[analyzer] [RetainCountChecker] Introduce optional tracking of unannotated retain out parameters, behind a flag

[NoQ]

Looks reasonable :)

clang/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountChecker.h

263–265

Why not simply make it a field? I.e., why do we need a unique_ptr / heap allocation here? Do we need to transfer ownership?

clang/lib/StaticAnalyzer/Core/RetainSummaryManager.cpp

191

I think you should try QT->getPointeeCXXRecordDecl().

253

You mean something like "inverted"? I.e., flipped rather than un-done?

294

I think it's not a great place for auto.

clang/include/clang/StaticAnalyzer/Core/RetainSummaryManager.h

public:
   RetainSummary(ArgEffects A,
                 RetEffect R,
                 ArgEffect defaultEff,
                 ArgEffect ReceiverEff,
                 ArgEffect ThisEff)
     : Args(A), DefaultArgEffect(defaultEff), Receiver(ReceiverEff),
       This(ThisEff), Ret(R) {}
 
+  RetainSummary(ArgEffects::Factory &AF) : Args(AF.getEmptyMap()),
+                                           Ret(RetEffect::MakeNoRet()){};
+
   /// getArg - Return the argument effect on the argument specified by
   ///  idx (starting from 0).
   ArgEffect getArg(unsigned idx) const {
     if (const ArgEffect *AE = Args.lookup(idx))
       return *AE;
 
     return DefaultArgEffect;
   }
class RetainSummaryManager {
 
   /// Ctx - The ASTContext object for the analyzed ASTs.
   ASTContext &Ctx;
 
   /// Records whether or not the analyzed code runs in ARC mode.
   const bool ARCEnabled;
 
   /// Track Objective-C and CoreFoundation objects.
-  const bool TrackObjCAndCFObjects;
+  bool TrackObjCAndCFObjects = false;
 
   /// Track sublcasses of OSObject.
-  const bool TrackOSObjects;
+  bool TrackOSObjects = false;
+
+  /// Track out parameters returning OSObjects even when they don't
+  /// have annotations.
+  bool TrackUnannotatedOSOutParameters = false;
 
   /// FuncSummaries - A map from FunctionDecls to summaries.
   FuncSummariesTy FuncSummaries;
 
   /// ObjCClassMethodSummaries - A map from selectors (for instance methods)
   ///  to summaries.
   ObjCMethodSummariesTy ObjCClassMethodSummaries;
 
class RetainSummaryManager {
   /// Apply the annotation of {@code pd} in function {@code FD}
   /// to the resulting summary stored in out-parameter {@code Template}.
   /// \return whether an annotation was applied.
   bool applyParamAnnotationEffect(const ParmVarDecl *pd, unsigned parm_idx,
                                   const NamedDecl *FD,
                                   RetainSummaryTemplate &Template);
 
 public:
-  RetainSummaryManager(ASTContext &ctx,
-                       bool usesARC,
-                       bool trackObjCAndCFObjects,
-                       bool trackOSObjects)
-   : Ctx(ctx),
-     ARCEnabled(usesARC),
-     TrackObjCAndCFObjects(trackObjCAndCFObjects),
-     TrackOSObjects(trackOSObjects),
+  RetainSummaryManager(ASTContext &ctx)
+      : Ctx(ctx), ARCEnabled((bool)ctx.getLangOpts().ObjCAutoRefCount),
         AF(BPAlloc),
-     ObjCAllocRetE(usesARC ? RetEffect::MakeNotOwned(ObjKind::ObjC)
+        ObjCAllocRetE(ARCEnabled ? RetEffect::MakeNotOwned(ObjKind::ObjC)
                                  : RetEffect::MakeOwned(ObjKind::ObjC)),
-     ObjCInitRetE(usesARC ? RetEffect::MakeNotOwned(ObjKind::ObjC)
+        ObjCInitRetE(ARCEnabled ? RetEffect::MakeNotOwned(ObjKind::ObjC)
                                 : RetEffect::MakeOwnedWhenTrackedReceiver()) {
     InitializeClassMethodSummaries();
     InitializeMethodSummaries();
   }
 
