[clang][dataflow] Add transfer functions for data members and this pointers

[sgatev]

Summary

This is part of the implementation of the dataflow analysis framework.
See "[RFC] A dataflow analysis framework for Clang AST" on cfe-dev.

[sgatev]

Add missing include.

[ymandel]

Thanks!

clang/lib/Analysis/FlowSensitive/DataflowEnvironment.cpp

57

nit: invert the if and return?

clang/lib/Analysis/FlowSensitive/Transfer.cpp

144

nit: maybe comment to explain why we use this setting?

clang/unittests/Analysis/FlowSensitive/TransferTest.cpp

834

maybe dyn_cast with ASSERT? (or somesuch)

919

Why EXPECT here but ASSERT (as last line) in previous tests?

1040

dyn_cast and ASSERT (or somesuch)? I'd think that whether or not we have a registered this in the environment is something we want to test?

1059

why test a class distinct from a struct? Is there a meaningful difference between the two with regard to our model? if so, might it be worth instead testing explicit public vs private?

[xazax.hun]

clang/include/clang/Analysis/FlowSensitive/DataflowAnalysisContext.h

120

It feels a bit wrong to have a separate ThisPointeeLoc here. But as far as I understand, this is an artifact of the AST representation we have. I think a superior AST representation would have an implicit ParmVarDecl to represent this, so we would not need to do any special handling at all, the general code path would do the right thing. I think the C++ language, with the deducing this started its approach in this direction officially. I really hope someone will have the time to fix all the mess and get rid of all the unnecessary corner cases in the foreseeable future :)

clang/lib/Analysis/FlowSensitive/DataflowEnvironment.cpp

52

There might be an optimization opportunity for initValueInStorageLocation. If we initialize a class or struct, we will end up create locations for all of the fields recursively (unless self-referential) right? Actually, in many of the codebases we cannot even access many of those fields because they might be private/protected etc. Unfortunately, it might not be easy to query whether a field is accessible from this method, but I wonder if it is worth a TODO somewhere.

clang/lib/Analysis/FlowSensitive/Transfer.cpp

130

Nit: I got confused for a second what will happen in a loop. I wonder if createStorageLocation is better renamed to createOrGetStorageLocation to express the fact it will not always create a new location. But I don't have strong feelings about this, also feel free to defer to a later PR.

140–141

I wonder if we also want to create a non-null pointer value for these in the future so we can evaluate certain if statements.

clang/unittests/Analysis/FlowSensitive/TransferTest.cpp

813

I wonder if we can make the tests a bit more concise by merging some of them. E.g. we could have a single test with both a pointer, a reference, and a value param. Although I understand that some people like to keep most tests minimal, so feel free to ignore this.

1062

I'd love to see a test with multiple fields and a nested struct.

[sgatev]

Address reviewers' comments.

[sgatev]

Thank you both for the reviews!

clang/lib/Analysis/FlowSensitive/DataflowEnvironment.cpp

52

Right. I added a FIXME in initValueInStorageLocationUnlessSelfReferential.

57

I prefer to keep the block self-contained as we might end up adding code after the outer if statement.

clang/lib/Analysis/FlowSensitive/Transfer.cpp

130

Ack. I added a FIXME.

140–141

I added a FIXME.

clang/unittests/Analysis/FlowSensitive/TransferTest.cpp

813

I'll keep the tests separate for now, but I'll think about how to make them more concise.

919

My bad. I updated all tests to use ASSERT only where necessary.

1059

For completeness. Changing the isStructureOrClassType predicate in initValueInStorageLocationUnlessSelfReferential to isStructureType or isClassType should make one of these tests fail. I'll address public and private members in a follow up.

1062

I added a nested struct and an extra member.

[xazax.hun]

clang/unittests/Analysis/FlowSensitive/TransferTest.cpp

1034

A chained access would be nice, like Qux.Baz.

[sgatev]

Address reviewers' comments.

clang/include/clang/Analysis/FlowSensitive/DataflowAnalysisContext.h

public:
 
   /// Returns the storage location assigned to `E` or null if `E` has no
   /// assigned storage location.
   StorageLocation *getStorageLocation(const Expr &E) const {
     auto It = ExprToLoc.find(&E);
     return It == ExprToLoc.end() ? nullptr : It->second;
   }
 
+  /// Assigns `Loc` as the storage location of the `this` pointee.
+  ///
+  /// Requirements:
+  ///
+  ///  The `this` pointee must not be assigned a storage location.
+  void setThisPointeeStorageLocation(StorageLocation &Loc) {
+    assert(ThisPointeeLoc == nullptr);
+    ThisPointeeLoc = &Loc;
+  }
+
+  /// Returns the storage location assigned to the `this` pointee or null if the
+  /// `this` pointee has no assigned storage location.
+  StorageLocation *getThisPointeeStorageLocation() const {
+    return ThisPointeeLoc;
+  }
+
 private:
   // Storage for the state of a program.
   std::vector<std::unique_ptr<StorageLocation>> Locs;
   std::vector<std::unique_ptr<Value>> Vals;
 
   // Maps from program declarations and statements to storage locations that are
   // assigned to them. These assignments are global (aggregated across all basic
   // blocks) and are used to produce stable storage locations when the same
   // basic blocks are evaluated multiple times. The storage locations that are
   // in scope for a particular basic block are stored in `Environment`.
   llvm::DenseMap<const ValueDecl *, StorageLocation *> DeclToLoc;
   llvm::DenseMap<const Expr *, StorageLocation *> ExprToLoc;
 
-  // FIXME: Add `StorageLocation` for `this`.
+  StorageLocation *ThisPointeeLoc = nullptr;
 
   // FIXME: Add support for boolean expressions.
 };
 
 } // namespace dataflow
 } // namespace clang
 
 #endif // LLVM_CLANG_ANALYSIS_FLOWSENSITIVE_DATAFLOWANALYSISCONTEXT_H

clang/include/clang/Analysis/FlowSensitive/DataflowEnvironment.h

 //  program at given program points.
 //
 //===----------------------------------------------------------------------===//
 
 #ifndef LLVM_CLANG_ANALYSIS_FLOWSENSITIVE_DATAFLOWENVIRONMENT_H
 #define LLVM_CLANG_ANALYSIS_FLOWSENSITIVE_DATAFLOWENVIRONMENT_H
 
 #include "clang/AST/Decl.h"
+#include "clang/AST/DeclBase.h"
 #include "clang/AST/Expr.h"
 #include "clang/AST/Type.h"
 #include "clang/AST/TypeOrdering.h"
 #include "clang/Analysis/FlowSensitive/DataflowAnalysisContext.h"
 #include "clang/Analysis/FlowSensitive/DataflowLattice.h"
 #include "clang/Analysis/FlowSensitive/StorageLocation.h"
 #include "clang/Analysis/FlowSensitive/Value.h"
 #include "llvm/ADT/DenseMap.h"
 #include "llvm/ADT/DenseSet.h"
 
 namespace clang {
 namespace dataflow {
 
 /// Indicates what kind of indirections should be skipped past when retrieving
 /// storage locations or values.
 ///
 /// FIXME: Consider renaming this or replacing it with a more appropriate model.
 /// See the discussion in https://reviews.llvm.org/D116596 for context.
 enum class SkipPast {
   /// No indirections should be skipped past.
   None,
   /// An optional reference should be skipped past.
   Reference,
+  /// An optional reference should be skipped past, then an optional pointer
+  /// should be skipped past.
+  ReferenceThenPointer,
 };
 
