False positive OBL_UNSATIFIED_OBLIGATION with try with resources

[jsotuyod]

Local issue to track findbugsproject/findbugs#99

[jsotuyod]

The issue can be reproduced and is confirmed. I'll be working on a fix.

[jsotuyod]

This one is going to be harder to fix than expected. The detector seems to be deeply broken as it's failing on lot of scenarios were it shouldn't.

The database should recognize that closing a Statement closes the ResultSet, 'though the opposite is not currently true:

database.addEntry(new MatchMethodEntry(new SubtypeTypeMatcher(BCELUtil.getObjectTypeInstance("java.sql.Statement")),
        new ExactStringMatcher("close"), new ExactStringMatcher("()V"), false, ObligationPolicyDatabaseActionType.DEL,
        ObligationPolicyDatabaseEntryType.STRONG, statement, resultSet));
database.addEntry(new MatchMethodEntry(new SubtypeTypeMatcher(BCELUtil.getObjectTypeInstance("java.sql.ResultSet")),
         new ExactStringMatcher("close"), new ExactStringMatcher("()V"), false, ObligationPolicyDatabaseActionType.DEL,
         ObligationPolicyDatabaseEntryType.STRONG, resultSet));

However, this is failing even without the use-with-resources construct:

public class Issue79 {
  private static final String QUERY = "";

  public void f(Connection cnx) throws SQLException {
    PreparedStatement st = null;
    ResultSet rs = null;
    try {
      st = cnx.prepareStatement(QUERY);
      rs = st.executeQuery();
      while (rs.next()) {
        System.out.println(rs.getString("ID"));
      }
    } finally {
      /*
       * The statement closes the result set, and there is no scenario where st may be null
       * but not the resultset, however an unsatisfied obligation is reported on the resultset
      */
      if (st != null) {
    	st.close();
      }
    }
  }
}

Also of note, the current implementation can't track which result set is associated with which statement, so when using more than one it can produce lots of false positives and false negatives...

We should probably drop this one for release 4.0.0 and think of a deep refactor for this detector.