Summary: Replaced by pulse. `--ownership` is now a deprecated form of `--pulse`. The ownership checker is starting to give wrong answers due to changes in the clang frontend, so it's better to remove it in favour of pulse. there_goes_my_hero Reviewed By: ngorogiannis Differential Revision: D16107650 fbshipit-source-id: bb2446a19master
Jules Villard
5 years ago
committed by
Facebook Github Bot
parent
bc208ee9c8
commit
c89a8d3e63
@ -1,418 +0,0 @@
|
||||
(*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates.
|
||||
*
|
||||
* This source code is licensed under the MIT license found in the
|
||||
* LICENSE file in the root directory of this source tree.
|
||||
*)
|
||||
|
||||
open! IStd
|
||||
module F = Format
|
||||
module L = Logging
|
||||
|
||||
module Base = struct
|
||||
type t = AccessPath.base
|
||||
|
||||
let compare = AccessPath.compare_base
|
||||
|
||||
let pp = AccessPath.pp_base
|
||||
end
|
||||
|
||||
module VarSet = AbstractDomain.FiniteSet (Base)
|
||||
|
||||
module CapabilityDomain = struct
|
||||
type t =
|
||||
| InvalidatedAt of Location.t
|
||||
(** neither owned nor borrowed; we can't safely do anything with this value. tagged with the
|
||||
location where invalidation occurred. *)
|
||||
| BorrowedFrom of VarSet.t
|
||||
(** not owned, but borrowed from existing reference(s). for now, permits both reads and writes *)
|
||||
| Owned
|
||||
(** owned. permits reads, writes, and ownership transfer (e.g. call a destructor, delete, or free) *)
|
||||
|
||||
let make_borrowed_vars vars =
|
||||
assert (not (VarSet.is_empty vars)) ;
|
||||
BorrowedFrom vars
|
||||
|
||||
|
||||
(** Owned <= BorrowedFrom <= InvalidatedAt *)
|
||||
let ( <= ) ~lhs ~rhs =
|
||||
if phys_equal lhs rhs then true
|
||||
else
|
||||
match (lhs, rhs) with
|
||||
| InvalidatedAt loc1, InvalidatedAt loc2 ->
|
||||
Location.compare loc1 loc2 <= 0
|
||||
| _, InvalidatedAt _ ->
|
||||
true
|
||||
| InvalidatedAt _, _ ->
|
||||
false
|
||||
| BorrowedFrom s1, BorrowedFrom s2 ->
|
||||
VarSet.( <= ) ~lhs:s1 ~rhs:s2
|
||||
| Owned, _ ->
|
||||
true
|
||||
| _, Owned ->
|
||||
false
|
||||
|
||||
|
||||
let join astate1 astate2 =
|
||||
if phys_equal astate1 astate2 then astate1
|
||||
else
|
||||
match (astate1, astate2) with
|
||||
| BorrowedFrom s1, BorrowedFrom s2 ->
|
||||
BorrowedFrom (VarSet.union s1 s2)
|
||||
| Owned, astate | astate, Owned ->
|
||||
astate
|
||||
| InvalidatedAt loc1, InvalidatedAt loc2 ->
|
||||
(* pick the "higher" program point that occurs syntactically later *)
|
||||
if Location.compare loc1 loc2 >= 0 then astate1 else astate2
|
||||
| (InvalidatedAt _ as invalid), _ | _, (InvalidatedAt _ as invalid) ->
|
||||
invalid
|
||||
|
||||
|
||||
let widen ~prev ~next ~num_iters:_ = join prev next
|
||||
|
||||
let pp fmt = function
|
||||
| InvalidatedAt loc ->
|
||||
F.fprintf fmt "InvalidatedAt(%a)" Location.pp loc
|
||||
| BorrowedFrom vars ->
|
||||
F.fprintf fmt "BorrowedFrom(%a)" VarSet.pp vars
|
||||
| Owned ->
|
||||
F.pp_print_string fmt "Owned"
|
||||
end
|
||||
|
||||
let rec is_function_typ = function
|
||||
| {Typ.desc= Tptr (t, _)} ->
|
||||
is_function_typ t
|
||||
| {Typ.desc= Tstruct typename} ->
|
||||
String.is_prefix ~prefix:"std::function" (Typ.Name.name typename)
|
||||
| _ ->
|
||||
false
|
||||
|
||||
|
||||
(** map from program variable to its capability *)
|
||||
module Domain = struct
|
||||
include AbstractDomain.Map (Base) (CapabilityDomain)
|
||||
|
||||
let report message loc ltr summary =
|
||||
Reporting.log_error summary ~loc ~ltr IssueType.use_after_lifetime message
|
||||
|
||||
|
||||
let report_return_stack_var (var, _) loc summary =
|
||||
let message =
|
||||
F.asprintf "Reference to stack variable %a is returned at %a" Var.pp var Location.pp loc
|
||||
in
|
||||
let ltr =
|
||||
[ Errlog.make_trace_element 0 loc "Return of stack variable" []
|
||||
; Errlog.make_trace_element 0 loc "End of procedure" [] ]
|
||||
in
|
||||
report message loc ltr summary
|
||||
|
||||
|
||||
let report_use_after_lifetime (var, _) ~use_loc ~invalidated_loc summary =
|
||||
if Var.appears_in_source_code var then
|
||||
let message =
|
||||
F.asprintf "Variable %a is used at line %a after its lifetime ended at %a" Var.pp var
|
||||
Location.pp use_loc Location.pp invalidated_loc
|
||||
in
|
||||
let ltr =
|
||||
[ Errlog.make_trace_element 0 invalidated_loc "End of variable lifetime" []
|
||||
; Errlog.make_trace_element 0 use_loc "Use of invalid variable" [] ]
|
||||
in
|
||||
report message use_loc ltr summary
|
||||
|
||||
|
||||
(* complain if we do not have the right capability to access [var] *)
|
||||
let check_var_lifetime base_var use_loc summary astate =
|
||||
let open CapabilityDomain in
|
||||
match find base_var astate with
|
||||
| InvalidatedAt invalidated_loc ->
|
||||
report_use_after_lifetime base_var ~use_loc ~invalidated_loc summary
|
||||
| BorrowedFrom borrowed_vars ->
|
||||
(* warn if any of the borrowed vars are Invalid *)
|
||||
let report_invalidated v =
|
||||
match find v astate with
|
||||
| InvalidatedAt invalidated_loc ->
|
||||
report_use_after_lifetime base_var ~use_loc ~invalidated_loc summary
|
||||
| BorrowedFrom _
|
||||
(* TODO: can do deeper checking here, but have to worry about borrow cycles *)
|
||||
| Owned ->
|
||||
()
|
||||
| exception Caml.Not_found ->
|
||||
()
|
||||
in
|
||||
VarSet.iter report_invalidated borrowed_vars
|
||||
| Owned ->
|
||||
()
|
||||
| exception Caml.Not_found ->
|
||||
()
|
||||
|
||||
|
||||
let base_add_read ((_, typ) as base_var) loc summary astate =
|
||||
(* don't warn if it's a read of a std::function type. we model closures as borrowing their
|
||||
captured vars, but simply reading a closure doesn't actually use these vars. this means that
|
||||
