[StaticAnalyzer] Remove dead code (DO NOT COMMIT)

[kazu]

Summary

DO NOT COMMIT! This untested patch deletes dead code under
clang/lib/StaticAnalyzer, including debug functions. Please
intelligently choose what to actually remove.

[martong]

Thanks!

What was your method to discover the unused code? Did you use an automated tool?

clang/lib/StaticAnalyzer/Checkers/ArrayBoundCheckerV2.cpp

66

We shall not delete any dump or LLVM_DUMP_METHOD annotated function because they can be really useful in actual debugging, either in gdb or with other tools.

clang/lib/StaticAnalyzer/Checkers/CheckerDocumentation.cpp

30–33

As the comment says, we need this to demonstrate and document what can be the possible callbacks.

[steakhal]

Thanks @kazu. I evaluated your results and made a patch as D127836.
I think we can abandon this one.

clang/lib/StaticAnalyzer/Checkers/ArrayBoundCheckerV2.cpp

public:
 
   NonLoc getByteOffset() const { return byteOffset.castAs<NonLoc>(); }
   const SubRegion *getRegion() const { return baseRegion; }
 
   static RegionRawOffsetV2 computeOffset(ProgramStateRef state,
                                          SValBuilder &svalBuilder,
                                          SVal location);
 
-  void dump() const;
   void dumpToStream(raw_ostream &os) const;
 };
 }
 
 static SVal computeExtentBegin(SValBuilder &svalBuilder,
                                const MemRegion *region) {
   const MemSpaceRegion *SR = region->getMemorySpace();
   if (SR->getKind() == MemRegion::UnknownSpaceRegionKind)
void ArrayBoundCheckerV2::reportOOB(
   }
 
   auto BR = std::make_unique<PathSensitiveBugReport>(*BT, os.str(), errorNode);
   BR->addVisitor(std::move(Visitor));
   checkerContext.emitReport(std::move(BR));
 }
 
 #ifndef NDEBUG
-LLVM_DUMP_METHOD void RegionRawOffsetV2::dump() const {
-  dumpToStream(llvm::errs());
-}
 
 void RegionRawOffsetV2::dumpToStream(raw_ostream &os) const {
   os << "raw_offset_v2{" << getRegion() << ',' << getByteOffset() << '}';
 }
 #endif
 
 // Lazily computes a value to be used by 'computeOffset'.  If 'val'
 // is unknown or undefined, we lazily substitute '0'.  Otherwise,

clang/lib/StaticAnalyzer/Checkers/BasicObjCFoundationChecks.cpp

 namespace {
 class CFNumberChecker : public Checker< check::PreStmt<CallExpr> > {
   mutable std::unique_ptr<APIMisuse> BT;
   mutable IdentifierInfo *ICreate, *IGetValue;
 public:
   CFNumberChecker() : ICreate(nullptr), IGetValue(nullptr) {}
 
   void checkPreStmt(const CallExpr *CE, CheckerContext &C) const;
-
-private:
-  void EmitError(const TypedRegion* R, const Expr *Ex,
-                uint64_t SourceSize, uint64_t TargetSize, uint64_t NumberKind);
 };
 } // end anonymous namespace
 
 enum CFNumberType {
   kCFNumberSInt8Type = 1,
   kCFNumberSInt16Type = 2,
   kCFNumberSInt32Type = 3,
   kCFNumberSInt64Type = 4,

clang/lib/StaticAnalyzer/Checkers/CheckerDocumentation.cpp

 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
 
 using namespace clang;
 using namespace ento;
 
