1 //==- CheckObjCDealloc.cpp - Check ObjC -dealloc implementation --*- C++ -*-==//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This file defines a CheckObjCDealloc, a checker that
11 // analyzes an Objective-C class's implementation to determine if it
12 // correctly implements -dealloc.
13 //
14 //===----------------------------------------------------------------------===//
15
16 #include "ClangSACheckers.h"
17 #include "clang/AST/Attr.h"
18 #include "clang/AST/DeclObjC.h"
19 #include "clang/AST/Expr.h"
20 #include "clang/AST/ExprObjC.h"
21 #include "clang/Basic/LangOptions.h"
22 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
23 #include "clang/StaticAnalyzer/Core/BugReporter/PathDiagnostic.h"
24 #include "clang/StaticAnalyzer/Core/Checker.h"
25 #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
26 #include "llvm/Support/raw_ostream.h"
27
28 using namespace clang;
29 using namespace ento;
30
scan_dealloc(Stmt * S,Selector Dealloc)31 static bool scan_dealloc(Stmt *S, Selector Dealloc) {
32
33 if (ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(S))
34 if (ME->getSelector() == Dealloc) {
35 switch (ME->getReceiverKind()) {
36 case ObjCMessageExpr::Instance: return false;
37 case ObjCMessageExpr::SuperInstance: return true;
38 case ObjCMessageExpr::Class: break;
39 case ObjCMessageExpr::SuperClass: break;
40 }
41 }
42
43 // Recurse to children.
44
45 for (Stmt::child_iterator I = S->child_begin(), E= S->child_end(); I!=E; ++I)
46 if (*I && scan_dealloc(*I, Dealloc))
47 return true;
48
49 return false;
50 }
51
scan_ivar_release(Stmt * S,ObjCIvarDecl * ID,const ObjCPropertyDecl * PD,Selector Release,IdentifierInfo * SelfII,ASTContext & Ctx)52 static bool scan_ivar_release(Stmt *S, ObjCIvarDecl *ID,
53 const ObjCPropertyDecl *PD,
54 Selector Release,
55 IdentifierInfo* SelfII,
56 ASTContext &Ctx) {
57
58 // [mMyIvar release]
59 if (ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(S))
60 if (ME->getSelector() == Release)
61 if (ME->getInstanceReceiver())
62 if (Expr *Receiver = ME->getInstanceReceiver()->IgnoreParenCasts())
63 if (ObjCIvarRefExpr *E = dyn_cast<ObjCIvarRefExpr>(Receiver))
64 if (E->getDecl() == ID)
65 return true;
66
67 // [self setMyIvar:nil];
68 if (ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(S))
69 if (ME->getInstanceReceiver())
70 if (Expr *Receiver = ME->getInstanceReceiver()->IgnoreParenCasts())
71 if (DeclRefExpr *E = dyn_cast<DeclRefExpr>(Receiver))
72 if (E->getDecl()->getIdentifier() == SelfII)
73 if (ME->getMethodDecl() == PD->getSetterMethodDecl() &&
74 ME->getNumArgs() == 1 &&
75 ME->getArg(0)->isNullPointerConstant(Ctx,
76 Expr::NPC_ValueDependentIsNull))
77 return true;
78
79 // self.myIvar = nil;
80 if (BinaryOperator* BO = dyn_cast<BinaryOperator>(S))
81 if (BO->isAssignmentOp())
82 if (ObjCPropertyRefExpr *PRE =
83 dyn_cast<ObjCPropertyRefExpr>(BO->getLHS()->IgnoreParenCasts()))
84 if (PRE->isExplicitProperty() && PRE->getExplicitProperty() == PD)
85 if (BO->getRHS()->isNullPointerConstant(Ctx,
86 Expr::NPC_ValueDependentIsNull)) {
87 // This is only a 'release' if the property kind is not
88 // 'assign'.
89 return PD->getSetterKind() != ObjCPropertyDecl::Assign;
90 }
91
92 // Recurse to children.
