Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[analyzer] MallocChecker: Prevent Integer Set Library false positives
Summary: Integer Set Library using retain-count based allocation which is not modeled in MallocChecker. Reviewed By: NoQ Tags: #clang Differential Revision: https://reviews.llvm.org/D64680 llvm-svn: 366391
- Loading branch information
Showing
2 changed files
with
75 additions
and
1 deletion.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,37 @@ | ||
// RUN: %clang_analyze_cc1 \ | ||
// RUN: -analyzer-checker=core,unix.Malloc \ | ||
// RUN: -verify %s | ||
|
||
// expected-no-diagnostics: We do not model Integer Set Library's retain-count | ||
// based allocation. If any of the parameters has an | ||
// '__isl_' prefixed macro definition we escape every | ||
// of them when we are about to 'free()' something. | ||
|
||
#define __isl_take | ||
#define __isl_keep | ||
|
||
struct Object { int Ref; }; | ||
void free(void *); | ||
|
||
Object *copyObj(__isl_keep Object *O) { | ||
O->Ref++; | ||
return O; | ||
} | ||
|
||
void freeObj(__isl_take Object *O) { | ||
if (--O->Ref > 0) | ||
return; | ||
|
||
free(O); // Here we notice that the parameter contains '__isl_', escape it. | ||
} | ||
|
||
void useAfterFree(__isl_take Object *A) { | ||
if (!A) | ||
return; | ||
|
||
Object *B = copyObj(A); | ||
freeObj(B); | ||
|
||
A->Ref = 13; | ||
// no-warning: 'Use of memory after it is freed' was here. | ||
} |