1 //== RetainSummaryManager.cpp - Summaries for reference counting --*- C++ -*--//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 //  This file defines summaries implementation for retain counting, which
10 //  implements a reference count checker for Core Foundation, Cocoa
11 //  and OSObject (on Mac OS X).
12 //
13 //===----------------------------------------------------------------------===//
14 
15 #include "clang/Analysis/DomainSpecific/CocoaConventions.h"
16 #include "clang/Analysis/RetainSummaryManager.h"
17 #include "clang/AST/Attr.h"
18 #include "clang/AST/DeclCXX.h"
19 #include "clang/AST/DeclObjC.h"
20 #include "clang/AST/ParentMap.h"
21 #include "clang/ASTMatchers/ASTMatchFinder.h"
22 
23 using namespace clang;
24 using namespace ento;
25 
26 template <class T>
isOneOf()27 constexpr static bool isOneOf() {
28   return false;
29 }
30 
31 /// Helper function to check whether the class is one of the
32 /// rest of varargs.
33 template <class T, class P, class... ToCompare>
isOneOf()34 constexpr static bool isOneOf() {
35   return std::is_same<T, P>::value || isOneOf<T, ToCompare...>();
36 }
37 
38 namespace {
39 
40 /// Fake attribute class for RC* attributes.
41 struct GeneralizedReturnsRetainedAttr {
classof__anonae875c3f0111::GeneralizedReturnsRetainedAttr42   static bool classof(const Attr *A) {
43     if (auto AA = dyn_cast<AnnotateAttr>(A))
44       return AA->getAnnotation() == "rc_ownership_returns_retained";
45     return false;
46   }
47 };
48 
49 struct GeneralizedReturnsNotRetainedAttr {
classof__anonae875c3f0111::GeneralizedReturnsNotRetainedAttr50   static bool classof(const Attr *A) {
51     if (auto AA = dyn_cast<AnnotateAttr>(A))
52       return AA->getAnnotation() == "rc_ownership_returns_not_retained";
53     return false;
54   }
55 };
56 
57 struct GeneralizedConsumedAttr {
classof__anonae875c3f0111::GeneralizedConsumedAttr58   static bool classof(const Attr *A) {
59     if (auto AA = dyn_cast<AnnotateAttr>(A))
60       return AA->getAnnotation() == "rc_ownership_consumed";
61     return false;
62   }
63 };
64 
65 }
66 
67 template <class T>
hasAnyEnabledAttrOf(const Decl * D,QualType QT)68 Optional<ObjKind> RetainSummaryManager::hasAnyEnabledAttrOf(const Decl *D,
69                                                             QualType QT) {
70   ObjKind K;
71   if (isOneOf<T, CFConsumedAttr, CFReturnsRetainedAttr,
72               CFReturnsNotRetainedAttr>()) {
73     if (!TrackObjCAndCFObjects)
74       return None;
75 
76     K = ObjKind::CF;
77   } else if (isOneOf<T, NSConsumedAttr, NSConsumesSelfAttr,
78                      NSReturnsAutoreleasedAttr, NSReturnsRetainedAttr,
79                      NSReturnsNotRetainedAttr, NSConsumesSelfAttr>()) {
80 
81     if (!TrackObjCAndCFObjects)
82       return None;
83 
84     if (isOneOf<T, NSReturnsRetainedAttr, NSReturnsAutoreleasedAttr,
85                 NSReturnsNotRetainedAttr>() &&
86         !cocoa::isCocoaObjectRef(QT))
87       return None;
88     K = ObjKind::ObjC;
89   } else if (isOneOf<T, OSConsumedAttr, OSConsumesThisAttr,
90                      OSReturnsNotRetainedAttr, OSReturnsRetainedAttr,
91                      OSReturnsRetainedOnZeroAttr,
92                      OSReturnsRetainedOnNonZeroAttr>()) {
93     if (!TrackOSObjects)
94       return None;
95     K = ObjKind::OS;
96   } else if (isOneOf<T, GeneralizedReturnsNotRetainedAttr,
97                      GeneralizedReturnsRetainedAttr,
98                      GeneralizedConsumedAttr>()) {
99     K = ObjKind::Generalized;
100   } else {
101     llvm_unreachable("Unexpected attribute");
102   }
103   if (D->hasAttr<T>())
104     return K;
105   return None;
106 }
107 
108 template <class T1, class T2, class... Others>
hasAnyEnabledAttrOf(const Decl * D,QualType QT)109 Optional<ObjKind> RetainSummaryManager::hasAnyEnabledAttrOf(const Decl *D,
110                                                             QualType QT) {
111   if (auto Out = hasAnyEnabledAttrOf<T1>(D, QT))
112     return Out;
113   return hasAnyEnabledAttrOf<T2, Others...>(D, QT);
114 }
115 
116 const RetainSummary *
getPersistentSummary(const RetainSummary & OldSumm)117 RetainSummaryManager::getPersistentSummary(const RetainSummary &OldSumm) {
118   // Unique "simple" summaries -- those without ArgEffects.
119   if (OldSumm.isSimple()) {
120     ::llvm::FoldingSetNodeID ID;
121     OldSumm.Profile(ID);
122 
123     void *Pos;
124     CachedSummaryNode *N = SimpleSummaries.FindNodeOrInsertPos(ID, Pos);
125 
126     if (!N) {
127       N = (CachedSummaryNode *) BPAlloc.Allocate<CachedSummaryNode>();
128       new (N) CachedSummaryNode(OldSumm);
129       SimpleSummaries.InsertNode(N, Pos);
130     }
131 
132     return &N->getValue();
133   }
134 
135   RetainSummary *Summ = (RetainSummary *) BPAlloc.Allocate<RetainSummary>();
136   new (Summ) RetainSummary(OldSumm);
137   return Summ;
138 }
139 
isSubclass(const Decl * D,StringRef ClassName)140 static bool isSubclass(const Decl *D,
141                        StringRef ClassName) {
142   using namespace ast_matchers;
143   DeclarationMatcher SubclassM =
144       cxxRecordDecl(isSameOrDerivedFrom(std::string(ClassName)));
145   return !(match(SubclassM, *D, D->getASTContext()).empty());
146 }
147 
isExactClass(const Decl * D,StringRef ClassName)148 static bool isExactClass(const Decl *D, StringRef ClassName) {
149   using namespace ast_matchers;
150   DeclarationMatcher sameClassM =
151       cxxRecordDecl(hasName(std::string(ClassName)));
152   return !(match(sameClassM, *D, D->getASTContext()).empty());
153 }
154 
isOSObjectSubclass(const Decl * D)155 static bool isOSObjectSubclass(const Decl *D) {
156   return D && isSubclass(D, "OSMetaClassBase") &&
157          !isExactClass(D, "OSMetaClass");
158 }
159 
isOSObjectDynamicCast(StringRef S)160 static bool isOSObjectDynamicCast(StringRef S) { return S == "safeMetaCast"; }
161 
isOSObjectRequiredCast(StringRef S)162 static bool isOSObjectRequiredCast(StringRef S) {
163   return S == "requiredMetaCast";
164 }
165 
isOSObjectThisCast(StringRef S)166 static bool isOSObjectThisCast(StringRef S) {
167   return S == "metaCast";
168 }
169 
170 
isOSObjectPtr(QualType QT)171 static bool isOSObjectPtr(QualType QT) {
172   return isOSObjectSubclass(QT->getPointeeCXXRecordDecl());
173 }
174 
isISLObjectRef(QualType Ty)175 static bool isISLObjectRef(QualType Ty) {
176   return StringRef(Ty.getAsString()).startswith("isl_");
177 }
178 
isOSIteratorSubclass(const Decl * D)179 static bool isOSIteratorSubclass(const Decl *D) {
180   return isSubclass(D, "OSIterator");
181 }
182 
hasRCAnnotation(const Decl * D,StringRef rcAnnotation)183 static bool hasRCAnnotation(const Decl *D, StringRef rcAnnotation) {
184   for (const auto *Ann : D->specific_attrs<AnnotateAttr>()) {
185     if (Ann->getAnnotation() == rcAnnotation)
186       return true;
187   }
188   return false;
189 }
190 
isRetain(const FunctionDecl * FD,StringRef FName)191 static bool isRetain(const FunctionDecl *FD, StringRef FName) {
192   return FName.startswith_insensitive("retain") ||
193          FName.endswith_insensitive("retain");
194 }
195 
isRelease(const FunctionDecl * FD,StringRef FName)196 static bool isRelease(const FunctionDecl *FD, StringRef FName) {
197   return FName.startswith_insensitive("release") ||
198          FName.endswith_insensitive("release");
199 }
200 
isAutorelease(const FunctionDecl * FD,StringRef FName)201 static bool isAutorelease(const FunctionDecl *FD, StringRef FName) {
202   return FName.startswith_insensitive("autorelease") ||
203          FName.endswith_insensitive("autorelease");
204 }
205 
isMakeCollectable(StringRef FName)206 static bool isMakeCollectable(StringRef FName) {
207   return FName.contains_insensitive("MakeCollectable");
208 }
209 
210 /// A function is OSObject related if it is declared on a subclass
211 /// of OSObject, or any of the parameters is a subclass of an OSObject.
