[analyzer] [NFC] Split up RetainSummaryManager from RetainCountChecker - try #2

[george.karpenkov]

Summary

Turns out it can't be removed from the analyzer since it relies on CallEvent.

Moving to staticAnalyzer/core

[NoQ]

Ugh. I guess this knot remains to be untangled.

clang/include/clang/Analysis/ObjCRetainCount.h

-//==-- ObjCRetainCount.h - Retain count summaries for Cocoa -------*- C++ -*--//
-//
-//                     The LLVM Compiler Infrastructure
-//
-// This file is distributed under the University of Illinois Open Source
-// License. See LICENSE.TXT for details.
-//
-//===----------------------------------------------------------------------===//
-//
-//  This file defines the core data structures for retain count "summaries"
-//  for Objective-C and Core Foundation APIs.  These summaries are used
-//  by the static analyzer to summarize the retain/release effects of
-//  function and method calls.  This drives a path-sensitive typestate
-//  analysis in the static analyzer, but can also potentially be used by
-//  other clients.
-//
-//===----------------------------------------------------------------------===//
-
-#ifndef LLVM_CLANG_STATICANALYZER_CHECKERS_OBJCRETAINCOUNT_H
-#define LLVM_CLANG_STATICANALYZER_CHECKERS_OBJCRETAINCOUNT_H
-
-#include "clang/Basic/LLVM.h"
-#include "llvm/ADT/ArrayRef.h"
-#include "llvm/ADT/SmallVector.h"
-
-namespace clang {
-class FunctionDecl;
-class ObjCMethodDecl;
-
-namespace ento { namespace objc_retain {
-
-/// An ArgEffect summarizes the retain count behavior on an argument or receiver
-/// to a function or method.
-enum ArgEffect {
-  /// There is no effect.
-  DoNothing,
-
-  /// The argument is treated as if an -autorelease message had been sent to
-  /// the referenced object.
-  Autorelease,
-
-  /// The argument is treated as if an -dealloc message had been sent to
-  /// the referenced object.
-  Dealloc,
-
-  /// The argument has its reference count decreased by 1.  This is as
-  /// if CFRelease has been called on the argument.
-  DecRef,
-
-  /// The argument has its reference count decreased by 1.  This is as
-  /// if a -release message has been sent to the argument.  This differs
-  /// in behavior from DecRef when GC is enabled.
-  DecRefMsg,
-
-  /// The argument has its reference count decreased by 1 to model
-  /// a transferred bridge cast under ARC.
-  DecRefBridgedTransferred,
-
-  /// The argument has its reference count increased by 1.  This is as
-  /// if a -retain message has been sent to the argument.  This differs
-  /// in behavior from IncRef when GC is enabled.
-  IncRefMsg,
-
-  /// The argument has its reference count increased by 1.  This is as
-  /// if CFRetain has been called on the argument.
-  IncRef,
-
-  /// Used to mark an argument as collectible in GC mode, currently a noop.
-  MakeCollectable,
-
-  /// The argument is a pointer to a retain-counted object; on exit, the new
-  /// value of the pointer is a +0 value or NULL.
-  UnretainedOutParameter,
-
-  /// The argument is a pointer to a retain-counted object; on exit, the new
-  /// value of the pointer is a +1 value or NULL.
-  RetainedOutParameter,
-
-  /// The argument is treated as potentially escaping, meaning that
-  /// even when its reference count hits 0 it should be treated as still
-  /// possibly being alive as someone else *may* be holding onto the object.
-  MayEscape,
-
-  /// All typestate tracking of the object ceases.  This is usually employed
-  /// when the effect of the call is completely unknown.
-  StopTracking,
-
-  /// All typestate tracking of the object ceases.  Unlike StopTracking,
-  /// this is also enforced when the method body is inlined.
-  ///
-  /// In some cases, we obtain a better summary for this checker
-  /// by looking at the call site than by inlining the function.
-  /// Signifies that we should stop tracking the symbol even if
-  /// the function is inlined.
-  StopTrackingHard,
-
-  /// Performs the combined functionality of DecRef and StopTrackingHard.
-  ///
-  /// The models the effect that the called function decrements the reference
-  /// count of the argument and all typestate tracking on that argument
-  /// should cease.
-  DecRefAndStopTrackingHard,
-
-  /// Performs the combined functionality of DecRefMsg and StopTrackingHard.
-  ///
-  /// The models the effect that the called function decrements the reference
-  /// count of the argument and all typestate tracking on that argument
-  /// should cease.
-  DecRefMsgAndStopTrackingHard
-};
-
-/// RetEffect summarizes a call's retain/release behavior with respect
-/// to its return value.
-class RetEffect {
-public:
-  enum Kind {
-    /// Indicates that no retain count information is tracked for
-    /// the return value.
-    NoRet,
-    /// Indicates that the returned value is an owned (+1) symbol.
-    OwnedSymbol,
-    /// Indicates that the returned value is an object with retain count
-    /// semantics but that it is not owned (+0).  This is the default
-    /// for getters, etc.
-    NotOwnedSymbol,
-    /// Indicates that the object is not owned and controlled by the
-    /// Garbage collector.
-    GCNotOwnedSymbol,
-    /// Indicates that the return value is an owned object when the
-    /// receiver is also a tracked object.
-    OwnedWhenTrackedReceiver,
-    // Treat this function as returning a non-tracked symbol even if
-    // the function has been inlined. This is used where the call
-    // site summary is more presise than the summary indirectly produced
-    // by inlining the function
-    NoRetHard
-  };
-
-  /// Determines the object kind of a tracked object.
-  enum ObjKind {
-    /// Indicates that the tracked object is a CF object.  This is
-    /// important between GC and non-GC code.
-    CF,
-    /// Indicates that the tracked object is an Objective-C object.
-    ObjC,
-    /// Indicates that the tracked object could be a CF or Objective-C object.
-    AnyObj,
-    /// Indicates that the tracked object is a generalized object.
-    Generalized
-  };
-
-private:
-  Kind K;
-  ObjKind O;
-
-  RetEffect(Kind k, ObjKind o = AnyObj) : K(k), O(o) {}
-
-public:
-  Kind getKind() const { return K; }
-
-  ObjKind getObjKind() const { return O; }
-
-  bool isOwned() const {
-    return K == OwnedSymbol || K == OwnedWhenTrackedReceiver;
-  }
-
-  bool notOwned() const {
-    return K == NotOwnedSymbol;
-  }
-
-  bool operator==(const RetEffect &Other) const {
-    return K == Other.K && O == Other.O;
-  }
-
-  static RetEffect MakeOwnedWhenTrackedReceiver() {
-    return RetEffect(OwnedWhenTrackedReceiver, ObjC);
-  }
-
-  static RetEffect MakeOwned(ObjKind o) {
-    return RetEffect(OwnedSymbol, o);
-  }
-  static RetEffect MakeNotOwned(ObjKind o) {
-    return RetEffect(NotOwnedSymbol, o);
-  }
-  static RetEffect MakeGCNotOwned() {
-    return RetEffect(GCNotOwnedSymbol, ObjC);
-  }
-  static RetEffect MakeNoRet() {
-    return RetEffect(NoRet);
-  }
-  static RetEffect MakeNoRetHard() {
-    return RetEffect(NoRetHard);
-  }
-};
-
-/// Encapsulates the retain count semantics on the arguments, return value,
-/// and receiver (if any) of a function/method call.
-///
-/// Note that construction of these objects is not highly efficient.  That
-/// is okay for clients where creating these objects isn't really a bottleneck.
-/// The purpose of the API is to provide something simple.  The actual
-/// static analyzer checker that implements retain/release typestate
-/// tracking uses something more efficient.
-class CallEffects {
-  llvm::SmallVector<ArgEffect, 10> Args;
-  RetEffect Ret;
-  ArgEffect Receiver;
-
-  CallEffects(const RetEffect &R) : Ret(R) {}
-
-public:
-  /// Returns the argument effects for a call.
-  ArrayRef<ArgEffect> getArgs() const { return Args; }
-
-  /// Returns the effects on the receiver.
-  ArgEffect getReceiver() const { return Receiver; }
-
-  /// Returns the effect on the return value.
-  RetEffect getReturnValue() const { return Ret; }
-
-  /// Return the CallEfect for a given Objective-C method.
-  static CallEffects getEffect(const ObjCMethodDecl *MD);
-
-  /// Return the CallEfect for a given C/C++ function.
-  static CallEffects getEffect(const FunctionDecl *FD);
-};
-
-}}}
-
-#endif
-