 /// Holds the state of the program (store and heap) at a given program point.
 class Environment {
 public:
-  Environment(DataflowAnalysisContext &DACtx) : DACtx(&DACtx) {}
+  /// Creates an environment that uses `DACtx` to store objects that encompass
+  /// the state of a program.
+  explicit Environment(DataflowAnalysisContext &DACtx) : DACtx(&DACtx) {}
+
+  /// Creates an environment that uses `DACtx` to store objects that encompass
+  /// the state of a program.
+  ///
+  /// If `DeclCtx` is a function, initializes the environment with symbolic
+  /// representations of the function parameters.
+  ///
+  /// If `DeclCtx` is a non-static member function, initializes the environment
+  /// with a symbolic representation of the `this` pointee.
+  Environment(DataflowAnalysisContext &DACtx, const DeclContext &DeclCtx);
 
   bool operator==(const Environment &) const;
 
   LatticeJoinEffect join(const Environment &);
 
   /// Creates a storage location appropriate for `Type`. Does not assign a value
   /// to the returned storage location in the environment.
   ///
public:
   ///  `E` must not be assigned a storage location in the environment.
   void setStorageLocation(const Expr &E, StorageLocation &Loc);
 
   /// Returns the storage location assigned to `E` in the environment, applying
   /// the `SP` policy for skipping past indirections, or null if `E` isn't
   /// assigned a storage location in the environment.
   StorageLocation *getStorageLocation(const Expr &E, SkipPast SP) const;
 
+  /// Returns the storage location assigned to the `this` pointee in the
+  /// environment or null if the `this` pointee has no assigned storage location
+  /// in the environment.
+  StorageLocation *getThisPointeeStorageLocation() const;
+
   /// Creates a value appropriate for `Type`, assigns it to `Loc`, and returns
   /// it, if `Type` is supported, otherwise return null. If `Type` is a pointer
   /// or reference type, creates all the necessary storage locations and values
   /// for indirections until it finds a non-pointer/non-reference type.
   ///
   /// Requirements:
   ///
   ///  `Type` must not be null.

clang/lib/Analysis/FlowSensitive/DataflowEnvironment.cpp

 //===-- DataflowEnvironment.cpp ---------------------------------*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
 //  This file defines an Environment class that is used by dataflow analyses
 //  that run over Control-Flow Graphs (CFGs) to keep track of the state of the
 //  program at given program points.
 //
 //===----------------------------------------------------------------------===//
 
 #include "clang/Analysis/FlowSensitive/DataflowEnvironment.h"
 #include "clang/AST/Decl.h"
+#include "clang/AST/DeclCXX.h"
 #include "clang/AST/Type.h"
 #include "clang/Analysis/FlowSensitive/DataflowLattice.h"
 #include "clang/Analysis/FlowSensitive/StorageLocation.h"
 #include "clang/Analysis/FlowSensitive/Value.h"
 #include "llvm/ADT/DenseMap.h"
 #include "llvm/ADT/DenseSet.h"
 #include "llvm/Support/ErrorHandling.h"
 #include <memory>
llvm::DenseMap<K, V> intersectDenseMaps(const llvm::DenseMap<K, V> &Map1,
   for (auto &Entry : Map1) {
     auto It = Map2.find(Entry.first);
     if (It != Map2.end() && Entry.second == It->second)
       Result.insert({Entry.first, Entry.second});
   }
   return Result;
 }
 
+Environment::Environment(DataflowAnalysisContext &DACtx,
+                         const DeclContext &DeclCtx)
+    : Environment(DACtx) {
+  if (const auto *FuncDecl = dyn_cast<FunctionDecl>(&DeclCtx)) {
+    for (const auto *ParamDecl : FuncDecl->parameters()) {
+      assert(ParamDecl != nullptr);
+      auto &ParamLoc = createStorageLocation(*ParamDecl);
+      setStorageLocation(*ParamDecl, ParamLoc);
+      initValueInStorageLocation(ParamLoc, ParamDecl->getType());
+    }
+  }
+
+  if (const auto *MethodDecl = dyn_cast<CXXMethodDecl>(&DeclCtx)) {
+    if (!MethodDecl->isStatic()) {
+      QualType ThisPointeeType = MethodDecl->getThisObjectType();
+      // FIXME: Add support for union types.
+      if (!ThisPointeeType->isUnionType()) {
+        auto &ThisPointeeLoc = createStorageLocation(ThisPointeeType);
+        DACtx.setThisPointeeStorageLocation(ThisPointeeLoc);
+        initValueInStorageLocation(ThisPointeeLoc, ThisPointeeType);
+      }
+    }
+  }
+}
+
 bool Environment::operator==(const Environment &Other) const {
   assert(DACtx == Other.DACtx);
   return DeclToLoc == Other.DeclToLoc && LocToVal == Other.LocToVal;
 }
 
 LatticeJoinEffect Environment::join(const Environment &Other) {
   assert(DACtx == Other.DACtx);
 

 }
 
 StorageLocation *Environment::getStorageLocation(const Expr &E,
                                                  SkipPast SP) const {
   auto It = ExprToLoc.find(&E);
   return It == ExprToLoc.end() ? nullptr : &skip(*It->second, SP);
 }
 
+StorageLocation *Environment::getThisPointeeStorageLocation() const {
+  return DACtx->getThisPointeeStorageLocation();
+}
+
 void Environment::setValue(const StorageLocation &Loc, Value &Value) {
   LocToVal[&Loc] = &Value;
 }
 
 Value *Environment::getValue(const StorageLocation &Loc) const {
   auto It = LocToVal.find(&Loc);
   return It == LocToVal.end() ? nullptr : It->second;
 }
StorageLocation &Environment::skip(StorageLocation &Loc, SkipPast SP) const {
   case SkipPast::None:
     return Loc;
   case SkipPast::Reference:
     // References cannot be chained so we only need to skip past one level of
     // indirection.
     if (auto *Val = dyn_cast_or_null<ReferenceValue>(getValue(Loc)))
       return Val->getPointeeLoc();
     return Loc;
+  case SkipPast::ReferenceThenPointer:
+    StorageLocation &LocPastRef = skip(Loc, SkipPast::Reference);
+    if (auto *Val = dyn_cast_or_null<PointerValue>(getValue(LocPastRef)))
+      return Val->getPointeeLoc();
+    return LocPastRef;
   }
   llvm_unreachable("bad SkipPast kind");
 }
 
 const StorageLocation &Environment::skip(const StorageLocation &Loc,
                                          SkipPast SP) const {
   return skip(*const_cast<StorageLocation *>(&Loc), SP);
 }
 
