisitor(SymbolRef sym, bool gcEnabled, const SummaryLogTy &log)
1631       : Sym(sym), SummaryLog(log), GCEnabled(gcEnabled) {}
1632
1633    virtual void Profile(llvm::FoldingSetNodeID &ID) const {
1634      static int x = 0;
1635      ID.AddPointer(&x);
1636      ID.AddPointer(Sym);
1637    }
1638
1639    virtual PathDiagnosticPiece *VisitNode(const ExplodedNode *N,
1640                                           const ExplodedNode *PrevN,
1641                                           BugReporterContext &BRC,
1642                                           BugReport &BR);
1643
1644    virtual PathDiagnosticPiece *getEndPath(BugReporterContext &BRC,
1645                                            const ExplodedNode *N,
1646                                            BugReport &BR);
1647  };
1648
1649  class CFRefLeakReportVisitor : public CFRefReportVisitor {
1650  public:
1651    CFRefLeakReportVisitor(SymbolRef sym, bool GCEnabled,
1652                           const SummaryLogTy &log)
1653       : CFRefReportVisitor(sym, GCEnabled, log) {}
1654
1655    PathDiagnosticPiece *getEndPath(BugReporterContext &BRC,
1656                                    const ExplodedNode *N,
1657                                    BugReport &BR);
1658
1659    virtual BugReporterVisitor *clone() const {
1660      // The curiously-recurring template pattern only works for one level of
1661      // subclassing. Rather than make a new template base for
1662      // CFRefReportVisitor, we simply override clone() to do the right thing.
1663      // This could be trouble someday if BugReporterVisitorImpl is ever
1664      // used for something else besides a convenient implementation of clone().
1665      return new CFRefLeakReportVisitor(*this);
1666    }
1667  };
1668
1669  class CFRefReport : public BugReport {
1670    void addGCModeDescription(const LangOptions &LOpts, bool GCEnabled);
1671
1672  public:
1673    CFRefReport(CFRefBug &D, const LangOptions &LOpts, bool GCEnabled,
1674                const SummaryLogTy &Log, ExplodedNode *n, SymbolRef sym,
1675                bool registerVisitor = true)
1676      : BugReport(D, D.getDescription(), n) {
1677      if (registerVisitor)
1678        addVisitor(new CFRefReportVisitor(sym, GCEnabled, Log));
1679      addGCModeDescription(LOpts, GCEnabled);
1680    }
1681
1682    CFRefReport(CFRefBug &D, const LangOptions &LOpts, bool GCEnabled,
1683                const SummaryLogTy &Log, ExplodedNode *n, SymbolRef sym,
1684                StringRef endText)
1685      : BugReport(D, D.getDescription(), endText, n) {
1686      addVisitor(new CFRefReportVisitor(sym, GCEnabled, Log));
1687      addGCModeDescription(LOpts, GCEnabled);
1688    }
1689
1690    virtual std::pair<ranges_iterator, ranges_iterator> getRanges() {
1691      const CFRefBug& BugTy = static_cast<CFRefBug&>(getBugType());
1692      if (!BugTy.isLeak())
1693        return BugReport::getRanges();
1694      else
1695        return std::make_pair(ranges_iterator(), ranges_iterator());
1696    }
1697  };
1698
1699  class CFRefLeakReport : public CFRefReport {
1700    const MemRegion* AllocBinding;
1701  public:
1702    CFRefLeakReport(CFRefBug &D, const LangOptions &LOpts, bool GCEnabled,
1703                    const SummaryLogTy &Log, ExplodedNode *n, SymbolRef sym,
1704                    CheckerContext &Ctx,
1705                    bool IncludeAllocationLine);
1706
1707    PathDiagnosticLocation getLocation(const SourceManager &SM) const {
1708      assert(Location.isValid());
1709      return Location;
1710    }
1711  };
1712} // end anonymous namespace
1713
1714void CFRefReport::addGCModeDescription(const LangOptions &LOpts,
1715                                       bool GCEnabled) {
1716  const char *GCModeDescription = 0;
1717
1718  switch (LOpts.getGC()) {
1719  case LangOptions::GCOnly:
1720    assert(GCEnabled);
1721    GCModeDescription = "Code is compiled to only use garbage collection";
1722    break;
1723
1724  case LangOptions::NonGC:
1725    assert(!GCEnabled);
1726    GCModeDescription = "Code is compiled to use reference counts";
1727    break;
1728
1729  case LangOptions::HybridGC:
1730    if (GCEnabled) {
1731      GCModeDescription = "Code is compiled to use either garbage collection "
1732                          "(GC) or reference counts (non-GC).  The bug occurs "
1733                          "with GC enabled";
1734      break;
1735    } else {
1736      GCModeDescription = "Code is compiled to use either garbage collection "
1737                          "(GC) or reference counts (non-GC).  The bug occurs "
1738                          "in non-GC mode";
1739      break;
1740    }
1741  }
1742
1743  assert(GCModeDescription && "invalid/unknown GC mode");
1744  addExtraText(GCModeDescription);
1745}
1746
1747static bool isNumericLiteralExpression(const Expr *E) {
1748  // FIXME: This set of cases was copied from SemaExprObjC.
1749  return isa<IntegerLiteral>(E) ||
1750         isa<CharacterLiteral>(E) ||
1751         isa<FloatingLiteral>(E) ||
1752         isa<ObjCBoolLiteralExpr>(E) ||
1753         isa<CXXBoolLiteralExpr>(E);
1754}
1755
1756PathDiagnosticPiece *CFRefReportVisitor::VisitNode(const ExplodedNode *N,
1757                                                   const ExplodedNode *PrevN,
1758                                                   BugReporterContext &BRC,
1759                                                   BugReport &BR) {
1760  // FIXME: We will eventually need to handle non-statement-based events
1761  // (__attribute__((cleanup))).
1762  if (!N->getLocation().getAs<StmtPoint>())
1763    return NULL;
1764
1765  // Check if the type state has changed.
1766  ProgramStateRef PrevSt = PrevN->getState();
1767  ProgramStateRef CurrSt = N->getState();
1768  const LocationContext *LCtx = N->getLocationContext();
1769
1770  const RefVal* CurrT = getRefBinding(CurrSt, Sym);
1771  if (!CurrT) return NULL;
1772
1773  const RefVal &CurrV = *CurrT;
1774  const RefVal *PrevT = getRefBinding(PrevSt, Sym);
1775
1776  // Create a string buffer to constain all the useful things we want
1777  // to tell the user.
1778  std::string sbuf;
1779  llvm::raw_string_ostream os(sbuf);
1780
1781  // This is the allocation site since the previous node had no bindings
1782  // for this symbol.
1783  if (!PrevT) {
1784    const Stmt *S = N->getLocation().castAs<StmtPoint>().getStmt();
1785
1786    if (isa<ObjCArrayLiteral>(S)) {
1787      os << "NSArray literal is an object with a +0 retain count";
1788    }
1789    else if (isa<ObjCDictionaryLiteral>(S)) {
1790      os << "NSDictionary literal is an object with a +0 retain count";
1791    }
1792    else if (const ObjCBoxedExpr *BL = dyn_cast<ObjCBoxedExpr>(S)) {
1793      if (isNumericLiteralExpression(BL->getSubExpr()))
1794        os << "NSNumber literal is an object with a +0 retain count";
1795      else {
1796        const ObjCInterfaceDecl *BoxClass = 0;
1797        if (const ObjCMethodDecl *Method = BL->getBoxingMethod())
1798          BoxClass = Method->getClassInterface();
1799
1800        // We should always be able to find the boxing class interface,
1801        // but consider this future-proofing.
1802        if (BoxClass)
1803          os << *BoxClass << " b";
1804        else
1805          os << "B";
1806
1807        os << "oxed expression produces an object with a +0 retain count";
1808      }
1809    }
1810    else {
1811      if (const CallExpr *CE = dyn_cast<CallExpr>(S)) {
1812        // Get the name of the callee (if it is available).
1813        SVal X = CurrSt->getSValAsScalarOrLoc(CE->getCallee(), LCtx);
1814        if (const FunctionDecl *FD = X.getAsFunctionDecl())
1815          os << "Call to function '" << *FD << '\'';
1816        else
1817          os << "function call";
1818      }
1819      else {
1820        assert(isa<ObjCMessageExpr>(S));
1821        CallEventManager &Mgr = CurrSt->getStateManager().getCallEventManager();
1822        CallEventRef<ObjCMethodCall> Call
1823          = Mgr.getObjCMethodCall(cast<ObjCMessageExpr>(S), CurrSt, LCtx);
1824
1825        switch (Call->getMessageKind()) {
1826        case OCM_Message:
1827          os << "Method";
1828          break;
1829        case OCM_PropertyAccess:
1830          os << "Property";
1831          break;
1832        case OCM_Subscript:
1833          os << "Subscript";
1834          break;
1835        }
1836      }
1837
1838      if (CurrV.getObjKind() == RetEffect::CF) {
1839        os << " returns a Core Foundation object with a ";
1840      }
1841      else {
1842        assert (CurrV.getObjKind() == RetEffect::ObjC);
1843        os << " returns an Objective-C object with a ";
1844      }
1845
1846      if (CurrV.isOwned()) {
1847        os << "+1 retain count";
1848
1849        if (GCEnabled) {
1850          assert(CurrV.getObjKind() == RetEffect::CF);
1851          os << ".  "
1852          "Core Foundation objects are not automatically garbage collected.";
1853        }
1854      }
1855      else {
1856        assert (CurrV.isNotOwned());
1857        os << "+0 retain count";
1858      }
1859    }
1860
1861    PathDiagnosticLocation Pos(S, BRC.getSourceManager(),
1862                                  N->getLocationContext());
1863    return new PathDiagnosticEventPiece(Pos, os.str());
1864  }
1865
1866  // Gather up the effects that were performed on the object at this
1867  // program point
1868  SmallVector<ArgEffect, 2> AEffects;
1869
1870  const ExplodedNode *OrigNode = BRC.getNodeResolver().getOriginalNode(N);
1871  if (const RetainSummary *Summ = SummaryLog.lookup(OrigNode)) {
1872    // We only have summaries attached to nodes after evaluating CallExpr and
1873    // ObjCMessageExprs.
1874    const Stmt *S = N->getLocation().castAs<StmtPoint>().getStmt();
1875
1876    if (const CallExpr *CE = dyn_cast<CallExpr>(S)) {
1877      // Iterate through the parameter expressions and see if the symbol
1878      // was ever passed as an argument.
1879      unsigned i = 0;
1880
1881      for (CallExpr::const_arg_iterator AI=CE->arg_begin(), AE=CE->arg_end();
1882           AI!=AE; ++AI, ++i) {
1883
1884        // Retrieve the value of the argument.  Is it the symbol
1885        // we are interested in?
