<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Erik,<div><br></div><div>This is a bug. I opened <a href="http://llvm.org/bugs/show_bug.cgi?id=13974">http://llvm.org/bugs/show_bug.cgi?id=13974</a></div><div><br></div><div>You could use a flag to simplify the code for the analyzer as a workaround:</div><div><div style="margin: 0px; font-size: 11px; font-family: Monaco; "> <span style="color: rgb(147, 26, 104); ">unsigned</span> flag = *argv;</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; "> // use the flag in conditions instead of *argv.</div></div><div><br></div><div>Anna.<br><div><div>On Sep 28, 2012, at 1:29 AM, Erik Cederstrand <<a href="mailto:erik@cederstrand.dk">erik@cederstrand.dk</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">Hi Anna,<br><br>Den 28/09/2012 kl. 08.51 skrev Anna Zaks <<a href="mailto:ganna@apple.com">ganna@apple.com</a>>:<br><br><blockquote type="cite">Erik,<br><br>The analyzer specifically complains about memory allocated by malloc here:<br>196<span class="Apple-tab-span" style="white-space:pre"> </span><span class="Apple-tab-span" style="white-space:pre"> </span><span class="Apple-tab-span" style="white-space:pre"> </span>/* just the filesystems specified on the command line */<br>197<span class="Apple-tab-span" style="white-space:pre"> </span><span class="Apple-tab-span" style="white-space:pre"> </span><span class="Apple-tab-span" style="white-space:pre"> </span>mntbuf = malloc(argc * sizeof(*mntbuf));<br><br>So the call to free could be conditioned on the value of "!*argv" as well.<br></blockquote><br>Thanks for the hint! I tried doing this, but it's still complaining. It seems the analyzer is confused about the value of argv. First, it takes this decision:<br><br><br>191<span class="Apple-tab-span" style="white-space:pre"> </span><span class="Apple-tab-span" style="white-space:pre"> </span>if (!*argv) {<br>2 ← Taking false branch →<br><br><br>So *argv must be evaluated as True. Then it does this:<br><br><br>205<span class="Apple-tab-span" style="white-space:pre"> </span><span class="Apple-tab-span" style="white-space:pre"> </span>for (; *argv; argv++) {<br>6 ← Loop condition is false. Execution continues on line 280 →<br><br><br>Now *argv is evaluated as False, right? I can't see that argv is touched along the way.<br><br><br>Thanks,<br>Erik<br><br><br><blockquote type="cite">On Sep 27, 2012, at 4:21 AM, Erik Cederstrand wrote:<br><br><blockquote type="cite">Den 14/09/2012 kl. 21.15 skrev Eitan Adler <<a href="mailto:lists@eitanadler.com">lists@eitanadler.com</a>>:<br><br><blockquote type="cite">On 14 September 2012 13:54, Anna Zaks <<a href="mailto:ganna@apple.com">ganna@apple.com</a>> wrote:<br><blockquote type="cite">I think it is reasonable to expect the analyzer not to warn in this particular case.<br></blockquote><br>FWIW, I plan to fix this case. But, it would be nice to differentiate<br>the output from a legitimate one.<br></blockquote><br>It turns out it was a bit more complicated than this. The memory pointed to by mntbuf is allocated by getmntinfo() from FreeBSD libc (original report: <a href="http://scan.freebsd.your.org/freebsd-head/bin.df/2012-09-12-amd64/report-WwB2qk.html#EndPath">http://scan.freebsd.your.org/freebsd-head/bin.df/2012-09-12-amd64/report-WwB2qk.html#EndPath</a>). The man page for this function says: "The memory allocated by getmntinfo() cannot be free(3)'d by the application." (<a href="http://www.freebsd.org/cgi/man.cgi?query=getmntinfo">http://www.freebsd.org/cgi/man.cgi?query=getmntinfo</a>).<br><br>I believe the reason for this is that the memory is shared between calls: <a href="http://fxr.watson.org/fxr/source/gen/getmntinfo.c?v=FREEBSD-LIBC">http://fxr.watson.org/fxr/source/gen/getmntinfo.c?v=FREEBSD-LIBC</a><br><br>In this specific case, it should be OK to free the memory anyway since malloc'ed memory only lives for the duration of the application, but someone on the FreeBSD list pointed out that an alternative libc implementation might instead implement getmntinfo() with file-backed mmap, in which case we can't free it.<br><br>I'm uncertain how to proceed here, so I'd like an opinion :-)<br><br>Thanks,<br>Erik<br></blockquote><br></blockquote><br></blockquote></div><br></div></body></html>