vendor/clang/clang-trunk-r351319

4 files changed, 2819 insertions, 0 deletions

diff --git a/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountChecker.cpp b/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountChecker.cpp
new file mode 100644
index 0000000000000..0652af8566437
--- /dev/null
+++ b/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountChecker.cpp
@@ -0,0 +1,1547 @@
+//==-- RetainCountChecker.cpp - Checks for leaks and other issues -*- C++ -*--//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+//  This file defines the methods for RetainCountChecker, which implements
+//  a reference count checker for Core Foundation and Cocoa on (Mac OS X).
+//
+//===----------------------------------------------------------------------===//
+
+#include "RetainCountChecker.h"
+
+using namespace clang;
+using namespace ento;
+using namespace retaincountchecker;
+using llvm::StrInStrNoCase;
+
+REGISTER_MAP_WITH_PROGRAMSTATE(RefBindings, SymbolRef, RefVal)
+
+namespace clang {
+namespace ento {
+namespace retaincountchecker {
+
+const RefVal *getRefBinding(ProgramStateRef State, SymbolRef Sym) {
+  return State->get<RefBindings>(Sym);
+}
+
+ProgramStateRef setRefBinding(ProgramStateRef State, SymbolRef Sym,
+                                     RefVal Val) {
+  assert(Sym != nullptr);
+  return State->set<RefBindings>(Sym, Val);
+}
+
+ProgramStateRef removeRefBinding(ProgramStateRef State, SymbolRef Sym) {
+  return State->remove<RefBindings>(Sym);
+}
+
+class UseAfterRelease : public RefCountBug {
+public:
+  UseAfterRelease(const CheckerBase *checker)
+      : RefCountBug(checker, "Use-after-release") {}
+
+  const char *getDescription() const override {
+    return "Reference-counted object is used after it is released";
+  }
+};
+
+class BadRelease : public RefCountBug {
+public:
+  BadRelease(const CheckerBase *checker) : RefCountBug(checker, "Bad release") {}
+
+  const char *getDescription() const override {
+    return "Incorrect decrement of the reference count of an object that is "
+           "not owned at this point by the caller";
+  }
+};
+
+class DeallocNotOwned : public RefCountBug {
+public:
+  DeallocNotOwned(const CheckerBase *checker)
+      : RefCountBug(checker, "-dealloc sent to non-exclusively owned object") {}
+
+  const char *getDescription() const override {
+    return "-dealloc sent to object that may be referenced elsewhere";
+  }
+};
+
+class OverAutorelease : public RefCountBug {
+public:
+  OverAutorelease(const CheckerBase *checker)
+      : RefCountBug(checker, "Object autoreleased too many times") {}
+
+  const char *getDescription() const override {
+    return "Object autoreleased too many times";
+  }
+};
+
+class ReturnedNotOwnedForOwned : public RefCountBug {
+public:
+  ReturnedNotOwnedForOwned(const CheckerBase *checker)
+      : RefCountBug(checker, "Method should return an owned object") {}
+
+  const char *getDescription() const override {
+    return "Object with a +0 retain count returned to caller where a +1 "
+           "(owning) retain count is expected";
+  }
+};
+
+class Leak : public RefCountBug {
+public:
+  Leak(const CheckerBase *checker, StringRef name) : RefCountBug(checker, name) {
+    // Leaks should not be reported if they are post-dominated by a sink.
+    setSuppressOnSink(true);
+  }
+
+  const char *getDescription() const override { return ""; }
+
+  bool isLeak() const override { return true; }
+};
+
+} // end namespace retaincountchecker
+} // end namespace ento
+} // end namespace clang
+
+void RefVal::print(raw_ostream &Out) const {
+  if (!T.isNull())
+    Out << "Tracked " << T.getAsString() << " | ";
+
+  switch (getKind()) {
+    default: llvm_unreachable("Invalid RefVal kind");
+    case Owned: {
+      Out << "Owned";
+      unsigned cnt = getCount();
+      if (cnt) Out << " (+ " << cnt << ")";
+      break;
+    }
+
+    case NotOwned: {
+      Out << "NotOwned";
+      unsigned cnt = getCount();
+      if (cnt) Out << " (+ " << cnt << ")";
+      break;
+    }
+
+    case ReturnedOwned: {
+      Out << "ReturnedOwned";
+      unsigned cnt = getCount();
+      if (cnt) Out << " (+ " << cnt << ")";
+      break;
+    }
+
+    case ReturnedNotOwned: {
+      Out << "ReturnedNotOwned";
+      unsigned cnt = getCount();
+      if (cnt) Out << " (+ " << cnt << ")";
+      break;
+    }
+
+    case Released:
+      Out << "Released";
+      break;
+
+    case ErrorDeallocNotOwned:
+      Out << "-dealloc (not-owned)";
+      break;
+
+    case ErrorLeak:
+      Out << "Leaked";
+      break;
+
+    case ErrorLeakReturned:
+      Out << "Leaked (Bad naming)";
+      break;
+
+    case ErrorUseAfterRelease:
+      Out << "Use-After-Release [ERROR]";
+      break;
+
+    case ErrorReleaseNotOwned:
+      Out << "Release of Not-Owned [ERROR]";
+      break;
+
+    case RefVal::ErrorOverAutorelease:
+      Out << "Over-autoreleased";
+      break;
+
+    case RefVal::ErrorReturnedNotOwned:
+      Out << "Non-owned object returned instead of owned";
+      break;
+  }
+
+  switch (getIvarAccessHistory()) {
+  case IvarAccessHistory::None:
+    break;
+  case IvarAccessHistory::AccessedDirectly:
+    Out << " [direct ivar access]";
+    break;
+  case IvarAccessHistory::ReleasedAfterDirectAccess:
+    Out << " [released after direct ivar access]";
+  }
+
+  if (ACnt) {
+    Out << " [autorelease -" << ACnt << ']';
+  }
+}
+
+namespace {
+class StopTrackingCallback final : public SymbolVisitor {
+  ProgramStateRef state;
+public:
+  StopTrackingCallback(ProgramStateRef st) : state(std::move(st)) {}
+  ProgramStateRef getState() const { return state; }
+
+  bool VisitSymbol(SymbolRef sym) override {
+    state = state->remove<RefBindings>(sym);
+    return true;
+  }
+};
+} // end anonymous namespace
+
+//===----------------------------------------------------------------------===//
+// Handle statements that may have an effect on refcounts.
+//===----------------------------------------------------------------------===//
+
+void RetainCountChecker::checkPostStmt(const BlockExpr *BE,
+                                       CheckerContext &C) const {
+
+  // Scan the BlockDecRefExprs for any object the retain count checker
+  // may be tracking.
+  if (!BE->getBlockDecl()->hasCaptures())
+    return;
+
+  ProgramStateRef state = C.getState();
+  auto *R = cast<BlockDataRegion>(C.getSVal(BE).getAsRegion());
+
+  BlockDataRegion::referenced_vars_iterator I = R->referenced_vars_begin(),
+                                            E = R->referenced_vars_end();
+
+  if (I == E)
+    return;
+
+  // FIXME: For now we invalidate the tracking of all symbols passed to blocks
+  // via captured variables, even though captured variables result in a copy
+  // and in implicit increment/decrement of a retain count.
+  SmallVector<const MemRegion*, 10> Regions;
+  const LocationContext *LC = C.getLocationContext();
+  MemRegionManager &MemMgr = C.getSValBuilder().getRegionManager();
+
+  for ( ; I != E; ++I) {
+    const VarRegion *VR = I.getCapturedRegion();
+    if (VR->getSuperRegion() == R) {
+      VR = MemMgr.getVarRegion(VR->getDecl(), LC);
+    }
+    Regions.push_back(VR);
+  }
+
+  state = state->scanReachableSymbols<StopTrackingCallback>(Regions).getState();
+  C.addTransition(state);
+}
+
+void RetainCountChecker::checkPostStmt(const CastExpr *CE,
+                                       CheckerContext &C) const {
+  const ObjCBridgedCastExpr *BE = dyn_cast<ObjCBridgedCastExpr>(CE);
+  if (!BE)
+    return;
+
+  ArgEffect AE = ArgEffect(IncRef, ObjKind::ObjC);
+
+  switch (BE->getBridgeKind()) {
+    case OBC_Bridge:
+      // Do nothing.
+      return;
+    case OBC_BridgeRetained:
+      AE = AE.withKind(IncRef);
+      break;
+    case OBC_BridgeTransfer:
+      AE = AE.withKind(DecRefBridgedTransferred);
+      break;
+  }
+
+  ProgramStateRef state = C.getState();
+  SymbolRef Sym = C.getSVal(CE).getAsLocSymbol();
+  if (!Sym)
+    return;
+  const RefVal* T = getRefBinding(state, Sym);
+  if (!T)
+    return;
+
+  RefVal::Kind hasErr = (RefVal::Kind) 0;
+  state = updateSymbol(state, Sym, *T, AE, hasErr, C);
+
+  if (hasErr) {
+    // FIXME: If we get an error during a bridge cast, should we report it?
+    return;
+  }
+
+  C.addTransition(state);
+}
+
+void RetainCountChecker::processObjCLiterals(CheckerContext &C,
+                                             const Expr *Ex) const {
+  ProgramStateRef state = C.getState();
+  const ExplodedNode *pred = C.getPredecessor();
+  for (const Stmt *Child : Ex->children()) {
+    SVal V = pred->getSVal(Child);
+    if (SymbolRef sym = V.getAsSymbol())
+      if (const RefVal* T = getRefBinding(state, sym)) {
+        RefVal::Kind hasErr = (RefVal::Kind) 0;
+        state = updateSymbol(state, sym, *T,
+                             ArgEffect(MayEscape, ObjKind::ObjC), hasErr, C);
+        if (hasErr) {
+          processNonLeakError(state, Child->getSourceRange(), hasErr, sym, C);
+          return;
+        }
+      }
+  }
+
+  // Return the object as autoreleased.
+  //  RetEffect RE = RetEffect::MakeNotOwned(ObjKind::ObjC);
+  if (SymbolRef sym =
+        state->getSVal(Ex, pred->getLocationContext()).getAsSymbol()) {
+    QualType ResultTy = Ex->getType();
+    state = setRefBinding(state, sym,
+                          RefVal::makeNotOwned(ObjKind::ObjC, ResultTy));
+  }
+
+  C.addTransition(state);
+}
+
+void RetainCountChecker::checkPostStmt(const ObjCArrayLiteral *AL,
+                                       CheckerContext &C) const {
+  // Apply the 'MayEscape' to all values.
+  processObjCLiterals(C, AL);
+}
+
+void RetainCountChecker::checkPostStmt(const ObjCDictionaryLiteral *DL,
+                                       CheckerContext &C) const {
+  // Apply the 'MayEscape' to all keys and values.
+  processObjCLiterals(C, DL);
+}
+
+void RetainCountChecker::checkPostStmt(const ObjCBoxedExpr *Ex,
+                                       CheckerContext &C) const {
+  const ExplodedNode *Pred = C.getPredecessor();
+  ProgramStateRef State = Pred->getState();
+
+  if (SymbolRef Sym = Pred->getSVal(Ex).getAsSymbol()) {
+    QualType ResultTy = Ex->getType();
+    State = setRefBinding(State, Sym,
+                          RefVal::makeNotOwned(ObjKind::ObjC, ResultTy));
+  }
+
+  C.addTransition(State);
+}
+
+void RetainCountChecker::checkPostStmt(const ObjCIvarRefExpr *IRE,
+                                       CheckerContext &C) const {
+  Optional<Loc> IVarLoc = C.getSVal(IRE).getAs<Loc>();
+  if (!IVarLoc)
+    return;
+
+  ProgramStateRef State = C.getState();
+  SymbolRef Sym = State->getSVal(*IVarLoc).getAsSymbol();
+  if (!Sym || !dyn_cast_or_null<ObjCIvarRegion>(Sym->getOriginRegion()))
+    return;
+
+  // Accessing an ivar directly is unusual. If we've done that, be more
+  // forgiving about what the surrounding code is allowed to do.
+
+  QualType Ty = Sym->getType();
+  ObjKind Kind;
+  if (Ty->isObjCRetainableType())
+    Kind = ObjKind::ObjC;
+  else if (coreFoundation::isCFObjectRef(Ty))
+    Kind = ObjKind::CF;
+  else
+    return;
+
+  // If the value is already known to be nil, don't bother tracking it.
+  ConstraintManager &CMgr = State->getConstraintManager();
+  if (CMgr.isNull(State, Sym).isConstrainedTrue())
+    return;
+
+  if (const RefVal *RV = getRefBinding(State, Sym)) {
+    // If we've seen this symbol before, or we're only seeing it now because
+    // of something the analyzer has synthesized, don't do anything.
+    if (RV->getIvarAccessHistory() != RefVal::IvarAccessHistory::None ||
+        isSynthesizedAccessor(C.getStackFrame())) {
+      return;
+    }
+
+    // Note that this value has been loaded from an ivar.
+    C.addTransition(setRefBinding(State, Sym, RV->withIvarAccess()));
+    return;
+  }
+
+  RefVal PlusZero = RefVal::makeNotOwned(Kind, Ty);
+
+  // In a synthesized accessor, the effective retain count is +0.
+  if (isSynthesizedAccessor(C.getStackFrame())) {
+    C.addTransition(setRefBinding(State, Sym, PlusZero));
+    return;
+  }
+
+  State = setRefBinding(State, Sym, PlusZero.withIvarAccess());
+  C.addTransition(State);
+}
+
+void RetainCountChecker::checkPostCall(const CallEvent &Call,
+                                       CheckerContext &C) const {
+  RetainSummaryManager &Summaries = getSummaryManager(C);
+
+  // Leave null if no receiver.