+  void setTrackObjCAndCFObjects() {
+    TrackObjCAndCFObjects = true;
+  }
+
+  void setTrackOSObjects() {
+    TrackOSObjects = true;
+  }
+
+  void setTrackUnannotatedOSOutParameters() {
+    TrackUnannotatedOSOutParameters = true;
+  }
+
   enum class BehaviorSummary {
     // Function does not return.
     NoOp,
 
     // Function returns the first argument.
     Identity,
 
     // Function either returns zero, or the input parameter.

clang/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountChecker.h

: public Checker< check::Bind,
                     check::RegionChanges,
                     eval::Assume,
                     eval::Call > {
   mutable std::unique_ptr<RefCountBug> useAfterRelease, releaseNotOwned;
   mutable std::unique_ptr<RefCountBug> deallocNotOwned;
   mutable std::unique_ptr<RefCountBug> overAutorelease, returnNotOwnedForOwned;
   mutable std::unique_ptr<RefCountBug> leakWithinFunction, leakAtReturn;
 
-  mutable std::unique_ptr<RetainSummaryManager> Summaries;
+  std::unique_ptr<RetainSummaryManager> Summaries;
 public:
   static constexpr const char *DeallocTagDescription = "DeallocSent";
 
-  /// Track Objective-C and CoreFoundation objects.
-  bool TrackObjCAndCFObjects = false;
-
-  /// Track sublcasses of OSObject.
-  bool TrackOSObjects = false;
-
-  RetainCountChecker() {}
+  RetainCountChecker(ASTContext &Ctx) {
+    Summaries = llvm::make_unique<RetainSummaryManager>(Ctx);
+  }
 
   RefCountBug *getLeakWithinFunctionBug(const LangOptions &LOpts) const;
 
   RefCountBug *getLeakAtReturnBug(const LangOptions &LOpts) const;
 
-  RetainSummaryManager &getSummaryManager(ASTContext &Ctx) const {
-    // FIXME: We don't support ARC being turned on and off during one analysis.
-    // (nor, for that matter, do we support changing ASTContexts)
-    bool ARCEnabled = (bool)Ctx.getLangOpts().ObjCAutoRefCount;
-    if (!Summaries) {
-      Summaries.reset(new RetainSummaryManager(
-          Ctx, ARCEnabled, TrackObjCAndCFObjects, TrackOSObjects));
-    } else {
-      assert(Summaries->isARCEnabled() == ARCEnabled);
-    }
+  RetainSummaryManager &getSummaryManager() const {
     return *Summaries;
   }
 
-  RetainSummaryManager &getSummaryManager(CheckerContext &C) const {
-    return getSummaryManager(C.getASTContext());
-  }
-
   void printState(raw_ostream &Out, ProgramStateRef State,
                   const char *NL, const char *Sep) const override;
 
   void checkBind(SVal loc, SVal val, const Stmt *S, CheckerContext &C) const;
   void checkPostStmt(const BlockExpr *BE, CheckerContext &C) const;
   void checkPostStmt(const CastExpr *CE, CheckerContext &C) const;
 
   void checkPostStmt(const ObjCArrayLiteral *AL, CheckerContext &C) const;

clang/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountChecker.cpp

void RetainCountChecker::checkPostStmt(const ObjCIvarRefExpr *IRE,
   }
 
   State = setRefBinding(State, Sym, PlusZero.withIvarAccess());
   C.addTransition(State);
 }
 
 void RetainCountChecker::checkPostCall(const CallEvent &Call,
                                        CheckerContext &C) const {
-  RetainSummaryManager &Summaries = getSummaryManager(C);
+  RetainSummaryManager &Summaries = getSummaryManager();
 
