1292 lines
48 KiB
C++
1292 lines
48 KiB
C++
//== RetainSummaryManager.cpp - Summaries for reference counting --*- C++ -*--//
|
|
//
|
|
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
|
|
// See https://llvm.org/LICENSE.txt for license information.
|
|
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
//
|
|
// This file defines summaries implementation for retain counting, which
|
|
// implements a reference count checker for Core Foundation, Cocoa
|
|
// and OSObject (on Mac OS X).
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
#include "clang/Analysis/DomainSpecific/CocoaConventions.h"
|
|
#include "clang/Analysis/RetainSummaryManager.h"
|
|
#include "clang/AST/Attr.h"
|
|
#include "clang/AST/DeclCXX.h"
|
|
#include "clang/AST/DeclObjC.h"
|
|
#include "clang/AST/ParentMap.h"
|
|
#include "clang/ASTMatchers/ASTMatchFinder.h"
|
|
|
|
using namespace clang;
|
|
using namespace ento;
|
|
|
|
template <class T>
|
|
constexpr static bool isOneOf() {
|
|
return false;
|
|
}
|
|
|
|
/// Helper function to check whether the class is one of the
|
|
/// rest of varargs.
|
|
template <class T, class P, class... ToCompare>
|
|
constexpr static bool isOneOf() {
|
|
return std::is_same<T, P>::value || isOneOf<T, ToCompare...>();
|
|
}
|
|
|
|
namespace {
|
|
|
|
/// Fake attribute class for RC* attributes.
|
|
struct GeneralizedReturnsRetainedAttr {
|
|
static bool classof(const Attr *A) {
|
|
if (auto AA = dyn_cast<AnnotateAttr>(A))
|
|
return AA->getAnnotation() == "rc_ownership_returns_retained";
|
|
return false;
|
|
}
|
|
};
|
|
|
|
struct GeneralizedReturnsNotRetainedAttr {
|
|
static bool classof(const Attr *A) {
|
|
if (auto AA = dyn_cast<AnnotateAttr>(A))
|
|
return AA->getAnnotation() == "rc_ownership_returns_not_retained";
|
|
return false;
|
|
}
|
|
};
|
|
|
|
struct GeneralizedConsumedAttr {
|
|
static bool classof(const Attr *A) {
|
|
if (auto AA = dyn_cast<AnnotateAttr>(A))
|
|
return AA->getAnnotation() == "rc_ownership_consumed";
|
|
return false;
|
|
}
|
|
};
|
|
|
|
}
|
|
|
|
template <class T>
|
|
Optional<ObjKind> RetainSummaryManager::hasAnyEnabledAttrOf(const Decl *D,
|
|
QualType QT) {
|
|
ObjKind K;
|
|
if (isOneOf<T, CFConsumedAttr, CFReturnsRetainedAttr,
|
|
CFReturnsNotRetainedAttr>()) {
|
|
if (!TrackObjCAndCFObjects)
|
|
return None;
|
|
|
|
K = ObjKind::CF;
|
|
} else if (isOneOf<T, NSConsumedAttr, NSConsumesSelfAttr,
|
|
NSReturnsAutoreleasedAttr, NSReturnsRetainedAttr,
|
|
NSReturnsNotRetainedAttr, NSConsumesSelfAttr>()) {
|
|
|
|
if (!TrackObjCAndCFObjects)
|
|
return None;
|
|
|
|
if (isOneOf<T, NSReturnsRetainedAttr, NSReturnsAutoreleasedAttr,
|
|
NSReturnsNotRetainedAttr>() &&
|
|
!cocoa::isCocoaObjectRef(QT))
|
|
return None;
|
|
K = ObjKind::ObjC;
|
|
} else if (isOneOf<T, OSConsumedAttr, OSConsumesThisAttr,
|
|
OSReturnsNotRetainedAttr, OSReturnsRetainedAttr,
|
|
OSReturnsRetainedOnZeroAttr,
|
|
OSReturnsRetainedOnNonZeroAttr>()) {
|
|
if (!TrackOSObjects)
|
|
return None;
|
|
K = ObjKind::OS;
|
|
} else if (isOneOf<T, GeneralizedReturnsNotRetainedAttr,
|
|
GeneralizedReturnsRetainedAttr,
|
|
GeneralizedConsumedAttr>()) {
|
|
K = ObjKind::Generalized;
|
|
} else {
|
|
llvm_unreachable("Unexpected attribute");
|
|
}
|
|
if (D->hasAttr<T>())
|
|
return K;
|
|
return None;
|
|
}
|
|
|
|
template <class T1, class T2, class... Others>
|
|
Optional<ObjKind> RetainSummaryManager::hasAnyEnabledAttrOf(const Decl *D,
|
|
QualType QT) {
|
|
if (auto Out = hasAnyEnabledAttrOf<T1>(D, QT))
|
|
return Out;
|
|
return hasAnyEnabledAttrOf<T2, Others...>(D, QT);
|
|
}
|
|
|
|
const RetainSummary *
|
|
RetainSummaryManager::getPersistentSummary(const RetainSummary &OldSumm) {
|
|
// Unique "simple" summaries -- those without ArgEffects.
|
|
if (OldSumm.isSimple()) {
|
|
::llvm::FoldingSetNodeID ID;
|
|
OldSumm.Profile(ID);
|
|
|
|
void *Pos;
|
|
CachedSummaryNode *N = SimpleSummaries.FindNodeOrInsertPos(ID, Pos);
|
|
|
|
if (!N) {
|
|
N = (CachedSummaryNode *) BPAlloc.Allocate<CachedSummaryNode>();
|
|
new (N) CachedSummaryNode(OldSumm);
|
|
SimpleSummaries.InsertNode(N, Pos);
|
|
}
|
|
|
|
return &N->getValue();
|
|
}
|
|
|
|
RetainSummary *Summ = (RetainSummary *) BPAlloc.Allocate<RetainSummary>();
|
|
new (Summ) RetainSummary(OldSumm);
|
|
return Summ;
|
|
}
|
|
|
|
static bool isSubclass(const Decl *D,
|
|
StringRef ClassName) {
|
|
using namespace ast_matchers;
|
|
DeclarationMatcher SubclassM =
|
|
cxxRecordDecl(isSameOrDerivedFrom(std::string(ClassName)));
|
|
return !(match(SubclassM, *D, D->getASTContext()).empty());
|
|
}
|
|
|
|
static bool isOSObjectSubclass(const Decl *D) {
|
|
// OSSymbols are particular OSObjects that are allocated globally
|
|
// and therefore aren't really refcounted, so we ignore them.
|
|
return D && isSubclass(D, "OSMetaClassBase") && !isSubclass(D, "OSSymbol");
|
|
}
|
|
|
|
static bool isOSObjectDynamicCast(StringRef S) {
|
|
return S == "safeMetaCast";
|
|
}
|
|
|
|
static bool isOSObjectRequiredCast(StringRef S) {
|
|
return S == "requiredMetaCast";
|
|
}
|
|
|
|
static bool isOSObjectThisCast(StringRef S) {
|
|
return S == "metaCast";
|
|
}
|
|
|
|
|
|
static bool isOSObjectPtr(QualType QT) {
|
|
return isOSObjectSubclass(QT->getPointeeCXXRecordDecl());
|
|
}
|
|
|
|
static bool isISLObjectRef(QualType Ty) {
|
|
return StringRef(Ty.getAsString()).startswith("isl_");
|
|
}
|
|
|
|
static bool isOSIteratorSubclass(const Decl *D) {
|
|
return isSubclass(D, "OSIterator");
|
|
}
|
|
|
|
static bool hasRCAnnotation(const Decl *D, StringRef rcAnnotation) {
|
|
for (const auto *Ann : D->specific_attrs<AnnotateAttr>()) {
|
|
if (Ann->getAnnotation() == rcAnnotation)
|
|
return true;
|
|
}
|
|
return false;
|
|
}
|
|
|
|
static bool isRetain(const FunctionDecl *FD, StringRef FName) {
|
|
return FName.startswith_lower("retain") || FName.endswith_lower("retain");
|
|
}
|
|
|
|
static bool isRelease(const FunctionDecl *FD, StringRef FName) {
|
|
return FName.startswith_lower("release") || FName.endswith_lower("release");
|
|
}
|
|
|
|
static bool isAutorelease(const FunctionDecl *FD, StringRef FName) {
|
|
return FName.startswith_lower("autorelease") ||
|
|
FName.endswith_lower("autorelease");
|
|
}
|
|
|
|
static bool isMakeCollectable(StringRef FName) {
|
|
return FName.contains_lower("MakeCollectable");
|
|
}
|
|
|
|
/// A function is OSObject related if it is declared on a subclass
|
|
/// of OSObject, or any of the parameters is a subclass of an OSObject.
