pghs975uc
/
infer_clone
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '12415a174d'
${ noResults }
infer_clone/infer/tests/codetoanalyze/objcpp/pulse/issues.exp

26 lines
8.5 KiB
Raw Normal View History Unescape

[pulse] no longer drop attributes of dead addresses Summary: When garbage-collecting addresses we would also remove their attributes. But even though the addresses are no longer allocated in the heap, they might show up in the formula and so we need to remember facts about them. This forces us to detect leaks closer to the point where addresses are deleted from the heap, in AbductiveDomain.ml. This is a nice refactoring in itself: doing so fixes some other FNs where we sometimes missed leak detection on dead addresses. This also makes it unecessary to simplify InstanceOf eagerly when variables get out of scope. Some new {folly,std}::optionals false positives that either are similar to existing ones or involve unmodelled smart pointers. Reviewed By: da319 Differential Revision: D28126103 fbshipit-source-id: e3a903282
4 years ago
codetoanalyze/objcpp/pulse/AllocPatternMemLeak.mm, A.create_no_release_leak_bad, 2, MEMORY_LEAK, no_bucket, ERROR, [allocation part of the trace starts here,allocated by call to `ABFDataCreate` (modelled),allocation part of the trace ends here,memory becomes unreachable here]
[pulse][objc][nullptr] Model NSMutableDictionary.setObject:forKeyedSubscript: Summary: `mutableDictionary[key] = value`, crashes if key is nil, however, if value is nil, any object corresponding to a key will be removed from the dictionary. Under the hood, `NSMutableDictionary.setObject:forKeyedSubscript:` is called by `mutableDictionary[key] = value`. Reviewed By: ezgicicek Differential Revision: D28288789 fbshipit-source-id: e4e1c4288
4 years ago
codetoanalyze/objcpp/pulse/NPEBasic.mm, accessZeroElementOk_FP, 4, NIL_INSERTION_INTO_COLLECTION, no_bucket, ERROR, [source of the null value part of the trace starts here,assigned,is the null pointer,null pointer dereference part of the trace starts here,assigned,passed as argument to `NSArray.objectAtIndexedSubscript:`,return from call to `NSArray.objectAtIndexedSubscript:`,assigned,when calling `addInDictBracketsDefault` here,parameter `key` of addInDictBracketsDefault,passed as argument to `mutableDictionary[someKey] = value` (modelled),return from call to `mutableDictionary[someKey] = value` (modelled),invalid access occurs here]
[pulse][objc][nullptr] Model NSArray methods to catch nil insertion into collection issues Reviewed By: jvillard Differential Revision: D28257293 fbshipit-source-id: c9808ebf8
4 years ago
codetoanalyze/objcpp/pulse/NPEBasic.mm, addNilInArrayBad, 0, NIL_INSERTION_INTO_COLLECTION, no_bucket, ERROR, [is the null pointer,passed as argument to `NSMutableArray.addObject:` (modelled),return from call to `NSMutableArray.addObject:` (modelled),invalid access occurs here]
[pulse][nullptr][objc] A separate issue type for nil insertion into collections Reviewed By: jvillard Differential Revision: D28221909 fbshipit-source-id: 49750ceb3
4 years ago
codetoanalyze/objcpp/pulse/NPEBasic.mm, addNilInDictBad, 2, NIL_INSERTION_INTO_COLLECTION, no_bucket, ERROR, [is the null pointer,assigned,passed as argument to `NSMutableDictionary.setObject:forKey:` (modelled),return from call to `NSMutableDictionary.setObject:forKey:` (modelled),invalid access occurs here]
[pulse][objc][nullptr] Model NSMutableDictionary.setObject:forKeyedSubscript: Summary: `mutableDictionary[key] = value`, crashes if key is nil, however, if value is nil, any object corresponding to a key will be removed from the dictionary. Under the hood, `NSMutableDictionary.setObject:forKeyedSubscript:` is called by `mutableDictionary[key] = value`. Reviewed By: ezgicicek Differential Revision: D28288789 fbshipit-source-id: e4e1c4288
4 years ago