we'll miss bugs involving invalid uses of std::function's, but that seems ok *)
|
||||
if not (is_function_typ typ) then check_var_lifetime base_var loc summary astate ;
|
||||
astate
|
||||
|
||||
|
||||
let access_path_add_read (base, _) loc summary astate = base_add_read base loc summary astate
|
||||
|
||||
let exp_add_reads exp loc summary astate =
|
||||
List.fold
|
||||
~f:(fun acc access_expr ->
|
||||
access_path_add_read (HilExp.AccessExpression.to_access_path access_expr) loc summary acc
|
||||
)
|
||||
(HilExp.get_access_exprs exp) ~init:astate
|
||||
|
||||
|
||||
let actuals_add_reads actuals loc summary astate =
|
||||
(* TODO: handle reads in actuals + return values properly. This is nontrivial because the
|
||||
frontend sometimes chooses to translate return as pass-by-ref on a dummy actual *)
|
||||
List.fold actuals
|
||||
~f:(fun acc actual_exp -> exp_add_reads actual_exp loc summary acc)
|
||||
~init:astate
|
||||
|
||||
|
||||
let borrow_vars lhs_base rhs_vars astate =
|
||||
(* borrow all of the vars read on the rhs *)
|
||||
if VarSet.is_empty rhs_vars then remove lhs_base astate
|
||||
else add lhs_base (CapabilityDomain.make_borrowed_vars rhs_vars) astate
|
||||
|
||||
|
||||
(* copy capability if it exists, consider borrowing if it doesn't *)
|
||||
let copy_or_borrow_var lhs_base rhs_base astate =
|
||||
try
|
||||
let rhs_capability = find rhs_base astate in
|
||||
add lhs_base rhs_capability astate
|
||||
with Caml.Not_found ->
|
||||
if Var.is_cpp_temporary (fst rhs_base) then
|
||||
borrow_vars lhs_base (VarSet.singleton rhs_base) astate
|
||||
else add lhs_base CapabilityDomain.Owned astate
|
||||
|
||||
|
||||
(* handle assigning directly to a base var *)
|
||||
let handle_var_assign ?(is_operator_equal = false) lhs_base rhs_exp loc summary astate =
|
||||
match (rhs_exp : HilExp.t) with
|
||||
| Constant _ when not (Var.is_cpp_temporary (fst lhs_base)) ->
|
||||
add lhs_base CapabilityDomain.Owned astate
|
||||
| AccessExpression (Base rhs_base | AddressOf (Base rhs_base))
|
||||
when not (Var.appears_in_source_code (fst rhs_base)) ->
|
||||
copy_or_borrow_var lhs_base rhs_base astate
|
||||
| Closure (_, captured_vars) ->
|
||||
(* TODO: can be folded into the case above once we have proper AccessExpressions *)
|
||||
let vars_captured_by_ref =
|
||||
List.fold captured_vars
|
||||
~f:(fun acc (((_, typ) as base), _) ->
|
||||
match typ.Typ.desc with Typ.Tptr _ -> VarSet.add base acc | _ -> acc )
|
||||
~init:VarSet.empty
|
||||
in
|
||||
borrow_vars lhs_base vars_captured_by_ref astate
|
||||
| AccessExpression (Base rhs_base)
|
||||
when (not is_operator_equal) && Typ.is_reference (snd rhs_base) ->
|
||||
copy_or_borrow_var lhs_base rhs_base astate
|
||||
| AccessExpression (AddressOf (Base rhs_base)) when not is_operator_equal ->
|
||||
borrow_vars lhs_base (VarSet.singleton rhs_base) astate
|
||||
| _ ->
|
||||
(* TODO: support capability transfer between source vars, other assignment modes *)
|
||||
exp_add_reads rhs_exp loc summary astate |> remove lhs_base
|
||||
|
||||
|
||||
let release_ownership base loc summary astate =
|
||||
base_add_read base loc summary astate |> add base (CapabilityDomain.InvalidatedAt loc)
|
||||
end
|
||||
|
||||
module TransferFunctions (CFG : ProcCfg.S) = struct
|
||||
module CFG = CFG
|
||||
module Domain = Domain
|
||||
|
||||
type extras = Summary.t
|
||||
|
||||
let is_aggregate (_, typ) =
|
||||
match typ.Typ.desc with
|
||||
| Tstruct _ ->
|
||||
(* TODO: we could compute this precisely by recursively checking all of the fields of the
|
||||
type, but that's going to be expensive. will add it to the frontend instead *)
|
||||
true
|
||||
| _ ->
|
||||
false
|
||||
|
||||
|
||||
let get_assigned_base (access_expression : HilExp.AccessExpression.t) =
|
||||
match access_expression with
|
||||
| Base base ->
|
||||
Some base
|
||||
| _ ->
|
||||
let base = HilExp.AccessExpression.get_base access_expression in
|
||||
(* assume assigning to any field of an aggregate struct re-initalizes the struct *)
|
||||
Option.some_if (is_aggregate base) base
|
||||
|
||||
|
||||
let returns_struct pname =
|
||||
(* Assumption: we add an extra return param for structs *)
|
||||
Ondemand.get_proc_desc pname
|
||||
|> Option.value_map ~default:false ~f:Procdesc.has_added_return_param
|
||||
|
||||
|
||||
let acquire_ownership call_exp return_base actuals loc summary astate =
|
||||
let aquire_ownership_of_first_param actuals =
|
||||
match actuals with
|
||||
| HilExp.AccessExpression (AddressOf access_expression) :: other_actuals -> (
|
||||
match get_assigned_base access_expression with
|
||||
| Some constructed_base ->
|
||||
let astate' = Domain.actuals_add_reads other_actuals loc summary astate in
|
||||
Some (Domain.add constructed_base CapabilityDomain.Owned astate')
|
||||
| None ->
|
||||
Some astate )
|
||||
| _ ->
|
||||
Some astate
|
||||
in
|
||||
match call_exp with
|
||||
| HilInstr.Direct pname ->
|
||||
(* TODO: support new[], malloc, others? *)
|
||||
if Typ.Procname.equal pname BuiltinDecl.__new then
|
||||
let astate' = Domain.actuals_add_reads actuals loc summary astate in
|
||||
Some (Domain.add return_base CapabilityDomain.Owned astate')
|
||||
else if Typ.Procname.equal pname BuiltinDecl.__placement_new then
|
||||
match List.rev actuals with
|
||||
| HilExp.AccessExpression (Base placement_base) :: other_actuals ->
|
||||
(* TODO: placement new creates an alias between return var and placement var, should
|
||||
eventually model as return borrowing from placement (see
|
||||
FN_placement_new_aliasing2_bad test) *)
|
||||
Domain.actuals_add_reads other_actuals loc summary astate
|
||||
|> Domain.add placement_base CapabilityDomain.Owned
|
||||
|> Domain.add return_base CapabilityDomain.Owned
|
||||
|> Option.some
|
||||
