[analyzer] Remove whitespace in source code

[honggyu.kim]

Summary

This patch just removes whitespace at the end of each line.
It only modifies source files related to static analyzer.

[honggyu.kim]

If anyone thinks this patch is too big, I can submit smaller separated patches.

[sylvestre.ledru]

Note: I am not the owner of this code but to me, this should be committed without a review.

[honggyu.kim]

In D12673#240933, @sylvestre.ledru wrote:

Note: I am not the owner of this code but to me, this should be committed without a review.

I don't have commit permission, so please anyone commit it instead of me.

[dblaikie]

We generally don't do large whitespace changes like this because of issue
with version control (not all told are whitespace ignorant which makes
history work difficult).

I don't mind these changes personally, but it should get sign of from Ted
or similar first.

[honggyu.kim]

In D12673#241100, @dblaikie wrote:

We generally don't do large whitespace changes like this because of issue
with version control (not all told are whitespace ignorant which makes
history work difficult).

I agree that it would be difficult to trace the history of svn or git.
But I wrote this patch because it would be better to have cleaner source code.
If we don't make whitespace in the future changes, it would be okay to trace the history in the long term.

I don't mind these changes personally, but it should get sign of from Ted
or similar first.

I know it can be just a matter of preference, so someone who is in charge of this code can make decision.
I'm also okay if they don't accept this patch.
Thanks for the comment.

[krememek]

I am OK with taking these changes. For those using git, git blame -w should suffice to show the real blame history.

[krememek]

Committed in r246978.

lib/StaticAnalyzer/Checkers/AnalyzerStatsChecker.cpp

void AnalyzerStatsChecker::checkEndAnalysis(ExplodedGraph &G,
 
   if (isa<FunctionDecl>(D) || isa<ObjCMethodDecl>(D)) {
     const NamedDecl *ND = cast<NamedDecl>(D);
     output << *ND;
   }
   else if (isa<BlockDecl>(D)) {
     output << "block(line:" << Loc.getLine() << ":col:" << Loc.getColumn();
   }
-  
   NumBlocksUnreachable += unreachable;
   NumBlocks += total;
   std::string NameOfRootFunction = output.str();
 
   output << " -> Total CFGBlocks: " << total << " | Unreachable CFGBlocks: "
       << unreachable << " | Exhausted Block: "
       << (Eng.wasBlocksExhausted() ? "yes" : "no")
       << " | Empty WorkList: "

lib/StaticAnalyzer/Checkers/ArrayBoundChecker.cpp

 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
 
 using namespace clang;
 using namespace ento;
 
 namespace {
-class ArrayBoundChecker : 
+class ArrayBoundChecker :
     public Checker<check::Location> {
   mutable std::unique_ptr<BuiltinBug> BT;
 
 public:
   void checkLocation(SVal l, bool isLoad, const Stmt* S,
                      CheckerContext &C) const;
 };
 }
void ArrayBoundChecker::checkLocation(SVal l, bool isLoad, const Stmt* LoadS,
   // Zero index is always in bound, this also passes ElementRegions created for
   // pointer casts.
   if (Idx.isZeroConstant())
     return;
 
   ProgramStateRef state = C.getState();
 
   // Get the size of the array.
-  DefinedOrUnknownSVal NumElements 
-    = C.getStoreManager().getSizeInElements(state, ER->getSuperRegion(), 
+  DefinedOrUnknownSVal NumElements
+    = C.getStoreManager().getSizeInElements(state, ER->getSuperRegion(),
                                             ER->getValueType());
 
   ProgramStateRef StInBound = state->assumeInBound(Idx, NumElements, true);
   ProgramStateRef StOutBound = state->assumeInBound(Idx, NumElements, false);
   if (StOutBound && !StInBound) {
     ExplodedNode *N = C.generateSink(StOutBound);
     if (!N)
       return;
-  
     if (!BT)
       BT.reset(new BuiltinBug(
           this, "Out-of-bound array access",
           "Access out-of-bound array element (buffer overflow)"));
 
     // FIXME: It would be nice to eventually make this diagnostic more clear,
     // e.g., by referencing the original declaration or by saying *why* this
     // reference is outside the range.
 
     // Generate a report for this bug.
     auto report = llvm::make_unique<BugReport>(*BT, BT->getDescription(), N);
 
     report->addRange(LoadS->getSourceRange());
     C.emitReport(std::move(report));
     return;
   }
-  
   // Array bound check succeeded.  From this point forward the array bound
   // should always succeed.
   C.addTransition(StInBound);
 }
 
 void ento::registerArrayBoundChecker(CheckerManager &mgr) {
   mgr.registerChecker<ArrayBoundChecker>();
 }

lib/StaticAnalyzer/Checkers/ArrayBoundCheckerV2.cpp

 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
 #include "llvm/ADT/SmallString.h"
 #include "llvm/Support/raw_ostream.h"
 
 using namespace clang;
 using namespace ento;
 
 namespace {
-class ArrayBoundCheckerV2 : 
+class ArrayBoundCheckerV2 :
     public Checker<check::Location> {
   mutable std::unique_ptr<BuiltinBug> BT;
 
   enum OOB_Kind { OOB_Precedes, OOB_Excedes, OOB_Tainted };
-  
   void reportOOB(CheckerContext &C, ProgramStateRef errorState,
                  OOB_Kind kind) const;
-      
 public:
   void checkLocation(SVal l, bool isLoad, const Stmt*S,
                      CheckerContext &C) const;
 };
 
 // FIXME: Eventually replace RegionRawOffset with this class.
 class RegionRawOffsetV2 {
 private:
   const SubRegion *baseRegion;
   SVal byteOffset;
 
   RegionRawOffsetV2()
     : baseRegion(nullptr), byteOffset(UnknownVal()) {}
 
 public:
   RegionRawOffsetV2(const SubRegion* base, SVal offset)
     : baseRegion(base), byteOffset(offset) {}
 
   NonLoc getByteOffset() const { return byteOffset.castAs<NonLoc>(); }
   const SubRegion *getRegion() const { return baseRegion; }
-  
   static RegionRawOffsetV2 computeOffset(ProgramStateRef state,
                                          SValBuilder &svalBuilder,
                                          SVal location);
 
   void dump() const;
   void dumpToStream(raw_ostream &os) const;
 };
 }
 
-static SVal computeExtentBegin(SValBuilder &svalBuilder, 
+static SVal computeExtentBegin(SValBuilder &svalBuilder,
                                const MemRegion *region) {
   while (true)
     switch (region->getKind()) {
       default:
-        return svalBuilder.makeZeroArrayIndex();        
+        return svalBuilder.makeZeroArrayIndex();
       case MemRegion::SymbolicRegionKind:
         // FIXME: improve this later by tracking symbolic lower bounds
         // for symbolic regions.
         return UnknownVal();
       case MemRegion::ElementRegionKind:
         region = cast<SubRegion>(region)->getSuperRegion();
         continue;
     }
 }
 
 void ArrayBoundCheckerV2::checkLocation(SVal location, bool isLoad,
                                         const Stmt* LoadS,
                                         CheckerContext &checkerContext) const {
 
   // NOTE: Instead of using ProgramState::assumeInBound(), we are prototyping
   // some new logic here that reasons directly about memory region extents.
   // Once that logic is more mature, we can bring it back to assumeInBound()
   // for all clients to use.
   //
   // The algorithm we are using here for bounds checking is to see if the
   // memory access is within the extent of the base region.  Since we
   // have some flexibility in defining the base region, we can achieve
   // various levels of conservatism in our buffer overflow checking.
-  ProgramStateRef state = checkerContext.getState();  
+  ProgramStateRef state = checkerContext.getState();
   ProgramStateRef originalState = state;
 
   SValBuilder &svalBuilder = checkerContext.getSValBuilder();
-  const RegionRawOffsetV2 &rawOffset = 
+  const RegionRawOffsetV2 &rawOffset =
     RegionRawOffsetV2::computeOffset(state, svalBuilder, location);
 
   if (!rawOffset.getRegion())
     return;
 
-  // CHECK LOWER BOUND: Is byteOffset < extent begin?  
+  // CHECK LOWER BOUND: Is byteOffset < extent begin?
   //  If so, we are doing a load/store
   //  before the first valid offset in the memory region.
 
   SVal extentBegin = computeExtentBegin(svalBuilder, rawOffset.getRegion());
-  
   if (Optional<NonLoc> NV = extentBegin.getAs<NonLoc>()) {
     SVal lowerBound =
         svalBuilder.evalBinOpNN(state, BO_LT, rawOffset.getByteOffset(), *NV,
                                 svalBuilder.getConditionType());
 
     Optional<NonLoc> lowerBoundToCheck = lowerBound.getAs<NonLoc>();
     if (!lowerBoundToCheck)
       return;
-    
     ProgramStateRef state_precedesLowerBound, state_withinLowerBound;
     std::tie(state_precedesLowerBound, state_withinLowerBound) =
       state->assume(*lowerBoundToCheck);
 
     // Are we constrained enough to definitely precede the lower bound?
     if (state_precedesLowerBound && !state_withinLowerBound) {
       reportOOB(checkerContext, state_precedesLowerBound, OOB_Precedes);
       return;
     }
-  
     // Otherwise, assume the constraint of the lower bound.
     assert(state_withinLowerBound);
     state = state_withinLowerBound;
   }
-  
   do {
     // CHECK UPPER BOUND: Is byteOffset >= extent(baseRegion)?  If so,
     // we are doing a load/store after the last valid offset.
     DefinedOrUnknownSVal extentVal =
       rawOffset.getRegion()->getExtent(svalBuilder);
     if (!extentVal.getAs<NonLoc>())
       break;
 
     SVal upperbound
       = svalBuilder.evalBinOpNN(state, BO_GE, rawOffset.getByteOffset(),
                                 extentVal.castAs<NonLoc>(),
                                 svalBuilder.getConditionType());
-  
     Optional<NonLoc> upperboundToCheck = upperbound.getAs<NonLoc>();
     if (!upperboundToCheck)
       break;
-  
     ProgramStateRef state_exceedsUpperBound, state_withinUpperBound;
     std::tie(state_exceedsUpperBound, state_withinUpperBound) =
       state->assume(*upperboundToCheck);
 
     // If we are under constrained and the index variables are tainted, report.
     if (state_exceedsUpperBound && state_withinUpperBound) {
       if (state->isTainted(rawOffset.getByteOffset()))
         reportOOB(checkerContext, state_exceedsUpperBound, OOB_Tainted);
         return;
     }
-  
     // If we are constrained enough to definitely exceed the upper bound, report.
     if (state_exceedsUpperBound) {
       assert(!state_withinUpperBound);
       reportOOB(checkerContext, state_exceedsUpperBound, OOB_Excedes);
       return;
     }
-  
     assert(state_withinUpperBound);
     state = state_withinUpperBound;
   }
   while (false);
-  
   if (state != originalState)
     checkerContext.addTransition(state);
 }
 
 void ArrayBoundCheckerV2::reportOOB(CheckerContext &checkerContext,
                                     ProgramStateRef errorState,
                                     OOB_Kind kind) const {
-  
   ExplodedNode *errorNode = checkerContext.generateSink(errorState);
   if (!errorNode)
     return;
 
   if (!BT)
     BT.reset(new BuiltinBug(this, "Out-of-bound access"));
 
   // FIXME: This diagnostics are preliminary.  We should get far better

 /// Compute a raw byte offset from a base region.  Used for array bounds
 /// checking.
 RegionRawOffsetV2 RegionRawOffsetV2::computeOffset(ProgramStateRef state,
                                                    SValBuilder &svalBuilder,
                                                    SVal location)
 {
   const MemRegion *region = location.getAsRegion();
   SVal offset = UndefinedVal();
-  
   while (region) {
     switch (region->getKind()) {
       default: {
         if (const SubRegion *subReg = dyn_cast<SubRegion>(region)) {
           offset = getValue(offset, svalBuilder);
           if (!offset.isUnknownOrUndef())
             return RegionRawOffsetV2(subReg, offset);
         }
         return RegionRawOffsetV2();
       }
       case MemRegion::ElementRegionKind: {
         const ElementRegion *elemReg = cast<ElementRegion>(region);
         SVal index = elemReg->getIndex();
         if (!index.getAs<NonLoc>())
           return RegionRawOffsetV2();
         QualType elemType = elemReg->getElementType();
         // If the element is an incomplete type, go no further.
         ASTContext &astContext = svalBuilder.getContext();
         if (elemType->isIncompleteType())
           return RegionRawOffsetV2();
-        
         // Update the offset.
         offset = addValue(state,
                           getValue(offset, svalBuilder),
                           scaleValue(state,
                           index.castAs<NonLoc>(),
                           astContext.getTypeSizeInChars(elemType),
                           svalBuilder),
                           svalBuilder);

lib/StaticAnalyzer/Checkers/BasicObjCFoundationChecks.cpp

void NilArgChecker::warnIfNilExpr(const Expr *E,
                                   const char *Msg,
                                   CheckerContext &C) const {
   ProgramStateRef State = C.getState();
   if (State->isNull(C.getSVal(E)).isConstrainedTrue()) {
 
     if (ExplodedNode *N = C.generateSink()) {
       generateBugReport(N, Msg, E->getSourceRange(), E, C);
     }
-    
   }
 }
 
 void NilArgChecker::warnIfNilArg(CheckerContext &C,
                                  const ObjCMethodCall &msg,
                                  unsigned int Arg,
                                  FoundationClass Class,
                                  bool CanBeSubscript) const {
   // Check if the argument is nil.
   ProgramStateRef State = C.getState();
   if (!State->isNull(msg.getArgSVal(Arg)).isConstrainedTrue())
       return;
-      
   if (ExplodedNode *N = C.generateSink()) {
     SmallString<128> sbuf;
     llvm::raw_svector_ostream os(sbuf);
 
     if (CanBeSubscript && msg.getMessageKind() == OCM_Subscript) {
 
       if (Class == FC_NSArray) {
         os << "Array element cannot be nil";
if (CanBeSubscript && msg.getMessageKind() == OCM_Subscript) {
         msg.getSelector().print(os);
         os << "' cannot be nil";
       } else {
         os << "Argument to '" << GetReceiverInterfaceName(msg) << "' method '";
         msg.getSelector().print(os);
         os << "' cannot be nil";
       }
     }
-    
     generateBugReport(N, os.str(), msg.getArgSourceRange(Arg),
                       msg.getArgExpr(Arg), C);
   }
 }
 
 void NilArgChecker::generateBugReport(ExplodedNode *N,
                                       StringRef Msg,
                                       SourceRange Range,
void NilArgChecker::checkPreObjCMessage(const ObjCMethodCall &msg,
   if (!ID)
     return;
 
   FoundationClass Class = findKnownClass(ID);
 
   static const unsigned InvalidArgIndex = UINT_MAX;
   unsigned Arg = InvalidArgIndex;
   bool CanBeSubscript = false;
-  
   if (Class == FC_NSString) {
     Selector S = msg.getSelector();
 
     if (S.isUnarySelector())
       return;
 
     if (StringSelectors.empty()) {
       ASTContext &Ctx = C.getASTContext();

 #endif
 
 void CFNumberCreateChecker::checkPreStmt(const CallExpr *CE,
                                          CheckerContext &C) const {
   ProgramStateRef state = C.getState();
   const FunctionDecl *FD = C.getCalleeDecl(CE);
   if (!FD)
     return;
-  
   ASTContext &Ctx = C.getASTContext();
   if (!II)
     II = &Ctx.Idents.get("CFNumberCreate");
 
   if (FD->getIdentifier() != II || CE->getNumArgs() != 3)
     return;
 
   // Get the value of the "theType" argument.
if (SourceSize == TargetSize)
     return;
 
   // Generate an error.  Only generate a sink if 'SourceSize < TargetSize';
   // otherwise generate a regular node.
   //
   // FIXME: We can actually create an abstract "CFNumber" object that has
   //  the bits initialized to the provided values.
   //
-  if (ExplodedNode *N = SourceSize < TargetSize ? C.generateSink() 
+  if (ExplodedNode *N = SourceSize < TargetSize ? C.generateSink()
                                                 : C.addTransition()) {
     SmallString<128> sbuf;
     llvm::raw_svector_ostream os(sbuf);
-    
     os << (SourceSize == 8 ? "An " : "A ")
        << SourceSize << " bit integer is used to initialize a CFNumber "
                         "object that represents "
        << (TargetSize == 8 ? "an " : "a ")
        << TargetSize << " bit integer. ";
-    
     if (SourceSize < TargetSize)
       os << (TargetSize - SourceSize)
       << " bits of the CFNumber value will be garbage." ;
     else
       os << (SourceSize - TargetSize)
       << " bits of the input integer will be lost.";
 
     if (!BT)
void CFRetainReleaseChecker::checkPreStmt(const CallExpr *CE,
   // If the CallExpr doesn't have exactly 1 argument just give up checking.
   if (CE->getNumArgs() != 1)
     return;
 
   ProgramStateRef state = C.getState();
   const FunctionDecl *FD = C.getCalleeDecl(CE);
   if (!FD)
     return;
-  
   if (!BT) {
     ASTContext &Ctx = C.getASTContext();
     Retain = &Ctx.Idents.get("CFRetain");
     Release = &Ctx.Idents.get("CFRelease");
     MakeCollectable = &Ctx.Idents.get("CFMakeCollectable");
     Autorelease = &Ctx.Idents.get("CFAutorelease");
     BT.reset(new APIMisuse(
         this, "null passed to CF memory management function"));

 
 public:
   void checkPreObjCMessage(const ObjCMethodCall &msg, CheckerContext &C) const;
 };
 }
 
 void ClassReleaseChecker::checkPreObjCMessage(const ObjCMethodCall &msg,
                                               CheckerContext &C) const {
-  
   if (!BT) {
     BT.reset(new APIMisuse(
         this, "message incorrectly sent to class instead of class instance"));
 
     ASTContext &Ctx = C.getASTContext();
     releaseS = GetNullarySelector("release", Ctx);
     retainS = GetNullarySelector("retain", Ctx);
     autoreleaseS = GetNullarySelector("autorelease", Ctx);
     drainS = GetNullarySelector("drain", Ctx);
   }
-  
   if (msg.isInstanceMessage())
     return;
   const ObjCInterfaceDecl *Class = msg.getReceiverInterface();
   assert(Class);
 
   Selector S = msg.getSelector();
   if (!(S == releaseS || S == retainS || S == autoreleaseS || S == drainS))
     return;
-  
   if (ExplodedNode *N = C.addTransition()) {
     SmallString<200> buf;
     llvm::raw_svector_ostream os(buf);
 
     os << "The '";
     S.print(os);
     os << "' message should be sent to instances "
           "of class '" << Class->getName()
        << "' and not the class directly";
-  
     auto report = llvm::make_unique<BugReport>(*BT, os.str(), N);
     report->addRange(msg.getSourceRange());
     C.emitReport(std::move(report));
   }
 }
 
 //===----------------------------------------------------------------------===//
 // Check for passing non-Objective-C types to variadic methods that expect

 };
 }
 
 /// isVariadicMessage - Returns whether the given message is a variadic message,
 /// where all arguments must be Objective-C types.
 bool
 VariadicMethodTypeChecker::isVariadicMessage(const ObjCMethodCall &msg) const {
   const ObjCMethodDecl *MD = msg.getDecl();
-  
   if (!MD || !MD->isVariadic() || isa<ObjCProtocolDecl>(MD->getDeclContext()))
     return false;
-  
   Selector S = msg.getSelector();
-  
   if (msg.isInstanceMessage()) {
     // FIXME: Ideally we'd look at the receiver interface here, but that's not
     // useful for init, because alloc returns 'id'. In theory, this could lead
     // to false positives, for example if there existed a class that had an
     // initWithObjects: implementation that does accept non-Objective-C pointer
     // types, but the chance of that happening is pretty small compared to the
     // gains that this analysis gives.
     const ObjCInterfaceDecl *Class = MD->getClassInterface();
void VariadicMethodTypeChecker::checkPreObjCMessage(const ObjCMethodCall &msg,
                                                     CheckerContext &C) const {
   if (!BT) {
     BT.reset(new APIMisuse(this,
                            "Arguments passed to variadic method aren't all "
                            "Objective-C pointer types"));
 
     ASTContext &Ctx = C.getASTContext();
     arrayWithObjectsS = GetUnarySelector("arrayWithObjects", Ctx);
-    dictionaryWithObjectsAndKeysS = 
+    dictionaryWithObjectsAndKeysS =
       GetUnarySelector("dictionaryWithObjectsAndKeys", Ctx);
     setWithObjectsS = GetUnarySelector("setWithObjects", Ctx);
     orderedSetWithObjectsS = GetUnarySelector("orderedSetWithObjects", Ctx);
 
     initWithObjectsS = GetUnarySelector("initWithObjects", Ctx);
     initWithObjectsAndKeysS = GetUnarySelector("initWithObjectsAndKeys", Ctx);
   }
 
for (unsigned I = variadicArgsBegin; I != variadicArgsEnd; ++I) {
 
     // Block pointers are treaded as Objective-C pointers.
     if (ArgTy->isBlockPointerType())
       continue;
 
     // Ignore pointer constants.
     if (msg.getArgSVal(I).getAs<loc::ConcreteInt>())
       continue;
-    
     // Ignore pointer types annotated with 'NSObject' attribute.
     if (C.getASTContext().isObjCNSObjectType(ArgTy))
       continue;
-    
     // Ignore CF references, which can be toll-free bridged.
     if (coreFoundation::isCFObjectRef(ArgTy))
       continue;
 
     // Generate only one error node to use for all bug reports.
     if (!errorNode.hasValue())
       errorNode = C.addTransition();
 
ProgramStateRef checkPointerEscape(ProgramStateRef State,
                                      PointerEscapeKind Kind) const;
 };
 }
 
 static bool isKnownNonNilCollectionType(QualType T) {
   const ObjCObjectPointerType *PT = T->getAs<ObjCObjectPointerType>();
   if (!PT)
     return false;
-  
   const ObjCInterfaceDecl *ID = PT->getInterfaceDecl();
   if (!ID)
     return false;
 
   switch (findKnownClass(ID)) {
   case FC_NSArray:
   case FC_NSDictionary:
   case FC_NSEnumerator:
if (!alreadyExecutedAtLeastOneLoopIteration(C.getPredecessor(), FCS))
       State = assumeCollectionNonEmpty(C, State, FCS, /*Assumption*/false);
 
   // Otherwise, this is a branch that goes through the loop body.
   } else {
     State = checkCollectionNonNil(C, State, FCS);
     State = checkElementNonNil(C, State, FCS);
     State = assumeCollectionNonEmpty(C, State, FCS, /*Assumption*/true);
   }
-  
   if (!State)
     C.generateSink();
   else if (State != C.getState())
     C.addTransition(State);
 }
 
 bool ObjCLoopChecker::isCollectionCountMethod(const ObjCMethodCall &M,
                                               CheckerContext &C) const {
   Selector S = M.getSelector();
   // Initialize the identifiers on first use.
   if (!CountSelectorII)
     CountSelectorII = &C.getASTContext().Idents.get("count");
 
   // If the method returns collection count, record the value.
   if (S.isUnarySelector() &&
       (S.getIdentifierInfoForSlot(0) == CountSelectorII))
     return true;
-  
   return false;
 }
 
 void ObjCLoopChecker::checkPostObjCMessage(const ObjCMethodCall &M,
                                            CheckerContext &C) const {
   if (!M.isInstanceMessage())
     return;
 
void ObjCLoopChecker::checkPostObjCMessage(const ObjCMethodCall &M,
   SymbolRef ContainerS = M.getReceiverSVal().getAsSymbol();
   if (!ContainerS)
     return;
 
   // If we are processing a call to "count", get the symbolic value returned by
   // a call to "count" and add it to the map.
   if (!isCollectionCountMethod(M, C))
     return;
-  
   const Expr *MsgExpr = M.getOriginExpr();
   SymbolRef CountS = C.getSVal(MsgExpr).getAsSymbol();
   if (CountS) {
     ProgramStateRef State = C.getState();
 
     C.getSymbolManager().addSymbolDependency(ContainerS, CountS);
     State = State->set<ContainerCountMap>(ContainerS, CountS);
 

lib/StaticAnalyzer/Checkers/BoolAssignmentChecker.cpp

if (!BT)
       BT.reset(new BuiltinBug(this, "Assignment of a non-Boolean value"));
     C.emitReport(llvm::make_unique<BugReport>(*BT, BT->getDescription(), N));
   }
 }
 
 static bool isBooleanType(QualType Ty) {
   if (Ty->isBooleanType()) // C++ or C99
     return true;
-  
   if (const TypedefType *TT = Ty->getAs<TypedefType>())
     return TT->getDecl()->getName() == "BOOL"   || // Objective-C
            TT->getDecl()->getName() == "_Bool"  || // stdbool.h < C99
            TT->getDecl()->getName() == "Boolean";  // MacTypes.h
-  
   return false;
 }
 
 void BoolAssignmentChecker::checkBind(SVal loc, SVal val, const Stmt *S,
                                       CheckerContext &C) const {
-  
   // We are only interested in stores into Booleans.
   const TypedValueRegion *TR =
     dyn_cast_or_null<TypedValueRegion>(loc.getAsRegion());
-  
   if (!TR)
     return;
-  
   QualType valTy = TR->getValueType();
-  
   if (!isBooleanType(valTy))
     return;
-  
   // Get the value of the right-hand side.  We only care about values
   // that are defined (UnknownVals and UndefinedVals are handled by other
   // checkers).
   Optional<DefinedSVal> DV = val.getAs<DefinedSVal>();
   if (!DV)
     return;
-    
   // Check if the assigned value meets our criteria for correctness.  It must
   // be a value that is either 0 or 1.  One way to check this is to see if
   // the value is possibly < 0 (for a negative value) or greater than 1.
-  ProgramStateRef state = C.getState(); 
+  ProgramStateRef state = C.getState();
   SValBuilder &svalBuilder = C.getSValBuilder();
   ConstraintManager &CM = C.getConstraintManager();
-  
-  // First, ensure that the value is >= 0.  
+  // First, ensure that the value is >= 0.
   DefinedSVal zeroVal = svalBuilder.makeIntVal(0, valTy);
   SVal greaterThanOrEqualToZeroVal =
     svalBuilder.evalBinOp(state, BO_GE, *DV, zeroVal,
                           svalBuilder.getConditionType());
 
   Optional<DefinedSVal> greaterThanEqualToZero =
       greaterThanOrEqualToZeroVal.getAs<DefinedSVal>();
 
   if (!greaterThanEqualToZero) {
     // The SValBuilder cannot construct a valid SVal for this condition.
-    // This means we cannot properly reason about it.    
+    // This means we cannot properly reason about it.
     return;
   }
-  
   ProgramStateRef stateLT, stateGE;
   std::tie(stateGE, stateLT) = CM.assumeDual(state, *greaterThanEqualToZero);
-  
   // Is it possible for the value to be less than zero?
   if (stateLT) {
     // It is possible for the value to be less than zero.  We only
     // want to emit a warning, however, if that value is fully constrained.
     // If it it possible for the value to be >= 0, then essentially the
     // value is underconstrained and there is nothing left to be done.
     if (!stateGE)
       emitReport(stateLT, C);
-    
     // In either case, we are done.
     return;
   }
-  
   // If we reach here, it must be the case that the value is constrained
   // to only be >= 0.
   assert(stateGE == state);
-  
   // At this point we know that the value is >= 0.
   // Now check to ensure that the value is <= 1.
   DefinedSVal OneVal = svalBuilder.makeIntVal(1, valTy);
   SVal lessThanEqToOneVal =
     svalBuilder.evalBinOp(state, BO_LE, *DV, OneVal,
                           svalBuilder.getConditionType());
 
   Optional<DefinedSVal> lessThanEqToOne =
       lessThanEqToOneVal.getAs<DefinedSVal>();
 
   if (!lessThanEqToOne) {
     // The SValBuilder cannot construct a valid SVal for this condition.
-    // This means we cannot properly reason about it.    
+    // This means we cannot properly reason about it.
     return;
   }
-  
   ProgramStateRef stateGT, stateLE;
   std::tie(stateLE, stateGT) = CM.assumeDual(state, *lessThanEqToOne);
-  
   // Is it possible for the value to be greater than one?
   if (stateGT) {
     // It is possible for the value to be greater than one.  We only
     // want to emit a warning, however, if that value is fully constrained.
     // If it is possible for the value to be <= 1, then essentially the
     // value is underconstrained and there is nothing left to be done.
     if (!stateLE)
       emitReport(stateGT, C);
-    
     // In either case, we are done.
     return;
   }
-  
   // If we reach here, it must be the case that the value is constrained
   // to only be <= 1.
   assert(stateLE == state);
 }
 
 void ento::registerBoolAssignmentChecker(CheckerManager &mgr) {
     mgr.registerChecker<BoolAssignmentChecker>();
 }

lib/StaticAnalyzer/Checkers/CStringChecker.cpp

public:
   static void *getTag() { static int tag; return &tag; }
 
   bool evalCall(const CallExpr *CE, CheckerContext &C) const;
   void checkPreStmt(const DeclStmt *DS, CheckerContext &C) const;
   void checkLiveSymbols(ProgramStateRef state, SymbolReaper &SR) const;
   void checkDeadSymbols(SymbolReaper &SR, CheckerContext &C) const;
   bool wantsRegionChangeUpdate(ProgramStateRef state) const;
 
-  ProgramStateRef 
+  ProgramStateRef
     checkRegionChanges(ProgramStateRef state,
                        const InvalidatedSymbols *,
                        ArrayRef<const MemRegion *> ExplicitRegions,
                        ArrayRef<const MemRegion *> Regions,
                        const CallEvent *Call) const;
 
   typedef void (CStringChecker::*FnCheck)(CheckerContext &,
                                           const CallExpr *) const;
void evalCopyCommon(CheckerContext &C, const CallExpr *CE,
                       bool Restricted = false,
                       bool IsMempcpy = false) const;
 
   void evalMemcmp(CheckerContext &C, const CallExpr *CE) const;
 
   void evalstrLength(CheckerContext &C, const CallExpr *CE) const;
   void evalstrnLength(CheckerContext &C, const CallExpr *CE) const;
   void evalstrLengthCommon(CheckerContext &C,
-                           const CallExpr *CE, 
+                           const CallExpr *CE,
                            bool IsStrnlen = false) const;
 
   void evalStrcpy(CheckerContext &C, const CallExpr *CE) const;
   void evalStrncpy(CheckerContext &C, const CallExpr *CE) const;
   void evalStpcpy(CheckerContext &C, const CallExpr *CE) const;
   void evalStrcpyCommon(CheckerContext &C,
                         const CallExpr *CE,
                         bool returnEnd,
static SVal getCStringLengthForRegion(CheckerContext &C,
                                         const MemRegion *MR,
                                         bool hypothetical);
   SVal getCStringLength(CheckerContext &C,
                         ProgramStateRef &state,
                         const Expr *Ex,
                         SVal Buf,
                         bool hypothetical = false) const;
 
-  const StringLiteral *getCStringLiteral(CheckerContext &C, 
+  const StringLiteral *getCStringLiteral(CheckerContext &C,
                                          ProgramStateRef &state,
-                                         const Expr *expr,  
+                                         const Expr *expr,
                                          SVal val) const;
 
   static ProgramStateRef InvalidateBuffer(CheckerContext &C,
                                           ProgramStateRef state,
                                           const Expr *Ex, SVal V,
                                           bool IsSourceBuffer);
 
   static bool SummarizeRegion(raw_ostream &os, ASTContext &Ctx,
if (!ER)
     return state;
 
   assert(ER->getValueType() == C.getASTContext().CharTy &&
     "CheckLocation should only be called with char* ElementRegions");
 
   // Get the size of the array.
   const SubRegion *superReg = cast<SubRegion>(ER->getSuperRegion());
   SValBuilder &svalBuilder = C.getSValBuilder();
-  SVal Extent = 
+  SVal Extent =
     svalBuilder.convertToArrayIndex(superReg->getExtent(svalBuilder));
   DefinedOrUnknownSVal Size = Extent.castAs<DefinedOrUnknownSVal>();
 
   // Get the index of the accessed element.
   DefinedOrUnknownSVal Idx = ER->getIndex().castAs<DefinedOrUnknownSVal>();
 
   ProgramStateRef StInBound = state->assumeInBound(Idx, Size, true);
   ProgramStateRef StOutBound = state->assumeInBound(Idx, Size, false);
if (StOutBound && !StInBound) {
     // FIXME: It would be nice to eventually make this diagnostic more clear,
     // e.g., by referencing the original declaration or by saying *why* this
     // reference is outside the range.
 
     report->addRange(S->getSourceRange());
     C.emitReport(std::move(report));
     return nullptr;
   }
-  
   // Array bound check succeeded.  From this point forward the array bound
   // should always succeed.
   return StInBound;
 }
 
 ProgramStateRef CStringChecker::CheckBufferAccess(CheckerContext &C,
                                                  ProgramStateRef state,
                                                  const Expr *Size,
ProgramStateRef CStringChecker::CheckOverlap(CheckerContext &C,
   if (!firstLoc)
     return state;
 
   Optional<Loc> secondLoc = secondVal.getAs<Loc>();
   if (!secondLoc)
     return state;
 
   // Are the two values the same?
-  SValBuilder &svalBuilder = C.getSValBuilder();  
+  SValBuilder &svalBuilder = C.getSValBuilder();
   std::tie(stateTrue, stateFalse) =
     state->assume(svalBuilder.evalEQ(state, *firstLoc, *secondLoc));
 
   if (stateTrue && !stateFalse) {
     // If the values are known to be equal, that's automatically an overlap.
     emitOverlapBug(C, stateTrue, First, Second);
     return nullptr;
   }
ProgramStateRef CStringChecker::CheckOverlap(CheckerContext &C,
   Optional<NonLoc> Length = LengthVal.getAs<NonLoc>();
   if (!Length)
     return state;
 
   // Convert the first buffer's start address to char*.
   // Bail out if the cast fails.
   ASTContext &Ctx = svalBuilder.getContext();
   QualType CharPtrTy = Ctx.getPointerType(Ctx.CharTy);
-  SVal FirstStart = svalBuilder.evalCast(*firstLoc, CharPtrTy, 
+  SVal FirstStart = svalBuilder.evalCast(*firstLoc, CharPtrTy,
                                          First->getType());
   Optional<Loc> FirstStartLoc = FirstStart.getAs<Loc>();
   if (!FirstStartLoc)
     return state;
 
   // Compute the end of the first buffer. Bail out if THAT fails.
   SVal FirstEnd = svalBuilder.evalBinOpLN(state, BO_Add,
                                  *FirstStartLoc, *Length, CharPtrTy);
ProgramStateRef CStringChecker::checkAdditionOverflow(CheckerContext &C,
 
   SVal maxMinusRight;
   if (right.getAs<nonloc::ConcreteInt>()) {
     maxMinusRight = svalBuilder.evalBinOpNN(state, BO_Sub, maxVal, right,
                                                  sizeTy);
   } else {
     // Try switching the operands. (The order of these two assignments is
     // important!)
-    maxMinusRight = svalBuilder.evalBinOpNN(state, BO_Sub, maxVal, left, 
+    maxMinusRight = svalBuilder.evalBinOpNN(state, BO_Sub, maxVal, left,
                                             sizeTy);
     left = right;
   }
 
   if (Optional<NonLoc> maxMinusRightNL = maxMinusRight.getAs<NonLoc>()) {
     QualType cmpTy = svalBuilder.getConditionType();
     // If left > max - right, we have an overflow.
     SVal willOverflow = svalBuilder.evalBinOpNN(state, BO_GT, left,
if (Optional<loc::GotoLabel> Label = Buf.getAs<loc::GotoLabel>()) {
         os << "Argument to " << CurrentFunctionDescription
            << " is the address of the label '" << Label->getLabel()->getName()
            << "', which is not a null-terminated string";
 
         // Generate a report for this bug.
         auto report = llvm::make_unique<BugReport>(*BT_NotCString, os.str(), N);
 
         report->addRange(Ex->getSourceRange());
-        C.emitReport(std::move(report));        
+        C.emitReport(std::move(report));
       }
       return UndefinedVal();
 
     }
 
     // If it's not a region and not a label, give up.
     return UnknownVal();
   }
if (ExplodedNode *N = C.addTransition(state)) {
         os << ", which is not a null-terminated string";
       else
         os << "not a null-terminated string";
 
       // Generate a report for this bug.
       auto report = llvm::make_unique<BugReport>(*BT_NotCString, os.str(), N);
 
       report->addRange(Ex->getSourceRange());
-      C.emitReport(std::move(report));        
+      C.emitReport(std::move(report));
     }
 
     return UndefinedVal();
   }
 }
 
 const StringLiteral *CStringChecker::getCStringLiteral(CheckerContext &C,
   ProgramStateRef &state, const Expr *expr, SVal val) const {
if (Optional<loc::MemRegionVal> MR = L->getAs<loc::MemRegionVal>()) {
     // Invalidate this region.
     const LocationContext *LCtx = C.getPredecessor()->getLocationContext();
 
     bool CausesPointerEscape = false;
     RegionAndSymbolInvalidationTraits ITraits;
     // Invalidate and escape only indirect regions accessible through the source
     // buffer.
     if (IsSourceBuffer) {
-      ITraits.setTrait(R, 
+      ITraits.setTrait(R,
                        RegionAndSymbolInvalidationTraits::TK_PreserveContents);
       ITraits.setTrait(R, RegionAndSymbolInvalidationTraits::TK_SuppressEscape);
       CausesPointerEscape = true;
     }
 
-    return state->invalidateRegions(R, E, C.blockCount(), LCtx, 
+    return state->invalidateRegions(R, E, C.blockCount(), LCtx,
                                     CausesPointerEscape, nullptr, nullptr,
                                     &ITraits);
   }
 
   // If we have a non-region value by chance, just remove the binding.
   // FIXME: is this necessary or correct? This handles the non-Region
   //  cases.  Is it ever valid to store to these?
   return state->killBinding(*L);
default:
     return false;
   }
 }
 
 //===----------------------------------------------------------------------===//
 // evaluation of individual function calls.
 //===----------------------------------------------------------------------===//
 
-void CStringChecker::evalCopyCommon(CheckerContext &C, 
+void CStringChecker::evalCopyCommon(CheckerContext &C,
                                     const CallExpr *CE,
                                     ProgramStateRef state,
                                     const Expr *Size, const Expr *Dest,
                                     const Expr *Source, bool Restricted,
                                     bool IsMempcpy) const {
   CurrentFunctionDescription = "memory copy function";
 
   // See if the size argument is zero.
if (stateNonZeroSize) {
     // Ensure the destination is not null. If it is NULL there will be a
     // NULL pointer dereference.
     state = checkNonNull(C, state, Dest, destVal);
     if (!state)
       return;
 
     // Get the value of the Src.
     SVal srcVal = state->getSVal(Source, LCtx);
-    
     // Ensure the source is not null. If it is NULL there will be a
     // NULL pointer dereference.
     state = checkNonNull(C, state, Source, srcVal);
     if (!state)
       return;
 
     // Ensure the accesses are valid and that the buffers do not overlap.
     const char * const writeWarning =
       "Memory copy function overflows destination buffer";
     state = CheckBufferAccess(C, state, Size, Dest, Source,
                               writeWarning, /* sourceWarning = */ nullptr);
     if (Restricted)
       state = CheckOverlap(C, state, Size, Dest, Source);
 
     if (!state)
       return;
 
-    // If this is mempcpy, get the byte after the last byte copied and 
+    // If this is mempcpy, get the byte after the last byte copied and
     // bind the expr.
     if (IsMempcpy) {
       loc::MemRegionVal destRegVal = destVal.castAs<loc::MemRegionVal>();
-      
       // Get the length to copy.
       if (Optional<NonLoc> lenValNonLoc = sizeVal.getAs<NonLoc>()) {
         // Get the byte after the last byte copied.
         SValBuilder &SvalBuilder = C.getSValBuilder();
         ASTContext &Ctx = SvalBuilder.getContext();
         QualType CharPtrTy = Ctx.getPointerType(Ctx.CharTy);
         loc::MemRegionVal DestRegCharVal = SvalBuilder.evalCast(destRegVal,
           CharPtrTy, Dest->getType()).castAs<loc::MemRegionVal>();
-        SVal lastElement = C.getSValBuilder().evalBinOpLN(state, BO_Add, 
+        SVal lastElement = C.getSValBuilder().evalBinOpLN(state, BO_Add,
                                                           DestRegCharVal,
-                                                          *lenValNonLoc, 
+                                                          *lenValNonLoc,
                                                           Dest->getType());
-      
         // The byte after the last byte copied is the return value.
         state = state->BindExpr(CE, LCtx, lastElement);
       } else {
         // If we don't know how much we copied, we can at least
         // conjure a return value for later.
         SVal result = C.getSValBuilder().conjureSymbolVal(nullptr, CE, LCtx,
                                                           C.blockCount());
         state = state->BindExpr(CE, LCtx, result);
       }
 
     } else {
       // All other copies return the destination buffer.
       // (Well, bcopy() has a void return type, but this won't hurt.)
       state = state->BindExpr(CE, LCtx, destVal);
     }
 
     // Invalidate the destination (regular invalidation without pointer-escaping
     // the address of the top-level region).
     // FIXME: Even if we can't perfectly model the copy, we should see if we
     // can use LazyCompoundVals to copy the source values into the destination.
     // This would probably remove any existing bindings past the end of the
     // copied region, but that's still an improvement over blank invalidation.
-    state = InvalidateBuffer(C, state, Dest, C.getSVal(Dest), 
+    state = InvalidateBuffer(C, state, Dest, C.getSVal(Dest),
                              /*IsSourceBuffer*/false);
 
     // Invalidate the source (const-invalidation without const-pointer-escaping
     // the address of the top-level region).
-    state = InvalidateBuffer(C, state, Source, C.getSVal(Source), 
+    state = InvalidateBuffer(C, state, Source, C.getSVal(Source),
                              /*IsSourceBuffer*/true);
 
     C.addTransition(state);
   }
 }
 
 
 void CStringChecker::evalMemcpy(CheckerContext &C, const CallExpr *CE) const {

 void CStringChecker::evalMempcpy(CheckerContext &C, const CallExpr *CE) const {
   if (CE->getNumArgs() < 3)
     return;
 
   // void *mempcpy(void *restrict dst, const void *restrict src, size_t n);
   // The return value is a pointer to the byte following the last written byte.
   const Expr *Dest = CE->getArg(0);
   ProgramStateRef state = C.getState();
-  
   evalCopyCommon(C, CE, state, CE->getArg(2), Dest, CE->getArg(1), true, true);
 }
 
 void CStringChecker::evalMemmove(CheckerContext &C, const CallExpr *CE) const {
   if (CE->getNumArgs() < 3)
     return;
 
   // void *memmove(void *dst, const void *src, size_t n);
   // The return value is the address of the destination buffer.
   const Expr *Dest = CE->getArg(0);
   ProgramStateRef state = C.getState();
 
   evalCopyCommon(C, CE, state, CE->getArg(2), Dest, CE->getArg(1));
 }
 
 void CStringChecker::evalBcopy(CheckerContext &C, const CallExpr *CE) const {
   if (CE->getNumArgs() < 3)
     return;
 
   // void bcopy(const void *src, void *dst, size_t n);
-  evalCopyCommon(C, CE, C.getState(), 
+  evalCopyCommon(C, CE, C.getState(),
                  CE->getArg(2), CE->getArg(1), CE->getArg(0));
 }
 
 void CStringChecker::evalMemcmp(CheckerContext &C, const CallExpr *CE) const {
   if (CE->getNumArgs() < 3)
     return;
 
   // int memcmp(const void *s1, const void *s2, size_t n);
if (result.isUnknown()) {
                                                    C.blockCount());
       NonLoc resultNL = result.castAs<NonLoc>();
 
       if (strLengthNL) {
         state = state->assume(C.getSValBuilder().evalBinOpNN(
                                   state, BO_LE, resultNL, *strLengthNL, cmpTy)
                                   .castAs<DefinedOrUnknownSVal>(), true);
       }
-      
       if (maxlenValNL) {
         state = state->assume(C.getSValBuilder().evalBinOpNN(
                                   state, BO_LE, resultNL, *maxlenValNL, cmpTy)
                                   .castAs<DefinedOrUnknownSVal>(), true);
       }
     }
 
   } else {
void CStringChecker::evalstrLengthCommon(CheckerContext &C, const CallExpr *CE,
   C.addTransition(state);
 }
 
 void CStringChecker::evalStrcpy(CheckerContext &C, const CallExpr *CE) const {
   if (CE->getNumArgs() < 2)
     return;
 
   // char *strcpy(char *restrict dst, const char *restrict src);
-  evalStrcpyCommon(C, CE, 
-                   /* returnEnd = */ false, 
+  evalStrcpyCommon(C, CE,
+                   /* returnEnd = */ false,
                    /* isBounded = */ false,
                    /* isAppending = */ false);
 }
 
 void CStringChecker::evalStrncpy(CheckerContext &C, const CallExpr *CE) const {
   if (CE->getNumArgs() < 3)
     return;
 
   // char *strncpy(char *restrict dst, const char *restrict src, size_t n);
-  evalStrcpyCommon(C, CE, 
-                   /* returnEnd = */ false, 
+  evalStrcpyCommon(C, CE,
+                   /* returnEnd = */ false,
                    /* isBounded = */ true,
                    /* isAppending = */ false);
 }
 
 void CStringChecker::evalStpcpy(CheckerContext &C, const CallExpr *CE) const {
   if (CE->getNumArgs() < 2)
     return;
 
   // char *stpcpy(char *restrict dst, const char *restrict src);
-  evalStrcpyCommon(C, CE, 
-                   /* returnEnd = */ true, 
+  evalStrcpyCommon(C, CE,
+                   /* returnEnd = */ true,
                    /* isBounded = */ false,
                    /* isAppending = */ false);
 }
 
 void CStringChecker::evalStrcat(CheckerContext &C, const CallExpr *CE) const {
   if (CE->getNumArgs() < 2)
     return;
 
   //char *strcat(char *restrict s1, const char *restrict s2);
-  evalStrcpyCommon(C, CE, 
-                   /* returnEnd = */ false, 
+  evalStrcpyCommon(C, CE,
+                   /* returnEnd = */ false,
                    /* isBounded = */ false,
                    /* isAppending = */ true);
 }
 
 void CStringChecker::evalStrncat(CheckerContext &C, const CallExpr *CE) const {
   if (CE->getNumArgs() < 3)
     return;
 
   //char *strncat(char *restrict s1, const char *restrict s2, size_t n);
-  evalStrcpyCommon(C, CE, 
-                   /* returnEnd = */ false, 
+  evalStrcpyCommon(C, CE,
+                   /* returnEnd = */ false,
                    /* isBounded = */ true,
                    /* isAppending = */ true);
 }
 
 void CStringChecker::evalStrcpyCommon(CheckerContext &C, const CallExpr *CE,
                                       bool returnEnd, bool isBounded,
                                       bool isAppending) const {
   CurrentFunctionDescription = "string copy function";
if (isAppending) {
     // Get the string length of the destination. If the destination is memory
     // that can't have a string length, we shouldn't be copying into it anyway.
     SVal dstStrLength = getCStringLength(C, state, Dst, DstVal);
     if (dstStrLength.isUndef())
       return;
 
     Optional<NonLoc> srcStrLengthNL = amountCopied.getAs<NonLoc>();
     Optional<NonLoc> dstStrLengthNL = dstStrLength.getAs<NonLoc>();
-    
     // If we know both string lengths, we might know the final string length.
     if (srcStrLengthNL && dstStrLengthNL) {
       // Make sure the two lengths together don't overflow a size_t.
       state = checkAdditionOverflow(C, state, *srcStrLengthNL, *dstStrLengthNL);
       if (!state)
         return;
 
-      finalStrLength = svalBuilder.evalBinOpNN(state, BO_Add, *srcStrLengthNL, 
+      finalStrLength = svalBuilder.evalBinOpNN(state, BO_Add, *srcStrLengthNL,
                                                *dstStrLengthNL, sizeTy);
     }
 
     // If we couldn't get a single value for the final string length,
     // we can at least bound it by the individual lengths.
     if (finalStrLength.isUnknown()) {
       // Try to get a "hypothetical" string length symbol, which we can later
       // set as a real value if that turns out to be the case.
if (Optional<loc::MemRegionVal> dstRegVal =
     QualType ptrTy = Dst->getType();
 
     // If we have an exact value on a bounded copy, use that to check for
     // overflows, rather than our estimate about how much is actually copied.
     if (boundWarning) {
       if (Optional<NonLoc> maxLastNL = maxLastElementIndex.getAs<NonLoc>()) {
         SVal maxLastElement = svalBuilder.evalBinOpLN(state, BO_Add, *dstRegVal,
                                                       *maxLastNL, ptrTy);
-        state = CheckLocation(C, state, CE->getArg(2), maxLastElement, 
+        state = CheckLocation(C, state, CE->getArg(2), maxLastElement,
                               boundWarning);
         if (!state)
           return;
       }
     }
 
     // Then, if the final length is known...
     if (Optional<NonLoc> knownStrLength = finalStrLength.getAs<NonLoc>()) {

 void CStringChecker::evalStrncmp(CheckerContext &C, const CallExpr *CE) const {
   if (CE->getNumArgs() < 3)
     return;
 
   //int strncmp(const char *s1, const char *s2, size_t n);
   evalStrcmpCommon(C, CE, /* isBounded = */ true, /* ignoreCase = */ false);
 }
 
-void CStringChecker::evalStrcasecmp(CheckerContext &C, 
+void CStringChecker::evalStrcasecmp(CheckerContext &C,
                                     const CallExpr *CE) const {
   if (CE->getNumArgs() < 2)
     return;
 
   //int strcasecmp(const char *s1, const char *s2);
   evalStrcmpCommon(C, CE, /* isBounded = */ false, /* ignoreCase = */ true);
 }
 
-void CStringChecker::evalStrncasecmp(CheckerContext &C, 
+void CStringChecker::evalStrncasecmp(CheckerContext &C,
                                      const CallExpr *CE) const {
   if (CE->getNumArgs() < 3)
     return;
 
   //int strncasecmp(const char *s1, const char *s2, size_t n);
   evalStrcmpCommon(C, CE, /* isBounded = */ true, /* ignoreCase = */ true);
 }
 
bool CStringChecker::evalCall(const CallExpr *CE, CheckerContext &C) const {
   else if (C.isCLibraryFunction(FDecl, "strncasecmp"))
     evalFunction =  &CStringChecker::evalStrncasecmp;
   else if (C.isCLibraryFunction(FDecl, "strsep"))
     evalFunction =  &CStringChecker::evalStrsep;
   else if (C.isCLibraryFunction(FDecl, "bcopy"))
     evalFunction =  &CStringChecker::evalBcopy;
   else if (C.isCLibraryFunction(FDecl, "bcmp"))
     evalFunction =  &CStringChecker::evalMemcmp;
-  
   // If the callee isn't a string function, let another checker handle it.
   if (!evalFunction)
     return false;
 
   // Check and evaluate the call.
   (this->*evalFunction)(C, CE);
 
   // If the evaluate call resulted in no change, chain to the next eval call
void CStringChecker::checkPreStmt(const DeclStmt *DS, CheckerContext &C) const {
   C.addTransition(state);
 }
 
 bool CStringChecker::wantsRegionChangeUpdate(ProgramStateRef state) const {
   CStringLengthTy Entries = state->get<CStringLength>();
   return !Entries.isEmpty();
 }
 
-ProgramStateRef 
+ProgramStateRef
 CStringChecker::checkRegionChanges(ProgramStateRef state,
                                    const InvalidatedSymbols *,
                                    ArrayRef<const MemRegion *> ExplicitRegions,
                                    ArrayRef<const MemRegion *> Regions,
                                    const CallEvent *Call) const {
   CStringLengthTy Entries = state->get<CStringLength>();
   if (Entries.isEmpty())
     return state;

lib/StaticAnalyzer/Checkers/CheckObjCDealloc.cpp

static bool scan_ivar_release(Stmt *S, ObjCIvarDecl *ID,
   // [self setMyIvar:nil];
   if (ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(S))
     if (ME->getInstanceReceiver())
       if (Expr *Receiver = ME->getInstanceReceiver()->IgnoreParenCasts())
         if (DeclRefExpr *E = dyn_cast<DeclRefExpr>(Receiver))
           if (E->getDecl()->getIdentifier() == SelfII)
             if (ME->getMethodDecl() == PD->getSetterMethodDecl() &&
                 ME->getNumArgs() == 1 &&
-                ME->getArg(0)->isNullPointerConstant(Ctx, 
+                ME->getArg(0)->isNullPointerConstant(Ctx,
                                               Expr::NPC_ValueDependentIsNull))
               return true;
 
   // self.myIvar = nil;
   if (BinaryOperator* BO = dyn_cast<BinaryOperator>(S))
     if (BO->isAssignmentOp())
       if (ObjCPropertyRefExpr *PRE =
            dyn_cast<ObjCPropertyRefExpr>(BO->getLHS()->IgnoreParenCasts()))
         if (PRE->isExplicitProperty() && PRE->getExplicitProperty() == PD)
-            if (BO->getRHS()->isNullPointerConstant(Ctx, 
+            if (BO->getRHS()->isNullPointerConstant(Ctx,
                                             Expr::NPC_ValueDependentIsNull)) {
               // This is only a 'release' if the property kind is not
               // 'assign'.
               return PD->getSetterKind() != ObjCPropertyDecl::Assign;
             }
 
   // Recurse to children.
   for (Stmt *SubStmt : S->children())

lib/StaticAnalyzer/Checkers/CheckSecuritySyntaxOnly.cpp

 
 void WalkAST::VisitChildren(Stmt *S) {
   for (Stmt *Child : S->children())
     if (Child)
       Visit(Child);
 }
 
 void WalkAST::VisitCallExpr(CallExpr *CE) {
-  // Get the callee.  
+  // Get the callee.
   const FunctionDecl *FD = CE->getDirectCallee();
 
   if (!FD)
     return;
 
   // Get the name of the callee. If it's a builtin, strip off the prefix.
   IdentifierInfo *II = FD->getIdentifier();
   if (!II)   // if no identifier, not a simple C function

 // Originally: <rdar://problem/6335715>
 // Implements (part of): 300-BSI (buildsecurityin.us-cert.gov)
 // CWE-242: Use of Inherently Dangerous Function
 //===----------------------------------------------------------------------===//
 
 void WalkAST::checkCall_gets(const CallExpr *CE, const FunctionDecl *FD) {
   if (!filter.check_gets)
     return;
-  
   const FunctionProtoType *FPT = FD->getType()->getAs<FunctionProtoType>();
   if (!FPT)
     return;
 
   // Verify that the function takes a single argument.
   if (FPT->getNumParams() != 1)
     return;
 
void WalkAST::checkCall_mkstemp(const CallExpr *CE, const FunctionDecl *FD) {
   StringRef Name = FD->getIdentifier()->getName();
   std::pair<signed, signed> ArgSuffix =
     llvm::StringSwitch<std::pair<signed, signed> >(Name)
       .Case("mktemp", std::make_pair(0,-1))
       .Case("mkstemp", std::make_pair(0,-1))
       .Case("mkdtemp", std::make_pair(0,-1))
       .Case("mkstemps", std::make_pair(0,1))
       .Default(std::make_pair(-1, -1));
-  
   assert(ArgSuffix.first >= 0 && "Unsupported function");
 
   // Check if the number of arguments is consistent with out expectations.
   unsigned numArgs = CE->getNumArgs();
   if ((signed) numArgs <= ArgSuffix.first)
     return;
-  
   const StringLiteral *strArg =
     dyn_cast<StringLiteral>(CE->getArg((unsigned)ArgSuffix.first)
                               ->IgnoreParenImpCasts());
-  
   // Currently we only handle string literals.  It is possible to do better,
   // either by looking at references to const variables, or by doing real
   // flow analysis.
   if (!strArg || strArg->getCharByteWidth() != 1)
     return;
 