|
|
static bool isOSObjectRelated(const CXXMethodDecl *MD) {
|
|
if (isOSObjectSubclass(MD->getParent()))
|
|
return true;
|
|
|
|
for (ParmVarDecl *Param : MD->parameters()) {
|
|
QualType PT = Param->getType()->getPointeeType();
|
|
if (!PT.isNull())
|
|
if (CXXRecordDecl *RD = PT->getAsCXXRecordDecl())
|
|
if (isOSObjectSubclass(RD))
|
|
return true;
|
|
}
|
|
|
|
return false;
|
|
}
|
|
|
|
bool
|
|
RetainSummaryManager::isKnownSmartPointer(QualType QT) {
|
|
QT = QT.getCanonicalType();
|
|
const auto *RD = QT->getAsCXXRecordDecl();
|
|
if (!RD)
|
|
return false;
|
|
const IdentifierInfo *II = RD->getIdentifier();
|
|
if (II && II->getName() == "smart_ptr")
|
|
if (const auto *ND = dyn_cast<NamespaceDecl>(RD->getDeclContext()))
|
|
if (ND->getNameAsString() == "os")
|
|
return true;
|
|
return false;
|
|
}
|
|
|
|
const RetainSummary *
|
|
RetainSummaryManager::getSummaryForOSObject(const FunctionDecl *FD,
|
|
StringRef FName, QualType RetTy) {
|
|
assert(TrackOSObjects &&
|
|
"Requesting a summary for an OSObject but OSObjects are not tracked");
|
|
|
|
if (RetTy->isPointerType()) {
|
|
const CXXRecordDecl *PD = RetTy->getPointeeType()->getAsCXXRecordDecl();
|
|
if (PD && isOSObjectSubclass(PD)) {
|
|
if (isOSObjectDynamicCast(FName) || isOSObjectRequiredCast(FName) ||
|
|
isOSObjectThisCast(FName))
|
|
return getDefaultSummary();
|
|
|
|
// TODO: Add support for the slightly common *Matching(table) idiom.
|
|
// Cf. IOService::nameMatching() etc. - these function have an unusual
|
|
// contract of returning at +0 or +1 depending on their last argument.
|
|
if (FName.endswith("Matching")) {
|
|
return getPersistentStopSummary();
|
|
}
|
|
|
|
// All objects returned with functions *not* starting with 'get',
|
|
// or iterators, are returned at +1.
|
|
if ((!FName.startswith("get") && !FName.startswith("Get")) ||
|
|
isOSIteratorSubclass(PD)) {
|
|
return getOSSummaryCreateRule(FD);
|
|
} else {
|
|
return getOSSummaryGetRule(FD);
|
|
}
|
|
}
|
|
}
|
|
|
|
if (const auto *MD = dyn_cast<CXXMethodDecl>(FD)) {
|
|
const CXXRecordDecl *Parent = MD->getParent();
|
|
if (Parent && isOSObjectSubclass(Parent)) {
|
|
if (FName == "release" || FName == "taggedRelease")
|
|
return getOSSummaryReleaseRule(FD);
|
|
|
|
if (FName == "retain" || FName == "taggedRetain")
|
|
return getOSSummaryRetainRule(FD);
|
|
|
|
if (FName == "free")
|
|
return getOSSummaryFreeRule(FD);
|
|
|
|
if (MD->getOverloadedOperator() == OO_New)
|
|
return getOSSummaryCreateRule(MD);
|
|
}
|
|
}
|
|
|
|
return nullptr;
|
|
}
|
|
|
|
const RetainSummary *RetainSummaryManager::getSummaryForObjCOrCFObject(
|
|
const FunctionDecl *FD,
|
|
StringRef FName,
|
|
QualType RetTy,
|
|
const FunctionType *FT,
|
|
bool &AllowAnnotations) {
|
|
|
|
ArgEffects ScratchArgs(AF.getEmptyMap());
|
|
|
|
std::string RetTyName = RetTy.getAsString();
|
|
if (FName == "pthread_create" || FName == "pthread_setspecific") {
|
|
// Part of: <rdar://problem/7299394> and <rdar://problem/11282706>.
|
|
// This will be addressed better with IPA.
|
|
return getPersistentStopSummary();
|
|
} else if(FName == "NSMakeCollectable") {
|
|
// Handle: id NSMakeCollectable(CFTypeRef)
|
|
AllowAnnotations = false;
|
|
return RetTy->isObjCIdType() ? getUnarySummary(FT, DoNothing)
|
|
: getPersistentStopSummary();
|
|
} else if (FName == "CMBufferQueueDequeueAndRetain" ||
|
|
FName == "CMBufferQueueDequeueIfDataReadyAndRetain") {
|
|
// Part of: <rdar://problem/39390714>.
|
|
return getPersistentSummary(RetEffect::MakeOwned(ObjKind::CF),
|
|
ScratchArgs,
|
|
ArgEffect(DoNothing),
|
|
ArgEffect(DoNothing));
|
|
} else if (FName == "CFPlugInInstanceCreate") {
|
|
return getPersistentSummary(RetEffect::MakeNoRet(), ScratchArgs);
|
|
} else if (FName == "IORegistryEntrySearchCFProperty" ||
|
|
(RetTyName == "CFMutableDictionaryRef" &&
|
|
(FName == "IOBSDNameMatching" || FName == "IOServiceMatching" ||
|
|
FName == "IOServiceNameMatching" ||
|
|
FName == "IORegistryEntryIDMatching" ||
|
|
FName == "IOOpenFirmwarePathMatching"))) {
|
|
// Part of <rdar://problem/6961230>. (IOKit)
|
|
// This should be addressed using a API table.
|
|
return getPersistentSummary(RetEffect::MakeOwned(ObjKind::CF), ScratchArgs,
|
|
ArgEffect(DoNothing), ArgEffect(DoNothing));
|
|
} else if (FName == "IOServiceGetMatchingService" ||
|
|
FName == "IOServiceGetMatchingServices") {
|
|
// FIXES: <rdar://problem/6326900>
|
|
// This should be addressed using a API table. This strcmp is also
|
|
// a little gross, but there is no need to super optimize here.
|
|
ScratchArgs = AF.add(ScratchArgs, 1, ArgEffect(DecRef, ObjKind::CF));
|
|
return getPersistentSummary(RetEffect::MakeNoRet(),
|
|
ScratchArgs,
|
|
ArgEffect(DoNothing), ArgEffect(DoNothing));
|
|
} else if (FName == "IOServiceAddNotification" ||
|
|
FName == "IOServiceAddMatchingNotification") {
|
|
// Part of <rdar://problem/6961230>. (IOKit)
|
|
// This should be addressed using a API table.
|
|
ScratchArgs = AF.add(ScratchArgs, 2, ArgEffect(DecRef, ObjKind::CF));
|
|
return getPersistentSummary(RetEffect::MakeNoRet(),
|
|
ScratchArgs,
|
|
ArgEffect(DoNothing), ArgEffect(DoNothing));
|
|
} else if (FName == "CVPixelBufferCreateWithBytes") {
|
|
// FIXES: <rdar://problem/7283567>
|
|
// Eventually this can be improved by recognizing that the pixel
|
|
// buffer passed to CVPixelBufferCreateWithBytes is released via
|
|
// a callback and doing full IPA to make sure this is done correctly.
