Throwaway commit to put in phabricator (WIP patch for temporary destructor analysis based on CFG changes)

include/clang/Analysis/AnalysisContext.h

class AnalysisDeclContextManager {
   LocationContextManager LocContexts;
   CFG::BuildOptions cfgBuildOptions;
   
   /// Flag to indicate whether or not bodies should be synthesized
   /// for well-known functions.
   bool SynthesizeBodies;
 
 public:
-  AnalysisDeclContextManager(bool useUnoptimizedCFG = false,
-                             bool addImplicitDtors = false,
-                             bool addInitializers = false,
-                             bool addTemporaryDtors = false,
-                             bool synthesizeBodies = false,
-                             bool addStaticInitBranches = false,
-                             bool addCXXNewAllocator = true);
+  AnalysisDeclContextManager(bool useUnoptimizedCFG,
+                             bool addImplicitDtors,
+                             bool addInitializers,
+                             bool addTemporaryDtors,
+                             bool synthesizeBodies,
+                             bool addStaticInitBranches,
+                             bool addCXXNewAllocator,
+                             bool useTemporaryTerminators);
 
   ~AnalysisDeclContextManager();
 
   AnalysisDeclContext *getContext(const Decl *D);
 
   bool getUseUnoptimizedCFG() const {
     return !cfgBuildOptions.PruneTriviallyFalseEdges;
   }

include/clang/Analysis/CFG.h

public:
     CFGCallback *Observer;
     bool PruneTriviallyFalseEdges;
     bool AddEHEdges;
     bool AddInitializers;
     bool AddImplicitDtors;
     bool AddTemporaryDtors;
     bool AddStaticInitBranches;
     bool AddCXXNewAllocator;
+    bool UseTemporaryTerminators;
 
     bool alwaysAdd(const Stmt *stmt) const {
       return alwaysAddMask[stmt->getStmtClass()];
     }
 
     BuildOptions &setAlwaysAdd(Stmt::StmtClass stmtClass, bool val = true) {
       alwaysAddMask[stmtClass] = val;
       return *this;
     }
 
     BuildOptions &setAllAlwaysAdd() {
       alwaysAddMask.set();
       return *this;
     }
 
     BuildOptions()
       : forcedBlkExprs(nullptr), Observer(nullptr),
         PruneTriviallyFalseEdges(true), AddEHEdges(false),
         AddInitializers(false), AddImplicitDtors(false),
         AddTemporaryDtors(false), AddStaticInitBranches(false),
-        AddCXXNewAllocator(false) {}
+        AddCXXNewAllocator(false), UseTemporaryTerminators(false) {}
   };
 
   /// \brief Provides a custom implementation of the iterator class to have the
   /// same interface as Function::iterator - iterator returns CFGBlock
   /// (not a pointer to CFGBlock).
   class graph_iterator {
   public:
     typedef const CFGBlock                  value_type;

include/clang/StaticAnalyzer/Core/AnalyzerOptions.h

private:
   IPAKind IPAMode;
 
   /// Controls which C++ member functions will be considered for inlining.
   CXXInlineableMemberKind CXXMemberInliningMode;
   
   /// \sa includeTemporaryDtorsInCFG
   Optional<bool> IncludeTemporaryDtorsInCFG;
   
+  /// \sa useTemporaryTerminatorsInCFG
+  Optional<bool> UseTemporaryTerminatorsInCFG;
+  
   /// \sa mayInlineCXXStandardLibrary
   Optional<bool> InlineCXXStandardLibrary;
   
   /// \sa mayInlineTemplateFunctions
   Optional<bool> InlineTemplateFunctions;
 
   /// \sa mayInlineCXXAllocator
   Optional<bool> InlineCXXAllocator;
public:
 
   /// Returns whether or not the destructors for C++ temporary objects should
   /// be included in the CFG.
   ///
   /// This is controlled by the 'cfg-temporary-dtors' config option, which
   /// accepts the values "true" and "false".
   bool includeTemporaryDtorsInCFG();
 
