[analyzer][NFC] Prefer using isa<> instead getAs<> in conditions

[steakhal]

Summary

Depends on D125709

[martong]

Why not replace all getAs?

I suppose you picked conditions because isa can have variadic parameters. If we are about to keep getAs then why not replace only those occurrences where we see the benefit of the variadic isa?

[steakhal]

In D127742#3581874, @martong wrote:

Why not replace all getAs?

That's a massive change. I actually experimented with it and I see no advantage with that.

I suppose you picked conditions because isa can have variadic parameters. If we are about to keep getAs then why not replace only those occurrences where we see the benefit of the variadic isa?

I believe it reads more naturally. getAs<> should be used only if we care about the value and don't know if it has one.

[martong]

In D127742#3582236, @steakhal wrote:

In D127742#3581874, @martong wrote:

Why not replace all getAs?

That's a massive change. I actually experimented with it and I see no advantage with that.

I suppose you picked conditions because isa can have variadic parameters. If we are about to keep getAs then why not replace only those occurrences where we see the benefit of the variadic isa?

I believe it reads more naturally. getAs<> should be used only if we care about the value and don't know if it has one.

Ok, makes sense. LGTM.

clang/include/clang/StaticAnalyzer/Core/BugReporter/BugReporterVisitors.h

class TrackConstraintBRVisitor final : public BugReporterVisitor {
 
   /// We should start tracking from the last node along the path in which the
   /// value is constrained.
   bool IsTrackingTurnedOn = false;
 
 public:
   TrackConstraintBRVisitor(DefinedSVal constraint, bool assumption)
       : Constraint(constraint), Assumption(assumption),
-        IsZeroCheck(!Assumption && Constraint.getAs<Loc>()) {}
+        IsZeroCheck(!Assumption && isa<Loc>(Constraint)) {}
 
   void Profile(llvm::FoldingSetNodeID &ID) const override;
 
   /// Return the tag associated with this visitor.  This tag will be used
   /// to make all PathDiagnosticPieces created by this visitor.
   static const char *getTag();
 
   PathDiagnosticPieceRef VisitNode(const ExplodedNode *N,

clang/include/clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h

class ElementRegion : public TypedValueRegion {
   friend class MemRegionManager;
 
   QualType ElementType;
   NonLoc Index;
 
   ElementRegion(QualType elementType, NonLoc Idx, const SubRegion *sReg)
       : TypedValueRegion(sReg, ElementRegionKind), ElementType(elementType),
         Index(Idx) {
-    assert((!Idx.getAs<nonloc::ConcreteInt>() ||
+    assert((!isa<nonloc::ConcreteInt>(Idx) ||
             Idx.castAs<nonloc::ConcreteInt>().getValue().isSigned()) &&
            "The index must be signed");
     assert(!elementType.isNull() && !elementType->isVoidType() &&
            "Invalid region type!");
   }
 
   static void ProfileRegion(llvm::FoldingSetNodeID& ID, QualType elementType,
                             SVal Idx, const MemRegion* superRegion);

clang/include/clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h

 }
 
 inline ProgramStateRef ProgramState::assumeInclusiveRange(
     DefinedOrUnknownSVal Val, const llvm::APSInt &From, const llvm::APSInt &To,
     bool Assumption) const {
   if (Val.isUnknown())
     return this;
 
-  assert(Val.getAs<NonLoc>() && "Only NonLocs are supported!");
+  assert(isa<NonLoc>(Val) && "Only NonLocs are supported!");
 
   return getStateManager().ConstraintMgr->assumeInclusiveRange(
       this, Val.castAs<NonLoc>(), From, To, Assumption);
 }
 
 inline std::pair<ProgramStateRef, ProgramStateRef>
 ProgramState::assumeInclusiveRange(DefinedOrUnknownSVal Val,
                                    const llvm::APSInt &From,
                                    const llvm::APSInt &To) const {
   if (Val.isUnknown())
     return std::make_pair(this, this);
 
-  assert(Val.getAs<NonLoc>() && "Only NonLocs are supported!");
+  assert(isa<NonLoc>(Val) && "Only NonLocs are supported!");
 
   return getStateManager().ConstraintMgr->assumeInclusiveRangeDual(
       this, Val.castAs<NonLoc>(), From, To);
 }
 
 inline ProgramStateRef ProgramState::bindLoc(SVal LV, SVal V, const LocationContext *LCtx) const {
   if (Optional<Loc> L = LV.getAs<Loc>())
     return bindLoc(*L, V, LCtx);

clang/lib/StaticAnalyzer/Checkers/ArrayBoundCheckerV2.cpp

void ArrayBoundCheckerV2::checkLocation(SVal location, bool isLoad,
 
   // CHECK LOWER BOUND: Is byteOffset < extent begin?
   //  If so, we are doing a load/store
   //  before the first valid offset in the memory region.
 
   SVal extentBegin = computeExtentBegin(svalBuilder, rawOffset.getRegion());
 
   if (Optional<NonLoc> NV = extentBegin.getAs<NonLoc>()) {
-    if (NV->getAs<nonloc::ConcreteInt>()) {
+    if (auto ConcreteNV = NV->getAs<nonloc::ConcreteInt>()) {
       std::pair<NonLoc, nonloc::ConcreteInt> simplifiedOffsets =
-          getSimplifiedOffsets(rawOffset.getByteOffset(),
-                               NV->castAs<nonloc::ConcreteInt>(),
+          getSimplifiedOffsets(rawOffset.getByteOffset(), *ConcreteNV,
                                svalBuilder);
       rawOffsetVal = simplifiedOffsets.first;
       *NV = simplifiedOffsets.second;
     }
 
     SVal lowerBound = svalBuilder.evalBinOpNN(state, BO_LT, rawOffsetVal, *NV,
                                               svalBuilder.getConditionType());
 
if (Optional<NonLoc> NV = extentBegin.getAs<NonLoc>()) {
     state = state_withinLowerBound;
   }
 
   do {
     // CHECK UPPER BOUND: Is byteOffset >= size(baseRegion)?  If so,
     // we are doing a load/store after the last valid offset.
     const MemRegion *MR = rawOffset.getRegion();
     DefinedOrUnknownSVal Size = getDynamicExtent(state, MR, svalBuilder);
-    if (!Size.getAs<NonLoc>())
+    if (!isa<NonLoc>(Size))
       break;
 
-    if (Size.getAs<nonloc::ConcreteInt>()) {
+    if (auto ConcreteSize = Size.getAs<nonloc::ConcreteInt>()) {
       std::pair<NonLoc, nonloc::ConcreteInt> simplifiedOffsets =
-          getSimplifiedOffsets(rawOffset.getByteOffset(),
-                               Size.castAs<nonloc::ConcreteInt>(), svalBuilder);
+          getSimplifiedOffsets(rawOffset.getByteOffset(), *ConcreteSize,
+                               svalBuilder);
       rawOffsetVal = simplifiedOffsets.first;
       Size = simplifiedOffsets.second;
     }
 
     SVal upperbound = svalBuilder.evalBinOpNN(state, BO_GE, rawOffsetVal,
                                               Size.castAs<NonLoc>(),
                                               svalBuilder.getConditionType());
 
void RegionRawOffsetV2::dumpToStream(raw_ostream &os) const {
   os << "raw_offset_v2{" << getRegion() << ',' << getByteOffset() << '}';
 }
 #endif
 
 // Lazily computes a value to be used by 'computeOffset'.  If 'val'
 // is unknown or undefined, we lazily substitute '0'.  Otherwise,
 // return 'val'.
 static inline SVal getValue(SVal val, SValBuilder &svalBuilder) {
-  return val.getAs<UndefinedVal>() ? svalBuilder.makeArrayIndex(0) : val;
+  return val.isUndef() ? svalBuilder.makeZeroArrayIndex() : val;
 }
 
