Home | History | Annotate | Download | only in Analysis
      1 // RUN: %clang_cc1 -analyze -analyzer-checker=core,osx.cocoa.RetainCount -analyzer-store=region -analyzer-max-loop 6 -verify %s
      2 
      3 //===----------------------------------------------------------------------===//
      4 // The following code is reduced using delta-debugging from
      5 // Foundation.h (Mac OS X).
      6 //
      7 // It includes the basic definitions for the test cases below.
      8 // Not including Foundation.h directly makes this test case both svelte and
      9 // portable to non-Mac platforms.
     10 //===----------------------------------------------------------------------===//
     11 
     12 typedef unsigned int __darwin_natural_t;
     13 typedef unsigned long UInt32;
     14 typedef signed long CFIndex;
     15 typedef const void * CFTypeRef;
     16 typedef const struct __CFString * CFStringRef;
     17 typedef const struct __CFAllocator * CFAllocatorRef;
     18 extern const CFAllocatorRef kCFAllocatorDefault;
     19 extern CFTypeRef CFRetain(CFTypeRef cf);
     20 extern void CFRelease(CFTypeRef cf);
     21 typedef struct {
     22 }
     23 CFArrayCallBacks;
     24 extern const CFArrayCallBacks kCFTypeArrayCallBacks;
     25 typedef const struct __CFArray * CFArrayRef;
     26 typedef struct __CFArray * CFMutableArrayRef;
     27 extern CFMutableArrayRef CFArrayCreateMutable(CFAllocatorRef allocator, CFIndex capacity, const CFArrayCallBacks *callBacks);
     28 extern const void *CFArrayGetValueAtIndex(CFArrayRef theArray, CFIndex idx);
     29 typedef const struct __CFDictionary * CFDictionaryRef;
     30 typedef UInt32 CFStringEncoding;
     31 enum {
     32 kCFStringEncodingMacRoman = 0,     kCFStringEncodingWindowsLatin1 = 0x0500,     kCFStringEncodingISOLatin1 = 0x0201,     kCFStringEncodingNextStepLatin = 0x0B01,     kCFStringEncodingASCII = 0x0600,     kCFStringEncodingUnicode = 0x0100,     kCFStringEncodingUTF8 = 0x08000100,     kCFStringEncodingNonLossyASCII = 0x0BFF      ,     kCFStringEncodingUTF16 = 0x0100,     kCFStringEncodingUTF16BE = 0x10000100,     kCFStringEncodingUTF16LE = 0x14000100,      kCFStringEncodingUTF32 = 0x0c000100,     kCFStringEncodingUTF32BE = 0x18000100,     kCFStringEncodingUTF32LE = 0x1c000100  };
     33 extern CFStringRef CFStringCreateWithCString(CFAllocatorRef alloc, const char *cStr, CFStringEncoding encoding);
     34 typedef double CFTimeInterval;
     35 typedef CFTimeInterval CFAbsoluteTime;
     36 typedef const struct __CFDate * CFDateRef;
     37 extern CFDateRef CFDateCreate(CFAllocatorRef allocator, CFAbsoluteTime at);
     38 extern CFAbsoluteTime CFDateGetAbsoluteTime(CFDateRef theDate);
     39 typedef __darwin_natural_t natural_t;
     40 typedef natural_t mach_port_name_t;
     41 typedef mach_port_name_t mach_port_t;
     42 typedef signed char BOOL;
     43 typedef struct _NSZone NSZone;
     44 @class NSInvocation, NSMethodSignature, NSCoder, NSString, NSEnumerator;
     45 @protocol NSObject
     46 - (BOOL)isEqual:(id)object;
     47 - (id)retain;
     48 - (oneway void)release;
     49 @end  @protocol NSCopying  - (id)copyWithZone:(NSZone *)zone;
     50 @end  @protocol NSCoding  - (void)encodeWithCoder:(NSCoder *)aCoder;