+  /// Returns whether or not the CFG should be built with the new temporary
+  /// terminator based algorithm to correctly handle the destructors for C++
+  /// temporary objects. This new algorithm is more correct and should be
+  /// turned on by default, but it needs to bake for a while.
+  ///
+  /// This is controlled by the 'cfg-temporary-terminators' config option, which
+  /// accepts the values "true" and "false".
+  bool useTemporaryTerminatorsInCFG();
+
   /// Returns whether or not C++ standard library functions may be considered
   /// for inlining.
   ///
   /// This is controlled by the 'c++-stdlib-inlining' config option, which
   /// accepts the values "true" and "false".
   bool mayInlineCXXStandardLibrary();
 
   /// Returns whether or not templated functions may be considered for inlining.

include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h

private:
   void HandleBlockEdge(const BlockEdge &E, ExplodedNode *Pred);
   void HandleBlockEntrance(const BlockEntrance &E, ExplodedNode *Pred);
   void HandleBlockExit(const CFGBlock *B, ExplodedNode *Pred);
   void HandlePostStmt(const CFGBlock *B, unsigned StmtIdx, ExplodedNode *Pred);
 
   void HandleBranch(const Stmt *Cond, const Stmt *Term, const CFGBlock *B,
                     ExplodedNode *Pred);
 
+  /// Handle conditional logic for running destructors for temporary objects.
+  void HandleTemporaryCleanup(const CXXBindTemporaryExpr *BTE,
+                        const CFGBlock *B,
+                        ExplodedNode *Pred);
   /// Handle conditional logic for running static initializers.
   void HandleStaticInit(const DeclStmt *DS, const CFGBlock *B,
                         ExplodedNode *Pred);
 
 private:
   CoreEngine(const CoreEngine &) LLVM_DELETED_FUNCTION;
   void operator=(const CoreEngine &) LLVM_DELETED_FUNCTION;
 

include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h

public:
   void processBranch(const Stmt *Condition, const Stmt *Term, 
                      NodeBuilderContext& BuilderCtx,
                      ExplodedNode *Pred,
                      ExplodedNodeSet &Dst,
                      const CFGBlock *DstT,
                      const CFGBlock *DstF) override;
 
   /// Called by CoreEngine.  Used to processing branching behavior
+  /// for temporary object destructor calls.
+  void processTemporaryCleanup(const CXXBindTemporaryExpr *BTE,
+                               NodeBuilderContext& BuilderCtx,
+                               ExplodedNode *Pred,
+                               ExplodedNodeSet &Dst,
+                               const CFGBlock *DstT,
+                               const CFGBlock *DstF) override;
+
+  /// Called by CoreEngine.  Used to processing branching behavior
   /// at static initalizers.
   void processStaticInitializer(const DeclStmt *DS,
                                 NodeBuilderContext& BuilderCtx,
                                 ExplodedNode *Pred,
                                 ExplodedNodeSet &Dst,
                                 const CFGBlock *DstT,
                                 const CFGBlock *DstF) override;
 
public:
 
   void VisitCXXDeleteExpr(const CXXDeleteExpr *CDE, ExplodedNode *Pred,
                           ExplodedNodeSet &Dst);
 
   /// Create a C++ temporary object for an rvalue.
   void CreateCXXTemporaryObject(const MaterializeTemporaryExpr *ME,
                                 ExplodedNode *Pred, 
                                 ExplodedNodeSet &Dst);
-  
+  // Handle a C++ temporary object binding, potentially tracking object construction so we can
+  // call destructors correctly.
+  void BindCXXTemporaryObject(const CXXBindTemporaryExpr *BTE,
+                              ExplodedNode *Pred, 
+                              ExplodedNodeSet &Dst);
+  
   /// evalEagerlyAssumeBinOpBifurcation - Given the nodes in 'Src', eagerly assume symbolic
   ///  expressions of the form 'x != 0' and generate new nodes (stored in Dst)
   ///  with those assumptions.
   void evalEagerlyAssumeBinOpBifurcation(ExplodedNodeSet &Dst, ExplodedNodeSet &Src, 
                          const Expr *Ex);
   
   std::pair<const ProgramPointTag *, const ProgramPointTag*>
     geteagerlyAssumeBinOpBifurcationTags();

include/clang/StaticAnalyzer/Core/PathSensitive/SubEngine.h

public:
   virtual void processBranch(const Stmt *Condition, const Stmt *Term,
                              NodeBuilderContext& BuilderCtx,
                              ExplodedNode *Pred,
                              ExplodedNodeSet &Dst,
                              const CFGBlock *DstT,
                              const CFGBlock *DstF) = 0;
 