clang/include/clang/Analysis/SelectorExtras.h

 //=== SelectorExtras.h - Helpers for checkers using selectors -----*- C++ -*-=//
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 
-#ifndef LLVM_CLANG_LIB_STATICANALYZER_CHECKERS_SELECTOREXTRAS_H
-#define LLVM_CLANG_LIB_STATICANALYZER_CHECKERS_SELECTOREXTRAS_H
+#ifndef LLVM_CLANG_LIB_ANALYSIS_SELECTOREXTRAS_H
+#define LLVM_CLANG_LIB_ANALYSIS_SELECTOREXTRAS_H
 
 #include "clang/AST/ASTContext.h"
 
 namespace clang {
-namespace ento {
 
 template <typename... IdentifierInfos>
 static inline Selector getKeywordSelector(ASTContext &Ctx,
                                           IdentifierInfos *... IIs) {
   static_assert(sizeof...(IdentifierInfos),
                 "keyword selectors must have at least one argument");
   SmallVector<IdentifierInfo *, 10> II({&Ctx.Idents.get(IIs)...});
 
   return Ctx.Selectors.getSelector(II.size(), &II[0]);
 }
 
 template <typename... IdentifierInfos>
 static inline void lazyInitKeywordSelector(Selector &Sel, ASTContext &Ctx,
                                            IdentifierInfos *... IIs) {
   if (!Sel.isNull())
     return;
   Sel = getKeywordSelector(Ctx, IIs...);
 }
 
-static inline void lazyInitNullarySelector(Selector &Sel, ASTContext &Ctx,
-                                           const char *Name) {
-  if (!Sel.isNull())
-    return;
-  Sel = GetNullarySelector(Name, Ctx);
-}
-
-} // end namespace ento
 } // end namespace clang
 
 #endif

clang/include/clang/StaticAnalyzer/Core/RetainSummaryManager.h

-//=== RetainCountSummaries.h - Checks for leaks and other issues -*- C++ -*--//
+//=== RetainSummaryManager.h - Summaries for reference counting ---*- C++ -*--//
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 //
-//  This file defines summaries implementation for RetainCountChecker, which
+//  This file defines summaries implementation for retain counting, which
 //  implements a reference count checker for Core Foundation and Cocoa
 //  on (Mac OS X).
 //
 //===----------------------------------------------------------------------===//
 
