[Static Analyzer] Use generics related information to infer dynamic types.

[xazax.hun]

Summary

This patch makes the DynamicTypePropagation checker utilize the information about generics. Using this additional information more precise inlining can be done. It also fixes an XFAIL test.

The same stored information will be used by a separate general type checker. That checker will make it possible to get rid of the isReturnValueMisused function.

[zaks.anna]

lib/StaticAnalyzer/Checkers/DynamicTypePropagation.cpp

871 ↗

(On Diff #34942)

Would it be possible for this to reset the type to a less specific type? (What happens if the method was inlined and we already inferred the value of the returned symbolic region.)
Same question for where we update the type in dynamicTypePropagationOnCasts.

This also introduces a situation where both tables track the type. Maybe we should add a TODO here?

[xazax.hun]

Addressed the comments.

[xazax.hun]

lib/StaticAnalyzer/Checkers/DynamicTypePropagation.cpp

871 ↗

(On Diff #35027)

You are right, I am added the check and the comment.
The dynamicTypePropagationOnCasts should not cause any trouble, it only updates the dynamic type map, when there is new and better information available. See getBetterObjCType function.

We do not need to call getBetterObjCType here, because if there were no information yet, we will populate the table, if a function was inlined and there is a cast before return getBetterObjCType was already called there, so it is safe to just skip updating the DynamicTypeMap.

[zaks.anna]

lib/StaticAnalyzer/Checkers/DynamicTypePropagation.cpp

871 ↗

(On Diff #35027)

We do not need to call getBetterObjCType here, because if there were no information yet, we will populate the table, if a > function was inlined and there is a cast before return getBetterObjCType was already called there, so it is safe to just
skip updating the DynamicTypeMap.

You should explain this in the comment.

cfe/trunk/lib/StaticAnalyzer/Checkers/DynamicTypePropagation.cpp

findMethodDecl(const ObjCMessageExpr *MessageExpr,
   // Fallback to statick method lookup when the one based on the tracked type
   // failed.
   return Method ? Method : MessageExpr->getMethodDecl();
 }
 
 /// Get the returned ObjCObjectPointerType by a method based on the tracked type
 /// information, or null pointer when the returned type is not an
 /// ObjCObjectPointerType.
-static const ObjCObjectPointerType *getReturnTypeForMethod(
+static QualType getReturnTypeForMethod(
     const ObjCMethodDecl *Method, ArrayRef<QualType> TypeArgs,
     const ObjCObjectPointerType *SelfType, ASTContext &C) {
   QualType StaticResultType = Method->getReturnType();
 
   // Is the return type declared as instance type?
   if (StaticResultType == C.getObjCInstanceType())
-    return SelfType;
+    return QualType(SelfType, 0);
 
   // Check whether the result type depends on a type parameter.
   if (!isObjCTypeParamDependent(StaticResultType))
-    return nullptr;
+    return QualType();
 
   QualType ResultType = StaticResultType.substObjCTypeArgs(
       C, TypeArgs, ObjCSubstitutionContext::Result);
 
-  return ResultType->getAs<ObjCObjectPointerType>();
+  return ResultType;
 }
 
 /// Validate that the return type of a message expression is used correctly.
 /// Returns true in case an error is detected.
 bool DynamicTypePropagation::isReturnValueMisused(
     const ObjCMessageExpr *MessageExpr,
-    const ObjCObjectPointerType *SeflType, SymbolRef Sym,
+    const ObjCObjectPointerType *ResultPtrType, SymbolRef Sym,
     const ObjCMethodDecl *Method, ArrayRef<QualType> TypeArgs,
     bool SubscriptOrProperty, CheckerContext &C) const {
-  ASTContext &ASTCtxt = C.getASTContext();
-  const auto *ResultPtrType =
-      getReturnTypeForMethod(Method, TypeArgs, SeflType, ASTCtxt);
   if (!ResultPtrType)
     return false;
 
+  ASTContext &ASTCtxt = C.getASTContext();
   const Stmt *Parent =
       C.getCurrentAnalysisDeclContext()->getParentMap().getParent(MessageExpr);
   if (SubscriptOrProperty) {
     // Properties and subscripts are not direct parents.
     Parent =
         C.getCurrentAnalysisDeclContext()->getParentMap().getParent(Parent);
   }
 
void DynamicTypePropagation::checkPostObjCMessage(const ObjCMethodCall &M,
   if (!Method)
     return;
 
   Optional<ArrayRef<QualType>> TypeArgs =
       (*TrackedType)->getObjCSubstitutions(Method->getDeclContext());
   if (!TypeArgs)
     return;
 
-  if (isReturnValueMisused(MessageExpr, *TrackedType, RecSym, Method, *TypeArgs,
-                           M.getMessageKind() != OCM_Message, C))
+  QualType ResultType =
+      getReturnTypeForMethod(Method, *TypeArgs, *TrackedType, ASTCtxt);
+  // The static type is the same as the deduced type.
+  if (ResultType.isNull())
+    return;
+
+  const MemRegion *RetRegion = M.getReturnValue().getAsRegion();
+  ExplodedNode *Pred = C.getPredecessor();
+  // When there is an entry available for the return symbol in DynamicTypeMap,
+  // the call was inlined, and the information in the DynamicTypeMap is should
+  // be precise.
+  if (RetRegion && !State->get<DynamicTypeMap>(RetRegion)) {
+    // TODO: we have duplicated information in DynamicTypeMap and
+    // MostSpecializedTypeArgsMap. We should only store anything in the later if
+    // the stored data differs from the one stored in the former.
+    State = setDynamicTypeInfo(State, RetRegion, ResultType,
+                               /*CanBeSubclass=*/true);
+    Pred = C.addTransition(State);
+  }
+
+  const auto *ResultPtrType = ResultType->getAs<ObjCObjectPointerType>();
+
+  if (isReturnValueMisused(MessageExpr, ResultPtrType, RecSym, Method,
+                           *TypeArgs, M.getMessageKind() != OCM_Message, C))
     return;
 
-  const auto *ResultPtrType =
-      getReturnTypeForMethod(Method, *TypeArgs, *TrackedType, ASTCtxt);
   if (!ResultPtrType || ResultPtrType->isUnspecialized())
     return;
 
   // When the result is a specialized type and it is not tracked yet, track it
   // for the result symbol.
   if (!State->get<MostSpecializedTypeArgsMap>(RetSym)) {
     State = State->set<MostSpecializedTypeArgsMap>(RetSym, ResultPtrType);
-    C.addTransition(State);
+    C.addTransition(State, Pred);
   }
 }
 
 void DynamicTypePropagation::reportGenericsBug(
     const ObjCObjectPointerType *From, const ObjCObjectPointerType *To,
     ExplodedNode *N, SymbolRef Sym, CheckerContext &C,
     const Stmt *ReportedNode) const {
   if (!CheckGenerics)

cfe/trunk/test/Analysis/DynamicTypePropagation.m

 // RUN: %clang_cc1 -analyze -analyzer-checker=core,alpha.osx.cocoa.ObjCGenerics -verify %s
-// XFAIL: *
 
 #if !__has_feature(objc_generics)
 #  error Compiler does not support Objective-C generics?
 #endif
 
 #define nil 0
 typedef unsigned long NSUInteger;
 typedef int BOOL;