 } // namespace dataflow
 } // namespace clang

clang/lib/Analysis/FlowSensitive/Transfer.cpp

if (S->getOpcode() == UO_Deref) {
       auto &Loc = Env.createStorageLocation(*S);
       Env.setStorageLocation(*S, Loc);
       Env.setValue(Loc, Env.takeOwnership(std::make_unique<ReferenceValue>(
                             SubExprVal->getPointeeLoc())));
     }
     // FIXME: Add support for UO_AddrOf, UO_LNot.
   }
 
+  void VisitCXXThisExpr(const CXXThisExpr *S) {
+    auto *ThisPointeeLoc = Env.getThisPointeeStorageLocation();
+    assert(ThisPointeeLoc != nullptr);
+
+    auto &Loc = Env.createStorageLocation(*S);
+    Env.setStorageLocation(*S, Loc);
+    Env.setValue(Loc, Env.takeOwnership(
+                          std::make_unique<PointerValue>(*ThisPointeeLoc)));
+  }
+
+  void VisitMemberExpr(const MemberExpr *S) {
+    ValueDecl *Member = S->getMemberDecl();
+    assert(Member != nullptr);
+
+    if (Member->isFunctionOrFunctionTemplate())
+      return;
+
+    auto *BaseLoc = cast_or_null<AggregateStorageLocation>(
+        Env.getStorageLocation(*S->getBase(), SkipPast::ReferenceThenPointer));
+    if (BaseLoc == nullptr)
+      return;
+
+    // FIXME: Add support for union types.
+    if (BaseLoc->getType()->isUnionType())
+      return;
+
+    auto &MemberLoc = BaseLoc->getChild(*Member);
+    if (MemberLoc.getType()->isReferenceType()) {
+      Env.setStorageLocation(*S, MemberLoc);
+    } else {
+      auto &Loc = Env.createStorageLocation(*S);
+      Env.setStorageLocation(*S, Loc);
+      Env.setValue(
+          Loc, Env.takeOwnership(std::make_unique<ReferenceValue>(MemberLoc)));
+    }
+  }
+
   // FIXME: Add support for:
   // - CallExpr
   // - CXXBindTemporaryExpr
   // - CXXBoolLiteralExpr
   // - CXXConstructExpr
   // - CXXFunctionalCastExpr
   // - CXXOperatorCallExpr
   // - CXXStaticCastExpr
-  // - CXXThisExpr
   // - MaterializeTemporaryExpr
-  // - MemberExpr
 
 private:
   void visitVarDecl(const VarDecl &D) {
     auto &Loc = Env.createStorageLocation(D);
     Env.setStorageLocation(D, Loc);
 
     const Expr *InitExpr = D.getInit();
     if (InitExpr == nullptr) {

clang/unittests/Analysis/FlowSensitive/TestingSupport.h

const FunctionDecl *F = ast_matchers::selectFirst<FunctionDecl>(
               .bind("target"),
           Context));
   ASSERT_TRUE(F != nullptr) << "Could not find target function.";
 
   auto CFCtx = ControlFlowContext::build(F, F->getBody(), &F->getASTContext());
   ASSERT_TRUE((bool)CFCtx) << "Could not build ControlFlowContext.";
 
   DataflowAnalysisContext DACtx;
-  Environment Env(DACtx);
+  Environment Env(DACtx, *F);
   auto Analysis = MakeAnalysis(Context, Env);
 
   llvm::Expected<llvm::DenseMap<const clang::Stmt *, std::string>>
       StmtToAnnotations = buildStatementToAnnotationMapping(F, AnnotatedCode);
   if (auto E = StmtToAnnotations.takeError()) {
     FAIL() << "Failed to build annotation map: "
            << llvm::toString(std::move(E));
     return;

clang/unittests/Analysis/FlowSensitive/TransferTest.cpp

static const ValueDecl *findValueDecl(ASTContext &ASTCtx,
   auto *const Result = ast_matchers::selectFirst<ValueDecl>("v", TargetNodes);
   assert(Result != nullptr);
   return Result;
 }
 
 TEST_F(TransferTest, IntVarDecl) {
   std::string Code = R"(
     void target() {
-      int foo;
+      int Foo;
       // [[p]]
     }
   )";
   runDataflow(
       Code, [](llvm::ArrayRef<
                    std::pair<std::string, DataflowAnalysisState<NoopLattice>>>
                    Results,
                ASTContext &ASTCtx) {
         ASSERT_THAT(Results, ElementsAre(Pair("p", _)));
         const Environment &Env = Results[0].second.Env;
 
-        const ValueDecl *FooDecl = findValueDecl(ASTCtx, "foo");
+        const ValueDecl *FooDecl = findValueDecl(ASTCtx, "Foo");
         ASSERT_THAT(FooDecl, NotNull());
 
         const StorageLocation *FooLoc =
             Env.getStorageLocation(*FooDecl, SkipPast::None);
         ASSERT_TRUE(isa_and_nonnull<ScalarStorageLocation>(FooLoc));
 
         const Value *FooVal = Env.getValue(*FooLoc);
         ASSERT_TRUE(isa_and_nonnull<IntegerValue>(FooVal));
       });
 }
 
 TEST_F(TransferTest, StructVarDecl) {
   std::string Code = R"(
-    struct Foo {
+    struct A {
       int Bar;
     };
 
     void target() {
-      Foo foo;
+      A Foo;
       // [[p]]
     }
   )";
   runDataflow(
       Code, [](llvm::ArrayRef<
                    std::pair<std::string, DataflowAnalysisState<NoopLattice>>>
                    Results,
                ASTContext &ASTCtx) {
         ASSERT_THAT(Results, ElementsAre(Pair("p", _)));
         const Environment &Env = Results[0].second.Env;
 
-        const ValueDecl *FooDecl = findValueDecl(ASTCtx, "foo");
+        const ValueDecl *FooDecl = findValueDecl(ASTCtx, "Foo");
         ASSERT_THAT(FooDecl, NotNull());
 
         ASSERT_TRUE(FooDecl->getType()->isStructureType());
         auto FooFields = FooDecl->getType()->getAsRecordDecl()->fields();
 
         FieldDecl *BarDecl = nullptr;
         for (FieldDecl *Field : FooFields) {
           if (Field->getNameAsString() == "Bar") {
runDataflow(
         const auto *FooVal = cast<StructValue>(Env.getValue(*FooLoc));
         const auto *BarVal = cast<IntegerValue>(&FooVal->getChild(*BarDecl));
         ASSERT_EQ(Env.getValue(*BarLoc), BarVal);
       });
 }
 
 TEST_F(TransferTest, ClassVarDecl) {
   std::string Code = R"(
-    class Foo {
+    class A {
       int Bar;
     };
 
     void target() {
-      Foo foo;
+      A Foo;
       // [[p]]
     }
   )";
   runDataflow(
       Code, [](llvm::ArrayRef<
                    std::pair<std::string, DataflowAnalysisState<NoopLattice>>>
                    Results,
                ASTContext &ASTCtx) {
         ASSERT_THAT(Results, ElementsAre(Pair("p", _)));
         const Environment &Env = Results[0].second.Env;
 
