[thread-safety] model SynchronizedPool.acquire as acquiring ownership

Summary:
To address a common source of false positives observed in D4494901.
We don't do anything with `release` yet, but can model it as releasing ownership in the future if we want to enforce correct usage of `SynchronizedPool`'s.

Reviewed By: peterogithub

Differential Revision: D4593635

fbshipit-source-id: 621e937

infer/src/checkers/ThreadSafety.ml

@@ -236,7 +236,11 @@ module TransferFunctions (CFG : ProcCfg.S) = struct
             | "java.lang.ThreadLocal", "get" ->
                 (* ThreadLocal prevents sharing between threads behind the scenes *)
                 true
-            | _ -> false
+            | "android.support.v4.util.Pools$SynchronizedPool", "acquire" ->
+                (* a pool should own all of its objects *)
+                true
+            | _ ->
+                false
           end
       | _ ->
           false in

infer/tests/codetoanalyze/java/threadsafety/Containers.java

@@ -20,6 +20,8 @@ import java.util.concurrent.CopyOnWriteArrayList;
 
 import javax.annotation.concurrent.ThreadSafe;
 
+import android.support.v4.util.Pools.SynchronizedPool;
+
 class ContainerWrapper {
   private final List<Object> children = new ArrayList<Object>();
 
@@ -152,4 +154,37 @@ class Containers {
     mContainerWrapper.write(o);
   }
 
+  static SynchronizedPool<Obj> sPool;
+
+  void poolAcquireOk() {
+    Obj obj = sPool.acquire();
+    obj.f = new Object();
+  }
+
+  void poolAcquireThenNullCheckOk() {
+    Obj obj = sPool.acquire();
+    if (obj == null) {
+      obj = new Obj();
+    }
+    obj.f = new Object();
+  }
+
+  // need to understand semantics of release to get this one
+  void FN_poolReleaseThenWriteBad() {
+    Obj obj = sPool.acquire();
+    sPool.release(obj);
+    obj.f = new Object(); // should flag
+  }
+
+  void release(Obj o) {
+    sPool.release(o);
+  }
+
+  // we won't catch this without a fancier ownership domain
+  void FN_poolReleaseThenWriteInterprocBad() {
+    Obj obj = sPool.acquire();
+    release(obj);
+    obj.f = new Object(); // should flag
+  }
+
 }