Index: clang/include/clang/StaticAnalyzer/Checkers/SValExplainer.h =================================================================== --- clang/include/clang/StaticAnalyzer/Checkers/SValExplainer.h +++ clang/include/clang/StaticAnalyzer/Checkers/SValExplainer.h @@ -258,7 +258,7 @@ std::string(OS.str()) + ")"; } - std::string VisitSymExpr(SymbolRef S) { + std::string VisitSymExpr(SymExprRef S) { std::string Str; llvm::raw_string_ostream OS(Str); S->dumpToStream(OS); Index: clang/include/clang/StaticAnalyzer/Core/BugReporter/BugReporter.h =================================================================== --- clang/include/clang/StaticAnalyzer/Core/BugReporter/BugReporter.h +++ clang/include/clang/StaticAnalyzer/Core/BugReporter/BugReporter.h @@ -92,11 +92,11 @@ /// The hint can be customized by redefining 'getMessageForX()' methods. class StackHintGeneratorForSymbol : public StackHintGenerator { private: - SymbolRef Sym; + SymExprRef Sym; std::string Msg; public: - StackHintGeneratorForSymbol(SymbolRef S, StringRef M) : Sym(S), Msg(M) {} + StackHintGeneratorForSymbol(SymExprRef S, StringRef M) : Sym(S), Msg(M) {} ~StackHintGeneratorForSymbol() override = default; /// Search the call expression for the symbol Sym and dispatch the @@ -310,7 +310,7 @@ /// diagnostics to include when constructing the final path diagnostic. /// The stack is largely used by BugReporter when generating PathDiagnostics /// for multiple PathDiagnosticConsumers. - llvm::DenseMap InterestingSymbols; + llvm::DenseMap InterestingSymbols; /// A (stack of) set of regions that are registered with this report as being /// "interesting", and thus used to help decide which diagnostics @@ -429,8 +429,8 @@ /// Marks a symbol as interesting. Different kinds of interestingness will /// be processed differently by visitors (e.g. if the tracking kind is /// condition, will append "will be used as a condition" to the message). - void markInteresting(SymbolRef sym, bugreporter::TrackingKind TKind = - bugreporter::TrackingKind::Thorough); + void markInteresting(SymExprRef sym, bugreporter::TrackingKind TKind = + bugreporter::TrackingKind::Thorough); /// Marks a region as interesting. Different kinds of interestingness will /// be processed differently by visitors (e.g. if the tracking kind is @@ -446,13 +446,13 @@ bugreporter::TrackingKind::Thorough); void markInteresting(const LocationContext *LC); - bool isInteresting(SymbolRef sym) const; + bool isInteresting(SymExprRef sym) const; bool isInteresting(const MemRegion *R) const; bool isInteresting(SVal V) const; bool isInteresting(const LocationContext *LC) const; Optional - getInterestingnessKind(SymbolRef sym) const; + getInterestingnessKind(SymExprRef sym) const; Optional getInterestingnessKind(const MemRegion *R) const; Index: clang/include/clang/StaticAnalyzer/Core/PathSensitive/ConstraintManager.h =================================================================== --- clang/include/clang/StaticAnalyzer/Core/PathSensitive/ConstraintManager.h +++ clang/include/clang/StaticAnalyzer/Core/PathSensitive/ConstraintManager.h @@ -148,8 +148,8 @@ /// /// Note that a ConstraintManager is not obligated to return a concretized /// value for a symbol, even if it is perfectly constrained. - virtual const llvm::APSInt* getSymVal(ProgramStateRef state, - SymbolRef sym) const { + virtual const llvm::APSInt *getSymVal(ProgramStateRef state, + SymExprRef sym) const { return nullptr; } @@ -164,7 +164,7 @@ /// Convenience method to query the state to see if a symbol is null or /// not null, or if neither assumption can be made. - ConditionTruthVal isNull(ProgramStateRef State, SymbolRef Sym) { + ConditionTruthVal isNull(ProgramStateRef State, SymExprRef Sym) { SaveAndRestore DisableNotify(NotifyAssumeClients, false); return checkNull(State, Sym); @@ -188,7 +188,7 @@ /// Returns whether or not a symbol is known to be null ("true"), known to be /// non-null ("false"), or may be either ("underconstrained"). - virtual ConditionTruthVal checkNull(ProgramStateRef State, SymbolRef Sym); + virtual ConditionTruthVal checkNull(ProgramStateRef State, SymExprRef Sym); }; std::unique_ptr Index: clang/include/clang/StaticAnalyzer/Core/PathSensitive/DynamicType.h =================================================================== --- clang/include/clang/StaticAnalyzer/Core/PathSensitive/DynamicType.h +++ clang/include/clang/StaticAnalyzer/Core/PathSensitive/DynamicType.h @@ -38,7 +38,7 @@ /// Get dynamic type information stored in a class object represented by \p Sym. DynamicTypeInfo getClassObjectDynamicTypeInfo(ProgramStateRef State, - SymbolRef Sym); + SymExprRef Sym); /// Get dynamic cast information from \p CastFromTy to \p CastToTy of \p MR. const DynamicCastInfo *getDynamicCastInfo(ProgramStateRef State, @@ -56,12 +56,12 @@ /// Set constraint on a type contained in a class object; return the new state. ProgramStateRef setClassObjectDynamicTypeInfo(ProgramStateRef State, - SymbolRef Sym, + SymExprRef Sym, DynamicTypeInfo NewTy); /// Set constraint on a type contained in a class object; return the new state. ProgramStateRef setClassObjectDynamicTypeInfo(ProgramStateRef State, - SymbolRef Sym, QualType NewTy, + SymExprRef Sym, QualType NewTy, bool CanBeSubClassed = true); /// Set dynamic type and cast information of the region; return the new state. Index: clang/include/clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h =================================================================== --- clang/include/clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h +++ clang/include/clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h @@ -754,9 +754,9 @@ class SymbolicRegion : public SubRegion { friend class MemRegionManager; - const SymbolRef sym; + const SymExprRef sym; - SymbolicRegion(const SymbolRef s, const MemSpaceRegion *sreg) + SymbolicRegion(const SymExprRef s, const MemSpaceRegion *sreg) : SubRegion(sreg, SymbolicRegionKind), sym(s) { // Because pointer arithmetic is represented by ElementRegion layers, // the base symbol here should not contain any arithmetic. @@ -768,15 +768,14 @@ } public: - SymbolRef getSymbol() const { return sym; } + SymExprRef getSymbol() const { return sym; } bool isBoundable() const override { return true; } void Profile(llvm::FoldingSetNodeID& ID) const override; - static void ProfileRegion(llvm::FoldingSetNodeID& ID, - SymbolRef sym, - const MemRegion* superRegion); + static void ProfileRegion(llvm::FoldingSetNodeID &ID, SymExprRef sym, + const MemRegion *superRegion); void dumpToStream(raw_ostream &os) const override; @@ -1375,10 +1374,10 @@ const LocationContext *LC); /// Retrieve or create a "symbolic" memory region. - const SymbolicRegion* getSymbolicRegion(SymbolRef Sym); + const SymbolicRegion *getSymbolicRegion(SymExprRef Sym); /// Return a unique symbolic region belonging to heap memory space. - const SymbolicRegion *getSymbolicHeapRegion(SymbolRef sym); + const SymbolicRegion *getSymbolicHeapRegion(SymExprRef sym); const StringRegion *getStringRegion(const StringLiteral *Str); @@ -1517,12 +1516,12 @@ using StorageTypeForKinds = unsigned char; llvm::DenseMap MRTraitsMap; - llvm::DenseMap SymTraitsMap; + llvm::DenseMap SymTraitsMap; using const_region_iterator = llvm::DenseMap::const_iterator; using const_symbol_iterator = - llvm::DenseMap::const_iterator; + llvm::DenseMap::const_iterator; public: /// Describes different invalidation traits. @@ -1544,9 +1543,9 @@ // the number of bits StorageTypeForKinds can store. }; - void setTrait(SymbolRef Sym, InvalidationKinds IK); + void setTrait(SymExprRef Sym, InvalidationKinds IK); void setTrait(const MemRegion *MR, InvalidationKinds IK); - bool hasTrait(SymbolRef Sym, InvalidationKinds IK) const; + bool hasTrait(SymExprRef Sym, InvalidationKinds IK) const; bool hasTrait(const MemRegion *MR, InvalidationKinds IK) const; }; Index: clang/include/clang/StaticAnalyzer/Core/PathSensitive/RangedConstraintManager.h =================================================================== --- clang/include/clang/StaticAnalyzer/Core/PathSensitive/RangedConstraintManager.h +++ clang/include/clang/StaticAnalyzer/Core/PathSensitive/RangedConstraintManager.h @@ -136,7 +136,7 @@ } }; -using ConstraintMap = llvm::ImmutableMap; +using ConstraintMap = llvm::ImmutableMap; ConstraintMap getConstraintMap(ProgramStateRef State); class RangedConstraintManager : public SimpleConstraintManager { @@ -150,20 +150,20 @@ // Implementation for interface from SimpleConstraintManager. //===------------------------------------------------------------------===// - ProgramStateRef assumeSym(ProgramStateRef State, SymbolRef Sym, + ProgramStateRef assumeSym(ProgramStateRef State, SymExprRef Sym, bool Assumption) override; - ProgramStateRef assumeSymInclusiveRange(ProgramStateRef State, SymbolRef Sym, + ProgramStateRef assumeSymInclusiveRange(ProgramStateRef State, SymExprRef Sym, const llvm::APSInt &From, const llvm::APSInt &To, bool InRange) override; - ProgramStateRef assumeSymUnsupported(ProgramStateRef State, SymbolRef Sym, + ProgramStateRef assumeSymUnsupported(ProgramStateRef State, SymExprRef Sym, bool Assumption) override; protected: /// Assume a constraint between a symbolic expression and a concrete integer. - virtual ProgramStateRef assumeSymRel(ProgramStateRef State, SymbolRef Sym, + virtual ProgramStateRef assumeSymRel(ProgramStateRef State, SymExprRef Sym, BinaryOperator::Opcode op, const llvm::APSInt &Int); @@ -174,43 +174,43 @@ // Each of these is of the form "$Sym+Adj <> V", where "<>" is the comparison // operation for the method being invoked. - virtual ProgramStateRef assumeSymNE(ProgramStateRef State, SymbolRef Sym, + virtual ProgramStateRef assumeSymNE(ProgramStateRef State, SymExprRef Sym, const llvm::APSInt &V, const llvm::APSInt &Adjustment) = 0; - virtual ProgramStateRef assumeSymEQ(ProgramStateRef State, SymbolRef Sym, + virtual ProgramStateRef assumeSymEQ(ProgramStateRef State, SymExprRef Sym, const llvm::APSInt &V, const llvm::APSInt &Adjustment) = 0; - virtual ProgramStateRef assumeSymLT(ProgramStateRef State, SymbolRef Sym, + virtual ProgramStateRef assumeSymLT(ProgramStateRef State, SymExprRef Sym, const llvm::APSInt &V, const llvm::APSInt &Adjustment) = 0; - virtual ProgramStateRef assumeSymGT(ProgramStateRef State, SymbolRef Sym, + virtual ProgramStateRef assumeSymGT(ProgramStateRef State, SymExprRef Sym, const llvm::APSInt &V, const llvm::APSInt &Adjustment) = 0; - virtual ProgramStateRef assumeSymLE(ProgramStateRef State, SymbolRef Sym, + virtual ProgramStateRef assumeSymLE(ProgramStateRef State, SymExprRef Sym, const llvm::APSInt &V, const llvm::APSInt &Adjustment) = 0; - virtual ProgramStateRef assumeSymGE(ProgramStateRef State, SymbolRef Sym, + virtual ProgramStateRef assumeSymGE(ProgramStateRef State, SymExprRef Sym, const llvm::APSInt &V, const llvm::APSInt &Adjustment) = 0; virtual ProgramStateRef assumeSymWithinInclusiveRange( - ProgramStateRef State, SymbolRef Sym, const llvm::APSInt &From, + ProgramStateRef State, SymExprRef Sym, const llvm::APSInt &From, const llvm::APSInt &To, const llvm::APSInt &Adjustment) = 0; virtual ProgramStateRef assumeSymOutsideInclusiveRange( - ProgramStateRef State, SymbolRef Sym, const llvm::APSInt &From, + ProgramStateRef State, SymExprRef Sym, const llvm::APSInt &From, const llvm::APSInt &To, const llvm::APSInt &Adjustment) = 0; //===------------------------------------------------------------------===// // Internal implementation. //===------------------------------------------------------------------===// private: - static void computeAdjustment(SymbolRef &Sym, llvm::APSInt &Adjustment); + static void computeAdjustment(SymExprRef &Sym, llvm::APSInt &Adjustment); }; } // namespace ento Index: clang/include/clang/StaticAnalyzer/Core/PathSensitive/SMTConstraintManager.h =================================================================== --- clang/include/clang/StaticAnalyzer/Core/PathSensitive/SMTConstraintManager.h +++ clang/include/clang/StaticAnalyzer/Core/PathSensitive/SMTConstraintManager.h @@ -20,7 +20,7 @@ #include "clang/StaticAnalyzer/Core/PathSensitive/SMTConv.h" typedef llvm::ImmutableSet< - std::pair> + std::pair> ConstraintSMTType; REGISTER_TRAIT_WITH_PROGRAMSTATE(ConstraintSMT, ConstraintSMTType) @@ -40,7 +40,7 @@ // Implementation for interface from SimpleConstraintManager. //===------------------------------------------------------------------===// - ProgramStateRef assumeSym(ProgramStateRef State, SymbolRef Sym, + ProgramStateRef assumeSym(ProgramStateRef State, SymExprRef Sym, bool Assumption) override { ASTContext &Ctx = getBasicVals().getContext(); @@ -60,7 +60,7 @@ return assumeExpr(State, Sym, Assumption ? Exp : Solver->mkNot(Exp)); } - ProgramStateRef assumeSymInclusiveRange(ProgramStateRef State, SymbolRef Sym, + ProgramStateRef assumeSymInclusiveRange(ProgramStateRef State, SymExprRef Sym, const llvm::APSInt &From, const llvm::APSInt &To, bool InRange) override { @@ -69,7 +69,7 @@ State, Sym, SMTConv::getRangeExpr(Solver, Ctx, Sym, From, To, InRange)); } - ProgramStateRef assumeSymUnsupported(ProgramStateRef State, SymbolRef Sym, + ProgramStateRef assumeSymUnsupported(ProgramStateRef State, SymExprRef Sym, bool Assumption) override { // Skip anything that is unsupported return State; @@ -79,7 +79,7 @@ // Implementation for interface from ConstraintManager. //===------------------------------------------------------------------===// - ConditionTruthVal checkNull(ProgramStateRef State, SymbolRef Sym) override { + ConditionTruthVal checkNull(ProgramStateRef State, SymExprRef Sym) override { ASTContext &Ctx = getBasicVals().getContext(); QualType RetTy; @@ -108,7 +108,7 @@ } const llvm::APSInt *getSymVal(ProgramStateRef State, - SymbolRef Sym) const override { + SymExprRef Sym) const override { BasicValueFactory &BVF = getBasicVals(); ASTContext &Ctx = BVF.getContext(); @@ -154,7 +154,7 @@ } if (const SymbolCast *SC = dyn_cast(Sym)) { - SymbolRef CastSym = SC->getOperand(); + SymExprRef CastSym = SC->getOperand(); QualType CastTy = SC->getType(); // Skip the void type if (CastTy->isVoidType()) @@ -294,7 +294,7 @@ protected: // Check whether a new model is satisfiable, and update the program state. - virtual ProgramStateRef assumeExpr(ProgramStateRef State, SymbolRef Sym, + virtual ProgramStateRef assumeExpr(ProgramStateRef State, SymExprRef Sym, const llvm::SMTExprRef &Exp) { // Check the model, avoid simplifying AST to save time if (checkModel(State, Sym, Exp).isConstrainedTrue()) @@ -324,7 +324,7 @@ } // Generate and check a Z3 model, using the given constraint. - ConditionTruthVal checkModel(ProgramStateRef State, SymbolRef Sym, + ConditionTruthVal checkModel(ProgramStateRef State, SymExprRef Sym, const llvm::SMTExprRef &Exp) const { ProgramStateRef NewState = State->add(std::make_pair(Sym, Exp)); Index: clang/include/clang/StaticAnalyzer/Core/PathSensitive/SMTConv.h =================================================================== --- clang/include/clang/StaticAnalyzer/Core/PathSensitive/SMTConv.h +++ clang/include/clang/StaticAnalyzer/Core/PathSensitive/SMTConv.h @@ -420,7 +420,7 @@ // Recursive implementation to unpack and generate symbolic expression. // Sets the hasComparison and RetTy parameters. See getExpr(). static inline llvm::SMTExprRef getSymExpr(llvm::SMTSolverRef &Solver, - ASTContext &Ctx, SymbolRef Sym, + ASTContext &Ctx, SymExprRef Sym, QualType *RetTy, bool *hasComparison) { if (const SymbolData *SD = dyn_cast(Sym)) { @@ -455,7 +455,7 @@ return Exp; } - llvm_unreachable("Unsupported SymbolRef type!"); + llvm_unreachable("Unsupported SymExprRef type!"); } // Generate an SMTSolverRef that represents the given symbolic expression. @@ -463,7 +463,7 @@ // operator. Sets the RetTy parameter to the final return type after // promotions and casts. static inline llvm::SMTExprRef getExpr(llvm::SMTSolverRef &Solver, - ASTContext &Ctx, SymbolRef Sym, + ASTContext &Ctx, SymExprRef Sym, QualType *RetTy = nullptr, bool *hasComparison = nullptr) { if (hasComparison) { @@ -505,7 +505,7 @@ // Wrapper to generate SMTSolverRef from a range. If From == To, an // equality will be created instead. static inline llvm::SMTExprRef - getRangeExpr(llvm::SMTSolverRef &Solver, ASTContext &Ctx, SymbolRef Sym, + getRangeExpr(llvm::SMTSolverRef &Solver, ASTContext &Ctx, SymExprRef Sym, const llvm::APSInt &From, const llvm::APSInt &To, bool InRange) { // Convert lower bound QualType FromTy; Index: clang/include/clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h =================================================================== --- clang/include/clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h +++ clang/include/clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h @@ -224,8 +224,9 @@ const LocationContext *LCtx, unsigned Count); - DefinedOrUnknownSVal getDerivedRegionValueSymbolVal( - SymbolRef parentSymbol, const TypedValueRegion *region); + DefinedOrUnknownSVal + getDerivedRegionValueSymbolVal(SymExprRef parentSymbol, + const TypedValueRegion *region); DefinedSVal getMetadataSymbolVal(const void *symbolTag, const MemRegion *region, @@ -350,7 +351,7 @@ return loc::ConcreteInt(BasicVals.getZeroWithPtrWidth()); } - Loc makeLoc(SymbolRef sym) { + Loc makeLoc(SymExprRef sym) { return loc::MemRegionVal(MemMgr.getSymbolicRegion(sym)); } @@ -369,7 +370,7 @@ /// Make an SVal that represents the given symbol. This follows the convention /// of representing Loc-type symbols (symbolic pointers and references) /// as Loc values wrapping the symbol rather than as plain symbol values. - SVal makeSymbolVal(SymbolRef Sym) { + SVal makeSymbolVal(SymExprRef Sym) { if (Loc::isLocType(Sym->getType())) return makeLoc(Sym); return nonloc::SymbolVal(Sym); Index: clang/include/clang/StaticAnalyzer/Core/PathSensitive/SValVisitor.h =================================================================== --- clang/include/clang/StaticAnalyzer/Core/PathSensitive/SValVisitor.h +++ clang/include/clang/StaticAnalyzer/Core/PathSensitive/SValVisitor.h @@ -78,7 +78,7 @@ #define DISPATCH(CLASS) \ return static_cast(this)->Visit ## CLASS(cast(S)) - RetTy Visit(SymbolRef S) { + RetTy Visit(SymExprRef S) { // Dispatch to VisitSymbolFoo for each SymbolFoo. switch (S->getKind()) { #define SYMBOL(Id, Parent) \ @@ -95,7 +95,7 @@ #include "clang/StaticAnalyzer/Core/PathSensitive/Symbols.def" // Base case, ignore it. :) - RetTy VisitSymExpr(SymbolRef S) { return RetTy(); } + RetTy VisitSymExpr(SymExprRef S) { return RetTy(); } #undef DISPATCH }; Index: clang/include/clang/StaticAnalyzer/Core/PathSensitive/SVals.h =================================================================== --- clang/include/clang/StaticAnalyzer/Core/PathSensitive/SVals.h +++ clang/include/clang/StaticAnalyzer/Core/PathSensitive/SVals.h @@ -164,23 +164,23 @@ const FunctionDecl *getAsFunctionDecl() const; /// If this SVal is a location and wraps a symbol, return that - /// SymbolRef. Otherwise return 0. + /// SymExprRef. Otherwise return 0. /// /// Casts are ignored during lookup. /// \param IncludeBaseRegions The boolean that controls whether the search /// should continue to the base regions if the region is not symbolic. - SymbolRef getAsLocSymbol(bool IncludeBaseRegions = false) const; + SymExprRef getAsLocSymbol(bool IncludeBaseRegions = false) const; /// Get the symbol in the SVal or its base region. - SymbolRef getLocSymbolInBase() const; + SymExprRef getLocSymbolInBase() const; - /// If this SVal wraps a symbol return that SymbolRef. + /// If this SVal wraps a symbol return that SymExprRef. /// Otherwise, return 0. /// /// Casts are ignored during lookup. /// \param IncludeBaseRegions The boolean that controls whether the search /// should continue to the base regions if the region is not symbolic. - SymbolRef getAsSymbol(bool IncludeBaseRegions = false) const; + SymExprRef getAsSymbol(bool IncludeBaseRegions = false) const; const MemRegion *getAsRegion() const; @@ -343,14 +343,12 @@ class SymbolVal : public NonLoc { public: SymbolVal() = delete; - SymbolVal(SymbolRef sym) : NonLoc(SymbolValKind, sym) { + SymbolVal(SymExprRef sym) : NonLoc(SymbolValKind, sym) { assert(sym); assert(!Loc::isLocType(sym->getType())); } - SymbolRef getSymbol() const { - return (const SymExpr *) Data; - } + SymExprRef getSymbol() const { return (const SymExpr *)Data; } bool isExpression() const { return !isa(getSymbol()); Index: clang/include/clang/StaticAnalyzer/Core/PathSensitive/SimpleConstraintManager.h =================================================================== --- clang/include/clang/StaticAnalyzer/Core/PathSensitive/SimpleConstraintManager.h +++ clang/include/clang/StaticAnalyzer/Core/PathSensitive/SimpleConstraintManager.h @@ -51,7 +51,7 @@ /// Given a symbolic expression that can be reasoned about, assume that it is /// true/false and generate the new program state. - virtual ProgramStateRef assumeSym(ProgramStateRef State, SymbolRef Sym, + virtual ProgramStateRef assumeSym(ProgramStateRef State, SymExprRef Sym, bool Assumption) = 0; /// Given a symbolic expression within the range [From, To], assume that it is @@ -59,7 +59,7 @@ /// This function is used to handle case ranges produced by a language /// extension for switch case statements. virtual ProgramStateRef assumeSymInclusiveRange(ProgramStateRef State, - SymbolRef Sym, + SymExprRef Sym, const llvm::APSInt &From, const llvm::APSInt &To, bool InRange) = 0; @@ -67,7 +67,7 @@ /// Given a symbolic expression that cannot be reasoned about, assume that /// it is zero/nonzero and add it directly to the solver state. virtual ProgramStateRef assumeSymUnsupported(ProgramStateRef State, - SymbolRef Sym, + SymExprRef Sym, bool Assumption) = 0; //===------------------------------------------------------------------===// Index: clang/include/clang/StaticAnalyzer/Core/PathSensitive/Store.h =================================================================== --- clang/include/clang/StaticAnalyzer/Core/PathSensitive/Store.h +++ clang/include/clang/StaticAnalyzer/Core/PathSensitive/Store.h @@ -48,7 +48,7 @@ class ScanReachableSymbols; class SymbolReaper; -using InvalidatedSymbols = llvm::DenseSet; +using InvalidatedSymbols = llvm::DenseSet; class StoreManager { protected: @@ -258,12 +258,12 @@ }; class FindUniqueBinding : public BindingsHandler { - SymbolRef Sym; + SymExprRef Sym; const MemRegion* Binding = nullptr; bool First = true; public: - FindUniqueBinding(SymbolRef sym) : Sym(sym) {} + FindUniqueBinding(SymExprRef sym) : Sym(sym) {} explicit operator bool() { return First && Binding; } Index: clang/include/clang/StaticAnalyzer/Core/PathSensitive/SymExpr.h =================================================================== --- clang/include/clang/StaticAnalyzer/Core/PathSensitive/SymExpr.h +++ clang/include/clang/StaticAnalyzer/Core/PathSensitive/SymExpr.h @@ -107,8 +107,8 @@ return os; } -using SymbolRef = const SymExpr *; -using SymbolRefSmallVectorTy = SmallVector; +using SymExprRef = const SymExpr *; +using SymbolRefSmallVectorTy = SmallVector; using SymbolID = unsigned; /// A symbol representing data which can be stored in a memory location Index: clang/include/clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h =================================================================== --- clang/include/clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h +++ clang/include/clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h @@ -129,18 +129,18 @@ /// A symbol representing the value of a MemRegion whose parent region has /// symbolic value. class SymbolDerived : public SymbolData { - SymbolRef parentSymbol; + SymExprRef parentSymbol; const TypedValueRegion *R; public: - SymbolDerived(SymbolID sym, SymbolRef parent, const TypedValueRegion *r) + SymbolDerived(SymbolID sym, SymExprRef parent, const TypedValueRegion *r) : SymbolData(SymbolDerivedKind, sym), parentSymbol(parent), R(r) { assert(parent); assert(r); assert(isValidTypeForSymbol(r->getValueType())); } - SymbolRef getParentSymbol() const { return parentSymbol; } + SymExprRef getParentSymbol() const { return parentSymbol; } const TypedValueRegion *getRegion() const { return