[analyzer][NFCi] Annotate major nonnull returning functions

[steakhal]

Summary

This patch annotates the most important analyzer function APIs.
Also adds a couple of assertions for uncovering any potential issues earlier in the constructor; in those cases, the member functions were already dereferencing the members unconditionally anyway.

Measurements showed no performance impact, nor crashes.

[steakhal]

fix typo migth -> might

[martong]

Looks good, with minor revisions.

clang/include/clang/Analysis/AnalysisDeclContext.h

233

To be consistent with the other hunks, where you assert on the parameter, not on the member.

clang/include/clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h

919

1021

1091

[steakhal]

clang/include/clang/Analysis/AnalysisDeclContext.h

233

It's totally messed up, there is absolutely no consistency regarding this.

[xazax.hun]

I prefer references to annotations, but this is also a step in the right direction :l

[steakhal]

assert(ctx)

[steakhal]

A sanitizer buildbot caught a wrong annotation, fixed by e651ed8621c3719937517ddb0b0815b18ec888e4.

[uabelho]

Hi,

I see crashes like this with this patch:

clang: ../../clang/include/clang/StaticAnalyzer/Core/PathSensitive/BasicValueFactory.h:94: clang::ento::PointerToMemberData::PointerToMemberData(const clang::NamedDecl *, llvm::ImmutableList<const CXXBaseSpecifier *>): Assertion `D' failed.

Anyhting known or familiar?

Unfortunately I don't have any reproducer to share (yet).

[uabelho]

In D126198#3549790, @uabelho wrote:

Hi,

I see crashes like this with this patch:

clang: ../../clang/include/clang/StaticAnalyzer/Core/PathSensitive/BasicValueFactory.h:94: clang::ento::PointerToMemberData::PointerToMemberData(const clang::NamedDecl *, llvm::ImmutableList<const CXXBaseSpecifier *>): Assertion `D' failed.

Anyhting known or familiar?

Unfortunately I don't have any reproducer to share (yet).

Reproducer:

clang -cc1 -analyze -analyzer-checker=core bbi-70461.C

on bbi-70461.C being

class B{
};

class D: public B{
};

int f(int D::* pd);

int test(void)
{
  int B::* pb = 0;

  return f(pb);
}

[uabelho]

@steakhal : Thanks for the quick fix!

clang/include/clang/Analysis/AnalysisDeclContext.h

private:
   AnalysisDeclContext *Ctx;
 
   const LocationContext *Parent;
   int64_t ID;
 
 protected:
   LocationContext(ContextKind k, AnalysisDeclContext *ctx,
                   const LocationContext *parent, int64_t ID)
-      : Kind(k), Ctx(ctx), Parent(parent), ID(ID) {}
+      : Kind(k), Ctx(ctx), Parent(parent), ID(ID) {
+    assert(ctx);
+  }
 
 public:
   virtual ~LocationContext();
 
   ContextKind getKind() const { return Kind; }
 
   int64_t getID() const { return ID; }
 
+  LLVM_ATTRIBUTE_RETURNS_NONNULL
   AnalysisDeclContext *getAnalysisDeclContext() const { return Ctx; }
 
+  /// It might return null.
   const LocationContext *getParent() const { return Parent; }
 
   bool isParentOf(const LocationContext *LC) const;
 
   const Decl *getDecl() const { return Ctx->getDecl(); }
 
   CFG *getCFG() const { return Ctx->getCFG(); }
 

clang/include/clang/StaticAnalyzer/Core/PathSensitive/BasicValueFactory.h

 
 class LazyCompoundValData : public llvm::FoldingSetNode {
   StoreRef store;
   const TypedValueRegion *region;
 
 public:
   LazyCompoundValData(const StoreRef &st, const TypedValueRegion *r)
       : store(st), region(r) {
+    assert(r);
     assert(NonLoc::isCompoundType(r->getValueType()));
   }
 
+  /// It might return null.
   const void *getStore() const { return store.getStore(); }
+
+  LLVM_ATTRIBUTE_RETURNS_NONNULL
   const TypedValueRegion *getRegion() const { return region; }
 
   static void Profile(llvm::FoldingSetNodeID& ID,
                       const StoreRef &store,
                       const TypedValueRegion *region);
 
   void Profile(llvm::FoldingSetNodeID& ID) { Profile(ID, store, region); }
 };
 
 class PointerToMemberData : public llvm::FoldingSetNode {
   const NamedDecl *D;
   llvm::ImmutableList<const CXXBaseSpecifier *> L;
 
 public:
   PointerToMemberData(const NamedDecl *D,
                       llvm::ImmutableList<const CXXBaseSpecifier *> L)
-      : D(D), L(L) {}
+      : D(D), L(L) {
+    assert(D);
+  }
 
   using iterator = llvm::ImmutableList<const CXXBaseSpecifier *>::iterator;
 
   iterator begin() const { return L.begin(); }
   iterator end() const { return L.end(); }
 
   static void Profile(llvm::FoldingSetNodeID &ID, const NamedDecl *D,
                       llvm::ImmutableList<const CXXBaseSpecifier *> L);
 
