Possible XCode Analyzer bug when an init method/argument contains the word "delegate"

Question

I'm in XCode 5.1.1 and not using ARC.

When I add the word delegate to the end of any argument of an init method, XCode's Analyzer doesn't complain if you alloc it without releasing it.

The example below shows this behaviour. If you change initWithDelegate it to initWithDelegat (without the e on the end) then the Analyze behaves as expected.

@interface mrTest : NSObject
  -(id)initWithDelegate:(id)delegate;
@end

@implementation mrTest
  -(id)initWithDelegate:(id)delegate {
      self = [super init];
      return self;
  }
@end

-(void)example {
    mrTest * t = [[mrTest alloc] initWithDelegate:nil];

    // (just calling a method here so there are no build warnings)
    [t toggleItalics:nil];

    // Should complain that it's not being released, also doesn't complain if you uncomment this line
    //[t release];
}

It's not like it's somehow adding autorelease because that should complain when you do uncomment the [t release]; line.

It even lets you get away with over-releasing it like this...

-(void)example {
    mrTest * t = [[[[mrTest alloc] initWithDelegate:nil] autorelease] autorelease];

    [t release];
    [t release];
    [t release];
    [t release];
}

Interested to know if anyone has an explanation or has experienced this before?

Answer 1

This seems to be a deliberate decision of the Clang static analyzer, as can be seen in the source code

http://clang.llvm.org/doxygen/RetainCountChecker_8cpp_source.html

01424   // If one of the arguments in the selector has the keyword 'delegate' we
01425   // should stop tracking the reference count for the receiver.  This is
01426   // because the reference count is quite possibly handled by a delegate
01427   // method.

It is also explained in the history

https://llvm.org/viewvc/llvm-project?view=revision&revision=158532

[analyzer] RetainCount: don't track objects init'd with a delegate

We already didn't track objects that have delegates or callbacks or objects that are passed through void * "context pointers". It's a not-uncommon pattern to release the object in its callback, and so the leak message we give is not very helpful.