[analyzer] Preliminary version of retain count checking for OSObjects

[george.karpenkov]

Summary

Still has quite a lot of false positives, in alpha for now.

[NoQ]

Tests have disappeared again.

clang/include/clang/StaticAnalyzer/Core/RetainSummaryManager.h

533–534 ↗

(On Diff #161846)

I suspect that this line wasn't intended to be moved around.

clang/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountChecker.cpp

1403–1410 ↗

(On Diff #161846)

Now enabling OSObjectRetainCount checker would enable the regular RetainCountChecker.

If we want to keep them separate, i guess we'll have to make it work both ways and add a flag for the regular retain count checker everywhere in its code.

It's easy to forget the check, so we might probably want to add assertions somewhere in emitReport that we at least don't throw warnings from disabled checkers.

clang/lib/StaticAnalyzer/Core/RetainSummaryManager.cpp

331–334 ↗

(On Diff #161846)

Should we check TrackOSObjects here?

[george.karpenkov]

clang/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountChecker.cpp

1403–1410 ↗

(On Diff #161846)

I think I'm fine with enabling the "regular" one, I don't think it would cause any issues with codebases using OSObject, as they probably would never have CFObject or NSObject.

[george.karpenkov]

Updated, now with tests.

[NoQ]

Looks great. I enjoyed how we managed to re-use the infrastructure.

cfe/trunk/include/clang/StaticAnalyzer/Core/RetainSummaryManager.h

enum ObjKind {
     /// Indicates that the tracked object is a CF object.  This is
     /// important between GC and non-GC code.
     CF,
     /// Indicates that the tracked object is an Objective-C object.
     ObjC,
     /// Indicates that the tracked object could be a CF or Objective-C object.
     AnyObj,
     /// Indicates that the tracked object is a generalized object.
-    Generalized
+    Generalized,
+
+    /// A descendant of OSObject.
+    OS
   };
 
 private:
   Kind K;
   ObjKind O;
 
   RetEffect(Kind k, ObjKind o = AnyObj) : K(k), O(o) {}
 
class RetainSummary {
   /// DefaultArgEffect - The default ArgEffect to apply to arguments that
   ///  do not have an entry in Args.
   ArgEffect DefaultArgEffect;
 
   /// Receiver - If this summary applies to an Objective-C message expression,
   ///  this is the effect applied to the state of the receiver.
   ArgEffect Receiver;
 
+  /// Effect on "this" pointer - applicable only to C++ method calls.
+  ArgEffect This;
+
   /// Ret - The effect on the return value.  Used to indicate if the
   ///  function/method call returns a new tracked symbol.
   RetEffect Ret;
 
 public:
-  RetainSummary(ArgEffects A, RetEffect R, ArgEffect defaultEff,
-                ArgEffect ReceiverEff)
-    : Args(A), DefaultArgEffect(defaultEff), Receiver(ReceiverEff), Ret(R) {}
+  RetainSummary(ArgEffects A,
+                RetEffect R,
+                ArgEffect defaultEff,
+                ArgEffect ReceiverEff,
+                ArgEffect ThisEff)
+    : Args(A), DefaultArgEffect(defaultEff), Receiver(ReceiverEff),
+      This(ThisEff), Ret(R) {}
 
   /// getArg - Return the argument effect on the argument specified by
   ///  idx (starting from 0).
   ArgEffect getArg(unsigned idx) const {
     if (const ArgEffect *AE = Args.lookup(idx))
       return *AE;
 
     return DefaultArgEffect;
public:
 
   /// Sets the effect on the receiver of the message.
   void setReceiverEffect(ArgEffect e) { Receiver = e; }
 
   /// getReceiverEffect - Returns the effect on the receiver of the call.
   ///  This is only meaningful if the summary applies to an ObjCMessageExpr*.
   ArgEffect getReceiverEffect() const { return Receiver; }
 
+  ArgEffect getThisEffect() const { return This; }
+
+  bool isNoop() const {
+    return Ret == RetEffect::MakeNoRet() && Receiver == DoNothing
+      && DefaultArgEffect == MayEscape && This == DoNothing
+      && Args.isEmpty();
+  }
+
   /// Test if two retain summaries are identical. Note that merely equivalent
   /// summaries are not necessarily identical (for example, if an explicit
   /// argument effect matches the default effect).
   bool operator==(const RetainSummary &Other) const {
     return Args == Other.Args && DefaultArgEffect == Other.DefaultArgEffect &&
-           Receiver == Other.Receiver && Ret == Other.Ret;
+           Receiver == Other.Receiver && This == Other.This && Ret == Other.Ret;
   }
 