 // Scale a base value by a scaling factor, and return the scaled
 // value as an SVal.  Used by 'computeOffset'.
 static inline SVal scaleValue(ProgramStateRef state,
                               NonLoc baseVal, CharUnits scaling,
                               SValBuilder &sb) {
   return sb.evalBinOpNN(state, BO_Mul, baseVal,
switch (region->getKind()) {
           if (!offset.isUnknownOrUndef())
             return RegionRawOffsetV2(subReg, offset);
         }
         return RegionRawOffsetV2();
       }
       case MemRegion::ElementRegionKind: {
         const ElementRegion *elemReg = cast<ElementRegion>(region);
         SVal index = elemReg->getIndex();
-        if (!index.getAs<NonLoc>())
+        if (!isa<NonLoc>(index))
           return RegionRawOffsetV2();
         QualType elemType = elemReg->getElementType();
         // If the element is an incomplete type, go no further.
         ASTContext &astContext = svalBuilder.getContext();
         if (elemType->isIncompleteType())
           return RegionRawOffsetV2();
 
         // Update the offset.

clang/lib/StaticAnalyzer/Checkers/BasicObjCFoundationChecks.cpp

for (unsigned I = variadicArgsBegin; I != variadicArgsEnd; ++I) {
     if (ArgTy->isObjCObjectPointerType())
       continue;
 
     // Block pointers are treaded as Objective-C pointers.
     if (ArgTy->isBlockPointerType())
       continue;
 
     // Ignore pointer constants.
-    if (msg.getArgSVal(I).getAs<loc::ConcreteInt>())
+    if (isa<loc::ConcreteInt>(msg.getArgSVal(I)))
       continue;
 
     // Ignore pointer types annotated with 'NSObject' attribute.
     if (C.getASTContext().isObjCNSObjectType(ArgTy))
       continue;
 
     // Ignore CF references, which can be toll-free bridged.
     if (coreFoundation::isCFObjectRef(ArgTy))

clang/lib/StaticAnalyzer/Checkers/CStringChecker.cpp

ProgramStateRef CStringChecker::checkAdditionOverflow(CheckerContext &C,
   SValBuilder &svalBuilder = C.getSValBuilder();
   BasicValueFactory &BVF = svalBuilder.getBasicValueFactory();
 
   QualType sizeTy = svalBuilder.getContext().getSizeType();
   const llvm::APSInt &maxValInt = BVF.getMaxValue(sizeTy);
   NonLoc maxVal = svalBuilder.makeIntVal(maxValInt);
 
   SVal maxMinusRight;
-  if (right.getAs<nonloc::ConcreteInt>()) {
+  if (isa<nonloc::ConcreteInt>(right)) {
     maxMinusRight = svalBuilder.evalBinOpNN(state, BO_Sub, maxVal, right,
                                                  sizeTy);
   } else {
     // Try switching the operands. (The order of these two assignments is
     // important!)
     maxMinusRight = svalBuilder.evalBinOpNN(state, BO_Sub, maxVal, left,
                                             sizeTy);
     left = right;
if (strLengthNL && lenValNL) {
       }
       case ConcatFnKind::strlcat:
         if (!dstStrLengthNL)
           return;
 
         // amountCopied = min (size - dstLen - 1 , srcLen)
         SVal freeSpace = svalBuilder.evalBinOpNN(state, BO_Sub, *lenValNL,
                                                  *dstStrLengthNL, sizeTy);
-        if (!freeSpace.getAs<NonLoc>())
+        if (!isa<NonLoc>(freeSpace))
           return;
         freeSpace =
             svalBuilder.evalBinOp(state, BO_Sub, freeSpace,
                                   svalBuilder.makeIntVal(1, sizeTy), sizeTy);
         Optional<NonLoc> freeSpaceNL = freeSpace.getAs<NonLoc>();
 
         // While unlikely, it is possible that the subtraction is
         // too complex to compute, let's check whether it succeeded.

clang/lib/StaticAnalyzer/Checkers/DereferenceChecker.cpp

if (l.isUndef()) {
     if (!suppressReport(C, DerefExpr))
       reportBug(DerefKind::UndefinedPointerValue, C.getState(), DerefExpr, C);
     return;
   }
 
   DefinedOrUnknownSVal location = l.castAs<DefinedOrUnknownSVal>();
 
   // Check for null dereferences.
-  if (!location.getAs<Loc>())
+  if (!isa<Loc>(location))
     return;
 
   ProgramStateRef state = C.getState();
 
   ProgramStateRef notNullState, nullState;
   std::tie(notNullState, nullState) = state->assume(location);
 
   if (nullState) {

clang/lib/StaticAnalyzer/Checkers/GTestChecker.cpp

 void GTestChecker::modelAssertionResultBoolConstructor(
     const CXXConstructorCall *Call, bool IsRef, CheckerContext &C) const {
   assert(Call->getNumArgs() >= 1 && Call->getNumArgs() <= 2);
 
   ProgramStateRef State = C.getState();
   SVal BooleanArgVal = Call->getArgSVal(0);
   if (IsRef) {
     // The argument is a reference, so load from it to get the boolean value.
-    if (!BooleanArgVal.getAs<Loc>())
+    if (!isa<Loc>(BooleanArgVal))
       return;
     BooleanArgVal = C.getState()->getSVal(BooleanArgVal.castAs<Loc>());
   }
 
   SVal ThisVal = Call->getCXXThisVal();
 
   SVal ThisSuccess = getAssertionResultSuccessFieldValue(
       Call->getDecl()->getParent(), ThisVal, State);
SVal GTestChecker::getAssertionResultSuccessFieldValue(
 
   return State->getSVal(*FieldLoc);
 }
 
 /// Constrain the passed-in state to assume two values are equal.
 ProgramStateRef GTestChecker::assumeValuesEqual(SVal Val1, SVal Val2,
                                                 ProgramStateRef State,
                                                 CheckerContext &C) {
-  if (!Val1.getAs<DefinedOrUnknownSVal>() ||
-      !Val2.getAs<DefinedOrUnknownSVal>())
+  auto DVal1 = Val1.getAs<DefinedOrUnknownSVal>();
+  auto DVal2 = Val2.getAs<DefinedOrUnknownSVal>();
+  if (!DVal1.hasValue() || !DVal2.hasValue())
     return State;
 
   auto ValuesEqual =
-      C.getSValBuilder().evalEQ(State, Val1.castAs<DefinedOrUnknownSVal>(),
-                                Val2.castAs<DefinedOrUnknownSVal>());
-
-  if (!ValuesEqual.getAs<DefinedSVal>())
+      C.getSValBuilder().evalEQ(State, *DVal1, *DVal2).getAs<DefinedSVal>();
+  if (!ValuesEqual.hasValue())
     return State;
 
-  State = C.getConstraintManager().assume(
-      State, ValuesEqual.castAs<DefinedSVal>(), true);
-
+  State = C.getConstraintManager().assume(State, *ValuesEqual, true);
   return State;
 }
 
 void ento::registerGTestChecker(CheckerManager &Mgr) {
   Mgr.registerChecker<GTestChecker>();
 }
 
 bool ento::shouldRegisterGTestChecker(const CheckerManager &mgr) {
   // gtest is a C++ API so there is no sense running the checker
   // if not compiling for C++.
   const LangOptions &LO = mgr.getLangOpts();
   return LO.CPlusPlus;
 }

clang/lib/StaticAnalyzer/Checkers/GenericTaintChecker.cpp

ForEachCallArg(
         IsMatching = IsMatching || (PropSrcArgs.contains(I) &&
                                     isTaintedOrPointsToTainted(E, State, C));
       });
 
   if (!IsMatching)
     return;
 
   const auto WouldEscape = [](SVal V, QualType Ty) -> bool {
-    if (!V.getAs<Loc>())
+    if (!isa<Loc>(V))
       return false;
 
     const bool IsNonConstRef = Ty->isReferenceType() && !Ty.isConstQualified();
     const bool IsNonConstPtr =
         Ty->isPointerType() && !Ty->getPointeeType().isConstQualified();
 
     return IsNonConstRef || IsNonConstPtr;
   };

clang/lib/StaticAnalyzer/Checkers/Iterator.cpp

 
 bool compare(ProgramStateRef State, NonLoc NL1, NonLoc NL2,
              BinaryOperator::Opcode Opc) {
   auto &SVB = State->getStateManager().getSValBuilder();
 
   const auto comparison =
     SVB.evalBinOp(State, Opc, NL1, NL2, SVB.getConditionType());
 