|
|
// FIXME: This function has an out parameter that returns an
|
|
// allocated object.
|
|
ScratchArgs = AF.add(ScratchArgs, 7, ArgEffect(StopTracking));
|
|
return getPersistentSummary(RetEffect::MakeNoRet(),
|
|
ScratchArgs,
|
|
ArgEffect(DoNothing), ArgEffect(DoNothing));
|
|
} else if (FName == "CGBitmapContextCreateWithData") {
|
|
// FIXES: <rdar://problem/7358899>
|
|
// Eventually this can be improved by recognizing that 'releaseInfo'
|
|
// passed to CGBitmapContextCreateWithData is released via
|
|
// a callback and doing full IPA to make sure this is done correctly.
|
|
ScratchArgs = AF.add(ScratchArgs, 8, ArgEffect(ArgEffect(StopTracking)));
|
|
return getPersistentSummary(RetEffect::MakeOwned(ObjKind::CF), ScratchArgs,
|
|
ArgEffect(DoNothing), ArgEffect(DoNothing));
|
|
} else if (FName == "CVPixelBufferCreateWithPlanarBytes") {
|
|
// FIXES: <rdar://problem/7283567>
|
|
// Eventually this can be improved by recognizing that the pixel
|
|
// buffer passed to CVPixelBufferCreateWithPlanarBytes is released
|
|
// via a callback and doing full IPA to make sure this is done
|
|
// correctly.
|
|
ScratchArgs = AF.add(ScratchArgs, 12, ArgEffect(StopTracking));
|
|
return getPersistentSummary(RetEffect::MakeNoRet(),
|
|
ScratchArgs,
|
|
ArgEffect(DoNothing), ArgEffect(DoNothing));
|
|
} else if (FName == "VTCompressionSessionEncodeFrame") {
|
|
// The context argument passed to VTCompressionSessionEncodeFrame()
|
|
// is passed to the callback specified when creating the session
|
|
// (e.g. with VTCompressionSessionCreate()) which can release it.
|
|
// To account for this possibility, conservatively stop tracking
|
|
// the context.
|
|
ScratchArgs = AF.add(ScratchArgs, 5, ArgEffect(StopTracking));
|
|
return getPersistentSummary(RetEffect::MakeNoRet(),
|
|
ScratchArgs,
|
|
ArgEffect(DoNothing), ArgEffect(DoNothing));
|
|
} else if (FName == "dispatch_set_context" ||
|
|
FName == "xpc_connection_set_context") {
|
|
// <rdar://problem/11059275> - The analyzer currently doesn't have
|
|
// a good way to reason about the finalizer function for libdispatch.
|
|
// If we pass a context object that is memory managed, stop tracking it.
|
|
// <rdar://problem/13783514> - Same problem, but for XPC.
|
|
// FIXME: this hack should possibly go away once we can handle
|
|
// libdispatch and XPC finalizers.
|
|
ScratchArgs = AF.add(ScratchArgs, 1, ArgEffect(StopTracking));
|
|
return getPersistentSummary(RetEffect::MakeNoRet(),
|
|
ScratchArgs,
|
|
ArgEffect(DoNothing), ArgEffect(DoNothing));
|
|
} else if (FName.startswith("NSLog")) {
|
|
return getDoNothingSummary();
|
|
} else if (FName.startswith("NS") &&
|
|
(FName.find("Insert") != StringRef::npos)) {
|
|
// Whitelist NSXXInsertXX, for example NSMapInsertIfAbsent, since they can
|
|
// be deallocated by NSMapRemove. (radar://11152419)
|
|
ScratchArgs = AF.add(ScratchArgs, 1, ArgEffect(StopTracking));
|
|
ScratchArgs = AF.add(ScratchArgs, 2, ArgEffect(StopTracking));
|
|
return getPersistentSummary(RetEffect::MakeNoRet(),
|
|
ScratchArgs, ArgEffect(DoNothing),
|
|
ArgEffect(DoNothing));
|
|
}
|
|
|
|
if (RetTy->isPointerType()) {
|
|
|
|
// For CoreFoundation ('CF') types.
|
|
if (cocoa::isRefType(RetTy, "CF", FName)) {
|
|
if (isRetain(FD, FName)) {
|
|
// CFRetain isn't supposed to be annotated. However, this may as
|
|
// well be a user-made "safe" CFRetain function that is incorrectly
|
|
// annotated as cf_returns_retained due to lack of better options.
|
|
// We want to ignore such annotation.
|
|
AllowAnnotations = false;
|
|
|
|
return getUnarySummary(FT, IncRef);
|
|
} else if (isAutorelease(FD, FName)) {
|
|
// The headers use cf_consumed, but we can fully model CFAutorelease
|
|
// ourselves.
|
|
AllowAnnotations = false;
|
|
|
|
return getUnarySummary(FT, Autorelease);
|
|
} else if (isMakeCollectable(FName)) {
|
|
AllowAnnotations = false;
|
|
return getUnarySummary(FT, DoNothing);
|
|
} else {
|
|
return getCFCreateGetRuleSummary(FD);
|
|
}
|
|
}
|
|
|
|
// For CoreGraphics ('CG') and CoreVideo ('CV') types.
|
|
if (cocoa::isRefType(RetTy, "CG", FName) ||
|
|
cocoa::isRefType(RetTy, "CV", FName)) {
|
|
if (isRetain(FD, FName))
|
|
return getUnarySummary(FT, IncRef);
|
|
else
|
|
return getCFCreateGetRuleSummary(FD);
|
|
}
|
|
|
|
// For all other CF-style types, use the Create/Get
|
|
// rule for summaries but don't support Retain functions
|
|
// with framework-specific prefixes.
|
|
if (coreFoundation::isCFObjectRef(RetTy)) {
|
|
return getCFCreateGetRuleSummary(FD);
|
|
}
|
|
|
|
if (FD->hasAttr<CFAuditedTransferAttr>()) {
|
|
return getCFCreateGetRuleSummary(FD);
|
|
}
|
|
}
|
|
|
|
// Check for release functions, the only kind of functions that we care
|
|
// about that don't return a pointer type.
|
|
if (FName.startswith("CG") || FName.startswith("CF")) {
|
|
// Test for 'CGCF'.
|
|
FName = FName.substr(FName.startswith("CGCF") ? 4 : 2);
|
|
|
|
if (isRelease(FD, FName))
|
|
return getUnarySummary(FT, DecRef);
|
|
else {
|
|
assert(ScratchArgs.isEmpty());
|
|
// Remaining CoreFoundation and CoreGraphics functions.
|
|
// We use to assume that they all strictly followed the ownership idiom
|
|
// and that ownership cannot be transferred. While this is technically
|
|
// correct, many methods allow a tracked object to escape. For example:
|
|
//
|
|
// CFMutableDictionaryRef x = CFDictionaryCreateMutable(...);
|
|
// CFDictionaryAddValue(y, key, x);
|
|
// CFRelease(x);
|
|
// ... it is okay to use 'x' since 'y' has a reference to it
|
|
//
|
|
// We handle this and similar cases with the follow heuristic. If the
|
|
// function name contains "InsertValue", "SetValue", "AddValue",
|
|
// "AppendValue", or "SetAttribute", then we assume that arguments may
|
|
// "escape." This means that something else holds on to the object,
|
|
// allowing it be used even after its local retain count drops to 0.