| _ :: other_actuals ->
|
||||
Domain.actuals_add_reads other_actuals loc summary astate
|
||||
|> Domain.add return_base CapabilityDomain.Owned
|
||||
|> Option.some
|
||||
| _ ->
|
||||
L.die InternalError "Placement new without placement in %a %a" Typ.Procname.pp pname
|
||||
Location.pp loc
|
||||
else if Typ.Procname.is_constructor pname then aquire_ownership_of_first_param actuals
|
||||
else if returns_struct pname then aquire_ownership_of_first_param (List.rev actuals)
|
||||
else None
|
||||
| HilInstr.Indirect _ ->
|
||||
None
|
||||
|
||||
|
||||
let is_destructor = function
|
||||
| Typ.Procname.ObjC_Cpp clang_pname ->
|
||||
Typ.Procname.ObjC_Cpp.is_destructor clang_pname
|
||||
&& not
|
||||
(* Our frontend generates synthetic inner destructors to model invocation of base class
|
||||
destructors correctly; see D5834555/D7189239 *)
|
||||
(Typ.Procname.ObjC_Cpp.is_inner_destructor clang_pname)
|
||||
| _ ->
|
||||
false
|
||||
|
||||
|
||||
let is_early_return call_exp =
|
||||
match call_exp with
|
||||
| HilInstr.Direct pname ->
|
||||
Typ.Procname.equal pname BuiltinDecl.exit
|
||||
|| Typ.Procname.equal pname BuiltinDecl.objc_cpp_throw
|
||||
|| Typ.Procname.equal pname BuiltinDecl.abort
|
||||
| _ ->
|
||||
false
|
||||
|
||||
|
||||
let exec_instr (astate : Domain.t) (proc_data : extras ProcData.t) _ (instr : HilInstr.t) =
|
||||
let summary = proc_data.extras in
|
||||
match instr with
|
||||
| Assign (lhs_access_exp, rhs_exp, loc) -> (
|
||||
match get_assigned_base lhs_access_exp with
|
||||
| Some lhs_base ->
|
||||
Domain.handle_var_assign lhs_base rhs_exp loc summary astate
|
||||
| None ->
|
||||
(* assign to field, array, indirectly with &/*, or a combination *)
|
||||
Domain.exp_add_reads rhs_exp loc summary astate
|
||||
|> Domain.access_path_add_read
|
||||
(HilExp.AccessExpression.to_access_path lhs_access_exp)
|
||||
loc summary )
|
||||
| Call (_, Direct callee_pname, [AccessExpression (Base lhs_base)], _, loc)
|
||||
when Typ.Procname.equal callee_pname BuiltinDecl.__delete ->
|
||||
(* TODO: support delete[], free, and (in some cases) std::move *)
|
||||
Domain.release_ownership lhs_base loc summary astate
|
||||
| Call (_, Direct callee_pname, [AccessExpression (AddressOf (Base lhs_base))], _, loc)
|
||||
when is_destructor callee_pname ->
|
||||
Domain.release_ownership lhs_base loc summary astate
|
||||
| Call
|
||||
( _
|
||||
, Direct (Typ.Procname.ObjC_Cpp callee_pname)
|
||||
, [AccessExpression (AddressOf (Base lhs_base)); rhs_exp]
|
||||
, _
|
||||
, loc )
|
||||
when Typ.Procname.ObjC_Cpp.is_operator_equal callee_pname ->
|
||||
(* TODO: once we go interprocedural, this case should only apply for operator='s with an
|
||||
empty summary *)
|
||||
Domain.handle_var_assign ~is_operator_equal:true lhs_base rhs_exp loc summary astate
|
||||
| Call
|
||||
( _
|
||||
, Direct (Typ.Procname.ObjC_Cpp callee_pname)
|
||||
, AccessExpression (AddressOf (Base lhs_base)) :: _
|
||||
, _
|
||||
, loc )
|
||||
when Typ.Procname.ObjC_Cpp.is_cpp_lambda callee_pname ->
|
||||
(* invoking a lambda; check that its captured vars are valid *)
|
||||
Domain.check_var_lifetime lhs_base loc summary astate ;
|
||||
astate
|
||||
| Call (ret_id_typ, call_exp, actuals, _, loc) -> (
|
||||
match acquire_ownership call_exp ret_id_typ actuals loc summary astate with
|
||||
| Some astate' ->
|
||||
astate'
|
||||
| None ->
|
||||
if is_early_return call_exp then
|
||||
(* thrown exception, abort(), or exit; return _|_ *)
|
||||
Domain.empty
|
||||
else
|
||||
let astate' = Domain.actuals_add_reads actuals loc summary astate in
|
||||
Domain.remove ret_id_typ astate' )
|
||||
| Assume (assume_exp, _, _, loc) ->
|
||||
Domain.exp_add_reads assume_exp loc summary astate
|
||||
| Metadata _ ->
|
||||
astate
|
||||
|
||||
|
||||
let pp_session_name _node fmt = F.pp_print_string fmt "ownership"
|
||||
end
|
||||
|
||||
module Analyzer = LowerHil.MakeAbstractInterpreter (TransferFunctions (ProcCfg.Exceptional))
|
||||
|
||||
let report_invalid_return post end_loc summary =
|
||||
let proc_name = Summary.get_proc_name summary in
|
||||
let is_local_to_procedure var =
|
||||
(* In case of lambdas, only report on variables local to the lambda that are not captured from
|
||||
the enclosing procedure to avoid false positives in case the lambda is called within the
|
||||
same procedure (which is frequent, at the cost of false negatives in case this lambda is
|
||||
returned to the caller). *)
|
||||
Var.is_local_to_procedure proc_name var
|
||||
&& not (Procdesc.is_captured_var summary.Summary.proc_desc var)
|
||||
in
|
||||
(* look for return values that are borrowed from (now-invalid) local variables *)
|
||||
let report_invalid_return base (capability : CapabilityDomain.t) =
|
||||
if Var.is_return (fst base) then
|
||||
match capability with
|
||||
| BorrowedFrom vars ->
|
||||
VarSet.iter
|
||||
(fun ((var, _) as borrowed_base) ->
|
||||
if is_local_to_procedure var then
|
||||
Domain.report_return_stack_var borrowed_base end_loc summary )
|
||||
vars
|
||||
| InvalidatedAt invalidated_loc ->
|
||||
Domain.report_use_after_lifetime base ~use_loc:end_loc ~invalidated_loc summary
|
||||
| Owned ->
|
||||
()
|
||||
in
|
||||
Domain.iter report_invalid_return post
|
||||
|
||||
|
||||
let checker {Callbacks.proc_desc; tenv; summary} =
|
||||
let proc_data = ProcData.make proc_desc tenv summary in
|
||||
let initial = Domain.empty in
|
||||
( match Analyzer.compute_post proc_data ~initial with
|
||||
| Some post ->
|
||||
let end_loc = Procdesc.Node.get_loc (Procdesc.get_exit_node proc_desc) in
|
||||
report_invalid_return post end_loc summary
|
||||
| None ->
|
||||
() ) ;
|
||||
summary
|
||||
@ -1,10 +0,0 @@
|
||||
(*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates.