   // Leave null if no receiver.
   QualType ReceiverType;
   if (const auto *MC = dyn_cast<ObjCMethodCall>(&Call)) {
     if (MC->isInstanceMessage()) {
       SVal ReceiverV = MC->getReceiverSVal();
       if (SymbolRef Sym = ReceiverV.getAsLocSymbol())
         if (const RefVal *T = getRefBinding(C.getState(), Sym))
if (hasErr) {
     return;
   }
 
   // Consult the summary for the return value.
   RetEffect RE = Summ.getRetEffect();
 
   if (RE.getKind() == RetEffect::OwnedWhenTrackedReceiver) {
     if (ReceiverIsTracked)
-      RE = getSummaryManager(C).getObjAllocRetEffect();
+      RE = getSummaryManager().getObjAllocRetEffect();
     else
       RE = RetEffect::MakeNoRet();
   }
 
   if (SymbolRef Sym = CallOrMsg.getReturnValue().getAsSymbol()) {
     QualType ResultTy = CallOrMsg.getResultType();
     if (RE.notOwned()) {
       const Expr *Ex = CallOrMsg.getOriginExpr();

 
 bool RetainCountChecker::evalCall(const CallExpr *CE, CheckerContext &C) const {
   // Get the callee. We're only interested in simple C functions.
   ProgramStateRef state = C.getState();
   const FunctionDecl *FD = C.getCalleeDecl(CE);
   if (!FD)
     return false;
 
-  RetainSummaryManager &SmrMgr = getSummaryManager(C);
+  RetainSummaryManager &SmrMgr = getSummaryManager();
   QualType ResultTy = CE->getCallReturnType(C.getASTContext());
 
   // See if the function has 'rc_ownership_trusted_implementation'
   // annotate attribute. If it does, we will not inline it.
   bool hasTrustedImplementationAnnotation = false;
 
   const LocationContext *LCtx = C.getLocationContext();
 
if (!state)
     return nullptr;
 
   // Get the updated binding.
   T = getRefBinding(state, Sym);
   assert(T);
   X = *T;
 
   // Consult the summary of the enclosing method.
-  RetainSummaryManager &Summaries = getSummaryManager(C);
+  RetainSummaryManager &Summaries = getSummaryManager();
   const Decl *CD = &Pred->getCodeDecl();
   RetEffect RE = RetEffect::MakeNoRet();
 
   // FIXME: What is the convention for blocks? Is there one?
   if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(CD)) {
     const RetainSummary *Summ = Summaries.getMethodSummary(MD);
     RE = Summ->getRetEffect();
   } else if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(CD)) {

 static bool isISLObjectRef(QualType Ty) {
   return StringRef(Ty.getAsString()).startswith("isl_");
 }
 
 void RetainCountChecker::checkBeginFunction(CheckerContext &Ctx) const {
   if (!Ctx.inTopFrame())
     return;
 
-  RetainSummaryManager &SmrMgr = getSummaryManager(Ctx);
+  RetainSummaryManager &SmrMgr = getSummaryManager();
   const LocationContext *LCtx = Ctx.getLocationContext();
   const FunctionDecl *FD = dyn_cast<FunctionDecl>(LCtx->getDecl());
 
   if (!FD || SmrMgr.isTrustedReferenceCountImplementation(FD))
     return;
 
   ProgramStateRef state = Ctx.getState();
   const RetainSummary *FunctionSummary = SmrMgr.getFunctionSummary(FD);
for (RefBindingsTy::iterator I = B.begin(), E = B.end(); I != E; ++I) {
     Out << NL;
   }
 }
 
 //===----------------------------------------------------------------------===//
 // Checker registration.
 //===----------------------------------------------------------------------===//
 
