Why in Objective-C does doing alloc and init in separate statements cause the object to be released according to the Xcode static analyzer?

Question

I'm making my first steps with Objective-C and have encountered a minor, albeit confusing issue with the static analyzer (Product->Analyze) in XCode 4.1. I have created a simple Fraction class for rational numbers which I allocate and initialize like this,

Fraction* f = [[[ Fraction alloc ] initWithNumerator:3 withDenomimator:5]
                                                               autorelease];
[ f print ];

where print is a method which just uses NSLog to display the fraction, everything works fine. However, if I split the alloc/init construct apart into two statements (I realize this is non-idiomatic - I'm just trying to understand the machinery) and use manual release rather than autorelease giving:

Fraction* f = [ Fraction alloc ]; // 1. Method returns an Objective-C object with
                                  //    a +1 retain count (owning reference)
[ f initWithNumerator:3 withDenomimator:5]; // 2. Object released
[ f print ]; // 3. Reference-counted object is used after it is released
[ f release ];

the program still appears to run without error, but the XCode analyzer gives the warnings in the comments. Why does XCode think the init call causes the object to be released?

Thinking through this further as I frame the question I can see that my two programs are not quite equivalent because in the first snippet my pointer f is the result of the call to init whereas in the second snippet it is the result of alloc. So changing my code to,

 Fraction* a = [ Fraction alloc ];
 Fraction* f = [ a initWithNumerator:3 withDenomimator:5];
[ f print ];
[ f release ]; // or should it be [ a release ] ?

makes it exactly equivalent and the static analyzer stops complaining. So is it possible that init can return a different pointer than the one passed to it from alloc, rather than just configuring the memory it has been passed? With this code should I pair [ a release ] with the alloc or [ f release ] with the init?

Answer 1

So is it possible that init can return a different pointer than the one passed to it from alloc, rather than just configuring the memory it has been passed?

absolutely.

With this code should I pair [ a release ] with the alloc or [ f release ] with the init?

you would assign the value of the initialized object to f (as you have). at this point, a may be a dangling pointer (if another address is returned). thereore, f should be released.

the explanation for this order is that the object may have opted to return a specialized version/variant of itself, and this reallocation happens along the init... chain.

silly demonstration:

@interface Fraction : NSObject
{
@private
    int numerator;
    int denominator;
}

@end

static Fraction* EvilFraction = ...;

@implementation Fraction

- (id)initWithNumerator:(int)num denominator:(int)den
{
    self = [super init];
    if (nil != self) {
        if (0 == den){
            [self release];
            return [EvilFraction retain];
        }
    }
    return self;
}

@end