[analyzer] MIGChecker: Add support for more deallocator APIs.

[NoQ]

Summary

Most of these were obtained by invoking

$ find . -name '*.defs' -exec grep destructor {} \; | sed s/'.*destructor: '// | sed s/'(.*)'// | awk '{print "CALL(1, 0, " $1 "),"}' | sort -u

in XNU.

rdar://problem/49358317

cfe/trunk/lib/StaticAnalyzer/Checkers/MIGChecker.cpp

#define CALL(required_args, deallocated_arg, ...)                              \
       // E.g., if the checker sees a C function 'vm_deallocate' that is
       // defined on class 'IOUserClient' that has exactly 3 parameters, it knows
       // that argument #1 (starting from 0, i.e. the second argument) is going
       // to be consumed in the sense of the MIG consume-on-success convention.
       CALL(3, 1, "vm_deallocate"),
       CALL(3, 1, "mach_vm_deallocate"),
       CALL(2, 0, "mig_deallocate"),
       CALL(2, 1, "mach_port_deallocate"),
+      CALL(1, 0, "device_deallocate"),
+      CALL(1, 0, "iokit_remove_connect_reference"),
+      CALL(1, 0, "iokit_remove_reference"),
+      CALL(1, 0, "iokit_release_port"),
+      CALL(1, 0, "ipc_port_release"),
+      CALL(1, 0, "ipc_port_release_sonce"),
+      CALL(1, 0, "ipc_voucher_attr_control_release"),
+      CALL(1, 0, "ipc_voucher_release"),
+      CALL(1, 0, "lock_set_dereference"),
+      CALL(1, 0, "memory_object_control_deallocate"),
+      CALL(1, 0, "pset_deallocate"),
+      CALL(1, 0, "semaphore_dereference"),
+      CALL(1, 0, "space_deallocate"),
+      CALL(1, 0, "space_inspect_deallocate"),
+      CALL(1, 0, "task_deallocate"),
+      CALL(1, 0, "task_inspect_deallocate"),
+      CALL(1, 0, "task_name_deallocate"),
+      CALL(1, 0, "thread_deallocate"),
+      CALL(1, 0, "thread_inspect_deallocate"),
+      CALL(1, 0, "upl_deallocate"),
+      CALL(1, 0, "vm_map_deallocate"),
       // E.g., if the checker sees a method 'releaseAsyncReference64()' that is
       // defined on class 'IOUserClient' that takes exactly 1 argument, it knows
       // that the argument is going to be consumed in the sense of the MIG
       // consume-on-success convention.
       CALL(1, 0, "IOUserClient", "releaseAsyncReference64"),
+      CALL(1, 0, "IOUserClient", "releaseNotificationPort"),
 #undef CALL
   };
 
   void checkReturnAux(const ReturnStmt *RS, CheckerContext &C) const;
 
 public:
   void checkPostCall(const CallEvent &Call, CheckerContext &C) const;
 

cfe/trunk/test/Analysis/mig.mm

 #define KERN_ERROR 1
 #define MIG_NO_REPLY (-305)
 
 typedef unsigned mach_port_name_t;
 typedef unsigned vm_address_t;
 typedef unsigned vm_size_t;
 typedef void *ipc_space_t;
 typedef unsigned long io_user_reference_t;
+typedef struct ipc_port *ipc_port_t;
+typedef unsigned mach_port_t;
+typedef uint32_t UInt32;
 
 kern_return_t vm_deallocate(mach_port_name_t, vm_address_t, vm_size_t);
 kern_return_t mach_vm_deallocate(mach_port_name_t, vm_address_t, vm_size_t);
 void mig_deallocate(vm_address_t, vm_size_t);
 kern_return_t mach_port_deallocate(ipc_space_t, mach_port_name_t);
+void ipc_port_release(ipc_port_t);
 
 #define MIG_SERVER_ROUTINE __attribute__((mig_server_routine))
 
 // IOKit wrappers.
 