-void ento::registerRetainCountChecker(CheckerManager &Mgr) {
-  auto *Chk = Mgr.registerChecker<RetainCountChecker>();
-  Chk->TrackObjCAndCFObjects = true;
+// FIXME: hack for getting the value of an option with a known prefix,
+// otherwise the current system does not work if the same
+// checker is registered multiple times with different names.
+static bool getOption(const AnalyzerOptions &Options, StringRef Prefix,
+                      StringRef Option, StringRef Default) {
+  auto I = Options.Config.find((Prefix + ":" + Option).str());
+  if (I != Options.Config.end()) {
+    return I->getValue() == Default;
+  }
+  return false;
 }
 
 // FIXME: remove this, hack for backwards compatibility:
 // it should be possible to enable the NS/CF retain count checker as
 // osx.cocoa.RetainCount, and it should be possible to disable
 // osx.OSObjectRetainCount using osx.cocoa.RetainCount:CheckOSObject=false.
 static bool hasPrevCheckOSObjectOptionDisabled(AnalyzerOptions &Options) {
-  auto I = Options.Config.find("osx.cocoa.RetainCount:CheckOSObject");
-  if (I != Options.Config.end())
-    return I->getValue() == "false";
-  return false;
+  return getOption(Options, "osx.cocoa.RetainCount", "CheckOSObject", "false");
+}
+
+void ento::registerRetainCountChecker(CheckerManager &Mgr) {
+  auto *Chk = Mgr.registerChecker<RetainCountChecker>(Mgr.getASTContext());
+  Chk->getSummaryManager().setTrackObjCAndCFObjects();
 }
 
 void ento::registerOSObjectRetainCountChecker(CheckerManager &Mgr) {
-  auto *Chk = Mgr.registerChecker<RetainCountChecker>();
+  AnalyzerOptions &Opts = Mgr.getAnalyzerOptions();
+  auto *Chk = Mgr.registerChecker<RetainCountChecker>(Mgr.getASTContext());
   if (!hasPrevCheckOSObjectOptionDisabled(Mgr.getAnalyzerOptions()))
-    Chk->TrackOSObjects = true;
+    Chk->getSummaryManager().setTrackOSObjects();
+
+  if (getOption(Opts, "osx.OSObjectRetainCount",
+                "TrackUnannotatedOSOutParameters", "false")) {
+    Chk->getSummaryManager().setTrackUnannotatedOSOutParameters();
+  }
 }

clang/lib/StaticAnalyzer/Core/RetainSummaryManager.cpp

static bool isAutorelease(const FunctionDecl *FD, StringRef FName) {
   return FName.startswith_lower("autorelease") ||
          FName.endswith_lower("autorelease");
 }
 
 static bool isMakeCollectable(StringRef FName) {
   return FName.contains_lower("MakeCollectable");
 }
 
+/// \return A Pointer to OSObject subclass record declaration, if {@code QT}
+/// is a pointer to such object. NULL otherwise.
+static const CXXRecordDecl* findPointerToOSObject(QualType QT) {
+  if (!QT.isNull()) {
+    if (QT->isPointerType()) {
+      QualType PT = QT->getPointeeType();
+      if (const auto *RD = PT->getAsCXXRecordDecl())
+        if (isOSObjectSubclass(RD))
+          return RD;
+    }
+  }
+  return nullptr;
+}
+
 /// A function is OSObject related if it is declared on a subclass
 /// of OSObject, or any of the parameters is a subclass of an OSObject.
 static bool isOSObjectRelated(const CXXMethodDecl *MD) {
   if (isOSObjectSubclass(MD->getParent()))
     return true;
 
   for (ParmVarDecl *Param : MD->parameters()) {
-    QualType PT = Param->getType()->getPointeeType();
-    if (!PT.isNull())
-      if (CXXRecordDecl *RD = PT->getAsCXXRecordDecl())
-        if (isOSObjectSubclass(RD))
-          return true;
+    QualType QT = Param->getType();
+    if (findPointerToOSObject(QT) ||
+        (QT->isPointerType() && findPointerToOSObject(QT->getPointeeType())))
   }
 