   /// Profile this summary for inclusion in a FoldingSet.
   void Profile(llvm::FoldingSetNodeID& ID) const {
     ID.Add(Args);
     ID.Add(DefaultArgEffect);
     ID.Add(Receiver);
+    ID.Add(This);
     ID.Add(Ret);
   }
 
   /// A retain summary is simple if it has no ArgEffects other than the default.
   bool isSimple() const {
     return Args.isEmpty();
   }
 
class RetainSummaryManager {
   typedef llvm::FoldingSetNodeWrapper<RetainSummary> CachedSummaryNode;
 
   /// Ctx - The ASTContext object for the analyzed ASTs.
   ASTContext &Ctx;
 
   /// Records whether or not the analyzed code runs in ARC mode.
   const bool ARCEnabled;
 
+  /// Track sublcasses of OSObject
+  const bool TrackOSObjects;
+
   /// FuncSummaries - A map from FunctionDecls to summaries.
   FuncSummariesTy FuncSummaries;
 
   /// ObjCClassMethodSummaries - A map from selectors (for instance methods)
   ///  to summaries.
   ObjCMethodSummariesTy ObjCClassMethodSummaries;
 
   /// ObjCMethodSummaries - A map from selectors to summaries.
class RetainSummaryManager {
   /// SimpleSummaries - Used for uniquing summaries that don't have special
   /// effects.
   llvm::FoldingSet<CachedSummaryNode> SimpleSummaries;
 
   /// getArgEffects - Returns a persistent ArgEffects object based on the
   ///  data in ScratchArgs.
   ArgEffects getArgEffects();
 
+  /// Create an OS object at +1.
+  const RetainSummary *getOSSummaryCreateRule(const FunctionDecl *FD);
+
+  /// Get an OS object at +0.
+  const RetainSummary *getOSSummaryGetRule(const FunctionDecl *FD);
+
+  /// Increment the reference count on OS object.
+  const RetainSummary *getOSSummaryRetainRule(const FunctionDecl *FD);
+
+  /// Decrement the reference count on OS object.
+  const RetainSummary *getOSSummaryReleaseRule(const FunctionDecl *FD);
+
+
   enum UnaryFuncKind { cfretain, cfrelease, cfautorelease, cfmakecollectable };
 
   const RetainSummary *getUnarySummary(const FunctionType* FT,
                                        UnaryFuncKind func);
 
   const RetainSummary *getCFSummaryCreateRule(const FunctionDecl *FD);
   const RetainSummary *getCFSummaryGetRule(const FunctionDecl *FD);
   const RetainSummary *getCFCreateGetRuleSummary(const FunctionDecl *FD);
 
   const RetainSummary *getPersistentSummary(const RetainSummary &OldSumm);
 
   const RetainSummary *getPersistentSummary(RetEffect RetEff,
                                             ArgEffect ReceiverEff = DoNothing,
-                                            ArgEffect DefaultEff = MayEscape) {
-    RetainSummary Summ(getArgEffects(), RetEff, DefaultEff, ReceiverEff);
+                                            ArgEffect DefaultEff = MayEscape,
+                                            ArgEffect ThisEff = DoNothing) {
+    RetainSummary Summ(getArgEffects(), RetEff, DefaultEff, ReceiverEff,
+                       ThisEff);
     return getPersistentSummary(Summ);
   }
 
   const RetainSummary *getDoNothingSummary() {
     return getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
   }
 
   const RetainSummary *getDefaultSummary() {
void addClsMethSummary(IdentifierInfo *II, const RetainSummary *Summ,
                          Keywords *... Kws) {
     addMethodSummary(II, ObjCClassMethodSummaries, Summ, Kws...);
   }
 
   const RetainSummary * generateSummary(const FunctionDecl *FD,
                                         bool &AllowAnnotations);
 