   // Count the number of X's, taking into account a possible cutoff suffix.
   StringRef str = strArg->getString();
   unsigned numX = 0;
   unsigned n = str.size();
 
   // Take into account the suffix.
   unsigned suffix = 0;
   if (ArgSuffix.second >= 0) {
     const Expr *suffixEx = CE->getArg((unsigned)ArgSuffix.second);
     llvm::APSInt Result;
     if (!suffixEx->EvaluateAsInt(Result, BR.getContext()))
       return;
     // FIXME: Issue a warning.
     if (Result.isNegative())
       return;
     suffix = (unsigned) Result.getZExtValue();
     n = (n > suffix) ? n - suffix : 0;
   }
-  
   for (unsigned i = 0; i < n; ++i)
     if (str[i] == 'X') ++numX;
-  
   if (numX >= 6)
     return;
-  
   // Issue a warning.
   PathDiagnosticLocation CELoc =
     PathDiagnosticLocation::createBegin(CE, BR.getSourceManager(), AC);
   SmallString<512> buf;
   llvm::raw_svector_ostream out(buf);
   out << "Call to '" << Name << "' should have at least 6 'X's in the"
     " format string to be secure (" << numX << " 'X'";
   if (numX != 1)
void WalkAST::checkCall_mkstemp(const CallExpr *CE, const FunctionDecl *FD) {
   BR.EmitBasicReport(AC->getDecl(), filter.checkName_mkstemp,
                      "Insecure temporary file creation", "Security",
                      out.str(), CELoc, strArg->getSourceRange());
 }
 
 //===----------------------------------------------------------------------===//
 // Check: Any use of 'strcpy' is insecure.
 //
-// CWE-119: Improper Restriction of Operations within 
-// the Bounds of a Memory Buffer 
+// CWE-119: Improper Restriction of Operations within
+// the Bounds of a Memory Buffer
 //===----------------------------------------------------------------------===//
 void WalkAST::checkCall_strcpy(const CallExpr *CE, const FunctionDecl *FD) {
   if (!filter.check_strcpy)
     return;
-  
   if (!checkCall_strCommon(CE, FD))
     return;
 
   // Issue a warning.
   PathDiagnosticLocation CELoc =
     PathDiagnosticLocation::createBegin(CE, BR.getSourceManager(), AC);
   BR.EmitBasicReport(AC->getDecl(), filter.checkName_strcpy,
                      "Potential insecure memory buffer bounds restriction in "
                      "call 'strcpy'",
                      "Security",
                      "Call to function 'strcpy' is insecure as it does not "
                      "provide bounding of the memory buffer. Replace "
                      "unbounded copy functions with analogous functions that "
                      "support length arguments such as 'strlcpy'. CWE-119.",
                      CELoc, CE->getCallee()->getSourceRange());
 }
 
 //===----------------------------------------------------------------------===//
 // Check: Any use of 'strcat' is insecure.
 //
-// CWE-119: Improper Restriction of Operations within 
-// the Bounds of a Memory Buffer 
+// CWE-119: Improper Restriction of Operations within
+// the Bounds of a Memory Buffer
 //===----------------------------------------------------------------------===//
 void WalkAST::checkCall_strcat(const CallExpr *CE, const FunctionDecl *FD) {
   if (!filter.check_strcpy)
     return;
 
   if (!checkCall_strCommon(CE, FD))
     return;
 

 //===----------------------------------------------------------------------===//
 // Check: Should check whether privileges are dropped successfully.
 // Originally: <rdar://problem/6337132>
 //===----------------------------------------------------------------------===//
 
 void WalkAST::checkUncheckedReturnValue(CallExpr *CE) {
   if (!filter.check_UncheckedReturn)
     return;
-  
   const FunctionDecl *FD = CE->getDirectCallee();
   if (!FD)
     return;
 
   if (II_setid[0] == nullptr) {
     static const char * const identifiers[num_setids] = {
       "setuid", "setgid", "seteuid", "setegid",
       "setreuid", "setregid"

 //===----------------------------------------------------------------------===//
 // SecuritySyntaxChecker
 //===----------------------------------------------------------------------===//
 
 namespace {
 class SecuritySyntaxChecker : public Checker<check::ASTCodeBody> {
 public:
   ChecksFilter filter;
-  
   void checkASTCodeBody(const Decl *D, AnalysisManager& mgr,
                         BugReporter &BR) const {
     WalkAST walker(BR, mgr.getAnalysisDeclContext(D), filter);
     walker.Visit(D->getBody());
   }
 };
 }
 

lib/StaticAnalyzer/Checkers/CheckSizeofPointer.cpp

void WalkAST::VisitUnaryExprOrTypeTraitExpr(UnaryExprOrTypeTraitExpr *E) {
   // If an explicit type is used in the code, usually the coder knows what they are
   // doing.
   if (E->isArgumentType())
     return;
 
   QualType T = E->getTypeOfArgument();
   if (T->isPointerType()) {
 
-    // Many false positives have the form 'sizeof *p'. This is reasonable 
-    // because people know what they are doing when they intentionally 
+    // Many false positives have the form 'sizeof *p'. This is reasonable
+    // because people know what they are doing when they intentionally
     // dereference the pointer.
     Expr *ArgEx = E->getArgumentExpr();
     if (!isa<DeclRefExpr>(ArgEx->IgnoreParens()))
       return;
 
     PathDiagnosticLocation ELoc =
       PathDiagnosticLocation::createBegin(E, BR.getSourceManager(), AC);
     BR.EmitBasicReport(AC->getDecl(), Checker,

lib/StaticAnalyzer/Checkers/CheckerDocumentation.cpp

public:
 
   /// \brief Called to determine if the checker currently needs to know if when
   /// contents of any regions change.
   ///
   /// Since it is not necessarily cheap to compute which regions are being
   /// changed, this allows the analyzer core to skip the more expensive
   /// #checkRegionChanges when no checkers are tracking any state.
   bool wantsRegionChangeUpdate(ProgramStateRef St) const { return true; }
-  
   /// \brief Called when the contents of one or more regions change.
   ///
   /// This can occur in many different ways: an explicit bind, a blanket
   /// invalidation of the region contents, or by passing a region to a function
   /// call whose behavior the analyzer cannot model perfectly.
   ///
   /// \param State The current program state.
   /// \param Invalidated A set of all symbols potentially touched by the change.
   /// \param ExplicitRegions The regions explicitly requested for invalidation.
   ///        For a function call, this would be the arguments. For a bind, this
   ///        would be the region being bound to.
   /// \param Regions The transitive closure of regions accessible from,
   ///        \p ExplicitRegions, i.e. all regions that may have been touched
   ///        by this change. For a simple bind, this list will be the same as
   ///        \p ExplicitRegions, since a bind does not affect the contents of
   ///        anything accessible through the base region.
   /// \param Call The opaque call triggering this invalidation. Will be 0 if the
   ///        change was not triggered by a call.
   ///
   /// Note that this callback will not be invoked unless
   /// #wantsRegionChangeUpdate returns \c true.
   ///
   /// check::RegionChanges
-  ProgramStateRef 
+  ProgramStateRef
     checkRegionChanges(ProgramStateRef State,
                        const InvalidatedSymbols *Invalidated,
                        ArrayRef<const MemRegion *> ExplicitRegions,
                        ArrayRef<const MemRegion *> Regions,
                        const CallEvent *Call) const {
     return State;
   }
 
   /// \brief Called when pointers escape.
   ///
   /// This notifies the checkers about pointer escape, which occurs whenever
   /// the analyzer cannot track the symbol any more. For example, as a
-  /// result of assigning a pointer into a global or when it's passed to a 
+  /// result of assigning a pointer into a global or when it's passed to a
   /// function call the analyzer cannot model.
-  /// 
+  ///
   /// \param State The state at the point of escape.
   /// \param Escaped The list of escaped symbols.
-  /// \param Call The corresponding CallEvent, if the symbols escape as 
+  /// \param Call The corresponding CallEvent, if the symbols escape as
   /// parameters to the given call.
   /// \param Kind How the symbols have escaped.
   /// \returns Checkers can modify the state by returning a new state.
   ProgramStateRef checkPointerEscape(ProgramStateRef State,
                                      const InvalidatedSymbols &Escaped,
                                      const CallEvent *Call,
                                      PointerEscapeKind Kind) const {
     return State;
   }
 
   /// \brief Called when const pointers escape.
   ///
   /// Note: in most cases checkPointerEscape callback is sufficient.
   /// \sa checkPointerEscape
   ProgramStateRef checkConstPointerEscape(ProgramStateRef State,
                                      const InvalidatedSymbols &Escaped,
                                      const CallEvent *Call,
                                      PointerEscapeKind Kind) const {
     return State;
   }
-                                         
   /// check::Event<ImplicitNullDerefEvent>
   void checkEvent(ImplicitNullDerefEvent Event) const {}
 
   /// \brief Check every declaration in the AST.
   ///
   /// An AST traversal callback, which should only be used when the checker is
   /// not path sensitive. It will be called for every Declaration in the AST and
   /// can be specialized to only be called on subclasses of Decl, for example,

lib/StaticAnalyzer/Checkers/Checkers.td

 def CplusplusAlpha : Package<"cplusplus">, InPackage<Alpha>, Hidden;
 
 def DeadCode : Package<"deadcode">;
 def DeadCodeAlpha : Package<"deadcode">, InPackage<Alpha>, Hidden;
 
 def Security : Package <"security">;
 def InsecureAPI : Package<"insecureAPI">, InPackage<Security>;
 def SecurityAlpha : Package<"security">, InPackage<Alpha>, Hidden;
-def Taint : Package<"taint">, InPackage<SecurityAlpha>, Hidden;  
+def Taint : Package<"taint">, InPackage<SecurityAlpha>, Hidden;
 
 def Unix : Package<"unix">;
 def UnixAlpha : Package<"unix">, InPackage<Alpha>, Hidden;
 def CString : Package<"cstring">, InPackage<Unix>, Hidden;
 def CStringAlpha : Package<"cstring">, InPackage<UnixAlpha>, Hidden;
 
 def OSX : Package<"osx">;
 def OSXAlpha : Package<"osx">, InPackage<Alpha>, Hidden;

 
 def UndefBranchChecker : Checker<"Branch">,
   HelpText<"Check for uninitialized values used as branch conditions">,
   DescFile<"UndefBranchChecker.cpp">;
 
 def UndefCapturedBlockVarChecker : Checker<"CapturedBlockVariable">,
   HelpText<"Check for blocks that capture uninitialized values">,
   DescFile<"UndefCapturedBlockVarChecker.cpp">;
-  
 def ReturnUndefChecker : Checker<"UndefReturn">,
   HelpText<"Check for uninitialized values being returned to the caller">,
   DescFile<"ReturnUndefChecker.cpp">;
 
 } // end "core.uninitialized"
 
 //===----------------------------------------------------------------------===//
 // C++ checkers.
 //===----------------------------------------------------------------------===//
 
 let ParentPackage = Cplusplus in {
 
 def NewDeleteChecker : Checker<"NewDelete">,
-  HelpText<"Check for double-free and use-after-free problems. Traces memory managed by new/delete.">, 
+  HelpText<"Check for double-free and use-after-free problems. Traces memory managed by new/delete.">,
   DescFile<"MallocChecker.cpp">;
 
 def NewDeleteLeaksChecker : Checker<"NewDeleteLeaks">,
-  HelpText<"Check for memory leaks. Traces memory managed by new/delete.">, 
+  HelpText<"Check for memory leaks. Traces memory managed by new/delete.">,
   DescFile<"MallocChecker.cpp">;
 
 } // end: "cplusplus"
 
 let ParentPackage = CplusplusAlpha in {
 
 def VirtualCallChecker : Checker<"VirtualCall">,
-  HelpText<"Check virtual function calls during construction or destruction">, 
+  HelpText<"Check virtual function calls during construction or destruction">,
   DescFile<"VirtualCallChecker.cpp">;
 
 } // end: "alpha.cplusplus"
 
 //===----------------------------------------------------------------------===//
 // Deadcode checkers.
 //===----------------------------------------------------------------------===//
 
def FloatLoopCounter : Checker<"FloatLoopCounter">,
     HelpText<"Warn on using a floating point value as a loop counter (CERT: FLP30-C, FLP30-CPP)">,
     DescFile<"CheckSecuritySyntaxOnly.cpp">;
 }
 
 let ParentPackage = SecurityAlpha in {
 
 def ArrayBoundChecker : Checker<"ArrayBound">,
   HelpText<"Warn about buffer overflows (older checker)">,
-  DescFile<"ArrayBoundChecker.cpp">;  
+  DescFile<"ArrayBoundChecker.cpp">;
 
 def ArrayBoundCheckerV2 : Checker<"ArrayBoundV2">,
   HelpText<"Warn about buffer overflows (newer checker)">,
   DescFile<"ArrayBoundCheckerV2.cpp">;
 
 def ReturnPointerRangeChecker : Checker<"ReturnPtrRange">,
   HelpText<"Check for an out-of-bound pointer being returned to callers">,
   DescFile<"ReturnPointerRangeChecker.cpp">;

 
 def UnixAPIChecker : Checker<"API">,
   HelpText<"Check calls to various UNIX/Posix functions">,
   DescFile<"UnixAPIChecker.cpp">;
 
 def MallocChecker: Checker<"Malloc">,
   HelpText<"Check for memory leaks, double free, and use-after-free problems. Traces memory managed by malloc()/free().">,
   DescFile<"MallocChecker.cpp">;
-  
 def MallocSizeofChecker : Checker<"MallocSizeof">,
   HelpText<"Check for dubious malloc arguments involving sizeof">,
   DescFile<"MallocSizeofChecker.cpp">;
 
 def MismatchedDeallocatorChecker : Checker<"MismatchedDeallocator">,
   HelpText<"Check for mismatched deallocators.">,
   DescFile<"MallocChecker.cpp">;
-  
 } // end "unix"
 
 let ParentPackage = UnixAlpha in {
 
 def ChrootChecker : Checker<"Chroot">,
   HelpText<"Check improper use of chroot">,
   DescFile<"ChrootChecker.cpp">;
 

 let ParentPackage = CString in {
 
 def CStringNullArg : Checker<"NullArg">,
   HelpText<"Check for null pointers being passed as arguments to C string functions">,
   DescFile<"CStringChecker.cpp">;
 
 def CStringSyntaxChecker : Checker<"BadSizeArg">,
   HelpText<"Check the size argument passed into C string functions for common erroneous patterns">,
-  DescFile<"CStringSyntaxChecker.cpp">;  
+  DescFile<"CStringSyntaxChecker.cpp">;
 }
 
 let ParentPackage = CStringAlpha in {
 
 def CStringOutOfBounds : Checker<"OutOfBounds">,
   HelpText<"Check for out-of-bounds access in string functions">,
   DescFile<"CStringChecker.cpp">;
 

 let ParentPackage = Containers in {
 def ObjCContainersASTChecker : Checker<"PointerSizedValues">,
   HelpText<"Warns if 'CFArray', 'CFDictionary', 'CFSet' are created with non-pointer-size values">,
   DescFile<"ObjCContainersASTChecker.cpp">;
 
 def ObjCContainersChecker : Checker<"OutOfBounds">,
   HelpText<"Checks for index out-of-bounds when using 'CFArray' API">,
   DescFile<"ObjCContainersChecker.cpp">;
-    
 }
 //===----------------------------------------------------------------------===//
 // Checkers for LLVM development.
 //===----------------------------------------------------------------------===//
 
 def LLVMConventionsChecker : Checker<"Conventions">,
   InPackage<LLVM>,
   HelpText<"Check code for LLVM codebase conventions">,

lib/StaticAnalyzer/Checkers/ChrootChecker.cpp

 #include "llvm/ADT/ImmutableMap.h"
 using namespace clang;
 using namespace ento;
 
 namespace {
 
 // enum value that represent the jail state
 enum Kind { NO_CHROOT, ROOT_CHANGED, JAIL_ENTERED };
-  
 bool isRootChanged(intptr_t k) { return k == ROOT_CHANGED; }
 //bool isJailEntered(intptr_t k) { return k == JAIL_ENTERED; }
 
 // This checker checks improper use of chroot.
 // The state transition:
 // NO_CHROOT ---chroot(path)--> ROOT_CHANGED ---chdir(/) --> JAIL_ENTERED
 //                                  |                               |
 //         ROOT_CHANGED<--chdir(..)--      JAIL_ENTERED<--chdir(..)--
 //                                  |                               |
 //                      bug<--foo()--          JAIL_ENTERED<--foo()--
 class ChrootChecker : public Checker<eval::Call, check::PreStmt<CallExpr> > {
   mutable IdentifierInfo *II_chroot, *II_chdir;
   // This bug refers to possibly break out of a chroot() jail.
   mutable std::unique_ptr<BuiltinBug> BT_BreakJail;
 
 public:
   ChrootChecker() : II_chroot(nullptr), II_chdir(nullptr) {}
 
   static void *getTag() {
     static int x;
     return &x;
   }
-  
   bool evalCall(const CallExpr *CE, CheckerContext &C) const;
   void checkPreStmt(const CallExpr *CE, CheckerContext &C) const;
 
 private:
   void Chroot(CheckerContext &C, const CallExpr *CE) const;
   void Chdir(CheckerContext &C, const CallExpr *CE) const;
 };
 
bool ChrootChecker::evalCall(const CallExpr *CE, CheckerContext &C) const {
   }
 
   return false;
 }
 
 void ChrootChecker::Chroot(CheckerContext &C, const CallExpr *CE) const {
   ProgramStateRef state = C.getState();
   ProgramStateManager &Mgr = state->getStateManager();
-  
-  // Once encouter a chroot(), set the enum value ROOT_CHANGED directly in 
+  // Once encouter a chroot(), set the enum value ROOT_CHANGED directly in
   // the GDM.
   state = Mgr.addGDM(state, ChrootChecker::getTag(), (void*) ROOT_CHANGED);
   C.addTransition(state);
 }
 
 void ChrootChecker::Chdir(CheckerContext &C, const CallExpr *CE) const {
   ProgramStateRef state = C.getState();
   ProgramStateManager &Mgr = state->getStateManager();
 
   // If there are no jail state in the GDM, just return.
   const void *k = state->FindGDM(ChrootChecker::getTag());
   if (!k)
     return;
 
   // After chdir("/"), enter the jail, set the enum value JAIL_ENTERED.
   const Expr *ArgExpr = CE->getArg(0);
   SVal ArgVal = state->getSVal(ArgExpr, C.getLocationContext());
-  
   if (const MemRegion *R = ArgVal.getAsRegion()) {
     R = R->StripCasts();
     if (const StringRegion* StrRegion= dyn_cast<StringRegion>(R)) {
       const StringLiteral* Str = StrRegion->getStringLiteral();
       if (Str->getString() == "/")
         state = Mgr.addGDM(state, ChrootChecker::getTag(),
                            (void*) JAIL_ENTERED);
     }
void ChrootChecker::checkPreStmt(const CallExpr *CE, CheckerContext &C) const {
   if (!II_chroot)
     II_chroot = &Ctx.Idents.get("chroot");
   if (!II_chdir)
     II_chdir = &Ctx.Idents.get("chdir");
 
   // Ingnore chroot and chdir.
   if (FD->getIdentifier() == II_chroot || FD->getIdentifier() == II_chdir)
     return;
-  
   // If jail state is ROOT_CHANGED, generate BugReport.
   void *const* k = C.getState()->FindGDM(ChrootChecker::getTag());
   if (k)
     if (isRootChanged((intptr_t) *k))
       if (ExplodedNode *N = C.addTransition()) {
         if (!BT_BreakJail)
           BT_BreakJail.reset(new BuiltinBug(
               this, "Break out of jail", "No call of chdir(\"/\") immediately "

lib/StaticAnalyzer/Checkers/DeadStoresChecker.cpp

 #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
 #include "llvm/ADT/BitVector.h"
 #include "llvm/ADT/SmallString.h"
 #include "llvm/Support/SaveAndRestore.h"
 
 using namespace clang;
 using namespace ento;
 
-namespace {  
-  
+namespace {
 /// A simple visitor to record what VarDecls occur in EH-handling code.
 class EHCodeVisitor : public RecursiveASTVisitor<EHCodeVisitor> {
 public:
   bool inEH;
   llvm::DenseSet<const VarDecl *> &S;
-  
   bool TraverseObjCAtFinallyStmt(ObjCAtFinallyStmt *S) {
     SaveAndRestore<bool> inFinally(inEH, true);
     return ::RecursiveASTVisitor<EHCodeVisitor>::TraverseObjCAtFinallyStmt(S);
   }
-  
   bool TraverseObjCAtCatchStmt(ObjCAtCatchStmt *S) {
     SaveAndRestore<bool> inCatch(inEH, true);
     return ::RecursiveASTVisitor<EHCodeVisitor>::TraverseObjCAtCatchStmt(S);
   }
-  
   bool TraverseCXXCatchStmt(CXXCatchStmt *S) {
     SaveAndRestore<bool> inCatch(inEH, true);
     return TraverseStmt(S->getHandlerBlock());
   }
-  
   bool VisitDeclRefExpr(DeclRefExpr *DR) {
     if (inEH)
       if (const VarDecl *D = dyn_cast<VarDecl>(DR->getDecl()))
         S.insert(D);
     return true;
   }
-  
   EHCodeVisitor(llvm::DenseSet<const VarDecl *> &S) :
   inEH(false), S(S) {}
 };
 
 // FIXME: Eventually migrate into its own file, and have it managed by
 // AnalysisManager.
 class ReachableCode {
   const CFG &cfg;
   llvm::BitVector reachable;
 public:
   ReachableCode(const CFG &cfg)
     : cfg(cfg), reachable(cfg.getNumBlockIDs(), false) {}
-  
   void computeReachableBlocks();
-  
   bool isReachable(const CFGBlock *block) const {
     return reachable[block->getBlockID()];
   }
 };
 }
 
 void ReachableCode::computeReachableBlocks() {
   if (!cfg.getNumBlockIDs())
     return;
-  
   SmallVector<const CFGBlock*, 10> worklist;
   worklist.push_back(&cfg.getEntry());
 
   while (!worklist.empty()) {
     const CFGBlock *block = worklist.pop_back_val();
     llvm::BitVector::reference isReachable = reachable[block->getBlockID()];
     if (isReachable)
       continue;
if (!InEH.get()) {
       V.TraverseStmt(AC->getBody());
     }
     // Treat all VarDecls that occur in EH code as being "always live"
     // when considering to suppress dead stores.  Frequently stores
     // are followed by reads in EH code, but we don't have the ability
     // to analyze that yet.
     return InEH->count(D);
   }
-  
   void Report(const VarDecl *V, DeadStoreKind dsk,
               PathDiagnosticLocation L, SourceRange R) {
     if (Escaped.count(V))
       return;
-    
     // Compute reachable blocks within the CFG for trivial cases
     // where a bogus dead store can be reported because itself is unreachable.
     if (!reachableCode.get()) {
       reachableCode.reset(new ReachableCode(cfg));
       reachableCode->computeReachableBlocks();
     }
-    
     if (!reachableCode->isReachable(currentBlock))
       return;
 
     SmallString<64> buf;
     llvm::raw_svector_ostream os(buf);
     const char *BugType = nullptr;
 
     switch (dsk) {
       case DeadInit:
         BugType = "Dead initialization";
         os << "Value stored to '" << *V
            << "' during its initialization is never read";
         break;
 
       case DeadIncrement:
         BugType = "Dead increment";
       case Standard:
         if (!BugType) BugType = "Dead assignment";
         os << "Value stored to '" << *V << "' is never read";
         break;
 
       case Enclosing:
         // Don't report issues in this case, e.g.: "if (x = foo())",
-        // where 'x' is unused later.  We have yet to see a case where 
+        // where 'x' is unused later.  We have yet to see a case where
         // this is a real bug.
         return;
     }
 
     BR.EmitBasicReport(AC->getDecl(), Checker, BugType, "Dead store", os.str(),
                        L, R);
   }
 
bool isIncrement(VarDecl *VD, const BinaryOperator* B) {
 
     return false;
   }
 
   void observeStmt(const Stmt *S, const CFGBlock *block,
                    const LiveVariables::LivenessValues &Live) override {
 
     currentBlock = block;
-    
     // Skip statements in macros.
     if (S->getLocStart().isMacroID())
       return;
 
     // Only cover dead stores from regular assignments.  ++/-- dead stores
     // have never flagged a real bug.
     if (const BinaryOperator* B = dyn_cast<BinaryOperator>(S)) {
       if (!B->isAssignmentOp()) return; // Skip non-assignments.
 
       if (DeclRefExpr *DR = dyn_cast<DeclRefExpr>(B->getLHS()))
         if (VarDecl *VD = dyn_cast<VarDecl>(DR->getDecl())) {
           // Special case: check for assigning null to a pointer.
           //  This is a common form of defensive programming.
           const Expr *RHS =
             LookThroughTransitiveAssignmentsAndCommaOperators(B->getRHS());
           RHS = RHS->IgnoreParenCasts();
-          
           QualType T = VD->getType();
           if (T->isPointerType() || T->isObjCObjectPointerType()) {
             if (RHS->isNullPointerConstant(Ctx, Expr::NPC_ValueDependentIsNull))
               return;
           }
 
           // Special case: self-assignments.  These are often used to shut up
           //  "unused variable" compiler warnings.
void observeStmt(const Stmt *S, const CFGBlock *block,
     else if (const DeclStmt *DS = dyn_cast<DeclStmt>(S))
       // Iterate through the decls.  Warn if any initializers are complex
       // expressions that are not live (never used).
       for (const auto *DI : DS->decls()) {
         const auto *V = dyn_cast<VarDecl>(DI);
 
         if (!V)
           continue;
-          
-        if (V->hasLocalStorage()) {          
+        if (V->hasLocalStorage()) {
           // Reference types confuse the dead stores checker.  Skip them
           // for now.
           if (V->getType()->getAs<ReferenceType>())
             return;
-            
           if (const Expr *E = V->getInit()) {
             while (const ExprWithCleanups *exprClean =
                     dyn_cast<ExprWithCleanups>(E))
               E = exprClean->getSubExpr();
-            
             // Look through transitive assignments, e.g.:
             // int x = y = 0;
             E = LookThroughTransitiveAssignmentsAndCommaOperators(E);
-            
             // Don't warn on C++ objects (yet) until we can show that their
             // constructors/destructors don't have side effects.
             if (isa<CXXConstructExpr>(E))
               return;
-            
             // A dead initialization is a variable that is dead after it
             // is initialized.  We don't flag warnings for those variables
             // marked 'unused' or 'objc_precise_lifetime'.
             if (!isLive(Live, V) &&
                 !V->hasAttr<UnusedAttr>() &&
                 !V->hasAttr<ObjCPreciseLifetimeAttr>()) {
               // Special case: check for initializations with constants.
               //

lib/StaticAnalyzer/Checkers/DereferenceChecker.cpp

switch (Ex->getStmtClass()) {
     }
     case Stmt::ObjCIvarRefExprClass: {
       const ObjCIvarRefExpr *IV = cast<ObjCIvarRefExpr>(Ex);
       os << " (" << (loadedFrom ? "loaded from" : "via")
          << " ivar '" << IV->getDecl()->getName() << "')";
       SourceLocation L = IV->getLocation();
       Ranges.push_back(SourceRange(L, L));
       break;
-    }    
+    }
   }
 }
 
 void DereferenceChecker::reportBug(ProgramStateRef State, const Stmt *S,
                                    CheckerContext &C, bool IsBind) const {
   // Generate an error node.
   ExplodedNode *N = C.generateSink(State);
   if (!N)

lib/StaticAnalyzer/Checkers/DivZeroChecker.cpp

 namespace {
 class DivZeroChecker : public Checker< check::PreStmt<BinaryOperator> > {
   mutable std::unique_ptr<BuiltinBug> BT;
   void reportBug(const char *Msg,
                  ProgramStateRef StateZero,
                  CheckerContext &C) const ;
 public:
   void checkPreStmt(const BinaryOperator *B, CheckerContext &C) const;
-};  
+};
 } // end anonymous namespace
 
 void DivZeroChecker::reportBug(const char *Msg,
                                ProgramStateRef StateZero,
                                CheckerContext &C) const {
   if (ExplodedNode *N = C.generateSink(StateZero)) {
     if (!BT)
       BT.reset(new BuiltinBug(this, "Division by zero"));

lib/StaticAnalyzer/Checkers/DynamicTypePropagation.cpp

if (const ObjCMethodCall *Msg = dyn_cast<ObjCMethodCall>(&Call)) {
 
     // Get the returned value if it's a region.
     const MemRegion *RetReg = Call.getReturnValue().getAsRegion();
     if (!RetReg)
       return;
 
     ProgramStateRef State = C.getState();
     const ObjCMethodDecl *D = Msg->getDecl();
-    
     if (D && D->hasRelatedResultType()) {
       switch (Msg->getMethodFamily()) {
       default:
         break;
 
       // We assume that the type of the object returned by alloc and new are the
       // pointer to the object of the class specified in the receiver of the
       // message.
void DynamicTypePropagation::checkPostStmt(const CXXNewExpr *NewE,
                                            CheckerContext &C) const {
   if (NewE->isArray())
     return;
 
   // We only track dynamic type info for regions.
   const MemRegion *MR = C.getSVal(NewE).getAsRegion();
   if (!MR)
     return;
-  
   C.addTransition(C.getState()->setDynamicTypeInfo(MR, NewE->getType(),
                                                    /*CanBeSubclass=*/false));
 }
 
 const ObjCObjectType *
 DynamicTypePropagation::getObjectTypeForAllocAndNew(const ObjCMessageExpr *MsgE,
                                                     CheckerContext &C) const {
   if (MsgE->getReceiverKind() == ObjCMessageExpr::Class) {

lib/StaticAnalyzer/Checkers/FixedAddressChecker.cpp

 #include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 
 using namespace clang;
 using namespace ento;
 
 namespace {
-class FixedAddressChecker 
+class FixedAddressChecker
   : public Checker< check::PreStmt<BinaryOperator> > {
   mutable std::unique_ptr<BuiltinBug> BT;
 
 public:
   void checkPreStmt(const BinaryOperator *B, CheckerContext &C) const;
 };
 }
 

lib/StaticAnalyzer/Checkers/GenericTaintChecker.cpp

private:
   /// and allocators.
   static const char MsgTaintedBufferSize[];
   bool checkTaintedBufferSize(const CallExpr *CE, const FunctionDecl *FDecl,
                               CheckerContext &C) const;
 
   /// Generate a report if the expression is tainted or points to tainted data.
   bool generateReportIfTainted(const Expr *E, const char Msg[],
                                CheckerContext &C) const;
-                               
-  
   typedef SmallVector<unsigned, 2> ArgVector;
 
   /// \brief A struct used to specify taint propagation rules for a function.
   ///
   /// If any of the possible taint source arguments is tainted, all of the
   /// destination arguments should also be tainted. Use InvalidArgIndex in the
   /// src list to specify that all of the arguments can introduce taint. Use
   /// InvalidArgIndex in the dst arguments to signify that all the non-const
SymbolRef GenericTaintChecker::getPointedToSymbol(CheckerContext &C,
 
   const PointerType *ArgTy =
     dyn_cast<PointerType>(Arg->getType().getCanonicalType().getTypePtr());
   SVal Val = State->getSVal(*AddrLoc,
                             ArgTy ? ArgTy->getPointeeType(): QualType());
   return Val.getAsSymbol();
 }
 
-ProgramStateRef 
+ProgramStateRef
 GenericTaintChecker::TaintPropagationRule::process(const CallExpr *CE,
                                                    CheckerContext &C) const {
   ProgramStateRef State = C.getState();
 
   // Check for taint in arguments.
   bool IsTainted = false;
   for (ArgVector::const_iterator I = SrcArgs.begin(),
                                  E = SrcArgs.end(); I != E; ++I) {
if (generateReportIfTainted(CE->getArg(ArgNum),
                               MsgUncontrolledFormatString, C))
     return true;
   return false;
 }
 
 bool GenericTaintChecker::checkSystemCall(const CallExpr *CE,
                                           StringRef Name,
                                           CheckerContext &C) const {
-  // TODO: It might make sense to run this check on demand. In some cases, 
-  // we should check if the environment has been cleansed here. We also might 
+  // TODO: It might make sense to run this check on demand. In some cases,
+  // we should check if the environment has been cleansed here. We also might
   // need to know if the user was reset before these calls(seteuid).
   unsigned ArgNum = llvm::StringSwitch<unsigned>(Name)
     .Case("system", 0)
     .Case("popen", 0)
     .Case("execl", 0)
     .Case("execle", 0)
     .Case("execlp", 0)
     .Case("execv", 0)

lib/StaticAnalyzer/Checkers/IdenticalExprChecker.cpp

if (B->getOpcode() != B2->getOpcode())
       break;
     if (isIdenticalStmt(AC->getASTContext(), RHS, B2->getRHS())) {
       Sr[0] = RHS->getSourceRange();
       Sr[1] = B2->getRHS()->getSourceRange();
       reportIdenticalExpr(B, CheckBitwise, Sr);
     }
     LHS = B2->getLHS();
   }
-  
   if (isIdenticalStmt(AC->getASTContext(), RHS, LHS)) {
     Sr[0] = RHS->getSourceRange();
     Sr[1] = LHS->getSourceRange();
     reportIdenticalExpr(B, CheckBitwise, Sr);
   }
 }
 
 bool FindIdenticalExprVisitor::VisitIfStmt(const IfStmt *I) {

lib/StaticAnalyzer/Checkers/IvarInvalidationChecker.cpp

 //  invalidated. We call an instance variable ivalidatable if it is an object of
 //  a class which contains an invalidation method. There could be multiple
 //  methods annotated with such annotations per class, either one can be used
 //  to invalidate the ivar. An ivar or property are considered to be
 //  invalidated if they are being assigned 'nil' or an invalidation method has
 //  been called on them. An invalidation method should either invalidate all
 //  the ivars or call another invalidation method (on self).
 //
-//  Partial invalidor annotation allows to addess cases when ivars are 
-//  invalidated by other methods, which might or might not be called from 
+//  Partial invalidor annotation allows to addess cases when ivars are
+//  invalidated by other methods, which might or might not be called from
 //  the invalidation method. The checker checks that each invalidation
 //  method and all the partial methods cumulatively invalidate all ivars.
 //    __attribute__((annotate("objc_instance_variable_invalidator_partial")));
 //
 //===----------------------------------------------------------------------===//
 
 #include "ClangSACheckers.h"
 #include "clang/AST/Attr.h"
const ObjCIvarDecl *IvarInvalidationCheckerImpl::findPropertyBackingIvar(
                         const ObjCPropertyDecl *Prop,
                         const ObjCInterfaceDecl *InterfaceD,
                         IvarSet &TrackedIvars,
                         const ObjCIvarDecl **FirstIvarDecl) {
   const ObjCIvarDecl *IvarD = nullptr;
 
   // Lookup for the synthesized case.
   IvarD = Prop->getPropertyIvarDecl();
-  // We only track the ivars/properties that are defined in the current 
+  // We only track the ivars/properties that are defined in the current
   // class (not the parent).
   if (IvarD && IvarD->getContainingInterface() == InterfaceD) {
     if (TrackedIvars.count(IvarD)) {
       return IvarD;
     }
     // If the ivar is synthesized we still want to track it.
     if (trackIvar(IvarD, TrackedIvars, FirstIvarDecl))
       return IvarD;

lib/StaticAnalyzer/Checkers/MacOSKeychainAPIChecker.cpp

bool definitelyReturnedError(SymbolRef RetSym,
                                bool noError = false) const;
 
   /// Check if RetSym evaluates to a NoErr value in the current state.
   bool definitelyDidnotReturnError(SymbolRef RetSym,
                                    ProgramStateRef State,
                                    SValBuilder &Builder) const {
     return definitelyReturnedError(RetSym, State, Builder, true);
   }
-                                                 
   /// Mark an AllocationPair interesting for diagnostic reporting.
   void markInteresting(BugReport *R, const AllocationPair &AP) const {
     R->markInteresting(AP.first);
     R->markInteresting(AP.second->Region);
   }
 
   /// The bug visitor which allows us to print extra diagnostics along the
   /// BugReport path. For example, showing the allocation site of the leaked

 void MacOSKeychainAPIChecker::checkPreStmt(const CallExpr *CE,
                                            CheckerContext &C) const {
   unsigned idx = InvalidIdx;
   ProgramStateRef State = C.getState();
 
   const FunctionDecl *FD = C.getCalleeDecl(CE);
   if (!FD || FD->getKind() != Decl::Function)
     return;
-  
   StringRef funName = C.getCalleeName(FD);
   if (funName.empty())
     return;
 
   // If it is a call to an allocator function, it could be a double allocation.
   idx = getTrackedFunctionIndex(funName, true);
   if (idx != InvalidIdx) {
     unsigned paramIdx = FunctionsToTrack[idx].Param;

lib/StaticAnalyzer/Checkers/MacOSXAPIChecker.cpp

void MacOSXAPIChecker::CheckDispatchOnce(CheckerContext &C, const CallExpr *CE,
   // that dispatch_once is a macro that wraps a call to _dispatch_once.
   // _dispatch_once is then a function which then calls the real dispatch_once.
   // Users do not care; they just want the warning at the top-level call.
   if (CE->getLocStart().isMacroID()) {
     StringRef TrimmedFName = FName.ltrim("_");
     if (TrimmedFName != FName)
       FName = TrimmedFName;
   }
-  
   SmallString<256> S;
   llvm::raw_svector_ostream os(S);
   os << "Call to '" << FName << "' uses";
   if (const VarRegion *VR = dyn_cast<VarRegion>(R))
     os << " the local variable '" << VR->getDecl()->getName() << '\'';
   else
     os << " stack allocated memory";
   os << " for the predicate value.  Using such transient memory for "

lib/StaticAnalyzer/Checkers/Makefile

 ##===- clang/lib/Checker/Makefile --------------------------*- Makefile -*-===##
-# 
+#
 #                     The LLVM Compiler Infrastructure
 #
 # This file is distributed under the University of Illinois Open Source
 # License. See LICENSE.TXT for details.
-# 
+#
 ##===----------------------------------------------------------------------===##
 #
-# This implements analyses built on top of source-level CFGs. 
+# This implements analyses built on top of source-level CFGs.
 #
 ##===----------------------------------------------------------------------===##
 
 CLANG_LEVEL := ../../..
 LIBRARYNAME := clangStaticAnalyzerCheckers
 
 BUILT_SOURCES = Checkers.inc
 TABLEGEN_INC_FILES_COMMON = 1
 
 include $(CLANG_LEVEL)/Makefile
 
 $(ObjDir)/Checkers.inc.tmp : Checkers.td $(PROJ_SRC_DIR)/$(CLANG_LEVEL)/include/clang/StaticAnalyzer/Checkers/CheckerBase.td $(CLANG_TBLGEN) $(ObjDir)/.dir
   $(Echo) "Building Clang SA Checkers tables with tblgen"
   $(Verb) $(ClangTableGen) -gen-clang-sa-checkers -I $(PROJ_SRC_DIR)/$(CLANG_LEVEL)/include -o $(call SYSPATH, $@) $<

lib/StaticAnalyzer/Checkers/MallocChecker.cpp

enum Kind { // Reference to allocated memory.
               // We are no longer guaranteed to have observed all manipulations
               // of this pointer/memory. For example, it could have been
               // passed as a parameter to an opaque function.
               Escaped
   };
 
   const Stmt *S;
   unsigned K : 3; // Kind enum, but stored as a bitfield.
-  unsigned Family : 29; // Rest of 32-bit word, currently just an allocation 
+  unsigned Family : 29; // Rest of 32-bit word, currently just an allocation
                         // family.
 
-  RefState(Kind k, const Stmt *s, unsigned family) 
+  RefState(Kind k, const Stmt *s, unsigned family)
     : S(s), K(k), Family(family) {
     assert(family != AF_None);
   }
 public:
   bool isAllocated() const { return K == Allocated; }
   bool isAllocatedOfSizeZero() const { return K == AllocatedOfSizeZero; }
   bool isReleased() const { return K == Released; }
   bool isRelinquished() const { return K == Relinquished; }
public:
 
   static RefState getAllocated(unsigned family, const Stmt *s) {
     return RefState(Allocated, s, family);
   }
   static RefState getAllocatedOfSizeZero(const RefState *RS) {
     return RefState(AllocatedOfSizeZero, RS->getStmt(),
                     RS->getAllocationFamily());
   }
-  static RefState getReleased(unsigned family, const Stmt *s) { 
+  static RefState getReleased(unsigned family, const Stmt *s) {
     return RefState(Released, s, family);
   }
   static RefState getRelinquished(unsigned family, const Stmt *s) {
     return RefState(Relinquished, s, family);
   }
   static RefState getEscaped(const RefState *RS) {
     return RefState(Escaped, RS->getStmt(), RS->getAllocationFamily());
   }
class MallocChecker : public Checker<check::DeadSymbols,
                                      check::PreStmt<CXXDeleteExpr>,
                                      check::PostStmt<BlockExpr>,
                                      check::PostObjCMessage,
                                      check::Location,
                                      eval::Assume>
 {
 public:
   MallocChecker()
-      : II_alloca(nullptr), II_malloc(nullptr), II_free(nullptr), 
+      : II_alloca(nullptr), II_malloc(nullptr), II_free(nullptr),
         II_realloc(nullptr), II_calloc(nullptr), II_valloc(nullptr),
-        II_reallocf(nullptr), II_strndup(nullptr), II_strdup(nullptr), 
+        II_reallocf(nullptr), II_strndup(nullptr), II_strdup(nullptr),
         II_kmalloc(nullptr), II_if_nameindex(nullptr),
         II_if_freenameindex(nullptr) {}
 
   /// In pessimistic mode, the checker assumes that it does not know which
   /// functions might free the memory.
   enum CheckKind {
     CK_MallocChecker,
     CK_NewDeleteChecker,
     CK_NewDeleteLeaksChecker,
     CK_MismatchedDeallocatorChecker,
     CK_NumCheckKinds
   };
 
-  enum class MemoryOperationKind { 
+  enum class MemoryOperationKind {
     MOK_Allocate,
     MOK_Free,
     MOK_Any
   };
 
   DefaultBool IsOptimistic;
 
   DefaultBool ChecksEnabled[CK_NumCheckKinds];
private:
   void initIdentifierInfo(ASTContext &C) const;
 
   /// \brief Determine family of a deallocation expression.
   AllocationFamily getAllocationFamily(CheckerContext &C, const Stmt *S) const;
 
   /// \brief Print names of allocators and deallocators.
   ///
   /// \returns true on success.
-  bool printAllocDeallocName(raw_ostream &os, CheckerContext &C, 
+  bool printAllocDeallocName(raw_ostream &os, CheckerContext &C,
                              const Expr *E) const;
 
   /// \brief Print expected name of an allocator based on the deallocator's
   /// family derived from the DeallocExpr.
-  void printExpectedAllocName(raw_ostream &os, CheckerContext &C, 
+  void printExpectedAllocName(raw_ostream &os, CheckerContext &C,
                               const Expr *DeallocExpr) const;
-  /// \brief Print expected name of a deallocator based on the allocator's 
+  /// \brief Print expected name of a deallocator based on the allocator's
   /// family.
   void printExpectedDeallocName(raw_ostream &os, AllocationFamily Family) const;
 
   ///@{
-  /// Check if this is one of the functions which can allocate/reallocate memory 
+  /// Check if this is one of the functions which can allocate/reallocate memory
   /// pointed to by one of its arguments.
   bool isMemFunction(const FunctionDecl *FD, ASTContext &C) const;
   bool isCMemFunction(const FunctionDecl *FD,
                       ASTContext &C,
                       AllocationFamily Family,
                       MemoryOperationKind MemKind) const;
   bool isStandardNewDelete(const FunctionDecl *FD, ASTContext &C) const;
   ///@}
private:
 
   // Check if this malloc() for special flags. At present that means M_ZERO or
   // __GFP_ZERO (in which case, treat it like calloc).
   llvm::Optional<ProgramStateRef>
   performKernelMalloc(const CallExpr *CE, CheckerContext &C,
                       const ProgramStateRef &State) const;
 
   /// Update the RefState to reflect the new memory allocation.
-  static ProgramStateRef 
+  static ProgramStateRef
   MallocUpdateRefState(CheckerContext &C, const Expr *E, ProgramStateRef State,
                        AllocationFamily Family = AF_Malloc);
 
   ProgramStateRef FreeMemAttr(CheckerContext &C, const CallExpr *CE,
                               const OwnershipAttr* Att,
                               ProgramStateRef State) const;
   ProgramStateRef FreeMemAux(CheckerContext &C, const CallExpr *CE,
                              ProgramStateRef state, unsigned Num,
                              bool Hold,
                              bool &ReleasedAllocated,
                              bool ReturnsNullOnFailure = false) const;
   ProgramStateRef FreeMemAux(CheckerContext &C, const Expr *Arg,
                              const Expr *ParentExpr,
                              ProgramStateRef State,
                              bool Hold,
                              bool &ReleasedAllocated,
                              bool ReturnsNullOnFailure = false) const;
 
   ProgramStateRef ReallocMem(CheckerContext &C, const CallExpr *CE,
-                             bool FreesMemOnFailure, 
+                             bool FreesMemOnFailure,
                              ProgramStateRef State) const;
   static ProgramStateRef CallocMem(CheckerContext &C, const CallExpr *CE,
                                    ProgramStateRef State);
-  
   ///\brief Check if the memory associated with this symbol was released.
   bool isReleased(SymbolRef Sym, CheckerContext &C) const;
 
   bool checkUseAfterFree(SymbolRef Sym, CheckerContext &C, const Stmt *S) const;
 
-  void checkUseZeroAllocated(SymbolRef Sym, CheckerContext &C, 
+  void checkUseZeroAllocated(SymbolRef Sym, CheckerContext &C,
                              const Stmt *S) const;
 
   bool checkDoubleDelete(SymbolRef Sym, CheckerContext &C) const;
 
   /// Check if the function is known free memory, or if it is
   /// "interesting" and should be modeled explicitly.
   ///
-  /// \param [out] EscapingSymbol A function might not free memory in general, 
+  /// \param [out] EscapingSymbol A function might not free memory in general,
   ///   but could be known to free a particular symbol. In this case, false is
   ///   returned and the single escaping symbol is returned through the out
   ///   parameter.
   ///
   /// We assume that pointers do not escape through calls to system functions
   /// not handled by this checker.
   bool mayFreeAnyEscapedMemoryOrIsModeledExplicitly(const CallEvent *Call,
                                    ProgramStateRef State,
private:
   /// Tells if a given family/call/symbol is tracked by the current checker.
   /// Sets CheckKind to the kind of the checker responsible for this
   /// family/call/symbol.
   Optional<CheckKind> getCheckIfTracked(AllocationFamily Family,
                                         bool IsALeakCheck = false) const;
   Optional<CheckKind> getCheckIfTracked(CheckerContext &C,
                                         const Stmt *AllocDeallocStmt,
                                         bool IsALeakCheck = false) const;
-  Optional<CheckKind> getCheckIfTracked(CheckerContext &C, SymbolRef Sym, 
+  Optional<CheckKind> getCheckIfTracked(CheckerContext &C, SymbolRef Sym,
                                         bool IsALeakCheck = false) const;
   ///@}
   static bool SummarizeValue(raw_ostream &os, SVal V);
   static bool SummarizeRegion(raw_ostream &os, const MemRegion *MR);
-  void ReportBadFree(CheckerContext &C, SVal ArgVal, SourceRange Range, 
+  void ReportBadFree(CheckerContext &C, SVal ArgVal, SourceRange Range,
                      const Expr *DeallocExpr) const;
   void ReportFreeAlloca(CheckerContext &C, SVal ArgVal,
                         SourceRange Range) const;
   void ReportMismatchedDealloc(CheckerContext &C, SourceRange Range,
                                const Expr *DeallocExpr, const RefState *RS,
                                SymbolRef Sym, bool OwnershipTransferred) const;
-  void ReportOffsetFree(CheckerContext &C, SVal ArgVal, SourceRange Range, 
-                        const Expr *DeallocExpr, 
+  void ReportOffsetFree(CheckerContext &C, SVal ArgVal, SourceRange Range,
+                        const Expr *DeallocExpr,
                         const Expr *AllocExpr = nullptr) const;
   void ReportUseAfterFree(CheckerContext &C, SourceRange Range,
                           SymbolRef Sym) const;
   void ReportDoubleFree(CheckerContext &C, SourceRange Range, bool Released,
                         SymbolRef Sym, SymbolRef PrevSym) const;
 
   void ReportDoubleDelete(CheckerContext &C, SymbolRef Sym) const;
 
void Profile(llvm::FoldingSetNodeID &ID) const override {
       ID.AddPointer(&X);
       ID.AddPointer(Sym);
     }
 
     inline bool isAllocated(const RefState *S, const RefState *SPrev,
                             const Stmt *Stmt) {
       // Did not track -> allocated. Other state (released) -> allocated.
       return (Stmt && (isa<CallExpr>(Stmt) || isa<CXXNewExpr>(Stmt)) &&
-              (S && (S->isAllocated() || S->isAllocatedOfSizeZero())) && 
-              (!SPrev || !(SPrev->isAllocated() || 
+              (S && (S->isAllocated() || S->isAllocatedOfSizeZero())) &&
+              (!SPrev || !(SPrev->isAllocated() ||
                            SPrev->isAllocatedOfSizeZero())));
     }
 
     inline bool isReleased(const RefState *S, const RefState *SPrev,
                            const Stmt *Stmt) {
       // Did not track -> released. Other state (allocated) -> released.
       return (Stmt && (isa<CallExpr>(Stmt) || isa<CXXDeleteExpr>(Stmt)) &&
               (S && S->isReleased()) && (!SPrev || !SPrev->isReleased()));
private:
     };
   };
 };
 } // end anonymous namespace
 
 REGISTER_MAP_WITH_PROGRAMSTATE(RegionState, SymbolRef, RefState)
 REGISTER_MAP_WITH_PROGRAMSTATE(ReallocPairs, SymbolRef, ReallocPair)
 
-// A map from the freed symbol to the symbol representing the return value of 
+// A map from the freed symbol to the symbol representing the return value of
 // the free function.
 REGISTER_MAP_WITH_PROGRAMSTATE(FreeReturnValue, SymbolRef, SymbolRef)
 
 namespace {
 class StopTrackingCallback final : public SymbolVisitor {
   ProgramStateRef state;
 public:
   StopTrackingCallback(ProgramStateRef st) : state(st) {}

 // 2) A global placement operator function with the single placement argument
 //    of type std::nothrow_t.
 bool MallocChecker::isStandardNewDelete(const FunctionDecl *FD,
                                         ASTContext &C) const {
   if (!FD)
     return false;
 
   OverloadedOperatorKind Kind = FD->getOverloadedOperator();
-  if (Kind != OO_New && Kind != OO_Array_New && 
+  if (Kind != OO_New && Kind != OO_Array_New &&
       Kind != OO_Delete && Kind != OO_Array_Delete)
     return false;
 
   // Skip all operator new/delete methods.
   if (isa<CXXMethodDecl>(FD))
     return false;
 
   // Return true if tested operator is a standard placement nothrow operator.
if (FD->getKind() == Decl::Function) {
     } else if (FunI == II_strndup) {
       State = MallocUpdateRefState(C, CE, State);
     } else if (FunI == II_alloca) {
       State = MallocMemAux(C, CE, CE->getArg(0), UndefinedVal(), State,
                            AF_Alloca);
       State = ProcessZeroAllocation(C, CE, 0, State);
     } else if (isStandardNewDelete(FD, C.getASTContext())) {
       // Process direct calls to operator new/new[]/delete/delete[] functions
-      // as distinct from new/new[]/delete/delete[] expressions that are 
-      // processed by the checkPostStmt callbacks for CXXNewExpr and 
+      // as distinct from new/new[]/delete/delete[] expressions that are
+      // processed by the checkPostStmt callbacks for CXXNewExpr and
       // CXXDeleteExpr.
       OverloadedOperatorKind K = FD->getOverloadedOperator();
       if (K == OO_New) {
         State = MallocMemAux(C, CE, CE->getArg(0), UndefinedVal(), State,
                              AF_CXXNew);
         State = ProcessZeroAllocation(C, CE, 0, State);
       }
       else if (K == OO_Array_New) {
else if (const CXXNewExpr *NE = dyn_cast<CXXNewExpr>(E)) {
     else
       return State;
   }
   else
     llvm_unreachable("not a CallExpr or CXXNewExpr");
 
   assert(Arg);
 
-  Optional<DefinedSVal> DefArgVal = 
+  Optional<DefinedSVal> DefArgVal =
       State->getSVal(Arg, C.getLocationContext()).getAs<DefinedSVal>();
 
   if (!DefArgVal)
     return State;
 
   // Check if the allocation size is 0.
   ProgramStateRef TrueState, FalseState;
   SValBuilder &SvalBuilder = C.getSValBuilder();
   DefinedSVal Zero =
       SvalBuilder.makeZeroVal(Arg->getType()).castAs<DefinedSVal>();
 
-  std::tie(TrueState, FalseState) = 
+  std::tie(TrueState, FalseState) =
       State->assume(SvalBuilder.evalEQ(State, *DefArgVal, Zero));
 
   if (TrueState && !FalseState) {
     SVal retVal = State->getSVal(E, C.getLocationContext());
     SymbolRef Sym = retVal.getAsLocSymbol();
     if (!Sym)
       return State;
 
     const RefState *RS = State->get<RegionState>(Sym);
     if (!RS)
-      return State; // TODO: change to assert(RS); after realloc() will 
+      return State; // TODO: change to assert(RS); after realloc() will
                     // guarantee have a RegionState attached.
 
     if (!RS->isAllocated())
       return State;
 
     return TrueState->set<RegionState>(Sym,
                                        RefState::getAllocatedOfSizeZero(RS));
   }
for (const auto *CtorParam : CtorD->params()) {
 
     if (CtorParamPointeeT->getAsCXXRecordDecl())
       return true;
   }
 
   return false;
 }
 
-void MallocChecker::checkPostStmt(const CXXNewExpr *NE, 
+void MallocChecker::checkPostStmt(const CXXNewExpr *NE,
                                   CheckerContext &C) const {
 
   if (NE->getNumPlacementArgs())
     for (CXXNewExpr::const_arg_iterator I = NE->placement_arg_begin(),
          E = NE->placement_arg_end(); I != E; ++I)
       if (SymbolRef Sym = C.getSVal(*I).getAsSymbol())
         checkUseAfterFree(Sym, C, *I);
 
   if (!isStandardNewDelete(NE->getOperatorNew(), C.getASTContext()))
     return;
 
   ParentMap &PM = C.getLocationContext()->getParentMap();
   if (!PM.isConsumedExpr(NE) && treatUnusedNewEscaped(NE))
     return;
 
   ProgramStateRef State = C.getState();
-  // The return value from operator new is bound to a specified initialization 
-  // value (if any) and we don't want to loose this value. So we call 
-  // MallocUpdateRefState() instead of MallocMemAux() which breakes the 
+  // The return value from operator new is bound to a specified initialization
+  // value (if any) and we don't want to loose this value. So we call
+  // MallocUpdateRefState() instead of MallocMemAux() which breakes the
   // existing binding.
-  State = MallocUpdateRefState(C, NE, State, NE->isArray() ? AF_CXXNewArray 
+  State = MallocUpdateRefState(C, NE, State, NE->isArray() ? AF_CXXNewArray
                                                            : AF_CXXNew);
   State = ProcessZeroAllocation(C, NE, 0, State);
   C.addTransition(State);
 }
 
