[analyzer] Model another special-case kind of cast for OSObject RetainCountChecker

[george.karpenkov]

Summary

Ideally, those should be handled with attributes

[NoQ]

clang/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountChecker.cpp

882–883

Was it checked previously that the function with the metaCast/safeMetaCast name is indeed a member function and that it takes at least one argument? Otherwise it'd crash.

[george.karpenkov]

clang/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountChecker.cpp

882–883

That's a good point.

clang/include/clang/StaticAnalyzer/Core/RetainSummaryManager.h

public:
 
   enum class BehaviorSummary {
     // Function does not return.
     NoOp,
 
     // Function returns the first argument.
     Identity,
 
+    // Function returns "this" argument.
+    IdentityThis,
+
     // Function either returns zero, or the input parameter.
     IdentityOrZero
   };
 
   Optional<BehaviorSummary> canEval(const CallExpr *CE, const FunctionDecl *FD,
                                     bool &hasTrustedImplementationAnnotation);
 
   /// \return Whether the type corresponds to a known smart pointer

clang/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountChecker.cpp

void RetainCountChecker::processNonLeakError(ProgramStateRef St,
   C.emitReport(std::move(report));
 }
 
 //===----------------------------------------------------------------------===//
 // Handle the return values of retain-count-related functions.
 //===----------------------------------------------------------------------===//
 
 bool RetainCountChecker::evalCall(const CallExpr *CE, CheckerContext &C) const {
-  // Get the callee. We're only interested in simple C functions.
   ProgramStateRef state = C.getState();
   const FunctionDecl *FD = C.getCalleeDecl(CE);
   if (!FD)
     return false;
 
   RetainSummaryManager &SmrMgr = getSummaryManager(C);
   QualType ResultTy = CE->getCallReturnType(C.getASTContext());
 
   // See if the function has 'rc_ownership_trusted_implementation'
   // annotate attribute. If it does, we will not inline it.
   bool hasTrustedImplementationAnnotation = false;
 
   const LocationContext *LCtx = C.getLocationContext();
 
   using BehaviorSummary = RetainSummaryManager::BehaviorSummary;
   Optional<BehaviorSummary> BSmr =
       SmrMgr.canEval(CE, FD, hasTrustedImplementationAnnotation);
 
   // See if it's one of the specific functions we know how to eval.
   if (!BSmr)
     return false;
 
   // Bind the return value.
   if (BSmr == BehaviorSummary::Identity ||
-      BSmr == BehaviorSummary::IdentityOrZero) {
-    SVal RetVal = state->getSVal(CE->getArg(0), LCtx);
+      BSmr == BehaviorSummary::IdentityOrZero ||
+      BSmr == BehaviorSummary::IdentityThis) {
+
+    const Expr *BindReturnTo =
+        (BSmr == BehaviorSummary::IdentityThis)
+            ? cast<CXXMemberCallExpr>(CE)->getImplicitObjectArgument()
+            : CE->getArg(0);
+    SVal RetVal = state->getSVal(BindReturnTo, LCtx);
 
     // If the receiver is unknown or the function has
     // 'rc_ownership_trusted_implementation' annotate attribute, conjure a
     // return value.
+    // FIXME: this branch is very strange.
     if (RetVal.isUnknown() ||
         (hasTrustedImplementationAnnotation && !ResultTy.isNull())) {
       SValBuilder &SVB = C.getSValBuilder();
       RetVal =
           SVB.conjureSymbolVal(nullptr, CE, LCtx, ResultTy, C.blockCount());
     }
+
+    // Bind the value.
     state = state->BindExpr(CE, LCtx, RetVal, /*Invalidate=*/false);
 
     if (BSmr == BehaviorSummary::IdentityOrZero) {
       // Add a branch where the output is zero.
       ProgramStateRef NullOutputState = C.getState();
 