|
||||
*
|
||||
* This source code is licensed under the MIT license found in the
|
||||
* LICENSE file in the root directory of this source tree.
|
||||
*)
|
||||
|
||||
open! IStd
|
||||
|
||||
val checker : Callbacks.proc_callback_t
|
||||
@ -1,17 +0,0 @@
|
||||
# Copyright (c) Facebook, Inc. and its affiliates.
|
||||
#
|
||||
# This source code is licensed under the MIT license found in the
|
||||
# LICENSE file in the root directory of this source tree.
|
||||
|
||||
TESTS_DIR = ../../..
|
||||
|
||||
# see explanations in cpp/errors/Makefile for the custom isystem
|
||||
CLANG_OPTIONS = -x c++ -std=c++14 -Wc++1z-extensions -nostdinc++ -isystem$(MODELS_DIR)/cpp/include -isystem$(CLANG_INCLUDES)/c++/v1/ -c
|
||||
INFER_OPTIONS = --ownership-only --ml-buckets cpp --debug-exceptions --project-root $(TESTS_DIR)
|
||||
INFERPRINT_OPTIONS = --issues-tests
|
||||
|
||||
SOURCES = $(wildcard *.cpp)
|
||||
|
||||
include $(TESTS_DIR)/clang.make
|
||||
|
||||
infer-out/report.json: $(MAKEFILE_LIST)
|
||||
@ -1,102 +0,0 @@
|
||||
/*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates.
|
||||
*
|
||||
* This source code is licensed under the MIT license found in the
|
||||
* LICENSE file in the root directory of this source tree.
|
||||
*/
|
||||
|
||||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
struct Aggregate {
|
||||
int i;
|
||||
|
||||
~Aggregate() {}
|
||||
};
|
||||
|
||||
void aggregate_reassign_ok() {
|
||||
const int len = 5;
|
||||
Aggregate arr[len];
|
||||
for (int i = 0; i < len; i++) {
|
||||
Aggregate s = {1};
|
||||
// assign with curly bracket syntax doesn't call constructor; need to
|
||||
// recognize that this is a reassignment anyway
|
||||
arr[0] = s; // shouldn't be flagged as a use-after-lifetime
|
||||
}
|
||||
}
|
||||
|
||||
struct AggregateWithConstructedField {
|
||||
std::string str;
|
||||
};
|
||||
|
||||
void aggregate_reassign2_ok() {
|
||||
AggregateWithConstructedField arr[10];
|
||||
for (int i = 0; i < 10; i++) {
|
||||
// this is translated as string(&(a.str), "hi"). need to make sure this is
|
||||
// treated the same as initializing a
|
||||
AggregateWithConstructedField a{"hi"};
|
||||
arr[i] = a;
|
||||
}
|
||||
}
|
||||
|
||||
struct NestedAggregate {
|
||||
AggregateWithConstructedField a;
|
||||
};
|
||||
|
||||
void aggregate_reassign3_ok() {
|
||||
NestedAggregate arr[10];
|
||||
for (int i = 0; i < 10; i++) {
|
||||
// this is translated as std::basic_string(&(a.str), "hi"). need to make
|
||||
// sure this is treated the same as initializing a
|
||||
NestedAggregate a{{"hi"}};
|
||||
arr[i] = a;
|
||||
}
|
||||
}
|
||||
|
||||
int multiple_invalidations_branch_bad(int n, int* ptr) {
|
||||
if (n == 7) {
|
||||
delete ptr;
|
||||
} else {
|
||||
delete ptr;
|
||||
}
|
||||
return *ptr;
|
||||
}
|
||||
|
||||
int multiple_invalidations_loop_bad(int n, int* ptr) {
|
||||
for (int i = 0; i < n; i++) {
|
||||
if (i == 7) {
|
||||
delete ptr;
|
||||
} else {
|
||||
delete ptr;
|
||||
}
|
||||
}
|
||||
return *ptr;
|
||||
}
|
||||
|
||||
Aggregate* pointer_arithmetic_ok(Aggregate* a) {
|
||||
a->~Aggregate();
|
||||
a++;
|
||||
return a;
|
||||
}
|
||||
|
||||
void iterator_pointer_arithmetic_ok(std::vector<Aggregate> v) {
|
||||
for (auto it = v.begin(); it != v.end(); ++it) {
|
||||
it->~Aggregate();
|
||||
}
|
||||
}
|
||||
|
||||
struct A {
|
||||
~A();
|
||||
int f(int i);
|
||||
};
|
||||
|
||||
A getA();
|
||||
|
||||
int struct_inside_loop_ok(std::vector<int> numbers) {
|
||||
int sum;
|
||||
for (auto number : numbers) {
|
||||
A a = getA();
|
||||
sum += a.f(number);
|
||||
}
|
||||
return sum;
|
||||
}
|
||||
@ -1,144 +0,0 @@
|
||||
/*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates.
|
||||
*
|
||||
* This source code is licensed under the MIT license found in the
|
||||
* LICENSE file in the root directory of this source tree.