R; } QualType getType() const override; @@ -150,7 +150,7 @@ void dumpToStream(raw_ostream &os) const override; const MemRegion *getOriginRegion() const override { return getRegion(); } - static void Profile(llvm::FoldingSetNodeID& profile, SymbolRef parent, + static void Profile(llvm::FoldingSetNodeID &profile, SymExprRef parent, const TypedValueRegion *r) { profile.AddInteger((unsigned) SymbolDerivedKind); profile.AddPointer(r); @@ -417,7 +417,7 @@ class SymbolManager { using DataSetTy = llvm::FoldingSet; using SymbolDependTy = - llvm::DenseMap>; + llvm::DenseMap>; DataSetTy DataSet; @@ -453,7 +453,7 @@ return conjureSymbol(E, LCtx, E->getType(), VisitCount, SymbolTag); } - const SymbolDerived *getDerivedSymbol(SymbolRef parentSymbol, + const SymbolDerived *getDerivedSymbol(SymExprRef parentSymbol, const TypedValueRegion *R); const SymbolExtent *getExtentSymbol(const SubRegion *R); @@ -493,9 +493,10 @@ /// Add artificial symbol dependency. /// /// The dependent symbol should stay alive as long as the primary is alive. - void addSymbolDependency(const SymbolRef Primary, const SymbolRef Dependent); + void addSymbolDependency(const SymExprRef Primary, + const SymExprRef Dependent); - const SymbolRefSmallVectorTy *getDependentSymbols(const SymbolRef Primary); + const SymbolRefSmallVectorTy *getDependentSymbols(const SymExprRef Primary); ASTContext &getContext() { return Ctx; } BasicValueFactory &getBasicVals() { return BV; } @@ -508,8 +509,8 @@ HaveMarkedDependents }; - using SymbolSetTy = llvm::DenseSet; - using SymbolMapTy = llvm::DenseMap; + using SymbolSetTy = llvm::DenseSet; + using SymbolMapTy = llvm::DenseMap; using RegionSetTy = llvm::DenseSet; SymbolMapTy TheLiving; @@ -537,7 +538,7 @@ const LocationContext *getLocationContext() const { return LCtx; } - bool isLive(SymbolRef sym); + bool isLive(SymExprRef sym); bool isLiveRegion(const MemRegion *region); bool isLive(const Expr *ExprVal, const LocationContext *LCtx) const; bool isLive(const VarRegion *VR, bool includeStoreBindings = false) const; @@ -547,7 +548,7 @@ /// This should never be /// used by checkers, only by the state infrastructure such as the store and /// environment. Checkers should instead use metadata symbols and markInUse. - void markLive(SymbolRef sym); + void markLive(SymExprRef sym); /// Marks a symbol as important to a checker. /// @@ -556,7 +557,7 @@ /// live. For other symbols, this has no effect; checkers are not permitted /// to influence the life of other symbols. This should be used before any /// symbol marking has occurred, i.e. in the MarkLiveSymbols callback. - void markInUse(SymbolRef sym); + void markInUse(SymExprRef sym); using region_iterator = RegionSetTy::const_iterator; @@ -567,9 +568,7 @@ /// /// This should only be called once all marking of dead symbols has completed. /// (For checkers, this means only in the checkDeadSymbols callback.) - bool isDead(SymbolRef sym) { - return !isLive(sym); - } + bool isDead(SymExprRef sym) { return !isLive(sym); } void markLive(const MemRegion *region); void markElementIndicesLive(const MemRegion *region); @@ -580,7 +579,7 @@ private: /// Mark the symbols dependent on the input symbol as live. - void markDependentsLive(SymbolRef sym); + void markDependentsLive(SymExprRef sym); }; class SymbolVisitor { @@ -596,7 +595,7 @@ /// /// The method returns \c true if symbols should continue be scanned and \c /// false otherwise. - virtual bool VisitSymbol(SymbolRef sym) = 0; + virtual bool VisitSymbol(SymExprRef sym) = 0; virtual bool VisitMemRegion(const MemRegion *) { return true; } }; Index: clang/lib/StaticAnalyzer/Checkers/AllocationState.h =================================================================== --- clang/lib/StaticAnalyzer/Checkers/AllocationState.h +++ clang/lib/StaticAnalyzer/Checkers/AllocationState.h @@ -17,18 +17,18 @@ namespace allocation_state { -ProgramStateRef markReleased(ProgramStateRef State, SymbolRef Sym, +ProgramStateRef markReleased(ProgramStateRef State, SymExprRef Sym, const Expr *Origin); /// This function provides an additional visitor that augments the bug report /// with information relevant to memory errors caused by the misuse of /// AF_InnerBuffer symbols. -std::unique_ptr getInnerPointerBRVisitor(SymbolRef Sym); +std::unique_ptr getInnerPointerBRVisitor(SymExprRef Sym); /// 'Sym' represents a pointer to the inner buffer of a container object. /// This function looks up the memory region of that object in /// DanglingInternalBufferChecker's program state map. -const MemRegion *getContainerObjRegion(ProgramStateRef State, SymbolRef Sym); +const MemRegion *getContainerObjRegion(ProgramStateRef State, SymExprRef Sym); } // end namespace allocation_state Index: clang/lib/StaticAnalyzer/Checkers/BasicObjCFoundationChecks.cpp =================================================================== --- clang/lib/StaticAnalyzer/Checkers/BasicObjCFoundationChecks.cpp +++ clang/lib/StaticAnalyzer/Checkers/BasicObjCFoundationChecks.cpp @@ -801,8 +801,8 @@ // The map from container symbol to the container count symbol. // We currently will remember the last container count symbol encountered. -REGISTER_MAP_WITH_PROGRAMSTATE(ContainerCountMap, SymbolRef, SymbolRef) -REGISTER_MAP_WITH_PROGRAMSTATE(ContainerNonEmptyMap, SymbolRef, bool) +REGISTER_MAP_WITH_PROGRAMSTATE(ContainerCountMap, SymExprRef, SymExprRef) +REGISTER_MAP_WITH_PROGRAMSTATE(ContainerNonEmptyMap, SymExprRef, bool) namespace { class ObjCLoopChecker @@ -910,13 +910,14 @@ /// Returns NULL state if the collection is known to contain elements /// (or is known not to contain elements if the Assumption parameter is false.) -static ProgramStateRef -assumeCollectionNonEmpty(CheckerContext &C, ProgramStateRef State, - SymbolRef CollectionS, bool Assumption) { +static ProgramStateRef assumeCollectionNonEmpty(CheckerContext &C, + ProgramStateRef State, + SymExprRef CollectionS, + bool Assumption) { if (!State || !CollectionS) return State; - const SymbolRef *CountS = State->get(CollectionS); + const SymExprRef *CountS = State->get(CollectionS); if (!CountS) { const bool *KnownNonEmpty = State->get(CollectionS); if (!KnownNonEmpty) @@ -948,7 +949,7 @@ if (!State) return nullptr; - SymbolRef CollectionS = C.getSVal(FCS->getCollection()).getAsSymbol(); + SymExprRef CollectionS = C.getSVal(FCS->getCollection()).getAsSymbol(); return assumeCollectionNonEmpty(C, State, CollectionS, Assumption); } @@ -1023,7 +1024,7 @@ Class != FC_NSOrderedSet) return; - SymbolRef ContainerS = M.getReceiverSVal().getAsSymbol(); + SymExprRef ContainerS = M.getReceiverSVal().getAsSymbol(); if (!ContainerS) return; @@ -1033,7 +1034,7 @@ return; const Expr *MsgExpr = M.getOriginExpr(); - SymbolRef CountS = C.getSVal(MsgExpr).getAsSymbol(); + SymExprRef CountS = C.getSVal(MsgExpr).getAsSymbol(); if (CountS) { ProgramStateRef State = C.getState(); @@ -1049,7 +1050,7 @@ } } -static SymbolRef getMethodReceiverIfKnownImmutable(const CallEvent *Call) { +static SymExprRef getMethodReceiverIfKnownImmutable(const CallEvent *Call) { const ObjCMethodCall *Message = dyn_cast_or_null(Call); if (!Message) return nullptr; @@ -1092,13 +1093,13 @@ const InvalidatedSymbols &Escaped, const CallEvent *Call, PointerEscapeKind Kind) const { - SymbolRef ImmutableReceiver = getMethodReceiverIfKnownImmutable(Call); + SymExprRef ImmutableReceiver = getMethodReceiverIfKnownImmutable(Call); // Remove the invalidated symbols form the collection count map. for (InvalidatedSymbols::const_iterator I = Escaped.begin(), E = Escaped.end(); I != E; ++I) { - SymbolRef Sym = *I; + SymExprRef Sym = *I; // Don't invalidate this symbol's count if we know the method being called // is declared on an immutable class. This isn't completely correct if the @@ -1123,7 +1124,7 @@ ContainerCountMapTy Tracked = State->get(); for (ContainerCountMapTy::iterator I = Tracked.begin(), E = Tracked.end(); I != E; ++I) { - SymbolRef Sym = I->first; + SymExprRef Sym = I->first; if (SymReaper.isDead(Sym)) { State = State->remove(Sym); State = State->remove(Sym); Index: clang/lib/StaticAnalyzer/Checkers/BlockInCriticalSectionChecker.cpp =================================================================== --- clang/lib/StaticAnalyzer/Checkers/BlockInCriticalSectionChecker.cpp +++ clang/lib/StaticAnalyzer/Checkers/BlockInCriticalSectionChecker.cpp @@ -41,8 +41,7 @@ void initIdentifierInfo(ASTContext &Ctx) const; - void reportBlockInCritSection(SymbolRef FileDescSym, - const CallEvent &call, + void reportBlockInCritSection(SymExprRef FileDescSym, const CallEvent &call, CheckerContext &C) const; public: @@ -158,13 +157,13 @@ State = State->set(++mutexCount); C.addTransition(State); } else if (mutexCount > 0) { - SymbolRef BlockDesc = Call.getReturnValue().getAsSymbol(); + SymExprRef BlockDesc = Call.getReturnValue().getAsSymbol(); reportBlockInCritSection(BlockDesc, Call, C); } } void BlockInCriticalSectionChecker::reportBlockInCritSection( - SymbolRef BlockDescSym, const CallEvent &Call, CheckerContext &C) const { + SymExprRef BlockDescSym, const CallEvent &Call, CheckerContext &C) const { ExplodedNode *ErrNode = C.generateNonFatalErrorNode(); if (!ErrNode) return; Index: clang/lib/StaticAnalyzer/Checkers/CStringChecker.cpp =================================================================== --- clang/lib/StaticAnalyzer/Checkers/CStringChecker.cpp +++ clang/lib/StaticAnalyzer/Checkers/CStringChecker.cpp @@ -2429,7 +2429,7 @@ for (CStringLengthTy::iterator I = Entries.begin(), E = Entries.end(); I != E; ++I) { SVal Len = I.getData(); - if (SymbolRef Sym = Len.getAsSymbol()) { + if (SymExprRef Sym = Len.getAsSymbol()) { if (SR.isDead(Sym)) Entries = F.remove(Entries, I.getKey()); } Index: clang/lib/StaticAnalyzer/Checkers/CheckObjCDealloc.cpp =================================================================== --- clang/lib/StaticAnalyzer/Checkers/CheckObjCDealloc.cpp +++ clang/lib/StaticAnalyzer/Checkers/CheckObjCDealloc.cpp @@ -130,21 +130,21 @@ private: void diagnoseMissingReleases(CheckerContext &C) const; - bool diagnoseExtraRelease(SymbolRef ReleasedValue, const ObjCMethodCall &M, + bool diagnoseExtraRelease(SymExprRef ReleasedValue, const ObjCMethodCall &M, CheckerContext &C) const; - bool diagnoseMistakenDealloc(SymbolRef DeallocedValue, + bool diagnoseMistakenDealloc(SymExprRef DeallocedValue, const ObjCMethodCall &M, CheckerContext &C) const; - SymbolRef getValueReleasedByNillingOut(const ObjCMethodCall &M, - CheckerContext &C) const; + SymExprRef getValueReleasedByNillingOut(const ObjCMethodCall &M, + CheckerContext &C) const; - const ObjCIvarRegion *getIvarRegionForIvarSymbol(SymbolRef IvarSym) const; - SymbolRef getInstanceSymbolFromIvarSymbol(SymbolRef IvarSym) const; + const ObjCIvarRegion *getIvarRegionForIvarSymbol(SymExprRef IvarSym) const; + SymExprRef getInstanceSymbolFromIvarSymbol(SymExprRef IvarSym) const; - const ObjCPropertyImplDecl* - findPropertyOnDeallocatingInstance(SymbolRef IvarSym, + const ObjCPropertyImplDecl * + findPropertyOnDeallocatingInstance(SymExprRef IvarSym, CheckerContext &C) const; ReleaseRequirement @@ -163,10 +163,10 @@ const ObjCPropertyDecl * findShadowedPropertyDecl(const ObjCPropertyImplDecl *PropImpl) const; - void transitionToReleaseValue(CheckerContext &C, SymbolRef Value) const; + void transitionToReleaseValue(CheckerContext &C, SymExprRef Value) const; ProgramStateRef removeValueRequiringRelease(ProgramStateRef State, - SymbolRef InstanceSym, - SymbolRef ValueSym) const; + SymExprRef InstanceSym, + SymExprRef ValueSym) const; void initIdentifierInfoAndSelectors(ASTContext &Ctx) const; @@ -180,9 +180,8 @@ /// Maps from the symbol for a class instance to the set of /// symbols remaining that must be released in -dealloc. -REGISTER_SET_FACTORY_WITH_PROGRAMSTATE(SymbolSet, SymbolRef) -REGISTER_MAP_WITH_PROGRAMSTATE(UnreleasedIvarMap, SymbolRef, SymbolSet) - +REGISTER_SET_FACTORY_WITH_PROGRAMSTATE(SymbolSet, SymExprRef) +REGISTER_MAP_WITH_PROGRAMSTATE(UnreleasedIvarMap, SymExprRef, SymbolSet) /// An AST check that diagnose when the class requires a -dealloc method and /// is missing one. @@ -259,7 +258,7 @@ if (!isInInstanceDealloc(C, SelfVal)) return; - SymbolRef SelfSymbol = SelfVal.getAsSymbol(); + SymExprRef SelfSymbol = SelfVal.getAsSymbol(); const LocationContext *LCtx = C.getLocationContext(); ProgramStateRef InitialState = C.getState(); @@ -287,7 +286,7 @@ continue; SVal InitialVal = State->getSVal(LValLoc.getValue()); - SymbolRef Symbol = InitialVal.getAsSymbol(); + SymExprRef Symbol = InitialVal.getAsSymbol(); if (!Symbol || !isa(Symbol)) continue; @@ -307,14 +306,14 @@ /// Given a symbol for an ivar, return the ivar region it was loaded from. /// Returns nullptr if the instance symbol cannot be found. const ObjCIvarRegion * -ObjCDeallocChecker::getIvarRegionForIvarSymbol(SymbolRef IvarSym) const { +ObjCDeallocChecker::getIvarRegionForIvarSymbol(SymExprRef IvarSym) const { return dyn_cast_or_null(IvarSym->getOriginRegion()); } /// Given a symbol for an ivar, return a symbol for the instance containing /// the ivar. Returns nullptr if the instance symbol cannot be found. -SymbolRef -ObjCDeallocChecker::getInstanceSymbolFromIvarSymbol(SymbolRef IvarSym) const { +SymExprRef +ObjCDeallocChecker::getInstanceSymbolFromIvarSymbol(SymExprRef IvarSym) const { const ObjCIvarRegion *IvarRegion = getIvarRegionForIvarSymbol(IvarSym); if (!IvarRegion) @@ -332,7 +331,7 @@ if (!instanceDeallocIsOnStack(C, DeallocedInstance)) return; - SymbolRef ReleasedValue = nullptr; + SymExprRef ReleasedValue = nullptr; if (M.getSelector() == ReleaseSel) { ReleasedValue = M.getReceiverSVal().getAsSymbol(); @@ -369,7 +368,7 @@ if (Call.getNumArgs() != 1) return; - SymbolRef ReleasedValue = Call.getArgSVal(0).getAsSymbol(); + SymExprRef ReleasedValue = Call.getArgSVal(0).getAsSymbol(); if (!ReleasedValue) return; @@ -419,7 +418,7 @@ return State; } - SymbolRef NullSymbol = nullptr; + SymExprRef NullSymbol = nullptr; if (auto *SIE = dyn_cast(CondBSE)) { const llvm::APInt &RHS = SIE->getRHS(); if (RHS != 0) @@ -434,7 +433,7 @@ return State; } - SymbolRef InstanceSymbol = getInstanceSymbolFromIvarSymbol(NullSymbol); + SymExprRef InstanceSymbol = getInstanceSymbolFromIvarSymbol(NullSymbol); if (!InstanceSymbol) return State; @@ -471,8 +470,7 @@ State = State->remove(Sym); } - - SymbolRef InstanceSymbol = getInstanceSymbolFromIvarSymbol(Sym); + SymExprRef InstanceSymbol = getInstanceSymbolFromIvarSymbol(Sym); if (!InstanceSymbol) continue; @@ -496,7 +494,7 @@ ExplodedNode *ErrNode = nullptr; - SymbolRef SelfSym = SelfVal.getAsSymbol(); + SymExprRef SelfSym = SelfVal.getAsSymbol(); if (!SelfSym) return; @@ -604,7 +602,7 @@ /// ivar, if one exists. Otherwise return null. const ObjCPropertyImplDecl * ObjCDeallocChecker::findPropertyOnDeallocatingInstance( - SymbolRef IvarSym, CheckerContext &C) const { + SymExprRef IvarSym, CheckerContext &C) const { SVal DeallocedInstance; if (!isInInstanceDealloc(C, DeallocedInstance)) return nullptr; @@ -632,7 +630,7 @@ /// Emits a warning if the current context is -dealloc and ReleasedValue /// must not be directly released in a -dealloc. Returns true if a diagnostic /// was emitted. -bool ObjCDeallocChecker::diagnoseExtraRelease(SymbolRef ReleasedValue, +bool ObjCDeallocChecker::diagnoseExtraRelease(SymExprRef ReleasedValue, const ObjCMethodCall &M, CheckerContext &C) const { // Try to get the region from which the released value was loaded. @@ -710,7 +708,7 @@ /// Emits a warning if the current context is -dealloc and DeallocedValue /// must not be directly dealloced in a -dealloc. Returns true if a diagnostic /// was emitted. -bool ObjCDeallocChecker::diagnoseMistakenDealloc(SymbolRef DeallocedValue, +bool ObjCDeallocChecker::diagnoseMistakenDealloc(SymExprRef DeallocedValue, const ObjCMethodCall &M, CheckerContext &C) const { // TODO: Apart from unknown/undefined receivers, this may happen when @@ -833,9 +831,9 @@ /// Add a transition noting the release of the given value. void ObjCDeallocChecker::transitionToReleaseValue(CheckerContext &C, - SymbolRef Value) const { + SymExprRef Value) const { assert(Value); - SymbolRef InstanceSym = getInstanceSymbolFromIvarSymbol(Value); + SymExprRef InstanceSym = getInstanceSymbolFromIvarSymbol(Value); if (!InstanceSym) return; ProgramStateRef InitialState = C.getState(); @@ -851,7 +849,7 @@ /// Remove the Value requiring a release from the tracked set for /// Instance and return the resultant state. ProgramStateRef ObjCDeallocChecker::removeValueRequiringRelease( - ProgramStateRef State, SymbolRef Instance, SymbolRef Value) const { + ProgramStateRef State, SymExprRef Instance, SymExprRef Value) const { assert(Instance); assert(Value); const ObjCIvarRegion *RemovedRegion = getIvarRegionForIvarSymbol(Value); @@ -921,7 +919,7 @@ /// Returns the released value if M is a call a setter that releases /// and nils out its underlying instance variable. -SymbolRef +SymExprRef ObjCDeallocChecker::getValueReleasedByNillingOut(const ObjCMethodCall &M, CheckerContext &C) const { SVal ReceiverVal = M.getReceiverSVal(); Index: clang/lib/StaticAnalyzer/Checkers/ContainerModeling.cpp =================================================================== --- clang/lib/StaticAnalyzer/Checkers/ContainerModeling.cpp +++ clang/lib/StaticAnalyzer/Checkers/ContainerModeling.cpp @@ -114,8 +114,8 @@ bool hasSubscriptOperator(ProgramStateRef State, const MemRegion *Reg); bool frontModifiable(ProgramStateRef State, const MemRegion *Reg); bool backModifiable(ProgramStateRef State, const MemRegion *Reg); -SymbolRef getContainerBegin(ProgramStateRef State, const MemRegion *Cont); -SymbolRef getContainerEnd(ProgramStateRef State, const MemRegion *Cont); +SymExprRef getContainerBegin(ProgramStateRef State, const MemRegion *Cont); +SymExprRef getContainerEnd(ProgramStateRef State, const MemRegion *Cont); ProgramStateRef createContainerBegin(ProgramStateRef State, const MemRegion *Cont, const Expr *E, QualType T, const LocationContext *LCtx, @@ -130,15 +130,15 @@ const MemRegion *Cont); ProgramStateRef invalidateAllIteratorPositionsExcept(ProgramStateRef State, - const MemRegion *Cont, SymbolRef Offset, + const MemRegion *Cont, SymExprRef Offset, BinaryOperator::Opcode Opc); ProgramStateRef invalidateIteratorPositions(ProgramStateRef State, - SymbolRef Offset, + SymExprRef Offset, BinaryOperator::Opcode Opc); ProgramStateRef invalidateIteratorPositions(ProgramStateRef State, - SymbolRef Offset1, + SymExprRef Offset1, BinaryOperator::Opcode Opc1, - SymbolRef Offset2, + SymExprRef Offset2, BinaryOperator::Opcode Opc2); ProgramStateRef reassignAllIteratorPositions(ProgramStateRef State, const MemRegion *Cont, @@ -146,13 +146,13 @@ ProgramStateRef reassignAllIteratorPositionsUnless(ProgramStateRef State, const MemRegion *Cont, const MemRegion *NewCont, - SymbolRef Offset, + SymExprRef Offset, BinaryOperator::Opcode Opc); ProgramStateRef rebaseSymbolInIteratorPositionsIf( - ProgramStateRef State, SValBuilder &SVB, SymbolRef OldSym, - SymbolRef NewSym, SymbolRef CondSym, BinaryOperator::Opcode Opc); -SymbolRef rebaseSymbol(ProgramStateRef State, SValBuilder &SVB, SymbolRef Expr, - SymbolRef OldSym, SymbolRef NewSym); + ProgramStateRef State, SValBuilder &SVB, SymExprRef OldSym, + SymExprRef NewSym, SymExprRef CondSym, BinaryOperator::Opcode Opc); +SymExprRef rebaseSymbol(ProgramStateRef State, SValBuilder &SVB, + SymExprRef Expr, SymExprRef OldSym, SymExprRef NewSym); bool hasLiveIterators(ProgramStateRef State, const MemRegion *Cont); } // namespace @@ -833,7 +833,7 @@ return false; } -SymbolRef getContainerBegin(ProgramStateRef State, const MemRegion *Cont) { +SymExprRef getContainerBegin(ProgramStateRef State, const MemRegion *Cont) { const auto *CDataPtr = getContainerData(State, Cont); if (!CDataPtr) return nullptr; @@ -841,7 +841,7 @@ return CDataPtr->getBegin(); } -SymbolRef getContainerEnd(ProgramStateRef State, const MemRegion *Cont) { +SymExprRef getContainerEnd(ProgramStateRef State, const MemRegion *Cont) { const auto *CDataPtr = getContainerData(State, Cont); if (!CDataPtr) return nullptr; @@ -945,7 +945,7 @@ ProgramStateRef invalidateAllIteratorPositionsExcept(ProgramStateRef State, - const MemRegion *Cont, SymbolRef Offset, + const MemRegion *Cont, SymExprRef Offset, BinaryOperator::Opcode Opc) { auto MatchContAndCompare = [&](const IteratorPosition &Pos) { return Pos.getContainer() == Cont && @@ -958,7 +958,7 @@ } ProgramStateRef invalidateIteratorPositions(ProgramStateRef State, - SymbolRef Offset, + SymExprRef Offset, BinaryOperator::Opcode Opc) { auto Compare = [&](const IteratorPosition &Pos) { return compare(State, Pos.getOffset(), Offset, Opc); @@ -970,9 +970,9 @@ } ProgramStateRef invalidateIteratorPositions(ProgramStateRef State, - SymbolRef Offset1, + SymExprRef Offset1, BinaryOperator::Opcode Opc1, - SymbolRef Offset2, + SymExprRef Offset2, BinaryOperator::Opcode Opc2) { auto Compare = [&](const IteratorPosition &Pos) { return compare(State, Pos.getOffset(), Offset1, Opc1) && @@ -999,7 +999,7 @@ ProgramStateRef reassignAllIteratorPositionsUnless(ProgramStateRef State, const MemRegion *Cont, const MemRegion *NewCont, - SymbolRef Offset, + SymExprRef Offset, BinaryOperator::Opcode Opc) { auto MatchContAndCompare = [&](const IteratorPosition &Pos) { return Pos.getContainer() == Cont && @@ -1015,8 +1015,8 @@ // `OldSym - Int` to `NewSym - Int` and `OldSym` to `NewSym` in any iterator // position offsets where `CondSym` is true. ProgramStateRef rebaseSymbolInIteratorPositionsIf( - ProgramStateRef State, SValBuilder &SVB, SymbolRef OldSym, - SymbolRef NewSym, SymbolRef CondSym, BinaryOperator::Opcode Opc) { + ProgramStateRef State, SValBuilder &SVB, SymExprRef OldSym, + SymExprRef NewSym, SymExprRef CondSym, BinaryOperator::Opcode Opc) { auto LessThanEnd = [&](const IteratorPosition &Pos) { return compare(State, Pos.getOffset(), CondSym, Opc); }; @@ -1030,9 +1030,9 @@ // This function rebases symbolic expression `OldExpr + Int` to `NewExpr + Int`, // `OldExpr - Int` to `NewExpr - Int` and `OldExpr` to `NewExpr` in expression // `OrigExpr`. -SymbolRef rebaseSymbol(ProgramStateRef State, SValBuilder &SVB, - SymbolRef OrigExpr, SymbolRef OldExpr, - SymbolRef NewSym) { +SymExprRef rebaseSymbol(ProgramStateRef State, SValBuilder &SVB, + SymExprRef OrigExpr, SymExprRef OldExpr, + SymExprRef NewSym) { auto &SymMgr = SVB.getSymbolManager(); auto Diff = SVB.evalBinOpNN(State, BO_Sub, nonloc::SymbolVal(OrigExpr), nonloc::SymbolVal(OldExpr), Index: clang/lib/StaticAnalyzer/Checkers/DebugContainerModeling.cpp =================================================================== --- clang/lib/StaticAnalyzer/Checkers/DebugContainerModeling.cpp +++ clang/lib/StaticAnalyzer/Checkers/DebugContainerModeling.cpp @@ -88,7 +88,7 @@ if (Cont) { const auto *Data = getContainerData(State, Cont); if (Data) { - SymbolRef Field = get(Data); + SymExprRef Field = get(Data); if (Field) { State = State->BindExpr(CE, C.getLocationContext(), nonloc::SymbolVal(Field)); Index: clang/lib/StaticAnalyzer/Checkers/DynamicTypePropagation.cpp =================================================================== --- clang/lib/StaticAnalyzer/Checkers/DynamicTypePropagation.cpp +++ clang/lib/StaticAnalyzer/Checkers/DynamicTypePropagation.cpp @@ -43,7 +43,7 @@ // TODO: In some case the type stored in this map is exactly the same that is // stored in DynamicTypeMap. We should no store duplicated information in those // cases. -REGISTER_MAP_WITH_PROGRAMSTATE(MostSpecializedTypeArgsMap, SymbolRef, +REGISTER_MAP_WITH_PROGRAMSTATE(MostSpecializedTypeArgsMap, SymExprRef, const ObjCObjectPointerType *) namespace { @@ -76,7 +76,7 @@ class GenericsBugVisitor : public BugReporterVisitor { public: - GenericsBugVisitor(SymbolRef S) : Sym(S) {} + GenericsBugVisitor(SymExprRef S) : Sym(S) {} void Profile(llvm::FoldingSetNodeID &ID) const override { static int X = 0; @@ -90,12 +90,12 @@ private: // The tracked symbol. - SymbolRef Sym; + SymExprRef Sym; }; void reportGenericsBug(const ObjCObjectPointerType *From, const ObjCObjectPointerType *To, ExplodedNode *N, - SymbolRef Sym, CheckerContext &C, + SymExprRef Sym, CheckerContext &C, const Stmt *ReportedNode = nullptr) const; public: @@ -179,7 +179,7 @@ } } - if (SymbolRef ReceiverSymbol = ReceiverSVal.getAsSymbol()) { + if (SymExprRef ReceiverSymbol = ReceiverSVal.getAsSymbol()) { if (InferredType.isNull()) { InferredType = ReceiverSymbol->getType(); } @@ -538,7 +538,7 @@ /// lower bound must be specialized. If the result differs from \p Current or /// \p Current is null, store the result. static bool -storeWhenMoreInformative(ProgramStateRef &State, SymbolRef Sym, +storeWhenMoreInformative(ProgramStateRef &State, SymExprRef Sym, const ObjCObjectPointerType *const *Current, const ObjCObjectPointerType *StaticLowerBound, const ObjCObjectPointerType *StaticUpperBound, @@ -641,7 +641,7 @@ DestObjectPtrType->isUnspecialized()) return; - SymbolRef Sym = C.getSVal(CE).getAsSymbol(); + SymExprRef Sym = C.getSVal(CE).getAsSymbol(); if (!Sym) return; @@ -797,7 +797,7 @@ void DynamicTypePropagation::checkPreObjCMessage(const ObjCMethodCall &M, CheckerContext &C) const { ProgramStateRef State = C.getState(); - SymbolRef Sym = M.getReceiverSVal().getAsSymbol(); + SymExprRef Sym = M.getReceiverSVal().getAsSymbol(); if (!Sym) return; @@ -876,7 +876,7 @@ // Check if we have more concrete tracked type that is not a super type of // the static argument type. SVal ArgSVal = M.getArgSVal(i); - SymbolRef ArgSym = ArgSVal.getAsSymbol(); + SymExprRef ArgSym = ArgSVal.getAsSymbol(); if (ArgSym) { const ObjCObjectPointerType *const *TrackedArgType = State->get(ArgSym); @@ -908,7 +908,7 @@ CheckerContext &C) const { const ObjCMessageExpr *MessageExpr = M.getOriginExpr(); - SymbolRef RetSym = M.getReturnValue().getAsSymbol(); + SymExprRef RetSym = M.getReturnValue().getAsSymbol(); if (!RetSym) return; @@ -967,7 +967,7 @@ } // Tracking for return types. - SymbolRef RecSym = M.getReceiverSVal().getAsSymbol(); + SymExprRef RecSym = M.getReceiverSVal().getAsSymbol(); if (!RecSym) return; @@ -1022,7 +1022,7 @@ void DynamicTypePropagation::reportGenericsBug( const ObjCObjectPointerType *From, const ObjCObjectPointerType *To, - ExplodedNode *N, SymbolRef Sym, CheckerContext &C, + ExplodedNode *N, SymExprRef Sym, CheckerContext &C, const Stmt *ReportedNode) const { if (!CheckGenerics) return; Index: clang/lib/StaticAnalyzer/Checkers/ExprInspectionChecker.cpp =================================================================== --- clang/lib/StaticAnalyzer/Checkers/ExprInspectionChecker.cpp +++ clang/lib/StaticAnalyzer/Checkers/ExprInspectionChecker.cpp @@ -67,8 +67,9 @@ }; } -REGISTER_SET_WITH_PROGRAMSTATE(MarkedSymbols, SymbolRef) -REGISTER_MAP_WITH_PROGRAMSTATE(DenotedSymbols, SymbolRef, const StringLiteral *) +REGISTER_SET_WITH_PROGRAMSTATE(MarkedSymbols, SymExprRef) +REGISTER_MAP_WITH_PROGRAMSTATE(DenotedSymbols, SymExprRef, + const StringLiteral *) bool ExprInspectionChecker::evalCall(const CallEvent &Call, CheckerContext &C) const { @@ -270,7 +271,7 @@ if (CE->getNumArgs() == 0) return; SVal Val = C.getSVal(CE->getArg(0)); - SymbolRef Sym = Val.getAsSymbol(); + SymExprRef Sym = Val.getAsSymbol(); if (!Sym) return; @@ -285,7 +286,7 @@ const MarkedSymbolsTy &Syms = State->get(); ExplodedNode *N = C.getPredecessor(); for (auto I = Syms.begin(), E = Syms.end(); I != E; ++I) { - SymbolRef Sym = *I; + SymExprRef Sym = *I; if (!SymReaper.isDead(Sym)) continue; @@ -296,7 +297,7 @@ } for (auto I : State->get()) { - SymbolRef Sym = I.first; + SymExprRef Sym = I.first; if (!SymReaper.isLive(Sym)) State = State->remove(Sym); } @@ -340,7 +341,7 @@ return; } - SymbolRef Sym = C.getSVal(CE->getArg(0)).getAsSymbol(); + SymExprRef Sym = C.getSVal(CE->getArg(0)).getAsSymbol(); if (!Sym) { reportBug("Not a symbol", C); return; @@ -416,7 +417,7 @@ } SVal ArgVal = C.getSVal(CE->getArg(0)); - SymbolRef Sym = ArgVal.getAsSymbol(); + SymExprRef Sym = ArgVal.getAsSymbol(); if (!Sym) { reportBug("Not a symbol", C); return; Index: clang/lib/StaticAnalyzer/Checkers/FuchsiaHandleChecker.cpp =================================================================== --- clang/lib/StaticAnalyzer/Checkers/FuchsiaHandleChecker.cpp +++ clang/lib/StaticAnalyzer/Checkers/FuchsiaHandleChecker.cpp @@ -103,8 +103,8 @@ class HandleState { private: enum class Kind { MaybeAllocated, Allocated, Released, Escaped } K; - SymbolRef ErrorSym; - HandleState(Kind K, SymbolRef ErrorSym) : K(K), ErrorSym(ErrorSym) {} + SymExprRef ErrorSym; + HandleState(Kind K, SymExprRef ErrorSym) : K(K), ErrorSym(ErrorSym) {} public: bool operator==(const HandleState &Other) const { @@ -115,7 +115,7 @@ bool isReleased() const { return K == Kind::Released; } bool isEscaped() const { return K == Kind::Escaped; } - static HandleState getMaybeAllocated(SymbolRef ErrorSym) { + static HandleState getMaybeAllocated(SymExprRef ErrorSym) { return HandleState(Kind::MaybeAllocated, ErrorSym); } static HandleState getAllocated(ProgramStateRef State, HandleState S) { @@ -132,7 +132,7 @@ return HandleState(Kind::Escaped, nullptr); } - SymbolRef getErrorSym() const { return ErrorSym; } + SymExprRef getErrorSym() const { return ErrorSym; } void Profile(llvm::FoldingSetNodeID &ID) const { ID.AddInteger(static_cast(K)); @@ -184,16 +184,16 @@ const CallEvent *Call, PointerEscapeKind Kind) const; - ExplodedNode *reportLeaks(ArrayRef LeakedHandles, + ExplodedNode *reportLeaks(ArrayRef LeakedHandles, CheckerContext &C, ExplodedNode *Pred) const; - void reportDoubleRelease(SymbolRef HandleSym, const SourceRange &Range, + void reportDoubleRelease(SymExprRef HandleSym, const SourceRange &Range, CheckerContext &C) const; - void reportUseAfterFree(SymbolRef HandleSym, const SourceRange &Range, + void reportUseAfterFree(SymExprRef HandleSym, const SourceRange &Range, CheckerContext &C) const; - void reportBug(SymbolRef Sym, ExplodedNode *ErrorNode, CheckerContext &C, + void reportBug(SymExprRef Sym, ExplodedNode *ErrorNode, CheckerContext &C, const SourceRange *Range, const BugType &Type, StringRef Msg) const; @@ -202,9 +202,9 @@ }; } // end anonymous namespace -REGISTER_MAP_WITH_PROGRAMSTATE(HStateMap, SymbolRef, HandleState) +REGISTER_MAP_WITH_PROGRAMSTATE(HStateMap, SymExprRef, HandleState) -static const ExplodedNode *getAcquireSite(const ExplodedNode *N, SymbolRef Sym, +static const ExplodedNode *getAcquireSite(const ExplodedNode *N, SymExprRef Sym, CheckerContext &Ctx) { ProgramStateRef State = N->getState(); // When bug type is handle leak, exploded node N does not have state info for @@ -228,8 +228,8 @@ /// Returns the symbols extracted from the argument or null if it cannot be /// found. -static SymbolRef getFuchsiaHandleSymbol(QualType QT, SVal Arg, - ProgramStateRef State) { +static SymExprRef getFuchsiaHandleSymbol(QualType QT, SVal Arg, + ProgramStateRef State) { int PtrToHandleLevel = 0; while (QT->isAnyPointerType() || QT->isReferenceType()) { ++PtrToHandleLevel; @@ -262,7 +262,7 @@ // Unknown call, escape by value handles. They are not covered by // PointerEscape callback. for (unsigned Arg = 0; Arg < Call.getNumArgs(); ++Arg) { - if (SymbolRef Handle = Call.getArgSVal(Arg).getAsSymbol()) + if (SymExprRef Handle = Call.getArgSVal(Arg).getAsSymbol()) State = State->set(Handle, HandleState::getEscaped()); } C.addTransition(State); @@ -273,7 +273,7 @@ if (Arg >= FuncDecl->getNumParams()) break; const ParmVarDecl *PVD = FuncDecl->getParamDecl(Arg); - SymbolRef Handle = + SymExprRef Handle = getFuchsiaHandleSymbol(PVD->getType(), Call.getArgSVal(Arg), State); if (!Handle) continue; @@ -311,14 +311,14 @@ ProgramStateRef State = C.getState(); std::vector> Notes; - SymbolRef ResultSymbol = nullptr; + SymExprRef ResultSymbol = nullptr; if (const auto *TypeDefTy = FuncDecl->getReturnType()->getAs()) if (TypeDefTy->getDecl()->getName() == ErrorTypeName) ResultSymbol = Call.getReturnValue().getAsSymbol(); // Function returns an open handle. if (hasFuchsiaAttr(FuncDecl)) { - SymbolRef RetSym = Call.getReturnValue().getAsSymbol(); + SymExprRef RetSym = Call.getReturnValue().getAsSymbol(); Notes.push_back([RetSym, FuncDecl](BugReport &BR) -> std::string { auto *PathBR = static_cast(&BR); if (auto IsInteresting = PathBR->getInterestingnessKind(RetSym)) { @@ -339,7 +339,7 @@ break; const ParmVarDecl *PVD = FuncDecl->getParamDecl(Arg); unsigned ParamDiagIdx = PVD->getFunctionScopeIndex() + 1; - SymbolRef Handle = + SymExprRef Handle = getFuchsiaHandleSymbol(PVD->getType(), Call.getArgSVal(Arg), State); if (!Handle) continue; @@ -403,10 +403,10 @@ void FuchsiaHandleChecker::checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const { ProgramStateRef State = C.getState(); - SmallVector LeakedSyms; + SmallVector LeakedSyms; HStateMapTy TrackedHandles = State->get(); for (auto &CurItem : TrackedHandles) { - SymbolRef ErrorSym = CurItem.second.getErrorSym(); + SymExprRef ErrorSym = CurItem.second.getErrorSym(); // Keeping zombie handle symbols. In case the error symbol is dying later // than the handle symbol we might produce spurious leak warnings (in case // we find out later from the status code that the handle allocation failed @@ -448,7 +448,7 @@ // The handle is invalid. We can no longer follow the symbol on this path. State = State->remove(CurItem.first); } - SymbolRef ErrorSym = CurItem.second.getErrorSym(); + SymExprRef ErrorSym = CurItem.second.getErrorSym(); if (!ErrorSym) continue; ConditionTruthVal ErrorVal = Cmr.isNull(State, ErrorSym); @@ -472,7 +472,7 @@ const FunctionDecl *FuncDecl = Call ? dyn_cast_or_null(Call->getDecl()) : nullptr; - llvm::DenseSet UnEscaped; + llvm::DenseSet UnEscaped; // Not all calls should escape our symbols. if (FuncDecl && (Kind == PSK_DirectEscapeOnCall || Kind == PSK_IndirectEscapeOnCall || @@ -481,7 +481,7 @@ if (Arg >= FuncDecl->getNumParams()) break; const ParmVarDecl *PVD = FuncDecl->getParamDecl(Arg); - SymbolRef Handle = + SymExprRef Handle = getFuchsiaHandleSymbol(PVD->getType(), Call->getArgSVal(Arg), State); if (!Handle) continue; @@ -507,17 +507,17 @@ } ExplodedNode * -FuchsiaHandleChecker::reportLeaks(ArrayRef LeakedHandles, +FuchsiaHandleChecker::reportLeaks(ArrayRef LeakedHandles, CheckerContext &C, ExplodedNode *Pred) const { ExplodedNode *ErrNode = C.generateNonFatalErrorNode(C.getState(), Pred); - for (SymbolRef LeakedHandle : LeakedHandles) { + for (SymExprRef LeakedHandle : LeakedHandles) { reportBug(LeakedHandle, ErrNode, C, nullptr, LeakBugType, "Potential leak of handle"); } return ErrNode; } -void FuchsiaHandleChecker::reportDoubleRelease(SymbolRef HandleSym, +void FuchsiaHandleChecker::reportDoubleRelease(SymExprRef HandleSym, const SourceRange &Range, CheckerContext &C) const { ExplodedNode *ErrNode = C.generateErrorNode(C.getState()); @@ -525,7 +525,7 @@ "Releasing a previously released handle"); } -void FuchsiaHandleChecker::reportUseAfterFree(SymbolRef HandleSym, +void FuchsiaHandleChecker::reportUseAfterFree(SymExprRef HandleSym, const SourceRange &Range, CheckerContext &C) const { ExplodedNode *ErrNode = C.generateErrorNode(C.getState()); @@ -533,7 +533,7 @@ "Using a previously released handle"); } -void FuchsiaHandleChecker::reportBug(SymbolRef Sym, ExplodedNode *ErrorNode, +void FuchsiaHandleChecker::reportBug(SymExprRef Sym, ExplodedNode *ErrorNode, CheckerContext &C, const SourceRange *Range, const BugType &Type, StringRef Msg) const { Index: clang/lib/StaticAnalyzer/Checkers/InnerPointerChecker.cpp =================================================================== --- clang/lib/StaticAnalyzer/Checkers/InnerPointerChecker.cpp +++ clang/lib/StaticAnalyzer/Checkers/InnerPointerChecker.cpp @@ -25,7 +25,7 @@ using namespace ento; // Associate container objects with a set of raw pointer symbols. -REGISTER_SET_FACTORY_WITH_PROGRAMSTATE(PtrSet, SymbolRef) +REGISTER_SET_FACTORY_WITH_PROGRAMSTATE(PtrSet, SymExprRef) REGISTER_MAP_WITH_PROGRAMSTATE(RawPtrMap, const MemRegion *, PtrSet) @@ -40,10 +40,10 @@ public: class InnerPointerBRVisitor : public BugReporterVisitor { - SymbolRef PtrToBuf; + SymExprRef PtrToBuf; public: - InnerPointerBRVisitor(SymbolRef Sym) : PtrToBuf(Sym) {} + InnerPointerBRVisitor(SymExprRef Sym) : PtrToBuf(Sym) {} static void *getTag() { static int Tag = 0; @@ -60,7 +60,7 @@ // FIXME: Scan the map once in the visitor's constructor and do a direct // lookup by region. - bool isSymbolTracked(ProgramStateRef State, SymbolRef Sym) { + bool isSymbolTracked(ProgramStateRef State, SymExprRef Sym) { RawPtrMapTy Map = State->get(); for (const auto &Entry : Map) { if (Entry.second.contains(Sym)) @@ -204,7 +204,7 @@ if (Call.isCalled(CStrFn) || Call.isCalled(DataFn)) { SVal RawPtr = Call.getReturnValue(); - if (SymbolRef Sym = RawPtr.getAsSymbol(/*IncludeBaseRegions=*/true)) { + if (SymExprRef Sym = RawPtr.getAsSymbol(/*IncludeBaseRegions=*/true)) { // Start tracking this raw pointer by adding it to the set of symbols // associated with this container object in the program state map. @@ -260,11 +260,11 @@ namespace ento { namespace allocation_state { -std::unique_ptr getInnerPointerBRVisitor(SymbolRef Sym) { +std::unique_ptr getInnerPointerBRVisitor(SymExprRef Sym) { return std::make_unique(Sym); } -const MemRegion *getContainerObjRegion(ProgramStateRef State, SymbolRef Sym) { +const MemRegion *getContainerObjRegion(ProgramStateRef State, SymExprRef Sym) { RawPtrMapTy Map = State->get(); for (const auto &Entry : Map) { if (Entry.second.contains(Sym)) { Index: clang/lib/StaticAnalyzer/Checkers/Iterator.h =================================================================== --- clang/lib/StaticAnalyzer/Checkers/Iterator.h +++ clang/lib/StaticAnalyzer/Checkers/Iterator.h @@ -33,25 +33,25 @@ const bool Valid; // Abstract offset - const SymbolRef Offset; + const SymExprRef Offset; - IteratorPosition(const MemRegion *C, bool V, SymbolRef Of) + IteratorPosition(const MemRegion *C, bool V, SymExprRef Of) : Cont(C), Valid(V), Offset(Of) {} public: const MemRegion *getContainer() const { return Cont; } bool isValid() const { return Valid; } - SymbolRef getOffset() const { return Offset; } + SymExprRef getOffset() const { return Offset; } IteratorPosition invalidate() const { return IteratorPosition(Cont, false, Offset); } - static IteratorPosition getPosition(const MemRegion *C, SymbolRef Of) { + static IteratorPosition getPosition(const MemRegion *C, SymExprRef Of) { return IteratorPosition(C, true, Of); } - IteratorPosition setTo(SymbolRef NewOf) const { + IteratorPosition setTo(SymExprRef NewOf) const { return IteratorPosition(Cont, Valid, NewOf); } @@ -77,25 +77,25 @@ // Structure to record the symbolic begin and end position of a container struct ContainerData { private: - const SymbolRef Begin, End; + const SymExprRef Begin, End; - ContainerData(SymbolRef B, SymbolRef E) : Begin(B), End(E) {} + ContainerData(SymExprRef B, SymExprRef E) : Begin(B), End(E) {} public: - static ContainerData fromBegin(SymbolRef B) { + static ContainerData fromBegin(SymExprRef B) { return ContainerData(B, nullptr); } - static ContainerData fromEnd(SymbolRef E) { + static ContainerData fromEnd(SymExprRef E) { return ContainerData(nullptr, E); } - SymbolRef getBegin() const { return Begin; } - SymbolRef getEnd() const { return End; } + SymExprRef getBegin() const { return Begin; } + SymExprRef getEnd() const { return End; } - ContainerData newBegin(SymbolRef B) const { return ContainerData(B, End); } + ContainerData newBegin(SymExprRef B) const { return ContainerData(B, End); } - ContainerData newEnd(SymbolRef E) const { return ContainerData(Begin, E); } + ContainerData newEnd(SymExprRef E) const { return ContainerData(Begin, E); } bool operator==(const ContainerData &X) const { return Begin == X.Begin && End == X.End; @@ -115,8 +115,8 @@ class IteratorRegionMap {}; class ContainerMap {}; -using IteratorSymbolMapTy = - CLANG_ENTO_PROGRAMSTATE_MAP(SymbolRef, IteratorPosition); +using IteratorSymbolMapTy = CLANG_ENTO_PROGRAMSTATE_MAP(SymExprRef, + IteratorPosition); using IteratorRegionMapTy = CLANG_ENTO_PROGRAMSTATE_MAP(const MemRegion *, IteratorPosition); using ContainerMapTy = @@ -177,9 +177,9 @@ const SVal &Iter, OverloadedOperatorKind Op, const SVal &Distance); -ProgramStateRef assumeNoOverflow(ProgramStateRef State, SymbolRef Sym, +ProgramStateRef assumeNoOverflow(ProgramStateRef State, SymExprRef Sym, long Scale); -bool compare(ProgramStateRef State, SymbolRef Sym1, SymbolRef Sym2, +bool compare(ProgramStateRef State, SymExprRef Sym1, SymExprRef Sym2, BinaryOperator::Opcode Opc); bool compare(ProgramStateRef State, NonLoc NL1, NonLoc NL2, BinaryOperator::Opcode Opc); Index: clang/lib/StaticAnalyzer/Checkers/Iterator.cpp =================================================================== --- clang/lib/StaticAnalyzer/Checkers/Iterator.cpp +++ clang/lib/StaticAnalyzer/Checkers/Iterator.cpp @@ -262,7 +262,7 @@ // we can help the analyzer perform operations on these symbols // without being afraid of integer overflows. // FIXME: Should we provide it as an API, so that all checkers could use it? -ProgramStateRef assumeNoOverflow(ProgramStateRef State, SymbolRef Sym, +ProgramStateRef assumeNoOverflow(ProgramStateRef State, SymExprRef Sym, long Scale) { SValBuilder &SVB = State->getStateManager().getSValBuilder(); BasicValueFactory &BV = SVB.getBasicValueFactory(); @@ -296,7 +296,7 @@ return NewState; } -bool compare(ProgramStateRef State, SymbolRef Sym1, SymbolRef Sym2, +bool compare(ProgramStateRef State, SymExprRef Sym1, SymExprRef Sym2, BinaryOperator::Opcode Opc) { return compare(State, nonloc::SymbolVal(Sym1), nonloc::SymbolVal(Sym2), Opc); } Index: clang/lib/StaticAnalyzer/Checkers/IteratorModeling.cpp =================================================================== --- clang/lib/StaticAnalyzer/Checkers/IteratorModeling.cpp +++ clang/lib/StaticAnalyzer/Checkers/IteratorModeling.cpp @@ -101,7 +101,7 @@ const SVal &LVal, const SVal &RVal, OverloadedOperatorKind Op) const; void processComparison(CheckerContext &C, ProgramStateRef State, - SymbolRef Sym1, SymbolRef Sym2, const SVal &RetVal, + SymExprRef Sym1, SymExprRef Sym2, const SVal &RetVal, OverloadedOperatorKind Op) const; void handleIncrement(CheckerContext &C, const SVal &RetVal, const SVal &Iter, bool Postfix) const; @@ -161,8 +161,8 @@ bool isSimpleComparisonOperator(OverloadedOperatorKind OK); bool isSimpleComparisonOperator(BinaryOperatorKind OK); ProgramStateRef removeIteratorPosition(ProgramStateRef State, const SVal &Val); -ProgramStateRef relateSymbols(ProgramStateRef State, SymbolRef Sym1, - SymbolRef Sym2, bool Equal); +ProgramStateRef relateSymbols(ProgramStateRef State, SymExprRef Sym1, + SymExprRef Sym2, bool Equal); bool isBoundThroughLazyCompoundVal(const Environment &Env, const MemRegion *Reg); const ExplodedNode *findCallEnter(const ExplodedNode *Node, const Expr *Call); @@ -468,7 +468,7 @@ // At least one of the iterators has recorded positions. If one of them does // not then create a new symbol for the offset. - SymbolRef Sym; + SymExprRef Sym; if (!LPos || !RPos) { auto &SymMgr = C.getSymbolManager(); Sym = SymMgr.conjureSymbol(CE, C.getLocationContext(), @@ -506,8 +506,8 @@ } void IteratorModeling::processComparison(CheckerContext &C, - ProgramStateRef State, SymbolRef Sym1, - SymbolRef Sym2, const SVal &RetVal, + ProgramStateRef State, SymExprRef Sym1, + SymExprRef Sym2, const SVal &RetVal, OverloadedOperatorKind Op) const { if (const auto TruthVal = RetVal.getAs()) { if ((State = relateSymbols(State, Sym1, Sym2, @@ -787,8 +787,8 @@ return nullptr; } -ProgramStateRef relateSymbols(ProgramStateRef State, SymbolRef Sym1, - SymbolRef Sym2, bool Equal) { +ProgramStateRef relateSymbols(ProgramStateRef State, SymExprRef Sym1, + SymExprRef Sym2, bool Equal) { auto &SVB = State->getStateManager().getSValBuilder(); // FIXME: This code should be reworked as follows: Index: clang/lib/StaticAnalyzer/Checkers/IteratorRangeChecker.cpp =================================================================== --- clang/lib/StaticAnalyzer/Checkers/IteratorRangeChecker.cpp +++ clang/lib/StaticAnalyzer/Checkers/IteratorRangeChecker.cpp @@ -291,9 +291,9 @@ namespace { -bool isLess(ProgramStateRef State, SymbolRef Sym1, SymbolRef Sym2); -bool isGreater(ProgramStateRef State, SymbolRef Sym1, SymbolRef Sym2); -bool isEqual(ProgramStateRef State, SymbolRef Sym1, SymbolRef Sym2); +bool isLess(ProgramStateRef State, SymExprRef Sym1, SymExprRef Sym2); +bool isGreater(ProgramStateRef State, SymExprRef Sym1, SymExprRef Sym2); +bool isEqual(ProgramStateRef State, SymExprRef Sym1, SymExprRef Sym2); bool isZero(ProgramStateRef State, const NonLoc &Val) { auto &BVF = State->getBasicVals(); @@ -350,15 +350,15 @@ return false; } -bool isLess(ProgramStateRef State, SymbolRef Sym1, SymbolRef Sym2) { +bool isLess(ProgramStateRef State, SymExprRef Sym1, SymExprRef Sym2) { return compare(State, Sym1, Sym2, BO_LT); } -bool isGreater(ProgramStateRef State, SymbolRef Sym1, SymbolRef Sym2) { +bool isGreater(ProgramStateRef State, SymExprRef Sym1, SymExprRef Sym2) { return compare(State, Sym1, Sym2, BO_GT); } -bool isEqual(ProgramStateRef State, SymbolRef Sym1, SymbolRef Sym2) { +bool isEqual(ProgramStateRef State, SymExprRef Sym1, SymExprRef Sym2) { return compare(State, Sym1, Sym2, BO_EQ); } Index: clang/lib/StaticAnalyzer/Checkers/MIGChecker.cpp =================================================================== --- clang/lib/StaticAnalyzer/Checkers/MIGChecker.cpp +++ clang/lib/StaticAnalyzer/Checkers/MIGChecker.cpp @@ -118,7 +118,7 @@ static const ParmVarDecl *getOriginParam(SVal V, CheckerContext &C, bool IncludeBaseRegions = false) { // TODO: We should most likely always include base regions here. - SymbolRef Sym = V.getAsSymbol(IncludeBaseRegions); + SymExprRef Sym = V.getAsSymbol(IncludeBaseRegions); if (!Sym) return nullptr; Index: clang/lib/StaticAnalyzer/Checkers/MacOSKeychainAPIChecker.cpp =================================================================== --- clang/lib/StaticAnalyzer/Checkers/MacOSKeychainAPIChecker.cpp +++ clang/lib/StaticAnalyzer/Checkers/MacOSKeychainAPIChecker.cpp @@ -39,11 +39,10 @@ struct AllocationState { /// The index of the allocator function. unsigned int AllocatorIdx; - SymbolRef Region; + SymExprRef Region; - AllocationState(const Expr *E, unsigned int Idx, SymbolRef R) : - AllocatorIdx(Idx), - Region(R) {} + AllocationState(const Expr *E, unsigned int Idx, SymExprRef R) + : AllocatorIdx(Idx), Region(R) {} bool operator==(const AllocationState &X) const { return (AllocatorIdx == X.AllocatorIdx && @@ -69,7 +68,7 @@ const char *NL, const char *Sep) const override; private: - typedef std::pair AllocationPair; + typedef std::pair AllocationPair; typedef SmallVector AllocationPairVec; enum APIKind { @@ -110,7 +109,7 @@ CheckerContext &C) const; /// Find the allocation site for Sym on the path leading to the node N. - const ExplodedNode *getAllocationNode(const ExplodedNode *N, SymbolRef Sym, + const ExplodedNode *getAllocationNode(const ExplodedNode *N, SymExprRef Sym, CheckerContext &C) const; std::unique_ptr @@ -131,10 +130,10 @@ class SecKeychainBugVisitor : public BugReporterVisitor { protected: // The allocated region symbol tracked by the main analysis. - SymbolRef Sym; + SymExprRef Sym; public: - SecKeychainBugVisitor(SymbolRef S) : Sym(S) {} + SecKeychainBugVisitor(SymExprRef S) : Sym(S) {} void Profile(llvm::FoldingSetNodeID &ID) const override { static int X = 0; @@ -152,8 +151,7 @@ /// ProgramState traits to store the currently allocated (and not yet freed) /// symbols. This is a map from the allocated content symbol to the /// corresponding AllocationState. -REGISTER_MAP_WITH_PROGRAMSTATE(AllocatedData, - SymbolRef, +REGISTER_MAP_WITH_PROGRAMSTATE(AllocatedData, SymExprRef, MacOSKeychainAPIChecker::AllocationState) static bool isEnclosingFunctionParam(const Expr *E) { @@ -205,14 +203,13 @@ /// Given the address expression, retrieve the value it's pointing to. Assume /// that value is itself an address, and return the corresponding symbol. -static SymbolRef getAsPointeeSymbol(const Expr *Expr, - CheckerContext &C) { +static SymExprRef getAsPointeeSymbol(const Expr *Expr, CheckerContext &C) { ProgramStateRef State = C.getState(); SVal ArgV = C.getSVal(Expr); if (Optional X = ArgV.getAs()) { StoreManager& SM = C.getStoreManager(); - SymbolRef sym = SM.getBinding(State->getStore(), *X).getAsLocSymbol(); + SymExprRef sym = SM.getBinding(State->getStore(), *X).getAsLocSymbol(); if (sym) return sym; } @@ -267,7 +264,7 @@ return; const Expr *ArgExpr = CE->getArg(paramIdx); - if (SymbolRef V = getAsPointeeSymbol(ArgExpr, C)) + if (SymExprRef V = getAsPointeeSymbol(ArgExpr, C)) if (const AllocationState *AS = State->get(V)) { // Remove the value from the state. The new symbol will be added for // tracking when the second allocator is processed in checkPostStmt(). @@ -310,7 +307,7 @@ if (ArgSVal.isUndef()) return; - SymbolRef ArgSM = ArgSVal.getAsLocSymbol(); + SymExprRef ArgSM = ArgSVal.getAsLocSymbol(); // If the argument is coming from the heap, globals, or unknown, do not // report it. @@ -420,7 +417,7 @@ C.getLocationContext()->getParent() == nullptr) return; - if (SymbolRef V = getAsPointeeSymbol(ArgExpr, C)) { + if (SymExprRef V = getAsPointeeSymbol(ArgExpr, C)) { // If the argument points to something that's not a symbolic region, it // can be: // - unknown (cannot reason about it) @@ -433,7 +430,7 @@ // allocated value symbol, since our diagnostics depend on the value // returned by the call. Ex: Data should only be freed if noErr was // returned during allocation.) - SymbolRef RetStatusSymbol = C.getSVal(CE).getAsSymbol(); + SymExprRef RetStatusSymbol = C.getSVal(CE).getAsSymbol(); C.getSymbolManager().addSymbolDependency(V, RetStatusSymbol); // Track the allocated value in the checker state. @@ -445,10 +442,8 @@ } // TODO: This logic is the same as in Malloc checker. -const ExplodedNode * -MacOSKeychainAPIChecker::getAllocationNode(const ExplodedNode *N, - SymbolRef Sym, - CheckerContext &C) const { +const ExplodedNode *MacOSKeychainAPIChecker::getAllocationNode( + const ExplodedNode *N, SymExprRef Sym, CheckerContext &C) const { const LocationContext *LeakContext = N->getLocationContext(); // Walk the ExplodedGraph backwards and find the first node that referred to // the tracked symbol. @@ -518,7 +513,7 @@ // Match for a restricted set of patterns for cmparison of error codes. // Note, the comparisons of type '0 == st' are transformed into SymIntExpr. - SymbolRef ReturnSymbol = nullptr; + SymExprRef ReturnSymbol = nullptr; if (auto *SIE = dyn_cast(CondBSE)) { const llvm::APInt &RHS = SIE->getRHS(); bool ErrorIsReturned = (OpCode == BO_EQ && RHS != NoErr) || @@ -588,7 +583,7 @@ return State; for (auto I : State->get()) { - SymbolRef Sym = I.first; + SymExprRef Sym = I.first; if (Escaped.count(Sym)) State = State->remove(Sym); @@ -609,7 +604,7 @@ // symbol escapes. // if (const auto *SD = dyn_cast(Sym)) { - SymbolRef ParentSym = SD->getParentSymbol(); + SymExprRef ParentSym = SD->getParentSymbol(); if (Escaped.count(ParentSym)) State = State->remove(Sym); } Index: clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp =================================================================== --- clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp +++ clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp @@ -202,10 +202,10 @@ } // end of anonymous namespace -REGISTER_MAP_WITH_PROGRAMSTATE(RegionState, SymbolRef, RefState) +REGISTER_MAP_WITH_PROGRAMSTATE(RegionState, SymExprRef, RefState) /// Check if the memory associated with this symbol was released. -static bool isReleased(SymbolRef Sym, CheckerContext &C); +static bool isReleased(SymExprRef Sym, CheckerContext &C); /// Update the RefState to reflect the new memory allocation. /// The optional \p RetVal parameter specifies the newly allocated pointer @@ -222,7 +222,7 @@ // toPtr = realloc(fromPtr, 20); //===----------------------------------------------------------------------===// -REGISTER_SET_WITH_PROGRAMSTATE(ReallocSizeZeroSymbols, SymbolRef) +REGISTER_SET_WITH_PROGRAMSTATE(ReallocSizeZeroSymbols, SymExprRef) namespace { @@ -251,10 +251,10 @@ struct ReallocPair { // The 'fromPtr'. - SymbolRef ReallocatedSym; + SymExprRef ReallocatedSym; OwnershipAfterReallocKind Kind; - ReallocPair(SymbolRef S, OwnershipAfterReallocKind K) + ReallocPair(SymExprRef S, OwnershipAfterReallocKind K) : ReallocatedSym(S), Kind(K) {} void Profile(llvm::FoldingSetNodeID &ID) const { ID.AddInteger(Kind); @@ -268,7 +268,7 @@ } // end of anonymous namespace -REGISTER_MAP_WITH_PROGRAMSTATE(ReallocPairs, SymbolRef, ReallocPair) +REGISTER_MAP_WITH_PROGRAMSTATE(ReallocPairs, SymExprRef, ReallocPair) /// Tells if the callee is one of the builtin new/delete operators, including /// placement operators and other standard overloads. @@ -637,15 +637,16 @@ CheckerContext &C) const; /// If in \p S \p Sym is used, check whether \p Sym was already freed. - bool checkUseAfterFree(SymbolRef Sym, CheckerContext &C, const Stmt *S) const; + bool checkUseAfterFree(SymExprRef Sym, CheckerContext &C, + const Stmt *S) const; /// If in \p S \p Sym is used, check whether \p Sym was allocated as a zero /// sized memory region. - void checkUseZeroAllocated(SymbolRef Sym, CheckerContext &C, + void checkUseZeroAllocated(SymExprRef Sym, CheckerContext &C, const Stmt *S) const; /// If in \p S \p Sym is being freed, check whether \p Sym was already freed. - bool checkDoubleDelete(SymbolRef Sym, CheckerContext &C) const; + bool checkDoubleDelete(SymExprRef Sym, CheckerContext &C) const; /// Check if the function is known to free memory, or if it is /// "interesting" and should be modeled explicitly. @@ -657,9 +658,9 @@ /// /// We assume that pointers do not escape through calls to system functions /// not handled by this checker. - bool mayFreeAnyEscapedMemoryOrIsModeledExplicitly(const CallEvent *Call, - ProgramStateRef State, - SymbolRef &EscapingSymbol) const; + bool mayFreeAnyEscapedMemoryOrIsModeledExplicitly( + const CallEvent *Call, ProgramStateRef State, + SymExprRef &EscapingSymbol) const; /// Implementation of the checkPointerEscape callbacks. LLVM_NODISCARD @@ -679,7 +680,7 @@ Optional getCheckIfTracked(AllocationFamily Family, bool IsALeakCheck = false) const; - Optional getCheckIfTracked(CheckerContext &C, SymbolRef Sym, + Optional getCheckIfTracked(CheckerContext &C, SymExprRef Sym, bool IsALeakCheck = false) const; ///@} static bool SummarizeValue(raw_ostream &os, SVal V); @@ -694,22 +695,22 @@ void HandleMismatchedDealloc(CheckerContext &C, SourceRange Range, const Expr *DeallocExpr, const RefState *RS, - SymbolRef Sym, bool OwnershipTransferred) const; + SymExprRef Sym, bool OwnershipTransferred) const; void HandleOffsetFree(CheckerContext &C, SVal ArgVal, SourceRange Range, const Expr *DeallocExpr, AllocationFamily Family, const Expr *AllocExpr = nullptr) const; void HandleUseAfterFree(CheckerContext &C, SourceRange Range, - SymbolRef Sym) const; + SymExprRef Sym) const; void HandleDoubleFree(CheckerContext &C, SourceRange Range, bool Released, - SymbolRef Sym, SymbolRef PrevSym) const; + SymExprRef Sym, SymExprRef PrevSym) const; - void HandleDoubleDelete(CheckerContext &C, SymbolRef Sym) const; + void HandleDoubleDelete(CheckerContext &C, SymExprRef Sym) const; void HandleUseZeroAlloc(CheckerContext &C, SourceRange Range, - SymbolRef Sym) const; + SymExprRef Sym) const; void HandleFunctionPtrFree(CheckerContext &C, SVal ArgVal, SourceRange Range, const Expr *FreeExpr, @@ -717,10 +718,10 @@ /// Find the location of the allocation for Sym on the path leading to the /// exploded node N. - static LeakInfo getAllocationSite(const ExplodedNode *N, SymbolRef Sym, + static LeakInfo getAllocationSite(const ExplodedNode *N, SymExprRef Sym, CheckerContext &C); - void HandleLeak(SymbolRef Sym, ExplodedNode *N, CheckerContext &C) const; + void HandleLeak(SymExprRef Sym, ExplodedNode *N, CheckerContext &C) const; /// Test if value in ArgVal equals to value in macro `ZERO_SIZE_PTR`. bool isArgZERO_SIZE_PTR(ProgramStateRef State, CheckerContext &C, @@ -739,13 +740,13 @@ enum NotificationMode { Normal, ReallocationFailed }; // The allocated region symbol tracked by the main analysis. - SymbolRef Sym; + SymExprRef Sym; // The mode we are in, i.e. what kind of diagnostics will be emitted. NotificationMode Mode; // A symbol from when the primary region should have been reallocated. - SymbolRef FailedReallocSymbol; + SymExprRef FailedReallocSymbol; // A C++ destructor stack frame in which memory was released. Used for // miscellaneous false positive suppression. @@ -754,7 +755,7 @@ bool IsLeak; public: - MallocBugVisitor(SymbolRef S, bool isLeak = false) + MallocBugVisitor(SymExprRef S, bool isLeak = false) : Sym(S), Mode(Normal), FailedReallocSymbol(nullptr), ReleaseDestructorLC(nullptr), IsLeak(isLeak) {} @@ -834,7 +835,7 @@ class StackHintGeneratorForReallocationFailed : public StackHintGeneratorForSymbol { public: - StackHintGeneratorForReallocationFailed(SymbolRef S, StringRef M) + StackHintGeneratorForReallocationFailed(SymExprRef S, StringRef M) : StackHintGeneratorForSymbol(S, M) {} std::string getMessageForArg(const Expr *ArgE, unsigned ArgIndex) override { @@ -860,7 +861,7 @@ // A map from the freed symbol to the symbol representing the return value of // the free function. -REGISTER_MAP_WITH_PROGRAMSTATE(FreeReturnValue, SymbolRef, SymbolRef) +REGISTER_MAP_WITH_PROGRAMSTATE(FreeReturnValue, SymExprRef, SymExprRef) namespace { class StopTrackingCallback final : public SymbolVisitor { @@ -870,7 +871,7 @@ StopTrackingCallback(ProgramStateRef st) : state(std::move(st)) {} ProgramStateRef getState() const { return state; } - bool VisitSymbol(SymbolRef sym) override { + bool VisitSymbol(SymExprRef sym) override { state = state->remove(sym); return true; } @@ -1337,7 +1338,7 @@ State->assume(SvalBuilder.evalEQ(State, *DefArgVal, Zero)); if (TrueState && !FalseState) { - SymbolRef Sym = RetVal->getAsLocSymbol(); + SymExprRef Sym = RetVal->getAsLocSymbol(); if (!Sym) return State; @@ -1622,7 +1623,7 @@ if (!RetVal->getAs()) return nullptr; - SymbolRef Sym = RetVal->getAsLocSymbol(); + SymExprRef Sym = RetVal->getAsLocSymbol(); // This is a return value of a function that was not inlined, such as malloc() // or new(). We've checked that in the caller. Therefore, it must be a symbol. assert(Sym); @@ -1672,9 +1673,9 @@ /// Checks if the previous call to free on the given symbol failed - if free /// failed, returns true. Also, returns the corresponding return value symbol. -static bool didPreviousFreeFail(ProgramStateRef State, - SymbolRef Sym, SymbolRef &RetStatusSymbol) { - const SymbolRef *Ret = State->get(Sym); +static bool didPreviousFreeFail(ProgramStateRef State, SymExprRef Sym, + SymExprRef &RetStatusSymbol) { + const SymExprRef *Ret = State->get(Sym); if (Ret) { assert(*Ret && "We should not store the null return symbol"); ConstraintManager &CMgr = State->getConstraintManager(); @@ -1840,9 +1841,9 @@ if (!SrBase) return nullptr; - SymbolRef SymBase = SrBase->getSymbol(); + SymExprRef SymBase = SrBase->getSymbol(); const RefState *RsBase = State->get(SymBase); - SymbolRef PreviousRetStatusSymbol = nullptr; + SymExprRef PreviousRetStatusSymbol = nullptr; IsKnownToBeAllocated = RsBase && (RsBase->isAllocated() || RsBase->isAllocatedOfSizeZero()); @@ -1902,7 +1903,7 @@ // failed. if (ReturnsNullOnFailure) { SVal RetVal = C.getSVal(ParentExpr); - SymbolRef RetStatusSymbol = RetVal.getAsSymbol(); + SymExprRef RetStatusSymbol = RetVal.getAsSymbol(); if (RetStatusSymbol) { C.getSymbolManager().addSymbolDependency(SymBase, RetStatusSymbol); State = State->set(SymBase, RetStatusSymbol); @@ -1961,7 +1962,7 @@ } Optional -MallocChecker::getCheckIfTracked(CheckerContext &C, SymbolRef Sym, +MallocChecker::getCheckIfTracked(CheckerContext &C, SymExprRef Sym, bool IsALeakCheck) const { if (C.getState()->contains(Sym)) return CK_MallocChecker; @@ -2137,7 +2138,7 @@ void MallocChecker::HandleMismatchedDealloc(CheckerContext &C, SourceRange Range, const Expr *DeallocExpr, - const RefState *RS, SymbolRef Sym, + const RefState *RS, SymExprRef Sym, bool OwnershipTransferred) const { if (!ChecksEnabled[CK_MismatchedDeallocatorChecker]) { @@ -2250,7 +2251,7 @@ } void MallocChecker::HandleUseAfterFree(CheckerContext &C, SourceRange Range, - SymbolRef Sym) const { + SymExprRef Sym) const { if (!ChecksEnabled[CK_MallocChecker] && !ChecksEnabled[CK_NewDeleteChecker] && !ChecksEnabled[CK_InnerPointerChecker]) { @@ -2289,8 +2290,8 @@ } void MallocChecker::HandleDoubleFree(CheckerContext &C, SourceRange Range, - bool Released, SymbolRef Sym, - SymbolRef PrevSym) const { + bool Released, SymExprRef Sym, + SymExprRef PrevSym) const { if (!ChecksEnabled[CK_MallocChecker] && !ChecksEnabled[CK_NewDeleteChecker]) { C.addSink(); @@ -2320,7 +2321,8 @@ } } -void MallocChecker::HandleDoubleDelete(CheckerContext &C, SymbolRef Sym) const { +void MallocChecker::HandleDoubleDelete(CheckerContext &C, + SymExprRef Sym) const { if (!ChecksEnabled[CK_NewDeleteChecker]) { C.addSink(); @@ -2347,7 +2349,7 @@ } void MallocChecker::HandleUseZeroAlloc(CheckerContext &C, SourceRange Range, - SymbolRef Sym) const { + SymExprRef Sym) const { if (!ChecksEnabled[CK_MallocChecker] && !ChecksEnabled[CK_NewDeleteChecker]) { C.addSink(); @@ -2506,9 +2508,9 @@ Kind = OAR_DoNotTrackAfterFailure; // Get the from and to pointer symbols as in toPtr = realloc(fromPtr, size). - SymbolRef FromPtr = arg0Val.getLocSymbolInBase(); + SymExprRef FromPtr = arg0Val.getLocSymbolInBase(); SVal RetVal = C.getSVal(CE); - SymbolRef ToPtr = RetVal.getAsSymbol(); + SymExprRef ToPtr = RetVal.getAsSymbol(); assert(FromPtr && ToPtr && "By this point, FreeMemAux and MallocMemAux should have checked " "whether the argument or the return value is symbolic!"); @@ -2542,7 +2544,7 @@ } MallocChecker::LeakInfo MallocChecker::getAllocationSite(const ExplodedNode *N, - SymbolRef Sym, + SymExprRef Sym, CheckerContext &C) { const LocationContext *LeakContext = N->getLocationContext(); // Walk the ExplodedGraph backwards and find the first node that referred to @@ -2582,7 +2584,7 @@ return LeakInfo(AllocNode, ReferenceRegion); } -void MallocChecker::HandleLeak(SymbolRef Sym, ExplodedNode *N, +void MallocChecker::HandleLeak(SymExprRef Sym, ExplodedNode *N, CheckerContext &C) const { if (!ChecksEnabled[CK_MallocChecker] && @@ -2653,7 +2655,7 @@ RegionStateTy::Factory &F = state->get_context(); RegionStateTy RS = OldRS; - SmallVector Errors; + SmallVector Errors; for (RegionStateTy::iterator I = RS.begin(), E = RS.end(); I != E; ++I) { if (SymReaper.isDead(I->first)) { if (I->second.isAllocated() || I->second.isAllocatedOfSizeZero()) @@ -2696,8 +2698,9 @@ static CheckerProgramPointTag Tag("MallocChecker", "DeadSymbolsLeak"); N = C.generateNonFatalErrorNode(C.getState(), &Tag); if (N) { - for (SmallVectorImpl::iterator - I = Errors.begin(), E = Errors.end(); I != E; ++I) { + for (SmallVectorImpl::iterator I = Errors.begin(), + E = Errors.end(); + I != E; ++I) { HandleLeak(*I, N, C); } } @@ -2713,7 +2716,7 @@ const CXXDeleteExpr *DE = DC->getOriginExpr(); if (!ChecksEnabled[CK_NewDeleteChecker]) - if (SymbolRef Sym = C.getSVal(DE->getArgument()).getAsSymbol()) + if (SymExprRef Sym = C.getSVal(DE->getArgument()).getAsSymbol()) checkUseAfterFree(Sym, C, DE->getArgument()); if (!isStandardNewDelete(DC->getDecl())) @@ -2730,7 +2733,7 @@ } if (const auto *DC = dyn_cast(&Call)) { - SymbolRef Sym = DC->getCXXThisVal().getAsSymbol(); + SymExprRef Sym = DC->getCXXThisVal().getAsSymbol(); if (!Sym || checkDoubleDelete(Sym, C)) return; } @@ -2747,7 +2750,7 @@ // Check if the callee of a method is deleted. if (const CXXInstanceCall *CC = dyn_cast(&Call)) { - SymbolRef Sym = CC->getCXXThisVal().getAsSymbol(); + SymExprRef Sym = CC->getCXXThisVal().getAsSymbol(); if (!Sym || checkUseAfterFree(Sym, C, CC->getCXXThisExpr())) return; } @@ -2756,7 +2759,7 @@ for (unsigned I = 0, E = Call.getNumArgs(); I != E; ++I) { SVal ArgSVal = Call.getArgSVal(I); if (ArgSVal.getAs()) { - SymbolRef Sym = ArgSVal.getAsSymbol(); + SymExprRef Sym = ArgSVal.getAsSymbol(); if (!Sym) continue; if (checkUseAfterFree(Sym, C, Call.getArgExpr(I))) @@ -2790,7 +2793,7 @@ // Check if we are returning a symbol. ProgramStateRef State = C.getState(); SVal RetVal = C.getSVal(E); - SymbolRef Sym = RetVal.getAsSymbol(); + SymExprRef Sym = RetVal.getAsSymbol(); if (!Sym) // If we are returning a field of the allocated struct or an array element, // the callee could still free the memory. @@ -2844,7 +2847,7 @@ C.addTransition(state); } -static bool isReleased(SymbolRef Sym, CheckerContext &C) { +static bool isReleased(SymExprRef Sym, CheckerContext &C) { assert(Sym); const RefState *RS = C.getState()->get(Sym); return (RS && RS->isReleased()); @@ -2871,7 +2874,7 @@ ProgramStateRef State = C.getState(); for (const Expr *Arg : cast(Call.getOriginExpr())->arguments()) - if (SymbolRef Sym = C.getSVal(Arg).getAsSymbol()) + if (SymExprRef Sym = C.getSVal(Arg).getAsSymbol()) if (const RefState *RS = State->get(Sym)) State = State->set(Sym, RefState::getEscaped(RS)); @@ -2879,7 +2882,7 @@ return true; } -bool MallocChecker::checkUseAfterFree(SymbolRef Sym, CheckerContext &C, +bool MallocChecker::checkUseAfterFree(SymExprRef Sym, CheckerContext &C, const Stmt *S) const { if (isReleased(Sym, C)) { @@ -2890,7 +2893,7 @@ return false; } -void MallocChecker::checkUseZeroAllocated(SymbolRef Sym, CheckerContext &C, +void MallocChecker::checkUseZeroAllocated(SymExprRef Sym, CheckerContext &C, const Stmt *S) const { assert(Sym); @@ -2903,7 +2906,7 @@ } } -bool MallocChecker::checkDoubleDelete(SymbolRef Sym, CheckerContext &C) const { +bool MallocChecker::checkDoubleDelete(SymExprRef Sym, CheckerContext &C) const { if (isReleased(Sym, C)) { HandleDoubleDelete(C, Sym); @@ -2915,7 +2918,7 @@ // Check if the location is a freed symbolic region. void MallocChecker::checkLocation(SVal l, bool isLoad, const Stmt *S, CheckerContext &C) const { - SymbolRef Sym = l.getLocSymbolInBase(); + SymExprRef Sym = l.getLocSymbolInBase(); if (Sym) { checkUseAfterFree(Sym, C, S); checkUseZeroAllocated(Sym, C, S); @@ -2946,7 +2949,7 @@ if (!AllocFailed.isConstrainedTrue()) continue; - SymbolRef ReallocSym = I.getData().ReallocatedSym; + SymExprRef ReallocSym = I.getData().ReallocatedSym; if (const RefState *RS = state->get(ReallocSym)) { if (RS->isReleased()) { switch (I.getData().Kind) { @@ -2969,9 +2972,8 @@ } bool MallocChecker::mayFreeAnyEscapedMemoryOrIsModeledExplicitly( - const CallEvent *Call, - ProgramStateRef State, - SymbolRef &EscapingSymbol) const { + const CallEvent *Call, ProgramStateRef State, + SymExprRef &EscapingSymbol) const { assert(Call); EscapingSymbol = nullptr; @@ -3160,7 +3162,7 @@ bool IsConstPointerEscape) const { // If we know that the call does not free memory, or we want to process the // call later, keep tracking the top level arguments. - SymbolRef EscapingSymbol = nullptr; + SymExprRef EscapingSymbol = nullptr; if (Kind == PSK_DirectEscapeOnCall && !mayFreeAnyEscapedMemoryOrIsModeledExplicitly(Call, State, EscapingSymbol) && @@ -3171,7 +3173,7 @@ for (InvalidatedSymbols::const_iterator I = Escaped.begin(), E = Escaped.end(); I != E; ++I) { - SymbolRef sym = *I; + SymExprRef sym = *I; if (EscapingSymbol && EscapingSymbol != sym) continue; @@ -3196,13 +3198,13 @@ ArgValKnown->getSExtValue() == **KernelZeroSizePtrValue; } -static SymbolRef findFailedReallocSymbol(ProgramStateRef currState, - ProgramStateRef prevState) { +static SymExprRef findFailedReallocSymbol(ProgramStateRef currState, + ProgramStateRef prevState) { ReallocPairsTy currMap = currState->get(); ReallocPairsTy prevMap = prevState->get(); for (const ReallocPairsTy::value_type &Pair : prevMap) { - SymbolRef sym = Pair.first; + SymExprRef sym = Pair.first; if (!currMap.lookup(sym)) return sym; } @@ -3361,7 +3363,7 @@ StackHint = std::make_unique( Sym, "Reallocation failed"); - if (SymbolRef sym = findFailedReallocSymbol(state, statePrev)) { + if (SymExprRef sym = findFailedReallocSymbol(state, statePrev)) { // Is it possible to fail two reallocs WITHOUT testing in between? assert((!FailedReallocSymbol || FailedReallocSymbol == sym) && "We only support one failed realloc at a time."); @@ -3439,8 +3441,8 @@ namespace ento { namespace allocation_state { -ProgramStateRef -markReleased(ProgramStateRef State, SymbolRef Sym, const Expr *Origin) { +ProgramStateRef markReleased(ProgramStateRef State, SymExprRef Sym, + const Expr *Origin) { AllocationFamily Family = AF_InnerBuffer; return State->set(Sym, RefState::getReleased(Family, Origin)); } Index: clang/lib/StaticAnalyzer/Checkers/MoveChecker.cpp =================================================================== --- clang/lib/StaticAnalyzer/Checkers/MoveChecker.cpp +++ clang/lib/StaticAnalyzer/Checkers/MoveChecker.cpp @@ -263,7 +263,7 @@ static const MemRegion *unwrapRValueReferenceIndirection(const MemRegion *MR) { if (const auto *SR = dyn_cast_or_null(MR)) { - SymbolRef Sym = SR->getSymbol(); + SymExprRef Sym = SR->getSymbol(); if (Sym->getType()->isRValueReferenceType()) if (const MemRegion *OriginMR = Sym->getOriginRegion()) return OriginMR; Index: clang/lib/StaticAnalyzer/Checkers/NSErrorChecker.cpp =================================================================== --- clang/lib/StaticAnalyzer/Checkers/NSErrorChecker.cpp +++ clang/lib/StaticAnalyzer/Checkers/NSErrorChecker.cpp @@ -176,13 +176,13 @@ }; } -typedef llvm::ImmutableMap ErrorOutFlag; +typedef llvm::ImmutableMap ErrorOutFlag; REGISTER_TRAIT_WITH_PROGRAMSTATE(NSErrorOut, ErrorOutFlag) REGISTER_TRAIT_WITH_PROGRAMSTATE(CFErrorOut, ErrorOutFlag) template static bool hasFlag(SVal val, ProgramStateRef state) { - if (SymbolRef sym = val.getAsSymbol()) + if (SymExprRef sym = val.getAsSymbol()) if (const unsigned *attachedFlags = state->get(sym)) return *attachedFlags; return false; @@ -191,7 +191,7 @@ template static void setFlag(ProgramStateRef state, SVal val, CheckerContext &C) { // We tag the symbol that the SVal wraps. - if (SymbolRef sym = val.getAsSymbol()) + if (SymExprRef sym = val.getAsSymbol()) C.addTransition(state->set(sym, true)); } Index: clang/lib/StaticAnalyzer/Checkers/NullabilityChecker.cpp =================================================================== --- clang/lib/StaticAnalyzer/Checkers/NullabilityChecker.cpp +++ clang/lib/StaticAnalyzer/Checkers/NullabilityChecker.cpp @@ -1113,7 +1113,7 @@ NullConstraint RhsNullness = getNullConstraint(*ValDefOrUnknown, State); Nullability ValNullability = Nullability::Unspecified; - if (SymbolRef Sym = ValDefOrUnknown->getAsSymbol()) + if (SymExprRef Sym = ValDefOrUnknown->getAsSymbol()) ValNullability = getNullabilityAnnotation(Sym->getType()); Nullability LocNullability = getNullabilityAnnotation(LocType); Index: clang/lib/StaticAnalyzer/Checkers/ObjCContainersChecker.cpp =================================================================== --- clang/lib/StaticAnalyzer/Checkers/ObjCContainersChecker.cpp +++ clang/lib/StaticAnalyzer/Checkers/ObjCContainersChecker.cpp @@ -37,9 +37,9 @@ categories::CoreFoundationObjectiveC)); } - inline SymbolRef getArraySym(const Expr *E, CheckerContext &C) const { + inline SymExprRef getArraySym(const Expr *E, CheckerContext &C) const { SVal ArrayRef = C.getSVal(E); - SymbolRef ArraySym = ArrayRef.getAsSymbol(); + SymExprRef ArraySym = ArrayRef.getAsSymbol(); return ArraySym; } @@ -63,7 +63,7 @@ } // end anonymous namespace // ProgramState trait - a map from array symbol to its state. -REGISTER_MAP_WITH_PROGRAMSTATE(ArraySizeMap, SymbolRef, DefinedSVal) +REGISTER_MAP_WITH_PROGRAMSTATE(ArraySizeMap, SymExprRef, DefinedSVal) void ObjCContainersChecker::addSizeInfo(const Expr *Array, const Expr *Size, CheckerContext &C) const { @@ -75,7 +75,7 @@ // Get the ArrayRef symbol. SVal ArrayRef = C.getSVal(Array); - SymbolRef ArraySym = ArrayRef.getAsSymbol(); + SymExprRef ArraySym = ArrayRef.getAsSymbol(); if (!ArraySym) return; @@ -119,7 +119,7 @@ // Find out if we saw this array symbol before and have information about // it. const Expr *ArrayExpr = CE->getArg(0); - SymbolRef ArraySym = getArraySym(ArrayExpr, C); + SymExprRef ArraySym = getArraySym(ArrayExpr, C); if (!ArraySym) return; Index: clang/lib/StaticAnalyzer/Checkers/ObjCSelfInitChecker.cpp =================================================================== --- clang/lib/StaticAnalyzer/Checkers/ObjCSelfInitChecker.cpp +++ clang/lib/StaticAnalyzer/Checkers/ObjCSelfInitChecker.cpp @@ -94,7 +94,7 @@ }; } -REGISTER_MAP_WITH_PROGRAMSTATE(SelfFlag, SymbolRef, unsigned) +REGISTER_MAP_WITH_PROGRAMSTATE(SelfFlag, SymExprRef, unsigned) REGISTER_TRAIT_WITH_PROGRAMSTATE(CalledInit, bool) /// A call receiving a reference to 'self' invalidates the object that @@ -104,7 +104,7 @@ REGISTER_TRAIT_WITH_PROGRAMSTATE(PreCallSelfFlags, unsigned) static SelfFlagEnum getSelfFlags(SVal val, ProgramStateRef state) { - if (SymbolRef sym = val.getAsSymbol()) + if (SymExprRef sym = val.getAsSymbol()) if (const unsigned *attachedFlags = state->get(sym)) return (SelfFlagEnum)*attachedFlags; return SelfFlag_None; @@ -117,7 +117,7 @@ static void addSelfFlag(ProgramStateRef state, SVal val, SelfFlagEnum flag, CheckerContext &C) { // We tag the symbol that the SVal wraps. - if (SymbolRef sym = val.getAsSymbol()) { + if (SymExprRef sym = val.getAsSymbol()) { state = state->set(sym, getSelfFlags(val, state) | flag); C.addTransition(state); } @@ -328,7 +328,7 @@ // Stop tracking the checker-specific state in the state. ProgramStateRef State = C.getState(); State = State->remove(); - if (SymbolRef sym = loc.getAsSymbol()) + if (SymExprRef sym = loc.getAsSymbol()) State = State->remove(sym); C.addTransition(State); } Index: clang/lib/StaticAnalyzer/Checkers/ObjCSuperDeallocChecker.cpp =================================================================== --- clang/lib/StaticAnalyzer/Checkers/ObjCSuperDeallocChecker.cpp +++ clang/lib/StaticAnalyzer/Checkers/ObjCSuperDeallocChecker.cpp @@ -50,23 +50,23 @@ void diagnoseCallArguments(const CallEvent &CE, CheckerContext &C) const; - void reportUseAfterDealloc(SymbolRef Sym, StringRef Desc, const Stmt *S, + void reportUseAfterDealloc(SymExprRef Sym, StringRef Desc, const Stmt *S, CheckerContext &C) const; }; } // End anonymous namespace. // Remember whether [super dealloc] has previously been called on the -// SymbolRef for the receiver. -REGISTER_SET_WITH_PROGRAMSTATE(CalledSuperDealloc, SymbolRef) +// SymExprRef for the receiver. +REGISTER_SET_WITH_PROGRAMSTATE(CalledSuperDealloc, SymExprRef) namespace { class SuperDeallocBRVisitor final : public BugReporterVisitor { - SymbolRef ReceiverSymbol; + SymExprRef ReceiverSymbol; bool Satisfied; public: - SuperDeallocBRVisitor(SymbolRef ReceiverSymbol) + SuperDeallocBRVisitor(SymExprRef ReceiverSymbol) : ReceiverSymbol(ReceiverSymbol), Satisfied(false) {} PathDiagnosticPieceRef VisitNode(const ExplodedNode *Succ, @@ -83,7 +83,7 @@ CheckerContext &C) const { ProgramStateRef State = C.getState(); - SymbolRef ReceiverSymbol = M.getReceiverSVal().getAsSymbol(); + SymExprRef ReceiverSymbol = M.getReceiverSVal().getAsSymbol(); if (!ReceiverSymbol) { diagnoseCallArguments(M, C); return; @@ -117,7 +117,7 @@ ProgramStateRef State = C.getState(); const LocationContext *LC = C.getLocationContext(); - SymbolRef SelfSymbol = State->getSelfSVal(LC).getAsSymbol(); + SymExprRef SelfSymbol = State->getSelfSVal(LC).getAsSymbol(); assert(SelfSymbol && "No receiver symbol at call to [super dealloc]?"); // We add this transition in checkPostObjCMessage to avoid warning when @@ -129,7 +129,7 @@ void ObjCSuperDeallocChecker::checkLocation(SVal L, bool IsLoad, const Stmt *S, CheckerContext &C) const { - SymbolRef BaseSym = L.getLocSymbolInBase(); + SymExprRef BaseSym = L.getLocSymbolInBase(); if (!BaseSym) return; @@ -172,7 +172,7 @@ /// Report a use-after-dealloc on Sym. If not empty, /// Desc will be used to describe the error; otherwise, /// a default warning will be used. -void ObjCSuperDeallocChecker::reportUseAfterDealloc(SymbolRef Sym, +void ObjCSuperDeallocChecker::reportUseAfterDealloc(SymExprRef Sym, StringRef Desc, const Stmt *S, CheckerContext &C) const { @@ -202,7 +202,7 @@ ProgramStateRef State = C.getState(); unsigned ArgCount = CE.getNumArgs(); for (unsigned I = 0; I < ArgCount; I++) { - SymbolRef Sym = CE.getArgSVal(I).getAsSymbol(); + SymExprRef Sym = CE.getArgSVal(I).getAsSymbol(); if (!Sym) continue; Index: clang/lib/StaticAnalyzer/Checkers/PthreadLockChecker.cpp =================================================================== --- clang/lib/StaticAnalyzer/Checkers/PthreadLockChecker.cpp +++ clang/lib/StaticAnalyzer/Checkers/PthreadLockChecker.cpp @@ -166,7 +166,7 @@ ProgramStateRef resolvePossiblyDestroyedMutex(ProgramStateRef state, const MemRegion *lockR, - const SymbolRef *sym) const; + const SymExprRef *sym) const; void reportBug(CheckerContext &C, std::unique_ptr BT[], const Expr *MtxExpr, CheckerKind CheckKind, StringRef Desc) const; @@ -253,7 +253,7 @@ REGISTER_MAP_WITH_PROGRAMSTATE(LockMap, const MemRegion *, LockState) // Return values for unresolved calls to pthread_mutex_destroy(). -REGISTER_MAP_WITH_PROGRAMSTATE(DestroyRetVal, const MemRegion *, SymbolRef) +REGISTER_MAP_WITH_PROGRAMSTATE(DestroyRetVal, const MemRegion *, SymExprRef) void PthreadLockChecker::checkPostCall(const CallEvent &Call, CheckerContext &C) const { @@ -284,8 +284,10 @@ // In PthreadSemantics, pthread_mutex_destroy() returns zero if the lock is // successfully destroyed and it returns a non-zero value otherwise. -ProgramStateRef PthreadLockChecker::resolvePossiblyDestroyedMutex( - ProgramStateRef state, const MemRegion *lockR, const SymbolRef *sym) const { +ProgramStateRef +PthreadLockChecker::resolvePossiblyDestroyedMutex(ProgramStateRef state, + const MemRegion *lockR, + const SymExprRef *sym) const { const LockState *lstate = state->get(lockR); // Existence in DestroyRetVal ensures existence in LockMap. // Existence in Destroyed also ensures that the lock state for lockR is either @@ -395,7 +397,7 @@ return; ProgramStateRef state = C.getState(); - const SymbolRef *sym = state->get(lockR); + const SymExprRef *sym = state->get(lockR); if (sym) state = resolvePossiblyDestroyedMutex(state, lockR, sym); @@ -473,7 +475,7 @@ return; ProgramStateRef state = C.getState(); - const SymbolRef *sym = state->get(lockR); + const SymExprRef *sym = state->get(lockR); if (sym) state = resolvePossiblyDestroyedMutex(state, lockR, sym); @@ -535,7 +537,7 @@ ProgramStateRef State = C.getState(); - const SymbolRef *sym = State->get(LockR); + const SymExprRef *sym = State->get(LockR); if (sym) State = resolvePossiblyDestroyedMutex(State, LockR, sym); @@ -544,7 +546,7 @@ // PthreadSemantics if (Semantics == PthreadSemantics) { if (!LState || LState->isUnlocked()) { - SymbolRef sym = Call.getReturnValue().getAsSymbol(); + SymExprRef sym = Call.getReturnValue().getAsSymbol(); if (!sym) { State = State->remove(LockR); C.addTransition(State); @@ -592,7 +594,7 @@ ProgramStateRef State = C.getState(); - const SymbolRef *sym = State->get(LockR); + const SymExprRef *sym = State->get(LockR); if (sym) State = resolvePossiblyDestroyedMutex(State, LockR, sym); Index: clang/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountChecker.h =================================================================== --- clang/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountChecker.h +++ clang/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountChecker.h @@ -323,40 +323,41 @@ const LocationContext* LCtx, const CallEvent *Call) const; - ExplodedNode* checkReturnWithRetEffect(const ReturnStmt *S, CheckerContext &C, - ExplodedNode *Pred, RetEffect RE, RefVal X, - SymbolRef Sym, ProgramStateRef state) const; + ExplodedNode *checkReturnWithRetEffect(const ReturnStmt *S, CheckerContext &C, + ExplodedNode *Pred, RetEffect RE, + RefVal X, SymExprRef Sym, + ProgramStateRef state) const; void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const; void checkBeginFunction(CheckerContext &C) const; void checkEndFunction(const ReturnStmt *RS, CheckerContext &C) const; - ProgramStateRef updateSymbol(ProgramStateRef state, SymbolRef sym, - RefVal V, ArgEffect E, RefVal::Kind &hasErr, + ProgramStateRef updateSymbol(ProgramStateRef state, SymExprRef sym, RefVal V, + ArgEffect E, RefVal::Kind &hasErr, CheckerContext &C) const; const RefCountBug &errorKindToBugKind(RefVal::Kind ErrorKind, - SymbolRef Sym) const; + SymExprRef Sym) const; void processNonLeakError(ProgramStateRef St, SourceRange ErrorRange, - RefVal::Kind ErrorKind, SymbolRef Sym, + RefVal::Kind ErrorKind, SymExprRef Sym, CheckerContext &C) const; void processObjCLiterals(CheckerContext &C, const Expr *Ex) const; - ProgramStateRef handleSymbolDeath(ProgramStateRef state, - SymbolRef sid, RefVal V, - SmallVectorImpl &Leaked) const; + ProgramStateRef handleSymbolDeath(ProgramStateRef state, SymExprRef sid, + RefVal V, + SmallVectorImpl &Leaked) const; - ProgramStateRef - handleAutoreleaseCounts(ProgramStateRef state, ExplodedNode *Pred, - const ProgramPointTag *Tag, CheckerContext &Ctx, - SymbolRef Sym, - RefVal V, - const ReturnStmt *S=nullptr) const; + ProgramStateRef handleAutoreleaseCounts(ProgramStateRef state, + ExplodedNode *Pred, + const ProgramPointTag *Tag, + CheckerContext &Ctx, SymExprRef Sym, + RefVal V, + const ReturnStmt *S = nullptr) const; ExplodedNode *processLeaks(ProgramStateRef state, - SmallVectorImpl &Leaked, + SmallVectorImpl &Leaked, CheckerContext &Ctx, ExplodedNode *Pred = nullptr) const; @@ -377,7 +378,7 @@ // RefBindings - State used to track object reference counts. //===----------------------------------------------------------------------===// -const RefVal *getRefBinding(ProgramStateRef State, SymbolRef Sym); +const RefVal *getRefBinding(ProgramStateRef State, SymExprRef Sym); /// Returns true if this stack frame is for an Objective-C method that is a /// property getter or setter whose body has been synthesized by the analyzer. Index: clang/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountChecker.cpp =================================================================== --- clang/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountChecker.cpp +++ clang/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountChecker.cpp @@ -19,13 +19,13 @@ using namespace ento; using namespace retaincountchecker; -REGISTER_MAP_WITH_PROGRAMSTATE(RefBindings, SymbolRef, RefVal) +REGISTER_MAP_WITH_PROGRAMSTATE(RefBindings, SymExprRef, RefVal) namespace clang { namespace ento { namespace retaincountchecker { -const RefVal *getRefBinding(ProgramStateRef State, SymbolRef Sym) { +const RefVal *getRefBinding(ProgramStateRef State, SymExprRef Sym) { return State->get(Sym); } @@ -33,13 +33,13 @@ } // end namespace ento } // end namespace clang -static ProgramStateRef setRefBinding(ProgramStateRef State, SymbolRef Sym, +static ProgramStateRef setRefBinding(ProgramStateRef State, SymExprRef Sym, RefVal Val) { assert(Sym != nullptr); return State->set(Sym, Val); } -static ProgramStateRef removeRefBinding(ProgramStateRef State, SymbolRef Sym) { +static ProgramStateRef removeRefBinding(ProgramStateRef State, SymExprRef Sym) { return State->remove(Sym); } @@ -132,7 +132,7 @@ StopTrackingCallback(ProgramStateRef st) : state(std::move(st)) {} ProgramStateRef getState() const { return state; } - bool VisitSymbol(SymbolRef sym) override { + bool VisitSymbol(SymExprRef sym) override { state = removeRefBinding(state, sym); return true; } @@ -208,7 +208,7 @@ } ProgramStateRef state = C.getState(); - SymbolRef Sym = C.getSVal(CE).getAsLocSymbol(); + SymExprRef Sym = C.getSVal(CE).getAsLocSymbol(); if (!Sym) return; const RefVal* T = getRefBinding(state, Sym); @@ -232,7 +232,7 @@ const ExplodedNode *pred = C.getPredecessor(); for (const Stmt *Child : Ex->children()) { SVal V = pred->getSVal(Child); - if (SymbolRef sym = V.getAsSymbol()) + if (SymExprRef sym = V.getAsSymbol()) if (const RefVal* T = getRefBinding(state, sym)) { RefVal::Kind hasErr = (RefVal::Kind) 0; state = updateSymbol(state, sym, *T, @@ -246,8 +246,8 @@ // Return the object as autoreleased. // RetEffect RE = RetEffect::MakeNotOwned(ObjKind::ObjC); - if (SymbolRef sym = - state->getSVal(Ex, pred->getLocationContext()).getAsSymbol()) { + if (SymExprRef sym = + state->getSVal(Ex, pred->getLocationContext()).getAsSymbol()) { QualType ResultTy = Ex->getType(); state = setRefBinding(state, sym, RefVal::makeNotOwned(ObjKind::ObjC, ResultTy)); @@ -273,7 +273,7 @@ const ExplodedNode *Pred = C.getPredecessor(); ProgramStateRef State = Pred->getState(); - if (SymbolRef Sym = Pred->getSVal(Ex).getAsSymbol()) { + if (SymExprRef Sym = Pred->getSVal(Ex).getAsSymbol()) { QualType ResultTy = Ex->getType(); State = setRefBinding(State, Sym, RefVal::makeNotOwned(ObjKind::ObjC, ResultTy)); @@ -289,7 +289,7 @@ return; ProgramStateRef State = C.getState(); - SymbolRef Sym = State->getSVal(*IVarLoc).getAsSymbol(); + SymExprRef Sym = State->getSVal(*IVarLoc).getAsSymbol(); if (!Sym || !dyn_cast_or_null(Sym->getOriginRegion())) return; @@ -369,7 +369,7 @@ if (const auto *MC = dyn_cast(&Call)) { if (MC->isInstanceMessage()) { SVal ReceiverV = MC->getReceiverSVal(); - if (SymbolRef Sym = ReceiverV.getAsLocSymbol()) + if (SymExprRef Sym = ReceiverV.getAsLocSymbol()) if (const RefVal *T = getRefBinding(C.getState(), Sym)) ReceiverType = T->getType(); } @@ -454,7 +454,7 @@ for (unsigned idx = 0, e = CallOrMsg.getNumArgs(); idx != e; ++idx) { SVal V = CallOrMsg.getArgSVal(idx); - if (SymbolRef Sym = V.getAsLocSymbol()) { + if (SymExprRef Sym = V.getAsLocSymbol()) { bool ShouldRemoveBinding = Summ.getArg(idx).getKind() == StopTrackingHard; if (const RefVal *T = getRefBinding(state, Sym)) if (shouldEscapeOSArgumentOnCall(CallOrMsg, idx, T)) @@ -467,7 +467,7 @@ // Evaluate the effect on the message receiver. if (const auto *MsgInvocation = dyn_cast(&CallOrMsg)) { - if (SymbolRef Sym = MsgInvocation->getReceiverSVal().getAsLocSymbol()) { + if (SymExprRef Sym = MsgInvocation->getReceiverSVal().getAsLocSymbol()) { if (Summ.getReceiverEffect().getKind() == StopTrackingHard) { state = removeRefBinding(state, Sym); } @@ -477,7 +477,7 @@ // Consult the summary for the return value. RetEffect RE = Summ.getRetEffect(); - if (SymbolRef Sym = CallOrMsg.getReturnValue().getAsSymbol()) { + if (SymExprRef Sym = CallOrMsg.getReturnValue().getAsSymbol()) { if (RE.getKind() == RetEffect::NoRetHard) state = removeRefBinding(state, Sym); } @@ -558,7 +558,7 @@ QualType PointeeTy = ArgRegion->getValueType(); SVal PointeeVal = State->getSVal(ArgRegion); - SymbolRef Pointee = PointeeVal.getAsLocSymbol(); + SymExprRef Pointee = PointeeVal.getAsLocSymbol(); if (!Pointee) continue; @@ -610,7 +610,7 @@ // Evaluate the effect of the arguments. RefVal::Kind hasErr = (RefVal::Kind) 0; SourceRange ErrorRange; - SymbolRef ErrorSym = nullptr; + SymExprRef ErrorSym = nullptr; // Helper tag for providing diagnostics: indicate whether dealloc was sent // at this location. @@ -620,7 +620,7 @@ SVal V = CallOrMsg.getArgSVal(idx); ArgEffect Effect = Summ.getArg(idx); - if (SymbolRef Sym = V.getAsLocSymbol()) { + if (SymExprRef Sym = V.getAsLocSymbol()) { if (const RefVal *T = getRefBinding(state, Sym)) { if (shouldEscapeOSArgumentOnCall(CallOrMsg, idx, T)) @@ -642,7 +642,7 @@ bool ReceiverIsTracked = false; if (!hasErr) { if (const auto *MsgInvocation = dyn_cast(&CallOrMsg)) { - if (SymbolRef Sym = MsgInvocation->getReceiverSVal().getAsLocSymbol()) { + if (SymExprRef Sym = MsgInvocation->getReceiverSVal().getAsLocSymbol()) { if (const RefVal *T = getRefBinding(state, Sym)) { ReceiverIsTracked = true; state = updateSymbol(state, Sym, *T, @@ -656,7 +656,7 @@ } } } else if (const auto *MCall = dyn_cast(&CallOrMsg)) { - if (SymbolRef Sym = MCall->getCXXThisVal().getAsLocSymbol()) { + if (SymExprRef Sym = MCall->getCXXThisVal().getAsLocSymbol()) { if (const RefVal *T = getRefBinding(state, Sym)) { state = updateSymbol(state, Sym, *T, Summ.getThisEffect(), hasErr, C); @@ -685,7 +685,7 @@ RE = RetEffect::MakeNoRet(); } - if (SymbolRef Sym = CallOrMsg.getReturnValue().getAsSymbol()) { + if (SymExprRef Sym = CallOrMsg.getReturnValue().getAsSymbol()) { QualType ResultTy = CallOrMsg.getResultType(); if (RE.notOwned()) { const Expr *Ex = CallOrMsg.getOriginExpr(); @@ -709,7 +709,7 @@ } ProgramStateRef RetainCountChecker::updateSymbol(ProgramStateRef state, - SymbolRef sym, RefVal V, + SymExprRef sym, RefVal V, ArgEffect AE, RefVal::Kind &hasErr, CheckerContext &C) const { @@ -841,7 +841,7 @@ const RefCountBug & RetainCountChecker::errorKindToBugKind(RefVal::Kind ErrorKind, - SymbolRef Sym) const { + SymExprRef Sym) const { switch (ErrorKind) { case RefVal::ErrorUseAfterRelease: return *UseAfterRelease; @@ -859,7 +859,7 @@ void RetainCountChecker::processNonLeakError(ProgramStateRef St, SourceRange ErrorRange, RefVal::Kind ErrorKind, - SymbolRef Sym, + SymExprRef Sym, CheckerContext &C) const { // HACK: Ignore retain-count issues on values accessed through ivars, // because of cases like this: @@ -982,8 +982,8 @@ ProgramStateRef state = C.getState(); // We need to dig down to the symbolic base here because various // custom allocators do sometimes return the symbol with an offset. - SymbolRef Sym = state->getSValAsScalarOrLoc(RetE, C.getLocationContext()) - .getAsLocSymbol(/*IncludeBaseRegions=*/true); + SymExprRef Sym = state->getSValAsScalarOrLoc(RetE, C.getLocationContext()) + .getAsLocSymbol(/*IncludeBaseRegions=*/true); if (!Sym) return Pred; @@ -1063,12 +1063,9 @@ return checkReturnWithRetEffect(S, C, Pred, RE, X, Sym, state); } -ExplodedNode * RetainCountChecker::checkReturnWithRetEffect(const ReturnStmt *S, - CheckerContext &C, - ExplodedNode *Pred, - RetEffect RE, RefVal X, - SymbolRef Sym, - ProgramStateRef state) const { +ExplodedNode *RetainCountChecker::checkReturnWithRetEffect( + const ReturnStmt *S, CheckerContext &C, ExplodedNode *Pred, RetEffect RE, + RefVal X, SymExprRef Sym, ProgramStateRef state) const { // HACK: Ignore retain-count issues on values accessed through ivars, // because of cases like this: // [_contentView retain]; @@ -1188,13 +1185,13 @@ if (!invalidated) return state; - llvm::SmallPtrSet WhitelistedSymbols; + llvm::SmallPtrSet WhitelistedSymbols; for (const MemRegion *I : ExplicitRegions) if (const SymbolicRegion *SR = I->StripCasts()->getAs()) WhitelistedSymbols.insert(SR->getSymbol()); - for (SymbolRef sym : *invalidated) { + for (SymExprRef sym : *invalidated) { if (WhitelistedSymbols.count(sym)) continue; // Remove any existing reference-count binding. @@ -1203,14 +1200,9 @@ return state; } -ProgramStateRef -RetainCountChecker::handleAutoreleaseCounts(ProgramStateRef state, - ExplodedNode *Pred, - const ProgramPointTag *Tag, - CheckerContext &Ctx, - SymbolRef Sym, - RefVal V, - const ReturnStmt *S) const { +ProgramStateRef RetainCountChecker::handleAutoreleaseCounts( + ProgramStateRef state, ExplodedNode *Pred, const ProgramPointTag *Tag, + CheckerContext &Ctx, SymExprRef Sym, RefVal V, const ReturnStmt *S) const { unsigned ACnt = V.getAutoreleaseCount(); // No autorelease counts? Nothing to be done. @@ -1281,10 +1273,9 @@ return nullptr; } -ProgramStateRef -RetainCountChecker::handleSymbolDeath(ProgramStateRef state, - SymbolRef sid, RefVal V, - SmallVectorImpl &Leaked) const { +ProgramStateRef RetainCountChecker::handleSymbolDeath( + ProgramStateRef state, SymExprRef sid, RefVal V, + SmallVectorImpl &Leaked) const { bool hasLeak; // HACK: Ignore retain-count issues on values accessed through ivars, @@ -1309,17 +1300,15 @@ return setRefBinding(state, sid, V ^ RefVal::ErrorLeak); } -ExplodedNode * -RetainCountChecker::processLeaks(ProgramStateRef state, - SmallVectorImpl &Leaked, - CheckerContext &Ctx, - ExplodedNode *Pred) const { +ExplodedNode *RetainCountChecker::processLeaks( + ProgramStateRef state, SmallVectorImpl &Leaked, + CheckerContext &Ctx, ExplodedNode *Pred) const { // Generate an intermediate node representing the leak point. ExplodedNode *N = Ctx.addTransition(state, Pred); const LangOptions &LOpts = Ctx.getASTContext().getLangOpts(); if (N) { - for (SymbolRef L : Leaked) { + for (SymExprRef L : Leaked) { const RefCountBug &BT = Pred ? *LeakWithinFunction : *LeakAtReturn; Ctx.emitReport(std::make_unique(BT, LOpts, N, L, Ctx)); } @@ -1346,7 +1335,8 @@ for (unsigned idx = 0, e = C->param_size(); idx != e; ++idx) { const ParmVarDecl *Param = C->parameters()[idx]; - SymbolRef Sym = state->getSVal(state->getRegion(Param, LCtx)).getAsSymbol(); + SymExprRef Sym = + state->getSVal(state->getRegion(Param, LCtx)).getAsSymbol(); QualType Ty = Param->getType(); const ArgEffect *AE = CalleeSideArgEffects.lookup(idx); @@ -1398,7 +1388,7 @@ return; B = state->get(); - SmallVector Leaked; + SmallVector Leaked; for (auto &I : B) state = handleSymbolDeath(state, I.first, I.second, Leaked); @@ -1411,11 +1401,11 @@ ExplodedNode *Pred = C.getPredecessor(); ProgramStateRef state = C.getState(); - SmallVector Leaked; + SmallVector Leaked; // Update counts from autorelease pools for (const auto &I: state->get()) { - SymbolRef Sym = I.first; + SymExprRef Sym = I.first; if (SymReaper.isDead(Sym)) { static CheckerProgramPointTag Tag(this, "DeadSymbolAutorelease"); const RefVal &V = I.second; @@ -1445,7 +1435,7 @@ RefBindingsTy::Factory &F = state->get_context(); RefBindingsTy B = state->get(); - for (SymbolRef L : Leaked) + for (SymExprRef L : Leaked) B = F.remove(B, L); state = state->set(B); Index: clang/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountDiagnostics.h =================================================================== --- clang/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountDiagnostics.h +++ clang/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountDiagnostics.h @@ -48,17 +48,15 @@ class RefCountReport : public PathSensitiveBugReport { protected: - SymbolRef Sym; + SymExprRef Sym; bool isLeak = false; public: RefCountReport(const RefCountBug &D, const LangOptions &LOpts, - ExplodedNode *n, SymbolRef sym, - bool isLeak=false); + ExplodedNode *n, SymExprRef sym, bool isLeak = false); RefCountReport(const RefCountBug &D, const LangOptions &LOpts, - ExplodedNode *n, SymbolRef sym, - StringRef endText); + ExplodedNode *n, SymExprRef sym, StringRef endText); ArrayRef getRanges() const override { if (!isLeak) @@ -74,15 +72,15 @@ // Finds the function declaration where a leak warning for the parameter // 'sym' should be raised. - void deriveParamLocation(CheckerContext &Ctx, SymbolRef sym); + void deriveParamLocation(CheckerContext &Ctx, SymExprRef sym); // Finds the location where a leak warning for 'sym' should be raised. - void deriveAllocLocation(CheckerContext &Ctx, SymbolRef sym); + void deriveAllocLocation(CheckerContext &Ctx, SymExprRef sym); // Produces description of a leak warning which is printed on the console. void createDescription(CheckerContext &Ctx); public: RefLeakReport(const RefCountBug &D, const LangOptions &LOpts, ExplodedNode *n, - SymbolRef sym, CheckerContext &Ctx); + SymExprRef sym, CheckerContext &Ctx); PathDiagnosticLocation getLocation() const override { assert(Location.isValid()); return Location; Index: clang/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountDiagnostics.cpp =================================================================== --- clang/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountDiagnostics.cpp +++ clang/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountDiagnostics.cpp @@ -169,7 +169,7 @@ /// If none found, returns None. static Optional findArgIdxOfSymbol(ProgramStateRef CurrSt, const LocationContext *LCtx, - SymbolRef &Sym, + SymExprRef &Sym, Optional> CE) { if (!CE) return None; @@ -210,7 +210,7 @@ static void generateDiagnosticsForCallLike(ProgramStateRef CurrSt, const LocationContext *LCtx, - const RefVal &CurrV, SymbolRef &Sym, + const RefVal &CurrV, SymExprRef &Sym, const Stmt *S, llvm::raw_string_ostream &os) { CallEventManager &Mgr = CurrSt->getStateManager().getCallEventManager(); @@ -315,10 +315,10 @@ class RefCountReportVisitor : public BugReporterVisitor { protected: - SymbolRef Sym; + SymExprRef Sym; public: - RefCountReportVisitor(SymbolRef sym) : Sym(sym) {} + RefCountReportVisitor(SymExprRef sym) : Sym(sym) {} void Profile(llvm::FoldingSetNodeID &ID) const override { static int x = 0; @@ -337,7 +337,7 @@ class RefLeakReportVisitor : public RefCountReportVisitor { public: - RefLeakReportVisitor(SymbolRef sym) : RefCountReportVisitor(sym) {} + RefLeakReportVisitor(SymExprRef