1//==- CheckObjCDealloc.cpp - Check ObjC -dealloc implementation --*- C++ -*-==//
2//
3//                     The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10//  This file defines a CheckObjCDealloc, a checker that
11//  analyzes an Objective-C class's implementation to determine if it
12//  correctly implements -dealloc.
13//
14//===----------------------------------------------------------------------===//
15
16#include "ClangSACheckers.h"
17#include "clang/AST/Attr.h"
18#include "clang/AST/DeclObjC.h"
19#include "clang/AST/Expr.h"
20#include "clang/AST/ExprObjC.h"
21#include "clang/Basic/LangOptions.h"
22#include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
23#include "clang/StaticAnalyzer/Core/BugReporter/PathDiagnostic.h"
24#include "clang/StaticAnalyzer/Core/Checker.h"
25#include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
26#include "llvm/Support/raw_ostream.h"
27
28using namespace clang;
29using namespace ento;
30
31static bool scan_dealloc(Stmt *S, Selector Dealloc) {
32
33  if (ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(S))
34    if (ME->getSelector() == Dealloc) {
35      switch (ME->getReceiverKind()) {
36      case ObjCMessageExpr::Instance: return false;
37      case ObjCMessageExpr::SuperInstance: return true;
38      case ObjCMessageExpr::Class: break;
39      case ObjCMessageExpr::SuperClass: break;
40      }
41    }
42
43  // Recurse to children.
44
45  for (Stmt::child_iterator I = S->child_begin(), E= S->child_end(); I!=E; ++I)
46    if (*I && scan_dealloc(*I, Dealloc))
47      return true;
48
49  return false;
50}
51
52static bool scan_ivar_release(Stmt *S, ObjCIvarDecl *ID,
53                              const ObjCPropertyDecl *PD,
54                              Selector Release,
55                              IdentifierInfo* SelfII,
56                              ASTContext &Ctx) {
57
58  // [mMyIvar release]
59  if (ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(S))
60    if (ME->getSelector() == Release)
61      if (ME->getInstanceReceiver())
62        if (Expr *Receiver = ME->getInstanceReceiver()->IgnoreParenCasts())
63          if (ObjCIvarRefExpr *E = dyn_cast<ObjCIvarRefExpr>(Receiver))
64            if (E->getDecl() == ID)
65              return true;
66
67  // [self setMyIvar:nil];
68  if (ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(S))
69    if (ME->getInstanceReceiver())
70      if (Expr *Receiver = ME->getInstanceReceiver()->IgnoreParenCasts())
71        if (DeclRefExpr *E = dyn_cast<DeclRefExpr>(Receiver))
72          if (E->getDecl()->getIdentifier() == SelfII)
73            if (ME->getMethodDecl() == PD->getSetterMethodDecl() &&
74                ME->getNumArgs() == 1 &&
75                ME->getArg(0)->isNullPointerConstant(Ctx,
76                                              Expr::NPC_ValueDependentIsNull))
77              return true;
78
79  // self.myIvar = nil;
80  if (BinaryOperator* BO = dyn_cast<BinaryOperator>(S))
81    if (BO->isAssignmentOp())
82      if (ObjCPropertyRefExpr *PRE =
83           dyn_cast<ObjCPropertyRefExpr>(BO->getLHS()->IgnoreParenCasts()))
84        if (PRE->isExplicitProperty() && PRE->getExplicitProperty() == PD)
85            if (BO->getRHS()->isNullPointerConstant(Ctx,
86                                            Expr::NPC_ValueDependentIsNull)) {
87              // This is only a 'release' if the property kind is not
88              // 'assign'.
89              return PD->getSetterKind() != ObjCPropertyDecl::Assign;
90            }
91
92  // Recurse to children.
93  for (Stmt::child_iterator I = S->child_begin(), E= S->child_end(); I!=E; ++I)
94    if (*I && scan_ivar_release(*I, ID, PD, Release, SelfII, Ctx))
95      return true;
96
97  return false;
98}
99
100static void checkObjCDealloc(const ObjCImplementationDecl *D,
101                             const LangOptions& LOpts, BugReporter& BR) {
102
103  assert (LOpts.getGC() != LangOptions::GCOnly);
104
105  ASTContext &Ctx = BR.getContext();
106  const ObjCInterfaceDecl *ID = D->getClassInterface();
107
108  // Does the class contain any ivars that are pointers (or id<...>)?
109  // If not, skip the check entirely.
110  // NOTE: This is motivated by PR 2517:
111  //        http://llvm.org/bugs/show_bug.cgi?id=2517
112
113  bool containsPointerIvar = false;
114
115  for (ObjCInterfaceDecl::ivar_iterator I=ID->ivar_begin(), E=ID->ivar_end();
116       I!=E; ++I) {
117
118    ObjCIvarDecl *ID = *I;
119    QualType T = ID->getType();
120
121    if (!T->isObjCObjectPointerType() ||
122        ID->getAttr<IBOutletAttr>() || // Skip IBOutlets.
123        ID->getAttr<IBOutletCollectionAttr>()) // Skip IBOutletCollections.
124      continue;
125
126    containsPointerIvar = true;
127    break;
128  }
129
130  if (!containsPointerIvar)
131    return;
132
133  // Determine if the class subclasses NSObject.
134  IdentifierInfo* NSObjectII = &Ctx.Idents.get("NSObject");
135  IdentifierInfo* SenTestCaseII = &Ctx.Idents.get("SenTestCase");
136
137
138  for ( ; ID ; ID = ID->getSuperClass()) {
139    IdentifierInfo *II = ID->getIdentifier();
140
141    if (II == NSObjectII)
142      break;
143
144    // FIXME: For now, ignore classes that subclass SenTestCase, as these don't
145    // need to implement -dealloc.  They implement tear down in another way,
146    // which we should try and catch later.
