<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Hello llvm,<div><br></div><div>I am a first year PhD student at "Politehnica" University of Timisoara, Romania. I am a part of the LOOSE Research group (<a href="http://www.loose.upt.ro">http://www.loose.upt.ro</a>) and until now I have been involved in several research projects in reverse-engineering object oriented software. </div><div><br></div><div>Currently I am using llvm to statically check C/C++ programs for memory leaks. What I have until now is a llvm FunctionPass that tries to find a CFG path from each malloc or new to a corresponding free or delete. This is achieved by first doing a quick intra-procedural search for leaking paths and then inter-procedurally double checking the results. Further improvements would include a path viability check with a solver and some shape analysis. </div><div><br></div><div>This summer however, I plan to create an "optimization" that automatically fixes memory leaks in programs - obviously only those that can be fixed with the available information, for example:</div><div><br></div><div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 10px/normal Monaco; "><span style="color: #aa0d91">int</span> addAndFree(<span style="color: #aa0d91">int</span> *<span style="color: #3f6e74">x</span>, <span style="color: #aa0d91">int</span> <span style="color: #3f6e74">y</span>) {</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 10px/normal Monaco; "><span class="Apple-tab-span" style="white-space:pre"> </span><span style="color: #3f6e74">y</span> += *<span style="color: #3f6e74">x</span>; <span style="color: #2e0d6e">free</span>(<span style="color: #3f6e74">x</span>);</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 10px/normal Monaco; color: rgb(170, 13, 145); "><span style="color: #000000"><span class="Apple-tab-span" style="white-space:pre"> </span></span>return<span style="color: #000000"> </span><span style="color: #3f6e74">y</span><span style="color: #000000">;</span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 10px/normal Monaco; ">}</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 10px/normal Monaco; min-height: 14px; "><br></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 10px/normal Monaco; "><span style="color: #aa0d91">int</span> functionCalled10MTimesInSomeLoop(<span style="color: #aa0d91">int</span> <span style="color: #3f6e74">index</span>, <span style="color: #aa0d91">int</span> <span style="color: #3f6e74">data</span>[]) {</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 10px/normal Monaco; color: rgb(170, 13, 145); "><span style="color: #000000"><span class="Apple-tab-span" style="white-space:pre"> </span></span>int<span style="color: #000000"> *</span><span style="color: #3f6e74">x</span><span style="color: #000000"> = (</span>int<span style="color: #000000">*)</span><span style="color: #2e0d6e">malloc</span><span style="color: #000000">(</span>sizeof<span style="color: #000000">(</span>int<span style="color: #000000">));</span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 10px/normal Monaco; color: rgb(0, 116, 0); "><span style="color: #000000"><span class="Apple-tab-span" style="white-space:pre"> </span></span><span style="color: #aa0d91">if</span><span style="color: #000000">(</span><span style="color: #3f6e74">index</span><span style="color: #000000"> < </span><span style="color: #1c00cf">3</span><span style="color: #000000">) { </span>// do stuff with x, index and data</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 10px/normal Monaco; color: rgb(63, 110, 116); "><span style="color: #000000"><span class="Apple-tab-span" style="white-space:pre"> </span>*</span>x<span style="color: #000000"> = </span>data<span style="color: #000000">[</span>index<span style="color: #000000">];</span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 10px/normal Monaco; "><span class="Apple-tab-span" style="white-space:pre"> </span><span style="color: #aa0d91">return</span> addAndFree(<span style="color: #3f6e74">x</span>,<span style="color: #3f6e74">index</span>);</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 10px/normal Monaco; color: rgb(170, 13, 145); "><span style="color: #000000"><span class="Apple-tab-span" style="white-space:pre"> </span>} </span>else</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 10px/normal Monaco; color: rgb(170, 13, 145); "><span style="color: #000000"><span class="Apple-tab-span" style="white-space:pre"> </span></span>return<span style="color: #000000"> -</span><span style="color: #1c00cf">1</span><span style="color: #000000">;</span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 10px/normal Monaco; ">}</div><div><font class="Apple-style-span" face="Monaco" size="2"><span class="Apple-style-span" style="font-size: 10px;"><br></span></font></div></div><div>the function would not leak if that free instruction was copied in bb2: before <span class="Apple-style-span" style="color: rgb(170, 13, 145); font-family: Monaco; font-size: 10px; ">ret</span> (see bellow: -O4 version of above)</div><div><br></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 