-#ifndef LLVM_CLANG_LIB_STATICANALYZER_CHECKERS_RETAINCOUNTCHECKER_SUMMARY_H
-#define LLVM_CLANG_LIB_STATICANALYZER_CHECKERS_RETAINCOUNTCHECKER_SUMMARY_H
+#ifndef LLVM_CLANG_ANALYZER_CORE_RETAINSUMMARYMANAGER
+#define LLVM_CLANG_ANALYZER_CORE_RETAINSUMMARYMANAGER
 
-#include "../ClangSACheckers.h"
-#include "../AllocationDiagnostics.h"
-#include "../SelectorExtras.h"
 #include "llvm/ADT/DenseMap.h"
 #include "llvm/ADT/FoldingSet.h"
-#include "clang/Analysis/ObjCRetainCount.h"
 #include "clang/AST/Attr.h"
 #include "clang/AST/DeclCXX.h"
 #include "clang/AST/DeclObjC.h"
 #include "clang/AST/ParentMap.h"
-#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
-#include "clang/StaticAnalyzer/Core/BugReporter/PathDiagnostic.h"
-#include "clang/StaticAnalyzer/Core/Checker.h"
-#include "clang/StaticAnalyzer/Core/CheckerManager.h"
+#include "clang/Analysis/SelectorExtras.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
-#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
-#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
-#include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h"
-#include "llvm/ADT/ImmutableList.h"
-#include "llvm/ADT/ImmutableMap.h"
 #include "llvm/ADT/STLExtras.h"
 
 //===----------------------------------------------------------------------===//
 // Adapters for FoldingSet.
 //===----------------------------------------------------------------------===//
 
 using namespace clang;
 using namespace ento;
-using namespace objc_retain;
 
 namespace clang {
 namespace ento {
-namespace retaincountchecker {
+
+/// An ArgEffect summarizes the retain count behavior on an argument or receiver
+/// to a function or method.
+enum ArgEffect {
+  /// There is no effect.
+  DoNothing,
+
+  /// The argument is treated as if an -autorelease message had been sent to
+  /// the referenced object.
+  Autorelease,
+
+  /// The argument is treated as if an -dealloc message had been sent to
+  /// the referenced object.
+  Dealloc,
+
+  /// The argument has its reference count decreased by 1.  This is as
+  /// if CFRelease has been called on the argument.
+  DecRef,
+
+  /// The argument has its reference count decreased by 1.  This is as
+  /// if a -release message has been sent to the argument.  This differs
+  /// in behavior from DecRef when GC is enabled.
+  DecRefMsg,
+
+  /// The argument has its reference count decreased by 1 to model
+  /// a transferred bridge cast under ARC.
+  DecRefBridgedTransferred,
+
+  /// The argument has its reference count increased by 1.  This is as
+  /// if a -retain message has been sent to the argument.  This differs
+  /// in behavior from IncRef when GC is enabled.
+  IncRefMsg,
+
+  /// The argument has its reference count increased by 1.  This is as
+  /// if CFRetain has been called on the argument.
+  IncRef,
+
+  /// The argument acts as if has been passed to CFMakeCollectable, which
+  /// transfers the object to the Garbage Collector under GC.
+  MakeCollectable,
+
+  /// The argument is a pointer to a retain-counted object; on exit, the new
+  /// value of the pointer is a +0 value or NULL.
+  UnretainedOutParameter,
+
+  /// The argument is a pointer to a retain-counted object; on exit, the new
+  /// value of the pointer is a +1 value or NULL.
+  RetainedOutParameter,
+
+  /// The argument is treated as potentially escaping, meaning that
+  /// even when its reference count hits 0 it should be treated as still
+  /// possibly being alive as someone else *may* be holding onto the object.
+  MayEscape,
+
+  /// All typestate tracking of the object ceases.  This is usually employed
+  /// when the effect of the call is completely unknown.
+  StopTracking,
+
+  /// All typestate tracking of the object ceases.  Unlike StopTracking,
+  /// this is also enforced when the method body is inlined.
+  ///
+  /// In some cases, we obtain a better summary for this checker
+  /// by looking at the call site than by inlining the function.
+  /// Signifies that we should stop tracking the symbol even if
+  /// the function is inlined.
+  StopTrackingHard,
+
+  /// Performs the combined functionality of DecRef and StopTrackingHard.
+  ///
+  /// The models the effect that the called function decrements the reference
+  /// count of the argument and all typestate tracking on that argument
+  /// should cease.
+  DecRefAndStopTrackingHard,
+
+  /// Performs the combined functionality of DecRefMsg and StopTrackingHard.
+  ///
+  /// The models the effect that the called function decrements the reference
+  /// count of the argument and all typestate tracking on that argument
+  /// should cease.
+  DecRefMsgAndStopTrackingHard
+};
+
+/// RetEffect summarizes a call's retain/release behavior with respect
+/// to its return value.
+class RetEffect {
+public:
+  enum Kind {
+    /// Indicates that no retain count information is tracked for
+    /// the return value.
+    NoRet,
+    /// Indicates that the returned value is an owned (+1) symbol.
+    OwnedSymbol,
+    /// Indicates that the returned value is an object with retain count
+    /// semantics but that it is not owned (+0).  This is the default
+    /// for getters, etc.
+    NotOwnedSymbol,
+    /// Indicates that the object is not owned and controlled by the
+    /// Garbage collector.
+    GCNotOwnedSymbol,
+    /// Indicates that the return value is an owned object when the
+    /// receiver is also a tracked object.
+    OwnedWhenTrackedReceiver,
+    // Treat this function as returning a non-tracked symbol even if
+    // the function has been inlined. This is used where the call
+    // site summary is more presise than the summary indirectly produced
+    // by inlining the function
+    NoRetHard
+  };
+
+  /// Determines the object kind of a tracked object.
+  enum ObjKind {
+    /// Indicates that the tracked object is a CF object.  This is
+    /// important between GC and non-GC code.
+    CF,
+    /// Indicates that the tracked object is an Objective-C object.
+    ObjC,
+    /// Indicates that the tracked object could be a CF or Objective-C object.
+    AnyObj,
+    /// Indicates that the tracked object is a generalized object.
+    Generalized
+  };
+
+private:
+  Kind K;
+  ObjKind O;
+
+  RetEffect(Kind k, ObjKind o = AnyObj) : K(k), O(o) {}
+
+public:
+  Kind getKind() const { return K; }
+
+  ObjKind getObjKind() const { return O; }
+
+  bool isOwned() const {
+    return K == OwnedSymbol || K == OwnedWhenTrackedReceiver;
+  }
+
+  bool notOwned() const {
+    return K == NotOwnedSymbol;
+  }
+
+  bool operator==(const RetEffect &Other) const {
+    return K == Other.K && O == Other.O;
+  }
+
+  static RetEffect MakeOwnedWhenTrackedReceiver() {
+    return RetEffect(OwnedWhenTrackedReceiver, ObjC);
+  }
+
+  static RetEffect MakeOwned(ObjKind o) {
+    return RetEffect(OwnedSymbol, o);
+  }
+  static RetEffect MakeNotOwned(ObjKind o) {
+    return RetEffect(NotOwnedSymbol, o);
+  }
+  static RetEffect MakeGCNotOwned() {
+    return RetEffect(GCNotOwnedSymbol, ObjC);
+  }
+  static RetEffect MakeNoRet() {
+    return RetEffect(NoRet);
+  }
+  static RetEffect MakeNoRetHard() {
+    return RetEffect(NoRetHard);
+  }
+};
+
+/// Encapsulates the retain count semantics on the arguments, return value,
+/// and receiver (if any) of a function/method call.
+///
+/// Note that construction of these objects is not highly efficient.  That
+/// is okay for clients where creating these objects isn't really a bottleneck.
+/// The purpose of the API is to provide something simple.  The actual
+/// static analyzer checker that implements retain/release typestate
+/// tracking uses something more efficient.
+class CallEffects {
+  llvm::SmallVector<ArgEffect, 10> Args;
+  RetEffect Ret;
+  ArgEffect Receiver;
+
+  CallEffects(const RetEffect &R) : Ret(R) {}
+
+public:
+  /// Returns the argument effects for a call.
+  ArrayRef<ArgEffect> getArgs() const { return Args; }
+
+  /// Returns the effects on the receiver.
+  ArgEffect getReceiver() const { return Receiver; }
+
+  /// Returns the effect on the return value.
+  RetEffect getReturnValue() const { return Ret; }
+
+  /// Return the CallEfect for a given Objective-C method.
+  static CallEffects getEffect(const ObjCMethodDecl *MD);
+
+  /// Return the CallEfect for a given C/C++ function.
+  static CallEffects getEffect(const FunctionDecl *FD);
+};
 