-  assert(comparison.getAs<DefinedSVal>() &&
+  assert(isa<DefinedSVal>(comparison) &&
          "Symbol comparison must be a `DefinedSVal`");
 
   return !State->assume(comparison.castAs<DefinedSVal>(), false);
 }
 
 } // namespace iterator
 } // namespace ento
 } // namespace clang

clang/lib/StaticAnalyzer/Checkers/IteratorModeling.cpp

if (AdvancedState) {
     assignToContainer(C, CE, TgtVal, Pos->getContainer());
   }
 }
 
 void IteratorModeling::handlePtrIncrOrDecr(CheckerContext &C,
                                            const Expr *Iterator,
                                            OverloadedOperatorKind OK,
                                            SVal Offset) const {
-  if (!Offset.getAs<DefinedSVal>())
+  if (!isa<DefinedSVal>(Offset))
     return;
 
   QualType PtrType = Iterator->getType();
   if (!PtrType->isPointerType())
     return;
   QualType ElementType = PtrType->getPointeeType();
 
   ProgramStateRef State = C.getState();
ProgramStateRef relateSymbols(ProgramStateRef State, SymbolRef Sym1,
   // 1. Subtract the operands using evalBinOp().
   // 2. Assume that the result doesn't overflow.
   // 3. Compare the result to 0.
   // 4. Assume the result of the comparison.
   const auto comparison =
     SVB.evalBinOp(State, BO_EQ, nonloc::SymbolVal(Sym1),
                   nonloc::SymbolVal(Sym2), SVB.getConditionType());
 
-  assert(comparison.getAs<DefinedSVal>() &&
+  assert(isa<DefinedSVal>(comparison) &&
          "Symbol comparison must be a `DefinedSVal`");
 
   auto NewState = State->assume(comparison.castAs<DefinedSVal>(), Equal);
   if (!NewState)
     return nullptr;
 
   if (const auto CompSym = comparison.getAsSymbol()) {
     assert(isa<SymIntExpr>(CompSym) &&
            "Symbol comparison must be a `SymIntExpr`");

clang/lib/StaticAnalyzer/Checkers/MPI-Checker/MPIChecker.cpp

if (!SuperRegion) {
       ReqRegions.push_back(MR);
       return;
     }
 
     DefinedOrUnknownSVal ElementCount = getDynamicElementCount(
         Ctx.getState(), SuperRegion, Ctx.getSValBuilder(),
         CE.getArgExpr(1)->getType()->getPointeeType());
     const llvm::APSInt &ArrSize =
-        ElementCount.getAs<nonloc::ConcreteInt>()->getValue();
+        ElementCount.castAs<nonloc::ConcreteInt>().getValue();
 
     for (size_t i = 0; i < ArrSize; ++i) {
       const NonLoc Idx = Ctx.getSValBuilder().makeArrayIndex(i);
 
       const ElementRegion *const ER = RegionManager.getElementRegion(
           CE.getArgExpr(1)->getType()->getPointeeType(), Idx, SuperRegion,
           Ctx.getASTContext());
 

clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp

MallocChecker::performKernelMalloc(const CallEvent &Call, CheckerContext &C,
   // We treat the last argument as the flags argument, and callers fall-back to
   // normal malloc on a None return. This works for the FreeBSD kernel malloc
   // as well as Linux kmalloc.
   if (Call.getNumArgs() < 2)
     return None;
 
   const Expr *FlagsEx = Call.getArgExpr(Call.getNumArgs() - 1);
   const SVal V = C.getSVal(FlagsEx);
-  if (!V.getAs<NonLoc>()) {
+  if (!isa<NonLoc>(V)) {
     // The case where 'V' can be a location can only be due to a bad header,
     // so in this case bail out.
     return None;
   }
 
   NonLoc Flags = V.castAs<NonLoc>();
   NonLoc ZeroFlag = C.getSValBuilder()
       .makeIntVal(KernelZeroFlagVal.getValue(), FlagsEx->getType())
ProgramStateRef MallocChecker::FreeMemAux(
     CheckerContext &C, const Expr *ArgExpr, const CallEvent &Call,
     ProgramStateRef State, bool Hold, bool &IsKnownToBeAllocated,
     AllocationFamily Family, bool ReturnsNullOnFailure) const {
 
   if (!State)
     return nullptr;
 
   SVal ArgVal = C.getSVal(ArgExpr);
-  if (!ArgVal.getAs<DefinedOrUnknownSVal>())
+  if (!isa<DefinedOrUnknownSVal>(ArgVal))
     return nullptr;
   DefinedOrUnknownSVal location = ArgVal.castAs<DefinedOrUnknownSVal>();
 
   // Check for null dereferences.
-  if (!location.getAs<Loc>())
+  if (!isa<Loc>(location))
     return nullptr;
 
   // The explicit NULL case, no operation is performed.
   ProgramStateRef notNullState, nullState;
   std::tie(notNullState, nullState) = State->assume(location);
   if (nullState && !notNullState)
     return nullptr;
 
MallocChecker::ReallocMemAux(CheckerContext &C, const CallEvent &Call,
 
   if (SuffixWithN && CE->getNumArgs() < 3)
     return nullptr;
   else if (CE->getNumArgs() < 2)
     return nullptr;
 
   const Expr *arg0Expr = CE->getArg(0);
   SVal Arg0Val = C.getSVal(arg0Expr);
-  if (!Arg0Val.getAs<DefinedOrUnknownSVal>())
+  if (!isa<DefinedOrUnknownSVal>(Arg0Val))
     return nullptr;
   DefinedOrUnknownSVal arg0Val = Arg0Val.castAs<DefinedOrUnknownSVal>();
 
   SValBuilder &svalBuilder = C.getSValBuilder();
 
   DefinedOrUnknownSVal PtrEQ = svalBuilder.evalEQ(
       State, arg0Val, svalBuilder.makeNullWithType(arg0Expr->getType()));
 
   // Get the size argument.
   const Expr *Arg1 = CE->getArg(1);
 
   // Get the value of the size argument.
   SVal TotalSize = C.getSVal(Arg1);
   if (SuffixWithN)
     TotalSize = evalMulForBufferSize(C, Arg1, CE->getArg(2));
-  if (!TotalSize.getAs<DefinedOrUnknownSVal>())
+  if (!isa<DefinedOrUnknownSVal>(TotalSize))
     return nullptr;
 
   // Compare the size argument to 0.
   DefinedOrUnknownSVal SizeZero =
       svalBuilder.evalEQ(State, TotalSize.castAs<DefinedOrUnknownSVal>(),
                          svalBuilder.makeIntValWithWidth(
                              svalBuilder.getContext().getSizeType(), 0));
 
if (const CXXInstanceCall *CC = dyn_cast<CXXInstanceCall>(&Call)) {
     SymbolRef Sym = CC->getCXXThisVal().getAsSymbol();
     if (!Sym || checkUseAfterFree(Sym, C, CC->getCXXThisExpr()))
       return;
   }
 
