[analyzer] RetainCount: Fix a crash when a function follows retain/autorelease naming convention but takes no arguments.

[NoQ]

Summary

We desperately need a checker that finds unchecked getArg() calls :)

[NoQ]

The actual crash happens in RetainCountChecker::evalCall():

912     const Expr *BindReturnTo =
913         (BSmr == BehaviorSummary::IdentityThis)
914             ? cast<CXXMemberCallExpr>(CE)->getImplicitObjectArgument()
915             : CE->getArg(0); // <== here

[dcoughlin]

Sigh. Looks good!

lib/Analysis/RetainSummaryManager.cpp

if (ResultTy->isObjCIdType()) {
     //         CFAutorelease
     // It's okay to be a little sloppy here.
     if (FName == "CMBufferQueueDequeueAndRetain" ||
         FName == "CMBufferQueueDequeueIfDataReadyAndRetain") {
       // Part of: <rdar://problem/39390714>.
       // These are not retain. They just return something and retain it.
       return None;
     }
-    if (cocoa::isRefType(ResultTy, "CF", FName) ||
+    if (CE->getNumArgs() == 1 &&
+        (cocoa::isRefType(ResultTy, "CF", FName) ||
          cocoa::isRefType(ResultTy, "CG", FName) ||
-        cocoa::isRefType(ResultTy, "CV", FName))
-      if (isRetain(FD, FName) || isAutorelease(FD, FName) ||
-          isMakeCollectable(FName))
-        return BehaviorSummary::Identity;
+         cocoa::isRefType(ResultTy, "CV", FName)) &&
+        (isRetain(FD, FName) || isAutorelease(FD, FName) ||
+         isMakeCollectable(FName)))
 
     // safeMetaCast is called by OSDynamicCast.
     // We assume that OSDynamicCast is either an identity (cast is OK,
     // the input was non-zero),
     // or that it returns zero (when the cast failed, or the input
     // was zero).
     if (TrackOSObjects) {
       if (isOSObjectDynamicCast(FName) && FD->param_size() >= 1) {

test/Analysis/retain-release.mm

 }
 
 void test_cxx_method_escaping(S *s) {
   CFArrayRef arr = s->testGetNoTrackingMember();
   CFRelease(arr);
 }
 
 }
+
+namespace yet_another_unexpected_signature_crash {
+
+CFTypeRef CFSomethingSomethingRetain();
+CFTypeRef CFSomethingSomethingAutorelease();
+
+void foo() {
+  CFSomethingSomethingRetain(); // no-crash
+  CFSomethingSomethingAutorelease(); // no-crash
+}
+
+}