 /// A key identifying a summary.
 class ObjCSummaryKey {
   IdentifierInfo* II;
   Selector S;
 public:
   ObjCSummaryKey(IdentifierInfo* ii, Selector s)
     : II(ii), S(s) {}
 
   ObjCSummaryKey(const ObjCInterfaceDecl *d, Selector s)
     : II(d ? d->getIdentifier() : nullptr), S(s) {}
 
   ObjCSummaryKey(Selector s)
     : II(nullptr), S(s) {}
 
   IdentifierInfo *getIdentifier() const { return II; }
   Selector getSelector() const { return S; }
 };
 
-} // end namespace retaincountchecker
 } // end namespace ento
 } // end namespace clang
 
+
 namespace llvm {
-using namespace retaincountchecker;
 
 template <> struct FoldingSetTrait<ArgEffect> {
 static inline void Profile(const ArgEffect X, FoldingSetNodeID &ID) {
   ID.AddInteger((unsigned) X);
 }
 };
 template <> struct FoldingSetTrait<RetEffect> {
   static inline void Profile(const RetEffect &X, FoldingSetNodeID &ID) {

 
 };
 
 } // end llvm namespace
 
 
 namespace clang {
 namespace ento {
-namespace retaincountchecker {
 
 /// ArgEffects summarizes the effects of a function/method call on all of
 /// its arguments.
 typedef llvm::ImmutableMap<unsigned, ArgEffect> ArgEffects;
 
 /// Summary for a function with respect to ownership changes.
 class RetainSummary {
   /// Args - a map of (index, ArgEffect) pairs, where index
void Profile(llvm::FoldingSetNodeID& ID) const {
     ID.Add(Ret);
   }
 
   /// A retain summary is simple if it has no ArgEffects other than the default.
   bool isSimple() const {
     return Args.isEmpty();
   }
 
-private:
   ArgEffects getArgEffects() const { return Args; }
+
+private:
   ArgEffect getDefaultArgEffect() const { return DefaultArgEffect; }
 
   friend class RetainSummaryManager;
-  friend class RetainCountChecker;
 };
 
 class ObjCSummaryCache {
   typedef llvm::DenseMap<ObjCSummaryKey, const RetainSummary *> MapTy;
   MapTy M;
 public:
   ObjCSummaryCache() {}
 
class RetainSummaryManager {
   }
 
   template <typename... Keywords>
   void addClsMethSummary(IdentifierInfo *II, const RetainSummary *Summ,
                          Keywords *... Kws) {
     addMethodSummary(II, ObjCClassMethodSummaries, Summ, Kws...);
   }
 