1886        if (CurrSt->getSValAsScalarOrLoc(*AI, LCtx).getAsLocSymbol() != Sym)
1887          continue;
1888
1889        // We have an argument.  Get the effect!
1890        AEffects.push_back(Summ->getArg(i));
1891      }
1892    }
1893    else if (const ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(S)) {
1894      if (const Expr *receiver = ME->getInstanceReceiver())
1895        if (CurrSt->getSValAsScalarOrLoc(receiver, LCtx)
1896              .getAsLocSymbol() == Sym) {
1897          // The symbol we are tracking is the receiver.
1898          AEffects.push_back(Summ->getReceiverEffect());
1899        }
1900    }
1901  }
1902
1903  do {
1904    // Get the previous type state.
1905    RefVal PrevV = *PrevT;
1906
1907    // Specially handle -dealloc.
1908    if (!GCEnabled && std::find(AEffects.begin(), AEffects.end(), Dealloc) !=
1909                          AEffects.end()) {
1910      // Determine if the object's reference count was pushed to zero.
1911      assert(!(PrevV == CurrV) && "The typestate *must* have changed.");
1912      // We may not have transitioned to 'release' if we hit an error.
1913      // This case is handled elsewhere.
1914      if (CurrV.getKind() == RefVal::Released) {
1915        assert(CurrV.getCombinedCounts() == 0);
1916        os << "Object released by directly sending the '-dealloc' message";
1917        break;
1918      }
1919    }
1920
1921    // Specially handle CFMakeCollectable and friends.
1922    if (std::find(AEffects.begin(), AEffects.end(), MakeCollectable) !=
1923        AEffects.end()) {
1924      // Get the name of the function.
1925      const Stmt *S = N->getLocation().castAs<StmtPoint>().getStmt();
1926      SVal X =
1927        CurrSt->getSValAsScalarOrLoc(cast<CallExpr>(S)->getCallee(), LCtx);
1928      const FunctionDecl *FD = X.getAsFunctionDecl();
1929
1930      if (GCEnabled) {
1931        // Determine if the object's reference count was pushed to zero.
1932        assert(!(PrevV == CurrV) && "The typestate *must* have changed.");
1933
1934        os << "In GC mode a call to '" << *FD
1935        <<  "' decrements an object's retain count and registers the "
1936        "object with the garbage collector. ";
1937
1938        if (CurrV.getKind() == RefVal::Released) {
1939          assert(CurrV.getCount() == 0);
1940          os << "Since it now has a 0 retain count the object can be "
1941          "automatically collected by the garbage collector.";
1942        }
1943        else
1944          os << "An object must have a 0 retain count to be garbage collected. "
1945          "After this call its retain count is +" << CurrV.getCount()
1946          << '.';
1947      }
1948      else
1949        os << "When GC is not enabled a call to '" << *FD
1950        << "' has no effect on its argument.";
1951
1952      // Nothing more to say.
1953      break;
1954    }
1955
1956    // Determine if the typestate has changed.
1957    if (!(PrevV == CurrV))
1958      switch (CurrV.getKind()) {
1959        case RefVal::Owned:
1960        case RefVal::NotOwned:
1961
1962          if (PrevV.getCount() == CurrV.getCount()) {
1963            // Did an autorelease message get sent?
1964            if (PrevV.getAutoreleaseCount() == CurrV.getAutoreleaseCount())
1965              return 0;
1966
1967            assert(PrevV.getAutoreleaseCount() < CurrV.getAutoreleaseCount());
1968            os << "Object autoreleased";
1969            break;
1970          }
1971
1972          if (PrevV.getCount() > CurrV.getCount())
1973            os << "Reference count decremented.";
1974          else
1975            os << "Reference count incremented.";
1976
1977          if (unsigned Count = CurrV.getCount())
1978            os << " The object now has a +" << Count << " retain count.";
1979
1980          if (PrevV.getKind() == RefVal::Released) {
1981            assert(GCEnabled && CurrV.getCount() > 0);
1982            os << " The object is not eligible for garbage collection until "
1983                  "the retain count reaches 0 again.";
1984          }
1985
1986          break;
1987
1988        case RefVal::Released:
1989          os << "Object released.";
1990          break;
1991
1992        case RefVal::ReturnedOwned:
1993          // Autoreleases can be applied after marking a node ReturnedOwned.
1994          if (CurrV.getAutoreleaseCount())
1995            return NULL;
1996
1997          os << "Object returned to caller as an owning reference (single "
1998                "retain count transferred to caller)";
1999          break;
2000
2001        case RefVal::ReturnedNotOwned:
2002          os << "Object returned to caller with a +0 retain count";
2003          break;
2004
2005        default:
2006          return NULL;
2007      }
2008
2009    // Emit any remaining diagnostics for the argument effects (if any).
2010    for (SmallVectorImpl<ArgEffect>::iterator I=AEffects.begin(),
2011         E=AEffects.end(); I != E; ++I) {
2012
2013      // A bunch of things have alternate behavior under GC.
2014      if (GCEnabled)
2015        switch (*I) {
2016          default: break;
2017          case Autorelease:
2018            os << "In GC mode an 'autorelease' has no effect.";
2019            continue;
2020          case IncRefMsg:
2021            os << "In GC mode the 'retain' message has no effect.";
2022            continue;
2023          case DecRefMsg:
2024            os << "In GC mode the 'release' message has no effect.";
2025            continue;
2026        }
2027    }
2028  } while (0);
2029
2030  if (os.str().empty())
2031    return 0; // We have nothing to say!
2032
2033  const Stmt *S = N->getLocation().castAs<StmtPoint>().getStmt();
2034  PathDiagnosticLocation Pos(S, BRC.getSourceManager(),
2035                                N->getLocationContext());
2036  PathDiagnosticPiece *P = new PathDiagnosticEventPiece(Pos, os.str());
2037
2038  // Add the range by scanning the children of the statement for any bindings
2039  // to Sym.
2040  for (Stmt::const_child_iterator I = S->child_begin(), E = S->child_end();
2041       I!=E; ++I)
2042    if (const Expr *Exp = dyn_cast_or_null<Expr>(*I))
2043      if (CurrSt->getSValAsScalarOrLoc(Exp, LCtx).getAsLocSymbol() == Sym) {
2044        P->addRange(Exp->getSourceRange());
2045        break;
2046      }
2047
2048  return P;
2049}
2050
2051// Find the first node in the current function context that referred to the
2052// tracked symbol and the memory location that value was stored to. Note, the
2053// value is only reported if the allocation occurred in the same function as
2054// the leak. The function can also return a location context, which should be
2055// treated as interesting.
2056struct AllocationInfo {
2057  const ExplodedNode* N;
2058  const MemRegion *R;
2059  const LocationContext *InterestingMethodContext;
2060  AllocationInfo(const ExplodedNode *InN,
2061                 const MemRegion *InR,
2062                 const LocationContext *InInterestingMethodContext) :
2063    N(InN), R(InR), InterestingMethodContext(InInterestingMethodContext) {}
2064};
2065
2066static AllocationInfo
2067GetAllocationSite(ProgramStateManager& StateMgr, const ExplodedNode *N,
2068                  SymbolRef Sym) {
2069  const ExplodedNode *AllocationNode = N;
2070  const ExplodedNode *AllocationNodeInCurrentContext = N;
2071  const MemRegion* FirstBinding = 0;
2072  const LocationContext *LeakContext = N->getLocationContext();
2073
2074  // The location context of the init method called on the leaked object, if
2075  // available.
2076  const LocationContext *InitMethodContext = 0;
2077
2078  while (N) {
2079    ProgramStateRef St = N->getState();
2080    const LocationContext *NContext = N->getLocationContext();
2081
2082    if (!getRefBinding(St, Sym))
2083      break;
2084
2085    StoreManager::FindUniqueBinding FB(Sym);
2086    StateMgr.iterBindings(St, FB);
2087
2088    if (FB) {
2089      const MemRegion *R = FB.getRegion();
2090      const VarRegion *VR = R->getBaseRegion()->getAs<VarRegion>();
2091      // Do not show local variables belonging to a function other than
2092      // where the error is reported.
2093      if (!VR || VR->getStackFrame() == LeakContext->getCurrentStackFrame())
2094        FirstBinding = R;
2095    }
2096
2097    // AllocationNode is the last node in which the symbol was tracked.
2098    AllocationNode = N;
2099
2100    // AllocationNodeInCurrentContext, is the last node in the current context
2101    // in which the symbol was tracked.
2102    if (NContext == LeakContext)
2103      AllocationNodeInCurrentContext = N;
2104
2105    // Find the last init that was called on the given symbol and store the
2106    // init method's location context.
2107    if (!InitMethodContext)
2108      if (Optional<CallEnter> CEP = N->getLocation().getAs<CallEnter>()) {
2109        const Stmt *CE = CEP->getCallExpr();
2110        if (const ObjCMessageExpr *ME = dyn_cast_or_null<ObjCMessageExpr>(CE)) {
2111          const Stmt *RecExpr = ME->getInstanceReceiver();
2112          if (RecExpr) {
2113            SVal RecV = St->getSVal(RecExpr, NContext);
2114            if (ME->getMethodFamily() == OMF_init && RecV.getAsSymbol() == Sym)
2115              InitMethodContext = CEP->getCalleeContext();
2116          }
2117        }
2118      }
2119
2120    N = N->pred_empty() ? NULL : *(N->pred_begin());
2121  }
2122
2123  // If we are reporting a leak of the object that was allocated with alloc,
2124  // mark its init method as interesting.
2125  const LocationContext *InterestingMethodContext = 0;
2126  if (InitMethodContext) {
2127    const ProgramPoint AllocPP = AllocationNode->getLocation();
2128    if (Optional<StmtPoint> SP = AllocPP.getAs<StmtPoint>())
2129      if (const ObjCMessageExpr *ME = SP->getStmtAs<ObjCMessageExpr>())
2130        if (ME->getMethodFamily() == OMF_alloc)
2131          InterestingMethodContext = InitMethodContext;
2132  }
2133
2134  // If allocation happened in a function different from the leak node context,
2135  // do not report the binding.
2136  assert(N && "Could not find allocation node");
2137  if (N->getLocationContext() != LeakContext) {
2138    FirstBinding = 0;
2139  }
2140
2141  return AllocationInfo(AllocationNodeInCurrentContext,
2142                        FirstBinding,
2143                        InterestingMethodContext);
2144}
2145
2146PathDiagnosticPiece*
2147CFRefReportVisitor::getEndPath(BugReporterContext &BRC,
2148                               const ExplodedNode *EndN,
2149                               BugReport &BR) {
2150  BR.markInteresting(Sym);
2151  return BugReporterVisitor::getDefaultEndPath(BRC, EndN, BR);
2152}
2153
2154PathDiagnosticPiece*
2155CFRefLeakReportVisitor::getEndPath(BugReporterContext &BRC,
2156                                   const ExplodedNode *EndN,
2157                                   BugReport &BR) {
2158
2159  // Tell the BugReporterContext to report cases when the tracked symbol is
2160  // assigned to different variables, etc.