|
|
ArgEffectKind E =
|
|
(StrInStrNoCase(FName, "InsertValue") != StringRef::npos ||
|
|
StrInStrNoCase(FName, "AddValue") != StringRef::npos ||
|
|
StrInStrNoCase(FName, "SetValue") != StringRef::npos ||
|
|
StrInStrNoCase(FName, "AppendValue") != StringRef::npos ||
|
|
StrInStrNoCase(FName, "SetAttribute") != StringRef::npos)
|
|
? MayEscape
|
|
: DoNothing;
|
|
|
|
return getPersistentSummary(RetEffect::MakeNoRet(), ScratchArgs,
|
|
ArgEffect(DoNothing), ArgEffect(E, ObjKind::CF));
|
|
}
|
|
}
|
|
|
|
return nullptr;
|
|
}
|
|
|
|
const RetainSummary *
|
|
RetainSummaryManager::generateSummary(const FunctionDecl *FD,
|
|
bool &AllowAnnotations) {
|
|
// We generate "stop" summaries for implicitly defined functions.
|
|
if (FD->isImplicit())
|
|
return getPersistentStopSummary();
|
|
|
|
const IdentifierInfo *II = FD->getIdentifier();
|
|
|
|
StringRef FName = II ? II->getName() : "";
|
|
|
|
// Strip away preceding '_'. Doing this here will effect all the checks
|
|
// down below.
|
|
FName = FName.substr(FName.find_first_not_of('_'));
|
|
|
|
// Inspect the result type. Strip away any typedefs.
|
|
const auto *FT = FD->getType()->castAs<FunctionType>();
|
|
QualType RetTy = FT->getReturnType();
|
|
|
|
if (TrackOSObjects)
|
|
if (const RetainSummary *S = getSummaryForOSObject(FD, FName, RetTy))
|
|
return S;
|
|
|
|
if (const auto *MD = dyn_cast<CXXMethodDecl>(FD))
|
|
if (!isOSObjectRelated(MD))
|
|
return getPersistentSummary(RetEffect::MakeNoRet(),
|
|
ArgEffects(AF.getEmptyMap()),
|
|
ArgEffect(DoNothing),
|
|
ArgEffect(StopTracking),
|
|
ArgEffect(DoNothing));
|
|
|
|
if (TrackObjCAndCFObjects)
|
|
if (const RetainSummary *S =
|
|
getSummaryForObjCOrCFObject(FD, FName, RetTy, FT, AllowAnnotations))
|
|
return S;
|
|
|
|
return getDefaultSummary();
|
|
}
|
|
|
|
const RetainSummary *
|
|
RetainSummaryManager::getFunctionSummary(const FunctionDecl *FD) {
|
|
// If we don't know what function we're calling, use our default summary.
|
|
if (!FD)
|
|
return getDefaultSummary();
|
|
|
|
// Look up a summary in our cache of FunctionDecls -> Summaries.
|
|
FuncSummariesTy::iterator I = FuncSummaries.find(FD);
|
|
if (I != FuncSummaries.end())
|
|
return I->second;
|
|
|
|
// No summary? Generate one.
|
|
bool AllowAnnotations = true;
|
|
const RetainSummary *S = generateSummary(FD, AllowAnnotations);
|
|
|
|
// Annotations override defaults.
|
|
if (AllowAnnotations)
|
|
updateSummaryFromAnnotations(S, FD);
|
|
|
|
FuncSummaries[FD] = S;
|
|
return S;
|
|
}
|
|
|
|
//===----------------------------------------------------------------------===//
|
|
// Summary creation for functions (largely uses of Core Foundation).
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
static ArgEffect getStopTrackingHardEquivalent(ArgEffect E) {
|
|
switch (E.getKind()) {
|
|
case DoNothing:
|
|
case Autorelease:
|
|
case DecRefBridgedTransferred:
|
|
case IncRef:
|
|
case UnretainedOutParameter:
|
|
case RetainedOutParameter:
|
|
case RetainedOutParameterOnZero:
|
|
case RetainedOutParameterOnNonZero:
|
|
case MayEscape:
|
|
case StopTracking:
|
|
case StopTrackingHard:
|
|
return E.withKind(StopTrackingHard);
|
|
case DecRef:
|
|
case DecRefAndStopTrackingHard:
|
|
return E.withKind(DecRefAndStopTrackingHard);
|
|
case Dealloc:
|
|
return E.withKind(Dealloc);
|
|
}
|
|
|
|
llvm_unreachable("Unknown ArgEffect kind");
|
|
}
|
|
|
|
const RetainSummary *
|
|
RetainSummaryManager::updateSummaryForNonZeroCallbackArg(const RetainSummary *S,
|
|
AnyCall &C) {
|
|
ArgEffect RecEffect = getStopTrackingHardEquivalent(S->getReceiverEffect());
|
|
ArgEffect DefEffect = getStopTrackingHardEquivalent(S->getDefaultArgEffect());
|
|
|
|
ArgEffects ScratchArgs(AF.getEmptyMap());
|
|
ArgEffects CustomArgEffects = S->getArgEffects();
|
|
for (ArgEffects::iterator I = CustomArgEffects.begin(),
|
|
E = CustomArgEffects.end();
|
|
I != E; ++I) {
|
|
ArgEffect Translated = getStopTrackingHardEquivalent(I->second);
|
|
if (Translated.getKind() != DefEffect.getKind())
|
|
ScratchArgs = AF.add(ScratchArgs, I->first, Translated);
|
|
}
|
|
|
|
RetEffect RE = RetEffect::MakeNoRetHard();
|
|
|
|
// Special cases where the callback argument CANNOT free the return value.
|
|
// This can generally only happen if we know that the callback will only be
|
|
// called when the return value is already being deallocated.
|
|
if (const IdentifierInfo *Name = C.getIdentifier()) {
|
|
// When the CGBitmapContext is deallocated, the callback here will free
|
|
// the associated data buffer.
|
|
// The callback in dispatch_data_create frees the buffer, but not
|
|
// the data object.
|
|
if (Name->isStr("CGBitmapContextCreateWithData") ||
|
|
Name->isStr("dispatch_data_create"))
|
|
RE = S->getRetEffect();
|
|
}
|
|
|
|
return getPersistentSummary(RE, ScratchArgs, RecEffect, DefEffect);
|
|
}
|
|
|
|
void RetainSummaryManager::updateSummaryForReceiverUnconsumedSelf(
|
|
const RetainSummary *&S) {
|
|
|
|
RetainSummaryTemplate Template(S, *this);
|
|
|
|
Template->setReceiverEffect(ArgEffect(DoNothing));
|
|
Template->setRetEffect(RetEffect::MakeNoRet());
|
|
}
|
|
|
|
|
|
void RetainSummaryManager::updateSummaryForArgumentTypes(
|
|
const AnyCall &C, const RetainSummary *&RS) {
|
|
RetainSummaryTemplate Template(RS, *this);
|
|
|
|
unsigned parm_idx = 0;
|
|
for (auto pi = C.param_begin(), pe = C.param_end(); pi != pe;
|
|
++pi, ++parm_idx) {
|
|
QualType QT = (*pi)->getType();
|
|
|
|
// Skip already created values.
|
|
if (RS->getArgEffects().contains(parm_idx))
|
|
continue;
|
|
|
|
ObjKind K = ObjKind::AnyObj;
|
|
|
|
if (isISLObjectRef(QT)) {
|
|
K = ObjKind::Generalized;
|
|
} else if (isOSObjectPtr(QT)) {
|
|
K = ObjKind::OS;
|
|
} else if (cocoa::isCocoaObjectRef(QT)) {
|
|
K = ObjKind::ObjC;
|
|
} else if (coreFoundation::isCFObjectRef(QT)) {
|
|
K = ObjKind::CF;
|
|
}
|
|
|
|
if (K != ObjKind::AnyObj)
|
|
Template->addArg(AF, parm_idx,
|
|
ArgEffect(RS->getDefaultArgEffect().getKind(), K));
|
|
}
|
|
}
|
|
|
|
const RetainSummary *
|
|
RetainSummaryManager::getSummary(AnyCall C,
|
|
bool HasNonZeroCallbackArg,
|
|
bool IsReceiverUnconsumedSelf,
|
|
QualType ReceiverType) {
|
|
const RetainSummary *Summ;
|
|
switch (C.getKind()) {
|
|
case AnyCall::Function:
|
|
case AnyCall::Constructor:
|
|
case AnyCall::InheritedConstructor:
|
|
case AnyCall::Allocator:
|
|
case AnyCall::Deallocator:
|
|
Summ = getFunctionSummary(cast_or_null<FunctionDecl>(C.getDecl()));
|
|
break;
|
|
case AnyCall::Block:
|
|
case AnyCall::Destructor:
|
|
// FIXME: These calls are currently unsupported.