       // Assume that output is zero on the other branch.
       NullOutputState = NullOutputState->BindExpr(

clang/lib/StaticAnalyzer/Core/RetainSummaryManager.cpp

 static bool isOSObjectSubclass(const Decl *D) {
   return isSubclass(D, "OSMetaClassBase");
 }
 
 static bool isOSObjectDynamicCast(StringRef S) {
   return S == "safeMetaCast";
 }
 
+static bool isOSObjectThisCast(StringRef S) {
+  return S == "metaCast";
+}
+
 static bool isOSIteratorSubclass(const Decl *D) {
   return isSubclass(D, "OSIterator");
 }
 
 static bool hasRCAnnotation(const Decl *D, StringRef rcAnnotation) {
   for (const auto *Ann : D->specific_attrs<AnnotateAttr>()) {
     if (Ann->getAnnotation() == rcAnnotation)
       return true;

 
 const RetainSummary *
 RetainSummaryManager::getSummaryForOSObject(const FunctionDecl *FD,
                                             StringRef FName, QualType RetTy) {
   if (RetTy->isPointerType()) {
     const CXXRecordDecl *PD = RetTy->getPointeeType()->getAsCXXRecordDecl();
     if (PD && isOSObjectSubclass(PD)) {
       if (const IdentifierInfo *II = FD->getIdentifier()) {
-        if (isOSObjectDynamicCast(II->getName()))
+        StringRef FuncName = II->getName();
+        if (isOSObjectDynamicCast(FuncName) || isOSObjectThisCast(FuncName))
           return getDefaultSummary();
 
         // All objects returned with functions *not* starting with
         // get, or iterators, are returned at +1.
-        if ((!II->getName().startswith("get") &&
-             !II->getName().startswith("Get")) ||
+        if ((!FuncName.startswith("get") && !FuncName.startswith("Get")) ||
             isOSIteratorSubclass(PD)) {
           return getOSSummaryCreateRule(FD);
         } else {
           return getOSSummaryGetRule(FD);
         }
       }
     }
   }
if (cocoa::isRefType(ResultTy, "CF", FName) ||
           isMakeCollectable(FName))
         return BehaviorSummary::Identity;
 
     // safeMetaCast is called by OSDynamicCast.
     // We assume that OSDynamicCast is either an identity (cast is OK,
     // the input was non-zero),
     // or that it returns zero (when the cast failed, or the input
     // was zero).
-    if (TrackOSObjects && isOSObjectDynamicCast(FName)) {
+    if (TrackOSObjects) {
+      if (isOSObjectDynamicCast(FName)) {
         return BehaviorSummary::IdentityOrZero;
+      } else if (isOSObjectThisCast(FName)) {
+        return BehaviorSummary::IdentityThis;
+      }
     }
 
     const FunctionDecl* FDD = FD->getDefinition();
     if (FDD && isTrustedReferenceCountImplementation(FDD)) {
       hasTrustedImplementationAnnotation = true;
       return BehaviorSummary::Identity;
     }
   }

clang/test/Analysis/os_object_base.h

 using size_t = decltype(sizeof(int));
 
 struct OSMetaClass;
 
 struct OSMetaClassBase {
   static OSMetaClassBase *safeMetaCast(const OSMetaClassBase *inst,
                                        const OSMetaClass *meta);
 
+  OSMetaClassBase *metaCast(const char *toMeta);
+
   virtual void retain() const;
   virtual void release() const;
   virtual void free();
   virtual ~OSMetaClassBase(){};
 };
 
 struct OSObject : public OSMetaClassBase {
   virtual ~OSObject(){}

clang/test/Analysis/osobject-retain-release.cpp

struct MyArray : public OSArray {
   OSObject *generateObject(OSObject *input) override;
 };
 
 struct OtherStruct {
   static void doNothingToArray(OSArray *array);
   OtherStruct(OSArray *arr);
 };
 
+bool test_meta_cast_no_leak(OSMetaClassBase *arg) {
+  return arg && arg->metaCast("blah") != nullptr;
+}
 
 void escape(void *);
 void escape_with_source(void *p) {}
 bool coin();
 
 typedef int kern_return_t;
 typedef kern_return_t IOReturn;
 typedef kern_return_t OSReturn;