+  QualType ReceiverType;
+  if (const auto *MC = dyn_cast<ObjCMethodCall>(&Call)) {
+    if (MC->isInstanceMessage()) {
+      SVal ReceiverV = MC->getReceiverSVal();
+      if (SymbolRef Sym = ReceiverV.getAsLocSymbol())
+        if (const RefVal *T = getRefBinding(C.getState(), Sym))
+          ReceiverType = T->getType();
+    }
+  }
+
+  const RetainSummary *Summ = Summaries.getSummary(Call, ReceiverType);
+
+  if (C.wasInlined) {
+    processSummaryOfInlined(*Summ, Call, C);
+    return;
+  }
+  checkSummary(*Summ, Call, C);
+}
+
+RefCountBug *
+RetainCountChecker::getLeakWithinFunctionBug(const LangOptions &LOpts) const {
+  if (!leakWithinFunction)
+    leakWithinFunction.reset(new Leak(this, "Leak"));
+  return leakWithinFunction.get();
+}
+
+RefCountBug *
+RetainCountChecker::getLeakAtReturnBug(const LangOptions &LOpts) const {
+  if (!leakAtReturn)
+    leakAtReturn.reset(new Leak(this, "Leak of returned object"));
+  return leakAtReturn.get();
+}
+
+/// GetReturnType - Used to get the return type of a message expression or
+///  function call with the intention of affixing that type to a tracked symbol.
+///  While the return type can be queried directly from RetEx, when
+///  invoking class methods we augment to the return type to be that of
+///  a pointer to the class (as opposed it just being id).
+// FIXME: We may be able to do this with related result types instead.
+// This function is probably overestimating.
+static QualType GetReturnType(const Expr *RetE, ASTContext &Ctx) {
+  QualType RetTy = RetE->getType();
+  // If RetE is not a message expression just return its type.
+  // If RetE is a message expression, return its types if it is something
+  /// more specific than id.
+  if (const ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(RetE))
+    if (const ObjCObjectPointerType *PT = RetTy->getAs<ObjCObjectPointerType>())
+      if (PT->isObjCQualifiedIdType() || PT->isObjCIdType() ||
+          PT->isObjCClassType()) {
+        // At this point we know the return type of the message expression is
+        // id, id<...>, or Class. If we have an ObjCInterfaceDecl, we know this
+        // is a call to a class method whose type we can resolve.  In such
+        // cases, promote the return type to XXX* (where XXX is the class).
+        const ObjCInterfaceDecl *D = ME->getReceiverInterface();
+        return !D ? RetTy :
+                    Ctx.getObjCObjectPointerType(Ctx.getObjCInterfaceType(D));
+      }
+
+  return RetTy;
+}
+
+static Optional<RefVal> refValFromRetEffect(RetEffect RE,
+                                            QualType ResultTy) {
+  if (RE.isOwned()) {
+    return RefVal::makeOwned(RE.getObjKind(), ResultTy);
+  } else if (RE.notOwned()) {
+    return RefVal::makeNotOwned(RE.getObjKind(), ResultTy);
+  }
+
+  return None;
+}
+
+static bool isPointerToObject(QualType QT) {
+  QualType PT = QT->getPointeeType();
+  if (!PT.isNull())
+    if (PT->getAsCXXRecordDecl())
+      return true;
+  return false;
+}
+
+/// Whether the tracked value should be escaped on a given call.
+/// OSObjects are escaped when passed to void * / etc.
+static bool shouldEscapeOSArgumentOnCall(const CallEvent &CE, unsigned ArgIdx,
+                                       const RefVal *TrackedValue) {
+  if (TrackedValue->getObjKind() != ObjKind::OS)
+    return false;
+  if (ArgIdx >= CE.parameters().size())
+    return false;
+  return !isPointerToObject(CE.parameters()[ArgIdx]->getType());
+}
+
+// We don't always get the exact modeling of the function with regards to the
+// retain count checker even when the function is inlined. For example, we need
+// to stop tracking the symbols which were marked with StopTrackingHard.
+void RetainCountChecker::processSummaryOfInlined(const RetainSummary &Summ,
+                                                 const CallEvent &CallOrMsg,
+                                                 CheckerContext &C) const {
+  ProgramStateRef state = C.getState();
+
+  // Evaluate the effect of the arguments.
+  for (unsigned idx = 0, e = CallOrMsg.getNumArgs(); idx != e; ++idx) {
+    SVal V = CallOrMsg.getArgSVal(idx);
+
+    if (SymbolRef Sym = V.getAsLocSymbol()) {
+      bool ShouldRemoveBinding = Summ.getArg(idx).getKind() == StopTrackingHard;
+      if (const RefVal *T = getRefBinding(state, Sym))
+        if (shouldEscapeOSArgumentOnCall(CallOrMsg, idx, T))
+          ShouldRemoveBinding = true;
+
+      if (ShouldRemoveBinding)
+        state = removeRefBinding(state, Sym);
+    }
+  }
+
+  // Evaluate the effect on the message receiver.
+  if (const auto *MsgInvocation = dyn_cast<ObjCMethodCall>(&CallOrMsg)) {
+    if (SymbolRef Sym = MsgInvocation->getReceiverSVal().getAsLocSymbol()) {
+      if (Summ.getReceiverEffect().getKind() == StopTrackingHard) {
+        state = removeRefBinding(state, Sym);
+      }
+    }
+  }
+
+  // Consult the summary for the return value.
+  RetEffect RE = Summ.getRetEffect();
+
+  if (SymbolRef Sym = CallOrMsg.getReturnValue().getAsSymbol()) {
+    if (RE.getKind() == RetEffect::NoRetHard)
+      state = removeRefBinding(state, Sym);
+  }
+
+  C.addTransition(state);
+}
+
+static bool shouldEscapeRegion(const MemRegion *R) {
+
+  // We do not currently model what happens when a symbol is
+  // assigned to a struct field, so be conservative here and let the symbol
+  // go. TODO: This could definitely be improved upon.
+  return !R->hasStackStorage() || !isa<VarRegion>(R);
+}
+
+static SmallVector<ProgramStateRef, 2>
+updateOutParameters(ProgramStateRef State, const RetainSummary &Summ,
+                    const CallEvent &CE) {
+
+  SVal L = CE.getReturnValue();
+
+  // Splitting is required to support out parameters,
+  // as out parameters might be created only on the "success" branch.
+  // We want to avoid eagerly splitting unless out parameters are actually
+  // needed.
+  bool SplitNecessary = false;
+  for (auto &P : Summ.getArgEffects())
+    if (P.second.getKind() == RetainedOutParameterOnNonZero ||
+        P.second.getKind() == RetainedOutParameterOnZero)
+      SplitNecessary = true;
+
+  ProgramStateRef AssumeNonZeroReturn = State;
+  ProgramStateRef AssumeZeroReturn = State;
+
+  if (SplitNecessary) {
+    if (auto DL = L.getAs<DefinedOrUnknownSVal>()) {
+      AssumeNonZeroReturn = AssumeNonZeroReturn->assume(*DL, true);
+      AssumeZeroReturn = AssumeZeroReturn->assume(*DL, false);
+    }
+  }
+
+  for (unsigned idx = 0, e = CE.getNumArgs(); idx != e; ++idx) {
+    SVal ArgVal = CE.getArgSVal(idx);
+    ArgEffect AE = Summ.getArg(idx);
+
+    auto *ArgRegion = dyn_cast_or_null<TypedValueRegion>(ArgVal.getAsRegion());
+    if (!ArgRegion)
+      continue;
+
+    QualType PointeeTy = ArgRegion->getValueType();
+    SVal PointeeVal = State->getSVal(ArgRegion);
+    SymbolRef Pointee = PointeeVal.getAsLocSymbol();
+    if (!Pointee)
+      continue;
+
+    if (shouldEscapeRegion(ArgRegion))
+      continue;
+
+    auto makeNotOwnedParameter = [&](ProgramStateRef St) {
+      return setRefBinding(St, Pointee,
+                           RefVal::makeNotOwned(AE.getObjKind(), PointeeTy));
+    };
+    auto makeOwnedParameter = [&](ProgramStateRef St) {
+      return setRefBinding(St, Pointee,
+                           RefVal::makeOwned(ObjKind::OS, PointeeTy));
+    };
+
+    switch (AE.getKind()) {
+    case UnretainedOutParameter:
+      AssumeNonZeroReturn = makeNotOwnedParameter(AssumeNonZeroReturn);
+      AssumeZeroReturn = makeNotOwnedParameter(AssumeZeroReturn);
+      break;
+    case RetainedOutParameter:
+      AssumeNonZeroReturn = makeOwnedParameter(AssumeNonZeroReturn);
+      AssumeZeroReturn = makeOwnedParameter(AssumeZeroReturn);
+      break;
+    case RetainedOutParameterOnNonZero:
+      AssumeNonZeroReturn = makeOwnedParameter(AssumeNonZeroReturn);
+      break;
+    case RetainedOutParameterOnZero:
+      AssumeZeroReturn = makeOwnedParameter(AssumeZeroReturn);
+      break;
+    default:
+      break;
+    }
+  }
+
+  if (SplitNecessary) {
+    return {AssumeNonZeroReturn, AssumeZeroReturn};
+  } else {
+    assert(AssumeZeroReturn == AssumeNonZeroReturn);
+    return {AssumeZeroReturn};
+  }
+}
+
+void RetainCountChecker::checkSummary(const RetainSummary &Summ,
+                                      const CallEvent &CallOrMsg,
+                                      CheckerContext &C) const {
+  ProgramStateRef state = C.getState();
+
+  // Evaluate the effect of the arguments.
+  RefVal::Kind hasErr = (RefVal::Kind) 0;
+  SourceRange ErrorRange;
+  SymbolRef ErrorSym = nullptr;
+
+  // Helper tag for providing diagnostics: indicate whether dealloc was sent
+  // at this location.
+  static CheckerProgramPointTag DeallocSentTag(this, DeallocTagDescription);
+  bool DeallocSent = false;
+
+  for (unsigned idx = 0, e = CallOrMsg.getNumArgs(); idx != e; ++idx) {
+    SVal V = CallOrMsg.getArgSVal(idx);
+
+    ArgEffect Effect = Summ.getArg(idx);
+    if (SymbolRef Sym = V.getAsLocSymbol()) {
+      if (const RefVal *T = getRefBinding(state, Sym)) {
+
+        if (shouldEscapeOSArgumentOnCall(CallOrMsg, idx, T))
+          Effect = ArgEffect(StopTrackingHard, ObjKind::OS);
+
+        state = updateSymbol(state, Sym, *T, Effect, hasErr, C);
+        if (hasErr) {
+          ErrorRange = CallOrMsg.getArgSourceRange(idx);
+          ErrorSym = Sym;
+          break;
+        } else if (Effect.getKind() == Dealloc) {
+          DeallocSent = true;
+        }
+      }
+    }
+  }
+
+  // Evaluate the effect on the message receiver / `this` argument.
+  bool ReceiverIsTracked = false;
+  if (!hasErr) {
+    if (const auto *MsgInvocation = dyn_cast<ObjCMethodCall>(&CallOrMsg)) {
+      if (SymbolRef Sym = MsgInvocation->getReceiverSVal().getAsLocSymbol()) {
+        if (const RefVal *T = getRefBinding(state, Sym)) {
+          ReceiverIsTracked = true;
+          state = updateSymbol(state, Sym, *T,
+                               Summ.getReceiverEffect(), hasErr, C);
+          if (hasErr) {
+            ErrorRange = MsgInvocation->getOriginExpr()->getReceiverRange();
+            ErrorSym = Sym;
+          } else if (Summ.getReceiverEffect().getKind() == Dealloc) {
+            DeallocSent = true;
+          }
+        }
+      }
+    } else if (const auto *MCall = dyn_cast<CXXMemberCall>(&CallOrMsg)) {
+      if (SymbolRef Sym = MCall->getCXXThisVal().getAsLocSymbol()) {
+        if (const RefVal *T = getRefBinding(state, Sym)) {
+          state = updateSymbol(state, Sym, *T, Summ.getThisEffect(),
+                               hasErr, C);
+          if (hasErr) {
+            ErrorRange = MCall->getOriginExpr()->getSourceRange();
+            ErrorSym = Sym;
+          }
+        }
+      }
+    }
+  }
+
+  // Process any errors.
+  if (hasErr) {
+    processNonLeakError(state, ErrorRange, hasErr, ErrorSym, C);
+    return;
+  }
+
+  // Consult the summary for the return value.
+  RetEffect RE = Summ.getRetEffect();
+
+  if (RE.getKind() == RetEffect::OwnedWhenTrackedReceiver) {
+    if (ReceiverIsTracked)
+      RE = getSummaryManager(C).getObjAllocRetEffect();
+    else
+      RE = RetEffect::MakeNoRet();
+  }
+
+  if (SymbolRef Sym = CallOrMsg.getReturnValue().getAsSymbol()) {
+    QualType ResultTy = CallOrMsg.getResultType();
+    if (RE.notOwned()) {
+      const Expr *Ex = CallOrMsg.getOriginExpr();
+      assert(Ex);
+      ResultTy = GetReturnType(Ex, C.getASTContext());
+    }
+    if (Optional<RefVal> updatedRefVal = refValFromRetEffect(RE, ResultTy))
+      state = setRefBinding(state, Sym, *updatedRefVal);
+  }
+
+  SmallVector<ProgramStateRef, 2> Out =
+      updateOutParameters(state, Summ, CallOrMsg);
+
+  for (ProgramStateRef St : Out) {
+    if (DeallocSent) {
+      C.addTransition(St, C.getPredecessor(), &DeallocSentTag);
+    } else {
+      C.addTransition(St);
+    }
+  }
+}
+
+ProgramStateRef RetainCountChecker::updateSymbol(ProgramStateRef state,
+                                                 SymbolRef sym, RefVal V,
+                                                 ArgEffect AE,
+                                                 RefVal::Kind &hasErr,
+                                                 CheckerContext &C) const {
+  bool IgnoreRetainMsg = (bool)C.getASTContext().getLangOpts().ObjCAutoRefCount;
+  if (AE.getObjKind() == ObjKind::ObjC && IgnoreRetainMsg) {
+    switch (AE.getKind()) {
+    default:
+      break;
+    case IncRef:
+      AE = AE.withKind(DoNothing);
+      break;
+    case DecRef:
+      AE = AE.withKind(DoNothing);
+      break;
+    case DecRefAndStopTrackingHard:
+      AE = AE.withKind(StopTracking);
+      break;
+    }
+  }
+
+  // Handle all use-after-releases.