|
|
return getPersistentStopSummary();
|
|
case AnyCall::ObjCMethod: {
|
|
const auto *ME = cast_or_null<ObjCMessageExpr>(C.getExpr());
|
|
if (!ME) {
|
|
Summ = getMethodSummary(cast<ObjCMethodDecl>(C.getDecl()));
|
|
} else if (ME->isInstanceMessage()) {
|
|
Summ = getInstanceMethodSummary(ME, ReceiverType);
|
|
} else {
|
|
Summ = getClassMethodSummary(ME);
|
|
}
|
|
break;
|
|
}
|
|
}
|
|
|
|
if (HasNonZeroCallbackArg)
|
|
Summ = updateSummaryForNonZeroCallbackArg(Summ, C);
|
|
|
|
if (IsReceiverUnconsumedSelf)
|
|
updateSummaryForReceiverUnconsumedSelf(Summ);
|
|
|
|
updateSummaryForArgumentTypes(C, Summ);
|
|
|
|
assert(Summ && "Unknown call type?");
|
|
return Summ;
|
|
}
|
|
|
|
|
|
const RetainSummary *
|
|
RetainSummaryManager::getCFCreateGetRuleSummary(const FunctionDecl *FD) {
|
|
if (coreFoundation::followsCreateRule(FD))
|
|
return getCFSummaryCreateRule(FD);
|
|
|
|
return getCFSummaryGetRule(FD);
|
|
}
|
|
|
|
bool RetainSummaryManager::isTrustedReferenceCountImplementation(
|
|
const Decl *FD) {
|
|
return hasRCAnnotation(FD, "rc_ownership_trusted_implementation");
|
|
}
|
|
|
|
Optional<RetainSummaryManager::BehaviorSummary>
|
|
RetainSummaryManager::canEval(const CallExpr *CE, const FunctionDecl *FD,
|
|
bool &hasTrustedImplementationAnnotation) {
|
|
|
|
IdentifierInfo *II = FD->getIdentifier();
|
|
if (!II)
|
|
return None;
|
|
|
|
StringRef FName = II->getName();
|
|
FName = FName.substr(FName.find_first_not_of('_'));
|
|
|
|
QualType ResultTy = CE->getCallReturnType(Ctx);
|
|
if (ResultTy->isObjCIdType()) {
|
|
if (II->isStr("NSMakeCollectable"))
|
|
return BehaviorSummary::Identity;
|
|
} else if (ResultTy->isPointerType()) {
|
|
// Handle: (CF|CG|CV)Retain
|
|
// CFAutorelease
|
|
// It's okay to be a little sloppy here.
|
|
if (FName == "CMBufferQueueDequeueAndRetain" ||
|
|
FName == "CMBufferQueueDequeueIfDataReadyAndRetain") {
|
|
// Part of: <rdar://problem/39390714>.
|
|
// These are not retain. They just return something and retain it.
|
|
return None;
|
|
}
|
|
if (CE->getNumArgs() == 1 &&
|
|
(cocoa::isRefType(ResultTy, "CF", FName) ||
|
|
cocoa::isRefType(ResultTy, "CG", FName) ||
|
|
cocoa::isRefType(ResultTy, "CV", FName)) &&
|
|
(isRetain(FD, FName) || isAutorelease(FD, FName) ||
|
|
isMakeCollectable(FName)))
|
|
return BehaviorSummary::Identity;
|
|
|
|
// safeMetaCast is called by OSDynamicCast.
|
|
// We assume that OSDynamicCast is either an identity (cast is OK,
|
|
// the input was non-zero),
|
|
// or that it returns zero (when the cast failed, or the input
|
|
// was zero).
|
|
if (TrackOSObjects) {
|
|
if (isOSObjectDynamicCast(FName) && FD->param_size() >= 1) {
|
|
return BehaviorSummary::IdentityOrZero;
|
|
} else if (isOSObjectRequiredCast(FName) && FD->param_size() >= 1) {
|
|
return BehaviorSummary::Identity;
|
|
} else if (isOSObjectThisCast(FName) && isa<CXXMethodDecl>(FD) &&
|
|
!cast<CXXMethodDecl>(FD)->isStatic()) {
|
|
return BehaviorSummary::IdentityThis;
|
|
}
|
|
}
|
|
|
|
const FunctionDecl* FDD = FD->getDefinition();
|
|
if (FDD && isTrustedReferenceCountImplementation(FDD)) {
|
|
hasTrustedImplementationAnnotation = true;
|
|
return BehaviorSummary::Identity;
|
|
}
|
|
}
|
|
|
|
if (const auto *MD = dyn_cast<CXXMethodDecl>(FD)) {
|
|
const CXXRecordDecl *Parent = MD->getParent();
|
|
if (TrackOSObjects && Parent && isOSObjectSubclass(Parent))
|
|
if (FName == "release" || FName == "retain")
|
|
return BehaviorSummary::NoOp;
|
|
}
|
|
|
|
return None;
|
|
}
|
|
|
|
const RetainSummary *
|
|
RetainSummaryManager::getUnarySummary(const FunctionType* FT,
|
|
ArgEffectKind AE) {
|
|
|
|
// Unary functions have no arg effects by definition.
|
|
ArgEffects ScratchArgs(AF.getEmptyMap());
|
|
|
|
// Sanity check that this is *really* a unary function. This can
|
|
// happen if people do weird things.
|
|
const FunctionProtoType* FTP = dyn_cast<FunctionProtoType>(FT);
|
|
if (!FTP || FTP->getNumParams() != 1)
|
|
return getPersistentStopSummary();
|
|
|
|
ArgEffect Effect(AE, ObjKind::CF);
|
|
|
|
ScratchArgs = AF.add(ScratchArgs, 0, Effect);
|
|
return getPersistentSummary(RetEffect::MakeNoRet(),
|
|
ScratchArgs,
|
|
ArgEffect(DoNothing), ArgEffect(DoNothing));
|
|
}
|
|
|
|
const RetainSummary *
|
|
RetainSummaryManager::getOSSummaryRetainRule(const FunctionDecl *FD) {
|
|
return getPersistentSummary(RetEffect::MakeNoRet(),
|
|
AF.getEmptyMap(),
|
|
/*ReceiverEff=*/ArgEffect(DoNothing),
|
|
/*DefaultEff=*/ArgEffect(DoNothing),
|
|
/*ThisEff=*/ArgEffect(IncRef, ObjKind::OS));
|
|
}
|
|
|
|
const RetainSummary *
|
|
RetainSummaryManager::getOSSummaryReleaseRule(const FunctionDecl *FD) {
|
|
return getPersistentSummary(RetEffect::MakeNoRet(),
|
|
AF.getEmptyMap(),
|
|
/*ReceiverEff=*/ArgEffect(DoNothing),
|
|
/*DefaultEff=*/ArgEffect(DoNothing),
|
|
/*ThisEff=*/ArgEffect(DecRef, ObjKind::OS));
|
|
}
|
|
|
|
const RetainSummary *
|
|
RetainSummaryManager::getOSSummaryFreeRule(const FunctionDecl *FD) {
|
|
return getPersistentSummary(RetEffect::MakeNoRet(),
|
|
AF.getEmptyMap(),
|
|
/*ReceiverEff=*/ArgEffect(DoNothing),
|
|
/*DefaultEff=*/ArgEffect(DoNothing),
|
|
/*ThisEff=*/ArgEffect(Dealloc, ObjKind::OS));
|
|
}
|
|
|
|
const RetainSummary *
|
|
RetainSummaryManager::getOSSummaryCreateRule(const FunctionDecl *FD) {
|
|
return getPersistentSummary(RetEffect::MakeOwned(ObjKind::OS),
|
|
AF.getEmptyMap());
|
|
}
|
|
|
|
const RetainSummary *
|
|
RetainSummaryManager::getOSSummaryGetRule(const FunctionDecl *FD) {
|
|
return getPersistentSummary(RetEffect::MakeNotOwned(ObjKind::OS),
|
|
AF.getEmptyMap());
|
|
}
|
|
|
|
const RetainSummary *
|
|
RetainSummaryManager::getCFSummaryCreateRule(const FunctionDecl *FD) {
|
|
return getPersistentSummary(RetEffect::MakeOwned(ObjKind::CF),
|
|
ArgEffects(AF.getEmptyMap()));
|
|
}
|
|
|
|
const RetainSummary *
|
|
RetainSummaryManager::getCFSummaryGetRule(const FunctionDecl *FD) {
|
|
return getPersistentSummary(RetEffect::MakeNotOwned(ObjKind::CF),
|
|
ArgEffects(AF.getEmptyMap()),
|
|
ArgEffect(DoNothing), ArgEffect(DoNothing));
|
|
}
|
|
|
|
|
|
|
|
|
|
//===----------------------------------------------------------------------===//
|
|
// Summary creation for Selectors.
