[analyzer] Exrtend ObjCAutoreleaseWriteChecker to also catch block declarations with autoreleasing variables

[NoQ]

Yup, totally!

cfe/trunk/lib/StaticAnalyzer/Checkers/ObjCAutoreleaseWriteChecker.cpp

static void emitDiagnostics(BoundNodes &Match, const Decl *D, BugReporter &BR,
                             AnalysisManager &AM,
                             const ObjCAutoreleaseWriteChecker *Checker) {
   AnalysisDeclContext *ADC = AM.getAnalysisDeclContext(D);
 
   const auto *PVD = Match.getNodeAs<ParmVarDecl>(ParamBind);
   QualType Ty = PVD->getType();
   if (Ty->getPointeeType().getObjCLifetime() != Qualifiers::OCL_Autoreleasing)
     return;
-  const char *WarningMsg = "Write to";
+  const char *ActionMsg = "Write to";
   const auto *MarkedStmt = Match.getNodeAs<Expr>(ProblematicWriteBind);
+  bool IsCapture = false;
 
   // Prefer to warn on write, but if not available, warn on capture.
   if (!MarkedStmt) {
     MarkedStmt = Match.getNodeAs<Expr>(CapturedBind);
     assert(MarkedStmt);
-    WarningMsg = "Capture of";
+    ActionMsg = "Capture of";
+    IsCapture = true;
   }
 
   SourceRange Range = MarkedStmt->getSourceRange();
   PathDiagnosticLocation Location = PathDiagnosticLocation::createBegin(
       MarkedStmt, BR.getSourceManager(), ADC);
   bool IsMethod = Match.getNodeAs<ObjCMethodDecl>(IsMethodBind) != nullptr;
   const char *Name = IsMethod ? "method" : "function";
+
   BR.EmitBasicReport(
       ADC->getDecl(), Checker,
-      /*Name=*/(llvm::Twine(WarningMsg)
+      /*Name=*/(llvm::Twine(ActionMsg)
                 + " autoreleasing out parameter inside autorelease pool").str(),
       /*Category=*/"Memory",
-      (llvm::Twine(WarningMsg) + " autoreleasing out parameter inside " +
+      (llvm::Twine(ActionMsg) + " autoreleasing out parameter " +
+       (IsCapture ? "'" + PVD->getName() + "'" + " " : "") + "inside " +
        "autorelease pool that may exit before " + Name + " returns; consider "
        "writing first to a strong local variable declared outside of the block")
           .str(),
       Location,
       Range);
 }
 
 void ObjCAutoreleaseWriteChecker::checkASTCodeBody(const Decl *D,
                                                   AnalysisManager &AM,
                                                   BugReporter &BR) const {
 
   auto DoublePointerParamM =
       parmVarDecl(hasType(hasCanonicalType(pointerType(
                       pointee(hasCanonicalType(objcObjectPointerType()))))))
           .bind(ParamBind);
 
   auto ReferencedParamM =
-      declRefExpr(to(parmVarDecl(DoublePointerParamM)));
+      declRefExpr(to(parmVarDecl(DoublePointerParamM))).bind(CapturedBind);
 
   // Write into a binded object, e.g. *ParamBind = X.
   auto WritesIntoM = binaryOperator(
     hasLHS(unaryOperator(
         hasOperatorName("*"),
         hasUnaryOperand(
           ignoringParenImpCasts(ReferencedParamM))
     )),
     hasOperatorName("=")
   ).bind(ProblematicWriteBind);
 
   auto ArgumentCaptureM = hasAnyArgument(
     ignoringParenImpCasts(ReferencedParamM));
   auto CapturedInParamM = stmt(anyOf(
       callExpr(ArgumentCaptureM),
-      objcMessageExpr(ArgumentCaptureM))).bind(CapturedBind);
+      objcMessageExpr(ArgumentCaptureM)));
 
   // WritesIntoM happens inside a block passed as an argument.
   auto WritesOrCapturesInBlockM = hasAnyArgument(allOf(
       hasType(hasCanonicalType(blockPointerType())),
       forEachDescendant(
         stmt(anyOf(WritesIntoM, CapturedInParamM))
       )));
 
   auto BlockPassedToMarkedFuncM = stmt(anyOf(
     callExpr(allOf(
       callsNames(FunctionsWithAutoreleasingPool), WritesOrCapturesInBlockM)),
     objcMessageExpr(allOf(
        hasAnySelector(toRefs(SelectorsWithAutoreleasingPool)),
        WritesOrCapturesInBlockM))
   ));
 
   auto HasParamAndWritesInMarkedFuncM = allOf(
       hasAnyParameter(DoublePointerParamM),
       forEachDescendant(BlockPassedToMarkedFuncM));
 
   auto MatcherM = decl(anyOf(
       objcMethodDecl(HasParamAndWritesInMarkedFuncM).bind(IsMethodBind),
-      functionDecl(HasParamAndWritesInMarkedFuncM)));
+      functionDecl(HasParamAndWritesInMarkedFuncM),
+      blockDecl(HasParamAndWritesInMarkedFuncM)));
 
   auto Matches = match(MatcherM, *D, AM.getASTContext());
   for (BoundNodes Match : Matches)
     emitDiagnostics(Match, D, BR, AM, this);
 }
 
 void ento::registerAutoreleaseWriteChecker(CheckerManager &Mgr) {
   Mgr.registerChecker<ObjCAutoreleaseWriteChecker>();
 }

cfe/trunk/test/Analysis/autoreleasewritechecker_test.m

 void multipleErrors(NSError *__autoreleasing* error, NSDictionary *a) {
   [a enumerateKeysAndObjectsUsingBlock:^{
      writeIntoError(error); // expected-warning{{Capture of autoreleasing out parameter}}
      *error = [NSError errorWithDomain:1]; // expected-warning{{Write to autoreleasing out parameter}}
      writeIntoError(error); // expected-warning{{Capture of autoreleasing out parameter}}
   }];
 }
 
+typedef void (^errBlock)(NSError *__autoreleasing *error);
+
+extern void expectError(errBlock);
+
+void captureAutoreleasingVarFromBlock(NSDictionary *dict) {
+  expectError(^(NSError *__autoreleasing *err) {
+    [dict enumerateKeysAndObjectsUsingBlock:^{
+      writeIntoError(err); // expected-warning{{Capture of autoreleasing out parameter 'err'}}
+    }];
+  });
+}
+
 #endif