2161  BR.markInteresting(Sym);
2162
2163  // We are reporting a leak.  Walk up the graph to get to the first node where
2164  // the symbol appeared, and also get the first VarDecl that tracked object
2165  // is stored to.
2166  AllocationInfo AllocI =
2167    GetAllocationSite(BRC.getStateManager(), EndN, Sym);
2168
2169  const MemRegion* FirstBinding = AllocI.R;
2170  BR.markInteresting(AllocI.InterestingMethodContext);
2171
2172  SourceManager& SM = BRC.getSourceManager();
2173
2174  // Compute an actual location for the leak.  Sometimes a leak doesn't
2175  // occur at an actual statement (e.g., transition between blocks; end
2176  // of function) so we need to walk the graph and compute a real location.
2177  const ExplodedNode *LeakN = EndN;
2178  PathDiagnosticLocation L = PathDiagnosticLocation::createEndOfPath(LeakN, SM);
2179
2180  std::string sbuf;
2181  llvm::raw_string_ostream os(sbuf);
2182
2183  os << "Object leaked: ";
2184
2185  if (FirstBinding) {
2186    os << "object allocated and stored into '"
2187       << FirstBinding->getString() << '\'';
2188  }
2189  else
2190    os << "allocated object";
2191
2192  // Get the retain count.
2193  const RefVal* RV = getRefBinding(EndN->getState(), Sym);
2194  assert(RV);
2195
2196  if (RV->getKind() == RefVal::ErrorLeakReturned) {
2197    // FIXME: Per comments in rdar://6320065, "create" only applies to CF
2198    // objects.  Only "copy", "alloc", "retain" and "new" transfer ownership
2199    // to the caller for NS objects.
2200    const Decl *D = &EndN->getCodeDecl();
2201
2202    os << (isa<ObjCMethodDecl>(D) ? " is returned from a method "
2203                                  : " is returned from a function ");
2204
2205    if (D->getAttr<CFReturnsNotRetainedAttr>())
2206      os << "that is annotated as CF_RETURNS_NOT_RETAINED";
2207    else if (D->getAttr<NSReturnsNotRetainedAttr>())
2208      os << "that is annotated as NS_RETURNS_NOT_RETAINED";
2209    else {
2210      if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(D)) {
2211        os << "whose name ('" << MD->getSelector().getAsString()
2212           << "') does not start with 'copy', 'mutableCopy', 'alloc' or 'new'."
2213              "  This violates the naming convention rules"
2214              " given in the Memory Management Guide for Cocoa";
2215      }
2216      else {
2217        const FunctionDecl *FD = cast<FunctionDecl>(D);
2218        os << "whose name ('" << *FD
2219           << "') does not contain 'Copy' or 'Create'.  This violates the naming"
2220              " convention rules given in the Memory Management Guide for Core"
2221              " Foundation";
2222      }
2223    }
2224  }
2225  else if (RV->getKind() == RefVal::ErrorGCLeakReturned) {
2226    const ObjCMethodDecl &MD = cast<ObjCMethodDecl>(EndN->getCodeDecl());
2227    os << " and returned from method '" << MD.getSelector().getAsString()
2228       << "' is potentially leaked when using garbage collection.  Callers "
2229          "of this method do not expect a returned object with a +1 retain "
2230          "count since they expect the object to be managed by the garbage "
2231          "collector";
2232  }
2233  else
2234    os << " is not referenced later in this execution path and has a retain "
2235          "count of +" << RV->getCount();
2236
2237  return new PathDiagnosticEventPiece(L, os.str());
2238}
2239
2240CFRefLeakReport::CFRefLeakReport(CFRefBug &D, const LangOptions &LOpts,
2241                                 bool GCEnabled, const SummaryLogTy &Log,
2242                                 ExplodedNode *n, SymbolRef sym,
2243                                 CheckerContext &Ctx,
2244                                 bool IncludeAllocationLine)
2245  : CFRefReport(D, LOpts, GCEnabled, Log, n, sym, false) {
2246
2247  // Most bug reports are cached at the location where they occurred.
2248  // With leaks, we want to unique them by the location where they were
2249  // allocated, and only report a single path.  To do this, we need to find
2250  // the allocation site of a piece of tracked memory, which we do via a
2251  // call to GetAllocationSite.  This will walk the ExplodedGraph backwards.
2252  // Note that this is *not* the trimmed graph; we are guaranteed, however,
2253  // that all ancestor nodes that represent the allocation site have the
2254  // same SourceLocation.
2255  const ExplodedNode *AllocNode = 0;
2256
2257  const SourceManager& SMgr = Ctx.getSourceManager();
2258
2259  AllocationInfo AllocI =
2260    GetAllocationSite(Ctx.getStateManager(), getErrorNode(), sym);
2261
2262  AllocNode = AllocI.N;
2263  AllocBinding = AllocI.R;
2264  markInteresting(AllocI.InterestingMethodContext);
2265
2266  // Get the SourceLocation for the allocation site.
2267  // FIXME: This will crash the analyzer if an allocation comes from an
2268  // implicit call. (Currently there are no such allocations in Cocoa, though.)
2269  const Stmt *AllocStmt;
2270  ProgramPoint P = AllocNode->getLocation();
2271  if (Optional<CallExitEnd> Exit = P.getAs<CallExitEnd>())
2272    AllocStmt = Exit->getCalleeContext()->getCallSite();
2273  else
2274    AllocStmt = P.castAs<PostStmt>().getStmt();
2275  assert(AllocStmt && "All allocations must come from explicit calls");
2276
2277  PathDiagnosticLocation AllocLocation =
2278    PathDiagnosticLocation::createBegin(AllocStmt, SMgr,
2279                                        AllocNode->getLocationContext());
2280  Location = AllocLocation;
2281
2282  // Set uniqieing info, which will be used for unique the bug reports. The
2283  // leaks should be uniqued on the allocation site.
2284  UniqueingLocation = AllocLocation;
2285  UniqueingDecl = AllocNode->getLocationContext()->getDecl();
2286
2287  // Fill in the description of the bug.
2288  Description.clear();
2289  llvm::raw_string_ostream os(Description);
2290  os << "Potential leak ";
2291  if (GCEnabled)
2292    os << "(when using garbage collection) ";
2293  os << "of an object";
2294
2295  if (AllocBinding) {
2296    os << " stored into '" << AllocBinding->getString() << '\'';
2297    if (IncludeAllocationLine) {
2298      FullSourceLoc SL(AllocStmt->getLocStart(), Ctx.getSourceManager());
2299      os << " (allocated on line " << SL.getSpellingLineNumber() << ")";
2300    }
2301  }
2302
2303  addVisitor(new CFRefLeakReportVisitor(sym, GCEnabled, Log));
2304}
2305
2306//===----------------------------------------------------------------------===//
2307// Main checker logic.
2308//===----------------------------------------------------------------------===//
2309
2310namespace {
2311class RetainCountChecker
2312  : public Checker< check::Bind,
2313                    check::DeadSymbols,
2314                    check::EndAnalysis,
2315                    check::EndFunction,
2316                    check::PostStmt<BlockExpr>,
2317                    check::PostStmt<CastExpr>,
2318                    check::PostStmt<ObjCArrayLiteral>,
2319                    check::PostStmt<ObjCDictionaryLiteral>,
2320                    check::PostStmt<ObjCBoxedExpr>,
2321                    check::PostCall,
2322                    check::PreStmt<ReturnStmt>,
2323                    check::RegionChanges,
2324                    eval::Assume,
2325                    eval::Call > {
2326  mutable OwningPtr<CFRefBug> useAfterRelease, releaseNotOwned;
2327  mutable OwningPtr<CFRefBug> deallocGC, deallocNotOwned;
2328  mutable OwningPtr<CFRefBug> overAutorelease, returnNotOwnedForOwned;
2329  mutable OwningPtr<CFRefBug> leakWithinFunction, leakAtReturn;
2330  mutable OwningPtr<CFRefBug> leakWithinFunctionGC, leakAtReturnGC;
2331
2332  typedef llvm::DenseMap<SymbolRef, const SimpleProgramPointTag *> SymbolTagMap;
2333
2334  // This map is only used to ensure proper deletion of any allocated tags.
2335  mutable SymbolTagMap DeadSymbolTags;
2336
2337  mutable OwningPtr<RetainSummaryManager> Summaries;
2338  mutable OwningPtr<RetainSummaryManager> SummariesGC;
2339  mutable SummaryLogTy SummaryLog;
2340  mutable bool ShouldResetSummaryLog;
2341
2342  /// Optional setting to indicate if leak reports should include
2343  /// the allocation line.
2344  mutable bool IncludeAllocationLine;
2345
2346public:
2347  RetainCountChecker(AnalyzerOptions &AO)
2348    : ShouldResetSummaryLog(false),
2349      IncludeAllocationLine(shouldIncludeAllocationSiteInLeakDiagnostics(AO)) {}
2350
2351  virtual ~RetainCountChecker() {
2352    DeleteContainerSeconds(DeadSymbolTags);
2353  }
2354
2355  void checkEndAnalysis(ExplodedGraph &G, BugReporter &BR,
2356                        ExprEngine &Eng) const {
2357    // FIXME: This is a hack to make sure the summary log gets cleared between
2358    // analyses of different code bodies.
2359    //
2360    // Why is this necessary? Because a checker's lifetime is tied to a
2361    // translation unit, but an ExplodedGraph's lifetime is just a code body.
2362    // Once in a blue moon, a new ExplodedNode will have the same address as an
2363    // old one with an associated summary, and the bug report visitor gets very
2364    // confused. (To make things worse, the summary lifetime is currently also
2365    // tied to a code body, so we get a crash instead of incorrect results.)
2366    //
2367    // Why is this a bad solution? Because if the lifetime of the ExplodedGraph
2368    // changes, things will start going wrong again. Really the lifetime of this
2369    // log needs to be tied to either the specific nodes in it or the entire
2370    // ExplodedGraph, not to a specific part of the code being analyzed.
2371    //
2372    // (Also, having stateful local data means that the same checker can't be
2373    // used from multiple threads, but a lot of checkers have incorrect
2374    // assumptions about that anyway. So that wasn't a priority at the time of
2375    // this fix.)
2376    //
2377    // This happens at the end of analysis, but bug reports are emitted /after/
2378    // this point. So we can't just clear the summary log now. Instead, we mark
2379    // that the next time we access the summary log, it should be cleared.