   /// Called by CoreEngine.  Used to processing branching behavior
+  /// for temporary object destructor calls.
+  virtual void processTemporaryCleanup(const CXXBindTemporaryExpr *BTE,
+                                       NodeBuilderContext& BuilderCtx,
+                                       ExplodedNode *Pred,
+                                       ExplodedNodeSet &Dst,
+                                       const CFGBlock *DstT,
+                                       const CFGBlock *DstF) = 0;
+  /// Called by CoreEngine.  Used to processing branching behavior
   /// at static initalizers.
   virtual void processStaticInitializer(const DeclStmt *DS,
                                         NodeBuilderContext& BuilderCtx,
                                         ExplodedNode *Pred,
                                         ExplodedNodeSet &Dst,
                                         const CFGBlock *DstT,
                                         const CFGBlock *DstF) = 0;
 

lib/Analysis/AnalysisDeclContext.cpp

: Manager(Mgr),
   builtCFG(false),
   builtCompleteCFG(false),
   ReferencedBlockVars(0),
   ManagedAnalyses(0)
 {  
   cfgBuildOptions.forcedBlkExprs = &forcedBlkExprs;
 }
 
-AnalysisDeclContextManager::AnalysisDeclContextManager(bool useUnoptimizedCFG,
-                                                       bool addImplicitDtors,
-                                                       bool addInitializers,
-                                                       bool addTemporaryDtors,
-                                                       bool synthesizeBodies,
-                                                       bool addStaticInitBranch,
-                                                       bool addCXXNewAllocator)
+AnalysisDeclContextManager::AnalysisDeclContextManager(
+    bool useUnoptimizedCFG,
+    bool addCXXNewAllocator,
+    bool useTemporaryTerminators)
   : SynthesizeBodies(synthesizeBodies)
 {
   cfgBuildOptions.PruneTriviallyFalseEdges = !useUnoptimizedCFG;
   cfgBuildOptions.AddImplicitDtors = addImplicitDtors;
   cfgBuildOptions.AddInitializers = addInitializers;
   cfgBuildOptions.AddTemporaryDtors = addTemporaryDtors;
   cfgBuildOptions.AddStaticInitBranches = addStaticInitBranch;
   cfgBuildOptions.AddCXXNewAllocator = addCXXNewAllocator;
+  cfgBuildOptions.UseTemporaryTerminators = useTemporaryTerminators;
 }
 
 void AnalysisDeclContextManager::clear() {
   llvm::DeleteContainerSeconds(Contexts);
 }
 
 static BodyFarm &getBodyFarm(ASTContext &C) {
   static BodyFarm *BF = new BodyFarm(C);

lib/Analysis/CFG.cpp

CFGBlock *CFGBuilder::VisitChildrenForTemporaryDtors(Stmt *E) {
   for (Stmt::child_range I = E->children(); I; ++I) {
     if (Stmt *Child = *I)
       if (CFGBlock *R = VisitForTemporaryDtors(Child))
         B = R;
   }
   return B;
 }
 