   void Profile(llvm::FoldingSetNodeID &ID) { Profile(ID, D, L); }
+
+  LLVM_ATTRIBUTE_RETURNS_NONNULL
   const NamedDecl *getDeclaratorDecl() const { return D; }
 
   llvm::ImmutableList<const CXXBaseSpecifier *> getCXXBaseList() const {
     return L;
   }
 };
 
 class BasicValueFactory {

clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h

public:
   /// BugReporterVisitor mechanism: instead of visiting the bug report
   /// node-by-node to restore the sequence of events that led to discovering
   /// a bug, you can add notes as you add your transitions.
   ///
   /// @param Cb Callback with 'BugReporterContext &, BugReport &' parameters.
   /// @param IsPrunable Whether the note is prunable. It allows BugReporter
   ///        to omit the note from the report if it would make the displayed
   ///        bug path significantly shorter.
+  LLVM_ATTRIBUTE_RETURNS_NONNULL
   const NoteTag *getNoteTag(NoteTag::Callback &&Cb, bool IsPrunable = false) {
     return Eng.getDataTags().make<NoteTag>(std::move(Cb), IsPrunable);
   }
 
   /// A shorthand version of getNoteTag that doesn't require you to accept
   /// the 'BugReporterContext' argument when you don't need it.
   ///
   /// @param Cb Callback only with 'BugReport &' parameter.

clang/include/clang/StaticAnalyzer/Core/PathSensitive/ConstraintManager.h

ProgramStatePair assumeInclusiveRangeDual(ProgramStateRef State, NonLoc Value,
                                             const llvm::APSInt &From,
                                             const llvm::APSInt &To);
 
   /// If a symbol is perfectly constrained to a constant, attempt
   /// to return the concrete value.
   ///
   /// Note that a ConstraintManager is not obligated to return a concretized
   /// value for a symbol, even if it is perfectly constrained.
+  /// It might return null.
   virtual const llvm::APSInt* getSymVal(ProgramStateRef state,
                                         SymbolRef sym) const {
     return nullptr;
   }
 
   /// Scan all symbols referenced by the constraints. If the symbol is not
   /// alive, remove it.
   virtual ProgramStateRef removeDeadBindings(ProgramStateRef state,

clang/include/clang/StaticAnalyzer/Core/PathSensitive/DynamicType.h

 
 namespace clang {
 namespace ento {
 
 /// Get dynamic type information for the region \p MR.
 DynamicTypeInfo getDynamicTypeInfo(ProgramStateRef State, const MemRegion *MR);
 
 /// Get raw dynamic type information for the region \p MR.
+/// It might return null.
 const DynamicTypeInfo *getRawDynamicTypeInfo(ProgramStateRef State,
                                              const MemRegion *MR);
 
 /// Get dynamic type information stored in a class object represented by \p Sym.
 DynamicTypeInfo getClassObjectDynamicTypeInfo(ProgramStateRef State,
                                               SymbolRef Sym);
 
 /// Get dynamic cast information from \p CastFromTy to \p CastToTy of \p MR.

clang/include/clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h

 public:
   // We're using a const instead of an enumeration due to the size required;
   // Visual Studio will only create enumerations of size int, not long long.
   static const int64_t Symbolic = std::numeric_limits<int64_t>::max();
 
   RegionOffset() = default;
   RegionOffset(const MemRegion *r, int64_t off) : R(r), Offset(off) {}
 
+  /// It might return null.
   const MemRegion *getRegion() const { return R; }
 
   bool hasSymbolicOffset() const { return Offset == Symbolic; }
 
   int64_t getOffset() const {
     assert(!hasSymbolicOffset());
     return Offset;
   }

 
 public:
   ASTContext &getContext() const;
 
   virtual void Profile(llvm::FoldingSetNodeID& ID) const = 0;
 
   virtual MemRegionManager &getMemRegionManager() const = 0;
 
-  const MemSpaceRegion *getMemorySpace() const;
+  LLVM_ATTRIBUTE_RETURNS_NONNULL const MemSpaceRegion *getMemorySpace() const;
 
-  const MemRegion *getBaseRegion() const;
+  LLVM_ATTRIBUTE_RETURNS_NONNULL const MemRegion *getBaseRegion() const;
 
   /// Recursively retrieve the region of the most derived class instance of
   /// regions of C++ base class instances.
+  LLVM_ATTRIBUTE_RETURNS_NONNULL
   const MemRegion *getMostDerivedObjectRegion() const;
 
   /// Check if the region is a subregion of the given region.
   /// Each region is a subregion of itself.
   virtual bool isSubRegionOf(const MemRegion *R) const;
 
+  LLVM_ATTRIBUTE_RETURNS_NONNULL
   const MemRegion *StripCasts(bool StripBaseAndDerivedCasts = true) const;
 
