[StaticAnalyzer] Fix block pointer type nullability check

[tripleCC]

Summary

This patch fixes a false negative when the property type is an objective-c block pointer.
I don't have commit access.

[steakhal]

Looks good.
That pesky ObjC :D

[tripleCC]

In D151651#4379144, @steakhal wrote:

Looks good.
That pesky ObjC :D

I don't have commit access, could you help me to commit it? thanks
--author "tripleCC <[e-mail]>"

clang/lib/StaticAnalyzer/Checkers/NullabilityChecker.cpp

static NullConstraint getNullConstraint(DefinedOrUnknownSVal Val,
   ConditionTruthVal Nullness = State->isNull(Val);
   if (Nullness.isConstrainedFalse())
     return NullConstraint::IsNotNull;
   if (Nullness.isConstrainedTrue())
     return NullConstraint::IsNull;
   return NullConstraint::Unknown;
 }
 
+static bool isValidPointerType(QualType T) {
+  return T->isAnyPointerType() || T->isBlockPointerType();
+}
+
 const SymbolicRegion *
 NullabilityChecker::getTrackRegion(SVal Val, bool CheckSuperRegion) const {
   if (!NeedTracking)
     return nullptr;
 
   auto RegionSVal = Val.getAs<loc::MemRegionVal>();
   if (!RegionSVal)
     return nullptr;

 /// This method check when nullable pointer or null value is returned from a
 /// function that has nonnull return type.
 void NullabilityChecker::checkPreStmt(const ReturnStmt *S,
                                       CheckerContext &C) const {
   auto RetExpr = S->getRetValue();
   if (!RetExpr)
     return;
 
-  if (!RetExpr->getType()->isAnyPointerType())
+  if (!isValidPointerType(RetExpr->getType()))
     return;
 
   ProgramStateRef State = C.getState();
   if (State->get<InvariantViolated>())
     return;
 
   auto RetSVal = C.getSVal(S).getAs<DefinedOrUnknownSVal>();
   if (!RetSVal)
for (const ParmVarDecl *Param : Call.parameters()) {
     if (Idx >= Call.getNumArgs())
       break;
 
     const Expr *ArgExpr = Call.getArgExpr(Idx);
     auto ArgSVal = Call.getArgSVal(Idx++).getAs<DefinedOrUnknownSVal>();
     if (!ArgSVal)
       continue;
 
-    if (!Param->getType()->isAnyPointerType() &&
+    if (!isValidPointerType(Param->getType()) &&
         !Param->getType()->isReferenceType())
       continue;
 
     NullConstraint Nullness = getNullConstraint(*ArgSVal, State);
 
     Nullability RequiredNullability =
         getNullabilityAnnotation(Param->getType());
     Nullability ArgExprTypeLevelNullability =
if (!Decl)
     return;
   // ObjC Messages handles in a different callback.
   if (Call.getKind() == CE_ObjCMessage)
     return;
   const FunctionType *FuncType = Decl->getFunctionType();
   if (!FuncType)
     return;
   QualType ReturnType = FuncType->getReturnType();
-  if (!ReturnType->isAnyPointerType())
+  if (!isValidPointerType(ReturnType))
     return;
   ProgramStateRef State = C.getState();
   if (State->get<InvariantViolated>())
     return;
 
   const MemRegion *Region = getTrackRegion(Call.getReturnValue());
   if (!Region)
     return;

 /// nullability of the receiver, the nullability of the return value, and the
 /// constraints.
 void NullabilityChecker::checkPostObjCMessage(const ObjCMethodCall &M,
                                               CheckerContext &C) const {
   auto Decl = M.getDecl();
   if (!Decl)
     return;
   QualType RetType = Decl->getReturnType();
-  if (!RetType->isAnyPointerType())
+  if (!isValidPointerType(RetType))
     return;
 
   ProgramStateRef State = C.getState();
   if (State->get<InvariantViolated>())
     return;
 
   const MemRegion *ReturnRegion = getTrackRegion(M.getReturnValue());
   if (!ReturnRegion)

 /// Explicit casts are trusted. If there is a disagreement in the nullability
 /// annotations in the destination and the source or '0' is casted to nonnull
 /// track the value as having contraditory nullability. This will allow users to
 /// suppress warnings.
 void NullabilityChecker::checkPostStmt(const ExplicitCastExpr *CE,
                                        CheckerContext &C) const {
   QualType OriginType = CE->getSubExpr()->getType();
   QualType DestType = CE->getType();
-  if (!OriginType->isAnyPointerType())
+  if (!isValidPointerType(OriginType))
     return;
-  if (!DestType->isAnyPointerType())
+  if (!isValidPointerType(DestType))
     return;
 
   ProgramStateRef State = C.getState();
   if (State->get<InvariantViolated>())
     return;
 