 public:
-  RetainSummaryManager(ASTContext &ctx, bool usesARC)
+  RetainSummaryManager(ASTContext &ctx,
+                       bool usesARC,
+                       bool trackOSObject)
    : Ctx(ctx),
      ARCEnabled(usesARC),
+     TrackOSObjects(trackOSObject),
      AF(BPAlloc), ScratchArgs(AF.getEmptyMap()),
      ObjCAllocRetE(usesARC ? RetEffect::MakeNotOwned(RetEffect::ObjC)
                                : RetEffect::MakeOwned(RetEffect::ObjC)),
      ObjCInitRetE(usesARC ? RetEffect::MakeNotOwned(RetEffect::ObjC)
                                : RetEffect::MakeOwnedWhenTrackedReceiver()) {
     InitializeClassMethodSummaries();
     InitializeMethodSummaries();
   }

cfe/trunk/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountChecker.h

private:
   /// The current state of the object.
   ///
   /// See the RefVal::Kind enum for possible values.
   unsigned RawKind : 5;
 
   /// The kind of object being tracked (CF or ObjC), if known.
   ///
   /// See the RetEffect::ObjKind enum for possible values.
-  unsigned RawObjectKind : 2;
+  unsigned RawObjectKind : 3;
 
   /// True if the current state and/or retain count may turn out to not be the
   /// best possible approximation of the reference counting state.
   ///
   /// If true, the checker may decide to throw away ("override") this state
   /// in favor of something else when it sees the object being used in new ways.
   ///
   /// This setting should not be propagated to state derived from this state.
class RetainCountChecker
 
   typedef llvm::DenseMap<SymbolRef, const CheckerProgramPointTag *> SymbolTagMap;
 
   // This map is only used to ensure proper deletion of any allocated tags.
   mutable SymbolTagMap DeadSymbolTags;
 
   mutable std::unique_ptr<RetainSummaryManager> Summaries;
   mutable SummaryLogTy SummaryLog;
+
+  AnalyzerOptions &Options;
   mutable bool ShouldResetSummaryLog;
 
   /// Optional setting to indicate if leak reports should include
   /// the allocation line.
   mutable bool IncludeAllocationLine;
 
 public:
-  RetainCountChecker(AnalyzerOptions &AO)
-    : ShouldResetSummaryLog(false),
-      IncludeAllocationLine(shouldIncludeAllocationSiteInLeakDiagnostics(AO)) {}
+  RetainCountChecker(AnalyzerOptions &Options)
+      : Options(Options), ShouldResetSummaryLog(false),
+        IncludeAllocationLine(
+            shouldIncludeAllocationSiteInLeakDiagnostics(Options)) {}
 
   ~RetainCountChecker() override { DeleteContainerSeconds(DeadSymbolTags); }
 
+  bool shouldCheckOSObjectRetainCount() const {
+    return Options.getBooleanOption("CheckOSObject", false, this);
+  }
+
   void checkEndAnalysis(ExplodedGraph &G, BugReporter &BR,
                         ExprEngine &Eng) const {
     // FIXME: This is a hack to make sure the summary log gets cleared between
     // analyses of different code bodies.
     //
     // Why is this necessary? Because a checker's lifetime is tied to a
     // translation unit, but an ExplodedGraph's lifetime is just a code body.
     // Once in a blue moon, a new ExplodedNode will have the same address as an
CFRefBug *getLeakAtReturnBug(const LangOptions &LOpts) const {
         leakAtReturn.reset(new Leak(this, "Leak of returned object"));
       return leakAtReturn.get();
   }
 
   RetainSummaryManager &getSummaryManager(ASTContext &Ctx) const {
     // FIXME: We don't support ARC being turned on and off during one analysis.
     // (nor, for that matter, do we support changing ASTContexts)
     bool ARCEnabled = (bool)Ctx.getLangOpts().ObjCAutoRefCount;
-    if (!Summaries)
-      Summaries.reset(new RetainSummaryManager(Ctx, ARCEnabled));
-    else
+    if (!Summaries) {
+      Summaries.reset(new RetainSummaryManager(
+          Ctx, ARCEnabled, shouldCheckOSObjectRetainCount()));
+    } else {
       assert(Summaries->isARCEnabled() == ARCEnabled);
+    }
     return *Summaries;
   }
 
   RetainSummaryManager &getSummaryManager(CheckerContext &C) const {
     return getSummaryManager(C.getASTContext());
   }
 
   void printState(raw_ostream &Out, ProgramStateRef State,

cfe/trunk/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountChecker.cpp

if (const auto *MsgInvocation = dyn_cast<ObjCMethodCall>(&CallOrMsg)) {
     if (SymbolRef Sym = MsgInvocation->getReceiverSVal().getAsLocSymbol()) {
       if (Summ.getReceiverEffect() == StopTrackingHard) {
         state = removeRefBinding(state, Sym);
       }
     }
   }
 