-        const ValueDecl *FooDecl = findValueDecl(ASTCtx, "foo");
+        const ValueDecl *FooDecl = findValueDecl(ASTCtx, "Foo");
         ASSERT_THAT(FooDecl, NotNull());
 
         ASSERT_TRUE(FooDecl->getType()->isClassType());
         auto FooFields = FooDecl->getType()->getAsRecordDecl()->fields();
 
         FieldDecl *BarDecl = nullptr;
         for (FieldDecl *Field : FooFields) {
           if (Field->getNameAsString() == "Bar") {
runDataflow(
         const auto *FooVal = cast<StructValue>(Env.getValue(*FooLoc));
         const auto *BarVal = cast<IntegerValue>(&FooVal->getChild(*BarDecl));
         ASSERT_EQ(Env.getValue(*BarLoc), BarVal);
       });
 }
 
 TEST_F(TransferTest, ReferenceVarDecl) {
   std::string Code = R"(
-    struct Foo {};
+    struct A {};
 
-    Foo& getFoo();
+    A &getA();
 
     void target() {
-      Foo& foo = getFoo();
+      A &Foo = getA();
       // [[p]]
     }
   )";
   runDataflow(
       Code, [](llvm::ArrayRef<
                    std::pair<std::string, DataflowAnalysisState<NoopLattice>>>
                    Results,
                ASTContext &ASTCtx) {
         ASSERT_THAT(Results, ElementsAre(Pair("p", _)));
         const Environment &Env = Results[0].second.Env;
 
-        const ValueDecl *FooDecl = findValueDecl(ASTCtx, "foo");
+        const ValueDecl *FooDecl = findValueDecl(ASTCtx, "Foo");
         ASSERT_THAT(FooDecl, NotNull());
 
         const StorageLocation *FooLoc =
             Env.getStorageLocation(*FooDecl, SkipPast::None);
         ASSERT_TRUE(isa_and_nonnull<ScalarStorageLocation>(FooLoc));
 
         const ReferenceValue *FooVal =
             cast<ReferenceValue>(Env.getValue(*FooLoc));
         const StorageLocation &FooPointeeLoc = FooVal->getPointeeLoc();
         ASSERT_TRUE(isa<AggregateStorageLocation>(&FooPointeeLoc));
 
         const Value *FooPointeeVal = Env.getValue(FooPointeeLoc);
         ASSERT_TRUE(isa_and_nonnull<StructValue>(FooPointeeVal));
       });
 }
 
 TEST_F(TransferTest, SelfReferentialReferenceVarDecl) {
   std::string Code = R"(
-    struct Foo;
+    struct A;
 
-    struct Baz {};
+    struct B {};
 
-    struct Bar {
-      Foo& FooRef;
-      Foo* FooPtr;
-      Baz& BazRef;
-      Baz* BazPtr;
+    struct C {
+      A &FooRef;
+      A *FooPtr;
+      B &BazRef;
+      B *BazPtr;
     };
 
-    struct Foo {
-      Bar& Bar;
+    struct A {
+      C &Bar;
     };
 
-    Foo& getFoo();
+    A &getA();
 
     void target() {
-      Foo& foo = getFoo();
+      A &Foo = getA();
       // [[p]]
     }
   )";
   runDataflow(Code, [](llvm::ArrayRef<std::pair<
                            std::string, DataflowAnalysisState<NoopLattice>>>
                            Results,
                        ASTContext &ASTCtx) {
     ASSERT_THAT(Results, ElementsAre(Pair("p", _)));
     const Environment &Env = Results[0].second.Env;
 
-    const ValueDecl *FooDecl = findValueDecl(ASTCtx, "foo");
+    const ValueDecl *FooDecl = findValueDecl(ASTCtx, "Foo");
     ASSERT_THAT(FooDecl, NotNull());
 
     ASSERT_TRUE(FooDecl->getType()->isReferenceType());
     ASSERT_TRUE(FooDecl->getType().getNonReferenceType()->isStructureType());
     const auto FooFields =
         FooDecl->getType().getNonReferenceType()->getAsRecordDecl()->fields();
 
     FieldDecl *BarDecl = nullptr;
const auto *BazPtrVal =
         cast<PointerValue>(&BarPointeeVal->getChild(*BazPtrDecl));
     const StorageLocation &BazPtrPointeeLoc = BazPtrVal->getPointeeLoc();
     ASSERT_THAT(Env.getValue(BazPtrPointeeLoc), NotNull());
   });
 }
 
 TEST_F(TransferTest, PointerVarDecl) {
   std::string Code = R"(
-    struct Foo {};
+    struct A {};
 
-    Foo* getFoo();
+    A *getA();
 
     void target() {
-      Foo* foo = getFoo();
+      A *Foo = getA();
       // [[p]]
     }
   )";
   runDataflow(
       Code, [](llvm::ArrayRef<
                    std::pair<std::string, DataflowAnalysisState<NoopLattice>>>
                    Results,
                ASTContext &ASTCtx) {
         ASSERT_THAT(Results, ElementsAre(Pair("p", _)));
         const Environment &Env = Results[0].second.Env;
 
-        const ValueDecl *FooDecl = findValueDecl(ASTCtx, "foo");
+        const ValueDecl *FooDecl = findValueDecl(ASTCtx, "Foo");
         ASSERT_THAT(FooDecl, NotNull());
 
         const StorageLocation *FooLoc =
             Env.getStorageLocation(*FooDecl, SkipPast::None);
         ASSERT_TRUE(isa_and_nonnull<ScalarStorageLocation>(FooLoc));
 
         const PointerValue *FooVal = cast<PointerValue>(Env.getValue(*FooLoc));
         const StorageLocation &FooPointeeLoc = FooVal->getPointeeLoc();
         ASSERT_TRUE(isa<AggregateStorageLocation>(&FooPointeeLoc));
 
         const Value *FooPointeeVal = Env.getValue(FooPointeeLoc);
         ASSERT_TRUE(isa_and_nonnull<StructValue>(FooPointeeVal));
       });
 }
 
 TEST_F(TransferTest, SelfReferentialPointerVarDecl) {
   std::string Code = R"(
-    struct Foo;
+    struct A;
 
-    struct Baz {};
+    struct B {};
 
-    struct Bar {
-      Foo& FooRef;
-      Foo* FooPtr;
-      Baz& BazRef;
-      Baz* BazPtr;
+    struct C {
+      A &FooRef;
+      A *FooPtr;
+      B &BazRef;
+      B *BazPtr;
     };
 
-    struct Foo {
-      Bar* Bar;
+    struct A {
+      C *Bar;
     };
 
-    Foo* getFoo();
+    A *getA();
 
     void target() {
-      Foo* foo = getFoo();
+      A *Foo = getA();
       // [[p]]
     }
   )";
   runDataflow(
       Code, [](llvm::ArrayRef<
                    std::pair<std::string, DataflowAnalysisState<NoopLattice>>>
                    Results,
                ASTContext &ASTCtx) {
         ASSERT_THAT(Results, ElementsAre(Pair("p", _)));
         const Environment &Env = Results[0].second.Env;
 