|
||||
*/
|
||||
#include <functional>
|
||||
|
||||
struct S {
|
||||
int f;
|
||||
|
||||
S() { f = 1; }
|
||||
};
|
||||
|
||||
int ref_capture_destroy_invoke_bad() {
|
||||
std::function<int()> f;
|
||||
{
|
||||
S s;
|
||||
f = [&s] { return s.f; };
|
||||
} // destructor for s called here
|
||||
return f(); // s used here
|
||||
}
|
||||
|
||||
int implicit_ref_capture_destroy_invoke_bad() {
|
||||
std::function<int()> f;
|
||||
{
|
||||
auto s = S();
|
||||
f = [&] { return s.f; };
|
||||
}
|
||||
return f();
|
||||
}
|
||||
|
||||
int FN_reassign_lambda_capture_destroy_invoke_bad() {
|
||||
std::function<int()> f;
|
||||
{
|
||||
auto s = S();
|
||||
auto tmp = [&] { return s.f; };
|
||||
f = tmp;
|
||||
}
|
||||
return f();
|
||||
}
|
||||
|
||||
// frontend doesn't understand difference between capture-by-value and
|
||||
// capture-by-ref, need to fix
|
||||
int value_capture_destroy_invoke_ok() {
|
||||
std::function<int()> f;
|
||||
{
|
||||
S s;
|
||||
f = [s] { return s.f; };
|
||||
}
|
||||
return f();
|
||||
}
|
||||
|
||||
// same thing here
|
||||
int implicit_value_capture_destroy_invoke_ok() {
|
||||
std::function<int()> f;
|
||||
{
|
||||
S s;
|
||||
f = [=] { return s.f; };
|
||||
}
|
||||
return f();
|
||||
}
|
||||
|
||||
int ref_capture_invoke_ok() {
|
||||
std::function<int()> f;
|
||||
int ret;
|
||||
{
|
||||
S s;
|
||||
f = [&s] { return s.f; };
|
||||
ret = f();
|
||||
}
|
||||
return ret;
|
||||
}
|
||||
|
||||
void invoke_twice_ok() {
|
||||
std::function<int()> f;
|
||||
int ret;
|
||||
{
|
||||
S s;
|
||||
f = [&s] { return s.f; };
|
||||
f();
|
||||
f();
|
||||
}
|
||||
}
|
||||
|
||||
std::function<int()> ref_capture_read_lambda_ok() {
|
||||
std::function<int()> f;
|
||||
int ret;
|
||||
{
|
||||
S s;
|
||||
f = [&s] { return s.f; };
|
||||
}
|
||||
auto tmp =
|
||||
f; // reading (but not invoking) the lambda doesn't use its captured vars
|
||||
}
|
||||
|
||||
// we'll miss this because we count invoking a lambda object as a use of its
|
||||
// captured vars, not the lambda object itself.
|
||||
void FN_delete_lambda_then_call_bad() {
|
||||
auto lambda = [] { return 1; };
|
||||
~lambda();
|
||||
return lambda();
|
||||
}
|
||||
|
||||
// need to treat escaping as a use in order to catch this
|
||||
std::function<int()> FN_ref_capture_return_lambda_bad() {
|
||||
std::function<int()> f;
|
||||
int ret;
|
||||
{
|
||||
S s;
|
||||
f = [&s] { return s.f; };
|
||||
}
|
||||
return f; // if the caller invokes the lambda, it will try to read the invalid
|
||||
// stack address
|
||||
}
|
||||
|
||||
S& lambda_return_local_bad() {
|
||||
S x;
|
||||
auto f = [&x](void) -> S& {
|
||||
S y;
|
||||
return y;
|
||||
};
|
||||
return f();
|
||||
}
|
||||
|
||||
int ref_capture_return_enclosing_local_lambda_ok() {
|
||||
S x;
|
||||
auto f = [&x](void) -> S& {
|
||||
// do not report this because there is a good chance that this function will
|
||||
// only be used in the local scope
|
||||
return x;
|
||||
};
|
||||
return f().f;
|
||||
}
|
||||
|
||||
S& FN_ref_capture_return_enclosing_local_lambda_bad() {
|
||||
S x;
|
||||
auto f = [&x](void) -> S& {
|
||||
// no way to know if ok here
|
||||
return x;
|
||||
};
|
||||
// woops, this returns a ref to a local!
|
||||
return f();
|
||||
}
|
||||
@ -1,27 +0,0 @@
|
||||
codetoanalyze/cpp/ownership/basics.cpp, multiple_invalidations_branch_bad, 6, USE_AFTER_LIFETIME, no_bucket, ERROR, [End of variable lifetime,Use of invalid variable]
|
||||
codetoanalyze/cpp/ownership/basics.cpp, multiple_invalidations_loop_bad, 3, USE_AFTER_LIFETIME, no_bucket, ERROR, [End of variable lifetime,Use of invalid variable]
|
||||
codetoanalyze/cpp/ownership/basics.cpp, multiple_invalidations_loop_bad, 5, USE_AFTER_LIFETIME, no_bucket, ERROR, [End of variable lifetime,Use of invalid variable]
|
||||
codetoanalyze/cpp/ownership/basics.cpp, multiple_invalidations_loop_bad, 8, USE_AFTER_LIFETIME, no_bucket, ERROR, [End of variable lifetime,Use of invalid variable]
|
||||
codetoanalyze/cpp/ownership/closures.cpp, implicit_ref_capture_destroy_invoke_bad, 6, USE_AFTER_LIFETIME, no_bucket, ERROR, [End of variable lifetime,Use of invalid variable]
|
||||
codetoanalyze/cpp/ownership/closures.cpp, implicit_value_capture_destroy_invoke_ok, 6, USE_AFTER_LIFETIME, no_bucket, ERROR, [End of variable lifetime,Use of invalid variable]
|
||||
codetoanalyze/cpp/ownership/closures.cpp, lambda_return_local_bad::lambda_closures.cpp:119:12::operator(), 3, USE_AFTER_LIFETIME, no_bucket, ERROR, [Return of stack variable,End of procedure]
|
||||
codetoanalyze/cpp/ownership/closures.cpp, ref_capture_destroy_invoke_bad, 6, USE_AFTER_LIFETIME, no_bucket, ERROR, [End of variable lifetime,Use of invalid variable]
|
||||
codetoanalyze/cpp/ownership/closures.cpp, value_capture_destroy_invoke_ok, 6, USE_AFTER_LIFETIME, no_bucket, ERROR, [End of variable lifetime,Use of invalid variable]