   return false;
 }
 
-const RetainSummary *
-RetainSummaryManager::getSummaryForOSObject(const FunctionDecl *FD,
-                                            StringRef FName, QualType RetTy) {
-  if (RetTy->isPointerType()) {
-    const CXXRecordDecl *PD = RetTy->getPointeeType()->getAsCXXRecordDecl();
-    if (PD && isOSObjectSubclass(PD)) {
-      if (const IdentifierInfo *II = FD->getIdentifier()) {
-        if (isOSObjectDynamicCast(II->getName()))
-          return getDefaultSummary();
+static bool isOSObjectGetter(const NamedDecl *ND) {
+  if (const IdentifierInfo *II = ND->getIdentifier()) {
+    return II->getName().startswith("get") ||
+      II->getName().startswith("Get");
+  }
+  return false;
+}
 
-        // All objects returned with functions *not* starting with
-        // get, or iterators, are returned at +1.
-        if ((!II->getName().startswith("get") &&
-             !II->getName().startswith("Get")) ||
-            isOSIteratorSubclass(PD)) {
-          return getOSSummaryCreateRule(FD);
-        } else {
-          return getOSSummaryGetRule(FD);
-        }
-      }
-    }
-  }
+/// \return Whether the chain of typedefs starting from {@code QT}
+/// has a typedef with a given name {@code Name}.
+static bool hasTypedefNamed(QualType QT,
+                            StringRef Name) {
+  while (auto *T = dyn_cast<TypedefType>(QT)) {
+    const auto &Context = T->getDecl()->getASTContext();
+    if (T->getDecl()->getIdentifier() == &Context.Idents.get(Name))
+      return true;
+    QT = T->getDecl()->getUnderlyingType();
+  }
+  return false;
+}
+
+static QualType getCallableReturnType(const NamedDecl *ND) {
+  if (const auto *FD = dyn_cast<FunctionDecl>(ND)) {
+    return FD->getReturnType();
+  } else if (const auto *MD = dyn_cast<ObjCMethodDecl>(ND)) {
+    return MD->getReturnType();
+    llvm_unreachable("Unexpected decl");
+
+static ArgEffectKind
+getOSObjectRetainedOutParamEffectKind(const NamedDecl *ND,
+                              bool HasRetainedOnZeroAnnotation,
+                              bool HasRetainedOnNonZeroAnnotation) {
+  QualType QT = getCallableReturnType(ND);
+
+  // The usual convention is to create an object on non-zero return, but
+  // it's reverted if the typedef chain has a typedef kern_return_t,
+  // because kReturnSuccess constant is defined as zero.
+  // The convention can be overwritten by custom attributes.
+  bool SuccessOnZero =
+      HasRetainedOnZeroAnnotation ||
+      (hasTypedefNamed(QT, "kern_return_t") && !HasRetainedOnNonZeroAnnotation);
+  bool ShouldSplit = !QT.isNull() && !QT->isVoidType();
+  ArgEffectKind AK = RetainedOutParameter;
+
+  if (ShouldSplit && SuccessOnZero) {
+    AK = RetainedOutParameterOnZero;
+  } else if (ShouldSplit &&
+             (!SuccessOnZero || HasRetainedOnNonZeroAnnotation)) {
+    AK = RetainedOutParameterOnNonZero;
+  return AK;
 
+const RetainSummary *
+RetainSummaryManager::getSummaryForOSObject(const FunctionDecl *FD,
+                                            StringRef FName, QualType RetTy) {
   if (const auto *MD = dyn_cast<CXXMethodDecl>(FD)) {
     const CXXRecordDecl *Parent = MD->getParent();
-    if (TrackOSObjects && Parent && isOSObjectSubclass(Parent)) {
+    if (Parent && isOSObjectSubclass(Parent)) {
       if (FName == "release")
         return getOSSummaryReleaseRule(FD);
 
       if (FName == "retain")
         return getOSSummaryRetainRule(FD);
 
       if (FName == "free")
         return getOSSummaryFreeRule(FD);
 
       if (MD->getOverloadedOperator() == OO_New)
         return getOSSummaryCreateRule(MD);
     }
   }
 
