Fix a bug found by Thomas Clement where 'return [[[NSString alloc] init] autorelease]' would emit a false 'too many overreleases' error.

llvm-svn: 71432

1 files changed, 10 insertions, 2 deletions

diff --git a/clang/lib/Analysis/CFRefCount.cpp b/clang/lib/Analysis/CFRefCount.cpp
index d3702ec8eb7..ebc4dcc6ff5 100644
--- a/clang/lib/Analysis/CFRefCount.cpp
+++ b/clang/lib/Analysis/CFRefCount.cpp
@@ -3314,12 +3314,20 @@ CFRefCount::HandleAutoreleaseCounts(GRStateRef state, GenericNodeBuilder Bd,
   assert(!isGCEnabled() && "Autorelease counts in GC mode?");  
   unsigned Cnt = V.getCount();
   
+  // FIXME: Handle sending 'autorelease' to already released object.
+
+  if (V.getKind() == RefVal::ReturnedOwned)
+    ++Cnt;
+  
   if (ACnt <= Cnt) {
     if (ACnt == Cnt) {
       V.clearCounts();
-      V = V ^ RefVal::NotOwned;
+      if (V.getKind() == RefVal::ReturnedOwned)
+        V = V ^ RefVal::ReturnedNotOwned;
+      else
+        V = V ^ RefVal::NotOwned;
     }
-    else {      
+    else {
       V.setCount(Cnt - ACnt);
       V.setAutoreleaseCount(0);
     }