   // Consult the summary for the return value.
-  RetEffect RE = Summ.getRetEffect();
-  if (RE.getKind() == RetEffect::NoRetHard) {
-    SymbolRef Sym = CallOrMsg.getReturnValue().getAsSymbol();
-    if (Sym)
-      state = removeRefBinding(state, Sym);
+  RetEffect RE = Summ.getRetEffect();
+  if (const auto *MCall = dyn_cast<CXXMemberCall>(&CallOrMsg)) {
+    if (Optional<RefVal> updatedRefVal =
+            refValFromRetEffect(RE, MCall->getResultType())) {
+      state = setRefBinding(state, Sym, *updatedRefVal);
     }
+  }
+
+  if (RE.getKind() == RetEffect::NoRetHard && Sym)
+    state = removeRefBinding(state, Sym);
 
   C.addTransition(state);
 }
 
 static ProgramStateRef updateOutParameter(ProgramStateRef State,
                                           SVal ArgVal,
                                           ArgEffect Effect) {
   auto *ArgRegion = dyn_cast_or_null<TypedValueRegion>(ArgVal.getAsRegion());
if (Effect == RetainedOutParameter || Effect == UnretainedOutParameter) {
           ErrorRange = CallOrMsg.getArgSourceRange(idx);
           ErrorSym = Sym;
           break;
         }
       }
     }
   }
 
-  // Evaluate the effect on the message receiver.
+  // Evaluate the effect on the message receiver / `this` argument.
   bool ReceiverIsTracked = false;
   if (!hasErr) {
-    const ObjCMethodCall *MsgInvocation = dyn_cast<ObjCMethodCall>(&CallOrMsg);
-    if (MsgInvocation) {
+    if (const auto *MsgInvocation = dyn_cast<ObjCMethodCall>(&CallOrMsg)) {
       if (SymbolRef Sym = MsgInvocation->getReceiverSVal().getAsLocSymbol()) {
         if (const RefVal *T = getRefBinding(state, Sym)) {
           ReceiverIsTracked = true;
           state = updateSymbol(state, Sym, *T, Summ.getReceiverEffect(),
                                  hasErr, C);
           if (hasErr) {
             ErrorRange = MsgInvocation->getOriginExpr()->getReceiverRange();
             ErrorSym = Sym;
           }
         }
       }
+    } else if (const auto *MCall = dyn_cast<CXXMemberCall>(&CallOrMsg)) {
+      if (SymbolRef Sym = MCall->getCXXThisVal().getAsLocSymbol()) {
+        if (const RefVal *T = getRefBinding(state, Sym)) {
+          state = updateSymbol(state, Sym, *T, Summ.getThisEffect(),
+                               hasErr, C);
+          if (hasErr) {
+            ErrorRange = MCall->getOriginExpr()->getSourceRange();
+            ErrorSym = Sym;
+          }
+        }
+      }
     }
   }
 
   // Process any errors.
   if (hasErr) {
     processNonLeakError(state, ErrorRange, hasErr, ErrorSym, C);
     return;
   }

cfe/trunk/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountDiagnostics.cpp

else {
           os << "Subscript";
           break;
         }
       }
 
       if (CurrV.getObjKind() == RetEffect::CF) {
         os << " returns a Core Foundation object of type "
            << Sym->getType().getAsString() << " with a ";
+      } else if (CurrV.getObjKind() == RetEffect::OS) {
+        os << " returns an OSObject of type "
+           << Sym->getType().getAsString() << " with a ";
       } else if (CurrV.getObjKind() == RetEffect::Generalized) {
         os << " returns an object of type " << Sym->getType().getAsString()
            << " with a ";
       } else {
         assert (CurrV.getObjKind() == RetEffect::ObjC);
         QualType T = Sym->getType();
         if (!isa<ObjCObjectPointerType>(T)) {
           os << " returns an Objective-C object with a ";

cfe/trunk/lib/StaticAnalyzer/Core/RetainSummaryManager.cpp

if (OldSumm.isSimple()) {
     return &N->getValue();
   }
 
   RetainSummary *Summ = (RetainSummary *) BPAlloc.Allocate<RetainSummary>();
   new (Summ) RetainSummary(OldSumm);
   return Summ;
 }
 