+  if (V.getKind() == RefVal::Released) {
+    V = V ^ RefVal::ErrorUseAfterRelease;
+    hasErr = V.getKind();
+    return setRefBinding(state, sym, V);
+  }
+
+  switch (AE.getKind()) {
+    case UnretainedOutParameter:
+    case RetainedOutParameter:
+    case RetainedOutParameterOnZero:
+    case RetainedOutParameterOnNonZero:
+      llvm_unreachable("Applies to pointer-to-pointer parameters, which should "
+                       "not have ref state.");
+
+    case Dealloc: // NB. we only need to add a note in a non-error case.
+      switch (V.getKind()) {
+        default:
+          llvm_unreachable("Invalid RefVal state for an explicit dealloc.");
+        case RefVal::Owned:
+          // The object immediately transitions to the released state.
+          V = V ^ RefVal::Released;
+          V.clearCounts();
+          return setRefBinding(state, sym, V);
+        case RefVal::NotOwned:
+          V = V ^ RefVal::ErrorDeallocNotOwned;
+          hasErr = V.getKind();
+          break;
+      }
+      break;
+
+    case MayEscape:
+      if (V.getKind() == RefVal::Owned) {
+        V = V ^ RefVal::NotOwned;
+        break;
+      }
+
+      LLVM_FALLTHROUGH;
+
+    case DoNothing:
+      return state;
+
+    case Autorelease:
+      // Update the autorelease counts.
+      V = V.autorelease();
+      break;
+
+    case StopTracking:
+    case StopTrackingHard:
+      return removeRefBinding(state, sym);
+
+    case IncRef:
+      switch (V.getKind()) {
+        default:
+          llvm_unreachable("Invalid RefVal state for a retain.");
+        case RefVal::Owned:
+        case RefVal::NotOwned:
+          V = V + 1;
+          break;
+      }
+      break;
+
+    case DecRef:
+    case DecRefBridgedTransferred:
+    case DecRefAndStopTrackingHard:
+      switch (V.getKind()) {
+        default:
+          // case 'RefVal::Released' handled above.
+          llvm_unreachable("Invalid RefVal state for a release.");
+
+        case RefVal::Owned:
+          assert(V.getCount() > 0);
+          if (V.getCount() == 1) {
+            if (AE.getKind() == DecRefBridgedTransferred ||
+                V.getIvarAccessHistory() ==
+                  RefVal::IvarAccessHistory::AccessedDirectly)
+              V = V ^ RefVal::NotOwned;
+            else
+              V = V ^ RefVal::Released;
+          } else if (AE.getKind() == DecRefAndStopTrackingHard) {
+            return removeRefBinding(state, sym);
+          }
+
+          V = V - 1;
+          break;
+
+        case RefVal::NotOwned:
+          if (V.getCount() > 0) {
+            if (AE.getKind() == DecRefAndStopTrackingHard)
+              return removeRefBinding(state, sym);
+            V = V - 1;
+          } else if (V.getIvarAccessHistory() ==
+                       RefVal::IvarAccessHistory::AccessedDirectly) {
+            // Assume that the instance variable was holding on the object at
+            // +1, and we just didn't know.
+            if (AE.getKind() == DecRefAndStopTrackingHard)
+              return removeRefBinding(state, sym);
+            V = V.releaseViaIvar() ^ RefVal::Released;
+          } else {
+            V = V ^ RefVal::ErrorReleaseNotOwned;
+            hasErr = V.getKind();
+          }
+          break;
+      }
+      break;
+  }
+  return setRefBinding(state, sym, V);
+}
+
+void RetainCountChecker::processNonLeakError(ProgramStateRef St,
+                                             SourceRange ErrorRange,
+                                             RefVal::Kind ErrorKind,
+                                             SymbolRef Sym,
+                                             CheckerContext &C) const {
+  // HACK: Ignore retain-count issues on values accessed through ivars,
+  // because of cases like this:
+  //   [_contentView retain];
+  //   [_contentView removeFromSuperview];
+  //   [self addSubview:_contentView]; // invalidates 'self'
+  //   [_contentView release];
+  if (const RefVal *RV = getRefBinding(St, Sym))
+    if (RV->getIvarAccessHistory() != RefVal::IvarAccessHistory::None)
+      return;
+
+  ExplodedNode *N = C.generateErrorNode(St);
+  if (!N)
+    return;
+
+  RefCountBug *BT;
+  switch (ErrorKind) {
+    default:
+      llvm_unreachable("Unhandled error.");
+    case RefVal::ErrorUseAfterRelease:
+      if (!useAfterRelease)
+        useAfterRelease.reset(new UseAfterRelease(this));
+      BT = useAfterRelease.get();
+      break;
+    case RefVal::ErrorReleaseNotOwned:
+      if (!releaseNotOwned)
+        releaseNotOwned.reset(new BadRelease(this));
+      BT = releaseNotOwned.get();
+      break;
+    case RefVal::ErrorDeallocNotOwned:
+      if (!deallocNotOwned)
+        deallocNotOwned.reset(new DeallocNotOwned(this));
+      BT = deallocNotOwned.get();
+      break;
+  }
+
+  assert(BT);
+  auto report = llvm::make_unique<RefCountReport>(
+      *BT, C.getASTContext().getLangOpts(), N, Sym);
+  report->addRange(ErrorRange);
+  C.emitReport(std::move(report));
+}
+
+//===----------------------------------------------------------------------===//
+// Handle the return values of retain-count-related functions.
+//===----------------------------------------------------------------------===//
+
+bool RetainCountChecker::evalCall(const CallExpr *CE, CheckerContext &C) const {
+  // Get the callee. We're only interested in simple C functions.
+  ProgramStateRef state = C.getState();
+  const FunctionDecl *FD = C.getCalleeDecl(CE);
+  if (!FD)
+    return false;
+
+  RetainSummaryManager &SmrMgr = getSummaryManager(C);
+  QualType ResultTy = CE->getCallReturnType(C.getASTContext());
+
+  // See if the function has 'rc_ownership_trusted_implementation'
+  // annotate attribute. If it does, we will not inline it.
+  bool hasTrustedImplementationAnnotation = false;
+
+  const LocationContext *LCtx = C.getLocationContext();
+
+  using BehaviorSummary = RetainSummaryManager::BehaviorSummary;
+  Optional<BehaviorSummary> BSmr =
+      SmrMgr.canEval(CE, FD, hasTrustedImplementationAnnotation);
+
+  // See if it's one of the specific functions we know how to eval.
+  if (!BSmr)
+    return false;
+
+  // Bind the return value.
+  if (BSmr == BehaviorSummary::Identity ||
+      BSmr == BehaviorSummary::IdentityOrZero) {
+    SVal RetVal = state->getSVal(CE->getArg(0), LCtx);
+
+    // If the receiver is unknown or the function has
+    // 'rc_ownership_trusted_implementation' annotate attribute, conjure a
+    // return value.
+    if (RetVal.isUnknown() ||
+        (hasTrustedImplementationAnnotation && !ResultTy.isNull())) {
+      SValBuilder &SVB = C.getSValBuilder();
+      RetVal =
+          SVB.conjureSymbolVal(nullptr, CE, LCtx, ResultTy, C.blockCount());
+    }
+    state = state->BindExpr(CE, LCtx, RetVal, /*Invalidate=*/false);
+
+    if (BSmr == BehaviorSummary::IdentityOrZero) {
+      // Add a branch where the output is zero.
+      ProgramStateRef NullOutputState = C.getState();
+
+      // Assume that output is zero on the other branch.
+      NullOutputState = NullOutputState->BindExpr(
+          CE, LCtx, C.getSValBuilder().makeNull(), /*Invalidate=*/false);
+
+      C.addTransition(NullOutputState);
+
+      // And on the original branch assume that both input and
+      // output are non-zero.
+      if (auto L = RetVal.getAs<DefinedOrUnknownSVal>())
+        state = state->assume(*L, /*Assumption=*/true);
+
+    }
+  }
+
+  C.addTransition(state);
+  return true;
+}
+
+ExplodedNode * RetainCountChecker::processReturn(const ReturnStmt *S,
+                                                 CheckerContext &C) const {
+  ExplodedNode *Pred = C.getPredecessor();
+
+  // Only adjust the reference count if this is the top-level call frame,
+  // and not the result of inlining.  In the future, we should do
+  // better checking even for inlined calls, and see if they match
+  // with their expected semantics (e.g., the method should return a retained
+  // object, etc.).
+  if (!C.inTopFrame())
+    return Pred;
+
+  if (!S)
+    return Pred;
+
+  const Expr *RetE = S->getRetValue();
+  if (!RetE)
+    return Pred;
+
+  ProgramStateRef state = C.getState();
+  SymbolRef Sym =
+    state->getSValAsScalarOrLoc(RetE, C.getLocationContext()).getAsLocSymbol();
+  if (!Sym)
+    return Pred;
+
+  // Get the reference count binding (if any).
+  const RefVal *T = getRefBinding(state, Sym);
+  if (!T)
+    return Pred;
+
+  // Change the reference count.
+  RefVal X = *T;
+
+  switch (X.getKind()) {
+    case RefVal::Owned: {
+      unsigned cnt = X.getCount();
+      assert(cnt > 0);
+      X.setCount(cnt - 1);
+      X = X ^ RefVal::ReturnedOwned;
+      break;
+    }
+
+    case RefVal::NotOwned: {
+      unsigned cnt = X.getCount();
+      if (cnt) {
+        X.setCount(cnt - 1);
+        X = X ^ RefVal::ReturnedOwned;
+      } else {
+        X = X ^ RefVal::ReturnedNotOwned;
+      }
+      break;
+    }
+
+    default:
+      return Pred;
+  }
+
+  // Update the binding.
+  state = setRefBinding(state, Sym, X);
+  Pred = C.addTransition(state);
+
+  // At this point we have updated the state properly.
+  // Everything after this is merely checking to see if the return value has
+  // been over- or under-retained.
+
+  // Did we cache out?
+  if (!Pred)
+    return nullptr;
+
+  // Update the autorelease counts.
+  static CheckerProgramPointTag AutoreleaseTag(this, "Autorelease");
+  state = handleAutoreleaseCounts(state, Pred, &AutoreleaseTag, C, Sym, X, S);
+
+  // Have we generated a sink node?
+  if (!state)
+    return nullptr;
+
+  // Get the updated binding.
+  T = getRefBinding(state, Sym);
+  assert(T);
+  X = *T;
+
+  // Consult the summary of the enclosing method.
+  RetainSummaryManager &Summaries = getSummaryManager(C);
+  const Decl *CD = &Pred->getCodeDecl();
+  RetEffect RE = RetEffect::MakeNoRet();
+
+  // FIXME: What is the convention for blocks? Is there one?
+  if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(CD)) {
+    const RetainSummary *Summ = Summaries.getMethodSummary(MD);
+    RE = Summ->getRetEffect();
+  } else if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(CD)) {
+    if (!isa<CXXMethodDecl>(FD)) {
+      const RetainSummary *Summ = Summaries.getFunctionSummary(FD);
+      RE = Summ->getRetEffect();
+    }
+  }
+
+  return checkReturnWithRetEffect(S, C, Pred, RE, X, Sym, state);
+}
+
+ExplodedNode * RetainCountChecker::checkReturnWithRetEffect(const ReturnStmt *S,
+                                                  CheckerContext &C,
+                                                  ExplodedNode *Pred,
+                                                  RetEffect RE, RefVal X,
+                                                  SymbolRef Sym,
+                                                  ProgramStateRef state) const {
+  // HACK: Ignore retain-count issues on values accessed through ivars,
+  // because of cases like this:
+  //   [_contentView retain];
+  //   [_contentView removeFromSuperview];
+  //   [self addSubview:_contentView]; // invalidates 'self'
+  //   [_contentView release];
+  if (X.getIvarAccessHistory() != RefVal::IvarAccessHistory::None)
+    return Pred;
+
+  // Any leaks or other errors?
+  if (X.isReturnedOwned() && X.getCount() == 0) {
+    if (RE.getKind() != RetEffect::NoRet) {
+      if (!RE.isOwned()) {
+
+        // The returning type is a CF, we expect the enclosing method should
+        // return ownership.
+        X = X ^ RefVal::ErrorLeakReturned;
+
+        // Generate an error node.
+        state = setRefBinding(state, Sym, X);
+
+        static CheckerProgramPointTag ReturnOwnLeakTag(this, "ReturnsOwnLeak");
+        ExplodedNode *N = C.addTransition(state, Pred, &ReturnOwnLeakTag);
+        if (N) {
+          const LangOptions &LOpts = C.getASTContext().getLangOpts();
+          auto R = llvm::make_unique<RefLeakReport>(
+              *getLeakAtReturnBug(LOpts), LOpts, N, Sym, C);
+          C.emitReport(std::move(R));
+        }
+        return N;
+      }
+    }
+  } else if (X.isReturnedNotOwned()) {
+    if (RE.isOwned()) {
+      if (X.getIvarAccessHistory() ==
+            RefVal::IvarAccessHistory::AccessedDirectly) {
+        // Assume the method was trying to transfer a +1 reference from a
+        // strong ivar to the caller.
