[PATCH] [analyzer] Detect use-after-free scenarios in -dealloc after calling [super dealloc]

Jordan Rose jordan_rose at apple.com
Thu Sep 4 18:41:03 PDT 2014


Here's an example that won't be caught without at least flow-sensitive analysis:

```
- (void)dealloc {
  if (!_everInitialized) {
    [super dealloc];
    // should return here, but forgot
  }
  carefullyDisposeOfLazyData(self->_lazilyConstructedData);
  [super dealloc];
}
```

In this case I //think// we'll get a double-dealloc warning from the retain-count checker, but even so. Do you think this is worth moving to a path-sensitive model for?

(Also, please make sure you're following the [[ http://llvm.org/docs/CodingStandards.html#name-types-functions-variables-and-enumerators-properly | LLVM naming conventions ]]. The function names and `m_` member names are the offenders, I think.)

http://reviews.llvm.org/D5042






More information about the cfe-commits mailing list