1//== RetainCountDiagnostics.h - Checks for leaks and other issues -*- C++ -*--//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9//  This file defines diagnostics for RetainCountChecker, which implements
10//  a reference count checker for Core Foundation and Cocoa on (Mac OS X).
11//
12//===----------------------------------------------------------------------===//
13
14#ifndef LLVM_CLANG_LIB_STATICANALYZER_CHECKERS_RETAINCOUNTCHECKER_DIAGNOSTICS_H
15#define LLVM_CLANG_LIB_STATICANALYZER_CHECKERS_RETAINCOUNTCHECKER_DIAGNOSTICS_H
16
17#include "clang/Analysis/PathDiagnostic.h"
18#include "clang/Analysis/RetainSummaryManager.h"
19#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
20#include "clang/StaticAnalyzer/Core/BugReporter/BugReporterVisitors.h"
21#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
22
23namespace clang {
24namespace ento {
25namespace retaincountchecker {
26
27class RefCountBug : public BugType {
28public:
29  enum RefCountBugKind {
30    UseAfterRelease,
31    ReleaseNotOwned,
32    DeallocNotOwned,
33    FreeNotOwned,
34    OverAutorelease,
35    ReturnNotOwnedForOwned,
36    LeakWithinFunction,
37    LeakAtReturn,
38  };
39  RefCountBug(CheckerNameRef Checker, RefCountBugKind BT);
40  StringRef getDescription() const;
41
42  RefCountBugKind getBugType() const { return BT; }
43
44private:
45  RefCountBugKind BT;
46  static StringRef bugTypeToName(RefCountBugKind BT);
47};
48
49class RefCountReport : public PathSensitiveBugReport {
50protected:
51  SymbolRef Sym;
52  bool isLeak = false;
53
54public:
55  RefCountReport(const RefCountBug &D, const LangOptions &LOpts,
56              ExplodedNode *n, SymbolRef sym,
57              bool isLeak=false);
58
59  RefCountReport(const RefCountBug &D, const LangOptions &LOpts,
60              ExplodedNode *n, SymbolRef sym,
61              StringRef endText);
62
63  ArrayRef<SourceRange> getRanges() const override {
64    if (!isLeak)
65      return PathSensitiveBugReport::getRanges();
66    return {};
67  }
68};
69
70class RefLeakReport : public RefCountReport {
71  const MemRegion *AllocFirstBinding = nullptr;
72  const MemRegion *AllocBindingToReport = nullptr;
73  const Stmt *AllocStmt = nullptr;
74  PathDiagnosticLocation Location;
75
76  // Finds the function declaration where a leak warning for the parameter
77  // 'sym' should be raised.
78  void deriveParamLocation(CheckerContext &Ctx);
79  // Finds the location where the leaking object is allocated.
80  void deriveAllocLocation(CheckerContext &Ctx);
81  // Produces description of a leak warning which is printed on the console.
82  void createDescription(CheckerContext &Ctx);
83  // Finds the binding that we should use in a leak warning.
84  void findBindingToReport(CheckerContext &Ctx, ExplodedNode *Node);
85
86public:
87  RefLeakReport(const RefCountBug &D, const LangOptions &LOpts, ExplodedNode *n,
88                SymbolRef sym, CheckerContext &Ctx);
89  PathDiagnosticLocation getLocation() const override {
90    assert(Location.isValid());
91    return Location;
92  }
93
94  PathDiagnosticLocation getEndOfPath() const {
95    return PathSensitiveBugReport::getLocation();
96  }
97};
98
99} // end namespace retaincountchecker
100} // end namespace ento
101} // end namespace clang
102
103#endif
104