     51 @end
     52 @interface NSObject <NSObject> {}
     53 - (id)init;
     54 + (id)allocWithZone:(NSZone *)zone;
     55 + (id)alloc;
     56 - (void)dealloc;
     57 @end
     58 typedef float CGFloat;
     59 typedef double NSTimeInterval;
     60 @interface NSDate : NSObject <NSCopying, NSCoding>  - (NSTimeInterval)timeIntervalSinceReferenceDate;
     61 @end      enum {
     62 NSObjCNoType = 0,     NSObjCVoidType = 'v',     NSObjCCharType = 'c',     NSObjCShortType = 's',     NSObjCLongType = 'l',     NSObjCLonglongType = 'q',     NSObjCFloatType = 'f',     NSObjCDoubleType = 'd',      NSObjCBoolType = 'B',      NSObjCSelectorType = ':',     NSObjCObjectType = '@',     NSObjCStructType = '{',     NSObjCPointerType = '^',     NSObjCStringType = '*',     NSObjCArrayType = '[',     NSObjCUnionType = '(',     NSObjCBitfield = 'b' }
     63 __attribute__((deprecated));
     64 typedef int kern_return_t;
     65 typedef kern_return_t mach_error_t;
     66 typedef mach_port_t io_object_t;
     67 typedef io_object_t io_service_t;
     68 typedef struct __DASession * DASessionRef;
     69 extern DASessionRef DASessionCreate( CFAllocatorRef allocator );
     70 typedef struct __DADisk * DADiskRef;
     71 extern DADiskRef DADiskCreateFromBSDName( CFAllocatorRef allocator, DASessionRef session, const char * name );
     72 extern DADiskRef DADiskCreateFromIOMedia( CFAllocatorRef allocator, DASessionRef session, io_service_t media );
     73 extern CFDictionaryRef DADiskCopyDescription( DADiskRef disk );
     74 extern DADiskRef DADiskCopyWholeDisk( DADiskRef disk );
     75 @interface NSAppleEventManager : NSObject {
     76 }
     77 @end enum {
     78 kDAReturnSuccess = 0,     kDAReturnError = (((0x3eU)&0x3f)<<26) | (((0x368)&0xfff)<<14) | 0x01,     kDAReturnBusy = (((0x3eU)&0x3f)<<26) | (((0x368)&0xfff)<<14) | 0x02,     kDAReturnBadArgument = (((0x3eU)&0x3f)<<26) | (((0x368)&0xfff)<<14) | 0x03,     kDAReturnExclusiveAccess = (((0x3eU)&0x3f)<<26) | (((0x368)&0xfff)<<14) | 0x04,     kDAReturnNoResources = (((0x3eU)&0x3f)<<26) | (((0x368)&0xfff)<<14) | 0x05,     kDAReturnNotFound = (((0x3eU)&0x3f)<<26) | (((0x368)&0xfff)<<14) | 0x06,     kDAReturnNotMounted = (((0x3eU)&0x3f)<<26) | (((0x368)&0xfff)<<14) | 0x07,     kDAReturnNotPermitted = (((0x3eU)&0x3f)<<26) | (((0x368)&0xfff)<<14) | 0x08,     kDAReturnNotPrivileged = (((0x3eU)&0x3f)<<26) | (((0x368)&0xfff)<<14) | 0x09,     kDAReturnNotReady = (((0x3eU)&0x3f)<<26) | (((0x368)&0xfff)<<14) | 0x0A,     kDAReturnNotWritable = (((0x3eU)&0x3f)<<26) | (((0x368)&0xfff)<<14) | 0x0B,     kDAReturnUnsupported = (((0x3eU)&0x3f)<<26) | (((0x368)&0xfff)<<14) | 0x0C };
     79 typedef mach_error_t DAReturn;
     80 typedef const struct __DADissenter * DADissenterRef;
     81 extern DADissenterRef DADissenterCreate( CFAllocatorRef allocator, DAReturn status, CFStringRef string );
     82 @interface NSNumber : NSObject
     83 - (id)initWithInt:(int)value;
     84 @end
     85 typedef unsigned long NSUInteger;
     86 @interface NSArray : NSObject
     87 -(id) initWithObjects:(const id *)objects count:(NSUInteger) cnt;
     88 @end
     89 
     90 //===----------------------------------------------------------------------===//
     91 // Test cases.
