[analyzer] Treat @throw as a sink (stop processing).

The CFG approximates @throw as a return statement, but that's not good
enough in inlined functions. Moreover, since Objective-C exceptions are
usually considered fatal, we should be suppressing leak warnings like we
do for calls to noreturn functions (like abort()).

The comments indicate that we were probably intending to do this all along;
it may have been inadvertantly changed during a refactor at one point.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162156 91177308-0d34-0410-b5e6-96231b3b80d8

2 files changed, 24 insertions, 1 deletions

diff --git a/lib/StaticAnalyzer/Core/ExprEngine.cpp b/lib/StaticAnalyzer/Core/ExprEngine.cpp
index b0435fb562..e7b009a176 100644
--- a/lib/StaticAnalyzer/Core/ExprEngine.cpp
+++ b/lib/StaticAnalyzer/Core/ExprEngine.cpp
@@ -889,7 +889,7 @@ void ExprEngine::Visit(const Stmt *S, ExplodedNode *Pred,
     case Stmt::ObjCAtThrowStmtClass: {
       // FIXME: This is not complete.  We basically treat @throw as
       // an abort.
-      Bldr.generateNode(S, Pred, Pred->getState());
+      Bldr.generateNode(S, Pred, Pred->getState(), /*IsSink=*/true);
       break;
     }
 
diff --git a/test/Analysis/exceptions.mm b/test/Analysis/exceptions.mm
new file mode 100644
index 0000000000..7306038ba1
--- /dev/null
+++ b/test/Analysis/exceptions.mm
@@ -0,0 +1,23 @@
+// RUN: %clang_cc1 -analyze -fexceptions -fobjc-exceptions -fcxx-exceptions -analyzer-ipa=inlining -analyzer-checker=core,unix.Malloc,debug.ExprInspection -verify %s
+
+void clang_analyzer_checkInlined(bool);
+
+typedef typeof(sizeof(int)) size_t;
+void *malloc(size_t);
+void free(void *);
+
+
+id getException();
+void inlinedObjC() {
+  clang_analyzer_checkInlined(true); // expected-warning{{TRUE}}
+  @throw getException();
+}
+
+int testObjC() {
+  int a; // uninitialized
+  void *mem = malloc(4); // no-warning (ObjC exceptions are usually fatal)
+  inlinedObjC();
+  free(mem);
+  return a; // no-warning
+}
+