isOSObjectRelated(const CXXMethodDecl * MD)212 static bool isOSObjectRelated(const CXXMethodDecl *MD) {
213   if (isOSObjectSubclass(MD->getParent()))
214     return true;
215 
216   for (ParmVarDecl *Param : MD->parameters()) {
217     QualType PT = Param->getType()->getPointeeType();
218     if (!PT.isNull())
219       if (CXXRecordDecl *RD = PT->getAsCXXRecordDecl())
220         if (isOSObjectSubclass(RD))
221           return true;
222   }
223 
224   return false;
225 }
226 
227 bool
isKnownSmartPointer(QualType QT)228 RetainSummaryManager::isKnownSmartPointer(QualType QT) {
229   QT = QT.getCanonicalType();
230   const auto *RD = QT->getAsCXXRecordDecl();
231   if (!RD)
232     return false;
233   const IdentifierInfo *II = RD->getIdentifier();
234   if (II && II->getName() == "smart_ptr")
235     if (const auto *ND = dyn_cast<NamespaceDecl>(RD->getDeclContext()))
236       if (ND->getNameAsString() == "os")
237         return true;
238   return false;
239 }
240 
241 const RetainSummary *
getSummaryForOSObject(const FunctionDecl * FD,StringRef FName,QualType RetTy)242 RetainSummaryManager::getSummaryForOSObject(const FunctionDecl *FD,
243                                             StringRef FName, QualType RetTy) {
244   assert(TrackOSObjects &&
245          "Requesting a summary for an OSObject but OSObjects are not tracked");
246 
247   if (RetTy->isPointerType()) {
248     const CXXRecordDecl *PD = RetTy->getPointeeType()->getAsCXXRecordDecl();
249     if (PD && isOSObjectSubclass(PD)) {
250       if (isOSObjectDynamicCast(FName) || isOSObjectRequiredCast(FName) ||
251           isOSObjectThisCast(FName))
252         return getDefaultSummary();
253 
254       // TODO: Add support for the slightly common *Matching(table) idiom.
255       // Cf. IOService::nameMatching() etc. - these function have an unusual
256       // contract of returning at +0 or +1 depending on their last argument.
257       if (FName.endswith("Matching")) {
258         return getPersistentStopSummary();
259       }
260 
261       // All objects returned with functions *not* starting with 'get',
262       // or iterators, are returned at +1.
263       if ((!FName.startswith("get") && !FName.startswith("Get")) ||
264           isOSIteratorSubclass(PD)) {
265         return getOSSummaryCreateRule(FD);
266       } else {
267         return getOSSummaryGetRule(FD);
268       }
269     }
270   }
271 
272   if (const auto *MD = dyn_cast<CXXMethodDecl>(FD)) {
273     const CXXRecordDecl *Parent = MD->getParent();
274     if (Parent && isOSObjectSubclass(Parent)) {
275       if (FName == "release" || FName == "taggedRelease")
276         return getOSSummaryReleaseRule(FD);
277 
278       if (FName == "retain" || FName == "taggedRetain")
279         return getOSSummaryRetainRule(FD);
280 
281       if (FName == "free")
282         return getOSSummaryFreeRule(FD);
283 
284       if (MD->getOverloadedOperator() == OO_New)
285         return getOSSummaryCreateRule(MD);
286     }
287   }
288 
289   return nullptr;
290 }
291 
getSummaryForObjCOrCFObject(const FunctionDecl * FD,StringRef FName,QualType RetTy,const FunctionType * FT,bool & AllowAnnotations)292 const RetainSummary *RetainSummaryManager::getSummaryForObjCOrCFObject(
293     const FunctionDecl *FD,
294     StringRef FName,
295     QualType RetTy,
296     const FunctionType *FT,
297     bool &AllowAnnotations) {
298 
299   ArgEffects ScratchArgs(AF.getEmptyMap());
300 
301   std::string RetTyName = RetTy.getAsString();
302   if (FName == "pthread_create" || FName == "pthread_setspecific") {
303     // Part of: <rdar://problem/7299394> and <rdar://problem/11282706>.
304     // This will be addressed better with IPA.
305     return getPersistentStopSummary();
306   } else if(FName == "NSMakeCollectable") {
307     // Handle: id NSMakeCollectable(CFTypeRef)
308     AllowAnnotations = false;
309     return RetTy->isObjCIdType() ? getUnarySummary(FT, DoNothing)
310                                  : getPersistentStopSummary();
311   } else if (FName == "CMBufferQueueDequeueAndRetain" ||
312              FName == "CMBufferQueueDequeueIfDataReadyAndRetain") {
313     // Part of: <rdar://problem/39390714>.
314     return getPersistentSummary(RetEffect::MakeOwned(ObjKind::CF),
315                                 ScratchArgs,
316                                 ArgEffect(DoNothing),
317                                 ArgEffect(DoNothing));
318   } else if (FName == "CFPlugInInstanceCreate") {
319     return getPersistentSummary(RetEffect::MakeNoRet(), ScratchArgs);
320   } else if (FName == "IORegistryEntrySearchCFProperty" ||
321              (RetTyName == "CFMutableDictionaryRef" &&
322               (FName == "IOBSDNameMatching" || FName == "IOServiceMatching" ||
323                FName == "IOServiceNameMatching" ||
324                FName == "IORegistryEntryIDMatching" ||
325                FName == "IOOpenFirmwarePathMatching"))) {
326     // Part of <rdar://problem/6961230>. (IOKit)
327     // This should be addressed using a API table.
328     return getPersistentSummary(RetEffect::MakeOwned(ObjKind::CF), ScratchArgs,
329                                 ArgEffect(DoNothing), ArgEffect(DoNothing));
330   } else if (FName == "IOServiceGetMatchingService" ||
331              FName == "IOServiceGetMatchingServices") {
332     // FIXES: <rdar://problem/6326900>
333     // This should be addressed using a API table.  This strcmp is also
334     // a little gross, but there is no need to super optimize here.
335     ScratchArgs = AF.add(ScratchArgs, 1, ArgEffect(DecRef, ObjKind::CF));
336     return getPersistentSummary(RetEffect::MakeNoRet(),
337                                 ScratchArgs,
338                                 ArgEffect(DoNothing), ArgEffect(DoNothing));
339   } else if (FName == "IOServiceAddNotification" ||
340              FName == "IOServiceAddMatchingNotification") {
341     // Part of <rdar://problem/6961230>. (IOKit)
342     // This should be addressed using a API table.
