[analyzer] Track runtime types represented by Obj-C Class objects

[vsavchenko]

Summary

Objective-C Class objects can be used to do a dynamic dispatch on
class methods. The analyzer had a few places where we tried to overcome
the dynamic nature of it and still guess the actual function that
is being called. That was done mostly using some simple heuristics
covering the most widespread cases (e.g. [[self class] classmethod]).
This solution introduces a way to track types represented by Class
objects and work with that instead of direct AST matching.

rdar://problem/50739539

[vsavchenko]

Fix unfinished comment

[NoQ]

clang/lib/StaticAnalyzer/Checkers/DynamicTypePropagation.cpp

135

Let's explain what true means here, i.e. /*Precise=*/true.

163

I suspect that self, unlike this, can be reassigned in the middle of the method.

164–165

That's a good place for const auto *.

208–211

When exactly does this situation happen? Can we predict it during pattern-matching instead of patching it up after the fact?

229–230

This needs to be filled in for the new trait as well! It's very important :3

336–337

Looks like a missed word somewhere.

clang/lib/StaticAnalyzer/Core/DynamicType.cpp

37

I'd rather word this as "pointed-to type".

[vsavchenko]

clang/lib/StaticAnalyzer/Checkers/DynamicTypePropagation.cpp

135

Sure

163

That's true, and we didn't account for that in here. I'll try to make a test on that (and maybe re-order how we handle these cases a bit

164–165

Right, didn't pay much attention to this moved code

229–230

Whoops! I forgot!
Good catch!

336–337

OK, I'll try to re-write to make it more clear

clang/lib/StaticAnalyzer/Core/DynamicType.cpp

37

Sure

[vsavchenko]

Fix issues pointed by @NoQ.

clang/lib/StaticAnalyzer/Checkers/DynamicTypePropagation.cpp

229–230

But it looks like that info was not removed from the state neither for dynamic types, nor for dynamic casts (see the diff)

[NoQ]

clang/lib/StaticAnalyzer/Checkers/DynamicTypePropagation.cpp

113

static?

134

These comments will never be parsed by doxygen, i don't think those \code thingies are needed here. Or is it some editor/IDE-specific thingies that i'm not educated about?

193

Why are we discarding CanBeSubClassed here?

198

I believe this is pretty much always the case. At least whenever getInstanceReceiver() is available. Another exception seem to be when ReceiverSVal is an UnknownVal (in this case self is going to be SymbolRegionValue because it's never set in the Store), but that's it. I inferred this by looking at ObjCMethodCall::getInitialStackFrameContents().

I think we should have used getSelfSVal() to begin with.

921

I don't think this line of code does anything.

(time for some LLVM_NODISCARD???)

clang/lib/StaticAnalyzer/Core/CallEvent.cpp

1200–1207

Before i forget: Stuff that's shared across analyses usually lives in AnalysisConsumer. Cf. FunctionSummaries. This is the intended way of avoiding globals in such cases.

1287–1313

Wait, how do we get a decl here that's anyhow relevant if the compiler doesn't even know that it's a class method?

clang/lib/StaticAnalyzer/Core/DynamicType.cpp

85–87

My favorite idiom for this stuff so far:

const DynamicTypeInfo *DTI = State->get<DynamicClassObjectMap>(Sym);
return DTI ? *DTI : {};

(not sure ?: will typecheck correctly in case of {} though)

146

Feel free to rename isLiveRegion instead if it helps :)

[vsavchenko]

clang/lib/StaticAnalyzer/Checkers/DynamicTypePropagation.cpp

113

It is all inside of anonymous namespace, so no need in putting static here.

134

No, you are correct. It's more like a matter of habit and consistent look of the comment. I would anyway prefer to somehow tell the reader that this is a snippet. It can be with a more or less familiar way of doing it. (I've seen a good amount of doxygen-style comments for static functions in the project, I guess similar logic applies to those as well)

193

Good point, we should propagate it further

198

I believe this is pretty much always the case.

I didn't quite get what you mean by that

921

Whoops, that's true!

clang/lib/StaticAnalyzer/Core/CallEvent.cpp

1200–1207

We can re-do it in a separate commit I guess.

1287–1313

Compiler knows it, but still marks it as an instance method (because technically self is an object).

[NoQ]

clang/lib/StaticAnalyzer/Checkers/DynamicTypePropagation.cpp

198

What i'm trying to say is that C.getSVal(RecE) and Message.getSelfSVal() and Message.getReceiverSVal() are basically the same SVal. It shouldn't be necessary to check both or check whether they're the same; you must have meant to check for something else, probably something purely syntactic.

---

I inferred this by looking at ObjCMethodCall::getInitialStackFrameContents().

Wait, so it's only true for inlined methods. For non-inlined methods getSelfSVal() will be unknown :/

[vsavchenko]

clang/lib/StaticAnalyzer/Checkers/DynamicTypePropagation.cpp

198

Yeah, that might be a bit extraneous to do it with SVals, but this code for sure does its job (it is definitely not a redundant check). getSelfSVal() returns receiver of the function containing the call and not the call itself. So, it does check if we the receiver of the message is self.

I changed it to this way of doing things because it is consistent with how the same thing is done in getRuntimeDefinition.

[NoQ]

clang/lib/StaticAnalyzer/Checkers/DynamicTypePropagation.cpp

198

getSelfSVal() returns receiver of the function containing the call and not the call itself

😱 looks broken to me.

[NoQ]

clang/lib/StaticAnalyzer/Checkers/DynamicTypePropagation.cpp

198

Let's rename getSelfSVal() so that it screamed that it's the callee's self as opposed to the caller's self, and explain in a long comment why do we even care about the caller's self. I.e., that we heuristically assume that if a class method jumps into another class method on the same class object, it's going to be devirtualized to the same class. Which isn't always the case, hence !Precise.

[vsavchenko]

Fix review remarks

clang/lib/StaticAnalyzer/Checkers/DynamicTypePropagation.cpp

198

I don't really think that it's a good idea to mix these two worlds:

• world one - interface function that allows to get an SVal for self of the containing method. It does exactly this, for no specific reason. I'm on board with renaming, but we need to come up with an appropriate name that describes what it gives and not why.
• world two - use-case of this interface method that tries to figure out the type of the receiver (for devirtualization purposes or not).

So, the comment can be only here. I agree, I can add more explanation about what we are doing in this particular piece of code, but it won't make any sense to add this (or similar) comment for getSelfSVal().

clang/lib/StaticAnalyzer/Core/DynamicType.cpp

85–87

Yep, initializer lists are not allowed in ternary operators.

146

Unfortunately, it is named a bit differently for a reason, - compiler couldn't decide which function to use bool isLive(const MemRegion *region) or bool isLive(const VarRegion *VR, bool includeStoreBindings = false) const for a call isLive(VarRegion *) (even though it's pretty obvious). Splitting isLive for VarRegion into two functions doesn't seem like an easy one. The only option I can see is the introduction of isLiveImpl (not very pretty in a header file) and two functions isLive(const VarRegion*) const and isLiveIncludingStoreBindings(const VarRegion *) const.

[NoQ]

Let's land this, I guess? Fantastic work!

clang/lib/StaticAnalyzer/Checkers/DynamicTypePropagation.cpp

198

Ideally i'd detach getSelfSVal() from CallEvent entirely. Like, it doesn't even depend on the call site, why would it be part of CallEvent to begin with? This additionally takes care of world one.

so that it screamed that it's the callee's self as opposed to the caller's self

Mmm, the opposite, of course. getCallerSelfSVal()?

clang/lib/StaticAnalyzer/Core/DynamicType.cpp

146

Or rename isLive(const VarRegion *, bool includeStoreBindings)? (I suspect this function should really be private anyway)

[vsavchenko]

Let's land this, I guess? Fantastic work!

Thanks :-)

clang/lib/StaticAnalyzer/Checkers/DynamicTypePropagation.cpp

198

Where do you think it should be?

My vote goes to location context.

clang/lib/StaticAnalyzer/Core/DynamicType.cpp

146

I don't know about that, it doesn't seem like a good change. I think that all of them should be isLive

[NoQ]

clang/lib/StaticAnalyzer/Checkers/DynamicTypePropagation.cpp

198

As of now LocationContext is an entity so low-level that it doesn't even live in libStaticAnalyzer*, so it can't be made aware of SVals.

Given that it's basically a Store lookup, i'd recommend putting it into ProgramState. I.e., State->getSelfSVal(LCtx);.