93 for (Stmt::child_iterator I = S->child_begin(), E= S->child_end(); I!=E; ++I)
94 if (*I && scan_ivar_release(*I, ID, PD, Release, SelfII, Ctx))
95 return true;
96
97 return false;
98 }
99
checkObjCDealloc(const ObjCImplementationDecl * D,const LangOptions & LOpts,BugReporter & BR)100 static void checkObjCDealloc(const ObjCImplementationDecl *D,
101 const LangOptions& LOpts, BugReporter& BR) {
102
103 assert (LOpts.getGC() != LangOptions::GCOnly);
104
105 ASTContext &Ctx = BR.getContext();
106 const ObjCInterfaceDecl *ID = D->getClassInterface();
107
108 // Does the class contain any ivars that are pointers (or id<...>)?
109 // If not, skip the check entirely.
110 // NOTE: This is motivated by PR 2517:
111 // http://llvm.org/bugs/show_bug.cgi?id=2517
112
113 bool containsPointerIvar = false;
114
115 for (ObjCInterfaceDecl::ivar_iterator I=ID->ivar_begin(), E=ID->ivar_end();
116 I!=E; ++I) {
117
118 ObjCIvarDecl *ID = *I;
119 QualType T = ID->getType();
120
121 if (!T->isObjCObjectPointerType() ||
122 ID->getAttr<IBOutletAttr>() || // Skip IBOutlets.
123 ID->getAttr<IBOutletCollectionAttr>()) // Skip IBOutletCollections.
124 continue;
125
126 containsPointerIvar = true;
127 break;
128 }
129
130 if (!containsPointerIvar)
131 return;
132
133 // Determine if the class subclasses NSObject.
134 IdentifierInfo* NSObjectII = &Ctx.Idents.get("NSObject");
135 IdentifierInfo* SenTestCaseII = &Ctx.Idents.get("SenTestCase");
136
137
138 for ( ; ID ; ID = ID->getSuperClass()) {
139 IdentifierInfo *II = ID->getIdentifier();
140
141 if (II == NSObjectII)
142 break;
143
144 // FIXME: For now, ignore classes that subclass SenTestCase, as these don't
145 // need to implement -dealloc. They implement tear down in another way,
146 // which we should try and catch later.
147 // http://llvm.org/bugs/show_bug.cgi?id=3187
148 if (II == SenTestCaseII)
149 return;
150 }
151
152 if (!ID)
153 return;
154
155 // Get the "dealloc" selector.
156 IdentifierInfo* II = &Ctx.Idents.get("dealloc");
157 Selector S = Ctx.Selectors.getSelector(0, &II);
158 ObjCMethodDecl *MD = 0;
159
160 // Scan the instance methods for "dealloc".
161 for (ObjCImplementationDecl::instmeth_iterator I = D->instmeth_begin(),
162 E = D->instmeth_end(); I!=E; ++I) {
163
164 if ((*I)->getSelector() == S) {
165 MD = *I;
166 break;
167 }
168 }
169
170 PathDiagnosticLocation DLoc =
171 PathDiagnosticLocation::createBegin(D, BR.getSourceManager());
172
173 if (!MD) { // No dealloc found.
174
175 const char* name = LOpts.getGC() == LangOptions::NonGC
176 ? "missing -dealloc"
177 : "missing -dealloc (Hybrid MM, non-GC)";
178
179 std::string buf;
180 llvm::raw_string_ostream os(buf);
181 os << "Objective-C class '" << *D << "' lacks a 'dealloc' instance method";
182
183 BR.EmitBasicReport(D, name, categories::CoreFoundationObjectiveC,
184 os.str(), DLoc);
185 return;
186 }
187
188 // dealloc found. Scan for missing [super dealloc].