343     ScratchArgs = AF.add(ScratchArgs, 2, ArgEffect(DecRef, ObjKind::CF));
344     return getPersistentSummary(RetEffect::MakeNoRet(),
345                                 ScratchArgs,
346                                 ArgEffect(DoNothing), ArgEffect(DoNothing));
347   } else if (FName == "CVPixelBufferCreateWithBytes") {
348     // FIXES: <rdar://problem/7283567>
349     // Eventually this can be improved by recognizing that the pixel
350     // buffer passed to CVPixelBufferCreateWithBytes is released via
351     // a callback and doing full IPA to make sure this is done correctly.
352     // FIXME: This function has an out parameter that returns an
353     // allocated object.
354     ScratchArgs = AF.add(ScratchArgs, 7, ArgEffect(StopTracking));
355     return getPersistentSummary(RetEffect::MakeNoRet(),
356                                 ScratchArgs,
357                                 ArgEffect(DoNothing), ArgEffect(DoNothing));
358   } else if (FName == "CGBitmapContextCreateWithData") {
359     // FIXES: <rdar://problem/7358899>
360     // Eventually this can be improved by recognizing that 'releaseInfo'
361     // passed to CGBitmapContextCreateWithData is released via
362     // a callback and doing full IPA to make sure this is done correctly.
363     ScratchArgs = AF.add(ScratchArgs, 8, ArgEffect(ArgEffect(StopTracking)));
364     return getPersistentSummary(RetEffect::MakeOwned(ObjKind::CF), ScratchArgs,
365                                 ArgEffect(DoNothing), ArgEffect(DoNothing));
366   } else if (FName == "CVPixelBufferCreateWithPlanarBytes") {
367     // FIXES: <rdar://problem/7283567>
368     // Eventually this can be improved by recognizing that the pixel
369     // buffer passed to CVPixelBufferCreateWithPlanarBytes is released
370     // via a callback and doing full IPA to make sure this is done
371     // correctly.
372     ScratchArgs = AF.add(ScratchArgs, 12, ArgEffect(StopTracking));
373     return getPersistentSummary(RetEffect::MakeNoRet(),
374                                 ScratchArgs,
375                                 ArgEffect(DoNothing), ArgEffect(DoNothing));
376   } else if (FName == "VTCompressionSessionEncodeFrame") {
377     // The context argument passed to VTCompressionSessionEncodeFrame()
378     // is passed to the callback specified when creating the session
379     // (e.g. with VTCompressionSessionCreate()) which can release it.
380     // To account for this possibility, conservatively stop tracking
381     // the context.
382     ScratchArgs = AF.add(ScratchArgs, 5, ArgEffect(StopTracking));
383     return getPersistentSummary(RetEffect::MakeNoRet(),
384                                 ScratchArgs,
385                                 ArgEffect(DoNothing), ArgEffect(DoNothing));
386   } else if (FName == "dispatch_set_context" ||
387              FName == "xpc_connection_set_context") {
388     // <rdar://problem/11059275> - The analyzer currently doesn't have
389     // a good way to reason about the finalizer function for libdispatch.
390     // If we pass a context object that is memory managed, stop tracking it.
391     // <rdar://problem/13783514> - Same problem, but for XPC.
392     // FIXME: this hack should possibly go away once we can handle
393     // libdispatch and XPC finalizers.
394     ScratchArgs = AF.add(ScratchArgs, 1, ArgEffect(StopTracking));
395     return getPersistentSummary(RetEffect::MakeNoRet(),
396                                 ScratchArgs,
397                                 ArgEffect(DoNothing), ArgEffect(DoNothing));
398   } else if (FName.startswith("NSLog")) {
399     return getDoNothingSummary();
400   } else if (FName.startswith("NS") &&
401              (FName.find("Insert") != StringRef::npos)) {
402     // Whitelist NSXXInsertXX, for example NSMapInsertIfAbsent, since they can
403     // be deallocated by NSMapRemove. (radar://11152419)
404     ScratchArgs = AF.add(ScratchArgs, 1, ArgEffect(StopTracking));
405     ScratchArgs = AF.add(ScratchArgs, 2, ArgEffect(StopTracking));
406     return getPersistentSummary(RetEffect::MakeNoRet(),
407                                 ScratchArgs, ArgEffect(DoNothing),
408                                 ArgEffect(DoNothing));
409   }
410 
411   if (RetTy->isPointerType()) {
412 
413     // For CoreFoundation ('CF') types.
414     if (cocoa::isRefType(RetTy, "CF", FName)) {
415       if (isRetain(FD, FName)) {
416         // CFRetain isn't supposed to be annotated. However, this may as
417         // well be a user-made "safe" CFRetain function that is incorrectly
418         // annotated as cf_returns_retained due to lack of better options.
419         // We want to ignore such annotation.
420         AllowAnnotations = false;
421 
422         return getUnarySummary(FT, IncRef);
423       } else if (isAutorelease(FD, FName)) {
424         // The headers use cf_consumed, but we can fully model CFAutorelease
425         // ourselves.
426         AllowAnnotations = false;
427 
428         return getUnarySummary(FT, Autorelease);
429       } else if (isMakeCollectable(FName)) {
430         AllowAnnotations = false;
431         return getUnarySummary(FT, DoNothing);
432       } else {
433         return getCFCreateGetRuleSummary(FD);
434       }
435     }
436 
437     // For CoreGraphics ('CG') and CoreVideo ('CV') types.
438     if (cocoa::isRefType(RetTy, "CG", FName) ||
439         cocoa::isRefType(RetTy, "CV", FName)) {
440       if (isRetain(FD, FName))
441         return getUnarySummary(FT, IncRef);
442       else
443         return getCFCreateGetRuleSummary(FD);
444     }
445 
446     // For all other CF-style types, use the Create/Get
447     // rule for summaries but don't support Retain functions
448     // with framework-specific prefixes.
449     if (coreFoundation::isCFObjectRef(RetTy)) {
450       return getCFCreateGetRuleSummary(FD);
451     }
452 
453     if (FD->hasAttr<CFAuditedTransferAttr>()) {
454       return getCFCreateGetRuleSummary(FD);
455     }
456   }
457 
458   // Check for release functions, the only kind of functions that we care
459   // about that don't return a pointer type.
460   if (FName.startswith("CG") || FName.startswith("CF")) {
461     // Test for 'CGCF'.
462     FName = FName.substr(FName.startswith("CGCF") ? 4 : 2);
463 
464     if (isRelease(FD, FName))
465       return getUnarySummary(FT, DecRef);
466     else {
467       assert(ScratchArgs.isEmpty());
468       // Remaining CoreFoundation and CoreGraphics functions.
469       // We use to assume that they all strictly followed the ownership idiom
470       // and that ownership cannot be transferred.  While this is technically
471       // correct, many methods allow a tracked object to escape.  For example:
472       //
473       //   CFMutableDictionaryRef x = CFDictionaryCreateMutable(...);
474       //   CFDictionaryAddValue(y, key, x);
475       //   CFRelease(x);
476       //   ... it is okay to use 'x' since 'y' has a reference to it
477       //
478       // We handle this and similar cases with the follow heuristic.  If the
479       // function name contains "InsertValue", "SetValue", "AddValue",
480       // "AppendValue", or "SetAttribute", then we assume that arguments may
481       // "escape."  This means that something else holds on to the object,
482       // allowing it be used even after its local retain count drops to 0.
