[analyzer] Add initial support for ObjCIndirectCopyRestoreExpr.

[NoQ]

Summary

Idiomatic objc using ARC will generate this expression regularly due to NSError out-param passing. Providing an implementation for this expression allows the analyzer to explore many more codepaths in ARC projects.

Patch by Paul Pelzl!
(who can't participate in the discussion for IRL reasons; i'll address comments)

[vsavchenko]

LGTM!

clang/lib/StaticAnalyzer/Core/ExprEngine.cpp

PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(),
                                 S->getBeginLoc(), "Error evaluating statement");
   ExplodedNodeSet Dst;
   StmtNodeBuilder Bldr(Pred, DstTop, *currBldrCtx);
 
   assert(!isa<Expr>(S) || S == cast<Expr>(S)->IgnoreParens());
 
   switch (S->getStmtClass()) {
     // C++, OpenMP and ARC stuff we don't support yet.
-    case Expr::ObjCIndirectCopyRestoreExprClass:
     case Stmt::CXXDependentScopeMemberExprClass:
     case Stmt::CXXTryStmtClass:
     case Stmt::CXXTypeidExprClass:
     case Stmt::CXXUuidofExprClass:
     case Stmt::CXXFoldExprClass:
     case Stmt::MSPropertyRefExprClass:
     case Stmt::MSPropertySubscriptExprClass:
     case Stmt::CXXUnresolvedConstructExprClass:
case Stmt::PseudoObjectExprClass: {
       else
         Bldr.generateNode(S, Pred,
                           state->BindExpr(S, Pred->getLocationContext(),
                                                    UnknownVal()));
 
       Bldr.addNodes(Dst);
       break;
     }
+
+    case Expr::ObjCIndirectCopyRestoreExprClass: {
+      // ObjCIndirectCopyRestoreExpr implies passing a temporary for
+      // correctness of lifetime management.  Due to limited analysis
+      // of ARC, this is implemented as direct arg passing.
+      Bldr.takeNodes(Pred);
+      ProgramStateRef state = Pred->getState();
+      const auto *OIE = cast<ObjCIndirectCopyRestoreExpr>(S);
+      const Expr *E = OIE->getSubExpr();
+      SVal V = state->getSVal(E, Pred->getLocationContext());
+      Bldr.generateNode(S, Pred,
+              state->BindExpr(S, Pred->getLocationContext(), V));
+      Bldr.addNodes(Dst);
+      break;
+    }
   }
 }
 
 bool ExprEngine::replayWithoutInlining(ExplodedNode *N,
                                        const LocationContext *CalleeLC) {
   const StackFrameContext *CalleeSF = CalleeLC->getStackFrame();
   const StackFrameContext *CallerSF = CalleeSF->getParent()->getStackFrame();
   assert(CalleeSF && CallerSF);

clang/test/Analysis/objc-indirect-copy-restore.m

+// RUN: %clang_analyze_cc1 -fobjc-arc -analyzer-checker=core,debug.ExprInspection -verify %s
+
+void clang_analyzer_eval(int);
+void clang_analyzer_warnIfReached();
+
+extern void __assert_fail (__const char *__assertion, __const char *__file,
+    unsigned int __line, __const char *__function)
+     __attribute__ ((__noreturn__));
+
+#define assert(expr) \
+  ((expr)  ? (void)(0)  : __assert_fail (#expr, __FILE__, __LINE__, __func__))
+
+
+@protocol NSObject
++ (nonnull instancetype)alloc;
+- (nonnull instancetype)init;
+@end
+@interface NSObject <NSObject> {}
+@end
+
+@interface NSError : NSObject {
+@public
+  int x;
+}
+@end
+
+
+@interface SomeClass : NSObject
++ (int)doSomethingWithError:(NSError *__autoreleasing *)error;
+@end
+
+@implementation SomeClass
++ (int)doSomethingWithError:(NSError *__autoreleasing *)error {
+    if (error) {
+        NSError *e = [[NSError alloc] init];
+        assert(e);
+        e->x = 5;
+        *error = e;
+        clang_analyzer_eval(*error != 0); // expected-warning{{TRUE}}
+    }
+    return 0;
+}
+@end
+
+void testStrongOutParam(void) {
+  NSError *error;
+  clang_analyzer_eval(error != 0); // expected-warning{{FALSE}}
+  int ok = [SomeClass doSomethingWithError:&error];
+  clang_analyzer_eval(ok);         // expected-warning{{FALSE}}
+  clang_analyzer_eval(error != 0); // expected-warning{{TRUE}}
+  clang_analyzer_eval(error->x == 5); // expected-warning{{TRUE}}
+}
+
+void testAutoreleasingOutParam(void) {
+  NSError *__autoreleasing error;
+  clang_analyzer_eval(error != 0); // expected-warning{{FALSE}}
+  int ok = [SomeClass doSomethingWithError:&error];
+  clang_analyzer_eval(ok);         // expected-warning{{FALSE}}
+  clang_analyzer_eval(error != 0); // expected-warning{{TRUE}}
+  clang_analyzer_eval(error->x == 5); // expected-warning{{TRUE}}
+}
+
+void testNilOutParam(void) {
+    int ok = [SomeClass doSomethingWithError:(void *)0];
+    clang_analyzer_eval(ok);  // expected-warning{{FALSE}}
+}
+