10px/normal Monaco; "><span style="color: #aa0d91">define</span> <span style="color: #aa0d91">i32</span> @_Z32functionCalled10MTimesInSomeLoopiPi(<span style="color: #aa0d91">i32</span> %index, <span style="color: #aa0d91">i32</span>* nocapture %data) <span style="color: #aa0d91">nounwind</span> {</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 10px/normal Monaco; ">entry:</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 10px/normal Monaco; color: rgb(0, 116, 0); "><span style="color: #000000"><span class="Apple-tab-span" style="white-space:pre"> </span>%0 = </span><span style="color: #aa0d91">malloc</span><span style="color: #000000"> </span><span style="color: #aa0d91">i32</span><span style="color: #000000"><span class="Apple-tab-span" style="white-space:pre"> </span></span>; <i32*> [#uses=1]</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 10px/normal Monaco; "><span class="Apple-tab-span" style="white-space:pre"> </span>%1 = <span style="color: #aa0d91">icmp</span> <span style="color: #aa0d91">sgt</span> <span style="color: #aa0d91">i32</span> %index, <span style="color: #1c00cf">2</span><span class="Apple-tab-span" style="white-space:pre"> </span><span style="color: #007400">; <i1> [#uses=1]</span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 10px/normal Monaco; "><span class="Apple-tab-span" style="white-space:pre"> </span><span style="color: #aa0d91">br</span> <span style="color: #aa0d91">i1</span> %1, <span style="color: #aa0d91">label</span> %bb2, <span style="color: #aa0d91">label</span> %bb</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 10px/normal Monaco; min-height: 14px; "><br></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 10px/normal Monaco; color: rgb(0, 116, 0); "><span style="color: #000000">bb:<span class="Apple-tab-span" style="white-space:pre"> </span></span>; preds = %entry</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 10px/normal Monaco; "><span class="Apple-tab-span" style="white-space:pre"> </span>%2 = <span style="color: #aa0d91">getelementptr</span> <span style="color: #aa0d91">i32</span>* %data, <span style="color: #aa0d91">i32</span> %index<span class="Apple-tab-span" style="white-space:pre"> </span><span style="color: #007400">; <i32*> [#uses=1]</span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 10px/normal Monaco; color: rgb(0, 116, 0); "><span style="color: #000000"><span class="Apple-tab-span" style="white-space:pre"> </span>%3 = </span><span style="color: #aa0d91">load</span><span style="color: #000000"> </span><span style="color: #aa0d91">i32</span><span style="color: #000000">* %2, </span><span style="color: #aa0d91">align</span><span style="color: #000000"> </span><span style="color: #1c00cf">4</span><span style="color: #000000"><span class="Apple-tab-span" style="white-space:pre"> </span></span>; <i32> [#uses=1]</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 10px/normal Monaco; "><span class="Apple-tab-span" style="white-space:pre"> </span>%4 = <span style="color: #aa0d91">add</span> <span style="color: #aa0d91">i32</span> %3, %index<span class="Apple-tab-span" style="white-space:pre"> </span><span style="color: #007400">; <i32> [#uses=1]</span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 10px/normal Monaco; color: rgb(170, 13, 145); "><span style="color: #000000"><span class="Apple-tab-span" style="white-space:pre"> </span></span>free<span style="color: #000000"> </span>i32<span style="color: #000000">* %0</span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 10px/normal Monaco; color: rgb(170, 13, 145); "><span style="color: #000000"><span class="Apple-tab-span" style="white-space:pre"> </span></span>ret<span style="color: #000000"> </span>i32<span style="color: #000000"> %4</span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 10px/normal Monaco; min-height: 14px; "><br></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 10px/normal Monaco; color: rgb(0, 116, 0); "><span style="color: #000000">bb2:<span class="Apple-tab-span" style="white-space:pre"> </span></span>; preds = %entry</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 10px/normal Monaco; color: rgb(0, 116, 0); "><span class="Apple-tab-span" style="white-space:pre"> </span>; would be nice to insert: <span class="Apple-style-span" style="color: rgb(170, 13, 145); ">free<span style="color: rgb(0, 0, 0); "> </span>i32<span style="color: rgb(0, 0, 0); ">* %0 <span class="Apple-style-span" style="color: rgb(0, 116, 0); ">; here</span></span></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 10px/normal Monaco; color: rgb(170, 13, 145); "><span style="color: #000000"><span class="Apple-tab-span" style="white-space:pre"> </span></span>ret<span style="color: #000000"> </span>i32<span style="color: #000000"> -</span><span style="color: #1c00cf">1</span></div><div><span class="Apple-style-span" style="font-family: Monaco; font-size: 10px; ">}</span></div><div><br></div><div>So seeing as this is not on the open projects list, is it even worth applying for SummerOfCode? </div><div><br></div><div>best wishes,</div><div><br></div><div>Mihai.</div></body></html>