|
||||
codetoanalyze/cpp/ownership/returns.cpp, returns::return_deleted_bad, 4, USE_AFTER_LIFETIME, no_bucket, ERROR, [End of variable lifetime,Use of invalid variable]
|
||||
codetoanalyze/cpp/ownership/returns.cpp, returns::return_literal_stack_reference_bad, 0, USE_AFTER_LIFETIME, no_bucket, ERROR, [Return of stack variable,End of procedure]
|
||||
codetoanalyze/cpp/ownership/returns.cpp, returns::return_stack_pointer_bad, 3, USE_AFTER_LIFETIME, no_bucket, ERROR, [Return of stack variable,End of procedure]
|
||||
codetoanalyze/cpp/ownership/returns.cpp, returns::return_variable_stack_reference1_bad, 3, USE_AFTER_LIFETIME, no_bucket, ERROR, [Return of stack variable,End of procedure]
|
||||
codetoanalyze/cpp/ownership/returns.cpp, returns::return_variable_stack_reference2_bad, 4, USE_AFTER_LIFETIME, no_bucket, ERROR, [Return of stack variable,End of procedure]
|
||||
codetoanalyze/cpp/ownership/use_after_delete.cpp, delete_in_branch_bad, 5, USE_AFTER_LIFETIME, no_bucket, ERROR, [End of variable lifetime,Use of invalid variable]
|
||||
codetoanalyze/cpp/ownership/use_after_delete.cpp, delete_in_loop_bad, 3, USE_AFTER_LIFETIME, no_bucket, ERROR, [End of variable lifetime,Use of invalid variable]
|
||||
codetoanalyze/cpp/ownership/use_after_delete.cpp, deref_deleted_bad, 3, USE_AFTER_LIFETIME, no_bucket, ERROR, [End of variable lifetime,Use of invalid variable]
|
||||
codetoanalyze/cpp/ownership/use_after_delete.cpp, double_delete_bad, 3, USE_AFTER_LIFETIME, no_bucket, ERROR, [End of variable lifetime,Use of invalid variable]
|
||||
codetoanalyze/cpp/ownership/use_after_delete.cpp, reassign_field_of_deleted_bad, 3, USE_AFTER_LIFETIME, no_bucket, ERROR, [End of variable lifetime,Use of invalid variable]
|
||||
codetoanalyze/cpp/ownership/use_after_delete.cpp, return_deleted_bad, 3, USE_AFTER_LIFETIME, no_bucket, ERROR, [End of variable lifetime,Use of invalid variable]
|
||||
codetoanalyze/cpp/ownership/use_after_delete.cpp, use_in_branch_bad, 4, USE_AFTER_LIFETIME, no_bucket, ERROR, [End of variable lifetime,Use of invalid variable]
|
||||
codetoanalyze/cpp/ownership/use_after_delete.cpp, use_in_loop_bad, 4, USE_AFTER_LIFETIME, no_bucket, ERROR, [End of variable lifetime,Use of invalid variable]
|
||||
codetoanalyze/cpp/ownership/use_after_destructor.cpp, FP_destructor_order_empty_destructor_ok, 4, USE_AFTER_LIFETIME, no_bucket, ERROR, [End of variable lifetime,Use of invalid variable]
|
||||
codetoanalyze/cpp/ownership/use_after_destructor.cpp, destructor_order_bad, 4, USE_AFTER_LIFETIME, no_bucket, ERROR, [End of variable lifetime,Use of invalid variable]
|
||||
codetoanalyze/cpp/ownership/use_after_destructor.cpp, double_destructor_bad, 5, USE_AFTER_LIFETIME, no_bucket, ERROR, [End of variable lifetime,Use of invalid variable]
|
||||
codetoanalyze/cpp/ownership/use_after_destructor.cpp, use_after_destructor_bad, 3, USE_AFTER_LIFETIME, no_bucket, ERROR, [End of variable lifetime,Use of invalid variable]
|
||||
codetoanalyze/cpp/ownership/use_after_destructor.cpp, use_after_scope4_bad, 6, USE_AFTER_LIFETIME, no_bucket, ERROR, [End of variable lifetime,Use of invalid variable]
|
||||
@ -1,48 +0,0 @@
|
||||
/*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates.
|
||||
*
|
||||
* This source code is licensed under the MIT license found in the
|
||||
* LICENSE file in the root directory of this source tree.
|
||||
*/
|
||||
struct B {
|
||||
B(int v) : f(v){};
|
||||
int f;
|
||||
};
|
||||
|
||||
struct WrapsB {
|
||||
WrapsB(int f) { b = new B(f); }
|
||||
B* b;
|
||||
B* getb() { return b; };
|
||||
~WrapsB() { delete b; }
|
||||
};
|
||||
|
||||
struct ReferenceWrapperHeap {
|
||||
ReferenceWrapperHeap(WrapsB& a) : b(a.getb()){};
|
||||
B* b;
|
||||
};
|
||||
|
||||
ReferenceWrapperHeap getwrapperHeap() {
|
||||
WrapsB a(1);
|
||||
return a; // We store a.b in ReferenceWrapper, but we delete a.b in the
|
||||
// destructor of WrapsB
|
||||
}
|
||||
|
||||
int FN_reference_wrapper_heap_bad() {
|
||||
ReferenceWrapperHeap rw = getwrapperHeap();
|
||||
return rw.b->f; // we want to report use after lifetime bug here
|
||||
}
|
||||
|
||||
struct ReferenceWrapperStack {
|
||||
ReferenceWrapperStack(B& bref) : b(&bref){};
|
||||
B* b;
|
||||
};
|
||||
|
||||
ReferenceWrapperStack getwrapperStack() {
|
||||
B b(1);
|
||||
return b;
|
||||
}
|
||||
|
||||
int FN_reference_wrapper_stack_bad() {
|
||||
ReferenceWrapperStack rw = getwrapperStack();
|
||||
return rw.b->f; // we want to report use after lifetime bug here
|
||||
}
|
||||
@ -1,144 +0,0 @@
|
||||
/*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates.
|
||||
*
|
||||
* This source code is licensed under the MIT license found in the
|
||||
* LICENSE file in the root directory of this source tree.