   // Check arguments for being used after free.
   for (unsigned I = 0, E = Call.getNumArgs(); I != E; ++I) {
     SVal ArgSVal = Call.getArgSVal(I);
-    if (ArgSVal.getAs<Loc>()) {
+    if (isa<Loc>(ArgSVal)) {
       SymbolRef Sym = ArgSVal.getAsSymbol();
       if (!Sym)
         continue;
       if (checkUseAfterFree(Sym, C, Call.getArgExpr(I)))
         return;
     }
   }
 }

clang/lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp

 int MmapWriteExecChecker::ProtWrite = 0x02;
 int MmapWriteExecChecker::ProtExec  = 0x04;
 int MmapWriteExecChecker::ProtRead  = 0x01;
 
 void MmapWriteExecChecker::checkPreCall(const CallEvent &Call,
                                          CheckerContext &C) const {
   if (matchesAny(Call, MmapFn, MprotectFn)) {
     SVal ProtVal = Call.getArgSVal(2);
-    Optional<nonloc::ConcreteInt> ProtLoc = ProtVal.getAs<nonloc::ConcreteInt>();
-    int64_t Prot = ProtLoc->getValue().getSExtValue();
+    auto ProtLoc = ProtVal.castAs<nonloc::ConcreteInt>();
+    int64_t Prot = ProtLoc.getValue().getSExtValue();
     if (ProtExecOv != ProtExec)
       ProtExec = ProtExecOv;
     if (ProtReadOv != ProtRead)
       ProtRead = ProtReadOv;
 
     // Wrong settings
     if (ProtRead == ProtExec)
       return;

clang/lib/StaticAnalyzer/Checkers/NSErrorChecker.cpp

static QualType parameterTypeFromSVal(SVal val, CheckerContext &C) {
   return QualType();
 }
 
 void NSOrCFErrorDerefChecker::checkLocation(SVal loc, bool isLoad,
                                             const Stmt *S,
                                             CheckerContext &C) const {
   if (!isLoad)
     return;
-  if (loc.isUndef() || !loc.getAs<Loc>())
+  if (loc.isUndef() || !isa<Loc>(loc))
     return;
 
   ASTContext &Ctx = C.getASTContext();
   ProgramStateRef state = C.getState();
 
   // If we are loading from NSError**/CFErrorRef* parameter, mark the resulting
   // SVal so that we can later check it when handling the
   // ImplicitNullDerefEvent event.

clang/lib/StaticAnalyzer/Checkers/NonNullParamChecker.cpp

for (unsigned idx = 0; idx < NumArgs; ++idx) {
 
     // If the value is unknown or undefined, we can't perform this check.
     const Expr *ArgE = Call.getArgExpr(idx);
     SVal V = Call.getArgSVal(idx);
     auto DV = V.getAs<DefinedSVal>();
     if (!DV)
       continue;
 
-    assert(!HasRefTypeParam || DV->getAs<Loc>());
+    assert(!HasRefTypeParam || isa<Loc>(DV.getValue()));
 
     // Process the case when the argument is not a location.
-    if (ExpectedToBeNonNull && !DV->getAs<Loc>()) {
+    if (ExpectedToBeNonNull && !isa<Loc>(DV.getValue())) {
       // If the argument is a union type, we want to handle a potential
       // transparent_union GCC extension.
       if (!ArgE)
         continue;
 
       QualType T = ArgE->getType();
       const RecordType *UT = T->getAsUnionType();
       if (!UT || !UT->getDecl()->hasAttr<TransparentUnionAttr>())
         continue;
 
       auto CSV = DV->getAs<nonloc::CompoundVal>();
 
       // FIXME: Handle LazyCompoundVals?
       if (!CSV)
         continue;
 
       V = *(CSV->begin());
       DV = V.getAs<DefinedSVal>();
       assert(++CSV->begin() == CSV->end());
       // FIXME: Handle (some_union){ some_other_union_val }, which turns into
       // a LazyCompoundVal inside a CompoundVal.
-      if (!V.getAs<Loc>())
+      if (!isa<Loc>(V))
         continue;
 
       // Retrieve the corresponding expression.
       if (const auto *CE = dyn_cast<CompoundLiteralExpr>(ArgE))
         if (const auto *IE = dyn_cast<InitListExpr>(CE->getInitializer()))
           ArgE = dyn_cast<Expr>(*(IE->begin()));
     }
 

clang/lib/StaticAnalyzer/Checkers/ObjCAtSyncChecker.cpp

 void ObjCAtSyncChecker::checkPreStmt(const ObjCAtSynchronizedStmt *S,
                                      CheckerContext &C) const {
 
   const Expr *Ex = S->getSynchExpr();
   ProgramStateRef state = C.getState();
   SVal V = C.getSVal(Ex);
 
   // Uninitialized value used for the mutex?
-  if (V.getAs<UndefinedVal>()) {
+  if (isa<UndefinedVal>(V)) {
     if (ExplodedNode *N = C.generateErrorNode()) {
       if (!BT_undef)
         BT_undef.reset(new BuiltinBug(this, "Uninitialized value used as mutex "
                                             "for @synchronized"));
       auto report = std::make_unique<PathSensitiveBugReport>(
           *BT_undef, BT_undef->getDescription(), N);
       bugreporter::trackExpressionValue(N, Ex, *report);
       C.emitReport(std::move(report));

clang/lib/StaticAnalyzer/Checkers/ObjCSelfInitChecker.cpp

static bool shouldRunOnFunctionOrMethod(const NamedDecl *ND) {
   return ID != nullptr;
 }
 
 /// Returns true if the location is 'self'.
 static bool isSelfVar(SVal location, CheckerContext &C) {
   AnalysisDeclContext *analCtx = C.getCurrentAnalysisDeclContext();
   if (!analCtx->getSelfDecl())
     return false;
-  if (!location.getAs<loc::MemRegionVal>())
+  if (!isa<loc::MemRegionVal>(location))
     return false;
 
   loc::MemRegionVal MRV = location.castAs<loc::MemRegionVal>();
   if (const DeclRegion *DR = dyn_cast<DeclRegion>(MRV.stripCasts()))
     return (DR->getDecl() == analCtx->getSelfDecl());
 
   return false;
 }

clang/lib/StaticAnalyzer/Checkers/STLAlgorithmModeling.cpp

StateFound = createIteratorPosition(StateFound, RetVal, Pos->getContainer(),
                                         CE, LCtx, C.blockCount());
     const auto *NewPos = getIteratorPosition(StateFound, RetVal);
     assert(NewPos && "Failed to create new iterator position.");
 
     SVal GreaterOrEqual = SVB.evalBinOp(StateFound, BO_GE,
                                         nonloc::SymbolVal(NewPos->getOffset()),
                                         nonloc::SymbolVal(Pos->getOffset()),
                                         SVB.getConditionType());
-    assert(GreaterOrEqual.getAs<DefinedSVal>() &&
+    assert(isa<DefinedSVal>(GreaterOrEqual) &&
            "Symbol comparison must be a `DefinedSVal`");
     StateFound = StateFound->assume(GreaterOrEqual.castAs<DefinedSVal>(), true);
   }
 
   Param = State->getSVal(CE->getArg(paramNum + 1), LCtx);
 
   // If we have an iterator position for the range-end argument then we can
   // assume that in case of successful search the position of the found element
   // is ahead of it.
   // FIXME: Reverse iterators
   Pos = getIteratorPosition(State, Param);
   if (Pos) {
     StateFound = createIteratorPosition(StateFound, RetVal, Pos->getContainer(),
                                         CE, LCtx, C.blockCount());
     const auto *NewPos = getIteratorPosition(StateFound, RetVal);
     assert(NewPos && "Failed to create new iterator position.");
 
     SVal Less = SVB.evalBinOp(StateFound, BO_LT,
                               nonloc::SymbolVal(NewPos->getOffset()),
                               nonloc::SymbolVal(Pos->getOffset()),
                               SVB.getConditionType());
-    assert(Less.getAs<DefinedSVal>() &&
+    assert(isa<DefinedSVal>(Less) &&
            "Symbol comparison must be a `DefinedSVal`");
     StateFound = StateFound->assume(Less.castAs<DefinedSVal>(), true);
   }
 
   C.addTransition(StateFound);
 
   if (AggressiveStdFindModeling) {
     auto StateNotFound = State->BindExpr(CE, LCtx, Param);

clang/lib/StaticAnalyzer/Checkers/StdLibraryFunctionsChecker.cpp

public:
     ProgramStateRef apply(ProgramStateRef State, const CallEvent &Call,
                           const Summary &Summary,
                           CheckerContext &C) const override {
       SVal V = getArgSVal(Call, getArgNo());
       if (V.isUndef())
         return State;
 