   /// If this is a symbolic region, returns the region. Otherwise,
   /// goes up the base chain looking for the first symbolic base region.
+  /// It might return null.
   const SymbolicRegion *getSymbolicBase() const;
 
   bool hasGlobalsOrParametersStorage() const;
 
   bool hasStackStorage() const;
 
   bool hasStackNonParametersStorage() const;
 
public:
   ///
   /// When this region represents a subexpression, the method is for printing
   /// an expression containing it.
   virtual void printPrettyAsExpr(raw_ostream &os) const;
 
   Kind getKind() const { return kind; }
 
   template<typename RegionTy> const RegionTy* getAs() const;
-  template<typename RegionTy> const RegionTy* castAs() const;
+  template <typename RegionTy>
+  LLVM_ATTRIBUTE_RETURNS_NONNULL const RegionTy *castAs() const;
 
   virtual bool isBoundable() const { return false; }
 
   /// Get descriptive name for memory region. The name is obtained from
   /// the variable/field declaration retrieved from the memory region.
   /// Regions that point to an element of an array are returned as: "arr[0]".
   /// Regions that point to a struct are returned as: "st.var".
   //
StaticGlobalSpaceRegion(MemRegionManager &mgr, const CodeTextRegion *cr)
     assert(cr);
   }
 
 public:
   void Profile(llvm::FoldingSetNodeID &ID) const override;
 
   void dumpToStream(raw_ostream &os) const override;
 
+  LLVM_ATTRIBUTE_RETURNS_NONNULL
   const CodeTextRegion *getCodeRegion() const { return CR; }
 
   static bool classof(const MemRegion *R) {
     return R->getKind() == StaticGlobalSpaceRegionKind;
   }
 };
 
 /// The region for all the non-static global variables.

 protected:
   StackSpaceRegion(MemRegionManager &mgr, Kind k, const StackFrameContext *sfc)
       : MemSpaceRegion(mgr, k), SFC(sfc) {
     assert(classof(this));
     assert(sfc);
   }
 
 public:
+  LLVM_ATTRIBUTE_RETURNS_NONNULL
   const StackFrameContext *getStackFrame() const { return SFC; }
 
   void Profile(llvm::FoldingSetNodeID &ID) const override;
 
   static bool classof(const MemRegion *R) {
     Kind k = R->getKind();
     return k >= BEGIN_STACK_MEMSPACES && k <= END_STACK_MEMSPACES;
   }
protected:
   const MemRegion* superRegion;
 
   SubRegion(const MemRegion *sReg, Kind k) : MemRegion(k), superRegion(sReg) {
     assert(classof(this));
     assert(sReg);
   }
 
 public:
+  LLVM_ATTRIBUTE_RETURNS_NONNULL
   const MemRegion* getSuperRegion() const {
     return superRegion;
   }
 
   MemRegionManager &getMemRegionManager() const override;
 
   bool isSubRegionOf(const MemRegion* R) const override;
 
AllocaRegion(const Expr *ex, unsigned cnt, const MemSpaceRegion *superRegion)
       : SubRegion(superRegion, AllocaRegionKind), Cnt(cnt), Ex(ex) {
     assert(Ex);
   }
 
   static void ProfileRegion(llvm::FoldingSetNodeID& ID, const Expr *Ex,
                             unsigned Cnt, const MemRegion *superRegion);
 
 public:
+  LLVM_ATTRIBUTE_RETURNS_NONNULL
   const Expr *getExpr() const { return Ex; }
 
   bool isBoundable() const override { return true; }
 
   void Profile(llvm::FoldingSetNodeID& ID) const override;
 
   void dumpToStream(raw_ostream &os) const override;
 
static void ProfileRegion(llvm::FoldingSetNodeID& ID, const BlockDecl *BD,
                             CanQualType, const AnalysisDeclContext*,
                             const MemRegion*);
 
 public:
   QualType getLocationType() const override {
     return locTy;
   }
 
+  LLVM_ATTRIBUTE_RETURNS_NONNULL
   const BlockDecl *getDecl() const {
     return BD;
   }
 
+  LLVM_ATTRIBUTE_RETURNS_NONNULL
   AnalysisDeclContext *getAnalysisDeclContext() const { return AC; }
 
   void dumpToStream(raw_ostream &os) const override;
 
   void Profile(llvm::FoldingSetNodeID& ID) const override;
 
   static bool classof(const MemRegion* R) {
     return R->getKind() == BlockCodeRegionKind;
class BlockDataRegion : public TypedRegion {
   void *ReferencedVars = nullptr;
   void *OriginalVars = nullptr;
 
   BlockDataRegion(const BlockCodeRegion *bc, const LocationContext *lc,
                   unsigned count, const MemSpaceRegion *sreg)
       : TypedRegion(sreg, BlockDataRegionKind), BC(bc), LC(lc),
         BlockCount(count) {
     assert(bc);
+    assert(bc->getDecl());
     assert(lc);
     assert(isa<GlobalImmutableSpaceRegion>(sreg) ||
            isa<StackLocalsSpaceRegion>(sreg) ||
            isa<UnknownSpaceRegion>(sreg));
   }
 
   static void ProfileRegion(llvm::FoldingSetNodeID&, const BlockCodeRegion *,
                             const LocationContext *, unsigned,
                             const MemRegion *);
 
 public:
+  LLVM_ATTRIBUTE_RETURNS_NONNULL
   const BlockCodeRegion *getCodeRegion() const { return BC; }
 