+  const RetainSummary * generateSummary(const FunctionDecl *FD,
+                                        bool &AllowAnnotations);
+
 public:
   RetainSummaryManager(ASTContext &ctx, bool usesARC)
    : Ctx(ctx),
      ARCEnabled(usesARC),
      AF(BPAlloc), ScratchArgs(AF.getEmptyMap()),
      ObjCAllocRetE(usesARC ? RetEffect::MakeNotOwned(RetEffect::ObjC)
                                : RetEffect::MakeOwned(RetEffect::ObjC)),
      ObjCInitRetE(usesARC ? RetEffect::MakeNotOwned(RetEffect::ObjC)
                                : RetEffect::MakeOwnedWhenTrackedReceiver()) {
     InitializeClassMethodSummaries();
     InitializeMethodSummaries();
   }
 
   bool canEval(const CallExpr *CE,
                const FunctionDecl *FD,
                bool &hasTrustedImplementationAnnotation);
 
   bool isTrustedReferenceCountImplementation(const FunctionDecl *FD);
 
   const RetainSummary *getSummary(const CallEvent &Call,
-                                  ProgramStateRef State = nullptr);
+                                  QualType ReceiverType=QualType());
 
   const RetainSummary *getFunctionSummary(const FunctionDecl *FD);
 
   const RetainSummary *getMethodSummary(Selector S, const ObjCInterfaceDecl *ID,
                                         const ObjCMethodDecl *MD,
                                         QualType RetTy,
                                         ObjCMethodSummariesTy &CachedSummaries);
 
-  const RetainSummary *getInstanceMethodSummary(const ObjCMethodCall &M,
-                                                ProgramStateRef State);
+  const RetainSummary *
+  getInstanceMethodSummary(const ObjCMethodCall &M,
+                           QualType ReceiverType);
 
   const RetainSummary *getClassMethodSummary(const ObjCMethodCall &M) {
     assert(!M.isInstanceMessage());
     const ObjCInterfaceDecl *Class = M.getReceiverInterface();
 
     return getMethodSummary(M.getSelector(), Class, M.getDecl(),
                             M.getResultType(), ObjCClassMethodSummaries);
   }
public:
 
   void updateSummaryForCall(const RetainSummary *&Summ,
                             const CallEvent &Call);
 
   bool isARCEnabled() const { return ARCEnabled; }
 
   RetEffect getObjAllocRetEffect() const { return ObjCAllocRetE; }
 
-private:
-  const RetainSummary * generateSummary(const FunctionDecl *FD,
-                                        bool &AllowAnnotations);
-
   friend class RetainSummaryTemplate;
 };
 
 // Used to avoid allocating long-term (BPAlloc'd) memory for default retain
 // summaries. If a function or method looks like it has a default summary, but
 // it has annotations, the annotations are added to the stack-based template
 // and then copied into managed memory.
 class RetainSummaryTemplate {
public:
   }
 
   RetainSummary *operator->() {
     Accessed = true;
     return &ScratchSummary;
   }
 };
 
-} // end namespace retaincountchecker
 } // end namespace ento
 } // end namespace clang
 
 #endif

clang/lib/ARCMigrate/ObjCMT.cpp

 //===--- ObjCMT.cpp - ObjC Migrate Tool -----------------------------------===//
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 
 #include "Transforms.h"
-#include "clang/Analysis/ObjCRetainCount.h"
 #include "clang/ARCMigrate/ARCMT.h"
 #include "clang/ARCMigrate/ARCMTActions.h"
 #include "clang/AST/ASTConsumer.h"
 #include "clang/AST/ASTContext.h"
 #include "clang/AST/Attr.h"
 #include "clang/AST/NSAPI.h"
 #include "clang/AST/ParentMap.h"
 #include "clang/AST/RecursiveASTVisitor.h"
 #include "clang/Analysis/DomainSpecific/CocoaConventions.h"
 #include "clang/Basic/FileManager.h"
 #include "clang/Edit/Commit.h"
 #include "clang/Edit/EditedSource.h"
 #include "clang/Edit/EditsReceiver.h"
 #include "clang/Edit/Rewriters.h"
 #include "clang/Frontend/CompilerInstance.h"
 #include "clang/Frontend/MultiplexConsumer.h"
 #include "clang/Lex/PPConditionalDirectiveRecord.h"
 #include "clang/Lex/Preprocessor.h"
 #include "clang/Rewrite/Core/Rewriter.h"
+#include "clang/StaticAnalyzer/Core/RetainSummaryManager.h"
 #include "llvm/ADT/SmallString.h"
 #include "llvm/ADT/StringSet.h"
 #include "llvm/Support/Path.h"
 #include "llvm/Support/SourceMgr.h"
 #include "llvm/Support/YAMLParser.h"
 
 using namespace clang;
 using namespace arcmt;
-using namespace ento::objc_retain;
+using namespace ento;
 
 namespace {
 
 class ObjCMigrateASTConsumer : public ASTConsumer {
   enum CF_BRIDGING_KIND {
     CF_BRIDGING_NONE,
     CF_BRIDGING_ENABLE,
     CF_BRIDGING_MAY_INCLUDE

clang/lib/StaticAnalyzer/Checkers/BasicObjCFoundationChecks.cpp

 //== BasicObjCFoundationChecks.cpp - Simple Apple-Foundation checks -*- C++ -*--
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 //
 //  This file defines BasicObjCFoundationChecks, a class that encapsulates
 //  a set of simple checks to run on Objective-C code using Apple's Foundation
 //  classes.
 //
 //===----------------------------------------------------------------------===//
 