+  RetainSummary Out(AF);
+  bool SummaryFound = false;
+
+  if (const auto *RD = findPointerToOSObject(RetTy)) {
+    if (const IdentifierInfo *II = FD->getIdentifier()) {
+      if (isOSObjectDynamicCast(II->getName()))
+        return getDefaultSummary();
+
+      // All objects returned with functions *not* starting with
+      // get, or iterators, are returned at +1.
+      if (!isOSObjectGetter(FD) || isOSIteratorSubclass(RD)) {
+        Out.setRetEffect(RetEffect::MakeOwned(ObjKind::OS));
+        SummaryFound = true;
+      } else {
+        Out.setRetEffect(RetEffect::MakeNotOwned(ObjKind::OS));
+        SummaryFound = true;
+      }
+    }
+  }
+
+  if (TrackUnannotatedOSOutParameters) {
+    for (unsigned ParmIdx = 0; ParmIdx < FD->parameters().size(); ParmIdx++) {
+      const ParmVarDecl *PD = FD->parameters()[ParmIdx];
+      QualType QT = PD->getType();
+
+      // Decayed type is used to differentiate between double pointers
+      // and arrays of pointers (although they have the same operational
+      // semantics, the intent differs).
+      if (QT.isNull() || !QT->isPointerType() || isa<DecayedType>(QT))
+        continue;
+
+      const auto *RD = findPointerToOSObject(QT->getPointeeType());
+      if (!RD)
+        continue;
+
+      ArgEffectKind AE =
+          isOSObjectGetter(FD)
+              ? UnretainedOutParameter
+              : getOSObjectRetainedOutParamEffectKind(FD, false, false);
+
+      Out.addArg(AF, ParmIdx, ArgEffect(AE, ObjKind::OS));
+      SummaryFound = true;
+    }
+  }
+
+  if (SummaryFound)
+    return getPersistentSummary(Out);
   return nullptr;
 }
 
 const RetainSummary *RetainSummaryManager::getSummaryForObjCOrCFObject(
     const FunctionDecl *FD,
     StringRef FName,
     QualType RetTy,
     const FunctionType *FT,
if (TrackOSObjects)
     if (const RetainSummary *S = getSummaryForOSObject(FD, FName, RetTy))
       return S;
 
   if (TrackObjCAndCFObjects)
     if (const RetainSummary *S =
             getSummaryForObjCOrCFObject(FD, FName, RetTy, FT, AllowAnnotations))
       return S;
 
+  // Unless the OSObject tracking is enabled, AND the method is
+  // OSObject-related, all calls to CXX methods are treated as escaping.
   if (const auto *MD = dyn_cast<CXXMethodDecl>(FD))
     if (!(TrackOSObjects && isOSObjectRelated(MD)))
       return getPersistentSummary(RetEffect::MakeNoRet(),
                                   ArgEffects(AF.getEmptyMap()),
                                   ArgEffect(DoNothing),
                                   ArgEffect(StopTracking),
                                   ArgEffect(DoNothing));
 
RetainSummaryManager::getRetEffectFromAnnotations(QualType RetTy,
   if (const auto *MD = dyn_cast<CXXMethodDecl>(D))
     for (const auto *PD : MD->overridden_methods())
       if (auto RE = getRetEffectFromAnnotations(RetTy, PD))
         return RE;
 