-void MallocChecker::checkPreStmt(const CXXDeleteExpr *DE, 
+void MallocChecker::checkPreStmt(const CXXDeleteExpr *DE,
                                  CheckerContext &C) const {
 
   if (!ChecksEnabled[CK_NewDeleteChecker])
     if (SymbolRef Sym = C.getSVal(DE->getArgument()).getAsSymbol())
       checkUseAfterFree(Sym, C, DE->getArgument());
 
   if (!isStandardNewDelete(DE->getOperatorDelete(), C.getASTContext()))
     return;
ProgramStateRef State = FreeMemAux(C, Call.getArgExpr(0),
                                      /*Hold=*/true, ReleasedAllocatedMemory,
                                      /*RetNullOnFailure=*/true);
 
   C.addTransition(State);
 }
 
 ProgramStateRef
 MallocChecker::MallocMemReturnsAttr(CheckerContext &C, const CallExpr *CE,
-                                    const OwnershipAttr *Att, 
+                                    const OwnershipAttr *Att,
                                     ProgramStateRef State) const {
   if (!State)
     return nullptr;
 
   if (Att->getModule() != II_malloc)
     return nullptr;
 
   OwnershipAttr::args_iterator I = Att->args_begin(), E = Att->args_end();
if (Optional<DefinedOrUnknownSVal> DefinedSize =
     SValBuilder &svalBuilder = C.getSValBuilder();
     DefinedOrUnknownSVal Extent = R->getExtent(svalBuilder);
     DefinedOrUnknownSVal extentMatchesSize =
         svalBuilder.evalEQ(State, Extent, *DefinedSize);
 
     State = State->assume(extentMatchesSize, true);
     assert(State);
   }
-  
   return MallocUpdateRefState(C, CE, State, Family);
 }
 
 ProgramStateRef MallocChecker::MallocUpdateRefState(CheckerContext &C,
                                                     const Expr *E,
                                                     ProgramStateRef State,
                                                     AllocationFamily Family) {
   if (!State)
ProgramStateRef MallocChecker::MallocUpdateRefState(CheckerContext &C,
   assert(Sym);
 
   // Set the symbol's state to Allocated.
   return State->set<RegionState>(Sym, RefState::getAllocated(Family, E));
 }
 
 ProgramStateRef MallocChecker::FreeMemAttr(CheckerContext &C,
                                            const CallExpr *CE,
-                                           const OwnershipAttr *Att, 
+                                           const OwnershipAttr *Att,
                                            ProgramStateRef State) const {
   if (!State)
     return nullptr;
 
   if (Att->getModule() != II_malloc)
     return nullptr;
 
   bool ReleasedAllocated = false;
if (Ret) {
     ConstraintManager &CMgr = State->getConstraintManager();
     ConditionTruthVal FreeFailed = CMgr.isNull(State, *Ret);
     RetStatusSymbol = *Ret;
     return FreeFailed.isConstrainedTrue();
   }
   return false;
 }
 
-AllocationFamily MallocChecker::getAllocationFamily(CheckerContext &C, 
+AllocationFamily MallocChecker::getAllocationFamily(CheckerContext &C,
                                                     const Stmt *S) const {
   if (!S)
     return AF_None;
 
   if (const CallExpr *CE = dyn_cast<CallExpr>(S)) {
     const FunctionDecl *FD = C.getCalleeDecl(CE);
 
     if (!FD)
if (const CXXDeleteExpr *DE = dyn_cast<CXXDeleteExpr>(S))
     return DE->isArrayForm() ? AF_CXXNewArray : AF_CXXNew;
 
   if (isa<ObjCMessageExpr>(S))
     return AF_Malloc;
 
   return AF_None;
 }
 
-bool MallocChecker::printAllocDeallocName(raw_ostream &os, CheckerContext &C, 
+bool MallocChecker::printAllocDeallocName(raw_ostream &os, CheckerContext &C,
                                           const Expr *E) const {
   if (const CallExpr *CE = dyn_cast<CallExpr>(E)) {
     // FIXME: This doesn't handle indirect calls.
     const FunctionDecl *FD = CE->getDirectCallee();
     if (!FD)
       return false;
-    
     os << *FD;
     if (!FD->isOverloadedOperator())
       os << "()";
     return true;
   }
 
   if (const ObjCMessageExpr *Msg = dyn_cast<ObjCMessageExpr>(E)) {
     if (Msg->isInstanceMessage())
       os << "-";
     else
       os << "+";
     Msg->getSelector().print(os);
     return true;
   }
 
   if (const CXXNewExpr *NE = dyn_cast<CXXNewExpr>(E)) {
-    os << "'" 
+    os << "'"
        << getOperatorSpelling(NE->getOperatorNew()->getOverloadedOperator())
        << "'";
     return true;
   }
 
   if (const CXXDeleteExpr *DE = dyn_cast<CXXDeleteExpr>(E)) {
-    os << "'" 
+    os << "'"
        << getOperatorSpelling(DE->getOperatorDelete()->getOverloadedOperator())
        << "'";
     return true;
   }
 
   return false;
 }
 
 void MallocChecker::printExpectedAllocName(raw_ostream &os, CheckerContext &C,
                                            const Expr *E) const {
   AllocationFamily Family = getAllocationFamily(C, E);
 
   switch(Family) {
     case AF_Malloc: os << "malloc()"; return;
     case AF_CXXNew: os << "'new'"; return;
     case AF_CXXNewArray: os << "'new[]'"; return;
     case AF_IfNameIndex: os << "'if_nameindex()'"; return;
     case AF_Alloca:
     case AF_None: llvm_unreachable("not a deallocation expression");
   }
 }
 
-void MallocChecker::printExpectedDeallocName(raw_ostream &os, 
+void MallocChecker::printExpectedDeallocName(raw_ostream &os,
                                              AllocationFamily Family) const {
   switch(Family) {
     case AF_Malloc: os << "free()"; return;
     case AF_CXXNew: os << "'delete'"; return;
     case AF_CXXNewArray: os << "'delete[]'"; return;
     case AF_IfNameIndex: os << "'if_freenameindex()'"; return;
     case AF_Alloca:
     case AF_None: llvm_unreachable("suspicious argument");
if (nullState && !notNullState)
     return nullptr;
 
   // Unknown values could easily be okay
   // Undefined values are handled elsewhere
   if (ArgVal.isUnknownOrUndef())
     return nullptr;
 
   const MemRegion *R = ArgVal.getAsRegion();
-  
   // Nonlocs can't be freed, of course.
   // Non-region locations (labels and fixed addresses) also shouldn't be freed.
   if (!R) {
     ReportBadFree(C, ArgVal, ArgExpr->getSourceRange(), ParentExpr);
     return nullptr;
   }
-  
   R = R->StripCasts();
-  
   // Blocks might show up as heap data, but should not be free()d
   if (isa<BlockDataRegion>(R)) {
     ReportBadFree(C, ArgVal, ArgExpr->getSourceRange(), ParentExpr);
     return nullptr;
   }
-  
   const MemSpaceRegion *MS = R->getMemorySpace();
-  
-  // Parameters, locals, statics, globals, and memory returned by 
+  // Parameters, locals, statics, globals, and memory returned by
   // __builtin_alloca() shouldn't be freed.
   if (!(isa<UnknownSpaceRegion>(MS) || isa<HeapSpaceRegion>(MS))) {
     // FIXME: at the time this code was written, malloc() regions were
     // represented by conjured symbols, which are all in UnknownSpaceRegion.
     // This means that there isn't actually anything from HeapSpaceRegion
     // that should be freed, even though we allow it here.
     // Of course, free() can work on memory allocated outside the current
     // function, so UnknownSpaceRegion is always a possibility.
if (RsBase) {
     if ((RsBase->isReleased() || RsBase->isRelinquished()) &&
         !didPreviousFreeFail(State, SymBase, PreviousRetStatusSymbol)) {
       ReportDoubleFree(C, ParentExpr->getSourceRange(), RsBase->isReleased(),
                        SymBase, PreviousRetStatusSymbol);
       return nullptr;
 
     // If the pointer is allocated or escaped, but we are now trying to free it,
     // check that the call to free is proper.
-    } else if (RsBase->isAllocated() || RsBase->isAllocatedOfSizeZero() || 
+    } else if (RsBase->isAllocated() || RsBase->isAllocatedOfSizeZero() ||
                RsBase->isEscaped()) {
 
       // Check if an expected deallocation function matches the real one.
       bool DeallocMatchesAlloc =
         RsBase->getAllocationFamily() == getAllocationFamily(C, ParentExpr);
       if (!DeallocMatchesAlloc) {
         ReportMismatchedDealloc(C, ArgExpr->getSourceRange(),
                                 ParentExpr, RsBase, SymBase, Hold);
         return nullptr;
       }
 
       // Check if the memory location being freed is the actual location
       // allocated, or an offset.
       RegionOffset Offset = R->getAsOffset();
       if (Offset.isValid() &&
           !Offset.hasSymbolicOffset() &&
           Offset.getOffset() != 0) {
         const Expr *AllocExpr = cast<Expr>(RsBase->getStmt());
-        ReportOffsetFree(C, ArgVal, ArgExpr->getSourceRange(), ParentExpr, 
+        ReportOffsetFree(C, ArgVal, ArgExpr->getSourceRange(), ParentExpr,
                          AllocExpr);
         return nullptr;
       }
     }
   }
 
-  ReleasedAllocated = (RsBase != nullptr) && (RsBase->isAllocated() || 
+  ReleasedAllocated = (RsBase != nullptr) && (RsBase->isAllocated() ||
                                               RsBase->isAllocatedOfSizeZero());
 
   // Clean out the info on previous call to free return info.
   State = State->remove<FreeReturnValue>(SymBase);
 
-  // Keep track of the return value. If it is NULL, we will know that free 
+  // Keep track of the return value. If it is NULL, we will know that free
   // failed.
   if (ReturnsNullOnFailure) {
     SVal RetVal = C.getSVal(ParentExpr);
     SymbolRef RetStatusSymbol = RetVal.getAsSymbol();
     if (RetStatusSymbol) {
       C.getSymbolManager().addSymbolDependency(SymBase, RetStatusSymbol);
       State = State->set<FreeReturnValue>(SymBase, RetStatusSymbol);
     }
case AF_IfNameIndex: {
 
     return Optional<MallocChecker::CheckKind>();
   }
   case AF_CXXNew:
   case AF_CXXNewArray: {
     if (IsALeakCheck) {
       if (ChecksEnabled[CK_NewDeleteLeaksChecker])
         return CK_NewDeleteLeaksChecker;
-    } 
+    }
     else {
       if (ChecksEnabled[CK_NewDeleteChecker])
         return CK_NewDeleteChecker;
     }
     return Optional<MallocChecker::CheckKind>();
   }
   case AF_None: {
     llvm_unreachable("no family");
bool MallocChecker::SummarizeValue(raw_ostream &os, SVal V) {
   if (Optional<nonloc::ConcreteInt> IntVal = V.getAs<nonloc::ConcreteInt>())
     os << "an integer (" << IntVal->getValue() << ")";
   else if (Optional<loc::ConcreteInt> ConstAddr = V.getAs<loc::ConcreteInt>())
     os << "a constant address (" << ConstAddr->getValue() << ")";
   else if (Optional<loc::GotoLabel> Label = V.getAs<loc::GotoLabel>())
     os << "the address of the label '" << Label->getLabel()->getName() << "'";
   else
     return false;
-  
   return true;
 }
 
 bool MallocChecker::SummarizeRegion(raw_ostream &os,
                                     const MemRegion *MR) {
   switch (MR->getKind()) {
   case MemRegion::FunctionTextRegionKind: {
     const NamedDecl *FD = cast<FunctionTextRegion>(MR)->getDecl();
     if (FD)
       os << "the address of the function '" << *FD << '\'';
     else
       os << "the address of a function";
     return true;
   }
   case MemRegion::BlockTextRegionKind:
     os << "block text";
     return true;
   case MemRegion::BlockDataRegionKind:
     // FIXME: where the block came from?
     os << "a block";
     return true;
   default: {
     const MemSpaceRegion *MS = MR->getMemorySpace();
-    
     if (isa<StackLocalsSpaceRegion>(MS)) {
       const VarRegion *VR = dyn_cast<VarRegion>(MR);
       const VarDecl *VD;
       if (VR)
         VD = VR->getDecl();
       else
         VD = nullptr;
 
if (isa<GlobalsSpaceRegion>(MS)) {
       return true;
     }
 
     return false;
   }
   }
 }
 
-void MallocChecker::ReportBadFree(CheckerContext &C, SVal ArgVal, 
-                                  SourceRange Range, 
+void MallocChecker::ReportBadFree(CheckerContext &C, SVal ArgVal,
+                                  SourceRange Range,
                                   const Expr *DeallocExpr) const {
 
   if (!ChecksEnabled[CK_MallocChecker] &&
       !ChecksEnabled[CK_NewDeleteChecker])
     return;
 
   Optional<MallocChecker::CheckKind> CheckKind =
       getCheckIfTracked(C, DeallocExpr);
if (ExplodedNode *N = C.generateSink()) {
     while (const ElementRegion *ER = dyn_cast_or_null<ElementRegion>(MR))
       MR = ER->getSuperRegion();
 
     os << "Argument to ";
     if (!printAllocDeallocName(os, C, DeallocExpr))
       os << "deallocator";
 
     os << " is ";
-    bool Summarized = MR ? SummarizeRegion(os, MR) 
+    bool Summarized = MR ? SummarizeRegion(os, MR)
                          : SummarizeValue(os, ArgVal);
     if (Summarized)
       os << ", which is not memory allocated by ";
     else
       os << "not memory allocated by ";
 
     printExpectedAllocName(os, C, DeallocExpr);
 
     auto R = llvm::make_unique<BugReport>(*BT_BadFree[*CheckKind], os.str(), N);
     R->markInteresting(MR);
     R->addRange(Range);
     C.emitReport(std::move(R));
   }
 }
 
-void MallocChecker::ReportFreeAlloca(CheckerContext &C, SVal ArgVal, 
+void MallocChecker::ReportFreeAlloca(CheckerContext &C, SVal ArgVal,
                                      SourceRange Range) const {
 
   Optional<MallocChecker::CheckKind> CheckKind;
 
   if (ChecksEnabled[CK_MallocChecker])
     CheckKind = CK_MallocChecker;
   else if (ChecksEnabled[CK_MismatchedDeallocatorChecker])
     CheckKind = CK_MismatchedDeallocatorChecker;
auto R = llvm::make_unique<BugReport>(
         *BT_FreeAlloca[*CheckKind],
         "Memory allocated by alloca() should not be deallocated", N);
     R->markInteresting(ArgVal.getAsRegion());
     R->addRange(Range);
     C.emitReport(std::move(R));
   }
 }
 
-void MallocChecker::ReportMismatchedDealloc(CheckerContext &C, 
+void MallocChecker::ReportMismatchedDealloc(CheckerContext &C,
                                             SourceRange Range,
-                                            const Expr *DeallocExpr, 
+                                            const Expr *DeallocExpr,
                                             const RefState *RS,
-                                            SymbolRef Sym, 
+                                            SymbolRef Sym,
                                             bool OwnershipTransferred) const {
 
   if (!ChecksEnabled[CK_MismatchedDeallocatorChecker])
     return;
 
   if (ExplodedNode *N = C.generateSink()) {
     if (!BT_MismatchedDealloc)
       BT_MismatchedDealloc.reset(
           new BugType(CheckNames[CK_MismatchedDeallocatorChecker],
                       "Bad deallocator", "Memory Error"));
 
     SmallString<100> buf;
     llvm::raw_svector_ostream os(buf);
 
     const Expr *AllocExpr = cast<Expr>(RS->getStmt());
     SmallString<20> AllocBuf;
     llvm::raw_svector_ostream AllocOs(AllocBuf);
     SmallString<20> DeallocBuf;
     llvm::raw_svector_ostream DeallocOs(DeallocBuf);
 
     if (OwnershipTransferred) {
       if (printAllocDeallocName(DeallocOs, C, DeallocExpr))
         os << DeallocOs.str() << " cannot";
-      else 
+      else
         os << "Cannot";
 
       os << " take ownership of memory";
 
       if (printAllocDeallocName(AllocOs, C, AllocExpr))
         os << " allocated by " << AllocOs.str();
     } else {
       os << "Memory";
if (ExplodedNode *N = C.generateSink()) {
     R->markInteresting(Sym);
     R->addRange(Range);
     R->addVisitor(llvm::make_unique<MallocBugVisitor>(Sym));
     C.emitReport(std::move(R));
   }
 }
 
 void MallocChecker::ReportDoubleFree(CheckerContext &C, SourceRange Range,
-                                     bool Released, SymbolRef Sym, 
+                                     bool Released, SymbolRef Sym,
                                      SymbolRef PrevSym) const {
 
   if (!ChecksEnabled[CK_MallocChecker] &&
       !ChecksEnabled[CK_NewDeleteChecker])
     return;
 
   Optional<MallocChecker::CheckKind> CheckKind = getCheckIfTracked(C, Sym);
   if (!CheckKind.hasValue())
ProgramStateRef MallocChecker::ReallocMem(CheckerContext &C,
   std::tie(StatePtrIsNull, StatePtrNotNull) = State->assume(PtrEQ);
   ProgramStateRef StateSizeIsZero, StateSizeNotZero;
   std::tie(StateSizeIsZero, StateSizeNotZero) = State->assume(SizeZero);
   // We only assume exceptional states if they are definitely true; if the
   // state is under-constrained, assume regular realloc behavior.
   bool PrtIsNull = StatePtrIsNull && !StatePtrNotNull;
   bool SizeIsZero = StateSizeIsZero && !StateSizeNotZero;
 
-  // If the ptr is NULL and the size is not 0, the call is equivalent to 
+  // If the ptr is NULL and the size is not 0, the call is equivalent to
   // malloc(size).
   if ( PrtIsNull && !SizeIsZero) {
     ProgramStateRef stateMalloc = MallocMemAux(C, CE, CE->getArg(1),
                                                UndefinedVal(), StatePtrIsNull);
     return stateMalloc;
   }
 
   if (PrtIsNull && SizeIsZero)
stateRealloc = stateRealloc->set<ReallocPairs>(ToPtr,
                                                    ReallocPair(FromPtr, Kind));
     // The reallocated symbol should stay alive for as long as the new symbol.
     C.getSymbolManager().addSymbolDependency(ToPtr, FromPtr);
     return stateRealloc;
   }
   return nullptr;
 }
 
-ProgramStateRef MallocChecker::CallocMem(CheckerContext &C, const CallExpr *CE, 
+ProgramStateRef MallocChecker::CallocMem(CheckerContext &C, const CallExpr *CE,
                                          ProgramStateRef State) {
   if (!State)
     return nullptr;
 
   if (CE->getNumArgs() < 2)
     return nullptr;
 
   SValBuilder &svalBuilder = C.getSValBuilder();
   const LocationContext *LCtx = C.getLocationContext();
   SVal count = State->getSVal(CE->getArg(0), LCtx);
   SVal elementSize = State->getSVal(CE->getArg(1), LCtx);
   SVal TotalSize = svalBuilder.evalBinOp(State, BO_Mul, count, elementSize,
-                                        svalBuilder.getContext().getSizeType());  
+                                        svalBuilder.getContext().getSizeType());
   SVal zeroVal = svalBuilder.makeZeroVal(svalBuilder.getContext().CharTy);
 
   return MallocMemAux(C, CE, TotalSize, zeroVal, State);
 }
 
 LeakInfo
 MallocChecker::getAllocationSite(const ExplodedNode *N, SymbolRef Sym,
                                  CheckerContext &C) const {
void MallocChecker::reportLeak(SymbolRef Sym, ExplodedNode *N,
 
   // Most bug reports are cached at the location where they occurred.
   // With leaks, we want to unique them by the location where they were
   // allocated, and only report a single path.
   PathDiagnosticLocation LocUsedForUniqueing;
   const ExplodedNode *AllocNode = nullptr;
   const MemRegion *Region = nullptr;
   std::tie(AllocNode, Region) = getAllocationSite(N, Sym, C);
-  
   ProgramPoint P = AllocNode->getLocation();
   const Stmt *AllocationStmt = nullptr;
   if (Optional<CallExitEnd> Exit = P.getAs<CallExitEnd>())
     AllocationStmt = Exit->getCalleeContext()->getCallSite();
   else if (Optional<StmtPoint> SP = P.getAs<StmtPoint>())
     AllocationStmt = SP->getStmt();
   if (AllocationStmt)
     LocUsedForUniqueing = PathDiagnosticLocation::createBegin(AllocationStmt,
for (RegionStateTy::iterator I = RS.begin(), E = RS.end(); I != E; ++I) {
     if (SymReaper.isDead(I->first)) {
       if (I->second.isAllocated() || I->second.isAllocatedOfSizeZero())
         Errors.push_back(I->first);
       // Remove the dead symbol from the map.
       RS = F.remove(RS, I->first);
 
     }
   }
-  
   // Cleanup the Realloc Pairs Map.
   ReallocPairsTy RP = state->get<ReallocPairs>();
   for (ReallocPairsTy::iterator I = RP.begin(), E = RP.end(); I != E; ++I) {
     if (SymReaper.isDead(I->first) ||
         SymReaper.isDead(I->second.ReallocatedSym)) {
       state = state->remove<ReallocPairs>(I->first);
     }
   }
if (const MemRegion *MR = RetVal.getAsRegion())
           Sym = BMR->getSymbol();
 
   // Check if we are returning freed memory.
   if (Sym)
     checkUseAfterFree(Sym, C, E);
 }
 
 // TODO: Blocks should be either inlined or should call invalidate regions
-// upon invocation. After that's in place, special casing here will not be 
+// upon invocation. After that's in place, special casing here will not be
 // needed.
 void MallocChecker::checkPostStmt(const BlockExpr *BE,
                                   CheckerContext &C) const {
 
   // Scan the BlockDecRefExprs for any object the retain count checker
   // may be tracking.
   if (!BE->getBlockDecl()->hasCaptures())
     return;
bool MallocChecker::mayFreeAnyEscapedMemoryOrIsModeledExplicitly(
 
   // White list the system functions whose arguments escape.
   const IdentifierInfo *II = FD->getIdentifier();
   if (!II)
     return true;
   StringRef FName = II->getName();
 
   // White list the 'XXXNoCopy' CoreFoundation functions.
-  // We specifically check these before 
+  // We specifically check these before
   if (FName.endswith("NoCopy")) {
     // Look for the deallocator argument. We know that the memory ownership
     // is not transferred only if the deallocator argument is
     // 'kCFAllocatorNull'.
     for (unsigned i = 1; i < Call->getNumArgs(); ++i) {
       const Expr *ArgE = Call->getArgExpr(i)->IgnoreParenCasts();
       if (const DeclRefExpr *DE = dyn_cast<DeclRefExpr>(ArgE)) {
         StringRef DeallocatorName = DE->getFoundDecl()->getName();
ProgramStateRef MallocChecker::checkPointerEscapeAux(ProgramStateRef State,
 
   for (InvalidatedSymbols::const_iterator I = Escaped.begin(),
        E = Escaped.end();
        I != E; ++I) {
     SymbolRef sym = *I;
 
     if (EscapingSymbol && EscapingSymbol != sym)
       continue;
-    
     if (const RefState *RS = State->get<RegionState>(sym)) {
       if ((RS->isAllocated() || RS->isAllocatedOfSizeZero()) &&
           CheckRefState(RS)) {
         State = State->remove<RegionState>(sym);
         State = State->set<RegionState>(sym, RefState::getEscaped(RS));
       }
     }
   }

 void ento::registerNewDeleteLeaksChecker(CheckerManager &mgr) {
   registerCStringCheckerBasic(mgr);
   MallocChecker *checker = mgr.registerChecker<MallocChecker>();
   checker->IsOptimistic = mgr.getAnalyzerOptions().getBooleanOption(
       "Optimistic", false, checker);
   checker->ChecksEnabled[MallocChecker::CK_NewDeleteLeaksChecker] = true;
   checker->CheckNames[MallocChecker::CK_NewDeleteLeaksChecker] =
       mgr.getCurrentCheckName();
-  // We currently treat NewDeleteLeaks checker as a subchecker of NewDelete 
+  // We currently treat NewDeleteLeaks checker as a subchecker of NewDelete
   // checker.
   if (!checker->ChecksEnabled[MallocChecker::CK_NewDeleteChecker])
     checker->ChecksEnabled[MallocChecker::CK_NewDeleteChecker] = true;
 }
 
 #define REGISTER_CHECKER(name)                                                 \
   void ento::register##name(CheckerManager &mgr) {                             \
     registerCStringCheckerBasic(mgr);                                          \

lib/StaticAnalyzer/Checkers/MallocOverflowSecurityChecker.cpp

 using namespace clang;
 using namespace ento;
 
 namespace {
 struct MallocOverflowCheck {
   const BinaryOperator *mulop;
   const Expr *variable;
 
-  MallocOverflowCheck (const BinaryOperator *m, const Expr *v) 
+  MallocOverflowCheck (const BinaryOperator *m, const Expr *v)
     : mulop(m), variable (v)
   {}
 };
 
 class MallocOverflowSecurityChecker : public Checker<check::ASTCodeBody> {
 public:
   void checkASTCodeBody(const Decl *D, AnalysisManager &mgr,
                         BugReporter &BR) const;

lib/StaticAnalyzer/Checkers/MallocSizeofChecker.cpp

 static bool typesCompatible(ASTContext &C, QualType A, QualType B) {
   // sizeof(void*) is compatible with any other pointer.
   if (B->isVoidPointerType() && A->getAs<PointerType>())
     return true;
 
   while (true) {
     A = A.getCanonicalType();
     B = B.getCanonicalType();
-  
     if (A.getTypePtr() == B.getTypePtr())
       return true;
-    
     if (const PointerType *ptrA = A->getAs<PointerType>())
       if (const PointerType *ptrB = B->getAs<PointerType>()) {
         A = ptrA->getPointeeType();
         B = ptrB->getPointeeType();
         continue;
       }
-      
     break;
   }
-  
   return false;
 }
 
 static bool compatibleWithArrayType(ASTContext &C, QualType PT, QualType T) {
   // Ex: 'int a[10][2]' is compatible with 'int', 'int[2]', 'int[10][2]'.
   while (const ArrayType *AT = T->getAsArrayTypeUnsafe()) {
     QualType ElemType = AT->getElementType();
     if (typesCompatible(C, PT, AT->getElementType()))

lib/StaticAnalyzer/Checkers/NSAutoreleasePoolChecker.cpp

 //=- NSAutoreleasePoolChecker.cpp --------------------------------*- C++ -*-==//
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 //
 //  This file defines a NSAutoreleasePoolChecker, a small checker that warns
 //  about subpar uses of NSAutoreleasePool.  Note that while the check itself
 //  (in its current form) could be written as a flow-insensitive check, in
 //  can be potentially enhanced in the future with flow-sensitive information.
-//  It is also a good example of the CheckerVisitor interface. 
+//  It is also a good example of the CheckerVisitor interface.
 //
 //===----------------------------------------------------------------------===//
 
 #include "ClangSACheckers.h"
 #include "clang/AST/Decl.h"
 #include "clang/AST/DeclObjC.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"

 
 void NSAutoreleasePoolChecker::checkPreObjCMessage(const ObjCMethodCall &msg,
                                                    CheckerContext &C) const {
   if (!msg.isInstanceMessage())
     return;
 
   const ObjCInterfaceDecl *OD = msg.getReceiverInterface();
   if (!OD)
-    return;  
+    return;
   if (!OD->getIdentifier()->isStr("NSAutoreleasePool"))
     return;
 
   if (releaseS.isNull())
     releaseS = GetNullarySelector("release", C.getASTContext());
   // Sending 'release' message?
   if (msg.getSelector() != releaseS)
     return;

lib/StaticAnalyzer/Checkers/NSErrorChecker.cpp

void NSErrorMethodChecker::checkASTDecl(const ObjCMethodDecl *D,
                                         AnalysisManager &mgr,
                                         BugReporter &BR) const {
   if (!D->isThisDeclarationADefinition())
     return;
   if (!D->getReturnType()->isVoidType())
     return;
 
   if (!II)
-    II = &D->getASTContext().Idents.get("NSError"); 
+    II = &D->getASTContext().Idents.get("NSError");
 
   bool hasNSError = false;
   for (const auto *I : D->params())  {
     if (IsNSError(I->getType(), II)) {
       hasNSError = true;
       break;
     }
   }
void CFErrorFunctionChecker::checkASTDecl(const FunctionDecl *D,
                                         AnalysisManager &mgr,
                                         BugReporter &BR) const {
   if (!D->doesThisDeclarationHaveABody())
     return;
   if (!D->getReturnType()->isVoidType())
     return;
 
   if (!II)
-    II = &D->getASTContext().Idents.get("CFErrorRef"); 
+    II = &D->getASTContext().Idents.get("CFErrorRef");
 
   bool hasCFError = false;
   for (auto I : D->params())  {
     if (IsCFError(I->getType(), II)) {
       hasCFError = true;
       break;
     }
   }

lib/StaticAnalyzer/Checkers/ObjCContainersChecker.cpp

if (!Size)
       return;
 
     // Get the index.
     const Expr *IdxExpr = CE->getArg(1);
     SVal IdxVal = State->getSVal(IdxExpr, C.getLocationContext());
     if (IdxVal.isUnknownOrUndef())
       return;
     DefinedSVal Idx = IdxVal.castAs<DefinedSVal>();
-    
     // Now, check if 'Idx in [0, Size-1]'.
     const QualType T = IdxExpr->getType();
     ProgramStateRef StInBound = State->assumeInBound(Idx, *Size, true, T);
     ProgramStateRef StOutBound = State->assumeInBound(Idx, *Size, false, T);
     if (StOutBound && !StInBound) {
       ExplodedNode *N = C.generateSink(StOutBound);
       if (!N)
         return;

lib/StaticAnalyzer/Checkers/ObjCMissingSuperCallChecker.cpp

public:
   explicit FindSuperCallVisitor(Selector S) : DoesCallSuper(false), Sel(S) {}
 
   bool VisitObjCMessageExpr(ObjCMessageExpr *E) {
     if (E->getSelector() == Sel)
       if (E->getReceiverKind() == ObjCMessageExpr::SuperInstance)
         DoesCallSuper = true;
 
     // Recurse if we didn't find the super call yet.
-    return !DoesCallSuper; 
+    return !DoesCallSuper;
   }
 
   bool DoesCallSuper;
 
 private:
   Selector Sel;
 };
 
 //===----------------------------------------------------------------------===//
-// ObjCSuperCallChecker 
+// ObjCSuperCallChecker
 //===----------------------------------------------------------------------===//
 
 class ObjCSuperCallChecker : public Checker<
                                       check::ASTDecl<ObjCImplementationDecl> > {
 public:
   ObjCSuperCallChecker() : IsInitialized(false) {}
 
   void checkASTDecl(const ObjCImplementationDecl *D, AnalysisManager &Mgr,
if (MD->getBody())
           PathDiagnosticLocation::createEnd(MD->getBody(),
                                             BR.getSourceManager(),
                                             Mgr.getAnalysisDeclContext(D));
 
         const char *Name = "Missing call to superclass";
         SmallString<320> Buf;
         llvm::raw_svector_ostream os(Buf);
 
-        os << "The '" << S.getAsString() 
+        os << "The '" << S.getAsString()
            << "' instance method in " << SuperclassName.str() << " subclass '"
            << *D << "' is missing a [super " << S.getAsString() << "] call";
 
         BR.EmitBasicReport(MD, this, Name, categories::CoreFoundationObjectiveC,
                            os.str(), DLoc);
       }
     }
   }

lib/StaticAnalyzer/Checkers/ObjCSelfInitChecker.cpp

static bool isInvalidSelf(const Expr *E, CheckerContext &C) {
 
   return true;
 }
 
 void ObjCSelfInitChecker::checkForInvalidSelf(const Expr *E, CheckerContext &C,
                                               const char *errorStr) const {
   if (!E)
     return;
-  
   if (!C.getState()->get<CalledInit>())
     return;
-  
   if (!isInvalidSelf(E, C))
     return;
-  
   // Generate an error node.
   ExplodedNode *N = C.generateSink();
   if (!N)
     return;
 
   if (!BT)
     BT.reset(new BugType(this, "Missing \"self = [(super or self) init...]\"",
                          categories::CoreFoundationObjectiveC));
void ObjCSelfInitChecker::checkPostObjCMessage(const ObjCMethodCall &Msg,
   // FIXME: A callback should disable checkers at the start of functions.
   if (!shouldRunOnFunctionOrMethod(dyn_cast<NamedDecl>(
                                 C.getCurrentAnalysisDeclContext()->getDecl())))
     return;
 
   if (isInitMessage(Msg)) {
     // Tag the return value as the result of an initializer.
     ProgramStateRef state = C.getState();
-    
     // FIXME this really should be context sensitive, where we record
     // the current stack frame (for IPA).  Also, we need to clean this
     // value out when we return from this method.
     state = state->set<CalledInit>(true);
-    
     SVal V = state->getSVal(Msg.getOriginExpr(), C.getLocationContext());
     addSelfFlag(state, V, SelfFlag_InitRes, C);
     return;
   }
 
   // We don't check for an invalid 'self' in an obj-c message expression to cut
   // down false positives where logging functions get information from self
   // (like its class) or doing "invalidation" on self when the initialization
addSelfFlag(state, state->getSVal(location.castAs<Loc>()), SelfFlag_Self,
                 C);
 }
 
 
 void ObjCSelfInitChecker::checkBind(SVal loc, SVal val, const Stmt *S,
                                     CheckerContext &C) const {
   // Allow assignment of anything to self. Self is a local variable in the
   // initializer, so it is legal to assign anything to it, like results of
-  // static functions/method calls. After self is assigned something we cannot 
+  // static functions/method calls. After self is assigned something we cannot
   // reason about, stop enforcing the rules.
   // (Only continue checking if the assigned value should be treated as self.)
   if ((isSelfVar(loc, C)) &&
       !hasSelfFlag(val, SelfFlag_InitRes, C) &&
       !hasSelfFlag(val, SelfFlag_Self, C) &&
       !isSelfVar(val, C)) {
 
     // Stop tracking the checker-specific state in the state.
static bool shouldRunOnFunctionOrMethod(const NamedDecl *ND) {
   if (!ID)
     return false;
 
   return true;
 }
 
 /// \brief Returns true if the location is 'self'.
 static bool isSelfVar(SVal location, CheckerContext &C) {
-  AnalysisDeclContext *analCtx = C.getCurrentAnalysisDeclContext(); 
+  AnalysisDeclContext *analCtx = C.getCurrentAnalysisDeclContext();
   if (!analCtx->getSelfDecl())
     return false;
   if (!location.getAs<loc::MemRegionVal>())
     return false;
 
   loc::MemRegionVal MRV = location.castAs<loc::MemRegionVal>();
   if (const DeclRegion *DR = dyn_cast<DeclRegion>(MRV.stripCasts()))
     return (DR->getDecl() == analCtx->getSelfDecl());

lib/StaticAnalyzer/Checkers/PointerArithChecker.cpp

 #include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 
 using namespace clang;
 using namespace ento;
 
 namespace {
-class PointerArithChecker 
+class PointerArithChecker
   : public Checker< check::PreStmt<BinaryOperator> > {
   mutable std::unique_ptr<BuiltinBug> BT;
 
 public:
   void checkPreStmt(const BinaryOperator *B, CheckerContext &C) const;
 };
 }
 
void PointerArithChecker::checkPreStmt(const BinaryOperator *B,
 
   const MemRegion *LR = LV.getAsRegion();
 
   if (!LR || !RV.isConstant())
     return;
 
   // If pointer arithmetic is done on variables of non-array type, this often
   // means behavior rely on memory organization, which is dangerous.
-  if (isa<VarRegion>(LR) || isa<CodeTextRegion>(LR) || 
+  if (isa<VarRegion>(LR) || isa<CodeTextRegion>(LR) ||
       isa<CompoundLiteralRegion>(LR)) {
 
     if (ExplodedNode *N = C.addTransition()) {
       if (!BT)
         BT.reset(
             new BuiltinBug(this, "Dangerous pointer arithmetic",
                            "Pointer arithmetic done on non-array variables "
                            "means reliance on memory layout, which is "

lib/StaticAnalyzer/Checkers/PointerSubChecker.cpp

 //=== PointerSubChecker.cpp - Pointer subtraction checker ------*- C++ -*--===//
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 //
 // This files defines PointerSubChecker, a builtin checker that checks for
-// pointer subtractions on two pointers pointing to different memory chunks. 
+// pointer subtractions on two pointers pointing to different memory chunks.
 // This check corresponds to CWE-469.
 //
 //===----------------------------------------------------------------------===//
 
 #include "ClangSACheckers.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
 #include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 
 using namespace clang;
 using namespace ento;
 
 namespace {
-class PointerSubChecker 
+class PointerSubChecker
   : public Checker< check::PreStmt<BinaryOperator> > {
   mutable std::unique_ptr<BuiltinBug> BT;
 
 public:
   void checkPreStmt(const BinaryOperator *B, CheckerContext &C) const;
 };
 }
 

lib/StaticAnalyzer/Checkers/PthreadLockChecker.cpp

class PthreadLockChecker : public Checker< check::PostStmt<CallExpr> > {
   mutable std::unique_ptr<BugType> BT_lor;
   enum LockingSemantics {
     NotApplicable = 0,
     PthreadSemantics,
     XNUSemantics
   };
 public:
   void checkPostStmt(const CallExpr *CE, CheckerContext &C) const;
-    
   void AcquireLock(CheckerContext &C, const CallExpr *CE, SVal lock,
                    bool isTryLock, enum LockingSemantics semantics) const;
-    
   void ReleaseLock(CheckerContext &C, const CallExpr *CE, SVal lock) const;
   void DestroyLock(CheckerContext &C, const CallExpr *CE, SVal Lock) const;
   void InitLock(CheckerContext &C, const CallExpr *CE, SVal Lock) const;
   void reportUseDestroyedBug(CheckerContext &C, const CallExpr *CE) const;
 };
 } // end anonymous namespace
 
 // GDM Entry for tracking lock state.
void PthreadLockChecker::checkPostStmt(const CallExpr *CE,
 
   if (FName == "pthread_mutex_lock" ||
       FName == "pthread_rwlock_rdlock" ||
       FName == "pthread_rwlock_wrlock")
     AcquireLock(C, CE, state->getSVal(CE->getArg(0), LCtx),
                 false, PthreadSemantics);
   else if (FName == "lck_mtx_lock" ||
            FName == "lck_rw_lock_exclusive" ||
-           FName == "lck_rw_lock_shared") 
+           FName == "lck_rw_lock_shared")
     AcquireLock(C, CE, state->getSVal(CE->getArg(0), LCtx),
                 false, XNUSemantics);
   else if (FName == "pthread_mutex_trylock" ||
            FName == "pthread_rwlock_tryrdlock" ||
            FName == "pthread_rwlock_trywrlock")
     AcquireLock(C, CE, state->getSVal(CE->getArg(0), LCtx),
                 true, PthreadSemantics);
   else if (FName == "lck_mtx_try_lock" ||
else if (FName == "pthread_mutex_destroy" ||
     DestroyLock(C, CE, state->getSVal(CE->getArg(0), LCtx));
   else if (FName == "pthread_mutex_init")
     InitLock(C, CE, state->getSVal(CE->getArg(0), LCtx));
 }
 
 void PthreadLockChecker::AcquireLock(CheckerContext &C, const CallExpr *CE,
                                      SVal lock, bool isTryLock,
                                      enum LockingSemantics semantics) const {
-  
   const MemRegion *lockR = lock.getAsRegion();
   if (!lockR)
     return;
-  
   ProgramStateRef state = C.getState();
-  
   SVal X = state->getSVal(CE, C.getLocationContext());
   if (X.isUnknownOrUndef())
     return;
-  
   DefinedSVal retVal = X.castAs<DefinedSVal>();
 
   if (const LockState *LState = state->get<LockMap>(lockR)) {
     if (LState->isLocked()) {
       if (!BT_doublelock)
         BT_doublelock.reset(new BugType(this, "Double locking",
                                         "Lock checker"));
       ExplodedNode *N = C.generateSink();
if (isTryLock) {
     lockSucc = state->assume(retVal, false);
     assert(lockSucc);
 
   } else {
     // XNU locking semantics return void on non-try locks
     assert((semantics == XNUSemantics) && "Unknown locking semantics");
     lockSucc = state;
   }
-  
-  // Record that the lock was acquired.  
+  // Record that the lock was acquired.
   lockSucc = lockSucc->add<LockSet>(lockR);
   lockSucc = lockSucc->set<LockMap>(lockR, LockState::getLocked());
   C.addTransition(lockSucc);
 }
 
 void PthreadLockChecker::ReleaseLock(CheckerContext &C, const CallExpr *CE,
                                      SVal lock) const {
 
   const MemRegion *lockR = lock.getAsRegion();
   if (!lockR)
     return;
-  
   ProgramStateRef state = C.getState();
 
   if (const LockState *LState = state->get<LockMap>(lockR)) {
     if (LState->isUnlocked()) {
       if (!BT_doubleunlock)
         BT_doubleunlock.reset(new BugType(this, "Double unlocking",
                                           "Lock checker"));
       ExplodedNode *N = C.generateSink();

lib/StaticAnalyzer/Checkers/RetainCountChecker.cpp

public:
   bool hasSameState(const RefVal &X) const {
     return getKind() == X.getKind() && Cnt == X.Cnt && ACnt == X.ACnt &&
            getIvarAccessHistory() == X.getIvarAccessHistory();
   }
 
   bool operator==(const RefVal& X) const {
     return T == X.T && hasSameState(X) && getObjKind() == X.getObjKind();
   }
-  
   void Profile(llvm::FoldingSetNodeID& ID) const {
     ID.Add(T);
     ID.AddInteger(RawKind);
     ID.AddInteger(Cnt);
     ID.AddInteger(ACnt);
     ID.AddInteger(RawObjectKind);
     ID.AddInteger(RawIvarAccessHistory);
   }
public:
   }
 
   /// getRetEffect - Returns the effect on the return value of the call.
   RetEffect getRetEffect() const { return Ret; }
 
   /// setRetEffect - Set the effect of the return value of the call.
   void setRetEffect(RetEffect E) { Ret = E; }
 
-  
   /// Sets the effect on the receiver of the message.
   void setReceiverEffect(ArgEffect e) { Receiver = e; }
-  
   /// getReceiverEffect - Returns the effect on the receiver of the call.
   ///  This is only meaningful if the summary applies to an ObjCMessageExpr*.
   ArgEffect getReceiverEffect() const { return Receiver; }
 
   /// Test if two retain summaries are identical. Note that merely equivalent
-  /// summaries are not necessarily identical (for example, if an explicit 
+  /// summaries are not necessarily identical (for example, if an explicit
   /// argument effect matches the default effect).
   bool operator==(const RetainSummary &Other) const {
     return Args == Other.Args && DefaultArgEffect == Other.DefaultArgEffect &&
            Receiver == Other.Receiver && Ret == Other.Ret;
   }
 
   /// Profile this summary for inclusion in a FoldingSet.
   void Profile(llvm::FoldingSetNodeID& ID) const {
class RetainSummaryManager {
   /// BPAlloc - A BumpPtrAllocator used for allocating summaries, ArgEffects,
   ///  and all other data used by the checker.
   llvm::BumpPtrAllocator BPAlloc;
 
   /// AF - A factory for ArgEffects objects.
   ArgEffects::Factory AF;
 
   /// ScratchArgs - A holding buffer for construct ArgEffects.
-  ArgEffects ScratchArgs; 
+  ArgEffects ScratchArgs;
 
   /// ObjCAllocRetE - Default return effect for methods returning Objective-C
   ///  objects.
   RetEffect ObjCAllocRetE;
 
   /// ObjCInitRetE - Default return effect for init methods returning
   ///   Objective-C objects.
   RetEffect ObjCInitRetE;
 
   /// SimpleSummaries - Used for uniquing summaries that don't have special
   /// effects.
   llvm::FoldingSet<CachedSummaryNode> SimpleSummaries;
 
   //==-----------------------------------------------------------------==//
   //  Methods.
   //==-----------------------------------------------------------------==//
 
   /// getArgEffects - Returns a persistent ArgEffects object based on the
   ///  data in ScratchArgs.
   ArgEffects getArgEffects();
 
   enum UnaryFuncKind { cfretain, cfrelease, cfautorelease, cfmakecollectable };
-  
   const RetainSummary *getUnarySummary(const FunctionType* FT,
                                        UnaryFuncKind func);
 
   const RetainSummary *getCFSummaryCreateRule(const FunctionDecl *FD);
   const RetainSummary *getCFSummaryGetRule(const FunctionDecl *FD);
   const RetainSummary *getCFCreateGetRuleSummary(const FunctionDecl *FD);
 
   const RetainSummary *getPersistentSummary(const RetainSummary &OldSumm);
 
   const RetainSummary *getPersistentSummary(RetEffect RetEff,
                                             ArgEffect ReceiverEff = DoNothing,
                                             ArgEffect DefaultEff = MayEscape) {
     RetainSummary Summ(getArgEffects(), RetEff, DefaultEff, ReceiverEff);
     return getPersistentSummary(Summ);
   }
 
   const RetainSummary *getDoNothingSummary() {
     return getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
   }
-  
   const RetainSummary *getDefaultSummary() {
     return getPersistentSummary(RetEffect::MakeNoRet(),
                                 DoNothing, MayEscape);
   }
 
   const RetainSummary *getPersistentStopSummary() {
     return getPersistentSummary(RetEffect::MakeNoRet(),
                                 StopTracking, StopTracking);
   }
 
   void InitializeClassMethodSummaries();
   void InitializeMethodSummaries();
 private:
   void addNSObjectClsMethSummary(Selector S, const RetainSummary *Summ) {
     ObjCClassMethodSummaries[S] = Summ;
   }
 
   void addNSObjectMethSummary(Selector S, const RetainSummary *Summ) {
     ObjCMethodSummaries[S] = Summ;
   }
 
   void addClassMethSummary(const char* Cls, const char* name,
                            const RetainSummary *Summ, bool isNullary = true) {
     IdentifierInfo* ClsII = &Ctx.Idents.get(Cls);
-    Selector S = isNullary ? GetNullarySelector(name, Ctx) 
+    Selector S = isNullary ? GetNullarySelector(name, Ctx)
                            : GetUnarySelector(name, Ctx);
     ObjCClassMethodSummaries[ObjCSummaryKey(ClsII, S)]  = Summ;
   }
 
   void addInstMethSummary(const char* Cls, const char* nullaryName,
                           const RetainSummary *Summ) {
     IdentifierInfo* ClsII = &Ctx.Idents.get(Cls);
     Selector S = GetNullarySelector(nullaryName, Ctx);
public:
    : Ctx(ctx),
      GCEnabled(gcenabled),
      ARCEnabled(usesARC),
      AF(BPAlloc), ScratchArgs(AF.getEmptyMap()),
      ObjCAllocRetE(gcenabled
                     ? RetEffect::MakeGCNotOwned()
                     : (usesARC ? RetEffect::MakeNotOwned(RetEffect::ObjC)
                                : RetEffect::MakeOwned(RetEffect::ObjC, true))),
-     ObjCInitRetE(gcenabled 
+     ObjCInitRetE(gcenabled
                     ? RetEffect::MakeGCNotOwned()
                     : (usesARC ? RetEffect::MakeNotOwned(RetEffect::ObjC)
                                : RetEffect::MakeOwnedWhenTrackedReceiver())) {
     InitializeClassMethodSummaries();
     InitializeMethodSummaries();
   }
 
   const RetainSummary *getSummary(const CallEvent &Call,
void updateSummaryFromAnnotations(const RetainSummary *&Summ,
                                     const FunctionDecl *FD);
 
   void updateSummaryForCall(const RetainSummary *&Summ,
                             const CallEvent &Call);
 
   bool isGCEnabled() const { return GCEnabled; }
 
   bool isARCEnabled() const { return ARCEnabled; }
-  
   bool isARCorGCEnabled() const { return GCEnabled || ARCEnabled; }
 
   RetEffect getObjAllocRetEffect() const { return ObjCAllocRetE; }
 
   friend class RetainSummaryTemplate;
 };
 
 // Used to avoid allocating long-term (BPAlloc'd) memory for default retain
void RetainSummaryManager::updateSummaryForCall(const RetainSummary *&S,
 
   // Special case '[super init];' and '[self init];'
   //
   // Even though calling '[super init]' without assigning the result to self
   // and checking if the parent returns 'nil' is a bad pattern, it is common.
   // Additionally, our Self Init checker already warns about it. To avoid
   // overwhelming the user with messages from both checkers, we model the case
   // of '[super init]' in cases when it is not consumed by another expression
-  // as if the call preserves the value of 'self'; essentially, assuming it can 
+  // as if the call preserves the value of 'self'; essentially, assuming it can
   // never fail and return 'nil'.
   // Note, we don't want to just stop tracking the value since we want the
   // RetainCount checker to report leaks and use-after-free if SelfInit checker
   // is turned off.
   if (const ObjCMethodCall *MC = dyn_cast<ObjCMethodCall>(&Call)) {
     if (MC->getMethodFamily() == OMF_init && MC->isReceiverSelfOrSuper()) {
 
       // Check if the message is not consumed, we know it will not be used in
if (FName == "pthread_create" || FName == "pthread_setspecific") {
       ScratchArgs = AF.add(ScratchArgs, 2, StopTracking);
       S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
     }
 
     // Did we get a summary?
     if (S)
       break;
 
-    if (RetTy->isPointerType()) {      
+    if (RetTy->isPointerType()) {
       // For CoreFoundation ('CF') types.
       if (cocoa::isRefType(RetTy, "CF", FName)) {
         if (isRetain(FD, FName)) {
           S = getUnarySummary(FT, cfretain);
         } else if (isAutorelease(FD, FName)) {
           S = getUnarySummary(FT, cfautorelease);
           // The headers use cf_consumed, but we can fully model CFAutorelease
           // ourselves.
RetainSummaryManager::getUnarySummary(const FunctionType* FT,
   case cfautorelease: Effect = Autorelease; break;
   case cfmakecollectable: Effect = MakeCollectable; break;
   }
 
   ScratchArgs = AF.add(ScratchArgs, 0, Effect);
   return getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
 }
 
-const RetainSummary * 
+const RetainSummary *
 RetainSummaryManager::getCFSummaryCreateRule(const FunctionDecl *FD) {
   assert (ScratchArgs.isEmpty());
 
   return getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF, true));
 }
 
-const RetainSummary * 
+const RetainSummary *
 RetainSummaryManager::getCFSummaryGetRule(const FunctionDecl *FD) {
   assert (ScratchArgs.isEmpty());
   return getPersistentSummary(RetEffect::MakeNotOwned(RetEffect::CF),
                               DoNothing, DoNothing);
 }
 
 //===----------------------------------------------------------------------===//
 // Summary creation for Selectors.
RetainSummaryManager::updateSummaryFromAnnotations(const RetainSummary *&Summ,
   if (!FD)
     return;
 
   assert(Summ && "Must have a summary to add annotations to.");
   RetainSummaryTemplate Template(Summ, *this);
 
   // Effects on the parameters.
   unsigned parm_idx = 0;
-  for (FunctionDecl::param_const_iterator pi = FD->param_begin(), 
+  for (FunctionDecl::param_const_iterator pi = FD->param_begin(),
          pe = FD->param_end(); pi != pe; ++pi, ++parm_idx) {
     const ParmVarDecl *pd = *pi;
     if (pd->hasAttr<NSConsumedAttr>())
       Template->addArg(AF, parm_idx, DecRefMsg);
     else if (pd->hasAttr<CFConsumedAttr>())
       Template->addArg(AF, parm_idx, DecRef);
     else if (pd->hasAttr<CFReturnsRetainedAttr>()) {
       QualType PointeeTy = pd->getType()->getPointeeType();
RetainSummaryManager::updateSummaryFromAnnotations(const RetainSummary *&Summ,
   if (!MD)
     return;
 
   assert(Summ && "Must have a valid summary to add annotations to");
   RetainSummaryTemplate Template(Summ, *this);
 
   // Effects on the receiver.
   if (MD->hasAttr<NSConsumesSelfAttr>())
-    Template->setReceiverEffect(DecRefMsg);      
-  
+    Template->setReceiverEffect(DecRefMsg);
   // Effects on the parameters.
   unsigned parm_idx = 0;
   for (ObjCMethodDecl::param_const_iterator
          pi=MD->param_begin(), pe=MD->param_end();
        pi != pe; ++pi, ++parm_idx) {
     const ParmVarDecl *pd = *pi;
     if (pd->hasAttr<NSConsumedAttr>())
-      Template->addArg(AF, parm_idx, DecRefMsg);      
+      Template->addArg(AF, parm_idx, DecRefMsg);
     else if (pd->hasAttr<CFConsumedAttr>()) {
-      Template->addArg(AF, parm_idx, DecRef);      
+      Template->addArg(AF, parm_idx, DecRef);
     } else if (pd->hasAttr<CFReturnsRetainedAttr>()) {
       QualType PointeeTy = pd->getType()->getPointeeType();
       if (!PointeeTy.isNull())
         if (coreFoundation::isCFObjectRef(PointeeTy))
           Template->addArg(AF, parm_idx, RetainedOutParameter);
     } else if (pd->hasAttr<CFReturnsNotRetainedAttr>()) {
       QualType PointeeTy = pd->getType()->getPointeeType();
       if (!PointeeTy.isNull())
switch (MD ? MD->getMethodFamily() : S.getMethodFamily()) {
     case OMF_initialize:
     case OMF_performSelector:
       // Assume all Objective-C methods follow Cocoa Memory Management rules.
       // FIXME: Does the non-threaded performSelector family really belong here?
       // The selector could be, say, @selector(copy).
       if (cocoa::isCocoaObjectRef(RetTy))
         ResultEff = RetEffect::MakeNotOwned(RetEffect::ObjC);
       else if (coreFoundation::isCFObjectRef(RetTy)) {
-        // ObjCMethodDecl currently doesn't consider CF objects as valid return 
+        // ObjCMethodDecl currently doesn't consider CF objects as valid return
         // values for alloc, new, copy, or mutableCopy, so we have to
         // double-check with the selector. This is ugly, but there aren't that
         // many Objective-C methods that return CF objects, right?
         if (MD) {
           switch (S.getMethodFamily()) {
           case OMF_alloc:
           case OMF_new:
           case OMF_copy:
           case OMF_mutableCopy:
             ResultEff = RetEffect::MakeOwned(RetEffect::CF, true);
             break;
           default:
-            ResultEff = RetEffect::MakeNotOwned(RetEffect::CF);        
+            ResultEff = RetEffect::MakeNotOwned(RetEffect::CF);
             break;
           }
         } else {
-          ResultEff = RetEffect::MakeNotOwned(RetEffect::CF);        
+          ResultEff = RetEffect::MakeNotOwned(RetEffect::CF);
         }
       }
       break;
     case OMF_init:
       ResultEff = ObjCInitRetE;
       ReceiverEff = DecRefMsg;
       break;
     case OMF_alloc:
namespace {
   // Bug Reports.  //
   //===---------===//
 
   class CFRefReportVisitor : public BugReporterVisitorImpl<CFRefReportVisitor> {
   protected:
     SymbolRef Sym;
     const SummaryLogTy &SummaryLog;
     bool GCEnabled;
-    
   public:
     CFRefReportVisitor(SymbolRef sym, bool gcEnabled, const SummaryLogTy &log)
        : Sym(sym), SummaryLog(log), GCEnabled(gcEnabled) {}
 
     void Profile(llvm::FoldingSetNodeID &ID) const override {
       static int x = 0;
       ID.AddPointer(&x);
       ID.AddPointer(Sym);
void CFRefReport::addGCModeDescription(const LangOptions &LOpts,
   }
 
   assert(GCModeDescription && "invalid/unknown GC mode");
   addExtraText(GCModeDescription);
 }
 
 static bool isNumericLiteralExpression(const Expr *E) {
   // FIXME: This set of cases was copied from SemaExprObjC.
-  return isa<IntegerLiteral>(E) || 
+  return isa<IntegerLiteral>(E) ||
          isa<CharacterLiteral>(E) ||
          isa<FloatingLiteral>(E) ||
          isa<ObjCBoolLiteralExpr>(E) ||
          isa<CXXBoolLiteralExpr>(E);
 }
 