+static bool isOSObjectSubclass(QualType T);
+
+static bool isOSObjectSubclass(const CXXRecordDecl *RD) {
+  if (RD->getDeclName().getAsString() == "OSObject")
+    return true;
+
+  const CXXRecordDecl *RDD = RD->getDefinition();
+  if (!RDD)
+    return false;
+
+  for (const CXXBaseSpecifier Spec : RDD->bases()) {
+    if (isOSObjectSubclass(Spec.getType()))
+      return true;
+  }
+  return false;
+}
+
+/// \return Whether type represents an OSObject successor.
+static bool isOSObjectSubclass(QualType T) {
+  if (const auto *RD = T->getAsCXXRecordDecl()) {
+    return isOSObjectSubclass(RD);
+  }
+  return false;
+}
+
 static bool hasRCAnnotation(const Decl *D, StringRef rcAnnotation) {
   for (const auto *Ann : D->specific_attrs<AnnotateAttr>()) {
     if (Ann->getAnnotation() == rcAnnotation)
       return true;
   }
   return false;
 }
 
if (FName == "pthread_create" || FName == "pthread_setspecific") {
     // Whitelist NSXXInsertXX, for example NSMapInsertIfAbsent, since they can
     // be deallocated by NSMapRemove. (radar://11152419)
     ScratchArgs = AF.add(ScratchArgs, 1, StopTracking);
     ScratchArgs = AF.add(ScratchArgs, 2, StopTracking);
     return getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
   }
 
   if (RetTy->isPointerType()) {
+    if (TrackOSObjects && isOSObjectSubclass(RetTy->getPointeeType())) {
+      if (const IdentifierInfo *II = FD->getIdentifier()) {
+        StringRef FuncName = II->getName();
+        if (FuncName.contains_lower("with")
+            || FuncName.contains_lower("create")
+            || FuncName.contains_lower("copy"))
+          return getOSSummaryCreateRule(FD);
+      }
+      return getOSSummaryGetRule(FD);
+    }
+
     // For CoreFoundation ('CF') types.
     if (cocoa::isRefType(RetTy, "CF", FName)) {
       if (isRetain(FD, FName)) {
         // CFRetain isn't supposed to be annotated. However, this may as well
         // be a user-made "safe" CFRetain function that is incorrectly
         // annotated as cf_returns_retained due to lack of better options.
         // We want to ignore such annotation.
         AllowAnnotations = false;
if (coreFoundation::isCFObjectRef(RetTy)) {
       return getCFCreateGetRuleSummary(FD);
     }
 
     if (FD->hasAttr<CFAuditedTransferAttr>()) {
       return getCFCreateGetRuleSummary(FD);
     }
   }
 
+  if (const auto *MD = dyn_cast<CXXMethodDecl>(FD)) {
+    const CXXRecordDecl *Parent = MD->getParent();
+    if (TrackOSObjects && isOSObjectSubclass(Parent)) {
+      if (isRelease(FD, FName))
+        return getOSSummaryReleaseRule(FD);
+
+      if (isRetain(FD, FName))
+        return getOSSummaryRetainRule(FD);
+    }
+  }
+
   // Check for release functions, the only kind of functions that we care
   // about that don't return a pointer type.
   if (FName.size() >= 2 && FName[0] == 'C' &&
       (FName[1] == 'F' || FName[1] == 'G')) {
     // Test for 'CGCF'.
     FName = FName.substr(FName.startswith("CGCF") ? 4 : 2);
 
     if (isRelease(FD, FName))
else {
                      StrInStrNoCase(FName, "SetAttribute") != StringRef::npos)
                         ? MayEscape
                         : DoNothing;
 
       return getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, E);
     }
   }
 
+  if (const auto *MD = dyn_cast<CXXMethodDecl>(FD)) {
+
+    // Stop tracking arguments passed to C++ methods, as those might be
+    // wrapping smart pointers.
+    return getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, StopTracking,
+                                DoNothing);
+  }
+
   return getDefaultSummary();
 }
 
 const RetainSummary *
 RetainSummaryManager::getFunctionSummary(const FunctionDecl *FD) {
   // If we don't know what function we're calling, use our default summary.
   if (!FD)
     return getDefaultSummary();

