[clang][dataflow] Change transfer and diagnoser functions to receive a CFGElement

[merrymeerkat]

Summary

Previously, the diagnoser function returned an AST element that was faulty.
If the dataflow analysis wanted to warn about Stmts and CXXCtorInitializers, or any AST elements without a common base class, we had to choose which type to return.

Now, diagnosers receive and return a CFGElement and can thus warn about any type of C++ construct.

[xazax.hun]

clang/include/clang/Analysis/FlowSensitive/CFGMatchSwitch.h

35

Why do we need to keep this pointer on the heap?

[ymandel]

Thanks for this patch! Unfortunately, I'm having trouble following the change. Can you expand the description to give a more detailed explantion of the motivation and the key point that are changing? Unfortunately, I don't understand the motivation for the new API and am even having trouble finding where the changes were made that correspond to the new API used by clients. Maybe that would be good to include in the description? That is, call out the key old API that's being upgraded and write the explanation with respect to the old and the new?

Thanks!

clang/include/clang/Analysis/FlowSensitive/CFGMatchSwitch.h

33

nit: just wanted to double check on the formatting: i'm used to seeing class put on a new line.

35

Can you please explain the need for the unique pointer?

42

Where is this field used?

150–151

Please add a comment explaining the design pattern. I'm not quite clear on why we're taking this approach, so it would probably be generally useful to explain to future readers.

clang/include/clang/Analysis/FlowSensitive/MatchSwitch.h

52

should this change too?

clang/lib/Analysis/FlowSensitive/Models/UncheckedOptionalAccessModel.cpp

280

Here and below: if the callee does not use the paramter, drop its name.

280–281

This seems a surprising API choice. Once the callee is getting the element as statement at a specific type, why does it need the element?

clang/include/clang/Analysis/FlowSensitive/CFGMatchSwitch.h

 #ifndef LLVM_CLANG_ANALYSIS_FLOWSENSITIVE_CFGMATCHSWITCH_H_
 #define LLVM_CLANG_ANALYSIS_FLOWSENSITIVE_CFGMATCHSWITCH_H_
 
 #include "clang/AST/ASTContext.h"
 #include "clang/AST/Stmt.h"
 #include "clang/Analysis/CFG.h"
 #include "clang/Analysis/FlowSensitive/MatchSwitch.h"
 #include <functional>
+#include <memory>
 #include <utility>
 
 namespace clang {
 namespace dataflow {
 
-template <typename State, typename Result = void>
-using CFGMatchSwitch =
-    std::function<Result(const CFGElement &, ASTContext &, State &)>;
+template <typename State, typename Result = void> class CFGMatchSwitch {
+public:
+  CFGMatchSwitch(std::unique_ptr<const CFGElement *> CurrentElement,
+                 ASTMatchSwitch<Stmt, State, Result> StmtMS,
+                 ASTMatchSwitch<CXXCtorInitializer, State, Result> InitMS)
+      : CurrentElement(std::move(CurrentElement)), StmtMS(std::move(StmtMS)),
+        InitMS(std::move(InitMS)) {}
+
+  Result operator()(const CFGElement &Element, ASTContext &Context, State &S) {
+    *CurrentElement = &Element;
+    switch (Element.getKind()) {
+    case CFGElement::Initializer:
+      return InitMS(*Element.castAs<CFGInitializer>().getInitializer(), Context,
+                    S);
+    case CFGElement::Statement:
+    case CFGElement::Constructor:
+    case CFGElement::CXXRecordTypedCall:
+      return StmtMS(*Element.castAs<CFGStmt>().getStmt(), Context, S);
+    default:
+      // FIXME: Handle other kinds of CFGElement.
+      return Result();
+    }
+  }
+
+private:
+  std::unique_ptr<const CFGElement *> CurrentElement;
+  ASTMatchSwitch<Stmt, State, Result> StmtMS;
+  ASTMatchSwitch<CXXCtorInitializer, State, Result> InitMS;
+};
+
+template <typename T, typename State, typename Result = void>
+using CFGMatchSwitchAction =
+    std::function<Result(const CFGElement &, const T *,
+                         const ast_matchers::MatchFinder::MatchResult &,
+                         State &)>;
 