483       ArgEffectKind E =
484           (StrInStrNoCase(FName, "InsertValue") != StringRef::npos ||
485            StrInStrNoCase(FName, "AddValue") != StringRef::npos ||
486            StrInStrNoCase(FName, "SetValue") != StringRef::npos ||
487            StrInStrNoCase(FName, "AppendValue") != StringRef::npos ||
488            StrInStrNoCase(FName, "SetAttribute") != StringRef::npos)
489               ? MayEscape
490               : DoNothing;
491 
492       return getPersistentSummary(RetEffect::MakeNoRet(), ScratchArgs,
493                                   ArgEffect(DoNothing), ArgEffect(E, ObjKind::CF));
494     }
495   }
496 
497   return nullptr;
498 }
499 
500 const RetainSummary *
generateSummary(const FunctionDecl * FD,bool & AllowAnnotations)501 RetainSummaryManager::generateSummary(const FunctionDecl *FD,
502                                       bool &AllowAnnotations) {
503   // We generate "stop" summaries for implicitly defined functions.
504   if (FD->isImplicit())
505     return getPersistentStopSummary();
506 
507   const IdentifierInfo *II = FD->getIdentifier();
508 
509   StringRef FName = II ? II->getName() : "";
510 
511   // Strip away preceding '_'.  Doing this here will effect all the checks
512   // down below.
513   FName = FName.substr(FName.find_first_not_of('_'));
514 
515   // Inspect the result type. Strip away any typedefs.
516   const auto *FT = FD->getType()->castAs<FunctionType>();
517   QualType RetTy = FT->getReturnType();
518 
519   if (TrackOSObjects)
520     if (const RetainSummary *S = getSummaryForOSObject(FD, FName, RetTy))
521       return S;
522 
523   if (const auto *MD = dyn_cast<CXXMethodDecl>(FD))
524     if (!isOSObjectRelated(MD))
525       return getPersistentSummary(RetEffect::MakeNoRet(),
526                                   ArgEffects(AF.getEmptyMap()),
527                                   ArgEffect(DoNothing),
528                                   ArgEffect(StopTracking),
529                                   ArgEffect(DoNothing));
530 
531   if (TrackObjCAndCFObjects)
532     if (const RetainSummary *S =
533             getSummaryForObjCOrCFObject(FD, FName, RetTy, FT, AllowAnnotations))
534       return S;
535 
536   return getDefaultSummary();
537 }
538 
539 const RetainSummary *
getFunctionSummary(const FunctionDecl * FD)540 RetainSummaryManager::getFunctionSummary(const FunctionDecl *FD) {
541   // If we don't know what function we're calling, use our default summary.
542   if (!FD)
543     return getDefaultSummary();
544 
545   // Look up a summary in our cache of FunctionDecls -> Summaries.
546   FuncSummariesTy::iterator I = FuncSummaries.find(FD);
547   if (I != FuncSummaries.end())
548     return I->second;
549 
550   // No summary?  Generate one.
551   bool AllowAnnotations = true;
552   const RetainSummary *S = generateSummary(FD, AllowAnnotations);
553 
554   // Annotations override defaults.
555   if (AllowAnnotations)
556     updateSummaryFromAnnotations(S, FD);
557 
558   FuncSummaries[FD] = S;
559   return S;
560 }
561 
562 //===----------------------------------------------------------------------===//
563 // Summary creation for functions (largely uses of Core Foundation).
564 //===----------------------------------------------------------------------===//
565 
getStopTrackingHardEquivalent(ArgEffect E)566 static ArgEffect getStopTrackingHardEquivalent(ArgEffect E) {
567   switch (E.getKind()) {
568   case DoNothing:
569   case Autorelease:
570   case DecRefBridgedTransferred:
571   case IncRef:
572   case UnretainedOutParameter:
573   case RetainedOutParameter:
574   case RetainedOutParameterOnZero:
575   case RetainedOutParameterOnNonZero:
576   case MayEscape:
577   case StopTracking:
578   case StopTrackingHard:
579     return E.withKind(StopTrackingHard);
580   case DecRef:
581   case DecRefAndStopTrackingHard:
582     return E.withKind(DecRefAndStopTrackingHard);
583   case Dealloc:
584     return E.withKind(Dealloc);
585   }
586 
587   llvm_unreachable("Unknown ArgEffect kind");
588 }
589 
590 const RetainSummary *
updateSummaryForNonZeroCallbackArg(const RetainSummary * S,AnyCall & C)591 RetainSummaryManager::updateSummaryForNonZeroCallbackArg(const RetainSummary *S,
592                                                          AnyCall &C) {
593   ArgEffect RecEffect = getStopTrackingHardEquivalent(S->getReceiverEffect());
594   ArgEffect DefEffect = getStopTrackingHardEquivalent(S->getDefaultArgEffect());
595 
596   ArgEffects ScratchArgs(AF.getEmptyMap());
597   ArgEffects CustomArgEffects = S->getArgEffects();
598   for (ArgEffects::iterator I = CustomArgEffects.begin(),
599                             E = CustomArgEffects.end();
600        I != E; ++I) {
601     ArgEffect Translated = getStopTrackingHardEquivalent(I->second);
602     if (Translated.getKind() != DefEffect.getKind())
603       ScratchArgs = AF.add(ScratchArgs, I->first, Translated);
604   }
605 
606   RetEffect RE = RetEffect::MakeNoRetHard();
607 
608   // Special cases where the callback argument CANNOT free the return value.
609   // This can generally only happen if we know that the callback will only be
610   // called when the return value is already being deallocated.
611   if (const IdentifierInfo *Name = C.getIdentifier()) {
612     // When the CGBitmapContext is deallocated, the callback here will free
613     // the associated data buffer.
614     // The callback in dispatch_data_create frees the buffer, but not
615     // the data object.
616     if (Name->isStr("CGBitmapContextCreateWithData") ||
617         Name->isStr("dispatch_data_create"))
618       RE = S->getRetEffect();
619   }
620 
621   return getPersistentSummary(RE, ScratchArgs, RecEffect, DefEffect);
622 }
623 
updateSummaryForReceiverUnconsumedSelf(const RetainSummary * & S)624 void RetainSummaryManager::updateSummaryForReceiverUnconsumedSelf(
625     const RetainSummary *&S) {
626 
627   RetainSummaryTemplate Template(S, *this);
628 
629   Template->setReceiverEffect(ArgEffect(DoNothing));
630   Template->setRetEffect(RetEffect::MakeNoRet());
631 }
632 
633 
updateSummaryForArgumentTypes(const AnyCall & C,const RetainSummary * & RS)634 void RetainSummaryManager::updateSummaryForArgumentTypes(
635   const AnyCall &C, const RetainSummary *&RS) {
636   RetainSummaryTemplate Template(RS, *this);
637 
638   unsigned parm_idx = 0;
639   for (auto pi = C.param_begin(), pe = C.param_end(); pi != pe;
640        ++pi, ++parm_idx) {
641     QualType QT = (*pi)->getType();
642 
643     // Skip already created values.
644     if (RS->getArgEffects().contains(parm_idx))
645       continue;
646 
647     ObjKind K = ObjKind::AnyObj;
648 
649     if (isISLObjectRef(QT)) {
650       K = ObjKind::Generalized;
651     } else if (isOSObjectPtr(QT)) {
652       K = ObjKind::OS;
653     } else if (cocoa::isCocoaObjectRef(QT)) {
654       K = ObjKind::ObjC;
655     } else if (coreFoundation::isCFObjectRef(QT)) {
656       K = ObjKind::CF;
657     }
658 
659     if (K != ObjKind::AnyObj)
660       Template->addArg(AF, parm_idx,
661                        ArgEffect(RS->getDefaultArgEffect().getKind(), K));
662   }
663 }
664 
665 const RetainSummary *
getSummary(AnyCall C,bool HasNonZeroCallbackArg,bool IsReceiverUnconsumedSelf,QualType ReceiverType)666 RetainSummaryManager::getSummary(AnyCall C,
667                                  bool HasNonZeroCallbackArg,
668                                  bool IsReceiverUnconsumedSelf,
669                                  QualType ReceiverType) {
670   const RetainSummary *Summ;
671   switch (C.getKind()) {
672   case AnyCall::Function:
673   case AnyCall::Constructor:
674   case AnyCall::InheritedConstructor:
675   case AnyCall::Allocator:
676   case AnyCall::Deallocator:
677     Summ = getFunctionSummary(cast_or_null<FunctionDecl>(C.getDecl()));
678     break;
679   case AnyCall::Block:
680   case AnyCall::Destructor:
681     // FIXME: These calls are currently unsupported.
