[Static Analyzer] Relaxing a caching out related assert.

[xazax.hun]

Summary

During the development of the nullability checkers I hit this assert several times. However it is very hard to reproduce it with a minimal example, and hard to come up with a test case. I could not identify any issue with the checkers themselves, and I think it is ok to cache out at this point of execution, when the node was created by a checker.

At some point with an older version of the nullability checkers I could came up with a minimal example (which no longer triggers the caching out issue with the nullability checker):

NSString *getString();
int getInt();

int main() {
    for(int i = 0; i < 2; ++i) {
        NSString *serviceID = getString();
     
        if (!getInt())
            [serviceID isEqualToString: @"literal"];
    }
    return 0;
}

Consider the following two paths:
a, First iteration -> take the branch, store information about the literal. Second iteration -> Take the branch.
b, First iteration -> do not take the branch. Second iteration -> take the branch, and store the same information about the literals that was stored in path a.

At the end of path b, according to the analyzer we see the same state that is at the end of path a. However the predecessor state differs.

lib/StaticAnalyzer/Core/ExprEngineObjC.cpp

if (UpdatedMsg->isInstanceMessage()) {
           // If we raise an exception, for now treat it as a sink.
           // Eventually we will want to handle exceptions properly.
           Bldr.generateSink(ME, Pred, State);
           continue;
         }
 
         // Generate a transition to non-Nil state.
         if (notNilState != State) {
+          bool HasTag = Pred->getLocation().getTag();
           Pred = Bldr.generateNode(ME, Pred, notNilState);
-          assert(Pred && "Should have cached out already!");
+          assert((Pred || HasTag) && "Should have cached out already!");
+          if (!Pred)
+            continue;
         }
       }
     } else {
       // Check for special class methods that are known to not return
       // and that we should treat as a sink.
       if (ObjCNoRet.isImplicitNoReturn(ME)) {
         // If we raise an exception, for now treat it as a sink.
         // Eventually we will want to handle exceptions properly.