 /// Collects cases of a "match switch": a collection of matchers paired with
 /// callbacks, which together define a switch that can be applied to an AST node
 /// contained in a CFG element.
 template <typename State, typename Result = void> class CFGMatchSwitchBuilder {
 public:
   /// Registers an action `A` for `CFGStmt`s that will be triggered by the match
   /// of the pattern `M` against the `Stmt` contained in the input `CFGStmt`.
   ///
   /// Requirements:
   ///
   ///  `NodeT` should be derived from `Stmt`.
   template <typename NodeT>
   CFGMatchSwitchBuilder &&
   CaseOfCFGStmt(MatchSwitchMatcher<Stmt> M,
-                MatchSwitchAction<NodeT, State, Result> A) && {
+                CFGMatchSwitchAction<NodeT, State, Result> A) && {
+    std::move(StmtBuilder)
+        .template CaseOf<NodeT>(
+            M,
+            [A, CurrentElement = CurrentElement.get()](
+                const NodeT *N,
+                const ast_matchers::MatchFinder::MatchResult &MR,
+                State &S) -> Result { return A(**CurrentElement, N, MR, S); });
+    return std::move(*this);
+  }
+
+  // TODO: Refactor all callers to call the overload above and delete this
+  // function.
+  template <typename NodeT>
+  CFGMatchSwitchBuilder &&CaseOfCFGStmt(
+      MatchSwitchMatcher<Stmt> M,
+      std::function<Result(const NodeT *,
+                           const ast_matchers::MatchFinder::MatchResult &,
+                           State &)>
+          A) && {
     std::move(StmtBuilder).template CaseOf<NodeT>(M, A);
     return std::move(*this);
   }
 
   /// Registers an action `A` for `CFGInitializer`s that will be triggered by
   /// the match of the pattern `M` against the `CXXCtorInitializer` contained in
   /// the input `CFGInitializer`.
   ///
   /// Requirements:
   ///
   ///  `NodeT` should be derived from `CXXCtorInitializer`.
   template <typename NodeT>
   CFGMatchSwitchBuilder &&
   CaseOfCFGInit(MatchSwitchMatcher<CXXCtorInitializer> M,
-                MatchSwitchAction<NodeT, State, Result> A) && {
+                CFGMatchSwitchAction<NodeT, State, Result> A) && {
+    std::move(InitBuilder)
+        .template CaseOf<NodeT>(
+            M,
+            [A, CurrentElement = CurrentElement.get()](
+                const NodeT *N,
+                const ast_matchers::MatchFinder::MatchResult &MR,
+                State &S) -> Result { return A(**CurrentElement, N, MR, S); });
+    return std::move(*this);
+  }
+
+  // TODO: Refactor all callers to call the overload above and delete this
+  // function.
+  template <typename NodeT>
+  CFGMatchSwitchBuilder &&CaseOfCFGInit(
+      MatchSwitchMatcher<CXXCtorInitializer> M,
+      std::function<Result(const NodeT *,
+                           const ast_matchers::MatchFinder::MatchResult &,
+                           State &)>
+          A) && {
     std::move(InitBuilder).template CaseOf<NodeT>(M, A);
     return std::move(*this);
   }
 