 // All checkers should be placed into anonymous namespace.
 // We place the CheckerDocumentation inside ento namespace to make the
 // it visible in doxygen.
-namespace clang {
-namespace ento {
-
-/// This checker documents the callback functions checkers can use to implement
-/// the custom handling of the specific events during path exploration as well
-/// as reporting bugs. Most of the callbacks are targeted at path-sensitive
-/// checking.
-///
-/// \sa CheckerContext
-class CheckerDocumentation : public Checker< check::PreStmt<ReturnStmt>,
-                                       check::PostStmt<DeclStmt>,
-                                       check::PreObjCMessage,
-                                       check::PostObjCMessage,
-                                       check::ObjCMessageNil,
-                                       check::PreCall,
-                                       check::PostCall,
-                                       check::BranchCondition,
-                                       check::NewAllocator,
-                                       check::Location,
-                                       check::Bind,
-                                       check::DeadSymbols,
-                                       check::BeginFunction,
-                                       check::EndFunction,
-                                       check::EndAnalysis,
-                                       check::EndOfTranslationUnit,
-                                       eval::Call,
-                                       eval::Assume,
-                                       check::LiveSymbols,
-                                       check::RegionChanges,
-                                       check::PointerEscape,
-                                       check::ConstPointerEscape,
-                                       check::Event<ImplicitNullDerefEvent>,
-                                       check::ASTDecl<FunctionDecl> > {
-public:
-  /// Pre-visit the Statement.
-  ///
-  /// The method will be called before the analyzer core processes the
-  /// statement. The notification is performed for every explored CFGElement,
-  /// which does not include the control flow statements such as IfStmt. The
-  /// callback can be specialized to be called with any subclass of Stmt.
-  ///
-  /// See checkBranchCondition() callback for performing custom processing of
-  /// the branching statements.
-  ///
-  /// check::PreStmt<ReturnStmt>
-  void checkPreStmt(const ReturnStmt *DS, CheckerContext &C) const {}
-
-  /// Post-visit the Statement.
-  ///
-  /// The method will be called after the analyzer core processes the
-  /// statement. The notification is performed for every explored CFGElement,
-  /// which does not include the control flow statements such as IfStmt. The
-  /// callback can be specialized to be called with any subclass of Stmt.
-  ///
-  /// check::PostStmt<DeclStmt>
-  void checkPostStmt(const DeclStmt *DS, CheckerContext &C) const;
-
-  /// Pre-visit the Objective C message.
-  ///
-  /// This will be called before the analyzer core processes the method call.
-  /// This is called for any action which produces an Objective-C message send,
-  /// including explicit message syntax and property access.
-  ///
-  /// check::PreObjCMessage
-  void checkPreObjCMessage(const ObjCMethodCall &M, CheckerContext &C) const {}
-
-  /// Post-visit the Objective C message.
-  /// \sa checkPreObjCMessage()
-  ///
-  /// check::PostObjCMessage
-  void checkPostObjCMessage(const ObjCMethodCall &M, CheckerContext &C) const {}
-
-  /// Visit an Objective-C message whose receiver is nil.
-  ///
-  /// This will be called when the analyzer core processes a method call whose
-  /// receiver is definitely nil. In this case, check{Pre/Post}ObjCMessage and
-  /// check{Pre/Post}Call will not be called.
-  ///
-  /// check::ObjCMessageNil
-  void checkObjCMessageNil(const ObjCMethodCall &M, CheckerContext &C) const {}
-
-  /// Pre-visit an abstract "call" event.
-  ///
-  /// This is used for checkers that want to check arguments or attributed
-  /// behavior for functions and methods no matter how they are being invoked.
-  ///
-  /// Note that this includes ALL cross-body invocations, so if you want to
-  /// limit your checks to, say, function calls, you should test for that at the
-  /// beginning of your callback function.
-  ///
-  /// check::PreCall
-  void checkPreCall(const CallEvent &Call, CheckerContext &C) const {}
-
-  /// Post-visit an abstract "call" event.
-  /// \sa checkPreObjCMessage()
-  ///
-  /// check::PostCall
-  void checkPostCall(const CallEvent &Call, CheckerContext &C) const {}
-
-  /// Pre-visit of the condition statement of a branch (such as IfStmt).
-  void checkBranchCondition(const Stmt *Condition, CheckerContext &Ctx) const {}
-
-  /// Post-visit the C++ operator new's allocation call.
-  ///
-  /// Execution of C++ operator new consists of the following phases: (1) call
-  /// default or overridden operator new() to allocate memory (2) cast the
-  /// return value of operator new() from void pointer type to class pointer
-  /// type, (3) assuming that the value is non-null, call the object's
-  /// constructor over this pointer, (4) declare that the value of the
-  /// new-expression is this pointer. This callback is called between steps
-  /// (2) and (3). Post-call for the allocator is called after step (1).
-  /// Pre-statement for the new-expression is called on step (4) when the value
-  /// of the expression is evaluated.
-  /// \param NE     The C++ new-expression that triggered the allocation.
-  /// \param Target The allocated region, casted to the class type.
-  void checkNewAllocator(const CXXNewExpr *NE, SVal Target,
-                         CheckerContext &) const {}
-
-  /// Called on a load from and a store to a location.
-  ///
-  /// The method will be called each time a location (pointer) value is
-  /// accessed.
-  /// \param Loc    The value of the location (pointer).
-  /// \param IsLoad The flag specifying if the location is a store or a load.
-  /// \param S      The load is performed while processing the statement.
-  ///
-  /// check::Location
-  void checkLocation(SVal Loc, bool IsLoad, const Stmt *S,
-                     CheckerContext &) const {}
-
-  /// Called on binding of a value to a location.
-  ///
-  /// \param Loc The value of the location (pointer).
-  /// \param Val The value which will be stored at the location Loc.
-  /// \param S   The bind is performed while processing the statement S.
-  ///
-  /// check::Bind
-  void checkBind(SVal Loc, SVal Val, const Stmt *S, CheckerContext &) const {}
-
-  /// Called whenever a symbol becomes dead.
-  ///
-  /// This callback should be used by the checkers to aggressively clean
-  /// up/reduce the checker state, which is important for reducing the overall
-  /// memory usage. Specifically, if a checker keeps symbol specific information
-  /// in the state, it can and should be dropped after the symbol becomes dead.
-  /// In addition, reporting a bug as soon as the checker becomes dead leads to
