[analyzer] [RetainCountChecker] Fix object type for CF/Obj-C bridged casts

[george.karpenkov]

Summary

Having an incorrect type for a cast causes the checker to incorrectly dismiss the operation under ARC, leading to a false positive use-after-release on the test.

rdar://47709885

[NoQ]

Thx!

clang/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountChecker.cpp

 }
 
 void RetainCountChecker::checkPostStmt(const CastExpr *CE,
                                        CheckerContext &C) const {
   const ObjCBridgedCastExpr *BE = dyn_cast<ObjCBridgedCastExpr>(CE);
   if (!BE)
     return;
 
-  ArgEffect AE = ArgEffect(IncRef, ObjKind::ObjC);
+  QualType QT = CE->getType();
+  ObjKind K;
+  if (coreFoundation::isCFObjectRef(QT)) {
+    K = ObjKind::CF;
+  } else {
+    assert(cocoa::isCocoaObjectRef(QT));
+    K = ObjKind::ObjC;
+  }
+
+  ArgEffect AE = ArgEffect(IncRef, K);
 
   switch (BE->getBridgeKind()) {
     case OBC_Bridge:
       // Do nothing.
       return;
     case OBC_BridgeRetained:
       AE = AE.withKind(IncRef);
       break;

clang/test/Analysis/objc-arc.m

 void rdar9424882() {
   id x = [NSObject alloc]; // expected-warning {{Value stored to 'x' during its initialization is never read}}
 }
 
 // Test 
 typedef const void *CFTypeRef;
 typedef const struct __CFString *CFStringRef;
 
-@interface NSString
+@interface NSString : NSObject
 - (id) self;
 @end
 
 CFTypeRef CFCreateSomething();
 CFStringRef CFCreateString();
 CFTypeRef CFGetSomething();
 CFStringRef CFGetString();
 

 id rdar14061675() {
   // ARC produces an implicit cast here. We need to make sure the combination
   // of that and the inlined call don't produce a spurious edge cycle.
   id result = rdar14061675_helper();
   *(volatile int *)0 = 1; // expected-warning{{Dereference of null pointer}}
   return result;
 }
 
+
+typedef const void * CFTypeRef;
+typedef const struct __CFString * CFStringRef;
+typedef const struct __CFAllocator * CFAllocatorRef;
+extern const CFAllocatorRef kCFAllocatorDefault;
+
+extern CFTypeRef CFRetain(CFTypeRef cf);
+extern void CFRelease(CFTypeRef cf);
+
+void check_bridge_retained_cast() {
+    NSString *nsStr = [[NSString alloc] init];
+    CFStringRef cfStr = (__bridge_retained CFStringRef)nsStr;
+    CFRelease(cfStr); // no-warning
+}