 RetainSummaryManager::getSummary(const CallEvent &Call,
                                  QualType ReceiverType) {
   const RetainSummary *Summ;
   switch (Call.getKind()) {
   case CE_Function:
     Summ = getFunctionSummary(cast<SimpleFunctionCall>(Call).getDecl());
     break;
   case CE_CXXMember:
+    Summ = getFunctionSummary(cast<CXXMemberCall>(Call).getDecl());
+    break;
   case CE_CXXMemberOperator:
   case CE_Block:
   case CE_CXXConstructor:
   case CE_CXXDestructor:
   case CE_CXXAllocator:
     // FIXME: These calls are currently unsupported.
     return getPersistentStopSummary();
   case CE_ObjCMessage: {
RetainSummaryManager::getUnarySummary(const FunctionType* FT,
   case cfmakecollectable: Effect = MakeCollectable; break;
   }
 
   ScratchArgs = AF.add(ScratchArgs, 0, Effect);
   return getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
 }
 
 const RetainSummary *
+RetainSummaryManager::getOSSummaryRetainRule(const FunctionDecl *FD) {
+  return getPersistentSummary(RetEffect::MakeNoRet(),
+                              /*ReceiverEff=*/DoNothing,
+                              /*DefaultEff=*/DoNothing,
+                              /*ThisEff=*/IncRef);
+}
+
+const RetainSummary *
+RetainSummaryManager::getOSSummaryReleaseRule(const FunctionDecl *FD) {
+  return getPersistentSummary(RetEffect::MakeNoRet(),
+                              /*ReceiverEff=*/DoNothing,
+                              /*DefaultEff=*/DoNothing,
+                              /*ThisEff=*/DecRef);
+}
+
+const RetainSummary *
+RetainSummaryManager::getOSSummaryCreateRule(const FunctionDecl *FD) {
+  return getPersistentSummary(RetEffect::MakeOwned(RetEffect::OS));
+}
+
+const RetainSummary *
+RetainSummaryManager::getOSSummaryGetRule(const FunctionDecl *FD) {
+  return getPersistentSummary(RetEffect::MakeNotOwned(RetEffect::OS));
+}
+
+const RetainSummary *
 RetainSummaryManager::getCFSummaryCreateRule(const FunctionDecl *FD) {
   assert (ScratchArgs.isEmpty());
 
   return getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF));
 }
 
 const RetainSummary *
 RetainSummaryManager::getCFSummaryGetRule(const FunctionDecl *FD) {
void RetainSummaryManager::InitializeMethodSummaries() {
   addInstMethSummary("CIContext", CFAllocSumm, "createCGImage", "fromRect",
                      "format", "colorSpace");
   addInstMethSummary("CIContext", CFAllocSumm, "createCGLayerWithSize", "info");
 }
 
 CallEffects CallEffects::getEffect(const ObjCMethodDecl *MD) {
   ASTContext &Ctx = MD->getASTContext();
   LangOptions L = Ctx.getLangOpts();
-  RetainSummaryManager M(Ctx, L.ObjCAutoRefCount);
+  RetainSummaryManager M(Ctx, L.ObjCAutoRefCount, /*TrackOSObjects=*/false);
   const RetainSummary *S = M.getMethodSummary(MD);
   CallEffects CE(S->getRetEffect());
   CE.Receiver = S->getReceiverEffect();
   unsigned N = MD->param_size();
   for (unsigned i = 0; i < N; ++i) {
     CE.Args.push_back(S->getArg(i));
   }
   return CE;
 }
 
 CallEffects CallEffects::getEffect(const FunctionDecl *FD) {
   ASTContext &Ctx = FD->getASTContext();
   LangOptions L = Ctx.getLangOpts();
-  RetainSummaryManager M(Ctx, L.ObjCAutoRefCount);
+  RetainSummaryManager M(Ctx, L.ObjCAutoRefCount, /*TrackOSObjects=*/false);
   const RetainSummary *S = M.getFunctionSummary(FD);
   CallEffects CE(S->getRetEffect());
   unsigned N = FD->param_size();
   for (unsigned i = 0; i < N; ++i) {
     CE.Args.push_back(S->getArg(i));
   }
   return CE;
 }