+  LLVM_ATTRIBUTE_RETURNS_NONNULL
   const BlockDecl *getDecl() const { return BC->getDecl(); }
 
   QualType getLocationType() const override { return BC->getLocationType(); }
 
   class referenced_vars_iterator {
     const MemRegion * const *R;
     const MemRegion * const *OriginalR;
 
   public:
     explicit referenced_vars_iterator(const MemRegion * const *r,
                                       const MemRegion * const *originalR)
         : R(r), OriginalR(originalR) {}
 
+    LLVM_ATTRIBUTE_RETURNS_NONNULL
     const VarRegion *getCapturedRegion() const {
       return cast<VarRegion>(*R);
     }
 
+    LLVM_ATTRIBUTE_RETURNS_NONNULL
     const VarRegion *getOriginalRegion() const {
       return cast<VarRegion>(*OriginalR);
     }
 
     bool operator==(const referenced_vars_iterator &I) const {
       assert((R == nullptr) == (I.R == nullptr));
       return I.R == R;
     }
 
     bool operator!=(const referenced_vars_iterator &I) const {
       assert((R == nullptr) == (I.R == nullptr));
       return I.R != R;
     }
 
     referenced_vars_iterator &operator++() {
       ++R;
       ++OriginalR;
       return *this;
     }
   };
 
   /// Return the original region for a captured region, if
-  /// one exists.
+  /// one exists. It might return null.
   const VarRegion *getOriginalRegion(const VarRegion *VR) const;
 
   referenced_vars_iterator referenced_vars_begin() const;
   referenced_vars_iterator referenced_vars_end() const;
 
   void dumpToStream(raw_ostream &os) const override;
 
   void Profile(llvm::FoldingSetNodeID& ID) const override;
SymbolicRegion(const SymbolRef s, const MemSpaceRegion *sreg)
     assert(s->getType()->isAnyPointerType() ||
            s->getType()->isReferenceType() ||
            s->getType()->isBlockPointerType());
     assert(isa<UnknownSpaceRegion>(sreg) || isa<HeapSpaceRegion>(sreg) ||
            isa<GlobalSystemSpaceRegion>(sreg));
   }
 
 public:
+  /// It might return null.
   SymbolRef getSymbol() const { return sym; }
 
   bool isBoundable() const override { return true; }
 
   void Profile(llvm::FoldingSetNodeID& ID) const override;
 
   static void ProfileRegion(llvm::FoldingSetNodeID& ID,
                             SymbolRef sym,
StringRegion(const StringLiteral *str, const GlobalInternalSpaceRegion *sreg)
     assert(str);
   }
 
   static void ProfileRegion(llvm::FoldingSetNodeID &ID,
                             const StringLiteral *Str,
                             const MemRegion *superRegion);
 
 public:
+  LLVM_ATTRIBUTE_RETURNS_NONNULL
   const StringLiteral *getStringLiteral() const { return Str; }
 
   QualType getValueType() const override { return Str->getType(); }
 
   bool isBoundable() const override { return false; }
 
   void Profile(llvm::FoldingSetNodeID& ID) const override {
     ProfileRegion(ID, Str, superRegion);
ObjCStringRegion(const ObjCStringLiteral *str,
     assert(str);
   }
 
   static void ProfileRegion(llvm::FoldingSetNodeID &ID,
                             const ObjCStringLiteral *Str,
                             const MemRegion *superRegion);
 
 public:
+  LLVM_ATTRIBUTE_RETURNS_NONNULL
   const ObjCStringLiteral *getObjCStringLiteral() const { return Str; }
 
   QualType getValueType() const override { return Str->getType(); }
 
   bool isBoundable() const override { return false; }
 
   void Profile(llvm::FoldingSetNodeID& ID) const override {
     ProfileRegion(ID, Str, superRegion);
public:
   QualType getValueType() const override { return CL->getType(); }
 
   bool isBoundable() const override { return !CL->isFileScope(); }
 
   void Profile(llvm::FoldingSetNodeID& ID) const override;
 
   void dumpToStream(raw_ostream &os) const override;
 