2380
2381    // If we never reset the summary log during /this/ code body analysis,
2382    // there were no new summaries. There might still have been summaries from
2383    // the /last/ analysis, so clear them out to make sure the bug report
2384    // visitors don't get confused.
2385    if (ShouldResetSummaryLog)
2386      SummaryLog.clear();
2387
2388    ShouldResetSummaryLog = !SummaryLog.empty();
2389  }
2390
2391  CFRefBug *getLeakWithinFunctionBug(const LangOptions &LOpts,
2392                                     bool GCEnabled) const {
2393    if (GCEnabled) {
2394      if (!leakWithinFunctionGC)
2395        leakWithinFunctionGC.reset(new Leak("Leak of object when using "
2396                                             "garbage collection"));
2397      return leakWithinFunctionGC.get();
2398    } else {
2399      if (!leakWithinFunction) {
2400        if (LOpts.getGC() == LangOptions::HybridGC) {
2401          leakWithinFunction.reset(new Leak("Leak of object when not using "
2402                                            "garbage collection (GC) in "
2403                                            "dual GC/non-GC code"));
2404        } else {
2405          leakWithinFunction.reset(new Leak("Leak"));
2406        }
2407      }
2408      return leakWithinFunction.get();
2409    }
2410  }
2411
2412  CFRefBug *getLeakAtReturnBug(const LangOptions &LOpts, bool GCEnabled) const {
2413    if (GCEnabled) {
2414      if (!leakAtReturnGC)
2415        leakAtReturnGC.reset(new Leak("Leak of returned object when using "
2416                                      "garbage collection"));
2417      return leakAtReturnGC.get();
2418    } else {
2419      if (!leakAtReturn) {
2420        if (LOpts.getGC() == LangOptions::HybridGC) {
2421          leakAtReturn.reset(new Leak("Leak of returned object when not using "
2422                                      "garbage collection (GC) in dual "
2423                                      "GC/non-GC code"));
2424        } else {
2425          leakAtReturn.reset(new Leak("Leak of returned object"));
2426        }
2427      }
2428      return leakAtReturn.get();
2429    }
2430  }
2431
2432  RetainSummaryManager &getSummaryManager(ASTContext &Ctx,
2433                                          bool GCEnabled) const {
2434    // FIXME: We don't support ARC being turned on and off during one analysis.
2435    // (nor, for that matter, do we support changing ASTContexts)
2436    bool ARCEnabled = (bool)Ctx.getLangOpts().ObjCAutoRefCount;
2437    if (GCEnabled) {
2438      if (!SummariesGC)
2439        SummariesGC.reset(new RetainSummaryManager(Ctx, true, ARCEnabled));
2440      else
2441        assert(SummariesGC->isARCEnabled() == ARCEnabled);
2442      return *SummariesGC;
2443    } else {
2444      if (!Summaries)
2445        Summaries.reset(new RetainSummaryManager(Ctx, false, ARCEnabled));
2446      else
2447        assert(Summaries->isARCEnabled() == ARCEnabled);
2448      return *Summaries;
2449    }
2450  }
2451
2452  RetainSummaryManager &getSummaryManager(CheckerContext &C) const {
2453    return getSummaryManager(C.getASTContext(), C.isObjCGCEnabled());
2454  }
2455
2456  void printState(raw_ostream &Out, ProgramStateRef State,
2457                  const char *NL, const char *Sep) const;
2458
2459  void checkBind(SVal loc, SVal val, const Stmt *S, CheckerContext &C) const;
2460  void checkPostStmt(const BlockExpr *BE, CheckerContext &C) const;
2461  void checkPostStmt(const CastExpr *CE, CheckerContext &C) const;
2462
2463  void checkPostStmt(const ObjCArrayLiteral *AL, CheckerContext &C) const;
2464  void checkPostStmt(const ObjCDictionaryLiteral *DL, CheckerContext &C) const;
2465  void checkPostStmt(const ObjCBoxedExpr *BE, CheckerContext &C) const;
2466
2467  void checkPostCall(const CallEvent &Call, CheckerContext &C) const;
2468
2469  void checkSummary(const RetainSummary &Summ, const CallEvent &Call,
2470                    CheckerContext &C) const;
2471
2472  void processSummaryOfInlined(const RetainSummary &Summ,
2473                               const CallEvent &Call,
2474                               CheckerContext &C) const;
2475
2476  bool evalCall(const CallExpr *CE, CheckerContext &C) const;
2477
2478  ProgramStateRef evalAssume(ProgramStateRef state, SVal Cond,
2479                                 bool Assumption) const;
2480
2481  ProgramStateRef
2482  checkRegionChanges(ProgramStateRef state,
2483                     const InvalidatedSymbols *invalidated,
2484                     ArrayRef<const MemRegion *> ExplicitRegions,
2485                     ArrayRef<const MemRegion *> Regions,
2486                     const CallEvent *Call) const;
2487
2488  bool wantsRegionChangeUpdate(ProgramStateRef state) const {
2489    return true;
2490  }
2491
2492  void checkPreStmt(const ReturnStmt *S, CheckerContext &C) const;
2493  void checkReturnWithRetEffect(const ReturnStmt *S, CheckerContext &C,
2494                                ExplodedNode *Pred, RetEffect RE, RefVal X,
2495                                SymbolRef Sym, ProgramStateRef state) const;
2496
2497  void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const;
2498  void checkEndFunction(CheckerContext &C) const;
2499
2500  ProgramStateRef updateSymbol(ProgramStateRef state, SymbolRef sym,
2501                               RefVal V, ArgEffect E, RefVal::Kind &hasErr,
2502                               CheckerContext &C) const;
2503
2504  void processNonLeakError(ProgramStateRef St, SourceRange ErrorRange,
2505                           RefVal::Kind ErrorKind, SymbolRef Sym,
2506                           CheckerContext &C) const;
2507
2508  void processObjCLiterals(CheckerContext &C, const Expr *Ex) const;
2509
2510  const ProgramPointTag *getDeadSymbolTag(SymbolRef sym) const;
2511
2512  ProgramStateRef handleSymbolDeath(ProgramStateRef state,
2513                                    SymbolRef sid, RefVal V,
2514                                    SmallVectorImpl<SymbolRef> &Leaked) const;
2515
2516  ProgramStateRef
2517  handleAutoreleaseCounts(ProgramStateRef state, ExplodedNode *Pred,
2518                          const ProgramPointTag *Tag, CheckerContext &Ctx,
2519                          SymbolRef Sym, RefVal V) const;
2520
2521  ExplodedNode *processLeaks(ProgramStateRef state,
2522                             SmallVectorImpl<SymbolRef> &Leaked,
2523                             CheckerContext &Ctx,
2524                             ExplodedNode *Pred = 0) const;
2525};
2526} // end anonymous namespace
2527
2528namespace {
2529class StopTrackingCallback : public SymbolVisitor {
2530  ProgramStateRef state;
2531public:
2532  StopTrackingCallback(ProgramStateRef st) : state(st) {}
2533  ProgramStateRef getState() const { return state; }
2534
2535  bool VisitSymbol(SymbolRef sym) {
2536    state = state->remove<RefBindings>(sym);
2537    return true;
2538  }
2539};
2540} // end anonymous namespace
2541
2542//===----------------------------------------------------------------------===//
2543// Handle statements that may have an effect on refcounts.
2544//===----------------------------------------------------------------------===//
2545
2546void RetainCountChecker::checkPostStmt(const BlockExpr *BE,
2547                                       CheckerContext &C) const {
2548
2549  // Scan the BlockDecRefExprs for any object the retain count checker
2550  // may be tracking.
2551  if (!BE->getBlockDecl()->hasCaptures())
2552    return;
2553
2554  ProgramStateRef state = C.getState();
2555  const BlockDataRegion *R =
2556    cast<BlockDataRegion>(state->getSVal(BE,
2557                                         C.getLocationContext()).getAsRegion());
2558
2559  BlockDataRegion::referenced_vars_iterator I = R->referenced_vars_begin(),
2560                                            E = R->referenced_vars_end();
2561
2562  if (I == E)
2563    return;
2564
2565  // FIXME: For now we invalidate the tracking of all symbols passed to blocks
2566  // via captured variables, even though captured variables result in a copy
2567  // and in implicit increment/decrement of a retain count.
2568  SmallVector<const MemRegion*, 10> Regions;
2569  const LocationContext *LC = C.getLocationContext();
2570  MemRegionManager &MemMgr = C.getSValBuilder().getRegionManager();
2571
2572  for ( ; I != E; ++I) {
2573    const VarRegion *VR = I.getCapturedRegion();
2574    if (VR->getSuperRegion() == R) {
2575      VR = MemMgr.getVarRegion(VR->getDecl(), LC);
2576    }
2577    Regions.push_back(VR);
2578  }
2579
2580  state =
2581    state->scanReachableSymbols<StopTrackingCallback>(Regions.data(),
2582                                    Regions.data() + Regions.size()).getState();
2583  C.addTransition(state);
2584}
2585
2586void RetainCountChecker::checkPostStmt(const CastExpr *CE,
2587                                       CheckerContext &C) const {
2588  const ObjCBridgedCastExpr *BE = dyn_cast<ObjCBridgedCastExpr>(CE);
2589  if (!BE)
2590    return;
2591
2592  ArgEffect AE = IncRef;
2593
2594  switch (BE->getBridgeKind()) {
2595    case clang::OBC_Bridge:
2596      // Do nothing.
2597      return;
2598    case clang::OBC_BridgeRetained:
2599      AE = IncRef;
2600      break;
2601    case clang::OBC_BridgeTransfer:
2602      AE = DecRefBridgedTransfered;
2603      break;
2604  }
2605
2606  ProgramStateRef state = C.getState();
2607  SymbolRef Sym = state->getSVal(CE, C.getLocationContext()).getAsLocSymbol();
2608  if (!Sym)
2609    return;
2610  const RefVal* T = getRefBinding(state, Sym);
2611  if (!T)
2612    return;
2613
2614  RefVal::Kind hasErr = (RefVal::Kind) 0;
2615  state = updateSymbol(state, Sym, *T, AE, hasErr, C);
2616
2617  if (hasErr) {
2618    // FIXME: If we get an error during a bridge cast, should we report it?
2619    // Should we assert that there is no error?
2620    return;
2621  }
2622
2623  C.addTransition(state);
2624}
2625
2626void RetainCountChecker::processObjCLiterals(CheckerContext &C,
2627                                             const Expr *Ex) const {
2628  ProgramStateRef state = C.getState();
2629  const ExplodedNode *pred = C.getPredecessor();
2630  for (Stmt::const_child_iterator it = Ex->child_begin(), et = Ex->child_end() ;
2631       it != et ; ++it) {
2632    const Stmt *child = *it;
2633    SVal V = state->getSVal(child, pred->getLocationContext());
2634    if (SymbolRef sym = V.getAsSymbol())
2635      if (const RefVal* T = getRefBinding(state, sym)) {
2636        RefVal::Kind hasErr = (RefVal::Kind) 0;
2637        state = updateSymbol(state, sym, *T, MayEscape, hasErr, C);
2638        if (hasErr) {
2639          processNonLeakError(state, child->getSourceRange(), hasErr, sym, C);
2640          return;
2641        }
2642      }
2643  }
2644
2645  // Return the object as autoreleased.