codetoanalyze/objcpp/pulse/NPEBasic.mm, addNilKeyInDictBracketsBad, 2, NIL_INSERTION_INTO_COLLECTION, no_bucket, ERROR, [is the null pointer,assigned,passed as argument to `mutableDictionary[someKey] = value` (modelled),return from call to `mutableDictionary[someKey] = value` (modelled),invalid access occurs here]
[pulse][objc][nullptr] Model NSMutableSet methods to catch nil issues Summary: Facebook Reviewed By: ezgicicek Differential Revision: D28382190 fbshipit-source-id: 9e763043f
4 years ago
codetoanalyze/objcpp/pulse/NPEBasic.mm, addObjectInMSetBad, 0, NIL_INSERTION_INTO_COLLECTION, no_bucket, ERROR, [is the null pointer,when calling `addObjectInMSet` here,parameter `object` of addObjectInMSet,passed as argument to `NSMutableSet.addObject:` (modelled),return from call to `NSMutableSet.addObject:` (modelled),invalid access occurs here]
[pulse][nullptr][objc] A separate issue type for nil insertion into collections Reviewed By: jvillard Differential Revision: D28221909 fbshipit-source-id: 49750ceb3
4 years ago
codetoanalyze/objcpp/pulse/NPEBasic.mm, addObjectKeyNilInDictBad, 2, NIL_INSERTION_INTO_COLLECTION, no_bucket, ERROR, [is the null pointer,passed as argument to `NSMutableDictionary.setObject:forKey:` (modelled),return from call to `NSMutableDictionary.setObject:forKey:` (modelled),invalid access occurs here]
[pulse] better traces when invalidation happens along the access trace Summary: As explained in the previous diff: when the access trace goes through the invalidation step there is no need to print the invalidation trace at all. Note: only a few sources of invalidation are handled at the moment. The following diffs gradually fix the other sources of invalidation. Reviewed By: skcho Differential Revision: D28098335 fbshipit-source-id: 5a5e6481e
4 years ago
codetoanalyze/objcpp/pulse/NPEBasic.mm, dereferenceNilBad, 2, NULLPTR_DEREFERENCE, no_bucket, ERROR, [is the null pointer,assigned,invalid access occurs here]
[pulse][objc][nullptr] Tests for NSDictionary literals Summary: There is no need to model anything, Pulse is able to catch nil insertion into NSDictionary literals because the frontend dereferences keys and values during the translation of NSDictionary literals Reviewed By: jvillard Differential Revision: D28383176 fbshipit-source-id: 01a064daf
4 years ago
codetoanalyze/objcpp/pulse/NPEBasic.mm, dictionaryLiteralKeyNilBad, 0, NULLPTR_DEREFERENCE, no_bucket, ERROR, [is the null pointer,when calling `dictionaryLiteral` here,parameter `key` of dictionaryLiteral,invalid access occurs here]
codetoanalyze/objcpp/pulse/NPEBasic.mm, dictionaryLiteralObjectNilBad, 0, NULLPTR_DEREFERENCE, no_bucket, ERROR, [is the null pointer,when calling `dictionaryLiteral` here,parameter `object` of dictionaryLiteral,invalid access occurs here]
[pulse][objc][nullptr] Model more NSMutableDictionary methods to catch nil insertion into collection issues Reviewed By: jvillard Differential Revision: D28352735 fbshipit-source-id: ea263b0d7
4 years ago
codetoanalyze/objcpp/pulse/NPEBasic.mm, dictionaryWithSharedKeySetBad, 2, NIL_INSERTION_INTO_COLLECTION, no_bucket, ERROR, [is the null pointer,passed as argument to `NSMutableDictionary.dictionaryWithSharedKeySet` (modelled),return from call to `NSMutableDictionary.dictionaryWithSharedKeySet` (modelled),invalid access occurs here]
[pulse][objc][nullptr] Model NSArray methods to catch nil insertion into collection issues Reviewed By: jvillard Differential Revision: D28257293 fbshipit-source-id: c9808ebf8
4 years ago
codetoanalyze/objcpp/pulse/NPEBasic.mm, insertNilInArrayBad, 1, NIL_INSERTION_INTO_COLLECTION, no_bucket, ERROR, [is the null pointer,passed as argument to `NSMutableArray.insertObject:atIndex:` (modelled),return from call to `NSMutableArray.insertObject:atIndex:` (modelled),invalid access occurs here]
[pulse][objc][nullptr] Model more NSMutableDictionary methods to catch nil insertion into collection issues Reviewed By: jvillard Differential Revision: D28352735 fbshipit-source-id: ea263b0d7
4 years ago