147    //  http://llvm.org/bugs/show_bug.cgi?id=3187
148    if (II == SenTestCaseII)
149      return;
150  }
151
152  if (!ID)
153    return;
154
155  // Get the "dealloc" selector.
156  IdentifierInfo* II = &Ctx.Idents.get("dealloc");
157  Selector S = Ctx.Selectors.getSelector(0, &II);
158  ObjCMethodDecl *MD = 0;
159
160  // Scan the instance methods for "dealloc".
161  for (ObjCImplementationDecl::instmeth_iterator I = D->instmeth_begin(),
162       E = D->instmeth_end(); I!=E; ++I) {
163
164    if ((*I)->getSelector() == S) {
165      MD = *I;
166      break;
167    }
168  }
169
170  PathDiagnosticLocation DLoc =
171    PathDiagnosticLocation::createBegin(D, BR.getSourceManager());
172
173  if (!MD) { // No dealloc found.
174
175    const char* name = LOpts.getGC() == LangOptions::NonGC
176                       ? "missing -dealloc"
177                       : "missing -dealloc (Hybrid MM, non-GC)";
178
179    std::string buf;
180    llvm::raw_string_ostream os(buf);
181    os << "Objective-C class '" << *D << "' lacks a 'dealloc' instance method";
182
183    BR.EmitBasicReport(D, name, categories::CoreFoundationObjectiveC,
184                       os.str(), DLoc);
185    return;
186  }
187
188  // dealloc found.  Scan for missing [super dealloc].
189  if (MD->getBody() && !scan_dealloc(MD->getBody(), S)) {
190
191    const char* name = LOpts.getGC() == LangOptions::NonGC
192                       ? "missing [super dealloc]"
193                       : "missing [super dealloc] (Hybrid MM, non-GC)";
194
195    std::string buf;
196    llvm::raw_string_ostream os(buf);
197    os << "The 'dealloc' instance method in Objective-C class '" << *D
198       << "' does not send a 'dealloc' message to its super class"
199           " (missing [super dealloc])";
200
201    BR.EmitBasicReport(MD, name, categories::CoreFoundationObjectiveC,
202                       os.str(), DLoc);
203    return;
204  }
205
206  // Get the "release" selector.
207  IdentifierInfo* RII = &Ctx.Idents.get("release");
208  Selector RS = Ctx.Selectors.getSelector(0, &RII);
209
210  // Get the "self" identifier
211  IdentifierInfo* SelfII = &Ctx.Idents.get("self");
212
213  // Scan for missing and extra releases of ivars used by implementations
214  // of synthesized properties
215  for (ObjCImplementationDecl::propimpl_iterator I = D->propimpl_begin(),
216       E = D->propimpl_end(); I!=E; ++I) {
217
218    // We can only check the synthesized properties
219    if (I->getPropertyImplementation() != ObjCPropertyImplDecl::Synthesize)
220      continue;
221
222    ObjCIvarDecl *ID = I->getPropertyIvarDecl();
223    if (!ID)
224      continue;
225
226    QualType T = ID->getType();
227    if (!T->isObjCObjectPointerType()) // Skip non-pointer ivars
228      continue;
229
230    const ObjCPropertyDecl *PD = I->getPropertyDecl();
231    if (!PD)
232      continue;
233
234    // ivars cannot be set via read-only properties, so we'll skip them
235    if (PD->isReadOnly())
236      continue;
237
238    // ivar must be released if and only if the kind of setter was not 'assign'
239    bool requiresRelease = PD->getSetterKind() != ObjCPropertyDecl::Assign;
240    if (scan_ivar_release(MD->getBody(), ID, PD, RS, SelfII, Ctx)
241       != requiresRelease) {
242      const char *name = 0;
243      std::string buf;
244      llvm::raw_string_ostream os(buf);
245
246      if (requiresRelease) {
247        name = LOpts.getGC() == LangOptions::NonGC
248               ? "missing ivar release (leak)"
249               : "missing ivar release (Hybrid MM, non-GC)";
250
251        os << "The '" << *ID
252           << "' instance variable was retained by a synthesized property but "
253              "wasn't released in 'dealloc'";
254      } else {
255        name = LOpts.getGC() == LangOptions::NonGC
256               ? "extra ivar release (use-after-release)"
257               : "extra ivar release (Hybrid MM, non-GC)";
258
259        os << "The '" << *ID
260           << "' instance variable was not retained by a synthesized property "
261              "but was released in 'dealloc'";
262      }
263
264      PathDiagnosticLocation SDLoc =
265        PathDiagnosticLocation::createBegin(*I, BR.getSourceManager());
266
267      BR.EmitBasicReport(MD, name, categories::CoreFoundationObjectiveC,
268                         os.str(), SDLoc);
269    }
270  }
271}
272
273//===----------------------------------------------------------------------===//
274// ObjCDeallocChecker
275//===----------------------------------------------------------------------===//
276
277namespace {
278class ObjCDeallocChecker : public Checker<
279                                      check::ASTDecl<ObjCImplementationDecl> > {
280public:
281  void checkASTDecl(const ObjCImplementationDecl *D, AnalysisManager& mgr,
282                    BugReporter &BR) const {
283    if (mgr.getLangOpts().getGC() == LangOptions::GCOnly)
284      return;
285    checkObjCDealloc(cast<ObjCImplementationDecl>(D), mgr.getLangOpts(), BR);
286  }
287};
288}
289
290void ento::registerObjCDeallocChecker(CheckerManager &mgr) {
291  mgr.registerChecker<ObjCDeallocChecker>();
292}
293