-  /// more precise diagnostics. (For example, one should report that a malloced
-  /// variable is not freed right after it goes out of scope.)
-  ///
-  /// \param SR The SymbolReaper object can be queried to determine which
-  ///           symbols are dead.
-  ///
-  /// check::DeadSymbols
-  void checkDeadSymbols(SymbolReaper &SR, CheckerContext &C) const {}
-
-
-  /// Called when the analyzer core starts analyzing a function,
-  /// regardless of whether it is analyzed at the top level or is inlined.
-  ///
-  /// check::BeginFunction
-  void checkBeginFunction(CheckerContext &Ctx) const {}
-
-  /// Called when the analyzer core reaches the end of a
-  /// function being analyzed regardless of whether it is analyzed at the top
-  /// level or is inlined.
-  ///
-  /// check::EndFunction
-  void checkEndFunction(const ReturnStmt *RS, CheckerContext &Ctx) const {}
-
-  /// Called after all the paths in the ExplodedGraph reach end of path
-  /// - the symbolic execution graph is fully explored.
-  ///
-  /// This callback should be used in cases when a checker needs to have a
-  /// global view of the information generated on all paths. For example, to
-  /// compare execution summary/result several paths.
-  /// See IdempotentOperationChecker for a usage example.
-  ///
-  /// check::EndAnalysis
-  void checkEndAnalysis(ExplodedGraph &G,
-                        BugReporter &BR,
-                        ExprEngine &Eng) const {}
-
-  /// Called after analysis of a TranslationUnit is complete.
-  ///
-  /// check::EndOfTranslationUnit
-  void checkEndOfTranslationUnit(const TranslationUnitDecl *TU,
-                                 AnalysisManager &Mgr,
-                                 BugReporter &BR) const {}
-
-  /// Evaluates function call.
-  ///
-  /// The analysis core treats all function calls in the same way. However, some
-  /// functions have special meaning, which should be reflected in the program
-  /// state. This callback allows a checker to provide domain specific knowledge
-  /// about the particular functions it knows about.
-  ///
-  /// \returns true if the call has been successfully evaluated
-  /// and false otherwise. Note, that only one checker can evaluate a call. If
-  /// more than one checker claims that they can evaluate the same call the
-  /// first one wins.
-  ///
-  /// eval::Call
-  bool evalCall(const CallExpr *CE, CheckerContext &C) const { return true; }
-
-  /// Handles assumptions on symbolic values.
-  ///
-  /// This method is called when a symbolic expression is assumed to be true or
-  /// false. For example, the assumptions are performed when evaluating a
-  /// condition at a branch. The callback allows checkers track the assumptions
-  /// performed on the symbols of interest and change the state accordingly.
-  ///
-  /// eval::Assume
-  ProgramStateRef evalAssume(ProgramStateRef State,
-                                 SVal Cond,
-                                 bool Assumption) const { return State; }
-
-  /// Allows modifying SymbolReaper object. For example, checkers can explicitly
-  /// register symbols of interest as live. These symbols will not be marked
-  /// dead and removed.
-  ///
-  /// check::LiveSymbols
-  void checkLiveSymbols(ProgramStateRef State, SymbolReaper &SR) const {}
-
-  /// Called when the contents of one or more regions change.
-  ///
-  /// This can occur in many different ways: an explicit bind, a blanket
-  /// invalidation of the region contents, or by passing a region to a function
-  /// call whose behavior the analyzer cannot model perfectly.
-  ///
-  /// \param State The current program state.
-  /// \param Invalidated A set of all symbols potentially touched by the change.
-  /// \param ExplicitRegions The regions explicitly requested for invalidation.
-  ///        For a function call, this would be the arguments. For a bind, this
-  ///        would be the region being bound to.
-  /// \param Regions The transitive closure of regions accessible from,
-  ///        \p ExplicitRegions, i.e. all regions that may have been touched
-  ///        by this change. For a simple bind, this list will be the same as
-  ///        \p ExplicitRegions, since a bind does not affect the contents of
-  ///        anything accessible through the base region.
-  /// \param LCtx LocationContext that is useful for getting various contextual
-  ///        info, like callstack, CFG etc.
-  /// \param Call The opaque call triggering this invalidation. Will be 0 if the
-  ///        change was not triggered by a call.
-  ///
-  /// check::RegionChanges
-  ProgramStateRef
-    checkRegionChanges(ProgramStateRef State,
-                       const InvalidatedSymbols *Invalidated,
-                       ArrayRef<const MemRegion *> ExplicitRegions,
-                       ArrayRef<const MemRegion *> Regions,
-                       const LocationContext *LCtx,
-                       const CallEvent *Call) const {
-    return State;
-  }
-
-  /// Called when pointers escape.
-  ///
-  /// This notifies the checkers about pointer escape, which occurs whenever
-  /// the analyzer cannot track the symbol any more. For example, as a
-  /// result of assigning a pointer into a global or when it's passed to a
-  /// function call the analyzer cannot model.
-  ///
-  /// \param State The state at the point of escape.
-  /// \param Escaped The list of escaped symbols.
-  /// \param Call The corresponding CallEvent, if the symbols escape as
-  /// parameters to the given call.
-  /// \param Kind How the symbols have escaped.
-  /// \returns Checkers can modify the state by returning a new state.
-  ProgramStateRef checkPointerEscape(ProgramStateRef State,
-                                     const InvalidatedSymbols &Escaped,
-                                     const CallEvent *Call,
-                                     PointerEscapeKind Kind) const {
-    return State;
-  }
-
-  /// Called when const pointers escape.
-  ///
-  /// Note: in most cases checkPointerEscape callback is sufficient.
-  /// \sa checkPointerEscape
-  ProgramStateRef checkConstPointerEscape(ProgramStateRef State,
-                                     const InvalidatedSymbols &Escaped,
-                                     const CallEvent *Call,
-                                     PointerEscapeKind Kind) const {
-    return State;
-  }
-
-  /// check::Event<ImplicitNullDerefEvent>
-  void checkEvent(ImplicitNullDerefEvent Event) const {}
-
-  /// Check every declaration in the AST.
-  ///
-  /// An AST traversal callback, which should only be used when the checker is
-  /// not path sensitive. It will be called for every Declaration in the AST and
-  /// can be specialized to only be called on subclasses of Decl, for example,
-  /// FunctionDecl.
-  ///
-  /// check::ASTDecl<FunctionDecl>
-  void checkASTDecl(const FunctionDecl *D,
-                    AnalysisManager &Mgr,
-                    BugReporter &BR) const {}
-};
-
-void CheckerDocumentation::checkPostStmt(const DeclStmt *DS,
-                                         CheckerContext &C) const {
-}
-
-} // end namespace ento
-} // end namespace clang