 #include "ClangSACheckers.h"
-#include "SelectorExtras.h"
 #include "clang/AST/ASTContext.h"
 #include "clang/AST/DeclObjC.h"
 #include "clang/AST/Expr.h"
 #include "clang/AST/ExprObjC.h"
 #include "clang/AST/StmtObjC.h"
 #include "clang/Analysis/DomainSpecific/CocoaConventions.h"
+#include "clang/Analysis/SelectorExtras.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
 #include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ExplodedGraph.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h"

clang/lib/StaticAnalyzer/Checkers/CMakeLists.txt

add_clang_library(clangStaticAnalyzerCheckers
   ObjCSelfInitChecker.cpp
   ObjCSuperDeallocChecker.cpp
   ObjCUnusedIVarsChecker.cpp
   PaddingChecker.cpp
   PointerArithChecker.cpp
   PointerSubChecker.cpp
   PthreadLockChecker.cpp
   RetainCountChecker/RetainCountChecker.cpp
-  RetainCountChecker/RetainCountSummaries.cpp
   RetainCountChecker/RetainCountDiagnostics.cpp
   ReturnPointerRangeChecker.cpp
   ReturnUndefChecker.cpp
   RunLoopAutoreleaseLeakChecker.cpp
   SimpleStreamChecker.cpp
   StackAddrEscapeChecker.cpp
   StdLibraryFunctionsChecker.cpp
   StreamChecker.cpp
add_clang_library(clangStaticAnalyzerCheckers
   UninitializedObject/UninitializedPointee.cpp
   UnixAPIChecker.cpp
   UnreachableCodeChecker.cpp
   VforkChecker.cpp
   VLASizeChecker.cpp
   ValistChecker.cpp
   VirtualCallChecker.cpp
 
-  DEPENDS
-  ClangSACheckers
-
   LINK_LIBS
   clangAST
   clangASTMatchers
   clangAnalysis
   clangBasic
   clangLex
   clangStaticAnalyzerCore
   )

clang/lib/StaticAnalyzer/Checkers/NoReturnFunctionChecker.cpp

 //=== NoReturnFunctionChecker.cpp -------------------------------*- C++ -*-===//
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 //
 // This defines NoReturnFunctionChecker, which evaluates functions that do not
 // return to the caller.
 //
 //===----------------------------------------------------------------------===//
 
 #include "ClangSACheckers.h"
-#include "SelectorExtras.h"
 #include "clang/AST/Attr.h"
+#include "clang/Analysis/SelectorExtras.h"
 #include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "llvm/ADT/StringSwitch.h"
 #include <cstdarg>
 
 using namespace clang;

clang/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountChecker.h

 //
 //===----------------------------------------------------------------------===//
 
 #ifndef LLVM_CLANG_LIB_STATICANALYZER_CHECKERS_RETAINCOUNTCHECKER_H
 #define LLVM_CLANG_LIB_STATICANALYZER_CHECKERS_RETAINCOUNTCHECKER_H
 
 #include "../ClangSACheckers.h"
 #include "../AllocationDiagnostics.h"
-#include "../SelectorExtras.h"
-#include "RetainCountSummaries.h"
 #include "RetainCountDiagnostics.h"
-#include "clang/Analysis/ObjCRetainCount.h"
 #include "clang/AST/Attr.h"
 #include "clang/AST/DeclCXX.h"
 #include "clang/AST/DeclObjC.h"
 #include "clang/AST/ParentMap.h"
 #include "clang/Analysis/DomainSpecific/CocoaConventions.h"
 #include "clang/Basic/LangOptions.h"
 #include "clang/Basic/SourceManager.h"
+#include "clang/Analysis/SelectorExtras.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/PathDiagnostic.h"
 #include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h"
+#include "clang/StaticAnalyzer/Core/RetainSummaryManager.h"
 #include "llvm/ADT/DenseMap.h"
 #include "llvm/ADT/FoldingSet.h"
 #include "llvm/ADT/ImmutableList.h"
 #include "llvm/ADT/ImmutableMap.h"
 #include "llvm/ADT/STLExtras.h"
 #include "llvm/ADT/SmallString.h"
 #include "llvm/ADT/StringExtras.h"
 #include <cstdarg>
 #include <utility>
 
-using namespace objc_retain;
 using llvm::StrInStrNoCase;
 
 namespace clang {
 namespace ento {
 namespace retaincountchecker {
 
 /// Metadata on reference.
 class RefVal {

clang/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountChecker.cpp

 //  a reference count checker for Core Foundation and Cocoa on (Mac OS X).
 //
 //===----------------------------------------------------------------------===//
 
 #include "RetainCountChecker.h"
 
 using namespace clang;
 using namespace ento;
-using namespace objc_retain;
 using namespace retaincountchecker;
 using llvm::StrInStrNoCase;
 
 REGISTER_MAP_WITH_PROGRAMSTATE(RefBindings, SymbolRef, RefVal)
 
 namespace clang {
 namespace ento {
 namespace retaincountchecker {
void RetainCountChecker::checkPostStmt(const ObjCIvarRefExpr *IRE,
 