+        state = setRefBinding(state, Sym,
+                              X.releaseViaIvar() ^ RefVal::ReturnedOwned);
+      } else {
+        // Trying to return a not owned object to a caller expecting an
+        // owned object.
+        state = setRefBinding(state, Sym, X ^ RefVal::ErrorReturnedNotOwned);
+
+        static CheckerProgramPointTag
+            ReturnNotOwnedTag(this, "ReturnNotOwnedForOwned");
+
+        ExplodedNode *N = C.addTransition(state, Pred, &ReturnNotOwnedTag);
+        if (N) {
+          if (!returnNotOwnedForOwned)
+            returnNotOwnedForOwned.reset(new ReturnedNotOwnedForOwned(this));
+
+          auto R = llvm::make_unique<RefCountReport>(
+              *returnNotOwnedForOwned, C.getASTContext().getLangOpts(), N, Sym);
+          C.emitReport(std::move(R));
+        }
+        return N;
+      }
+    }
+  }
+  return Pred;
+}
+
+//===----------------------------------------------------------------------===//
+// Check various ways a symbol can be invalidated.
+//===----------------------------------------------------------------------===//
+
+void RetainCountChecker::checkBind(SVal loc, SVal val, const Stmt *S,
+                                   CheckerContext &C) const {
+  // Are we storing to something that causes the value to "escape"?
+  bool escapes = true;
+
+  // A value escapes in three possible cases (this may change):
+  //
+  // (1) we are binding to something that is not a memory region.
+  // (2) we are binding to a memregion that does not have stack storage
+  ProgramStateRef state = C.getState();
+
+  if (auto regionLoc = loc.getAs<loc::MemRegionVal>()) {
+    escapes = shouldEscapeRegion(regionLoc->getRegion());
+  }
+
+  // If we are storing the value into an auto function scope variable annotated
+  // with (__attribute__((cleanup))), stop tracking the value to avoid leak
+  // false positives.
+  if (const auto *LVR = dyn_cast_or_null<VarRegion>(loc.getAsRegion())) {
+    const VarDecl *VD = LVR->getDecl();
+    if (VD->hasAttr<CleanupAttr>()) {
+      escapes = true;
+    }
+  }
+
+  // If our store can represent the binding and we aren't storing to something
+  // that doesn't have local storage then just return and have the simulation
+  // state continue as is.
+  if (!escapes)
+      return;
+
+  // Otherwise, find all symbols referenced by 'val' that we are tracking
+  // and stop tracking them.
+  state = state->scanReachableSymbols<StopTrackingCallback>(val).getState();
+  C.addTransition(state);
+}
+
+ProgramStateRef RetainCountChecker::evalAssume(ProgramStateRef state,
+                                               SVal Cond,
+                                               bool Assumption) const {
+  // FIXME: We may add to the interface of evalAssume the list of symbols
+  //  whose assumptions have changed.  For now we just iterate through the
+  //  bindings and check if any of the tracked symbols are NULL.  This isn't
+  //  too bad since the number of symbols we will track in practice are
+  //  probably small and evalAssume is only called at branches and a few
+  //  other places.
+  RefBindingsTy B = state->get<RefBindings>();
+
+  if (B.isEmpty())
+    return state;
+
+  bool changed = false;
+  RefBindingsTy::Factory &RefBFactory = state->get_context<RefBindings>();
+
+  for (RefBindingsTy::iterator I = B.begin(), E = B.end(); I != E; ++I) {
+    // Check if the symbol is null stop tracking the symbol.
+    ConstraintManager &CMgr = state->getConstraintManager();
+    ConditionTruthVal AllocFailed = CMgr.isNull(state, I.getKey());
+    if (AllocFailed.isConstrainedTrue()) {
+      changed = true;
+      B = RefBFactory.remove(B, I.getKey());
+    }
+  }
+
+  if (changed)
+    state = state->set<RefBindings>(B);
+
+  return state;
+}
+
+ProgramStateRef
+RetainCountChecker::checkRegionChanges(ProgramStateRef state,
+                                       const InvalidatedSymbols *invalidated,
+                                       ArrayRef<const MemRegion *> ExplicitRegions,
+                                       ArrayRef<const MemRegion *> Regions,
+                                       const LocationContext *LCtx,
+                                       const CallEvent *Call) const {
+  if (!invalidated)
+    return state;
+
+  llvm::SmallPtrSet<SymbolRef, 8> WhitelistedSymbols;
+  for (ArrayRef<const MemRegion *>::iterator I = ExplicitRegions.begin(),
+       E = ExplicitRegions.end(); I != E; ++I) {
+    if (const SymbolicRegion *SR = (*I)->StripCasts()->getAs<SymbolicRegion>())
+      WhitelistedSymbols.insert(SR->getSymbol());
+  }
+
+  for (SymbolRef sym :
+       llvm::make_range(invalidated->begin(), invalidated->end())) {
+    if (WhitelistedSymbols.count(sym))
+      continue;
+    // Remove any existing reference-count binding.
+    state = removeRefBinding(state, sym);
+  }
+  return state;
+}
+
+ProgramStateRef
+RetainCountChecker::handleAutoreleaseCounts(ProgramStateRef state,
+                                            ExplodedNode *Pred,
+                                            const ProgramPointTag *Tag,
+                                            CheckerContext &Ctx,
+                                            SymbolRef Sym,
+                                            RefVal V,
+                                            const ReturnStmt *S) const {
+  unsigned ACnt = V.getAutoreleaseCount();
+
+  // No autorelease counts?  Nothing to be done.
+  if (!ACnt)
+    return state;
+
+  unsigned Cnt = V.getCount();
+
+  // FIXME: Handle sending 'autorelease' to already released object.
+
+  if (V.getKind() == RefVal::ReturnedOwned)
+    ++Cnt;
+
+  // If we would over-release here, but we know the value came from an ivar,
+  // assume it was a strong ivar that's just been relinquished.
+  if (ACnt > Cnt &&
+      V.getIvarAccessHistory() == RefVal::IvarAccessHistory::AccessedDirectly) {
+    V = V.releaseViaIvar();
+    --ACnt;
+  }
+
+  if (ACnt <= Cnt) {
+    if (ACnt == Cnt) {
+      V.clearCounts();
+      if (V.getKind() == RefVal::ReturnedOwned) {
+        V = V ^ RefVal::ReturnedNotOwned;
+      } else {
+        V = V ^ RefVal::NotOwned;
+      }
+    } else {
+      V.setCount(V.getCount() - ACnt);
+      V.setAutoreleaseCount(0);
+    }
+    return setRefBinding(state, Sym, V);
+  }
+
+  // HACK: Ignore retain-count issues on values accessed through ivars,
+  // because of cases like this:
+  //   [_contentView retain];
+  //   [_contentView removeFromSuperview];
+  //   [self addSubview:_contentView]; // invalidates 'self'
+  //   [_contentView release];
+  if (V.getIvarAccessHistory() != RefVal::IvarAccessHistory::None)
+    return state;
+
+  // Woah!  More autorelease counts then retain counts left.
+  // Emit hard error.
+  V = V ^ RefVal::ErrorOverAutorelease;
+  state = setRefBinding(state, Sym, V);
+
+  ExplodedNode *N = Ctx.generateSink(state, Pred, Tag);
+  if (N) {
+    SmallString<128> sbuf;
+    llvm::raw_svector_ostream os(sbuf);
+    os << "Object was autoreleased ";
+    if (V.getAutoreleaseCount() > 1)
+      os << V.getAutoreleaseCount() << " times but the object ";
+    else
+      os << "but ";
+    os << "has a +" << V.getCount() << " retain count";
+
+    if (!overAutorelease)
+      overAutorelease.reset(new OverAutorelease(this));
+
+    const LangOptions &LOpts = Ctx.getASTContext().getLangOpts();
+    auto R = llvm::make_unique<RefCountReport>(*overAutorelease, LOpts, N, Sym,
+                                            os.str());
+    Ctx.emitReport(std::move(R));
+  }
+
+  return nullptr;
+}
+
+ProgramStateRef
+RetainCountChecker::handleSymbolDeath(ProgramStateRef state,
+                                      SymbolRef sid, RefVal V,
+                                    SmallVectorImpl<SymbolRef> &Leaked) const {
+  bool hasLeak;
+
+  // HACK: Ignore retain-count issues on values accessed through ivars,
+  // because of cases like this:
+  //   [_contentView retain];
+  //   [_contentView removeFromSuperview];
+  //   [self addSubview:_contentView]; // invalidates 'self'
+  //   [_contentView release];
+  if (V.getIvarAccessHistory() != RefVal::IvarAccessHistory::None)
+    hasLeak = false;
+  else if (V.isOwned())
+    hasLeak = true;
+  else if (V.isNotOwned() || V.isReturnedOwned())
+    hasLeak = (V.getCount() > 0);
+  else
+    hasLeak = false;
+
+  if (!hasLeak)
+    return removeRefBinding(state, sid);
+
+  Leaked.push_back(sid);
+  return setRefBinding(state, sid, V ^ RefVal::ErrorLeak);
+}
+
+ExplodedNode *
+RetainCountChecker::processLeaks(ProgramStateRef state,
+                                 SmallVectorImpl<SymbolRef> &Leaked,
+                                 CheckerContext &Ctx,
+                                 ExplodedNode *Pred) const {
+  // Generate an intermediate node representing the leak point.
+  ExplodedNode *N = Ctx.addTransition(state, Pred);
+
+  if (N) {
+    for (SmallVectorImpl<SymbolRef>::iterator
+         I = Leaked.begin(), E = Leaked.end(); I != E; ++I) {
+
+      const LangOptions &LOpts = Ctx.getASTContext().getLangOpts();
+      RefCountBug *BT = Pred ? getLeakWithinFunctionBug(LOpts)
+                          : getLeakAtReturnBug(LOpts);
+      assert(BT && "BugType not initialized.");
+
+      Ctx.emitReport(
+          llvm::make_unique<RefLeakReport>(*BT, LOpts, N, *I, Ctx));
+    }
+  }
+
+  return N;
+}
+
+static bool isISLObjectRef(QualType Ty) {
+  return StringRef(Ty.getAsString()).startswith("isl_");
+}
+
+void RetainCountChecker::checkBeginFunction(CheckerContext &Ctx) const {
+  if (!Ctx.inTopFrame())
+    return;
+
+  RetainSummaryManager &SmrMgr = getSummaryManager(Ctx);
+  const LocationContext *LCtx = Ctx.getLocationContext();
+  const FunctionDecl *FD = dyn_cast<FunctionDecl>(LCtx->getDecl());
+
+  if (!FD || SmrMgr.isTrustedReferenceCountImplementation(FD))
+    return;
+
+  ProgramStateRef state = Ctx.getState();
+  const RetainSummary *FunctionSummary = SmrMgr.getFunctionSummary(FD);
+  ArgEffects CalleeSideArgEffects = FunctionSummary->getArgEffects();
+
+  for (unsigned idx = 0, e = FD->getNumParams(); idx != e; ++idx) {
+    const ParmVarDecl *Param = FD->getParamDecl(idx);
+    SymbolRef Sym = state->getSVal(state->getRegion(Param, LCtx)).getAsSymbol();
+
+    QualType Ty = Param->getType();
+    const ArgEffect *AE = CalleeSideArgEffects.lookup(idx);
+    if (AE && AE->getKind() == DecRef && isISLObjectRef(Ty)) {
+      state = setRefBinding(
+          state, Sym, RefVal::makeOwned(ObjKind::Generalized, Ty));
+    } else if (isISLObjectRef(Ty)) {
+      state = setRefBinding(
+          state, Sym,
+          RefVal::makeNotOwned(ObjKind::Generalized, Ty));
+    }
+  }
+
+  Ctx.addTransition(state);
+}
+
+void RetainCountChecker::checkEndFunction(const ReturnStmt *RS,
+                                          CheckerContext &Ctx) const {
+  ExplodedNode *Pred = processReturn(RS, Ctx);
+
+  // Created state cached out.
+  if (!Pred) {
+    return;
+  }
+
+  ProgramStateRef state = Pred->getState();
+  RefBindingsTy B = state->get<RefBindings>();
+
+  // Don't process anything within synthesized bodies.
+  const LocationContext *LCtx = Pred->getLocationContext();
+  if (LCtx->getAnalysisDeclContext()->isBodyAutosynthesized()) {
+    assert(!LCtx->inTopFrame());
+    return;
+  }
+
+  for (RefBindingsTy::iterator I = B.begin(), E = B.end(); I != E; ++I) {
+    state = handleAutoreleaseCounts(state, Pred, /*Tag=*/nullptr, Ctx,
+                                    I->first, I->second);
+    if (!state)
+      return;
+  }
+
+  // If the current LocationContext has a parent, don't check for leaks.
+  // We will do that later.
+  // FIXME: we should instead check for imbalances of the retain/releases,
+  // and suggest annotations.