clang/lib/StaticAnalyzer/Checkers/DynamicTypePropagation.cpp

class DynamicTypePropagation:
     public Checker< check::PreCall,
                     check::PostCall,
                     check::DeadSymbols,
                     check::PostStmt<CastExpr>,
                     check::PostStmt<CXXNewExpr>,
                     check::PreObjCMessage,
                     check::PostObjCMessage > {
 
-  const ObjCObjectType *getObjectTypeForAllocAndNew(const ObjCMessageExpr *MsgE,
-                                                    CheckerContext &C) const;
-
   /// Return a better dynamic type if one can be derived from the cast.
   const ObjCObjectPointerType *getBetterObjCType(const Expr *CastE,
                                                  CheckerContext &C) const;
 
   ExplodedNode *dynamicTypePropagationOnCasts(const CastExpr *CE,
                                               ProgramStateRef &State,
                                               CheckerContext &C) const;
 

clang/lib/StaticAnalyzer/Checkers/FuchsiaHandleChecker.cpp

break;
       CASE(Kind::Escaped)
       CASE(Kind::Unowned)
     }
     if (ErrorSym) {
       OS << " ErrorSym: ";
       ErrorSym->dumpToStream(OS);
     }
   }
-
-  LLVM_DUMP_METHOD void dump() const { dump(llvm::errs()); }
 };
 
 template <typename Attr> static bool hasFuchsiaAttr(const Decl *D) {
   return D->hasAttr<Attr>() && D->getAttr<Attr>()->getHandleType() == "Fuchsia";
 }
 
 template <typename Attr> static bool hasFuchsiaUnownedAttr(const Decl *D) {
   return D->hasAttr<Attr>() &&
static const ExplodedNode *getAcquireSite(const ExplodedNode *N, SymbolRef Sym,
   }
   return nullptr;
 }
 
 namespace {
 class FuchsiaHandleSymbolVisitor final : public SymbolVisitor {
 public:
   FuchsiaHandleSymbolVisitor(ProgramStateRef State) : State(std::move(State)) {}
-  ProgramStateRef getState() const { return State; }
 
   bool VisitSymbol(SymbolRef S) override {
     if (const auto *HandleType = S->getType()->getAs<TypedefType>())
       if (HandleType->getDecl()->getName() == HandleTypeName)
         Symbols.push_back(S);
     return true;
   }
 

clang/lib/StaticAnalyzer/Checkers/GenericTaintChecker.cpp

bool contains(ArgIdxTy ArgIdx) const {
     if (llvm::is_contained(DiscreteArgs, ArgIdx))
       return true;
 
     return VariadicIndex && ArgIdx >= *VariadicIndex;
   }
 
   bool isEmpty() const { return DiscreteArgs.empty() && !VariadicIndex; }
 
-  ArgVecTy ArgsUpTo(ArgIdxTy LastArgIdx) const {
-    ArgVecTy Args;
-    for (ArgIdxTy I = ReturnValueIndex; I <= LastArgIdx; ++I) {
-      if (contains(I))
-        Args.push_back(I);
-    }
-    return Args;
-  }
-
 private:
   ArgVecTy DiscreteArgs;
   Optional<ArgIdxTy> VariadicIndex;
 };
 
 /// A struct used to specify taint propagation rules for a function.
 ///
 /// If any of the possible taint source arguments is tainted, all of the
void parseConfig(const std::string &Option,
                    TaintConfiguration::Propagation &&P,
                    RulesContTy &Rules) const;
 
   CheckerManager &Mgr;
 };
 
 class GenericTaintChecker : public Checker<check::PreCall, check::PostCall> {
 public:
-  static void *getTag() {
-    static int Tag;
-    return &Tag;
-  }
-
   void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
   void checkPostCall(const CallEvent &Call, CheckerContext &C) const;
 
   void printState(raw_ostream &Out, ProgramStateRef State, const char *NL,
                   const char *Sep) const override;
 
   /// Generate a report if the expression is tainted or points to tainted data.
   bool generateReportIfTainted(const Expr *E, StringRef Msg,

clang/lib/StaticAnalyzer/Checkers/Iterator.h

public:
   IteratorPosition reAssign(const MemRegion *NewCont) const {
     return IteratorPosition(NewCont, Valid, Offset);
   }
 
   bool operator==(const IteratorPosition &X) const {
     return Cont == X.Cont && Valid == X.Valid && Offset == X.Offset;
   }
 
-  bool operator!=(const IteratorPosition &X) const {
-    return Cont != X.Cont || Valid != X.Valid || Offset != X.Offset;
-  }
-
   void Profile(llvm::FoldingSetNodeID &ID) const {
     ID.AddPointer(Cont);
     ID.AddInteger(Valid);
     ID.Add(Offset);
   }
 };
 
 // Structure to record the symbolic begin and end position of a container
public:
   ContainerData newBegin(SymbolRef B) const { return ContainerData(B, End); }
 
   ContainerData newEnd(SymbolRef E) const { return ContainerData(Begin, E); }
 
   bool operator==(const ContainerData &X) const {
     return Begin == X.Begin && End == X.End;
   }
 
-  bool operator!=(const ContainerData &X) const {
-    return Begin != X.Begin || End != X.End;
-  }
-
   void Profile(llvm::FoldingSetNodeID &ID) const {
     ID.Add(Begin);
     ID.Add(End);
   }
 };
 
 class IteratorSymbolMap {};
 class IteratorRegionMap {};

clang/lib/StaticAnalyzer/Checkers/IteratorModeling.cpp

 
 public:
   IteratorModeling() = default;
 
   void checkPostCall(const CallEvent &Call, CheckerContext &C) const;
   void checkBind(SVal Loc, SVal Val, const Stmt *S, CheckerContext &C) const;
   void checkPostStmt(const UnaryOperator *UO, CheckerContext &C) const;
   void checkPostStmt(const BinaryOperator *BO, CheckerContext &C) const;
-  void checkPostStmt(const CXXConstructExpr *CCE, CheckerContext &C) const;
-  void checkPostStmt(const DeclStmt *DS, CheckerContext &C) const;
   void checkPostStmt(const MaterializeTemporaryExpr *MTE,
                      CheckerContext &C) const;
   void checkLiveSymbols(ProgramStateRef State, SymbolReaper &SR) const;
   void checkDeadSymbols(SymbolReaper &SR, CheckerContext &C) const;
 };
 
 bool isSimpleComparisonOperator(OverloadedOperatorKind OK);
 bool isSimpleComparisonOperator(BinaryOperatorKind OK);

clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp

 #define CASE(ID) case ID: OS << #ID; break;
     CASE(Allocated)
     CASE(AllocatedOfSizeZero)
     CASE(Released)
     CASE(Relinquished)
     CASE(Escaped)
     }
   }
-
-  LLVM_DUMP_METHOD void dump() const { dump(llvm::errs()); }
 };
 
 } // end of anonymous namespace
 
 REGISTER_MAP_WITH_PROGRAMSTATE(RegionState, SymbolRef, RefState)
 
 /// Check if the memory associated with this symbol was released.
 static bool isReleased(SymbolRef Sym, CheckerContext &C);
public:
 
     bool HandleBinding(StoreManager &SMgr, Store Store, const MemRegion *Region,
                        SVal Val) override {
       if (Val.getAsSymbol() == Sym)
         Owners.insert(Region);
       return true;
     }
 