+  LLVM_ATTRIBUTE_RETURNS_NONNULL
   const CompoundLiteralExpr *getLiteralExpr() const { return CL; }
 
   static bool classof(const MemRegion* R) {
     return R->getKind() == CompoundLiteralRegionKind;
   }
 };
 
 class DeclRegion : public TypedValueRegion {
 protected:
   DeclRegion(const MemRegion *sReg, Kind k) : TypedValueRegion(sReg, k) {
     assert(classof(this));
   }
 
 public:
+  // TODO what does this return?
   virtual const ValueDecl *getDecl() const = 0;
 
   static bool classof(const MemRegion* R) {
     unsigned k = R->getKind();
     return k >= BEGIN_DECL_REGIONS && k <= END_DECL_REGIONS;
   }
 };
 
 class VarRegion : public DeclRegion {
   friend class MemRegionManager;
 
 protected:
   // Constructors and protected methods.
   VarRegion(const MemRegion *sReg, Kind k) : DeclRegion(sReg, k) {
     // VarRegion appears in unknown space when it's a block variable as seen
     // from a block using it, when this block is analyzed at top-level.
     // Other block variables appear within block data regions,
     // which, unlike everything else on this list, are not memory spaces.
     assert(isa<GlobalsSpaceRegion>(sReg) || isa<StackSpaceRegion>(sReg) ||
            isa<BlockDataRegion>(sReg) || isa<UnknownSpaceRegion>(sReg));
   }
 
 public:
+  // TODO what does this return?
   const VarDecl *getDecl() const override = 0;
 
+  /// It might return null.
   const StackFrameContext *getStackFrame() const;
 
   QualType getValueType() const override {
     // FIXME: We can cache this if needed.
     return getDecl()->getType();
   }
 
   static bool classof(const MemRegion *R) {
class NonParamVarRegion : public VarRegion {
   NonParamVarRegion(const VarDecl *vd, const MemRegion *sReg)
       : VarRegion(sReg, NonParamVarRegionKind), VD(vd) {
     // VarRegion appears in unknown space when it's a block variable as seen
     // from a block using it, when this block is analyzed at top-level.
     // Other block variables appear within block data regions,
     // which, unlike everything else on this list, are not memory spaces.
     assert(isa<GlobalsSpaceRegion>(sReg) || isa<StackSpaceRegion>(sReg) ||
            isa<BlockDataRegion>(sReg) || isa<UnknownSpaceRegion>(sReg));
+    assert(vd);
   }
 
   static void ProfileRegion(llvm::FoldingSetNodeID &ID, const VarDecl *VD,
                             const MemRegion *superRegion);
 
 public:
   void Profile(llvm::FoldingSetNodeID &ID) const override;
 
+  LLVM_ATTRIBUTE_RETURNS_NONNULL
   const VarDecl *getDecl() const override { return VD; }
 
   QualType getValueType() const override {
     // FIXME: We can cache this if needed.
     return getDecl()->getType();
   }
 
   void dumpToStream(raw_ostream &os) const override;
class ParamVarRegion : public VarRegion {
   friend class MemRegionManager;
 
   const Expr *OriginExpr;
   unsigned Index;
 
   ParamVarRegion(const Expr *OE, unsigned Idx, const MemRegion *SReg)
       : VarRegion(SReg, ParamVarRegionKind), OriginExpr(OE), Index(Idx) {
     assert(!cast<StackSpaceRegion>(SReg)->getStackFrame()->inTopFrame());
+    assert(OriginExpr);
   }
 
   static void ProfileRegion(llvm::FoldingSetNodeID &ID, const Expr *OE,
                             unsigned Idx, const MemRegion *SReg);
 
 public:
+  LLVM_ATTRIBUTE_RETURNS_NONNULL
   const Expr *getOriginExpr() const { return OriginExpr; }
   unsigned getIndex() const { return Index; }
 
   void Profile(llvm::FoldingSetNodeID& ID) const override;
 
   void dumpToStream(raw_ostream &os) const override;
 
   QualType getValueType() const override;
+
+  /// TODO: What does this return?
   const ParmVarDecl *getDecl() const override;
 
   bool canPrintPrettyAsExpr() const override;
   void printPrettyAsExpr(raw_ostream &os) const override;
 
   static bool classof(const MemRegion *R) {
     return R->getKind() == ParamVarRegionKind;
   }

 };
 
 class FieldRegion : public DeclRegion {
   friend class MemRegionManager;
 
   const FieldDecl *FD;
 
   FieldRegion(const FieldDecl *fd, const SubRegion *sReg)
-      : DeclRegion(sReg, FieldRegionKind), FD(fd) {}
+      : DeclRegion(sReg, FieldRegionKind), FD(fd) {
+    assert(FD);
+  }
 
   static void ProfileRegion(llvm::FoldingSetNodeID &ID, const FieldDecl *FD,
                             const MemRegion* superRegion) {
     ID.AddInteger(static_cast<unsigned>(FieldRegionKind));
     ID.AddPointer(FD);
     ID.AddPointer(superRegion);
   }
 
 public:
+  LLVM_ATTRIBUTE_RETURNS_NONNULL
   const FieldDecl *getDecl() const override { return FD; }
 
   void Profile(llvm::FoldingSetNodeID &ID) const override;
 
   QualType getValueType() const override {
     // FIXME: We can cache this if needed.
     return getDecl()->getType();
   }
class ObjCIvarRegion : public DeclRegion {
   const ObjCIvarDecl *IVD;
 