       DefinedOrUnknownSVal L = V.castAs<DefinedOrUnknownSVal>();
-      if (!L.getAs<Loc>())
+      if (!isa<Loc>(L))
         return State;
 
       return State->assume(L, CannotBeNull);
     }
 
     ValueConstraintPtr negate() const override {
       NotNullConstraint Tmp(*this);
       Tmp.CannotBeNull = !this->CannotBeNull;

clang/lib/StaticAnalyzer/Checkers/UninitializedObject/UninitializedObjectChecker.cpp

for (const FieldDecl *I : RD->fields()) {
 
     if (T->isArrayType()) {
       IsAnyFieldInitialized = true;
       continue;
     }
 
     SVal V = State->getSVal(FieldVal);
 
-    if (isDereferencableType(T) || V.getAs<nonloc::LocAsInteger>()) {
+    if (isDereferencableType(T) || isa<nonloc::LocAsInteger>(V)) {
       if (isDereferencableUninit(FR, LocalChain))
         ContainsUninitField = true;
       continue;
     }
 
     if (isPrimitiveType(T)) {
       if (isPrimitiveUninit(V)) {
         if (addFieldToUninits(LocalChain.add(RegularField(FR))))

clang/lib/StaticAnalyzer/Checkers/UninitializedObject/UninitializedPointee.cpp

 //===----------------------------------------------------------------------===//
 
 bool FindUninitializedFields::isDereferencableUninit(
     const FieldRegion *FR, FieldChainInfo LocalChain) {
 
   SVal V = State->getSVal(FR);
 
   assert((isDereferencableType(FR->getDecl()->getType()) ||
-          V.getAs<nonloc::LocAsInteger>()) &&
+          isa<nonloc::LocAsInteger>(V)) &&
          "This method only checks dereferenceable objects!");
 
-  if (V.isUnknown() || V.getAs<loc::ConcreteInt>()) {
+  if (V.isUnknown() || isa<loc::ConcreteInt>(V)) {
     IsAnyFieldInitialized = true;
     return false;
   }
 
   if (V.isUndef()) {
     return addFieldToUninits(
         LocalChain.add(LocField(FR, /*IsDereferenced*/ false)), FR);
   }
static llvm::Optional<DereferenceInfo> dereference(ProgramStateRef State,
   llvm::SmallSet<const TypedValueRegion *, 5> VisitedRegions;
 
   SVal V = State->getSVal(FR);
   assert(V.getAsRegion() && "V must have an underlying region!");
 
   // If the static type of the field is a void pointer, or it is a
   // nonloc::LocAsInteger, we need to cast it back to the dynamic type before
   // dereferencing.
-  bool NeedsCastBack = isVoidPointer(FR->getDecl()->getType()) ||
-                       V.getAs<nonloc::LocAsInteger>();
+  bool NeedsCastBack =
+      isVoidPointer(FR->getDecl()->getType()) || isa<nonloc::LocAsInteger>(V);
 
   // The region we'd like to acquire.
   const auto *R = V.getAsRegion()->getAs<TypedValueRegion>();
   if (!R)
     return None;
 
   VisitedRegions.insert(R);
 

clang/lib/StaticAnalyzer/Checkers/UnixAPIChecker.cpp

else {
       // See also: MallocChecker.cpp / M_ZERO.
       return;
     }
   }
 
   // Now check if oflags has O_CREAT set.
   const Expr *oflagsEx = CE->getArg(FlagsArgIndex);
   const SVal V = C.getSVal(oflagsEx);
-  if (!V.getAs<NonLoc>()) {
+  if (!isa<NonLoc>(V)) {
     // The case where 'V' can be a location can only be due to a bad header,
     // so in this case bail out.
     return;
   }
   NonLoc oflags = V.castAs<NonLoc>();
   NonLoc ocreateFlag = C.getSValBuilder()
       .makeIntVal(Val_O_CREAT.getValue(), oflagsEx->getType()).castAs<NonLoc>();
   SVal maskedFlagsUC = C.getSValBuilder().evalBinOpNN(state, BO_And,

clang/lib/StaticAnalyzer/Checkers/VLASizeChecker.cpp

void VLASizeChecker::checkPreStmt(const DeclStmt *DS, CheckerContext &C) const {
   // Check the VLA sizes for validity.
 
   SVal ArraySize;
 
   State = checkVLA(C, State, VLA, ArraySize);
   if (!State)
     return;
 
-  auto ArraySizeNL = ArraySize.getAs<NonLoc>();
-  if (!ArraySizeNL) {
+  if (!isa<NonLoc>(ArraySize)) {
     // Array size could not be determined but state may contain new assumptions.
     C.addTransition(State);
     return;
   }
 
   // VLASizeChecker is responsible for defining the extent of the array.
   if (VD) {
     State =
         setDynamicExtent(State, State->getRegion(VD, C.getLocationContext()),
-                         ArraySize.castAs<DefinedOrUnknownSVal>(), SVB);
+                         ArraySize.castAs<NonLoc>(), SVB);
   }
 
   // Remember our assumptions!
   C.addTransition(State);
 }
 
 void VLASizeChecker::checkPreStmt(const UnaryExprOrTypeTraitExpr *UETTE,
                                   CheckerContext &C) const {

clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

public:
   }
 
   static void addMacroVisitorIfNecessary(
         const ExplodedNode *N, const MemRegion *R,
         bool EnableNullFPSuppression, PathSensitiveBugReport &BR,
         const SVal V) {
     AnalyzerOptions &Options = N->getState()->getAnalysisManager().options;
     if (EnableNullFPSuppression && Options.ShouldSuppressNullReturnPaths &&
-        V.getAs<Loc>())
+        isa<Loc>(V))
       BR.addVisitor<MacroNullReturnSuppressionVisitor>(R->getAs<SubRegion>(),
                                                        V);
   }
 
   void* getTag() const {
     static int Tag = 0;
     return static_cast<void *>(&Tag);
   }
PathDiagnosticPieceRef visitNodeInitial(const ExplodedNode *N,
     const Expr *RetE = Ret->getRetValue();
     assert(RetE && "Tracking a return value for a void function");
 
     // Handle cases where a reference is returned and then immediately used.
     Optional<Loc> LValue;
     if (RetE->isGLValue()) {
       if ((LValue = V.getAs<Loc>())) {
         SVal RValue = State->getRawSVal(*LValue, RetE->getType());
-        if (RValue.getAs<DefinedSVal>())
+        if (isa<DefinedSVal>(RValue))
           V = RValue;
       }
     }
 
     // Ignore aggregate rvalues.
-    if (V.getAs<nonloc::LazyCompoundVal>() ||
-        V.getAs<nonloc::CompoundVal>())
+    if (isa<nonloc::LazyCompoundVal, nonloc::CompoundVal>(V))
       return nullptr;
 
     RetE = RetE->IgnoreParenCasts();
 
     // Let's track the return value.
     getParentTracker().track(RetE, N, {TKind, EnableNullFPSuppression});
 
     // Build an appropriate message based on the return value.
     SmallString<64> Msg;
     llvm::raw_svector_ostream Out(Msg);
 
     bool WouldEventBeMeaningless = false;
 
     if (State->isNull(V).isConstrainedTrue()) {
-      if (V.getAs<Loc>()) {
+      if (isa<Loc>(V)) {
 
         // If we have counter-suppression enabled, make sure we keep visiting
         // future nodes. We want to emit a path note as well, in case
         // the report is resurrected as valid later on.
         if (EnableNullFPSuppression &&
             Options.ShouldAvoidSuppressingNullArgumentPaths)
           Mode = MaybeUnsuppress;
 
if (State->isNull(V).isConstrainedTrue()) {
         // There is nothing interesting about returning a value, when it is
         // plain value without any constraints, and the function is guaranteed
         // to return that every time. We could use CFG::isLinear() here, but
         // constexpr branches are obvious to the compiler, not necesserily to
         // the programmer.
         if (N->getCFG().size() == 3)
           WouldEventBeMeaningless = true;
 