682     return getPersistentStopSummary();
683   case AnyCall::ObjCMethod: {
684     const auto *ME = cast_or_null<ObjCMessageExpr>(C.getExpr());
685     if (!ME) {
686       Summ = getMethodSummary(cast<ObjCMethodDecl>(C.getDecl()));
687     } else if (ME->isInstanceMessage()) {
688       Summ = getInstanceMethodSummary(ME, ReceiverType);
689     } else {
690       Summ = getClassMethodSummary(ME);
691     }
692     break;
693   }
694   }
695 
696   if (HasNonZeroCallbackArg)
697     Summ = updateSummaryForNonZeroCallbackArg(Summ, C);
698 
699   if (IsReceiverUnconsumedSelf)
700     updateSummaryForReceiverUnconsumedSelf(Summ);
701 
702   updateSummaryForArgumentTypes(C, Summ);
703 
704   assert(Summ && "Unknown call type?");
705   return Summ;
706 }
707 
708 
709 const RetainSummary *
getCFCreateGetRuleSummary(const FunctionDecl * FD)710 RetainSummaryManager::getCFCreateGetRuleSummary(const FunctionDecl *FD) {
711   if (coreFoundation::followsCreateRule(FD))
712     return getCFSummaryCreateRule(FD);
713 
714   return getCFSummaryGetRule(FD);
715 }
716 
isTrustedReferenceCountImplementation(const Decl * FD)717 bool RetainSummaryManager::isTrustedReferenceCountImplementation(
718     const Decl *FD) {
719   return hasRCAnnotation(FD, "rc_ownership_trusted_implementation");
720 }
721 
722 Optional<RetainSummaryManager::BehaviorSummary>
canEval(const CallExpr * CE,const FunctionDecl * FD,bool & hasTrustedImplementationAnnotation)723 RetainSummaryManager::canEval(const CallExpr *CE, const FunctionDecl *FD,
724                               bool &hasTrustedImplementationAnnotation) {
725 
726   IdentifierInfo *II = FD->getIdentifier();
727   if (!II)
728     return None;
729 
730   StringRef FName = II->getName();
731   FName = FName.substr(FName.find_first_not_of('_'));
732 
733   QualType ResultTy = CE->getCallReturnType(Ctx);
734   if (ResultTy->isObjCIdType()) {
735     if (II->isStr("NSMakeCollectable"))
736       return BehaviorSummary::Identity;
737   } else if (ResultTy->isPointerType()) {
738     // Handle: (CF|CG|CV)Retain
739     //         CFAutorelease
740     // It's okay to be a little sloppy here.
741     if (FName == "CMBufferQueueDequeueAndRetain" ||
742         FName == "CMBufferQueueDequeueIfDataReadyAndRetain") {
743       // Part of: <rdar://problem/39390714>.
744       // These are not retain. They just return something and retain it.
745       return None;
746     }
747     if (CE->getNumArgs() == 1 &&
748         (cocoa::isRefType(ResultTy, "CF", FName) ||
749          cocoa::isRefType(ResultTy, "CG", FName) ||
750          cocoa::isRefType(ResultTy, "CV", FName)) &&
751         (isRetain(FD, FName) || isAutorelease(FD, FName) ||
752          isMakeCollectable(FName)))
753       return BehaviorSummary::Identity;
754 
755     // safeMetaCast is called by OSDynamicCast.
756     // We assume that OSDynamicCast is either an identity (cast is OK,
757     // the input was non-zero),
758     // or that it returns zero (when the cast failed, or the input
759     // was zero).
760     if (TrackOSObjects) {
761       if (isOSObjectDynamicCast(FName) && FD->param_size() >= 1) {
762         return BehaviorSummary::IdentityOrZero;
763       } else if (isOSObjectRequiredCast(FName) && FD->param_size() >= 1) {
764         return BehaviorSummary::Identity;
765       } else if (isOSObjectThisCast(FName) && isa<CXXMethodDecl>(FD) &&
766                  !cast<CXXMethodDecl>(FD)->isStatic()) {
767         return BehaviorSummary::IdentityThis;
768       }
769     }
770 
771     const FunctionDecl* FDD = FD->getDefinition();
772     if (FDD && isTrustedReferenceCountImplementation(FDD)) {
773       hasTrustedImplementationAnnotation = true;
774       return BehaviorSummary::Identity;
775     }
776   }
777 
778   if (const auto *MD = dyn_cast<CXXMethodDecl>(FD)) {
779     const CXXRecordDecl *Parent = MD->getParent();
780     if (TrackOSObjects && Parent && isOSObjectSubclass(Parent))
781       if (FName == "release" || FName == "retain")
782         return BehaviorSummary::NoOp;
783   }
784 
785   return None;
786 }
787 
788 const RetainSummary *
getUnarySummary(const FunctionType * FT,ArgEffectKind AE)789 RetainSummaryManager::getUnarySummary(const FunctionType* FT,
790                                       ArgEffectKind AE) {
791 
792   // Unary functions have no arg effects by definition.
793   ArgEffects ScratchArgs(AF.getEmptyMap());
794 
795   // Sanity check that this is *really* a unary function.  This can
796   // happen if people do weird things.
797   const FunctionProtoType* FTP = dyn_cast<FunctionProtoType>(FT);
798   if (!FTP || FTP->getNumParams() != 1)
799     return getPersistentStopSummary();
800 
801   ArgEffect Effect(AE, ObjKind::CF);
802 
803   ScratchArgs = AF.add(ScratchArgs, 0, Effect);
804   return getPersistentSummary(RetEffect::MakeNoRet(),
805                               ScratchArgs,
806                               ArgEffect(DoNothing), ArgEffect(DoNothing));
807 }
808 
809 const RetainSummary *
getOSSummaryRetainRule(const FunctionDecl * FD)810 RetainSummaryManager::getOSSummaryRetainRule(const FunctionDecl *FD) {
811   return getPersistentSummary(RetEffect::MakeNoRet(),
812                               AF.getEmptyMap(),
813                               /*ReceiverEff=*/ArgEffect(DoNothing),
814                               /*DefaultEff=*/ArgEffect(DoNothing),
815                               /*ThisEff=*/ArgEffect(IncRef, ObjKind::OS));
816 }
817 
818 const RetainSummary *
getOSSummaryReleaseRule(const FunctionDecl * FD)819 RetainSummaryManager::getOSSummaryReleaseRule(const FunctionDecl *FD) {
820   return getPersistentSummary(RetEffect::MakeNoRet(),
821                               AF.getEmptyMap(),
822                               /*ReceiverEff=*/ArgEffect(DoNothing),
823                               /*DefaultEff=*/ArgEffect(DoNothing),
824                               /*ThisEff=*/ArgEffect(DecRef, ObjKind::OS));
825 }
826 
827 const RetainSummary *
getOSSummaryFreeRule(const FunctionDecl * FD)828 RetainSummaryManager::getOSSummaryFreeRule(const FunctionDecl *FD) {
829   return getPersistentSummary(RetEffect::MakeNoRet(),
830                               AF.getEmptyMap(),
831                               /*ReceiverEff=*/ArgEffect(DoNothing),
832                               /*DefaultEff=*/ArgEffect(DoNothing),
833                               /*ThisEff=*/ArgEffect(Dealloc, ObjKind::OS));
834 }
835 
836 const RetainSummary *
getOSSummaryCreateRule(const FunctionDecl * FD)837 RetainSummaryManager::getOSSummaryCreateRule(const FunctionDecl *FD) {
838   return getPersistentSummary(RetEffect::MakeOwned(ObjKind::OS),
839                               AF.getEmptyMap());
840 }
841 
842 const RetainSummary *
getOSSummaryGetRule(const FunctionDecl * FD)843 RetainSummaryManager::getOSSummaryGetRule(const FunctionDecl *FD) {
844   return getPersistentSummary(RetEffect::MakeNotOwned(ObjKind::OS),
845                               AF.getEmptyMap());
846 }
847 
848 const RetainSummary *
getCFSummaryCreateRule(const FunctionDecl * FD)849 RetainSummaryManager::getCFSummaryCreateRule(const FunctionDecl *FD) {
850   return getPersistentSummary(RetEffect::MakeOwned(ObjKind::CF),
851                               ArgEffects(AF.getEmptyMap()));
852 }
853 
854 const RetainSummary *
getCFSummaryGetRule(const FunctionDecl * FD)855 RetainSummaryManager::getCFSummaryGetRule(const FunctionDecl *FD) {
856   return getPersistentSummary(RetEffect::MakeNotOwned(ObjKind::CF),
857                               ArgEffects(AF.getEmptyMap()),
858                               ArgEffect(DoNothing), ArgEffect(DoNothing));
859 }
860 
861 
862 
863 
864 //===----------------------------------------------------------------------===//
865 // Summary creation for Selectors.