   ObjCIvarRegion(const ObjCIvarDecl *ivd, const SubRegion *sReg);
 
   static void ProfileRegion(llvm::FoldingSetNodeID& ID, const ObjCIvarDecl *ivd,
                             const MemRegion* superRegion);
 
 public:
+  LLVM_ATTRIBUTE_RETURNS_NONNULL
   const ObjCIvarDecl *getDecl() const override;
 
   void Profile(llvm::FoldingSetNodeID& ID) const override;
 
   QualType getValueType() const override;
 
   bool canPrintPrettyAsExpr() const override;
   void printPrettyAsExpr(raw_ostream &os) const override;
class RegionRawOffset {
   CharUnits Offset;
 
   RegionRawOffset(const MemRegion* reg, CharUnits offset = CharUnits::Zero())
       : Region(reg), Offset(offset) {}
 
 public:
   // FIXME: Eventually support symbolic offsets.
   CharUnits getOffset() const { return Offset; }
+
+  // It might return null.
   const MemRegion *getRegion() const { return Region; }
 
   void dumpToStream(raw_ostream &os) const;
   void dump() const;
 };
 
 /// ElementRegion is used to represent both array elements and casts.
 class ElementRegion : public TypedValueRegion {
CXXTempObjectRegion(Expr const *E, MemSpaceRegion const *sReg)
     assert(isa<StackLocalsSpaceRegion>(sReg) ||
            isa<GlobalInternalSpaceRegion>(sReg));
   }
 
   static void ProfileRegion(llvm::FoldingSetNodeID &ID,
                             Expr const *E, const MemRegion *sReg);
 
 public:
+  LLVM_ATTRIBUTE_RETURNS_NONNULL
   const Expr *getExpr() const { return Ex; }
 
   QualType getValueType() const override { return Ex->getType(); }
 
   void dumpToStream(raw_ostream &os) const override;
 
   void Profile(llvm::FoldingSetNodeID &ID) const override;
 
CXXBaseObjectRegion(const CXXRecordDecl *RD, bool IsVirtual,
       : TypedValueRegion(SReg, CXXBaseObjectRegionKind), Data(RD, IsVirtual) {
     assert(RD);
   }
 
   static void ProfileRegion(llvm::FoldingSetNodeID &ID, const CXXRecordDecl *RD,
                             bool IsVirtual, const MemRegion *SReg);
 
 public:
+  LLVM_ATTRIBUTE_RETURNS_NONNULL
   const CXXRecordDecl *getDecl() const { return Data.getPointer(); }
   bool isVirtual() const { return Data.getInt(); }
 
   QualType getValueType() const override;
 
   void dumpToStream(raw_ostream &os) const override;
 
   void Profile(llvm::FoldingSetNodeID &ID) const override;
CXXDerivedObjectRegion(const CXXRecordDecl *DerivedD, const SubRegion *SReg)
     assert(SReg->getSymbolicBase() &&
            "Should have unwrapped a base region instead!");
   }
 
   static void ProfileRegion(llvm::FoldingSetNodeID &ID, const CXXRecordDecl *RD,
                             const MemRegion *SReg);
 
 public:
+  LLVM_ATTRIBUTE_RETURNS_NONNULL
   const CXXRecordDecl *getDecl() const { return DerivedD; }
 
   QualType getValueType() const override;
 
   void dumpToStream(raw_ostream &os) const override;
 
   void Profile(llvm::FoldingSetNodeID &ID) const override;
 

 template<typename RegionTy>
 const RegionTy* MemRegion::getAs() const {
   if (const auto *RT = dyn_cast<RegionTy>(this))
     return RT;
 
   return nullptr;
 }
 
-template<typename RegionTy>
-const RegionTy* MemRegion::castAs() const {
+template <typename RegionTy>
+LLVM_ATTRIBUTE_RETURNS_NONNULL const RegionTy *MemRegion::castAs() const {
   return cast<RegionTy>(this);
 }
 
 //===----------------------------------------------------------------------===//
 // MemRegionManager - Factory object for creating regions.
 //===----------------------------------------------------------------------===//
 
 class MemRegionManager {

clang/include/clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h

public:
   /// Check if the given SVal is constrained to zero or is a zero
   ///        constant.
   ConditionTruthVal isNull(SVal V) const;
 
   /// \return Whether values \p Lhs and \p Rhs are equal.
   ConditionTruthVal areEqual(SVal Lhs, SVal Rhs) const;
 
   /// Utility method for getting regions.
+  LLVM_ATTRIBUTE_RETURNS_NONNULL
   const VarRegion* getRegion(const VarDecl *D, const LocationContext *LC) const;
 
   //==---------------------------------------------------------------------==//
   // Binding and retrieving values to/from the environment and symbolic store.
   //==---------------------------------------------------------------------==//
 
   /// Create a new state by binding the value 'V' to the statement 'S' in the
   /// state's environment.

clang/include/clang/StaticAnalyzer/Core/PathSensitive/SVals.h

 class SymbolVal : public NonLoc {
 public:
   SymbolVal() = delete;
   SymbolVal(SymbolRef sym) : NonLoc(SymbolValKind, sym) {
     assert(sym);
     assert(!Loc::isLocType(sym->getType()));
   }
 