-        const ValueDecl *FooDecl = findValueDecl(ASTCtx, "foo");
+        const ValueDecl *FooDecl = findValueDecl(ASTCtx, "Foo");
         ASSERT_THAT(FooDecl, NotNull());
 
         ASSERT_TRUE(FooDecl->getType()->isPointerType());
         ASSERT_TRUE(FooDecl->getType()
                         ->getAs<PointerType>()
                         ->getPointeeType()
                         ->isStructureType());
         const auto FooFields = FooDecl->getType()
runDataflow(
             cast<PointerValue>(&BarPointeeVal->getChild(*BazPtrDecl));
         const StorageLocation &BazPtrPointeeLoc = BazPtrVal->getPointeeLoc();
         ASSERT_THAT(Env.getValue(BazPtrPointeeLoc), NotNull());
       });
 }
 
 TEST_F(TransferTest, JoinVarDecl) {
   std::string Code = R"(
-    void target(bool b) {
-      int foo;
+    void target(bool B) {
+      int Foo;
       // [[p1]]
-      if (b) {
-        int bar;
+      if (B) {
+        int Bar;
         // [[p2]]
       } else {
-        int baz;
+        int Baz;
         // [[p3]]
       }
       (void)0;
       // [[p4]]
     }
   )";
   runDataflow(Code, [](llvm::ArrayRef<std::pair<
                            std::string, DataflowAnalysisState<NoopLattice>>>
                            Results,
                        ASTContext &ASTCtx) {
     ASSERT_THAT(Results, ElementsAre(Pair("p4", _), Pair("p3", _),
                                      Pair("p2", _), Pair("p1", _)));
-    const ValueDecl *FooDecl = findValueDecl(ASTCtx, "foo");
+    const ValueDecl *FooDecl = findValueDecl(ASTCtx, "Foo");
     ASSERT_THAT(FooDecl, NotNull());
 
-    const ValueDecl *BarDecl = findValueDecl(ASTCtx, "bar");
+    const ValueDecl *BarDecl = findValueDecl(ASTCtx, "Bar");
     ASSERT_THAT(BarDecl, NotNull());
 
-    const ValueDecl *BazDecl = findValueDecl(ASTCtx, "baz");
+    const ValueDecl *BazDecl = findValueDecl(ASTCtx, "Baz");
     ASSERT_THAT(BazDecl, NotNull());
 
     const Environment &Env1 = Results[3].second.Env;
     const StorageLocation *FooLoc =
         Env1.getStorageLocation(*FooDecl, SkipPast::None);
     ASSERT_THAT(FooLoc, NotNull());
     ASSERT_THAT(Env1.getStorageLocation(*BarDecl, SkipPast::None), IsNull());
     ASSERT_THAT(Env1.getStorageLocation(*BazDecl, SkipPast::None), IsNull());
runDataflow(Code, [](llvm::ArrayRef<std::pair<
     ASSERT_THAT(Env4.getStorageLocation(*BarDecl, SkipPast::None), IsNull());
     ASSERT_THAT(Env4.getStorageLocation(*BazDecl, SkipPast::None), IsNull());
   });
 }
 
 TEST_F(TransferTest, BinaryOperatorAssign) {
   std::string Code = R"(
     void target() {
-      int foo;
-      int bar;
-      (bar) = (foo);
+      int Foo;
+      int Bar;
+      (Bar) = (Foo);
       // [[p]]
     }
   )";
   runDataflow(Code,
               [](llvm::ArrayRef<
                      std::pair<std::string, DataflowAnalysisState<NoopLattice>>>
                      Results,
                  ASTContext &ASTCtx) {
                 ASSERT_THAT(Results, ElementsAre(Pair("p", _)));
                 const Environment &Env = Results[0].second.Env;
 
-                const ValueDecl *FooDecl = findValueDecl(ASTCtx, "foo");
+                const ValueDecl *FooDecl = findValueDecl(ASTCtx, "Foo");
                 ASSERT_THAT(FooDecl, NotNull());
 
                 const Value *FooVal = Env.getValue(*FooDecl, SkipPast::None);
                 ASSERT_TRUE(isa_and_nonnull<IntegerValue>(FooVal));
 
-                const ValueDecl *BarDecl = findValueDecl(ASTCtx, "bar");
+                const ValueDecl *BarDecl = findValueDecl(ASTCtx, "Bar");
                 ASSERT_THAT(BarDecl, NotNull());
 
                 EXPECT_EQ(Env.getValue(*BarDecl, SkipPast::None), FooVal);
               });
 }
 
 TEST_F(TransferTest, VarDeclInitAssign) {
   std::string Code = R"(
     void target() {
-      int foo;
-      int bar = foo;
+      int Foo;
+      int Bar = Foo;
       // [[p]]
     }
   )";
   runDataflow(Code,
               [](llvm::ArrayRef<
                      std::pair<std::string, DataflowAnalysisState<NoopLattice>>>
                      Results,
                  ASTContext &ASTCtx) {
                 ASSERT_THAT(Results, ElementsAre(Pair("p", _)));
                 const Environment &Env = Results[0].second.Env;
 
-                const ValueDecl *FooDecl = findValueDecl(ASTCtx, "foo");
+                const ValueDecl *FooDecl = findValueDecl(ASTCtx, "Foo");
                 ASSERT_THAT(FooDecl, NotNull());
 
                 const Value *FooVal = Env.getValue(*FooDecl, SkipPast::None);
                 ASSERT_TRUE(isa_and_nonnull<IntegerValue>(FooVal));
 
-                const ValueDecl *BarDecl = findValueDecl(ASTCtx, "bar");
+                const ValueDecl *BarDecl = findValueDecl(ASTCtx, "Bar");
                 ASSERT_THAT(BarDecl, NotNull());
 
                 EXPECT_EQ(Env.getValue(*BarDecl, SkipPast::None), FooVal);
               });
 }
 
 TEST_F(TransferTest, VarDeclInitAssignChained) {
   std::string Code = R"(
     void target() {
-      int foo;
-      int bar;
-      int baz = (bar = foo);
+      int Foo;
+      int Bar;
+      int Baz = (Bar = Foo);
       // [[p]]
     }
   )";
   runDataflow(Code,
               [](llvm::ArrayRef<
                      std::pair<std::string, DataflowAnalysisState<NoopLattice>>>
                      Results,
                  ASTContext &ASTCtx) {
                 ASSERT_THAT(Results, ElementsAre(Pair("p", _)));
                 const Environment &Env = Results[0].second.Env;
 
-                const ValueDecl *FooDecl = findValueDecl(ASTCtx, "foo");
+                const ValueDecl *FooDecl = findValueDecl(ASTCtx, "Foo");
                 ASSERT_THAT(FooDecl, NotNull());
 
                 const Value *FooVal = Env.getValue(*FooDecl, SkipPast::None);
                 ASSERT_TRUE(isa_and_nonnull<IntegerValue>(FooVal));
 
