[infer][swift] demangle function-local class names in retain-cycle labels

dulmarod · meta-codesync[bot] · commit 10fe6e7a576d · 2026-06-09T03:12:29.000-07:00
Summary:
The retain-cycle message demangler (`Llair2TextualUtils.demangle_swift_class_name`)
bailed on classes declared local to a function: their mangled name carries a
local-discriminator suffix `L_C` instead of the plain `C` of a top-level class,
which wasn't in the nominal-instance whitelist, so the raw mangled string leaked
into the label.

Strip the leading `L&lt;disc&gt;` discriminator before the suffix check so a local
class renders its plain name. Flips the `rc_local_class_demangling` fixture from
`object of type class T5Hello...L_C` to `object of type class Node`.

Recovers the last literal name token only (`Node`); resolving the Swift mangling
substitution to the full `LocalNode`, and the nested `C0C` family, are follow-ups.

_Authored by Astro 🪐 (Claude Code agent)._

Reviewed By: davidpichardie

Differential Revision: D107674132

fbshipit-source-id: 33b060145c8b3a24a643388adff4143243114173
diff --git a/infer/src/llvm/Llair2TextualUtils.ml b/infer/src/llvm/Llair2TextualUtils.ml
@@ -39,6 +39,25 @@ let parse_mangled_identifier_core mangled =
       parse 0 "" 0 )
 
 
+(** A function-local or private nominal type carries a *local discriminator* [L<disc>] (where
+    [<disc>] is the anonymous [_] or a positional number) right before its kind char, so e.g. a
+    class declared inside a function mangles with suffix [L_C] rather than [C]. Strip that leading
+    discriminator so the bare kind char is left for the nominal-instance suffix check. [L] is the
+    Swift ABI's local-discriminator introducer specifically, so this never strips a
+    metadata/function marker (those are [M]/[W]/[X]/[T]-led). *)
+let strip_local_discriminator suffix =
+  match String.chop_prefix suffix ~prefix:"L" with
+  | None ->
+      suffix
+  | Some rest ->
+      let rest = String.chop_prefix_if_exists rest ~prefix:"_" in
+      let first_nondigit =
+        String.lfindi rest ~f:(fun _ c -> not (Char.is_digit c))
+        |> Option.value ~default:(String.length rest)
+      in
+      String.drop_prefix rest first_nondigit
+
+
 (** Generalized heuristic to extract the plain class name from a Swift mangled name. It finds the
     *last* length-prefixed string in the mangling. *)
 let demangle_swift_class_name (mangled : string) : string =
@@ -59,7 +78,9 @@ let demangle_swift_class_name (mangled : string) : string =
       (* Extract whatever is left in the string after our parsed name *)
       let suffix = String.sub mangled ~pos:last_end ~len:(String.length mangled - last_end) in
       let clean_suffix =
-        String.chop_suffix_if_exists suffix ~suffix:"*" |> String.chop_suffix_if_exists ~suffix:"D"
+        String.chop_suffix_if_exists suffix ~suffix:"*"
+        |> String.chop_suffix_if_exists ~suffix:"D"
+        |> strip_local_discriminator
       in
       (* In the Swift ABI, after the length-prefixed identifier, the mangler appends a type kind.
          If the string represents metadata, functions, or coroutines, it will have a complex
diff --git a/infer/tests/codetoanalyze/swift/pulse/issues.exp b/infer/tests/codetoanalyze/swift/pulse/issues.exp
@@ -38,7 +38,7 @@ codetoanalyze/swift/pulse/rc_framework_url_session_overloads.swift, startBad, 1,
 codetoanalyze/swift/pulse/rc_framework_url_session_overloads.swift, startBad, 1, RETAIN_CYCLE, no_bucket, ERROR, [assignment of self->task part of the trace starts here,parameter `self` of startBad,assigned,assignment of Swift closure part of the trace starts here,in call to `NSURLSession.downloadTaskWithURL:completionHandler:` (modelled),assigned,assignment of object of type class URLSessionDownloadTaskCycleHolder part of the trace starts here,variable `var6` accessed here,assigned,retain cycle here]
 codetoanalyze/swift/pulse/rc_inline_concrete_delegate.swift, BarViewController.barView.get, 0, RETAIN_CYCLE, no_bucket, ERROR, [assignment of self->barView part of the trace starts here,parameter `self` of BarViewController.barView.get,assigned,assignment of self part of the trace starts here,when calling `Hello.BarViewController._3E5CC6EA0AF57922CE73F632956A8E47` here,in call to `BarView.init`,in call to `swift_allocObject` (modelled),return from call to `BarView.init`,assigned,retain cycle here]
 codetoanalyze/swift/pulse/rc_intentional_self_retain.swift, fire_bad, 1, RETAIN_CYCLE, no_bucket, ERROR, [assignment of self->leakedSelf part of the trace starts here,parameter `self` of fire_bad,assigned,retain cycle here]
-codetoanalyze/swift/pulse/rc_local_class_demangling.swift, wireBad, 1, RETAIN_CYCLE, no_bucket, ERROR, [assignment of object of type class T5Hello19makeLocalClassCycleyyF0C4NodeL_C part of the trace starts here,parameter `self` of wireBad,assigned,retain cycle here]
+codetoanalyze/swift/pulse/rc_local_class_demangling.swift, wireBad, 1, RETAIN_CYCLE, no_bucket, ERROR, [assignment of object of type class Node part of the trace starts here,parameter `self` of wireBad,assigned,retain cycle here]
 codetoanalyze/swift/pulse/rc_objc_inheritance.swift, configureCell_bad, 7, RETAIN_CYCLE, no_bucket, ERROR, [assignment of self->embedded part of the trace starts here,parameter `self` of configureCell_bad,assigned,assignment of createWidgetView().hostCell part of the trace starts here,in call to `createWidgetView`,in call to `init`,in call to `__objc_alloc_from_swift` (modelled),in call to `init`,parameter `var1` of init,in call to `NSObject.init` (modelled),returned,return from call to `init`,returned,return from call to `init`,returned,return from call to `createWidgetView`,when calling `WidgetDisplayView.setup` here,parameter `self` of WidgetDisplayView.setup,when calling `WidgetDisplayView.hostCell.set` here,parameter `self` of WidgetDisplayView.hostCell.set,assigned,retain cycle here]
 codetoanalyze/swift/pulse/rc_unknown_value.swift, MainController.setup, 7, RETAIN_CYCLE, no_bucket, ERROR, [assignment of self part of the trace starts here,when calling `InnerWrapper.init` here,in call to `swift_allocObject` (modelled),when calling `init` here,parameter `self` of init,assigned,assignment of self->wrapper part of the trace starts here,parameter `self` of MainController.setup,assigned,retain cycle here]
 codetoanalyze/swift/pulse/rc_unknown_value2.swift, test_retain_cycle_bad2, 12, RETAIN_CYCLE, no_bucket, ERROR, [assignment of object of type class State part of the trace starts here,in call to `swift_allocObject` (modelled),assigned,assignment of dynamically allocated object part of the trace starts here,when calling `DeviceAppManagerDelegateImpl.init` here,in call to `swift_allocObject` (modelled),when calling `init` here,parameter `self` of init,assigned,assignment of State.init().delegate->field_0 part of the trace starts here,in call to `State.init`,in call to `swift_allocObject` (modelled),return from call to `State.init`,assigned,retain cycle here]