+  LLVM_ATTRIBUTE_RETURNS_NONNULL
   SymbolRef getSymbol() const {
     return (const SymExpr *) Data;
   }
 
   bool isExpression() const {
     return !isa<SymbolData>(getSymbol());
   }
 
public:
   }
 
   static bool classof(NonLoc V) { return V.getSubKind() == LocAsIntegerKind; }
 };
 
 class CompoundVal : public NonLoc {
   friend class ento::SValBuilder;
 
-  explicit CompoundVal(const CompoundValData* D) : NonLoc(CompoundValKind, D) {}
+  explicit CompoundVal(const CompoundValData *D) : NonLoc(CompoundValKind, D) {
+    assert(D);
+  }
 
 public:
+  LLVM_ATTRIBUTE_RETURNS_NONNULL
   const CompoundValData* getValue() const {
     return static_cast<const CompoundValData *>(Data);
   }
 
   using iterator = llvm::ImmutableList<SVal>::iterator;
 
   iterator begin() const;
   iterator end() const;
 
   static bool classof(SVal V) {
     return V.getBaseKind() == NonLocKind && V.getSubKind() == CompoundValKind;
   }
 
   static bool classof(NonLoc V) { return V.getSubKind() == CompoundValKind; }
 };
 
 class LazyCompoundVal : public NonLoc {
   friend class ento::SValBuilder;
 
   explicit LazyCompoundVal(const LazyCompoundValData *D)
-      : NonLoc(LazyCompoundValKind, D) {}
+      : NonLoc(LazyCompoundValKind, D) {
+    assert(D);
+  }
 
 public:
+  LLVM_ATTRIBUTE_RETURNS_NONNULL
   const LazyCompoundValData *getCVData() const {
     return static_cast<const LazyCompoundValData *>(Data);
   }
 
+  LLVM_ATTRIBUTE_RETURNS_NONNULL
   const void *getStore() const;
+
+  LLVM_ATTRIBUTE_RETURNS_NONNULL
   const TypedValueRegion *getRegion() const;
 
   static bool classof(SVal V) {
     return V.getBaseKind() == NonLocKind &&
            V.getSubKind() == LazyCompoundValKind;
   }
 
   static bool classof(NonLoc V) {

clang/include/clang/StaticAnalyzer/Core/PathSensitive/SymExpr.h

public:
   /// Whenever the symbol was constructed to denote an unknown value of
   /// a certain memory region, return this region. This method
   /// allows checkers to make decisions depending on the origin of the symbol.
   /// Symbol classes for which the origin region is known include
   /// SymbolRegionValue which denotes the value of the region before
   /// the beginning of the analysis, and SymbolDerived which denotes the value
   /// of a certain memory region after its super region (a memory space or
   /// a larger record region) is default-bound with a certain symbol.
+  /// It might return null.
   virtual const MemRegion *getOriginRegion() const { return nullptr; }
 };
 
 inline raw_ostream &operator<<(raw_ostream &os,
                                const clang::ento::SymExpr *SE) {
   SE->dumpToStream(os);
   return os;
 }

clang/include/clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h

 
 public:
   SymbolRegionValue(SymbolID sym, const TypedValueRegion *r)
       : SymbolData(SymbolRegionValueKind, sym), R(r) {
     assert(r);
     assert(isValidTypeForSymbol(r->getValueType()));
   }
 
+  LLVM_ATTRIBUTE_RETURNS_NONNULL
   const TypedValueRegion* getRegion() const { return R; }
 
   static void Profile(llvm::FoldingSetNodeID& profile, const TypedValueRegion* R) {
     profile.AddInteger((unsigned) SymbolRegionValueKind);
     profile.AddPointer(R);
   }
 
   void Profile(llvm::FoldingSetNodeID& profile) override {
SymbolConjured(SymbolID sym, const Stmt *s, const LocationContext *lctx,
     // that was caused by a destructor call on a temporary object,
     // which has no statement associated with it.
     // Due to this, we might be creating the same invalidation symbol for
     // two different invalidation passes (for two different temporaries).
     assert(lctx);
     assert(isValidTypeForSymbol(t));
   }
 
+  /// It might return null.
   const Stmt *getStmt() const { return S; }
   unsigned getCount() const { return Count; }
+  /// It might return null.
   const void *getTag() const { return SymbolTag; }
 
   QualType getType() const override;
 
   StringRef getKindStr() const override;
 
   void dumpToStream(raw_ostream &os) const override;
 

 public:
   SymbolDerived(SymbolID sym, SymbolRef parent, const TypedValueRegion *r)
       : SymbolData(SymbolDerivedKind, sym), parentSymbol(parent), R(r) {
     assert(parent);
     assert(r);
     assert(isValidTypeForSymbol(r->getValueType()));
   }
 
+  LLVM_ATTRIBUTE_RETURNS_NONNULL
   SymbolRef getParentSymbol() const { return parentSymbol; }
+  LLVM_ATTRIBUTE_RETURNS_NONNULL
   const TypedValueRegion *getRegion() const { return R; }
 