-    LLVM_DUMP_METHOD void dump() const { dumpToStream(llvm::errs()); }
     LLVM_DUMP_METHOD void dumpToStream(llvm::raw_ostream &out) const {
       out << "Owners: {\n";
       for (const MemRegion *Owner : Owners) {
         out << "  ";
         Owner->dumpToStream(out);
         out << ",\n";
       }
       out << "}\n";
     }
   };
 
 protected:
   OwnerSet getOwnersAtNode(const ExplodedNode *N) {
     OwnerSet Ret;
 
     ProgramStateRef State = N->getState();
     OwnershipBindingsHandler Handler{Sym, Ret};
     State->getStateManager().getStoreManager().iterBindings(State->getStore(),
                                                             Handler);
     return Ret;
   }
 
-  LLVM_DUMP_METHOD static std::string
-  getFunctionName(const ExplodedNode *CallEnterN) {
-    if (const CallExpr *CE = llvm::dyn_cast_or_null<CallExpr>(
-            CallEnterN->getLocationAs<CallEnter>()->getCallExpr()))
-      if (const FunctionDecl *FD = CE->getDirectCallee())
-        return FD->getQualifiedNameAsString();
-    return "";
-  }
-
   /// Syntactically checks whether the callee is a deallocating function. Since
   /// we have no path-sensitive information on this call (we would need a
   /// CallEvent instead of a CallExpr for that), its possible that a
   /// deallocation function was called indirectly through a function pointer,
   /// but we are not able to tell, so this is a best effort analysis.
   /// See namespace `memory_passed_to_fn_call_free_through_fn_ptr` in
   /// clang/test/Analysis/NewDeleteLeaks.cpp.
   bool isFreeingCallAsWritten(const CallExpr &Call) const {
NoOwnershipChangeVisitor(SymbolRef Sym, const MallocChecker *Checker)
       : NoStateChangeFuncVisitor(bugreporter::TrackingKind::Thorough), Sym(Sym),
         Checker(*Checker) {}
 
   void Profile(llvm::FoldingSetNodeID &ID) const override {
     static int Tag = 0;
     ID.AddPointer(&Tag);
     ID.AddPointer(Sym);
   }
-
-  void *getTag() const {
-    static int Tag = 0;
-    return static_cast<void *>(&Tag);
-  }
 };
 
 } // end anonymous namespace
 
 //===----------------------------------------------------------------------===//
 // Definition of MallocBugVisitor.
 //===----------------------------------------------------------------------===//
 

clang/lib/StaticAnalyzer/Checkers/MoveChecker.cpp

 };
 } // end of anonymous namespace
 
 namespace {
 class MoveChecker
     : public Checker<check::PreCall, check::PostCall,
                      check::DeadSymbols, check::RegionChanges> {
 public:
-  void checkEndFunction(const ReturnStmt *RS, CheckerContext &C) const;
   void checkPreCall(const CallEvent &MC, CheckerContext &C) const;
   void checkPostCall(const CallEvent &MC, CheckerContext &C) const;
   void checkDeadSymbols(SymbolReaper &SR, CheckerContext &C) const;
   ProgramStateRef
   checkRegionChanges(ProgramStateRef State,
                      const InvalidatedSymbols *Invalidated,
                      ArrayRef<const MemRegion *> RequestedRegions,
                      ArrayRef<const MemRegion *> InvalidatedRegions,
const ExplodedNode *getMoveLocation(const ExplodedNode *N,
                                       const MemRegion *Region,
                                       CheckerContext &C) const;
 };
 } // end anonymous namespace
 
 REGISTER_MAP_WITH_PROGRAMSTATE(TrackedRegionMap, const MemRegion *, RegionState)
 
 // Define the inter-checker API.
-namespace clang {
-namespace ento {
-namespace move {
-bool isMovedFrom(ProgramStateRef State, const MemRegion *Region) {
-  const RegionState *RS = State->get<TrackedRegionMap>(Region);
-  return RS && (RS->isMoved() || RS->isReported());
-}
-} // namespace move
-} // namespace ento
-} // namespace clang
 
 // If a region is removed all of the subregions needs to be removed too.
 static ProgramStateRef removeFromState(ProgramStateRef State,
                                        const MemRegion *Region) {
   if (!Region)
     return State;
   for (auto &E : State->get<TrackedRegionMap>()) {
     if (E.first->isSubRegionOf(Region))

clang/lib/StaticAnalyzer/Checkers/ObjCContainersChecker.cpp

inline SymbolRef getArraySym(const Expr *E, CheckerContext &C) const {
     SymbolRef ArraySym = ArrayRef.getAsSymbol();
     return ArraySym;
   }
 
   void addSizeInfo(const Expr *Array, const Expr *Size,
                    CheckerContext &C) const;
 
 public:
-  /// A tag to id this checker.
-  static void *getTag() { static int Tag; return &Tag; }
-
   void checkPostStmt(const CallExpr *CE, CheckerContext &C) const;
   void checkPreStmt(const CallExpr *CE, CheckerContext &C) const;
   ProgramStateRef checkPointerEscape(ProgramStateRef State,
                                      const InvalidatedSymbols &Escaped,
                                      const CallEvent *Call,
                                      PointerEscapeKind Kind) const;
 
   void printState(raw_ostream &OS, ProgramStateRef State,

clang/lib/StaticAnalyzer/Checkers/SimpleStreamChecker.cpp

 };
 
 } // end anonymous namespace
 
 /// The state of the checker is a map from tracked stream symbols to their
 /// state. Let's store it in the ProgramState.
 REGISTER_MAP_WITH_PROGRAMSTATE(StreamMap, SymbolRef, StreamState)
 
-namespace {
-class StopTrackingCallback final : public SymbolVisitor {
-  ProgramStateRef state;
-public:
-  StopTrackingCallback(ProgramStateRef st) : state(std::move(st)) {}
-  ProgramStateRef getState() const { return state; }
-
-  bool VisitSymbol(SymbolRef sym) override {
-    state = state->remove<StreamMap>(sym);
-    return true;
-  }
-};
-} // end anonymous namespace
-
 SimpleStreamChecker::SimpleStreamChecker()
     : OpenFn("fopen"), CloseFn("fclose", 1) {
   // Initialize the bug types.
   DoubleCloseBugType.reset(
       new BugType(this, "Double fclose", "Unix Stream API Error"));
 