sym) : RefCountReportVisitor(sym) {} PathDiagnosticPieceRef getEndPath(BugReporterContext &BRC, const ExplodedNode *N, @@ -390,7 +390,7 @@ if (!PVD->hasAttr()) continue; - if (SymbolRef SR = Call->getArgSVal(I).getAsLocSymbol()) { + if (SymExprRef SR = Call->getArgSVal(I).getAsLocSymbol()) { const RefVal *CountBeforeCall = getRefBinding(CN->getState(), SR); const RefVal *CountAtExit = getRefBinding(N->getState(), SR); @@ -420,7 +420,7 @@ /// Annotate the parameter at the analysis entry point. static std::shared_ptr -annotateStartParameter(const ExplodedNode *N, SymbolRef Sym, +annotateStartParameter(const ExplodedNode *N, SymExprRef Sym, const SourceManager &SM) { auto PP = N->getLocationAs(); if (!PP) @@ -628,7 +628,7 @@ } // end anonymous namespace static AllocationInfo GetAllocationSite(ProgramStateManager &StateMgr, - const ExplodedNode *N, SymbolRef Sym) { + const ExplodedNode *N, SymExprRef Sym) { const ExplodedNode *AllocationNode = N; const ExplodedNode *AllocationNodeInCurrentOrParentContext = N; const MemRegion *FirstBinding = nullptr; @@ -808,7 +808,7 @@ } RefCountReport::RefCountReport(const RefCountBug &D, const LangOptions &LOpts, - ExplodedNode *n, SymbolRef sym, bool isLeak) + ExplodedNode *n, SymExprRef sym, bool isLeak) : PathSensitiveBugReport(D, D.getDescription(), n), Sym(sym), isLeak(isLeak) { if (!isLeak) @@ -816,14 +816,14 @@ } RefCountReport::RefCountReport(const RefCountBug &D, const LangOptions &LOpts, - ExplodedNode *n, SymbolRef sym, + ExplodedNode *n, SymExprRef sym, StringRef endText) : PathSensitiveBugReport(D, D.getDescription(), endText, n) { addVisitor(std::make_unique(sym)); } -void RefLeakReport::deriveParamLocation(CheckerContext &Ctx, SymbolRef sym) { +void RefLeakReport::deriveParamLocation(CheckerContext &Ctx, SymExprRef sym) { const SourceManager& SMgr = Ctx.getSourceManager(); if (!sym->getOriginRegion()) @@ -842,8 +842,7 @@ } } -void RefLeakReport::deriveAllocLocation(CheckerContext &Ctx, - SymbolRef sym) { +void RefLeakReport::deriveAllocLocation(CheckerContext &Ctx, SymExprRef sym) { // Most bug reports are cached at the location where they occurred. // With leaks, we want to unique them by the location where they were // allocated, and only report a single path. To do this, we need to find @@ -902,7 +901,7 @@ } RefLeakReport::RefLeakReport(const RefCountBug &D, const LangOptions &LOpts, - ExplodedNode *n, SymbolRef sym, + ExplodedNode *n, SymExprRef sym, CheckerContext &Ctx) : RefCountReport(D, LOpts, n, sym, /*isLeak=*/true) { Index: clang/lib/StaticAnalyzer/Checkers/SimpleStreamChecker.cpp =================================================================== --- clang/lib/StaticAnalyzer/Checkers/SimpleStreamChecker.cpp +++ clang/lib/StaticAnalyzer/Checkers/SimpleStreamChecker.cpp @@ -25,7 +25,7 @@ using namespace ento; namespace { -typedef SmallVector SymbolVector; +typedef SmallVector SymbolVector; struct StreamState { private: @@ -56,11 +56,10 @@ std::unique_ptr DoubleCloseBugType; std::unique_ptr LeakBugType; - void reportDoubleClose(SymbolRef FileDescSym, - const CallEvent &Call, + void reportDoubleClose(SymExprRef FileDescSym, const CallEvent &Call, CheckerContext &C) const; - void reportLeaks(ArrayRef LeakedStreams, CheckerContext &C, + void reportLeaks(ArrayRef LeakedStreams, CheckerContext &C, ExplodedNode *ErrNode) const; bool guaranteedNotToCloseFile(const CallEvent &Call) const; @@ -86,7 +85,7 @@ /// The state of the checker is a map from tracked stream symbols to their /// state. Let's store it in the ProgramState. -REGISTER_MAP_WITH_PROGRAMSTATE(StreamMap, SymbolRef, StreamState) +REGISTER_MAP_WITH_PROGRAMSTATE(StreamMap, SymExprRef, StreamState) namespace { class StopTrackingCallback final : public SymbolVisitor { @@ -95,7 +94,7 @@ StopTrackingCallback(ProgramStateRef st) : state(std::move(st)) {} ProgramStateRef getState() const { return state; } - bool VisitSymbol(SymbolRef sym) override { + bool VisitSymbol(SymExprRef sym) override { state = state->remove(sym); return true; } @@ -123,7 +122,7 @@ return; // Get the symbolic value corresponding to the file handle. - SymbolRef FileDesc = Call.getReturnValue().getAsSymbol(); + SymExprRef FileDesc = Call.getReturnValue().getAsSymbol(); if (!FileDesc) return; @@ -142,7 +141,7 @@ return; // Get the symbolic value corresponding to the file handle. - SymbolRef FileDesc = Call.getArgSVal(0).getAsSymbol(); + SymExprRef FileDesc = Call.getArgSVal(0).getAsSymbol(); if (!FileDesc) return; @@ -159,8 +158,8 @@ C.addTransition(State); } -static bool isLeaked(SymbolRef Sym, const StreamState &SS, - bool IsSymDead, ProgramStateRef State) { +static bool isLeaked(SymExprRef Sym, const StreamState &SS, bool IsSymDead, + ProgramStateRef State) { if (IsSymDead && SS.isOpened()) { // If a symbol is NULL, assume that fopen failed on this path. // A symbol should only be considered leaked if it is non-null. @@ -178,7 +177,7 @@ StreamMapTy TrackedStreams = State->get(); for (StreamMapTy::iterator I = TrackedStreams.begin(), E = TrackedStreams.end(); I != E; ++I) { - SymbolRef Sym = I->first; + SymExprRef Sym = I->first; bool IsSymDead = SymReaper.isDead(Sym); // Collect leaked symbols. @@ -196,7 +195,7 @@ reportLeaks(LeakedStreams, C, N); } -void SimpleStreamChecker::reportDoubleClose(SymbolRef FileDescSym, +void SimpleStreamChecker::reportDoubleClose(SymExprRef FileDescSym, const CallEvent &Call, CheckerContext &C) const { // We reached a bug, stop exploring the path here by generating a sink. @@ -213,12 +212,12 @@ C.emitReport(std::move(R)); } -void SimpleStreamChecker::reportLeaks(ArrayRef LeakedStreams, +void SimpleStreamChecker::reportLeaks(ArrayRef LeakedStreams, CheckerContext &C, ExplodedNode *ErrNode) const { // Attach bug reports to the leak node. // TODO: Identify the leaked file descriptor. - for (SymbolRef LeakedStream : LeakedStreams) { + for (SymExprRef LeakedStream : LeakedStreams) { auto R = std::make_unique( *LeakBugType, "Opened file is never closed; potential resource leak", ErrNode); @@ -257,7 +256,7 @@ for (InvalidatedSymbols::const_iterator I = Escaped.begin(), E = Escaped.end(); I != E; ++I) { - SymbolRef Sym = *I; + SymExprRef Sym = *I; // The symbol escaped. Optimistically, assume that the corresponding file // handle will be closed somewhere else. Index: clang/lib/StaticAnalyzer/Checkers/StreamChecker.cpp =================================================================== --- clang/lib/StaticAnalyzer/Checkers/StreamChecker.cpp +++ clang/lib/StaticAnalyzer/Checkers/StreamChecker.cpp @@ -341,7 +341,7 @@ /// Emit resource leak warnings for the given symbols. /// Createn a non-fatal error node for these, and returns it (if any warnings /// were generated). Return value is non-null. - ExplodedNode *reportLeaks(const SmallVector &LeakedSyms, + ExplodedNode *reportLeaks(const SmallVector &LeakedSyms, CheckerContext &C, ExplodedNode *Pred) const; /// Find the description data of the function called by a call event. @@ -364,7 +364,7 @@ /// marked as interesting by the actual bug report. struct NoteFn { const CheckerNameRef CheckerName; - SymbolRef StreamSym; + SymExprRef StreamSym; std::string Message; std::string operator()(PathSensitiveBugReport &BR) const { @@ -376,7 +376,7 @@ } }; - const NoteTag *constructNoteTag(CheckerContext &C, SymbolRef StreamSym, + const NoteTag *constructNoteTag(CheckerContext &C, SymExprRef StreamSym, const std::string &Message) const { return C.getNoteTag(NoteFn{getCheckerName(), StreamSym, Message}); } @@ -384,13 +384,13 @@ /// Searches for the ExplodedNode where the file descriptor was acquired for /// StreamSym. static const ExplodedNode *getAcquisitionSite(const ExplodedNode *N, - SymbolRef StreamSym, + SymExprRef StreamSym, CheckerContext &C); }; } // end anonymous namespace -REGISTER_MAP_WITH_PROGRAMSTATE(StreamMap, SymbolRef, StreamState) +REGISTER_MAP_WITH_PROGRAMSTATE(StreamMap, SymExprRef, StreamState) inline void assertStreamStateOpened(const StreamState *SS) { assert(SS->isOpened() && @@ -398,7 +398,7 @@ } const ExplodedNode *StreamChecker::getAcquisitionSite(const ExplodedNode *N, - SymbolRef StreamSym, + SymExprRef StreamSym, CheckerContext &C) { ProgramStateRef State = N->getState(); // When bug type is resource leak, exploded node N may not have state info @@ -447,7 +447,7 @@ return; DefinedSVal RetVal = makeRetVal(C, CE); - SymbolRef RetSym = RetVal.getAsSymbol(); + SymExprRef RetSym = RetVal.getAsSymbol(); assert(RetSym && "RetVal must be a symbol here."); State = State->BindExpr(CE, C.getLocationContext(), RetVal); @@ -493,7 +493,7 @@ if (!StreamVal) return; - SymbolRef StreamSym = StreamVal->getAsSymbol(); + SymExprRef StreamSym = StreamVal->getAsSymbol(); // Do not care about concrete values for stream ("(FILE *)0x12345"?). // FIXME: Can be stdin, stdout, stderr such values? if (!StreamSym) @@ -527,7 +527,7 @@ void StreamChecker::evalFclose(const FnDescription *Desc, const CallEvent &Call, CheckerContext &C) const { ProgramStateRef State = C.getState(); - SymbolRef Sym = getStreamArg(Desc, Call).getAsSymbol(); + SymExprRef Sym = getStreamArg(Desc, Call).getAsSymbol(); if (!Sym) return; @@ -559,7 +559,7 @@ if (!State) return; - SymbolRef Sym = StreamVal.getAsSymbol(); + SymExprRef Sym = StreamVal.getAsSymbol(); if (Sym && State->get(Sym)) { const StreamState *SS = State->get(Sym); if (SS->ErrorState & ErrorFEof) @@ -590,7 +590,7 @@ const CallEvent &Call, CheckerContext &C, bool IsFread) const { ProgramStateRef State = C.getState(); - SymbolRef StreamSym = getStreamArg(Desc, Call).getAsSymbol(); + SymExprRef StreamSym = getStreamArg(Desc, Call).getAsSymbol(); if (!StreamSym) return; @@ -687,7 +687,7 @@ void StreamChecker::evalFseek(const FnDescription *Desc, const CallEvent &Call, CheckerContext &C) const { ProgramStateRef State = C.getState(); - SymbolRef StreamSym = getStreamArg(Desc, Call).getAsSymbol(); + SymExprRef StreamSym = getStreamArg(Desc, Call).getAsSymbol(); if (!StreamSym) return; @@ -729,7 +729,7 @@ const CallEvent &Call, CheckerContext &C) const { ProgramStateRef State = C.getState(); - SymbolRef StreamSym = getStreamArg(Desc, Call).getAsSymbol(); + SymExprRef StreamSym = getStreamArg(Desc, Call).getAsSymbol(); if (!StreamSym) return; @@ -750,7 +750,7 @@ const CallEvent &Call, CheckerContext &C, const StreamErrorState &ErrorKind) const { ProgramStateRef State = C.getState(); - SymbolRef StreamSym = getStreamArg(Desc, Call).getAsSymbol(); + SymExprRef StreamSym = getStreamArg(Desc, Call).getAsSymbol(); if (!StreamSym) return; @@ -804,7 +804,7 @@ const CallEvent &Call, CheckerContext &C, const StreamErrorState &ErrorKind) const { ProgramStateRef State = C.getState(); - SymbolRef StreamSym = getStreamArg(Desc, Call).getAsSymbol(); + SymExprRef StreamSym = getStreamArg(Desc, Call).getAsSymbol(); assert(StreamSym && "Operation not permitted on non-symbolic stream value."); const StreamState *SS = State->get(StreamSym); assert(SS && "Stream should be tracked by the checker."); @@ -839,7 +839,7 @@ ProgramStateRef StreamChecker::ensureStreamOpened(SVal StreamVal, CheckerContext &C, ProgramStateRef State) const { - SymbolRef Sym = StreamVal.getAsSymbol(); + SymExprRef Sym = StreamVal.getAsSymbol(); if (!Sym) return State; @@ -889,7 +889,7 @@ "after a failed operation. " "Can cause undefined behavior."; - SymbolRef Sym = StreamVal.getAsSymbol(); + SymExprRef Sym = StreamVal.getAsSymbol(); if (!Sym) return State; @@ -964,13 +964,13 @@ } ExplodedNode * -StreamChecker::reportLeaks(const SmallVector &LeakedSyms, +StreamChecker::reportLeaks(const SmallVector &LeakedSyms, CheckerContext &C, ExplodedNode *Pred) const { ExplodedNode *Err = C.generateNonFatalErrorNode(C.getState(), Pred); if (!Err) return Pred; - for (SymbolRef LeakSym : LeakedSyms) { + for (SymExprRef LeakSym : LeakedSyms) { // Resource leaks can result in multiple warning that describe the same kind // of programming error: // void f() { @@ -1006,11 +1006,11 @@ CheckerContext &C) const { ProgramStateRef State = C.getState(); - llvm::SmallVector LeakedSyms; + llvm::SmallVector LeakedSyms; const StreamMapTy &Map = State->get(); for (const auto &I : Map) { - SymbolRef Sym = I.first; + SymExprRef Sym = I.first; const StreamState &SS = I.second; if (!SymReaper.isDead(Sym)) continue; @@ -1035,7 +1035,7 @@ if (Kind == PSK_DirectEscapeOnCall && Call->isInSystemHeader()) return State; - for (SymbolRef Sym : Escaped) { + for (SymExprRef Sym : Escaped) { // The symbol escaped. // From now the stream can be manipulated in unknown way to the checker, // it is not possible to handle it any more. Index: clang/lib/StaticAnalyzer/Checkers/Taint.h =================================================================== --- clang/lib/StaticAnalyzer/Checkers/Taint.h +++ clang/lib/StaticAnalyzer/Checkers/Taint.h @@ -36,7 +36,7 @@ TaintTagType Kind = TaintTagGeneric); /// Create a new state in which the symbol is marked as tainted. -LLVM_NODISCARD ProgramStateRef addTaint(ProgramStateRef State, SymbolRef Sym, +LLVM_NODISCARD ProgramStateRef addTaint(ProgramStateRef State, SymExprRef Sym, TaintTagType Kind = TaintTagGeneric); /// Create a new state in which the pointer represented by the region @@ -51,14 +51,14 @@ const MemRegion *R); LLVM_NODISCARD ProgramStateRef removeTaint(ProgramStateRef State, - SymbolRef Sym); + SymExprRef Sym); /// Create a new state in a which a sub-region of a given symbol is tainted. /// This might be necessary when referring to regions that can not have an /// individual symbol, e.g. if they are represented by the default binding of /// a LazyCompoundVal. LLVM_NODISCARD ProgramStateRef addPartialTaint( - ProgramStateRef State, SymbolRef ParentSym, const SubRegion *SubRegion, + ProgramStateRef State, SymExprRef ParentSym, const SubRegion *SubRegion, TaintTagType Kind = TaintTagGeneric); /// Check if the statement has a tainted value in the given state. @@ -71,7 +71,7 @@ TaintTagType Kind = TaintTagGeneric); /// Check if the symbol is tainted in the given state. -bool isTainted(ProgramStateRef State, SymbolRef Sym, +bool isTainted(ProgramStateRef State, SymExprRef Sym, TaintTagType Kind = TaintTagGeneric); /// Check if the pointer represented by the region is tainted in the given Index: clang/lib/StaticAnalyzer/Checkers/Taint.cpp =================================================================== --- clang/lib/StaticAnalyzer/Checkers/Taint.cpp +++ clang/lib/StaticAnalyzer/Checkers/Taint.cpp @@ -19,12 +19,12 @@ using namespace taint; // Fully tainted symbols. -REGISTER_MAP_WITH_PROGRAMSTATE(TaintMap, SymbolRef, TaintTagType) +REGISTER_MAP_WITH_PROGRAMSTATE(TaintMap, SymExprRef, TaintTagType) // Partially tainted symbols. REGISTER_MAP_FACTORY_WITH_PROGRAMSTATE(TaintedSubRegions, const SubRegion *, TaintTagType) -REGISTER_MAP_WITH_PROGRAMSTATE(DerivedSymTaint, SymbolRef, TaintedSubRegions) +REGISTER_MAP_WITH_PROGRAMSTATE(DerivedSymTaint, SymExprRef, TaintedSubRegions) void taint::printTaint(ProgramStateRef State, raw_ostream &Out, const char *NL, const char *Sep) { @@ -47,7 +47,7 @@ ProgramStateRef taint::addTaint(ProgramStateRef State, SVal V, TaintTagType Kind) { - SymbolRef Sym = V.getAsSymbol(); + SymExprRef Sym = V.getAsSymbol(); if (Sym) return addTaint(State, Sym, Kind); @@ -64,7 +64,7 @@ if (Optional binding = State->getStateManager().getStoreManager().getDefaultBinding( *LCV)) { - if (SymbolRef Sym = binding->getAsSymbol()) + if (SymExprRef Sym = binding->getAsSymbol()) return addPartialTaint(State, Sym, LCV->getRegion(), Kind); } } @@ -80,7 +80,7 @@ return State; } -ProgramStateRef taint::addTaint(ProgramStateRef State, SymbolRef Sym, +ProgramStateRef taint::addTaint(ProgramStateRef State, SymExprRef Sym, TaintTagType Kind) { // If this is a symbol cast, remove the cast before adding the taint. Taint // is cast agnostic. @@ -93,7 +93,7 @@ } ProgramStateRef taint::removeTaint(ProgramStateRef State, SVal V) { - SymbolRef Sym = V.getAsSymbol(); + SymExprRef Sym = V.getAsSymbol(); if (Sym) return removeTaint(State, Sym); @@ -107,7 +107,7 @@ return State; } -ProgramStateRef taint::removeTaint(ProgramStateRef State, SymbolRef Sym) { +ProgramStateRef taint::removeTaint(ProgramStateRef State, SymExprRef Sym) { // If this is a symbol cast, remove the cast before adding the taint. Taint // is cast agnostic. while (const SymbolCast *SC = dyn_cast(Sym)) @@ -119,7 +119,7 @@ } ProgramStateRef taint::addPartialTaint(ProgramStateRef State, - SymbolRef ParentSym, + SymExprRef ParentSym, const SubRegion *SubRegion, TaintTagType Kind) { // Ignore partial taint if the entire parent symbol is already tainted. @@ -148,7 +148,7 @@ } bool taint::isTainted(ProgramStateRef State, SVal V, TaintTagType Kind) { - if (SymbolRef Sym = V.getAsSymbol()) + if (SymExprRef Sym = V.getAsSymbol()) return isTainted(State, Sym, Kind); if (const MemRegion *Reg = V.getAsRegion()) return isTainted(State, Reg, Kind); @@ -175,7 +175,8 @@ return false; } -bool taint::isTainted(ProgramStateRef State, SymbolRef Sym, TaintTagType Kind) { +bool taint::isTainted(ProgramStateRef State, SymExprRef Sym, + TaintTagType Kind) { if (!Sym) return false; Index: clang/lib/StaticAnalyzer/Checkers/TaintTesterChecker.cpp =================================================================== --- clang/lib/StaticAnalyzer/Checkers/TaintTesterChecker.cpp +++ clang/lib/StaticAnalyzer/Checkers/TaintTesterChecker.cpp @@ -29,9 +29,8 @@ /// Given a pointer argument, get the symbol of the value it contains /// (points to). - SymbolRef getPointedToSymbol(CheckerContext &C, - const Expr* Arg, - bool IssueWarning = true) const; + SymExprRef getPointedToSymbol(CheckerContext &C, const Expr *Arg, + bool IssueWarning = true) const; public: void checkPostStmt(const Expr *E, CheckerContext &C) const; Index: clang/lib/StaticAnalyzer/Checkers/TestAfterDivZeroChecker.cpp =================================================================== --- clang/lib/StaticAnalyzer/Checkers/TestAfterDivZeroChecker.cpp +++ clang/lib/StaticAnalyzer/Checkers/TestAfterDivZeroChecker.cpp @@ -25,12 +25,12 @@ class ZeroState { private: - SymbolRef ZeroSymbol; + SymExprRef ZeroSymbol; unsigned BlockID; const StackFrameContext *SFC; public: - ZeroState(SymbolRef S, unsigned B, const StackFrameContext *SFC) + ZeroState(SymExprRef S, unsigned B, const StackFrameContext *SFC) : ZeroSymbol(S), BlockID(B), SFC(SFC) {} const StackFrameContext *getStackFrameContext() const { return SFC; } @@ -56,12 +56,12 @@ class DivisionBRVisitor : public BugReporterVisitor { private: - SymbolRef ZeroSymbol; + SymExprRef ZeroSymbol; const StackFrameContext *SFC; bool Satisfied; public: - DivisionBRVisitor(SymbolRef ZeroSymbol, const StackFrameContext *SFC) + DivisionBRVisitor(SymExprRef ZeroSymbol, const StackFrameContext *SFC) : ZeroSymbol(ZeroSymbol), SFC(SFC), Satisfied(false) {} void Profile(llvm::FoldingSetNodeID &ID) const override { @@ -142,7 +142,7 @@ } void TestAfterDivZeroChecker::setDivZeroMap(SVal Var, CheckerContext &C) const { - SymbolRef SR = Var.getAsSymbol(); + SymExprRef SR = Var.getAsSymbol(); if (!SR) return; @@ -154,7 +154,7 @@ bool TestAfterDivZeroChecker::hasDivZeroMap(SVal Var, const CheckerContext &C) const { - SymbolRef SR = Var.getAsSymbol(); + SymExprRef SR = Var.getAsSymbol(); if (!SR) return false; Index: clang/lib/StaticAnalyzer/Checkers/TrustNonnullChecker.cpp =================================================================== --- clang/lib/StaticAnalyzer/Checkers/TrustNonnullChecker.cpp +++ clang/lib/StaticAnalyzer/Checkers/TrustNonnullChecker.cpp @@ -34,11 +34,11 @@ /// (antecedent != 0) => (consequent != 0) /// These implications are then read during the evaluation of the assumption, /// and the appropriate antecedents are applied. -REGISTER_MAP_WITH_PROGRAMSTATE(NonNullImplicationMap, SymbolRef, SymbolRef) +REGISTER_MAP_WITH_PROGRAMSTATE(NonNullImplicationMap, SymExprRef, SymExprRef) /// The semantics is: /// (antecedent == 0) => (consequent == 0) -REGISTER_MAP_WITH_PROGRAMSTATE(NullImplicationMap, SymbolRef, SymbolRef) +REGISTER_MAP_WITH_PROGRAMSTATE(NullImplicationMap, SymExprRef, SymExprRef) namespace { @@ -65,12 +65,12 @@ ProgramStateRef evalAssume(ProgramStateRef State, SVal Cond, bool Assumption) const { - const SymbolRef CondS = Cond.getAsSymbol(); + const SymExprRef CondS = Cond.getAsSymbol(); if (!CondS || CondS->computeComplexity() > ComplexityThreshold) return State; for (auto B=CondS->symbol_begin(), E=CondS->symbol_end(); B != E; ++B) { - const SymbolRef Antecedent = *B; + const SymExprRef Antecedent = *B; State = addImplication(Antecedent, State, true); State = addImplication(Antecedent, State, false); } @@ -113,8 +113,8 @@ if (interfaceHasSuperclass(ID, "NSDictionary") && (Msg.getSelector() == ObjectForKeyedSubscriptSel || Msg.getSelector() == ObjectForKeySel)) { - SymbolRef ArgS = Msg.getArgSVal(0).getAsSymbol(); - SymbolRef RetS = Msg.getReturnValue().getAsSymbol(); + SymExprRef ArgS = Msg.getArgSVal(0).getAsSymbol(); + SymExprRef RetS = Msg.getReturnValue().getAsSymbol(); if (ArgS && RetS) { // Emulate an implication: the argument is non-null if @@ -146,7 +146,7 @@ template ProgramStateRef dropDeadFromGDM(SymbolReaper &SymReaper, ProgramStateRef State) const { - for (const std::pair &P : State->get()) + for (const std::pair &P : State->get()) if (!SymReaper.isLive(P.first) || !SymReaper.isLive(P.second)) State = State->remove(P.first); return State; @@ -210,13 +210,13 @@ /// If \p Negated is true, checks NullImplicationMap, and assumes /// the negation of \p Antecedent. /// Checks NonNullImplicationMap and assumes \p Antecedent otherwise. - ProgramStateRef addImplication(SymbolRef Antecedent, + ProgramStateRef addImplication(SymExprRef Antecedent, ProgramStateRef InputState, bool Negated) const { if (!InputState) return nullptr; SValBuilder &SVB = InputState->getStateManager().getSValBuilder(); - const SymbolRef *Consequent = + const SymExprRef *Consequent = Negated ? InputState->get(Antecedent) : InputState->get(Antecedent); if (!Consequent) Index: clang/lib/StaticAnalyzer/Core/BugReporter.cpp =================================================================== --- clang/lib/StaticAnalyzer/Core/BugReporter.cpp +++ clang/lib/StaticAnalyzer/Core/BugReporter.cpp @@ -300,7 +300,7 @@ SVal SV = N->getSVal(*I); // Check if the variable corresponding to the symbol is passed by value. - SymbolRef AS = SV.getAsLocSymbol(); + SymExprRef AS = SV.getAsLocSymbol(); if (AS == Sym) { return getMessageForArg(*I, ArgIndex); } @@ -311,7 +311,7 @@ if ((*I)->getType()->isVoidPointerType()) continue; SVal PSV = N->getState()->getSVal(Reg->getRegion()); - SymbolRef AS = PSV.getAsLocSymbol(); + SymExprRef AS = PSV.getAsLocSymbol(); if (AS == Sym) { return getMessageForArg(*I, ArgIndex); } @@ -320,7 +320,7 @@ // Check if we are returning the interesting symbol. SVal SV = N->getSVal(CE); - SymbolRef RetSym = SV.getAsLocSymbol(); + SymExprRef RetSym = SV.getAsLocSymbol(); if (RetSym == Sym) { return getMessageForReturn(CE); } @@ -2250,7 +2250,7 @@ "have, if it was already marked as interesting with a different kind!"); } -void PathSensitiveBugReport::markInteresting(SymbolRef sym, +void PathSensitiveBugReport::markInteresting(SymExprRef sym, bugreporter::TrackingKind TKind) { if (!sym) return; @@ -2311,7 +2311,7 @@ } Optional -PathSensitiveBugReport::getInterestingnessKind(SymbolRef sym) const { +PathSensitiveBugReport::getInterestingnessKind(SymExprRef sym) const { if (!sym) return None; // We don't currently consider metadata symbols to be interesting @@ -2341,7 +2341,7 @@ return getInterestingnessKind(V).hasValue(); } -bool PathSensitiveBugReport::isInteresting(SymbolRef sym) const { +bool PathSensitiveBugReport::isInteresting(SymExprRef sym) const { return getInterestingnessKind(sym).hasValue(); } Index: clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp =================================================================== --- clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp +++ clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp @@ -2827,7 +2827,7 @@ // Add constraints to the solver for (const auto &I : Constraints) { - const SymbolRef Sym = I.first; + const SymExprRef Sym = I.first; auto