+  if (LCtx->getParent())
+    return;
+
+  B = state->get<RefBindings>();
+  SmallVector<SymbolRef, 10> Leaked;
+
+  for (RefBindingsTy::iterator I = B.begin(), E = B.end(); I != E; ++I)
+    state = handleSymbolDeath(state, I->first, I->second, Leaked);
+
+  processLeaks(state, Leaked, Ctx, Pred);
+}
+
+void RetainCountChecker::checkDeadSymbols(SymbolReaper &SymReaper,
+                                          CheckerContext &C) const {
+  ExplodedNode *Pred = C.getPredecessor();
+
+  ProgramStateRef state = C.getState();
+  RefBindingsTy B = state->get<RefBindings>();
+  SmallVector<SymbolRef, 10> Leaked;
+
+  // Update counts from autorelease pools
+  for (const auto &I: state->get<RefBindings>()) {
+    SymbolRef Sym = I.first;
+    if (SymReaper.isDead(Sym)) {
+      static CheckerProgramPointTag Tag(this, "DeadSymbolAutorelease");
+      const RefVal &V = I.second;
+      state = handleAutoreleaseCounts(state, Pred, &Tag, C, Sym, V);
+      if (!state)
+        return;
+
+      // Fetch the new reference count from the state, and use it to handle
+      // this symbol.
+      state = handleSymbolDeath(state, Sym, *getRefBinding(state, Sym), Leaked);
+    }
+  }
+
+  if (Leaked.empty()) {
+    C.addTransition(state);
+    return;
+  }
+
+  Pred = processLeaks(state, Leaked, C, Pred);
+
+  // Did we cache out?
+  if (!Pred)
+    return;
+
+  // Now generate a new node that nukes the old bindings.
+  // The only bindings left at this point are the leaked symbols.
+  RefBindingsTy::Factory &F = state->get_context<RefBindings>();
+  B = state->get<RefBindings>();
+
+  for (SmallVectorImpl<SymbolRef>::iterator I = Leaked.begin(),
+                                            E = Leaked.end();
+       I != E; ++I)
+    B = F.remove(B, *I);
+
+  state = state->set<RefBindings>(B);
+  C.addTransition(state, Pred);
+}
+
+void RetainCountChecker::printState(raw_ostream &Out, ProgramStateRef State,
+                                    const char *NL, const char *Sep) const {
+
+  RefBindingsTy B = State->get<RefBindings>();
+
+  if (B.isEmpty())
+    return;
+
+  Out << Sep << NL;
+
+  for (RefBindingsTy::iterator I = B.begin(), E = B.end(); I != E; ++I) {
+    Out << I->first << " : ";
+    I->second.print(Out);
+    Out << NL;
+  }
+}
+
+//===----------------------------------------------------------------------===//
+// Checker registration.
+//===----------------------------------------------------------------------===//
+
+void ento::registerRetainCountChecker(CheckerManager &Mgr) {
+  auto *Chk = Mgr.registerChecker<RetainCountChecker>();
+  Chk->TrackObjCAndCFObjects = true;
+}
+
+// FIXME: remove this, hack for backwards compatibility:
+// it should be possible to enable the NS/CF retain count checker as
+// osx.cocoa.RetainCount, and it should be possible to disable
+// osx.OSObjectRetainCount using osx.cocoa.RetainCount:CheckOSObject=false.
+static bool hasPrevCheckOSObjectOptionDisabled(AnalyzerOptions &Options) {
+  auto I = Options.Config.find("osx.cocoa.RetainCount:CheckOSObject");
+  if (I != Options.Config.end())
+    return I->getValue() == "false";
+  return false;
+}
+
+void ento::registerOSObjectRetainCountChecker(CheckerManager &Mgr) {
+  auto *Chk = Mgr.registerChecker<RetainCountChecker>();
+  if (!hasPrevCheckOSObjectOptionDisabled(Mgr.getAnalyzerOptions()))
+    Chk->TrackOSObjects = true;
+}
diff --git a/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountChecker.h b/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountChecker.h
new file mode 100644
index 0000000000000..31e2d9ae4932b
--- /dev/null
+++ b/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountChecker.h
@@ -0,0 +1,393 @@
+//==--- RetainCountChecker.h - Checks for leaks and other issues -*- C++ -*--//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+//  This file defines the methods for RetainCountChecker, which implements
+//  a reference count checker for Core Foundation and Cocoa on (Mac OS X).
+//
+//===----------------------------------------------------------------------===//
+
+#ifndef LLVM_CLANG_LIB_STATICANALYZER_CHECKERS_RETAINCOUNTCHECKER_H
+#define LLVM_CLANG_LIB_STATICANALYZER_CHECKERS_RETAINCOUNTCHECKER_H
+
+#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
+#include "RetainCountDiagnostics.h"
+#include "clang/AST/Attr.h"
+#include "clang/AST/DeclCXX.h"
+#include "clang/AST/DeclObjC.h"
+#include "clang/AST/ParentMap.h"
+#include "clang/Analysis/DomainSpecific/CocoaConventions.h"
+#include "clang/Basic/LangOptions.h"
+#include "clang/Basic/SourceManager.h"
+#include "clang/Analysis/SelectorExtras.h"
+#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
+#include "clang/StaticAnalyzer/Core/BugReporter/PathDiagnostic.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
+#include "clang/StaticAnalyzer/Core/CheckerManager.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h"
+#include "clang/StaticAnalyzer/Core/RetainSummaryManager.h"
+#include "llvm/ADT/DenseMap.h"
+#include "llvm/ADT/FoldingSet.h"
+#include "llvm/ADT/ImmutableList.h"
+#include "llvm/ADT/ImmutableMap.h"
+#include "llvm/ADT/STLExtras.h"
+#include "llvm/ADT/SmallString.h"
+#include "llvm/ADT/StringExtras.h"
+#include <cstdarg>
+#include <utility>
+
+namespace clang {
+namespace ento {
+namespace retaincountchecker {
+
+/// Metadata on reference.
+class RefVal {
+public:
+  enum Kind {
+    Owned = 0, // Owning reference.
+    NotOwned,  // Reference is not owned by still valid (not freed).
+    Released,  // Object has been released.
+    ReturnedOwned, // Returned object passes ownership to caller.
+    ReturnedNotOwned, // Return object does not pass ownership to caller.
+    ERROR_START,
+    ErrorDeallocNotOwned, // -dealloc called on non-owned object.
+    ErrorUseAfterRelease, // Object used after released.
+    ErrorReleaseNotOwned, // Release of an object that was not owned.
+    ERROR_LEAK_START,
+    ErrorLeak,  // A memory leak due to excessive reference counts.
+    ErrorLeakReturned, // A memory leak due to the returning method not having
+                       // the correct naming conventions.
+    ErrorOverAutorelease,
+    ErrorReturnedNotOwned
+  };
+
+  /// Tracks how an object referenced by an ivar has been used.
+  ///
+  /// This accounts for us not knowing if an arbitrary ivar is supposed to be
+  /// stored at +0 or +1.
+  enum class IvarAccessHistory {
+    None,
+    AccessedDirectly,
+    ReleasedAfterDirectAccess
+  };
+
+private:
+  /// The number of outstanding retains.
+  unsigned Cnt;
+  /// The number of outstanding autoreleases.
+  unsigned ACnt;
+  /// The (static) type of the object at the time we started tracking it.
+  QualType T;
+
+  /// The current state of the object.
+  ///
+  /// See the RefVal::Kind enum for possible values.
+  unsigned RawKind : 5;
+
+  /// The kind of object being tracked (CF or ObjC or OSObject), if known.
+  ///
+  /// See the ObjKind enum for possible values.
+  unsigned RawObjectKind : 3;
+
+  /// True if the current state and/or retain count may turn out to not be the
+  /// best possible approximation of the reference counting state.
+  ///
+  /// If true, the checker may decide to throw away ("override") this state
+  /// in favor of something else when it sees the object being used in new ways.
+  ///
+  /// This setting should not be propagated to state derived from this state.
+  /// Once we start deriving new states, it would be inconsistent to override
+  /// them.
+  unsigned RawIvarAccessHistory : 2;
+
+  RefVal(Kind k, ObjKind o, unsigned cnt, unsigned acnt, QualType t,
+         IvarAccessHistory IvarAccess)
+    : Cnt(cnt), ACnt(acnt), T(t), RawKind(static_cast<unsigned>(k)),
+      RawObjectKind(static_cast<unsigned>(o)),
+      RawIvarAccessHistory(static_cast<unsigned>(IvarAccess)) {
+    assert(getKind() == k && "not enough bits for the kind");
+    assert(getObjKind() == o && "not enough bits for the object kind");
+    assert(getIvarAccessHistory() == IvarAccess && "not enough bits");
+  }
+
+public:
+  Kind getKind() const { return static_cast<Kind>(RawKind); }
+
+  ObjKind getObjKind() const {
+    return static_cast<ObjKind>(RawObjectKind);
+  }
+
+  unsigned getCount() const { return Cnt; }
+  unsigned getAutoreleaseCount() const { return ACnt; }
+  unsigned getCombinedCounts() const { return Cnt + ACnt; }
+  void clearCounts() {
+    Cnt = 0;
+    ACnt = 0;
+  }
+  void setCount(unsigned i) {
+    Cnt = i;
+  }
+  void setAutoreleaseCount(unsigned i) {
+    ACnt = i;
+  }
+
+  QualType getType() const { return T; }
+
+  /// Returns what the analyzer knows about direct accesses to a particular
+  /// instance variable.
+  ///
+  /// If the object with this refcount wasn't originally from an Objective-C
+  /// ivar region, this should always return IvarAccessHistory::None.
+  IvarAccessHistory getIvarAccessHistory() const {
+    return static_cast<IvarAccessHistory>(RawIvarAccessHistory);
+  }
+
+  bool isOwned() const {
+    return getKind() == Owned;
+  }
+
+  bool isNotOwned() const {
+    return getKind() == NotOwned;
+  }
+
+  bool isReturnedOwned() const {
+    return getKind() == ReturnedOwned;
+  }
+
+  bool isReturnedNotOwned() const {
+    return getKind() == ReturnedNotOwned;
+  }
+
+  /// Create a state for an object whose lifetime is the responsibility of the
+  /// current function, at least partially.
+  ///
+  /// Most commonly, this is an owned object with a retain count of +1.
+  static RefVal makeOwned(ObjKind o, QualType t) {
+    return RefVal(Owned, o, /*Count=*/1, 0, t, IvarAccessHistory::None);
+  }
+
+  /// Create a state for an object whose lifetime is not the responsibility of
+  /// the current function.
+  ///
+  /// Most commonly, this is an unowned object with a retain count of +0.
+  static RefVal makeNotOwned(ObjKind o, QualType t) {
+    return RefVal(NotOwned, o, /*Count=*/0, 0, t, IvarAccessHistory::None);
+  }
+
+  RefVal operator-(size_t i) const {
+    return RefVal(getKind(), getObjKind(), getCount() - i,
+                  getAutoreleaseCount(), getType(), getIvarAccessHistory());
+  }
+
+  RefVal operator+(size_t i) const {
+    return RefVal(getKind(), getObjKind(), getCount() + i,
+                  getAutoreleaseCount(), getType(), getIvarAccessHistory());
+  }
+
+  RefVal operator^(Kind k) const {
+    return RefVal(k, getObjKind(), getCount(), getAutoreleaseCount(),
+                  getType(), getIvarAccessHistory());
+  }
+
+  RefVal autorelease() const {
+    return RefVal(getKind(), getObjKind(), getCount(), getAutoreleaseCount()+1,
+                  getType(), getIvarAccessHistory());
+  }
+
+  RefVal withIvarAccess() const {
+    assert(getIvarAccessHistory() == IvarAccessHistory::None);
+    return RefVal(getKind(), getObjKind(), getCount(), getAutoreleaseCount(),
+                  getType(), IvarAccessHistory::AccessedDirectly);
+  }
+
+  RefVal releaseViaIvar() const {
+    assert(getIvarAccessHistory() == IvarAccessHistory::AccessedDirectly);
+    return RefVal(getKind(), getObjKind(), getCount(), getAutoreleaseCount(),
+                  getType(), IvarAccessHistory::ReleasedAfterDirectAccess);
+  }
+
+  // Comparison, profiling, and pretty-printing.
+  bool hasSameState(const RefVal &X) const {
+    return getKind() == X.getKind() && Cnt == X.Cnt && ACnt == X.ACnt &&
+           getIvarAccessHistory() == X.getIvarAccessHistory();
+  }
+
+  bool operator==(const RefVal& X) const {
+    return T == X.T && hasSameState(X) && getObjKind() == X.getObjKind();
+  }
+
+  void Profile(llvm::FoldingSetNodeID& ID) const {
+    ID.Add(T);
+    ID.AddInteger(RawKind);
+    ID.AddInteger(Cnt);
+    ID.AddInteger(ACnt);
+    ID.AddInteger(RawObjectKind);
+    ID.AddInteger(RawIvarAccessHistory);
+  }
+
+  void print(raw_ostream &Out) const;
+};
+
+class RetainCountChecker
+  : public Checker< check::Bind,
+                    check::DeadSymbols,
+                    check::BeginFunction,
+                    check::EndFunction,
+                    check::PostStmt<BlockExpr>,
+                    check::PostStmt<CastExpr>,
+                    check::PostStmt<ObjCArrayLiteral>,
+                    check::PostStmt<ObjCDictionaryLiteral>,
+                    check::PostStmt<ObjCBoxedExpr>,
+                    check::PostStmt<ObjCIvarRefExpr>,
+                    check::PostCall,
+                    check::RegionChanges,
+                    eval::Assume,
+                    eval::Call > {
+  mutable std::unique_ptr<RefCountBug> useAfterRelease, releaseNotOwned;
+  mutable std::unique_ptr<RefCountBug> deallocNotOwned;
+  mutable std::unique_ptr<RefCountBug> overAutorelease, returnNotOwnedForOwned;
+  mutable std::unique_ptr<RefCountBug> leakWithinFunction, leakAtReturn;
+
+  mutable std::unique_ptr<RetainSummaryManager> Summaries;
+public:
+  static constexpr const char *DeallocTagDescription = "DeallocSent";
+
+  /// Track Objective-C and CoreFoundation objects.