-                const ValueDecl *BarDecl = findValueDecl(ASTCtx, "bar");
+                const ValueDecl *BarDecl = findValueDecl(ASTCtx, "Bar");
                 ASSERT_THAT(BarDecl, NotNull());
 
-                const ValueDecl *BazDecl = findValueDecl(ASTCtx, "baz");
+                const ValueDecl *BazDecl = findValueDecl(ASTCtx, "Baz");
                 ASSERT_THAT(BazDecl, NotNull());
 
                 EXPECT_EQ(Env.getValue(*BarDecl, SkipPast::None), FooVal);
                 EXPECT_EQ(Env.getValue(*BazDecl, SkipPast::None), FooVal);
               });
 }
 
 TEST_F(TransferTest, VarDeclInitAssignPtrDeref) {
   std::string Code = R"(
     void target() {
-      int foo;
-      int *bar;
-      *(bar) = foo;
-      int baz = *(bar);
+      int Foo;
+      int *Bar;
+      *(Bar) = Foo;
+      int Baz = *(Bar);
       // [[p]]
     }
   )";
   runDataflow(Code,
               [](llvm::ArrayRef<
                      std::pair<std::string, DataflowAnalysisState<NoopLattice>>>
                      Results,
                  ASTContext &ASTCtx) {
                 ASSERT_THAT(Results, ElementsAre(Pair("p", _)));
                 const Environment &Env = Results[0].second.Env;
 
-                const ValueDecl *FooDecl = findValueDecl(ASTCtx, "foo");
+                const ValueDecl *FooDecl = findValueDecl(ASTCtx, "Foo");
                 ASSERT_THAT(FooDecl, NotNull());
 
                 const Value *FooVal = Env.getValue(*FooDecl, SkipPast::None);
                 ASSERT_TRUE(isa_and_nonnull<IntegerValue>(FooVal));
 
-                const ValueDecl *BarDecl = findValueDecl(ASTCtx, "bar");
+                const ValueDecl *BarDecl = findValueDecl(ASTCtx, "Bar");
                 ASSERT_THAT(BarDecl, NotNull());
 
                 const auto *BarVal =
                     cast<PointerValue>(Env.getValue(*BarDecl, SkipPast::None));
                 EXPECT_EQ(Env.getValue(BarVal->getPointeeLoc()), FooVal);
 
-                const ValueDecl *BazDecl = findValueDecl(ASTCtx, "baz");
+                const ValueDecl *BazDecl = findValueDecl(ASTCtx, "Baz");
                 ASSERT_THAT(BazDecl, NotNull());
 
                 EXPECT_EQ(Env.getValue(*BazDecl, SkipPast::None), FooVal);
               });
 }
 
 TEST_F(TransferTest, AssignToAndFromReference) {
   std::string Code = R"(
     void target() {
-      int foo;
-      int bar;
-      int& baz = foo;
+      int Foo;
+      int Bar;
+      int &Baz = Foo;
       // [[p1]]
-      baz = bar;
-      int qux = baz;
-      int& quux = baz;
+      Baz = Bar;
+      int Qux = Baz;
+      int &Quux = Baz;
       // [[p2]]
     }
   )";
   runDataflow(
       Code, [](llvm::ArrayRef<
                    std::pair<std::string, DataflowAnalysisState<NoopLattice>>>
                    Results,
                ASTContext &ASTCtx) {
         ASSERT_THAT(Results, ElementsAre(Pair("p1", _), Pair("p2", _)));
         const Environment &Env1 = Results[0].second.Env;
         const Environment &Env2 = Results[1].second.Env;
 
-        const ValueDecl *FooDecl = findValueDecl(ASTCtx, "foo");
+        const ValueDecl *FooDecl = findValueDecl(ASTCtx, "Foo");
         ASSERT_THAT(FooDecl, NotNull());
 
         const Value *FooVal = Env1.getValue(*FooDecl, SkipPast::None);
         ASSERT_TRUE(isa_and_nonnull<IntegerValue>(FooVal));
 
-        const ValueDecl *BarDecl = findValueDecl(ASTCtx, "bar");
+        const ValueDecl *BarDecl = findValueDecl(ASTCtx, "Bar");
         ASSERT_THAT(BarDecl, NotNull());
 
         const Value *BarVal = Env1.getValue(*BarDecl, SkipPast::None);
         ASSERT_TRUE(isa_and_nonnull<IntegerValue>(BarVal));
 
-        const ValueDecl *BazDecl = findValueDecl(ASTCtx, "baz");
+        const ValueDecl *BazDecl = findValueDecl(ASTCtx, "Baz");
         ASSERT_THAT(BazDecl, NotNull());
 
         EXPECT_EQ(Env1.getValue(*BazDecl, SkipPast::Reference), FooVal);
 
         EXPECT_EQ(Env2.getValue(*BazDecl, SkipPast::Reference), BarVal);
         EXPECT_EQ(Env2.getValue(*FooDecl, SkipPast::None), BarVal);
 
-        const ValueDecl *QuxDecl = findValueDecl(ASTCtx, "qux");
+        const ValueDecl *QuxDecl = findValueDecl(ASTCtx, "Qux");
         ASSERT_THAT(QuxDecl, NotNull());
         EXPECT_EQ(Env2.getValue(*QuxDecl, SkipPast::None), BarVal);
 
-        const ValueDecl *QuuxDecl = findValueDecl(ASTCtx, "quux");
+        const ValueDecl *QuuxDecl = findValueDecl(ASTCtx, "Quux");
         ASSERT_THAT(QuuxDecl, NotNull());
         EXPECT_EQ(Env2.getValue(*QuuxDecl, SkipPast::Reference), BarVal);
       });
 }
 