 /// Returns true if this stack frame is for an Objective-C method that is a
 /// property getter or setter whose body has been synthesized by the analyzer.
else if (const ObjCBoxedExpr *BL = dyn_cast<ObjCBoxedExpr>(S)) {
           os << "B";
 
         os << "oxed expression produces an object with a +0 retain count";
       }
     }
     else if (isa<ObjCIvarRefExpr>(S)) {
       os << "Object loaded from instance variable";
     }
-    else {      
+    else {
       if (const CallExpr *CE = dyn_cast<CallExpr>(S)) {
         // Get the name of the callee (if it is available).
         SVal X = CurrSt->getSValAsScalarOrLoc(CE->getCallee(), LCtx);
         if (const FunctionDecl *FD = X.getAsFunctionDecl())
           os << "Call to function '" << *FD << '\'';
         else
           os << "function call";
       }
while (N) {
     ProgramStateRef St = N->getState();
     const LocationContext *NContext = N->getLocationContext();
 
     if (!getRefBinding(St, Sym))
       break;
 
     StoreManager::FindUniqueBinding FB(Sym);
     StateMgr.iterBindings(St, FB);
-    
     if (FB) {
       const MemRegion *R = FB.getRegion();
       const VarRegion *VR = R->getBaseRegion()->getAs<VarRegion>();
       // Do not show local variables belonging to a function other than
       // where the error is reported.
       if (!VR || VR->getStackFrame() == LeakContext->getCurrentStackFrame())
         FirstBinding = R;
     }
CFRefLeakReportVisitor::getEndPath(BugReporterContext &BRC,
   const RefVal* RV = getRefBinding(EndN->getState(), Sym);
   assert(RV);
 
   if (RV->getKind() == RefVal::ErrorLeakReturned) {
     // FIXME: Per comments in rdar://6320065, "create" only applies to CF
     // objects.  Only "copy", "alloc", "retain" and "new" transfer ownership
     // to the caller for NS objects.
     const Decl *D = &EndN->getCodeDecl();
-    
     os << (isa<ObjCMethodDecl>(D) ? " is returned from a method "
                                   : " is returned from a function ");
-    
     if (D->hasAttr<CFReturnsNotRetainedAttr>())
       os << "that is annotated as CF_RETURNS_NOT_RETAINED";
     else if (D->hasAttr<NSReturnsNotRetainedAttr>())
       os << "that is annotated as NS_RETURNS_NOT_RETAINED";
     else {
       if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(D)) {
         os << "whose name ('" << MD->getSelector().getAsString()
            << "') does not start with 'copy', 'mutableCopy', 'alloc' or 'new'."
CFRefLeakReportVisitor::getEndPath(BugReporterContext &BRC,
   else
     os << " is not referenced later in this execution path and has a retain "
           "count of +" << RV->getCount();
 
   return llvm::make_unique<PathDiagnosticEventPiece>(L, os.str());
 }
 
 CFRefLeakReport::CFRefLeakReport(CFRefBug &D, const LangOptions &LOpts,
-                                 bool GCEnabled, const SummaryLogTy &Log, 
+                                 bool GCEnabled, const SummaryLogTy &Log,
                                  ExplodedNode *n, SymbolRef sym,
                                  CheckerContext &Ctx,
                                  bool IncludeAllocationLine)
   : CFRefReport(D, LOpts, GCEnabled, Log, n, sym, false) {
 
   // Most bug reports are cached at the location where they occurred.
   // With leaks, we want to unique them by the location where they were
   // allocated, and only report a single path.  To do this, we need to find
class RetainCountChecker
   mutable std::unique_ptr<RetainSummaryManager> SummariesGC;
   mutable SummaryLogTy SummaryLog;
   mutable bool ShouldResetSummaryLog;
 
   /// Optional setting to indicate if leak reports should include
   /// the allocation line.
   mutable bool IncludeAllocationLine;
 
-public:  
+public:
   RetainCountChecker(AnalyzerOptions &AO)
     : ShouldResetSummaryLog(false),
       IncludeAllocationLine(shouldIncludeAllocationSiteInLeakDiagnostics(AO)) {}
 
   ~RetainCountChecker() override { DeleteContainerSeconds(DeadSymbolTags); }
 
   void checkEndAnalysis(ExplodedGraph &G, BugReporter &BR,
                         ExprEngine &Eng) const {
public:
 
   void checkPostStmt(const ObjCArrayLiteral *AL, CheckerContext &C) const;
   void checkPostStmt(const ObjCDictionaryLiteral *DL, CheckerContext &C) const;
   void checkPostStmt(const ObjCBoxedExpr *BE, CheckerContext &C) const;
 
   void checkPostStmt(const ObjCIvarRefExpr *IRE, CheckerContext &C) const;
 
   void checkPostCall(const CallEvent &Call, CheckerContext &C) const;
-                      
   void checkSummary(const RetainSummary &Summ, const CallEvent &Call,
                     CheckerContext &C) const;
 
   void processSummaryOfInlined(const RetainSummary &Summ,
                                const CallEvent &Call,
                                CheckerContext &C) const;
 
   bool evalCall(const CallExpr *CE, CheckerContext &C) const;
 
   ProgramStateRef evalAssume(ProgramStateRef state, SVal Cond,
                                  bool Assumption) const;
 
-  ProgramStateRef 
+  ProgramStateRef
   checkRegionChanges(ProgramStateRef state,
                      const InvalidatedSymbols *invalidated,
                      ArrayRef<const MemRegion *> ExplicitRegions,
                      ArrayRef<const MemRegion *> Regions,
                      const CallEvent *Call) const;
-                                        
   bool wantsRegionChangeUpdate(ProgramStateRef state) const {
     return true;
   }
 
   void checkPreStmt(const ReturnStmt *S, CheckerContext &C) const;
   void checkReturnWithRetEffect(const ReturnStmt *S, CheckerContext &C,
                                 ExplodedNode *Pred, RetEffect RE, RefVal X,
                                 SymbolRef Sym, ProgramStateRef state) const;
-                                              
   void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const;
   void checkEndFunction(CheckerContext &C) const;
 
   ProgramStateRef updateSymbol(ProgramStateRef state, SymbolRef sym,
                                RefVal V, ArgEffect E, RefVal::Kind &hasErr,
                                CheckerContext &C) const;
 
   void processNonLeakError(ProgramStateRef St, SourceRange ErrorRange,
                            RefVal::Kind ErrorKind, SymbolRef Sym,
                            CheckerContext &C) const;
-                      
   void processObjCLiterals(CheckerContext &C, const Expr *Ex) const;
 
   const ProgramPointTag *getDeadSymbolTag(SymbolRef sym) const;
 
   ProgramStateRef handleSymbolDeath(ProgramStateRef state,
                                     SymbolRef sid, RefVal V,
                                     SmallVectorImpl<SymbolRef> &Leaked) const;
 
void RetainCountChecker::checkPostStmt(const BlockExpr *BE,
   C.addTransition(state);
 }
 
 void RetainCountChecker::checkPostStmt(const CastExpr *CE,
                                        CheckerContext &C) const {
   const ObjCBridgedCastExpr *BE = dyn_cast<ObjCBridgedCastExpr>(CE);
   if (!BE)
     return;
-  
   ArgEffect AE = IncRef;
-  
   switch (BE->getBridgeKind()) {
     case clang::OBC_Bridge:
       // Do nothing.
       return;
     case clang::OBC_BridgeRetained:
       AE = IncRef;
-      break;      
+      break;
     case clang::OBC_BridgeTransfer:
       AE = DecRefBridgedTransferred;
       break;
   }
-  
   ProgramStateRef state = C.getState();
   SymbolRef Sym = state->getSVal(CE, C.getLocationContext()).getAsLocSymbol();
   if (!Sym)
     return;
   const RefVal* T = getRefBinding(state, Sym);
   if (!T)
     return;
 
   RefVal::Kind hasErr = (RefVal::Kind) 0;
   state = updateSymbol(state, Sym, *T, AE, hasErr, C);
-  
   if (hasErr) {
     // FIXME: If we get an error during a bridge cast, should we report it?
     return;
   }
 
   C.addTransition(state);
 }
 
 void RetainCountChecker::processObjCLiterals(CheckerContext &C,
                                              const Expr *Ex) const {
   ProgramStateRef state = C.getState();
-  const ExplodedNode *pred = C.getPredecessor();  
+  const ExplodedNode *pred = C.getPredecessor();
   for (const Stmt *Child : Ex->children()) {
     SVal V = state->getSVal(Child, pred->getLocationContext());
     if (SymbolRef sym = V.getAsSymbol())
       if (const RefVal* T = getRefBinding(state, sym)) {
         RefVal::Kind hasErr = (RefVal::Kind) 0;
         state = updateSymbol(state, sym, *T, MayEscape, hasErr, C);
         if (hasErr) {
           processNonLeakError(state, Child->getSourceRange(), hasErr, sym, C);
           return;
         }
       }
   }
-  
   // Return the object as autoreleased.
   //  RetEffect RE = RetEffect::MakeNotOwned(RetEffect::ObjC);
-  if (SymbolRef sym = 
+  if (SymbolRef sym =
         state->getSVal(Ex, pred->getLocationContext()).getAsSymbol()) {
     QualType ResultTy = Ex->getType();
     state = setRefBinding(state, sym,
                           RefVal::makeNotOwned(RetEffect::ObjC, ResultTy));
   }
-  
-  C.addTransition(state);  
+  C.addTransition(state);
 }
 
 void RetainCountChecker::checkPostStmt(const ObjCArrayLiteral *AL,
                                        CheckerContext &C) const {
   // Apply the 'MayEscape' to all values.
   processObjCLiterals(C, AL);
 }
 
 void RetainCountChecker::checkPostStmt(const ObjCDictionaryLiteral *DL,
                                        CheckerContext &C) const {
   // Apply the 'MayEscape' to all keys and values.
   processObjCLiterals(C, DL);
 }
 
 void RetainCountChecker::checkPostStmt(const ObjCBoxedExpr *Ex,
                                        CheckerContext &C) const {
-  const ExplodedNode *Pred = C.getPredecessor();  
+  const ExplodedNode *Pred = C.getPredecessor();
   const LocationContext *LCtx = Pred->getLocationContext();
   ProgramStateRef State = Pred->getState();
 
   if (SymbolRef Sym = State->getSVal(Ex, LCtx).getAsSymbol()) {
     QualType ResultTy = Ex->getType();
     State = setRefBinding(State, Sym,
                           RefVal::makeNotOwned(RetEffect::ObjC, ResultTy));
   }
void RetainCountChecker::processSummaryOfInlined(const RetainSummary &Summ,
 
   // Consult the summary for the return value.
   RetEffect RE = Summ.getRetEffect();
   if (RE.getKind() == RetEffect::NoRetHard) {
     SymbolRef Sym = CallOrMsg.getReturnValue().getAsSymbol();
     if (Sym)
       state = removeRefBinding(state, Sym);
   }
-  
   C.addTransition(state);
 }
 
 static ProgramStateRef updateOutParameter(ProgramStateRef State,
                                           SVal ArgVal,
                                           ArgEffect Effect) {
   auto *ArgRegion = dyn_cast_or_null<TypedValueRegion>(ArgVal.getAsRegion());
   if (!ArgRegion)
if (hasErr) {
     return;
   }
 
   // Consult the summary for the return value.
   RetEffect RE = Summ.getRetEffect();
 
   if (RE.getKind() == RetEffect::OwnedWhenTrackedReceiver) {
     if (ReceiverIsTracked)
-      RE = getSummaryManager(C).getObjAllocRetEffect();      
+      RE = getSummaryManager(C).getObjAllocRetEffect();
     else
       RE = RetEffect::MakeNoRet();
   }
 
   switch (RE.getKind()) {
     default:
       llvm_unreachable("Unhandled RetEffect.");
 
if (ShouldResetSummaryLog) {
       SummaryLog.clear();
       ShouldResetSummaryLog = false;
     }
     SummaryLog[NewNode] = &Summ;
   }
 }
 
 
-ProgramStateRef 
+ProgramStateRef
 RetainCountChecker::updateSymbol(ProgramStateRef state, SymbolRef sym,
                                  RefVal V, ArgEffect E, RefVal::Kind &hasErr,
                                  CheckerContext &C) const {
   // In GC mode [... release] and [... retain] do nothing.
   // In ARC mode they shouldn't exist at all, but we just ignore them.
   bool IgnoreRetainMsg = C.isObjCGCEnabled();
   if (!IgnoreRetainMsg)
     IgnoreRetainMsg = (bool)C.getASTContext().getLangOpts().ObjCAutoRefCount;
if (ResultTy->isObjCIdType()) {
     //         CFMakeCollectable
     // It's okay to be a little sloppy here (CGMakeCollectable doesn't exist).
     if (cocoa::isRefType(ResultTy, "CF", FName) ||
         cocoa::isRefType(ResultTy, "CG", FName)) {
       canEval = isRetain(FD, FName) || isAutorelease(FD, FName) ||
                 isMakeCollectable(FD, FName);
     }
   }
-        
   if (!canEval)
     return false;
 
   // Bind the return value.
   const LocationContext *LCtx = C.getLocationContext();
   SVal RetVal = state->getSVal(CE->getArg(0), LCtx);
   if (RetVal.isUnknown()) {
     // If the receiver is unknown, conjure a return value.
ProgramStateRef RetainCountChecker::evalAssume(ProgramStateRef state,
   }
 
   if (changed)
     state = state->set<RefBindings>(B);
 
   return state;
 }
 
-ProgramStateRef 
+ProgramStateRef
 RetainCountChecker::checkRegionChanges(ProgramStateRef state,
                                     const InvalidatedSymbols *invalidated,
                                     ArrayRef<const MemRegion *> ExplicitRegions,
                                     ArrayRef<const MemRegion *> Regions,
                                     const CallEvent *Call) const {
   if (!invalidated)
     return state;
 
if (N) {
     Ctx.emitReport(std::unique_ptr<BugReport>(
         new CFRefReport(*overAutorelease, LOpts, /* GCEnabled = */ false,
                         SummaryLog, N, Sym, os.str())));
   }
 
   return nullptr;
 }
 
-ProgramStateRef 
+ProgramStateRef
 RetainCountChecker::handleSymbolDeath(ProgramStateRef state,
                                       SymbolRef sid, RefVal V,
                                     SmallVectorImpl<SymbolRef> &Leaked) const {
   bool hasLeak;
 
   // HACK: Ignore retain-count issues on values accessed through ivars,
   // because of cases like this:
   //   [_contentView retain];
void RetainCountChecker::checkEndFunction(CheckerContext &Ctx) const {
   }
 
   // If the current LocationContext has a parent, don't check for leaks.
   // We will do that later.
   // FIXME: we should instead check for imbalances of the retain/releases,
   // and suggest annotations.
   if (LCtx->getParent())
     return;
-  
   B = state->get<RefBindings>();
   SmallVector<SymbolRef, 10> Leaked;
 
   for (RefBindingsTy::iterator I = B.begin(), E = B.end(); I != E; ++I)
     state = handleSymbolDeath(state, I->first, I->second, Leaked);
 
   processLeaks(state, Leaked, Ctx, Pred);
 }
 
 const ProgramPointTag *
 RetainCountChecker::getDeadSymbolTag(SymbolRef sym) const {
   const CheckerProgramPointTag *&tag = DeadSymbolTags[sym];
   if (!tag) {
     SmallString<64> buf;
     llvm::raw_svector_ostream out(buf);
     out << "Dead Symbol : ";
     sym->dumpToStream(out);
     tag = new CheckerProgramPointTag(this, out.str());
   }
-  return tag;  
+  return tag;
 }
 
 void RetainCountChecker::checkDeadSymbols(SymbolReaper &SymReaper,
                                           CheckerContext &C) const {
   ExplodedNode *Pred = C.getPredecessor();
 
   ProgramStateRef state = C.getState();
   RefBindingsTy B = state->get<RefBindings>();

lib/StaticAnalyzer/Checkers/ReturnPointerRangeChecker.cpp

 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
 
 using namespace clang;
 using namespace ento;
 
 namespace {
-class ReturnPointerRangeChecker : 
+class ReturnPointerRangeChecker :
     public Checker< check::PreStmt<ReturnStmt> > {
   mutable std::unique_ptr<BuiltinBug> BT;
 
 public:
     void checkPreStmt(const ReturnStmt *RS, CheckerContext &C) const;
 };
 }
 
 void ReturnPointerRangeChecker::checkPreStmt(const ReturnStmt *RS,
                                              CheckerContext &C) const {
   ProgramStateRef state = C.getState();
 
   const Expr *RetE = RS->getRetValue();
   if (!RetE)
     return;
- 
   SVal V = state->getSVal(RetE, C.getLocationContext());
   const MemRegion *R = V.getAsRegion();
 
   const ElementRegion *ER = dyn_cast_or_null<ElementRegion>(R);
   if (!ER)
     return;
 
   DefinedOrUnknownSVal Idx = ER->getIndex().castAs<DefinedOrUnknownSVal>();
void ReturnPointerRangeChecker::checkPreStmt(const ReturnStmt *RS,
 
   ProgramStateRef StInBound = state->assumeInBound(Idx, NumElements, true);
   ProgramStateRef StOutBound = state->assumeInBound(Idx, NumElements, false);
   if (StOutBound && !StInBound) {
     ExplodedNode *N = C.generateSink(StOutBound);
 
     if (!N)
       return;
-  
     // FIXME: This bug correspond to CWE-466.  Eventually we should have bug
     // types explicitly reference such exploit categories (when applicable).
     if (!BT)
       BT.reset(new BuiltinBug(
           this, "Return of pointer value outside of expected range",
           "Returned pointer value points outside the original object "
           "(potential buffer overflow)"));
 

lib/StaticAnalyzer/Checkers/StackAddrEscapeChecker.cpp

 //=== StackAddrEscapeChecker.cpp ----------------------------------*- C++ -*--//
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 //
-// This file defines stack address leak checker, which checks if an invalid 
+// This file defines stack address leak checker, which checks if an invalid
 // stack address is stored into a global or heap location. See CERT DCL30-C.
 //
 //===----------------------------------------------------------------------===//
 
 #include "ClangSACheckers.h"
 #include "clang/AST/ExprCXX.h"
 #include "clang/Basic/SourceManager.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"

 
 SourceRange StackAddrEscapeChecker::genName(raw_ostream &os, const MemRegion *R,
                                             ASTContext &Ctx) {
     // Get the base region, stripping away fields and elements.
   R = R->getBaseRegion();
   SourceManager &SM = Ctx.getSourceManager();
   SourceRange range;
   os << "Address of ";
-  
   // Check if the region is a compound literal.
-  if (const CompoundLiteralRegion* CR = dyn_cast<CompoundLiteralRegion>(R)) { 
+  if (const CompoundLiteralRegion* CR = dyn_cast<CompoundLiteralRegion>(R)) {
     const CompoundLiteralExpr *CL = CR->getLiteralExpr();
     os << "stack memory associated with a compound literal "
           "declared on line "
         << SM.getExpansionLineNumber(CL->getLocStart())
-        << " returned to caller";    
+        << " returned to caller";
     range = CL->getSourceRange();
   }
   else if (const AllocaRegion* AR = dyn_cast<AllocaRegion>(R)) {
     const Expr *ARE = AR->getExpr();
     SourceLocation L = ARE->getLocStart();
-    range = ARE->getSourceRange();    
+    range = ARE->getSourceRange();
     os << "stack memory allocated by call to alloca() on line "
        << SM.getExpansionLineNumber(L);
   }
   else if (const BlockDataRegion *BR = dyn_cast<BlockDataRegion>(R)) {
     const BlockDecl *BD = BR->getCodeRegion()->getDecl();
     SourceLocation L = BD->getLocStart();
     range = BD->getSourceRange();
     os << "stack-allocated block declared on line "
        << SM.getExpansionLineNumber(L);
   }
   else if (const VarRegion *VR = dyn_cast<VarRegion>(R)) {
     os << "stack memory associated with local variable '"
        << VR->getString() << '\'';
     range = VR->getDecl()->getSourceRange();
   }
   else if (const CXXTempObjectRegion *TOR = dyn_cast<CXXTempObjectRegion>(R)) {
     QualType Ty = TOR->getValueType().getLocalUnqualifiedType();
     os << "stack memory associated with temporary object of type '";
     Ty.print(os, Ctx.getPrintingPolicy());
     os << "'";
     range = TOR->getExpr()->getSourceRange();
   }
   else {
     llvm_unreachable("Invalid region in ReturnStackAddressChecker.");
-  } 
-  
+  }
   return range;
 }
 
 void StackAddrEscapeChecker::EmitStackError(CheckerContext &C, const MemRegion *R,
                                           const Expr *RetE) const {
   ExplodedNode *N = C.generateSink();
 
   if (!N)
void StackAddrEscapeChecker::EmitStackError(CheckerContext &C, const MemRegion *R,
   if (range.isValid())
     report->addRange(range);
 
   C.emitReport(std::move(report));
 }
 
 void StackAddrEscapeChecker::checkPreStmt(const ReturnStmt *RS,
                                           CheckerContext &C) const {
-  
   const Expr *RetE = RS->getRetValue();
   if (!RetE)
     return;
   RetE = RetE->IgnoreParens();
 
   const LocationContext *LCtx = C.getLocationContext();
   SVal V = C.getState()->getSVal(RetE, LCtx);
   const MemRegion *R = V.getAsRegion();
 
   if (!R)
     return;
-  
   const StackSpaceRegion *SS =
     dyn_cast_or_null<StackSpaceRegion>(R->getMemorySpace());
-    
   if (!SS)
     return;
 
   // Return stack memory in an ancestor stack frame is fine.
   const StackFrameContext *CurFrame = LCtx->getCurrentStackFrame();
   const StackFrameContext *MemFrame = SS->getStackFrame();
   if (MemFrame != CurFrame)
     return;
private:
     const StackFrameContext *CurSFC;
   public:
     SmallVector<std::pair<const MemRegion*, const MemRegion*>, 10> V;
 
     CallBack(CheckerContext &CC) :
       Ctx(CC),
       CurSFC(CC.getLocationContext()->getCurrentStackFrame())
     {}
-    
     bool HandleBinding(StoreManager &SMgr, Store store,
                        const MemRegion *region, SVal val) override {
 
       if (!isa<GlobalsSpaceRegion>(region->getMemorySpace()))
         return true;
-      
       const MemRegion *vR = val.getAsRegion();
       if (!vR)
         return true;
-        
       // Under automated retain release, it is okay to assign a block
       // directly to a global variable.
       if (Ctx.getASTContext().getLangOpts().ObjCAutoRefCount &&
           isa<BlockDataRegion>(vR))
         return true;
 
-      if (const StackSpaceRegion *SSR = 
+      if (const StackSpaceRegion *SSR =
           dyn_cast<StackSpaceRegion>(vR->getMemorySpace())) {
         // If the global variable holds a location in the current stack frame,
         // record the binding to emit a warning.
         if (SSR->getStackFrame() == CurSFC)
           V.push_back(std::make_pair(region, vR));
       }
-      
       return true;
     }
   };
-    
   CallBack cb(Ctx);
   state->getStateManager().getStoreManager().iterBindings(state->getStore(),cb);
 
   if (cb.V.empty())
     return;
 
   // Generate an error node.
   ExplodedNode *N = Ctx.addTransition(state);

lib/StaticAnalyzer/Checkers/StreamChecker.cpp

struct StreamState {
   //bool isEscaped() const { return K == Escaped; }
 
   bool operator==(const StreamState &X) const {
     return K == X.K && S == X.S;
   }
 
   static StreamState getOpened(const Stmt *s) { return StreamState(Opened, s); }
   static StreamState getClosed(const Stmt *s) { return StreamState(Closed, s); }
-  static StreamState getOpenFailed(const Stmt *s) { 
-    return StreamState(OpenFailed, s); 
+  static StreamState getOpenFailed(const Stmt *s) {
+    return StreamState(OpenFailed, s);
   }
   static StreamState getEscaped(const Stmt *s) {
     return StreamState(Escaped, s);
   }
 
   void Profile(llvm::FoldingSetNodeID &ID) const {
     ID.AddInteger(K);
     ID.AddPointer(S);
   }
 };
 
 class StreamChecker : public Checker<eval::Call,
                                      check::DeadSymbols > {
   mutable IdentifierInfo *II_fopen, *II_tmpfile, *II_fclose, *II_fread,
-                 *II_fwrite, 
-                 *II_fseek, *II_ftell, *II_rewind, *II_fgetpos, *II_fsetpos,  
+                 *II_fwrite,
+                 *II_fseek, *II_ftell, *II_rewind, *II_fgetpos, *II_fsetpos,
                  *II_clearerr, *II_feof, *II_ferror, *II_fileno;
   mutable std::unique_ptr<BuiltinBug> BT_nullfp, BT_illegalwhence,
       BT_doubleclose, BT_ResourceLeak;
 
 public:
-  StreamChecker() 
+  StreamChecker()
     : II_fopen(nullptr), II_tmpfile(nullptr), II_fclose(nullptr),
       II_fread(nullptr), II_fwrite(nullptr), II_fseek(nullptr),
       II_ftell(nullptr), II_rewind(nullptr), II_fgetpos(nullptr),
       II_fsetpos(nullptr), II_clearerr(nullptr), II_feof(nullptr),
       II_ferror(nullptr), II_fileno(nullptr) {}
 
   bool evalCall(const CallExpr *CE, CheckerContext &C) const;
   void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const;
private:
   void Fgetpos(CheckerContext &C, const CallExpr *CE) const;
   void Fsetpos(CheckerContext &C, const CallExpr *CE) const;
   void Clearerr(CheckerContext &C, const CallExpr *CE) const;
   void Feof(CheckerContext &C, const CallExpr *CE) const;
   void Ferror(CheckerContext &C, const CallExpr *CE) const;
   void Fileno(CheckerContext &C, const CallExpr *CE) const;
 
   void OpenFileAux(CheckerContext &C, const CallExpr *CE) const;
-  
-  ProgramStateRef CheckNullStream(SVal SV, ProgramStateRef state, 
+  ProgramStateRef CheckNullStream(SVal SV, ProgramStateRef state,
                                  CheckerContext &C) const;
-  ProgramStateRef CheckDoubleClose(const CallExpr *CE, ProgramStateRef state, 
+  ProgramStateRef CheckDoubleClose(const CallExpr *CE, ProgramStateRef state,
                                  CheckerContext &C) const;
 };
 
 } // end anonymous namespace
 
 REGISTER_MAP_WITH_PROGRAMSTATE(StreamMap, SymbolRef, StreamState)
 
 

 void StreamChecker::OpenFileAux(CheckerContext &C, const CallExpr *CE) const {
   ProgramStateRef state = C.getState();
   SValBuilder &svalBuilder = C.getSValBuilder();
   const LocationContext *LCtx = C.getPredecessor()->getLocationContext();
   DefinedSVal RetVal = svalBuilder.conjureSymbolVal(nullptr, CE, LCtx,
                                                     C.blockCount())
       .castAs<DefinedSVal>();
   state = state->BindExpr(CE, C.getLocationContext(), RetVal);
-  
   ConstraintManager &CM = C.getConstraintManager();
   // Bifurcate the state into two: one with a valid FILE* pointer, the other
   // with a NULL.
   ProgramStateRef stateNotNull, stateNull;
   std::tie(stateNotNull, stateNull) = CM.assumeDual(state, RetVal);
-  
   if (SymbolRef Sym = RetVal.getAsSymbol()) {
     // if RetVal is not NULL, set the symbol's state to Opened.
     stateNotNull =
       stateNotNull->set<StreamMap>(Sym,StreamState::getOpened(CE));
     stateNull =
       stateNull->set<StreamMap>(Sym, StreamState::getOpenFailed(CE));
 
     C.addTransition(stateNotNull);

 
 ProgramStateRef StreamChecker::CheckDoubleClose(const CallExpr *CE,
                                                ProgramStateRef state,
                                                CheckerContext &C) const {
   SymbolRef Sym =
     state->getSVal(CE->getArg(0), C.getLocationContext()).getAsSymbol();
   if (!Sym)
     return state;
-  
   const StreamState *SS = state->get<StreamMap>(Sym);
 
   // If the file stream is not tracked, return.
   if (!SS)
     return state;
-  
   // Check: Double close a File Descriptor could cause undefined behaviour.
   // Conforming to man-pages
   if (SS->isClosed()) {
     ExplodedNode *N = C.generateSink();
     if (N) {
       if (!BT_doubleclose)
         BT_doubleclose.reset(new BuiltinBug(
             this, "Double fclose", "Try to close a file Descriptor already"
                                    " closed. Cause undefined behaviour."));
       C.emitReport(llvm::make_unique<BugReport>(
           *BT_doubleclose, BT_doubleclose->getDescription(), N));
     }
     return nullptr;
   }
-  
   // Close the File Descriptor.
   return state->set<StreamMap>(Sym, StreamState::getClosed(CE));
 }
 
 void StreamChecker::checkDeadSymbols(SymbolReaper &SymReaper,
                                      CheckerContext &C) const {
   // TODO: Clean up the state.
   for (SymbolReaper::dead_iterator I = SymReaper.dead_begin(),

lib/StaticAnalyzer/Checkers/UndefBranchChecker.cpp

 
 class UndefBranchChecker : public Checker<check::BranchCondition> {
   mutable std::unique_ptr<BuiltinBug> BT;
 
   struct FindUndefExpr {
     ProgramStateRef St;
     const LocationContext *LCtx;
 
-    FindUndefExpr(ProgramStateRef S, const LocationContext *L) 
+    FindUndefExpr(ProgramStateRef S, const LocationContext *L)
       : St(S), LCtx(L) {}
 
     const Expr *FindExpr(const Expr *Ex) {
       if (!MatchesCriteria(Ex))
         return nullptr;
 
       for (const Stmt *SubStmt : Ex->children())
         if (const Expr *ExI = dyn_cast_or_null<Expr>(SubStmt))
           if (const Expr *E2 = FindExpr(ExI))
             return E2;
 
       return Ex;
     }
 
-    bool MatchesCriteria(const Expr *Ex) { 
+    bool MatchesCriteria(const Expr *Ex) {
       return St->getSVal(Ex, LCtx).isUndef();
     }
   };
 
 public:
   void checkBranchCondition(const Stmt *Condition, CheckerContext &Ctx) const;
 };
 

lib/StaticAnalyzer/Checkers/UndefCapturedBlockVarChecker.cpp

if (Optional<UndefinedVal> V =
         if (!BT)
           BT.reset(
               new BuiltinBug(this, "uninitialized variable captured by block"));
 
         // Generate a bug report.
         SmallString<128> buf;
         llvm::raw_svector_ostream os(buf);
 
-        os << "Variable '" << VD->getName() 
+        os << "Variable '" << VD->getName()
            << "' is uninitialized when captured by block";
 
         auto R = llvm::make_unique<BugReport>(*BT, os.str(), N);
         if (const Expr *Ex = FindBlockDeclRefExpr(BE->getBody(), VD))
           R->addRange(Ex->getSourceRange());
         R->addVisitor(llvm::make_unique<FindLastStoreBRVisitor>(
             *V, VR, /*EnableNullFPSuppression*/ false));
         R->disablePathPruning();

lib/StaticAnalyzer/Checkers/UndefResultChecker.cpp

 //=== UndefResultChecker.cpp ------------------------------------*- C++ -*-===//
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 //
-// This defines UndefResultChecker, a builtin check in ExprEngine that 
+// This defines UndefResultChecker, a builtin check in ExprEngine that
 // performs checks for undefined results of non-assignment binary operators.
 //
 //===----------------------------------------------------------------------===//
 
 #include "ClangSACheckers.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
 #include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
 #include "llvm/ADT/SmallString.h"
 #include "llvm/Support/raw_ostream.h"
 
 using namespace clang;
 using namespace ento;
 
 namespace {
-class UndefResultChecker 
+class UndefResultChecker
   : public Checker< check::PostStmt<BinaryOperator> > {
 
   mutable std::unique_ptr<BugType> BT;
 
 public:
   void checkPostStmt(const BinaryOperator *B, CheckerContext &C) const;
 };
 } // end anonymous namespace
if (const FunctionDecl *EnclosingFunctionDecl =
         dyn_cast<FunctionDecl>(C.getStackFrame()->getDecl()))
       if (C.getCalleeName(EnclosingFunctionDecl) == "swap")
         return;
 
     // Generate an error node.
     ExplodedNode *N = C.generateSink();
     if (!N)
       return;
-    
     if (!BT)
       BT.reset(
           new BuiltinBug(this, "Result of operation is garbage or undefined"));
 
     SmallString<256> sbuf;
     llvm::raw_svector_ostream OS(sbuf);
     const Expr *Ex = nullptr;
     bool isLeft = true;
-    
     if (state->getSVal(B->getLHS(), LCtx).isUndef()) {
       Ex = B->getLHS()->IgnoreParenCasts();
       isLeft = true;
     }
     else if (state->getSVal(B->getRHS(), LCtx).isUndef()) {
       Ex = B->getRHS()->IgnoreParenCasts();
       isLeft = false;
     }
-    
     if (Ex) {
       OS << "The " << (isLeft ? "left" : "right")
          << " operand of '"
          << BinaryOperator::getOpcodeStr(B->getOpcode())
          << "' is a garbage value";
-    }          
+    }
     else {
       // Neither operand was undefined, but the result is undefined.
       OS << "The result of the '"
          << BinaryOperator::getOpcodeStr(B->getOpcode())
          << "' expression is undefined";
     }
     auto report = llvm::make_unique<BugReport>(*BT, OS.str(), N);
     if (Ex) {
       report->addRange(Ex->getSourceRange());
       bugreporter::trackNullOrUndefValue(N, Ex, *report);
     }
     else
       bugreporter::trackNullOrUndefValue(N, B, *report);
-    
     C.emitReport(std::move(report));
   }
 }
 
 void ento::registerUndefResultChecker(CheckerManager &mgr) {
   mgr.registerChecker<UndefResultChecker>();
 }

lib/StaticAnalyzer/Checkers/UndefinedArraySubscriptChecker.cpp

class UndefinedArraySubscriptChecker
   : public Checker< check::PreStmt<ArraySubscriptExpr> > {
   mutable std::unique_ptr<BugType> BT;
 
 public:
   void checkPreStmt(const ArraySubscriptExpr *A, CheckerContext &C) const;
 };
 } // end anonymous namespace
 
-void 
+void
 UndefinedArraySubscriptChecker::checkPreStmt(const ArraySubscriptExpr *A,
                                              CheckerContext &C) const {
   const Expr *Index = A->getIdx();
   if (!C.getSVal(Index).isUndef())
     return;
 
   // Sema generates anonymous array variables for copying array struct fields.
   // Don't warn if we're in an implicitly-generated constructor.

lib/StaticAnalyzer/Checkers/UnixAPIChecker.cpp

ReportOpenBug(C, state,
                   "Call to 'open' with more than three arguments",
                   CE->getArg(3)->getSourceRange());
     return;
   }
 
   // The definition of O_CREAT is platform specific.  We need a better way
   // of querying this information from the checking environment.
   if (!Val_O_CREAT.hasValue()) {
-    if (C.getASTContext().getTargetInfo().getTriple().getVendor() 
+    if (C.getASTContext().getTargetInfo().getTriple().getVendor()
                                                       == llvm::Triple::Apple)
       Val_O_CREAT = 0x0200;
     else {
       // FIXME: We need a more general way of getting the O_CREAT value.
       // We could possibly grovel through the preprocessor state, but
       // that would require passing the Preprocessor object to the ExprEngine.
       // See also: MallocChecker.cpp / M_ZERO.
       return;

 // Returns true if we try to do a zero byte allocation, false otherwise.
 // Fills in trueState and falseState.
 static bool IsZeroByteAllocation(ProgramStateRef state,
                                 const SVal argVal,
                                 ProgramStateRef *trueState,
                                 ProgramStateRef *falseState) {
   std::tie(*trueState, *falseState) =
     state->assume(argVal.castAs<DefinedSVal>());
-  
   return (*falseState && !*trueState);
 }
 
 // Generates an error report, indicating that the function whose name is given
 // will perform a zero byte allocation.
 // Returns false if an error occurred, true otherwise.
 bool UnixAPIChecker::ReportZeroByteAllocation(CheckerContext &C,
                                               ProgramStateRef falseState,
                                               const Expr *arg,
                                               const char *fn_name) const {
   ExplodedNode *N = C.generateSink(falseState);
   if (!N)
     return false;
 
   LazyInitialize(BT_mallocZero,
                  "Undefined allocation of 0 bytes (CERT MEM04-C; CWE-131)");
 
   SmallString<256> S;
-  llvm::raw_svector_ostream os(S);    
+  llvm::raw_svector_ostream os(S);
   os << "Call to '" << fn_name << "' has an allocation size of 0 bytes";
   auto report = llvm::make_unique<BugReport>(*BT_mallocZero, os.str(), N);
 
   report->addRange(arg->getSourceRange());
   bugreporter::trackNullOrUndefValue(N, arg, *report);
   C.emitReport(std::move(report));
 
   return true;
void UnixAPIChecker::BasicAllocationCheck(CheckerContext &C,
   const Expr *arg = CE->getArg(sizeArg);
   SVal argVal = state->getSVal(arg, C.getLocationContext());
 
   if (argVal.isUnknownOrUndef())
     return;
 
   // Is the value perfectly constrained to zero?
   if (IsZeroByteAllocation(state, argVal, &trueState, &falseState)) {
-    (void) ReportZeroByteAllocation(C, falseState, arg, fn); 
+    (void) ReportZeroByteAllocation(C, falseState, arg, fn);
     return;
   }
   // Assume the value is non-zero going forward.
   assert(trueState);
   if (trueState != state)
-    C.addTransition(trueState);                           
+    C.addTransition(trueState);
 }
 
 void UnixAPIChecker::CheckCallocZero(CheckerContext &C,
                                      const CallExpr *CE) const {
   unsigned int nArgs = CE->getNumArgs();
   if (nArgs != 2)
     return;
 

lib/StaticAnalyzer/Checkers/UnreachableCodeChecker.cpp

private:
   static inline bool isEmptyCFGBlock(const CFGBlock *CB);
 };
 }
 
 void UnreachableCodeChecker::checkEndAnalysis(ExplodedGraph &G,
                                               BugReporter &B,
                                               ExprEngine &Eng) const {
   CFGBlocksSet reachable, visited;
-  
   if (Eng.hasWorkRemaining())
     return;
 
   const Decl *D = nullptr;
   CFG *C = nullptr;
   ParentMap *PM = nullptr;
   const LocationContext *LC = nullptr;
   // Iterate over ExplodedGraph
if (Optional<BlockEntrance> BE = P.getAs<BlockEntrance>()) {
       const CFGBlock *CB = BE->getBlock();
       reachable.insert(CB->getBlockID());
     }
   }
 
   // Bail out if we didn't get the CFG or the ParentMap.
   if (!D || !C || !PM)
     return;
-  
   // Don't do anything for template instantiations.  Proving that code
   // in a template instantiation is unreachable means proving that it is
   // unreachable in all instantiations.
   if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(D))
     if (FD->isTemplateInstantiation())
       return;
 
   // Find CFGBlocks that were not covered by any node

lib/StaticAnalyzer/Checkers/VLASizeChecker.cpp

 //=== VLASizeChecker.cpp - Undefined dereference checker --------*- C++ -*-===//
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 //
-// This defines VLASizeChecker, a builtin check in ExprEngine that 
+// This defines VLASizeChecker, a builtin check in ExprEngine that
 // performs checks for declaration of VLA of undefined or zero size.
 // In addition, VLASizeChecker is responsible for defining the extent
 // of the MemRegion that represents a VLA.
 //
 //===----------------------------------------------------------------------===//
 
 #include "ClangSACheckers.h"
 #include "clang/AST/CharUnits.h"
void VLASizeChecker::reportBug(VLASize_Kind Kind,
   bugreporter::trackNullOrUndefValue(N, SizeE, *report);
   C.emitReport(std::move(report));
   return;
 }
 
 void VLASizeChecker::checkPreStmt(const DeclStmt *DS, CheckerContext &C) const {
   if (!DS->isSingleDecl())
     return;
-  
   const VarDecl *VD = dyn_cast<VarDecl>(DS->getSingleDecl());
   if (!VD)
     return;
 
   ASTContext &Ctx = C.getASTContext();
   const VariableArrayType *VLA = Ctx.getAsVariableArrayType(VD->getType());
   if (!VLA)
     return;
 
   // FIXME: Handle multi-dimensional VLAs.
   const Expr *SE = VLA->getSizeExpr();
   ProgramStateRef state = C.getState();
   SVal sizeV = state->getSVal(SE, C.getLocationContext());
 
   if (sizeV.isUndef()) {
     reportBug(VLA_Garbage, SE, state, C);
     return;
   }
 
   // See if the size value is known. It can't be undefined because we would have
   // warned about that already.
   if (sizeV.isUnknown())
     return;
-  
   // Check if the size is tainted.
   if (state->isTainted(sizeV)) {
     reportBug(VLA_Tainted, SE, nullptr, C);
     return;
   }
 
   // Check if the size is zero.
   DefinedSVal sizeD = sizeV.castAs<DefinedSVal>();
 
   ProgramStateRef stateNotZero, stateZero;
   std::tie(stateNotZero, stateZero) = state->assume(sizeD);
 
   if (stateZero && !stateNotZero) {
     reportBug(VLA_Zero, SE, stateZero, C);
     return;
   }
- 
   // From this point on, assume that the size is not zero.
   state = stateNotZero;
 
   // VLASizeChecker is responsible for defining the extent of the array being
   // declared. We do this by multiplying the array length by the element size,
   // then matching that with the array region's extent symbol.
 
   // Check if the size is negative.

lib/StaticAnalyzer/Checkers/VirtualCallChecker.cpp

 //=======- VirtualCallChecker.cpp --------------------------------*- C++ -*-==//
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 //
-//  This file defines a checker that checks virtual function calls during 
+//  This file defines a checker that checks virtual function calls during
 //  construction or destruction of C++ objects.
 //
 //===----------------------------------------------------------------------===//
 
 #include "ClangSACheckers.h"
 #include "clang/AST/DeclCXX.h"
 #include "clang/AST/StmtVisitor.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
class WalkAST : public StmtVisitor<WalkAST> {
   BugReporter &BR;
   AnalysisDeclContext *AC;
 
   typedef const CallExpr * WorkListUnit;
   typedef SmallVector<WorkListUnit, 20> DFSWorkList;
 
   /// A vector representing the worklist which has a chain of CallExprs.
   DFSWorkList WList;
-  
   // PreVisited : A CallExpr to this FunctionDecl is in the worklist, but the
   // body has not been visited yet.
   // PostVisited : A CallExpr to this FunctionDecl is in the worklist, and the
   // body has been visited.
   enum Kind { NotVisited,
-              PreVisited,  /**< A CallExpr to this FunctionDecl is in the 
+              PreVisited,  /**< A CallExpr to this FunctionDecl is in the
                                 worklist, but the body has not yet been
                                 visited. */
               PostVisited  /**< A CallExpr to this FunctionDecl is in the
                                 worklist, and the body has been visited. */
   };
 
   /// A DenseMap that records visited states of FunctionDecls.
   llvm::DenseMap<const FunctionDecl *, Kind> VisitedFunctions;
 
   /// The CallExpr whose body is currently being visited.  This is used for
   /// generating bug reports.  This is null while visiting the body of a
   /// constructor or destructor.
   const CallExpr *visitingCallExpr;
-  
 public:
   WalkAST(const CheckerBase *checker, BugReporter &br,
           AnalysisDeclContext *ac)
       : Checker(checker), BR(br), AC(ac), visitingCallExpr(nullptr) {}
 
   bool hasWork() const { return !WList.empty(); }
 
   /// This method adds a CallExpr to the worklist and marks the callee as
   /// being PreVisited.
   void Enqueue(WorkListUnit WLUnit) {
     const FunctionDecl *FD = WLUnit->getDirectCallee();
     if (!FD || !FD->getBody())
-      return;    
+      return;
     Kind &K = VisitedFunctions[FD];
     if (K != NotVisited)
       return;
     K = PreVisited;
     WList.push_back(WLUnit);
   }
 
   /// This method returns an item from the worklist without removing it.
   WorkListUnit Dequeue() {
     assert(!WList.empty());
-    return WList.back();    
+    return WList.back();
   }
-  
   void Execute() {
     while (hasWork()) {
       WorkListUnit WLUnit = Dequeue();
       const FunctionDecl *FD = WLUnit->getDirectCallee();
       assert(FD && FD->getBody());
 
       if (VisitedFunctions[FD] == PreVisited) {
         // If the callee is PreVisited, walk its body.
         // Visit the body.
         SaveAndRestore<const CallExpr *> SaveCall(visitingCallExpr, WLUnit);
         Visit(FD->getBody());
-        
         // Mark the function as being PostVisited to indicate we have
         // scanned the body.
         VisitedFunctions[FD] = PostVisited;
         continue;
       }
 
       // Otherwise, the callee is PostVisited.
       // Remove it from the worklist.
       assert(VisitedFunctions[FD] == PostVisited);
       WList.pop_back();
     }
   }
 
   // Stmt visitor methods.
   void VisitCallExpr(CallExpr *CE);
   void VisitCXXMemberCallExpr(CallExpr *CE);
   void VisitStmt(Stmt *S) { VisitChildren(S); }
   void VisitChildren(Stmt *S);
-  
   void ReportVirtualCall(const CallExpr *CE, bool isPure);
 
 };
 } // end anonymous namespace
 
 //===----------------------------------------------------------------------===//
 // AST walking.
 //===----------------------------------------------------------------------===//
 
 void WalkAST::VisitChildren(Stmt *S) {
   for (Stmt *Child : S->children())
     if (Child)
       Visit(Child);
 }
 
 void WalkAST::VisitCallExpr(CallExpr *CE) {
   VisitChildren(CE);
   Enqueue(CE);
 }
 
 void WalkAST::VisitCXXMemberCallExpr(CallExpr *CE) {
   VisitChildren(CE);
   bool callIsNonVirtual = false;
-  
   // Several situations to elide for checking.
   if (MemberExpr *CME = dyn_cast<MemberExpr>(CE->getCallee())) {
     // If the member access is fully qualified (i.e., X::F), then treat
     // this as a non-virtual call and do not warn.
     if (CME->getQualifier())
       callIsNonVirtual = true;
 
     if (Expr *base = CME->getBase()->IgnoreImpCasts()) {
if (MD && MD->isVirtual() && !callIsNonVirtual && !MD->hasAttr<FinalAttr>() &&
     ReportVirtualCall(CE, MD->isPure());
 
   Enqueue(CE);
 }
 
 void WalkAST::ReportVirtualCall(const CallExpr *CE, bool isPure) {
   SmallString<100> buf;
   llvm::raw_svector_ostream os(buf);
-  
   os << "Call Path : ";
   // Name of current visiting CallExpr.
   os << *CE->getDirectCallee();
 
   // Name of the CallExpr whose body is current walking.
   if (visitingCallExpr)
     os << " <-- " << *visitingCallExpr->getDirectCallee();
   // Names of FunctionDecls in worklist with state PostVisited.
   for (SmallVectorImpl<const CallExpr *>::iterator I = WList.end(),
          E = WList.begin(); I != E; --I) {
     const FunctionDecl *FD = (*(I-1))->getDirectCallee();
     assert(FD);
     if (VisitedFunctions[FD] == PostVisited)
       os << " <-- " << *FD;
   }
 
   PathDiagnosticLocation CELoc =
     PathDiagnosticLocation::createBegin(CE, BR.getSourceManager(), AC);
   SourceRange R = CE->getCallee()->getSourceRange();
-  
   if (isPure) {
     os << "\n" <<  "Call pure virtual functions during construction or "
        << "destruction may leads undefined behaviour";
     BR.EmitBasicReport(AC->getDecl(), Checker,
                        "Call pure virtual function during construction or "
                        "Destruction",
                        "Cplusplus", os.str(), CELoc, R);
     return;

lib/StaticAnalyzer/Core/AnalysisManager.cpp

 using namespace ento;
 
 void AnalysisManager::anchor() { }
 
 AnalysisManager::AnalysisManager(ASTContext &ctx, DiagnosticsEngine &diags,
                                  const LangOptions &lang,
                                  const PathDiagnosticConsumers &PDC,
                                  StoreManagerCreator storemgr,
-                                 ConstraintManagerCreator constraintmgr, 
+                                 ConstraintManagerCreator constraintmgr,
                                  CheckerManager *checkerMgr,
                                  AnalyzerOptions &Options,
                                  CodeInjector *injector)
   : AnaCtxMgr(Options.UnoptimizedCFG,
               /*AddImplicitDtors=*/true,
               /*AddInitializers=*/true,
               Options.includeTemporaryDtorsInCFG(),
               Options.shouldSynthesizeBodies(),

lib/StaticAnalyzer/Core/AnalyzerOptions.cpp

IPAKind IPAConfig = llvm::StringSwitch<IPAKind>(ModeStr)
             .Case("dynamic", IPAK_DynamicDispatch)
             .Case("dynamic-bifurcate", IPAK_DynamicDispatchBifurcate)
             .Default(IPAK_NotSet);
     assert(IPAConfig != IPAK_NotSet && "IPA Mode is invalid.");
 
     // Set the member variable.
     IPAMode = IPAConfig;
   }
-  
   return IPAMode;
 }
 
 bool
 AnalyzerOptions::mayInlineCXXMemberFunction(CXXInlineableMemberKind K) {
   if (getIPAMode() < IPAK_Inlining)
     return false;
 

lib/StaticAnalyzer/Core/BlockCounter.cpp

 
 namespace {
 
 class CountKey {
   const StackFrameContext *CallSite;
   unsigned BlockID;
 
 public:
-  CountKey(const StackFrameContext *CS, unsigned ID) 
+  CountKey(const StackFrameContext *CS, unsigned ID)
     : CallSite(CS), BlockID(ID) {}
 
   bool operator==(const CountKey &RHS) const {
     return (CallSite == RHS.CallSite) && (BlockID == RHS.BlockID);
   }
 
   bool operator<(const CountKey &RHS) const {
     return std::tie(CallSite, BlockID) < std::tie(RHS.CallSite, RHS.BlockID);

 static inline CountMap GetMap(void *D) {
   return CountMap(static_cast<CountMap::TreeTy*>(D));
 }
 
 static inline CountMap::Factory& GetFactory(void *F) {
   return *static_cast<CountMap::Factory*>(F);
 }
 
-unsigned BlockCounter::getNumVisited(const StackFrameContext *CallSite, 
+unsigned BlockCounter::getNumVisited(const StackFrameContext *CallSite,
                                        unsigned BlockID) const {
   CountMap M = GetMap(Data);
   CountMap::data_type* T = M.lookup(CountKey(CallSite, BlockID));
   return T ? *T : 0;
 }
 
 BlockCounter::Factory::Factory(llvm::BumpPtrAllocator& Alloc) {
   F = new CountMap::Factory(Alloc);
 }
 
 BlockCounter::Factory::~Factory() {
   delete static_cast<CountMap::Factory*>(F);
 }
 
 BlockCounter
-BlockCounter::Factory::IncrementCount(BlockCounter BC, 
+BlockCounter::Factory::IncrementCount(BlockCounter BC,
                                         const StackFrameContext *CallSite,
                                         unsigned BlockID) {
-  return BlockCounter(GetFactory(F).add(GetMap(BC.Data), 
+  return BlockCounter(GetFactory(F).add(GetMap(BC.Data),
                                           CountKey(CallSite, BlockID),
                              BC.getNumVisited(CallSite, BlockID)+1).getRoot());
 }
 
 BlockCounter
 BlockCounter::Factory::GetEmptyCounter() {
   return BlockCounter(GetFactory(F).getEmptyMap().getRoot());
 }

lib/StaticAnalyzer/Core/BugReporter.cpp

 
 static PathDiagnosticEventPiece *
 eventsDescribeSameCondition(PathDiagnosticEventPiece *X,
                             PathDiagnosticEventPiece *Y) {
   // Prefer diagnostics that come from ConditionBRVisitor over
   // those that came from TrackConstraintBRVisitor.
   const void *tagPreferred = ConditionBRVisitor::getTag();
   const void *tagLesser = TrackConstraintBRVisitor::getTag();
-  
   if (X->getLocation() != Y->getLocation())
     return nullptr;
 
   if (X->getTag() == tagPreferred && Y->getTag() == tagLesser)
     return X;
-  
   if (Y->getTag() == tagPreferred && X->getTag() == tagLesser)
     return Y;
 
   return nullptr;
 }
 
 /// An optimization pass over PathPieces that removes redundant diagnostics
 /// generated by both ConditionBRVisitor and TrackConstraintBRVisitor.  Both
 /// BugReporterVisitors use different methods to generate diagnostics, with
 /// one capable of emitting diagnostics in some cases but not in others.  This
 /// can lead to redundant diagnostic pieces at the same point in a path.
 static void removeRedundantMsgs(PathPieces &path) {
   unsigned N = path.size();
   if (N < 2)
     return;
   // NOTE: this loop intentionally is not using an iterator.  Instead, we
   // are streaming the path and modifying it in place.  This is done by
   // grabbing the front, processing it, and if we decide to keep it append
   // it to the end of the path.  The entire path is processed in this way.
   for (unsigned i = 0; i < N; ++i) {
     IntrusiveRefCntPtr<PathDiagnosticPiece> piece(path.front());
     path.pop_front();
-    
     switch (piece->getKind()) {
       case clang::ento::PathDiagnosticPiece::Call:
         removeRedundantMsgs(cast<PathDiagnosticCallPiece>(piece)->path);
         break;
       case clang::ento::PathDiagnosticPiece::Macro:
         removeRedundantMsgs(cast<PathDiagnosticMacroPiece>(piece)->subPieces);
         break;
       case clang::ento::PathDiagnosticPiece::ControlFlow:
         break;
       case clang::ento::PathDiagnosticPiece::Event: {
         if (i == N-1)
           break;
-        
         if (PathDiagnosticEventPiece *nextEvent =
             dyn_cast<PathDiagnosticEventPiece>(path.front().get())) {
           PathDiagnosticEventPiece *event =
             cast<PathDiagnosticEventPiece>(piece);
           // Check to see if we should keep one of the two pieces.  If we
           // come up with a preference, record which piece to keep, and consume
           // another piece from the path.
           if (PathDiagnosticEventPiece *pieceToKeep =