   CFGMatchSwitch<State, Result> Build() && {
-    return [StmtMS = std::move(StmtBuilder).Build(),
-            InitMS = std::move(InitBuilder).Build()](const CFGElement &Element,
-                                                     ASTContext &Context,
-                                                     State &S) -> Result {
-      switch (Element.getKind()) {
-      case CFGElement::Initializer:
-        return InitMS(*Element.castAs<CFGInitializer>().getInitializer(),
-                      Context, S);
-      case CFGElement::Statement:
-      case CFGElement::Constructor:
-      case CFGElement::CXXRecordTypedCall:
-        return StmtMS(*Element.castAs<CFGStmt>().getStmt(), Context, S);
-      default:
-        // FIXME: Handle other kinds of CFGElement.
-        return Result();
-      }
-    };
+    return CFGMatchSwitch<State, Result>(std::move(CurrentElement),
+                                         std::move(StmtBuilder).Build(),
+                                         std::move(InitBuilder).Build());
   }
 
 private:
   ASTMatchSwitchBuilder<Stmt, State, Result> StmtBuilder;
   ASTMatchSwitchBuilder<CXXCtorInitializer, State, Result> InitBuilder;
+  std::unique_ptr<const CFGElement *> CurrentElement =
+      std::make_unique<const CFGElement *>(nullptr);
 };
 
 } // namespace dataflow
 } // namespace clang
 
 #endif // LLVM_CLANG_ANALYSIS_FLOWSENSITIVE_CFGMATCHSWITCH_H_

clang/include/clang/Analysis/FlowSensitive/MatchSwitch.h

TransferState(LatticeT &Lattice, Environment &Env)
       : Lattice(Lattice), Env(Env) {}
 
   /// Current lattice element.
   LatticeT &Lattice;
   Environment &Env;
 };
 
 template <typename T>
 using MatchSwitchMatcher = ast_matchers::internal::Matcher<T>;
 
 template <typename T, typename State, typename Result = void>
-using MatchSwitchAction = std::function<Result(
+using ASTMatchSwitchAction = std::function<Result(
     const T *, const ast_matchers::MatchFinder::MatchResult &, State &)>;
 
 template <typename BaseT, typename State, typename Result = void>
 using ASTMatchSwitch =
     std::function<Result(const BaseT &, ASTContext &, State &)>;
 
 // FIXME: Remove this alias when all usages of `MatchSwitch` are updated to
 // `ASTMatchSwitch<Stmt>`.

 public:
   /// Registers an action that will be triggered by the match of a pattern
   /// against the input statement.
   ///
   /// Requirements:
   ///
   ///  `NodeT` should be derived from `BaseT`.
   template <typename NodeT>
-  ASTMatchSwitchBuilder &&CaseOf(MatchSwitchMatcher<BaseT> M,
-                                 MatchSwitchAction<NodeT, State, Result> A) && {
+  ASTMatchSwitchBuilder &&
+  CaseOf(MatchSwitchMatcher<BaseT> M,
+         ASTMatchSwitchAction<NodeT, State, Result> A) && {
     static_assert(std::is_base_of<BaseT, NodeT>::value,
                   "NodeT must be derived from BaseT.");
     Matchers.push_back(std::move(M));
     Actions.push_back(
         [A = std::move(A)](const BaseT *Node,
                            const ast_matchers::MatchFinder::MatchResult &R,
                            State &S) { return A(cast<NodeT>(Node), R, S); });
     return std::move(*this);
ast_matchers::internal::DynTypedMatcher BuildMatcher() {
     // The matcher type on the cases ensures that `Expr` kind is compatible with
     // all of the matchers.
     return DynTypedMatcher::constructVariadic(
         DynTypedMatcher::VO_AnyOf, ASTNodeKind::getFromNodeKind<BaseT>(),
         std::move(Matchers));
   }
 
   std::vector<ast_matchers::internal::DynTypedMatcher> Matchers;
-  std::vector<MatchSwitchAction<BaseT, State, Result>> Actions;
+  std::vector<ASTMatchSwitchAction<BaseT, State, Result>> Actions;
 };
 
 // FIXME: Remove this alias when all usages of `MatchSwitchBuilder` are updated
 // to `ASTMatchSwitchBuilder<Stmt>`.
 template <typename State, typename Result = void>
 using MatchSwitchBuilder = ASTMatchSwitchBuilder<Stmt, State, Result>;
 