RangeIt = I.second.begin(); llvm::SMTExprRef SMTConstraints = SMTConv::getRangeExpr( @@ -2860,7 +2860,7 @@ // Add constraints if we don't have them yet for (auto const &C : NewCs) { - const SymbolRef &Sym = C.first; + const SymExprRef &Sym = C.first; if (!Constraints.contains(Sym)) { // This symbol is new, just add the constraint. Constraints = CF.add(Constraints, Sym, C.second); Index: clang/lib/StaticAnalyzer/Core/CallEvent.cpp =================================================================== --- clang/lib/StaticAnalyzer/Core/CallEvent.cpp +++ clang/lib/StaticAnalyzer/Core/CallEvent.cpp @@ -893,7 +893,7 @@ void AnyCXXConstructorCall::getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const { SVal V = getCXXThisVal(); - if (SymbolRef Sym = V.getAsSymbol(true)) + if (SymExprRef Sym = V.getAsSymbol(true)) ETraits->setTrait(Sym, RegionAndSymbolInvalidationTraits::TK_SuppressEscape); Values.push_back(V); @@ -1287,7 +1287,7 @@ // Otherwise, let's check if we know something about the type // inside of this class object. - if (SymbolRef ReceiverSym = getReceiverSVal().getAsSymbol()) { + if (SymExprRef ReceiverSym = getReceiverSVal().getAsSymbol()) { DynamicTypeInfo DTI = getClassObjectDynamicTypeInfo(getState(), ReceiverSym); if (DTI.isValid()) { Index: clang/lib/StaticAnalyzer/Core/ConstraintManager.cpp =================================================================== --- clang/lib/StaticAnalyzer/Core/ConstraintManager.cpp +++ clang/lib/StaticAnalyzer/Core/ConstraintManager.cpp @@ -23,14 +23,14 @@ ConstraintManager::~ConstraintManager() = default; static DefinedSVal getLocFromSymbol(const ProgramStateRef &State, - SymbolRef Sym) { + SymExprRef Sym) { const MemRegion *R = State->getStateManager().getRegionManager().getSymbolicRegion(Sym); return loc::MemRegionVal(R); } ConditionTruthVal ConstraintManager::checkNull(ProgramStateRef State, - SymbolRef Sym) { + SymExprRef Sym) { QualType Ty = Sym->getType(); DefinedSVal V = Loc::isLocType(Ty) ? getLocFromSymbol(State, Sym) : nonloc::SymbolVal(Sym); Index: clang/lib/StaticAnalyzer/Core/DynamicType.cpp =================================================================== --- clang/lib/StaticAnalyzer/Core/DynamicType.cpp +++ clang/lib/StaticAnalyzer/Core/DynamicType.cpp @@ -35,7 +35,7 @@ CastSet) // A map from Class object symbols to the most likely pointed-to type. -REGISTER_MAP_WITH_PROGRAMSTATE(DynamicClassObjectMap, clang::ento::SymbolRef, +REGISTER_MAP_WITH_PROGRAMSTATE(DynamicClassObjectMap, clang::ento::SymExprRef, clang::ento::DynamicTypeInfo) namespace clang { @@ -53,7 +53,7 @@ return DynamicTypeInfo(TR->getLocationType(), /*CanBeSub=*/false); if (const auto *SR = dyn_cast(MR)) { - SymbolRef Sym = SR->getSymbol(); + SymExprRef Sym = SR->getSymbol(); return DynamicTypeInfo(Sym->getType()); } @@ -91,7 +91,7 @@ } DynamicTypeInfo getClassObjectDynamicTypeInfo(ProgramStateRef State, - SymbolRef Sym) { + SymExprRef Sym) { const DynamicTypeInfo *DTI = State->get(Sym); return DTI ? *DTI : DynamicTypeInfo{}; } @@ -142,14 +142,14 @@ } ProgramStateRef setClassObjectDynamicTypeInfo(ProgramStateRef State, - SymbolRef Sym, + SymExprRef Sym, DynamicTypeInfo NewTy) { State = State->set(Sym, NewTy); return State; } ProgramStateRef setClassObjectDynamicTypeInfo(ProgramStateRef State, - SymbolRef Sym, QualType NewTy, + SymExprRef Sym, QualType NewTy, bool CanBeSubClassed) { return setClassObjectDynamicTypeInfo(State, Sym, DynamicTypeInfo(NewTy, CanBeSubClassed)); @@ -159,7 +159,7 @@ return SR.isLiveRegion(MR); } -static bool isLive(SymbolReaper &SR, SymbolRef Sym) { return SR.isLive(Sym); } +static bool isLive(SymbolReaper &SR, SymExprRef Sym) { return SR.isLive(Sym); } template static ProgramStateRef removeDeadImpl(ProgramStateRef State, SymbolReaper &SR) { Index: clang/lib/StaticAnalyzer/Core/Environment.cpp =================================================================== --- clang/lib/StaticAnalyzer/Core/Environment.cpp +++ clang/lib/StaticAnalyzer/Core/Environment.cpp @@ -154,7 +154,7 @@ public: MarkLiveCallback(SymbolReaper &symreaper) : SymReaper(symreaper) {} - bool VisitSymbol(SymbolRef sym) override { + bool VisitSymbol(SymExprRef sym) override { SymReaper.markLive(sym); return true; } Index: clang/lib/StaticAnalyzer/Core/ExprEngine.cpp =================================================================== --- clang/lib/StaticAnalyzer/Core/ExprEngine.cpp +++ clang/lib/StaticAnalyzer/Core/ExprEngine.cpp @@ -717,7 +717,7 @@ SymbolReaper SymReaper(SFC, ReferenceStmt, SymMgr, getStoreManager()); for (auto I : CleanedState->get()) { - if (SymbolRef Sym = I.second.getAsSymbol()) + if (SymExprRef Sym = I.second.getAsSymbol()) SymReaper.markLive(Sym); if (const MemRegion *MR = I.second.getAsRegion()) SymReaper.markLive(MR); @@ -1185,7 +1185,7 @@ const InvalidatedSymbols &getSymbols() const { return Symbols; } - bool VisitSymbol(SymbolRef Sym) override { + bool VisitSymbol(SymExprRef Sym) override { Symbols.insert(Sym); return true; } Index: clang/lib/StaticAnalyzer/Core/ExprEngineObjC.cpp =================================================================== --- clang/lib/StaticAnalyzer/Core/ExprEngineObjC.cpp +++ clang/lib/StaticAnalyzer/Core/ExprEngineObjC.cpp @@ -66,8 +66,8 @@ SVal V; if (hasElements) { - SymbolRef Sym = SymMgr.conjureSymbol(elem, LCtx, T, - currBldrCtx->blockCount()); + SymExprRef Sym = + SymMgr.conjureSymbol(elem, LCtx, T, currBldrCtx->blockCount()); V = svalBuilder.makeLoc(Sym); } else { V = svalBuilder.makeIntVal(0, T); Index: clang/lib/StaticAnalyzer/Core/MemRegion.cpp =================================================================== --- clang/lib/StaticAnalyzer/Core/MemRegion.cpp +++ clang/lib/StaticAnalyzer/Core/MemRegion.cpp @@ -314,7 +314,7 @@ ProfileRegion(ID, getOriginExpr(), getIndex(), superRegion); } -void SymbolicRegion::ProfileRegion(llvm::FoldingSetNodeID& ID, SymbolRef sym, +void SymbolicRegion::ProfileRegion(llvm::FoldingSetNodeID &ID, SymExprRef sym, const MemRegion *sreg) { ID.AddInteger(static_cast(MemRegion::SymbolicRegionKind)); ID.Add(sym); @@ -1133,11 +1133,11 @@ } /// getSymbolicRegion - Retrieve or create a "symbolic" memory region. -const SymbolicRegion *MemRegionManager::getSymbolicRegion(SymbolRef sym) { +const SymbolicRegion *MemRegionManager::getSymbolicRegion(SymExprRef sym) { return getSubRegion(sym, getUnknownRegion()); } -const SymbolicRegion *MemRegionManager::getSymbolicHeapRegion(SymbolRef Sym) { +const SymbolicRegion *MemRegionManager::getSymbolicHeapRegion(SymExprRef Sym) { return getSubRegion(Sym, getHeapRegion()); } @@ -1696,7 +1696,7 @@ // RegionAndSymbolInvalidationTraits //===----------------------------------------------------------------------===// -void RegionAndSymbolInvalidationTraits::setTrait(SymbolRef Sym, +void RegionAndSymbolInvalidationTraits::setTrait(SymExprRef Sym, InvalidationKinds IK) { SymTraitsMap[Sym] |= IK; } @@ -1710,7 +1710,7 @@ MRTraitsMap[MR] |= IK; } -bool RegionAndSymbolInvalidationTraits::hasTrait(SymbolRef Sym, +bool RegionAndSymbolInvalidationTraits::hasTrait(SymExprRef Sym, InvalidationKinds IK) const { const_symbol_iterator I = SymTraitsMap.find(Sym); if (I != SymTraitsMap.end()) Index: clang/lib/StaticAnalyzer/Core/ProgramState.cpp =================================================================== --- clang/lib/StaticAnalyzer/Core/ProgramState.cpp +++ clang/lib/StaticAnalyzer/Core/ProgramState.cpp @@ -273,7 +273,7 @@ // We only go into this branch if we can convert the APSInt value we have // to the type of T, which is not always the case (e.g. for void). if (!T.isNull() && (T->isIntegralOrEnumerationType() || Loc::isLocType(T))) { - if (SymbolRef sym = V.getAsSymbol()) { + if (SymExprRef sym = V.getAsSymbol()) { if (const llvm::APSInt *Int = getStateManager() .getConstraintManager() .getSymVal(this, sym)) { @@ -381,7 +381,7 @@ if (V.isConstant()) return false; - SymbolRef Sym = V.getAsSymbol(/* IncludeBaseRegion */ true); + SymExprRef Sym = V.getAsSymbol(/* IncludeBaseRegion */ true); if (!Sym) return ConditionTruthVal(); @@ -579,7 +579,7 @@ if (Optional X = val.getAs()) return scan(X->getLoc()); - if (SymbolRef Sym = val.getAsSymbol()) + if (SymExprRef Sym = val.getAsSymbol()) return scan(Sym); if (Optional X = val.getAs()) Index: clang/lib/StaticAnalyzer/Core/RangeConstraintManager.cpp =================================================================== --- clang/lib/StaticAnalyzer/Core/RangeConstraintManager.cpp +++ clang/lib/StaticAnalyzer/Core/RangeConstraintManager.cpp @@ -391,13 +391,13 @@ os << " }"; } -REGISTER_SET_FACTORY_WITH_PROGRAMSTATE(SymbolSet, SymbolRef) +REGISTER_SET_FACTORY_WITH_PROGRAMSTATE(SymbolSet, SymExprRef) namespace { class EquivalenceClass; } // end anonymous namespace -REGISTER_MAP_WITH_PROGRAMSTATE(ClassMap, SymbolRef, EquivalenceClass) +REGISTER_MAP_WITH_PROGRAMSTATE(ClassMap, SymExprRef, EquivalenceClass) REGISTER_MAP_WITH_PROGRAMSTATE(ClassMembers, EquivalenceClass, SymbolSet) REGISTER_MAP_WITH_PROGRAMSTATE(ConstraintRange, EquivalenceClass, RangeSet) @@ -433,12 +433,12 @@ public: /// Find equivalence class for the given symbol in the given state. LLVM_NODISCARD static inline EquivalenceClass find(ProgramStateRef State, - SymbolRef Sym); + SymExprRef Sym); /// Merge classes for the given symbols and return a new state. LLVM_NODISCARD static inline ProgramStateRef merge(BasicValueFactory &BV, RangeSet::Factory &F, ProgramStateRef State, - SymbolRef First, SymbolRef Second); + SymExprRef First, SymExprRef Second); // Merge this class with the given class and return a new state. LLVM_NODISCARD inline ProgramStateRef merge(BasicValueFactory &BV, RangeSet::Factory &F, @@ -455,7 +455,7 @@ LLVM_NODISCARD static inline ProgramStateRef markDisequal(BasicValueFactory &BV, RangeSet::Factory &F, - ProgramStateRef State, SymbolRef First, SymbolRef Second); + ProgramStateRef State, SymExprRef First, SymExprRef Second); LLVM_NODISCARD static inline ProgramStateRef markDisequal(BasicValueFactory &BV, RangeSet::Factory &F, ProgramStateRef State, EquivalenceClass First, @@ -464,14 +464,14 @@ markDisequal(BasicValueFactory &BV, RangeSet::Factory &F, ProgramStateRef State, EquivalenceClass Other) const; LLVM_NODISCARD static inline ClassSet - getDisequalClasses(ProgramStateRef State, SymbolRef Sym); + getDisequalClasses(ProgramStateRef State, SymExprRef Sym); LLVM_NODISCARD inline ClassSet getDisequalClasses(ProgramStateRef State) const; LLVM_NODISCARD inline ClassSet getDisequalClasses(DisequalityMapTy Map, ClassSet::Factory &Factory) const; LLVM_NODISCARD static inline Optional - areEqual(ProgramStateRef State, SymbolRef First, SymbolRef Second); + areEqual(ProgramStateRef State, SymExprRef First, SymExprRef Second); /// Check equivalence data for consistency. LLVM_NODISCARD LLVM_ATTRIBUTE_UNUSED static bool @@ -502,7 +502,7 @@ void Profile(llvm::FoldingSetNodeID &ID) const { Profile(ID, this->ID); } private: - /* implicit */ EquivalenceClass(SymbolRef Sym) + /* implicit */ EquivalenceClass(SymExprRef Sym) : ID(reinterpret_cast(Sym)) {} /// This function is intended to be used ONLY within the class. @@ -510,8 +510,8 @@ /// and should stay that way. /// In the current implementation, we use it to retrieve the only member /// of the trivial class. - SymbolRef getRepresentativeSymbol() const { - return reinterpret_cast(ID); + SymExprRef getRepresentativeSymbol() const { + return reinterpret_cast(ID); } static inline SymbolSet::Factory &getMembersFactory(ProgramStateRef State); @@ -539,7 +539,7 @@ } LLVM_NODISCARD inline const RangeSet *getConstraint(ProgramStateRef State, - SymbolRef Sym) { + SymExprRef Sym) { return getConstraint(State, EquivalenceClass::find(State, Sym)); } @@ -555,7 +555,7 @@ /// compared symbols. struct EqualityInfo { public: - SymbolRef Left, Right; + SymExprRef Left, Right; // true for equality and false for disequality. bool IsEquality = true; @@ -565,7 +565,7 @@ /// This function assumes the following expression Sym + Adjustment != Int. /// It is a default because the most widespread case of the equality check /// is (A == B) + 0 != 0. - static Optional extract(SymbolRef Sym, const llvm::APSInt &Int, + static Optional extract(SymExprRef Sym, const llvm::APSInt &Int, const llvm::APSInt &Adjustment) { // As of now, the only equality form supported is Sym + 0 != 0. if (!Int.isNullValue() || !Adjustment.isNullValue()) @@ -574,7 +574,7 @@ return extract(Sym); } /// Extract equality information from the given symbol. - static Optional extract(SymbolRef Sym) { + static Optional extract(SymExprRef Sym) { return EqualityExtractor().Visit(Sym); } @@ -716,7 +716,7 @@ return Inferrer.infer(Origin); } - RangeSet VisitSymExpr(SymbolRef Sym) { + RangeSet VisitSymExpr(SymExprRef Sym) { // If we got to this function, the actual type of the symbolic // expression is not supported for advanced inference. // In this case, we simply backoff to the default "let's simply @@ -750,7 +750,7 @@ } /// Infer range information from symbol in the context of the given type. - RangeSet inferAs(SymbolRef Sym, QualType DestType) { + RangeSet inferAs(SymExprRef Sym, QualType DestType) { QualType ActualType = Sym->getType(); // Check that we can reason about the symbol at all. if (ActualType->isIntegralOrEnumerationType() || @@ -762,7 +762,7 @@ return infer(DestType); } - RangeSet infer(SymbolRef Sym) { + RangeSet infer(SymExprRef Sym) { if (Optional ConstraintBasedRange = intersect( ValueFactory, RangeFactory, getConstraint(State, Sym), // If Sym is a difference of symbols A - B, then maybe we have range @@ -948,7 +948,7 @@ // symbol manually. This will allow us to support finding ranges of not // only negated SymSymExpr-type expressions, but also of other, simpler // expressions which we currently do not know how to negate. - Optional getRangeForNegatedSub(SymbolRef Sym) { + Optional getRangeForNegatedSub(SymExprRef Sym) { if (const SymSymExpr *SSE = dyn_cast(Sym)) { if (SSE->getOpcode() == BO_Sub) { QualType T = Sym->getType(); @@ -959,7 +959,7 @@ return llvm::None; SymbolManager &SymMgr = State->getSymbolManager(); - SymbolRef NegatedSym = + SymExprRef NegatedSym = SymMgr.getSymSymExpr(SSE->getRHS(), BO_Sub, SSE->getLHS(), T); if (const RangeSet *NegatedRange = getConstraint(State, NegatedSym)) { @@ -980,7 +980,7 @@ // It covers all possible combinations (see CmpOpTable description). // Note that `x` and `y` can also stand for subexpressions, // not only for actual symbols. - Optional getRangeForComparisonSymbol(SymbolRef Sym) { + Optional getRangeForComparisonSymbol(SymExprRef Sym) { const auto *SSE = dyn_cast(Sym); if (!SSE) return llvm::None; @@ -1054,7 +1054,7 @@ return llvm::None; } - Optional getRangeForEqualities(SymbolRef Sym) { + Optional getRangeForEqualities(SymExprRef Sym) { Optional Equality = EqualityInfo::extract(Sym); if (!Equality) @@ -1274,10 +1274,10 @@ bool canReasonAbout(SVal X) const override; - ConditionTruthVal checkNull(ProgramStateRef State, SymbolRef Sym) override; + ConditionTruthVal checkNull(ProgramStateRef State, SymExprRef Sym) override; const llvm::APSInt *getSymVal(ProgramStateRef State, - SymbolRef Sym) const override; + SymExprRef Sym) const override; ProgramStateRef removeDeadBindings(ProgramStateRef State, SymbolReaper &SymReaper) override; @@ -1289,57 +1289,57 @@ // Implementation for interface from RangedConstraintManager. //===------------------------------------------------------------------===// - ProgramStateRef assumeSymNE(ProgramStateRef State, SymbolRef Sym, + ProgramStateRef assumeSymNE(ProgramStateRef State, SymExprRef Sym, const llvm::APSInt &V, const llvm::APSInt &Adjustment) override; - ProgramStateRef assumeSymEQ(ProgramStateRef State, SymbolRef Sym, + ProgramStateRef assumeSymEQ(ProgramStateRef State, SymExprRef Sym, const llvm::APSInt &V, const llvm::APSInt &Adjustment) override; - ProgramStateRef assumeSymLT(ProgramStateRef State, SymbolRef Sym, + ProgramStateRef assumeSymLT(ProgramStateRef State, SymExprRef Sym, const llvm::APSInt &V, const llvm::APSInt &Adjustment) override; - ProgramStateRef assumeSymGT(ProgramStateRef State, SymbolRef Sym, + ProgramStateRef assumeSymGT(ProgramStateRef State, SymExprRef Sym, const llvm::APSInt &V, const llvm::APSInt &Adjustment) override; - ProgramStateRef assumeSymLE(ProgramStateRef State, SymbolRef Sym, + ProgramStateRef assumeSymLE(ProgramStateRef State, SymExprRef Sym, const llvm::APSInt &V, const llvm::APSInt &Adjustment) override; - ProgramStateRef assumeSymGE(ProgramStateRef State, SymbolRef Sym, + ProgramStateRef assumeSymGE(ProgramStateRef State, SymExprRef Sym, const llvm::APSInt &V, const llvm::APSInt &Adjustment) override; ProgramStateRef assumeSymWithinInclusiveRange( - ProgramStateRef State, SymbolRef Sym, const llvm::APSInt &From, + ProgramStateRef State, SymExprRef Sym, const llvm::APSInt &From, const llvm::APSInt &To, const llvm::APSInt &Adjustment) override; ProgramStateRef assumeSymOutsideInclusiveRange( - ProgramStateRef State, SymbolRef Sym, const llvm::APSInt &From, + ProgramStateRef State, SymExprRef Sym, const llvm::APSInt &From, const llvm::APSInt &To, const llvm::APSInt &Adjustment) override; private: RangeSet::Factory F; - RangeSet getRange(ProgramStateRef State, SymbolRef Sym); + RangeSet getRange(ProgramStateRef State, SymExprRef Sym); RangeSet getRange(ProgramStateRef State, EquivalenceClass Class); - RangeSet getSymLTRange(ProgramStateRef St, SymbolRef Sym, + RangeSet getSymLTRange(ProgramStateRef St, SymExprRef Sym, const llvm::APSInt &Int, const llvm::APSInt &Adjustment); - RangeSet getSymGTRange(ProgramStateRef St, SymbolRef Sym, + RangeSet getSymGTRange(ProgramStateRef St, SymExprRef Sym, const llvm::APSInt &Int, const llvm::APSInt &Adjustment); - RangeSet getSymLERange(ProgramStateRef St, SymbolRef Sym, + RangeSet getSymLERange(ProgramStateRef St, SymExprRef Sym, const llvm::APSInt &Int, const llvm::APSInt &Adjustment); RangeSet getSymLERange(llvm::function_ref RS, const llvm::APSInt &Int, const llvm::APSInt &Adjustment); - RangeSet getSymGERange(ProgramStateRef St, SymbolRef Sym, + RangeSet getSymGERange(ProgramStateRef St, SymExprRef Sym, const llvm::APSInt &Int, const llvm::APSInt &Adjustment); @@ -1348,20 +1348,20 @@ //===------------------------------------------------------------------===// ProgramStateRef trackEQ(RangeSet NewConstraint, ProgramStateRef State, - SymbolRef Sym, const llvm::APSInt &Int, + SymExprRef Sym, const llvm::APSInt &Int, const llvm::APSInt &Adjustment) { return track(NewConstraint, State, Sym, Int, Adjustment); } ProgramStateRef trackNE(RangeSet NewConstraint, ProgramStateRef State, - SymbolRef Sym, const llvm::APSInt &Int, + SymExprRef Sym, const llvm::APSInt &Int, const llvm::APSInt &Adjustment) { return track(NewConstraint, State, Sym, Int, Adjustment); } template ProgramStateRef track(RangeSet NewConstraint, ProgramStateRef State, - SymbolRef Sym, const llvm::APSInt &Int, + SymExprRef Sym, const llvm::APSInt &Int, const llvm::APSInt &Adjustment) { if (NewConstraint.isEmpty()) // This is an infeasible assumption. @@ -1385,13 +1385,13 @@ return trackDisequality(State, ToTrack.Left, ToTrack.Right); } - ProgramStateRef trackDisequality(ProgramStateRef State, SymbolRef LHS, - SymbolRef RHS) { + ProgramStateRef trackDisequality(ProgramStateRef State, SymExprRef LHS, + SymExprRef RHS) { return EquivalenceClass::markDisequal(getBasicVals(), F, State, LHS, RHS); } - ProgramStateRef trackEquality(ProgramStateRef State, SymbolRef LHS, - SymbolRef RHS) { + ProgramStateRef trackEquality(ProgramStateRef State, SymExprRef LHS, + SymExprRef RHS) { return EquivalenceClass::merge(getBasicVals(), F, State, LHS, RHS); } @@ -1420,7 +1420,7 @@ } LLVM_NODISCARD inline ProgramStateRef - setConstraint(ProgramStateRef State, SymbolRef Sym, RangeSet Constraint) { + setConstraint(ProgramStateRef State, SymExprRef Sym, RangeSet Constraint) { return setConstraint(State, EquivalenceClass::find(State, Sym), Constraint); } }; @@ -1444,7 +1444,7 @@ assert(!ClassMembers.isEmpty() && "Class must always have at least one member!"); - SymbolRef Representative = *ClassMembers.begin(); + SymExprRef Representative = *ClassMembers.begin(); Result = F.add(Result, Representative, ClassConstraint.second); } @@ -1456,7 +1456,7 @@ //===----------------------------------------------------------------------===// inline EquivalenceClass EquivalenceClass::find(ProgramStateRef State, - SymbolRef Sym) { + SymExprRef Sym) { // We store far from all Symbol -> Class mappings if (const EquivalenceClass *NontrivialClass = State->get(Sym)) return *NontrivialClass; @@ -1468,8 +1468,8 @@ inline ProgramStateRef EquivalenceClass::merge(BasicValueFactory &BV, RangeSet::Factory &F, ProgramStateRef State, - SymbolRef First, - SymbolRef Second) { + SymExprRef First, + SymExprRef Second) { EquivalenceClass FirstClass = find(State, First); EquivalenceClass SecondClass = find(State, Second); @@ -1570,7 +1570,7 @@ // 2. Merge members of the Other class into the current class. SymbolSet NewClassMembers = MyMembers; - for (SymbolRef Sym : OtherMembers) { + for (SymExprRef Sym : OtherMembers) { NewClassMembers = F.add(NewClassMembers, Sym); // *this is now the class for all these new symbols. Classes = CMF.add(Classes, Sym, *this); @@ -1644,8 +1644,8 @@ inline ProgramStateRef EquivalenceClass::markDisequal(BasicValueFactory &VF, RangeSet::Factory &RF, ProgramStateRef State, - SymbolRef First, - SymbolRef Second) { + SymExprRef First, + SymExprRef Second) { return markDisequal(VF, RF, State, find(State, First), find(State, Second)); } @@ -1717,8 +1717,8 @@ } inline Optional EquivalenceClass::areEqual(ProgramStateRef State, - SymbolRef FirstSym, - SymbolRef SecondSym) { + SymExprRef FirstSym, + SymExprRef SecondSym) { EquivalenceClass First = find(State, FirstSym); EquivalenceClass Second = find(State, SecondSym); @@ -1737,7 +1737,7 @@ } inline ClassSet EquivalenceClass::getDisequalClasses(ProgramStateRef State, - SymbolRef Sym) { + SymExprRef Sym) { return find(State, Sym).getDisequalClasses(State); } @@ -1760,7 +1760,7 @@ ClassMembersTy Members = State->get(); for (std::pair ClassMembersPair : Members) { - for (SymbolRef Member : ClassMembersPair.second) { + for (SymExprRef Member : ClassMembersPair.second) { // Every member of the class should have a mapping back to the class. if (find(State, Member) == ClassMembersPair.first) { continue; @@ -1846,7 +1846,7 @@ } ConditionTruthVal RangeConstraintManager::checkNull(ProgramStateRef State, - SymbolRef Sym) { + SymExprRef Sym) { const RangeSet *Ranges = getConstraint(State, Sym); // If we don't have any information about this symbol, it's underconstrained. @@ -1870,7 +1870,7 @@ } const llvm::APSInt *RangeConstraintManager::getSymVal(ProgramStateRef St, - SymbolRef Sym) const { + SymExprRef Sym) const { const RangeSet *T = getConstraint(St, Sym); return T ? T->getConcreteValue() : nullptr; } @@ -1952,8 +1952,8 @@ } // 2. We don't need to track classes for dead symbols. - for (std::pair SymbolClassPair : Map) { - SymbolRef Sym = SymbolClassPair.first; + for (std::pair SymbolClassPair : Map) { + SymExprRef Sym = SymbolClassPair.first; if (SymReaper.isDead(Sym)) { ClassMapChanged = true; @@ -1969,7 +1969,7 @@ SymbolSet LiveMembers = ClassMembersPair.second; bool MembersChanged = false; - for (SymbolRef Member : ClassMembersPair.second) { + for (SymExprRef Member : ClassMembersPair.second) { if (SymReaper.isDead(Member)) { MembersChanged = true; LiveMembers = SetFactory.remove(LiveMembers, Member); @@ -2016,7 +2016,7 @@ } RangeSet RangeConstraintManager::getRange(ProgramStateRef State, - SymbolRef Sym) { + SymExprRef Sym) { return SymbolicRangeInferrer::inferRange(getBasicVals(), F, State, Sym); } @@ -2038,7 +2038,7 @@ // UINT_MAX, 0, 1, and 2. ProgramStateRef -RangeConstraintManager::assumeSymNE(ProgramStateRef St, SymbolRef Sym, +RangeConstraintManager::assumeSymNE(ProgramStateRef St, SymExprRef Sym, const llvm::APSInt &Int, const llvm::APSInt &Adjustment) { // Before we do any real work, see if the value can even show up. @@ -2054,7 +2054,7 @@ } ProgramStateRef -RangeConstraintManager::assumeSymEQ(ProgramStateRef St, SymbolRef Sym, +RangeConstraintManager::assumeSymEQ(ProgramStateRef