+CXXBindTemporaryExpr* findBindTemporaryInFirstChildren(Stmt *E) {
+  if (!E->children().empty()) {
+    Stmt *FirstChild = *E->children();
+    assert(FirstChild);
+    if (CXXBindTemporaryExpr *BTE =
+        findBindTemporaryInFirstChildren(FirstChild))
+      return BTE;
+  }
+
+  return dyn_cast<CXXBindTemporaryExpr>(E);
+}
+
+CXXBindTemporaryExpr* findLastBindTemporary(Stmt *E) {
+  if (CXXBindTemporaryExpr *BTE = dyn_cast<CXXBindTemporaryExpr>(E))
+    return BTE;
+  // When visiting children for destructors we want to visit them in reverse
+  // order that they will appear in the CFG.  Because the CFG is built
+  // bottom-up, this means we visit them in their natural order, which
+  // reverses them in the CFG.
+  for (Stmt::child_range I = E->children(); I; ++I) {
+    if (Stmt *Child = *I)
+      if (CXXBindTemporaryExpr *BTE = findLastBindTemporary(Child))
+        return BTE; //FIXME: TODO: store this and return it? test with multiple temporaries
+  }
+  return NULL;
+}
+
 CFGBlock *CFGBuilder::VisitBinaryOperatorForTemporaryDtors(BinaryOperator *E) {
   if (E->isLogicalOp()) {
     // Destructors for temporaries in LHS expression should be called after
     // those for RHS expression. Even if this will unnecessarily create a block,
     // this block will be used at least by the full expression.
     autoCreateBlock();
     CFGBlock *ConfluenceBlock = VisitForTemporaryDtors(E->getLHS());
     if (badCFG)
       return NULL;
 
     Succ = ConfluenceBlock;
     Block = NULL;
     CFGBlock *RHSBlock = VisitForTemporaryDtors(E->getRHS());
 
     if (RHSBlock) {
       if (badCFG)
         return NULL;
 
+      CFGBlock *LHSBlock;
+      if (BuildOpts.UseTemporaryTerminators) {
+        CXXBindTemporaryExpr *BTE = findLastBindTemporary(E->getRHS());
+        assert(BTE);
+        /*CXXBindTemporaryExpr *BTE = findBindTemporaryInFirstChildren(E->getRHS());
+        if (!BTE) {
+          //TODO: what do we do when we don't have a terminator for this block?
+          Block = ConfluenceBlock;
+          return ConfluenceBlock;
+        }*/
+        LHSBlock = createBlock(false);
+        LHSBlock->setTerminator(BTE);
+      } else {
+        LHSBlock = createBlock(false);
         // If RHS expression did produce destructors we need to connect created
         // blocks to CFG in same manner as for binary operator itself.
-      CFGBlock *LHSBlock = createBlock(false);
         LHSBlock->setTerminator(CFGTerminator(E, true));
+      }
 
       // For binary operator LHS block is before RHS in list of predecessors
       // of ConfluenceBlock.
       std::reverse(ConfluenceBlock->pred_begin(),
           ConfluenceBlock->pred_end());
 
       // See if this is a known constant.
       TryResult KnownVal = tryEvaluateBool(E->getLHS());
CFGBlock *CFGBuilder::VisitConditionalOperatorForTemporaryDtors(
   if (!RHSBlock && !LHSBlock) {
     // If neither LHS nor RHS expression had temporaries to destroy don't create
     // more blocks.
     Block = ConfluenceBlock;
     return Block;
   }
 
   Block = createBlock(false);
+  //FIXME: use temporary terminator handling here
   Block->setTerminator(CFGTerminator(E, true));
   assert(Block->getTerminator().isTemporaryDtorsBranch());
 
   // See if this is a known constant.
   const TryResult &KnownVal = tryEvaluateBool(E->getCond());
 
   if (LHSBlock) {
     addSuccessor(Block, LHSBlock, !KnownVal.isFalse());

lib/Sema/AnalysisBasedWarnings.cpp

AnalysisBasedWarnings::IssueWarnings(sema::AnalysisBasedWarnings::Policy P,
   // Don't generate EH edges for CallExprs as we'd like to avoid the n^2
   // explosion for destructors that can result and the compile time hit.
   AC.getCFGBuildOptions().PruneTriviallyFalseEdges = true;
   AC.getCFGBuildOptions().AddEHEdges = false;
   AC.getCFGBuildOptions().AddInitializers = true;
   AC.getCFGBuildOptions().AddImplicitDtors = true;
   AC.getCFGBuildOptions().AddTemporaryDtors = true;
   AC.getCFGBuildOptions().AddCXXNewAllocator = false;
+  AC.getCFGBuildOptions().UseTemporaryTerminators = false;
 