 } // namespace dataflow
 } // namespace clang
 #endif // LLVM_CLANG_ANALYSIS_FLOWSENSITIVE_MATCHSWITCH_H_

clang/lib/Analysis/FlowSensitive/Models/UncheckedOptionalAccessModel.cpp

if (ValueVal == nullptr)
     return nullptr;
   auto &ValueLoc = Env.createStorageLocation(Ty);
   Env.setValue(ValueLoc, *ValueVal);
   auto ValueRef = std::make_unique<ReferenceValue>(ValueLoc);
   OptionalVal.setProperty("value", Env.takeOwnership(std::move(ValueRef)));
   return &ValueLoc;
 }
 
-void initializeOptionalReference(const Expr *OptionalExpr,
+void initializeOptionalReference(const CFGElement &Element,
+                                 const Expr *OptionalExpr,
                                  const MatchFinder::MatchResult &,
                                  LatticeTransferState &State) {
   if (auto *OptionalVal =
           State.Env.getValue(*OptionalExpr, SkipPast::Reference)) {
     if (OptionalVal->getProperty("has_value") == nullptr) {
       setHasValue(*OptionalVal, State.Env.makeAtomicBoolValue());
     }
   }
if (auto *OptionalVal =
           State.Env.getValue(*ObjectExpr, SkipPast::ReferenceThenPointer)) {
     if (State.Env.getStorageLocation(*UnwrapExpr, SkipPast::None) == nullptr)
       if (auto *Loc = maybeInitializeOptionalValueMember(
               UnwrapExpr->getType(), *OptionalVal, State.Env))
         State.Env.setStorageLocation(*UnwrapExpr, *Loc);
   }
 }
 
-void transferMakeOptionalCall(const CallExpr *E,
+void transferMakeOptionalCall(const CFGElement &Element, const CallExpr *E,
                               const MatchFinder::MatchResult &,
                               LatticeTransferState &State) {
   auto &Loc = State.Env.createStorageLocation(*E);
   State.Env.setStorageLocation(*E, Loc);
   State.Env.setValue(
       Loc, createOptionalValue(State.Env, State.Env.getBoolLiteralValue(true)));
 }
 
-void transferOptionalHasValueCall(const CXXMemberCallExpr *CallExpr,
+void transferOptionalHasValueCall(const CFGElement &Element,
+                                  const CXXMemberCallExpr *CallExpr,
                                   const MatchFinder::MatchResult &,
                                   LatticeTransferState &State) {
   if (auto *HasValueVal = getHasValue(
           State.Env, State.Env.getValue(*CallExpr->getImplicitObjectArgument(),
                                         SkipPast::ReferenceThenPointer))) {
     auto &CallExprLoc = State.Env.createStorageLocation(*CallExpr);
     State.Env.setValue(CallExprLoc, *HasValueVal);
     State.Env.setStorageLocation(*CallExpr, CallExprLoc);
if (ExprValue == nullptr) {
     ExprValue = &State.Env.makeAtomicBoolValue();
     State.Env.setValue(ExprLoc, *ExprValue);
     State.Env.setStorageLocation(*ValueOrPredExpr, ExprLoc);
   }
 
   Env.addToFlowCondition(ModelPred(Env, *ExprValue, *HasValueVal));
 }
 
-void transferValueOrStringEmptyCall(const clang::Expr *ComparisonExpr,
+void transferValueOrStringEmptyCall(const CFGElement &Element,
+                                    const clang::Expr *ComparisonExpr,
                                     const MatchFinder::MatchResult &Result,
                                     LatticeTransferState &State) {
   return transferValueOrImpl(ComparisonExpr, Result, State,
                              [](Environment &Env, BoolValue &ExprVal,
                                 BoolValue &HasValueVal) -> BoolValue & {
                                // If the result is *not* empty, then we know the
                                // optional must have been holding a value. If
                                // `ExprVal` is true, though, we don't learn
                                // anything definite about `has_value`, so we
                                // don't add any corresponding implications to
                                // the flow condition.
                                return Env.makeImplication(Env.makeNot(ExprVal),
                                                           HasValueVal);
                              });
 }
 