cfe/trunk/test/Analysis/osobject-retain-release.cpp

+// RUN: %clang_analyze_cc1 -analyze -analyzer-checker=core,osx.cocoa.RetainCount -analyzer-config osx.cocoa.RetainCount:CheckOSObject=true -analyzer-output=text -verify %s
+
+struct OSObject {
+  virtual void retain();
+  virtual void release();
+
+  virtual ~OSObject(){}
+};
+
+struct OSArray : public OSObject {
+  unsigned int getCount();
+
+  static OSArray *withCapacity(unsigned int capacity);
+};
+
+void use_after_release() {
+  OSArray *arr = OSArray::withCapacity(10); // expected-note{{Call to function 'withCapacity' returns an OSObject of type struct OSArray * with a +1 retain count}}
+  arr->release(); // expected-note{{Object released}}
+  arr->getCount(); // expected-warning{{Reference-counted object is used after it is released}}
+                   // expected-note@-1{{Reference-counted object is used after it is released}}
+}
+
+void potential_leak() {
+  OSArray *arr = OSArray::withCapacity(10); // expected-note{{Call to function 'withCapacity' returns an OSObject of type struct OSArray * with a +1 retain count}}
+  arr->retain(); // expected-note{{Reference count incremented. The object now has a +2 retain count}}
+  arr->release(); // expected-note{{Reference count decremented. The object now has a +1 retain count}}
+  arr->getCount();
+} // expected-warning{{Potential leak of an object stored into 'arr'}}
+  // expected-note@-1{{Object leaked: object allocated and stored into 'arr' is not referenced later in this execution path and has a retain count of +1}}
+
+void proper_cleanup() {
+  OSArray *arr = OSArray::withCapacity(10); // +1
+  arr->retain(); // +2
+  arr->release(); // +1
+  arr->getCount();
+  arr->release(); // 0
+}
+
+struct ArrayOwner {
+  OSArray *arr;
+
+  OSArray *getArray() {
+    return arr;
+  }
+
+  OSArray *createArray() {
+    return OSArray::withCapacity(10);
+  }
+
+  OSArray *createArraySourceUnknown();
+
+  OSArray *getArraySourceUnknown();
+};
+
+//unsigned int leak_on_create_no_release(ArrayOwner *owner) {
+  //OSArray *myArray = 
+
+//}
+
+unsigned int no_warning_on_getter(ArrayOwner *owner) {
+  OSArray *arr = owner->getArray();
+  return arr->getCount();
+}
+
+unsigned int warn_on_overrelease(ArrayOwner *owner) {
+  OSArray *arr = owner->getArray(); // expected-note{{function call returns an OSObject of type struct OSArray * with a +0 retain count}}
+  arr->release(); // expected-warning{{Incorrect decrement of the reference count of an object that is not owned at this point by the caller}}
+                  // expected-note@-1{{Incorrect decrement of the reference count of an object that is not owned at this point by the caller}}
+  return arr->getCount();
+}
+
+unsigned int nowarn_on_release_of_created(ArrayOwner *owner) {
+  OSArray *arr = owner->createArray();
+  unsigned int out = arr->getCount();
+  arr->release();
+  return out;
+}
+
+unsigned int nowarn_on_release_of_created_source_unknown(ArrayOwner *owner) {
+  OSArray *arr = owner->createArraySourceUnknown();
+  unsigned int out = arr->getCount();
+  arr->release();
+  return out;
+}
+
+unsigned int no_warn_ok_release(ArrayOwner *owner) {
+  OSArray *arr = owner->getArray(); // +0
+  arr->retain(); // +1
+  arr->release(); // +0
+  return arr->getCount(); // no-warning
+}
+
+unsigned int warn_on_overrelease_with_unknown_source(ArrayOwner *owner) {
+  OSArray *arr = owner->getArraySourceUnknown(); // expected-note{{function call returns an OSObject of type struct OSArray * with a +0 retain count}}
+  arr->release(); // expected-warning{{Incorrect decrement of the reference count of an object that is not owned at this point by the caller}}
+                  // expected-note@-1{{Incorrect decrement of the reference count of an object that is not owned at this point by the caller}}
+  return arr->getCount();
+}
+
+unsigned int ok_release_with_unknown_source(ArrayOwner *owner) {
+  OSArray *arr = owner->getArraySourceUnknown(); // +0
+  arr->retain(); // +1
+  arr->release(); // +0
+  return arr->getCount();
+}