 
 /// Recursively scan through a path and prune out calls and macros pieces
 /// that aren't needed.  Return true if afterwards the path contains
 /// "interesting stuff" which means it shouldn't be pruned from the parent path.
 static bool removeUnneededCalls(PathPieces &pieces, BugReport *R,
                                 LocationContextMap &LCM) {
   bool containsSomethingInteresting = false;
   const unsigned N = pieces.size();
-  
   for (unsigned i = 0 ; i < N ; ++i) {
     // Remove the front piece from the path.  If it is still something we
     // want to keep once we are done, we will push it back on the end.
     IntrusiveRefCntPtr<PathDiagnosticPiece> piece(pieces.front());
     pieces.pop_front();
-    
     switch (piece->getKind()) {
       case PathDiagnosticPiece::Call: {
         PathDiagnosticCallPiece *call = cast<PathDiagnosticCallPiece>(piece);
         // Check if the location context is interesting.
         assert(LCM.count(&call->path));
         if (R->isInteresting(LCM[&call->path])) {
           containsSomethingInteresting = true;
           break;
         }
 
         if (!removeUnneededCalls(call->path, R, LCM))
           continue;
-        
         containsSomethingInteresting = true;
         break;
       }
       case PathDiagnosticPiece::Macro: {
         PathDiagnosticMacroPiece *macro = cast<PathDiagnosticMacroPiece>(piece);
         if (!removeUnneededCalls(macro->subPieces, R, LCM))
           continue;
         containsSomethingInteresting = true;
         break;
       }
       case PathDiagnosticPiece::Event: {
         PathDiagnosticEventPiece *event = cast<PathDiagnosticEventPiece>(piece);
-        
         // We never throw away an event, but we do throw it away wholesale
         // as part of a path if we throw the entire path away.
         containsSomethingInteresting |= !event->isPrunable();
         break;
       }
       case PathDiagnosticPiece::ControlFlow:
         break;
     }
-    
     pieces.push_back(piece);
   }
-  
   return containsSomethingInteresting;
 }
 
 /// Returns true if the given decl has been implicitly given a body, either by
 /// the analyzer or by the compiler proper.
 static bool hasImplicitBody(const Decl *D) {
   assert(D);
   return D->isImplicit() || !D->hasBody();
 }
 
 /// Recursively scan through a path and make sure that all call pieces have
-/// valid locations. 
+/// valid locations.
 static void
 adjustCallLocations(PathPieces &Pieces,
                     PathDiagnosticLocation *LastCallLocation = nullptr) {
   for (PathPieces::iterator I = Pieces.begin(), E = Pieces.end(); I != E; ++I) {
     PathDiagnosticCallPiece *Call = dyn_cast<PathDiagnosticCallPiece>(*I);
 
     if (!Call) {
       assert((*I)->getLocation().asLocation().isValid());

 };
 
 class PathDiagnosticBuilder : public BugReporterContext {
   BugReport *R;
   PathDiagnosticConsumer *PDC;
   NodeMapClosure NMC;
 public:
   const LocationContext *LC;
-  
   PathDiagnosticBuilder(GRBugReporter &br,
                         BugReport *r, InterExplodedGraphMap &Backmap,
                         PathDiagnosticConsumer *pdc)
     : BugReporterContext(br),
       R(r), PDC(pdc), NMC(Backmap), LC(r->getErrorNode()->getLocationContext())
   {}
 
   PathDiagnosticLocation ExecutionContinues(const ExplodedNode *N);
 
   PathDiagnosticLocation ExecutionContinues(llvm::raw_string_ostream &os,
                                             const ExplodedNode *N);
 
   BugReport *getBugReport() { return R; }
 
   Decl const &getCodeDecl() { return R->getErrorNode()->getCodeDecl(); }
-  
   ParentMap& getParentMap() { return LC->getParentMap(); }
 
   const Stmt *getParent(const Stmt *S) {
     return getParentMap().getParent(S);
   }
 
   NodeMapClosure& getNodeResolver() override { return NMC; }
 
if (const Stmt *S = L.asStmt()) {
     }
 
     if (S != Original)
       L = PathDiagnosticLocation(S, L.getManager(), LC);
   }
 
   if (firstCharOnly)
     L  = PathDiagnosticLocation::createSingleLocation(L);
-  
   return L;
 }
 
 class EdgeBuilder {
   std::vector<ContextLocation> CLocs;
   typedef std::vector<ContextLocation>::iterator iterator;
   PathDiagnostic &PD;
   PathDiagnosticBuilder &PDB;
: PD(pd), PDB(pdb) {
 
         if (const Stmt *S = PrevLoc.asStmt())
           addExtendedContext(PDB.getEnclosingStmtLocation(S).asStmt());
       }
   }
 
   ~EdgeBuilder() {
     while (!CLocs.empty()) popLocation();
-    
     // Finally, add an initial edge from the start location of the first
     // statement (if it doesn't already exist).
     PathDiagnosticLocation L = PathDiagnosticLocation::createDeclBegin(
                                                        PDB.LC,
                                                        PDB.getSourceManager());
     if (L.isValid())
       rawAddEdge(L);
   }
 
   void flushLocations() {
     while (!CLocs.empty())
       popLocation();
     PrevLoc = PathDiagnosticLocation();
   }
-  
   void addEdge(PathDiagnosticLocation NewLoc, bool alwaysAdd = false,
                bool IsPostJump = false);
 
   void rawAddEdge(PathDiagnosticLocation NewLoc);
 
   void addContext(const Stmt *S);
   void addContext(const PathDiagnosticLocation &L);
   void addExtendedContext(const Stmt *S);
void EdgeBuilder::rawAddEdge(PathDiagnosticLocation NewLoc) {
 
   const PathDiagnosticLocation &NewLocClean = cleanUpLocation(NewLoc, PDB.LC);
   const PathDiagnosticLocation &PrevLocClean = cleanUpLocation(PrevLoc, PDB.LC);
 
   if (PrevLocClean.asLocation().isInvalid()) {
     PrevLoc = NewLoc;
     return;
   }
-  
   if (NewLocClean.asLocation() == PrevLocClean.asLocation())
     return;
 
   // FIXME: Ignore intra-macro edges for now.
   if (NewLocClean.asLocation().getExpansionLoc() ==
       PrevLocClean.asLocation().getExpansionLoc())
     return;
 

 static void reversePropagateIntererstingSymbols(BugReport &R,
                                                 InterestingExprs &IE,
                                                 const ProgramState *State,
                                                 const Expr *Ex,
                                                 const LocationContext *LCtx) {
   SVal V = State->getSVal(Ex, LCtx);
   if (!(R.isInteresting(V) || IE.count(Ex)))
     return;
-  
   switch (Ex->getStmtClass()) {
     default:
       if (!isa<CastExpr>(Ex))
         break;
       // Fall through.
     case Stmt::BinaryOperatorClass:
     case Stmt::UnaryOperatorClass: {
       for (const Stmt *SubStmt : Ex->children()) {
         if (const Expr *child = dyn_cast_or_null<Expr>(SubStmt)) {
           IE.insert(child);
           SVal ChildV = State->getSVal(child, LCtx);
           R.markInteresting(ChildV);
         }
       }
       break;
     }
   }
-  
   R.markInteresting(V);
 }
 
 static void reversePropagateInterestingSymbols(BugReport &R,
                                                InterestingExprs &IE,
                                                const ProgramState *State,
                                                const LocationContext *CalleeCtx,
                                                const LocationContext *CallerCtx)
 {
   // FIXME: Handle non-CallExpr-based CallEvents.
   const StackFrameContext *Callee = CalleeCtx->getCurrentStackFrame();
   const Stmt *CallSite = Callee->getCallSite();
   if (const CallExpr *CE = dyn_cast_or_null<CallExpr>(CallSite)) {
     if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(CalleeCtx->getDecl())) {
-      FunctionDecl::param_const_iterator PI = FD->param_begin(), 
+      FunctionDecl::param_const_iterator PI = FD->param_begin(),
                                          PE = FD->param_end();
       CallExpr::const_arg_iterator AI = CE->arg_begin(), AE = CE->arg_end();
       for (; AI != AE && PI != PE; ++AI, ++PI) {
         if (const Expr *ArgE = *AI) {
           if (const ParmVarDecl *PD = *PI) {
             Loc LV = State->getLValue(PD, CalleeCtx);
             if (R.isInteresting(LV) || R.isInteresting(State->getRawSVal(LV)))
               IE.insert(ArgE);
while (NextNode) {
 
     do {
       if (Optional<PostStmt> PS = P.getAs<PostStmt>()) {
         if (const Expr *Ex = PS->getStmtAs<Expr>())
           reversePropagateIntererstingSymbols(*PDB.getBugReport(), IE,
                                               N->getState().get(), Ex,
                                               N->getLocationContext());
       }
-      
       if (Optional<CallExitEnd> CE = P.getAs<CallExitEnd>()) {
         const Stmt *S = CE->getCalleeContext()->getCallSite();
         if (const Expr *Ex = dyn_cast_or_null<Expr>(S)) {
             reversePropagateIntererstingSymbols(*PDB.getBugReport(), IE,
                                                 N->getState().get(), Ex,
                                                 N->getLocationContext());
         }
-        
         PathDiagnosticCallPiece *C =
           PathDiagnosticCallPiece::construct(N, *CE, SM);
         LCM[&C->path] = CE->getCalleeContext();
 
         EB.addEdge(C->callReturn, /*AlwaysAdd=*/true, /*IsPostJump=*/true);
         EB.flushLocations();
 
         PD.getActivePath().push_front(C);
         PD.pushActivePath(&C->path);
         CallStack.push_back(StackDiagPair(C, N));
         break;
       }
-      
       // Pop the call hierarchy if we are done walking the contents
       // of a function call.
       if (Optional<CallEnter> CE = P.getAs<CallEnter>()) {
         // Add an edge to the start of the function.
         const Decl *D = CE->getCalleeContext()->getDecl();
         PathDiagnosticLocation pos =
           PathDiagnosticLocation::createBegin(D, SM);
         EB.addEdge(pos);
-        
         // Flush all locations, and pop the active path.
         bool VisitedEntireCall = PD.isWithinCall();
         EB.flushLocations();
         PD.popActivePath();
         PDB.LC = N->getLocationContext();
 
         // Either we just added a bunch of stuff to the top-level path, or
         // we have a previous CallExitEnd.  If the former, it means that the
do {
         EB.addContext(C->getLocation());
 
         if (!CallStack.empty()) {
           assert(CallStack.back().first == C);
           CallStack.pop_back();
         }
         break;
       }
-      
       // Note that is important that we update the LocationContext
       // after looking at CallExits.  CallExit basically adds an
       // edge in the *caller*, so we don't want to update the LocationContext
       // too soon.
       PDB.LC = N->getLocationContext();
 
       // Block edges.
       if (Optional<BlockEdge> BE = P.getAs<BlockEdge>()) {
         // Does this represent entering a call?  If so, look at propagating
         // interesting symbols across call boundaries.
         if (NextNode) {
           const LocationContext *CallerCtx = NextNode->getLocationContext();
           const LocationContext *CalleeCtx = PDB.LC;
           if (CallerCtx != CalleeCtx) {
             reversePropagateInterestingSymbols(*PDB.getBugReport(), IE,
                                                N->getState().get(),
                                                CalleeCtx, CallerCtx);
           }
         }
-       
         // Are we jumping to the head of a loop?  Add a special diagnostic.
         if (const Stmt *Loop = BE->getSrc()->getLoopTarget()) {
           PathDiagnosticLocation L(Loop, SM, PDB.LC);
           const CompoundStmt *CS = nullptr;
 
           if (const ForStmt *FS = dyn_cast<ForStmt>(Loop))
             CS = dyn_cast<CompoundStmt>(FS->getBody());
           else if (const WhileStmt *WS = dyn_cast<WhileStmt>(Loop))
do {
           const Stmt *stmt = S->getStmt();
           if (IsControlFlowExpr(stmt)) {
             // Add the proper context for '&&', '||', and '?'.
             EB.addContext(stmt);
           }
           else
             EB.addExtendedContext(PDB.getEnclosingStmtLocation(stmt).asStmt());
         }
-        
         break;
       }
-      
-      
     } while (0);
 
     if (!NextNode)
       continue;
 
     // Add pieces from custom visitors.
     BugReport *R = PDB.getBugReport();
     for (auto &V : visitors) {
if (s1End && s1End == s2Start && level2) {
         removeEdge = true;
       // Next only consider edges that are not anchored on
       // the condition of a terminator.  This are intermediate edges
       // that we might want to trim.
       else if (!isConditionForTerminator(level2, s1End)) {
         // Trim edges on expressions that are consumed by
         // the parent expression.
         if (isa<Expr>(s1End) && PM.isConsumedExpr(cast<Expr>(s1End))) {
-          removeEdge = true;          
+          removeEdge = true;
         }
         // Trim edges where a lexical containment doesn't exist.
         // For example:
         //
         //  X -> Y -> Z
         //
         // If 'Z' lexically contains Y (it is an ancestor) and
         // 'X' does not lexically contain Y (it is a descendant OR
BugReport::~BugReport() {
   while (!interestingSymbols.empty()) {
     popInterestingSymbolsAndRegions();
   }
 }
 
 const Decl *BugReport::getDeclWithIssue() const {
   if (DeclWithIssue)
     return DeclWithIssue;
-  
   const ExplodedNode *N = getErrorNode();
   if (!N)
     return nullptr;
 
   const LocationContext *LC = N->getLocationContext();
   return LC->getCurrentStackFrame()->getDecl();
 }
 
static void CompactPathDiagnostic(PathPieces &path, const SourceManager& SM) {
   typedef std::vector<IntrusiveRefCntPtr<PathDiagnosticPiece> >
           PiecesTy;
 
   MacroStackTy MacroStack;
   PiecesTy Pieces;
 
   for (PathPieces::const_iterator I = path.begin(), E = path.end();
        I!=E; ++I) {
-    
     PathDiagnosticPiece *piece = I->get();
 
     // Recursively compact calls.
     if (PathDiagnosticCallPiece *call=dyn_cast<PathDiagnosticCallPiece>(piece)){
       CompactPathDiagnostic(call->path, SM);
     }
-    
     // Get the location of the PathDiagnosticPiece.
     const FullSourceLoc Loc = piece->getLocation().asLocation();
 
     // Determine the instantiation location, which is the location we group
     // related PathDiagnosticPieces.
     SourceLocation InstantiationLoc = Loc.isMacroID() ?
                                       SM.getExpansionLoc(Loc) :
                                       SourceLocation();
do {
       for (BugReport::visitor_iterator I = R->visitor_begin(),
                                        E = R->visitor_end(); I != E; ++I)
         visitors.push_back((*I)->clone());
 
       // Clear out the active path from any previous work.
       PD.resetPath();
       origReportConfigToken = R->getConfigurationChangeToken();
 
-      // Generate the very last diagnostic piece - the piece is visible before 
+      // Generate the very last diagnostic piece - the piece is visible before
       // the trace is expanded.
       std::unique_ptr<PathDiagnosticPiece> LastPiece;
       for (BugReport::visitor_iterator I = visitors.begin(), E = visitors.end();
           I != E; ++I) {
         if (std::unique_ptr<PathDiagnosticPiece> Piece =
                 (*I)->getEndPath(PDB, N, *R)) {
           assert (!LastPiece &&
               "There can only be one final piece in a diagnostic.");
if (const ExplodedNode *E = R->getErrorNode()) {
     // The source of autosynthesized body can be handcrafted AST or a model
     // file. The locations from handcrafted ASTs have no valid source locations
     // and have to be discarded. Locations from model files should be preserved
     // for processing and reporting.
     if (DeclCtx->isBodyAutosynthesized() &&
         !DeclCtx->isBodyAutosynthesizedFromModelFile())
       return;
   }
-  
   bool ValidSourceLoc = R->getLocation(getSourceManager()).isValid();
   assert(ValidSourceLoc);
   // If we mess up in a release build, we'd still prefer to just drop the bug
   // instead of trying to go on.
   if (!ValidSourceLoc)
     return;
 
   // Compute the bug report's hash to determine its equivalence class.

 //===----------------------------------------------------------------------===//
 // Emitting reports in equivalence classes.
 //===----------------------------------------------------------------------===//
 
 namespace {
 struct FRIEC_WLItem {
   const ExplodedNode *N;
   ExplodedNode::const_succ_iterator I, E;
-  
   FRIEC_WLItem(const ExplodedNode *n)
   : N(n), I(N->succ_begin()), E(N->succ_end()) {}
-};  
+};
 }
 
 static BugReport *
 FindReportInEquivalenceClass(BugReportEquivClass& EQ,
                              SmallVectorImpl<BugReport*> &bugReports) {
 
   BugReportEquivClass::iterator I = EQ.begin(), E = EQ.end();
   assert(I != E);
for (; I != E; ++I) {
     if (errorNode->succ_empty()) {
       bugReports.push_back(I);
       if (!exampleReport)
         exampleReport = I;
       continue;
     }
 
     // At this point we know that 'N' is not a sink and it has at least one
-    // successor.  Use a DFS worklist to find a non-sink end-of-path node.    
+    // successor.  Use a DFS worklist to find a non-sink end-of-path node.
     typedef FRIEC_WLItem WLItem;
     typedef SmallVector<WLItem, 10> DFSWorkList;
     llvm::DenseMap<const ExplodedNode *, unsigned> Visited;
-    
     DFSWorkList WL;
     WL.push_back(errorNode);
     Visited[errorNode] = 1;
-    
     while (!WL.empty()) {
       WLItem &WI = WL.back();
       assert(!WI.N->succ_empty());
-            
       for (; WI.I != WI.E; ++WI.I) {
-        const ExplodedNode *Succ = *WI.I;        
+        const ExplodedNode *Succ = *WI.I;
         // End-of-path node?
         if (Succ->succ_empty()) {
           // If we found an end-of-path node that is not a sink.
           if (!Succ->isSink()) {
             bugReports.push_back(I);
             if (!exampleReport)
               exampleReport = I;
             WL.clear();

lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

public:
   /// node, looking for when the given statement was processed. If it turns out
   /// the statement is a call that was inlined, we add the visitor to the
   /// bug report, so it can print a note later.
   static void addVisitorIfNecessary(const ExplodedNode *Node, const Stmt *S,
                                     BugReport &BR,
                                     bool InEnableNullFPSuppression) {
     if (!CallEvent::isCallStmt(S))
       return;
-    
     // First, find when we processed the statement.
     do {
       if (Optional<CallExitEnd> CEE = Node->getLocationAs<CallExitEnd>())
         if (CEE->getCalleeContext()->getCallSite() == S)
           break;
       if (Optional<StmtPoint> SP = Node->getLocationAs<StmtPoint>())
         if (SP->getStmt() == S)
           break;
 
       Node = Node->getFirstPred();
     } while (Node);
 
     // Next, step over any post-statement checks.
     while (Node && Node->getLocation().getAs<PostStmt>())
       Node = Node->getFirstPred();
     if (!Node)
       return;
 
     // Finally, see if we inlined the call.
     Optional<CallExitEnd> CEE = Node->getLocationAs<CallExitEnd>();
     if (!CEE)
       return;
-    
     const StackFrameContext *CalleeContext = CEE->getCalleeContext();
     if (CalleeContext->getCallSite() != S)
       return;
-    
     // Check the return value.
     ProgramStateRef State = Node->getState();
     SVal RetVal = State->getSVal(S, Node->getLocationContext());
 
     // Handle cases where a reference is returned and then immediately used.
     if (cast<Expr>(S)->isGLValue())
       if (Optional<Loc> LValue = RetVal.getAs<Loc>())
         RetVal = State->getSVal(*LValue);
PathDiagnosticPiece *visitNodeInitial(const ExplodedNode *N,
     // If we can't prove the return value is 0, just mark it interesting, and
     // make sure to track it into any further inner functions.
     if (!State->isNull(V).isConstrainedTrue()) {
       BR.markInteresting(V);
       ReturnVisitor::addVisitorIfNecessary(N, RetE, BR,
                                            EnableNullFPSuppression);
       return nullptr;
     }
-      
     // If we're returning 0, we should track where that 0 came from.
     bugreporter::trackNullOrUndefValue(N, RetE, BR, /*IsArg*/ false,
                                        EnableNullFPSuppression);
 
     // Build an appropriate message based on the return value.
     SmallString<64> Msg;
     llvm::raw_svector_ostream Out(Msg);
 
PathDiagnosticPiece *FindLastStoreBRVisitor::VisitNode(const ExplodedNode *Succ,
   // should track the initializer expression.
   if (Optional<PostInitializer> PIP = Pred->getLocationAs<PostInitializer>()) {
     const MemRegion *FieldReg = (const MemRegion *)PIP->getLocationValue();
     if (FieldReg && FieldReg == R) {
       StoreSite = Pred;
       InitE = PIP->getInitializer()->getInit();
     }
   }
-  
   // Otherwise, see if this is the store site:
   // (1) Succ has this binding and Pred does not, i.e. this is
   //     where the binding first occurred.
   // (2) Succ has this binding and is a PostStore node for this region, i.e.
   //     the same binding was re-assigned here.
   if (!StoreSite) {
     if (Succ->getState()->getSVal(R) != V)
       return nullptr;
if (!StoreSite) {
 
     // If this is a call entry, the variable should be a parameter.
     // FIXME: Handle CXXThisRegion as well. (This is not a priority because
     // 'this' should never be NULL, but this visitor isn't just for NULL and
     // UndefinedVal.)
     if (Optional<CallEnter> CE = Succ->getLocationAs<CallEnter>()) {
       if (const VarRegion *VR = dyn_cast<VarRegion>(R)) {
         const ParmVarDecl *Param = cast<ParmVarDecl>(VR->getDecl());
-        
         ProgramStateManager &StateMgr = BRC.getStateManager();
         CallEventManager &CallMgr = StateMgr.getCallEventManager();
 
         CallEventRef<> Call = CallMgr.getCaller(CE->getCalleeContext(),
                                                 Succ->getState());
         InitE = Call->getArgExpr(Param->getFunctionScopeIndex());
         IsParam = true;
       }
if (V.getAs<loc::ConcreteInt>()) {
         os << "Assigning " << CV->getValue();
 
     } else {
       if (R->canPrintPretty())
         os << "Value assigned";
       else
         os << "Assigning value";
     }
-    
     if (R->canPrintPretty()) {
       os << " to ";
       R->printPretty(os);
     }
   }
 
   // Construct a new PathDiagnosticPiece.
   ProgramPoint P = StoreSite->getLocation();
do {
           break;
       }
       N = N->getFirstPred();
     } while (N);
 
     if (!N)
       return false;
   }
-  
   ProgramStateRef state = N->getState();
 
   // The message send could be nil due to the receiver being nil.
   // At this point in the path, the receiver should be live since we are at the
   // message send expr. If it is nil, start tracking it.
   if (const Expr *Receiver = NilReceiverBRVisitor::getNilReceiver(S, N))
     trackNullOrUndefValue(N, Receiver, report, false, EnableNullFPSuppression);
 
while (LVNode) {
         if (P->getStmt() == Inner)
           break;
       }
       LVNode = LVNode->getFirstPred();
     }
     assert(LVNode && "Unable to find the lvalue node.");
     ProgramStateRef LVState = LVNode->getState();
     SVal LVal = LVState->getSVal(Inner, LVNode->getLocationContext());
-    
     if (LVState->isNull(LVal).isConstrainedTrue()) {
       // In case of C++ references, we want to differentiate between a null
       // reference and reference to null pointer.
       // If the LVal is null, check if we are dealing with null reference.
       // For those, we want to track the location of the reference.
       if (const MemRegion *RR = getLocationRegionIfReference(Inner, N))
         R = RR;
     } else {
PathDiagnosticPiece *ConditionBRVisitor::VisitNode(const ExplodedNode *N,
   }
   return piece;
 }
 
 PathDiagnosticPiece *ConditionBRVisitor::VisitNodeImpl(const ExplodedNode *N,
                                                        const ExplodedNode *Prev,
                                                        BugReporterContext &BRC,
                                                        BugReport &BR) {
-  
   ProgramPoint progPoint = N->getLocation();
   ProgramStateRef CurrentState = N->getState();
   ProgramStateRef PrevState = Prev->getState();
-  
   // Compare the GDMs of the state, because that is where constraints
   // are managed.  Note that ensure that we only look at nodes that
   // were generated by the analyzer engine proper, not checkers.
   if (CurrentState->getGDM().getRoot() ==
       PrevState->getGDM().getRoot())
     return nullptr;
 
   // If an assumption was made on a branch, it should be caught
   // here by looking at the state transition.
   if (Optional<BlockEdge> BE = progPoint.getAs<BlockEdge>()) {
-    const CFGBlock *srcBlk = BE->getSrc();    
+    const CFGBlock *srcBlk = BE->getSrc();
     if (const Stmt *term = srcBlk->getTerminator())
       return VisitTerminator(term, N, srcBlk, BE->getDst(), BR, BRC);
     return nullptr;
   }
-  
   if (Optional<PostStmt> PS = progPoint.getAs<PostStmt>()) {
     // FIXME: Assuming that BugReporter is a GRBugReporter is a layering
     // violation.
-    const std::pair<const ProgramPointTag *, const ProgramPointTag *> &tags =      
+    const std::pair<const ProgramPointTag *, const ProgramPointTag *> &tags =
       cast<GRBugReporter>(BRC.getBugReporter()).
         getEngine().geteagerlyAssumeBinOpBifurcationTags();
 
     const ProgramPointTag *tag = PS->getTag();
     if (tag == tags.first)
       return VisitTrueTest(cast<Expr>(PS->getStmt()), true,
                            BRC, BR, N);
     if (tag == tags.second)
ConditionBRVisitor::VisitTerminator(const Stmt *Term,
   default:
     return nullptr;
   case Stmt::IfStmtClass:
     Cond = cast<IfStmt>(Term)->getCond();
     break;
   case Stmt::ConditionalOperatorClass:
     Cond = cast<ConditionalOperator>(Term)->getCond();
     break;
-  }      
+  }
 
   assert(Cond);
   assert(srcBlk->succ_size() == 2);
   const bool tookTrue = *(srcBlk->succ_begin()) == dstBlk;
   return VisitTrueTest(Cond, tookTrue, BRC, R, N);
 }
 
 PathDiagnosticPiece *
 ConditionBRVisitor::VisitTrueTest(const Expr *Cond,
                                   bool tookTrue,
                                   BugReporterContext &BRC,
                                   BugReport &R,
                                   const ExplodedNode *N) {
-  
   const Expr *Ex = Cond;
-  
   while (true) {
     Ex = Ex->IgnoreParenCasts();
     switch (Ex->getStmtClass()) {
       default:
         return nullptr;
       case Stmt::BinaryOperatorClass:
         return VisitTrueTest(Cond, cast<BinaryOperator>(Ex), tookTrue, BRC,
                              R, N);
if (quotes) {
         }
       }
     }
     Out << DR->getDecl()->getDeclName().getAsString();
     if (quotes)
       Out << '\'';
     return quotes;
   }
-  
   if (const IntegerLiteral *IL = dyn_cast<IntegerLiteral>(Ex)) {
     QualType OriginalTy = OriginalExpr->getType();
     if (OriginalTy->isPointerType()) {
       if (IL->getValue() == 0) {
         Out << "null";
         return false;
       }
     }
     else if (OriginalTy->isObjCObjectPointerType()) {
       if (IL->getValue() == 0) {
         Out << "nil";
         return false;
       }
     }
-    
     Out << IL->getValue();
     return false;
   }
-  
   return false;
 }
 
 PathDiagnosticPiece *
 ConditionBRVisitor::VisitTrueTest(const Expr *Cond,
                                   const BinaryOperator *BExpr,
                                   const bool tookTrue,
                                   BugReporterContext &BRC,
                                   BugReport &R,
                                   const ExplodedNode *N) {
-  
   bool shouldInvert = false;
   Optional<bool> shouldPrune;
-  
   SmallString<128> LhsString, RhsString;
   {
     llvm::raw_svector_ostream OutLHS(LhsString), OutRHS(RhsString);
     const bool isVarLHS = patternMatch(BExpr->getLHS(), OutLHS, BRC, R, N,
                                        shouldPrune);
     const bool isVarRHS = patternMatch(BExpr->getRHS(), OutRHS, BRC, R, N,
                                        shouldPrune);
-    
-    shouldInvert = !isVarLHS && isVarRHS;    
+    shouldInvert = !isVarLHS && isVarRHS;
   }
-  
   BinaryOperator::Opcode Op = BExpr->getOpcode();
 
   if (BinaryOperator::isAssignmentOp(Op)) {
     // For assignment operators, all that we care about is that the LHS
     // evaluates to "true" or "false".
     return VisitConditionVariable(LhsString, BExpr->getLHS(), tookTrue,
                                   BRC, R, N);
   }
switch (Op) {
       case BO_NE: Op = BO_EQ; break;
       case BO_LT: Op = BO_GE; break;
       case BO_GT: Op = BO_LE; break;
       case BO_LE: Op = BO_GT; break;
       case BO_GE: Op = BO_LT; break;
       default:
         return nullptr;
     }
-  
   switch (Op) {
     case BO_EQ:
       Out << "equal to ";
       break;
     case BO_NE:
       Out << "not equal to ";
       break;
     default:
       Out << BinaryOperator::getOpcodeStr(Op) << ' ';
       break;
   }
-  
   Out << (shouldInvert ? LhsString : RhsString);
   const LocationContext *LCtx = N->getLocationContext();
   PathDiagnosticLocation Loc(Cond, BRC.getSourceManager(), LCtx);
   PathDiagnosticEventPiece *event =
     new PathDiagnosticEventPiece(Loc, Out.str());
   if (shouldPrune.hasValue())
     event->setPrunable(shouldPrune.getValue());
   return event;
 }
 
 PathDiagnosticPiece *
 ConditionBRVisitor::VisitConditionVariable(StringRef LhsString,
                                            const Expr *CondVarExpr,
                                            const bool tookTrue,
                                            BugReporterContext &BRC,
                                            BugReport &report,
                                            const ExplodedNode *N) {
   // FIXME: If there's already a constraint tracker for this variable,
   // we shouldn't emit anything here (c.f. the double note in
   // test/Analysis/inlining/path-notes.c)
   SmallString<256> buf;
   llvm::raw_svector_ostream Out(buf);
   Out << "Assuming " << LhsString << " is ";
-  
   QualType Ty = CondVarExpr->getType();
 
   if (Ty->isPointerType())
     Out << (tookTrue ? "not null" : "null");
   else if (Ty->isObjCObjectPointerType())
     Out << (tookTrue ? "not nil" : "nil");
   else if (Ty->isBooleanType())
     Out << (tookTrue ? "true" : "false");
if (const DeclRefExpr *DR = dyn_cast<DeclRefExpr>(CondVarExpr)) {
     if (const VarDecl *VD = dyn_cast<VarDecl>(DR->getDecl())) {
       const ProgramState *state = N->getState().get();
       if (const MemRegion *R = state->getLValue(VD, LCtx).getAsRegion()) {
         if (report.isInteresting(R))
           event->setPrunable(false);
       }
     }
   }
-  
   return event;
 }
-  
 PathDiagnosticPiece *
 ConditionBRVisitor::VisitTrueTest(const Expr *Cond,
                                   const DeclRefExpr *DR,
                                   const bool tookTrue,
                                   BugReporterContext &BRC,
                                   BugReport &report,
                                   const ExplodedNode *N) {
 
   const VarDecl *VD = dyn_cast<VarDecl>(DR->getDecl());
   if (!VD)
     return nullptr;
 
   SmallString<256> Buf;
   llvm::raw_svector_ostream Out(Buf);
-    
   Out << "Assuming '" << VD->getDeclName() << "' is ";
-    
   QualType VDTy = VD->getType();
-  
   if (VDTy->isPointerType())
     Out << (tookTrue ? "non-null" : "null");
   else if (VDTy->isObjCObjectPointerType())
     Out << (tookTrue ? "non-nil" : "nil");
   else if (VDTy->isScalarType())
     Out << (tookTrue ? "not equal to 0" : "0");
   else
     return nullptr;
 
   const LocationContext *LCtx = N->getLocationContext();
   PathDiagnosticLocation Loc(Cond, BRC.getSourceManager(), LCtx);
   PathDiagnosticEventPiece *event =
     new PathDiagnosticEventPiece(Loc, Out.str());
-  
   const ProgramState *state = N->getState().get();
   if (const MemRegion *R = state->getLValue(VD, LCtx).getAsRegion()) {
     if (report.isInteresting(R))
       event->setPrunable(false);
     else {
       SVal V = state->getSVal(R);
       if (report.isInteresting(V))
         event->setPrunable(false);
for (ArrayRef<ParmVarDecl*>::iterator I = parms.begin(), E = parms.end();
     const ParmVarDecl *ParamDecl = *I;
     assert(ParamDecl && "Formal parameter has no decl?");
     QualType T = ParamDecl->getType();
 
     if (!(T->isAnyPointerType() || T->isReferenceType())) {
       // Function can only change the value passed in by address.
       continue;
     }
-    
     // If it is a const pointer value, the function does not intend to
     // change the value.
     if (T->getPointeeType().isConstQualified())
       continue;
 
-    // Mark the call site (LocationContext) as interesting if the value of the 
+    // Mark the call site (LocationContext) as interesting if the value of the
     // argument is undefined or '0'/'NULL'.
     SVal BoundVal = State->getSVal(R);
     if (BoundVal.isUndef() || BoundVal.isZeroConstant()) {
       BR.markInteresting(CEnter->getCalleeContext());
       return nullptr;
     }
   }
   return nullptr;
 }

lib/StaticAnalyzer/Core/CallEvent.cpp

for (CallEvent::param_type_iterator I = param_type_begin(),
                                        E = param_type_end();
        I != E && Idx < NumOfArgs; ++I, ++Idx) {
     if (NumOfArgs <= Idx)
       break;
 
     if (isCallbackArg(getArgSVal(Idx), *I))
       return true;
   }
-  
   return false;
 }
 
 bool CallEvent::isGlobalCFunction(StringRef FunctionName) const {
   const FunctionDecl *FD = dyn_cast_or_null<FunctionDecl>(getDecl());
   if (!FD)
     return false;
 
ProgramStateRef CallEvent::invalidateRegions(unsigned BlockCount,
   if (!argumentsMayEscape())
     findPtrToConstParams(PreserveArgs, *this);
 
   for (unsigned Idx = 0, Count = getNumArgs(); Idx != Count; ++Idx) {
     // Mark this region for invalidation.  We batch invalidate regions
     // below for efficiency.
     if (PreserveArgs.count(Idx))
       if (const MemRegion *MR = getArgSVal(Idx).getAsRegion())
-        ETraits.setTrait(MR->StripCasts(), 
+        ETraits.setTrait(MR->StripCasts(),
                         RegionAndSymbolInvalidationTraits::TK_PreserveContents);
         // TODO: Factor this out + handle the lower level const pointers.
 
     ValuesToInvalidate.push_back(getArgSVal(Idx));
   }
 
   // Invalidate designated regions using the batch invalidation API.
   // NOTE: Even if RegionsToInvalidate is empty, we may still invalidate
   //  global variables.
   return Result->invalidateRegions(ValuesToInvalidate, getOriginExpr(),
                                    BlockCount, getLocationContext(),
                                    /*CausedByPointerEscape*/ true,
                                    /*Symbols=*/nullptr, this, &ETraits);
 }
 
 ProgramPoint CallEvent::getProgramPoint(bool IsPreVisit,
                                         const ProgramPointTag *Tag) const {
   if (const Expr *E = getOriginExpr()) {
     if (IsPreVisit)
       return PreStmt(E, getLocationContext(), Tag);
     return PostStmt(E, getLocationContext(), Tag);
   }
 
   const Decl *D = getDecl();
-  assert(D && "Cannot get a program point without a statement or decl");  
+  assert(D && "Cannot get a program point without a statement or decl");
 
   SourceLocation Loc = getSourceRange().getBegin();
   if (IsPreVisit)
     return PreImplicitCall(D, Loc, getLocationContext(), Tag);
   return PostImplicitCall(D, Loc, getLocationContext(), Tag);
 }
 
 SVal CallEvent::getArgSVal(unsigned Index) const {
if (const TypeSourceInfo *TSI = BD->getSignatureAsWritten()) {
       if (const FunctionType *FT = Ty->getAs<FunctionType>())
         Ty = FT->getReturnType();
       if (!Ty->isDependentType())
         return Ty;
     }
 
     return QualType();
   }
-  
   llvm_unreachable("unknown callable kind");
 }
 
 bool CallEvent::isVariadic(const Decl *D) {
   assert(D);
 
   if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(D))
     return FD->isVariadic();
bool AnyFunctionCall::argumentsMayEscape() const {
   const FunctionDecl *D = getDecl();
   if (!D)
     return true;
 
   const IdentifierInfo *II = D->getIdentifier();
   if (!II)
     return false;
 
-  // This set of "escaping" APIs is 
+  // This set of "escaping" APIs is
 
   // - 'int pthread_setspecific(ptheread_key k, const void *)' stores a
   //   value into thread local storage. The value can later be retrieved with
   //   'void *ptheread_getspecific(pthread_key)'. So even thought the
   //   parameter is 'const void *', the region escapes through the call.
   if (II->isStr("pthread_setspecific"))
     return true;
 
RuntimeDefinition CXXInstanceCall::getRuntimeDefinition() const {
   // Find the decl for this method in that class.
   const CXXMethodDecl *Result = MD->getCorrespondingMethodInClass(RD, true);
   if (!Result) {
     // We might not even get the original statically-resolved method due to
     // some particularly nasty casting (e.g. casts to sister classes).
     // However, we should at least be able to search up and down our own class
     // hierarchy, and some real bugs have been caught by checking this.
     assert(!RD->isDerivedFrom(MD->getParent()) && "Couldn't find known method");
-    
     // FIXME: This is checking that our DynamicTypeInfo is at least as good as
     // the static type. However, because we currently don't update
     // DynamicTypeInfo when an object is cast, we can't actually be sure the
     // DynamicTypeInfo is up to date. This assert should be re-enabled once
     // this is fixed. <rdar://problem/12287087>
     //assert(!MD->getParent()->isDerivedFrom(RD) && "Bad DynamicTypeInfo");
 
     return RuntimeDefinition();

 RuntimeDefinition CXXMemberCall::getRuntimeDefinition() const {
   // C++11 [expr.call]p1: ...If the selected function is non-virtual, or if the
   // id-expression in the class member access expression is a qualified-id,
   // that function is called. Otherwise, its final overrider in the dynamic type
   // of the object expression is called.
   if (const MemberExpr *ME = dyn_cast<MemberExpr>(getOriginExpr()->getCallee()))
     if (ME->hasQualifier())
       return AnyFunctionCall::getRuntimeDefinition();
-  
   return CXXInstanceCall::getRuntimeDefinition();
 }
 
 
 const Expr *CXXMemberOperatorCall::getCXXThisExpr() const {
   return getOriginExpr()->getArg(0);
 }
 
if (!SelfDecl)
     return SVal();
   return getState()->getSVal(getState()->getRegion(SelfDecl, LCtx));
 }
 
 SVal ObjCMethodCall::getReceiverSVal() const {
   // FIXME: Is this the best way to handle class receivers?
   if (!isInstanceMessage())
     return UnknownVal();
-    
   if (const Expr *RecE = getOriginExpr()->getInstanceReceiver())
     return getSVal(RecE);
 
   // An instance message with no expression means we are sending to super.
   // In this case the object reference is the same as 'self'.
   assert(getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperInstance);
   SVal SelfVal = getSelfSVal();
   assert(SelfVal.isValid() && "Calling super but not in ObjC method");
if (const PseudoObjectExpr *POE = dyn_cast_or_null<PseudoObjectExpr>(S)) {
 
       if (K != OCM_Message) {
         const_cast<ObjCMethodCall *>(this)->Data
           = ObjCMessageDataTy(POE, K).getOpaqueValue();
         assert(getMessageKind() == K);
         return K;
       }
     }
-    
     const_cast<ObjCMethodCall *>(this)->Data
       = ObjCMessageDataTy(nullptr, 1).getOpaqueValue();
     assert(getMessageKind() == OCM_Message);
     return OCM_Message;
   }
 
   ObjCMessageDataTy Info = ObjCMessageDataTy::getFromOpaqueValue(Data);
   if (!Info.getPointer())
     return OCM_Message;
   return static_cast<ObjCMessageKind>(Info.getInt());
 }
 
 
 bool ObjCMethodCall::canBeOverridenInSubclass(ObjCInterfaceDecl *IDecl,
                                              Selector Sel) const {
   assert(IDecl);
   const SourceManager &SM =
     getState()->getStateManager().getContext().getSourceManager();
 
   // If the class interface is declared inside the main file, assume it is not
-  // subcassed. 
+  // subcassed.
   // TODO: It could actually be subclassed if the subclass is private as well.
   // This is probably very rare.
   SourceLocation InterfLoc = IDecl->getEndOfDefinitionLoc();
   if (InterfLoc.isValid() && SM.isInMainFile(InterfLoc))
     return false;
 
   // Assume that property accessors are not overridden.
   if (getMessageKind() == OCM_PropertyAccess)

lib/StaticAnalyzer/Core/Checker.cpp

 using namespace ento;
 
 StringRef CheckerBase::getTagDescription() const {
   return getCheckName().getName();
 }
 
 CheckName CheckerBase::getCheckName() const { return Name; }
 
-CheckerProgramPointTag::CheckerProgramPointTag(StringRef CheckerName, 
+CheckerProgramPointTag::CheckerProgramPointTag(StringRef CheckerName,
                                                StringRef Msg)
   : SimpleProgramPointTag(CheckerName, Msg) {}
 
 CheckerProgramPointTag::CheckerProgramPointTag(const CheckerBase *Checker,
                                                StringRef Msg)
   : SimpleProgramPointTag(Checker->getCheckName().getName(), Msg) {}
 
 raw_ostream& clang::ento::operator<<(raw_ostream &Out,
                                      const CheckerBase &Checker) {
   Out << Checker.getCheckName().getName();
   return Out;
 }

lib/StaticAnalyzer/Core/CheckerManager.cpp

 
 /// \brief Run checkers for end of path.
 // Note, We do not chain the checker output (like in expandGraphWithCheckers)
 // for this callback since end of path nodes are expected to be final.
 void CheckerManager::runCheckersForEndFunction(NodeBuilderContext &BC,
                                                ExplodedNodeSet &Dst,
                                                ExplodedNode *Pred,
                                                ExprEngine &Eng) {
-  
   // We define the builder outside of the loop bacause if at least one checkers
-  // creates a sucsessor for Pred, we do not need to generate an 
+  // creates a sucsessor for Pred, we do not need to generate an
   // autotransition for it.
   NodeBuilder Bldr(Pred, Dst, BC);
   for (unsigned i = 0, e = EndFunctionCheckers.size(); i != e; ++i) {
     CheckEndFunctionFunc checkFn = EndFunctionCheckers[i];
 
     const ProgramPoint &L = BlockEntrance(BC.Block,
                                           Pred->getLocationContext(),
                                           checkFn.Checker);
bool CheckerManager::wantsRegionChangeUpdate(ProgramStateRef state) {
   for (unsigned i = 0, e = RegionChangesCheckers.size(); i != e; ++i)
     if (RegionChangesCheckers[i].WantUpdateFn(state))
       return true;
 
   return false;
 }
 
 /// \brief Run checkers for region changes.
-ProgramStateRef 
+ProgramStateRef
 CheckerManager::runCheckersForRegionChanges(ProgramStateRef state,
                                     const InvalidatedSymbols *invalidated,
                                     ArrayRef<const MemRegion *> ExplicitRegions,
                                     ArrayRef<const MemRegion *> Regions,
                                     const CallEvent *Call) {
   for (unsigned i = 0, e = RegionChangesCheckers.size(); i != e; ++i) {
     // If any checker declares the state infeasible (or if it starts that way),
     // bail out.
     if (!state)
       return nullptr;
-    state = RegionChangesCheckers[i].CheckFn(state, invalidated, 
+    state = RegionChangesCheckers[i].CheckFn(state, invalidated,
                                              ExplicitRegions, Regions, Call);
   }
   return state;
 }
 
 /// \brief Run checkers to process symbol escape event.
 ProgramStateRef
 CheckerManager::runCheckersForPointerEscape(ProgramStateRef State,
for (unsigned i = 0, e = PointerEscapeCheckers.size(); i != e; ++i) {
       if (!State)
         return nullptr;
       State = PointerEscapeCheckers[i](State, Escaped, Call, Kind, ETraits);
     }
   return State;
 }
 
 /// \brief Run checkers for handling assumptions on symbolic values.
-ProgramStateRef 
+ProgramStateRef
 CheckerManager::runCheckersForEvalAssume(ProgramStateRef state,
                                          SVal Cond, bool Assumption) {
   for (unsigned i = 0, e = EvalAssumeCheckers.size(); i != e; ++i) {
     // If any checker declares the state infeasible (or if it starts that way),
     // bail out.
     if (!state)
       return nullptr;
     state = EvalAssumeCheckers[i](state, Cond, Assumption);
for (std::vector<EvalCallFunc>::iterator
       if (evaluated) {
         anyEvaluated = true;
         Dst.insert(checkDst);
 #ifdef NDEBUG
         break; // on release don't check that no other checker also evals.
 #endif
       }
     }
-    
     // If none of the checkers evaluated the call, ask ExprEngine to handle it.
     if (!anyEvaluated) {
       NodeBuilder B(Pred, Dst, Eng.getBuilderContext());
       Eng.defaultEvalCall(B, Pred, Call);
     }
   }
 }
 

lib/StaticAnalyzer/Core/CheckerRegistry.cpp

void CheckerRegistry::addChecker(InitializationFunction fn, StringRef name,
   StringRef packageName, leafName;
   std::tie(packageName, leafName) = name.rsplit(PackageSeparator);
   while (!leafName.empty()) {
     Packages[packageName] += 1;
     std::tie(packageName, leafName) = packageName.rsplit(PackageSeparator);
   }
 }
 
-void CheckerRegistry::initializeManager(CheckerManager &checkerMgr, 
+void CheckerRegistry::initializeManager(CheckerManager &checkerMgr,
                                   SmallVectorImpl<CheckerOptInfo> &opts) const {
   // Sort checkers for efficient collection.
   std::sort(Checkers.begin(), Checkers.end(), checkerNameLT);
 
   // Collect checkers enabled by the options.
   CheckerInfoSet enabledCheckers;
   for (SmallVectorImpl<CheckerOptInfo>::iterator
          i = opts.begin(), e = opts.end(); i != e; ++i) {

lib/StaticAnalyzer/Core/ConstraintManager.cpp

 static DefinedSVal getLocFromSymbol(const ProgramStateRef &State,
                                     SymbolRef Sym) {
   const MemRegion *R = State->getStateManager().getRegionManager()
                                                .getSymbolicRegion(Sym);
   return loc::MemRegionVal(R);
 }
 
 ConditionTruthVal ConstraintManager::checkNull(ProgramStateRef State,
-                                               SymbolRef Sym) {  
+                                               SymbolRef Sym) {
   QualType Ty = Sym->getType();
   DefinedSVal V = Loc::isLocType(Ty) ? getLocFromSymbol(State, Sym)
                                      : nonloc::SymbolVal(Sym);
   const ProgramStatePair &P = assumeDual(State, V);
   if (P.first && !P.second)
     return ConditionTruthVal(false);
   if (!P.first && P.second)
     return ConditionTruthVal(true);
   return ConditionTruthVal();
 }

lib/StaticAnalyzer/Core/CoreEngine.cpp

default:
              Loc.getAs<CallExitEnd>());
       HandlePostStmt(WU.getBlock(), WU.getIndex(), Pred);
       break;
   }
 }
 
 bool CoreEngine::ExecuteWorkListWithInitialState(const LocationContext *L,
                                                  unsigned Steps,
-                                                 ProgramStateRef InitState, 
+                                                 ProgramStateRef InitState,
                                                  ExplodedNodeSet &Dst) {
   bool DidNotFinish = ExecuteWorkList(L, Steps, InitState);
   for (ExplodedGraph::eop_iterator I = G.eop_begin(), E = G.eop_end(); I != E;
        ++I) {
     Dst.Add(*I);
   }
   return DidNotFinish;
 }
switch (Term->getStmtClass()) {
              et = B->succ_end(); it != et; ++it) {
           if (const CFGBlock *succ = *it) {
             generateNode(BlockEdge(B, succ, Pred->getLocationContext()),
                          Pred->State, Pred);
           }
         }
         return;
       }
-        
       case Stmt::DoStmtClass:
         HandleBranch(cast<DoStmt>(Term)->getCond(), Term, B, Pred);
         return;
 
       case Stmt::CXXForRangeStmtClass:
         HandleBranch(cast<CXXForRangeStmt>(Term)->getCond(), Term, B, Pred);
         return;
 
void CoreEngine::HandleBlockExit(const CFGBlock * B, ExplodedNode *Pred) {
 
   assert (B->succ_size() == 1 &&
           "Blocks with no terminator should have at most 1 successor.");
 
   generateNode(BlockEdge(B, *(B->succ_begin()), Pred->getLocationContext()),
                Pred->State, Pred);
 }
 
-void CoreEngine::HandleBranch(const Stmt *Cond, const Stmt *Term, 
+void CoreEngine::HandleBranch(const Stmt *Cond, const Stmt *Term,
                                 const CFGBlock * B, ExplodedNode *Pred) {
   assert(B->succ_size() == 2);
   NodeBuilderContext Ctx(*this, B, Pred);
   ExplodedNodeSet Dst;
   SubEng.processBranch(Cond, Term, Ctx, Pred, Dst,
                        *(B->succ_begin()), *(B->succ_begin()+1));
   // Enqueue the new frontier onto the worklist.
   enqueue(Dst);
void CoreEngine::HandleStaticInit(const DeclStmt *DS, const CFGBlock *B,
   ExplodedNodeSet Dst;
   SubEng.processStaticInitializer(DS, Ctx, Pred, Dst,
                                   *(B->succ_begin()), *(B->succ_begin()+1));
   // Enqueue the new frontier onto the worklist.
   enqueue(Dst);
 }
 
 
-void CoreEngine::HandlePostStmt(const CFGBlock *B, unsigned StmtIdx, 
+void CoreEngine::HandlePostStmt(const CFGBlock *B, unsigned StmtIdx,
                                   ExplodedNode *Pred) {
   assert(B);
   assert(!B->empty());
 
   if (StmtIdx == B->size())
     HandleBlockExit(B, Pred);
   else {
     NodeBuilderContext Ctx(*this, B, Pred);

lib/StaticAnalyzer/Core/Environment.cpp

SVal Environment::getSVal(const EnvironmentEntry &Entry,
   case Stmt::StringLiteralClass:
     // Known constants; defer to SValBuilder.
     return svalBuilder.getConstantVal(cast<Expr>(S)).getValue();
 
   case Stmt::ReturnStmtClass: {
     const ReturnStmt *RS = cast<ReturnStmt>(S);
     if (const Expr *RE = RS->getRetValue())
       return getSVal(EnvironmentEntry(RE, LCtx), svalBuilder);
-    return UndefinedVal();        
+    return UndefinedVal();
   }
-    
   // Handle all other Stmt* using a lookup.
   default:
     return lookupExpr(EnvironmentEntry(S, LCtx));
   }
 }
 
 Environment EnvironmentManager::bindExpr(Environment Env,
                                          const EnvironmentEntry &E,

 }
 
 void Environment::print(raw_ostream &Out, const char *NL,
                         const char *Sep) const {
   bool isFirst = true;
 
   for (Environment::iterator I = begin(), E = end(); I != E; ++I) {
     const EnvironmentEntry &En = I.getKey();
-    
     if (isFirst) {
       Out << NL << NL
           << "Expressions:"
-          << NL;      
+          << NL;
       isFirst = false;
     } else {
       Out << NL;
     }
-    
     const Stmt *S = En.getStmt();
     assert(S != nullptr && "Expected non-null Stmt");
 
     Out << " (" << (const void*) En.getLocationContext() << ','
       << (const void*) S << ") ";
     LangOptions LO; // FIXME.
     S->printPretty(Out, nullptr, PrintingPolicy(LO));
     Out << " : " << I.getData();
   }
 }

lib/StaticAnalyzer/Core/ExplodedGraph.cpp

bool ExplodedGraph::shouldCollect(const ExplodedNode *node) {
   //
   // (3) The ProgramPoint is for a PostStmt, but not a PostStore.
   // (4) There is no 'tag' for the ProgramPoint.
   // (5) The 'store' is the same as the predecessor.
   // (6) The 'GDM' is the same as the predecessor.
   // (7) The LocationContext is the same as the predecessor.
   // (8) Expressions that are *not* lvalue expressions.
   // (9) The PostStmt isn't for a non-consumed Stmt or Expr.
-  // (10) The successor is neither a CallExpr StmtPoint nor a CallEnter or 
-  //      PreImplicitCall (so that we would be able to find it when retrying a 
+  // (10) The successor is neither a CallExpr StmtPoint nor a CallEnter or
+  //      PreImplicitCall (so that we would be able to find it when retrying a
   //      call with no inlining).
   // FIXME: It may be safe to reclaim PreCall and PostCall nodes as well.
 