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
Optional<RetEffect>
|
|
RetainSummaryManager::getRetEffectFromAnnotations(QualType RetTy,
|
|
const Decl *D) {
|
|
if (hasAnyEnabledAttrOf<NSReturnsRetainedAttr>(D, RetTy))
|
|
return ObjCAllocRetE;
|
|
|
|
if (auto K = hasAnyEnabledAttrOf<CFReturnsRetainedAttr, OSReturnsRetainedAttr,
|
|
GeneralizedReturnsRetainedAttr>(D, RetTy))
|
|
return RetEffect::MakeOwned(*K);
|
|
|
|
if (auto K = hasAnyEnabledAttrOf<
|
|
CFReturnsNotRetainedAttr, OSReturnsNotRetainedAttr,
|
|
GeneralizedReturnsNotRetainedAttr, NSReturnsNotRetainedAttr,
|
|
NSReturnsAutoreleasedAttr>(D, RetTy))
|
|
return RetEffect::MakeNotOwned(*K);
|
|
|
|
if (const auto *MD = dyn_cast<CXXMethodDecl>(D))
|
|
for (const auto *PD : MD->overridden_methods())
|
|
if (auto RE = getRetEffectFromAnnotations(RetTy, PD))
|
|
return RE;
|
|
|
|
return None;
|
|
}
|
|
|
|
/// \return Whether the chain of typedefs starting from {@code QT}
|
|
/// has a typedef with a given name {@code Name}.
|
|
static bool hasTypedefNamed(QualType QT,
|
|
StringRef Name) {
|
|
while (auto *T = dyn_cast<TypedefType>(QT)) {
|
|
const auto &Context = T->getDecl()->getASTContext();
|
|
if (T->getDecl()->getIdentifier() == &Context.Idents.get(Name))
|
|
return true;
|
|
QT = T->getDecl()->getUnderlyingType();
|
|
}
|
|
return false;
|
|
}
|
|
|
|
static QualType getCallableReturnType(const NamedDecl *ND) {
|
|
if (const auto *FD = dyn_cast<FunctionDecl>(ND)) {
|
|
return FD->getReturnType();
|
|
} else if (const auto *MD = dyn_cast<ObjCMethodDecl>(ND)) {
|
|
return MD->getReturnType();
|
|
} else {
|
|
llvm_unreachable("Unexpected decl");
|
|
}
|
|
}
|
|
|
|
bool RetainSummaryManager::applyParamAnnotationEffect(
|
|
const ParmVarDecl *pd, unsigned parm_idx, const NamedDecl *FD,
|
|
RetainSummaryTemplate &Template) {
|
|
QualType QT = pd->getType();
|
|
if (auto K =
|
|
hasAnyEnabledAttrOf<NSConsumedAttr, CFConsumedAttr, OSConsumedAttr,
|
|
GeneralizedConsumedAttr>(pd, QT)) {
|
|
Template->addArg(AF, parm_idx, ArgEffect(DecRef, *K));
|
|
return true;
|
|
} else if (auto K = hasAnyEnabledAttrOf<
|
|
CFReturnsRetainedAttr, OSReturnsRetainedAttr,
|
|
OSReturnsRetainedOnNonZeroAttr, OSReturnsRetainedOnZeroAttr,
|
|
GeneralizedReturnsRetainedAttr>(pd, QT)) {
|
|
|
|
// For OSObjects, we try to guess whether the object is created based
|
|
// on the return value.
|
|
if (K == ObjKind::OS) {
|
|
QualType QT = getCallableReturnType(FD);
|
|
|
|
bool HasRetainedOnZero = pd->hasAttr<OSReturnsRetainedOnZeroAttr>();
|
|
bool HasRetainedOnNonZero = pd->hasAttr<OSReturnsRetainedOnNonZeroAttr>();
|
|
|
|
// The usual convention is to create an object on non-zero return, but
|
|
// it's reverted if the typedef chain has a typedef kern_return_t,
|
|
// because kReturnSuccess constant is defined as zero.
|
|
// The convention can be overwritten by custom attributes.
|
|
bool SuccessOnZero =
|
|
HasRetainedOnZero ||
|
|
(hasTypedefNamed(QT, "kern_return_t") && !HasRetainedOnNonZero);
|
|
bool ShouldSplit = !QT.isNull() && !QT->isVoidType();
|
|
ArgEffectKind AK = RetainedOutParameter;
|
|
if (ShouldSplit && SuccessOnZero) {
|
|
AK = RetainedOutParameterOnZero;
|
|
} else if (ShouldSplit && (!SuccessOnZero || HasRetainedOnNonZero)) {
|
|
AK = RetainedOutParameterOnNonZero;
|
|
}
|
|
Template->addArg(AF, parm_idx, ArgEffect(AK, ObjKind::OS));
|
|
}
|
|
|
|
// For others:
|
|
// Do nothing. Retained out parameters will either point to a +1 reference
|
|
// or NULL, but the way you check for failure differs depending on the
|
|
// API. Consequently, we don't have a good way to track them yet.
|
|
return true;
|
|
} else if (auto K = hasAnyEnabledAttrOf<CFReturnsNotRetainedAttr,
|
|
OSReturnsNotRetainedAttr,
|
|
GeneralizedReturnsNotRetainedAttr>(
|
|
pd, QT)) {
|
|
Template->addArg(AF, parm_idx, ArgEffect(UnretainedOutParameter, *K));
|
|
return true;
|
|
}
|
|
|
|
if (const auto *MD = dyn_cast<CXXMethodDecl>(FD)) {
|
|
for (const auto *OD : MD->overridden_methods()) {
|
|
const ParmVarDecl *OP = OD->parameters()[parm_idx];
|
|
if (applyParamAnnotationEffect(OP, parm_idx, OD, Template))
|
|
return true;
|
|
}
|
|
}
|
|
|
|
return false;
|
|
}
|
|
|
|
void
|
|
RetainSummaryManager::updateSummaryFromAnnotations(const RetainSummary *&Summ,
|
|
const FunctionDecl *FD) {
|
|
if (!FD)
|
|
return;
|
|
|
|
assert(Summ && "Must have a summary to add annotations to.");
|
|
RetainSummaryTemplate Template(Summ, *this);
|
|
|
|
// Effects on the parameters.