   Nullability DestNullability = getNullabilityAnnotation(DestType);
 

 void NullabilityChecker::checkBind(SVal L, SVal V, const Stmt *S,
                                    CheckerContext &C) const {
   const TypedValueRegion *TVR =
       dyn_cast_or_null<TypedValueRegion>(L.getAsRegion());
   if (!TVR)
     return;
 
   QualType LocType = TVR->getValueType();
-  if (!LocType->isAnyPointerType())
+  if (!isValidPointerType(LocType))
     return;
 
   ProgramStateRef State = C.getState();
   if (State->get<InvariantViolated>())
     return;
 
   auto ValDefOrUnknown = V.getAs<DefinedOrUnknownSVal>();
   if (!ValDefOrUnknown)

clang/test/Analysis/nullability.mm

 #define assert(expr) \
   ((expr) ? (void)(0) : __assert_fail(#expr, __FILE__, __LINE__, __func__))
 
 @interface TestObject : NSObject
 - (int *_Nonnull)returnsNonnull;
 - (int *_Nullable)returnsNullable;
 - (int *)returnsUnspecified;
 - (void)takesNonnull:(int *_Nonnull)p;
+- (void)takesNonnullBlock:(void (^ _Nonnull)(void))block;
 - (void)takesNullable:(int *_Nullable)p;
 - (void)takesUnspecified:(int *)p;
 @property(readonly, strong) NSString *stuff;
 @property(readonly, nonnull) int *propReturnsNonnull;
+@property(readonly, nonnull) void (^propReturnsNonnullBlock)(void);
+@property(readonly, nullable) void (^propReturnsNullableBlock)(void);
 @property(readonly, nullable) int *propReturnsNullable;
 @property(readonly) int *propReturnsUnspecified;
 @end
 
 TestObject * getUnspecifiedTestObject();
 TestObject *_Nonnull getNonnullTestObject();
 TestObject *_Nullable getNullableTestObject();
 
 int getRandom();
 
 typedef struct Dummy { int val; } Dummy;
 
 void takesNullable(Dummy *_Nullable);
 void takesNonnull(Dummy *_Nonnull);
 void takesUnspecified(Dummy *);
+void takesNonnullBlock(void (^ _Nonnull)(void));
 
 Dummy *_Nullable returnsNullable();
 Dummy *_Nonnull returnsNonnull();
 Dummy *returnsUnspecified();
 int *_Nullable returnsNullableInt();
 
 template <typename T> T *eraseNullab(T *p) { return p; }
 
void testObjCMessageResultNullability() {
   }
 }
 
 void testObjCPropertyReadNullability() {
   TestObject *o = getNonnullTestObject();
   switch (getRandom()) {
   case 0:
     [o takesNonnull:o.propReturnsNonnull]; // no-warning
+    [o takesNonnullBlock:o.propReturnsNonnullBlock]; // no-warning
     break;
   case 1:
     [o takesNonnull:o.propReturnsUnspecified]; // no-warning
     break;
   case 2:
     [o takesNonnull:o.propReturnsNullable]; // expected-warning {{Nullable pointer is passed to a callee that requires a non-null 1st parameter}}
     break;
   case 3:
if (o.propReturnsNullable) {
       [o takesNonnull:getNonnullTestObject().propReturnsNullable]; // expected-warning {{Nullable pointer is passed to a callee that requires a non-null 1st parameter}}
     }
     break;
   case 7:
     // Assertions must be effective at suppressing warnings
     assert(o.propReturnsNullable);
     [o takesNonnull:o.propReturnsNullable]; // no-warning
     break;
+  case 8:
+    [o takesNonnullBlock:o.propReturnsNullableBlock]; // expected-warning {{Nullable pointer is passed to a callee that requires a non-null 1st parameter}}
+    break;
   }
 }
 
 Dummy * _Nonnull testDirectCastNullableToNonnull() {
   Dummy *p = returnsNullable();
   takesNonnull((Dummy * _Nonnull)p);  // no-warning
   return (Dummy * _Nonnull)p;         // no-warning
 }

 }
 @end
 
 void testIndirectNilPassToNonnull() {
   Dummy *p = 0;
   takesNonnull(p);  // expected-warning {{Null passed to a callee that requires a non-null 1st parameter}}
 }
 
+void testBlockIndirectNilPassToNonnull() {
+  void (^p)(void) = nil;
+  takesNonnullBlock(p);  // expected-warning {{Null passed to a callee that requires a non-null 1st parameter}}
+}
+
 void testConditionalNilPassToNonnull(Dummy *p) {
   if (!p) {
     takesNonnull(p);  // expected-warning {{Null passed to a callee that requires a non-null 1st parameter}}
   }
 }
 
 Dummy * _Nonnull testIndirectCastNilToNonnullAndReturn() {
   Dummy *p = (Dummy * _Nonnull)0;