 class OSObject;
 typedef kern_return_t IOReturn;
 #define kIOReturnError 1
 
 enum {
   kOSAsyncRef64Count = 8,
 };
 
 typedef io_user_reference_t OSAsyncReference64[kOSAsyncRef64Count];
 
 struct IOExternalMethodArguments {
   io_user_reference_t *asyncReference;
 };
 
 struct IOExternalMethodDispatch {};
 
 class IOUserClient {
 public:
   static IOReturn releaseAsyncReference64(OSAsyncReference64);
+  static IOReturn releaseNotificationPort(mach_port_t port);
 
   MIG_SERVER_ROUTINE
-  virtual IOReturn externalMethod(uint32_t selector, IOExternalMethodArguments *arguments,
-                                  IOExternalMethodDispatch *dispatch = 0, OSObject *target = 0, void *reference = 0);
-};
+  virtual IOReturn externalMethod(
+      uint32_t selector, IOExternalMethodArguments *arguments,
+      IOExternalMethodDispatch *dispatch = 0, OSObject *target = 0,
+      void *reference = 0);
 
+  MIG_SERVER_ROUTINE
+  virtual IOReturn registerNotificationPort(mach_port_t, UInt32, UInt32);
+};
 
 // Tests.
 
 MIG_SERVER_ROUTINE
 kern_return_t basic_test(mach_port_name_t port, vm_address_t address, vm_size_t size) {
   vm_deallocate(port, address, size); // expected-note{{Value passed through parameter 'address' is deallocated}}
   if (size > 10) { // expected-note{{Assuming 'size' is > 10}}
                    // expected-note@-1{{Taking true branch}}

 
 MIG_SERVER_ROUTINE
 kern_return_t test_mig_deallocate(vm_address_t address, vm_size_t size) {
   mig_deallocate(address, size); // expected-note{{Value passed through parameter 'address' is deallocated}}
   return KERN_ERROR;             // expected-warning{{MIG callback fails with error after deallocating argument value}}
                                  // expected-note@-1{{MIG callback fails with error after deallocating argument value}}
 }
 
+MIG_SERVER_ROUTINE
+kern_return_t test_ipc_port_release(ipc_port_t port) {
+  ipc_port_release(port); // expected-note{{Value passed through parameter 'port' is deallocated}}
+  return KERN_ERROR; // expected-warning{{MIG callback fails with error after deallocating argument value}}
+                     // expected-note@-1{{MIG callback fails with error after deallocating argument value}}
+}
+
 // Let's try the C++11 attribute spelling syntax as well.
 [[clang::mig_server_routine]]
 IOReturn test_releaseAsyncReference64(IOExternalMethodArguments *arguments) {
   IOUserClient::releaseAsyncReference64(arguments->asyncReference); // expected-note{{Value passed through parameter 'arguments' is deallocated}}
   return kIOReturnError;                                            // expected-warning{{MIG callback fails with error after deallocating argument value}}
                                                                     // expected-note@-1{{MIG callback fails with error after deallocating argument value}}
 }
 
 MIG_SERVER_ROUTINE
 kern_return_t test_no_reply(ipc_space_t space, mach_port_name_t port) {
   mach_port_deallocate(space, port);
   return MIG_NO_REPLY; // no-warning
 }
 
 class MyClient: public IOUserClient {
   // The MIG_SERVER_ROUTINE annotation is intentionally skipped.
   // It should be picked up from the superclass.
   IOReturn externalMethod(uint32_t selector, IOExternalMethodArguments *arguments,
                           IOExternalMethodDispatch *dispatch = 0, OSObject *target = 0, void *reference = 0) override {
 
     releaseAsyncReference64(arguments->asyncReference); // expected-note{{Value passed through parameter 'arguments' is deallocated}}
     return kIOReturnError;                              // expected-warning{{MIG callback fails with error after deallocating argument value}}
                                                         // expected-note@-1{{MIG callback fails with error after deallocating argument value}}
   }
+
+  IOReturn registerNotificationPort(mach_port_t port, UInt32 x, UInt32 y) {
+    releaseNotificationPort(port); // expected-note{{Value passed through parameter 'port' is deallocated}}
+    return kIOReturnError; // expected-warning{{MIG callback fails with error after deallocating argument value}}
+                           // expected-note@-1{{MIG callback fails with error after deallocating argument value}}
+  }
 };