[vsavchenko]

Move getSelfSVal from CallEvent to ProgramState

[NoQ]

Perfect! Please get yourself some commit access already -__-

clang/include/clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h

Selector getSelector() const {
     return getOriginExpr()->getSelector();
   }
 
   SourceRange getSourceRange() const override;
 
   /// Returns the value of the receiver at the time of this call.
   SVal getReceiverSVal() const;
 
-  /// Return the value of 'self' if available.
-  SVal getSelfSVal() const;
-
   /// Get the interface for the receiver.
   ///
   /// This works whether this is an instance message or a class message.
   /// However, it currently just uses the static type of the receiver.
   const ObjCInterfaceDecl *getReceiverInterface() const {
     return getOriginExpr()->getReceiverInterface();
   }
 

clang/include/clang/StaticAnalyzer/Core/PathSensitive/DynamicType.h

 
 /// Get dynamic type information for the region \p MR.
 DynamicTypeInfo getDynamicTypeInfo(ProgramStateRef State, const MemRegion *MR);
 
 /// Get raw dynamic type information for the region \p MR.
 const DynamicTypeInfo *getRawDynamicTypeInfo(ProgramStateRef State,
                                              const MemRegion *MR);
 
+/// Get dynamic type information stored in a class object represented by \p Sym.
+DynamicTypeInfo getClassObjectDynamicTypeInfo(ProgramStateRef State,
+                                              SymbolRef Sym);
+
 /// Get dynamic cast information from \p CastFromTy to \p CastToTy of \p MR.
 const DynamicCastInfo *getDynamicCastInfo(ProgramStateRef State,
                                           const MemRegion *MR,
                                           QualType CastFromTy,
                                           QualType CastToTy);
 
 /// Set dynamic type information of the region; return the new state.
 ProgramStateRef setDynamicTypeInfo(ProgramStateRef State, const MemRegion *MR,
                                    DynamicTypeInfo NewTy);
 
 /// Set dynamic type information of the region; return the new state.
 ProgramStateRef setDynamicTypeInfo(ProgramStateRef State, const MemRegion *MR,
                                    QualType NewTy, bool CanBeSubClassed = true);
 
+/// Set constraint on a type contained in a class object; return the new state.
+ProgramStateRef setClassObjectDynamicTypeInfo(ProgramStateRef State,
+                                              SymbolRef Sym,
+                                              DynamicTypeInfo NewTy);
+
+/// Set constraint on a type contained in a class object; return the new state.
+ProgramStateRef setClassObjectDynamicTypeInfo(ProgramStateRef State,
+                                              SymbolRef Sym, QualType NewTy,
+                                              bool CanBeSubClassed = true);
+
 /// Set dynamic type and cast information of the region; return the new state.
 ProgramStateRef setDynamicTypeAndCastInfo(ProgramStateRef State,
                                           const MemRegion *MR,
                                           QualType CastFromTy,
                                           QualType CastToTy,
                                           bool IsCastSucceeds);
 
 /// Removes the dead type informations from \p State.
 ProgramStateRef removeDeadTypes(ProgramStateRef State, SymbolReaper &SR);
 
 /// Removes the dead cast informations from \p State.
 ProgramStateRef removeDeadCasts(ProgramStateRef State, SymbolReaper &SR);
 
+/// Removes the dead Class object type informations from \p State.
+ProgramStateRef removeDeadClassObjectTypes(ProgramStateRef State,
+                                           SymbolReaper &SR);
+
 void printDynamicTypeInfoJson(raw_ostream &Out, ProgramStateRef State,
                               const char *NL = "\n", unsigned int Space = 0,
                               bool IsDot = false);
 
 } // namespace ento
 } // namespace clang
 
 #endif // LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_DYNAMICTYPE_H

clang/include/clang/StaticAnalyzer/Core/PathSensitive/DynamicTypeInfo.h

public:
   bool canBeASubClass() const { return CanBeASubClass; }
 
   /// Returns true if the dynamic type info is available.
   bool isValid() const { return !DynTy.isNull(); }
 
   /// Returns the currently inferred upper bound on the runtime type.
   QualType getType() const { return DynTy; }
 
+  operator bool() const { return isValid(); }
+
   bool operator==(const DynamicTypeInfo &RHS) const {
     return DynTy == RHS.DynTy && CanBeASubClass == RHS.CanBeASubClass;
   }
 
   void Profile(llvm::FoldingSetNodeID &ID) const {
     ID.Add(DynTy);
     ID.AddBoolean(CanBeASubClass);
   }

clang/include/clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h

invalidateRegions(ArrayRef<SVal> Regions, const Expr *E,
                     const CallEvent *Call = nullptr,
                     RegionAndSymbolInvalidationTraits *ITraits = nullptr) const;
 
   /// enterStackFrame - Returns the state for entry to the given stack frame,
   ///  preserving the current state.
   LLVM_NODISCARD ProgramStateRef enterStackFrame(
       const CallEvent &Call, const StackFrameContext *CalleeCtx) const;
 
+  /// Return the value of 'self' if available in the given context.
+  SVal getSelfSVal(const LocationContext *LC) const;
+
   /// Get the lvalue for a base class object reference.
   Loc getLValue(const CXXBaseSpecifier &BaseSpec, const SubRegion *Super) const;
 
   /// Get the lvalue for a base class object reference.
   Loc getLValue(const CXXRecordDecl *BaseClass, const SubRegion *Super,
                 bool IsVirtual) const;
 
   /// Get the lvalue for a variable reference.

clang/lib/StaticAnalyzer/Checkers/CastValueChecker.cpp

 #include "clang/StaticAnalyzer/Core/PathSensitive/DynamicType.h"
 #include "llvm/ADT/Optional.h"
 #include <utility>
 
 using namespace clang;
 using namespace ento;
 
 namespace {
-class CastValueChecker : public Checker<eval::Call> {
+class CastValueChecker : public Checker<check::DeadSymbols, eval::Call> {
   enum class CallKind { Function, Method, InstanceOf };
 
   using CastCheck =
       std::function<void(const CastValueChecker *, const CallEvent &Call,
                          DefinedOrUnknownSVal, CheckerContext &)>;
 
 public:
   // We have five cases to evaluate a cast:
   // 1) The parameter is non-null, the return value is non-null.
   // 2) The parameter is non-null, the return value is null.
   // 3) The parameter is null, the return value is null.
   // cast: 1;  dyn_cast: 1, 2;  cast_or_null: 1, 3;  dyn_cast_or_null: 1, 2, 3.
   //
   // 4) castAs: Has no parameter, the return value is non-null.
   // 5) getAs:  Has no parameter, the return value is null or non-null.
   //
   // We have two cases to check the parameter is an instance of the given type.
   // 1) isa:             The parameter is non-null, returns boolean.
   // 2) isa_and_nonnull: The parameter is null or non-null, returns boolean.
   bool evalCall(const CallEvent &Call, CheckerContext &C) const;
+  void checkDeadSymbols(SymbolReaper &SR, CheckerContext &C) const;
 
 private:
   // These are known in the LLVM project. The pairs are in the following form:
   // {{{namespace, call}, argument-count}, {callback, kind}}
   const CallDescriptionMap<std::pair<CastCheck, CallKind>> CDM = {
       {{{"llvm", "cast"}, 1},
        {&CastValueChecker::evalCast, CallKind::Function}},
       {{{"llvm", "dyn_cast"}, 1},
bool CastValueChecker::evalCall(const CallEvent &Call,
 
   if (!DV)
     return false;
 
   Check(this, Call, *DV, C);
   return true;
 }
 
+void CastValueChecker::checkDeadSymbols(SymbolReaper &SR,
+                                        CheckerContext &C) const {
+  C.addTransition(removeDeadCasts(C.getState(), SR));
+}
+
 void ento::registerCastValueChecker(CheckerManager &Mgr) {
   Mgr.registerChecker<CastValueChecker>();
 }
 
 bool ento::shouldRegisterCastValueChecker(const CheckerManager &mgr) {
   return true;
 }

clang/lib/StaticAnalyzer/Checkers/DynamicTypePropagation.cpp

public:
   void checkPostStmt(const CXXNewExpr *NewE, CheckerContext &C) const;
   void checkDeadSymbols(SymbolReaper &SR, CheckerContext &C) const;
   void checkPreObjCMessage(const ObjCMethodCall &M, CheckerContext &C) const;
   void checkPostObjCMessage(const ObjCMethodCall &M, CheckerContext &C) const;
 
   /// This value is set to true, when the Generics checker is turned on.
   DefaultBool CheckGenerics;
 };
+
+bool isObjCClassType(QualType Type) {
+  if (const auto *PointerType = dyn_cast<ObjCObjectPointerType>(Type)) {
+    return PointerType->getObjectType()->isObjCClass();
+  }
+  return false;
+}
+
+struct RuntimeType {
+  const ObjCObjectType *Type = nullptr;
+  bool Precise = false;
+
+  operator bool() const { return Type != nullptr; }
+};
+
+RuntimeType inferReceiverType(const ObjCMethodCall &Message,
+                              CheckerContext &C) {
+  const ObjCMessageExpr *MessageExpr = Message.getOriginExpr();
+
+  // Check if we can statically infer the actual type precisely.
+  //
+  // 1. Class is written directly in the message:
+  // \code
+  //   [ActualClass classMethod];
+  // \endcode
+  if (MessageExpr->getReceiverKind() == ObjCMessageExpr::Class) {
+    return {MessageExpr->getClassReceiver()->getAs<ObjCObjectType>(),
+            /*Precise=*/true};
+  }
+
+  // 2. Receiver is 'super' from a class method (a.k.a 'super' is a
+  //    class object).
+  // \code
+  //   [super classMethod];
+  // \endcode
+  if (MessageExpr->getReceiverKind() == ObjCMessageExpr::SuperClass) {
+    return {MessageExpr->getSuperType()->getAs<ObjCObjectType>(),
+            /*Precise=*/true};
+  }
+
+  // 3. Receiver is 'super' from an instance method (a.k.a 'super' is an
+  //    instance of a super class).
+  // \code
+  //   [super instanceMethod];
+  // \encode
+  if (MessageExpr->getReceiverKind() == ObjCMessageExpr::SuperInstance) {
+    if (const auto *ObjTy =
+            MessageExpr->getSuperType()->getAs<ObjCObjectPointerType>())
+      return {ObjTy->getObjectType(), /*Precise=*/true};
+  }
+
+  const Expr *RecE = MessageExpr->getInstanceReceiver();
+
+  if (!RecE)
+    return {};
+
+  // Otherwise, let's try to get type information from our estimations of
+  // runtime types.
+  QualType InferredType;
+  SVal ReceiverSVal = C.getSVal(RecE);
+  ProgramStateRef State = C.getState();
+
+  if (const MemRegion *ReceiverRegion = ReceiverSVal.getAsRegion()) {
+    if (DynamicTypeInfo DTI = getDynamicTypeInfo(State, ReceiverRegion)) {
+      InferredType = DTI.getType().getCanonicalType();
+    }
+  }
+
+  if (SymbolRef ReceiverSymbol = ReceiverSVal.getAsSymbol()) {
+    if (InferredType.isNull()) {
+      InferredType = ReceiverSymbol->getType();
+    }
+
+    // If receiver is a Class object, we want to figure out the type it
+    // represents.
+    if (isObjCClassType(InferredType)) {
+      // We actually might have some info on what type is contained in there.
+      if (DynamicTypeInfo DTI =
+              getClassObjectDynamicTypeInfo(State, ReceiverSymbol)) {
+
+        // Types in Class objects can be ONLY Objective-C types
+        return {cast<ObjCObjectType>(DTI.getType()), !DTI.canBeASubClass()};
+      }
+
+      SVal SelfSVal = State->getSelfSVal(C.getLocationContext());
+
+      // Another way we can guess what is in Class object, is when it is a
+      // 'self' variable of the current class method.
+      if (ReceiverSVal == SelfSVal) {
+        // In this case, we should return the type of the enclosing class
+        // declaration.
+        if (const ObjCMethodDecl *MD =
+                dyn_cast<ObjCMethodDecl>(C.getStackFrame()->getDecl()))
+          if (const ObjCObjectType *ObjTy = dyn_cast<ObjCObjectType>(
+                  MD->getClassInterface()->getTypeForDecl()))
+            return {ObjTy};
+      }
+    }
+  }
+
+  // Unfortunately, it seems like we have no idea what that type is.
+  if (InferredType.isNull()) {
+    return {};
+  }
+
+  // We can end up here if we got some dynamic type info and the
+  // receiver is not one of the known Class objects.
+  if (const auto *ReceiverInferredType =
+          dyn_cast<ObjCObjectPointerType>(InferredType)) {
+    return {ReceiverInferredType->getObjectType()};
+  }
+
+  // Any other type (like 'Class') is not really useful at this point.
+  return {};
+}
 } // end anonymous namespace
 