-void transferValueOrNotEqX(const Expr *ComparisonExpr,
+void transferValueOrNotEqX(const CFGElement &Element,
+                           const Expr *ComparisonExpr,
                            const MatchFinder::MatchResult &Result,
                            LatticeTransferState &State) {
   transferValueOrImpl(ComparisonExpr, Result, State,
                       [](Environment &Env, BoolValue &ExprVal,
                          BoolValue &HasValueVal) -> BoolValue & {
                         // We know that if `(opt.value_or(X) != X)` then
                         // `opt.hasValue()`, even without knowing further
                         // details about the contents of `opt`.
                         return Env.makeImplication(ExprVal, HasValueVal);
                       });
 }
 
-void transferCallReturningOptional(const CallExpr *E,
+void transferCallReturningOptional(const CFGElement &Element, const CallExpr *E,
                                    const MatchFinder::MatchResult &Result,
                                    LatticeTransferState &State) {
   if (State.Env.getStorageLocation(*E, SkipPast::None) != nullptr)
     return;
 
   auto &Loc = State.Env.createStorageLocation(*E);
   State.Env.setStorageLocation(*E, Loc);
   State.Env.setValue(
BoolValue &value_orConversionHasValue(const FunctionDecl &F, const Expr &E,
   // type `optional<U>` such that `T` is constructible from `U`.
   if (auto *HasValueVal =
           getHasValue(State.Env, State.Env.getValue(E, SkipPast::Reference)))
     return *HasValueVal;
   return State.Env.makeAtomicBoolValue();
 }
 
 void transferValueOrConversionConstructor(
-    const CXXConstructExpr *E, const MatchFinder::MatchResult &MatchRes,
-    LatticeTransferState &State) {
+    const CFGElement &Element, const CXXConstructExpr *E,
+    const MatchFinder::MatchResult &MatchRes, LatticeTransferState &State) {
   assert(E->getNumArgs() > 0);
 
   assignOptionalValue(*E, State,
                       value_orConversionHasValue(*E->getConstructor(),
                                                  *E->getArg(0), MatchRes,
                                                  State));
 }
 
 void transferAssignment(const CXXOperatorCallExpr *E, BoolValue &HasValueVal,
                         LatticeTransferState &State) {
   assert(E->getNumArgs() > 0);
 
   auto *OptionalLoc =
       State.Env.getStorageLocation(*E->getArg(0), SkipPast::Reference);
   if (OptionalLoc == nullptr)
     return;
 
   State.Env.setValue(*OptionalLoc, createOptionalValue(State.Env, HasValueVal));
 
   // Assign a storage location for the whole expression.
   State.Env.setStorageLocation(*E, *OptionalLoc);
 }
 
 void transferValueOrConversionAssignment(
-    const CXXOperatorCallExpr *E, const MatchFinder::MatchResult &MatchRes,
-    LatticeTransferState &State) {
+    const CFGElement &Element, const CXXOperatorCallExpr *E,
+    const MatchFinder::MatchResult &MatchRes, LatticeTransferState &State) {
   assert(E->getNumArgs() > 1);
   transferAssignment(E,
                      value_orConversionHasValue(*E->getDirectCallee(),
                                                 *E->getArg(1), MatchRes, State),
                      State);
 }
 
-void transferNulloptAssignment(const CXXOperatorCallExpr *E,
+void transferNulloptAssignment(const CFGElement &Element,
+                               const CXXOperatorCallExpr *E,
                                const MatchFinder::MatchResult &,
                                LatticeTransferState &State) {
   transferAssignment(E, State.Env.getBoolLiteralValue(false), State);
 }
 
 void transferSwap(const StorageLocation &OptionalLoc1,
                   const StorageLocation &OptionalLoc2,
                   LatticeTransferState &State) {
   auto *OptionalVal1 = State.Env.getValue(OptionalLoc1);
   assert(OptionalVal1 != nullptr);
 
   auto *OptionalVal2 = State.Env.getValue(OptionalLoc2);
   assert(OptionalVal2 != nullptr);
 