   // Force that certain expressions appear as CFGElements in the CFG.  This
   // is used to speed up various analyses.
   // FIXME: This isn't the right factoring.  This is here for initial
   // prototyping, but we need a way for analyses to say what expressions they
   // expect to always be CFGElements and then fill in the BuildOptions
   // appropriately.  This is essentially a layering violation.
   if (P.enableCheckUnreachable || P.enableThreadSafetyAnalysis ||

lib/StaticAnalyzer/Core/AnalysisManager.cpp

AnalysisManager::AnalysisManager(ASTContext &ctx, DiagnosticsEngine &diags,
                                  ConstraintManagerCreator constraintmgr, 
                                  CheckerManager *checkerMgr,
                                  AnalyzerOptions &Options)
   : AnaCtxMgr(Options.UnoptimizedCFG,
               /*AddImplicitDtors=*/true,
               /*AddInitializers=*/true,
               Options.includeTemporaryDtorsInCFG(),
               Options.shouldSynthesizeBodies(),
-              Options.shouldConditionalizeStaticInitializers()),
+              Options.shouldConditionalizeStaticInitializers(),
+              /*AddCXXNewAllocator=*/true,
+              Options.useTemporaryTerminatorsInCFG()),
     Ctx(ctx),
     Diags(diags),
     LangOpts(lang),
     PathConsumers(PDC),
     CreateStoreMgr(storemgr), CreateConstraintMgr(constraintmgr),
     CheckerMgr(checkerMgr),
     options(Options) {
   AnaCtxMgr.getCFGBuildOptions().setAllAlwaysAdd();

lib/StaticAnalyzer/Core/AnalyzerOptions.cpp

 }
 
 bool AnalyzerOptions::includeTemporaryDtorsInCFG() {
   return getBooleanOption(IncludeTemporaryDtorsInCFG,
                           "cfg-temporary-dtors",
                           /* Default = */ false);
 }
 
+bool AnalyzerOptions::useTemporaryTerminatorsInCFG() {
+  return getBooleanOption(UseTemporaryTerminatorsInCFG,
+                          "cfg-temporary-terminators",
+                          /* Default = */ false);
+}
+
 bool AnalyzerOptions::mayInlineCXXStandardLibrary() {
   return getBooleanOption(InlineCXXStandardLibrary,
                           "c++-stdlib-inlining",
                           /*Default=*/true);
 }
 
 bool AnalyzerOptions::mayInlineTemplateFunctions() {
   return getBooleanOption(InlineTemplateFunctions,

lib/StaticAnalyzer/Core/CoreEngine.cpp

 //==- CoreEngine.cpp - Path-Sensitive Dataflow Engine ------------*- C++ -*-//
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 //
 //  This file defines a generic engine for intraprocedural, path-sensitive,
 //  dataflow analysis via graph reachability engine.
 //
 //===----------------------------------------------------------------------===//
 
 #include "clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h"
 #include "clang/AST/Expr.h"
+#include "clang/AST/ExprCXX.h"
 #include "clang/AST/StmtCXX.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
 #include "llvm/ADT/DenseMap.h"
 #include "llvm/ADT/Statistic.h"
 #include "llvm/Support/Casting.h"
 
 using namespace clang;
switch (Term->getStmtClass()) {
         }
         return;
       }
         
       case Stmt::DoStmtClass:
         HandleBranch(cast<DoStmt>(Term)->getCond(), Term, B, Pred);
         return;
 
+      case Stmt::CXXBindTemporaryExprClass:
+        HandleTemporaryCleanup(cast<CXXBindTemporaryExpr>(Term), B, Pred);
+        return;
+
       case Stmt::CXXForRangeStmtClass:
         HandleBranch(cast<CXXForRangeStmt>(Term)->getCond(), Term, B, Pred);
         return;
 
       case Stmt::ForStmtClass:
         HandleBranch(cast<ForStmt>(Term)->getCond(), Term, B, Pred);
         return;
 
void CoreEngine::HandleBlockExit(const CFGBlock * B, ExplodedNode *Pred) {
 
   assert (B->succ_size() == 1 &&
           "Blocks with no terminator should have at most 1 successor.");
 
   generateNode(BlockEdge(B, *(B->succ_begin()), Pred->getLocationContext()),
                Pred->State, Pred);
 }
 
