[analyzer] Treat @throw as a sink (stop processing).

The CFG approximates @throw as a return statement, but that's not good
enough in inlined functions. Moreover, since Objective-C exceptions are
usually considered fatal, we should be suppressing leak warnings like we
do for calls to noreturn functions (like abort()).

The comments indicate that we were probably intending to do this all along;
it may have been inadvertantly changed during a refactor at one point.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162156 91177308-0d34-0410-b5e6-96231b3b80d8

diff --git a/lib/StaticAnalyzer/Core/ExprEngine.cpp b/lib/StaticAnalyzer/Core/ExprEngine.cpp
index b0435fb562e3b31a94ec955f539f8aa6f7215438..e7b009a176ef68b3c2a5d940d444d9577bf76a9f 100644 (file)
--- a/lib/StaticAnalyzer/Core/ExprEngine.cpp
+++ b/lib/StaticAnalyzer/Core/ExprEngine.cpp
@@ -889,7 +889,7 @@ void ExprEngine::Visit(const Stmt *S, ExplodedNode *Pred,
     case Stmt::ObjCAtThrowStmtClass: {
       // FIXME: This is not complete.  We basically treat @throw as
       // an abort.
-      Bldr.generateNode(S, Pred, Pred->getState());
+      Bldr.generateNode(S, Pred, Pred->getState(), /*IsSink=*/true);
       break;
     }
 

diff --git a/test/Analysis/exceptions.mm b/test/Analysis/exceptions.mm
new file mode 100644 (file)
index 0000000..7306038
--- /dev/null
+++ b/test/Analysis/exceptions.mm
@@ -0,0 +1,23 @@
+// RUN: %clang_cc1 -analyze -fexceptions -fobjc-exceptions -fcxx-exceptions -analyzer-ipa=inlining -analyzer-checker=core,unix.Malloc,debug.ExprInspection -verify %s
+
+void clang_analyzer_checkInlined(bool);
+
+typedef typeof(sizeof(int)) size_t;
+void *malloc(size_t);
+void free(void *);
+
+
+id getException();
+void inlinedObjC() {
+  clang_analyzer_checkInlined(true); // expected-warning{{TRUE}}
+  @throw getException();
+}
+
+int testObjC() {
+  int a; // uninitialized
+  void *mem = malloc(4); // no-warning (ObjC exceptions are usually fatal)
+  inlinedObjC();
+  free(mem);
+  return a; // no-warning
+}
+