[cfe-dev] Memory leak analysis and self destructing objects

[Nikita Zhuk]

On 26.6.2008, at 21.24, Ted Kremenek wrote:

> What would help me with such feedback is to always provide concrete  
> code examples.  These give me a clear idea of what to implement in  
> the static analyzer, and it provides test cases we can put into the  
> test suite.

I was writing you a long reply describing these idioms in more detail  
with some concrete examples, but then I took a look how analyzer  
actually works with an open source project called Adium and I got  
little confused.

Adium contains several classes which use the self-ownership idiom,  
most of them are subclasses of NSWindowController. Each such  
controller object configures, displays and manages input and output of  
a single window. Each controller object is created usually in a class  
method of its own class. Each controller object releases itself later  
at some point (usually when the window or sheet it manages is closed  
by the user).

So I was expecting memory leak warning for each case where such  
controller object gets created. However, analyzer somehow does seem to  
handle those cases correctly.

For example, check:
http://trac.adiumx.com/browser/trunk/Source/AIDockIconSelectionSheet.m#L38

An object of class 'AIDockIconSelectionSheet' is created and stored  
into 'controller' variable. It's then passed to the [NSApp  
beginSheet:...] method. It's not released (or autoreleased)  
explicitly. After user closes the sheet, sheetDidEnd:... callback is  
called by AppKit (line 58), and the controller object created on line  
40 releases itself. Analyzer doesn't report any memory leaks here  
(which is correct, but I actually expected to get false positive here).

However, when I duplicated the whole +  
(void)showDockIconSelectorOnWindow:... method and made it an instance  
method, without any other changes, analyzer did report a memory leak:  
"Object allocated on line 40 and stored into 'controller' is no longer  
referenced after this point and has a retain count of +1 (object  
leaked)".

I tried to reproduce this behavior in a simplified test case (so one  
wouldn't have to build the whole Adium to test this), but there seem  
to be some factors which I'm unaware of which cause memory leak errors  
to be suppressed in Adium but not in my test cases. So what am I  
missing here?

- Nikita