   return None;
 }
 
-/// \return Whether the chain of typedefs starting from {@code QT}
-/// has a typedef with a given name {@code Name}.
-static bool hasTypedefNamed(QualType QT,
-                            StringRef Name) {
-  while (auto *T = dyn_cast<TypedefType>(QT)) {
-    const auto &Context = T->getDecl()->getASTContext();
-    if (T->getDecl()->getIdentifier() == &Context.Idents.get(Name))
-      return true;
-    QT = T->getDecl()->getUnderlyingType();
-  }
-  return false;
-}
-
-static QualType getCallableReturnType(const NamedDecl *ND) {
-  if (const auto *FD = dyn_cast<FunctionDecl>(ND)) {
-    return FD->getReturnType();
-  } else if (const auto *MD = dyn_cast<ObjCMethodDecl>(ND)) {
-    return MD->getReturnType();
-  } else {
-    llvm_unreachable("Unexpected decl");
-  }
-}
 
 bool RetainSummaryManager::applyParamAnnotationEffect(
     const ParmVarDecl *pd, unsigned parm_idx, const NamedDecl *FD,
     RetainSummaryTemplate &Template) {
   QualType QT = pd->getType();
   if (auto K =
           hasAnyEnabledAttrOf<NSConsumedAttr, CFConsumedAttr, OSConsumedAttr,
                               GeneralizedConsumedAttr>(pd, QT)) {
     Template->addArg(AF, parm_idx, ArgEffect(DecRef, *K));
     return true;
   } else if (auto K = hasAnyEnabledAttrOf<
                  CFReturnsRetainedAttr, OSReturnsRetainedAttr,
                  OSReturnsRetainedOnNonZeroAttr, OSReturnsRetainedOnZeroAttr,
                  GeneralizedReturnsRetainedAttr>(pd, QT)) {
 
     // For OSObjects, we try to guess whether the object is created based
     // on the return value.
     if (K == ObjKind::OS) {
-      QualType QT = getCallableReturnType(FD);
-
-      bool HasRetainedOnZero = pd->hasAttr<OSReturnsRetainedOnZeroAttr>();
-      bool HasRetainedOnNonZero = pd->hasAttr<OSReturnsRetainedOnNonZeroAttr>();
+      ArgEffectKind AK = getOSObjectRetainedOutParamEffectKind(
+          FD, pd->hasAttr<OSReturnsRetainedOnZeroAttr>(),
+          pd->hasAttr<OSReturnsRetainedOnNonZeroAttr>());
 
-      // The usual convention is to create an object on non-zero return, but
-      // it's reverted if the typedef chain has a typedef kern_return_t,
-      // because kReturnSuccess constant is defined as zero.
-      // The convention can be overwritten by custom attributes.
-      bool SuccessOnZero =
-          HasRetainedOnZero ||
-          (hasTypedefNamed(QT, "kern_return_t") && !HasRetainedOnNonZero);
-      bool ShouldSplit = !QT.isNull() && !QT->isVoidType();
-      ArgEffectKind AK = RetainedOutParameter;
-      if (ShouldSplit && SuccessOnZero) {
-        AK = RetainedOutParameterOnZero;
-      } else if (ShouldSplit && (!SuccessOnZero || HasRetainedOnNonZero)) {
-        AK = RetainedOutParameterOnNonZero;
-      }
       Template->addArg(AF, parm_idx, ArgEffect(AK, ObjKind::OS));
     }
 
     // For others:
     // Do nothing. Retained out parameters will either point to a +1 reference
     // or NULL, but the way you check for failure differs depending on the
     // API. Consequently, we don't have a good way to track them yet.
     return true;
void RetainSummaryManager::InitializeMethodSummaries() {
   addInstMethSummary("CIContext", CFAllocSumm, "createCGImage", "fromRect");
   addInstMethSummary("CIContext", CFAllocSumm, "createCGImage", "fromRect",
                      "format", "colorSpace");
   addInstMethSummary("CIContext", CFAllocSumm, "createCGLayerWithSize", "info");
 }
 