2646  //  RetEffect RE = RetEffect::MakeNotOwned(RetEffect::ObjC);
2647  if (SymbolRef sym =
2648        state->getSVal(Ex, pred->getLocationContext()).getAsSymbol()) {
2649    QualType ResultTy = Ex->getType();
2650    state = setRefBinding(state, sym,
2651                          RefVal::makeNotOwned(RetEffect::ObjC, ResultTy));
2652  }
2653
2654  C.addTransition(state);
2655}
2656
2657void RetainCountChecker::checkPostStmt(const ObjCArrayLiteral *AL,
2658                                       CheckerContext &C) const {
2659  // Apply the 'MayEscape' to all values.
2660  processObjCLiterals(C, AL);
2661}
2662
2663void RetainCountChecker::checkPostStmt(const ObjCDictionaryLiteral *DL,
2664                                       CheckerContext &C) const {
2665  // Apply the 'MayEscape' to all keys and values.
2666  processObjCLiterals(C, DL);
2667}
2668
2669void RetainCountChecker::checkPostStmt(const ObjCBoxedExpr *Ex,
2670                                       CheckerContext &C) const {
2671  const ExplodedNode *Pred = C.getPredecessor();
2672  const LocationContext *LCtx = Pred->getLocationContext();
2673  ProgramStateRef State = Pred->getState();
2674
2675  if (SymbolRef Sym = State->getSVal(Ex, LCtx).getAsSymbol()) {
2676    QualType ResultTy = Ex->getType();
2677    State = setRefBinding(State, Sym,
2678                          RefVal::makeNotOwned(RetEffect::ObjC, ResultTy));
2679  }
2680
2681  C.addTransition(State);
2682}
2683
2684void RetainCountChecker::checkPostCall(const CallEvent &Call,
2685                                       CheckerContext &C) const {
2686  RetainSummaryManager &Summaries = getSummaryManager(C);
2687  const RetainSummary *Summ = Summaries.getSummary(Call, C.getState());
2688
2689  if (C.wasInlined) {
2690    processSummaryOfInlined(*Summ, Call, C);
2691    return;
2692  }
2693  checkSummary(*Summ, Call, C);
2694}
2695
2696/// GetReturnType - Used to get the return type of a message expression or
2697///  function call with the intention of affixing that type to a tracked symbol.
2698///  While the return type can be queried directly from RetEx, when
2699///  invoking class methods we augment to the return type to be that of
2700///  a pointer to the class (as opposed it just being id).
2701// FIXME: We may be able to do this with related result types instead.
2702// This function is probably overestimating.
2703static QualType GetReturnType(const Expr *RetE, ASTContext &Ctx) {
2704  QualType RetTy = RetE->getType();
2705  // If RetE is not a message expression just return its type.
2706  // If RetE is a message expression, return its types if it is something
2707  /// more specific than id.
2708  if (const ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(RetE))
2709    if (const ObjCObjectPointerType *PT = RetTy->getAs<ObjCObjectPointerType>())
2710      if (PT->isObjCQualifiedIdType() || PT->isObjCIdType() ||
2711          PT->isObjCClassType()) {
2712        // At this point we know the return type of the message expression is
2713        // id, id<...>, or Class. If we have an ObjCInterfaceDecl, we know this
2714        // is a call to a class method whose type we can resolve.  In such
2715        // cases, promote the return type to XXX* (where XXX is the class).
2716        const ObjCInterfaceDecl *D = ME->getReceiverInterface();
2717        return !D ? RetTy :
2718                    Ctx.getObjCObjectPointerType(Ctx.getObjCInterfaceType(D));
2719      }
2720
2721  return RetTy;
2722}
2723
2724// We don't always get the exact modeling of the function with regards to the
2725// retain count checker even when the function is inlined. For example, we need
2726// to stop tracking the symbols which were marked with StopTrackingHard.
2727void RetainCountChecker::processSummaryOfInlined(const RetainSummary &Summ,
2728                                                 const CallEvent &CallOrMsg,
2729                                                 CheckerContext &C) const {
2730  ProgramStateRef state = C.getState();
2731
2732  // Evaluate the effect of the arguments.
2733  for (unsigned idx = 0, e = CallOrMsg.getNumArgs(); idx != e; ++idx) {
2734    if (Summ.getArg(idx) == StopTrackingHard) {
2735      SVal V = CallOrMsg.getArgSVal(idx);
2736      if (SymbolRef Sym = V.getAsLocSymbol()) {
2737        state = removeRefBinding(state, Sym);
2738      }
2739    }
2740  }
2741
2742  // Evaluate the effect on the message receiver.
2743  const ObjCMethodCall *MsgInvocation = dyn_cast<ObjCMethodCall>(&CallOrMsg);
2744  if (MsgInvocation) {
2745    if (SymbolRef Sym = MsgInvocation->getReceiverSVal().getAsLocSymbol()) {
2746      if (Summ.getReceiverEffect() == StopTrackingHard) {
2747        state = removeRefBinding(state, Sym);
2748      }
2749    }
2750  }
2751
2752  // Consult the summary for the return value.
2753  RetEffect RE = Summ.getRetEffect();
2754  if (RE.getKind() == RetEffect::NoRetHard) {
2755    SymbolRef Sym = CallOrMsg.getReturnValue().getAsSymbol();
2756    if (Sym)
2757      state = removeRefBinding(state, Sym);
2758  }
2759
2760  C.addTransition(state);
2761}
2762
2763void RetainCountChecker::checkSummary(const RetainSummary &Summ,
2764                                      const CallEvent &CallOrMsg,
2765                                      CheckerContext &C) const {
2766  ProgramStateRef state = C.getState();
2767
2768  // Evaluate the effect of the arguments.
2769  RefVal::Kind hasErr = (RefVal::Kind) 0;
2770  SourceRange ErrorRange;
2771  SymbolRef ErrorSym = 0;
2772
2773  for (unsigned idx = 0, e = CallOrMsg.getNumArgs(); idx != e; ++idx) {
2774    SVal V = CallOrMsg.getArgSVal(idx);
2775
2776    if (SymbolRef Sym = V.getAsLocSymbol()) {
2777      if (const RefVal *T = getRefBinding(state, Sym)) {
2778        state = updateSymbol(state, Sym, *T, Summ.getArg(idx), hasErr, C);
2779        if (hasErr) {
2780          ErrorRange = CallOrMsg.getArgSourceRange(idx);
2781          ErrorSym = Sym;
2782          break;
2783        }
2784      }
2785    }
2786  }
2787
2788  // Evaluate the effect on the message receiver.
2789  bool ReceiverIsTracked = false;
2790  if (!hasErr) {
2791    const ObjCMethodCall *MsgInvocation = dyn_cast<ObjCMethodCall>(&CallOrMsg);
2792    if (MsgInvocation) {
2793      if (SymbolRef Sym = MsgInvocation->getReceiverSVal().getAsLocSymbol()) {
2794        if (const RefVal *T = getRefBinding(state, Sym)) {
2795          ReceiverIsTracked = true;
2796          state = updateSymbol(state, Sym, *T, Summ.getReceiverEffect(),
2797                                 hasErr, C);
2798          if (hasErr) {
2799            ErrorRange = MsgInvocation->getOriginExpr()->getReceiverRange();
2800            ErrorSym = Sym;
2801          }
2802        }
2803      }
2804    }
2805  }
2806
2807  // Process any errors.
2808  if (hasErr) {
2809    processNonLeakError(state, ErrorRange, hasErr, ErrorSym, C);
2810    return;
2811  }
2812
2813  // Consult the summary for the return value.
2814  RetEffect RE = Summ.getRetEffect();
2815
2816  if (RE.getKind() == RetEffect::OwnedWhenTrackedReceiver) {
2817    if (ReceiverIsTracked)
2818      RE = getSummaryManager(C).getObjAllocRetEffect();
2819    else
2820      RE = RetEffect::MakeNoRet();
2821  }
2822
2823  switch (RE.getKind()) {
2824    default:
2825      llvm_unreachable("Unhandled RetEffect.");
2826
2827    case RetEffect::NoRet:
2828    case RetEffect::NoRetHard:
2829      // No work necessary.
2830      break;
2831
2832    case RetEffect::OwnedAllocatedSymbol:
2833    case RetEffect::OwnedSymbol: {
2834      SymbolRef Sym = CallOrMsg.getReturnValue().getAsSymbol();
2835      if (!Sym)
2836        break;
2837
2838      // Use the result type from the CallEvent as it automatically adjusts
2839      // for methods/functions that return references.
2840      QualType ResultTy = CallOrMsg.getResultType();
2841      state = setRefBinding(state, Sym, RefVal::makeOwned(RE.getObjKind(),
2842                                                          ResultTy));
2843
2844      // FIXME: Add a flag to the checker where allocations are assumed to
2845      // *not* fail.
2846      break;
2847    }
2848
2849    case RetEffect::GCNotOwnedSymbol:
2850    case RetEffect::ARCNotOwnedSymbol:
2851    case RetEffect::NotOwnedSymbol: {
2852      const Expr *Ex = CallOrMsg.getOriginExpr();
2853      SymbolRef Sym = CallOrMsg.getReturnValue().getAsSymbol();
2854      if (!Sym)
2855        break;
2856      assert(Ex);
2857      // Use GetReturnType in order to give [NSFoo alloc] the type NSFoo *.
2858      QualType ResultTy = GetReturnType(Ex, C.getASTContext());
2859      state = setRefBinding(state, Sym, RefVal::makeNotOwned(RE.getObjKind(),
2860                                                             ResultTy));
2861      break;
2862    }
2863  }
2864
2865  // This check is actually necessary; otherwise the statement builder thinks
2866  // we've hit a previously-found path.
2867  // Normally addTransition takes care of this, but we want the node pointer.
2868  ExplodedNode *NewNode;
2869  if (state == C.getState()) {
2870    NewNode = C.getPredecessor();
2871  } else {
2872    NewNode = C.addTransition(state);
2873  }
2874
2875  // Annotate the node with summary we used.
2876  if (NewNode) {
2877    // FIXME: This is ugly. See checkEndAnalysis for why it's necessary.