   // Conditions 1 and 2.
   if (node->pred_size() != 1 || node->succ_size() != 1)
     return false;
 
   const ExplodedNode *pred = *(node->pred_begin());
   if (pred->succ_size() != 1)
     return false;
-  
   const ExplodedNode *succ = *(node->succ_begin());
   if (succ->pred_size() != 1)
     return false;
 
   // Now reclaim any nodes that are (by definition) not essential to
   // analysis history and are not consulted by any client code.
   ProgramPoint progPoint = node->getLocation();
   if (progPoint.getAs<PreStmtPurgeDeadSymbols>())
     return !progPoint.getTag();
 
   // Condition 3.
   if (!progPoint.getAs<PostStmt>() || progPoint.getAs<PostStore>())
     return false;
 
   // Condition 4.
   if (progPoint.getTag())
     return false;
 
   // Conditions 5, 6, and 7.
   ProgramStateRef state = node->getState();
-  ProgramStateRef pred_state = pred->getState();    
+  ProgramStateRef pred_state = pred->getState();
   if (state->store != pred_state->store || state->GDM != pred_state->GDM ||
       progPoint.getLocationContext() != pred->getLocationContext())
     return false;
 
   // All further checks require expressions. As per #3, we know that we have
   // a PostStmt.
   const Expr *Ex = dyn_cast<Expr>(progPoint.castAs<PostStmt>().getStmt());
   if (!Ex)
void ExplodedGraph::collectNode(ExplodedNode *node) {
   assert(node->pred_size() == 1 || node->succ_size() == 1);
   ExplodedNode *pred = *(node->pred_begin());
   ExplodedNode *succ = *(node->succ_begin());
   pred->replaceSuccessor(succ);
   succ->replacePredecessor(pred);
   FreeNodes.push_back(node);
   Nodes.RemoveNode(node);
   --NumNodes;
-  node->~ExplodedNode();  
+  node->~ExplodedNode();
 }
 
 void ExplodedGraph::reclaimRecentlyAllocatedNodes() {
   if (ChangedNodes.empty())
     return;
 
   // Only periodically reclaim nodes so that we can build up a set of
   // nodes that meet the reclamation criteria.  Freshly created nodes

lib/StaticAnalyzer/Core/ExprEngine.cpp

if (!MD->isStatic()) {
         SVal V = state->getSVal(L);
         if (Optional<Loc> LV = V.getAs<Loc>()) {
           state = state->assume(*LV, true);
           assert(state && "'this' cannot be null");
         }
       }
     }
   }
-    
   return state;
 }
 
 ProgramStateRef
 ExprEngine::createTemporaryRegionIfNeeded(ProgramStateRef State,
                                           const LocationContext *LC,
                                           const Expr *Ex,
                                           const Expr *Result) {
ProgramStateRef ExprEngine::processAssume(ProgramStateRef state,
                                               SVal cond, bool assumption) {
   return getCheckerManager().runCheckersForEvalAssume(state, cond, assumption);
 }
 
 bool ExprEngine::wantsRegionChangeUpdate(ProgramStateRef state) {
   return getCheckerManager().wantsRegionChangeUpdate(state);
 }
 
-ProgramStateRef 
+ProgramStateRef
 ExprEngine::processRegionChanges(ProgramStateRef state,
                                  const InvalidatedSymbols *invalidated,
                                  ArrayRef<const MemRegion *> Explicits,
                                  ArrayRef<const MemRegion *> Regions,
                                  const CallEvent *Call) {
   return getCheckerManager().runCheckersForRegionChanges(state, invalidated,
                                                       Explicits, Regions, Call);
 }
case CFGElement::TemporaryDtor:
       return;
   }
 }
 
 static bool shouldRemoveDeadBindings(AnalysisManager &AMgr,
                                      const CFGStmt S,
                                      const ExplodedNode *Pred,
                                      const LocationContext *LC) {
-  
   // Are we never purging state values?
   if (AMgr.options.AnalysisPurgeOpt == PurgeNone)
     return false;
 
   // Is this the beginning of a basic block?
   if (Pred->getLocation().getAs<BlockEntrance>())
     return true;
 
   // Is this on a non-expression?
   if (!isa<Expr>(S.getStmt()))
     return true;
-    
   // Run before processing a call.
   if (CallEvent::isCallStmt(S.getStmt()))
     return true;
 
   // Is this an expression that is consumed by another expression?  If so,
   // postpone cleaning out the state.
   ParentMap &PM = LC->getAnalysisDeclContext()->getParentMap();
   return !PM.isConsumedExpr(cast<Expr>(S.getStmt()));
if (!isa<CXXConstructExpr>(Init)) {
         }
       } else {
         InitVal = State->getSVal(BMI->getInit(), stackFrame);
       }
 
       assert(Tmp.size() == 1 && "have not generated any new nodes yet");
       assert(*Tmp.begin() == Pred && "have not generated any new nodes yet");
       Tmp.clear();
-      
       PostInitializer PP(BMI, FieldLoc.getAsRegion(), stackFrame);
       evalBind(Tmp, Init, Pred, FieldLoc, InitVal, /*isInit=*/true, &PP);
     }
   } else {
     assert(BMI->isBaseInitializer() || BMI->isDelegatingInitializer());
     // We already did all the work when visiting the CXXConstructExpr.
   }
 
switch (S->getStmtClass()) {
     case Stmt::SEHExceptStmtClass:
     case Stmt::SEHLeaveStmtClass:
     case Stmt::LambdaExprClass:
     case Stmt::SEHFinallyStmtClass: {
       const ExplodedNode *node = Bldr.generateSink(S, Pred, Pred->getState());
       Engine.addAbortedBlock(node, currBldrCtx->getBlock());
       break;
     }
-    
     case Stmt::ParenExprClass:
       llvm_unreachable("ParenExprs already handled.");
     case Stmt::GenericSelectionExprClass:
       llvm_unreachable("GenericSelectionExprs already handled.");
     // Cases that should never be evaluated simply because they shouldn't
     // appear in the CFG.
     case Stmt::BreakStmtClass:
     case Stmt::CaseStmtClass:
switch (S->getStmtClass()) {
     case Stmt::CXXStdInitializerListExprClass:
     case Expr::ObjCArrayLiteralClass:
     case Expr::ObjCDictionaryLiteralClass:
     case Expr::ObjCBoxedExprClass: {
       Bldr.takeNodes(Pred);
 
       ExplodedNodeSet preVisit;
       getCheckerManager().runCheckersForPreStmt(preVisit, Pred, S, *this);
-      
       ExplodedNodeSet Tmp;
       StmtNodeBuilder Bldr2(preVisit, Tmp, *currBldrCtx);
 
       const Expr *Ex = cast<Expr>(S);
       QualType resultType = Ex->getType();
 
       for (ExplodedNodeSet::iterator it = preVisit.begin(), et = preVisit.end();
-           it != et; ++it) {      
+           it != et; ++it) {
         ExplodedNode *N = *it;
         const LocationContext *LCtx = N->getLocationContext();
         SVal result = svalBuilder.conjureSymbolVal(nullptr, Ex, LCtx,
                                                    resultType,
                                                    currBldrCtx->blockCount());
         ProgramStateRef state = N->getState()->BindExpr(Ex, LCtx, result);
         Bldr2.generateNode(S, N, state);
       }
-      
       getCheckerManager().runCheckersForPostStmt(Dst, Tmp, S, *this);
       Bldr.addNodes(Dst);
-      break;      
+      break;
     }
 
     case Stmt::ArraySubscriptExprClass:
       Bldr.takeNodes(Pred);
       VisitLvalArraySubscriptExpr(cast<ArraySubscriptExpr>(S), Pred, Dst);
       Bldr.addNodes(Dst);
       break;
 
case Stmt::BinaryOperatorClass: {
         Bldr.generateNode(B, Pred,
                           state->BindExpr(B, Pred->getLocationContext(),
                                           state->getSVal(B->getRHS(),
                                                   Pred->getLocationContext())));
         break;
       }
 
       Bldr.takeNodes(Pred);
-      
       if (AMgr.options.eagerlyAssumeBinOpBifurcation &&
           (B->isRelationalOp() || B->isEqualityOp())) {
         ExplodedNodeSet Tmp;
         VisitBinaryOperator(cast<BinaryOperator>(S), Pred, Tmp);
         evalEagerlyAssumeBinOpBifurcation(Dst, Tmp, cast<Expr>(S));
       }
       else
         VisitBinaryOperator(cast<BinaryOperator>(S), Pred, Dst);
switch (S->getStmtClass()) {
     case Stmt::CallExprClass:
     case Stmt::CXXMemberCallExprClass:
     case Stmt::UserDefinedLiteralClass: {
       Bldr.takeNodes(Pred);
       VisitCallExpr(cast<CallExpr>(S), Pred, Dst);
       Bldr.addNodes(Dst);
       break;
     }
-    
     case Stmt::CXXCatchStmtClass: {
       Bldr.takeNodes(Pred);
       VisitCXXCatchStmt(cast<CXXCatchStmt>(S), Pred, Dst);
       Bldr.addNodes(Dst);
       break;
     }
 
     case Stmt::CXXTemporaryObjectExprClass:
-    case Stmt::CXXConstructExprClass: {      
+    case Stmt::CXXConstructExprClass: {
       Bldr.takeNodes(Pred);
       VisitCXXConstructExpr(cast<CXXConstructExpr>(S), Pred, Dst);
       Bldr.addNodes(Dst);
       break;
     }
 
     case Stmt::CXXNewExprClass: {
       Bldr.takeNodes(Pred);
       ExplodedNodeSet PostVisit;
       VisitCXXNewExpr(cast<CXXNewExpr>(S), Pred, PostVisit);
       getCheckerManager().runCheckersForPostStmt(Dst, PostVisit, S, *this);
       Bldr.addNodes(Dst);
       break;
     }
 
     case Stmt::CXXDeleteExprClass: {
       Bldr.takeNodes(Pred);
       ExplodedNodeSet PreVisit;
       const CXXDeleteExpr *CDE = cast<CXXDeleteExpr>(S);
       getCheckerManager().runCheckersForPreStmt(PreVisit, Pred, S, *this);
 
-      for (ExplodedNodeSet::iterator i = PreVisit.begin(), 
+      for (ExplodedNodeSet::iterator i = PreVisit.begin(),
                                      e = PreVisit.end(); i != e ; ++i)
         VisitCXXDeleteExpr(CDE, *i, Dst);
 
       Bldr.addNodes(Dst);
       break;
     }
       // FIXME: ChooseExpr is really a constant.  We need to fix
       //        the CFG do not model them as explicit control-flow.
case Stmt::DeclStmtClass:
       break;
 
     case Stmt::ImplicitCastExprClass:
     case Stmt::CStyleCastExprClass:
     case Stmt::CXXStaticCastExprClass:
     case Stmt::CXXDynamicCastExprClass:
     case Stmt::CXXReinterpretCastExprClass:
     case Stmt::CXXConstCastExprClass:
-    case Stmt::CXXFunctionalCastExprClass: 
+    case Stmt::CXXFunctionalCastExprClass:
     case Stmt::ObjCBridgedCastExprClass: {
       Bldr.takeNodes(Pred);
       const CastExpr *C = cast<CastExpr>(S);
       // Handle the previsit checks.
       ExplodedNodeSet dstPrevisit;
       getCheckerManager().runCheckersForPreStmt(dstPrevisit, Pred, C, *this);
-      
       // Handle the expression itself.
       ExplodedNodeSet dstExpr;
       for (ExplodedNodeSet::iterator i = dstPrevisit.begin(),
-                                     e = dstPrevisit.end(); i != e ; ++i) { 
+                                     e = dstPrevisit.end(); i != e ; ++i) {
         VisitCast(C, C->getSubExpr(), *i, dstExpr);
       }
 
       // Handle the postvisit checks.
       getCheckerManager().runCheckersForPostStmt(Dst, dstExpr, C, *this);
       Bldr.addNodes(Dst);
       break;
     }
 
     case Expr::MaterializeTemporaryExprClass: {
       Bldr.takeNodes(Pred);
       const MaterializeTemporaryExpr *MTE = cast<MaterializeTemporaryExpr>(S);
       CreateCXXTemporaryObject(MTE, Pred, Dst);
       Bldr.addNodes(Dst);
       break;
     }
-      
     case Stmt::InitListExprClass:
       Bldr.takeNodes(Pred);
       VisitInitListExpr(cast<InitListExpr>(S), Pred, Dst);
       Bldr.addNodes(Dst);
       break;
 
     case Stmt::MemberExprClass:
       Bldr.takeNodes(Pred);
case Stmt::UnaryOperatorClass: {
       Bldr.addNodes(Dst);
       break;
     }
 
     case Stmt::PseudoObjectExprClass: {
       Bldr.takeNodes(Pred);
       ProgramStateRef state = Pred->getState();
       const PseudoObjectExpr *PE = cast<PseudoObjectExpr>(S);
-      if (const Expr *Result = PE->getResultExpr()) { 
+      if (const Expr *Result = PE->getResultExpr()) {
         SVal V = state->getSVal(Result, Pred->getLocationContext());
         Bldr.generateNode(S, Pred,
                           state->BindExpr(S, Pred->getLocationContext(), V));
       }
       else
         Bldr.generateNode(S, Pred,
                           state->BindExpr(S, Pred->getLocationContext(),
                                                    UnknownVal()));
bool ExprEngine::replayWithoutInlining(ExplodedNode *N,
   Engine.enqueueStmtNode(NewNode, CalleeSF->getCallSiteBlock(),
                                   CalleeSF->getIndex());
   NumTimesRetriedWithoutInlining++;
   return true;
 }
 
 /// Block entrance.  (Update counters).
 void ExprEngine::processCFGBlockEntrance(const BlockEdge &L,
-                                         NodeBuilderWithSinks &nodeBuilder, 
+                                         NodeBuilderWithSinks &nodeBuilder,
                                          ExplodedNode *Pred) {
   PrettyStackTraceLocationContext CrashInfo(Pred->getLocationContext());
 
   // FIXME: Refactor this into a checker.
   if (nodeBuilder.getContext().blockCount() >= AMgr.options.maxBlockVisitOnPath) {
     static SimpleProgramPointTag tag(TagProviderName, "Block count exceeded");
     const ExplodedNode *Sink =
                    nodeBuilder.generateSink(Pred->getState(), Pred, &tag);
if (X.isUnknownOrUndef()) {
                                                getContext());
 
           if (!recovered.isUnknown()) {
             X = recovered;
           }
         }
       }
     }
-    
     // If the condition is still unknown, give up.
     if (X.isUnknownOrUndef()) {
       builder.generateNode(PrevState, true, PredI);
       builder.generateNode(PrevState, false, PredI);
       continue;
     }
 
     DefinedSVal V = X.castAs<DefinedSVal>();
if (CondV_untested.isUndef()) {
     // FIXME: add checker
     //UndefBranches.insert(N);
 
     return;
   }
   DefinedOrUnknownSVal CondV = CondV_untested.castAs<DefinedOrUnknownSVal>();
 
   ProgramStateRef DefaultSt = state;
-  
   iterator I = builder.begin(), EI = builder.end();
   bool defaultIsFeasible = I == EI;
 
   for ( ; I != EI; ++I) {
     // Successor may be pruned out during CFG construction.
     if (!I.getBlock())
       continue;
-    
     const CaseStmt *Case = I.getCase();
 
     // Evaluate the LHS of the case value.
     llvm::APSInt V1 = Case->getLHS()->EvaluateKnownConstInt(getContext());
     assert(V1.getBitWidth() == getContext().getTypeSize(CondE->getType()));
 
     // Get the RHS of the case, if it exists.
     llvm::APSInt V2;
void ExprEngine::VisitCommonDeclRefExpr(const Expr *Ex, const NamedDecl *D,
                                         ExplodedNodeSet &Dst) {
   StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
 
   ProgramStateRef state = Pred->getState();
   const LocationContext *LCtx = Pred->getLocationContext();
 
   if (const VarDecl *VD = dyn_cast<VarDecl>(D)) {
     // C permits "extern void v", and if you cast the address to a valid type,
-    // you can even do things with it. We simply pretend 
+    // you can even do things with it. We simply pretend
     assert(Ex->isGLValue() || VD->getType()->isVoidType());
     SVal V = state->getLValue(VD, Pred->getLocationContext());
 
     // For references, the 'lvalue' is the pointer address stored in the
     // reference region.
     if (VD->getType()->isReferenceType()) {
       if (const MemRegion *R = V.getAsRegion())
         V = state->getSVal(R);

 
 /// VisitArraySubscriptExpr - Transfer function for array accesses
 void ExprEngine::VisitLvalArraySubscriptExpr(const ArraySubscriptExpr *A,
                                              ExplodedNode *Pred,
                                              ExplodedNodeSet &Dst){
 
   const Expr *Base = A->getBase()->IgnoreParens();
   const Expr *Idx  = A->getIdx()->IgnoreParens();
-  
 
   ExplodedNodeSet checkerPreStmt;
   getCheckerManager().runCheckersForPreStmt(checkerPreStmt, Pred, A, *this);
 
   StmtNodeBuilder Bldr(checkerPreStmt, Dst, *currBldrCtx);
   assert(A->isGLValue() ||
           (!AMgr.getLangOpts().CPlusPlus &&
            A->getType().isCForbiddenLValueType()));
State = getCheckerManager().runCheckersForPointerEscape(State,
                                                           EscapedSymbols,
                                                           /*CallEvent*/ nullptr,
                                                           PSK_EscapeOnBind,
                                                           nullptr);
 
   return State;
 }
 
-ProgramStateRef 
+ProgramStateRef
 ExprEngine::notifyCheckersOfPointerEscape(ProgramStateRef State,
     const InvalidatedSymbols *Invalidated,
     ArrayRef<const MemRegion *> ExplicitRegions,
     ArrayRef<const MemRegion *> Regions,
     const CallEvent *Call,
     RegionAndSymbolInvalidationTraits &ITraits) {
-  
   if (!Invalidated || Invalidated->empty())
     return State;
 
   if (!Call)
     return getCheckerManager().runCheckersForPointerEscape(State,
                                                            *Invalidated,
                                                            nullptr,
                                                            PSK_EscapeOther,
                                                            &ITraits);
 
-  // If the symbols were invalidated by a call, we want to find out which ones 
+  // If the symbols were invalidated by a call, we want to find out which ones
   // were invalidated directly due to being arguments to the call.
   InvalidatedSymbols SymbolsDirectlyInvalidated;
   for (ArrayRef<const MemRegion *>::iterator I = ExplicitRegions.begin(),
       E = ExplicitRegions.end(); I != E; ++I) {
     if (const SymbolicRegion *R = (*I)->StripCasts()->getAs<SymbolicRegion>())
       SymbolsDirectlyInvalidated.insert(R->getSymbol());
   }
 
void ExprEngine::evalBind(ExplodedNodeSet &Dst, const Stmt *StoreE,
   if (!location.getAs<Loc>()) {
     const ProgramPoint L = PostStore(StoreE, LC, /*Loc*/nullptr,
                                      /*tag*/nullptr);
     ProgramStateRef state = Pred->getState();
     state = processPointerEscapedOnBind(state, location, Val);
     Bldr.generateNode(L, state, Pred);
     return;
   }
-  
 
   for (ExplodedNodeSet::iterator I = CheckedSet.begin(), E = CheckedSet.end();
        I!=E; ++I) {
     ExplodedNode *PredI = *I;
     ProgramStateRef state = PredI->getState();
-    
     state = processPointerEscapedOnBind(state, location, Val);
 
     // When binding the value, pass on the hint that this is a initialization.
     // For initializations, we do not need to inform clients of region
     // changes.
     state = state->bindLoc(location.castAs<Loc>(),
                            Val, /* notifyChanges = */ !atDeclInit);
 
if (Pred->getState() != state) {
     // Associate this new state with an ExplodedNode.
     // FIXME: If I pass null tag, the graph is incorrect, e.g for
     //   int *p;
     //   p = 0;
     //   *p = 0xDEADBEEF;
     // "p = 0" is not noted as "Null pointer value stored to 'p'" but
     // instead "int *p" is noted as
     // "Variable 'p' initialized to a null pointer value"
-    
     static SimpleProgramPointTag tag(TagProviderName, "Location");
     Bldr.generateNode(NodeEx, Pred, state, &tag);
   }
   ExplodedNodeSet Tmp;
   getCheckerManager().runCheckersForLocation(Tmp, Src, location, isLoad,
                                              NodeEx, BoundEx, *this);
   BldrTop.addNodes(Tmp);
 }
 
 std::pair<const ProgramPointTag *, const ProgramPointTag*>
 ExprEngine::geteagerlyAssumeBinOpBifurcationTags() {
   static SimpleProgramPointTag
          eagerlyAssumeBinOpBifurcationTrue(TagProviderName,
                                            "Eagerly Assume True"),
          eagerlyAssumeBinOpBifurcationFalse(TagProviderName,
                                             "Eagerly Assume False");
   return std::make_pair(&eagerlyAssumeBinOpBifurcationTrue,
                         &eagerlyAssumeBinOpBifurcationFalse);
 }
 
 void ExprEngine::evalEagerlyAssumeBinOpBifurcation(ExplodedNodeSet &Dst,
                                                    ExplodedNodeSet &Src,
                                                    const Expr *Ex) {
   StmtNodeBuilder Bldr(Src, Dst, *currBldrCtx);
-  
   for (ExplodedNodeSet::iterator I=Src.begin(), E=Src.end(); I!=E; ++I) {
     ExplodedNode *Pred = *I;
     // Test if the previous node was as the same expression.  This can happen
     // when the expression fails to evaluate to anything meaningful and
     // (as an optimization) we don't generate a node.
     ProgramPoint P = Pred->getLocation();
     if (!P.getAs<PostStmt>() || P.castAs<PostStmt>().getStmt() != Ex) {
       continue;
     }
 
     ProgramStateRef state = Pred->getState();
     SVal V = state->getSVal(Ex, Pred->getLocationContext());
     Optional<nonloc::SymbolVal> SEV = V.getAs<nonloc::SymbolVal>();
     if (SEV && SEV->isExpression()) {
       const std::pair<const ProgramPointTag *, const ProgramPointTag*> &tags =
         geteagerlyAssumeBinOpBifurcationTags();
 
       ProgramStateRef StateTrue, StateFalse;
       std::tie(StateTrue, StateFalse) = state->assume(*SEV);
 
       // First assume that the condition is true.
       if (StateTrue) {
-        SVal Val = svalBuilder.makeIntVal(1U, Ex->getType());        
+        SVal Val = svalBuilder.makeIntVal(1U, Ex->getType());
         StateTrue = StateTrue->BindExpr(Ex, Pred->getLocationContext(), Val);
         Bldr.generateNode(Ex, Pred, StateTrue, tags.first);
       }
 
       // Next, assume that the condition is false.
       if (StateFalse) {
         SVal Val = svalBuilder.makeIntVal(0U, Ex->getType());
         StateFalse = StateFalse->BindExpr(Ex, Pred->getLocationContext(), Val);
#endif
       }
     }
 
     ProgramStateRef state = N->getState();
     Out << "\\|StateID: " << (const void*) state.get()
         << " NodeID: " << (const void*) N << "\\|";
     state->printDOT(Out);
 
-    Out << "\\l";    
+    Out << "\\l";
 
     if (const ProgramPointTag *tag = Loc.getTag()) {
-      Out << "\\|Tag: " << tag->getTagDescription(); 
+      Out << "\\|Tag: " << tag->getTagDescription();
       Out << "\\l";
     }
     return Out.str();
   }
 };
 } // end llvm namespace
 #endif
 

lib/StaticAnalyzer/Core/ExprEngineC.cpp

 using llvm::APSInt;
 
 void ExprEngine::VisitBinaryOperator(const BinaryOperator* B,
                                      ExplodedNode *Pred,
                                      ExplodedNodeSet &Dst) {
 
   Expr *LHS = B->getLHS()->IgnoreParens();
   Expr *RHS = B->getRHS()->IgnoreParens();
-  
   // FIXME: Prechecks eventually go in ::Visit().
   ExplodedNodeSet CheckedSet;
   ExplodedNodeSet Tmp2;
   getCheckerManager().runCheckersForPreStmt(CheckedSet, Pred, B, *this);
-    
   // With both the LHS and RHS evaluated, process the operation itself.
   for (ExplodedNodeSet::iterator it=CheckedSet.begin(), ei=CheckedSet.end();
          it != ei; ++it) {
-      
     ProgramStateRef state = (*it)->getState();
     const LocationContext *LCtx = (*it)->getLocationContext();
     SVal LeftV = state->getSVal(LHS, LCtx);
     SVal RightV = state->getSVal(RHS, LCtx);
-      
     BinaryOperator::Opcode Op = B->getOpcode();
-      
     if (Op == BO_Assign) {
       // EXPERIMENTAL: "Conjured" symbols.
       // FIXME: Handle structs.
       if (RightV.isUnknown()) {
         unsigned Count = currBldrCtx->blockCount();
         RightV = svalBuilder.conjureSymbolVal(nullptr, B->getRHS(), LCtx,
                                               Count);
       }
       // Simulate the effects of a "store":  bind the value of the RHS
       // to the L-Value represented by the LHS.
       SVal ExprVal = B->isGLValue() ? LeftV : RightV;
       evalStore(Tmp2, B, LHS, *it, state->BindExpr(B, LCtx, ExprVal),
                 LeftV, RightV);
       continue;
     }
-      
     if (!B->isAssignmentOp()) {
       StmtNodeBuilder Bldr(*it, Tmp2, *currBldrCtx);
 
       if (B->isAdditiveOp()) {
         // If one of the operands is a location, conjure a symbol for the other
         // one (offset) if it's unknown so that memory arithmetic always
         // results in an ElementRegion.
         // TODO: This can be removed after we enable history tracking with
if (!B->isAssignmentOp()) {
       // Although we don't yet model pointers-to-members, we do need to make
       // sure that the members of temporaries have a valid 'this' pointer for
       // other checks.
       if (B->getOpcode() == BO_PtrMemD)
         state = createTemporaryRegionIfNeeded(state, LCtx, LHS);
 
       // Process non-assignments except commas or short-circuited
       // logical expressions (LAnd and LOr).
-      SVal Result = evalBinOp(state, Op, LeftV, RightV, B->getType());      
+      SVal Result = evalBinOp(state, Op, LeftV, RightV, B->getType());
       if (Result.isUnknown()) {
         Bldr.generateNode(B, *it, state);
         continue;
-      }        
+      }
 
-      state = state->BindExpr(B, LCtx, Result);      
+      state = state->BindExpr(B, LCtx, Result);
       Bldr.generateNode(B, *it, state);
       continue;
     }
-      
     assert (B->isCompoundAssignmentOp());
-    
     switch (Op) {
       default:
         llvm_unreachable("Invalid opcode for compound assignment.");
       case BO_MulAssign: Op = BO_Mul; break;
       case BO_DivAssign: Op = BO_Div; break;
       case BO_RemAssign: Op = BO_Rem; break;
       case BO_AddAssign: Op = BO_Add; break;
       case BO_SubAssign: Op = BO_Sub; break;
       case BO_ShlAssign: Op = BO_Shl; break;
       case BO_ShrAssign: Op = BO_Shr; break;
       case BO_AndAssign: Op = BO_And; break;
       case BO_XorAssign: Op = BO_Xor; break;
       case BO_OrAssign:  Op = BO_Or;  break;
     }
-      
     // Perform a load (the LHS).  This performs the checks for
     // null dereferences, and so on.
     ExplodedNodeSet Tmp;
     SVal location = LeftV;
     evalLoad(Tmp, B, LHS, *it, state, location);
-    
     for (ExplodedNodeSet::iterator I = Tmp.begin(), E = Tmp.end(); I != E;
          ++I) {
 
       state = (*I)->getState();
       const LocationContext *LCtx = (*I)->getLocationContext();
       SVal V = state->getSVal(LHS, LCtx);
-      
       // Get the computation type.
       QualType CTy =
         cast<CompoundAssignOperator>(B)->getComputationResultType();
       CTy = getContext().getCanonicalType(CTy);
-      
       QualType CLHSTy =
         cast<CompoundAssignOperator>(B)->getComputationLHSType();
       CLHSTy = getContext().getCanonicalType(CLHSTy);
-      
       QualType LTy = getContext().getCanonicalType(LHS->getType());
-      
       // Promote LHS.
       V = svalBuilder.evalCast(V, CLHSTy, LTy);
-      
       // Compute the result of the operation.
       SVal Result = svalBuilder.evalCast(evalBinOp(state, Op, V, RightV, CTy),
                                          B->getType(), CTy);
-      
       // EXPERIMENTAL: "Conjured" symbols.
       // FIXME: Handle structs.
-      
       SVal LHSVal;
-      
       if (Result.isUnknown()) {
         // The symbolic value is actually for the type of the left-hand side
         // expression, not the computation type, as this is the value the
         // LValue on the LHS will bind to.
         LHSVal = svalBuilder.conjureSymbolVal(nullptr, B->getRHS(), LCtx, LTy,
                                               currBldrCtx->blockCount());
         // However, we need to convert the symbol to the computation type.
         Result = svalBuilder.evalCast(LHSVal, CTy, LTy);
       }
       else {
         // The left-hand side may bind to a different value then the
         // computation type.
         LHSVal = svalBuilder.evalCast(Result, LTy, CTy);
       }
-      
-      // In C++, assignment and compound assignment operators return an 
+      // In C++, assignment and compound assignment operators return an
       // lvalue.
       if (B->isGLValue())
         state = state->BindExpr(B, LCtx, location);
       else
         state = state->BindExpr(B, LCtx, Result);
-      
       evalStore(Tmp2, B, LHS, *I, state, location, LHSVal);
     }
   }
-  
   // FIXME: postvisits eventually go in ::Visit()
   getCheckerManager().runCheckersForPostStmt(Dst, Tmp2, B, *this);
 }
 
 void ExprEngine::VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred,
                                 ExplodedNodeSet &Dst) {
-  
   CanQualType T = getContext().getCanonicalType(BE->getType());
 
   // Get the value of the block itself.
   SVal V = svalBuilder.getBlockPointer(BE->getBlockDecl(), T,
                                        Pred->getLocationContext(),
                                        currBldrCtx->blockCount());
-  
   ProgramStateRef State = Pred->getState();
-  
   // If we created a new MemRegion for the block, we should explicitly bind
   // the captured variables.
   if (const BlockDataRegion *BDR =
       dyn_cast_or_null<BlockDataRegion>(V.getAsRegion())) {
-    
     BlockDataRegion::referenced_vars_iterator I = BDR->referenced_vars_begin(),
                                               E = BDR->referenced_vars_end();
-    
     for (; I != E; ++I) {
       const MemRegion *capturedR = I.getCapturedRegion();
       const MemRegion *originalR = I.getOriginalRegion();
       if (capturedR != originalR) {
         SVal originalV = State->getSVal(loc::MemRegionVal(originalR));
         State = State->bindLoc(loc::MemRegionVal(capturedR), originalV);
       }
     }
   }
-  
   ExplodedNodeSet Tmp;
   StmtNodeBuilder Bldr(Pred, Tmp, *currBldrCtx);
   Bldr.generateNode(BE, Pred,
                     State->BindExpr(BE, Pred->getLocationContext(), V),
                     nullptr, ProgramPoint::PostLValueKind);
 
   // FIXME: Move all post/pre visits to ::Visit().
   getCheckerManager().runCheckersForPostStmt(Dst, Tmp, BE, *this);
 }
 
-void ExprEngine::VisitCast(const CastExpr *CastE, const Expr *Ex, 
+void ExprEngine::VisitCast(const CastExpr *CastE, const Expr *Ex,
                            ExplodedNode *Pred, ExplodedNodeSet &Dst) {
-  
   ExplodedNodeSet dstPreStmt;
   getCheckerManager().runCheckersForPreStmt(dstPreStmt, Pred, CastE, *this);
-  
   if (CastE->getCastKind() == CK_LValueToRValue) {
     for (ExplodedNodeSet::iterator I = dstPreStmt.begin(), E = dstPreStmt.end();
          I!=E; ++I) {
       ExplodedNode *subExprNode = *I;
       ProgramStateRef state = subExprNode->getState();
       const LocationContext *LCtx = subExprNode->getLocationContext();
       evalLoad(Dst, CastE, CastE, subExprNode, state, state->getSVal(Ex, LCtx));
     }
     return;
   }
-  
-  // All other casts.  
+  // All other casts.
   QualType T = CastE->getType();
   QualType ExTy = Ex->getType();
-  
   if (const ExplicitCastExpr *ExCast=dyn_cast_or_null<ExplicitCastExpr>(CastE))
     T = ExCast->getTypeAsWritten();
-  
   StmtNodeBuilder Bldr(dstPreStmt, Dst, *currBldrCtx);
   for (ExplodedNodeSet::iterator I = dstPreStmt.begin(), E = dstPreStmt.end();
        I != E; ++I) {
-    
     Pred = *I;
     ProgramStateRef state = Pred->getState();
     const LocationContext *LCtx = Pred->getLocationContext();
 
     switch (CastE->getCastKind()) {
       case CK_LValueToRValue:
         llvm_unreachable("LValueToRValue casts handled earlier.");
       case CK_ToVoid:
switch (CastE->getCastKind()) {
       case CK_FloatingComplexToIntegralComplex:
       case CK_IntegralRealToComplex:
       case CK_IntegralComplexToReal:
       case CK_IntegralComplexToBoolean:
       case CK_IntegralComplexCast:
       case CK_IntegralComplexToFloatingComplex:
       case CK_CPointerToObjCPointerCast:
       case CK_BlockPointerToObjCPointerCast:
-      case CK_AnyPointerToBlockPointerCast:  
-      case CK_ObjCObjectLValueCast: 
+      case CK_AnyPointerToBlockPointerCast:
+      case CK_ObjCObjectLValueCast:
       case CK_ZeroToOCLEvent:
       case CK_LValueBitCast: {
         // Delegate to SValBuilder to process.
         SVal V = state->getSVal(Ex, LCtx);
         V = svalBuilder.evalCast(V, T, ExTy);
         state = state->BindExpr(CastE, LCtx, V);
         Bldr.generateNode(CastE, Pred, state);
         continue;
switch (CastE->getCastKind()) {
           }
         } else {
           // If we don't know if the cast succeeded, conjure a new symbol.
           if (val.isUnknown()) {
             DefinedOrUnknownSVal NewSym =
               svalBuilder.conjureSymbolVal(nullptr, CastE, LCtx, resultType,
                                            currBldrCtx->blockCount());
             state = state->BindExpr(CastE, LCtx, NewSym);
-          } else 
+          } else
             // Else, bind to the derived region value.
             state = state->BindExpr(CastE, LCtx, val);
         }
         Bldr.generateNode(CastE, Pred, state);
         continue;
       }
       case CK_NullToMemberPointer: {
         // FIXME: For now, member pointers are represented by void *.
void ExprEngine::VisitCompoundLiteralExpr(const CompoundLiteralExpr *CL,
                                           ExplodedNodeSet &Dst) {
   StmtNodeBuilder B(Pred, Dst, *currBldrCtx);
 
   ProgramStateRef State = Pred->getState();
   const LocationContext *LCtx = Pred->getLocationContext();
 
   const Expr *Init = CL->getInitializer();
   SVal V = State->getSVal(CL->getInitializer(), LCtx);
-  
   if (isa<CXXConstructExpr>(Init)) {
     // No work needed. Just pass the value up to this expression.
   } else {
     assert(isa<InitListExpr>(Init));
     Loc CLLoc = State->getLValue(CL, LCtx);
     State = State->bindLoc(CLLoc, V);
 
     // Compound literal expressions are a GNU extension in C++.
void ExprEngine::VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred,
   // Assumption: The CFG has one DeclStmt per Decl.
   const VarDecl *VD = dyn_cast_or_null<VarDecl>(*DS->decl_begin());
 
   if (!VD) {
     //TODO:AZ: remove explicit insertion after refactoring is done.
     Dst.insert(Pred);
     return;
   }
-  
   // FIXME: all pre/post visits should eventually be handled by ::Visit().
   ExplodedNodeSet dstPreVisit;
   getCheckerManager().runCheckersForPreStmt(dstPreVisit, Pred, DS, *this);
-  
   ExplodedNodeSet dstEvaluated;
   StmtNodeBuilder B(dstPreVisit, dstEvaluated, *currBldrCtx);
   for (ExplodedNodeSet::iterator I = dstPreVisit.begin(), E = dstPreVisit.end();
        I!=E; ++I) {
     ExplodedNode *N = *I;
     ProgramStateRef state = N->getState();
     const LocationContext *LC = N->getLocationContext();
 
if (const Expr *InitEx = VD->getInit()) {
         if (AMgr.getLangOpts().CPlusPlus && VD->getType()->isRecordType() &&
             !VD->getType()->isReferenceType()) {
           if (Optional<loc::MemRegionVal> M =
                   InitVal.getAs<loc::MemRegionVal>()) {
             InitVal = state->getSVal(M->getRegion());
             assert(InitVal.getAs<nonloc::LazyCompoundVal>());
           }
         }
-        
         // Recover some path-sensitivity if a scalar value evaluated to
         // UnknownVal.
         if (InitVal.isUnknown()) {
           QualType Ty = InitEx->getType();
           if (InitEx->isGLValue()) {
             Ty = getContext().getPointerType(Ty);
           }
 
void ExprEngine::VisitInitListExpr(const InitListExpr *IE,
   const LocationContext *LCtx = Pred->getLocationContext();
   QualType T = getContext().getCanonicalType(IE->getType());
   unsigned NumInitElements = IE->getNumInits();
 
   if (!IE->isGLValue() &&
       (T->isArrayType() || T->isRecordType() || T->isVectorType() ||
        T->isAnyComplexType())) {
     llvm::ImmutableList<SVal> vals = getBasicVals().getEmptySValList();
-    
     // Handle base case where the initializer has no elements.
     // e.g: static int* myArray[] = {};
     if (NumInitElements == 0) {
       SVal V = svalBuilder.makeCompoundVal(T, vals);
       B.generateNode(IE, Pred, state->BindExpr(IE, LCtx, V));
       return;
     }
-    
     for (InitListExpr::const_reverse_iterator it = IE->rbegin(),
          ei = IE->rend(); it != ei; ++it) {
       SVal V = state->getSVal(cast<Expr>(*it), LCtx);
       vals = getBasicVals().consVals(V, vals);
     }
-    
     B.generateNode(IE, Pred,
                    state->BindExpr(IE, LCtx,
                                    svalBuilder.makeCompoundVal(T, vals)));
     return;
   }
 
   // Handle scalars: int{5} and int{} and GLvalues.
   // Note, if the InitListExpr is a GLvalue, it means that there is an address
   // representing it, so it must have a single init element.
   assert(NumInitElements <= 1);
 
   SVal V;
   if (NumInitElements == 0)
     V = getSValBuilder().makeZeroVal(T);
   else
     V = state->getSVal(IE->getInit(0), LCtx);
 
   B.generateNode(IE, Pred, state->BindExpr(IE, LCtx, V));
 }
 
 void ExprEngine::VisitGuardedExpr(const Expr *Ex,
-                                  const Expr *L, 
+                                  const Expr *L,
                                   const Expr *R,
                                   ExplodedNode *Pred,
                                   ExplodedNodeSet &Dst) {
   assert(L && R);
 
   StmtNodeBuilder B(Pred, Dst, *currBldrCtx);
   ProgramStateRef state = Pred->getState();
   const LocationContext *LCtx = Pred->getLocationContext();
if (!hasValue)
     V = svalBuilder.conjureSymbolVal(nullptr, Ex, LCtx,
                                      currBldrCtx->blockCount());
 
   // Generate a new node with the binding from the appropriate path.
   B.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V, true));
 }
 
 void ExprEngine::
-VisitOffsetOfExpr(const OffsetOfExpr *OOE, 
+VisitOffsetOfExpr(const OffsetOfExpr *OOE,
                   ExplodedNode *Pred, ExplodedNodeSet &Dst) {
   StmtNodeBuilder B(Pred, Dst, *currBldrCtx);
   APSInt IV;
   if (OOE->EvaluateAsInt(IV, getContext())) {
     assert(IV.getBitWidth() == getContext().getTypeSize(OOE->getType()));
     assert(OOE->getType()->isBuiltinType());
     assert(OOE->getType()->getAs<BuiltinType>()->isInteger());
     assert(IV.isSigned() == OOE->getType()->isSignedIntegerType());
VisitUnaryExprOrTypeTraitExpr(const UnaryExprOrTypeTraitExpr *Ex,
 
   QualType T = Ex->getTypeOfArgument();
 
   for (ExplodedNodeSet::iterator I = CheckedSet.begin(), E = CheckedSet.end();
        I != E; ++I) {
     if (Ex->getKind() == UETT_SizeOf) {
       if (!T->isIncompleteType() && !T->isConstantSizeType()) {
         assert(T->isVariableArrayType() && "Unknown non-constant-sized type.");
-        
         // FIXME: Add support for VLA type arguments and VLA expressions.
         // When that happens, we should probably refactor VLASizeChecker's code.
         continue;
       } else if (T->getAs<ObjCObjectType>()) {
         // Some code tries to take the sizeof an ObjCObjectType, relying that
         // the compiler has laid out its representation.  Just report Unknown
         // for these.
         continue;
       }
     }
-    
     APSInt Value = Ex->EvaluateKnownConstInt(getContext());
     CharUnits amt = CharUnits::fromQuantity(Value.getZExtValue());
-    
     ProgramStateRef state = (*I)->getState();
     state = state->BindExpr(Ex, (*I)->getLocationContext(),
                             svalBuilder.makeIntVal(amt.getQuantity(),
                                                    Ex->getType()));
     Bldr.generateNode(Ex, *I, state);
   }
 
   getCheckerManager().runCheckersForPostStmt(Dst, EvalSet, Ex, *this);
 }
 
-void ExprEngine::VisitUnaryOperator(const UnaryOperator* U, 
+void ExprEngine::VisitUnaryOperator(const UnaryOperator* U,
                                     ExplodedNode *Pred,
                                     ExplodedNodeSet &Dst) {
   // FIXME: Prechecks eventually go in ::Visit().
   ExplodedNodeSet CheckedSet;
   getCheckerManager().runCheckersForPreStmt(CheckedSet, Pred, U, *this);
 
   ExplodedNodeSet EvalSet;
   StmtNodeBuilder Bldr(CheckedSet, EvalSet, *currBldrCtx);
 
   for (ExplodedNodeSet::iterator I = CheckedSet.begin(), E = CheckedSet.end();
        I != E; ++I) {
     switch (U->getOpcode()) {
     default: {
       Bldr.takeNodes(*I);
       ExplodedNodeSet Tmp;
       VisitIncrementDecrementOperator(U, *I, Tmp);
       Bldr.addNodes(Tmp);
       break;
     }
     case UO_Real: {
       const Expr *Ex = U->getSubExpr()->IgnoreParens();
-        
       // FIXME: We don't have complex SValues yet.
       if (Ex->getType()->isAnyComplexType()) {
         // Just report "Unknown."
         break;
       }
-        
       // For all other types, UO_Real is an identity operation.
       assert (U->getType() == Ex->getType());
       ProgramStateRef state = (*I)->getState();
       const LocationContext *LCtx = (*I)->getLocationContext();
       Bldr.generateNode(U, *I, state->BindExpr(U, LCtx,
                                                state->getSVal(Ex, LCtx)));
       break;
     }
-      
-    case UO_Imag: {      
+    case UO_Imag: {
       const Expr *Ex = U->getSubExpr()->IgnoreParens();
       // FIXME: We don't have complex SValues yet.
       if (Ex->getType()->isAnyComplexType()) {
         // Just report "Unknown."
         break;
       }
       // For all other types, UO_Imag returns 0.
       ProgramStateRef state = (*I)->getState();
       const LocationContext *LCtx = (*I)->getLocationContext();
       SVal X = svalBuilder.makeZeroVal(Ex->getType());
       Bldr.generateNode(U, *I, state->BindExpr(U, LCtx, X));
       break;
     }
-      
     case UO_Plus:
       assert(!U->isGLValue());
       // FALL-THROUGH.
     case UO_Deref:
     case UO_AddrOf:
     case UO_Extension: {
       // FIXME: We can probably just have some magic in Environment::getSVal()
       // that propagates values, instead of creating a new node here.
       //
       // Unary "+" is a no-op, similar to a parentheses.  We still have places
       // where it may be a block-level expression, so we need to
       // generate an extra node that just propagates the value of the
-      // subexpression.      
+      // subexpression.
       const Expr *Ex = U->getSubExpr()->IgnoreParens();
       ProgramStateRef state = (*I)->getState();
       const LocationContext *LCtx = (*I)->getLocationContext();
       Bldr.generateNode(U, *I, state->BindExpr(U, LCtx,
                                                state->getSVal(Ex, LCtx)));
       break;
     }
-      
     case UO_LNot:
     case UO_Minus:
     case UO_Not: {
       assert (!U->isGLValue());
       const Expr *Ex = U->getSubExpr()->IgnoreParens();
       ProgramStateRef state = (*I)->getState();
       const LocationContext *LCtx = (*I)->getLocationContext();
-        
       // Get the value of the subexpression.
       SVal V = state->getSVal(Ex, LCtx);
-        
       if (V.isUnknownOrUndef()) {
         Bldr.generateNode(U, *I, state->BindExpr(U, LCtx, V));
         break;
       }
-        
       switch (U->getOpcode()) {
         default:
           llvm_unreachable("Invalid Opcode.");
         case UO_Not:
           // FIXME: Do we need to handle promotions?
           state = state->BindExpr(U, LCtx, evalComplement(V.castAs<NonLoc>()));
           break;
         case UO_Minus:
           // FIXME: Do we need to handle promotions?
           state = state->BindExpr(U, LCtx, evalMinus(V.castAs<NonLoc>()));
           break;
         case UO_LNot:
           // C99 6.5.3.3: "The expression !E is equivalent to (0==E)."
           //
           //  Note: technically we do "E == 0", but this is the same in the
           //    transfer functions as "0 == E".
-          SVal Result;          
+          SVal Result;
           if (Optional<Loc> LV = V.getAs<Loc>()) {
             Loc X = svalBuilder.makeNull();
             Result = evalBinOp(state, BO_EQ, *LV, X, U->getType());
           }
           else if (Ex->getType()->isFloatingType()) {
             // FIXME: handle floating point types.
             Result = UnknownVal();
           } else {
             nonloc::ConcreteInt X(getBasicVals().getValue(0, Ex->getType()));
             Result = evalBinOp(state, BO_EQ, V.castAs<NonLoc>(), X,
                                U->getType());
           }
-          
-          state = state->BindExpr(U, LCtx, Result);          
+          state = state->BindExpr(U, LCtx, Result);
           break;
       }
       Bldr.generateNode(U, *I, state);
       break;
     }
     }
   }
 
   getCheckerManager().runCheckersForPostStmt(Dst, EvalSet, U, *this);
 }
 
 void ExprEngine::VisitIncrementDecrementOperator(const UnaryOperator* U,
                                                  ExplodedNode *Pred,
                                                  ExplodedNodeSet &Dst) {
   // Handle ++ and -- (both pre- and post-increment).
   assert (U->isIncrementDecrementOp());
   const Expr *Ex = U->getSubExpr()->IgnoreParens();
-  
   const LocationContext *LCtx = Pred->getLocationContext();
   ProgramStateRef state = Pred->getState();
   SVal loc = state->getSVal(Ex, LCtx);
-  
   // Perform a load.
   ExplodedNodeSet Tmp;
   evalLoad(Tmp, U, Ex, Pred, state, loc);
-  
   ExplodedNodeSet Dst2;
   StmtNodeBuilder Bldr(Tmp, Dst2, *currBldrCtx);
   for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end();I!=E;++I) {
-    
     state = (*I)->getState();
     assert(LCtx == (*I)->getLocationContext());
     SVal V2_untested = state->getSVal(Ex, LCtx);
-    
     // Propagate unknown and undefined values.
     if (V2_untested.isUnknownOrUndef()) {
       Bldr.generateNode(U, *I, state->BindExpr(U, LCtx, V2_untested));
       continue;
     }
     DefinedSVal V2 = V2_untested.castAs<DefinedSVal>();
-    
     // Handle all other values.
     BinaryOperator::Opcode Op = U->isIncrementOp() ? BO_Add : BO_Sub;
-    
     // If the UnaryOperator has non-location type, use its type to create the
     // constant value. If the UnaryOperator has location type, create the
     // constant with int type and pointer width.
     SVal RHS;
-    
     if (U->getType()->isAnyPointerType())
       RHS = svalBuilder.makeArrayIndex(1);
     else if (U->getType()->isIntegralOrEnumerationType())
       RHS = svalBuilder.makeIntVal(1, U->getType());
     else
       RHS = UnknownVal();
-    
     SVal Result = evalBinOp(state, Op, V2, RHS, U->getType());
-    
     // Conjure a new symbol if necessary to recover precision.
     if (Result.isUnknown()){
       DefinedOrUnknownSVal SymVal =
         svalBuilder.conjureSymbolVal(nullptr, Ex, LCtx,
                                      currBldrCtx->blockCount());
       Result = SymVal;
-      
       // If the value is a location, ++/-- should always preserve
       // non-nullness.  Check if the original value was non-null, and if so
       // propagate that constraint.
       if (Loc::isLocType(U->getType())) {
         DefinedOrUnknownSVal Constraint =
         svalBuilder.evalEQ(state, V2,svalBuilder.makeZeroVal(U->getType()));
-        
         if (!state->assume(Constraint, true)) {
           // It isn't feasible for the original value to be null.
           // Propagate this constraint.
           Constraint = svalBuilder.evalEQ(state, SymVal,
                                        svalBuilder.makeZeroVal(U->getType()));
-          
-          
           state = state->assume(Constraint, false);
           assert(state);
         }
       }
     }
-    
     // Since the lvalue-to-rvalue conversion is explicit in the AST,
     // we bind an l-value if the operator is prefix and an lvalue (in C++).
     if (U->isGLValue())
       state = state->BindExpr(U, LCtx, loc);
     else
       state = state->BindExpr(U, LCtx, U->isPostfix() ? V2 : Result);
-    
     // Perform the store.
     Bldr.takeNodes(*I);
     ExplodedNodeSet Dst3;
     evalStore(Dst3, U, U, *I, state, loc, Result);
     Bldr.addNodes(Dst3);
   }
   Dst.insert(Dst2);
 }

lib/StaticAnalyzer/Core/ExprEngineCXX.cpp

getCheckerManager().runCheckersForPostCall(DstPostCall, DstEvaluated,
                                              *Call, *this);
   getCheckerManager().runCheckersForPostStmt(destNodes, DstPostCall, CE, *this);
 }
 
 void ExprEngine::VisitCXXDestructor(QualType ObjectType,
                                     const MemRegion *Dest,
                                     const Stmt *S,
                                     bool IsBaseDtor,
-                                    ExplodedNode *Pred, 
+                                    ExplodedNode *Pred,
                                     ExplodedNodeSet &Dst) {
   const LocationContext *LCtx = Pred->getLocationContext();
   ProgramStateRef State = Pred->getState();
 
   // FIXME: We need to run the same destructor on every element of the array.
   // This workaround will just run the first destructor (which will still
   // invalidate the entire array).
   SVal DestVal = UnknownVal();

 
 
 void ExprEngine::VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred,
                                    ExplodedNodeSet &Dst) {
   // FIXME: Much of this should eventually migrate to CXXAllocatorCall.
   // Also, we need to decide how allocators actually work -- they're not
   // really part of the CXXNewExpr because they happen BEFORE the
   // CXXConstructExpr subexpression. See PR12014 for some discussion.
-  
   unsigned blockCount = currBldrCtx->blockCount();
   const LocationContext *LCtx = Pred->getLocationContext();
   DefinedOrUnknownSVal symVal = UnknownVal();
   FunctionDecl *FD = CNE->getOperatorNew();
 
   bool IsStandardGlobalOpNewFunction = false;
   if (FD && !isa<CXXMethodDecl>(FD) && !FD->isVariadic()) {
     if (FD->getNumParams() == 2) {
       QualType T = FD->getParamDecl(1)->getType();
       if (const IdentifierInfo *II = T.getBaseTypeIdentifier())
         // NoThrow placement new behaves as a standard new.
         IsStandardGlobalOpNewFunction = II->getName().equals("nothrow_t");
     }
     else
       // Placement forms are considered non-standard.
       IsStandardGlobalOpNewFunction = (FD->getNumParams() == 1);
   }
 
-  // We assume all standard global 'operator new' functions allocate memory in 
-  // heap. We realize this is an approximation that might not correctly model 
+  // We assume all standard global 'operator new' functions allocate memory in
+  // heap. We realize this is an approximation that might not correctly model
   // a custom global allocator.
   if (IsStandardGlobalOpNewFunction)
     symVal = svalBuilder.getConjuredHeapSymbolVal(CNE, LCtx, blockCount);
   else
     symVal = svalBuilder.conjureSymbolVal(nullptr, CNE, LCtx, CNE->getType(),
                                           blockCount);
 
   ProgramStateRef State = Pred->getState();
if (!isa<CXXConstructExpr>(Init)) {
       assert(Bldr.getResults().size() == 1);
       Bldr.takeNodes(NewN);
       evalBind(Dst, CNE, NewN, Result, State->getSVal(Init, LCtx),
                /*FirstInit=*/IsStandardGlobalOpNewFunction);
     }
   }
 }
 
-void ExprEngine::VisitCXXDeleteExpr(const CXXDeleteExpr *CDE, 
+void ExprEngine::VisitCXXDeleteExpr(const CXXDeleteExpr *CDE,
                                     ExplodedNode *Pred, ExplodedNodeSet &Dst) {
   StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
   ProgramStateRef state = Pred->getState();
   Bldr.generateNode(CDE, Pred, state);
 }
 
 void ExprEngine::VisitCXXCatchStmt(const CXXCatchStmt *CS,
                                    ExplodedNode *Pred,

lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp

 
 void ExprEngine::processCallEnter(CallEnter CE, ExplodedNode *Pred) {
   // Get the entry block in the CFG of the callee.
   const StackFrameContext *calleeCtx = CE.getCalleeContext();
   PrettyStackTraceLocationContext CrashInfo(calleeCtx);
 
   const CFG *CalleeCFG = calleeCtx->getCFG();
   const CFGBlock *Entry = &(CalleeCFG->getEntry());
-  
   // Validate the CFG.
   assert(Entry->empty());
   assert(Entry->succ_size() == 1);
-  
   // Get the solitary successor.
   const CFGBlock *Succ = *(Entry->succ_begin());
-  
   // Construct an edge representing the starting location in the callee.
   BlockEdge Loc(Entry, Succ, calleeCtx);
 
   ProgramStateRef state = Pred->getState();
-  
   // Construct a new node and add it to the worklist.
   bool isNew;
   ExplodedNode *Node = G.getNode(Loc, state, false, &isNew);
   Node->addPredecessor(Pred, G);
   if (isNew)
     Engine.getWorkList()->enqueue(Node);
 }
 
static bool isTemporaryPRValue(const CXXConstructExpr *E, SVal V) {
 
   const MemRegion *MR = V.getAsRegion();
   if (!MR)
     return false;
 
   return isa<CXXTempObjectRegion>(MR);
 }
 
-/// The call exit is simulated with a sequence of nodes, which occur between 
-/// CallExitBegin and CallExitEnd. The following operations occur between the 
+/// The call exit is simulated with a sequence of nodes, which occur between
+/// CallExitBegin and CallExitEnd. The following operations occur between the
 /// two program points:
 /// 1. CallExitBegin (triggers the start of call exit sequence)
 /// 2. Bind the return value
 /// 3. Run Remove dead bindings to clean up the dead symbols from the callee.
 /// 4. CallExitEnd (switch to the caller context)
 /// 5. PostStmt<CallExpr>
 void ExprEngine::processCallExit(ExplodedNode *CEBNode) {
   // Step 1 CEBNode was generated before the call.
   PrettyStackTraceLocationContext CrashInfo(CEBNode->getLocationContext());
   const StackFrameContext *calleeCtx =
       CEBNode->getLocationContext()->getCurrentStackFrame();
-  
   // The parent context might not be a stack frame, so make sure we
   // look up the first enclosing stack frame.
   const StackFrameContext *callerCtx =
     calleeCtx->getParent()->getCurrentStackFrame();
-  
   const Stmt *CE = calleeCtx->getCallSite();
   ProgramStateRef state = CEBNode->getState();
   // Find the last statement in the function and the corresponding basic block.
   const Stmt *LastSt = nullptr;
   const CFGBlock *Blk = nullptr;
   std::tie(LastSt, Blk) = getLastStmt(CEBNode);
 
   // Generate a CallEvent /before/ cleaning the state, so that we can get the
bool ExprEngine::inlineCall(const CallEvent &Call, const Decl *D,
   if (Call.getKind() == CE_Block) {
     const BlockDataRegion *BR = cast<BlockCall>(Call).getBlockRegion();
     assert(BR && "If we have the block definition we should have its region");
     AnalysisDeclContext *BlockCtx = AMgr.getAnalysisDeclContext(D);
     ParentOfCallee = BlockCtx->getBlockInvocationContext(CallerSFC,
                                                          cast<BlockDecl>(D),
                                                          BR);
   }
-  
   // This may be NULL, but that's fine.
   const Expr *CallE = Call.getOriginExpr();
 
   // Construct a new stack frame for the callee.
   AnalysisDeclContext *CalleeADC = AMgr.getAnalysisDeclContext(D);
   const StackFrameContext *CalleeSFC =
     CalleeADC->getStackFrame(ParentOfCallee, CallE,
                              currBldrCtx->getBlock(),
                              currStmtIdx);
-  
-    
   CallEnter Loc(CallE, CalleeSFC, CurLC);
 
   // Construct a new state which contains the mapping from actual to
   // formal arguments.
   State = State->enterStackFrame(Call, CalleeSFC);
 
   bool isNew;
   if (ExplodedNode *N = G.getNode(Loc, State, false, &isNew)) {
if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(CalleeADC->getDecl())) {
             return false;
 
       // Conditionally control the inlining of methods on objects that look
       // like C++ containers.
       if (!Opts.mayInlineCXXContainerMethods())
         if (!Ctx.getSourceManager().isInMainFile(FD->getLocation()))
           if (isContainerMethod(Ctx, FD))
             return false;
-            
       // Conditionally control the inlining of the destructor of C++ shared_ptr.
       // We don't currently do a good job modeling shared_ptr because we can't
       // see the reference count, so treating as opaque is probably the best
       // idea.
       if (!Opts.mayInlineCXXSharedPtrDtor())
         if (isCXXSharedPtrDtor(FD))
           return false;
 
void ExprEngine::BifurcateCall(const MemRegion *BifurReg,
 
   NumOfDynamicDispatchPathSplits++;
   return;
 }
 
 
 void ExprEngine::VisitReturnStmt(const ReturnStmt *RS, ExplodedNode *Pred,
                                  ExplodedNodeSet &Dst) {
-  
   ExplodedNodeSet dstPreVisit;
   getCheckerManager().runCheckersForPreStmt(dstPreVisit, Pred, RS, *this);
 