+  bool TrackObjCAndCFObjects = false;
+
+  /// Track sublcasses of OSObject.
+  bool TrackOSObjects = false;
+
+  RetainCountChecker() {}
+
+  RefCountBug *getLeakWithinFunctionBug(const LangOptions &LOpts) const;
+
+  RefCountBug *getLeakAtReturnBug(const LangOptions &LOpts) const;
+
+  RetainSummaryManager &getSummaryManager(ASTContext &Ctx) const {
+    // FIXME: We don't support ARC being turned on and off during one analysis.
+    // (nor, for that matter, do we support changing ASTContexts)
+    bool ARCEnabled = (bool)Ctx.getLangOpts().ObjCAutoRefCount;
+    if (!Summaries) {
+      Summaries.reset(new RetainSummaryManager(
+          Ctx, ARCEnabled, TrackObjCAndCFObjects, TrackOSObjects));
+    } else {
+      assert(Summaries->isARCEnabled() == ARCEnabled);
+    }
+    return *Summaries;
+  }
+
+  RetainSummaryManager &getSummaryManager(CheckerContext &C) const {
+    return getSummaryManager(C.getASTContext());
+  }
+
+  void printState(raw_ostream &Out, ProgramStateRef State,
+                  const char *NL, const char *Sep) const override;
+
+  void checkBind(SVal loc, SVal val, const Stmt *S, CheckerContext &C) const;
+  void checkPostStmt(const BlockExpr *BE, CheckerContext &C) const;
+  void checkPostStmt(const CastExpr *CE, CheckerContext &C) const;
+
+  void checkPostStmt(const ObjCArrayLiteral *AL, CheckerContext &C) const;
+  void checkPostStmt(const ObjCDictionaryLiteral *DL, CheckerContext &C) const;
+  void checkPostStmt(const ObjCBoxedExpr *BE, CheckerContext &C) const;
+
+  void checkPostStmt(const ObjCIvarRefExpr *IRE, CheckerContext &C) const;
+
+  void checkPostCall(const CallEvent &Call, CheckerContext &C) const;
+
+  void checkSummary(const RetainSummary &Summ, const CallEvent &Call,
+                    CheckerContext &C) const;
+
+  void processSummaryOfInlined(const RetainSummary &Summ,
+                               const CallEvent &Call,
+                               CheckerContext &C) const;
+
+  bool evalCall(const CallExpr *CE, CheckerContext &C) const;
+
+  ProgramStateRef evalAssume(ProgramStateRef state, SVal Cond,
+                                 bool Assumption) const;
+
+  ProgramStateRef
+  checkRegionChanges(ProgramStateRef state,
+                     const InvalidatedSymbols *invalidated,
+                     ArrayRef<const MemRegion *> ExplicitRegions,
+                     ArrayRef<const MemRegion *> Regions,
+                     const LocationContext* LCtx,
+                     const CallEvent *Call) const;
+
+  ExplodedNode* checkReturnWithRetEffect(const ReturnStmt *S, CheckerContext &C,
+                                ExplodedNode *Pred, RetEffect RE, RefVal X,
+                                SymbolRef Sym, ProgramStateRef state) const;
+
+  void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const;
+  void checkBeginFunction(CheckerContext &C) const;
+  void checkEndFunction(const ReturnStmt *RS, CheckerContext &C) const;
+
+  ProgramStateRef updateSymbol(ProgramStateRef state, SymbolRef sym,
+                               RefVal V, ArgEffect E, RefVal::Kind &hasErr,
+                               CheckerContext &C) const;
+
+  void processNonLeakError(ProgramStateRef St, SourceRange ErrorRange,
+                           RefVal::Kind ErrorKind, SymbolRef Sym,
+                           CheckerContext &C) const;
+
+  void processObjCLiterals(CheckerContext &C, const Expr *Ex) const;
+
+  ProgramStateRef handleSymbolDeath(ProgramStateRef state,
+                                    SymbolRef sid, RefVal V,
+                                    SmallVectorImpl<SymbolRef> &Leaked) const;
+
+  ProgramStateRef
+  handleAutoreleaseCounts(ProgramStateRef state, ExplodedNode *Pred,
+                          const ProgramPointTag *Tag, CheckerContext &Ctx,
+                          SymbolRef Sym,
+                          RefVal V,
+                          const ReturnStmt *S=nullptr) const;
+
+  ExplodedNode *processLeaks(ProgramStateRef state,
+                             SmallVectorImpl<SymbolRef> &Leaked,
+                             CheckerContext &Ctx,
+                             ExplodedNode *Pred = nullptr) const;
+
+private:
+  /// Perform the necessary checks and state adjustments at the end of the
+  /// function.
+  /// \p S Return statement, may be null.
+  ExplodedNode * processReturn(const ReturnStmt *S, CheckerContext &C) const;
+};
+
+//===----------------------------------------------------------------------===//
+// RefBindings - State used to track object reference counts.
+//===----------------------------------------------------------------------===//
+
+const RefVal *getRefBinding(ProgramStateRef State, SymbolRef Sym);
+
+ProgramStateRef setRefBinding(ProgramStateRef State, SymbolRef Sym,
+                                     RefVal Val);
+
+ProgramStateRef removeRefBinding(ProgramStateRef State, SymbolRef Sym);
+
+/// Returns true if this stack frame is for an Objective-C method that is a
+/// property getter or setter whose body has been synthesized by the analyzer.
+inline bool isSynthesizedAccessor(const StackFrameContext *SFC) {
+  auto Method = dyn_cast_or_null<ObjCMethodDecl>(SFC->getDecl());
+  if (!Method || !Method->isPropertyAccessor())
+    return false;
+
+  return SFC->getAnalysisDeclContext()->isBodyAutosynthesized();
+}
+
+} // end namespace retaincountchecker
+} // end namespace ento
+} // end namespace clang
+
+#endif
diff --git a/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountDiagnostics.cpp b/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountDiagnostics.cpp
new file mode 100644
index 0000000000000..cda1a928de134
--- /dev/null
+++ b/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountDiagnostics.cpp
@@ -0,0 +1,794 @@
+// RetainCountDiagnostics.cpp - Checks for leaks and other issues -*- C++ -*--//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+//  This file defines diagnostics for RetainCountChecker, which implements
+//  a reference count checker for Core Foundation and Cocoa on (Mac OS X).
+//
+//===----------------------------------------------------------------------===//
+
+#include "RetainCountDiagnostics.h"
+#include "RetainCountChecker.h"
+
+using namespace clang;
+using namespace ento;
+using namespace retaincountchecker;
+
+static bool isNumericLiteralExpression(const Expr *E) {
+  // FIXME: This set of cases was copied from SemaExprObjC.
+  return isa<IntegerLiteral>(E) ||
+         isa<CharacterLiteral>(E) ||
+         isa<FloatingLiteral>(E) ||
+         isa<ObjCBoolLiteralExpr>(E) ||
+         isa<CXXBoolLiteralExpr>(E);
+}
+
+/// If type represents a pointer to CXXRecordDecl,
+/// and is not a typedef, return the decl name.
+/// Otherwise, return the serialization of type.
+static std::string getPrettyTypeName(QualType QT) {
+  QualType PT = QT->getPointeeType();
+  if (!PT.isNull() && !QT->getAs<TypedefType>())
+    if (const auto *RD = PT->getAsCXXRecordDecl())
+      return RD->getName();
+  return QT.getAsString();
+}
+
+/// Write information about the type state change to {@code os},
+/// return whether the note should be generated.
+static bool shouldGenerateNote(llvm::raw_string_ostream &os,
+                               const RefVal *PrevT, const RefVal &CurrV,
+                               bool DeallocSent) {
+  // Get the previous type state.
+  RefVal PrevV = *PrevT;
+
+  // Specially handle -dealloc.
+  if (DeallocSent) {
+    // Determine if the object's reference count was pushed to zero.
+    assert(!PrevV.hasSameState(CurrV) && "The state should have changed.");
+    // We may not have transitioned to 'release' if we hit an error.
+    // This case is handled elsewhere.
+    if (CurrV.getKind() == RefVal::Released) {
+      assert(CurrV.getCombinedCounts() == 0);
+      os << "Object released by directly sending the '-dealloc' message";
+      return true;
+    }
+  }
+
+  // Determine if the typestate has changed.
+  if (!PrevV.hasSameState(CurrV))
+    switch (CurrV.getKind()) {
+    case RefVal::Owned:
+    case RefVal::NotOwned:
+      if (PrevV.getCount() == CurrV.getCount()) {
+        // Did an autorelease message get sent?
+        if (PrevV.getAutoreleaseCount() == CurrV.getAutoreleaseCount())
+          return false;
+
+        assert(PrevV.getAutoreleaseCount() < CurrV.getAutoreleaseCount());
+        os << "Object autoreleased";
+        return true;
+      }
+
+      if (PrevV.getCount() > CurrV.getCount())
+        os << "Reference count decremented.";
+      else
+        os << "Reference count incremented.";
+
+      if (unsigned Count = CurrV.getCount())
+        os << " The object now has a +" << Count << " retain count.";
+
+      return true;
+
+    case RefVal::Released:
+      if (CurrV.getIvarAccessHistory() ==
+              RefVal::IvarAccessHistory::ReleasedAfterDirectAccess &&
+          CurrV.getIvarAccessHistory() != PrevV.getIvarAccessHistory()) {
+        os << "Strong instance variable relinquished. ";
+      }
+      os << "Object released.";
+      return true;
+
+    case RefVal::ReturnedOwned:
+      // Autoreleases can be applied after marking a node ReturnedOwned.
+      if (CurrV.getAutoreleaseCount())
+        return false;
+
+      os << "Object returned to caller as an owning reference (single "
+            "retain count transferred to caller)";
+      return true;
+
+    case RefVal::ReturnedNotOwned:
+      os << "Object returned to caller with a +0 retain count";
+      return true;
+
+    default:
+      return false;
+    }
+  return true;
+}
+
+/// Finds argument index of the out paramter in the call {@code S}
+/// corresponding to the symbol {@code Sym}.
+/// If none found, returns None.
+static Optional<unsigned> findArgIdxOfSymbol(ProgramStateRef CurrSt,
+                                             const LocationContext *LCtx,
+                                             SymbolRef &Sym,
+                                             Optional<CallEventRef<>> CE) {
+  if (!CE)
+    return None;
+
+  for (unsigned Idx = 0; Idx < (*CE)->getNumArgs(); Idx++)
+    if (const MemRegion *MR = (*CE)->getArgSVal(Idx).getAsRegion())
+      if (const auto *TR = dyn_cast<TypedValueRegion>(MR))
+        if (CurrSt->getSVal(MR, TR->getValueType()).getAsSymExpr() == Sym)
+          return Idx;
+
+  return None;
+}
+
+static void generateDiagnosticsForCallLike(ProgramStateRef CurrSt,
+                                           const LocationContext *LCtx,
+                                           const RefVal &CurrV, SymbolRef &Sym,
+                                           const Stmt *S,
+                                           llvm::raw_string_ostream &os) {
+  CallEventManager &Mgr = CurrSt->getStateManager().getCallEventManager();
+  if (const CallExpr *CE = dyn_cast<CallExpr>(S)) {
+    // Get the name of the callee (if it is available)
+    // from the tracked SVal.
+    SVal X = CurrSt->getSValAsScalarOrLoc(CE->getCallee(), LCtx);
+    const FunctionDecl *FD = X.getAsFunctionDecl();
+
+    // If failed, try to get it from AST.
+    if (!FD)
+      FD = dyn_cast<FunctionDecl>(CE->getCalleeDecl());
+
+    if (const auto *MD = dyn_cast<CXXMethodDecl>(CE->getCalleeDecl())) {
+      os << "Call to method '" << MD->getQualifiedNameAsString() << '\'';
+    } else if (FD) {
+      os << "Call to function '" << FD->getQualifiedNameAsString() << '\'';
+    } else {
+      os << "function call";
+    }
+  } else if (isa<CXXNewExpr>(S)) {
+    os << "Operator 'new'";
+  } else {
+    assert(isa<ObjCMessageExpr>(S));
+    CallEventRef<ObjCMethodCall> Call =
+        Mgr.getObjCMethodCall(cast<ObjCMessageExpr>(S), CurrSt, LCtx);
+
+    switch (Call->getMessageKind()) {
+    case OCM_Message:
+      os << "Method";
+      break;
+    case OCM_PropertyAccess:
+      os << "Property";
+      break;
+    case OCM_Subscript:
+      os << "Subscript";
+      break;
+    }
+  }
+
+  Optional<CallEventRef<>> CE = Mgr.getCall(S, CurrSt, LCtx);
+  auto Idx = findArgIdxOfSymbol(CurrSt, LCtx, Sym, CE);
+
+  // If index is not found, we assume that the symbol was returned.