866 //===----------------------------------------------------------------------===//
867 
868 Optional<RetEffect>
getRetEffectFromAnnotations(QualType RetTy,const Decl * D)869 RetainSummaryManager::getRetEffectFromAnnotations(QualType RetTy,
870                                                   const Decl *D) {
871   if (hasAnyEnabledAttrOf<NSReturnsRetainedAttr>(D, RetTy))
872     return ObjCAllocRetE;
873 
874   if (auto K = hasAnyEnabledAttrOf<CFReturnsRetainedAttr, OSReturnsRetainedAttr,
875                                    GeneralizedReturnsRetainedAttr>(D, RetTy))
876     return RetEffect::MakeOwned(*K);
877 
878   if (auto K = hasAnyEnabledAttrOf<
879           CFReturnsNotRetainedAttr, OSReturnsNotRetainedAttr,
880           GeneralizedReturnsNotRetainedAttr, NSReturnsNotRetainedAttr,
881           NSReturnsAutoreleasedAttr>(D, RetTy))
882     return RetEffect::MakeNotOwned(*K);
883 
884   if (const auto *MD = dyn_cast<CXXMethodDecl>(D))
885     for (const auto *PD : MD->overridden_methods())
886       if (auto RE = getRetEffectFromAnnotations(RetTy, PD))
887         return RE;
888 
889   return None;
890 }
891 
892 /// \return Whether the chain of typedefs starting from @c QT
893 /// has a typedef with a given name @c Name.
hasTypedefNamed(QualType QT,StringRef Name)894 static bool hasTypedefNamed(QualType QT,
895                             StringRef Name) {
896   while (auto *T = dyn_cast<TypedefType>(QT)) {
897     const auto &Context = T->getDecl()->getASTContext();
898     if (T->getDecl()->getIdentifier() == &Context.Idents.get(Name))
899       return true;
900     QT = T->getDecl()->getUnderlyingType();
901   }
902   return false;
903 }
904 
getCallableReturnType(const NamedDecl * ND)905 static QualType getCallableReturnType(const NamedDecl *ND) {
906   if (const auto *FD = dyn_cast<FunctionDecl>(ND)) {
907     return FD->getReturnType();
908   } else if (const auto *MD = dyn_cast<ObjCMethodDecl>(ND)) {
909     return MD->getReturnType();
910   } else {
911     llvm_unreachable("Unexpected decl");
912   }
913 }
914 
applyParamAnnotationEffect(const ParmVarDecl * pd,unsigned parm_idx,const NamedDecl * FD,RetainSummaryTemplate & Template)915 bool RetainSummaryManager::applyParamAnnotationEffect(
916     const ParmVarDecl *pd, unsigned parm_idx, const NamedDecl *FD,
917     RetainSummaryTemplate &Template) {
918   QualType QT = pd->getType();
919   if (auto K =
920           hasAnyEnabledAttrOf<NSConsumedAttr, CFConsumedAttr, OSConsumedAttr,
921                               GeneralizedConsumedAttr>(pd, QT)) {
922     Template->addArg(AF, parm_idx, ArgEffect(DecRef, *K));
923     return true;
924   } else if (auto K = hasAnyEnabledAttrOf<
925                  CFReturnsRetainedAttr, OSReturnsRetainedAttr,
926                  OSReturnsRetainedOnNonZeroAttr, OSReturnsRetainedOnZeroAttr,
927                  GeneralizedReturnsRetainedAttr>(pd, QT)) {
928 
929     // For OSObjects, we try to guess whether the object is created based
930     // on the return value.
931     if (K == ObjKind::OS) {
932       QualType QT = getCallableReturnType(FD);
933 
934       bool HasRetainedOnZero = pd->hasAttr<OSReturnsRetainedOnZeroAttr>();
935       bool HasRetainedOnNonZero = pd->hasAttr<OSReturnsRetainedOnNonZeroAttr>();
936 
937       // The usual convention is to create an object on non-zero return, but
938       // it's reverted if the typedef chain has a typedef kern_return_t,
939       // because kReturnSuccess constant is defined as zero.
940       // The convention can be overwritten by custom attributes.
941       bool SuccessOnZero =
942           HasRetainedOnZero ||
943           (hasTypedefNamed(QT, "kern_return_t") && !HasRetainedOnNonZero);
944       bool ShouldSplit = !QT.isNull() && !QT->isVoidType();
945       ArgEffectKind AK = RetainedOutParameter;
946       if (ShouldSplit && SuccessOnZero) {
947         AK = RetainedOutParameterOnZero;
948       } else if (ShouldSplit && (!SuccessOnZero || HasRetainedOnNonZero)) {
949         AK = RetainedOutParameterOnNonZero;
950       }
951       Template->addArg(AF, parm_idx, ArgEffect(AK, ObjKind::OS));
952     }
953 
954     // For others:
955     // Do nothing. Retained out parameters will either point to a +1 reference
956     // or NULL, but the way you check for failure differs depending on the
957     // API. Consequently, we don't have a good way to track them yet.
958     return true;
959   } else if (auto K = hasAnyEnabledAttrOf<CFReturnsNotRetainedAttr,
960                                           OSReturnsNotRetainedAttr,
961                                           GeneralizedReturnsNotRetainedAttr>(
962                  pd, QT)) {
963     Template->addArg(AF, parm_idx, ArgEffect(UnretainedOutParameter, *K));
964     return true;
965   }
966 
967   if (const auto *MD = dyn_cast<CXXMethodDecl>(FD)) {
968     for (const auto *OD : MD->overridden_methods()) {
969       const ParmVarDecl *OP = OD->parameters()[parm_idx];
970       if (applyParamAnnotationEffect(OP, parm_idx, OD, Template))
971         return true;
972     }
973   }
974 
975   return false;
976 }
977 
978 void
updateSummaryFromAnnotations(const RetainSummary * & Summ,const FunctionDecl * FD)979 RetainSummaryManager::updateSummaryFromAnnotations(const RetainSummary *&Summ,
980                                                    const FunctionDecl *FD) {
981   if (!FD)
982     return;
983 
984   assert(Summ && "Must have a summary to add annotations to.");
985   RetainSummaryTemplate Template(Summ, *this);
986 
987   // Effects on the parameters.