   State = setRefBinding(State, Sym, PlusZero.withIvarAccess());
   C.addTransition(State);
 }
 
 void RetainCountChecker::checkPostCall(const CallEvent &Call,
                                        CheckerContext &C) const {
   RetainSummaryManager &Summaries = getSummaryManager(C);
-  const RetainSummary *Summ = Summaries.getSummary(Call, C.getState());
+
+  // Leave null if no receiver.
+  QualType ReceiverType;
+  if (const auto *MC = dyn_cast<ObjCMethodCall>(&Call)) {
+    if (MC->isInstanceMessage()) {
+      SVal ReceiverV = MC->getReceiverSVal();
+      if (SymbolRef Sym = ReceiverV.getAsLocSymbol())
+        if (const RefVal *T = getRefBinding(C.getState(), Sym))
+          ReceiverType = T->getType();
+    }
+  }
+
+  const RetainSummary *Summ = Summaries.getSummary(Call, ReceiverType);
 
   if (C.wasInlined) {
     processSummaryOfInlined(*Summ, Call, C);
     return;
   }
   checkSummary(*Summ, Call, C);
 }
 
void RetainCountChecker::printState(raw_ostream &Out, ProgramStateRef State,
   for (RefBindingsTy::iterator I = B.begin(), E = B.end(); I != E; ++I) {
     Out << I->first << " : ";
     I->second.print(Out);
     Out << NL;
   }
 }
 
 //===----------------------------------------------------------------------===//
-// Implementation of the CallEffects API.
-//===----------------------------------------------------------------------===//
-
-namespace clang {
-namespace ento {
-namespace objc_retain {
-
-// This is a bit gross, but it allows us to populate CallEffects without
-// creating a bunch of accessors.  This kind is very localized, so the
-// damage of this macro is limited.
-#define createCallEffect(D, KIND)\
-  ASTContext &Ctx = D->getASTContext();\
-  LangOptions L = Ctx.getLangOpts();\
-  RetainSummaryManager M(Ctx, L.ObjCAutoRefCount);\
-  const RetainSummary *S = M.get ## KIND ## Summary(D);\
-  CallEffects CE(S->getRetEffect());\
-  CE.Receiver = S->getReceiverEffect();\
-  unsigned N = D->param_size();\
-  for (unsigned i = 0; i < N; ++i) {\
-    CE.Args.push_back(S->getArg(i));\
-  }
-
-CallEffects CallEffects::getEffect(const ObjCMethodDecl *MD) {
-  createCallEffect(MD, Method);
-  return CE;
-}
-
-CallEffects CallEffects::getEffect(const FunctionDecl *FD) {
-  createCallEffect(FD, Function);
-  return CE;
-}
-
-#undef createCallEffect
-
-} // end namespace objc_retain
-} // end namespace ento
-} // end namespace clang
-
-//===----------------------------------------------------------------------===//
 // Checker registration.
 //===----------------------------------------------------------------------===//
 
 void ento::registerRetainCountChecker(CheckerManager &Mgr) {
   Mgr.registerChecker<RetainCountChecker>(Mgr.getAnalyzerOptions());
 }

clang/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountDiagnostics.h

 //  This file defines diagnostics for RetainCountChecker, which implements
 //  a reference count checker for Core Foundation and Cocoa on (Mac OS X).
 //
 //===----------------------------------------------------------------------===//
 
 #ifndef LLVM_CLANG_LIB_STATICANALYZER_CHECKERS_RETAINCOUNTCHECKER_DIAGNOSTICS_H
 #define LLVM_CLANG_LIB_STATICANALYZER_CHECKERS_RETAINCOUNTCHECKER_DIAGNOSTICS_H
 
-#include "RetainCountSummaries.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporterVisitors.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/PathDiagnostic.h"
+#include "clang/StaticAnalyzer/Core/RetainSummaryManager.h"
 
 namespace clang {
 namespace ento {
 namespace retaincountchecker {
 
 class CFRefBug : public BugType {
 protected:
   CFRefBug(const CheckerBase *checker, StringRef name)

clang/lib/StaticAnalyzer/Checkers/TrustNonnullChecker.cpp

 // 2. NSDictionary key is non-null after the keyword subscript operation
 // on read if and only if the resulting expression is non-null.
 //
 // 3. NSMutableDictionary index is non-null after a write operation.
 //
 //===----------------------------------------------------------------------===//
 
 #include "ClangSACheckers.h"
-#include "SelectorExtras.h"
+#include "clang/Analysis/SelectorExtras.h"
 #include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerHelpers.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
 
 using namespace clang;
 using namespace ento;

clang/lib/StaticAnalyzer/Core/CMakeLists.txt

add_clang_library(clangStaticAnalyzerCore
   LoopWidening.cpp
   MemRegion.cpp
   PathDiagnostic.cpp
   PlistDiagnostics.cpp
   ProgramState.cpp
   RangeConstraintManager.cpp
   RangedConstraintManager.cpp
   RegionStore.cpp
+  RetainSummaryManager.cpp
   SValBuilder.cpp
   SVals.cpp
   SimpleConstraintManager.cpp
   SimpleSValBuilder.cpp
   SMTConstraintManager.cpp
   Store.cpp
   SubEngine.cpp
   SymbolManager.cpp

clang/lib/StaticAnalyzer/Core/RetainSummaryManager.cpp

-//== RetainCountSummaries.cpp - Checks for leaks and other issues -*- C++ -*--//
+//== RetainSummaryManager.cpp - Summaries for reference counting --*- C++ -*--//
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 //
-//  This file defines summaries implementation for RetainCountChecker, which
+//  This file defines summaries implementation for retain counting, which
 //  implements a reference count checker for Core Foundation and Cocoa
 //  on (Mac OS X).
 //
 //===----------------------------------------------------------------------===//
 