|
|
unsigned parm_idx = 0;
|
|
for (auto pi = FD->param_begin(),
|
|
pe = FD->param_end(); pi != pe; ++pi, ++parm_idx)
|
|
applyParamAnnotationEffect(*pi, parm_idx, FD, Template);
|
|
|
|
QualType RetTy = FD->getReturnType();
|
|
if (Optional<RetEffect> RetE = getRetEffectFromAnnotations(RetTy, FD))
|
|
Template->setRetEffect(*RetE);
|
|
|
|
if (hasAnyEnabledAttrOf<OSConsumesThisAttr>(FD, RetTy))
|
|
Template->setThisEffect(ArgEffect(DecRef, ObjKind::OS));
|
|
}
|
|
|
|
void
|
|
RetainSummaryManager::updateSummaryFromAnnotations(const RetainSummary *&Summ,
|
|
const ObjCMethodDecl *MD) {
|
|
if (!MD)
|
|
return;
|
|
|
|
assert(Summ && "Must have a valid summary to add annotations to");
|
|
RetainSummaryTemplate Template(Summ, *this);
|
|
|
|
// Effects on the receiver.
|
|
if (hasAnyEnabledAttrOf<NSConsumesSelfAttr>(MD, MD->getReturnType()))
|
|
Template->setReceiverEffect(ArgEffect(DecRef, ObjKind::ObjC));
|
|
|
|
// Effects on the parameters.
|
|
unsigned parm_idx = 0;
|
|
for (auto pi = MD->param_begin(), pe = MD->param_end(); pi != pe;
|
|
++pi, ++parm_idx)
|
|
applyParamAnnotationEffect(*pi, parm_idx, MD, Template);
|
|
|
|
QualType RetTy = MD->getReturnType();
|
|
if (Optional<RetEffect> RetE = getRetEffectFromAnnotations(RetTy, MD))
|
|
Template->setRetEffect(*RetE);
|
|
}
|
|
|
|
const RetainSummary *
|
|
RetainSummaryManager::getStandardMethodSummary(const ObjCMethodDecl *MD,
|
|
Selector S, QualType RetTy) {
|
|
// Any special effects?
|
|
ArgEffect ReceiverEff = ArgEffect(DoNothing, ObjKind::ObjC);
|
|
RetEffect ResultEff = RetEffect::MakeNoRet();
|
|
|
|
// Check the method family, and apply any default annotations.
|
|
switch (MD ? MD->getMethodFamily() : S.getMethodFamily()) {
|
|
case OMF_None:
|
|
case OMF_initialize:
|
|
case OMF_performSelector:
|
|
// Assume all Objective-C methods follow Cocoa Memory Management rules.
|
|
// FIXME: Does the non-threaded performSelector family really belong here?
|
|
// The selector could be, say, @selector(copy).
|
|
if (cocoa::isCocoaObjectRef(RetTy))
|
|
ResultEff = RetEffect::MakeNotOwned(ObjKind::ObjC);
|
|
else if (coreFoundation::isCFObjectRef(RetTy)) {
|
|
// ObjCMethodDecl currently doesn't consider CF objects as valid return
|
|
// values for alloc, new, copy, or mutableCopy, so we have to
|
|
// double-check with the selector. This is ugly, but there aren't that
|
|
// many Objective-C methods that return CF objects, right?
|
|
if (MD) {
|
|
switch (S.getMethodFamily()) {
|
|
case OMF_alloc:
|
|
case OMF_new:
|
|
case OMF_copy:
|
|
case OMF_mutableCopy:
|
|
ResultEff = RetEffect::MakeOwned(ObjKind::CF);
|
|
break;
|
|
default:
|
|
ResultEff = RetEffect::MakeNotOwned(ObjKind::CF);
|
|
break;
|
|
}
|
|
} else {
|
|
ResultEff = RetEffect::MakeNotOwned(ObjKind::CF);
|
|
}
|
|
}
|
|
break;
|
|
case OMF_init:
|
|
ResultEff = ObjCInitRetE;
|
|
ReceiverEff = ArgEffect(DecRef, ObjKind::ObjC);
|
|
break;
|
|
case OMF_alloc:
|
|
case OMF_new:
|
|
case OMF_copy:
|
|
case OMF_mutableCopy:
|
|
if (cocoa::isCocoaObjectRef(RetTy))
|
|
ResultEff = ObjCAllocRetE;
|
|
else if (coreFoundation::isCFObjectRef(RetTy))
|
|
ResultEff = RetEffect::MakeOwned(ObjKind::CF);
|
|
break;
|
|
case OMF_autorelease:
|
|
ReceiverEff = ArgEffect(Autorelease, ObjKind::ObjC);
|
|
break;
|
|
case OMF_retain:
|
|
ReceiverEff = ArgEffect(IncRef, ObjKind::ObjC);
|
|
break;
|
|
case OMF_release:
|
|
ReceiverEff = ArgEffect(DecRef, ObjKind::ObjC);
|
|
break;
|
|
case OMF_dealloc:
|
|
ReceiverEff = ArgEffect(Dealloc, ObjKind::ObjC);
|
|
break;
|
|
case OMF_self:
|
|
// -self is handled specially by the ExprEngine to propagate the receiver.
|
|
break;
|
|
case OMF_retainCount:
|
|
case OMF_finalize:
|
|
// These methods don't return objects.
|
|
break;
|
|
}
|
|
|
|
// If one of the arguments in the selector has the keyword 'delegate' we
|
|
// should stop tracking the reference count for the receiver. This is
|
|
// because the reference count is quite possibly handled by a delegate
|
|
// method.
|
|
if (S.isKeywordSelector()) {
|
|
for (unsigned i = 0, e = S.getNumArgs(); i != e; ++i) {
|
|
StringRef Slot = S.getNameForSlot(i);
|
|
if (Slot.substr(Slot.size() - 8).equals_lower("delegate")) {
|
|
if (ResultEff == ObjCInitRetE)
|
|
ResultEff = RetEffect::MakeNoRetHard();
|
|
else
|
|
ReceiverEff = ArgEffect(StopTrackingHard, ObjKind::ObjC);
|
|
}
|
|
}
|
|
}
|
|
|
|
if (ReceiverEff.getKind() == DoNothing &&
|
|
ResultEff.getKind() == RetEffect::NoRet)
|
|
return getDefaultSummary();
|
|
|
|
return getPersistentSummary(ResultEff, ArgEffects(AF.getEmptyMap()),
|
|
ArgEffect(ReceiverEff), ArgEffect(MayEscape));
|
|
}
|
|
|
|
const RetainSummary *
|
|
RetainSummaryManager::getClassMethodSummary(const ObjCMessageExpr *ME) {
|
|
assert(!ME->isInstanceMessage());
|
|
const ObjCInterfaceDecl *Class = ME->getReceiverInterface();
|
|
|
|
return getMethodSummary(ME->getSelector(), Class, ME->getMethodDecl(),
|
|
ME->getType(), ObjCClassMethodSummaries);
|
|
}
|
|
|
|
const RetainSummary *RetainSummaryManager::getInstanceMethodSummary(
|
|
const ObjCMessageExpr *ME,
|
|
QualType ReceiverType) {
|
|
const ObjCInterfaceDecl *ReceiverClass = nullptr;
|
|
|
|
// We do better tracking of the type of the object than the core ExprEngine.
|
|
// See if we have its type in our private state.
|
|
if (!ReceiverType.isNull())
|
|
if (const auto *PT = ReceiverType->getAs<ObjCObjectPointerType>())
|
|
ReceiverClass = PT->getInterfaceDecl();
|
|
|
|
// If we don't know what kind of object this is, fall back to its static type.
|
|
if (!ReceiverClass)
|
|
ReceiverClass = ME->getReceiverInterface();
|
|
|
|
// FIXME: The receiver could be a reference to a class, meaning that
|
|
// we should use the class method.