+
+
 void CoreEngine::HandleBranch(const Stmt *Cond, const Stmt *Term, 
                                 const CFGBlock * B, ExplodedNode *Pred) {
   assert(B->succ_size() == 2);
   NodeBuilderContext Ctx(*this, B, Pred);
   ExplodedNodeSet Dst;
   SubEng.processBranch(Cond, Term, Ctx, Pred, Dst,
                        *(B->succ_begin()), *(B->succ_begin()+1));
   // Enqueue the new frontier onto the worklist.
   enqueue(Dst);
 }
 
+void CoreEngine::HandleTemporaryCleanup(const CXXBindTemporaryExpr *BTE,
+                                        const CFGBlock *B,
+                                        ExplodedNode *Pred) {
+  assert(B->succ_size() == 2);
+  NodeBuilderContext Ctx(*this, B, Pred);
+  ExplodedNodeSet Dst;
+  SubEng.processTemporaryCleanup(BTE, Ctx, Pred, Dst,
+                                 *(B->succ_begin()), *(B->succ_begin()+1));
+  // Enqueue the new frontier onto the worklist.
+  enqueue(Dst);
+}
 
 void CoreEngine::HandleStaticInit(const DeclStmt *DS, const CFGBlock *B,
                                   ExplodedNode *Pred) {
   assert(B->succ_size() == 2);
   NodeBuilderContext Ctx(*this, B, Pred);
   ExplodedNodeSet Dst;
   SubEng.processStaticInitializer(DS, Ctx, Pred, Dst,
                                   *(B->succ_begin()), *(B->succ_begin()+1));

lib/StaticAnalyzer/Core/ExprEngine.cpp

switch (S->getStmtClass()) {
     case Stmt::ImplicitValueInitExprClass:
     case Stmt::CXXScalarValueInitExprClass:
     case Stmt::CXXBoolLiteralExprClass:
     case Stmt::ObjCBoolLiteralExprClass:
     case Stmt::FloatingLiteralClass:
     case Stmt::SizeOfPackExprClass:
     case Stmt::StringLiteralClass:
     case Stmt::ObjCStringLiteralClass:
-    case Stmt::CXXBindTemporaryExprClass:
     case Stmt::CXXPseudoDestructorExprClass:
     case Stmt::SubstNonTypeTemplateParmExprClass:
     case Stmt::CXXNullPtrLiteralExprClass: {
       Bldr.takeNodes(Pred);
       ExplodedNodeSet preVisit;
       getCheckerManager().runCheckersForPreStmt(preVisit, Pred, S, *this);
       getCheckerManager().runCheckersForPostStmt(Dst, preVisit, S, *this);
       Bldr.addNodes(Dst);
switch (S->getStmtClass()) {
     case Stmt::CXXTemporaryObjectExprClass:
     case Stmt::CXXConstructExprClass: {      
       Bldr.takeNodes(Pred);
       VisitCXXConstructExpr(cast<CXXConstructExpr>(S), Pred, Dst);
       Bldr.addNodes(Dst);
       break;
     }
 
+    case Stmt::CXXBindTemporaryExprClass: {
+      Bldr.takeNodes(Pred);
+      const CXXBindTemporaryExpr *BTE = cast<CXXBindTemporaryExpr>(S);
+      BindCXXTemporaryObject(BTE, Pred, Dst);
+      Bldr.addNodes(Dst);
+      break;
+    }
+
     case Stmt::CXXNewExprClass: {
       Bldr.takeNodes(Pred);
       ExplodedNodeSet PostVisit;
       VisitCXXNewExpr(cast<CXXNewExpr>(S), Pred, PostVisit);
       getCheckerManager().runCheckersForPostStmt(Dst, PostVisit, S, *this);
       Bldr.addNodes(Dst);
       break;
     }

lib/StaticAnalyzer/Core/ExprEngineCXX.cpp

 //===- ExprEngineCXX.cpp - ExprEngine support for C++ -----------*- C++ -*-===//
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 //
 //  This file defines the C++ expression evaluation engine.
 //
 //===----------------------------------------------------------------------===//
 