|
||||
*/
|
||||
|
||||
#include <string>
|
||||
|
||||
namespace returns {
|
||||
|
||||
struct S {
|
||||
int f_;
|
||||
|
||||
S(int f) : f_(f) {}
|
||||
|
||||
~S() {}
|
||||
};
|
||||
|
||||
const int& return_literal_stack_reference_bad() { return 1; }
|
||||
|
||||
const int& return_variable_stack_reference1_bad() {
|
||||
const int& x = 2;
|
||||
return x;
|
||||
}
|
||||
|
||||
const int& return_variable_stack_reference2_bad() {
|
||||
const int& x = 2;
|
||||
const int& y = x;
|
||||
return y;
|
||||
}
|
||||
|
||||
const int return_read_of_stack_reference_ok() {
|
||||
const int& x = 2;
|
||||
return x;
|
||||
}
|
||||
|
||||
const int& return_formal_reference_ok(int& formal) { return formal; }
|
||||
|
||||
const int& return_reference_to_formal_pointer_ok(const int* formal) {
|
||||
const int& local = *formal;
|
||||
return local;
|
||||
}
|
||||
|
||||
extern const int& callee();
|
||||
|
||||
const int& return_reference_from_callee_ok() {
|
||||
const int& local = callee();
|
||||
return local;
|
||||
}
|
||||
|
||||
const int return_int_ok() { return 1; }
|
||||
|
||||
const bool return_comparison_temp_ok() { return 1 != 2; }
|
||||
|
||||
const bool compare_local_refs_ok() {
|
||||
const int& local1 = 1;
|
||||
const int& local2 = 1;
|
||||
return local1 != local2;
|
||||
}
|
||||
|
||||
extern int& global;
|
||||
|
||||
const int& return_global_reference_ok() { return global; }
|
||||
|
||||
struct MemberReference {
|
||||
int& member1;
|
||||
|
||||
int& return_member_reference_ok() { return member1; }
|
||||
|
||||
int* member2;
|
||||
int* return_member_reference_indirect_ok() {
|
||||
int* local = member2;
|
||||
return local;
|
||||
}
|
||||
};
|
||||
|
||||
extern const char* const kOptions;
|
||||
|
||||
const char* return_field_addr_ternary_ok() {
|
||||
const char* const* const t = &kOptions;
|
||||
return t ? *t : "";
|
||||
}
|
||||
|
||||
int* return_stack_pointer_bad() {
|
||||
int x = 3;
|
||||
return &x;
|
||||
}
|
||||
|
||||
S* return_static_local_ok() {
|
||||
S* local;
|
||||
static S s{1};
|
||||
local = &s;
|
||||
return local;
|
||||
}
|
||||
|
||||
S* return_static_local_inner_scope_ok(bool b) {
|
||||
S* local = nullptr;
|
||||
if (b) {
|
||||
static S s{1};
|
||||
local = &s;
|
||||
// destructor for s gets called here, but it shouldn't be
|
||||
}
|
||||
return local;
|
||||
}
|
||||
|
||||
int* return_formal_pointer_ok(int* formal) { return formal; }
|
||||
|
||||
int* return_deleted_bad() {
|
||||
int* x = new int;
|
||||
*x = 2;
|
||||
delete x;
|
||||
return x;
|
||||
}
|
||||
|
||||
// this *could* be ok depending on what the destructor does, but there's
|
||||
// probably no good reason to do it
|
||||
S* FN_return_destructed_pointer_bad() {
|
||||
S* s = new S(1);
|
||||
s->~S();
|
||||
return s;
|
||||
}
|
||||
|
||||
const char* return_nullptr1_ok() { return nullptr; }
|
||||
|
||||
const char* return_nullptr2_ok() {
|
||||
const char* local = nullptr;
|
||||
return local;
|
||||
}
|
||||
|
||||
struct A {
|
||||
~A();
|
||||
};
|
||||
|
||||
int try_catch_return_ok() {
|
||||
A a;
|
||||
try {
|
||||
return 1;
|
||||
} catch (...) {
|
||||
return 2;
|
||||
}
|
||||
}
|
||||
|
||||
} // namespace returns
|
||||
@ -1,134 +0,0 @@
|
||||
/*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates.
|
||||
*
|
||||
* This source code is licensed under the MIT license found in the
|
||||
* LICENSE file in the root directory of this source tree.
|
||||
*/
|
||||
|
||||
#include <memory>
|
||||
#include <string>
|
||||
#include <vector>
|
||||
|
||||
struct Simple {
|
||||
int f;
|
||||
};
|
||||
|
||||
void deref_deleted_bad() {
|
||||
auto s = new Simple{1};
|
||||
delete s;
|
||||
Simple tmp = *s;
|
||||
}
|
||||
|
||||
Simple* return_deleted_bad() {
|
||||
auto s = new Simple{1};
|
||||
delete s;
|
||||
return s;
|
||||
}
|
||||
|
||||
Simple* reassign_deleted_ok() {
|
||||
auto s = new Simple{1};
|
||||
delete s;
|
||||
s = new Simple{2};
|
||||
return s;
|
||||
}
|
||||
|
||||
void reassign_field_of_deleted_bad() {
|
||||
auto s = new Simple{1};
|
||||
delete s;
|
||||
s->f = 7;
|
||||
}
|
||||
|
||||
void reassign_field_of_reinitialized_ok(Simple* tmp) {
|
||||
auto s = new Simple{1};
|
||||
delete s;
|
||||
s = tmp;
|
||||
s->f = 7;
|
||||
}
|
||||
|
||||
void double_delete_bad() {
|
||||
auto s = new Simple{1};
|
||||
delete s;
|
||||
delete s;
|
||||
}
|
||||
|
||||
Simple* delete_in_branch_bad(bool b) {
|
||||
auto s = new Simple{1};
|
||||
if (b) {
|
||||
delete s;
|
||||
}
|
||||
return s;
|
||||
}
|
||||
|
||||
void delete_in_branch_ok(bool b) {
|
||||
auto s = new Simple{1};
|
||||
if (b) {
|
||||
delete s;
|
||||
} else {
|
||||
delete s;
|
||||
}
|
||||
}
|
||||
|
||||
void use_in_branch_bad(bool b) {
|
||||
auto s = new Simple{1};
|
||||
delete s;
|
||||
if (b) {
|
||||
auto tmp = *s;
|
||||
}
|
||||
}
|
||||
|
||||
void delete_in_loop_bad() {
|
||||
auto s = new Simple{1};
|
||||
for (int i = 0; i < 10; i++) {
|
||||
delete s;
|
||||
}
|
||||
}
|
||||
|
||||
void delete_in_loop_ok() {
|
||||
for (int i = 0; i < 10; i++) {
|
||||
auto s = new Simple{1};
|
||||
delete s;
|
||||
}
|
||||
}
|
||||
|
||||
void delete_ref_in_loop_ok(int j, std::vector<std::string> v) {
|
||||
int i = 0;
|
||||
for (int i = 0; i < 10; i++) {
|
||||
auto s = &v[i];
|
||||
delete s;
|
||||
}
|
||||
}
|
||||
|
||||
void use_in_loop_bad() {
|
||||
auto s = new Simple{1};
|
||||
delete s;
|
||||
for (int i = 0; i < 10; i++) {
|
||||
s->f = i;
|
||||
}
|
||||
}
|
||||
|
||||
Simple* gated_delete_abort_ok(bool b) {
|
||||
auto s = new Simple{1};
|
||||
if (b) {
|
||||
delete s;
|
||||
std::abort();
|
||||
}
|
||||
return s;
|
||||
}
|
||||
|
||||
Simple* gated_exit_abort_ok(bool b) {
|
||||
auto s = new Simple{1};
|
||||
if (b) {
|
||||
delete s;
|
||||
exit(1);
|
||||
}
|
||||
return s;
|
||||
}
|
||||
|
||||
Simple* gated_delete_throw_ok(bool b) {
|
||||
auto s = new Simple{1};
|
||||
if (b) {
|
||||
delete s;
|
||||
throw 5;
|
||||
}
|
||||
return s;
|
||||
}
|
||||
@ -1,215 +0,0 @@
|
||||
/*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates.
