[PATCH] D55092: [analyzer] RetainCountChecker for OSObject model the "free" call

[George Karpenkov via Phabricator via llvm-commits]

This revision was automatically updated to reflect the committed changes.
Closed by commit rL347950: [analyzer] RetainCountChecker for OSObject model the "free" call (authored by george.karpenkov, committed by ).
Herald added a subscriber: llvm-commits.

Changed prior to commit:
  https://reviews.llvm.org/D55092?vs=175989&id=176023#toc

Repository:
  rL LLVM

CHANGES SINCE LAST ACTION
  https://reviews.llvm.org/D55092/new/

https://reviews.llvm.org/D55092

Files:
  cfe/trunk/include/clang/StaticAnalyzer/Core/RetainSummaryManager.h
  cfe/trunk/lib/StaticAnalyzer/Core/RetainSummaryManager.cpp
  cfe/trunk/test/Analysis/osobject-retain-release.cpp


Index: cfe/trunk/lib/StaticAnalyzer/Core/RetainSummaryManager.cpp
===================================================================
--- cfe/trunk/lib/StaticAnalyzer/Core/RetainSummaryManager.cpp
+++ cfe/trunk/lib/StaticAnalyzer/Core/RetainSummaryManager.cpp
@@ -303,6 +303,9 @@
       if (FName == "retain")
         return getOSSummaryRetainRule(FD);
 
+      if (FName == "free")
+        return getOSSummaryFreeRule(FD);
+
       if (MD->getOverloadedOperator() == OO_New)
         return getOSSummaryCreateRule(MD);
     }
@@ -622,6 +625,14 @@
 }
 
 const RetainSummary *
+RetainSummaryManager::getOSSummaryFreeRule(const FunctionDecl *FD) {
+  return getPersistentSummary(RetEffect::MakeNoRet(),
+                              /*ReceiverEff=*/DoNothing,
+                              /*DefaultEff=*/DoNothing,
+                              /*ThisEff=*/Dealloc);
+}
+
+const RetainSummary *
 RetainSummaryManager::getOSSummaryCreateRule(const FunctionDecl *FD) {
   return getPersistentSummary(RetEffect::MakeOwned(RetEffect::OS));
 }
Index: cfe/trunk/include/clang/StaticAnalyzer/Core/RetainSummaryManager.h
===================================================================
--- cfe/trunk/include/clang/StaticAnalyzer/Core/RetainSummaryManager.h
+++ cfe/trunk/include/clang/StaticAnalyzer/Core/RetainSummaryManager.h
@@ -530,6 +530,8 @@
   /// Decrement the reference count on OS object.
   const RetainSummary *getOSSummaryReleaseRule(const FunctionDecl *FD);
 
+  /// Free the OS object.
+  const RetainSummary *getOSSummaryFreeRule(const FunctionDecl *FD);
 
   enum UnaryFuncKind { cfretain, cfrelease, cfautorelease, cfmakecollectable };
 
Index: cfe/trunk/test/Analysis/osobject-retain-release.cpp
===================================================================
--- cfe/trunk/test/Analysis/osobject-retain-release.cpp
+++ cfe/trunk/test/Analysis/osobject-retain-release.cpp
@@ -14,6 +14,7 @@
 struct OSObject {
   virtual void retain();
   virtual void release() {};
+  virtual void free();
   virtual ~OSObject(){}
 
   unsigned int foo() { return 42; }
@@ -65,6 +66,22 @@
   static OSObject *safeMetaCast(const OSObject *inst, const OSMetaClass *meta);
 };
 
+void check_free_no_error() {
+  OSArray *arr = OSArray::withCapacity(10);
+  arr->retain();
+  arr->retain();
+  arr->retain();
+  arr->free();
+}
+
+void check_free_use_after_free() {
+  OSArray *arr = OSArray::withCapacity(10); // expected-note{{Call to function 'OSArray::withCapacity' returns an OSObject of type struct OSArray * with a +1 retain count}}
+  arr->retain(); // expected-note{{Reference count incremented. The object now has a +2 retain count}}
+  arr->free(); // expected-note{{Object released}}
+  arr->retain(); // expected-warning{{Reference-counted object is used after it is released}}
+                 // expected-note at -1{{Reference-counted object is used after it is released}}
+}
+
 unsigned int check_leak_explicit_new() {
   OSArray *arr = new OSArray; // expected-note{{Operator new returns an OSObject of type struct OSArray * with a +1 retain count}}
   return arr->getCount(); // expected-note{{Object leaked: allocated object of type struct OSArray * is not referenced later in this execution path and has a retain count of +1}}


-------------- next part --------------
A non-text attachment was scrubbed...
Name: D55092.176023.patch
Type: text/x-patch
Size: 3246 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20181130/ad7ee40b/attachment.bin>