988   unsigned parm_idx = 0;
989   for (auto pi = FD->param_begin(),
990          pe = FD->param_end(); pi != pe; ++pi, ++parm_idx)
991     applyParamAnnotationEffect(*pi, parm_idx, FD, Template);
992 
993   QualType RetTy = FD->getReturnType();
994   if (Optional<RetEffect> RetE = getRetEffectFromAnnotations(RetTy, FD))
995     Template->setRetEffect(*RetE);
996 
997   if (hasAnyEnabledAttrOf<OSConsumesThisAttr>(FD, RetTy))
998     Template->setThisEffect(ArgEffect(DecRef, ObjKind::OS));
999 }
1000 
1001 void
updateSummaryFromAnnotations(const RetainSummary * & Summ,const ObjCMethodDecl * MD)1002 RetainSummaryManager::updateSummaryFromAnnotations(const RetainSummary *&Summ,
1003                                                    const ObjCMethodDecl *MD) {
1004   if (!MD)
1005     return;
1006 
1007   assert(Summ && "Must have a valid summary to add annotations to");
1008   RetainSummaryTemplate Template(Summ, *this);
1009 
1010   // Effects on the receiver.
1011   if (hasAnyEnabledAttrOf<NSConsumesSelfAttr>(MD, MD->getReturnType()))
1012     Template->setReceiverEffect(ArgEffect(DecRef, ObjKind::ObjC));
1013 
1014   // Effects on the parameters.
1015   unsigned parm_idx = 0;
1016   for (auto pi = MD->param_begin(), pe = MD->param_end(); pi != pe;
1017        ++pi, ++parm_idx)
1018     applyParamAnnotationEffect(*pi, parm_idx, MD, Template);
1019 
1020   QualType RetTy = MD->getReturnType();
1021   if (Optional<RetEffect> RetE = getRetEffectFromAnnotations(RetTy, MD))
1022     Template->setRetEffect(*RetE);
1023 }
1024 
1025 const RetainSummary *
getStandardMethodSummary(const ObjCMethodDecl * MD,Selector S,QualType RetTy)1026 RetainSummaryManager::getStandardMethodSummary(const ObjCMethodDecl *MD,
1027                                                Selector S, QualType RetTy) {
1028   // Any special effects?
1029   ArgEffect ReceiverEff = ArgEffect(DoNothing, ObjKind::ObjC);
1030   RetEffect ResultEff = RetEffect::MakeNoRet();
1031 
1032   // Check the method family, and apply any default annotations.
1033   switch (MD ? MD->getMethodFamily() : S.getMethodFamily()) {
1034     case OMF_None:
1035     case OMF_initialize:
1036     case OMF_performSelector:
1037       // Assume all Objective-C methods follow Cocoa Memory Management rules.
1038       // FIXME: Does the non-threaded performSelector family really belong here?
1039       // The selector could be, say, @selector(copy).
1040       if (cocoa::isCocoaObjectRef(RetTy))
1041         ResultEff = RetEffect::MakeNotOwned(ObjKind::ObjC);
1042       else if (coreFoundation::isCFObjectRef(RetTy)) {
1043         // ObjCMethodDecl currently doesn't consider CF objects as valid return
1044         // values for alloc, new, copy, or mutableCopy, so we have to
1045         // double-check with the selector. This is ugly, but there aren't that
1046         // many Objective-C methods that return CF objects, right?
1047         if (MD) {
1048           switch (S.getMethodFamily()) {
1049           case OMF_alloc:
1050           case OMF_new:
1051           case OMF_copy:
1052           case OMF_mutableCopy:
1053             ResultEff = RetEffect::MakeOwned(ObjKind::CF);
1054             break;
1055           default:
1056             ResultEff = RetEffect::MakeNotOwned(ObjKind::CF);
1057             break;
1058           }
1059         } else {
1060           ResultEff = RetEffect::MakeNotOwned(ObjKind::CF);
1061         }
1062       }
1063       break;
1064     case OMF_init:
1065       ResultEff = ObjCInitRetE;
1066       ReceiverEff = ArgEffect(DecRef, ObjKind::ObjC);
1067       break;
1068     case OMF_alloc:
1069     case OMF_new:
1070     case OMF_copy:
1071     case OMF_mutableCopy:
1072       if (cocoa::isCocoaObjectRef(RetTy))
1073         ResultEff = ObjCAllocRetE;
1074       else if (coreFoundation::isCFObjectRef(RetTy))
1075         ResultEff = RetEffect::MakeOwned(ObjKind::CF);
1076       break;
1077     case OMF_autorelease:
1078       ReceiverEff = ArgEffect(Autorelease, ObjKind::ObjC);
1079       break;
1080     case OMF_retain:
1081       ReceiverEff = ArgEffect(IncRef, ObjKind::ObjC);
1082       break;
1083     case OMF_release:
1084       ReceiverEff = ArgEffect(DecRef, ObjKind::ObjC);
1085       break;
1086     case OMF_dealloc:
1087       ReceiverEff = ArgEffect(Dealloc, ObjKind::ObjC);
1088       break;
1089     case OMF_self:
1090       // -self is handled specially by the ExprEngine to propagate the receiver.
1091       break;
1092     case OMF_retainCount:
1093     case OMF_finalize:
1094       // These methods don't return objects.
1095       break;
1096   }
1097 
1098   // If one of the arguments in the selector has the keyword 'delegate' we
1099   // should stop tracking the reference count for the receiver.  This is
1100   // because the reference count is quite possibly handled by a delegate
1101   // method.
1102   if (S.isKeywordSelector()) {
1103     for (unsigned i = 0, e = S.getNumArgs(); i != e; ++i) {
1104       StringRef Slot = S.getNameForSlot(i);
1105       if (Slot.substr(Slot.size() - 8).equals_insensitive("delegate")) {
1106         if (ResultEff == ObjCInitRetE)
1107           ResultEff = RetEffect::MakeNoRetHard();
1108         else
1109           ReceiverEff = ArgEffect(StopTrackingHard, ObjKind::ObjC);
1110       }
1111     }
1112   }
1113 
1114   if (ReceiverEff.getKind() == DoNothing &&
1115       ResultEff.getKind() == RetEffect::NoRet)
1116     return getDefaultSummary();
1117 
1118   return getPersistentSummary(ResultEff, ArgEffects(AF.getEmptyMap()),
1119                               ArgEffect(ReceiverEff), ArgEffect(MayEscape));
1120 }
1121 
1122 const RetainSummary *
getClassMethodSummary(const ObjCMessageExpr * ME)1123 RetainSummaryManager::getClassMethodSummary(const ObjCMessageExpr *ME) {
1124   assert(!ME->isInstanceMessage());
1125   const ObjCInterfaceDecl *Class = ME->getReceiverInterface();
1126 
1127   return getMethodSummary(ME->getSelector(), Class, ME->getMethodDecl(),
1128                           ME->getType(), ObjCClassMethodSummaries);
1129 }
1130 
getInstanceMethodSummary(const ObjCMessageExpr * ME,QualType ReceiverType)1131 const RetainSummary *RetainSummaryManager::getInstanceMethodSummary(
1132     const ObjCMessageExpr *ME,
1133     QualType ReceiverType) {
1134   const ObjCInterfaceDecl *ReceiverClass = nullptr;
1135 
1136   // We do better tracking of the type of the object than the core ExprEngine.
1137   // See if we have its type in our private state.
1138   if (!ReceiverType.isNull())
1139     if (const auto *PT = ReceiverType->getAs<ObjCObjectPointerType>())
1140       ReceiverClass = PT->getInterfaceDecl();
1141 
1142   // If we don't know what kind of object this is, fall back to its static type.
1143   if (!ReceiverClass)
1144     ReceiverClass = ME->getReceiverInterface();
1145 
1146   // FIXME: The receiver could be a reference to a class, meaning that
1147   //  we should use the class method.
