[analyzer] De-duplicate some code for discovering the origin of the symbol.

[NoQ]

Summary

Or, more importantly, tell the users that there's a way to discover the region, value of which - at some moment of time - the symbol was introduced to represent. Idea proposed by Devin Coughlin.

Right now this is a simple code de-duplication, but in fact maybe it should be extended to support SymbolMetadata, SymbolExtent, and maybe, even more importantly, SymbolConjured (if the latter is created during invalidation of a region, *and* the symbol's structure is modified to remember that region - which i think is a useful idea, but that's another story; there's not much we could do for conjured-return-value symbols, even though sometimes even they should probably be tied to temporary object regions).

[zaks.anna]

include/clang/StaticAnalyzer/Core/PathSensitive/SymExpr.h

81 ↗

(On Diff #63594)

Please, add a doxygen style comment.

[NoQ]

Added a doxygen comment, made the function virtual instead of branching.

cfe/trunk/include/clang/StaticAnalyzer/Core/PathSensitive/SymExpr.h

 #include "clang/AST/Type.h"
 #include "llvm/ADT/FoldingSet.h"
 #include "llvm/ADT/SmallVector.h"
 #include "llvm/Support/raw_ostream.h"
 
 namespace clang {
 namespace ento {
 
+class MemRegion;
+
 /// \brief Symbolic value. These values used to capture symbolic execution of
 /// the program.
 class SymExpr : public llvm::FoldingSetNode {
   virtual void anchor();
 
 public:
   enum Kind {
 #define SYMBOL(Id, Parent) Id##Kind,
public:
     bool operator==(const symbol_iterator &X) const;
     bool operator!=(const symbol_iterator &X) const;
   };
 
   symbol_iterator symbol_begin() const { return symbol_iterator(this); }
   static symbol_iterator symbol_end() { return symbol_iterator(); }
 
   unsigned computeComplexity() const;
+
+  /// \brief Find the region from which this symbol originates.
+  ///
+  /// Whenever the symbol was constructed to denote an unknown value of
+  /// a certain memory region, return this region. This method
+  /// allows checkers to make decisions depending on the origin of the symbol.
+  /// Symbol classes for which the origin region is known include
+  /// SymbolRegionValue which denotes the value of the region before
+  /// the beginning of the analysis, and SymbolDerived which denotes the value
+  /// of a certain memory region after its super region (a memory space or
+  /// a larger record region) is default-bound with a certain symbol.
+  virtual const MemRegion *getOriginRegion() const { return nullptr; }
 };
 
 typedef const SymExpr *SymbolRef;
 typedef SmallVector<SymbolRef, 2> SymbolRefSmallVectorTy;
 
 typedef unsigned SymbolID;
 /// \brief A symbol representing data which can be stored in a memory location
 /// (region).

cfe/trunk/include/clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h

static void Profile(llvm::FoldingSetNodeID& profile, const TypedValueRegion* R) {
     profile.AddPointer(R);
   }
 
   void Profile(llvm::FoldingSetNodeID& profile) override {
     Profile(profile, R);
   }
 
   void dumpToStream(raw_ostream &os) const override;
+  const MemRegion *getOriginRegion() const override { return getRegion(); }
 
   QualType getType() const override;
 
   // Implement isa<T> support.
   static inline bool classof(const SymExpr *SE) {
     return SE->getKind() == SymbolRegionValueKind;
   }
 };
SymbolDerived(SymbolID sym, SymbolRef parent, const TypedValueRegion *r)
     : SymbolData(SymbolDerivedKind, sym), parentSymbol(parent), R(r) {}
 
   SymbolRef getParentSymbol() const { return parentSymbol; }
   const TypedValueRegion *getRegion() const { return R; }
 
   QualType getType() const override;
 
   void dumpToStream(raw_ostream &os) const override;
+  const MemRegion *getOriginRegion() const override { return getRegion(); }
 
   static void Profile(llvm::FoldingSetNodeID& profile, SymbolRef parent,
                       const TypedValueRegion *r) {
     profile.AddInteger((unsigned) SymbolDerivedKind);
     profile.AddPointer(r);
     profile.AddPointer(parent);
   }
 

cfe/trunk/lib/StaticAnalyzer/Checkers/CheckObjCDealloc.cpp

if (State != InitialState) {
     C.addTransition(State);
   }
 }
 
 /// Given a symbol for an ivar, return the ivar region it was loaded from.
 /// Returns nullptr if the instance symbol cannot be found.
 const ObjCIvarRegion *
 ObjCDeallocChecker::getIvarRegionForIvarSymbol(SymbolRef IvarSym) const {
-  const MemRegion *RegionLoadedFrom = nullptr;
-  if (auto *DerivedSym = dyn_cast<SymbolDerived>(IvarSym))
-    RegionLoadedFrom = DerivedSym->getRegion();
-  else if (auto *RegionSym = dyn_cast<SymbolRegionValue>(IvarSym))
-    RegionLoadedFrom = RegionSym->getRegion();
-  else
-    return nullptr;
-
-  return dyn_cast<ObjCIvarRegion>(RegionLoadedFrom);
+  return dyn_cast_or_null<ObjCIvarRegion>(IvarSym->getOriginRegion());
 }
 
 /// Given a symbol for an ivar, return a symbol for the instance containing
 /// the ivar. Returns nullptr if the instance symbol cannot be found.
 SymbolRef
 ObjCDeallocChecker::getInstanceSymbolFromIvarSymbol(SymbolRef IvarSym) const {
 
   const ObjCIvarRegion *IvarRegion = getIvarRegionForIvarSymbol(IvarSym);

cfe/trunk/lib/StaticAnalyzer/Checkers/RetainCountChecker.cpp

if (SymbolRef Sym = State->getSVal(Ex, LCtx).getAsSymbol()) {
     QualType ResultTy = Ex->getType();
     State = setRefBinding(State, Sym,
                           RefVal::makeNotOwned(RetEffect::ObjC, ResultTy));
   }
 
   C.addTransition(State);
 }
 
-static bool wasLoadedFromIvar(SymbolRef Sym) {
-  if (auto DerivedVal = dyn_cast<SymbolDerived>(Sym))
-    return isa<ObjCIvarRegion>(DerivedVal->getRegion());
-  if (auto RegionVal = dyn_cast<SymbolRegionValue>(Sym))
-    return isa<ObjCIvarRegion>(RegionVal->getRegion());
-  return false;
-}
-
 void RetainCountChecker::checkPostStmt(const ObjCIvarRefExpr *IRE,
                                        CheckerContext &C) const {
   Optional<Loc> IVarLoc = C.getSVal(IRE).getAs<Loc>();
   if (!IVarLoc)
     return;
 
   ProgramStateRef State = C.getState();
   SymbolRef Sym = State->getSVal(*IVarLoc).getAsSymbol();
-  if (!Sym || !wasLoadedFromIvar(Sym))
+  if (!Sym || !dyn_cast_or_null<ObjCIvarRegion>(Sym->getOriginRegion()))
     return;
 
   // Accessing an ivar directly is unusual. If we've done that, be more
   // forgiving about what the surrounding code is allowed to do.
 
   QualType Ty = Sym->getType();
   RetEffect::ObjKind Kind;
   if (Ty->isObjCRetainableType())