Szelethus added a comment. Aha, alright! So the tracker tracked back to where the tracked expression got computed to node `N`, which is the return value of some identity function. Unless its explicitly told that there is a link in between the return value and the parameter, the tracker can't figure this out that it could track further (why would it, right?). So it asks its handlers whether they want to do anything with `N`, which `IdentityHandler` does -- it digs out the node where the parameter was evaluated, and tells the tracker to go on. Awesome!
I guess we could put `IdentityHandler` in an anonymous namespace? ================ Comment at: clang/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountChecker.cpp:945-947 + ExprEngine &Eng = C.getStateManager().getOwningEngine(); + // Let's mark this place with a special tag. + Tag = Eng.getDataTags().make<IdentityTag>(CE, BindReturnTo); ---------------- I don't know ObjC at all, but is this identity obvious? Do you not need a `NoteTag` to say that "Foo is an identity function, its return value equals the parameter"? Or, in the possession of the actual `PathSensitiveBugReport` that you can retrieve in the handler, you could drop a note there, maybe? Repository: rG LLVM Github Monorepo CHANGES SINCE LAST ACTION https://reviews.llvm.org/D104136/new/ https://reviews.llvm.org/D104136 _______________________________________________ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