1148   // id x = [NSObject class];
1149   // [x performSelector:... withObject:... afterDelay:...];
1150   Selector S = ME->getSelector();
1151   const ObjCMethodDecl *Method = ME->getMethodDecl();
1152   if (!Method && ReceiverClass)
1153     Method = ReceiverClass->getInstanceMethod(S);
1154 
1155   return getMethodSummary(S, ReceiverClass, Method, ME->getType(),
1156                           ObjCMethodSummaries);
1157 }
1158 
1159 const RetainSummary *
getMethodSummary(Selector S,const ObjCInterfaceDecl * ID,const ObjCMethodDecl * MD,QualType RetTy,ObjCMethodSummariesTy & CachedSummaries)1160 RetainSummaryManager::getMethodSummary(Selector S,
1161                                        const ObjCInterfaceDecl *ID,
1162                                        const ObjCMethodDecl *MD, QualType RetTy,
1163                                        ObjCMethodSummariesTy &CachedSummaries) {
1164 
1165   // Objective-C method summaries are only applicable to ObjC and CF objects.
1166   if (!TrackObjCAndCFObjects)
1167     return getDefaultSummary();
1168 
1169   // Look up a summary in our summary cache.
1170   const RetainSummary *Summ = CachedSummaries.find(ID, S);
1171 
1172   if (!Summ) {
1173     Summ = getStandardMethodSummary(MD, S, RetTy);
1174 
1175     // Annotations override defaults.
1176     updateSummaryFromAnnotations(Summ, MD);
1177 
1178     // Memoize the summary.
1179     CachedSummaries[ObjCSummaryKey(ID, S)] = Summ;
1180   }
1181 
1182   return Summ;
1183 }
1184 
InitializeClassMethodSummaries()1185 void RetainSummaryManager::InitializeClassMethodSummaries() {
1186   ArgEffects ScratchArgs = AF.getEmptyMap();
1187 
1188   // Create the [NSAssertionHandler currentHander] summary.
1189   addClassMethSummary("NSAssertionHandler", "currentHandler",
1190                 getPersistentSummary(RetEffect::MakeNotOwned(ObjKind::ObjC),
1191                                      ScratchArgs));
1192 
1193   // Create the [NSAutoreleasePool addObject:] summary.
1194   ScratchArgs = AF.add(ScratchArgs, 0, ArgEffect(Autorelease));
1195   addClassMethSummary("NSAutoreleasePool", "addObject",
1196                       getPersistentSummary(RetEffect::MakeNoRet(), ScratchArgs,
1197                                            ArgEffect(DoNothing),
1198                                            ArgEffect(Autorelease)));
1199 }
1200 
InitializeMethodSummaries()1201 void RetainSummaryManager::InitializeMethodSummaries() {
1202 
1203   ArgEffects ScratchArgs = AF.getEmptyMap();
1204   // Create the "init" selector.  It just acts as a pass-through for the
1205   // receiver.
1206   const RetainSummary *InitSumm = getPersistentSummary(
1207       ObjCInitRetE, ScratchArgs, ArgEffect(DecRef, ObjKind::ObjC));
1208   addNSObjectMethSummary(GetNullarySelector("init", Ctx), InitSumm);
1209 
1210   // awakeAfterUsingCoder: behaves basically like an 'init' method.  It
1211   // claims the receiver and returns a retained object.
1212   addNSObjectMethSummary(GetUnarySelector("awakeAfterUsingCoder", Ctx),
1213                          InitSumm);
1214 
1215   // The next methods are allocators.
1216   const RetainSummary *AllocSumm = getPersistentSummary(ObjCAllocRetE,
1217                                                         ScratchArgs);
1218   const RetainSummary *CFAllocSumm =
1219     getPersistentSummary(RetEffect::MakeOwned(ObjKind::CF), ScratchArgs);
1220 
1221   // Create the "retain" selector.
1222   RetEffect NoRet = RetEffect::MakeNoRet();
1223   const RetainSummary *Summ = getPersistentSummary(
1224       NoRet, ScratchArgs, ArgEffect(IncRef, ObjKind::ObjC));
1225   addNSObjectMethSummary(GetNullarySelector("retain", Ctx), Summ);
1226 
1227   // Create the "release" selector.
1228   Summ = getPersistentSummary(NoRet, ScratchArgs,
1229                               ArgEffect(DecRef, ObjKind::ObjC));
1230   addNSObjectMethSummary(GetNullarySelector("release", Ctx), Summ);
1231 
1232   // Create the -dealloc summary.
1233   Summ = getPersistentSummary(NoRet, ScratchArgs, ArgEffect(Dealloc,
1234                                                             ObjKind::ObjC));
1235   addNSObjectMethSummary(GetNullarySelector("dealloc", Ctx), Summ);
1236 
1237   // Create the "autorelease" selector.
1238   Summ = getPersistentSummary(NoRet, ScratchArgs, ArgEffect(Autorelease,
1239                                                             ObjKind::ObjC));
1240   addNSObjectMethSummary(GetNullarySelector("autorelease", Ctx), Summ);
1241 
1242   // For NSWindow, allocated objects are (initially) self-owned.
1243   // FIXME: For now we opt for false negatives with NSWindow, as these objects
1244   //  self-own themselves.  However, they only do this once they are displayed.
1245   //  Thus, we need to track an NSWindow's display status.
1246   //  This is tracked in <rdar://problem/6062711>.
1247   //  See also http://llvm.org/bugs/show_bug.cgi?id=3714.
1248   const RetainSummary *NoTrackYet =
1249       getPersistentSummary(RetEffect::MakeNoRet(), ScratchArgs,
1250                            ArgEffect(StopTracking), ArgEffect(StopTracking));
1251 
1252   addClassMethSummary("NSWindow", "alloc", NoTrackYet);
1253 
1254   // For NSPanel (which subclasses NSWindow), allocated objects are not
1255   //  self-owned.
1256   // FIXME: For now we don't track NSPanels. object for the same reason
1257   //   as for NSWindow objects.
1258   addClassMethSummary("NSPanel", "alloc", NoTrackYet);
1259 
1260   // For NSNull, objects returned by +null are singletons that ignore
1261   // retain/release semantics.  Just don't track them.
1262   // <rdar://problem/12858915>
1263   addClassMethSummary("NSNull", "null", NoTrackYet);
1264 
1265   // Don't track allocated autorelease pools, as it is okay to prematurely
1266   // exit a method.
1267   addClassMethSummary("NSAutoreleasePool", "alloc", NoTrackYet);
1268   addClassMethSummary("NSAutoreleasePool", "allocWithZone", NoTrackYet, false);
1269   addClassMethSummary("NSAutoreleasePool", "new", NoTrackYet);
1270 
1271   // Create summaries QCRenderer/QCView -createSnapShotImageOfType:
1272   addInstMethSummary("QCRenderer", AllocSumm, "createSnapshotImageOfType");
1273   addInstMethSummary("QCView", AllocSumm, "createSnapshotImageOfType");
1274 
1275   // Create summaries for CIContext, 'createCGImage' and
1276   // 'createCGLayerWithSize'.  These objects are CF objects, and are not
1277   // automatically garbage collected.
1278   addInstMethSummary("CIContext", CFAllocSumm, "createCGImage", "fromRect");
1279   addInstMethSummary("CIContext", CFAllocSumm, "createCGImage", "fromRect",
1280                      "format", "colorSpace");
1281   addInstMethSummary("CIContext", CFAllocSumm, "createCGLayerWithSize", "info");
1282 }
1283 
1284 const RetainSummary *
getMethodSummary(const ObjCMethodDecl * MD)1285 RetainSummaryManager::getMethodSummary(const ObjCMethodDecl *MD) {
1286   const ObjCInterfaceDecl *ID = MD->getClassInterface();
1287   Selector S = MD->getSelector();
1288   QualType ResultTy = MD->getReturnType();
1289 
1290   ObjCMethodSummariesTy *CachedSummaries;
1291   if (MD->isInstanceMethod())
1292     CachedSummaries = &ObjCMethodSummaries;
1293   else
1294     CachedSummaries = &ObjCClassMethodSummaries;
1295 
1296   return getMethodSummary(S, ID, MD, ResultTy, *CachedSummaries);
1297 }
1298