1  /* A toy re-implementation of CPython's object model.  */
       2  
       3  #include <stddef.h>
       4  #include <string.h>
       5  #include <stdlib.h>
       6  
       7  typedef struct base_obj base_obj;
       8  typedef struct type_obj type_obj;
       9  typedef struct string_obj string_obj;
      10  
      11  struct base_obj
      12  {
      13    struct type_obj *ob_type;
      14    int ob_refcnt;
      15  };
      16  
      17  struct type_obj
      18  {
      19    base_obj tp_base;
      20    void (*tp_dealloc) (base_obj *);
      21  };
      22  
      23  struct string_obj
      24  {
      25    base_obj str_base;
      26    size_t str_len;
      27    char str_buf[];
      28  };
      29  
      30  extern void type_del (base_obj *);
      31  extern void str_del (base_obj *);
      32  
      33  type_obj type_type = {
      34    { &type_type, 1},
      35    type_del
      36  };
      37  
      38  type_obj str_type = {
      39    { &str_type, 1},
      40    str_del
      41  };
      42  
      43  base_obj *alloc_obj (type_obj *ob_type, size_t sz)
      44  {
      45    base_obj *obj = (base_obj *)malloc (sz);
      46    if (!obj)
      47      return NULL;
      48    obj->ob_type = ob_type;
      49    obj->ob_refcnt = 1;
      50    return obj;
      51  }
      52  
      53  string_obj *new_string_obj (const char *str)
      54  {
      55    //__analyzer_dump ();
      56    size_t len = strlen (str);
      57  #if 1
      58    string_obj *str_obj
      59      = (string_obj *)alloc_obj (&str_type, sizeof (string_obj) + len + 1);
      60  #else
      61    string_obj *str_obj = (string_obj *)malloc (sizeof (string_obj) + len + 1);
      62    if (!str_obj)
      63      return NULL;
      64    str_obj->str_base.ob_type = &str_type;
      65    str_obj->str_base.ob_refcnt = 1;
      66  #endif
      67    str_obj->str_len = len; /* { dg-warning "dereference of NULL 'str_obj'" } */
      68    memcpy (str_obj->str_buf, str, len);
      69    str_obj->str_buf[len] = '\0';
      70    return str_obj;
      71  }
      72  
      73  void unref (string_obj *obj)
      74  {
      75    //__analyzer_dump();
      76    if (--obj->str_base.ob_refcnt == 0)
      77      {
      78        //__analyzer_dump();
      79        obj->str_base.ob_type->tp_dealloc ((base_obj *)obj);
      80      }
      81  }
      82  
      83  void test_1 (const char *str)
      84  {
      85    string_obj *obj = new_string_obj (str);
      86    //__analyzer_dump();
      87    if (obj)
      88      unref (obj);
      89  } /* { dg-bogus "leak" "" { xfail *-*-* } } */
      90  /* XFAIL (false leak):
      91     Given that we only know "len" symbolically, this line:
      92       str_obj->str_buf[len] = '\0';
      93     is a symbolic write which could clobber the ob_type or ob_refcnt.
      94     It reports a leak when following the path where the refcount is clobbered
      95     to be a value that leads to the deallocator not being called.  */