2878    if (ShouldResetSummaryLog) {
2879      SummaryLog.clear();
2880      ShouldResetSummaryLog = false;
2881    }
2882    SummaryLog[NewNode] = &Summ;
2883  }
2884}
2885
2886
2887ProgramStateRef
2888RetainCountChecker::updateSymbol(ProgramStateRef state, SymbolRef sym,
2889                                 RefVal V, ArgEffect E, RefVal::Kind &hasErr,
2890                                 CheckerContext &C) const {
2891  // In GC mode [... release] and [... retain] do nothing.
2892  // In ARC mode they shouldn't exist at all, but we just ignore them.
2893  bool IgnoreRetainMsg = C.isObjCGCEnabled();
2894  if (!IgnoreRetainMsg)
2895    IgnoreRetainMsg = (bool)C.getASTContext().getLangOpts().ObjCAutoRefCount;
2896
2897  switch (E) {
2898  default:
2899    break;
2900  case IncRefMsg:
2901    E = IgnoreRetainMsg ? DoNothing : IncRef;
2902    break;
2903  case DecRefMsg:
2904    E = IgnoreRetainMsg ? DoNothing : DecRef;
2905    break;
2906  case DecRefMsgAndStopTrackingHard:
2907    E = IgnoreRetainMsg ? StopTracking : DecRefAndStopTrackingHard;
2908    break;
2909  case MakeCollectable:
2910    E = C.isObjCGCEnabled() ? DecRef : DoNothing;
2911    break;
2912  }
2913
2914  // Handle all use-after-releases.
2915  if (!C.isObjCGCEnabled() && V.getKind() == RefVal::Released) {
2916    V = V ^ RefVal::ErrorUseAfterRelease;
2917    hasErr = V.getKind();
2918    return setRefBinding(state, sym, V);
2919  }
2920
2921  switch (E) {
2922    case DecRefMsg:
2923    case IncRefMsg:
2924    case MakeCollectable:
2925    case DecRefMsgAndStopTrackingHard:
2926      llvm_unreachable("DecRefMsg/IncRefMsg/MakeCollectable already converted");
2927
2928    case Dealloc:
2929      // Any use of -dealloc in GC is *bad*.
2930      if (C.isObjCGCEnabled()) {
2931        V = V ^ RefVal::ErrorDeallocGC;
2932        hasErr = V.getKind();
2933        break;
2934      }
2935
2936      switch (V.getKind()) {
2937        default:
2938          llvm_unreachable("Invalid RefVal state for an explicit dealloc.");
2939        case RefVal::Owned:
2940          // The object immediately transitions to the released state.
2941          V = V ^ RefVal::Released;
2942          V.clearCounts();
2943          return setRefBinding(state, sym, V);
2944        case RefVal::NotOwned:
2945          V = V ^ RefVal::ErrorDeallocNotOwned;
2946          hasErr = V.getKind();
2947          break;
2948      }
2949      break;
2950
2951    case MayEscape:
2952      if (V.getKind() == RefVal::Owned) {
2953        V = V ^ RefVal::NotOwned;
2954        break;
2955      }
2956
2957      // Fall-through.
2958
2959    case DoNothing:
2960      return state;
2961
2962    case Autorelease:
2963      if (C.isObjCGCEnabled())
2964        return state;
2965      // Update the autorelease counts.
2966      V = V.autorelease();
2967      break;
2968
2969    case StopTracking:
2970    case StopTrackingHard:
2971      return removeRefBinding(state, sym);
2972
2973    case IncRef:
2974      switch (V.getKind()) {
2975        default:
2976          llvm_unreachable("Invalid RefVal state for a retain.");
2977        case RefVal::Owned:
2978        case RefVal::NotOwned:
2979          V = V + 1;
2980          break;
2981        case RefVal::Released:
2982          // Non-GC cases are handled above.
2983          assert(C.isObjCGCEnabled());
2984          V = (V ^ RefVal::Owned) + 1;
2985          break;
2986      }
2987      break;
2988
2989    case DecRef:
2990    case DecRefBridgedTransfered:
2991    case DecRefAndStopTrackingHard:
2992      switch (V.getKind()) {
2993        default:
2994          // case 'RefVal::Released' handled above.
2995          llvm_unreachable("Invalid RefVal state for a release.");
2996
2997        case RefVal::Owned:
2998          assert(V.getCount() > 0);
2999          if (V.getCount() == 1)
3000            V = V ^ (E == DecRefBridgedTransfered ?
3001                      RefVal::NotOwned : RefVal::Released);
3002          else if (E == DecRefAndStopTrackingHard)
3003            return removeRefBinding(state, sym);
3004
3005          V = V - 1;
3006          break;
3007
3008        case RefVal::NotOwned:
3009          if (V.getCount() > 0) {
3010            if (E == DecRefAndStopTrackingHard)
3011              return removeRefBinding(state, sym);
3012            V = V - 1;
3013          } else {
3014            V = V ^ RefVal::ErrorReleaseNotOwned;
3015            hasErr = V.getKind();
3016          }
3017          break;
3018
3019        case RefVal::Released:
3020          // Non-GC cases are handled above.
3021          assert(C.isObjCGCEnabled());
3022          V = V ^ RefVal::ErrorUseAfterRelease;
3023          hasErr = V.getKind();
3024          break;
3025      }
3026      break;
3027  }
3028  return setRefBinding(state, sym, V);
3029}
3030
3031void RetainCountChecker::processNonLeakError(ProgramStateRef St,
3032                                             SourceRange ErrorRange,
3033                                             RefVal::Kind ErrorKind,
3034                                             SymbolRef Sym,
3035                                             CheckerContext &C) const {
3036  ExplodedNode *N = C.generateSink(St);
3037  if (!N)
3038    return;
3039
3040  CFRefBug *BT;
3041  switch (ErrorKind) {
3042    default:
3043      llvm_unreachable("Unhandled error.");
3044    case RefVal::ErrorUseAfterRelease:
3045      if (!useAfterRelease)
3046        useAfterRelease.reset(new UseAfterRelease());
3047      BT = &*useAfterRelease;
3048      break;
3049    case RefVal::ErrorReleaseNotOwned:
3050      if (!releaseNotOwned)
3051        releaseNotOwned.reset(new BadRelease());
3052      BT = &*releaseNotOwned;
3053      break;
3054    case RefVal::ErrorDeallocGC:
3055      if (!deallocGC)
3056        deallocGC.reset(new DeallocGC());
3057      BT = &*deallocGC;
3058      break;
3059    case RefVal::ErrorDeallocNotOwned:
3060      if (!deallocNotOwned)
3061        deallocNotOwned.reset(new DeallocNotOwned());
3062      BT = &*deallocNotOwned;
3063      break;
3064  }
3065
3066  assert(BT);
3067  CFRefReport *report = new CFRefReport(*BT, C.getASTContext().getLangOpts(),
3068                                        C.isObjCGCEnabled(), SummaryLog,
3069                                        N, Sym);
3070  report->addRange(ErrorRange);
3071  C.emitReport(report);
3072}
3073
3074//===----------------------------------------------------------------------===//
3075// Handle the return values of retain-count-related functions.
3076//===----------------------------------------------------------------------===//
3077
3078bool RetainCountChecker::evalCall(const CallExpr *CE, CheckerContext &C) const {
3079  // Get the callee. We're only interested in simple C functions.
3080  ProgramStateRef state = C.getState();
3081  const FunctionDecl *FD = C.getCalleeDecl(CE);
3082  if (!FD)
3083    return false;
3084
3085  IdentifierInfo *II = FD->getIdentifier();
3086  if (!II)
3087    return false;
3088
3089  // For now, we're only handling the functions that return aliases of their
3090  // arguments: CFRetain and CFMakeCollectable (and their families).
3091  // Eventually we should add other functions we can model entirely,
3092  // such as CFRelease, which don't invalidate their arguments or globals.
3093  if (CE->getNumArgs() != 1)
3094    return false;
3095
3096  // Get the name of the function.
3097  StringRef FName = II->getName();
3098  FName = FName.substr(FName.find_first_not_of('_'));
3099
3100  // See if it's one of the specific functions we know how to eval.
3101  bool canEval = false;
3102
3103  QualType ResultTy = CE->getCallReturnType();
3104  if (ResultTy->isObjCIdType()) {
3105    // Handle: id NSMakeCollectable(CFTypeRef)
3106    canEval = II->isStr("NSMakeCollectable");
3107  } else if (ResultTy->isPointerType()) {
3108    // Handle: (CF|CG)Retain
3109    //         CFMakeCollectable
3110    // It's okay to be a little sloppy here (CGMakeCollectable doesn't exist).
3111    if (cocoa::isRefType(ResultTy, "CF", FName) ||
3112        cocoa::isRefType(ResultTy, "CG", FName)) {
3113      canEval = isRetain(FD, FName) || isMakeCollectable(FD, FName);
3114    }
3115  }
3116
3117  if (!canEval)
3118    return false;
3119
3120  // Bind the return value.
3121  const LocationContext *LCtx = C.getLocationContext();
3122  SVal RetVal = state->getSVal(CE->getArg(0), LCtx);
3123  if (RetVal.isUnknown()) {
3124    // If the receiver is unknown, conjure a return value.
3125    SValBuilder &SVB = C.getSValBuilder();
3126    RetVal = SVB.conjureSymbolVal(0, CE, LCtx, ResultTy, C.blockCount());
3127  }
3128  state = state->BindExpr(CE, LCtx, RetVal, false);
3129
3130  // FIXME: This should not be necessary, but otherwise the argument seems to be
3131  // considered alive during the next statement.
3132  if (const MemRegion *ArgRegion = RetVal.getAsRegion()) {
3133    // Save the refcount status of the argument.
3134    SymbolRef Sym = RetVal.getAsLocSymbol();
3135    const RefVal *Binding = 0;
3136    if (Sym)
3137      Binding = getRefBinding(state, Sym);
3138
3139    // Invalidate the argument region.
3140    state = state->invalidateRegions(ArgRegion, CE, C.blockCount(), LCtx,
3141                                     /*CausesPointerEscape*/ false);
3142
3143    // Restore the refcount status of the argument.
3144    if (Binding)
3145      state = setRefBinding(state, Sym, *Binding);
3146  }
3147
3148  C.addTransition(state);
3149  return true;
3150}
3151
3152//===----------------------------------------------------------------------===//
3153// Handle return statements.
3154//===----------------------------------------------------------------------===//
3155
3156void RetainCountChecker::checkPreStmt(const ReturnStmt *S,
3157                                      CheckerContext &C) const {
3158
3159  // Only adjust the reference count if this is the top-level call frame,
3160  // and not the result of inlining.  In the future, we should do
3161  // better checking even for inlined calls, and see if they match
3162  // with their expected semantics (e.g., the method should return a retained
3163  // object, etc.).