-        if (V.getAs<Loc>())
-          Out << "Returning pointer";
-        else
-          Out << "Returning value";
+        Out << (isa<Loc>(V) ? "Returning pointer" : "Returning value");
       }
     }
 
     if (LValue) {
       if (const MemRegion *MR = LValue->getAsRegion()) {
         if (MR->canPrintPretty()) {
           Out << " (reference to ";
           MR->printPretty(Out);
case StoreInfo::Initialization:
     break;
   case StoreInfo::BlockCapture:
     Action = HasPrefix ? "captured by block as " : "Captured by block as ";
     break;
   default:
     llvm_unreachable("Unexpected store kind");
   }
 
-  if (SI.Value.getAs<loc::ConcreteInt>()) {
+  if (isa<loc::ConcreteInt>(SI.Value)) {
     OS << Action << (isObjCPointer(SI.Dest) ? "nil" : "a null pointer value");
 
   } else if (auto CVal = SI.Value.getAs<nonloc::ConcreteInt>()) {
     OS << Action << CVal->getValue();
 
   } else if (SI.Origin && SI.Origin->canPrintPretty()) {
     OS << Action << "the value of ";
     SI.Origin->printPretty(OS);

 /// Display diagnostics for passing bad region as a parameter.
 static void showBRParamDiagnostics(llvm::raw_svector_ostream &OS,
                                    StoreInfo SI) {
   const auto *VR = cast<VarRegion>(SI.Dest);
   const auto *Param = cast<ParmVarDecl>(VR->getDecl());
 
   OS << "Passing ";
 
-  if (SI.Value.getAs<loc::ConcreteInt>()) {
+  if (isa<loc::ConcreteInt>(SI.Value)) {
     OS << (isObjCPointer(Param) ? "nil object reference"
                                 : "null pointer value");
 
   } else if (SI.Value.isUndef()) {
     OS << "uninitialized value";
 
   } else if (auto CI = SI.Value.getAs<nonloc::ConcreteInt>()) {
     OS << "the value " << CI->getValue();
static void showBRParamDiagnostics(llvm::raw_svector_ostream &OS,
   }
 }
 
 /// Show default diagnostics for storing bad region.
 static void showBRDefaultDiagnostics(llvm::raw_svector_ostream &OS,
                                      StoreInfo SI) {
   const bool HasSuffix = SI.Dest->canPrintPretty();
 
-  if (SI.Value.getAs<loc::ConcreteInt>()) {
+  if (isa<loc::ConcreteInt>(SI.Value)) {
     OS << (isObjCPointer(SI.Dest) ? "nil object reference stored"
                                   : (HasSuffix ? "Null pointer value stored"
                                                : "Storing null pointer value"));
 
   } else if (SI.Value.isUndef()) {
     OS << (HasSuffix ? "Uninitialized value stored"
                      : "Storing uninitialized value");
 
if (isUnderconstrained(PrevN)) {
     // the transition point.
     assert(!isUnderconstrained(N));
 
     // We found the transition point for the constraint.  We now need to
     // pretty-print the constraint. (work-in-progress)
     SmallString<64> sbuf;
     llvm::raw_svector_ostream os(sbuf);
 
-    if (Constraint.getAs<Loc>()) {
+    if (isa<Loc>(Constraint)) {
       os << "Assuming pointer value is ";
       os << (Assumption ? "non-null" : "null");
     }
 
     if (os.str().empty())
       return nullptr;
 
     // Construct a new PathDiagnosticPiece.

clang/lib/StaticAnalyzer/Core/CallEvent.cpp

 
 SVal CXXInstanceCall::getCXXThisVal() const {
   const Expr *Base = getCXXThisExpr();
   // FIXME: This doesn't handle an overloaded ->* operator.
   if (!Base)
     return UnknownVal();
 
   SVal ThisVal = getSVal(Base);
-  assert(ThisVal.isUnknownOrUndef() || ThisVal.getAs<Loc>());
+  assert(ThisVal.isUnknownOrUndef() || isa<Loc>(ThisVal));
   return ThisVal;
 }
 
 RuntimeDefinition CXXInstanceCall::getRuntimeDefinition() const {
   // Do we have a decl at all?
   const Decl *D = getDecl();
   if (!D)
     return {};

clang/lib/StaticAnalyzer/Core/CheckerContext.cpp

 }
 
 /// Evaluate comparison and return true if it's known that condition is true
 static bool evalComparison(SVal LHSVal, BinaryOperatorKind ComparisonOp,
                            SVal RHSVal, ProgramStateRef State) {
   if (LHSVal.isUnknownOrUndef())
     return false;
   ProgramStateManager &Mgr = State->getStateManager();
-  if (!LHSVal.getAs<NonLoc>()) {
+  if (!isa<NonLoc>(LHSVal)) {
     LHSVal = Mgr.getStoreManager().getBinding(State->getStore(),
                                               LHSVal.castAs<Loc>());
-    if (LHSVal.isUnknownOrUndef() || !LHSVal.getAs<NonLoc>())
+    if (LHSVal.isUnknownOrUndef() || !isa<NonLoc>(LHSVal))
       return false;
   }
 
   SValBuilder &Bldr = Mgr.getSValBuilder();
   SVal Eval = Bldr.evalBinOp(State, ComparisonOp, LHSVal, RHSVal,
                              Bldr.getConditionType());
   if (Eval.isUnknownOrUndef())
     return false;

clang/lib/StaticAnalyzer/Core/ExprEngine.cpp

ProgramStateRef ExprEngine::createTemporaryRegionIfNeeded(
   // we're often having with respect to C++ temporaries. If only we modelled
   // the actual execution order of statements properly in the CFG,
   // all the hassle with adjustments would not be necessary,
   // and perhaps the whole function would be removed.
   SVal InitValWithAdjustments = State->getSVal(InitWithAdjustments, LC);
   if (!Result) {
     // If we don't have an explicit result expression, we're in "if needed"
     // mode. Only create a region if the current value is a NonLoc.
-    if (!InitValWithAdjustments.getAs<NonLoc>()) {
+    if (!isa<NonLoc>(InitValWithAdjustments)) {
       if (OutRegionWithAdjustments)
         *OutRegionWithAdjustments = nullptr;
       return State;
     }
     Result = InitWithAdjustments;
   } else {
     // We need to create a region no matter what. Make sure we don't try to
     // stuff a Loc into a non-pointer temporary region.
-    assert(!InitValWithAdjustments.getAs<Loc>() ||
+    assert(!isa<Loc>(InitValWithAdjustments) ||
            Loc::isLocType(Result->getType()) ||
            Result->getType()->isMemberPointerType());
   }
 
   ProgramStateManager &StateMgr = State->getStateManager();
   MemRegionManager &MRMgr = StateMgr.getRegionManager();
   StoreManager &StoreMgr = StateMgr.getStoreManager();
 
for (iterator I = builder.begin(), E = builder.end(); I != E; ++I) {
         builder.generateNode(I, state);
         return;
       }
     }
 
     llvm_unreachable("No block with label.");
   }
 
-  if (V.getAs<loc::ConcreteInt>() || V.getAs<UndefinedVal>()) {
+  if (isa<UndefinedVal, loc::ConcreteInt>(V)) {
     // Dispatch to the first target and mark it as a sink.
     //ExplodedNode* N = builder.generateNode(builder.begin(), state, true);
     // FIXME: add checker visit.
     //    UndefBranches.insert(N);
     return;
   }
 
   // This is really a catch-all.  We don't support symbolics yet.
void ExprEngine::evalBind(ExplodedNodeSet &Dst, const Stmt *StoreE,
   ExplodedNodeSet CheckedSet;
   getCheckerManager().runCheckersForBind(CheckedSet, Pred, location, Val,
                                          StoreE, *this, *PP);
 
   StmtNodeBuilder Bldr(CheckedSet, Dst, *currBldrCtx);
 