   QualType getType() const override;
 
   StringRef getKindStr() const override;
 
   void dumpToStream(raw_ostream &os) const override;
   const MemRegion *getOriginRegion() const override { return getRegion(); }
class SymbolExtent : public SymbolData {
   const SubRegion *R;
 
 public:
   SymbolExtent(SymbolID sym, const SubRegion *r)
       : SymbolData(SymbolExtentKind, sym), R(r) {
     assert(r);
   }
 
+  LLVM_ATTRIBUTE_RETURNS_NONNULL
   const SubRegion *getRegion() const { return R; }
 
   QualType getType() const override;
 
   StringRef getKindStr() const override;
 
   void dumpToStream(raw_ostream &os) const override;
 
SymbolMetadata(SymbolID sym, const MemRegion* r, const Stmt *s, QualType t,
         Count(count), Tag(tag) {
       assert(r);
       assert(s);
       assert(isValidTypeForSymbol(t));
       assert(LCtx);
       assert(tag);
     }
 
+    LLVM_ATTRIBUTE_RETURNS_NONNULL
     const MemRegion *getRegion() const { return R; }
+
+    LLVM_ATTRIBUTE_RETURNS_NONNULL
     const Stmt *getStmt() const { return S; }
+
+    LLVM_ATTRIBUTE_RETURNS_NONNULL
     const LocationContext *getLocationContext() const { return LCtx; }
+
     unsigned getCount() const { return Count; }
+
+    LLVM_ATTRIBUTE_RETURNS_NONNULL
     const void *getTag() const { return Tag; }
 
     QualType getType() const override;
 
     StringRef getKindStr() const override;
 
     void dumpToStream(raw_ostream &os) const override;
 
-  static void Profile(llvm::FoldingSetNodeID& profile, const MemRegion *R,
+    static void Profile(llvm::FoldingSetNodeID &profile, const MemRegion *R,
                         const Stmt *S, QualType T, const LocationContext *LCtx,
                         unsigned Count, const void *Tag) {
-    profile.AddInteger((unsigned) SymbolMetadataKind);
+      profile.AddInteger((unsigned)SymbolMetadataKind);
       profile.AddPointer(R);
       profile.AddPointer(S);
       profile.Add(T);
       profile.AddPointer(LCtx);
       profile.AddInteger(Count);
       profile.AddPointer(Tag);
     }
 
   void Profile(llvm::FoldingSetNodeID& profile) override {
     Profile(profile, R, S, T, LCtx, Count, Tag);
   }
 
   // Implement isa<T> support.
   static bool classof(const SymExpr *SE) {
     return SE->getKind() == SymbolMetadataKind;
public:
   unsigned computeComplexity() const override {
     if (Complexity == 0)
       Complexity = 1 + Operand->computeComplexity();
     return Complexity;
   }
 
   QualType getType() const override { return ToTy; }
 
+  LLVM_ATTRIBUTE_RETURNS_NONNULL
   const SymExpr *getOperand() const { return Operand; }
 
   void dumpToStream(raw_ostream &os) const override;
 
   static void Profile(llvm::FoldingSetNodeID& ID,
                       const SymExpr *In, QualType From, QualType To) {
     ID.AddInteger((unsigned) SymbolCastKind);
     ID.AddPointer(In);
public:
   /// If the statement is NULL, everything is this and parent contexts is
   /// considered live.
   /// If the stack frame context is NULL, everything on stack is considered
   /// dead.
   SymbolReaper(const StackFrameContext *Ctx, const Stmt *s,
                SymbolManager &symmgr, StoreManager &storeMgr)
       : LCtx(Ctx), Loc(s), SymMgr(symmgr), reapedStore(nullptr, storeMgr) {}
 
+  /// It might return null.
   const LocationContext *getLocationContext() const { return LCtx; }
 
   bool isLive(SymbolRef sym);
   bool isLiveRegion(const MemRegion *region);
   bool isLive(const Expr *ExprVal, const LocationContext *LCtx) const;
   bool isLive(const VarRegion *VR, bool includeStoreBindings = false) const;
 
   /// Unconditionally marks a symbol as live.

clang/lib/StaticAnalyzer/Core/MemRegion.cpp

 }
 
 const StackFrameContext *VarRegion::getStackFrame() const {
   const auto *SSR = dyn_cast<StackSpaceRegion>(getMemorySpace());
   return SSR ? SSR->getStackFrame() : nullptr;
 }
 
 ObjCIvarRegion::ObjCIvarRegion(const ObjCIvarDecl *ivd, const SubRegion *sReg)
-    : DeclRegion(sReg, ObjCIvarRegionKind), IVD(ivd) {}
+    : DeclRegion(sReg, ObjCIvarRegionKind), IVD(ivd) {
+  assert(IVD);
+}
 
 const ObjCIvarDecl *ObjCIvarRegion::getDecl() const { return IVD; }
 
 QualType ObjCIvarRegion::getValueType() const {
   return getDecl()->getType();
 }
 
 QualType CXXBaseObjectRegion::getValueType() const {