189 if (MD->getBody() && !scan_dealloc(MD->getBody(), S)) {
190
191 const char* name = LOpts.getGC() == LangOptions::NonGC
192 ? "missing [super dealloc]"
193 : "missing [super dealloc] (Hybrid MM, non-GC)";
194
195 std::string buf;
196 llvm::raw_string_ostream os(buf);
197 os << "The 'dealloc' instance method in Objective-C class '" << *D
198 << "' does not send a 'dealloc' message to its super class"
199 " (missing [super dealloc])";
200
201 BR.EmitBasicReport(MD, name, categories::CoreFoundationObjectiveC,
202 os.str(), DLoc);
203 return;
204 }
205
206 // Get the "release" selector.
207 IdentifierInfo* RII = &Ctx.Idents.get("release");
208 Selector RS = Ctx.Selectors.getSelector(0, &RII);
209
210 // Get the "self" identifier
211 IdentifierInfo* SelfII = &Ctx.Idents.get("self");
212
213 // Scan for missing and extra releases of ivars used by implementations
214 // of synthesized properties
215 for (ObjCImplementationDecl::propimpl_iterator I = D->propimpl_begin(),
216 E = D->propimpl_end(); I!=E; ++I) {
217
218 // We can only check the synthesized properties
219 if (I->getPropertyImplementation() != ObjCPropertyImplDecl::Synthesize)
220 continue;
221
222 ObjCIvarDecl *ID = I->getPropertyIvarDecl();
223 if (!ID)
224 continue;
225
226 QualType T = ID->getType();
227 if (!T->isObjCObjectPointerType()) // Skip non-pointer ivars
228 continue;
229
230 const ObjCPropertyDecl *PD = I->getPropertyDecl();
231 if (!PD)
232 continue;
233
234 // ivars cannot be set via read-only properties, so we'll skip them
235 if (PD->isReadOnly())
236 continue;
237
238 // ivar must be released if and only if the kind of setter was not 'assign'
239 bool requiresRelease = PD->getSetterKind() != ObjCPropertyDecl::Assign;
240 if (scan_ivar_release(MD->getBody(), ID, PD, RS, SelfII, Ctx)
241 != requiresRelease) {
242 const char *name = 0;
243 std::string buf;
244 llvm::raw_string_ostream os(buf);
245
246 if (requiresRelease) {
247 name = LOpts.getGC() == LangOptions::NonGC
248 ? "missing ivar release (leak)"
249 : "missing ivar release (Hybrid MM, non-GC)";
250
251 os << "The '" << *ID
252 << "' instance variable was retained by a synthesized property but "
253 "wasn't released in 'dealloc'";
254 } else {
255 name = LOpts.getGC() == LangOptions::NonGC
256 ? "extra ivar release (use-after-release)"
257 : "extra ivar release (Hybrid MM, non-GC)";
258
259 os << "The '" << *ID
260 << "' instance variable was not retained by a synthesized property "
261 "but was released in 'dealloc'";
262 }
263
264 PathDiagnosticLocation SDLoc =
265 PathDiagnosticLocation::createBegin(*I, BR.getSourceManager());
266
267 BR.EmitBasicReport(MD, name, categories::CoreFoundationObjectiveC,
268 os.str(), SDLoc);
269 }
270 }
271 }
272
273 //===----------------------------------------------------------------------===//
274 // ObjCDeallocChecker
275 //===----------------------------------------------------------------------===//
276
277 namespace {
278 class ObjCDeallocChecker : public Checker<
279 check::ASTDecl<ObjCImplementationDecl> > {
280 public:
checkASTDecl(const ObjCImplementationDecl * D,AnalysisManager & mgr,BugReporter & BR) const281 void checkASTDecl(const ObjCImplementationDecl *D, AnalysisManager& mgr,
282 BugReporter &BR) const {
283 if (mgr.getLangOpts().getGC() == LangOptions::GCOnly)
284 return;
285 checkObjCDealloc(cast<ObjCImplementationDecl>(D), mgr.getLangOpts(), BR);
286 }
287 };
288 }
289
registerObjCDeallocChecker(CheckerManager & mgr)290 void ento::registerObjCDeallocChecker(CheckerManager &mgr) {
291 mgr.registerChecker<ObjCDeallocChecker>();
292 }
293