 void DynamicTypePropagation::checkDeadSymbols(SymbolReaper &SR,
                                               CheckerContext &C) const {
   ProgramStateRef State = removeDeadTypes(C.getState(), SR);
+  State = removeDeadClassObjectTypes(State, SR);
 
   MostSpecializedTypeArgsMapTy TyArgMap =
       State->get<MostSpecializedTypeArgsMap>();
   for (MostSpecializedTypeArgsMapTy::iterator I = TyArgMap.begin(),
                                               E = TyArgMap.end();
        I != E; ++I) {
     if (SR.isDead(I->first)) {
       State = State->remove<MostSpecializedTypeArgsMap>(I->first);
if (D && D->hasRelatedResultType()) {
         break;
 
       // We assume that the type of the object returned by alloc and new are the
       // pointer to the object of the class specified in the receiver of the
       // message.
       case OMF_alloc:
       case OMF_new: {
         // Get the type of object that will get created.
-        const ObjCMessageExpr *MsgE = Msg->getOriginExpr();
-        const ObjCObjectType *ObjTy = getObjectTypeForAllocAndNew(MsgE, C);
+        RuntimeType ObjTy = inferReceiverType(*Msg, C);
+
         if (!ObjTy)
           return;
+
         QualType DynResTy =
-                 C.getASTContext().getObjCObjectPointerType(QualType(ObjTy, 0));
+            C.getASTContext().getObjCObjectPointerType(QualType(ObjTy.Type, 0));
+        // We used to assume that whatever type we got from inferring the
+        // type is actually precise (and it is not exactly correct).
+        // A big portion of the existing behavior depends on that assumption
+        // (e.g. certain inlining won't take place). For this reason, we don't
+        // use ObjTy.Precise flag here.
+        //
+        // TODO: We should mitigate this problem some time in the future
+        // and replace hardcoded 'false' with '!ObjTy.Precise'.
         C.addTransition(setDynamicTypeInfo(State, RetReg, DynResTy, false));
         break;
       }
       case OMF_init: {
         // Assume, the result of the init method has the same dynamic type as
         // the receiver and propagate the dynamic type info.
         const MemRegion *RecReg = Msg->getReceiverSVal().getAsRegion();
         if (!RecReg)
void DynamicTypePropagation::checkPostStmt(const CXXNewExpr *NewE,
   const MemRegion *MR = C.getSVal(NewE).getAsRegion();
   if (!MR)
     return;
 
   C.addTransition(setDynamicTypeInfo(C.getState(), MR, NewE->getType(),
                                      /*CanBeSubClassed=*/false));
 }
 
-const ObjCObjectType *
-DynamicTypePropagation::getObjectTypeForAllocAndNew(const ObjCMessageExpr *MsgE,
-                                                    CheckerContext &C) const {
-  if (MsgE->getReceiverKind() == ObjCMessageExpr::Class) {
-    if (const ObjCObjectType *ObjTy
-          = MsgE->getClassReceiver()->getAs<ObjCObjectType>())
-    return ObjTy;
-  }
-
-  if (MsgE->getReceiverKind() == ObjCMessageExpr::SuperClass) {
-    if (const ObjCObjectType *ObjTy
-          = MsgE->getSuperType()->getAs<ObjCObjectType>())
-      return ObjTy;
-  }
-
-  const Expr *RecE = MsgE->getInstanceReceiver();
-  if (!RecE)
-    return nullptr;
-
-  RecE= RecE->IgnoreParenImpCasts();
-  if (const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(RecE)) {
-    const StackFrameContext *SFCtx = C.getStackFrame();
-    // Are we calling [self alloc]? If this is self, get the type of the
-    // enclosing ObjC class.
-    if (DRE->getDecl() == SFCtx->getSelfDecl()) {
-      if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(SFCtx->getDecl()))
-        if (const ObjCObjectType *ObjTy =
-            dyn_cast<ObjCObjectType>(MD->getClassInterface()->getTypeForDecl()))
-          return ObjTy;
-    }
-  }
-  return nullptr;
-}
-
 // Return a better dynamic type if one can be derived from the cast.
 // Compare the current dynamic type of the region and the new type to which we
 // are casting. If the new type is lower in the inheritance hierarchy, pick it.
 const ObjCObjectPointerType *
 DynamicTypePropagation::getBetterObjCType(const Expr *CastE,
                                           CheckerContext &C) const {
   const MemRegion *ToR = C.getSVal(CastE).getAsRegion();
   assert(ToR);
void DynamicTypePropagation::checkPostObjCMessage(const ObjCMethodCall &M,
   const ObjCMessageExpr *MessageExpr = M.getOriginExpr();
 
   SymbolRef RetSym = M.getReturnValue().getAsSymbol();
   if (!RetSym)
     return;
 
   Selector Sel = MessageExpr->getSelector();
   ProgramStateRef State = C.getState();
-  // Inference for class variables.
-  // We are only interested in cases where the class method is invoked on a
-  // class. This method is provided by the runtime and available on all classes.
-  if (MessageExpr->getReceiverKind() == ObjCMessageExpr::Class &&
-      Sel.getAsString() == "class") {
-    QualType ReceiverType = MessageExpr->getClassReceiver();
-    const auto *ReceiverClassType = ReceiverType->castAs<ObjCObjectType>();
-    if (!ReceiverClassType->isSpecialized())
-      return;
 
+  // Here we try to propagate information on Class objects.
+  if (Sel.getAsString() == "class") {
+    // We try to figure out the type from the receiver of the 'class' message.
+    if (RuntimeType ReceiverRuntimeType = inferReceiverType(M, C)) {
+
+      ReceiverRuntimeType.Type->getSuperClassType();
+      QualType ReceiverClassType(ReceiverRuntimeType.Type, 0);
+
+      // We want to consider only precise information on generics.
+      if (ReceiverRuntimeType.Type->isSpecialized() &&
+          ReceiverRuntimeType.Precise) {
         QualType ReceiverClassPointerType =
-        C.getASTContext().getObjCObjectPointerType(
-            QualType(ReceiverClassType, 0));
+            C.getASTContext().getObjCObjectPointerType(ReceiverClassType);
         const auto *InferredType =
             ReceiverClassPointerType->castAs<ObjCObjectPointerType>();
-
         State = State->set<MostSpecializedTypeArgsMap>(RetSym, InferredType);
+      }
+
+      // Constrain the resulting class object to the inferred type.
+      State = setClassObjectDynamicTypeInfo(State, RetSym, ReceiverClassType,
+                                            !ReceiverRuntimeType.Precise);
+
       C.addTransition(State);
       return;
     }
+  }
+
+  if (Sel.getAsString() == "superclass") {
+    // We try to figure out the type from the receiver of the 'superclass'
+    // message.
+    if (RuntimeType ReceiverRuntimeType = inferReceiverType(M, C)) {
+
+      // Result type would be a super class of the receiver's type.
+      QualType ReceiversSuperClass =
+          ReceiverRuntimeType.Type->getSuperClassType();
+
+      // Check if it really had super class.
+      //
+      // TODO: we can probably pay closer attention to cases when the class
+      // object can be 'nil' as the result of such message.
+      if (!ReceiversSuperClass.isNull()) {
+        // Constrain the resulting class object to the inferred type.
+        State = setClassObjectDynamicTypeInfo(
+            State, RetSym, ReceiversSuperClass, !ReceiverRuntimeType.Precise);
+
+        C.addTransition(State);
+      }
+      return;
+    }
+  }
 