-#include "RetainCountSummaries.h"
-#include "RetainCountChecker.h"
-
+#include "clang/StaticAnalyzer/Core/RetainSummaryManager.h"
 #include "clang/Analysis/DomainSpecific/CocoaConventions.h"
 #include "clang/AST/Attr.h"
 #include "clang/AST/DeclCXX.h"
 #include "clang/AST/DeclObjC.h"
 #include "clang/AST/ParentMap.h"
 
-using namespace objc_retain;
 using namespace clang;
 using namespace ento;
-using namespace retaincountchecker;
 
 ArgEffects RetainSummaryManager::getArgEffects() {
   ArgEffects AE = ScratchArgs;
   ScratchArgs = AF.getEmptyMap();
   return AE;
 }
 
 const RetainSummary *
if (MC->getMethodFamily() == OMF_init && MC->isReceiverSelfOrSuper()) {
         ModifiableSummaryTemplate->setRetEffect(RetEffect::MakeNoRet());
       }
     }
   }
 }
 
 const RetainSummary *
 RetainSummaryManager::getSummary(const CallEvent &Call,
-                                 ProgramStateRef State) {
+                                 QualType ReceiverType) {
   const RetainSummary *Summ;
   switch (Call.getKind()) {
   case CE_Function:
     Summ = getFunctionSummary(cast<SimpleFunctionCall>(Call).getDecl());
     break;
   case CE_CXXMember:
   case CE_CXXMemberOperator:
   case CE_Block:
   case CE_CXXConstructor:
   case CE_CXXDestructor:
   case CE_CXXAllocator:
     // FIXME: These calls are currently unsupported.
     return getPersistentStopSummary();
   case CE_ObjCMessage: {
     const ObjCMethodCall &Msg = cast<ObjCMethodCall>(Call);
     if (Msg.isInstanceMessage())
-      Summ = getInstanceMethodSummary(Msg, State);
+      Summ = getInstanceMethodSummary(Msg, ReceiverType);
     else
       Summ = getClassMethodSummary(Msg);
     break;
   }
   }
 
   updateSummaryForCall(Summ, Call);
 
RetainSummaryManager::getStandardMethodSummary(const ObjCMethodDecl *MD,
 
   if (ScratchArgs.isEmpty() && ReceiverEff == DoNothing &&
       ResultEff.getKind() == RetEffect::NoRet)
     return getDefaultSummary();
 
   return getPersistentSummary(ResultEff, ReceiverEff, MayEscape);
 }
 
-const RetainSummary *
-RetainSummaryManager::getInstanceMethodSummary(const ObjCMethodCall &Msg,
-                                               ProgramStateRef State) {
+const RetainSummary *RetainSummaryManager::getInstanceMethodSummary(
+    const ObjCMethodCall &Msg, QualType ReceiverType) {
   const ObjCInterfaceDecl *ReceiverClass = nullptr;
 
   // We do better tracking of the type of the object than the core ExprEngine.
   // See if we have its type in our private state.
-  // FIXME: Eventually replace the use of state->get<RefBindings> with
-  // a generic API for reasoning about the Objective-C types of symbolic
-  // objects.
-  SVal ReceiverV = Msg.getReceiverSVal();
-  if (SymbolRef Sym = ReceiverV.getAsLocSymbol())
-    if (const RefVal *T = getRefBinding(State, Sym))
-      if (const ObjCObjectPointerType *PT =
-            T->getType()->getAs<ObjCObjectPointerType>())
-        ReceiverClass = PT->getInterfaceDecl();
+  if (!ReceiverType.isNull())
+    if (const auto *PT = ReceiverType->getAs<ObjCObjectPointerType>())
 
   // If we don't know what kind of object this is, fall back to its static type.
   if (!ReceiverClass)
     ReceiverClass = Msg.getReceiverInterface();
 
   // FIXME: The receiver could be a reference to a class, meaning that
   //  we should use the class method.
   // id x = [NSObject class];
void RetainSummaryManager::InitializeMethodSummaries() {
   // Create summaries for CIContext, 'createCGImage' and
   // 'createCGLayerWithSize'.  These objects are CF objects, and are not
   // automatically garbage collected.
   addInstMethSummary("CIContext", CFAllocSumm, "createCGImage", "fromRect");
   addInstMethSummary("CIContext", CFAllocSumm, "createCGImage", "fromRect",
                      "format", "colorSpace");
   addInstMethSummary("CIContext", CFAllocSumm, "createCGLayerWithSize", "info");
 }
+
+CallEffects CallEffects::getEffect(const ObjCMethodDecl *MD) {
+  ASTContext &Ctx = MD->getASTContext();
+  LangOptions L = Ctx.getLangOpts();
+  RetainSummaryManager M(Ctx, L.ObjCAutoRefCount);
+  const RetainSummary *S = M.getMethodSummary(MD);
+  CallEffects CE(S->getRetEffect());
+  CE.Receiver = S->getReceiverEffect();
+  unsigned N = MD->param_size();
+  for (unsigned i = 0; i < N; ++i) {
+    CE.Args.push_back(S->getArg(i));
+  }
+  return CE;
+}
+
+CallEffects CallEffects::getEffect(const FunctionDecl *FD) {
+  ASTContext &Ctx = FD->getASTContext();
+  LangOptions L = Ctx.getLangOpts();
+  RetainSummaryManager M(Ctx, L.ObjCAutoRefCount);
+  const RetainSummary *S = M.getFunctionSummary(FD);
+  CallEffects CE(S->getRetEffect());
+  unsigned N = FD->param_size();
+  for (unsigned i = 0; i < N; ++i) {
+    CE.Args.push_back(S->getArg(i));
+  }
+  return CE;
+}