   // Sinks are higher importance bugs as well as calls to assert() or exit(0).
   LeakBugType.reset(

clang/lib/StaticAnalyzer/Checkers/SmartPtrModeling.cpp

: public Checker<eval::Call, check::DeadSymbols, check::RegionChanges,
                      check::LiveSymbols> {
 
   bool isBoolConversionMethod(const CallEvent &Call) const;
 
 public:
   // Whether the checker should model for null dereferences of smart pointers.
   bool ModelSmartPtrDereference = false;
   bool evalCall(const CallEvent &Call, CheckerContext &C) const;
-  void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
   void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const;
   ProgramStateRef
   checkRegionChanges(ProgramStateRef State,
                      const InvalidatedSymbols *Invalidated,
                      ArrayRef<const MemRegion *> ExplicitRegions,
                      ArrayRef<const MemRegion *> Regions,
                      const LocationContext *LCtx, const CallEvent *Call) const;
   void printState(raw_ostream &Out, ProgramStateRef State, const char *NL,

clang/lib/StaticAnalyzer/Checkers/StreamChecker.cpp

struct StreamErrorState {
   bool NoError = true;
   /// The stream can be in state where the EOF indicator is set.
   bool FEof = false;
   /// The stream can be in state where the error indicator is set.
   bool FError = false;
 
   bool isNoError() const { return NoError && !FEof && !FError; }
   bool isFEof() const { return !NoError && FEof && !FError; }
-  bool isFError() const { return !NoError && !FEof && FError; }
 
   bool operator==(const StreamErrorState &ES) const {
     return NoError == ES.NoError && FEof == ES.FEof && FError == ES.FError;
   }
 
   bool operator!=(const StreamErrorState &ES) const { return !(*this == ES); }
 
   StreamErrorState operator|(const StreamErrorState &E) const {
     return {NoError || E.NoError, FEof || E.FEof, FError || E.FError};
   }
 
   StreamErrorState operator&(const StreamErrorState &E) const {
     return {NoError && E.NoError, FEof && E.FEof, FError && E.FError};
   }
 
   StreamErrorState operator~() const { return {!NoError, !FEof, !FError}; }
 
   /// Returns if the StreamErrorState is a valid object.
   operator bool() const { return NoError || FEof || FError; }
-
-  void Profile(llvm::FoldingSetNodeID &ID) const {
-    ID.AddBoolean(NoError);
-    ID.AddBoolean(FEof);
-    ID.AddBoolean(FError);
-  }
 };
 
 const StreamErrorState ErrorNone{true, false, false};
 const StreamErrorState ErrorFEof{false, true, false};
 const StreamErrorState ErrorFError{false, false, true};
 
 /// Full state information about a stream pointer.
 struct StreamState {

clang/lib/StaticAnalyzer/Checkers/TaintTesterChecker.cpp

 using namespace taint;
 
 namespace {
 class TaintTesterChecker : public Checker< check::PostStmt<Expr> > {
 
   mutable std::unique_ptr<BugType> BT;
   void initBugType() const;
 
-  /// Given a pointer argument, get the symbol of the value it contains
-  /// (points to).
-  SymbolRef getPointedToSymbol(CheckerContext &C,
-                               const Expr* Arg,
-                               bool IssueWarning = true) const;
-
 public:
   void checkPostStmt(const Expr *E, CheckerContext &C) const;
 };
 }
 
 inline void TaintTesterChecker::initBugType() const {
   if (!BT)
     BT.reset(new BugType(this, "Tainted data", "General"));

clang/lib/StaticAnalyzer/Checkers/UnixAPIChecker.cpp

 
 namespace {
 
 class UnixAPIMisuseChecker : public Checker< check::PreStmt<CallExpr> > {
   mutable std::unique_ptr<BugType> BT_open, BT_pthreadOnce;
   mutable Optional<uint64_t> Val_O_CREAT;
 
 public:
-  bool CheckMisuse = false, CheckPortability = false;
-
   void checkPreStmt(const CallExpr *CE, CheckerContext &C) const;
 
   void CheckOpen(CheckerContext &C, const CallExpr *CE) const;
   void CheckOpenAt(CheckerContext &C, const CallExpr *CE) const;
   void CheckPthreadOnce(CheckerContext &C, const CallExpr *CE) const;
 
   void CheckOpenVariant(CheckerContext &C,
                         const CallExpr *CE, OpenVariant Variant) const;

clang/lib/StaticAnalyzer/Core/BugReporter.cpp

public:
   }
 
   const ParentMap &getParentMap() const {
     return getCurrLocationContext()->getParentMap();
   }
 
   const SourceManager &getSourceManager() const { return SM; }
 
-  const Stmt *getParent(const Stmt *S) const {
-    return getParentMap().getParent(S);
-  }
-
   void updateLocCtxMap(const PathPieces *Path, const LocationContext *LC) {
     assert(Path && LC);
     LCM[Path] = LC;
   }
 
   const LocationContext *getLocationContextFor(const PathPieces *Path) const {
     assert(LCM.count(Path) &&
            "Failed to find the context associated with these pieces!");
     return LCM.find(Path)->getSecond();
   }
 
   bool isInLocCtxMap(const PathPieces *Path) const { return LCM.count(Path); }
 
   PathPieces &getActivePath() { return PD->getActivePath(); }
   PathPieces &getMutablePieces() { return PD->getMutablePieces(); }
 
   bool shouldAddPathEdges() const { return Consumer->shouldAddPathEdges(); }
   bool shouldAddControlNotes() const {
     return Consumer->shouldAddControlNotes();
   }
-  bool shouldGenerateDiagnostics() const {
-    return Consumer->shouldGenerateDiagnostics();
-  }
   bool supportsLogicalOpControlFlow() const {
     return Consumer->supportsLogicalOpControlFlow();
   }
 };
 