|
|
// id x = [NSObject class];
|
|
// [x performSelector:... withObject:... afterDelay:...];
|
|
Selector S = ME->getSelector();
|
|
const ObjCMethodDecl *Method = ME->getMethodDecl();
|
|
if (!Method && ReceiverClass)
|
|
Method = ReceiverClass->getInstanceMethod(S);
|
|
|
|
return getMethodSummary(S, ReceiverClass, Method, ME->getType(),
|
|
ObjCMethodSummaries);
|
|
}
|
|
|
|
const RetainSummary *
|
|
RetainSummaryManager::getMethodSummary(Selector S,
|
|
const ObjCInterfaceDecl *ID,
|
|
const ObjCMethodDecl *MD, QualType RetTy,
|
|
ObjCMethodSummariesTy &CachedSummaries) {
|
|
|
|
// Objective-C method summaries are only applicable to ObjC and CF objects.
|
|
if (!TrackObjCAndCFObjects)
|
|
return getDefaultSummary();
|
|
|
|
// Look up a summary in our summary cache.
|
|
const RetainSummary *Summ = CachedSummaries.find(ID, S);
|
|
|
|
if (!Summ) {
|
|
Summ = getStandardMethodSummary(MD, S, RetTy);
|
|
|
|
// Annotations override defaults.
|
|
updateSummaryFromAnnotations(Summ, MD);
|
|
|
|
// Memoize the summary.
|
|
CachedSummaries[ObjCSummaryKey(ID, S)] = Summ;
|
|
}
|
|
|
|
return Summ;
|
|
}
|
|
|
|
void RetainSummaryManager::InitializeClassMethodSummaries() {
|
|
ArgEffects ScratchArgs = AF.getEmptyMap();
|
|
|
|
// Create the [NSAssertionHandler currentHander] summary.
|
|
addClassMethSummary("NSAssertionHandler", "currentHandler",
|
|
getPersistentSummary(RetEffect::MakeNotOwned(ObjKind::ObjC),
|
|
ScratchArgs));
|
|
|
|
// Create the [NSAutoreleasePool addObject:] summary.
|
|
ScratchArgs = AF.add(ScratchArgs, 0, ArgEffect(Autorelease));
|
|
addClassMethSummary("NSAutoreleasePool", "addObject",
|
|
getPersistentSummary(RetEffect::MakeNoRet(), ScratchArgs,
|
|
ArgEffect(DoNothing),
|
|
ArgEffect(Autorelease)));
|
|
}
|
|
|
|
void RetainSummaryManager::InitializeMethodSummaries() {
|
|
|
|
ArgEffects ScratchArgs = AF.getEmptyMap();
|
|
// Create the "init" selector. It just acts as a pass-through for the
|
|
// receiver.
|
|
const RetainSummary *InitSumm = getPersistentSummary(
|
|
ObjCInitRetE, ScratchArgs, ArgEffect(DecRef, ObjKind::ObjC));
|
|
addNSObjectMethSummary(GetNullarySelector("init", Ctx), InitSumm);
|
|
|
|
// awakeAfterUsingCoder: behaves basically like an 'init' method. It
|
|
// claims the receiver and returns a retained object.
|
|
addNSObjectMethSummary(GetUnarySelector("awakeAfterUsingCoder", Ctx),
|
|
InitSumm);
|
|
|
|
// The next methods are allocators.
|
|
const RetainSummary *AllocSumm = getPersistentSummary(ObjCAllocRetE,
|
|
ScratchArgs);
|
|
const RetainSummary *CFAllocSumm =
|
|
getPersistentSummary(RetEffect::MakeOwned(ObjKind::CF), ScratchArgs);
|
|
|
|
// Create the "retain" selector.
|
|
RetEffect NoRet = RetEffect::MakeNoRet();
|
|
const RetainSummary *Summ = getPersistentSummary(
|
|
NoRet, ScratchArgs, ArgEffect(IncRef, ObjKind::ObjC));
|
|
addNSObjectMethSummary(GetNullarySelector("retain", Ctx), Summ);
|
|
|
|
// Create the "release" selector.
|
|
Summ = getPersistentSummary(NoRet, ScratchArgs,
|
|
ArgEffect(DecRef, ObjKind::ObjC));
|
|
addNSObjectMethSummary(GetNullarySelector("release", Ctx), Summ);
|
|
|
|
// Create the -dealloc summary.
|
|
Summ = getPersistentSummary(NoRet, ScratchArgs, ArgEffect(Dealloc,
|
|
ObjKind::ObjC));
|
|
addNSObjectMethSummary(GetNullarySelector("dealloc", Ctx), Summ);
|
|
|
|
// Create the "autorelease" selector.
|
|
Summ = getPersistentSummary(NoRet, ScratchArgs, ArgEffect(Autorelease,
|
|
ObjKind::ObjC));
|
|
addNSObjectMethSummary(GetNullarySelector("autorelease", Ctx), Summ);
|
|
|
|
// For NSWindow, allocated objects are (initially) self-owned.
|
|
// FIXME: For now we opt for false negatives with NSWindow, as these objects
|
|
// self-own themselves. However, they only do this once they are displayed.
|
|
// Thus, we need to track an NSWindow's display status.
|
|
// This is tracked in <rdar://problem/6062711>.
|
|
// See also http://llvm.org/bugs/show_bug.cgi?id=3714.
|
|
const RetainSummary *NoTrackYet =
|
|
getPersistentSummary(RetEffect::MakeNoRet(), ScratchArgs,
|
|
ArgEffect(StopTracking), ArgEffect(StopTracking));
|
|
|
|
addClassMethSummary("NSWindow", "alloc", NoTrackYet);
|
|
|
|
// For NSPanel (which subclasses NSWindow), allocated objects are not
|
|
// self-owned.
|
|
// FIXME: For now we don't track NSPanels. object for the same reason
|
|
// as for NSWindow objects.
|
|
addClassMethSummary("NSPanel", "alloc", NoTrackYet);
|
|
|
|
// For NSNull, objects returned by +null are singletons that ignore
|
|
// retain/release semantics. Just don't track them.
|
|
// <rdar://problem/12858915>
|
|
addClassMethSummary("NSNull", "null", NoTrackYet);
|
|
|
|
// Don't track allocated autorelease pools, as it is okay to prematurely
|
|
// exit a method.
|
|
addClassMethSummary("NSAutoreleasePool", "alloc", NoTrackYet);
|
|
addClassMethSummary("NSAutoreleasePool", "allocWithZone", NoTrackYet, false);
|
|
addClassMethSummary("NSAutoreleasePool", "new", NoTrackYet);
|
|
|
|
// Create summaries QCRenderer/QCView -createSnapShotImageOfType:
|
|
addInstMethSummary("QCRenderer", AllocSumm, "createSnapshotImageOfType");
|
|
addInstMethSummary("QCView", AllocSumm, "createSnapshotImageOfType");
|
|
|
|
// Create summaries for CIContext, 'createCGImage' and
|
|
// 'createCGLayerWithSize'. These objects are CF objects, and are not
|
|
// automatically garbage collected.
|
|
addInstMethSummary("CIContext", CFAllocSumm, "createCGImage", "fromRect");
|
|
addInstMethSummary("CIContext", CFAllocSumm, "createCGImage", "fromRect",
|
|
"format", "colorSpace");
|
|
addInstMethSummary("CIContext", CFAllocSumm, "createCGLayerWithSize", "info");
|
|
}
|
|
|
|
const RetainSummary *
|
|
RetainSummaryManager::getMethodSummary(const ObjCMethodDecl *MD) {
|
|
const ObjCInterfaceDecl *ID = MD->getClassInterface();
|
|
Selector S = MD->getSelector();
|
|
QualType ResultTy = MD->getReturnType();
|
|
|
|
ObjCMethodSummariesTy *CachedSummaries;
|
|
if (MD->isInstanceMethod())
|
|
CachedSummaries = &ObjCMethodSummaries;
|
|
else
|
|
CachedSummaries = &ObjCClassMethodSummaries;
|
|
|
|
return getMethodSummary(S, ID, MD, ResultTy, *CachedSummaries);
|
|
}
|