codetoanalyze/objcpp/pulse/NPEBasic.mm, removeObjectFromDictKeyNilBad, 1, NIL_INSERTION_INTO_COLLECTION, no_bucket, ERROR, [is the null pointer,when calling `removeObjectFromDict` here,parameter `key` of removeObjectFromDict,passed as argument to `NSMutableDictionary.removeObjectForKey` (modelled),return from call to `NSMutableDictionary.removeObjectForKey` (modelled),invalid access occurs here]
[pulse][objc][nullptr] Model NSMutableSet methods to catch nil issues Summary: Facebook Reviewed By: ezgicicek Differential Revision: D28382190 fbshipit-source-id: 9e763043f
4 years ago
codetoanalyze/objcpp/pulse/NPEBasic.mm, removeObjectFromMSetBad, 1, NIL_INSERTION_INTO_COLLECTION, no_bucket, ERROR, [is the null pointer,when calling `removeObjectFromMSet` here,parameter `object` of removeObjectFromMSet,passed as argument to `NSMutableSet.removeObject:` (modelled),return from call to `NSMutableSet.removeObject:` (modelled),invalid access occurs here]
[pulse][objc][nullptr] Model NSArray methods to catch nil insertion into collection issues Reviewed By: jvillard Differential Revision: D28257293 fbshipit-source-id: c9808ebf8
4 years ago
codetoanalyze/objcpp/pulse/NPEBasic.mm, replaceNilInArrayBad, 1, NIL_INSERTION_INTO_COLLECTION, no_bucket, ERROR, [is the null pointer,passed as argument to `NSMutableArray.replaceObjectAtIndex:withObject:` (modelled),return from call to `NSMutableArray.replaceObjectAtIndex:withObject:` (modelled),invalid access occurs here]
[pulse] better traces when invalidation happens along the access trace Summary: As explained in the previous diff: when the access trace goes through the invalidation step there is no need to print the invalidation trace at all. Note: only a few sources of invalidation are handled at the moment. The following diffs gradually fix the other sources of invalidation. Reviewed By: skcho Differential Revision: D28098335 fbshipit-source-id: 5a5e6481e
4 years ago
codetoanalyze/objcpp/pulse/NPEBasic.mm, testAccessPropertyAccessorBad, 2, NIL_MESSAGING_TO_NON_POD, no_bucket, ERROR, [is the null pointer,assigned,when calling `SomeObject.ptr` here,parameter `self` of SomeObject.ptr,invalid access occurs here]
codetoanalyze/objcpp/pulse/NPEBasic.mm, testCallMethodReturnsnonPODBad, 2, NIL_MESSAGING_TO_NON_POD, no_bucket, ERROR, [is the null pointer,assigned,when calling `SomeObject.returnsnonPOD` here,parameter `self` of SomeObject.returnsnonPOD,invalid access occurs here]
codetoanalyze/objcpp/pulse/NPEBasic.mm, testCallMethodReturnsnonPODLatent, 7, NIL_MESSAGING_TO_NON_POD, no_bucket, ERROR, [*** LATENT ***,is the null pointer,assigned,when calling `SomeObject.returnsnonPOD` here,parameter `self` of SomeObject.returnsnonPOD,invalid access occurs here]
[pulse] correct order of calling context in trace Summary: The order was reversed when printing the trace, leading to confusion. Also make sure we indicate which part of the trace we are printing when there is more than one part (either context + access or invalidation + access, or all three). Also start nesting at <calling context length> to better represent the role of the calling context visually. Reviewed By: da319 Differential Revision: D28329263 fbshipit-source-id: b691fb1f4
4 years ago
codetoanalyze/objcpp/pulse/NPEBasic.mm, testCallMethodReturnsnonPODLatentBad, 1, NIL_MESSAGING_TO_NON_POD, no_bucket, ERROR, [calling context starts here,in call to `testCallMethodReturnsnonPODLatent`,null pointer dereference part of the trace starts here,is the null pointer,assigned,when calling `SomeObject.returnsnonPOD` here,parameter `self` of SomeObject.returnsnonPOD,invalid access occurs here]
[pulse][nullptr][objc] A separate issue type for nil insertion into collections Reviewed By: jvillard Differential Revision: D28221909 fbshipit-source-id: 49750ceb3
4 years ago