|
||||
*
|
||||
* This source code is licensed under the MIT license found in the
|
||||
* LICENSE file in the root directory of this source tree.
|
||||
*/
|
||||
|
||||
#include <iostream>
|
||||
#include <memory>
|
||||
#include <string>
|
||||
|
||||
struct S {
|
||||
int* f;
|
||||
S(int i) {
|
||||
f = new int;
|
||||
*f = i;
|
||||
}
|
||||
|
||||
// missing: operator= to copy the pointer. double delete can happen if
|
||||
// operator= is called
|
||||
|
||||
~S() { delete f; }
|
||||
};
|
||||
|
||||
// destructor called at end of function, no issues
|
||||
void normal_scope_destructor_ok() { S s(1); }
|
||||
|
||||
void nested_scope_destructor_ok() {
|
||||
{ S s(1); }
|
||||
}
|
||||
|
||||
int reinit_after_explicit_destructor_ok() {
|
||||
S s(1);
|
||||
s.~S();
|
||||
s = S(2);
|
||||
return *s.f;
|
||||
}
|
||||
|
||||
void placement_new_explicit_destructor_ok() {
|
||||
char buf[sizeof(S)];
|
||||
{
|
||||
S* s = new (buf) S(1);
|
||||
s->~S();
|
||||
}
|
||||
{
|
||||
// this use of [buf] shouldn't be flagged
|
||||
S* s = new (buf) S(2);
|
||||
s->~S();
|
||||
}
|
||||
}
|
||||
|
||||
void double_destructor_bad() {
|
||||
S s(1);
|
||||
s.~S();
|
||||
// destructor will be called again after S goes out of scope, which is
|
||||
// undefined behavior
|
||||
}
|
||||
|
||||
int use_after_destructor_bad() {
|
||||
S s(1);
|
||||
s.~S();
|
||||
int ret = *s.f;
|
||||
s = S{2};
|
||||
return ret;
|
||||
}
|
||||
|
||||
// can't get this yet because we assume operator= copies resources correctly
|
||||
// (but this isn't true for S)
|
||||
void FN_use_after_scope1_bad() {
|
||||
S s(1);
|
||||
{
|
||||
S tmp(2);
|
||||
s = tmp; // translated as operator=(s, tmp)
|
||||
} // destructor for tmp runs here
|
||||
// destructor for s here; second time the value held by s has been destructed
|
||||
}
|
||||
|
||||
void FN_use_after_scope2_bad() {
|
||||
S s(1);
|
||||
{
|
||||
s = S(1);
|
||||
} // destructor runs here, but our frontend currently doesn't insert it
|
||||
}
|
||||
|
||||
struct POD {
|
||||
int f;
|
||||
};
|
||||
|
||||
// this code is ok since double-destructing POD struct is ok
|
||||
void destruct_twice_ok() {
|
||||
POD p{1};
|
||||
{
|
||||
POD tmp{2};
|
||||
p = tmp;
|
||||
} // destructor for tmp
|
||||
} // destructor for p runs here, but it's harmless
|
||||
|
||||
class Subclass : virtual POD {
|
||||
int* f;
|
||||
Subclass() { f = new int; }
|
||||
|
||||
/** frontend code for this destructor will be:
|
||||
* ~Subclass:
|
||||
* __infer_inner_destructor_~Subclass(this)
|
||||
* __infer_inner_destructor_~POD(this)
|
||||
*
|
||||
* __infer_inner_destructor_~Subclass:
|
||||
* delete f;
|
||||
*
|
||||
* We need to be careful not to warn that this has been double-destructed
|
||||
*/
|
||||
~Subclass() { delete f; }
|
||||
};
|
||||
|
||||
void basic_placement_new_ok() {
|
||||
S* ptr = new S(1);
|
||||
S* tptr = new (ptr) S(1);
|
||||
tptr->~S();
|
||||
delete[] ptr;
|
||||
}
|
||||
|
||||
S* destruct_pointer_contents_then_placement_new1_ok(S* s) {
|
||||
s->~S();
|
||||
new (s) S(1);
|
||||
return s;
|
||||
}
|
||||
|
||||
// need better heap abstraction to catch this example and the next
|
||||
S* FN_placement_new_aliasing1_bad() {
|
||||
S* s = new S(1);
|
||||
s->~S();
|
||||
auto alias = new (s) S(2);
|
||||
delete alias; // this deletes s too
|
||||
return s; // bad, returning freed memory
|
||||
}
|
||||
|
||||
S* FN_placement_new_aliasing2_bad() {
|
||||
S* s = new S(1);
|
||||
s->~S();
|
||||
auto alias = new (s) S(2);
|
||||
delete s; // this deletes alias too
|
||||
return alias; // bad, returning freed memory
|
||||
}
|
||||
|
||||
void placement_new_non_var_ok() {
|
||||
struct M {
|
||||
S* s;
|
||||
} m;
|
||||
m.s = new S(1);
|
||||
m.s->~S();
|
||||
new (m.s) S(2);
|
||||
delete m.s;
|
||||
}
|
||||
|
||||
void return_placement_new_ok() {
|
||||
auto mem = new S(1);
|
||||
return new (mem) S(2);
|
||||
}
|
||||
|
||||
void destructor_in_loop_ok() {
|
||||
for (int i = 0; i < 10; i++) {
|
||||
S s(1);
|
||||
}
|
||||
}
|
||||
|
||||
int FN_use_after_scope3_bad() {
|
||||
int* p;
|
||||
{
|
||||
int value = 3;
|
||||
p = &value;
|
||||
} // we do not know in the plugin that value is out of scope
|
||||
return *p;
|
||||
}
|
||||
|
||||
struct C {
|
||||
C(int v) : f(v){};
|
||||
~C();
|
||||
int f;
|
||||
};
|
||||
|
||||
int use_after_scope4_bad() {
|
||||
C* pc;
|
||||
{
|
||||
C c(3);
|
||||
pc = &c;
|
||||
}
|
||||
return pc->f;
|
||||
}
|
||||
|
||||
struct B {
|
||||
~B();
|
||||
};
|
||||
|
||||
struct A {
|
||||
~A() { (void)*f; }
|
||||
const B* f;
|
||||
};
|
||||
|
||||
void destructor_order_bad() {
|
||||
A a;
|
||||
B b;
|
||||
a.f = &b;
|
||||
}
|
||||
|
||||
struct A2 {
|
||||
~A2() {}
|
||||
const B* f;
|
||||
};
|
||||
|
||||
// need interprocedural analysis to fix this
|
||||
void FP_destructor_order_empty_destructor_ok() {
|
||||
A2 a;
|
||||
B b;
|
||||
a.f = &b;
|
||||
}
|
||||
Loading…
Reference in new issue