<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 08.03.2013 5:09, Jordan Rose wrote:<br>
</div>
<blockquote
cite="mid:022A67D5-7179-4592-9B5C-0A9D567C5A40@apple.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
<br>
<div>
<div>On Mar 7, 2013, at 15:53 , Anton Yartsev <<a
moz-do-not-send="true" href="mailto:anton.yartsev@gmail.com">anton.yartsev@gmail.com</a>>
wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">On 07.03.2013 21:29, Jordan Rose wrote:<br>
<blockquote type="cite">On Mar 7, 2013, at 4:47 , Anton
Yartsev <<a moz-do-not-send="true"
href="mailto:anton.yartsev@gmail.com">anton.yartsev@gmail.com</a>>
wrote:<br>
<br>
Can we just do the Objective-C part first? Can you send that
patch too?<br>
</blockquote>
Attached. I'll update the main patch after this one gets in.<br>
</blockquote>
</div>
<br>
<div>Looking at this again, I think the old logic was right (or at
least more conservative). It says that any method with
"freeWhenDone" in the name can take ownership (if the param is
true), and additionally that any method with "NoCopy" and <i>no</i> "freeWhenDone"
will also take ownership.</div>
<div><br>
</div>
<div>Anna's right that this needs a test case too.</div>
<div>Jordan</div>
</blockquote>
Really, the old logic is more detailed. Restored the old logic, only
applied the fix.<br>
<br>
> As such, the patch needs a test case. I think you should be
able to test for double free here.<br>
First I tried to design a testcase giving different results for
double free before and after the fix, but failed - the overall logic
of the checker gives the same result. Managed to write sensitive
test for offset free.<br>
<br>
There seems to be other two problems: first pointed to by the test
case testRelinquished2() (before the patch
dataWithBytesNoCopy:length: had been processed by
checkPostObjCMessage and the test passed) and the second - by
testNoCopy() and testFreeWhenDone() test cases.<br>
<br>
The first problem is that checkPointerEscape() does not report
"Attempt to free released/non-owned" (see the FIXME in
checkPointerEscape())<br>
<br>
The second one is that checkPointerEscape() removes RefState and
does not store any info that memory is already released, so freeing
released memory by free() is not detected later.<br>
<br>
The first problem can be easily eliminated if the CheckerContext is
passed to checkPointerEscape(), the second one I have not meditated
yet.<br>
<br>
Should we finish with the main patch first or start digging this,
how do you think?<br>
<br>
Waiting for your feedback.<br>
<pre class="moz-signature" cols="72">--
Anton</pre>
</body>
</html>