 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
+#include "PrettyStackTraceLocationContext.h"
 #include "clang/AST/DeclCXX.h"
 #include "clang/AST/StmtCXX.h"
 #include "clang/Basic/PrettyStackTrace.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
 
 using namespace clang;
 using namespace ento;
 
+/// The GDM component containing a mapping from temporary object binding
+/// statements to the count of temporaries created at that statement.
+/// Statements might create multiple temporaries if they're contained in a loop
+/// (e.g. for (;;) { if (createTemporary().foo()){} } ).
+REGISTER_TRAIT_WITH_PROGRAMSTATE(
+    LiveTemporaries,
+    CLANG_ENTO_PROGRAMSTATE_MAP(const CXXBindTemporaryExpr*, unsigned));
+
+void ExprEngine::BindCXXTemporaryObject(const CXXBindTemporaryExpr *BTE,
+                                          ExplodedNode *Pred,
+                                          ExplodedNodeSet &Dst) {
+  StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
+  ProgramStateRef state = Pred->getState();
+  if (const unsigned *binding_count = state->get<LiveTemporaries>(BTE)) {
+    state = state->set<LiveTemporaries>(BTE, *binding_count + 1);
+  } else {
+    state = state->set<LiveTemporaries>(BTE, 1);
+  }
+  Bldr.generateNode(BTE, Pred, state);
+}
+
+void ExprEngine::processTemporaryCleanup(const CXXBindTemporaryExpr *BTE,
+                                         NodeBuilderContext &BuilderCtx,
+                                         ExplodedNode *Pred,
+                                         clang::ento::ExplodedNodeSet &Dst,
+                                         const CFGBlock *DstT,
+                                         const CFGBlock *DstF) {
+  PrettyStackTraceLocationContext CrashInfo(Pred->getLocationContext());
+  currBldrCtx = &BuilderCtx;
+
+  ProgramStateRef State = Pred->getState();
+
+  bool needs_cleanup = false;
+  if (const unsigned *binding_count = State->get<LiveTemporaries>(BTE)) {
+    needs_cleanup = true;
+    if (*binding_count == 1) {
+      State = State->remove<LiveTemporaries>(BTE);
+    } else {
+      State = State->set<LiveTemporaries>(BTE, *binding_count - 1);
+    }
+  }
+
+  BranchNodeBuilder builder(Pred, Dst, BuilderCtx, DstT, DstF);
+
+  builder.generateNode(State, !needs_cleanup, Pred);
+  builder.markInfeasible(needs_cleanup);
+
+  currBldrCtx = 0;
+}
+
 void ExprEngine::CreateCXXTemporaryObject(const MaterializeTemporaryExpr *ME,
                                           ExplodedNode *Pred,
                                           ExplodedNodeSet &Dst) {
   StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
   const Expr *tempExpr = ME->GetTemporaryExpr()->IgnoreParens();
   ProgramStateRef state = Pred->getState();
   const LocationContext *LCtx = Pred->getLocationContext();
 
void ExprEngine::VisitCXXDestructor(QualType ObjectType,
                                     const MemRegion *Dest,
                                     const Stmt *S,
                                     bool IsBaseDtor,
                                     ExplodedNode *Pred, 
                                     ExplodedNodeSet &Dst) {
   const LocationContext *LCtx = Pred->getLocationContext();
   ProgramStateRef State = Pred->getState();
 