   // Tracking for return types.
   SymbolRef RecSym = M.getReceiverSVal().getAsSymbol();
   if (!RecSym)
     return;
 
   const ObjCObjectPointerType *const *TrackedType =
       State->get<MostSpecializedTypeArgsMap>(RecSym);

clang/lib/StaticAnalyzer/Checkers/ObjCSuperDeallocChecker.cpp

 
 void ObjCSuperDeallocChecker::checkPostObjCMessage(const ObjCMethodCall &M,
                                                    CheckerContext &C) const {
   // Check for [super dealloc] method call.
   if (!isSuperDeallocMessage(M))
     return;
 
   ProgramStateRef State = C.getState();
-  SymbolRef ReceiverSymbol = M.getSelfSVal().getAsSymbol();
-  assert(ReceiverSymbol && "No receiver symbol at call to [super dealloc]?");
+  const LocationContext *LC = C.getLocationContext();
+  SymbolRef SelfSymbol = State->getSelfSVal(LC).getAsSymbol();
+  assert(SelfSymbol && "No receiver symbol at call to [super dealloc]?");
 
   // We add this transition in checkPostObjCMessage to avoid warning when
   // we inline a call to [super dealloc] where the inlined call itself
   // calls [super dealloc].
-  State = State->add<CalledSuperDealloc>(ReceiverSymbol);
+  State = State->add<CalledSuperDealloc>(SelfSymbol);
   C.addTransition(State);
 }
 
 void ObjCSuperDeallocChecker::checkLocation(SVal L, bool IsLoad, const Stmt *S,
                                   CheckerContext &C) const {
   SymbolRef BaseSym = L.getLocSymbolInBase();
   if (!BaseSym)
     return;

clang/lib/StaticAnalyzer/Core/CallEvent.cpp

if (const ObjCIvarDecl *PropIvar = PropDecl->getPropertyIvarDecl()) {
       }
       return;
     }
   }
 
   Values.push_back(getReceiverSVal());
 }
 
-SVal ObjCMethodCall::getSelfSVal() const {
-  const LocationContext *LCtx = getLocationContext();
-  const ImplicitParamDecl *SelfDecl = LCtx->getSelfDecl();
-  if (!SelfDecl)
-    return SVal();
-  return getState()->getSVal(getState()->getRegion(SelfDecl, LCtx));
-}
-
 SVal ObjCMethodCall::getReceiverSVal() const {
   // FIXME: Is this the best way to handle class receivers?
   if (!isInstanceMessage())
     return UnknownVal();
 
   if (const Expr *RecE = getOriginExpr()->getInstanceReceiver())
     return getSVal(RecE);
 
   // An instance message with no expression means we are sending to super.
   // In this case the object reference is the same as 'self'.
   assert(getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperInstance);
-  SVal SelfVal = getSelfSVal();
+  SVal SelfVal = getState()->getSelfSVal(getLocationContext());
   assert(SelfVal.isValid() && "Calling super but not in ObjC method");
   return SelfVal;
 }
 
 bool ObjCMethodCall::isReceiverSelfOrSuper() const {
   if (getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperInstance ||
       getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperClass)
       return true;
 
   if (!isInstanceMessage())
     return false;
 
   SVal RecVal = getSVal(getOriginExpr()->getInstanceReceiver());
+  SVal SelfVal = getState()->getSelfSVal(getLocationContext());
 
-  return (RecVal == getSelfSVal());
+  return (RecVal == SelfVal);
 }
 
 SourceRange ObjCMethodCall::getSourceRange() const {
   switch (getMessageKind()) {
   case OCM_Message:
     return getOriginExpr()->getSourceRange();
   case OCM_PropertyAccess:
   case OCM_Subscript:
static const ObjCMethodDecl *findDefiningRedecl(const ObjCMethodDecl *MD) {
   if (!MD->hasBody()) {
     for (auto I : MD->redecls())
       if (I->hasBody())
         MD = cast<ObjCMethodDecl>(I);
   }
   return MD;
 }
 
-static bool isCallToSelfClass(const ObjCMessageExpr *ME) {
-  const Expr* InstRec = ME->getInstanceReceiver();
-  if (!InstRec)
-    return false;
-  const auto *InstRecIg = dyn_cast<DeclRefExpr>(InstRec->IgnoreParenImpCasts());
+struct PrivateMethodKey {
+  const ObjCInterfaceDecl *Interface;
+  Selector LookupSelector;
+  bool IsClassMethod;
+};
 
-  // Check that receiver is called 'self'.
-  if (!InstRecIg || !InstRecIg->getFoundDecl() ||
-      !InstRecIg->getFoundDecl()->getName().equals("self"))
-    return false;
+template <> struct llvm::DenseMapInfo<PrivateMethodKey> {
+  using InterfaceInfo = DenseMapInfo<const ObjCInterfaceDecl *>;
+  using SelectorInfo = DenseMapInfo<Selector>;
 
-  // Check that the method name is 'class'.
-  if (ME->getSelector().getNumArgs() != 0 ||
-      !ME->getSelector().getNameForSlot(0).equals("class"))
-    return false;
+  static inline PrivateMethodKey getEmptyKey() {
+    return {InterfaceInfo::getEmptyKey(), SelectorInfo::getEmptyKey(), false};
+  }
 
-  return true;
+  static inline PrivateMethodKey getTombstoneKey() {
+    return {InterfaceInfo::getTombstoneKey(), SelectorInfo::getTombstoneKey(),
+            true};
+  }
+
+  static unsigned getHashValue(const PrivateMethodKey &Key) {
+    return llvm::hash_combine(
+        llvm::hash_code(InterfaceInfo::getHashValue(Key.Interface)),
+        llvm::hash_code(SelectorInfo::getHashValue(Key.LookupSelector)),
+        Key.IsClassMethod);
+  }
+
+  static bool isEqual(const PrivateMethodKey &LHS,
+                      const PrivateMethodKey &RHS) {
+    return InterfaceInfo::isEqual(LHS.Interface, RHS.Interface) &&
+           SelectorInfo::isEqual(LHS.LookupSelector, RHS.LookupSelector) &&
+           LHS.IsClassMethod == RHS.IsClassMethod;
+  }
+};
+
+const ObjCMethodDecl *
+lookupRuntimeDefinition(const ObjCInterfaceDecl *Interface,
+                        Selector LookupSelector, bool InstanceMethod) {
+  // Repeatedly calling lookupPrivateMethod() is expensive, especially
+  // when in many cases it returns null.  We cache the results so
+  // that repeated queries on the same ObjCIntefaceDecl and Selector
+  // don't incur the same cost.  On some test cases, we can see the
+  // same query being issued thousands of times.
+  //
+  // NOTE: This cache is essentially a "global" variable, but it
+  // only gets lazily created when we get here.  The value of the
+  // cache probably comes from it being global across ExprEngines,
+  // where the same queries may get issued.  If we are worried about
+  // concurrency, or possibly loading/unloading ASTs, etc., we may
+  // need to revisit this someday.  In terms of memory, this table
+  // stays around until clang quits, which also may be bad if we
+  // need to release memory.
+  using PrivateMethodCache =
+      llvm::DenseMap<PrivateMethodKey, Optional<const ObjCMethodDecl *>>;
+
+  static PrivateMethodCache PMC;
+  Optional<const ObjCMethodDecl *> &Val =
+      PMC[{Interface, LookupSelector, InstanceMethod}];
+
+  // Query lookupPrivateMethod() if the cache does not hit.
+  if (!Val.hasValue()) {
+    Val = Interface->lookupPrivateMethod(LookupSelector, InstanceMethod);
+
+    if (!*Val) {
+      // Query 'lookupMethod' as a backup.
+      Val = Interface->lookupMethod(LookupSelector, InstanceMethod);
+    }
+  }
+
+  return Val.getValue();
 }
 
 RuntimeDefinition ObjCMethodCall::getRuntimeDefinition() const {
   const ObjCMessageExpr *E = getOriginExpr();
   assert(E);
   Selector Sel = E->getSelector();
 
   if (E->isInstanceMessage()) {
     // Find the receiver type.
-    const ObjCObjectPointerType *ReceiverT = nullptr;
+    const ObjCObjectType *ReceiverT = nullptr;
     bool CanBeSubClassed = false;
+    bool LookingForInstanceMethod = true;
     QualType SupersType = E->getSuperType();
     const MemRegion *Receiver = nullptr;
 
     if (!SupersType.isNull()) {
       // The receiver is guaranteed to be 'super' in this case.
       // Super always means the type of immediate predecessor to the method
       // where the call occurs.
-      ReceiverT = cast<ObjCObjectPointerType>(SupersType);
+      ReceiverT = cast<ObjCObjectPointerType>(SupersType)->getObjectType();
     } else {
       Receiver = getReceiverSVal().getAsRegion();
       if (!Receiver)
         return {};
 
       DynamicTypeInfo DTI = getDynamicTypeInfo(getState(), Receiver);
       if (!DTI.isValid()) {
         assert(isa<AllocaRegion>(Receiver) &&
                "Unhandled untyped region class!");
         return {};
       }
 
       QualType DynType = DTI.getType();
       CanBeSubClassed = DTI.canBeASubClass();
-      ReceiverT = dyn_cast<ObjCObjectPointerType>(DynType.getCanonicalType());
 
-      if (ReceiverT && CanBeSubClassed)
-        if (ObjCInterfaceDecl *IDecl = ReceiverT->getInterfaceDecl())
-          if (!canBeOverridenInSubclass(IDecl, Sel))
-            CanBeSubClassed = false;
-    }
+      const auto *ReceiverDynT =
+          dyn_cast<ObjCObjectPointerType>(DynType.getCanonicalType());
 
