r265839 - [analyzer] Teach trackNullOrUndefValue about calls to property accessors.

[Devin Coughlin via cfe-commits]

Author: dcoughlin
Date: Fri Apr  8 14:59:16 2016
New Revision: 265839

URL: http://llvm.org/viewvc/llvm-project?rev=265839&view=rev
Log:
[analyzer] Teach trackNullOrUndefValue about calls to property accessors.

Teach trackNullOrUndefValue() how to look through PseudoObjectExprs to find
the underlying method call for property getters. This makes over-suppression
of 'return nil' in getters consistent with the similar over-suppression for
method and function calls.

rdar://problem/24437252

Modified:
    cfe/trunk/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp
    cfe/trunk/test/Analysis/inlining/false-positive-suppression.m

Modified: cfe/trunk/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp?rev=265839&r1=265838&r2=265839&view=diff
==============================================================================
--- cfe/trunk/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp (original)
+++ cfe/trunk/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp Fri Apr  8 14:59:16 2016
@@ -908,6 +908,12 @@ static const Expr *peelOffOuterExpr(cons
     return peelOffOuterExpr(EWC->getSubExpr(), N);
   if (const OpaqueValueExpr *OVE = dyn_cast<OpaqueValueExpr>(Ex))
     return peelOffOuterExpr(OVE->getSourceExpr(), N);
+  if (auto *POE = dyn_cast<PseudoObjectExpr>(Ex)) {
+    auto *PropRef = dyn_cast<ObjCPropertyRefExpr>(POE->getSyntacticForm());
+    if (PropRef && PropRef->isMessagingGetter()) {
+      return peelOffOuterExpr(POE->getSemanticExpr(1), N);
+    }
+  }
 
   // Peel off the ternary operator.
   if (const ConditionalOperator *CO = dyn_cast<ConditionalOperator>(Ex)) {

Modified: cfe/trunk/test/Analysis/inlining/false-positive-suppression.m
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/test/Analysis/inlining/false-positive-suppression.m?rev=265839&r1=265838&r2=265839&view=diff
==============================================================================
--- cfe/trunk/test/Analysis/inlining/false-positive-suppression.m (original)
+++ cfe/trunk/test/Analysis/inlining/false-positive-suppression.m Fri Apr  8 14:59:16 2016
@@ -36,3 +36,39 @@ void testNilReceiver(int coin) {
   else
     testNilReceiverHelperB([[x getObject] getPtr]);
 }
+
+// FALSE NEGATIVES (over-suppression)
+
+__attribute__((objc_root_class))
+ at interface SomeClass
+-(int *)methodReturningNull;
+
+ at property(readonly) int *propertyReturningNull;
+
+ at end
+
+ at implementation SomeClass
+-(int *)methodReturningNull {
+  return 0;
+}
+
+-(int *)propertyReturningNull {
+  return 0;
+}
+ at end
+
+void testMethodReturningNull(SomeClass *sc) {
+  int *result = [sc methodReturningNull];
+  *result = 1;
+#ifndef SUPPRESSED
+  // expected-warning at -2 {{Dereference of null pointer}}
+#endif
+}
+
+void testPropertyReturningNull(SomeClass *sc) {
+  int *result = sc.propertyReturningNull;
+  *result = 1;
+#ifndef SUPPRESSED
+  // expected-warning at -2 {{Dereference of null pointer}}
+#endif
+}