   StmtNodeBuilder B(dstPreVisit, Dst, *currBldrCtx);
-  
   if (RS->getRetValue()) {
     for (ExplodedNodeSet::iterator it = dstPreVisit.begin(),
                                   ei = dstPreVisit.end(); it != ei; ++it) {
       B.generateNode(RS, *it, (*it)->getState());
     }
   }
 }

lib/StaticAnalyzer/Core/ExprEngineObjC.cpp

 #include "clang/AST/StmtObjC.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
 
 using namespace clang;
 using namespace ento;
 
-void ExprEngine::VisitLvalObjCIvarRefExpr(const ObjCIvarRefExpr *Ex, 
+void ExprEngine::VisitLvalObjCIvarRefExpr(const ObjCIvarRefExpr *Ex,
                                           ExplodedNode *Pred,
                                           ExplodedNodeSet &Dst) {
   ProgramStateRef state = Pred->getState();
   const LocationContext *LCtx = Pred->getLocationContext();
   SVal baseVal = state->getSVal(Ex->getBase(), LCtx);
   SVal location = state->getLValue(Ex->getDecl(), baseVal);
-  
   ExplodedNodeSet dstIvar;
   StmtNodeBuilder Bldr(Pred, dstIvar, *currBldrCtx);
   Bldr.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, location));
-  
   // Perform the post-condition check of the ObjCIvarRefExpr and store
   // the created nodes in 'Dst'.
   getCheckerManager().runCheckersForPostStmt(Dst, dstIvar, Ex, *this);
 }
 
 void ExprEngine::VisitObjCAtSynchronizedStmt(const ObjCAtSynchronizedStmt *S,
                                              ExplodedNode *Pred,
                                              ExplodedNodeSet &Dst) {
   getCheckerManager().runCheckersForPreStmt(Dst, Pred, S, *this);
 }
 
 void ExprEngine::VisitObjCForCollectionStmt(const ObjCForCollectionStmt *S,
                                             ExplodedNode *Pred,
                                             ExplodedNodeSet &Dst) {
-  
   // ObjCForCollectionStmts are processed in two places.  This method
   // handles the case where an ObjCForCollectionStmt* occurs as one of the
   // statements within a basic block.  This transfer function does two things:
   //
   //  (1) binds the next container value to 'element'.  This creates a new
   //      node in the ExplodedGraph.
   //
   //  (2) binds the value 0/1 to the ObjCForCollectionStmt* itself, indicating
void ExprEngine::VisitObjCForCollectionStmt(const ObjCForCollectionStmt *S,
   //
   //  For now: simulate (1) by assigning either a symbol or nil if the
   //    container is empty.  Thus this transfer function will by default
   //    result in state splitting.
 
   const Stmt *elem = S->getElement();
   ProgramStateRef state = Pred->getState();
   SVal elementV;
-  
   if (const DeclStmt *DS = dyn_cast<DeclStmt>(elem)) {
     const VarDecl *elemD = cast<VarDecl>(DS->getSingleDecl());
     assert(elemD->getInit() == nullptr);
     elementV = state->getLValue(elemD, Pred->getLocationContext());
   }
   else {
     elementV = state->getSVal(elem, Pred->getLocationContext());
   }
-  
   ExplodedNodeSet dstLocation;
   evalLocation(dstLocation, S, elem, Pred, state, elementV, nullptr, false);
 
   ExplodedNodeSet Tmp;
   StmtNodeBuilder Bldr(Pred, Tmp, *currBldrCtx);
 
   for (ExplodedNodeSet::iterator NI = dstLocation.begin(),
        NE = dstLocation.end(); NI!=NE; ++NI) {
     Pred = *NI;
     ProgramStateRef state = Pred->getState();
     const LocationContext *LCtx = Pred->getLocationContext();
-    
     // Handle the case where the container still has elements.
     SVal TrueV = svalBuilder.makeTruthVal(1);
     ProgramStateRef hasElems = state->BindExpr(S, LCtx, TrueV);
-    
     // Handle the case where the container has no elements.
     SVal FalseV = svalBuilder.makeTruthVal(0);
     ProgramStateRef noElems = state->BindExpr(S, LCtx, FalseV);
 
     if (Optional<loc::MemRegionVal> MV = elementV.getAs<loc::MemRegionVal>())
-      if (const TypedValueRegion *R = 
+      if (const TypedValueRegion *R =
           dyn_cast<TypedValueRegion>(MV->getRegion())) {
         // FIXME: The proper thing to do is to really iterate over the
         //  container.  We will do this with dispatch logic to the store.
         //  For now, just 'conjure' up a symbolic value.
         QualType T = R->getValueType();
         assert(Loc::isLocType(T));
         SymbolRef Sym = SymMgr.conjureSymbol(elem, LCtx, T,
                                              currBldrCtx->blockCount());
         SVal V = svalBuilder.makeLoc(Sym);
         hasElems = hasElems->bindLoc(elementV, V);
-        
         // Bind the location to 'nil' on the false branch.
         SVal nilV = svalBuilder.makeIntVal(0, T);
         noElems = noElems->bindLoc(elementV, nilV);
       }
-    
     // Create the new nodes.
     Bldr.generateNode(S, Pred, hasElems);
     Bldr.generateNode(S, Pred, noElems);
   }
 
   // Finally, run any custom checkers.
   // FIXME: Eventually all pre- and post-checks should live in VisitStmt.
   getCheckerManager().runCheckersForPostStmt(Dst, Tmp, S, *this);
void ExprEngine::VisitObjCMessage(const ObjCMessageExpr *ME,
   ExplodedNodeSet dstEval;
   StmtNodeBuilder Bldr(dstGenericPrevisit, dstEval, *currBldrCtx);
 
   for (ExplodedNodeSet::iterator DI = dstGenericPrevisit.begin(),
        DE = dstGenericPrevisit.end(); DI != DE; ++DI) {
     ExplodedNode *Pred = *DI;
     ProgramStateRef State = Pred->getState();
     CallEventRef<ObjCMethodCall> UpdatedMsg = Msg.cloneWithState(State);
-    
     if (UpdatedMsg->isInstanceMessage()) {
       SVal recVal = UpdatedMsg->getReceiverSVal();
       if (!recVal.isUndef()) {
         // Bifurcate the state into nil and non-nil ones.
         DefinedOrUnknownSVal receiverVal =
             recVal.castAs<DefinedOrUnknownSVal>();
 
         ProgramStateRef notNilState, nilState;
         std::tie(notNilState, nilState) = State->assume(receiverVal);
-        
         // There are three cases: can be nil or non-nil, must be nil, must be
         // non-nil. We ignore must be nil, and merge the rest two into non-nil.
         // FIXME: This ignores many potential bugs (<rdar://problem/11733396>).
         // Revisit once we have lazier constraints.
         if (nilState && !notNilState) {
           continue;
         }
-        
         // Check if the "raise" message was sent.
         assert(notNilState);
         if (ObjCNoRet.isImplicitNoReturn(ME)) {
           // If we raise an exception, for now treat it as a sink.
           // Eventually we will want to handle exceptions properly.
           Bldr.generateSink(ME, Pred, State);
           continue;
         }
-        
         // Generate a transition to non-Nil state.
         if (notNilState != State) {
           Pred = Bldr.generateNode(ME, Pred, notNilState);
           assert(Pred && "Should have cached out already!");
         }
       }
     } else {
       // Check for special class methods that are known to not return
       // and that we should treat as a sink.
       if (ObjCNoRet.isImplicitNoReturn(ME)) {
         // If we raise an exception, for now treat it as a sink.
         // Eventually we will want to handle exceptions properly.
         Bldr.generateSink(ME, Pred, Pred->getState());
         continue;
       }
     }
 
     defaultEvalCall(Bldr, Pred, *UpdatedMsg);
   }
-  
   ExplodedNodeSet dstPostvisit;
   getCheckerManager().runCheckersForPostCall(dstPostvisit, dstEval,
                                              *Msg, *this);
 
   // Finally, perform the post-condition check of the ObjCMessageExpr and store
   // the created nodes in 'Dst'.
   getCheckerManager().runCheckersForPostObjCMessage(Dst, dstPostvisit,
                                                     *Msg, *this);
 }

lib/StaticAnalyzer/Core/Makefile

 ##===- clang/lib/StaticAnalyzer/Core/Makefile --------------*- Makefile -*-===##
-# 
+#
 #                     The LLVM Compiler Infrastructure
 #
 # This file is distributed under the University of Illinois Open Source
 # License. See LICENSE.TXT for details.
-# 
+#
 ##===----------------------------------------------------------------------===##
 #
-# This implements analyses built on top of source-level CFGs. 
+# This implements analyses built on top of source-level CFGs.
 #
 ##===----------------------------------------------------------------------===##
 
 CLANG_LEVEL := ../../..
 LIBRARYNAME := clangStaticAnalyzerCore
 
 include $(CLANG_LEVEL)/Makefile

lib/StaticAnalyzer/Core/MemRegion.cpp

if (const BlockInvocationContext *BC =
       for (BlockDataRegion::referenced_vars_iterator
            I = BR->referenced_vars_begin(),
            E = BR->referenced_vars_end(); I != E; ++I) {
         if (const VarRegion *VR = dyn_cast<VarRegion>(I.getOriginalRegion()))
           if (VR->getDecl() == VD)
             return cast<VarRegion>(I.getCapturedRegion());
       }
     }
-    
     LC = LC->getParent();
   }
   return (const StackFrameContext *)nullptr;
 }
 
 const VarRegion* MemRegionManager::getVarRegion(const VarDecl *D,
                                                 const LocationContext *LC) {
   const MemRegion *sReg = nullptr;
// Treat other globals as GlobalInternal unless they are constants.
       const Type *GT = GQT.getTypePtrOrNull();
       // TODO: We could walk the complex types here and see if everything is
       // constified.
       if (GT && GQT.isConstQualified() && GT->isArithmeticType())
         sReg = getGlobalsRegion(MemRegion::GlobalImmutableSpaceRegionKind);
       else
         sReg = getGlobalsRegion();
     }
-  
-  // Finally handle static locals.  
+  // Finally handle static locals.
   } else {
     // FIXME: Once we implement scope handling, we will need to properly lookup
     // 'D' to the proper LocationContext.
     const DeclContext *DC = D->getDeclContext();
     llvm::PointerUnion<const StackFrameContext *, const VarRegion *> V =
       getStackOrCaptureRegionForDeclContext(LC, DC, D);
-    
     if (V.is<const VarRegion*>())
       return V.get<const VarRegion*>();
-    
     const StackFrameContext *STC = V.get<const StackFrameContext*>();
 
     if (!STC)
       sReg = getUnknownRegion();
     else {
       if (D->hasLocalStorage()) {
         sReg = isa<ParmVarDecl>(D) || isa<ImplicitParamDecl>(D)
                ? static_cast<const MemRegion*>(getStackArgumentsRegion(STC))
case CXXBaseObjectRegionKind: {
         Ty = TVR->getDesugaredValueType(getContext());
       } else if (const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(R)) {
         // If our base region is symbolic, we don't know what type it really is.
         // Pretend the type of the symbol is the true dynamic type.
         // (This will at least be self-consistent for the life of the symbol.)
         Ty = SR->getSymbol()->getType()->getPointeeType();
         RootIsSymbolic = true;
       }
-      
       const CXXRecordDecl *Child = Ty->getAsCXXRecordDecl();
       if (!Child) {
         // We cannot compute the offset of the base class.
         SymbolicOffsetBase = R;
       }
 
       if (RootIsSymbolic) {
         // Base layers on symbolic regions may not be type-correct.
case ElementRegionKind: {
         SymbolicOffsetBase = R;
         continue;
       }
 
       SVal Index = ER->getIndex();
       if (Optional<nonloc::ConcreteInt> CI =
               Index.getAs<nonloc::ConcreteInt>()) {
         // Don't bother calculating precise offsets if we already have a
-        // symbolic offset somewhere in the chain. 
+        // symbolic offset somewhere in the chain.
         if (SymbolicOffsetBase)
           continue;
 
         int64_t i = CI->getValue().getSExtValue();
         // This type size is in bits.
         Offset += i * getContext().getTypeSize(EleTy);
       } else {
         // We cannot compute offset for non-concrete index.
case FieldRegionKind: {
 
       // Don't bother calculating precise offsets if we already have a
       // symbolic offset somewhere in the chain.
       if (SymbolicOffsetBase)
         continue;
 
       // Get the field number.
       unsigned idx = 0;
-      for (RecordDecl::field_iterator FI = RD->field_begin(), 
+      for (RecordDecl::field_iterator FI = RD->field_begin(),
              FE = RD->field_end(); FI != FE; ++FI, ++idx)
         if (FR->getDecl() == *FI)
           break;
 
       const ASTRecordLayout &Layout = getContext().getASTRecordLayout(RD);
       // This is offset in bits.
       Offset += Layout.getFieldOffset(idx);
       break;
BlockDataRegion::referenced_vars_begin() const {
   BumpVector<const MemRegion*> *Vec =
     static_cast<BumpVector<const MemRegion*>*>(ReferencedVars);
 
   if (Vec == (void*) 0x1)
     return BlockDataRegion::referenced_vars_iterator(nullptr, nullptr);
 
   BumpVector<const MemRegion*> *VecOriginal =
     static_cast<BumpVector<const MemRegion*>*>(OriginalVars);
-  
   return BlockDataRegion::referenced_vars_iterator(Vec->begin(),
                                                    VecOriginal->begin());
 }
 
 BlockDataRegion::referenced_vars_iterator
 BlockDataRegion::referenced_vars_end() const {
   const_cast<BlockDataRegion*>(this)->LazyInitializeReferencedVars();
 
const VarRegion *BlockDataRegion::getOriginalRegion(const VarRegion *R) const {
   }
   return nullptr;
 }
 
 //===----------------------------------------------------------------------===//
 // RegionAndSymbolInvalidationTraits
 //===----------------------------------------------------------------------===//
 
-void RegionAndSymbolInvalidationTraits::setTrait(SymbolRef Sym, 
+void RegionAndSymbolInvalidationTraits::setTrait(SymbolRef Sym,
                                                  InvalidationKinds IK) {
   SymTraitsMap[Sym] |= IK;
 }
 
-void RegionAndSymbolInvalidationTraits::setTrait(const MemRegion *MR, 
+void RegionAndSymbolInvalidationTraits::setTrait(const MemRegion *MR,
                                                  InvalidationKinds IK) {
   assert(MR);
   if (const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(MR))
     setTrait(SR->getSymbol(), IK);
   else
     MRTraitsMap[MR] |= IK;
 }
 
-bool RegionAndSymbolInvalidationTraits::hasTrait(SymbolRef Sym, 
+bool RegionAndSymbolInvalidationTraits::hasTrait(SymbolRef Sym,
                                                  InvalidationKinds IK) {
   const_symbol_iterator I = SymTraitsMap.find(Sym);
   if (I != SymTraitsMap.end())
     return I->second & IK;
 
-  return false;    
+  return false;
 }
 
 bool RegionAndSymbolInvalidationTraits::hasTrait(const MemRegion *MR,
                                                  InvalidationKinds IK) {
   if (!MR)
     return false;
 
   if (const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(MR))
     return hasTrait(SR->getSymbol(), IK);
 
   const_region_iterator I = MRTraitsMap.find(MR);
   if (I != MRTraitsMap.end())
     return I->second & IK;
 
   return false;
 }

lib/StaticAnalyzer/Core/PathDiagnostic.cpp

if (CP) {
         llvm::raw_svector_ostream os(buf);
         os << " (within a call to '" << ND->getDeclName() << "')";
         appendToDesc(os.str());
       }
 
       // Reset the report containing declaration and location.
       DeclWithIssue = CP->getCaller();
       Loc = CP->getLocation();
-      
       return;
     }
   }
 }
 
 void PathDiagnosticConsumer::anchor() { }
 
 PathDiagnosticConsumer::~PathDiagnosticConsumer() {
   // Delete the contents of the FoldingSet if it isn't empty already.
   for (llvm::FoldingSet<PathDiagnostic>::iterator it =
        Diags.begin(), et = Diags.end() ; it != et ; ++it) {
     delete &*it;
   }
 }
 
 void PathDiagnosticConsumer::HandlePathDiagnostic(
     std::unique_ptr<PathDiagnostic> D) {
   if (!D || D->path.empty())
     return;
-  
   // We need to flatten the locations (convert Stmt* to locations) because
   // the referenced statements may be freed by the time the diagnostics
   // are emitted.
   D->flattenLocations();
 
   // If the PathDiagnosticConsumer does not support diagnostics that
   // cross file boundaries, prune out such diagnostics now.
   if (!supportsCrossFileDiagnostics()) {
     // Verify that the entire path is from the same FileID.
     FileID FID;
     const SourceManager &SMgr = D->path.front()->getLocation().getManager();
     SmallVector<const PathPieces *, 5> WorkList;
     WorkList.push_back(&D->path);
 
     while (!WorkList.empty()) {
       const PathPieces &path = *WorkList.pop_back_val();
 
       for (PathPieces::const_iterator I = path.begin(), E = path.end(); I != E;
            ++I) {
         const PathDiagnosticPiece *piece = I->get();
         FullSourceLoc L = piece->getLocation().asLocation().getExpansionLoc();
-      
         if (FID.isInvalid()) {
           FID = SMgr.getFileID(L);
         } else if (SMgr.getFileID(L) != FID)
           return; // FIXME: Emit a warning?
-      
         // Check the source ranges.
         ArrayRef<SourceRange> Ranges = piece->getRanges();
         for (ArrayRef<SourceRange>::iterator I = Ranges.begin(),
                                              E = Ranges.end(); I != E; ++I) {
           SourceLocation L = SMgr.getExpansionLoc(I->getBegin());
           if (!L.isFileID() || SMgr.getFileID(L) != FID)
             return; // FIXME: Emit a warning?
           L = SMgr.getExpansionLoc(I->getEnd());
           if (!L.isFileID() || SMgr.getFileID(L) != FID)
             return; // FIXME: Emit a warning?
         }
-        
         if (const PathDiagnosticCallPiece *call =
             dyn_cast<PathDiagnosticCallPiece>(piece)) {
           WorkList.push_back(&call->path);
         }
         else if (const PathDiagnosticMacroPiece *macro =
                  dyn_cast<PathDiagnosticMacroPiece>(piece)) {
           WorkList.push_back(&macro->subPieces);
         }
       }
     }
-    
     if (FID.isInvalid())
       return; // FIXME: Emit a warning?
-  }  
+  }
 
   // Profile the node to see if we already have something matching it
   llvm::FoldingSetNodeID profile;
   D->Profile(profile);
   void *InsertPos = nullptr;
 
   if (PathDiagnostic *orig = Diags.FindNodeOrInsertPos(profile, InsertPos)) {
     // Keep the PathDiagnostic with the shorter path.
if (X_CRL != Y_CRL)
     return X_CRL.isBeforeInTranslationUnitThan(Y_CRL);
   return comparePath(X.path, Y.path);
 }
 
 static Optional<bool> comparePiece(const PathDiagnosticPiece &X,
                                    const PathDiagnosticPiece &Y) {
   if (X.getKind() != Y.getKind())
     return X.getKind() < Y.getKind();
-  
   FullSourceLoc XL = X.getLocation().asLocation();
   FullSourceLoc YL = Y.getLocation().asLocation();
   if (XL != YL)
     return XL.isBeforeInTranslationUnitThan(YL);
 
   if (X.getString() != Y.getString())
     return X.getString() < Y.getString();
 
   if (X.getRanges().size() != Y.getRanges().size())
     return X.getRanges().size() < Y.getRanges().size();
 
   const SourceManager &SM = XL.getManager();
-  
   for (unsigned i = 0, n = X.getRanges().size(); i < n; ++i) {
     SourceRange XR = X.getRanges()[i];
     SourceRange YR = Y.getRanges()[i];
     if (XR != YR) {
       if (XR.getBegin() != YR.getBegin())
         return SM.isBeforeInTranslationUnit(XR.getBegin(), YR.getBegin());
       return SM.isBeforeInTranslationUnit(XR.getEnd(), YR.getEnd());
     }
   }
-  
   switch (X.getKind()) {
     case clang::ento::PathDiagnosticPiece::ControlFlow:
       return compareControlFlow(cast<PathDiagnosticControlFlowPiece>(X),
                                 cast<PathDiagnosticControlFlowPiece>(Y));
     case clang::ento::PathDiagnosticPiece::Event:
       return None;
     case clang::ento::PathDiagnosticPiece::Macro:
       return compareMacro(cast<PathDiagnosticMacroPiece>(X),
static bool compare(const PathDiagnostic &X, const PathDiagnostic &Y) {
   assert(b.hasValue());
   return b.getValue();
 }
 
 void PathDiagnosticConsumer::FlushDiagnostics(
                                      PathDiagnosticConsumer::FilesMade *Files) {
   if (flushed)
     return;
-  
   flushed = true;
-  
   std::vector<const PathDiagnostic *> BatchDiags;
   for (llvm::FoldingSet<PathDiagnostic>::iterator it = Diags.begin(),
        et = Diags.end(); it != et; ++it) {
     const PathDiagnostic *D = &*it;
     BatchDiags.push_back(D);
   }
 
   // Sort the diagnostics so that they are always emitted in a deterministic
void PathDiagnosticConsumer::FlushDiagnostics(
   FlushDiagnosticsImpl(BatchDiags, Files);
 
   // Delete the flushed diagnostics.
   for (std::vector<const PathDiagnostic *>::iterator it = BatchDiags.begin(),
        et = BatchDiags.end(); it != et; ++it) {
     const PathDiagnostic *D = *it;
     delete D;
   }
-  
   // Clear out the FoldingSet.
   Diags.clear();
 }
 
 PathDiagnosticConsumer::FilesMade::~FilesMade() {
   for (PDFileEntry &Entry : Set)
     Entry.~PDFileEntry();
 }
 
 void PathDiagnosticConsumer::FilesMade::addDiagnostic(const PathDiagnostic &PD,
                                                       StringRef ConsumerName,
                                                       StringRef FileName) {
   llvm::FoldingSetNodeID NodeID;
   NodeID.Add(PD);
   void *InsertPos;
   PDFileEntry *Entry = Set.FindNodeOrInsertPos(NodeID, InsertPos);
   if (!Entry) {
     Entry = Alloc.Allocate<PDFileEntry>();
     Entry = new (Entry) PDFileEntry(NodeID);
     Set.InsertNode(Entry, InsertPos);
   }
-  
   // Allocate persistent storage for the file name.
   char *FileName_cstr = (char*) Alloc.Allocate(FileName.size(), 1);
   memcpy(FileName_cstr, FileName.data(), FileName.size());
 
   Entry->files.push_back(std::make_pair(ConsumerName,
                                         StringRef(FileName_cstr,
                                                   FileName.size())));
 }
case StmtK: {
         case Stmt::ObjCForCollectionStmtClass: {
           SourceLocation L = getValidSourceLocation(S, LAC);
           return SourceRange(L, L);
         }
       }
       SourceRange R = S->getSourceRange();
       if (R.isValid())
         return R;
-      break;  
+      break;
     }
     case DeclK:
       if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(D))
         return MD->getSourceRange();
       if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(D)) {
         if (Stmt *Body = FD->getBody())
           return Body->getSourceRange();
       }
if (const CXXConstructorDecl *CD = dyn_cast<CXXConstructorDecl>(MD)) {
         Out << "default ";
       else if (CD->isCopyConstructor())
         Out << "copy ";
       else if (CD->isMoveConstructor())
         Out << "move ";
 
       Out << "constructor";
       describeClass(Out, MD->getParent(), " for ");
-      
     } else if (isa<CXXDestructorDecl>(MD)) {
       if (!MD->isUserProvided()) {
         Out << "destructor";
         describeClass(Out, MD->getParent(), " for ");
       } else {
         // Use ~Foo for explicitly-written destructors.
         Out << "'" << *MD << "'";
       }
PathDiagnosticCallPiece::getCallExitEvent() const {
   assert(callReturn.asLocation().isValid());
   return new PathDiagnosticEventPiece(callReturn, Out.str());
 }
 
 static void compute_path_size(const PathPieces &pieces, unsigned &size) {
   for (PathPieces::const_iterator it = pieces.begin(),
                                   et = pieces.end(); it != et; ++it) {
     const PathDiagnosticPiece *piece = it->get();
-    if (const PathDiagnosticCallPiece *cp = 
+    if (const PathDiagnosticCallPiece *cp =
         dyn_cast<PathDiagnosticCallPiece>(piece)) {
       compute_path_size(cp->path, size);
     }
     else
       ++size;
   }
 }
 
void PathDiagnosticPiece::Profile(llvm::FoldingSetNodeID &ID) const {
   ID.AddString(str);
   // FIXME: Add profiling support for code hints.
   ID.AddInteger((unsigned) getDisplayHint());
   ArrayRef<SourceRange> Ranges = getRanges();
   for (ArrayRef<SourceRange>::iterator I = Ranges.begin(), E = Ranges.end();
                                         I != E; ++I) {
     ID.AddInteger(I->getBegin().getRawEncoding());
     ID.AddInteger(I->getEnd().getRawEncoding());
-  }  
+  }
 }
 
 void PathDiagnosticCallPiece::Profile(llvm::FoldingSetNodeID &ID) const {
   PathDiagnosticPiece::Profile(ID);
-  for (PathPieces::const_iterator it = path.begin(), 
+  for (PathPieces::const_iterator it = path.begin(),
        et = path.end(); it != et; ++it) {
     ID.Add(**it);
   }
 }
 
 void PathDiagnosticSpotPiece::Profile(llvm::FoldingSetNodeID &ID) const {
   PathDiagnosticPiece::Profile(ID);
   ID.Add(Pos);

lib/StaticAnalyzer/Core/PlistDiagnostics.cpp

if (!Ranges.empty()) {
     ++indent;
     for (auto &R : Ranges)
       EmitRange(o, SM,
                 Lexer::getAsCharRange(SM.getExpansionRange(R), SM, LangOpts),
                 FM, indent + 1);
     --indent;
     Indent(o, indent) << "</array>\n";
   }
-  
   // Output the call depth.
   Indent(o, indent) << "<key>depth</key>";
   EmitInteger(o, depth) << '\n';
 
   // Output the text.
   assert(!P.getString().empty());
   Indent(o, indent) << "<key>extended_message</key>\n";
   Indent(o, indent);
   EmitString(o, P.getString()) << '\n';
 
   // Output the short text.
   // FIXME: Really use a short string.
   Indent(o, indent) << "<key>message</key>\n";
   Indent(o, indent);
   EmitString(o, P.getString()) << '\n';
-  
   // Finish up.
   --indent;
   Indent(o, indent); o << "</dict>\n";
 }
 
 static void ReportPiece(raw_ostream &o,
                         const PathDiagnosticPiece &P,
                         const FIDMap& FM, const SourceManager &SM,
                         const LangOptions &LangOpts,
                         unsigned indent,
                         unsigned depth,
                         bool includeControlFlow,
                         bool isKeyEvent = false);
 
 static void ReportCall(raw_ostream &o,
                        const PathDiagnosticCallPiece &P,
                        const FIDMap& FM, const SourceManager &SM,
                        const LangOptions &LangOpts,
                        unsigned indent,
                        unsigned depth) {
-  
   IntrusiveRefCntPtr<PathDiagnosticEventPiece> callEnter =
-    P.getCallEnterEvent();  
+    P.getCallEnterEvent();
 
   if (callEnter)
     ReportPiece(o, *callEnter, FM, SM, LangOpts, indent, depth, true,
                 P.isLastInMainSourceFile());
 
   IntrusiveRefCntPtr<PathDiagnosticEventPiece> callEnterWithinCaller =
     P.getCallEnterWithinCallerEvent();
-  
   ++depth;
-  
   if (callEnterWithinCaller)
     ReportPiece(o, *callEnterWithinCaller, FM, SM, LangOpts,
                 indent, depth, true);
-  
   for (PathPieces::const_iterator I = P.path.begin(), E = P.path.end();I!=E;++I)
     ReportPiece(o, **I, FM, SM, LangOpts, indent, depth, true);
 
   --depth;
-  
   IntrusiveRefCntPtr<PathDiagnosticEventPiece> callExit =
     P.getCallExitEvent();
 
   if (callExit)
     ReportPiece(o, *callExit, FM, SM, LangOpts, indent, depth, true);
 }
 
 static void ReportMacro(raw_ostream &o,
void PlistDiagnostics::FlushDiagnosticsImpl(
   // ranges of the diagnostics.
   FIDMap FM;
   SmallVector<FileID, 10> Fids;
   const SourceManager* SM = nullptr;
 
   if (!Diags.empty())
     SM = &(*(*Diags.begin())->path.begin())->getLocation().getManager();
 
-  
   for (std::vector<const PathDiagnostic*>::iterator DI = Diags.begin(),
        DE = Diags.end(); DI != DE; ++DI) {
 
     const PathDiagnostic *D = *DI;
 
     SmallVector<const PathPieces *, 5> WorkList;
     WorkList.push_back(&D->path);
 
for (std::vector<const PathDiagnostic*>::iterator DI=Diags.begin(),
 
     o << "  <dict>\n"
          "   <key>path</key>\n";
 
     const PathDiagnostic *D = *DI;
 
     o << "   <array>\n";
 
-    for (PathPieces::const_iterator I = D->path.begin(), E = D->path.end(); 
+    for (PathPieces::const_iterator I = D->path.begin(), E = D->path.end();
          I != E; ++I)
       ReportDiag(o, **I, FM, *SM, LangOpts);
 
     o << "   </array>\n";
 
     // Output the bug type and bug category.
     o << "   <key>description</key>";
     EmitString(o, D->getShortDescription()) << '\n';
     o << "   <key>category</key>";
     EmitString(o, D->getCategory()) << '\n';
     o << "   <key>type</key>";
     EmitString(o, D->getBugType()) << '\n';
     o << "   <key>check_name</key>";
     EmitString(o, D->getCheckName()) << '\n';
- 
     // Output information about the semantic context where
     // the issue occurred.
     if (const Decl *DeclWithIssue = D->getDeclWithIssue()) {
       // FIXME: handle blocks, which have no name.
       if (const NamedDecl *ND = dyn_cast<NamedDecl>(DeclWithIssue)) {
         StringRef declKind;
         switch (ND->getKind()) {
           case Decl::CXXRecord:
if (const Decl *DeclWithIssue = D->getDeclWithIssue()) {
           EmitString(o, declKind) << '\n';
           o << "  <key>issue_context</key>";
           EmitString(o, declName) << '\n';
         }
 
         // Output the bug hash for issue unique-ing. Currently, it's just an
         // offset from the beginning of the function.
         if (const Stmt *Body = DeclWithIssue->getBody()) {
-          
           // If the bug uniqueing location exists, use it for the hash.
           // For example, this ensures that two leaks reported on the same line
           // will have different issue_hashes and that the hash will identify
           // the leak location even after code is added between the allocation
           // site and the end of scope (leak report location).
           PathDiagnosticLocation UPDLoc = D->getUniqueingLoc();
           if (UPDLoc.isValid()) {
             FullSourceLoc UL(SM->getExpansionLoc(UPDLoc.asLocation()),
for (std::vector<const PathDiagnostic*>::iterator DI=Diags.begin(),
 
     // Close up the entry.
     o << "  </dict>\n";
   }
 
   o << " </array>\n";
 
   // Finish.
-  o << "</dict>\n</plist>";  
+  o << "</dict>\n</plist>";
 }

lib/StaticAnalyzer/Core/ProgramState.cpp

 
 /// Decrement the number of times this state is referenced.
 void ProgramStateRelease(const ProgramState *state) {
   assert(state->refCount > 0);
   ProgramState *s = const_cast<ProgramState*>(state);
   if (--s->refCount == 0) {
     ProgramStateManager &Mgr = s->getStateManager();
     Mgr.StateSet.RemoveNode(s);
-    s->~ProgramState();    
+    s->~ProgramState();
     Mgr.freeStates.push_back(s);
   }
 }
 }}
 
 ProgramState::ProgramState(ProgramStateManager *mgr, const Environment& env,
                  StoreRef st, GenericDataMap gdm)
   : stateMgr(mgr),

 
 
 ProgramStateManager::~ProgramStateManager() {
   for (GDMContextsTy::iterator I=GDMContexts.begin(), E=GDMContexts.end();
        I!=E; ++I)
     I->second.second(I->second.first);
 }
 
-ProgramStateRef 
+ProgramStateRef
 ProgramStateManager::removeDeadBindings(ProgramStateRef state,
                                    const StackFrameContext *LCtx,
                                    SymbolReaper& SymReaper) {
 
   // This code essentially performs a "mark-and-sweep" of the VariableBindings.
   // The roots are any Block-level exprs and Decls that our liveness algorithm
   // tells us are live.  We then see what Decls they may reference, and keep
   // those around.  This code more than likely can be made faster, and the
ProgramStateManager::removeDeadBindings(ProgramStateRef state,
   SymReaper.setReapedStore(newStore);
 
   ProgramStateRef Result = getPersistentState(NewState);
   return ConstraintMgr->removeDeadBindings(Result, SymReaper);
 }
 
 ProgramStateRef ProgramState::bindLoc(Loc LV, SVal V, bool notifyChanges) const {
   ProgramStateManager &Mgr = getStateManager();
-  ProgramStateRef newState = makeWithStore(Mgr.StoreMgr->Bind(getStore(), 
+  ProgramStateRef newState = makeWithStore(Mgr.StoreMgr->Bind(getStore(),
                                                              LV, V));
   const MemRegion *MR = LV.getAsRegion();
   if (MR && Mgr.getOwningEngine() && notifyChanges)
     return Mgr.getOwningEngine()->processRegionChange(newState, MR);
 
   return newState;
 }
 
 ProgramStateRef ProgramState::bindDefault(SVal loc, SVal V) const {
   ProgramStateManager &Mgr = getStateManager();
   const MemRegion *R = loc.castAs<loc::MemRegionVal>().getRegion();
   const StoreRef &newStore = Mgr.StoreMgr->BindDefault(getStore(), R, V);
   ProgramStateRef new_state = makeWithStore(newStore);
-  return Mgr.getOwningEngine() ? 
-           Mgr.getOwningEngine()->processRegionChange(new_state, R) : 
+  return Mgr.getOwningEngine() ?
+           Mgr.getOwningEngine()->processRegionChange(new_state, R) :
            new_state;
 }
 
 typedef ArrayRef<const MemRegion *> RegionList;
 typedef ArrayRef<SVal> ValueList;
 
-ProgramStateRef 
+ProgramStateRef
 ProgramState::invalidateRegions(RegionList Regions,
                              const Expr *E, unsigned Count,
                              const LocationContext *LCtx,
                              bool CausedByPointerEscape,
                              InvalidatedSymbols *IS,
                              const CallEvent *Call,
                              RegionAndSymbolInvalidationTraits *ITraits) const {
   SmallVector<SVal, 8> Values;
= Mgr.StoreMgr->invalidateRegions(getStore(), Values, E, Count, LCtx, Call,
                                       *IS, *ITraits, &TopLevelInvalidated,
                                       &Invalidated);
 
     ProgramStateRef newState = makeWithStore(newStore);
 
     if (CausedByPointerEscape) {
       newState = Eng->notifyCheckersOfPointerEscape(newState, IS,
                                                     TopLevelInvalidated,
-                                                    Invalidated, Call, 
+                                                    Invalidated, Call,
                                                     *ITraits);
     }
 
-    return Eng->processRegionChanges(newState, IS, TopLevelInvalidated, 
+    return Eng->processRegionChanges(newState, IS, TopLevelInvalidated,
                                      Invalidated, Call);
   }
 
   const StoreRef &newStore =
   Mgr.StoreMgr->invalidateRegions(getStore(), Values, E, Count, LCtx, Call,
                                   *IS, *ITraits, nullptr, nullptr);
   return makeWithStore(newStore);
 }
 
 ProgramStateRef ProgramState::killBinding(Loc LV) const {
   assert(!LV.getAs<loc::MemRegionVal>() && "Use invalidateRegion instead.");
 
   Store OldStore = getStore();
   const StoreRef &newStore =
     getStateManager().StoreMgr->killBinding(OldStore, LV);
 
   if (newStore.getStore() == OldStore)
     return this;
 
   return makeWithStore(newStore);
 }
 
-ProgramStateRef 
+ProgramStateRef
 ProgramState::enterStackFrame(const CallEvent &Call,
                               const StackFrameContext *CalleeCtx) const {
   const StoreRef &NewStore =
     getStateManager().StoreMgr->enterStackFrame(getStore(), Call, CalleeCtx);
   return makeWithStore(NewStore);
 }
 
 SVal ProgramState::getSValAsScalarOrLoc(const MemRegion *R) const {
if (SymbolRef sym = V.getAsSymbol()) {
         //   unsigned x = foo();
         //   if (x == 54)
         //     ...
         //
         //  The symbolic value stored to 'x' is actually the conjured
         //  symbol for the call to foo(); the type of that symbol is 'char',
         //  not unsigned.
         const llvm::APSInt &NewV = getBasicVals().Convert(T, *Int);
-        
         if (V.getAs<Loc>())
           return loc::ConcreteInt(NewV);
         else
           return nonloc::ConcreteInt(NewV);
       }
     }
   }
-  
   return V;
 }
 
 ProgramStateRef ProgramState::BindExpr(const Stmt *S,
                                            const LocationContext *LCtx,
                                            SVal V, bool Invalidate) const{
   Environment NewEnv =
     getStateManager().EnvMgr.bindExpr(Env, EnvironmentEntry(S, LCtx), V,

 }
 
 ConditionTruthVal ProgramState::isNull(SVal V) const {
   if (V.isZeroConstant())
     return true;
 
   if (V.isConstant())
     return false;
-  
   SymbolRef Sym = V.getAsSymbol(/* IncludeBaseRegion */ true);
   if (!Sym)
     return ConditionTruthVal();
-  
   return getStateManager().ConstraintMgr->isNull(this, Sym);
 }
 
 ProgramStateRef ProgramStateManager::getInitialState(const LocationContext *InitLoc) {
   ProgramState State(this,
                 EnvMgr.getInitialEnvironment(),
                 StoreMgr->getInitialStore(InitLoc),
                 GDMFactory.getEmptyMap());
ProgramStateRef ProgramStateManager::getPersistentState(ProgramState &State) {
   void *InsertPos;
 
   if (ProgramState *I = StateSet.FindNodeOrInsertPos(ID, InsertPos))
     return I;
 
   ProgramState *newState = nullptr;
   if (!freeStates.empty()) {
     newState = freeStates.back();
-    freeStates.pop_back();    
+    freeStates.pop_back();
   }
   else {
     newState = (ProgramState*) Alloc.Allocate<ProgramState>();
   }
   new (newState) ProgramState(State);
   StateSet.InsertNode(newState, InsertPos);
   return newState;
 }
bool ScanReachableSymbols::scan(nonloc::CompoundVal val) {
 
   return true;
 }
 
 bool ScanReachableSymbols::scan(const SymExpr *sym) {
   bool wasVisited = !visited.insert(sym).second;
   if (wasVisited)
     return true;
-  
   if (!visitor.VisitSymbol(sym))
     return false;
-  
   // TODO: should be rewritten using SymExpr::symbol_iterator.
   switch (sym->getKind()) {
     case SymExpr::RegionValueKind:
     case SymExpr::ConjuredKind:
     case SymExpr::DerivedKind:
     case SymExpr::ExtentKind:
     case SymExpr::MetadataKind:
       break;
if (Optional<nonloc::CompoundVal> X = val.getAs<nonloc::CompoundVal>())
     return scan(*X);
 
   return true;
 }
 
 bool ScanReachableSymbols::scan(const MemRegion *R) {
   if (isa<MemSpaceRegion>(R))
     return true;
-  
   bool wasVisited = !visited.insert(R).second;
   if (wasVisited)
     return true;
-  
   if (!visitor.VisitMemRegion(R))
     return false;
 
   // If this is a symbolic region, visit the symbol for the region.
   if (const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(R))
     if (!visitor.VisitSymbol(SR->getSymbol()))
       return false;
 
if (const SubRegion *ER = dyn_cast<SubRegion>(Reg))
     return isTainted(ER->getSuperRegion(), K);
 
   return false;
 }
 
 bool ProgramState::isTainted(SymbolRef Sym, TaintTagType Kind) const {
   if (!Sym)
     return false;
-  
   // Traverse all the symbols this symbol depends on to see if any are tainted.
   bool Tainted = false;
   for (SymExpr::symbol_iterator SI = Sym->symbol_begin(), SE =Sym->symbol_end();
        SI != SE; ++SI) {
     if (!isa<SymbolData>(*SI))
       continue;
-    
     const TaintTagType *Tag = get<TaintMap>(*SI);
     Tainted = (Tag && *Tag == Kind);
 
     // If this is a SymbolDerived with a tainted parent, it's also tainted.
     if (const SymbolDerived *SD = dyn_cast<SymbolDerived>(*SI))
       Tainted = Tainted || isTainted(SD->getParentSymbol(), Kind);
 
     // If memory region is tainted, data is also tainted.
     if (const SymbolRegionValue *SRV = dyn_cast<SymbolRegionValue>(*SI))
       Tainted = Tainted || isTainted(SRV->getRegion(), Kind);
 
     // If If this is a SymbolCast from a tainted value, it's also tainted.
     if (const SymbolCast *SC = dyn_cast<SymbolCast>(*SI))
       Tainted = Tainted || isTainted(SC->getOperand(), Kind);
 
     if (Tainted)
       return true;
   }
-  
   return Tainted;
 }
 
 /// The GDM component containing the dynamic type info. This is a map from a
 /// symbol to its most likely type.
 REGISTER_TRAIT_WITH_PROGRAMSTATE(DynamicTypeMap,
                                  CLANG_ENTO_PROGRAMSTATE_MAP(const MemRegion *,
                                                              DynamicTypeInfo))

lib/StaticAnalyzer/Core/RangeConstraintManager.cpp

if (Ranges->Intersect(BV, F, Zero, Zero).isEmpty())
     return false;
 
   // Zero is a possible value, but it is not the /only/ possible value.
   return ConditionTruthVal();
 }
 
 /// Scan all symbols referenced by the constraints. If the symbol is not alive
 /// as marked in LSymbols, mark it as dead in DSymbols.
-ProgramStateRef 
+ProgramStateRef
 RangeConstraintManager::removeDeadBindings(ProgramStateRef state,
                                            SymbolReaper& SymReaper) {
 
   ConstraintRangeTy CR = state->get<ConstraintRange>();
   ConstraintRangeTy::Factory& CRFactory = state->get_context<ConstraintRange>();
 
   for (ConstraintRangeTy::iterator I = CR.begin(), E = CR.end(); I != E; ++I) {
     SymbolRef sym = I.getKey();

 // The syntax for ranges below is mathematical, using [x, y] for closed ranges
 // and (x, y) for open ranges. These ranges are modular, corresponding with
 // a common treatment of C integer overflow. This means that these methods
 // do not have to worry about overflow; RangeSet::Intersect can handle such a
 // "wraparound" range.
 // As an example, the range [UINT_MAX-1, 3) contains five values: UINT_MAX-1,
 // UINT_MAX, 0, 1, and 2.
 
-ProgramStateRef 
+ProgramStateRef
 RangeConstraintManager::assumeSymNE(ProgramStateRef St, SymbolRef Sym,
                                     const llvm::APSInt &Int,
                                     const llvm::APSInt &Adjustment) {
   // Before we do any real work, see if the value can even show up.
   APSIntType AdjustmentType(Adjustment);
   if (AdjustmentType.testInRange(Int, true) != APSIntType::RTR_Within)
     return St;
 
   llvm::APSInt Lower = AdjustmentType.convert(Int) - Adjustment;
   llvm::APSInt Upper = Lower;
   --Lower;
   ++Upper;
 
   // [Int-Adjustment+1, Int-Adjustment-1]
   // Notice that the lower bound is greater than the upper bound.
   RangeSet New = GetRange(St, Sym).Intersect(getBasicVals(), F, Upper, Lower);
   return New.isEmpty() ? nullptr : St->set<ConstraintRange>(Sym, New);
 }
 
-ProgramStateRef 
+ProgramStateRef
 RangeConstraintManager::assumeSymEQ(ProgramStateRef St, SymbolRef Sym,
                                     const llvm::APSInt &Int,
                                     const llvm::APSInt &Adjustment) {
   // Before we do any real work, see if the value can even show up.
   APSIntType AdjustmentType(Adjustment);
   if (AdjustmentType.testInRange(Int, true) != APSIntType::RTR_Within)
     return nullptr;
 
   // [Int-Adjustment, Int-Adjustment]
   llvm::APSInt AdjInt = AdjustmentType.convert(Int) - Adjustment;
   RangeSet New = GetRange(St, Sym).Intersect(getBasicVals(), F, AdjInt, AdjInt);
   return New.isEmpty() ? nullptr : St->set<ConstraintRange>(Sym, New);
 }
 
-ProgramStateRef 
+ProgramStateRef
 RangeConstraintManager::assumeSymLT(ProgramStateRef St, SymbolRef Sym,
                                     const llvm::APSInt &Int,
                                     const llvm::APSInt &Adjustment) {
   // Before we do any real work, see if the value can even show up.
   APSIntType AdjustmentType(Adjustment);
   switch (AdjustmentType.testInRange(Int, true)) {
   case APSIntType::RTR_Below:
     return nullptr;
RangeConstraintManager::assumeSymLT(ProgramStateRef St, SymbolRef Sym,
   llvm::APSInt Lower = Min-Adjustment;
   llvm::APSInt Upper = ComparisonVal-Adjustment;
   --Upper;
 
   RangeSet New = GetRange(St, Sym).Intersect(getBasicVals(), F, Lower, Upper);
   return New.isEmpty() ? nullptr : St->set<ConstraintRange>(Sym, New);
 }
 
-ProgramStateRef 
+ProgramStateRef
 RangeConstraintManager::assumeSymGT(ProgramStateRef St, SymbolRef Sym,
                                     const llvm::APSInt &Int,
                                     const llvm::APSInt &Adjustment) {
   // Before we do any real work, see if the value can even show up.
   APSIntType AdjustmentType(Adjustment);
   switch (AdjustmentType.testInRange(Int, true)) {
   case APSIntType::RTR_Below:
     return St;
RangeConstraintManager::assumeSymGT(ProgramStateRef St, SymbolRef Sym,
   llvm::APSInt Lower = ComparisonVal-Adjustment;
   llvm::APSInt Upper = Max-Adjustment;
   ++Lower;
 
   RangeSet New = GetRange(St, Sym).Intersect(getBasicVals(), F, Lower, Upper);
   return New.isEmpty() ? nullptr : St->set<ConstraintRange>(Sym, New);
 }
 
-ProgramStateRef 
+ProgramStateRef
 RangeConstraintManager::assumeSymGE(ProgramStateRef St, SymbolRef Sym,
                                     const llvm::APSInt &Int,
                                     const llvm::APSInt &Adjustment) {
   // Before we do any real work, see if the value can even show up.
   APSIntType AdjustmentType(Adjustment);
   switch (AdjustmentType.testInRange(Int, true)) {
   case APSIntType::RTR_Below:
     return St;
RangeConstraintManager::assumeSymGE(ProgramStateRef St, SymbolRef Sym,
   llvm::APSInt Max = AdjustmentType.getMaxValue();
   llvm::APSInt Lower = ComparisonVal-Adjustment;
   llvm::APSInt Upper = Max-Adjustment;
 
   RangeSet New = GetRange(St, Sym).Intersect(getBasicVals(), F, Lower, Upper);
   return New.isEmpty() ? nullptr : St->set<ConstraintRange>(Sym, New);
 }
 
-ProgramStateRef 
+ProgramStateRef
 RangeConstraintManager::assumeSymLE(ProgramStateRef St, SymbolRef Sym,
                                     const llvm::APSInt &Int,
                                     const llvm::APSInt &Adjustment) {
   // Before we do any real work, see if the value can even show up.
   APSIntType AdjustmentType(Adjustment);
   switch (AdjustmentType.testInRange(Int, true)) {
   case APSIntType::RTR_Below:
     return nullptr;

lib/StaticAnalyzer/Core/RegionStore.cpp

RegionBindingsRef bindAggregate(RegionBindingsConstRef B,
                                   SVal DefaultVal);
 
   /// \brief Create a new store with the specified binding removed.
   /// \param ST the original store, that is the basis for the new store.
   /// \param L the location whose binding should be removed.
   StoreRef killBinding(Store ST, Loc L) override;
 
   void incrementReferenceCount(Store store) override {
-    getRegionBindings(store).manualRetain();    
+    getRegionBindings(store).manualRetain();
   }
-  
   /// If the StoreManager supports it, decrement the reference count of
   /// the specified Store object.  If the reference count hits 0, the memory
   /// associated with the object is recycled.
   void decrementReferenceCount(Store store) override {
     getRegionBindings(store).manualRelease();
   }
 
   bool includedInBindings(Store store, const MemRegion *region) const override;
public: // Part of public interface to class.
 