     92 //===----------------------------------------------------------------------===//
     93 
     94 // Test to see if we *issue* an error when we store the pointer
     95 // to a struct.  This differs from basic store.
     96 
     97 CFAbsoluteTime CFAbsoluteTimeGetCurrent(void);
     98 
     99 struct foo {
    100   NSDate* f;
    101 };
    102 
    103 // FIXME: We should be warning about a use-after-free here, but we
    104 // temporarily "escape" retain counted objects stored to structs very eagerly
    105 // until we can properly tell whether they have escaped via a return value
    106 // or not.
    107 CFAbsoluteTime f4() {
    108   struct foo x;
    109   
    110   CFAbsoluteTime t = CFAbsoluteTimeGetCurrent();
    111   CFDateRef date = CFDateCreate(0, t);  
    112   [((NSDate*) date) retain];
    113   CFRelease(date);
    114   CFDateGetAbsoluteTime(date); // no-warning
    115   x.f = (NSDate*) date;  
    116   [((NSDate*) date) release];
    117   // FIXME: the following line should warn.
    118   t = CFDateGetAbsoluteTime(date);   // no-warning
    119   return t;
    120 }
    121 
    122 // Test that assigning to an self.ivar loses track of an object.
    123 // This is a temporary hack to reduce false positives.
    124 @interface Test3 : NSObject {
    125   id myObj;
    126 }
    127 - (void)test_self_assign_ivar;
    128 @end
    129 
    130 @implementation Test3
    131 - (void)test_self_assign_ivar {
    132   CFAbsoluteTime t = CFAbsoluteTimeGetCurrent();
    133   CFDateRef date = CFDateCreate(0, t); // no-warning
    134   myObj = (id) date;
    135 }
    136 @end
    137 
    138 //===------------------------------------------------------------------------------------------===//
    139 // <rdar://problem/7257223> (also <rdar://problem/7283470>) - False positive due to not invalidating
    140 //  the reference count of a tracked region that was itself invalidated.
    141 //===------------------------------------------------------------------------------------------===//
    142 
    143 typedef struct __rdar_7257223 { CFDateRef x; } RDar7257223;
    144 void rdar_7257223_aux(RDar7257223 *p);
    145 
    146 CFDateRef rdar7257223_Create(void) {
    147   RDar7257223 s;
    148   CFAbsoluteTime t = CFAbsoluteTimeGetCurrent();
    149   s.x = CFDateCreate(0, t); // no-warning
    150   rdar_7257223_aux(&s);
    151   return s.x;
    152 }
    153 
    154 CFDateRef rdar7257223_Create_2(void) {
    155   RDar7257223 s;
    156   CFAbsoluteTime t = CFAbsoluteTimeGetCurrent();
    157   s.x = CFDateCreate(0, t); // no-warning
    158   return s.x;
    159 }
    160 
    161 void rdar7283470(void) {
    162   NSNumber *numbers[] = {
    163     [[NSNumber alloc] initWithInt:1], // no-warning
    164     [[NSNumber alloc] initWithInt:2], // no-warning
    165     [[NSNumber alloc] initWithInt:3], // no-warning
    166     [[NSNumber alloc] initWithInt:4], // no-warning
    167     [[NSNumber alloc] initWithInt:5]  // no-warning
    168   };
    169   
    170   for (unsigned i = 0 ; i < sizeof(numbers) / sizeof(numbers[0]) ; ++i)
    171     [numbers[i] release];
    172 }
    173 
    174 void rdar7283470_positive(void) {