3164  if (!C.inTopFrame())
3165    return;
3166
3167  const Expr *RetE = S->getRetValue();
3168  if (!RetE)
3169    return;
3170
3171  ProgramStateRef state = C.getState();
3172  SymbolRef Sym =
3173    state->getSValAsScalarOrLoc(RetE, C.getLocationContext()).getAsLocSymbol();
3174  if (!Sym)
3175    return;
3176
3177  // Get the reference count binding (if any).
3178  const RefVal *T = getRefBinding(state, Sym);
3179  if (!T)
3180    return;
3181
3182  // Change the reference count.
3183  RefVal X = *T;
3184
3185  switch (X.getKind()) {
3186    case RefVal::Owned: {
3187      unsigned cnt = X.getCount();
3188      assert(cnt > 0);
3189      X.setCount(cnt - 1);
3190      X = X ^ RefVal::ReturnedOwned;
3191      break;
3192    }
3193
3194    case RefVal::NotOwned: {
3195      unsigned cnt = X.getCount();
3196      if (cnt) {
3197        X.setCount(cnt - 1);
3198        X = X ^ RefVal::ReturnedOwned;
3199      }
3200      else {
3201        X = X ^ RefVal::ReturnedNotOwned;
3202      }
3203      break;
3204    }
3205
3206    default:
3207      return;
3208  }
3209
3210  // Update the binding.
3211  state = setRefBinding(state, Sym, X);
3212  ExplodedNode *Pred = C.addTransition(state);
3213
3214  // At this point we have updated the state properly.
3215  // Everything after this is merely checking to see if the return value has
3216  // been over- or under-retained.
3217
3218  // Did we cache out?
3219  if (!Pred)
3220    return;
3221
3222  // Update the autorelease counts.
3223  static SimpleProgramPointTag
3224         AutoreleaseTag("RetainCountChecker : Autorelease");
3225  state = handleAutoreleaseCounts(state, Pred, &AutoreleaseTag, C, Sym, X);
3226
3227  // Did we cache out?
3228  if (!state)
3229    return;
3230
3231  // Get the updated binding.
3232  T = getRefBinding(state, Sym);
3233  assert(T);
3234  X = *T;
3235
3236  // Consult the summary of the enclosing method.
3237  RetainSummaryManager &Summaries = getSummaryManager(C);
3238  const Decl *CD = &Pred->getCodeDecl();
3239  RetEffect RE = RetEffect::MakeNoRet();
3240
3241  // FIXME: What is the convention for blocks? Is there one?
3242  if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(CD)) {
3243    const RetainSummary *Summ = Summaries.getMethodSummary(MD);
3244    RE = Summ->getRetEffect();
3245  } else if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(CD)) {
3246    if (!isa<CXXMethodDecl>(FD)) {
3247      const RetainSummary *Summ = Summaries.getFunctionSummary(FD);
3248      RE = Summ->getRetEffect();
3249    }
3250  }
3251
3252  checkReturnWithRetEffect(S, C, Pred, RE, X, Sym, state);
3253}
3254
3255void RetainCountChecker::checkReturnWithRetEffect(const ReturnStmt *S,
3256                                                  CheckerContext &C,
3257                                                  ExplodedNode *Pred,
3258                                                  RetEffect RE, RefVal X,
3259                                                  SymbolRef Sym,
3260                                              ProgramStateRef state) const {
3261  // Any leaks or other errors?
3262  if (X.isReturnedOwned() && X.getCount() == 0) {
3263    if (RE.getKind() != RetEffect::NoRet) {
3264      bool hasError = false;
3265      if (C.isObjCGCEnabled() && RE.getObjKind() == RetEffect::ObjC) {
3266        // Things are more complicated with garbage collection.  If the
3267        // returned object is suppose to be an Objective-C object, we have
3268        // a leak (as the caller expects a GC'ed object) because no
3269        // method should return ownership unless it returns a CF object.
3270        hasError = true;
3271        X = X ^ RefVal::ErrorGCLeakReturned;
3272      }
3273      else if (!RE.isOwned()) {
3274        // Either we are using GC and the returned object is a CF type
3275        // or we aren't using GC.  In either case, we expect that the
3276        // enclosing method is expected to return ownership.
3277        hasError = true;
3278        X = X ^ RefVal::ErrorLeakReturned;
3279      }
3280
3281      if (hasError) {
3282        // Generate an error node.
3283        state = setRefBinding(state, Sym, X);
3284
3285        static SimpleProgramPointTag
3286               ReturnOwnLeakTag("RetainCountChecker : ReturnsOwnLeak");
3287        ExplodedNode *N = C.addTransition(state, Pred, &ReturnOwnLeakTag);
3288        if (N) {
3289          const LangOptions &LOpts = C.getASTContext().getLangOpts();
3290          bool GCEnabled = C.isObjCGCEnabled();
3291          CFRefReport *report =
3292            new CFRefLeakReport(*getLeakAtReturnBug(LOpts, GCEnabled),
3293                                LOpts, GCEnabled, SummaryLog,
3294                                N, Sym, C, IncludeAllocationLine);
3295
3296          C.emitReport(report);
3297        }
3298      }
3299    }
3300  } else if (X.isReturnedNotOwned()) {
3301    if (RE.isOwned()) {
3302      // Trying to return a not owned object to a caller expecting an
3303      // owned object.
3304      state = setRefBinding(state, Sym, X ^ RefVal::ErrorReturnedNotOwned);
3305
3306      static SimpleProgramPointTag
3307             ReturnNotOwnedTag("RetainCountChecker : ReturnNotOwnedForOwned");
3308      ExplodedNode *N = C.addTransition(state, Pred, &ReturnNotOwnedTag);
3309      if (N) {
3310        if (!returnNotOwnedForOwned)
3311          returnNotOwnedForOwned.reset(new ReturnedNotOwnedForOwned());
3312
3313        CFRefReport *report =
3314            new CFRefReport(*returnNotOwnedForOwned,
3315                            C.getASTContext().getLangOpts(),
3316                            C.isObjCGCEnabled(), SummaryLog, N, Sym);
3317        C.emitReport(report);
3318      }
3319    }
3320  }
3321}
3322
3323//===----------------------------------------------------------------------===//
3324// Check various ways a symbol can be invalidated.
3325//===----------------------------------------------------------------------===//
3326
3327void RetainCountChecker::checkBind(SVal loc, SVal val, const Stmt *S,
3328                                   CheckerContext &C) const {
3329  // Are we storing to something that causes the value to "escape"?
3330  bool escapes = true;
3331
3332  // A value escapes in three possible cases (this may change):
3333  //
3334  // (1) we are binding to something that is not a memory region.
3335  // (2) we are binding to a memregion that does not have stack storage
3336  // (3) we are binding to a memregion with stack storage that the store
3337  //     does not understand.
3338  ProgramStateRef state = C.getState();
3339
3340  if (Optional<loc::MemRegionVal> regionLoc = loc.getAs<loc::MemRegionVal>()) {
3341    escapes = !regionLoc->getRegion()->hasStackStorage();
3342
3343    if (!escapes) {
3344      // To test (3), generate a new state with the binding added.  If it is
3345      // the same state, then it escapes (since the store cannot represent
3346      // the binding).
3347      // Do this only if we know that the store is not supposed to generate the
3348      // same state.
3349      SVal StoredVal = state->getSVal(regionLoc->getRegion());
3350      if (StoredVal != val)
3351        escapes = (state == (state->bindLoc(*regionLoc, val)));
3352    }
3353    if (!escapes) {
3354      // Case 4: We do not currently model what happens when a symbol is
3355      // assigned to a struct field, so be conservative here and let the symbol
3356      // go. TODO: This could definitely be improved upon.
3357      escapes = !isa<VarRegion>(regionLoc->getRegion());
3358    }
3359  }
3360
3361  // If our store can represent the binding and we aren't storing to something
3362  // that doesn't have local storage then just return and have the simulation
3363  // state continue as is.
3364  if (!escapes)
3365      return;
3366
3367  // Otherwise, find all symbols referenced by 'val' that we are tracking
3368  // and stop tracking them.
3369  state = state->scanReachableSymbols<StopTrackingCallback>(val).getState();
3370  C.addTransition(state);
3371}
3372
3373ProgramStateRef RetainCountChecker::evalAssume(ProgramStateRef state,
3374                                                   SVal Cond,
3375                                                   bool Assumption) const {
3376
3377  // FIXME: We may add to the interface of evalAssume the list of symbols
3378  //  whose assumptions have changed.  For now we just iterate through the
3379  //  bindings and check if any of the tracked symbols are NULL.  This isn't
3380  //  too bad since the number of symbols we will track in practice are
3381  //  probably small and evalAssume is only called at branches and a few
3382  //  other places.
3383  RefBindingsTy B = state->get<RefBindings>();
3384
3385  if (B.isEmpty())
3386    return state;
3387
3388  bool changed = false;
3389  RefBindingsTy::Factory &RefBFactory = state->get_context<RefBindings>();
3390
3391  for (RefBindingsTy::iterator I = B.begin(), E = B.end(); I != E; ++I) {
3392    // Check if the symbol is null stop tracking the symbol.
3393    ConstraintManager &CMgr = state->getConstraintManager();
3394    ConditionTruthVal AllocFailed = CMgr.isNull(state, I.getKey());
3395    if (AllocFailed.isConstrainedTrue()) {
3396      changed = true;
3397      B = RefBFactory.remove(B, I.getKey());
3398    }
3399  }
3400
3401  if (changed)
3402    state = state->set<RefBindings>(B);
3403
3404  return state;
3405}
3406
3407ProgramStateRef
3408RetainCountChecker::checkRegionChanges(ProgramStateRef state,
3409                                    const InvalidatedSymbols *invalidated,
3410                                    ArrayRef<const MemRegion *> ExplicitRegions,
3411                                    ArrayRef<const MemRegion *> Regions,
3412                                    const CallEvent *Call) const {
3413  if (!invalidated)
3414    return state;
3415
3416  llvm::SmallPtrSet<SymbolRef, 8> WhitelistedSymbols;
3417  for (ArrayRef<const MemRegion *>::iterator I = ExplicitRegions.begin(),
3418       E = ExplicitRegions.end(); I != E; ++I) {
3419    if (const SymbolicRegion *SR = (*I)->StripCasts()->getAs<SymbolicRegion>())
3420      WhitelistedSymbols.insert(SR->getSymbol());
3421  }
3422
3423  for (InvalidatedSymbols::const_iterator I=invalidated->begin(),
3424       E = invalidated->end(); I!=E; ++I) {
3425    SymbolRef sym = *I;
3426    if (WhitelistedSymbols.count(sym))
3427      continue;
3428    // Remove any existing reference-count binding.
3429    state = removeRefBinding(state, sym);
3430  }
3431  return state;
3432}
3433
3434//===----------------------------------------------------------------------===//
3435// Handle dead symbols and end-of-path.