-    // Handle special cases of '[self classMethod]' and
-    // '[[self class] classMethod]', which are treated by the compiler as
-    // instance (not class) messages. We will statically dispatch to those.
-    if (auto *PT = dyn_cast_or_null<ObjCObjectPointerType>(ReceiverT)) {
-      // For [self classMethod], return the compiler visible declaration.
-      if (PT->getObjectType()->isObjCClass() &&
-          Receiver == getSelfSVal().getAsRegion())
-        return RuntimeDefinition(findDefiningRedecl(E->getMethodDecl()));
+      if (ReceiverDynT) {
+        ReceiverT = ReceiverDynT->getObjectType();
 
-      // Similarly, handle [[self class] classMethod].
-      // TODO: We are currently doing a syntactic match for this pattern with is
-      // limiting as the test cases in Analysis/inlining/InlineObjCClassMethod.m
-      // shows. A better way would be to associate the meta type with the symbol
-      // using the dynamic type info tracking and use it here. We can add a new
-      // SVal for ObjC 'Class' values that know what interface declaration they
-      // come from. Then 'self' in a class method would be filled in with
-      // something meaningful in ObjCMethodCall::getReceiverSVal() and we could
-      // do proper dynamic dispatch for class methods just like we do for
-      // instance methods now.
-      if (E->getInstanceReceiver())
-        if (const auto *M = dyn_cast<ObjCMessageExpr>(E->getInstanceReceiver()))
-          if (isCallToSelfClass(M))
+        // It can be actually class methods called with Class object as a
+        // receiver. This type of messages is treated by the compiler as
+        // instance (not class).
+        if (ReceiverT->isObjCClass()) {
+
+          SVal SelfVal = getState()->getSelfSVal(getLocationContext());
+          // For [self classMethod], return compiler visible declaration.
+          if (Receiver == SelfVal.getAsRegion()) {
             return RuntimeDefinition(findDefiningRedecl(E->getMethodDecl()));
           }
 
-    // Lookup the instance method implementation.
-    if (ReceiverT)
-      if (ObjCInterfaceDecl *IDecl = ReceiverT->getInterfaceDecl()) {
-        // Repeatedly calling lookupPrivateMethod() is expensive, especially
-        // when in many cases it returns null.  We cache the results so
-        // that repeated queries on the same ObjCIntefaceDecl and Selector
-        // don't incur the same cost.  On some test cases, we can see the
-        // same query being issued thousands of times.
-        //
-        // NOTE: This cache is essentially a "global" variable, but it
-        // only gets lazily created when we get here.  The value of the
-        // cache probably comes from it being global across ExprEngines,
-        // where the same queries may get issued.  If we are worried about
-        // concurrency, or possibly loading/unloading ASTs, etc., we may
-        // need to revisit this someday.  In terms of memory, this table
-        // stays around until clang quits, which also may be bad if we
-        // need to release memory.
-        using PrivateMethodKey = std::pair<const ObjCInterfaceDecl *, Selector>;
-        using PrivateMethodCache =
-            llvm::DenseMap<PrivateMethodKey, Optional<const ObjCMethodDecl *>>;
-
-        static PrivateMethodCache PMC;
-        Optional<const ObjCMethodDecl *> &Val = PMC[std::make_pair(IDecl, Sel)];
-
-        // Query lookupPrivateMethod() if the cache does not hit.
-        if (!Val.hasValue()) {
-          Val = IDecl->lookupPrivateMethod(Sel);
+          // Otherwise, let's check if we know something about the type
+          // inside of this class object.
+          if (SymbolRef ReceiverSym = getReceiverSVal().getAsSymbol()) {
+            DynamicTypeInfo DTI =
+                getClassObjectDynamicTypeInfo(getState(), ReceiverSym);
+            if (DTI.isValid()) {
+              // Let's use this type for lookup.
+              ReceiverT =
+                  cast<ObjCObjectType>(DTI.getType().getCanonicalType());
 
-          // If the method is a property accessor, we should try to "inline" it
-          // even if we don't actually have an implementation.
-          if (!*Val)
-            if (const ObjCMethodDecl *CompileTimeMD = E->getMethodDecl())
-              if (CompileTimeMD->isPropertyAccessor()) {
-                if (!CompileTimeMD->getSelfDecl() &&
-                    isa<ObjCCategoryDecl>(CompileTimeMD->getDeclContext())) {
-                  // If the method is an accessor in a category, and it doesn't
-                  // have a self declaration, first
-                  // try to find the method in a class extension. This
-                  // works around a bug in Sema where multiple accessors
-                  // are synthesized for properties in class
-                  // extensions that are redeclared in a category and the
-                  // the implicit parameters are not filled in for
-                  // the method on the category.
-                  // This ensures we find the accessor in the extension, which
-                  // has the implicit parameters filled in.
-                  auto *ID = CompileTimeMD->getClassInterface();
-                  for (auto *CatDecl : ID->visible_extensions()) {
-                    Val = CatDecl->getMethod(Sel,
-                                             CompileTimeMD->isInstanceMethod());
-                    if (*Val)
-                      break;
-                  }
-                }
-                if (!*Val)
-                  Val = IDecl->lookupInstanceMethod(Sel);
-              }
-        }
+              CanBeSubClassed = DTI.canBeASubClass();
+              // And it should be a class method instead.
+              LookingForInstanceMethod = false;
+            }
+
+        if (CanBeSubClassed)
+          if (ObjCInterfaceDecl *IDecl = ReceiverT->getInterface())
+            // Even if `DynamicTypeInfo` told us that it can be
+            // not necessarily this type, but its descendants, we still want
+            // to check again if this selector can be actually overridden.
+            CanBeSubClassed = canBeOverridenInSubclass(IDecl, Sel);
 
-        const ObjCMethodDecl *MD = Val.getValue();
+    // Lookup the instance method implementation.
+    if (ReceiverT)
+      if (ObjCInterfaceDecl *IDecl = ReceiverT->getInterface()) {
+        const ObjCMethodDecl *MD =
+            lookupRuntimeDefinition(IDecl, Sel, LookingForInstanceMethod);
+
         if (MD && !MD->hasBody())
           MD = MD->getCanonicalDecl();
+
         if (CanBeSubClassed)
           return RuntimeDefinition(MD, Receiver);
         else
           return RuntimeDefinition(MD, nullptr);
       }
   } else {
     // This is a class method.
     // If we have type info for the receiver class, we are calling via

clang/lib/StaticAnalyzer/Core/DynamicType.cpp

 
 /// A set factory of dynamic cast informations.
 REGISTER_SET_FACTORY_WITH_PROGRAMSTATE(CastSet, clang::ento::DynamicCastInfo)
 
 /// A map from symbols to cast informations.
 REGISTER_MAP_WITH_PROGRAMSTATE(DynamicCastMap, const clang::ento::MemRegion *,
                                CastSet)
 
+// A map from Class object symbols to the most likely pointed-to type.
+REGISTER_MAP_WITH_PROGRAMSTATE(DynamicClassObjectMap, clang::ento::SymbolRef,
+                               clang::ento::DynamicTypeInfo)
+
 namespace clang {
 namespace ento {
 
 DynamicTypeInfo getDynamicTypeInfo(ProgramStateRef State, const MemRegion *MR) {
   MR = MR->StripCasts();
 
   // Look up the dynamic type in the GDM.
   if (const DynamicTypeInfo *DTI = State->get<DynamicTypeMap>(MR))
const DynamicCastInfo *getDynamicCastInfo(ProgramStateRef State,
 
   for (const DynamicCastInfo &Cast : *Lookup)
     if (Cast.equals(CastFromTy, CastToTy))
       return &Cast;
 
   return nullptr;
 }
 
+DynamicTypeInfo getClassObjectDynamicTypeInfo(ProgramStateRef State,
+                                              SymbolRef Sym) {
+  const DynamicTypeInfo *DTI = State->get<DynamicClassObjectMap>(Sym);
+  return DTI ? *DTI : DynamicTypeInfo{};
+}
+
 ProgramStateRef setDynamicTypeInfo(ProgramStateRef State, const MemRegion *MR,
                                    DynamicTypeInfo NewTy) {
   State = State->set<DynamicTypeMap>(MR->StripCasts(), NewTy);
   assert(State);
   return State;
 }
 
 ProgramStateRef setDynamicTypeInfo(ProgramStateRef State, const MemRegion *MR,
ProgramStateRef setDynamicTypeAndCastInfo(ProgramStateRef State,
 
   Set = F.add(Set, {CastFromTy, CastToTy, ResultKind});
   State = State->set<DynamicCastMap>(MR, Set);
 
   assert(State);
   return State;
 }
 
+ProgramStateRef setClassObjectDynamicTypeInfo(ProgramStateRef State,
+                                              SymbolRef Sym,
+                                              DynamicTypeInfo NewTy) {
+  State = State->set<DynamicClassObjectMap>(Sym, NewTy);
+  return State;
+}
+
+ProgramStateRef setClassObjectDynamicTypeInfo(ProgramStateRef State,
+                                              SymbolRef Sym, QualType NewTy,
+                                              bool CanBeSubClassed) {
+  return setClassObjectDynamicTypeInfo(State, Sym,
+                                       DynamicTypeInfo(NewTy, CanBeSubClassed));
+}
+
+static bool isLive(SymbolReaper &SR, const MemRegion *MR) {
+  return SR.isLiveRegion(MR);
+}
+
+static bool isLive(SymbolReaper &SR, SymbolRef Sym) { return SR.isLive(Sym); }
+
 template <typename MapTy>
-ProgramStateRef removeDead(ProgramStateRef State, const MapTy &Map,
-                           SymbolReaper &SR) {
+static ProgramStateRef removeDeadImpl(ProgramStateRef State, SymbolReaper &SR) {
+  const auto &Map = State->get<MapTy>();
+
   for (const auto &Elem : Map)
-    if (!SR.isLiveRegion(Elem.first))
-      State = State->remove<DynamicCastMap>(Elem.first);
+    if (!isLive(SR, Elem.first))
+      State = State->remove<MapTy>(Elem.first);
 
   return State;
 }
 
 ProgramStateRef removeDeadTypes(ProgramStateRef State, SymbolReaper &SR) {
-  return removeDead(State, State->get<DynamicTypeMap>(), SR);
+  return removeDeadImpl<DynamicTypeMap>(State, SR);
 }
 
