[analyzer] RetainCount: Fix a crash when os_returns_retained_on_zero (_nonzero) is applied to functions that return weird stuff.

[NoQ]

Summary

The checker crashes when it tries to assume a structure to be null or non-null so that to evaluate the effect of the annotation.

[dcoughlin]

Looks good do me. Thanks!

clang/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountChecker.cpp

for (auto &P : Summ.getArgEffects())
     if (P.second.getKind() == RetainedOutParameterOnNonZero ||
         P.second.getKind() == RetainedOutParameterOnZero)
       SplitNecessary = true;
 
   ProgramStateRef AssumeNonZeroReturn = State;
   ProgramStateRef AssumeZeroReturn = State;
 
   if (SplitNecessary) {
+    if (!CE.getResultType()->isScalarType()) {
+      // Structures cannot be assumed. This probably deserves
+      // a compiler warning for invalid annotations.
+      return {State};
+    }
     if (auto DL = L.getAs<DefinedOrUnknownSVal>()) {
       AssumeNonZeroReturn = AssumeNonZeroReturn->assume(*DL, true);
       AssumeZeroReturn = AssumeZeroReturn->assume(*DL, false);
     }
   }
 
   for (unsigned idx = 0, e = CE.getNumArgs(); idx != e; ++idx) {
     SVal ArgVal = CE.getArgSVal(idx);

clang/test/Analysis/osobject-retain-release.cpp

OSObject *testSuppressionForMethodsEndingWithMatching(IOService *svc,
 
   if (!table)
     table = OSTypeAlloc(OSArray);
 
   // This function itself ends with "Matching"! Do not warn when we're
   // returning from it at +0.
   return table; // no-warning
 }
+
+namespace weird_result {
+struct WeirdResult {
+  int x, y, z;
+};
+
+WeirdResult outParamWithWeirdResult(OS_RETURNS_RETAINED_ON_ZERO OSObject **obj);
+
+WeirdResult testOutParamWithWeirdResult() {
+  OSObject *obj;
+  return outParamWithWeirdResult(&obj); // no-warning
+}
+} // namespace weird_result