codetoanalyze/objcpp/pulse/NPEBasic.mm, testNilMessagingForModelNilNilOK_FP, 0, NIL_INSERTION_INTO_COLLECTION, no_bucket, ERROR, [is the null pointer,when calling `addObjectInDict` here,parameter `value` of addObjectInDict,passed as argument to `NSMutableDictionary.setObject:forKey:` (modelled),return from call to `NSMutableDictionary.setObject:forKey:` (modelled),invalid access occurs here]
codetoanalyze/objcpp/pulse/NPEBasic.mm, testNilMessagingForModelNotNilDictBad, 1, NIL_INSERTION_INTO_COLLECTION, no_bucket, ERROR, [is the null pointer,when calling `addObjectInDict` here,parameter `value` of addObjectInDict,passed as argument to `NSMutableDictionary.setObject:forKey:` (modelled),return from call to `NSMutableDictionary.setObject:forKey:` (modelled),invalid access occurs here]
[pulse] Separate issue type for nil messaging of non-pod return type Summary: Added a new issue type for sending a message to nil when its return type is non-POD. To distinguish these issues from other nullptr dereference issues, we extend the `MustBeValid` attribute to contain the reason of why an address must be valid. For now a reason can only have `SelfOfNonPODReturnMethod` as it's value, but in the future we will use it for other nullability issue types, such as nil insertion into collections. Reviewed By: jvillard Differential Revision: D27762333 fbshipit-source-id: 689e5a431
4 years ago
codetoanalyze/objcpp/pulse/NPEBasic.mm, testNonPODTraceBad, 2, NIL_MESSAGING_TO_NON_POD, no_bucket, ERROR, [source of the null value part of the trace starts here,when calling `SomeObject.returnsNil` here,assigned,is the null pointer,null pointer dereference part of the trace starts here,passed as argument to `SomeObject.returnsNil`,return from call to `SomeObject.returnsNil`,passed as argument to `SomeObject.get`,return from call to `SomeObject.get`,assigned,when calling `SomeObject.returnsnonPOD` here,parameter `self` of SomeObject.returnsnonPOD,invalid access occurs here]
[pulse] better traces when invalidation happens along the access trace Summary: As explained in the previous diff: when the access trace goes through the invalidation step there is no need to print the invalidation trace at all. Note: only a few sources of invalidation are handled at the moment. The following diffs gradually fix the other sources of invalidation. Reviewed By: skcho Differential Revision: D28098335 fbshipit-source-id: 5a5e6481e
4 years ago
codetoanalyze/objcpp/pulse/NPEBasic.mm, testTraceBad, 3, NULLPTR_DEREFERENCE, no_bucket, ERROR, [is the null pointer,assigned,passed as argument to `SomeObject.getXPtr`,return from call to `SomeObject.getXPtr`,assigned,invalid access occurs here]
[pulse] Model builtin __new as returning non-null Summary: We model internal builtin `__new` function to return a non-null value. This fixes nullptr_dereference false positives where we explicitly check the result of a function call for nullptr when the function returns a newly created object. Reviewed By: jvillard Differential Revision: D22772217 fbshipit-source-id: 37d209697
4 years ago
codetoanalyze/objcpp/pulse/use_after_delete.mm, PulseTest.deref_deleted_in_objc_method_bad, 3, USE_AFTER_DELETE, no_bucket, ERROR, [invalidation part of the trace starts here,passed as argument to `new` (modelled),return from call to `new` (modelled),assigned,was invalidated by `delete`,use-after-lifetime part of the trace starts here,passed as argument to `new` (modelled),return from call to `new` (modelled),assigned,when calling `Simple::Simple` here,parameter `__param_0` of Simple::Simple,invalid access occurs here]
codetoanalyze/objcpp/pulse/use_after_delete.mm, deref_deleted_bad, 3, USE_AFTER_DELETE, no_bucket, ERROR, [invalidation part of the trace starts here,passed as argument to `new` (modelled),return from call to `new` (modelled),assigned,was invalidated by `delete`,use-after-lifetime part of the trace starts here,passed as argument to `new` (modelled),return from call to `new` (modelled),assigned,when calling `Simple::Simple` here,parameter `__param_0` of Simple::Simple,invalid access occurs here]