 CallEffects CallEffects::getEffect(const ObjCMethodDecl *MD) {
   ASTContext &Ctx = MD->getASTContext();
-  LangOptions L = Ctx.getLangOpts();
-  RetainSummaryManager M(Ctx, L.ObjCAutoRefCount,
-                         /*TrackNSAndCFObjects=*/true,
-                         /*TrackOSObjects=*/false);
+  RetainSummaryManager M(Ctx);
+  M.setTrackOSObjects();
   const RetainSummary *S = M.getMethodSummary(MD);
   CallEffects CE(S->getRetEffect(), S->getReceiverEffect());
   unsigned N = MD->param_size();
   for (unsigned i = 0; i < N; ++i) {
     CE.Args.push_back(S->getArg(i));
   }
   return CE;
 }
 
 CallEffects CallEffects::getEffect(const FunctionDecl *FD) {
   ASTContext &Ctx = FD->getASTContext();
-  LangOptions L = Ctx.getLangOpts();
-  RetainSummaryManager M(Ctx, L.ObjCAutoRefCount,
-                         /*TrackNSAndCFObjects=*/true,
-                         /*TrackOSObjects=*/false);
+  RetainSummaryManager M(Ctx);
+  M.setTrackObjCAndCFObjects();
   const RetainSummary *S = M.getFunctionSummary(FD);
   CallEffects CE(S->getRetEffect());
   unsigned N = FD->param_size();
   for (unsigned i = 0; i < N; ++i) {
     CE.Args.push_back(S->getArg(i));
   }
   return CE;
 }

clang/test/Analysis/osobject-retain-release.cpp

 // RUN: %clang_analyze_cc1 -fblocks -analyze -analyzer-output=text\
 // RUN:                    -analyzer-checker=core,osx -verify %s
+// RUN: %clang_analyze_cc1 -fblocks -analyze -analyzer-output=text\
+// RUN:                    -analyzer-checker=core,osx -verify -DDEFAULT_OUTPARAMS=true -analyzer-config "osx.cocoa.RetainCount:TrackUnannotatedOSOutParameters=true" %s
 
 struct OSMetaClass;
 
 #define OS_CONSUME __attribute__((os_consumed))
 #define OS_RETURNS_RETAINED __attribute__((os_returns_retained))
 #define OS_RETURNS_RETAINED_ON_ZERO __attribute__((os_returns_retained_on_zero))
 #define OS_RETURNS_RETAINED_ON_NONZERO __attribute__((os_returns_retained_on_non_zero))
 #define OS_RETURNS_NOT_RETAINED __attribute__((os_returns_not_retained))

 }
 
 void use_out_param_leak_osreturn() {
   OSObject *obj;
   write_into_out_param_on_os_success(&obj); // expected-note-re{{Call to function 'write_into_out_param_on_os_success' writes an OSObject of type 'OSObject' with a +1 retain count into an out parameter 'obj' (assuming the call returns zero){{$}}}}
 } // expected-warning{{Potential leak of an object stored into 'obj'}}
   // expected-note@-1{{Object leaked: object allocated and stored into 'obj' is not referenced later in this execution path and has a retain count of +1}}
 
+void unannotated_out_param(OSObject **obj);
+
+void use_unannotated_out_param() {
+  OSObject *obj;
+  unannotated_out_param(&obj);
+#ifdef DEFAULT_OUTPARAMS
+  // expected-note@-2{{Call to function 'unannotated_out_param' writes an OSObject of type 'OSObject' with a +1 retain count into an out parameter 'obj'}}
+#endif
+}
+#ifdef DEFAULT_OUTPARAMS
+  // expected-warning@-2{{Potential leak of an object stored into 'obj'}}
+  // expected-note@-3{{Object leaked: object allocated and stored into 'obj' is not referenced later in this execution path and has a retain count of +1}}
+#endif
+
 struct StructWithField {
   OSObject *obj;
 
   void initViaOutParamCall() { // no warning on writing into fields
     always_write_into_out_param(&obj);
   }
 
 };