   // If the location is not a 'Loc', it will already be handled by
   // the checkers.  There is nothing left to do.
-  if (!location.getAs<Loc>()) {
+  if (!isa<Loc>(location)) {
     const ProgramPoint L = PostStore(StoreE, LC, /*Loc*/nullptr,
                                      /*tag*/nullptr);
     ProgramStateRef state = Pred->getState();
     state = processPointerEscapedOnBind(state, location, Val, LC);
     Bldr.generateNode(L, state, Pred);
     return;
   }
 

 void ExprEngine::evalLoad(ExplodedNodeSet &Dst,
                           const Expr *NodeEx,
                           const Expr *BoundEx,
                           ExplodedNode *Pred,
                           ProgramStateRef state,
                           SVal location,
                           const ProgramPointTag *tag,
                           QualType LoadTy) {
-  assert(!location.getAs<NonLoc>() && "location cannot be a NonLoc.");
+  assert(!isa<NonLoc>(location) && "location cannot be a NonLoc.");
   assert(NodeEx);
   assert(BoundEx);
   // Evaluate the location (checks for bad dereferences).
   ExplodedNodeSet Tmp;
   evalLocation(Tmp, NodeEx, BoundEx, Pred, state, location, true);
   if (Tmp.empty())
     return;
 
void ExprEngine::VisitGCCAsmStmt(const GCCAsmStmt *A, ExplodedNode *Pred,
   // FIXME: Some day in the future it would be nice to allow a "plug-in"
   // which interprets the inline asm and stores proper results in the
   // outputs.
 
   ProgramStateRef state = Pred->getState();
 
   for (const Expr *O : A->outputs()) {
     SVal X = state->getSVal(O, Pred->getLocationContext());
-    assert(!X.getAs<NonLoc>());  // Should be an Lval, or unknown, undef.
+    assert(!isa<NonLoc>(X)); // Should be an Lval, or unknown, undef.
 
     if (Optional<Loc> LV = X.getAs<Loc>())
       state = state->bindLoc(*LV, UnknownVal(), Pred->getLocationContext());
   }
 
   Bldr.generateNode(A, Pred, state);
 }
 

clang/lib/StaticAnalyzer/Core/ExprEngineC.cpp

 /// If \p Other is a location, conjure a symbol for \p Symbol
 /// (offset) if it is unknown so that memory arithmetic always
 /// results in an ElementRegion.
 /// \p Count The number of times the current basic block was visited.
 static SVal conjureOffsetSymbolOnLocation(
     SVal Symbol, SVal Other, Expr* Expression, SValBuilder &svalBuilder,
     unsigned Count, const LocationContext *LCtx) {
   QualType Ty = Expression->getType();
-  if (Other.getAs<Loc>() &&
-      Ty->isIntegralOrEnumerationType() &&
+  if (isa<Loc>(Other) && Ty->isIntegralOrEnumerationType() &&
       Symbol.isUnknown()) {
     return svalBuilder.conjureSymbolVal(Expression, LCtx, Ty, Count);
   }
   return Symbol;
 }
 
 void ExprEngine::VisitBinaryOperator(const BinaryOperator* B,
                                      ExplodedNode *Pred,
switch (CastE->getCastKind()) {
       case CK_Dependent:
       case CK_ArrayToPointerDecay:
       case CK_BitCast:
       case CK_AddressSpaceConversion:
       case CK_BooleanToSignedIntegral:
       case CK_IntegralToPointer:
       case CK_PointerToIntegral: {
         SVal V = state->getSVal(Ex, LCtx);
-        if (V.getAs<nonloc::PointerToMember>()) {
+        if (isa<nonloc::PointerToMember>(V)) {
           state = state->BindExpr(CastE, LCtx, UnknownVal());
           Bldr.generateNode(CastE, Pred, state);
           continue;
         }
         // Explicitly proceed with default handler for this case cascade.
         state =
             handleLValueBitCast(state, Ex, LCtx, T, ExTy, CastE, Bldr, Pred);
         continue;

clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp

 /// Adjusts a return value when the called function's return type does not
 /// match the caller's expression type. This can happen when a dynamic call
 /// is devirtualized, and the overriding method has a covariant (more specific)
 /// return type than the parent's method. For C++ objects, this means we need
 /// to add base casts.
 static SVal adjustReturnValue(SVal V, QualType ExpectedTy, QualType ActualTy,
                               StoreManager &StoreMgr) {
   // For now, the only adjustments we handle apply only to locations.
-  if (!V.getAs<Loc>())
+  if (!isa<Loc>(V))
     return V;
 
   // If the types already match, don't do any unnecessary work.
   ExpectedTy = ExpectedTy.getCanonicalType();
   ActualTy = ActualTy.getCanonicalType();
   if (ExpectedTy == ActualTy)
     return V;
 

clang/lib/StaticAnalyzer/Core/ProgramState.cpp

newState = Eng.notifyCheckersOfPointerEscape(newState, IS,
                                                  *ITraits);
   }
 
   return Eng.processRegionChanges(newState, IS, TopLevelInvalidated,
                                   Invalidated, LCtx, Call);
 }
 
 ProgramStateRef ProgramState::killBinding(Loc LV) const {
-  assert(!LV.getAs<loc::MemRegionVal>() && "Use invalidateRegion instead.");
+  assert(!isa<loc::MemRegionVal>(LV) && "Use invalidateRegion instead.");
 
   Store OldStore = getStore();
   const StoreRef &newStore =
     getStateManager().StoreMgr->killBinding(OldStore, LV);
 
   if (newStore.getStore() == OldStore)
     return this;
 

clang/lib/StaticAnalyzer/Core/RegionStore.cpp

 
 /// ArrayToPointer - Emulates the "decay" of an array to a pointer
 ///  type.  'Array' represents the lvalue of the array being decayed
 ///  to a pointer, and the returned SVal represents the decayed
 ///  version of that lvalue (i.e., a pointer to the first element of
 ///  the array).  This is called by ExprEngine when evaluating casts
 ///  from arrays to pointers.
 SVal RegionStoreManager::ArrayToPointer(Loc Array, QualType T) {
-  if (Array.getAs<loc::ConcreteInt>())
+  if (isa<loc::ConcreteInt>(Array))
     return Array;
 
-  if (!Array.getAs<loc::MemRegionVal>())
+  if (!isa<loc::MemRegionVal>(Array))
     return UnknownVal();
 
   const SubRegion *R =
       cast<SubRegion>(Array.castAs<loc::MemRegionVal>().getRegion());
   NonLoc ZeroIdx = svalBuilder.makeZeroArrayIndex();
   return loc::MemRegionVal(MRMgr.getElementRegion(T, ZeroIdx, R, Ctx));
 }
 
 //===----------------------------------------------------------------------===//
 // Loading values from regions.
 //===----------------------------------------------------------------------===//
 
 SVal RegionStoreManager::getBinding(RegionBindingsConstRef B, Loc L, QualType T) {
-  assert(!L.getAs<UnknownVal>() && "location unknown");
-  assert(!L.getAs<UndefinedVal>() && "location undefined");
+  assert(!isa<UnknownVal>(L) && "location unknown");
+  assert(!isa<UndefinedVal>(L) && "location undefined");
 
   // For access to concrete addresses, return UnknownVal.  Checks
   // for null dereferences (and similar errors) are done by checkers, not
   // the Store.
   // FIXME: We can consider lazily symbolicating such memory, but we really
   // should defer this when we can reason easily about symbolicating arrays
   // of bytes.
   if (L.getAs<loc::ConcreteInt>()) {
if (const Optional<SVal> &D = B.getDefaultBinding(superR)) {
     if (val.isZeroConstant())
       return svalBuilder.makeZeroVal(Ty);
 
     if (val.isUnknownOrUndef())
       return val;
 