3436//===----------------------------------------------------------------------===//
3437
3438ProgramStateRef
3439RetainCountChecker::handleAutoreleaseCounts(ProgramStateRef state,
3440                                            ExplodedNode *Pred,
3441                                            const ProgramPointTag *Tag,
3442                                            CheckerContext &Ctx,
3443                                            SymbolRef Sym, RefVal V) const {
3444  unsigned ACnt = V.getAutoreleaseCount();
3445
3446  // No autorelease counts?  Nothing to be done.
3447  if (!ACnt)
3448    return state;
3449
3450  assert(!Ctx.isObjCGCEnabled() && "Autorelease counts in GC mode?");
3451  unsigned Cnt = V.getCount();
3452
3453  // FIXME: Handle sending 'autorelease' to already released object.
3454
3455  if (V.getKind() == RefVal::ReturnedOwned)
3456    ++Cnt;
3457
3458  if (ACnt <= Cnt) {
3459    if (ACnt == Cnt) {
3460      V.clearCounts();
3461      if (V.getKind() == RefVal::ReturnedOwned)
3462        V = V ^ RefVal::ReturnedNotOwned;
3463      else
3464        V = V ^ RefVal::NotOwned;
3465    } else {
3466      V.setCount(V.getCount() - ACnt);
3467      V.setAutoreleaseCount(0);
3468    }
3469    return setRefBinding(state, Sym, V);
3470  }
3471
3472  // Woah!  More autorelease counts then retain counts left.
3473  // Emit hard error.
3474  V = V ^ RefVal::ErrorOverAutorelease;
3475  state = setRefBinding(state, Sym, V);
3476
3477  ExplodedNode *N = Ctx.generateSink(state, Pred, Tag);
3478  if (N) {
3479    SmallString<128> sbuf;
3480    llvm::raw_svector_ostream os(sbuf);
3481    os << "Object was autoreleased ";
3482    if (V.getAutoreleaseCount() > 1)
3483      os << V.getAutoreleaseCount() << " times but the object ";
3484    else
3485      os << "but ";
3486    os << "has a +" << V.getCount() << " retain count";
3487
3488    if (!overAutorelease)
3489      overAutorelease.reset(new OverAutorelease());
3490
3491    const LangOptions &LOpts = Ctx.getASTContext().getLangOpts();
3492    CFRefReport *report =
3493      new CFRefReport(*overAutorelease, LOpts, /* GCEnabled = */ false,
3494                      SummaryLog, N, Sym, os.str());
3495    Ctx.emitReport(report);
3496  }
3497
3498  return 0;
3499}
3500
3501ProgramStateRef
3502RetainCountChecker::handleSymbolDeath(ProgramStateRef state,
3503                                      SymbolRef sid, RefVal V,
3504                                    SmallVectorImpl<SymbolRef> &Leaked) const {
3505  bool hasLeak = false;
3506  if (V.isOwned())
3507    hasLeak = true;
3508  else if (V.isNotOwned() || V.isReturnedOwned())
3509    hasLeak = (V.getCount() > 0);
3510
3511  if (!hasLeak)
3512    return removeRefBinding(state, sid);
3513
3514  Leaked.push_back(sid);
3515  return setRefBinding(state, sid, V ^ RefVal::ErrorLeak);
3516}
3517
3518ExplodedNode *
3519RetainCountChecker::processLeaks(ProgramStateRef state,
3520                                 SmallVectorImpl<SymbolRef> &Leaked,
3521                                 CheckerContext &Ctx,
3522                                 ExplodedNode *Pred) const {
3523  // Generate an intermediate node representing the leak point.
3524  ExplodedNode *N = Ctx.addTransition(state, Pred);
3525
3526  if (N) {
3527    for (SmallVectorImpl<SymbolRef>::iterator
3528         I = Leaked.begin(), E = Leaked.end(); I != E; ++I) {
3529
3530      const LangOptions &LOpts = Ctx.getASTContext().getLangOpts();
3531      bool GCEnabled = Ctx.isObjCGCEnabled();
3532      CFRefBug *BT = Pred ? getLeakWithinFunctionBug(LOpts, GCEnabled)
3533                          : getLeakAtReturnBug(LOpts, GCEnabled);
3534      assert(BT && "BugType not initialized.");
3535
3536      CFRefLeakReport *report = new CFRefLeakReport(*BT, LOpts, GCEnabled,
3537                                                    SummaryLog, N, *I, Ctx,
3538                                                    IncludeAllocationLine);
3539      Ctx.emitReport(report);
3540    }
3541  }
3542
3543  return N;
3544}
3545
3546void RetainCountChecker::checkEndFunction(CheckerContext &Ctx) const {
3547  ProgramStateRef state = Ctx.getState();
3548  RefBindingsTy B = state->get<RefBindings>();
3549  ExplodedNode *Pred = Ctx.getPredecessor();
3550
3551  // Don't process anything within synthesized bodies.
3552  const LocationContext *LCtx = Pred->getLocationContext();
3553  if (LCtx->getAnalysisDeclContext()->isBodyAutosynthesized()) {
3554    assert(LCtx->getParent());
3555    return;
3556  }
3557
3558  for (RefBindingsTy::iterator I = B.begin(), E = B.end(); I != E; ++I) {
3559    state = handleAutoreleaseCounts(state, Pred, /*Tag=*/0, Ctx,
3560                                    I->first, I->second);
3561    if (!state)
3562      return;
3563  }
3564
3565  // If the current LocationContext has a parent, don't check for leaks.
3566  // We will do that later.
3567  // FIXME: we should instead check for imbalances of the retain/releases,
3568  // and suggest annotations.
3569  if (LCtx->getParent())
3570    return;
3571
3572  B = state->get<RefBindings>();
3573  SmallVector<SymbolRef, 10> Leaked;
3574
3575  for (RefBindingsTy::iterator I = B.begin(), E = B.end(); I != E; ++I)
3576    state = handleSymbolDeath(state, I->first, I->second, Leaked);
3577
3578  processLeaks(state, Leaked, Ctx, Pred);
3579}
3580
3581const ProgramPointTag *
3582RetainCountChecker::getDeadSymbolTag(SymbolRef sym) const {
3583  const SimpleProgramPointTag *&tag = DeadSymbolTags[sym];
3584  if (!tag) {
3585    SmallString<64> buf;
3586    llvm::raw_svector_ostream out(buf);
3587    out << "RetainCountChecker : Dead Symbol : ";
3588    sym->dumpToStream(out);
3589    tag = new SimpleProgramPointTag(out.str());
3590  }
3591  return tag;
3592}
3593
3594void RetainCountChecker::checkDeadSymbols(SymbolReaper &SymReaper,
3595                                          CheckerContext &C) const {
3596  ExplodedNode *Pred = C.getPredecessor();
3597
3598  ProgramStateRef state = C.getState();
3599  RefBindingsTy B = state->get<RefBindings>();
3600  SmallVector<SymbolRef, 10> Leaked;
3601
3602  // Update counts from autorelease pools
3603  for (SymbolReaper::dead_iterator I = SymReaper.dead_begin(),
3604       E = SymReaper.dead_end(); I != E; ++I) {
3605    SymbolRef Sym = *I;
3606    if (const RefVal *T = B.lookup(Sym)){
3607      // Use the symbol as the tag.
3608      // FIXME: This might not be as unique as we would like.
3609      const ProgramPointTag *Tag = getDeadSymbolTag(Sym);
3610      state = handleAutoreleaseCounts(state, Pred, Tag, C, Sym, *T);
3611      if (!state)
3612        return;
3613
3614      // Fetch the new reference count from the state, and use it to handle
3615      // this symbol.
3616      state = handleSymbolDeath(state, *I, *getRefBinding(state, Sym), Leaked);
3617    }
3618  }
3619
3620  if (Leaked.empty()) {
3621    C.addTransition(state);
3622    return;
3623  }
3624
3625  Pred = processLeaks(state, Leaked, C, Pred);
3626
3627  // Did we cache out?
3628  if (!Pred)
3629    return;
3630
3631  // Now generate a new node that nukes the old bindings.
3632  // The only bindings left at this point are the leaked symbols.
3633  RefBindingsTy::Factory &F = state->get_context<RefBindings>();
3634  B = state->get<RefBindings>();
3635
3636  for (SmallVectorImpl<SymbolRef>::iterator I = Leaked.begin(),
3637                                            E = Leaked.end();
3638       I != E; ++I)
3639    B = F.remove(B, *I);
3640
3641  state = state->set<RefBindings>(B);
3642  C.addTransition(state, Pred);
3643}
3644
3645void RetainCountChecker::printState(raw_ostream &Out, ProgramStateRef State,
3646                                    const char *NL, const char *Sep) const {
3647
3648  RefBindingsTy B = State->get<RefBindings>();
3649
3650  if (B.isEmpty())
3651    return;
3652
3653  Out << Sep << NL;
3654
3655  for (RefBindingsTy::iterator I = B.begin(), E = B.end(); I != E; ++I) {
3656    Out << I->first << " : ";
3657    I->second.print(Out);
3658    Out << NL;
3659  }
3660}
3661
3662//===----------------------------------------------------------------------===//
3663// Checker registration.
3664//===----------------------------------------------------------------------===//
3665
3666void ento::registerRetainCountChecker(CheckerManager &Mgr) {
3667  Mgr.registerChecker<RetainCountChecker>(Mgr.getAnalyzerOptions());
3668}
3669
3670//===----------------------------------------------------------------------===//
3671// Implementation of the CallEffects API.
3672//===----------------------------------------------------------------------===//
3673
3674namespace clang { namespace ento { namespace objc_retain {
3675
3676// This is a bit gross, but it allows us to populate CallEffects without
3677// creating a bunch of accessors.  This kind is very localized, so the
3678// damage of this macro is limited.
3679#define createCallEffect(D, KIND)\
3680  ASTContext &Ctx = D->getASTContext();\
3681  LangOptions L = Ctx.getLangOpts();\
3682  RetainSummaryManager M(Ctx, L.GCOnly, L.ObjCAutoRefCount);\
3683  const RetainSummary *S = M.get ## KIND ## Summary(D);\
3684  CallEffects CE(S->getRetEffect());\
3685  CE.Receiver = S->getReceiverEffect();\
3686  unsigned N = D->param_size();\
3687  for (unsigned i = 0; i < N; ++i) {\
3688    CE.Args.push_back(S->getArg(i));\
3689  }
3690
3691CallEffects CallEffects::getEffect(const ObjCMethodDecl *MD) {
3692  createCallEffect(MD, Method);
3693  return CE;
3694}
3695
3696CallEffects CallEffects::getEffect(const FunctionDecl *FD) {
3697  createCallEffect(FD, Function);
3698  return CE;
3699}
3700
3701#undef createCallEffect
3702
3703}}}
3704