    175   NSNumber *numbers[] = {
    176     [[NSNumber alloc] initWithInt:1], // expected-warning{{leak}}
    177     [[NSNumber alloc] initWithInt:2], // expected-warning{{leak}}
    178     [[NSNumber alloc] initWithInt:3], // expected-warning{{leak}}
    179     [[NSNumber alloc] initWithInt:4], // expected-warning{{leak}}
    180     [[NSNumber alloc] initWithInt:5]  // expected-warning{{leak}} 
    181   };
    182 }
    183 
    184 void rdar7283470_2(void) {
    185   NSNumber *numbers[] = {
    186     [[NSNumber alloc] initWithInt:1], // no-warning
    187     [[NSNumber alloc] initWithInt:2], // no-warning
    188     [[NSNumber alloc] initWithInt:3], // no-warning
    189     [[NSNumber alloc] initWithInt:4], // no-warning
    190     [[NSNumber alloc] initWithInt:5]  // no-warning
    191   };
    192   
    193   NSArray *s_numbers =[[NSArray alloc] initWithObjects:&numbers[0] count:sizeof(numbers) / sizeof(numbers[0])];
    194   
    195   for (unsigned i = 0 ; i < sizeof(numbers) / sizeof(numbers[0]) ; ++i)
    196     [numbers[i] release];
    197   
    198   [s_numbers release];
    199 }
    200 
    201 void rdar7283470_2_positive(void) {
    202   NSNumber *numbers[] = {
    203     [[NSNumber alloc] initWithInt:1], // no-warning
    204     [[NSNumber alloc] initWithInt:2], // no-warning
    205     [[NSNumber alloc] initWithInt:3], // no-warning
    206     [[NSNumber alloc] initWithInt:4], // no-warning
    207     [[NSNumber alloc] initWithInt:5]  // no-warning
    208   };
    209   
    210   NSArray *s_numbers =[[NSArray alloc] initWithObjects: &numbers[0] count:sizeof(numbers) / sizeof(numbers[0])]; // expected-warning{{leak}}
    211   
    212   for (unsigned i = 0 ; i < sizeof(numbers) / sizeof(numbers[0]) ; ++i)
    213     [numbers[i] release];
    214 }
    215 
    216 void pr6699(int x) {
    217   CFDateRef values[2];
    218   values[0] = values[1] = 0;
    219 
    220   if (x) {
    221     CFAbsoluteTime t = CFAbsoluteTimeGetCurrent();
    222     values[1] = CFDateCreate(0, t);
    223   }
    224 
    225   if (values[1]) {
    226     // A bug in RegionStore::RemoveDeadBindings caused 'values[1]' to get prematurely
    227     // pruned from the store.
    228     CFRelease(values[1]); // no-warning
    229   }
    230 }
    231 
    232 // <rdar://problem/8261992> Idempotent operation checker false positive with ObjC ivars
    233 @interface R8261992 : NSObject {
    234   @package int myIvar;
    235 }
    236 @end
    237 
    238 static void R8261992_ChangeMyIvar(R8261992 *tc) {
    239     tc->myIvar = 5;
    240 }
    241 
    242 void R8261992_test(R8261992 *tc) {
    243   int temp = tc->myIvar;
    244   // The ivar binding for tc->myIvar gets invalidated.
    245   R8261992_ChangeMyIvar(tc);
    246   tc->myIvar = temp; // no-warning
    247   tc = [[R8261992 alloc] init];
    248   temp = tc->myIvar; // no-warning
    249   // The ivar binding for tc->myIvar gets invalidated.
    250   R8261992_ChangeMyIvar(tc);
    251   tc->myIvar = temp;
    252   [tc release]; // no-warning
    253   // did we analyze this?
    254   int *p = 0x0;
    255   *p = 0xDEADBEEF; // expected-warning{{null}}
    256 }
    257 
    258