+  if (!Idx) {
+    os << " returns ";
+  } else {
+    os << " writes ";
+  }
+
+  if (CurrV.getObjKind() == ObjKind::CF) {
+    os << "a Core Foundation object of type '"
+       << Sym->getType().getAsString() << "' with a ";
+  } else if (CurrV.getObjKind() == ObjKind::OS) {
+    os << "an OSObject of type '" << getPrettyTypeName(Sym->getType())
+       << "' with a ";
+  } else if (CurrV.getObjKind() == ObjKind::Generalized) {
+    os << "an object of type '" << Sym->getType().getAsString()
+       << "' with a ";
+  } else {
+    assert(CurrV.getObjKind() == ObjKind::ObjC);
+    QualType T = Sym->getType();
+    if (!isa<ObjCObjectPointerType>(T)) {
+      os << "an Objective-C object with a ";
+    } else {
+      const ObjCObjectPointerType *PT = cast<ObjCObjectPointerType>(T);
+      os << "an instance of " << PT->getPointeeType().getAsString()
+         << " with a ";
+    }
+  }
+
+  if (CurrV.isOwned()) {
+    os << "+1 retain count";
+  } else {
+    assert(CurrV.isNotOwned());
+    os << "+0 retain count";
+  }
+
+  if (Idx) {
+    os << " into an out parameter '";
+    const ParmVarDecl *PVD = (*CE)->parameters()[*Idx];
+    PVD->getNameForDiagnostic(os, PVD->getASTContext().getPrintingPolicy(),
+                              /*Qualified=*/false);
+    os << "'";
+
+    QualType RT = (*CE)->getResultType();
+    if (!RT.isNull() && !RT->isVoidType()) {
+      SVal RV = (*CE)->getReturnValue();
+      if (CurrSt->isNull(RV).isConstrainedTrue()) {
+        os << " (assuming the call returns zero)";
+      } else if (CurrSt->isNonNull(RV).isConstrainedTrue()) {
+        os << " (assuming the call returns non-zero)";
+      }
+
+    }
+  }
+}
+
+namespace clang {
+namespace ento {
+namespace retaincountchecker {
+
+class RefCountReportVisitor : public BugReporterVisitor {
+protected:
+  SymbolRef Sym;
+
+public:
+  RefCountReportVisitor(SymbolRef sym) : Sym(sym) {}
+
+  void Profile(llvm::FoldingSetNodeID &ID) const override {
+    static int x = 0;
+    ID.AddPointer(&x);
+    ID.AddPointer(Sym);
+  }
+
+  std::shared_ptr<PathDiagnosticPiece> VisitNode(const ExplodedNode *N,
+                                                 BugReporterContext &BRC,
+                                                 BugReport &BR) override;
+
+  std::shared_ptr<PathDiagnosticPiece> getEndPath(BugReporterContext &BRC,
+                                                  const ExplodedNode *N,
+                                                  BugReport &BR) override;
+};
+
+class RefLeakReportVisitor : public RefCountReportVisitor {
+public:
+  RefLeakReportVisitor(SymbolRef sym) : RefCountReportVisitor(sym) {}
+
+  std::shared_ptr<PathDiagnosticPiece> getEndPath(BugReporterContext &BRC,
+                                                  const ExplodedNode *N,
+                                                  BugReport &BR) override;
+};
+
+} // end namespace retaincountchecker
+} // end namespace ento
+} // end namespace clang
+
+
+/// Find the first node with the parent stack frame.
+static const ExplodedNode *getCalleeNode(const ExplodedNode *Pred) {
+  const StackFrameContext *SC = Pred->getStackFrame();
+  if (SC->inTopFrame())
+    return nullptr;
+  const StackFrameContext *PC = SC->getParent()->getStackFrame();
+  if (!PC)
+    return nullptr;
+
+  const ExplodedNode *N = Pred;
+  while (N && N->getStackFrame() != PC) {
+    N = N->getFirstPred();
+  }
+  return N;
+}
+
+
+/// Insert a diagnostic piece at function exit
+/// if a function parameter is annotated as "os_consumed",
+/// but it does not actually consume the reference.
+static std::shared_ptr<PathDiagnosticEventPiece>
+annotateConsumedSummaryMismatch(const ExplodedNode *N,
+                                CallExitBegin &CallExitLoc,
+                                const SourceManager &SM,
+                                CallEventManager &CEMgr) {
+
+  const ExplodedNode *CN = getCalleeNode(N);
+  if (!CN)
+    return nullptr;
+
+  CallEventRef<> Call = CEMgr.getCaller(N->getStackFrame(), N->getState());
+
+  std::string sbuf;
+  llvm::raw_string_ostream os(sbuf);
+  ArrayRef<const ParmVarDecl *> Parameters = Call->parameters();
+  for (unsigned I=0; I < Call->getNumArgs() && I < Parameters.size(); ++I) {
+    const ParmVarDecl *PVD = Parameters[I];
+
+    if (!PVD->hasAttr<OSConsumedAttr>())
+      continue;
+
+    if (SymbolRef SR = Call->getArgSVal(I).getAsLocSymbol()) {
+      const RefVal *CountBeforeCall = getRefBinding(CN->getState(), SR);
+      const RefVal *CountAtExit = getRefBinding(N->getState(), SR);
+
+      if (!CountBeforeCall || !CountAtExit)
+        continue;
+
+      unsigned CountBefore = CountBeforeCall->getCount();
+      unsigned CountAfter = CountAtExit->getCount();
+
+      bool AsExpected = CountBefore > 0 && CountAfter == CountBefore - 1;
+      if (!AsExpected) {
+        os << "Parameter '";
+        PVD->getNameForDiagnostic(os, PVD->getASTContext().getPrintingPolicy(),
+                                  /*Qualified=*/false);
+        os << "' is marked as consuming, but the function did not consume "
+           << "the reference\n";
+      }
+    }
+  }
+
+  if (os.str().empty())
+    return nullptr;
+
+  // FIXME: remove the code duplication with NoStoreFuncVisitor.
+  PathDiagnosticLocation L;
+  if (const ReturnStmt *RS = CallExitLoc.getReturnStmt()) {
+    L = PathDiagnosticLocation::createBegin(RS, SM, N->getLocationContext());
+  } else {
+    L = PathDiagnosticLocation(
+        Call->getRuntimeDefinition().getDecl()->getSourceRange().getEnd(), SM);
+  }
+
+  return std::make_shared<PathDiagnosticEventPiece>(L, os.str());
+}
+
+std::shared_ptr<PathDiagnosticPiece>
+RefCountReportVisitor::VisitNode(const ExplodedNode *N,
+                              BugReporterContext &BRC, BugReport &BR) {
+
+  const SourceManager &SM = BRC.getSourceManager();
+  CallEventManager &CEMgr = BRC.getStateManager().getCallEventManager();
+  if (auto CE = N->getLocationAs<CallExitBegin>())
+    if (auto PD = annotateConsumedSummaryMismatch(N, *CE, SM, CEMgr))
+      return PD;
+
+  // FIXME: We will eventually need to handle non-statement-based events
+  // (__attribute__((cleanup))).
+  if (!N->getLocation().getAs<StmtPoint>())
+    return nullptr;
+
+  // Check if the type state has changed.
+  const ExplodedNode *PrevNode = N->getFirstPred();
+  ProgramStateRef PrevSt = PrevNode->getState();
+  ProgramStateRef CurrSt = N->getState();
+  const LocationContext *LCtx = N->getLocationContext();
+
+  const RefVal* CurrT = getRefBinding(CurrSt, Sym);
+  if (!CurrT) return nullptr;
+
+  const RefVal &CurrV = *CurrT;
+  const RefVal *PrevT = getRefBinding(PrevSt, Sym);
+
+  // Create a string buffer to constain all the useful things we want
+  // to tell the user.
+  std::string sbuf;
+  llvm::raw_string_ostream os(sbuf);
+
+  // This is the allocation site since the previous node had no bindings
+  // for this symbol.
+  if (!PrevT) {
+    const Stmt *S = N->getLocation().castAs<StmtPoint>().getStmt();
+
+    if (isa<ObjCIvarRefExpr>(S) &&
+        isSynthesizedAccessor(LCtx->getStackFrame())) {
+      S = LCtx->getStackFrame()->getCallSite();
+    }
+
+    if (isa<ObjCArrayLiteral>(S)) {
+      os << "NSArray literal is an object with a +0 retain count";
+    } else if (isa<ObjCDictionaryLiteral>(S)) {
+      os << "NSDictionary literal is an object with a +0 retain count";
+    } else if (const ObjCBoxedExpr *BL = dyn_cast<ObjCBoxedExpr>(S)) {
+      if (isNumericLiteralExpression(BL->getSubExpr()))
+        os << "NSNumber literal is an object with a +0 retain count";
+      else {
+        const ObjCInterfaceDecl *BoxClass = nullptr;
+        if (const ObjCMethodDecl *Method = BL->getBoxingMethod())
+          BoxClass = Method->getClassInterface();
+
+        // We should always be able to find the boxing class interface,
+        // but consider this future-proofing.
+        if (BoxClass) {
+          os << *BoxClass << " b";
+        } else {
+          os << "B";
+        }
+
+        os << "oxed expression produces an object with a +0 retain count";
+      }
+    } else if (isa<ObjCIvarRefExpr>(S)) {
+      os << "Object loaded from instance variable";
+    } else {
+      generateDiagnosticsForCallLike(CurrSt, LCtx, CurrV, Sym, S, os);
+    }
+
+    PathDiagnosticLocation Pos(S, SM, N->getLocationContext());
+    return std::make_shared<PathDiagnosticEventPiece>(Pos, os.str());
+  }
+
+  // Gather up the effects that were performed on the object at this
+  // program point
+  bool DeallocSent = false;
+
+  if (N->getLocation().getTag() &&
+      N->getLocation().getTag()->getTagDescription().contains(
+          RetainCountChecker::DeallocTagDescription)) {
+    // We only have summaries attached to nodes after evaluating CallExpr and
+    // ObjCMessageExprs.
+    const Stmt *S = N->getLocation().castAs<StmtPoint>().getStmt();
+
+    if (const CallExpr *CE = dyn_cast<CallExpr>(S)) {
+      // Iterate through the parameter expressions and see if the symbol
+      // was ever passed as an argument.
+      unsigned i = 0;
+
+      for (auto AI=CE->arg_begin(), AE=CE->arg_end(); AI!=AE; ++AI, ++i) {
+
+        // Retrieve the value of the argument.  Is it the symbol
+        // we are interested in?
+        if (CurrSt->getSValAsScalarOrLoc(*AI, LCtx).getAsLocSymbol() != Sym)
+          continue;
+
+        // We have an argument.  Get the effect!
+        DeallocSent = true;
+      }
+    } else if (const ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(S)) {
+      if (const Expr *receiver = ME->getInstanceReceiver()) {
+        if (CurrSt->getSValAsScalarOrLoc(receiver, LCtx)
+              .getAsLocSymbol() == Sym) {
+          // The symbol we are tracking is the receiver.
+          DeallocSent = true;
+        }
+      }
+    }
+  }
+
+  if (!shouldGenerateNote(os, PrevT, CurrV, DeallocSent))
+    return nullptr;
+
+  if (os.str().empty())
+    return nullptr; // We have nothing to say!
+
+  const Stmt *S = N->getLocation().castAs<StmtPoint>().getStmt();
+  PathDiagnosticLocation Pos(S, BRC.getSourceManager(),
+                                N->getLocationContext());
+  auto P = std::make_shared<PathDiagnosticEventPiece>(Pos, os.str());
+
+  // Add the range by scanning the children of the statement for any bindings
+  // to Sym.
+  for (const Stmt *Child : S->children())
+    if (const Expr *Exp = dyn_cast_or_null<Expr>(Child))
+      if (CurrSt->getSValAsScalarOrLoc(Exp, LCtx).getAsLocSymbol() == Sym) {
+        P->addRange(Exp->getSourceRange());
+        break;
+      }
+
+  return std::move(P);
+}
+
+static Optional<std::string> describeRegion(const MemRegion *MR) {
+  if (const auto *VR = dyn_cast_or_null<VarRegion>(MR))
+    return std::string(VR->getDecl()->getName());
+  // Once we support more storage locations for bindings,
+  // this would need to be improved.
+  return None;
+}
+
+namespace {
+// Find the first node in the current function context that referred to the
+// tracked symbol and the memory location that value was stored to. Note, the
+// value is only reported if the allocation occurred in the same function as
+// the leak. The function can also return a location context, which should be
+// treated as interesting.
+struct AllocationInfo {
+  const ExplodedNode* N;
+  const MemRegion *R;
+  const LocationContext *InterestingMethodContext;
+  AllocationInfo(const ExplodedNode *InN,
+                 const MemRegion *InR,
+                 const LocationContext *InInterestingMethodContext) :
+    N(InN), R(InR), InterestingMethodContext(InInterestingMethodContext) {}
+};
+} // end anonymous namespace
+
+static AllocationInfo GetAllocationSite(ProgramStateManager &StateMgr,
+                                        const ExplodedNode *N, SymbolRef Sym) {
+  const ExplodedNode *AllocationNode = N;
+  const ExplodedNode *AllocationNodeInCurrentOrParentContext = N;
+  const MemRegion *FirstBinding = nullptr;
+  const LocationContext *LeakContext = N->getLocationContext();
+
+  // The location context of the init method called on the leaked object, if
+  // available.
+  const LocationContext *InitMethodContext = nullptr;
+
+  while (N) {
+    ProgramStateRef St = N->getState();
+    const LocationContext *NContext = N->getLocationContext();
+
+    if (!getRefBinding(St, Sym))
+      break;
+
+    StoreManager::FindUniqueBinding FB(Sym);
+    StateMgr.iterBindings(St, FB);
+
+    if (FB) {
+      const MemRegion *R = FB.getRegion();
+      // Do not show local variables belonging to a function other than
+      // where the error is reported.
+      if (auto MR = dyn_cast<StackSpaceRegion>(R->getMemorySpace()))
+        if (MR->getStackFrame() == LeakContext->getStackFrame())
+          FirstBinding = R;
+    }
+
+    // AllocationNode is the last node in which the symbol was tracked.
+    AllocationNode = N;
+
+    // AllocationNodeInCurrentContext, is the last node in the current or
+    // parent context in which the symbol was tracked.
+    //
+    // Note that the allocation site might be in the parent context. For example,
+    // the case where an allocation happens in a block that captures a reference
+    // to it and that reference is overwritten/dropped by another call to
+    // the block.