   State.Env.setValue(OptionalLoc1, *OptionalVal2);
   State.Env.setValue(OptionalLoc2, *OptionalVal1);
 }
 
-void transferSwapCall(const CXXMemberCallExpr *E,
+void transferSwapCall(const CFGElement &Element, const CXXMemberCallExpr *E,
                       const MatchFinder::MatchResult &,
                       LatticeTransferState &State) {
   assert(E->getNumArgs() == 1);
 
   auto *OptionalLoc1 = State.Env.getStorageLocation(
       *E->getImplicitObjectArgument(), SkipPast::ReferenceThenPointer);
   assert(OptionalLoc1 != nullptr);
 
   auto *OptionalLoc2 =
       State.Env.getStorageLocation(*E->getArg(0), SkipPast::Reference);
   assert(OptionalLoc2 != nullptr);
 
   transferSwap(*OptionalLoc1, *OptionalLoc2, State);
 }
 
-void transferStdSwapCall(const CallExpr *E, const MatchFinder::MatchResult &,
+void transferStdSwapCall(const CFGElement &Element, const CallExpr *E,
+                         const MatchFinder::MatchResult &,
                          LatticeTransferState &State) {
   assert(E->getNumArgs() == 2);
 
   auto *OptionalLoc1 =
       State.Env.getStorageLocation(*E->getArg(0), SkipPast::Reference);
   assert(OptionalLoc1 != nullptr);
 
   auto *OptionalLoc2 =
return CFGMatchSwitchBuilder<LatticeTransferState>()
           initializeOptionalReference)
 
       // make_optional
       .CaseOfCFGStmt<CallExpr>(isMakeOptionalCall(), transferMakeOptionalCall)
 
       // optional::optional
       .CaseOfCFGStmt<CXXConstructExpr>(
           isOptionalInPlaceConstructor(),
-          [](const CXXConstructExpr *E, const MatchFinder::MatchResult &,
-             LatticeTransferState &State) {
+          [](const CFGElement &Element, const CXXConstructExpr *E,
+             const MatchFinder::MatchResult &, LatticeTransferState &State) {
             assignOptionalValue(*E, State, State.Env.getBoolLiteralValue(true));
           })
       .CaseOfCFGStmt<CXXConstructExpr>(
           isOptionalNulloptConstructor(),
-          [](const CXXConstructExpr *E, const MatchFinder::MatchResult &,
-             LatticeTransferState &State) {
+          [](const CFGElement &Element, const CXXConstructExpr *E,
+             const MatchFinder::MatchResult &, LatticeTransferState &State) {
             assignOptionalValue(*E, State,
                                 State.Env.getBoolLiteralValue(false));
           })
       .CaseOfCFGStmt<CXXConstructExpr>(isOptionalValueOrConversionConstructor(),
                                        transferValueOrConversionConstructor)
 
       // optional::operator=
       .CaseOfCFGStmt<CXXOperatorCallExpr>(
           isOptionalValueOrConversionAssignment(),
           transferValueOrConversionAssignment)
       .CaseOfCFGStmt<CXXOperatorCallExpr>(isOptionalNulloptAssignment(),
                                           transferNulloptAssignment)
 
       // optional::value
       .CaseOfCFGStmt<CXXMemberCallExpr>(
           valueCall(IgnorableOptional),
-          [](const CXXMemberCallExpr *E, const MatchFinder::MatchResult &,
-             LatticeTransferState &State) {
+          [](const CFGElement &Element, const CXXMemberCallExpr *E,
+             const MatchFinder::MatchResult &, LatticeTransferState &State) {
             transferUnwrapCall(E, E->getImplicitObjectArgument(), State);
           })
 
       // optional::operator*, optional::operator->
       .CaseOfCFGStmt<CallExpr>(valueOperatorCall(IgnorableOptional),
-                               [](const CallExpr *E,
+                               [](const CFGElement &Element, const CallExpr *E,
                                   const MatchFinder::MatchResult &,
                                   LatticeTransferState &State) {
                                  transferUnwrapCall(E, E->getArg(0), State);
                                })
 