 /// Contains every contextual information needed for constructing a
 /// PathDiagnostic object for a given bug report. This class and its fields are
 /// immutable, and passes a BugReportConstruct object around during the

clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

NoStoreFuncVisitor(const SubRegion *R, bugreporter::TrackingKind TKind)
         PP(MmrMgr.getContext().getPrintingPolicy()) {}
 
   void Profile(llvm::FoldingSetNodeID &ID) const override {
     static int Tag = 0;
     ID.AddPointer(&Tag);
     ID.AddPointer(RegionOfInterest);
   }
 
-  void *getTag() const {
-    static int Tag = 0;
-    return static_cast<void *>(&Tag);
-  }
-
 private:
   /// \return Whether \c RegionOfInterest was modified at \p CurrN compared to
   /// the value it holds in \p CallExitBeginN.
   virtual bool
   wasModifiedBeforeCallExit(const ExplodedNode *CurrN,
                             const ExplodedNode *CallExitBeginN) override;
 
   /// Attempts to find the region of interest in a given record decl,

clang/lib/StaticAnalyzer/Core/ExprEngine.cpp

 /// the construction context was present and contained references to these
 /// AST nodes.
 class ConstructedObjectKey {
   typedef std::pair<ConstructionContextItem, const LocationContext *>
       ConstructedObjectKeyImpl;
 
   const ConstructedObjectKeyImpl Impl;
 
-  const void *getAnyASTNodePtr() const {
-    if (const Stmt *S = getItem().getStmtOrNull())
-      return S;
-    else
-      return getItem().getCXXCtorInitializer();
-  }
-
 public:
   explicit ConstructedObjectKey(const ConstructionContextItem &Item,
                        const LocationContext *LC)
       : Impl(Item, LC) {}
 
   const ConstructionContextItem &getItem() const { return Impl.first; }
   const LocationContext *getLocationContext() const { return Impl.second; }
 

clang/lib/StaticAnalyzer/Core/LoopUnrolling.cpp

public:
   static LoopState getUnrolled(const Stmt *S, const LocationContext *L,
                                unsigned N) {
     return LoopState(Unrolled, S, L, N);
   }
   bool isUnrolled() const { return K == Unrolled; }
   unsigned getMaxStep() const { return maxStep; }
   const Stmt *getLoopStmt() const { return LoopStmt; }
   const LocationContext *getLocationContext() const { return LCtx; }
-  bool operator==(const LoopState &X) const {
-    return K == X.K && LoopStmt == X.LoopStmt;
-  }
   void Profile(llvm::FoldingSetNodeID &ID) const {
     ID.AddInteger(K);
     ID.AddPointer(LoopStmt);
     ID.AddPointer(LCtx);
     ID.AddInteger(maxStep);
   }
 };
 

clang/lib/StaticAnalyzer/Core/RangeConstraintManager.cpp

public:
   markDisequal(RangeSet::Factory &F, ProgramStateRef State, SymbolRef First,
                SymbolRef Second);
   LLVM_NODISCARD static inline ProgramStateRef
   markDisequal(RangeSet::Factory &F, ProgramStateRef State,
                EquivalenceClass First, EquivalenceClass Second);
   LLVM_NODISCARD inline ProgramStateRef
   markDisequal(RangeSet::Factory &F, ProgramStateRef State,
                EquivalenceClass Other) const;
-  LLVM_NODISCARD static inline ClassSet
-  getDisequalClasses(ProgramStateRef State, SymbolRef Sym);
   LLVM_NODISCARD inline ClassSet
   getDisequalClasses(ProgramStateRef State) const;
   LLVM_NODISCARD inline ClassSet
   getDisequalClasses(DisequalityMapTy Map, ClassSet::Factory &Factory) const;
 
   LLVM_NODISCARD static inline Optional<bool> areEqual(ProgramStateRef State,
                                                        EquivalenceClass First,
                                                        EquivalenceClass Second);
   LLVM_NODISCARD static inline Optional<bool>
   areEqual(ProgramStateRef State, SymbolRef First, SymbolRef Second);
 
   /// Remove one member from the class.
   LLVM_NODISCARD ProgramStateRef removeMember(ProgramStateRef State,
                                               const SymbolRef Old);
 
   /// Iterate over all symbols and try to simplify them.
   LLVM_NODISCARD static inline ProgramStateRef simplify(SValBuilder &SVB,
                                                         RangeSet::Factory &F,
                                                         ProgramStateRef State,
                                                         EquivalenceClass Class);
 
   void dumpToStream(ProgramStateRef State, raw_ostream &os) const;
-  LLVM_DUMP_METHOD void dump(ProgramStateRef State) const {
-    dumpToStream(State, llvm::errs());
-  }
 
   /// Check equivalence data for consistency.
   LLVM_NODISCARD LLVM_ATTRIBUTE_UNUSED static bool
   isClassDataConsistent(ProgramStateRef State);
 
   LLVM_NODISCARD QualType getType() const {
     return getRepresentativeSymbol()->getType();
   }
 
   EquivalenceClass() = delete;
   EquivalenceClass(const EquivalenceClass &) = default;
   EquivalenceClass &operator=(const EquivalenceClass &) = delete;
   EquivalenceClass(EquivalenceClass &&) = default;
   EquivalenceClass &operator=(EquivalenceClass &&) = delete;
 
   bool operator==(const EquivalenceClass &Other) const {
     return ID == Other.ID;
   }
   bool operator<(const EquivalenceClass &Other) const { return ID < Other.ID; }
-  bool operator!=(const EquivalenceClass &Other) const {
-    return !operator==(Other);
-  }
 
   static void Profile(llvm::FoldingSetNodeID &ID, uintptr_t CID) {
     ID.AddInteger(CID);
   }
 
   void Profile(llvm::FoldingSetNodeID &ID) const { Profile(ID, this->ID); }
 
 private:
public:
   ProgramStateRef assumeSymOutsideInclusiveRange(
       ProgramStateRef State, SymbolRef Sym, const llvm::APSInt &From,
       const llvm::APSInt &To, const llvm::APSInt &Adjustment) override;
 
 private:
   RangeSet::Factory F;
 
