retain/release checker: Stop tracking reference counts for any symbols touched by StoreManager::InvalidateRegion().

This fixes <rdar://problem/7257223> and <rdar://problem/7283470>.


git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@84223 91177308-0d34-0410-b5e6-96231b3b80d8

3 files changed, 37 insertions, 14 deletions

diff --git a/lib/Analysis/BasicStore.cpp b/lib/Analysis/BasicStore.cpp
index a4f451f364..d81d83c7bf 100644
--- a/lib/Analysis/BasicStore.cpp
+++ b/lib/Analysis/BasicStore.cpp
@@ -49,7 +49,8 @@ public:
                                  QualType T = QualType());
 
   const GRState *InvalidateRegion(const GRState *state, const MemRegion *R,
-                                  const Expr *E, unsigned Count);
+                                  const Expr *E, unsigned Count,
+                                  InvalidatedSymbols *IS);
 
   const GRState *Bind(const GRState *state, Loc L, SVal V) {
     return state->makeWithStore(BindInternal(state->getStore(), L, V));
@@ -623,12 +624,21 @@ StoreManager::BindingsHandler::~BindingsHandler() {}
 const GRState *BasicStoreManager::InvalidateRegion(const GRState *state,
                                                    const MemRegion *R,
                                                    const Expr *E,
-                                                   unsigned Count) {
+                                                   unsigned Count,
+                                                   InvalidatedSymbols *IS) {
   R = R->getBaseRegion();
 
   if (!(isa<VarRegion>(R) || isa<ObjCIvarRegion>(R)))
       return state;
 
+  if (IS) {
+    BindingsTy B = GetBindings(state->getStore());
+    if (BindingsTy::data_type *Val = B.lookup(R)) {
+      if (SymbolRef Sym = Val->getAsSymbol())
+        IS->insert(Sym);
+    }
+  }
+
   QualType T = cast<TypedRegion>(R)->getValueType(R->getContext());
   SVal V = ValMgr.getConjuredSymbolVal(R, E, T, Count);
   return Bind(state, loc::MemRegionVal(R), V);
diff --git a/lib/Analysis/CFRefCount.cpp b/lib/Analysis/CFRefCount.cpp
index 49cd4151a6..2f6425c0c7 100644
--- a/lib/Analysis/CFRefCount.cpp
+++ b/lib/Analysis/CFRefCount.cpp
@@ -2859,14 +2859,13 @@ void CFRefCount::EvalSummary(ExplodedNodeSet& Dst,
           // FIXME: What about layers of ElementRegions?
         }
 
-        // Is the invalidated variable something that we were tracking?
-        SymbolRef Sym = state->getSValAsScalarOrLoc(R).getAsLocSymbol();
-
-        // Remove any existing reference-count binding.
-        if (Sym)
-          state = state->remove<RefBindings>(Sym);
-
-        state = StoreMgr.InvalidateRegion(state, R, *I, Count);
+        StoreManager::InvalidatedSymbols IS;
+        state = StoreMgr.InvalidateRegion(state, R, *I, Count, &IS);
+        for (StoreManager::InvalidatedSymbols::iterator I = IS.begin(),
+             E = IS.end(); I!=E; ++I) {
+          // Remove any existing reference-count binding.
+          state = state->remove<RefBindings>(*I);
+        }
       }
       else {
         // Nuke all other arguments passed by reference.
diff --git a/lib/Analysis/RegionStore.cpp b/lib/Analysis/RegionStore.cpp
index 9456ab6454..18d58ab10f 100644
--- a/lib/Analysis/RegionStore.cpp
+++ b/lib/Analysis/RegionStore.cpp
@@ -262,7 +262,8 @@ public:
   //===-------------------------------------------------------------------===//
 
   const GRState *InvalidateRegion(const GRState *state, const MemRegion *R,
-                                  const Expr *E, unsigned Count);
+                                  const Expr *E, unsigned Count,
+                                  InvalidatedSymbols *IS);
 
 private:
   void RemoveSubRegionBindings(RegionBindings &B, const MemRegion *R,
@@ -455,7 +456,8 @@ void RegionStoreManager::RemoveSubRegionBindings(RegionBindings &B,
 const GRState *RegionStoreManager::InvalidateRegion(const GRState *state,
                                                     const MemRegion *R,
                                                     const Expr *Ex,
-                                                    unsigned Count) {
+                                                    unsigned Count,
+                                                    InvalidatedSymbols *IS) {
   ASTContext& Ctx = StateMgr.getContext();
 
   // Strip away casts.
@@ -490,9 +492,21 @@ const GRState *RegionStoreManager::InvalidateRegion(const GRState *state,
     if (Optional<SVal> V = getDirectBinding(B, R)) {
       if (const MemRegion *RV = V->getAsRegion())
         WorkList.push_back(RV);
+      
+      // A symbol?  Mark it touched by the invalidation.
+      if (IS) {
+        if (SymbolRef Sym = V->getAsSymbol())
+          IS->insert(Sym);
+      }
+    }
+
+    // Symbolic region?  Mark that symbol touched by the invalidation.
+    if (IS) {
+      if (const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(R))
+        IS->insert(SR->getSymbol());
     }
 
-    // Handle region.
+    // Handle the region itself.
     if (isa<AllocaRegion>(R) || isa<SymbolicRegion>(R) ||
         isa<ObjCObjectRegion>(R)) {
       // Invalidate the region by setting its default value to
@@ -1376,7 +1390,7 @@ const GRState *RegionStoreManager::Bind(const GRState *state, Loc L, SVal V) {
         // For now, just invalidate the fields of the struct/union/class.
         // FIXME: Precisely handle the fields of the record.
         if (superTy->isRecordType())
-          return InvalidateRegion(state, superR, NULL, 0);
+          return InvalidateRegion(state, superR, NULL, 0, NULL);
       }
     }
   }