   SVal getBindingForVar(RegionBindingsConstRef B, const VarRegion *R);
 
   SVal getBindingForLazySymbol(const TypedValueRegion *R);
 
   SVal getBindingForFieldOrElementCommon(RegionBindingsConstRef B,
                                          const TypedValueRegion *R,
                                          QualType Ty);
-  
   SVal getLazyBinding(const SubRegion *LazyBindingRegion,
                       RegionBindingsRef LazyBinding);
 
   /// Get bindings for the values in a struct and return a CompoundVal, used
   /// when doing struct copy:
   /// struct s x, y;
   /// x = y;
   /// y's value is retrieved by this method.
if (Optional<nonloc::LazyCompoundVal> LCS =
 
     return;
   }
 }
 
 void invalidateRegionsWorker::VisitCluster(const MemRegion *baseR,
                                            const ClusterBindings *C) {
 
-  bool PreserveRegionsContents = 
-      ITraits.hasTrait(baseR, 
+  bool PreserveRegionsContents =
+      ITraits.hasTrait(baseR,
                        RegionAndSymbolInvalidationTraits::TK_PreserveContents);
 
   if (C) {
     for (ClusterBindings::iterator I = C->begin(), E = C->end(); I != E; ++I)
       VisitBinding(I.getData());
 
     // Invalidate regions contents.
     if (!PreserveRegionsContents)
if (Result.second)
       Result.second = MRMgr.getFieldRegionWithSuper(FR, Result.second);
 
   } else if (const CXXBaseObjectRegion *BaseReg =
                dyn_cast<CXXBaseObjectRegion>(R)) {
     // C++ base object region is another kind of region that we should blast
     // through to look for lazy compound value. It is like a field region.
     Result = findLazyBinding(B, cast<SubRegion>(BaseReg->getSuperRegion()),
                              originalRegion);
-    
     if (Result.second)
       Result.second = MRMgr.getCXXBaseObjectRegionWithSuper(BaseReg,
                                                             Result.second);
   }
 
   return Result;
 }
 
if (Optional<nonloc::ConcreteInt> CI = Idx.getAs<nonloc::ConcreteInt>()) {
       // Technically, only i == length is guaranteed to be null.
       // However, such overflows should be caught before reaching this point;
       // the only time such an access would be made is if a string literal was
       // used to initialize a larger array.
       char c = (i >= length) ? '\0' : Str->getCodeUnit(i);
       return svalBuilder.makeIntVal(c, T);
     }
   }
-  
   // Check for loads from a code text region.  For such loads, just give up.
   if (isa<CodeTextRegion>(superR))
     return UnknownVal();
 
   // Handle the case where we are indexing into a larger scalar object.
   // For example, this handles:
   //   int x = ...
   //   char *y = &x;
   //   return *y;
   // FIXME: This is a hack, and doesn't do anything really intelligent yet.
   const RegionRawOffset &O = R->getAsArrayOffset();
-  
   // If we cannot reason about the offset, return an unknown value.
   if (!O.getRegion())
     return UnknownVal();
-  
-  if (const TypedValueRegion *baseR = 
+  if (const TypedValueRegion *baseR =
         dyn_cast_or_null<TypedValueRegion>(O.getRegion())) {
     QualType baseT = baseR->getValueType();
     if (baseT->isScalarType()) {
       QualType elemT = R->getElementType();
       if (elemT->isScalarType()) {
         if (Ctx.getTypeSizeInChars(baseT) >= Ctx.getTypeSizeInChars(elemT)) {
           if (const Optional<SVal> &V = B.getDirectBinding(superR)) {
             if (SymbolRef parentSym = V->getAsSymbol())
SVal RegionStoreManager::getLazyBinding(const SubRegion *LazyBindingRegion,
   //
   // This hack only takes care of the undefined case because that can very
   // quickly result in a warning.
   if (Result.isUndef())
     Result = UnknownVal();
 
   return Result;
 }
-                                        
 SVal
 RegionStoreManager::getBindingForFieldOrElementCommon(RegionBindingsConstRef B,
                                                       const TypedValueRegion *R,
                                                       QualType Ty) {
 
   // At this point we have already checked in either getBindingForElement or
   // getBindingForField if 'R' has a direct binding.
 
if (Optional<SVal> D = getBindingForDerivedDefaultValue(B, Base, R, Ty)) {
       return *D;
     }
 
     if (const ElementRegion *ER = dyn_cast<ElementRegion>(Base)) {
       NonLoc index = ER->getIndex();
       if (!index.isConstant())
         hasSymbolicIndex = true;
     }
-    
     // If our super region is a field or element itself, walk up the region
     // hierarchy to see if there is a default value installed in an ancestor.
     SR = dyn_cast<SubRegion>(Base);
   }
 
   if (R->hasStackNonParametersStorage()) {
     if (isa<ElementRegion>(R)) {
       // Currently we don't reason specially about Clang-style vectors.  Check
       // if superR is a vector and if so return Unknown.
-      if (const TypedValueRegion *typedSuperR = 
+      if (const TypedValueRegion *typedSuperR =
             dyn_cast<TypedValueRegion>(R->getSuperRegion())) {
         if (typedSuperR->getValueType()->isVectorType())
           return UnknownVal();
       }
     }
 
     // FIXME: We also need to take ElementRegions with symbolic indexes into
     // account.  This case handles both directly accessing an ElementRegion
if (V.isUnknownOrUndef() || V.isConstant())
       continue;
 
     if (Optional<nonloc::LazyCompoundVal> InnerLCV =
             V.getAs<nonloc::LazyCompoundVal>()) {
       const SValListTy &InnerList = getInterestingValues(*InnerLCV);
       List.insert(List.end(), InnerList.begin(), InnerList.end());
       continue;
     }
-    
     List.push_back(V);
   }
 
   return (LazyBindingsMap[LCV.getCVData()] = std::move(List));
 }
 
 NonLoc RegionStoreManager::createLazyBinding(RegionBindingsConstRef B,
                                              const TypedValueRegion *R) {
SVal RegionStoreManager::getBindingForStruct(RegionBindingsConstRef B,
 
   return createLazyBinding(B, R);
 }
 
 SVal RegionStoreManager::getBindingForArray(RegionBindingsConstRef B,
                                             const TypedValueRegion *R) {
   assert(Ctx.getAsConstantArrayType(R->getValueType()) &&
          "Only constant array types can have compound bindings.");
-  
   return createLazyBinding(B, R);
 }
 
 bool RegionStoreManager::includedInBindings(Store store,
                                             const MemRegion *region) const {
   RegionBindingsRef B = getRegionBindings(store);
   region = region->getBaseRegion();
 

 }
 
 RegionBindingsRef RegionStoreManager::bindVector(RegionBindingsConstRef B,
                                                  const TypedValueRegion* R,
                                                  SVal V) {
   QualType T = R->getValueType();
   assert(T->isVectorType());
   const VectorType *VT = T->getAs<VectorType>(); // Use getAs for typedefs.
- 
   // Handle lazy compound values and symbolic values.
   if (V.getAs<nonloc::LazyCompoundVal>() || V.getAs<nonloc::SymbolVal>())
     return bindAggregate(B, R, V);
-  
   // We may get non-CompoundVal accidentally due to imprecise cast logic or
   // that we are binding symbolic struct value. Kill the field values, and if
   // the value is symbolic go and bind it as a "default" binding.
   if (!V.getAs<nonloc::CompoundVal>()) {
     return bindAggregate(B, R, UnknownVal());
   }
 
   QualType ElemType = VT->getElementType();
   nonloc::CompoundVal CV = V.castAs<nonloc::CompoundVal>();
   nonloc::CompoundVal::iterator VI = CV.begin(), VE = CV.end();
   unsigned index = 0, numElements = VT->getNumElements();
   RegionBindingsRef NewB(B);
 
   for ( ; index != numElements ; ++index) {
     if (VI == VE)
       break;
-    
     NonLoc Idx = svalBuilder.makeArrayIndex(index);
     const ElementRegion *ER = MRMgr.getElementRegion(ElemType, Idx, R, Ctx);
 
     if (ElemType->isArrayType())
       NewB = bindArray(NewB, ER, *VI);
     else if (ElemType->isStructureOrClassType())
       NewB = bindStruct(NewB, ER, *VI);
     else
for (const auto *FD : RD->fields()) {
     QualType Ty = FD->getType();
     if (!(Ty->isScalarType() || Ty->isReferenceType()))
       return None;
 
     Fields.push_back(FD);
   }
 
   RegionBindingsRef NewB = B;
-  
   for (FieldVector::iterator I = Fields.begin(), E = Fields.end(); I != E; ++I){
     const FieldRegion *SourceFR = MRMgr.getFieldRegion(*I, LCV.getRegion());
     SVal V = getBindingForField(getRegionBindings(LCV.getStore()), SourceFR);
 
     const FieldRegion *DestFR = MRMgr.getFieldRegion(*I, R);
     NewB = bind(NewB, loc::MemRegionVal(DestFR), V);
   }
 
for (RegionStoreManager::SValListTy::const_iterator I = Vals.begin(),
       VisitBinding(*I);
 
     return;
   }
 
   // If V is a region, then add it to the worklist.
   if (const MemRegion *R = V.getAsRegion()) {
     AddToWorkList(R);
-    
     // All regions captured by a block are also live.
     if (const BlockDataRegion *BR = dyn_cast<BlockDataRegion>(R)) {
       BlockDataRegion::referenced_vars_iterator I = BR->referenced_vars_begin(),
                                                 E = BR->referenced_vars_end();
       for ( ; I != E; ++I)
         AddToWorkList(I.getCapturedRegion());
     }
   }
-    
 
   // Update the set of live symbols.
   for (SymExpr::symbol_iterator SI = V.symbol_begin(), SE = V.symbol_end();
        SI!=SE; ++SI)
     SymReaper.markLive(*SI);
 }
 
 bool removeDeadBindingsWorker::UpdatePostponed() {

lib/StaticAnalyzer/Core/SValBuilder.cpp

SVal SValBuilder::convertToArrayIndex(SVal val) {
 
   return evalCastFromNonLoc(val.castAs<NonLoc>(), ArrayIndexTy);
 }
 
 nonloc::ConcreteInt SValBuilder::makeBoolVal(const CXXBoolLiteralExpr *boolean){
   return makeTruthVal(boolean->getValue());
 }
 
-DefinedOrUnknownSVal 
+DefinedOrUnknownSVal
 SValBuilder::getRegionValueSymbolVal(const TypedValueRegion* region) {
   QualType T = region->getValueType();
 
   if (!SymbolManager::canSymbolicate(T))
     return UnknownVal();
 
   SymbolRef sym = SymMgr.getRegionValueSymbol(region);
 

 DefinedOrUnknownSVal SValBuilder::conjureSymbolVal(const Stmt *stmt,
                                                    const LocationContext *LCtx,
                                                    QualType type,
                                                    unsigned visitCount) {
   if (!SymbolManager::canSymbolicate(type))
     return UnknownVal();
 
   SymbolRef sym = SymMgr.conjureSymbol(stmt, LCtx, type, visitCount);
-  
   if (Loc::isLocType(type))
     return loc::MemRegionVal(MemMgr.getSymbolicRegion(sym));
-  
   return nonloc::SymbolVal(sym);
 }
 
 DefinedOrUnknownSVal
 SValBuilder::getConjuredHeapSymbolVal(const Expr *E,
                                       const LocationContext *LCtx,
                                       unsigned VisitCount) {
   QualType T = E->getType();

 //===----------------------------------------------------------------------===//
 
 SVal SValBuilder::makeSymExprValNN(ProgramStateRef State,
                                    BinaryOperator::Opcode Op,
                                    NonLoc LHS, NonLoc RHS,
                                    QualType ResultTy) {
   if (!State->isTainted(RHS) && !State->isTainted(LHS))
     return UnknownVal();
-    
   const SymExpr *symLHS = LHS.getAsSymExpr();
   const SymExpr *symRHS = RHS.getAsSymExpr();
   // TODO: When the Max Complexity is reached, we should conjure a symbol
   // instead of generating an Unknown value and propagate the taint info to it.
   const unsigned MaxComp = 10000; // 100000 28X
 
   if (symLHS && symRHS &&
       (symLHS->computeComplexity() + symRHS->computeComplexity()) <  MaxComp)
if (castTy->isBooleanType()) {
     return evalCastFromLoc(L, castTy);
   }
 
   // For const casts, casts to void, just propagate the value.
   if (!castTy->isVariableArrayType() && !originalTy->isVariableArrayType())
     if (shouldBeModeledWithNoOp(Context, Context.getPointerType(castTy),
                                          Context.getPointerType(originalTy)))
       return val;
-  
   // Check for casts from pointers to integers.
   if (castTy->isIntegralOrEnumerationType() && Loc::isLocType(originalTy))
     return evalCastFromLoc(val.castAs<Loc>(), castTy);
 
   // Check for casts from integers to pointers.
   if (Loc::isLocType(castTy) && originalTy->isIntegralOrEnumerationType()) {
     if (Optional<nonloc::LocAsInteger> LV = val.getAs<nonloc::LocAsInteger>()) {
       if (const MemRegion *R = LV->getLoc().getAsRegion()) {

lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp

if (rhs.isZeroConstant()) {
         return makeTruthVal(true, resultTy);
       }
     }
     // There may be two labels for the same location, and a function region may
     // have the same address as a label at the start of the function (depending
     // on the ABI).
     // FIXME: we can probably do a comparison against other MemRegions, though.
     // FIXME: is there a way to tell if two labels refer to the same location?
-    return UnknownVal(); 
+    return UnknownVal();
 
   case loc::ConcreteIntKind: {
     // If one of the operands is a symbol and the other is a constant,
     // build an expression for use by the constraint manager.
     if (SymbolRef rSym = rhs.getAsLocSymbol()) {
       // We can only build expressions with symbols on the left,
       // so we need a reversible operator.
       if (!BinaryOperator::isComparisonOp(op))
SVal SimpleSValBuilder::evalBinOpLN(ProgramStateRef state,
                                   BinaryOperator::Opcode op,
                                   Loc lhs, NonLoc rhs, QualType resultTy) {
   assert(!BinaryOperator::isComparisonOp(op) &&
          "arguments to comparison ops must be of the same type");
 
   // Special case: rhs is a zero constant.
   if (rhs.isZeroConstant())
     return lhs;
-  
   // We are dealing with pointer arithmetic.
 
   // Handle pointer arithmetic on constant values.
   if (Optional<nonloc::ConcreteInt> rhsInt = rhs.getAs<nonloc::ConcreteInt>()) {
     if (Optional<loc::ConcreteInt> lhsInt = lhs.getAs<loc::ConcreteInt>()) {
       const llvm::APSInt &leftI = lhsInt->getValue();
       assert(leftI.isUnsigned());
       llvm::APSInt rightI(rhsInt->getValue(), /* isUnsigned */ true);
 
       // Convert the bitwidth of rightI.  This should deal with overflow
       // since we are dealing with concrete values.
       rightI = rightI.extOrTrunc(leftI.getBitWidth());
 
       // Offset the increment by the pointer size.
       llvm::APSInt Multiplicand(rightI.getBitWidth(), /* isUnsigned */ true);
       rightI *= Multiplicand;
-      
       // Compute the adjusted pointer.
       switch (op) {
         case BO_Add:
           rightI = leftI + rightI;
           break;
         case BO_Sub:
           rightI = leftI - rightI;
           break;
else if (isa<SubRegion>(region)) {
         elementType = resultTy->getPointeeType();
     }
 
     if (Optional<NonLoc> indexV = index.getAs<NonLoc>()) {
       return loc::MemRegionVal(MemMgr.getElementRegion(elementType, *indexV,
                                                        superR, getContext()));
     }
   }
-  return UnknownVal();  
+  return UnknownVal();
 }
 
 const llvm::APSInt *SimpleSValBuilder::getKnownValue(ProgramStateRef state,
                                                    SVal V) {
   if (V.isUnknownOrUndef())
     return nullptr;
 
   if (Optional<loc::ConcreteInt> X = V.getAs<loc::ConcreteInt>())

lib/StaticAnalyzer/Core/Store.cpp

const MemRegion *StoreManager::MakeElementRegion(const MemRegion *Base,
   NonLoc idx = svalBuilder.makeArrayIndex(index);
   return MRMgr.getElementRegion(EleTy, idx, Base, svalBuilder.getContext());
 }
 
 StoreRef StoreManager::BindDefault(Store store, const MemRegion *R, SVal V) {
   return StoreRef(store, *this);
 }
 
-const ElementRegion *StoreManager::GetElementZeroRegion(const MemRegion *R, 
+const ElementRegion *StoreManager::GetElementZeroRegion(const MemRegion *R,
                                                         QualType T) {
   NonLoc idx = svalBuilder.makeZeroArrayIndex();
   assert(!T.isNull());
   return MRMgr.getElementRegion(T, idx, R, Ctx);
 }
 
 const MemRegion *StoreManager::castRegion(const MemRegion *R, QualType CastToTy) {
 

 }
 
 
 /// CastRetrievedVal - Used by subclasses of StoreManager to implement
 ///  implicit casts that arise from loads from regions that are reinterpreted
 ///  as another region.
 SVal StoreManager::CastRetrievedVal(SVal V, const TypedValueRegion *R,
                                     QualType castTy, bool performTestOnly) {
-  
   if (castTy.isNull() || V.isUnknownOrUndef())
     return V;
-  
   ASTContext &Ctx = svalBuilder.getContext();
 
-  if (performTestOnly) {  
+  if (performTestOnly) {
     // Automatically translate references to pointers.
     QualType T = R->getValueType();
     if (const ReferenceType *RT = T->getAs<ReferenceType>())
       T = Ctx.getPointerType(RT->getPointeeType());
-    
     assert(svalBuilder.getContext().hasSameUnqualifiedType(castTy, T));
     return V;
   }
-  
   return svalBuilder.dispatchCast(V, castTy);
 }
 
 SVal StoreManager::getLValueFieldOrIvar(const Decl *D, SVal Base) {
   if (Base.isUnknownOrUndef())
     return Base;
 
   Loc BaseL = Base.castAs<Loc>();
SVal StoreManager::getLValueFieldOrIvar(const Decl *D, SVal Base) {
 
   return loc::MemRegionVal(MRMgr.getFieldRegion(cast<FieldDecl>(D), BaseR));
 }
 
 SVal StoreManager::getLValueIvar(const ObjCIvarDecl *decl, SVal base) {
   return getLValueFieldOrIvar(decl, base);
 }
 
-SVal StoreManager::getLValueElement(QualType elementType, NonLoc Offset, 
+SVal StoreManager::getLValueElement(QualType elementType, NonLoc Offset,
                                     SVal Base) {
 
   // If the base is an unknown or undefined value, just return it back.
   // FIXME: For absolute pointer addresses, we just return that value back as
   //  well, although in reality we should return the offset added to that
   //  value.
   if (Base.isUnknownOrUndef() || Base.getAs<loc::ConcreteInt>())
     return Base;

lib/StaticAnalyzer/Core/SymbolManager.cpp

bool SymbolReaper::maybeDead(SymbolRef sym) {
 
   TheDead.insert(sym);
   return true;
 }
 
 bool SymbolReaper::isLiveRegion(const MemRegion *MR) {
   if (RegionRoots.count(MR))
     return true;
-  
   MR = MR->getBaseRegion();
 
   if (const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(MR))
     return isLive(SR->getSymbol());
 
   if (const VarRegion *VR = dyn_cast<VarRegion>(MR))
     return isLive(VR, true);
 
bool SymbolReaper::isLiveRegion(const MemRegion *MR) {
   return false;
 }
 
 bool SymbolReaper::isLive(SymbolRef sym) {
   if (TheLiving.count(sym)) {
     markDependentsLive(sym);
     return true;
   }
-  
   bool KnownLive;
-  
   switch (sym->getKind()) {
   case SymExpr::RegionValueKind:
     KnownLive = isLiveRegion(cast<SymbolRegionValue>(sym)->getRegion());
     break;
   case SymExpr::ConjuredKind:
     KnownLive = false;
     break;
   case SymExpr::DerivedKind:
if (VarContext == CurrentContext) {
     if (!Loc)
       return true;
 
     if (LCtx->getAnalysis<RelaxedLiveVariables>()->isLive(Loc, VR->getDecl()))
       return true;
 
     if (!includeStoreBindings)
       return false;
-    
     unsigned &cachedQuery =
       const_cast<SymbolReaper*>(this)->includedRegionCache[VR];
 
     if (cachedQuery) {
       return cachedQuery == 1;
     }
 
     // Query the store to see if the region occurs in any live bindings.
     if (Store store = reapedStore.getStore()) {
-      bool hasRegion = 
+      bool hasRegion =
         reapedStore.getStoreManager().includedInBindings(store, VR);
       cachedQuery = hasRegion ? 1 : 2;
       return hasRegion;
     }
-    
     return false;
   }
 
   return VarContext->isParentOf(CurrentContext);
 }

lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp

public:
   CodeInjector *Injector;
 
   /// \brief Stores the declarations from the local translation unit.
   /// Note, we pre-compute the local declarations at parse time as an
   /// optimization to make sure we do not deserialize everything from disk.
   /// The local declaration to all declarations ratio might be very small when
   /// working with a PCH file.
   SetOfDecls LocalTUDecls;
-                           
   // Set of PathDiagnosticConsumers.  Owned by AnalysisManager.
   PathDiagnosticConsumers PathConsumers;
 
   StoreManagerCreator CreateStoreMgr;
   ConstraintManagerCreator CreateConstraintMgr;
 
   std::unique_ptr<CheckerManager> checkerMgr;
   std::unique_ptr<AnalysisManager> Mgr;
#include "clang/StaticAnalyzer/Core/Analyses.def"
 
   bool VisitObjCMethodDecl(ObjCMethodDecl *MD) {
     if (MD->isThisDeclarationADefinition()) {
       assert(RecVisitorMode == AM_Syntax || Mgr->shouldInlineCall() == false);
       HandleCode(MD, RecVisitorMode);
     }
     return true;
   }
-  
   bool VisitBlockDecl(BlockDecl *BD) {
     if (BD->hasBody()) {
       assert(RecVisitorMode == AM_Syntax || Mgr->shouldInlineCall() == false);
       HandleCode(BD, RecVisitorMode);
     }
     return true;
   }
 
void AnalysisConsumer::HandleDeclsCallGraph(const unsigned LocalTUDeclsSize) {
   SetOfConstDecls VisitedAsTopLevel;
   llvm::ReversePostOrderTraversal<clang::CallGraph*> RPOT(&CG);
   for (llvm::ReversePostOrderTraversal<clang::CallGraph*>::rpo_iterator
          I = RPOT.begin(), E = RPOT.end(); I != E; ++I) {
     NumFunctionTopLevel++;
 
     CallGraphNode *N = *I;
     Decl *D = N->getDecl();
-    
     // Skip the abstract root node.
     if (!D)
       continue;
 
     // Skip the functions which have been processed already or previously
     // inlined.
     if (shouldSkipFunction(D, Visited, VisitedAsTopLevel))
       continue;

 void AnalysisConsumer::RunPathSensitiveChecks(Decl *D,
                                               ExprEngine::InliningModes IMode,
                                               SetOfConstDecls *Visited) {
 
   switch (Mgr->getLangOpts().getGC()) {
   case LangOptions::NonGC:
     ActionExprEngine(D, false, IMode, Visited);
     break;
-  
   case LangOptions::GCOnly:
     ActionExprEngine(D, true, IMode, Visited);
     break;
-  
   case LangOptions::HybridGC:
     ActionExprEngine(D, false, IMode, Visited);
     ActionExprEngine(D, true, IMode, Visited);
     break;
   }
 }
 
 //===----------------------------------------------------------------------===//

lib/StaticAnalyzer/Frontend/CheckerRegistration.cpp

class ClangCheckerRegistry : public CheckerRegistry {
   static bool isCompatibleAPIVersion(const char *versionString);
   static void warnIncompatible(DiagnosticsEngine *diags, StringRef pluginPath,
                                const char *pluginAPIVersion);
 
 public:
   ClangCheckerRegistry(ArrayRef<std::string> plugins,
                        DiagnosticsEngine *diags = nullptr);
 };
-  
 } // end anonymous namespace
 
 ClangCheckerRegistry::ClangCheckerRegistry(ArrayRef<std::string> plugins,
                                            DiagnosticsEngine *diags) {
   registerBuiltinCheckers(*this);
 
   for (ArrayRef<std::string>::iterator i = plugins.begin(), e = plugins.end();
        i != e; ++i) {

lib/StaticAnalyzer/Frontend/Makefile

 ##===- clang/lib/StaticAnalyzer/Frontend/Makefile ----------*- Makefile -*-===##
-# 
+#
 #                     The LLVM Compiler Infrastructure
 #
 # This file is distributed under the University of Illinois Open Source
 # License. See LICENSE.TXT for details.
-# 
+#
 ##===----------------------------------------------------------------------===##
 #
 # Starting point into the static analyzer land for the driver.
 #
 ##===----------------------------------------------------------------------===##
 
 CLANG_LEVEL := ../../..
 LIBRARYNAME := clangStaticAnalyzerFrontend
 
 CPP.Flags += -I${PROJ_OBJ_DIR}/../Checkers
 
 include $(CLANG_LEVEL)/Makefile

tools/scan-build/ccc-analyzer

elsif ($Verbose == 2) {
     print STDERR "#SHELL (cd '$dir' && @PrintArgs)\n";
   }
 
   # Save STDOUT and STDERR of clang to a temporary file and reroute
   # all clang output to ccc-analyzer's STDERR.
   # We save the output file in the 'crashes' directory if clang encounters
   # any problems with the file.
   my ($ofh, $ofile) = tempfile("clang_output_XXXXXX", DIR => $HtmlDir);
-  
   my $OutputStream = silent_system($HtmlDir, $Cmd, @CmdArgs);
   while ( <$OutputStream> ) {
     print $ofh $_;
     print STDERR $_;
   }
   my $Result = $?;
   close $ofh;
 

tools/scan-build/scan-build

 # Process command-line arguments.
 ##----------------------------------------------------------------------------##
 
 my $RequestDisplayHelp = 0;
 my $ForceDisplayHelp = 0;
 
 sub ProcessArgs {
   my $Args = shift;
- 
   while (@$Args) {
 
     # Scan for options we recognize.
 
     my $arg = $Args->[0];
 
     if ($arg eq "-h" or $arg eq "--help") {
       $RequestDisplayHelp = 1;

utils/analyzer/CmpRuns.py

 #!/usr/bin/env python
 
 """
 CmpRuns - A simple tool for comparing two static analyzer runs to determine
 which reports have been added, removed, or changed.
 
 This is designed to support automated testing using the static analyzer, from
-two perspectives: 
+two perspectives:
   1. To monitor changes in the static analyzer's reports on real code bases, for
      regression testing.
 
   2. For use by end users who want to integrate regular static analyzer testing
      into a buildbot like environment.
 
 Usage:
 
     # Load the results of both runs, to obtain lists of the corresponding
     # AnalysisDiagnostic objects.
     #
     resultsA = loadResultsFromSingleRun(singleRunInfoA, deleteEmpty)
     resultsB = loadResultsFromSingleRun(singleRunInfoB, deleteEmpty)
-    
-    # Generate a relation from diagnostics in run A to diagnostics in run B 
-    # to obtain a list of triples (a, b, confidence). 
+    # Generate a relation from diagnostics in run A to diagnostics in run B
+    # to obtain a list of triples (a, b, confidence).
     diff = compareResults(resultsA, resultsB)
-           
 """
 
 import os
 import plistlib
 import CmpRuns
 
 # Information about analysis run:
 # path - the analysis output directory
-# root - the name of the root directory, which will be disregarded when 
+# root - the name of the root directory, which will be disregarded when
 # determining the source file name
 class SingleRunInfo:
     def __init__(self, path, root="", verboseLog=None):
         self.path = path
         self.root = root.rstrip("/\\")
         self.verboseLog = verboseLog
 
 class AnalysisDiagnostic:
     def __init__(self, data, report, htmlReport):
         self._data = data
         self._loc = self._data['location']
         self._report = report
         self._htmlReport = htmlReport
 
     def getFileName(self):
         root = self._report.run.root
         fileName = self._report.files[self._loc['file']]
         if fileName.startswith(root) and len(root) > 0:
             return fileName[len(root)+1:]
         return fileName
 
     def getLine(self):
         return self._loc['line']
-        
     def getColumn(self):
         return self._loc['col']
 
     def getCategory(self):
         return self._data['category']
 
     def getDescription(self):
         return self._data['description']
 
     def getIssueIdentifier(self) :
         id = self.getFileName() + "+"
         if 'issue_context' in self._data :
           id += self._data['issue_context'] + "+"
         if 'issue_hash' in self._data :
           id += str(self._data['issue_hash'])
         return id
 
     def getReport(self):
         if self._htmlReport is None:
             return " "
         return os.path.join(self._report.run.path, self._htmlReport)
 
     def getReadableName(self):
-        return '%s:%d:%d, %s: %s' % (self.getFileName(), self.getLine(), 
-                                     self.getColumn(), self.getCategory(), 
+        return '%s:%d:%d, %s: %s' % (self.getFileName(), self.getLine(),
+                                     self.getColumn(), self.getCategory(),
                                      self.getDescription())
-        
-    # Note, the data format is not an API and may change from one analyzer 
-    # version to another.        
+    # Note, the data format is not an API and may change from one analyzer
+    # version to another.
     def getRawData(self):
         return self._data
 
 class multidict:
     def __init__(self, elts=()):
         self.data = {}
         for key,value in elts:
             self[key] = value
-    
     def __getitem__(self, item):
         return self.data[item]
     def __setitem__(self, key, value):
         if key in self.data:
             self.data[key].append(value)
         else:
             self.data[key] = [value]
     def items(self):
class AnalysisRun:
     def __init__(self, info):
         self.path = info.path
         self.root = info.root
         self.info = info
         self.reports = []
         # Cumulative list of all diagnostics from all the reports.
         self.diagnostics = []
         self.clang_version = None
-    
     def getClangVersion(self):
         return self.clang_version
 
     def readSingleFile(self, p, deleteEmpty):
         data = plistlib.readPlist(p)
 
-        # We want to retrieve the clang version even if there are no 
-        # reports. Assume that all reports were created using the same 
+        # We want to retrieve the clang version even if there are no
+        # reports. Assume that all reports were created using the same
         # clang version (this is always true and is more efficient).
         if 'clang_version' in data:
             if self.clang_version == None:
                 self.clang_version = data.pop('clang_version')
             else:
                 data.pop('clang_version')
 
         # Ignore/delete empty reports.
         if not data['files']:
             if deleteEmpty == True:
                 os.remove(p)
             return
 
         # Extract the HTML reports, if they exists.
         if 'HTMLDiagnostics_files' in data['diagnostics'][0]:
             htmlFiles = []
             for d in data['diagnostics']:
                 # FIXME: Why is this named files, when does it have multiple
                 # files?
                 assert len(d['HTMLDiagnostics_files']) == 1
                 htmlFiles.append(d.pop('HTMLDiagnostics_files')[0])
         else:
             htmlFiles = [None] * len(data['diagnostics'])
-            
         report = AnalysisReport(self, data.pop('files'))
-        diagnostics = [AnalysisDiagnostic(d, report, h) 
+        diagnostics = [AnalysisDiagnostic(d, report, h)
                        for d,h in zip(data.pop('diagnostics'),
                                       htmlFiles)]
 
         assert not data
 
         report.diagnostics.extend(diagnostics)
         self.reports.append(report)
         self.diagnostics.extend(diagnostics)
 
 
-# Backward compatibility API. 
+# Backward compatibility API.
 def loadResults(path, opts, root = "", deleteEmpty=True):
     return loadResultsFromSingleRun(SingleRunInfo(path, root, opts.verboseLog),
                                     deleteEmpty)
 
 # Load results of the analyzes from a given output folder.
 # - info is the SingleRunInfo object
 # - deleteEmpty specifies if the empty plist files should be deleted
 def loadResultsFromSingleRun(info, deleteEmpty=True):
for b in neqB:
         res.append((None, b, None))
 
     return res
 
 def dumpScanBuildResultsDiff(dirA, dirB, opts, deleteEmpty=True):
     # Load the run results.
     resultsA = loadResults(dirA, opts, opts.rootA, deleteEmpty)
     resultsB = loadResults(dirB, opts, opts.rootB, deleteEmpty)
-    
     # Open the verbose log, if given.
     if opts.verboseLog:
         auxLog = open(opts.verboseLog, "wb")
     else:
         auxLog = None
 
     diff = compareResults(resultsA, resultsB)
     foundDiffs = 0
for res in diff:
             if auxLog:
                 print >>auxLog, ("('REMOVED', %r, %r)" % (a.getReadableName(),
                                                           a.getReport()))
         elif confidence:
             print "CHANGED: %r to %r" % (a.getReadableName(),
                                          b.getReadableName())
             foundDiffs += 1
             if auxLog:
-                print >>auxLog, ("('CHANGED', %r, %r, %r, %r)" 
+                print >>auxLog, ("('CHANGED', %r, %r, %r, %r)"
                                  % (a.getReadableName(),
                                     b.getReadableName(),
                                     a.getReport(),
                                     b.getReport()))
         else:
             pass
 
     TotalReports = len(resultsB.diagnostics)
     print "TOTAL REPORTS: %r" % TotalReports
     print "TOTAL DIFFERENCES: %r" % foundDiffs
     if auxLog:
         print >>auxLog, "('TOTAL NEW REPORTS', %r)" % TotalReports
         print >>auxLog, "('TOTAL DIFFERENCES', %r)" % foundDiffs
-        
     return foundDiffs, len(resultsA.diagnostics), len(resultsB.diagnostics)
 
 def main():
     from optparse import OptionParser
     parser = OptionParser("usage: %prog [options] [dir A] [dir B]")
     parser.add_option("", "--rootA", dest="rootA",
                       help="Prefix to ignore on source files for directory A",
                       action="store", type=str, default="")
     parser.add_option("", "--rootB", dest="rootB",
                       help="Prefix to ignore on source files for directory B",
                       action="store", type=str, default="")
     parser.add_option("", "--verbose-log", dest="verboseLog",
                       help="Write additional information to LOG [default=None]",
                       action="store", type=str, default=None,
                       metavar="LOG")
     (opts, args) = parser.parse_args()
 
     if len(args) != 2:
         parser.error("invalid number of arguments")
 
     dirA,dirB = args
 
-    dumpScanBuildResultsDiff(dirA, dirB, opts)    
+    dumpScanBuildResultsDiff(dirA, dirB, opts)
 
 if __name__ == '__main__':
     main()

utils/analyzer/SATestAdd.py

 #!/usr/bin/env python
 
 """
-Static Analyzer qualification infrastructure: adding a new project to 
+Static Analyzer qualification infrastructure: adding a new project to
 the Repository Directory.
 
  Add a new project for testing: build it and add to the Project Map file.
    Assumes it's being run from the Repository Directory.
-   The project directory should be added inside the Repository Directory and 
+   The project directory should be added inside the Repository Directory and
    have the same name as the project ID
-   
  The project should use the following files for set up:
       - pre_run_static_analyzer.sh - prepare the build environment.
                                      Ex: make clean can be a part of it.
       - run_static_analyzer.cmd - a list of commands to run through scan-build.
                                      Each command should be on a separate line.
-                                     Choose from: configure, make, xcodebuild 
+                                     Choose from: configure, make, xcodebuild
 """
 import SATestBuild
 
 import os
 import csv
 import sys
 
 def isExistingProject(PMapFile, projectID) :
     PMapReader = csv.reader(PMapFile)
     for I in PMapReader:
         if projectID == I[0]:
             return True
-    return False    
+    return False
 
 # Add a new project for testing: build it and add to the Project Map file.
 # Params:
 #   Dir is the directory where the sources are.
 #   ID is a short string used to identify a project.
 def addNewProject(ID, BuildMode) :
     CurDir = os.path.abspath(os.curdir)
     Dir = SATestBuild.getProjectDir(ID)
     if not os.path.exists(Dir):
         print "Error: Project directory is missing: %s" % Dir
         sys.exit(-1)
-        
     # Build the project.
     SATestBuild.testProject(ID, BuildMode, IsReferenceBuild=True, Dir=Dir)
 
     # Add the project ID to the project map.
     ProjectMapPath = os.path.join(CurDir, SATestBuild.ProjectMapFile)
     if os.path.exists(ProjectMapPath):
         PMapFile = open(ProjectMapPath, "r+b")
     else:
         print "Warning: Creating the Project Map file!!"
         PMapFile = open(ProjectMapPath, "w+b")
     try:
-        if (isExistingProject(PMapFile, ID)) :        
+        if (isExistingProject(PMapFile, ID)) :
             print >> sys.stdout, 'Warning: Project with ID \'', ID, \
                                  '\' already exists.'
             print >> sys.stdout, "Reference output has been regenerated."
-        else:                     
+        else:
             PMapWriter = csv.writer(PMapFile)
             PMapWriter.writerow( (ID, int(BuildMode)) );
             print "The project map is updated: ", ProjectMapPath
     finally:
         PMapFile.close()
-            
 
-# TODO: Add an option not to build. 
+# TODO: Add an option not to build.
 # TODO: Set the path to the Repository directory.
 if __name__ == '__main__':
     if len(sys.argv) < 2:
         print >> sys.stderr, 'Usage: ', sys.argv[0],\
                              'project_ID <mode>' \
                              'mode - 0 for single file project; ' \
                              '1 for scan_build; ' \
                              '2 for single file c++11 project'
         sys.exit(-1)
-    
-    BuildMode = 1    
+    BuildMode = 1
     if (len(sys.argv) >= 3):
-        BuildMode = int(sys.argv[2])  
+        BuildMode = int(sys.argv[2])
     assert((BuildMode == 0) | (BuildMode == 1) | (BuildMode == 2))
-        
     addNewProject(sys.argv[1], BuildMode)

utils/analyzer/SATestBuild.py

 #!/usr/bin/env python
 
 """
 Static Analyzer qualification infrastructure.
 
 The goal is to test the analyzer against different projects, check for failures,
 compare results, and measure performance.
 
-Repository Directory will contain sources of the projects as well as the 
-information on how to build them and the expected output. 
+Repository Directory will contain sources of the projects as well as the
+information on how to build them and the expected output.
 Repository Directory structure:
    - ProjectMap file
    - Historical Performance Data
    - Project Dir1
      - ReferenceOutput
    - Project Dir2
      - ReferenceOutput
    ..
 Note that the build tree must be inside the project dir.
 
 To test the build of the analyzer one would:
-   - Copy over a copy of the Repository Directory. (TODO: Prefer to ensure that 
+   - Copy over a copy of the Repository Directory. (TODO: Prefer to ensure that
      the build directory does not pollute the repository to min network traffic).
    - Build all projects, until error. Produce logs to report errors.
-   - Compare results.  
+   - Compare results.
 
-The files which should be kept around for failure investigations: 
+The files which should be kept around for failure investigations:
    RepositoryCopy/Project DirI/ScanBuildResults
-   RepositoryCopy/Project DirI/run_static_analyzer.log      
-   
-Assumptions (TODO: shouldn't need to assume these.):   
+   RepositoryCopy/Project DirI/run_static_analyzer.log
+Assumptions (TODO: shouldn't need to assume these.):
    The script is being run from the Repository Directory.
    The compiler for scan-build and scan-build are in the PATH.
    export PATH=/Users/zaks/workspace/c2llvm/build/Release+Asserts/bin:$PATH
 
 For more logging, set the  env variables:
    zaks:TI zaks$ export CCC_ANALYZER_LOG=1
    zaks:TI zaks$ export CCC_ANALYZER_VERBOSE=1
-   
 The list of checkers tested are hardcoded in the Checkers variable.
 For testing additional checkers, use the SA_ADDITIONAL_CHECKERS environment
 variable. It should contain a comma separated list.
 """
 import CmpRuns
 
 import os
 import csv
def __init__(self, f):
         self.f = f
     def write(self, x):
         self.f.write(x)
         self.f.flush()
 
 sys.stdout = flushfile(sys.stdout)
 
 def getProjectMapPath():
-    ProjectMapPath = os.path.join(os.path.abspath(os.curdir), 
+    ProjectMapPath = os.path.join(os.path.abspath(os.curdir),
                                   ProjectMapFile)
     if not os.path.exists(ProjectMapPath):
         print "Error: Cannot find the Project Map file " + ProjectMapPath +\
                 "\nRunning script for the wrong directory?"
-        sys.exit(-1)  
-    return ProjectMapPath         
+        sys.exit(-1)
+    return ProjectMapPath
 
 def getProjectDir(ID):
-    return os.path.join(os.path.abspath(os.curdir), ID)        
+    return os.path.join(os.path.abspath(os.curdir), ID)
 
 def getSBOutputDirName(IsReferenceBuild) :
     if IsReferenceBuild == True :
         return SBOutputDirReferencePrefix + SBOutputDirName
     else :
         return SBOutputDirName
 
 #------------------------------------------------------------------------------

 Jobs = int(math.ceil(detectCPUs() * 0.75))
 
 # Project map stores info about all the "registered" projects.
 ProjectMapFile = "projectMap.csv"
 
 # Names of the project specific scripts.
 # The script that needs to be executed before the build can start.
 CleanupScript = "cleanup_run_static_analyzer.sh"
-# This is a file containing commands for scan-build.  
+# This is a file containing commands for scan-build.
 BuildScript = "run_static_analyzer.cmd"
 
 # The log file name.
 LogFolderName = "Logs"
 BuildLogName = "run_static_analyzer.log"
-# Summary file - contains the summary of the failures. Ex: This info can be be  
+# Summary file - contains the summary of the failures. Ex: This info can be be
 # displayed when buildbot detects a build failure.
 NumOfFailuresInSummary = 10
 FailuresSummaryFileName = "failures.txt"
 # Summary of the result diffs.
 DiffsSummaryFileName = "diffs.txt"
 
 # The scan-build result directory.
 SBOutputDirName = "ScanBuildResults"

 # Test harness logic.
 #------------------------------------------------------------------------------
 
 # Run pre-processing script if any.
 def runCleanupScript(Dir, PBuildLogFile):
     ScriptPath = os.path.join(Dir, CleanupScript)
     if os.path.exists(ScriptPath):
         try:
-            if Verbose == 1:        
+            if Verbose == 1:
                 print "  Executing: %s" % (ScriptPath,)
-            check_call("chmod +x %s" % ScriptPath, cwd = Dir, 
+            check_call("chmod +x %s" % ScriptPath, cwd = Dir,
                                               stderr=PBuildLogFile,
-                                              stdout=PBuildLogFile, 
-                                              shell=True)    
+                                              stdout=PBuildLogFile,
+                                              shell=True)
             check_call(ScriptPath, cwd = Dir, stderr=PBuildLogFile,
-                                              stdout=PBuildLogFile, 
+                                              stdout=PBuildLogFile,
                                               shell=True)
         except:
             print "Error: The pre-processing step failed. See ", \
                   PBuildLogFile.name, " for details."
             sys.exit(-1)
 
-# Build the project with scan-build by reading in the commands and 
+# Build the project with scan-build by reading in the commands and
 # prefixing them with the scan-build options.
 def runScanBuild(Dir, SBOutputDir, PBuildLogFile):
     BuildScriptPath = os.path.join(Dir, BuildScript)
     if not os.path.exists(BuildScriptPath):
         print "Error: build script is not defined: %s" % BuildScriptPath
         sys.exit(-1)
     SBOptions = "--use-analyzer " + Clang + " "
     SBOptions += "-plist-html -o " + SBOutputDir + " "
-    SBOptions += "-enable-checker " + Checkers + " "  
+    SBOptions += "-enable-checker " + Checkers + " "
     SBOptions += "--keep-empty "
-    # Always use ccc-analyze to ensure that we can locate the failures 
+    # Always use ccc-analyze to ensure that we can locate the failures
     # directory.
     SBOptions += "--override-compiler "
     try:
         SBCommandFile = open(BuildScriptPath, "r")
         SBPrefix = "scan-build " + SBOptions + " "
         for Command in SBCommandFile:
             Command = Command.strip()
             if len(Command) == 0:
                 continue;
             # If using 'make', auto imply a -jX argument
             # to speed up analysis.  xcodebuild will
             # automatically use the maximum number of cores.
             if (Command.startswith("make ") or Command == "make") and \
                 "-j" not in Command:
                 Command += " -j%d" % Jobs
             SBCommand = SBPrefix + Command
-            if Verbose == 1:        
+            if Verbose == 1:
                 print "  Executing: %s" % (SBCommand,)
             check_call(SBCommand, cwd = Dir, stderr=PBuildLogFile,
-                                             stdout=PBuildLogFile, 
+                                             stdout=PBuildLogFile,
                                              shell=True)
     except:
         print "Error: scan-build failed. See ",PBuildLogFile.name,\
               " for details."
         raise
 
 def hasNoExtension(FileName):
     (Root, Ext) = os.path.splitext(FileName)
     if ((Ext == "")) :
         return True
     return False
 
 def isValidSingleInputFile(FileName):
     (Root, Ext) = os.path.splitext(FileName)
-    if ((Ext == ".i") | (Ext == ".ii") | 
-        (Ext == ".c") | (Ext == ".cpp") | 
+    if ((Ext == ".i") | (Ext == ".ii") |
+        (Ext == ".c") | (Ext == ".cpp") |
         (Ext == ".m") | (Ext == "")) :
         return True
     return False
-   
 # Run analysis on a set of preprocessed files.
 def runAnalyzePreprocessed(Dir, SBOutputDir, Mode):
     if os.path.exists(os.path.join(Dir, BuildScript)):
         print "Error: The preprocessed files project should not contain %s" % \
                BuildScript
-        raise Exception()       
+        raise Exception()
 
     CmdPrefix = Clang + " -cc1 -analyze -analyzer-output=plist -w "
-    CmdPrefix += "-analyzer-checker=" + Checkers +" -fcxx-exceptions -fblocks "   
-    
+    CmdPrefix += "-analyzer-checker=" + Checkers +" -fcxx-exceptions -fblocks "
     if (Mode == 2) :
-        CmdPrefix += "-std=c++11 " 
-    
+        CmdPrefix += "-std=c++11 "
     PlistPath = os.path.join(Dir, SBOutputDir, "date")
     FailPath = os.path.join(PlistPath, "failures");
     os.makedirs(FailPath);
- 
     for FullFileName in glob.glob(Dir + "/*"):
         FileName = os.path.basename(FullFileName)
         Failed = False
-        
         # Only run the analyzes on supported files.
         if (hasNoExtension(FileName)):
             continue
         if (isValidSingleInputFile(FileName) == False):
             print "Error: Invalid single input file %s." % (FullFileName,)
             raise Exception()
-        
         # Build and call the analyzer command.
         OutputOption = "-o " + os.path.join(PlistPath, FileName) + ".plist "
         Command = CmdPrefix + OutputOption + FileName
         LogFile = open(os.path.join(FailPath, FileName + ".stderr.txt"), "w+b")
         try:
-            if Verbose == 1:        
+            if Verbose == 1:
                 print "  Executing: %s" % (Command,)
             check_call(Command, cwd = Dir, stderr=LogFile,
-                                           stdout=LogFile, 
+                                           stdout=LogFile,
                                            shell=True)
         except CalledProcessError, e:
             print "Error: Analyzes of %s failed. See %s for details." \
                   "Error code %d." % \
                    (FullFileName, LogFile.name, e.returncode)
-            Failed = True       
+            Failed = True
         finally:
-            LogFile.close()            
-        
+            LogFile.close()
         # If command did not fail, erase the log file.
         if Failed == False:
             os.remove(LogFile.name);
 
 def buildProject(Dir, SBOutputDir, ProjectBuildMode, IsReferenceBuild):
-    TBegin = time.time() 
+    TBegin = time.time()
 
     BuildLogPath = os.path.join(SBOutputDir, LogFolderName, BuildLogName)
-    print "Log file: %s" % (BuildLogPath,) 
+    print "Log file: %s" % (BuildLogPath,)
     print "Output directory: %s" %(SBOutputDir, )
-    
     # Clean up the log file.
     if (os.path.exists(BuildLogPath)) :
         RmCommand = "rm " + BuildLogPath
         if Verbose == 1:
             print "  Executing: %s" % (RmCommand,)
         check_call(RmCommand, shell=True)
-    
     # Clean up scan build results.
     if (os.path.exists(SBOutputDir)) :
         RmCommand = "rm -r " + SBOutputDir
-        if Verbose == 1: 
+        if Verbose == 1:
             print "  Executing: %s" % (RmCommand,)
             check_call(RmCommand, shell=True)
     assert(not os.path.exists(SBOutputDir))
     os.makedirs(os.path.join(SBOutputDir, LogFolderName))
-        
     # Open the log file.
     PBuildLogFile = open(BuildLogPath, "wb+")
-    
     # Build and analyze the project.
     try:
         runCleanupScript(Dir, PBuildLogFile)
-        
         if (ProjectBuildMode == 1):
             runScanBuild(Dir, SBOutputDir, PBuildLogFile)
         else:
             runAnalyzePreprocessed(Dir, SBOutputDir, ProjectBuildMode)
-        
         if IsReferenceBuild :
             runCleanupScript(Dir, PBuildLogFile)
 
             # Make the absolute paths relative in the reference results.
             for (DirPath, Dirnames, Filenames) in os.walk(SBOutputDir):
                 for F in Filenames:
                     if (not F.endswith('plist')):
                         continue
                     Plist = os.path.join(DirPath, F)
                     Data = plistlib.readPlist(Plist)
                     Paths = [SourceFile[len(Dir)+1:] if SourceFile.startswith(Dir)\
                             else SourceFile for SourceFile in Data['files']]
                     Data['files'] = Paths
                     plistlib.writePlist(Data, Plist)
-           
     finally:
         PBuildLogFile.close()
-        
     print "Build complete (time: %.2f). See the log for more details: %s" % \
-           ((time.time()-TBegin), BuildLogPath) 
-       
+           ((time.time()-TBegin), BuildLogPath)
 # A plist file is created for each call to the analyzer(each source file).
-# We are only interested on the once that have bug reports, so delete the rest.        
+# We are only interested on the once that have bug reports, so delete the rest.
 def CleanUpEmptyPlists(SBOutputDir):
     for F in glob.glob(SBOutputDir + "/*/*.plist"):
         P = os.path.join(SBOutputDir, F)
-        
         Data = plistlib.readPlist(P)
         # Delete empty reports.
         if not Data['files']:
             os.remove(P)
             continue
 
-# Given the scan-build output directory, checks if the build failed 
-# (by searching for the failures directories). If there are failures, it 
-# creates a summary file in the output directory.         
+# Given the scan-build output directory, checks if the build failed
+# (by searching for the failures directories). If there are failures, it
+# creates a summary file in the output directory.
 def checkBuild(SBOutputDir):
     # Check if there are failures.
     Failures = glob.glob(SBOutputDir + "/*/failures/*.stderr.txt")
     TotalFailed = len(Failures);
     if TotalFailed == 0:
         CleanUpEmptyPlists(SBOutputDir)
         Plists = glob.glob(SBOutputDir + "/*/*.plist")
         print "Number of bug reports (non-empty plist files) produced: %d" %\
            len(Plists)
         return;
-    
     # Create summary file to display when the build fails.
     SummaryPath = os.path.join(SBOutputDir, LogFolderName, FailuresSummaryFileName)
     if (Verbose > 0):
         print "  Creating the failures summary file %s" % (SummaryPath,)
-    
     SummaryLog = open(SummaryPath, "w+")
     try:
         SummaryLog.write("Total of %d failures discovered.\n" % (TotalFailed,))
         if TotalFailed > NumOfFailuresInSummary:
-            SummaryLog.write("See the first %d below.\n" 
+            SummaryLog.write("See the first %d below.\n"
                                                    % (NumOfFailuresInSummary,))
         # TODO: Add a line "See the results folder for more."
-    
         FailuresCopied = NumOfFailuresInSummary
         Idx = 0
         for FailLogPathI in Failures:
             if Idx >= NumOfFailuresInSummary:
                 break;
-            Idx += 1 
+            Idx += 1
             SummaryLog.write("\n-- Error #%d -----------\n" % (Idx,));
             FailLogI = open(FailLogPathI, "r");
-            try: 
+            try:
                 shutil.copyfileobj(FailLogI, SummaryLog);
             finally:
                 FailLogI.close()
     finally:
         SummaryLog.close()
-    
     print "Error: analysis failed. See ", SummaryPath
-    sys.exit(-1)       
+    sys.exit(-1)
 
 # Auxiliary object to discard stdout.
 class Discarder(object):
     def write(self, text):
         pass # do nothing
 
 # Compare the warnings produced by scan-build.
 # Strictness defines the success criteria for the test:
 #   0 - success if there are no crashes or analyzer failure.
 #   1 - success if there are no difference in the number of reported bugs.
 #   2 - success if all the bug reports are identical.
-def runCmpResults(Dir, Strictness = 0):   
-    TBegin = time.time() 
+def runCmpResults(Dir, Strictness = 0):
+    TBegin = time.time()
 
     RefDir = os.path.join(Dir, SBOutputDirReferencePrefix + SBOutputDirName)
     NewDir = os.path.join(Dir, SBOutputDirName)
-    
     # We have to go one level down the directory tree.
-    RefList = glob.glob(RefDir + "/*") 
+    RefList = glob.glob(RefDir + "/*")
     NewList = glob.glob(NewDir + "/*")
-    
     # Log folders are also located in the results dir, so ignore them.
     RefLogDir = os.path.join(RefDir, LogFolderName)
     if RefLogDir in RefList:
         RefList.remove(RefLogDir)
     NewList.remove(os.path.join(NewDir, LogFolderName))
-    
     if len(RefList) == 0 or len(NewList) == 0:
         return False
     assert(len(RefList) == len(NewList))
 
-    # There might be more then one folder underneath - one per each scan-build 
+    # There might be more then one folder underneath - one per each scan-build
     # command (Ex: one for configure and one for make).
     if (len(RefList) > 1):
         # Assume that the corresponding folders have the same names.
         RefList.sort()
         NewList.sort()
-    
     # Iterate and find the differences.
     NumDiffs = 0
-    PairList = zip(RefList, NewList)    
-    for P in PairList:    
-        RefDir = P[0] 
+    PairList = zip(RefList, NewList)
+    for P in PairList:
+        RefDir = P[0]
         NewDir = P[1]
-    
-        assert(RefDir != NewDir) 
-        if Verbose == 1:        
+        assert(RefDir != NewDir)
+        if Verbose == 1:
             print "  Comparing Results: %s %s" % (RefDir, NewDir)
-    
         DiffsPath = os.path.join(NewDir, DiffsSummaryFileName)
         Opts = CmpRuns.CmpOptions(DiffsPath, "", Dir)
         # Discard everything coming out of stdout (CmpRun produces a lot of them).
         OLD_STDOUT = sys.stdout
         sys.stdout = Discarder()
         # Scan the results, delete empty plist files.
         NumDiffs, ReportsInRef, ReportsInNew = \
             CmpRuns.dumpScanBuildResultsDiff(RefDir, NewDir, Opts, False)
         sys.stdout = OLD_STDOUT
         if (NumDiffs > 0) :
             print "Warning: %r differences in diagnostics. See %s" % \
                   (NumDiffs, DiffsPath,)
         if Strictness >= 2 and NumDiffs > 0:
             print "Error: Diffs found in strict mode (2)."
-            sys.exit(-1)       
+            sys.exit(-1)
         elif Strictness >= 1 and ReportsInRef != ReportsInNew:
             print "Error: The number of results are different in strict mode (1)."
-            sys.exit(-1)       
-                    
-    print "Diagnostic comparison complete (time: %.2f)." % (time.time()-TBegin) 
+            sys.exit(-1)
+    print "Diagnostic comparison complete (time: %.2f)." % (time.time()-TBegin)
     return (NumDiffs > 0)
-    
 def updateSVN(Mode, ProjectsMap):
     try:
-        ProjectsMap.seek(0)    
+        ProjectsMap.seek(0)
         for I in csv.reader(ProjectsMap):
-            ProjName = I[0] 
+            ProjName = I[0]
             Path = os.path.join(ProjName, getSBOutputDirName(True))
-    
             if Mode == "delete":
                 Command = "svn delete %s" % (Path,)
             else:
                 Command = "svn add %s" % (Path,)
 
-            if Verbose == 1:        
+            if Verbose == 1:
                 print "  Executing: %s" % (Command,)
-            check_call(Command, shell=True)    
-    
+            check_call(Command, shell=True)
         if Mode == "delete":
             CommitCommand = "svn commit -m \"[analyzer tests] Remove " \
-                            "reference results.\""     
+                            "reference results.\""
         else:
             CommitCommand = "svn commit -m \"[analyzer tests] Add new " \
                             "reference results.\""
-        if Verbose == 1:        
+        if Verbose == 1:
             print "  Executing: %s" % (CommitCommand,)
-        check_call(CommitCommand, shell=True)    
+        check_call(CommitCommand, shell=True)
     except:
         print "Error: SVN update failed."
         sys.exit(-1)
-        
 def testProject(ID, ProjectBuildMode, IsReferenceBuild=False, Dir=None, Strictness = 0):
     print " \n\n--- Building project %s" % (ID,)
 
-    TBegin = time.time() 
+    TBegin = time.time()
 
     if Dir is None :
-        Dir = getProjectDir(ID)        
-    if Verbose == 1:        
+        Dir = getProjectDir(ID)
+    if Verbose == 1:
         print "  Build directory: %s." % (Dir,)
-    
     # Set the build results directory.
     RelOutputDir = getSBOutputDirName(IsReferenceBuild)
     SBOutputDir = os.path.join(Dir, RelOutputDir)
-                
     buildProject(Dir, SBOutputDir, ProjectBuildMode, IsReferenceBuild)
 
     checkBuild(SBOutputDir)
-    
     if IsReferenceBuild == False:
         runCmpResults(Dir, Strictness)
-        
     print "Completed tests for project %s (time: %.2f)." % \
           (ID, (time.time()-TBegin))
-    
 def testAll(IsReferenceBuild = False, UpdateSVN = False, Strictness = 0):
     PMapFile = open(getProjectMapPath(), "rb")
-    try:        
+    try:
         # Validate the input.
         for I in csv.reader(PMapFile):
             if (len(I) != 2) :
                 print "Error: Rows in the ProjectMapFile should have 3 entries."
                 raise Exception()
             if (not ((I[1] == "0") | (I[1] == "1") | (I[1] == "2"))):
                 print "Error: Second entry in the ProjectMapFile should be 0" \
                       " (single file), 1 (project), or 2(single file c++11)."
-                raise Exception()              
+                raise Exception()
 
-        # When we are regenerating the reference results, we might need to 
+        # When we are regenerating the reference results, we might need to
         # update svn. Remove reference results from SVN.
         if UpdateSVN == True:
             assert(IsReferenceBuild == True);
             updateSVN("delete",  PMapFile);
-            
         # Test the projects.
-        PMapFile.seek(0)    
+        PMapFile.seek(0)
         for I in csv.reader(PMapFile):
             testProject(I[0], int(I[1]), IsReferenceBuild, None, Strictness)
 
         # Add reference results to SVN.
         if UpdateSVN == True:
             updateSVN("add",  PMapFile);
 
     except:
         print "Error occurred. Premature termination."
-        raise                            
+        raise
     finally:
-        PMapFile.close()    
-            
+        PMapFile.close()
 if __name__ == '__main__':
     # Parse command line arguments.
     Parser = argparse.ArgumentParser(description='Test the Clang Static Analyzer.')
     Parser.add_argument('--strictness', dest='strictness', type=int, default=0,
                        help='0 to fail on runtime errors, 1 to fail when the number\
                              of found bugs are different from the reference, 2 to \
                              fail on any difference from the reference. Default is 0.')
     Parser.add_argument('-r', dest='regenerate', action='store_true', default=False,

utils/analyzer/SumTimerInfo.py

 #!/usr/bin/env python
 
 """
 Script to Summarize statistics in the scan-build output.
 
-Statistics are enabled by passing '-internal-stats' option to scan-build 
+Statistics are enabled by passing '-internal-stats' option to scan-build
 (or '-analyzer-stats' to the analyzer).
 
 """
 
 import string
 from operator import itemgetter
 import sys
 
for line in f:
           s = line.split()
           NumInlinedCallSites = NumInlinedCallSites + int(s[0])
         if (("The # of times we split the path due to imprecise dynamic dispatch info" in line) and (Mode == 1)) :
           s = line.split()
           NumBifurcatedCallSites = NumBifurcatedCallSites + int(s[0])
         if ((")  Total" in line) and (Mode == 1)) :
           s = line.split()
           TotalTime = TotalTime + float(s[6])
-          
     print "TU Count %d" % (Count)
     print "Time %f" % (Time)
     print "Warnings %d" % (Warnings)
     print "Functions Analyzed %d" % (FunctionsAnalyzed)
     print "Reachable Blocks %d" % (ReachableBlocks)
     print "Reached Max Steps %d" % (ReachedMaxSteps)
     print "Number of Steps %d" % (NumSteps)
     print "Number of Inlined calls %d (bifurcated %d)" % (NumInlinedCallSites, NumBifurcatedCallSites)
     print "MaxTime %f" % (MaxTime)
     print "TotalTime %f" % (TotalTime)
     print "Max CFG Size %d" % (MaxCFGSize)
 
 

utils/analyzer/ubiviz

 ##===----------------------------------------------------------------------===##
 
 import xmlrpclib
 import sys
 
 def Error(message):
     print >> sys.stderr, 'ubiviz: ' + message
     sys.exit(1)
-    
 def StreamData(filename):
   file = open(filename)
   for ln in file:
     yield eval(ln)
   file.close()
 
 def Display(G, data):
   action = data[0]
for attribute in data[2:]:
       G.set_vertex_style_attribute(style_id, attribute[0], attribute[1])
   elif action == "change_vertex_style":
      vertex_id = data[1]
      style_id = data[2]
      G.change_vertex_style(vertex_id,style_id)
 
 def main(args):
   if len(args) == 0:
-    Error('no input files')    
+    Error('no input files')
 
   server = xmlrpclib.Server('http://127.0.0.1:20738/RPC2')
   G = server.ubigraph
-            
   for arg in args:
     G.clear()
     for x in StreamData(arg):
       Display(G,x)
-  
   sys.exit(0)
-  
 
 if __name__ == '__main__':
     main(sys.argv[1:])
-