+  /*if (const CXXBindTemporaryExpr *BTE = dyn_cast<CXXBindTemporaryExpr>(S)) {
+    const unsigned *binding_count = State->get<LiveTemporaries>(BTE);
+    assert(binding_count && "Destroying an unregistered temporary");
+    if (*binding_count == 1) {
+      State = State->remove<LiveTemporaries>(BTE);
+    } else {
+      State = State->set<LiveTemporaries>(BTE, *binding_count - 1);
+    }
+  }*/
+
   // FIXME: We need to run the same destructor on every element of the array.
   // This workaround will just run the first destructor (which will still
   // invalidate the entire array).
   SVal DestVal = UnknownVal();
   if (Dest)
     DestVal = loc::MemRegionVal(Dest);
   DestVal = makeZeroElementRegion(State, DestVal, ObjectType);
   Dest = DestVal.getAsRegion();
 
   const CXXRecordDecl *RecordDecl = ObjectType->getAsCXXRecordDecl();
   assert(RecordDecl && "Only CXXRecordDecls should have destructors");
   const CXXDestructorDecl *DtorDecl = RecordDecl->getDestructor();
 
   CallEventManager &CEMgr = getStateManager().getCallEventManager();
   CallEventRef<CXXDestructorCall> Call =
     CEMgr.getCXXDestructorCall(DtorDecl, S, Dest, IsBaseDtor, State, LCtx);
 
   PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(),
                                 Call->getSourceRange().getBegin(),
                                 "Error evaluating destructor");
 
+  //FIXME: TODO: remove!
+  llvm::errs() << "OMG running destructor with stack trace "; CrashInfo.print(llvm::errs()); llvm::errs() << "\n";
+
   ExplodedNodeSet DstPreCall;
   getCheckerManager().runCheckersForPreCall(DstPreCall, Pred,
                                             *Call, *this);
 
   ExplodedNodeSet DstInvalidated;
   StmtNodeBuilder Bldr(DstPreCall, DstInvalidated, *currBldrCtx);
   for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end();
        I != E; ++I)

test/Analysis/temporaries.cpp

if (compute(i == 5 &&
         i != 4) {
       clang_analyzer_eval(true);  // expected-warning{{TRUE}}
     }
 
     if (compute(i == 5 &&
                 (i == 4 || i == 4 ||
                  compute(i == 5 && (i == 4 || check(NoReturnDtor()))))) ||
         i != 4) {
-      // FIXME: This shouldn't cause a warning.
-      clang_analyzer_eval(true);  // expected-warning{{TRUE}}
+      clang_analyzer_eval(true); // no warning, unreachable code
     }
   }
 
   // PR16664 and PR18159
   void testConsistencyNestedSimple(bool value) {
     if (value) {
       if (!value || check(NoReturnDtor())) {
         clang_analyzer_eval(true); // no warning, unreachable code
       }
     }
   }
 
   // PR16664 and PR18159
   void testConsistencyNestedComplex(bool value) {
     if (value) {
       if (!value || !value || check(NoReturnDtor())) {
-        // FIXME: This shouldn't cause a warning.
-        clang_analyzer_eval(true); // expected-warning{{TRUE}}
+        clang_analyzer_eval(true); // no warning, unreachable code
+      }
+    }
+  }
+  
+  // PR16664 and PR18159
+  void testConsistencyNestedComplexMidBranch(bool value) {
+    if (value) {
+      if (!value || !value || check(NoReturnDtor()) || value) {
+        clang_analyzer_eval(true); // no warning, unreachable code
+      }
+    }
+  }
+  
+  // PR16664 and PR18159
+  void testConsistencyNestedComplexNestedBranch(bool value) {
+    if (value) {
+      if (!value || (!value || check(NoReturnDtor()) || value)) {
+        clang_analyzer_eval(true); // no warning, unreachable code
+      }
+    }
+  }
+
+  // PR16664 and PR18159
+  void testConsistencyNestedVariableModification(bool value) {
+    bool other = true;
+    if (value) {
+      if (!other || !value || (other = false) || check(NoReturnDtor())
+          || !other) {
+        clang_analyzer_eval(true); // no warning, unreachable code
       }
     }
   }
 
   // PR16664 and PR18159
   void testConsistencyNestedWarning(bool value) {
     if (value) {
       if (!value || value || check(NoReturnDtor())) {