[analyzer] Warn when a nil subscript is used on NSDictionary, as that crashes at runtime

[george.karpenkov]

Actually, turns out this is not valid, and I got confused. The getter does not crash.

[dcoughlin]

My mistake, sorry about that!

clang/lib/StaticAnalyzer/Checkers/BasicObjCFoundationChecks.cpp

class NilArgChecker : public Checker<check::PreObjCMessage,
     mutable Selector InsertObjectAtIndexSel;
     mutable Selector ReplaceObjectAtIndexWithObjectSel;
     mutable Selector SetObjectAtIndexedSubscriptSel;
     mutable Selector ArrayByAddingObjectSel;
     mutable Selector DictionaryWithObjectForKeySel;
     mutable Selector SetObjectForKeySel;
     mutable Selector SetObjectForKeyedSubscriptSel;
     mutable Selector RemoveObjectForKeySel;
+    mutable Selector ObjectForKeyedSubscriptSel;
 
     void warnIfNilExpr(const Expr *E,
                        const char *Msg,
                        CheckerContext &C) const;
 
     void warnIfNilArg(CheckerContext &C,
                       const ObjCMethodCall &msg, unsigned Arg,
                       FoundationClass Class,
if (Class == FC_NSString) {
     if (DictionaryWithObjectForKeySel.isNull()) {
       ASTContext &Ctx = C.getASTContext();
       DictionaryWithObjectForKeySel =
           getKeywordSelector(Ctx, "dictionaryWithObject", "forKey");
       SetObjectForKeySel = getKeywordSelector(Ctx, "setObject", "forKey");
       SetObjectForKeyedSubscriptSel =
           getKeywordSelector(Ctx, "setObject", "forKeyedSubscript");
       RemoveObjectForKeySel = getKeywordSelector(Ctx, "removeObjectForKey");
+      ObjectForKeyedSubscriptSel =
+          getKeywordSelector(Ctx, "objectForKeyedSubscript");
     }
 
     if (S == DictionaryWithObjectForKeySel || S == SetObjectForKeySel) {
       Arg = 0;
       warnIfNilArg(C, msg, /* Arg */1, Class);
     } else if (S == SetObjectForKeyedSubscriptSel) {
       CanBeSubscript = true;
       Arg = 1;
     } else if (S == RemoveObjectForKeySel) {
       Arg = 0;
+    } else if (S == ObjectForKeyedSubscriptSel) {
+      Arg = 0;
     }
   }
 
   // If argument is '0', report a warning.
   if ((Arg != InvalidArgIndex))
     warnIfNilArg(C, msg, Arg, Class, CanBeSubscript);
 }
 

clang/test/Analysis/NSContainers.m

 
 @end
 
 @interface NSDictionary : NSObject <NSCopying, NSMutableCopying, NSSecureCoding, NSFastEnumeration>
 
 - (NSUInteger)count;
 - (id)objectForKey:(id)aKey;
 - (NSEnumerator *)keyEnumerator;
+- (id)objectForKeyedSubscript:(id)aKey;
 
 @end
 
 @interface NSDictionary (NSDictionaryCreation)
 
 + (id)dictionary;
 + (id)dictionaryWithObject:(id)object forKey:(id <NSCopying>)key;
 + (instancetype)dictionaryWithObjects:(const id [])objects forKeys:(const id <NSCopying> [])keys count:(NSUInteger)cnt;
void testNoReportWhenReceiverNil(NSMutableArray *array, int b) {
   }
 
   MyView *view = b ? [[MyView alloc] init] : 0;
   NSMutableArray *subviews = [[view subviews] mutableCopy];
   // When view is nil, subviews is also nil so there should be no warning
   // here either.
   [subviews addObject:view]; // no-warning
 }
+
+void testNilSubscriptToDict(NSDictionary *d, NSString *s) {
+  if (s) {}
+  id obj = d[s]; // expected-warning{{Value argument to 'objectForKeyedSubscript:' cannot be nil}}
+}
+
+void testNilSubscriptToMutableDict(NSMutableDictionary *d, NSString *s) {
+  if (s) {}
+  id obj = d[s]; // expected-warning{{Value argument to 'objectForKeyedSubscript:' cannot be nil}}
+}