[cfe-dev] Memory leak analysis and self destructing objects

[Ted Kremenek]

On Jun 28, 2008, at 9:11 AM, Nikita Zhuk wrote:

> On 26.6.2008, at 21.24, Ted Kremenek wrote:
>
>> What would help me with such feedback is to always provide concrete  
>> code examples.  These give me a clear idea of what to implement in  
>> the static analyzer, and it provides test cases we can put into the  
>> test suite.
>
> I was writing you a long reply describing these idioms in more  
> detail with some concrete examples, but then I took a look how  
> analyzer actually works with an open source project called Adium and  
> I got little confused.
>
> Adium contains several classes which use the self-ownership idiom,  
> most of them are subclasses of NSWindowController. Each such  
> controller object configures, displays and manages input and output  
> of a single window. Each controller object is created usually in a  
> class method of its own class. Each controller object releases  
> itself later at some point (usually when the window or sheet it  
> manages is closed by the user).
>
> So I was expecting memory leak warning for each case where such  
> controller object gets created. However, analyzer somehow does seem  
> to handle those cases correctly.
>
> For example, check:
> http://trac.adiumx.com/browser/trunk/Source/AIDockIconSelectionSheet.m#L38
>
> An object of class 'AIDockIconSelectionSheet' is created and stored  
> into 'controller' variable. It's then passed to the [NSApp  
> beginSheet:...] method. It's not released (or autoreleased)  
> explicitly. After user closes the sheet, sheetDidEnd:... callback is  
> called by AppKit (line 58), and the controller object created on  
> line 40 releases itself. Analyzer doesn't report any memory leaks  
> here (which is correct, but I actually expected to get false  
> positive here).
>
> However, when I duplicated the whole +  
> (void)showDockIconSelectorOnWindow:... method and made it an  
> instance method, without any other changes, analyzer did report a  
> memory leak: "Object allocated on line 40 and stored into  
> 'controller' is no longer referenced after this point and has a  
> retain count of +1 (object leaked)".
>
> I tried to reproduce this behavior in a simplified test case (so one  
> wouldn't have to build the whole Adium to test this), but there seem  
> to be some factors which I'm unaware of which cause memory leak  
> errors to be suppressed in Adium but not in my test cases. So what  
> am I missing here?

Hi Nikita,

Thanks for the excellent example.  I'm not going to get a chance to  
look at it until next week, but the first thing I am going to do is  
verify why the analyzer is not emitting a warning when  
showDockIconSelectorOnWindow:... is a class method versus when it is  
an instance method.  The analyzer appearing to "get it right" in some  
cases could just be it not tracking an allocation correctly (or even a  
bug in Clang), or something else that I'm not remembering off the top  
of my head.  Once I investigate this a little further I'll follow up  
again on this message.

Thanks again.

Ted
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/cfe-dev/attachments/20080628/4f9bd9ec/attachment.html>