 ProgramStateRef removeDeadCasts(ProgramStateRef State, SymbolReaper &SR) {
-  return removeDead(State, State->get<DynamicCastMap>(), SR);
+  return removeDeadImpl<DynamicCastMap>(State, SR);
 }
 
-static void printDynamicTypesJson(raw_ostream &Out, ProgramStateRef State,
-                                  const char *NL, unsigned int Space,
-                                  bool IsDot) {
-  Indent(Out, Space, IsDot) << "\"dynamic_types\": ";
+ProgramStateRef removeDeadClassObjectTypes(ProgramStateRef State,
+                                           SymbolReaper &SR) {
+  return removeDeadImpl<DynamicClassObjectMap>(State, SR);
+}
 
-  const DynamicTypeMapTy &Map = State->get<DynamicTypeMap>();
-  if (Map.isEmpty()) {
-    Out << "null," << NL;
-    return;
-  }
+//===----------------------------------------------------------------------===//
+//               Implementation of the 'printer-to-JSON' function
+//===----------------------------------------------------------------------===//
+
+static raw_ostream &printJson(const MemRegion *Region, raw_ostream &Out,
+                              const char *NL, unsigned int Space, bool IsDot) {
+  return Out << "\"region\": \"" << Region << "\"";
 
-  ++Space;
-  Out << '[' << NL;
-  for (DynamicTypeMapTy::iterator I = Map.begin(); I != Map.end(); ++I) {
-    const MemRegion *MR = I->first;
-    const DynamicTypeInfo &DTI = I->second;
-    Indent(Out, Space, IsDot)
-        << "{ \"region\": \"" << MR << "\", \"dyn_type\": ";
-    if (!DTI.isValid()) {
-      Out << "null";
-    } else {
-      Out << '\"' << DTI.getType()->getPointeeType().getAsString()
-          << "\", \"sub_classable\": "
-          << (DTI.canBeASubClass() ? "true" : "false");
-    }
-    Out << " }";
-
-    if (std::next(I) != Map.end())
-      Out << ',';
-    Out << NL;
-  }
+static raw_ostream &printJson(const SymExpr *Symbol, raw_ostream &Out,
+                              const char *NL, unsigned int Space, bool IsDot) {
+  return Out << "\"symbol\": \"" << Symbol << "\"";
+}
+
+static raw_ostream &printJson(const DynamicTypeInfo &DTI, raw_ostream &Out,
+                              const char *NL, unsigned int Space, bool IsDot) {
+  Out << "\"dyn_type\": ";
+    QualType ToPrint = DTI.getType();
+    if (ToPrint->isAnyPointerType())
+      ToPrint = ToPrint->getPointeeType();
+
+    Out << '\"' << ToPrint.getAsString() << "\", \"sub_classable\": "
+  return Out;
 
-  --Space;
-  Indent(Out, Space, IsDot) << "]," << NL;
+static raw_ostream &printJson(const DynamicCastInfo &DCI, raw_ostream &Out,
+                              const char *NL, unsigned int Space, bool IsDot) {
+  return Out << "\"from\": \"" << DCI.from().getAsString() << "\", \"to\": \""
+             << DCI.to().getAsString() << "\", \"kind\": \""
+             << (DCI.succeeds() ? "success" : "fail") << "\"";
 }
 
-static void printDynamicCastsJson(raw_ostream &Out, ProgramStateRef State,
-                                  const char *NL, unsigned int Space,
-                                  bool IsDot) {
-  Indent(Out, Space, IsDot) << "\"dynamic_casts\": ";
+template <class T, class U>
+static raw_ostream &printJson(const std::pair<T, U> &Pair, raw_ostream &Out,
+                              const char *NL, unsigned int Space, bool IsDot) {
+  printJson(Pair.first, Out, NL, Space, IsDot) << ", ";
+  return printJson(Pair.second, Out, NL, Space, IsDot);
+}
 
-  const DynamicCastMapTy &Map = State->get<DynamicCastMap>();
-  if (Map.isEmpty()) {
-    Out << "null," << NL;
-    return;
+template <class ContainerTy>
+static raw_ostream &printJsonContainer(const ContainerTy &Container,
+                                       raw_ostream &Out, const char *NL,
+                                       unsigned int Space, bool IsDot) {
+  if (Container.isEmpty()) {
+    return Out << "null";
   }
 
   ++Space;
   Out << '[' << NL;
-  for (DynamicCastMapTy::iterator I = Map.begin(); I != Map.end(); ++I) {
-    const MemRegion *MR = I->first;
-    const CastSet &Set = I->second;
+  for (auto I = Container.begin(); I != Container.end(); ++I) {
+    const auto &Element = *I;
 
-    Indent(Out, Space, IsDot) << "{ \"region\": \"" << MR << "\", \"casts\": ";
-    if (Set.isEmpty()) {
-      Out << "null ";
-    } else {
-      ++Space;
-      Out << '[' << NL;
-      for (CastSet::iterator SI = Set.begin(); SI != Set.end(); ++SI) {
-        Indent(Out, Space, IsDot)
-            << "{ \"from\": \"" << SI->from().getAsString() << "\", \"to\": \""
-            << SI->to().getAsString() << "\", \"kind\": \""
-            << (SI->succeeds() ? "success" : "fail") << "\" }";
+    Indent(Out, Space, IsDot) << "{ ";
+    printJson(Element, Out, NL, Space, IsDot) << " }";
 
-        if (std::next(SI) != Set.end())
-          Out << ',';
-        Out << NL;
-      }
-      --Space;
-      Indent(Out, Space, IsDot) << ']';
-    }
-    Out << '}';
+    if (std::next(I) != Container.end())
+
+  return Indent(Out, Space, IsDot) << "]";
 
-    if (std::next(I) != Map.end())
-      Out << ',';
-    Out << NL;
-  }
+static raw_ostream &printJson(const CastSet &Set, raw_ostream &Out,
+                              const char *NL, unsigned int Space, bool IsDot) {
+  Out << "\"casts\": ";
+  return printJsonContainer(Set, Out, NL, Space, IsDot);
 
-  --Space;
-  Indent(Out, Space, IsDot) << "]," << NL;
+template <class MapTy>
+static void printJsonImpl(raw_ostream &Out, ProgramStateRef State,
+                          const char *Name, const char *NL, unsigned int Space,
+                          bool IsDot, bool PrintEvenIfEmpty = true) {
+  const auto &Map = State->get<MapTy>();
+  if (Map.isEmpty() && !PrintEvenIfEmpty)
+    return;
+
+  Indent(Out, Space, IsDot) << "\"" << Name << "\": ";
+  printJsonContainer(Map, Out, NL, Space, IsDot) << "," << NL;
+}
+
+static void printDynamicTypesJson(raw_ostream &Out, ProgramStateRef State,
+                                  const char *NL, unsigned int Space,
+                                  bool IsDot) {
+  printJsonImpl<DynamicTypeMap>(Out, State, "dynamic_types", NL, Space, IsDot);
+}
+
+static void printDynamicCastsJson(raw_ostream &Out, ProgramStateRef State,
+                                  const char *NL, unsigned int Space,
+                                  bool IsDot) {
+  printJsonImpl<DynamicCastMap>(Out, State, "dynamic_casts", NL, Space, IsDot);
+}
+
+static void printClassObjectDynamicTypesJson(raw_ostream &Out,
+                                             ProgramStateRef State,
+                                             const char *NL, unsigned int Space,
+                                             bool IsDot) {
+  // Let's print Class object type information only if we have something
+  // meaningful to print.
+  printJsonImpl<DynamicClassObjectMap>(Out, State, "class_object_types", NL,
+                                       Space, IsDot,
+                                       /*PrintEvenIfEmpty=*/false);
 }
 
 void printDynamicTypeInfoJson(raw_ostream &Out, ProgramStateRef State,
                               const char *NL, unsigned int Space, bool IsDot) {
   printDynamicTypesJson(Out, State, NL, Space, IsDot);
   printDynamicCastsJson(Out, State, NL, Space, IsDot);
+  printClassObjectDynamicTypesJson(Out, State, NL, Space, IsDot);
 }
 
 } // namespace ento
 } // namespace clang

clang/lib/StaticAnalyzer/Core/ProgramState.cpp

 ProgramStateRef
 ProgramState::enterStackFrame(const CallEvent &Call,
                               const StackFrameContext *CalleeCtx) const {
   const StoreRef &NewStore =
     getStateManager().StoreMgr->enterStackFrame(getStore(), Call, CalleeCtx);
   return makeWithStore(NewStore);
 }
 