+TEST_F(TransferTest, MultipleParamDecls) {
+  std::string Code = R"(
+    void target(int Foo, int Bar) {
+      (void)0;
+      // [[p]]
+    }
+  )";
+  runDataflow(Code,
+              [](llvm::ArrayRef<
+                     std::pair<std::string, DataflowAnalysisState<NoopLattice>>>
+                     Results,
+                 ASTContext &ASTCtx) {
+                ASSERT_THAT(Results, ElementsAre(Pair("p", _)));
+                const Environment &Env = Results[0].second.Env;
+
+                const ValueDecl *FooDecl = findValueDecl(ASTCtx, "Foo");
+                ASSERT_THAT(FooDecl, NotNull());
+
+                const StorageLocation *FooLoc =
+                    Env.getStorageLocation(*FooDecl, SkipPast::None);
+                ASSERT_TRUE(isa_and_nonnull<ScalarStorageLocation>(FooLoc));
+
+                const Value *FooVal = Env.getValue(*FooLoc);
+                ASSERT_TRUE(isa_and_nonnull<IntegerValue>(FooVal));
+
+                const ValueDecl *BarDecl = findValueDecl(ASTCtx, "Bar");
+                ASSERT_THAT(BarDecl, NotNull());
+
+                const StorageLocation *BarLoc =
+                    Env.getStorageLocation(*BarDecl, SkipPast::None);
+                ASSERT_TRUE(isa_and_nonnull<ScalarStorageLocation>(BarLoc));
+
+                const Value *BarVal = Env.getValue(*BarLoc);
+                ASSERT_TRUE(isa_and_nonnull<IntegerValue>(BarVal));
+              });
+}
+
+TEST_F(TransferTest, StructParamDecl) {
+  std::string Code = R"(
+    struct A {
+      int Bar;
+    };
+
+    void target(A Foo) {
+      (void)0;
+      // [[p]]
+    }
+  )";
+  runDataflow(
+      Code, [](llvm::ArrayRef<
+                   std::pair<std::string, DataflowAnalysisState<NoopLattice>>>
+                   Results,
+               ASTContext &ASTCtx) {
+        ASSERT_THAT(Results, ElementsAre(Pair("p", _)));
+        const Environment &Env = Results[0].second.Env;
+
+        const ValueDecl *FooDecl = findValueDecl(ASTCtx, "Foo");
+        ASSERT_THAT(FooDecl, NotNull());
+
+        ASSERT_TRUE(FooDecl->getType()->isStructureType());
+        auto FooFields = FooDecl->getType()->getAsRecordDecl()->fields();
+
+        FieldDecl *BarDecl = nullptr;
+        for (FieldDecl *Field : FooFields) {
+          if (Field->getNameAsString() == "Bar") {
+            BarDecl = Field;
+          } else {
+            FAIL() << "Unexpected field: " << Field->getNameAsString();
+          }
+        }
+        ASSERT_THAT(BarDecl, NotNull());
+
+        const auto *FooLoc = cast<AggregateStorageLocation>(
+            Env.getStorageLocation(*FooDecl, SkipPast::None));
+        const auto *BarLoc =
+            cast<ScalarStorageLocation>(&FooLoc->getChild(*BarDecl));
+
+        const auto *FooVal = cast<StructValue>(Env.getValue(*FooLoc));
+        const auto *BarVal = cast<IntegerValue>(&FooVal->getChild(*BarDecl));
+        ASSERT_EQ(Env.getValue(*BarLoc), BarVal);
+      });
+}
+
+TEST_F(TransferTest, ReferenceParamDecl) {
+  std::string Code = R"(
+    struct A {};
+
+    void target(A &Foo) {
+      (void)0;
+      // [[p]]
+    }
+  )";
+  runDataflow(Code,
+              [](llvm::ArrayRef<
+                     std::pair<std::string, DataflowAnalysisState<NoopLattice>>>
+                     Results,
+                 ASTContext &ASTCtx) {
+                ASSERT_THAT(Results, ElementsAre(Pair("p", _)));
+                const Environment &Env = Results[0].second.Env;
+
+                const ValueDecl *FooDecl = findValueDecl(ASTCtx, "Foo");
+                ASSERT_THAT(FooDecl, NotNull());
+
+                const StorageLocation *FooLoc =
+                    Env.getStorageLocation(*FooDecl, SkipPast::None);
+                ASSERT_TRUE(isa_and_nonnull<ScalarStorageLocation>(FooLoc));
+
+                const ReferenceValue *FooVal =
+                    cast<ReferenceValue>(Env.getValue(*FooLoc));
+                const StorageLocation &FooPointeeLoc = FooVal->getPointeeLoc();
+                ASSERT_TRUE(isa<AggregateStorageLocation>(&FooPointeeLoc));
+
+                const Value *FooPointeeVal = Env.getValue(FooPointeeLoc);
+                ASSERT_TRUE(isa_and_nonnull<StructValue>(FooPointeeVal));
+              });
+}
+
+TEST_F(TransferTest, PointerParamDecl) {
+  std::string Code = R"(
+    struct A {};
+
+    void target(A *Foo) {
+      (void)0;
+      // [[p]]
+    }
+  )";
+  runDataflow(
+      Code, [](llvm::ArrayRef<
+                   std::pair<std::string, DataflowAnalysisState<NoopLattice>>>
+                   Results,
+               ASTContext &ASTCtx) {
+        ASSERT_THAT(Results, ElementsAre(Pair("p", _)));
+        const Environment &Env = Results[0].second.Env;
+
+        const ValueDecl *FooDecl = findValueDecl(ASTCtx, "Foo");
+        ASSERT_THAT(FooDecl, NotNull());
+
+        const StorageLocation *FooLoc =
+            Env.getStorageLocation(*FooDecl, SkipPast::None);
+        ASSERT_TRUE(isa_and_nonnull<ScalarStorageLocation>(FooLoc));
+
+        const PointerValue *FooVal = cast<PointerValue>(Env.getValue(*FooLoc));
+        const StorageLocation &FooPointeeLoc = FooVal->getPointeeLoc();
+        ASSERT_TRUE(isa<AggregateStorageLocation>(&FooPointeeLoc));
+
+        const Value *FooPointeeVal = Env.getValue(FooPointeeLoc);
+        ASSERT_TRUE(isa_and_nonnull<StructValue>(FooPointeeVal));
+      });
+}
+
+TEST_F(TransferTest, StructMember) {
+  std::string Code = R"(
+    struct A {
+      int Bar;
+    };
+
+    void target(A Foo) {
+      int Baz = Foo.Bar;
+      // [[p]]
+    }
+  )";
+  runDataflow(
+      Code, [](llvm::ArrayRef<
+                   std::pair<std::string, DataflowAnalysisState<NoopLattice>>>
+                   Results,
+               ASTContext &ASTCtx) {
+        ASSERT_THAT(Results, ElementsAre(Pair("p", _)));
+        const Environment &Env = Results[0].second.Env;
+
+        const ValueDecl *FooDecl = findValueDecl(ASTCtx, "Foo");
+        ASSERT_THAT(FooDecl, NotNull());
+
+        ASSERT_TRUE(FooDecl->getType()->isStructureType());
+        auto FooFields = FooDecl->getType()->getAsRecordDecl()->fields();
+
+        FieldDecl *BarDecl = nullptr;
+        for (FieldDecl *Field : FooFields) {
+          if (Field->getNameAsString() == "Bar") {
+            BarDecl = Field;
+          } else {