       // optional::has_value
       .CaseOfCFGStmt<CXXMemberCallExpr>(
           isOptionalMemberCallWithName("has_value"),
           transferOptionalHasValueCall)
 
       // optional::operator bool
       .CaseOfCFGStmt<CXXMemberCallExpr>(
           isOptionalMemberCallWithName("operator bool"),
           transferOptionalHasValueCall)
 
       // optional::emplace
       .CaseOfCFGStmt<CXXMemberCallExpr>(
           isOptionalMemberCallWithName("emplace"),
-          [](const CXXMemberCallExpr *E, const MatchFinder::MatchResult &,
-             LatticeTransferState &State) {
+          [](const CFGElement &Element, const CXXMemberCallExpr *E,
+             const MatchFinder::MatchResult &, LatticeTransferState &State) {
             assignOptionalValue(*E->getImplicitObjectArgument(), State,
                                 State.Env.getBoolLiteralValue(true));
           })
 
       // optional::reset
       .CaseOfCFGStmt<CXXMemberCallExpr>(
           isOptionalMemberCallWithName("reset"),
-          [](const CXXMemberCallExpr *E, const MatchFinder::MatchResult &,
-             LatticeTransferState &State) {
+          [](const CFGElement &Element, const CXXMemberCallExpr *E,
+             const MatchFinder::MatchResult &, LatticeTransferState &State) {
             assignOptionalValue(*E->getImplicitObjectArgument(), State,
                                 State.Env.getBoolLiteralValue(false));
           })
 
       // optional::swap
       .CaseOfCFGStmt<CXXMemberCallExpr>(isOptionalMemberCallWithName("swap"),
                                         transferSwapCall)
 
auto buildDiagnoseMatchSwitch(
   // FIXME: Evaluate the efficiency of matchers. If using matchers results in a
   // lot of duplicated work (e.g. string comparisons), consider providing APIs
   // that avoid it through memoization.
   auto IgnorableOptional = ignorableOptional(Options);
   return CFGMatchSwitchBuilder<const Environment, std::vector<SourceLocation>>()
       // optional::value
       .CaseOfCFGStmt<CXXMemberCallExpr>(
           valueCall(IgnorableOptional),
-          [](const CXXMemberCallExpr *E, const MatchFinder::MatchResult &,
-             const Environment &Env) {
+          [](const CFGElement &Element, const CXXMemberCallExpr *E,
+             const MatchFinder::MatchResult &, const Environment &Env) {
             return diagnoseUnwrapCall(E, E->getImplicitObjectArgument(), Env);
           })
 
       // optional::operator*, optional::operator->
       .CaseOfCFGStmt<CallExpr>(
           valueOperatorCall(IgnorableOptional),
-          [](const CallExpr *E, const MatchFinder::MatchResult &,
-             const Environment &Env) {
+          [](const CFGElement &Element, const CallExpr *E,
+             const MatchFinder::MatchResult &, const Environment &Env) {
             return diagnoseUnwrapCall(E, E->getArg(0), Env);
           })
       .Build();
 }
 
 } // namespace
 
 ast_matchers::DeclarationMatcher

clang/unittests/Analysis/FlowSensitive/CFGMatchSwitchTest.cpp

 
 // Returns a match switch that counts the number of local variables
 // (singly-declared) and fields initialized to the integer literal 42.
 auto buildCFGMatchSwitch() {
   return CFGMatchSwitchBuilder<CFGElementMatches>()
       .CaseOfCFGStmt<DeclStmt>(
           declStmt(hasSingleDecl(
               varDecl(hasInitializer(integerLiteral(equals(42)))))),
-          [](const DeclStmt *, const MatchFinder::MatchResult &,
+          [](const CFGElement &Element, const DeclStmt *,
+             const MatchFinder::MatchResult &,
              CFGElementMatches &Counter) { Counter.StmtMatches++; })
       .CaseOfCFGInit<CXXCtorInitializer>(
           cxxCtorInitializer(withInitializer(integerLiteral(equals(42)))),
-          [](const CXXCtorInitializer *, const MatchFinder::MatchResult &,
+          [](const CFGElement &Element, const CXXCtorInitializer *,
+             const MatchFinder::MatchResult &,
              CFGElementMatches &Counter) { Counter.InitializerMatches++; })
       .Build();
 }
 