   RangeSet getRange(ProgramStateRef State, SymbolRef Sym);
-  RangeSet getRange(ProgramStateRef State, EquivalenceClass Class);
   ProgramStateRef setRange(ProgramStateRef State, SymbolRef Sym,
                            RangeSet Range);
-  ProgramStateRef setRange(ProgramStateRef State, EquivalenceClass Class,
-                           RangeSet Range);
 
   RangeSet getSymLTRange(ProgramStateRef St, SymbolRef Sym,
                          const llvm::APSInt &Int,
                          const llvm::APSInt &Adjustment);
   RangeSet getSymGTRange(ProgramStateRef St, SymbolRef Sym,
                          const llvm::APSInt &Int,
                          const llvm::APSInt &Adjustment);
   RangeSet getSymLERange(ProgramStateRef St, SymbolRef Sym,
if (SimplifiedMemberSym && MemberSym != SimplifiedMemberSym) {
       State = reAssume(State, ClassConstraint, SimplifiedMemberVal);
       if (!State)
         return nullptr;
     }
   }
   return State;
 }
 
-inline ClassSet EquivalenceClass::getDisequalClasses(ProgramStateRef State,
-                                                     SymbolRef Sym) {
-  return find(State, Sym).getDisequalClasses(State);
-}
-
 inline ClassSet
 EquivalenceClass::getDisequalClasses(ProgramStateRef State) const {
   return getDisequalClasses(State->get<DisequalityMap>(),
                             State->get_context<ClassSet>());
 }
 
 inline ClassSet
 EquivalenceClass::getDisequalClasses(DisequalityMapTy Map,

clang/lib/StaticAnalyzer/Core/RegionStore.cpp

if (P.getOpaqueValue() > X.P.getOpaqueValue())
       return false;
     return Data < X.Data;
   }
 
   bool operator==(const BindingKey &X) const {
     return P.getOpaqueValue() == X.P.getOpaqueValue() &&
            Data == X.Data;
   }
-
-  LLVM_DUMP_METHOD void dump() const;
 };
 } // end anonymous namespace
 
 BindingKey BindingKey::Make(const MemRegion *R, Kind k) {
   const RegionOffset &RO = R->getAsOffset();
   if (RO.hasSymbolicOffset())
     return BindingKey(cast<SubRegion>(R), cast<SubRegion>(RO.getRegion()), k);
 
else
     Out << "null";
 
   return Out;
 }
 
 } // namespace llvm
 
 #if !defined(NDEBUG) || defined(LLVM_ENABLE_DUMP)
-void BindingKey::dump() const { llvm::errs() << *this; }
 #endif
 
 //===----------------------------------------------------------------------===//
 // Actual Store type.
 //===----------------------------------------------------------------------===//
 
 typedef llvm::ImmutableMap<BindingKey, SVal>    ClusterBindings;
 typedef llvm::ImmutableMapRef<BindingKey, SVal> ClusterBindingsRef;
for (iterator I = begin(); I != end(); ++I) {
 
       --Space;
       Indent(Out, Space, IsDot) << "]}";
       if (std::next(I) != end())
         Out << ',';
       Out << NL;
     }
   }
-
-  LLVM_DUMP_METHOD void dump() const { printJson(llvm::errs()); }
 };
 } // end anonymous namespace
 
 typedef const RegionBindingsRef& RegionBindingsConstRef;
 
 Optional<SVal> RegionBindingsRef::getDirectBinding(const MemRegion *R) const {
   return Optional<SVal>::create(lookup(R, BindingKey::Direct));
 }
public:
 
   bool AddToWorkList(WorkListElement E, const ClusterBindings *C) {
     if (C && !Visited.insert(C).second)
       return false;
     WL.push_back(E);
     return true;
   }
 
-  bool AddToWorkList(const MemRegion *R) {
-    return static_cast<DERIVED*>(this)->AddToWorkList(R);
-  }
-
   void RunWorkList() {
     while (!WL.empty()) {
       WorkListElement E = WL.pop_back_val();
       const MemRegion *BaseR = E;
 
       static_cast<DERIVED*>(this)->VisitCluster(BaseR, getCluster(BaseR));
     }
   }
 
   void VisitAddedToCluster(const MemRegion *baseR, const ClusterBindings &C) {}
-  void VisitCluster(const MemRegion *baseR, const ClusterBindings *C) {}
 
   void VisitCluster(const MemRegion *BaseR, const ClusterBindings *C,
                     bool Flag) {
     static_cast<DERIVED*>(this)->VisitCluster(BaseR, C);
   }
 };
 }
 

clang/lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp

SVal VisitUnarySymExpr(const UnarySymExpr *S) {
       SVal Op = getConstOrVisit(S->getOperand());
       if (isUnchanged(S->getOperand(), Op))
         return skip(S);
 
       return cache(
           S, SVB.evalUnaryOp(State, S->getOpcode(), Op, S->getType()));
     }
 
-    SVal VisitSymExpr(SymbolRef S) { return nonloc::SymbolVal(S); }
-
-    SVal VisitMemRegion(const MemRegion *R) { return loc::MemRegionVal(R); }
-
     SVal VisitNonLocSymbolVal(nonloc::SymbolVal V) {
       // Simplification is much more costly than computing complexity.
       // For high complexity, it may be not worth it.
       return Visit(V.getSymbol());
     }
 
     SVal VisitSVal(SVal V) { return V; }
   };
 
   SVal SimplifiedV = Simplifier(State).Visit(V);
   return SimplifiedV;
 }

clang/lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp

#include "clang/StaticAnalyzer/Core/Analyses.def"
   }
 
   void AddCheckerRegistrationFn(std::function<void(CheckerRegistry&)> Fn) override {
     CheckerRegistrationFns.push_back(std::move(Fn));
   }
 
 private:
   void storeTopLevelDecls(DeclGroupRef DG);
-  std::string getFunctionName(const Decl *D);
 
   /// Check if we should skip (not analyze) the given function.
   AnalysisMode getModeForDecl(Decl *D, AnalysisMode Mode);
   void runAnalysisOnTranslationUnit(ASTContext &C);
 
   /// Print \p S to stderr if \c Opts->AnalyzerDisplayProgress is set.
   void reportAnalyzerProgress(StringRef S);
 }; // namespace