     // Lazy bindings are usually handled through getExistingLazyBinding().
     // We should unify these two code paths at some point.
-    if (val.getAs<nonloc::LazyCompoundVal>() ||
-        val.getAs<nonloc::CompoundVal>())
+    if (isa<nonloc::LazyCompoundVal, nonloc::CompoundVal>(val))
       return val;
 
     llvm_unreachable("Unknown default value");
   }
 
   return None;
 }
 
RegionStoreManager::bindArray(RegionBindingsConstRef B,
   // FIXME: It's not responsibility of the Store to transform this lvalue
   // to rvalue. ExprEngine or maybe even CFG should do this before binding.
   if (Optional<loc::MemRegionVal> MRV = Init.getAs<loc::MemRegionVal>()) {
     SVal V = getBinding(B.asStore(), *MRV, R->getValueType());
     return bindAggregate(B, R, V);
   }
 
   // Handle lazy compound values.
-  if (Init.getAs<nonloc::LazyCompoundVal>())
+  if (isa<nonloc::LazyCompoundVal>(Init))
     return bindAggregate(B, R, Init);
 
   if (Init.isUnknown())
     return bindAggregate(B, R, UnknownVal());
 
   // Remaining case: explicit compound values.
   const nonloc::CompoundVal& CV = Init.castAs<nonloc::CompoundVal>();
   nonloc::CompoundVal::iterator VI = CV.begin(), VE = CV.end();

 
 RegionBindingsRef RegionStoreManager::bindVector(RegionBindingsConstRef B,
                                                  const TypedValueRegion* R,
                                                  SVal V) {
   QualType T = R->getValueType();
   const VectorType *VT = T->castAs<VectorType>(); // Use castAs for typedefs.
 
   // Handle lazy compound values and symbolic values.
-  if (V.getAs<nonloc::LazyCompoundVal>() || V.getAs<nonloc::SymbolVal>())
+  if (isa<nonloc::LazyCompoundVal, nonloc::SymbolVal>(V))
     return bindAggregate(B, R, V);
 
   // We may get non-CompoundVal accidentally due to imprecise cast logic or
   // that we are binding symbolic struct value. Kill the field values, and if
   // the value is symbolic go and bind it as a "default" binding.
-  if (!V.getAs<nonloc::CompoundVal>()) {
+  if (!isa<nonloc::CompoundVal>(V)) {
     return bindAggregate(B, R, UnknownVal());
   }
 
   QualType ElemType = VT->getElementType();
   nonloc::CompoundVal CV = V.castAs<nonloc::CompoundVal>();
   nonloc::CompoundVal::iterator VI = CV.begin(), VE = CV.end();
   unsigned index = 0, numElements = VT->getNumElements();
   RegionBindingsRef NewB(B);
RegionBindingsRef RegionStoreManager::bindStruct(RegionBindingsConstRef B,
 
   // Handle lazy compound values and symbolic values.
   if (Optional<nonloc::LazyCompoundVal> LCV =
         V.getAs<nonloc::LazyCompoundVal>()) {
     if (Optional<RegionBindingsRef> NewB = tryBindSmallStruct(B, R, RD, *LCV))
       return *NewB;
     return bindAggregate(B, R, V);
   }
-  if (V.getAs<nonloc::SymbolVal>())
+  if (isa<nonloc::SymbolVal>(V))
     return bindAggregate(B, R, V);
 
   // We may get non-CompoundVal accidentally due to imprecise cast logic or
   // that we are binding symbolic struct value. Kill the field values, and if
   // the value is symbolic go and bind it as a "default" binding.
-  if (V.isUnknown() || !V.getAs<nonloc::CompoundVal>())
+  if (V.isUnknown() || !isa<nonloc::CompoundVal>(V))
     return bindAggregate(B, R, UnknownVal());
 
   // The raw CompoundVal is essentially a symbolic InitListExpr: an (immutable)
   // list of other values. It appears pretty much only when there's an actual
   // initializer list expression in the program, and the analyzer tries to
   // unwrap it as soon as possible.
   // This code is where such unwrap happens: when the compound value is put into
   // the object that it was supposed to initialize (it's an *initializer* list,

clang/lib/StaticAnalyzer/Core/SValBuilder.cpp

 SVal SValBuilder::evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op,
                             SVal lhs, SVal rhs, QualType type) {
   if (lhs.isUndef() || rhs.isUndef())
     return UndefinedVal();
 
   if (lhs.isUnknown() || rhs.isUnknown())
     return UnknownVal();
 
-  if (lhs.getAs<nonloc::LazyCompoundVal>() ||
-      rhs.getAs<nonloc::LazyCompoundVal>()) {
+  if (isa<nonloc::LazyCompoundVal>(lhs) || isa<nonloc::LazyCompoundVal>(rhs)) {
     return UnknownVal();
   }
 
   if (op == BinaryOperatorKind::BO_Cmp) {
     // We can't reason about C++20 spaceship operator yet.
     //
     // FIXME: Support C++20 spaceship operator.
     //        The main problem here is that the result is not integer.

clang/lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp

if (Optional<loc::ConcreteInt> rInt = rhs.getAs<loc::ConcreteInt>()) {
         return evalCast(nonloc::ConcreteInt(*ResultInt), resultTy, QualType{});
       return UnknownVal();
     }
 
     // Special case comparisons against NULL.
     // This must come after the test if the RHS is a symbol, which is used to
     // build constraints. The address of any non-symbolic region is guaranteed
     // to be non-NULL, as is any label.
-    assert(rhs.getAs<loc::MemRegionVal>() || rhs.getAs<loc::GotoLabel>());
+    assert((isa<loc::MemRegionVal, loc::GotoLabel>(rhs)));
     if (lhs.isZeroConstant()) {
       switch (op) {
       default:
         break;
       case BO_EQ:
       case BO_GT:
       case BO_GE:
         return makeTruthVal(false, resultTy);

clang/lib/StaticAnalyzer/Core/Store.cpp

if (!BT.isNull() && !elementType.isNull()) {
         return Base;
     }
   }
 
   // If the base is an unknown or undefined value, just return it back.
   // FIXME: For absolute pointer addresses, we just return that value back as
   //  well, although in reality we should return the offset added to that
   //  value. See also the similar FIXME in getLValueFieldOrIvar().
-  if (Base.isUnknownOrUndef() || Base.getAs<loc::ConcreteInt>())
+  if (Base.isUnknownOrUndef() || isa<loc::ConcreteInt>(Base))
     return Base;
 
-  if (Base.getAs<loc::GotoLabel>())
+  if (isa<loc::GotoLabel>(Base))
     return UnknownVal();
 
   const SubRegion *BaseRegion =
       Base.castAs<loc::MemRegionVal>().getRegionAs<SubRegion>();
 
   // Pointer of any type can be cast and used as array base.
   const auto *ElemR = dyn_cast<ElementRegion>(BaseRegion);
 
if (!ElemR) {
     //
     //  Observe that 'p' binds to an AllocaRegion.
     return loc::MemRegionVal(MRMgr.getElementRegion(elementType, Offset,
                                                     BaseRegion, Ctx));
   }
 
   SVal BaseIdx = ElemR->getIndex();
 
-  if (!BaseIdx.getAs<nonloc::ConcreteInt>())
+  if (!isa<nonloc::ConcreteInt>(BaseIdx))
     return UnknownVal();
 
   const llvm::APSInt &BaseIdxI =
       BaseIdx.castAs<nonloc::ConcreteInt>().getValue();
 
   // Only allow non-integer offsets if the base region has no offset itself.
   // FIXME: This is a somewhat arbitrary restriction. We should be using
   // SValBuilder here to add the two offsets without checking their types.
-  if (!Offset.getAs<nonloc::ConcreteInt>()) {
+  if (!isa<nonloc::ConcreteInt>(Offset)) {
     if (isa<ElementRegion>(BaseRegion->StripCasts()))
       return UnknownVal();
 
     return loc::MemRegionVal(MRMgr.getElementRegion(
         elementType, Offset, cast<SubRegion>(ElemR->getSuperRegion()), Ctx));
   }
 
   const llvm::APSInt& OffI = Offset.castAs<nonloc::ConcreteInt>().getValue();