+    if (NContext == LeakContext || NContext->isParentOf(LeakContext))
+      AllocationNodeInCurrentOrParentContext = N;
+
+    // Find the last init that was called on the given symbol and store the
+    // init method's location context.
+    if (!InitMethodContext)
+      if (auto CEP = N->getLocation().getAs<CallEnter>()) {
+        const Stmt *CE = CEP->getCallExpr();
+        if (const auto *ME = dyn_cast_or_null<ObjCMessageExpr>(CE)) {
+          const Stmt *RecExpr = ME->getInstanceReceiver();
+          if (RecExpr) {
+            SVal RecV = St->getSVal(RecExpr, NContext);
+            if (ME->getMethodFamily() == OMF_init && RecV.getAsSymbol() == Sym)
+              InitMethodContext = CEP->getCalleeContext();
+          }
+        }
+      }
+
+    N = N->getFirstPred();
+  }
+
+  // If we are reporting a leak of the object that was allocated with alloc,
+  // mark its init method as interesting.
+  const LocationContext *InterestingMethodContext = nullptr;
+  if (InitMethodContext) {
+    const ProgramPoint AllocPP = AllocationNode->getLocation();
+    if (Optional<StmtPoint> SP = AllocPP.getAs<StmtPoint>())
+      if (const ObjCMessageExpr *ME = SP->getStmtAs<ObjCMessageExpr>())
+        if (ME->getMethodFamily() == OMF_alloc)
+          InterestingMethodContext = InitMethodContext;
+  }
+
+  // If allocation happened in a function different from the leak node context,
+  // do not report the binding.
+  assert(N && "Could not find allocation node");
+
+  if (AllocationNodeInCurrentOrParentContext &&
+      AllocationNodeInCurrentOrParentContext->getLocationContext() !=
+          LeakContext)
+    FirstBinding = nullptr;
+
+  return AllocationInfo(AllocationNodeInCurrentOrParentContext,
+                        FirstBinding,
+                        InterestingMethodContext);
+}
+
+std::shared_ptr<PathDiagnosticPiece>
+RefCountReportVisitor::getEndPath(BugReporterContext &BRC,
+                               const ExplodedNode *EndN, BugReport &BR) {
+  BR.markInteresting(Sym);
+  return BugReporterVisitor::getDefaultEndPath(BRC, EndN, BR);
+}
+
+std::shared_ptr<PathDiagnosticPiece>
+RefLeakReportVisitor::getEndPath(BugReporterContext &BRC,
+                                   const ExplodedNode *EndN, BugReport &BR) {
+
+  // Tell the BugReporterContext to report cases when the tracked symbol is
+  // assigned to different variables, etc.
+  BR.markInteresting(Sym);
+
+  // We are reporting a leak.  Walk up the graph to get to the first node where
+  // the symbol appeared, and also get the first VarDecl that tracked object
+  // is stored to.
+  AllocationInfo AllocI = GetAllocationSite(BRC.getStateManager(), EndN, Sym);
+
+  const MemRegion* FirstBinding = AllocI.R;
+  BR.markInteresting(AllocI.InterestingMethodContext);
+
+  SourceManager& SM = BRC.getSourceManager();
+
+  // Compute an actual location for the leak.  Sometimes a leak doesn't
+  // occur at an actual statement (e.g., transition between blocks; end
+  // of function) so we need to walk the graph and compute a real location.
+  const ExplodedNode *LeakN = EndN;
+  PathDiagnosticLocation L = PathDiagnosticLocation::createEndOfPath(LeakN, SM);
+
+  std::string sbuf;
+  llvm::raw_string_ostream os(sbuf);
+
+  os << "Object leaked: ";
+
+  Optional<std::string> RegionDescription = describeRegion(FirstBinding);
+  if (RegionDescription) {
+    os << "object allocated and stored into '" << *RegionDescription << '\'';
+  } else {
+    os << "allocated object of type '" << getPrettyTypeName(Sym->getType())
+       << "'";
+  }
+
+  // Get the retain count.
+  const RefVal* RV = getRefBinding(EndN->getState(), Sym);
+  assert(RV);
+
+  if (RV->getKind() == RefVal::ErrorLeakReturned) {
+    // FIXME: Per comments in rdar://6320065, "create" only applies to CF
+    // objects.  Only "copy", "alloc", "retain" and "new" transfer ownership
+    // to the caller for NS objects.
+    const Decl *D = &EndN->getCodeDecl();
+
+    os << (isa<ObjCMethodDecl>(D) ? " is returned from a method "
+                                  : " is returned from a function ");
+
+    if (D->hasAttr<CFReturnsNotRetainedAttr>()) {
+      os << "that is annotated as CF_RETURNS_NOT_RETAINED";
+    } else if (D->hasAttr<NSReturnsNotRetainedAttr>()) {
+      os << "that is annotated as NS_RETURNS_NOT_RETAINED";
+    } else if (D->hasAttr<OSReturnsNotRetainedAttr>()) {
+      os << "that is annotated as OS_RETURNS_NOT_RETAINED";
+    } else {
+      if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(D)) {
+        if (BRC.getASTContext().getLangOpts().ObjCAutoRefCount) {
+          os << "managed by Automatic Reference Counting";
+        } else {
+          os << "whose name ('" << MD->getSelector().getAsString()
+             << "') does not start with "
+                "'copy', 'mutableCopy', 'alloc' or 'new'."
+                "  This violates the naming convention rules"
+                " given in the Memory Management Guide for Cocoa";
+        }
+      } else {
+        const FunctionDecl *FD = cast<FunctionDecl>(D);
+        os << "whose name ('" << *FD
+           << "') does not contain 'Copy' or 'Create'.  This violates the naming"
+              " convention rules given in the Memory Management Guide for Core"
+              " Foundation";
+      }
+    }
+  } else {
+    os << " is not referenced later in this execution path and has a retain "
+          "count of +" << RV->getCount();
+  }
+
+  return std::make_shared<PathDiagnosticEventPiece>(L, os.str());
+}
+
+RefCountReport::RefCountReport(RefCountBug &D, const LangOptions &LOpts,
+                               ExplodedNode *n, SymbolRef sym,
+                               bool registerVisitor)
+    : BugReport(D, D.getDescription(), n), Sym(sym) {
+  if (registerVisitor)
+    addVisitor(llvm::make_unique<RefCountReportVisitor>(sym));
+}
+
+RefCountReport::RefCountReport(RefCountBug &D, const LangOptions &LOpts,
+                               ExplodedNode *n, SymbolRef sym,
+                               StringRef endText)
+    : BugReport(D, D.getDescription(), endText, n) {
+
+  addVisitor(llvm::make_unique<RefCountReportVisitor>(sym));
+}
+
+void RefLeakReport::deriveParamLocation(CheckerContext &Ctx, SymbolRef sym) {
+  const SourceManager& SMgr = Ctx.getSourceManager();
+
+  if (!sym->getOriginRegion())
+    return;
+
+  auto *Region = dyn_cast<DeclRegion>(sym->getOriginRegion());
+  if (Region) {
+    const Decl *PDecl = Region->getDecl();
+    if (PDecl && isa<ParmVarDecl>(PDecl)) {
+      PathDiagnosticLocation ParamLocation =
+          PathDiagnosticLocation::create(PDecl, SMgr);
+      Location = ParamLocation;
+      UniqueingLocation = ParamLocation;
+      UniqueingDecl = Ctx.getLocationContext()->getDecl();
+    }
+  }
+}
+
+void RefLeakReport::deriveAllocLocation(CheckerContext &Ctx,
+                                          SymbolRef sym) {
+  // Most bug reports are cached at the location where they occurred.
+  // With leaks, we want to unique them by the location where they were
+  // allocated, and only report a single path.  To do this, we need to find
+  // the allocation site of a piece of tracked memory, which we do via a
+  // call to GetAllocationSite.  This will walk the ExplodedGraph backwards.
+  // Note that this is *not* the trimmed graph; we are guaranteed, however,
+  // that all ancestor nodes that represent the allocation site have the
+  // same SourceLocation.
+  const ExplodedNode *AllocNode = nullptr;
+
+  const SourceManager& SMgr = Ctx.getSourceManager();
+
+  AllocationInfo AllocI =
+      GetAllocationSite(Ctx.getStateManager(), getErrorNode(), sym);
+
+  AllocNode = AllocI.N;
+  AllocBinding = AllocI.R;
+  markInteresting(AllocI.InterestingMethodContext);
+
+  // Get the SourceLocation for the allocation site.
+  // FIXME: This will crash the analyzer if an allocation comes from an
+  // implicit call (ex: a destructor call).
+  // (Currently there are no such allocations in Cocoa, though.)
+  AllocStmt = PathDiagnosticLocation::getStmt(AllocNode);
+
+  if (!AllocStmt) {
+    AllocBinding = nullptr;
+    return;
+  }
+
+  PathDiagnosticLocation AllocLocation =
+    PathDiagnosticLocation::createBegin(AllocStmt, SMgr,
+                                        AllocNode->getLocationContext());
+  Location = AllocLocation;
+
+  // Set uniqieing info, which will be used for unique the bug reports. The
+  // leaks should be uniqued on the allocation site.
+  UniqueingLocation = AllocLocation;
+  UniqueingDecl = AllocNode->getLocationContext()->getDecl();
+}
+
+void RefLeakReport::createDescription(CheckerContext &Ctx) {
+  assert(Location.isValid() && UniqueingDecl && UniqueingLocation.isValid());
+  Description.clear();
+  llvm::raw_string_ostream os(Description);
+  os << "Potential leak of an object";
+
+  Optional<std::string> RegionDescription = describeRegion(AllocBinding);
+  if (RegionDescription) {
+    os << " stored into '" << *RegionDescription << '\'';
+  } else {
+
+    // If we can't figure out the name, just supply the type information.
+    os << " of type '" << getPrettyTypeName(Sym->getType()) << "'";
+  }
+}
+
+RefLeakReport::RefLeakReport(RefCountBug &D, const LangOptions &LOpts,
+                             ExplodedNode *n, SymbolRef sym,
+                             CheckerContext &Ctx)
+    : RefCountReport(D, LOpts, n, sym, false) {
+
+  deriveAllocLocation(Ctx, sym);
+  if (!AllocBinding)
+    deriveParamLocation(Ctx, sym);
+
+  createDescription(Ctx);
+
+  addVisitor(llvm::make_unique<RefLeakReportVisitor>(sym));
+}
diff --git a/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountDiagnostics.h b/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountDiagnostics.h
new file mode 100644
index 0000000000000..9f796abe8eae8
--- /dev/null
+++ b/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountDiagnostics.h
@@ -0,0 +1,85 @@
+//== RetainCountDiagnostics.h - Checks for leaks and other issues -*- C++ -*--//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+//  This file defines diagnostics for RetainCountChecker, which implements
+//  a reference count checker for Core Foundation and Cocoa on (Mac OS X).
+//
+//===----------------------------------------------------------------------===//
+
+#ifndef LLVM_CLANG_LIB_STATICANALYZER_CHECKERS_RETAINCOUNTCHECKER_DIAGNOSTICS_H
+#define LLVM_CLANG_LIB_STATICANALYZER_CHECKERS_RETAINCOUNTCHECKER_DIAGNOSTICS_H
+
+#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
+#include "clang/StaticAnalyzer/Core/BugReporter/BugReporterVisitors.h"
+#include "clang/StaticAnalyzer/Core/BugReporter/PathDiagnostic.h"
+#include "clang/StaticAnalyzer/Core/RetainSummaryManager.h"
+
+namespace clang {
+namespace ento {
+namespace retaincountchecker {
+
+class RefCountBug : public BugType {
+protected:
+  RefCountBug(const CheckerBase *checker, StringRef name)
+      : BugType(checker, name, categories::MemoryRefCount) {}
+
+public:
+  virtual const char *getDescription() const = 0;
+
+  virtual bool isLeak() const { return false; }
+};
+
+class RefCountReport : public BugReport {
+protected:
+  SymbolRef Sym;
+
+public:
+  RefCountReport(RefCountBug &D, const LangOptions &LOpts,
+              ExplodedNode *n, SymbolRef sym,
+              bool registerVisitor = true);
+
+  RefCountReport(RefCountBug &D, const LangOptions &LOpts,
+              ExplodedNode *n, SymbolRef sym,
+              StringRef endText);
+
+  llvm::iterator_range<ranges_iterator> getRanges() override {
+    const RefCountBug& BugTy = static_cast<RefCountBug&>(getBugType());
+    if (!BugTy.isLeak())
+      return BugReport::getRanges();
+    return llvm::make_range(ranges_iterator(), ranges_iterator());
+  }
+};
+
+class RefLeakReport : public RefCountReport {
+  const MemRegion* AllocBinding;
+  const Stmt *AllocStmt;
+
+  // Finds the function declaration where a leak warning for the parameter
+  // 'sym' should be raised.
+  void deriveParamLocation(CheckerContext &Ctx, SymbolRef sym);
+  // Finds the location where a leak warning for 'sym' should be raised.
+  void deriveAllocLocation(CheckerContext &Ctx, SymbolRef sym);
+  // Produces description of a leak warning which is printed on the console.
+  void createDescription(CheckerContext &Ctx);
+
+public:
+  RefLeakReport(RefCountBug &D, const LangOptions &LOpts, ExplodedNode *n,
+                SymbolRef sym, CheckerContext &Ctx);
+
+  PathDiagnosticLocation getLocation(const SourceManager &SM) const override {
+    assert(Location.isValid());
+    return Location;
+  }
+};
+
+} // end namespace retaincountchecker
+} // end namespace ento
+} // end namespace clang
+
+#endif