+SVal ProgramState::getSelfSVal(const LocationContext *LCtx) const {
+  const ImplicitParamDecl *SelfDecl = LCtx->getSelfDecl();
+  if (!SelfDecl)
+    return SVal();
+  return getSVal(getRegion(SelfDecl, LCtx));
+}
+
 SVal ProgramState::getSValAsScalarOrLoc(const MemRegion *R) const {
   // We only want to do fetches from regions that we can actually bind
   // values.  For example, SymbolicRegions of type 'id<...>' cannot
   // have direct bindings (but their can be bindings on their subregions).
   if (!R->isBoundable())
     return UnknownVal();
 
   if (const TypedValueRegion *TR = dyn_cast<TypedValueRegion>(R)) {

clang/test/Analysis/cast-value-state-dump.cpp

void evalNonNullParamNonNullReturn(const Shape *S) {
 
   // CHECK:      "dynamic_types": [
   // CHECK-NEXT:   { "region": "SymRegion{reg_$0<const struct clang::Shape * S>}", "dyn_type": "const class clang::Circle", "sub_classable": true }
   // CHECK-NEXT: ],
   // CHECK-NEXT: "dynamic_casts": [
   // CHECK:        { "region": "SymRegion{reg_$0<const struct clang::Shape * S>}", "casts": [
   // CHECK-NEXT:     { "from": "const struct clang::Shape *", "to": "const class clang::Circle *", "kind": "success" },
   // CHECK-NEXT:     { "from": "const struct clang::Shape *", "to": "const class clang::Square *", "kind": "fail" }
-  // CHECK-NEXT:   ]}
+  // CHECK-NEXT:   ] }
 
   (void)(1 / !C);
   // expected-note@-1 {{'C' is non-null}}
   // expected-note@-2 {{Division by zero}}
   // expected-warning@-3 {{Division by zero}}
 }
 

clang/test/Analysis/class-object-state-dump.m

+// RUN: %clang_analyze_cc1 -analyzer-checker=core,debug.ExprInspection \
+// RUN:   -verify %s 2>&1 | FileCheck %s
+
+// expected-no-diagnostics
+
+void clang_analyzer_printState();
+
+@interface NSObject {
+}
++ (id)alloc;
++ (Class)class;
+- (id)init;
+- (Class)class;
+@end
+
+@interface Parent : NSObject
+@end
+@interface Child : Parent
+@end
+
+void foo(id A, id B);
+
+@implementation Child
++ (void)test {
+  id ClassAsID = [self class];
+  id Object = [[ClassAsID alloc] init];
+  Class TheSameClass = [Object class];
+
+  clang_analyzer_printState();
+  // CHECK:      "class_object_types": [
+  // CHECK-NEXT:   { "symbol": "conj_$[[#]]{Class, LC[[#]], S[[#]], #[[#]]}", "dyn_type": "Child", "sub_classable": true },
+  // CHECK-NEXT:   { "symbol": "conj_$[[#]]{Class, LC[[#]], S[[#]], #[[#]]}", "dyn_type": "Child", "sub_classable": true }
+  // CHECK-NEXT: ]
+
+  // Let's make sure that the information is not GC'd away.
+  foo(ClassAsID, TheSameClass);
+}
+@end

clang/test/Analysis/inlining/InlineObjCClassMethod.m

 // RUN: %clang_analyze_cc1 -analyzer-checker=core,debug.ExprInspection -analyzer-config ipa=dynamic-bifurcate -verify -analyzer-config eagerly-assume=false %s
 
 void clang_analyzer_checkInlined(int);
 void clang_analyzer_eval(int);
 
 // Test inlining of ObjC class methods.
 
 typedef signed char BOOL;
+#define YES ((BOOL)1)
+#define NO ((BOOL)0)
 typedef struct objc_class *Class;
 typedef struct objc_object {
-    Class isa;
-} *id;
-@protocol NSObject  - (BOOL)isEqual:(id)object; @end
+} * id;
+@protocol NSObject
+- (BOOL)isEqual:(id)object;
+@end
 @interface NSObject <NSObject> {}
-+(id)alloc;
--(id)init;
--(id)autorelease;
--(id)copy;
++ (id)alloc;
++ (Class)class;
++ (Class)superclass;
+- (id)init;
+- (id)autorelease;
+- (id)copy;
 - (Class)class;
--(id)retain;
+- (instancetype)self;
+- (id)retain;
 @end
 
 // Vanila: ObjC class method is called by name.
 @interface MyParent : NSObject
 + (int)getInt;
 @end
 @interface MyClass : MyParent
 + (int)getInt;
+ (int)testClassVariableByUnknownVarDecl: (Class)cl  {
   int y = [cl getInt];
   return 3/y; // no-warning
 }
 + (int)getInt {
   return 0;
 }
 @end
 
-
-// False negative.
 // ObjC class method call through a decl with a known type.
-// We should be able to track the type of currentClass and inline this call.
 // Note, [self class] could be a subclass. Do we still want to inline here?
 @interface MyClassKT : NSObject
 @end
 @interface MyClassKT (MyCatKT)
 + (int)getInt;
 @end
 @implementation MyClassKT (MyCatKT)
 + (int)getInt {
     return 0;
 }
 @end
 @implementation MyClassKT
 - (int)testClassMethodByKnownVarDecl {
   Class currentClass = [self class];
   int y = [currentClass getInt];
-  return 5/y; // Would be great to get a warning here.
+  return 5 / y; // expected-warning{{Division by zero}}
 }
 @end
 
 // Another false negative due to us not reasoning about self, which in this 
 // case points to the object of the class in the call site and should be equal 
 // to [MyParent class].
 @interface MyParentSelf : NSObject
 + (int)testSelf;

 @end
 
 @interface SelfClassTestParent : NSObject
 -(unsigned)returns10;
 +(unsigned)returns20;
 +(unsigned)returns30;
 @end
 
-@implementation SelfClassTestParent
--(unsigned)returns10 { return 100; }
-+(unsigned)returns20 { return 100; }
-+(unsigned)returns30 { return 100; }
-@end
-
 @interface SelfClassTest : SelfClassTestParent
--(unsigned)returns10;
-+(unsigned)returns20;
-+(unsigned)returns30;
+- (unsigned)returns10;
++ (unsigned)returns20;
++ (unsigned)returns30;
 @end
 
+@implementation SelfClassTestParent
+- (unsigned)returns10 {
+  return 100;
+}
++ (unsigned)returns20 {
+  return 100;
+}
++ (unsigned)returns30 {
+  return 100;
+}
+
+- (void)testSelfReassignment {
+  // Check that we didn't hardcode type for self.
+  self = [[[SelfClassTest class] alloc] init];
+  Class actuallyChildClass = [self class];
+  unsigned result = [actuallyChildClass returns30];
+  clang_analyzer_eval(result == 30); // expected-warning{{TRUE}}
+}
+@end
+
 @implementation SelfClassTest
--(unsigned)returns10 { return 10; }
-+(unsigned)returns20 { return 20; }
-+(unsigned)returns30 { return 30; }
-+(void)classMethod {
+- (unsigned)returns10 {
+  return 10;
+}
++ (unsigned)returns20 {
+  return 20;
+}
++ (unsigned)returns30 {
+  return 30;
+}
++ (BOOL)isClass {
+  return YES;
+}
+- (BOOL)isClass {
+  return NO;
+}
++ (SelfClassTest *)create {
+  return [[self alloc] init];
+}
++ (void)classMethod {
   unsigned result1 = [self returns20];
   clang_analyzer_eval(result1 == 20); // expected-warning{{TRUE}}
+
   unsigned result2 = [[self class] returns30];
   clang_analyzer_eval(result2 == 30); // expected-warning{{TRUE}}
+
   unsigned result3 = [[super class] returns30];
-  clang_analyzer_eval(result3 == 100); // expected-warning{{UNKNOWN}}
+  clang_analyzer_eval(result3 == 100); // expected-warning{{TRUE}}
+
+  // Check that class info is propagated with data
+  Class class41 = [self class];
+  Class class42 = class41;
+  unsigned result4 = [class42 returns30];
+  clang_analyzer_eval(result4 == 30); // expected-warning{{TRUE}}
+
+  Class class51 = [super class];
+  Class class52 = class51;
+  unsigned result5 = [class52 returns30];
+  clang_analyzer_eval(result5 == 100); // expected-warning{{TRUE}}
 }
--(void)instanceMethod {
+- (void)instanceMethod {
   unsigned result0 = [self returns10];
   clang_analyzer_eval(result0 == 10); // expected-warning{{TRUE}}
+
   unsigned result2 = [[self class] returns30];
   clang_analyzer_eval(result2 == 30); // expected-warning{{TRUE}}
+
   unsigned result3 = [[super class] returns30];
-  clang_analyzer_eval(result3 == 100); // expected-warning{{UNKNOWN}}
+  clang_analyzer_eval(result3 == 100); // expected-warning{{TRUE}}
+
+  // Check that class info is propagated with data
+  Class class41 = [self class];
+  Class class42 = class41;
+  unsigned result4 = [class42 returns30];
+  clang_analyzer_eval(result4 == 30); // expected-warning{{TRUE}}
+
+  Class class51 = [super class];
+  Class class52 = class51;
+  unsigned result5 = [class52 returns30];
+  clang_analyzer_eval(result5 == 100); // expected-warning{{TRUE}}
+
+  // Check that we inline class methods when class object is a receiver
+  Class class6 = [self class];
+  BOOL calledClassMethod = [class6 isClass];
+  clang_analyzer_eval(calledClassMethod == YES); // expected-warning{{TRUE}}
+
+  // Check that class info is propagated through the 'self' method
+  Class class71 = [self class];
+  Class class72 = [class71 self];
+  unsigned result7 = [class72 returns30];
+  clang_analyzer_eval(result7 == 30); // expected-warning{{TRUE}}
+
+  // Check that 'class' and 'super' info from direct invocation of the
+  // corresponding class methods is propagated with data
+  Class class8 = [SelfClassTest class];
+  unsigned result8 = [class8 returns30];
+  clang_analyzer_eval(result8 == 30); // expected-warning{{TRUE}}
+
+  Class class9 = [SelfClassTest superclass];
+  unsigned result9 = [class9 returns30];
+  clang_analyzer_eval(result9 == 100); // expected-warning{{TRUE}}
+
+  // Check that we get class from a propagated type
+  SelfClassTestParent *selfAsParent10 = [[SelfClassTest alloc] init];
+  Class class10 = [selfAsParent10 class];
+  unsigned result10 = [class10 returns30];
+  clang_analyzer_eval(result10 == 30); // expected-warning{{TRUE}}
+
+  SelfClassTestParent *selfAsParent11 = [[[self class] alloc] init];
+  Class class11 = [selfAsParent11 class];
+  unsigned result11 = [class11 returns30];
+  clang_analyzer_eval(result11 == 30); // expected-warning{{TRUE}}
 }
 @end
 