St, SymExprRef Sym, const llvm::APSInt &Int, const llvm::APSInt &Adjustment) { // Before we do any real work, see if the value can even show up. @@ -2070,7 +2070,7 @@ } RangeSet RangeConstraintManager::getSymLTRange(ProgramStateRef St, - SymbolRef Sym, + SymExprRef Sym, const llvm::APSInt &Int, const llvm::APSInt &Adjustment) { // Before we do any real work, see if the value can even show up. @@ -2098,7 +2098,7 @@ } ProgramStateRef -RangeConstraintManager::assumeSymLT(ProgramStateRef St, SymbolRef Sym, +RangeConstraintManager::assumeSymLT(ProgramStateRef St, SymExprRef Sym, const llvm::APSInt &Int, const llvm::APSInt &Adjustment) { RangeSet New = getSymLTRange(St, Sym, Int, Adjustment); @@ -2106,7 +2106,7 @@ } RangeSet RangeConstraintManager::getSymGTRange(ProgramStateRef St, - SymbolRef Sym, + SymExprRef Sym, const llvm::APSInt &Int, const llvm::APSInt &Adjustment) { // Before we do any real work, see if the value can even show up. @@ -2134,7 +2134,7 @@ } ProgramStateRef -RangeConstraintManager::assumeSymGT(ProgramStateRef St, SymbolRef Sym, +RangeConstraintManager::assumeSymGT(ProgramStateRef St, SymExprRef Sym, const llvm::APSInt &Int, const llvm::APSInt &Adjustment) { RangeSet New = getSymGTRange(St, Sym, Int, Adjustment); @@ -2142,7 +2142,7 @@ } RangeSet RangeConstraintManager::getSymGERange(ProgramStateRef St, - SymbolRef Sym, + SymExprRef Sym, const llvm::APSInt &Int, const llvm::APSInt &Adjustment) { // Before we do any real work, see if the value can even show up. @@ -2170,7 +2170,7 @@ } ProgramStateRef -RangeConstraintManager::assumeSymGE(ProgramStateRef St, SymbolRef Sym, +RangeConstraintManager::assumeSymGE(ProgramStateRef St, SymExprRef Sym, const llvm::APSInt &Int, const llvm::APSInt &Adjustment) { RangeSet New = getSymGERange(St, Sym, Int, Adjustment); @@ -2206,14 +2206,14 @@ } RangeSet RangeConstraintManager::getSymLERange(ProgramStateRef St, - SymbolRef Sym, + SymExprRef Sym, const llvm::APSInt &Int, const llvm::APSInt &Adjustment) { return getSymLERange([&] { return getRange(St, Sym); }, Int, Adjustment); } ProgramStateRef -RangeConstraintManager::assumeSymLE(ProgramStateRef St, SymbolRef Sym, +RangeConstraintManager::assumeSymLE(ProgramStateRef St, SymExprRef Sym, const llvm::APSInt &Int, const llvm::APSInt &Adjustment) { RangeSet New = getSymLERange(St, Sym, Int, Adjustment); @@ -2221,7 +2221,7 @@ } ProgramStateRef RangeConstraintManager::assumeSymWithinInclusiveRange( - ProgramStateRef State, SymbolRef Sym, const llvm::APSInt &From, + ProgramStateRef State, SymExprRef Sym, const llvm::APSInt &From, const llvm::APSInt &To, const llvm::APSInt &Adjustment) { RangeSet New = getSymGERange(State, Sym, From, Adjustment); if (New.isEmpty()) @@ -2231,7 +2231,7 @@ } ProgramStateRef RangeConstraintManager::assumeSymOutsideInclusiveRange( - ProgramStateRef State, SymbolRef Sym, const llvm::APSInt &From, + ProgramStateRef State, SymExprRef Sym, const llvm::APSInt &From, const llvm::APSInt &To, const llvm::APSInt &Adjustment) { RangeSet RangeLT = getSymLTRange(State, Sym, From, Adjustment); RangeSet RangeGT = getSymGTRange(State, Sym, To, Adjustment); @@ -2261,7 +2261,7 @@ SymbolSet ClassMembers = P.first.getClassMembers(State); // We can print the same constraint for every class member. - for (SymbolRef ClassMember : ClassMembers) { + for (SymExprRef ClassMember : ClassMembers) { if (First) { First = false; } else { Index: clang/lib/StaticAnalyzer/Core/RangedConstraintManager.cpp =================================================================== --- clang/lib/StaticAnalyzer/Core/RangedConstraintManager.cpp +++ clang/lib/StaticAnalyzer/Core/RangedConstraintManager.cpp @@ -21,7 +21,7 @@ RangedConstraintManager::~RangedConstraintManager() {} ProgramStateRef RangedConstraintManager::assumeSym(ProgramStateRef State, - SymbolRef Sym, + SymExprRef Sym, bool Assumption) { // Handle SymbolData. if (isa(Sym)) { @@ -55,7 +55,7 @@ SymbolManager &SymMgr = getSymbolManager(); QualType DiffTy = SymMgr.getContext().getPointerDiffType(); - SymbolRef Subtraction = + SymExprRef Subtraction = SymMgr.getSymSymExpr(SSE->getRHS(), BO_Sub, SSE->getLHS(), DiffTy); const llvm::APSInt &Zero = getBasicVals().getValue(0, DiffTy); @@ -69,7 +69,7 @@ SymbolManager &SymMgr = getSymbolManager(); QualType ExprType = SSE->getType(); - SymbolRef CanonicalEquality = + SymExprRef CanonicalEquality = SymMgr.getSymSymExpr(SSE->getLHS(), BO_EQ, SSE->getRHS(), ExprType); bool WasEqual = SSE->getOpcode() == BO_EQ; @@ -91,14 +91,14 @@ } ProgramStateRef RangedConstraintManager::assumeSymInclusiveRange( - ProgramStateRef State, SymbolRef Sym, const llvm::APSInt &From, + ProgramStateRef State, SymExprRef Sym, const llvm::APSInt &From, const llvm::APSInt &To, bool InRange) { // Get the type used for calculating wraparound. BasicValueFactory &BVF = getBasicVals(); APSIntType WraparoundType = BVF.getAPSIntType(Sym->getType()); llvm::APSInt Adjustment = WraparoundType.getZeroValue(); - SymbolRef AdjustedSym = Sym; + SymExprRef AdjustedSym = Sym; computeAdjustment(AdjustedSym, Adjustment); // Convert the right-hand side integer as necessary. @@ -120,7 +120,7 @@ ProgramStateRef RangedConstraintManager::assumeSymUnsupported(ProgramStateRef State, - SymbolRef Sym, bool Assumption) { + SymExprRef Sym, bool Assumption) { BasicValueFactory &BVF = getBasicVals(); QualType T = Sym->getType(); @@ -137,7 +137,7 @@ } ProgramStateRef RangedConstraintManager::assumeSymRel(ProgramStateRef State, - SymbolRef Sym, + SymExprRef Sym, BinaryOperator::Opcode Op, const llvm::APSInt &Int) { assert(BinaryOperator::isComparisonOp(Op) && @@ -201,7 +201,7 @@ } // end switch } -void RangedConstraintManager::computeAdjustment(SymbolRef &Sym, +void RangedConstraintManager::computeAdjustment(SymExprRef &Sym, llvm::APSInt &Adjustment) { // Is it a "($sym+constant1)" expression? if (const SymIntExpr *SE = dyn_cast(Sym)) { Index: clang/lib/StaticAnalyzer/Core/RegionStore.cpp =================================================================== --- clang/lib/StaticAnalyzer/Core/RegionStore.cpp +++ clang/lib/StaticAnalyzer/Core/RegionStore.cpp @@ -1032,7 +1032,7 @@ void InvalidateRegionsWorker::VisitBinding(SVal V) { // A symbol? Mark it touched by the invalidation. - if (SymbolRef Sym = V.getAsSymbol()) + if (SymExprRef Sym = V.getAsSymbol()) IS.insert(Sym); if (const MemRegion *R = V.getAsRegion()) { @@ -1716,7 +1716,7 @@ if (elemT->isScalarType()) { if (Ctx.getTypeSizeInChars(baseT) >= Ctx.getTypeSizeInChars(elemT)) { if (const Optional &V = B.getDirectBinding(superR)) { - if (SymbolRef parentSym = V->getAsSymbol()) + if (SymExprRef parentSym = V->getAsSymbol()) return svalBuilder.getDerivedRegionValueSymbolVal(parentSym, R); if (V->isUnknownOrUndef()) @@ -1781,7 +1781,7 @@ if (const Optional &D = B.getDefaultBinding(superR)) { const SVal &val = D.getValue(); - if (SymbolRef parentSym = val.getAsSymbol()) + if (SymExprRef parentSym = val.getAsSymbol()) return svalBuilder.getDerivedRegionValueSymbolVal(parentSym, R); if (val.isZeroConstant()) @@ -1927,7 +1927,7 @@ // Check if the super region has a default binding. if (const Optional &V = B.getDefaultBinding(superR)) { - if (SymbolRef parentSym = V->getAsSymbol()) + if (SymExprRef parentSym = V->getAsSymbol()) return svalBuilder.getDerivedRegionValueSymbolVal(parentSym, R); // Other cases: give up. Index: clang/lib/StaticAnalyzer/Core/SValBuilder.cpp =================================================================== --- clang/lib/StaticAnalyzer/Core/SValBuilder.cpp +++ clang/lib/StaticAnalyzer/Core/SValBuilder.cpp @@ -124,7 +124,7 @@ if (!SymbolManager::canSymbolicate(T)) return UnknownVal(); - SymbolRef sym = SymMgr.getRegionValueSymbol(region); + SymExprRef sym = SymMgr.getRegionValueSymbol(region); if (Loc::isLocType(T)) return loc::MemRegionVal(MemMgr.getSymbolicRegion(sym)); @@ -161,7 +161,7 @@ if (!SymbolManager::canSymbolicate(type)) return UnknownVal(); - SymbolRef sym = SymMgr.conjureSymbol(expr, LCtx, type, count, symbolTag); + SymExprRef sym = SymMgr.conjureSymbol(expr, LCtx, type, count, symbolTag); if (Loc::isLocType(type)) return loc::MemRegionVal(MemMgr.getSymbolicRegion(sym)); @@ -179,7 +179,7 @@ if (!SymbolManager::canSymbolicate(type)) return UnknownVal(); - SymbolRef sym = SymMgr.conjureSymbol(stmt, LCtx, type, visitCount); + SymExprRef sym = SymMgr.conjureSymbol(stmt, LCtx, type, visitCount); if (Loc::isLocType(type)) return loc::MemRegionVal(MemMgr.getSymbolicRegion(sym)); @@ -197,7 +197,7 @@ if (T->isNullPtrType()) return makeZeroVal(T); - SymbolRef sym = SymMgr.conjureSymbol(E, LCtx, T, VisitCount); + SymExprRef sym = SymMgr.conjureSymbol(E, LCtx, T, VisitCount); return loc::MemRegionVal(MemMgr.getSymbolicHeapRegion(sym)); } @@ -208,7 +208,7 @@ unsigned count) { assert(SymbolManager::canSymbolicate(type) && "Invalid metadata symbol type"); - SymbolRef sym = + SymExprRef sym = SymMgr.getMetadataSymbol(region, expr, type, LCtx, count, symbolTag); if (Loc::isLocType(type)) @@ -218,8 +218,8 @@ } DefinedOrUnknownSVal -SValBuilder::getDerivedRegionValueSymbolVal(SymbolRef parentSymbol, - const TypedValueRegion *region) { +SValBuilder::getDerivedRegionValueSymbolVal(SymExprRef parentSymbol, + const TypedValueRegion *region) { QualType T = region->getValueType(); if (T->isNullPtrType()) @@ -228,7 +228,7 @@ if (!SymbolManager::canSymbolicate(T)) return UnknownVal(); - SymbolRef sym = SymMgr.getDerivedSymbol(parentSymbol, region); + SymExprRef sym = SymMgr.getDerivedSymbol(parentSymbol, region); if (Loc::isLocType(T)) return loc::MemRegionVal(MemMgr.getSymbolicRegion(sym)); @@ -386,8 +386,8 @@ SVal SValBuilder::makeSymExprValNN(BinaryOperator::Opcode Op, NonLoc LHS, NonLoc RHS, QualType ResultTy) { - SymbolRef symLHS = LHS.getAsSymbol(); - SymbolRef symRHS = RHS.getAsSymbol(); + SymExprRef symLHS = LHS.getAsSymbol(); + SymExprRef symRHS = RHS.getAsSymbol(); // TODO: When the Max Complexity is reached, we should conjure a symbol // instead of generating an Unknown value and propagate the taint info to it. @@ -501,7 +501,7 @@ if (getContext().getTypeSize(castTy) >= getContext().getTypeSize(originalTy)) return evalCast(val, castTy, originalTy); - SymbolRef se = val.getAsSymbol(); + SymExprRef se = val.getAsSymbol(); if (!se) // Let evalCast handle non symbolic expressions. return evalCast(val, castTy, originalTy); @@ -546,7 +546,7 @@ !originalTy->isIntegralOrEnumerationType() && !originalTy->isMemberPointerType()) return UnknownVal(); - if (SymbolRef Sym = val.getAsSymbol(true)) { + if (SymExprRef Sym = val.getAsSymbol(true)) { BasicValueFactory &BVF = getBasicValueFactory(); // FIXME: If we had a state here, we could see if the symbol is known to // be zero, but we don't. Index: clang/lib/StaticAnalyzer/Core/SVals.cpp =================================================================== --- clang/lib/StaticAnalyzer/Core/SVals.cpp +++ clang/lib/StaticAnalyzer/Core/SVals.cpp @@ -43,7 +43,7 @@ bool SVal::hasConjuredSymbol() const { if (Optional SV = getAs()) { - SymbolRef sym = SV->getSymbol(); + SymExprRef sym = SV->getSymbol(); if (isa(sym)) return true; } @@ -51,7 +51,7 @@ if (Optional RV = getAs()) { const MemRegion *R = RV->getRegion(); if (const auto *SR = dyn_cast(R)) { - SymbolRef sym = SR->getSymbol(); + SymExprRef sym = SR->getSymbol(); if (isa(sym)) return true; } @@ -76,14 +76,14 @@ } /// If this SVal is a location (subclasses Loc) and wraps a symbol, -/// return that SymbolRef. Otherwise return 0. +/// return that SymExprRef. Otherwise return 0. /// /// Implicit casts (ex: void* -> char*) can turn Symbolic region into Element /// region. If that is the case, gets the underlining region. /// When IncludeBaseRegions is set to true and the SubRegion is non-symbolic, /// the first symbolic parent region is returned. -SymbolRef SVal::getAsLocSymbol(bool IncludeBaseRegions) const { - // FIXME: should we consider SymbolRef wrapped in CodeTextRegion? +SymExprRef SVal::getAsLocSymbol(bool IncludeBaseRegions) const { + // FIXME: should we consider SymExprRef wrapped in CodeTextRegion? if (Optional X = getAs()) return X->getLoc().getAsLocSymbol(IncludeBaseRegions); @@ -98,7 +98,7 @@ } /// Get the symbol in the SVal or its base region. -SymbolRef SVal::getLocSymbolInBase() const { +SymExprRef SVal::getLocSymbolInBase() const { Optional X = getAs(); if (!X) @@ -116,14 +116,14 @@ return nullptr; } -/// If this SVal wraps a symbol return that SymbolRef. +/// If this SVal wraps a symbol return that SymExprRef. /// Otherwise, return 0. /// /// Casts are ignored during lookup. /// \param IncludeBaseRegions The boolean that controls whether the search /// should continue to the base regions if the region is not symbolic. -SymbolRef SVal::getAsSymbol(bool IncludeBaseRegions) const { - // FIXME: should we consider SymbolRef wrapped in CodeTextRegion? +SymExprRef SVal::getAsSymbol(bool IncludeBaseRegions) const { + // FIXME: should we consider SymExprRef wrapped in CodeTextRegion? if (Optional X = getAs()) return X->getSymbol(); Index: clang/lib/StaticAnalyzer/Core/SimpleConstraintManager.cpp =================================================================== --- clang/lib/StaticAnalyzer/Core/SimpleConstraintManager.cpp +++ clang/lib/StaticAnalyzer/Core/SimpleConstraintManager.cpp @@ -57,7 +57,7 @@ // SymIntExprs. if (!canReasonAbout(Cond)) { // Just add the constraint to the expression without trying to simplify. - SymbolRef Sym = Cond.getAsSymbol(); + SymExprRef Sym = Cond.getAsSymbol(); assert(Sym); return assumeSymUnsupported(State, Sym, Assumption); } @@ -68,7 +68,7 @@ case nonloc::SymbolValKind: { nonloc::SymbolVal SV = Cond.castAs(); - SymbolRef Sym = SV.getSymbol(); + SymExprRef Sym = SV.getSymbol(); assert(Sym); return assumeSym(State, Sym, Assumption); } @@ -101,7 +101,7 @@ if (!canReasonAbout(Value)) { // Just add the constraint to the expression without trying to simplify. - SymbolRef Sym = Value.getAsSymbol(); + SymExprRef Sym = Value.getAsSymbol(); assert(Sym); return assumeSymInclusiveRange(State, Sym, From, To, InRange); } @@ -113,7 +113,7 @@ case nonloc::LocAsIntegerKind: case nonloc::SymbolValKind: { - if (SymbolRef Sym = Value.getAsSymbol()) + if (SymExprRef Sym = Value.getAsSymbol()) return assumeSymInclusiveRange(State, Sym, From, To, InRange); return State; } // end switch Index: clang/lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp =================================================================== --- clang/lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp +++ clang/lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp @@ -86,7 +86,7 @@ return makeLocAsInteger(LI->getLoc(), castSize); } - if (SymbolRef se = val.getAsSymbol()) { + if (SymExprRef se = val.getAsSymbol()) { QualType T = Context.getCanonicalType(se->getType()); // If types are the same or both are integers, ignore the cast. // FIXME: Remove this hack when we support symbolic truncation/extension. @@ -310,7 +310,7 @@ } // See if Sym is known to be a relation Rel with Bound. -static bool isInRelation(BinaryOperator::Opcode Rel, SymbolRef Sym, +static bool isInRelation(BinaryOperator::Opcode Rel, SymExprRef Sym, llvm::APSInt Bound, ProgramStateRef State) { SValBuilder &SVB = State->getStateManager().getSValBuilder(); SVal Result = @@ -327,7 +327,7 @@ // some manipulations can be performed without the risk of overflow. // assume() doesn't cause infinite recursion because we should be dealing // with simpler symbols on every recursive call. -static bool isWithinConstantOverflowBounds(SymbolRef Sym, +static bool isWithinConstantOverflowBounds(SymExprRef Sym, ProgramStateRef State) { SValBuilder &SVB = State->getStateManager().getSValBuilder(); BasicValueFactory &BV = SVB.getBasicValueFactory(); @@ -352,8 +352,8 @@ return (I <= Max) && (I >= -Max); } -static std::pair -decomposeSymbol(SymbolRef Sym, BasicValueFactory &BV) { +static std::pair +decomposeSymbol(SymExprRef Sym, BasicValueFactory &BV) { if (const auto *SymInt = dyn_cast(Sym)) if (BinaryOperator::isAdditiveOp(SymInt->getOpcode())) return std::make_pair(SymInt->getLHS(), @@ -369,9 +369,9 @@ // same signed integral type and no overflows occur (which should be checked // by the caller). static NonLoc doRearrangeUnchecked(ProgramStateRef State, - BinaryOperator::Opcode Op, - SymbolRef LSym, llvm::APSInt LInt, - SymbolRef RSym, llvm::APSInt RInt) { + BinaryOperator::Opcode Op, SymExprRef LSym, + llvm::APSInt LInt, SymExprRef RSym, + llvm::APSInt RInt) { SValBuilder &SVB = State->getStateManager().getSValBuilder(); BasicValueFactory &BV = SVB.getBasicValueFactory(); SymbolManager &SymMgr = SVB.getSymbolManager(); @@ -398,7 +398,7 @@ nonloc::ConcreteInt(RInt), ResultTy) .castAs(); - SymbolRef ResultSym = nullptr; + SymExprRef ResultSym = nullptr; BinaryOperator::Opcode ResultOp; llvm::APSInt ResultInt; if (BinaryOperator::isComparisonOp(Op)) { @@ -436,7 +436,7 @@ // comparison operator, both symbol and constant must be within constant // overflow bounds. static bool shouldRearrange(ProgramStateRef State, BinaryOperator::Opcode Op, - SymbolRef Sym, llvm::APSInt Int, QualType Ty) { + SymExprRef Sym, llvm::APSInt Int, QualType Ty) { return Sym->getType() == Ty && (!BinaryOperator::isComparisonOp(Op) || (isWithinConstantOverflowBounds(Sym, State) && @@ -461,7 +461,7 @@ if(!Opts.ShouldAggressivelySimplifyBinaryOperation) return None; - SymbolRef LSym = Lhs.getAsSymbol(); + SymExprRef LSym = Lhs.getAsSymbol(); if (!LSym) return None; @@ -485,7 +485,7 @@ if (!SingleTy->isSignedIntegerOrEnumerationType()) return None; - SymbolRef RSym = Rhs.getAsSymbol(); + SymExprRef RSym = Rhs.getAsSymbol(); if (!RSym || RSym->getType() != SingleTy) return None; @@ -576,7 +576,7 @@ // regions it doesn't matter that much because such comparisons would // most likely evaluate to concrete false anyway. FIXME: We might // still need to handle the non-comparison case. - if (SymbolRef lSym = lhs.getAsLocSymbol(true)) + if (SymExprRef lSym = lhs.getAsLocSymbol(true)) BasicVals.getAPSIntType(lSym->getType()).apply(i); else BasicVals.getAPSIntType(Context.VoidPtrTy).apply(i); @@ -663,7 +663,7 @@ } case nonloc::SymbolValKind: { // We only handle LHS as simple symbols or SymIntExprs. - SymbolRef Sym = lhs.castAs().getSymbol(); + SymExprRef Sym = lhs.castAs().getSymbol(); // LHS is a symbolic expression. if (const SymIntExpr *symIntExpr = dyn_cast(Sym)) { @@ -886,7 +886,7 @@ case loc::ConcreteIntKind: { // If one of the operands is a symbol and the other is a constant, // build an expression for use by the constraint manager. - if (SymbolRef rSym = rhs.getAsLocSymbol()) { + if (SymExprRef rSym = rhs.getAsLocSymbol()) { // We can only build expressions with symbols on the left, // so we need a reversible operator. if (!BinaryOperator::isComparisonOp(op) || op == BO_Cmp) @@ -936,7 +936,7 @@ if (Optional rInt = rhs.getAs()) { // If one of the operands is a symbol and the other is a constant, // build an expression for use by the constraint manager. - if (SymbolRef lSym = lhs.getAsLocSymbol(true)) { + if (SymExprRef lSym = lhs.getAsLocSymbol(true)) { if (BinaryOperator::isComparisonOp(op)) return MakeSymIntVal(lSym, op, rInt->getValue(), resultTy); return UnknownVal(); @@ -1094,8 +1094,8 @@ // At this point we're not going to get a good answer, but we can try // conjuring an expression instead. - SymbolRef LHSSym = lhs.getAsLocSymbol(); - SymbolRef RHSSym = rhs.getAsLocSymbol(); + SymExprRef LHSSym = lhs.getAsLocSymbol(); + SymExprRef RHSSym = rhs.getAsLocSymbol(); if (LHSSym && RHSSym) return makeNonLoc(LHSSym, op, RHSSym, resultTy); @@ -1233,7 +1233,7 @@ if (Optional X = V.getAs()) return &X->getValue(); - if (SymbolRef Sym = V.getAsSymbol()) + if (SymExprRef Sym = V.getAsSymbol()) return state->getConstraintManager().getSymVal(state, Sym); // FIXME: Add support for SymExprs. @@ -1253,20 +1253,18 @@ // time new constraints are added to the program state, which is the whole // point of simplifying, and for that very reason it's pointless to maintain // the same cache for the duration of the whole analysis. - llvm::DenseMap Cached; + llvm::DenseMap Cached; - static bool isUnchanged(SymbolRef Sym, SVal Val) { + static bool isUnchanged(SymExprRef Sym, SVal Val) { return Sym == Val.getAsSymbol(); } - SVal cache(SymbolRef Sym, SVal V) { + SVal cache(SymExprRef Sym, SVal V) { Cached[Sym] = V; return V; } - SVal skip(SymbolRef Sym) { - return cache(Sym, SVB.makeSymbolVal(Sym)); - } + SVal skip(SymExprRef Sym) { return cache(Sym, SVB.makeSymbolVal(Sym)); } public: Simplifier(ProgramStateRef State) @@ -1303,7 +1301,7 @@ // The usual conversion of $sym to &SymRegion{$sym}, as they have // the same meaning for Loc-type symbols, but the latter form // is preferred in SVal computations for being Loc itself. - if (SymbolRef Sym = LHS.getAsSymbol()) { + if (SymExprRef Sym = LHS.getAsSymbol()) { assert(Loc::isLocType(Sym->getType())); LHS = SVB.makeLoc(Sym); } @@ -1338,7 +1336,7 @@ S, SVB.evalBinOp(State, S->getOpcode(), LHS, RHS, S->getType())); } - SVal VisitSymExpr(SymbolRef S) { return nonloc::SymbolVal(S); } + SVal VisitSymExpr(SymExprRef S) { return nonloc::SymbolVal(S); } SVal VisitMemRegion(const MemRegion *R) { return loc::MemRegionVal(R); } Index: clang/lib/StaticAnalyzer/Core/Store.cpp =================================================================== --- clang/lib/StaticAnalyzer/Core/Store.cpp +++ clang/lib/StaticAnalyzer/Core/Store.cpp @@ -413,7 +413,7 @@ // from ints to floats. // TODO: What other combinations of types are affected? if (castTy->isFloatingType()) { - SymbolRef Sym = V.getAsSymbol(); + SymExprRef Sym = V.getAsSymbol(); if (Sym && !Sym->getType()->isFloatingType()) return UnknownVal(); } @@ -552,7 +552,7 @@ Store store, const MemRegion* R, SVal val) { - SymbolRef SymV = val.getAsLocSymbol(); + SymExprRef SymV = val.getAsLocSymbol(); if (!SymV || SymV != Sym) return true; Index: clang/lib/StaticAnalyzer/Core/SymbolManager.cpp =================================================================== --- clang/lib/StaticAnalyzer/Core/SymbolManager.cpp +++ clang/lib/StaticAnalyzer/Core/SymbolManager.cpp @@ -119,7 +119,7 @@ return *this; } -SymbolRef SymExpr::symbol_iterator::operator*() { +SymExprRef SymExpr::symbol_iterator::operator*() { assert(!itr.empty() && "attempting to dereference an 'end' iterator"); return itr.back(); } @@ -188,8 +188,8 @@ return cast(SD); } -const SymbolDerived* -SymbolManager::getDerivedSymbol(SymbolRef parentSymbol, +const SymbolDerived * +SymbolManager::getDerivedSymbol(SymExprRef parentSymbol, const TypedValueRegion *R) { llvm::FoldingSetNodeID profile; SymbolDerived::Profile(profile, parentSymbol, R); @@ -345,8 +345,8 @@ return false; } -void SymbolManager::addSymbolDependency(const SymbolRef Primary, - const SymbolRef Dependent) { +void SymbolManager::addSymbolDependency(const SymExprRef Primary, + const SymExprRef Dependent) { auto &dependencies = SymbolDependencies[Primary]; if (!dependencies) { dependencies = std::make_unique(); @@ -354,15 +354,15 @@ dependencies->push_back(Dependent); } -const SymbolRefSmallVectorTy *SymbolManager::getDependentSymbols( - const SymbolRef Primary) { +const SymbolRefSmallVectorTy * +SymbolManager::getDependentSymbols(const SymExprRef Primary) { SymbolDependTy::const_iterator I = SymbolDependencies.find(Primary); if (I == SymbolDependencies.end()) return nullptr; return I->second.get(); } -void SymbolReaper::markDependentsLive(SymbolRef sym) { +void SymbolReaper::markDependentsLive(SymExprRef sym) { // Do not mark dependents more then once. SymbolMapTy::iterator LI = TheLiving.find(sym); assert(LI != TheLiving.end() && "The primary symbol is not live."); @@ -379,7 +379,7 @@ } } -void SymbolReaper::markLive(SymbolRef sym) { +void SymbolReaper::markLive(SymExprRef sym) { TheLiving[sym] = NotProcessed; markDependentsLive(sym); } @@ -400,7 +400,7 @@ } } -void SymbolReaper::markInUse(SymbolRef sym) { +void SymbolReaper::markInUse(SymExprRef sym) { if (isa(sym)) MetadataInUse.insert(sym); } @@ -440,7 +440,7 @@ return false; } -bool SymbolReaper::isLive(SymbolRef sym) { +bool SymbolReaper::isLive(SymExprRef sym) { if (TheLiving.count(sym)) { markDependentsLive(sym); return true;