Index: lib/StaticAnalyzer/Checkers/MallocChecker.cpp =================================================================== --- lib/StaticAnalyzer/Checkers/MallocChecker.cpp +++ lib/StaticAnalyzer/Checkers/MallocChecker.cpp @@ -164,6 +164,7 @@ check::EndFunction, check::PreCall, check::PostStmt, + check::PreStmt, check::PostStmt, check::NewAllocator, check::PreStmt, @@ -211,6 +212,7 @@ void checkPreCall(const CallEvent &Call, CheckerContext &C) const; void checkPostStmt(const CallExpr *CE, CheckerContext &C) const; + void checkPreStmt(const CXXNewExpr *DE, CheckerContext &C) const; void checkPostStmt(const CXXNewExpr *NE, CheckerContext &C) const; void checkNewAllocator(const CXXNewExpr *NE, SVal Target, CheckerContext &C) const; @@ -712,10 +714,8 @@ return false; } -// Tells if the callee is one of the following: -// 1) A global non-placement new/delete operator function. -// 2) A global placement operator function with the single placement argument -// of type std::nothrow_t. +// Tells if the callee is one of the builtin new/delete operators, including +// placement operators and other standard overloads. bool MallocChecker::isStandardNewDelete(const FunctionDecl *FD, ASTContext &C) const { if (!FD) @@ -726,23 +726,9 @@ Kind != OO_Delete && Kind != OO_Array_Delete) return false; - // Skip all operator new/delete methods. - if (isa(FD)) - return false; - - // Return true if tested operator is a standard placement nothrow operator. - if (FD->getNumParams() == 2) { - QualType T = FD->getParamDecl(1)->getType(); - if (const IdentifierInfo *II = T.getBaseTypeIdentifier()) - return II->getName().equals("nothrow_t"); - } - - // Skip placement operators. - if (FD->getNumParams() != 1 || FD->isVariadic()) - return false; - - // One of the standard new/new[]/delete/delete[] non-placement operators. - return true; + // This is standard iff it's not defined in a user file. + SourceLocation L = FD->getLocation(); + return !L.isValid() || C.getSourceManager().isInSystemHeader(L); } llvm::Optional MallocChecker::performKernelMalloc( @@ -1084,15 +1070,17 @@ return false; } +void MallocChecker::checkPreStmt(const CXXNewExpr *NE, + CheckerContext &C) const { + for (CXXNewExpr::const_arg_iterator I = NE->placement_arg_begin(), + E = NE->placement_arg_end(); I != E; ++I) + if (SymbolRef Sym = C.getSVal(*I).getAsSymbol()) + checkUseAfterFree(Sym, C, *I); +} + void MallocChecker::processNewAllocation(const CXXNewExpr *NE, CheckerContext &C, SVal Target) const { - if (NE->getNumPlacementArgs()) - for (CXXNewExpr::const_arg_iterator I = NE->placement_arg_begin(), - E = NE->placement_arg_end(); I != E; ++I) - if (SymbolRef Sym = C.getSVal(*I).getAsSymbol()) - checkUseAfterFree(Sym, C, *I); - if (!isStandardNewDelete(NE->getOperatorNew(), C.getASTContext())) return; @@ -2438,10 +2426,6 @@ isCMemFunction(FD, Ctx, AF_IfNameIndex, MemoryOperationKind::MOK_Free))) return; - - if (ChecksEnabled[CK_NewDeleteChecker] && - isStandardNewDelete(FD, Ctx)) - return; } // Check if the callee of a method is deleted. Index: test/Analysis/NewDelete-custom.cpp =================================================================== --- test/Analysis/NewDelete-custom.cpp +++ test/Analysis/NewDelete-custom.cpp @@ -4,9 +4,7 @@ // RUN: %clang_analyze_cc1 -analyzer-checker=core,cplusplus.NewDelete,cplusplus.NewDeleteLeaks,unix.Malloc -std=c++11 -DLEAKS=1 -DALLOCATOR_INLINING=1 -fblocks -verify %s #include "Inputs/system-header-simulator-cxx.h" -#if !(LEAKS && !ALLOCATOR_INLINING) // expected-no-diagnostics -#endif void *allocator(std::size_t size); @@ -24,24 +22,18 @@ void testNewMethod() { void *p1 = C::operator new(0); // no warn - C *p2 = new C; // no warn + C *p2 = new C; // no-warning - C *c3 = ::new C; + C *c3 = ::new C; // no-warning } -#if LEAKS && !ALLOCATOR_INLINING -// expected-warning@-2{{Potential leak of memory pointed to by 'c3'}} -#endif void testOpNewArray() { void *p = operator new[](0); // call is inlined, no warn } void testNewExprArray() { - int *p = new int[0]; + int *p = new int[0]; // no-warning } -#if LEAKS && !ALLOCATOR_INLINING -// expected-warning@-2{{Potential leak of memory pointed to by 'p'}} -#endif //----- Custom non-placement operators @@ -50,12 +42,8 @@ } void testNewExpr() { - int *p = new int; + int *p = new int; // no-warning } -#if LEAKS && !ALLOCATOR_INLINING -// expected-warning@-2{{Potential leak of memory pointed to by 'p'}} -#endif - //----- Custom NoThrow placement operators void testOpNewNoThrow() { @@ -63,11 +51,8 @@ } void testNewExprNoThrow() { - int *p = new(std::nothrow) int; + int *p = new(std::nothrow) int; // no-warning } -#if LEAKS && !ALLOCATOR_INLINING -// expected-warning@-2{{Potential leak of memory pointed to by 'p'}} -#endif //----- Custom placement operators void testOpNewPlacement() { Index: test/Analysis/NewDelete-sized-deallocation.cpp =================================================================== --- /dev/null +++ test/Analysis/NewDelete-sized-deallocation.cpp @@ -0,0 +1,11 @@ +// RUN: %clang_analyze_cc1 -std=c++17 -analyzer-checker=core,cplusplus -verify %s +// RUN: %clang_analyze_cc1 -std=c++17 -analyzer-checker=core,cplusplus -verify -fsized-deallocation %s + +void foo() { + int *x = new int; +} // expected-warning{{Potential leak of memory pointed to by 'x'}} + +void bar() { + int *x = new int; + delete x; +} // no-warning