 @interface Parent : NSObject
 + (int)a;
 + (int)b;
 @end
 @interface Child : Parent

clang/test/Analysis/inlining/ObjCDynTypePopagation.m

 // RUN: %clang_analyze_cc1 -analyzer-checker=core,debug.ExprInspection -analyzer-config ipa=dynamic-bifurcate -verify %s
 
 #include "InlineObjCInstanceMethod.h"
 
 void clang_analyzer_eval(int);
 
 PublicSubClass2 *getObj();
 
 @implementation PublicParent
-- (int) getZeroOverridden {
-   return 1;
+- (int)getZeroOverridden {
 }
-- (int) getZero {
-   return 0;
+- (int)getZero {
 }
 @end
 
 @implementation PublicSubClass2
-- (int) getZeroOverridden {
-   return 0;
+- (int)getZeroOverridden {
 }
 
 /* Test that we get the right type from call to alloc. */
-+ (void) testAllocSelf {
++ (void)testAllocSelf {
   id a = [self alloc];
   clang_analyzer_eval([a getZeroOverridden] == 0); // expected-warning{{TRUE}}
 }
 
-
-+ (void) testAllocClass {
++ (void)testAllocClass {
   id a = [PublicSubClass2 alloc];
   clang_analyzer_eval([a getZeroOverridden] == 0); // expected-warning{{TRUE}}
 }
 
-+ (void) testAllocSuperOverriden {
++ (void)testAllocSuperOverriden {
   id a = [super alloc];
   // Evaluates to 1 in the parent.
-  clang_analyzer_eval([a getZeroOverridden] == 0); // expected-warning{{FALSE}} 
+  clang_analyzer_eval([a getZeroOverridden] == 0); // expected-warning{{FALSE}}
 }
 
-+ (void) testAllocSuper {
++ (void)testAllocSuper {
   id a = [super alloc];
   clang_analyzer_eval([a getZero] == 0); // expected-warning{{TRUE}}
 }
 
-+ (void) testAllocInit {
++ (void)testAllocInit {
   id a = [[self alloc] init];
   clang_analyzer_eval([a getZeroOverridden] == 0); // expected-warning{{TRUE}}
 }
 
-+ (void) testNewSelf {
++ (void)testNewSelf {
   id a = [self new];
   clang_analyzer_eval([a getZeroOverridden] == 0); // expected-warning{{TRUE}}
 }
 
-// Casting to parent should not pessimize the dynamic type. 
-+ (void) testCastToParent {
+// Casting to parent should not pessimize the dynamic type.
++ (void)testCastToParent {
   id a = [[self alloc] init];
- PublicParent *p = a;  
+  PublicParent *p = a;
   clang_analyzer_eval([p getZeroOverridden] == 0); // expected-warning{{TRUE}}
 }
 
 // The type of parameter gets used.
-+ (void)testTypeFromParam:(PublicParent*) p {
++ (void)testTypeFromParam:(PublicParent *)p {
   clang_analyzer_eval([p getZero] == 0); // expected-warning{{TRUE}}
 }
 
 // Test implicit cast.
 // Note, in this case, p could also be a subclass of MyParent.
-+ (void) testCastFromId:(id) a {
-  PublicParent *p = a;  
++ (void)testCastFromId:(id)a {
+  PublicParent *p = a;
   clang_analyzer_eval([p getZero] == 0); // expected-warning{{TRUE}}
 }
 @end
 
 // TODO: Would be nice to handle the case of dynamically obtained class info
 // as well. We need a MemRegion for class types for this.
 int testDynamicClass(BOOL coin) {
   Class AllocClass = (coin ? [NSObject class] : [PublicSubClass2 class]);
   id x = [[AllocClass alloc] init];
   if (coin)
     return [x getZero];
   return 1;
 }
 
 @interface UserClass : NSObject
-- (PublicSubClass2 *) _newPublicSubClass2;
-- (int) getZero;
-- (void) callNew;
+- (PublicSubClass2 *)_newPublicSubClass2;
+- (int)getZero;
+- (void)callNew;
 @end
 
 @implementation UserClass
-- (PublicSubClass2 *) _newPublicSubClass2 {
+- (PublicSubClass2 *)_newPublicSubClass2 {
   return [[PublicSubClass2 alloc] init];
 }
-- (int) getZero { return 5; }
-- (void) callNew {
+- (int)getZero {
+  return 5;
+}
+- (void)callNew {
   PublicSubClass2 *x = [self _newPublicSubClass2];
   clang_analyzer_eval([x getZero] == 0); //expected-warning{{TRUE}}
 }
 @end
 No newline at end of file

clang/test/Analysis/retain-release-inline.m

 // RUN: %clang_analyze_cc1 -triple x86_64-apple-darwin10 -analyzer-checker=core,osx.coreFoundation.CFRetainRelease,osx.cocoa.ClassRelease,osx.cocoa.RetainCount -fblocks -verify %s
 
 //===----------------------------------------------------------------------===//
 // The following code is reduced using delta-debugging from Mac OS X headers:
 //
 // #include <Cocoa/Cocoa.h>
 // #include <CoreFoundation/CoreFoundation.h>
 // #include <DiskArbitration/DiskArbitration.h>
 // #include <QuartzCore/QuartzCore.h>
 // #include <Quartz/Quartz.h>
 // #include <IOKit/IOKitLib.h>
 //
 // It includes the basic definitions for the test cases below.
 //===----------------------------------------------------------------------===//
 #define NULL 0
+#define nil ((id)0)
 typedef unsigned int __darwin_natural_t;
 typedef unsigned long uintptr_t;
 typedef unsigned int uint32_t;
 typedef unsigned long long uint64_t;
 typedef unsigned int UInt32;
 typedef signed long CFIndex;
 typedef CFIndex CFByteOrder;
 typedef struct {
-    CFIndex location;
-    CFIndex length;
 } CFRange;
 static __inline__ __attribute__((always_inline)) CFRange CFRangeMake(CFIndex loc, CFIndex len) {
-    CFRange range;
-    range.location = loc;
-    range.length = len;
-    return range;
 }
 typedef const void * CFTypeRef;
 typedef const struct __CFString * CFStringRef;
 typedef const struct __CFAllocator * CFAllocatorRef;
 extern const CFAllocatorRef kCFAllocatorDefault;
 extern CFTypeRef CFRetain(CFTypeRef cf);
 extern void CFRelease(CFTypeRef cf);
 typedef struct {

 @class NSString, Protocol;
 extern void NSLog(NSString *format, ...) __attribute__((format(__NSString__, 1, 2)));
 typedef struct _NSZone NSZone;
 @class NSInvocation, NSMethodSignature, NSCoder, NSString, NSEnumerator;
 @protocol NSObject
 - (BOOL)isEqual:(id)object;
 - (id)retain;
 - (oneway void)release;
+- (Class)class;
 - (id)autorelease;
 - (id)init;
 @end  @protocol NSCopying  - (id)copyWithZone:(NSZone *)zone;
 @end  @protocol NSMutableCopying  - (id)mutableCopyWithZone:(NSZone *)zone;
 @end  @protocol NSCoding  - (void)encodeWithCoder:(NSCoder *)aCoder;
 @end
 @interface NSObject <NSObject> {}
 + (id)allocWithZone:(NSZone *)zone;
 + (id)alloc;
++ (Class)class;
 - (void)dealloc;
 @end
 @interface NSObject (NSCoderMethods)
 - (id)awakeAfterUsingCoder:(NSCoder *)aDecoder;
 @end
 extern id NSAllocateObject(Class aClass, NSUInteger extraBytes, NSZone *zone);
 typedef struct {
 }

 }
 
 - (void)inline_test_reanalyze_as_top_level {
   id x = [self test_reanalyze_as_top_level];
   [x release];
   [self test_inline_tiny_when_reanalyzing];
 }
 @end
+
+// Original problem: rdar://problem/50739539
+@interface MyClassThatLeaksDuringInit : NSObject
+
++ (MyClassThatLeaksDuringInit *)getAnInstance1;
++ (MyClassThatLeaksDuringInit *)getAnInstance2;
+
+@end
+
+@implementation MyClassThatLeaksDuringInit
+
++ (MyClassThatLeaksDuringInit *)getAnInstance1 {
+  return [[[MyClassThatLeaksDuringInit alloc] init] autorelease]; // expected-warning{{leak}}
+}
+
++ (MyClassThatLeaksDuringInit *)getAnInstance2 {
+  return [[[[self class] alloc] init] autorelease]; // expected-warning{{leak}}
+}
+
+- (instancetype)init {
+  if (1) {
+    return nil;
+  }
+
+  if (nil != (self = [super init])) {
+  }
+  return self;
+}
+
+@end