+            FAIL() << "Unexpected field: " << Field->getNameAsString();
+          }
+        }
+        ASSERT_THAT(BarDecl, NotNull());
+
+        const auto *FooLoc = cast<AggregateStorageLocation>(
+            Env.getStorageLocation(*FooDecl, SkipPast::None));
+        const auto *FooVal = cast<StructValue>(Env.getValue(*FooLoc));
+        const auto *BarVal = cast<IntegerValue>(&FooVal->getChild(*BarDecl));
+
+        const ValueDecl *BazDecl = findValueDecl(ASTCtx, "Baz");
+        ASSERT_THAT(BazDecl, NotNull());
+
+        EXPECT_EQ(Env.getValue(*BazDecl, SkipPast::None), BarVal);
+      });
+}
+
+TEST_F(TransferTest, ClassMember) {
+  std::string Code = R"(
+    class A {
+    public:
+      int Bar;
+    };
+
+    void target(A Foo) {
+      int Baz = Foo.Bar;
+      // [[p]]
+    }
+  )";
+  runDataflow(
+      Code, [](llvm::ArrayRef<
+                   std::pair<std::string, DataflowAnalysisState<NoopLattice>>>
+                   Results,
+               ASTContext &ASTCtx) {
+        ASSERT_THAT(Results, ElementsAre(Pair("p", _)));
+        const Environment &Env = Results[0].second.Env;
+
+        const ValueDecl *FooDecl = findValueDecl(ASTCtx, "Foo");
+        ASSERT_THAT(FooDecl, NotNull());
+
+        ASSERT_TRUE(FooDecl->getType()->isClassType());
+        auto FooFields = FooDecl->getType()->getAsRecordDecl()->fields();
+
+        FieldDecl *BarDecl = nullptr;
+        for (FieldDecl *Field : FooFields) {
+          if (Field->getNameAsString() == "Bar") {
+            BarDecl = Field;
+          } else {
+            FAIL() << "Unexpected field: " << Field->getNameAsString();
+          }
+        }
+        ASSERT_THAT(BarDecl, NotNull());
+
+        const auto *FooLoc = cast<AggregateStorageLocation>(
+            Env.getStorageLocation(*FooDecl, SkipPast::None));
+        const auto *FooVal = cast<StructValue>(Env.getValue(*FooLoc));
+        const auto *BarVal = cast<IntegerValue>(&FooVal->getChild(*BarDecl));
+
+        const ValueDecl *BazDecl = findValueDecl(ASTCtx, "Baz");
+        ASSERT_THAT(BazDecl, NotNull());
+
+        EXPECT_EQ(Env.getValue(*BazDecl, SkipPast::None), BarVal);
+      });
+}
+
+TEST_F(TransferTest, ReferenceMember) {
+  std::string Code = R"(
+    struct A {
+      int &Bar;
+    };
+
+    void target(A Foo) {
+      int Baz = Foo.Bar;
+      // [[p]]
+    }
+  )";
+  runDataflow(
+      Code, [](llvm::ArrayRef<
+                   std::pair<std::string, DataflowAnalysisState<NoopLattice>>>
+                   Results,
+               ASTContext &ASTCtx) {
+        ASSERT_THAT(Results, ElementsAre(Pair("p", _)));
+        const Environment &Env = Results[0].second.Env;
+
+        const ValueDecl *FooDecl = findValueDecl(ASTCtx, "Foo");
+        ASSERT_THAT(FooDecl, NotNull());
+
+        ASSERT_TRUE(FooDecl->getType()->isStructureType());
+        auto FooFields = FooDecl->getType()->getAsRecordDecl()->fields();
+
+        FieldDecl *BarDecl = nullptr;
+        for (FieldDecl *Field : FooFields) {
+          if (Field->getNameAsString() == "Bar") {
+            BarDecl = Field;
+          } else {
+            FAIL() << "Unexpected field: " << Field->getNameAsString();
+          }
+        }
+        ASSERT_THAT(BarDecl, NotNull());
+
+        const auto *FooLoc = cast<AggregateStorageLocation>(
+            Env.getStorageLocation(*FooDecl, SkipPast::None));
+        const auto *FooVal = cast<StructValue>(Env.getValue(*FooLoc));
+        const auto *BarVal = cast<ReferenceValue>(&FooVal->getChild(*BarDecl));
+        const auto *BarPointeeVal =
+            cast<IntegerValue>(Env.getValue(BarVal->getPointeeLoc()));
+
+        const ValueDecl *BazDecl = findValueDecl(ASTCtx, "Baz");
+        ASSERT_THAT(BazDecl, NotNull());
+
+        EXPECT_EQ(Env.getValue(*BazDecl, SkipPast::None), BarPointeeVal);
+      });
+}
+
+TEST_F(TransferTest, StructThisMember) {
+  std::string Code = R"(
+    struct A {
+      int Bar;
+
+      void target() {
+        int Foo = Bar;
+        // [[p]]
+      }
+    };
+  )";
+  runDataflow(
+      Code, [](llvm::ArrayRef<
+                   std::pair<std::string, DataflowAnalysisState<NoopLattice>>>
+                   Results,
+               ASTContext &ASTCtx) {
+        ASSERT_THAT(Results, ElementsAre(Pair("p", _)));
+        const Environment &Env = Results[0].second.Env;
+
+        const auto *ThisLoc =
+            cast<AggregateStorageLocation>(Env.getThisPointeeStorageLocation());
+
+        const ValueDecl *BarDecl = findValueDecl(ASTCtx, "Bar");
+        ASSERT_THAT(BarDecl, NotNull());
+
+        const auto *BarLoc =
+            cast<ScalarStorageLocation>(&ThisLoc->getChild(*BarDecl));
+        ASSERT_TRUE(isa_and_nonnull<ScalarStorageLocation>(BarLoc));
+
+        const Value *BarVal = Env.getValue(*BarLoc);
+        ASSERT_TRUE(isa_and_nonnull<IntegerValue>(BarVal));
+
+        const ValueDecl *FooDecl = findValueDecl(ASTCtx, "Foo");
+        ASSERT_THAT(FooDecl, NotNull());
+
+        EXPECT_EQ(Env.getValue(*FooDecl, SkipPast::None), BarVal);
+      });
+}
+
+TEST_F(TransferTest, ClassThisMember) {
+  std::string Code = R"(
+    class A {
+      int Bar;
+
+      void target() {
+        int Foo = Bar;
+        // [[p]]
+      }
+    };
+  )";
+  runDataflow(
+      Code, [](llvm::ArrayRef<
+                   std::pair<std::string, DataflowAnalysisState<NoopLattice>>>
+                   Results,
+               ASTContext &ASTCtx) {
+        ASSERT_THAT(Results, ElementsAre(Pair("p", _)));
+        const Environment &Env = Results[0].second.Env;
+
+        const auto *ThisLoc =
+            cast<AggregateStorageLocation>(Env.getThisPointeeStorageLocation());
+
+        const ValueDecl *BarDecl = findValueDecl(ASTCtx, "Bar");
+        ASSERT_THAT(BarDecl, NotNull());
+
+        const auto *BarLoc =
+            cast<ScalarStorageLocation>(&ThisLoc->getChild(*BarDecl));
+        ASSERT_TRUE(isa_and_nonnull<ScalarStorageLocation>(BarLoc));
+
+        const Value *BarVal = Env.getValue(*BarLoc);
+        ASSERT_TRUE(isa_and_nonnull<IntegerValue>(BarVal));
+
+        const ValueDecl *FooDecl = findValueDecl(ASTCtx, "Foo");
+        ASSERT_THAT(FooDecl, NotNull());
+
+        EXPECT_EQ(Env.getValue(*FooDecl, SkipPast::None), BarVal);
+      });
+}
+
 } // namespace