 // Runs the match switch `MS` on the control flow graph generated from `Code`,
 // tracking information in state `S`. For simplicity, this test utility is
 // restricted to CFGs with a single control flow block (excluding entry and
 // exit blocks) - generated by `Code` with sequential flow (i.e. no branching).

clang/unittests/Analysis/FlowSensitive/SignAnalysisTest.cpp

SignProperties initUnknown(Value &Val, Environment &Env) {
   return Ps;
 }
 SignProperties getSignProperties(const Value &Val, const Environment &Env) {
   return {dyn_cast_or_null<BoolValue>(Val.getProperty("neg")),
           dyn_cast_or_null<BoolValue>(Val.getProperty("zero")),
           dyn_cast_or_null<BoolValue>(Val.getProperty("pos"))};
 }
 
-void transferUninitializedInt(const DeclStmt *D,
+void transferUninitializedInt(const CFGElement &Element, const DeclStmt *D,
                               const MatchFinder::MatchResult &M,
                               LatticeTransferState &State) {
   const auto *Var = M.Nodes.getNodeAs<clang::VarDecl>(kVar);
   assert(Var != nullptr);
   const StorageLocation *Loc =
       State.Env.getStorageLocation(*Var, SkipPast::None);
   Value *Val = State.Env.getValue(*Loc);
   initUnknown(*Val, State.Env);
getValueAndSignProperties(const UnaryOperator *UO,
   SignProperties OperandProps = getSignProperties(*OperandValue, State.Env);
   if (OperandProps.Neg == nullptr)
     return {nullptr, {}, {}};
   // Properties for the operator expr itself.
   SignProperties UnaryOpProps = initUnknown(*UnaryOpValue, State.Env);
   return {UnaryOpValue, UnaryOpProps, OperandProps};
 }
 
-void transferBinary(const BinaryOperator *BO, const MatchFinder::MatchResult &M,
+void transferBinary(const CFGElement &Element, const BinaryOperator *BO,
+                    const MatchFinder::MatchResult &M,
                     LatticeTransferState &State) {
   StorageLocation *Loc = State.Env.getStorageLocation(*BO, SkipPast::None);
   if (!Loc) {
     Loc = &State.Env.createStorageLocation(*BO);
     State.Env.setStorageLocation(*BO, *Loc);
   }
   BoolValue *Comp = cast_or_null<BoolValue>(State.Env.getValue(*Loc));
   if (!Comp) {
case BO_EQ:
     break;
   case BO_NE: // Noop.
     break;
   default:
     llvm_unreachable("not implemented");
   }
 }
 
-void transferUnaryMinus(const UnaryOperator *UO,
+void transferUnaryMinus(const CFGElement &Element, const UnaryOperator *UO,
                         const MatchFinder::MatchResult &M,
                         LatticeTransferState &State) {
   auto [UnaryOpValue, UnaryOpProps, OperandProps] =
       getValueAndSignProperties(UO, M, State);
   if (!UnaryOpValue)
     return;
 
   // a is pos ==> -a is neg
   State.Env.addToFlowCondition(
       State.Env.makeImplication(*OperandProps.Pos, *UnaryOpProps.Neg));
   // a is neg ==> -a is pos
   State.Env.addToFlowCondition(
       State.Env.makeImplication(*OperandProps.Neg, *UnaryOpProps.Pos));
   // a is zero ==> -a is zero
   State.Env.addToFlowCondition(
       State.Env.makeImplication(*OperandProps.Zero, *UnaryOpProps.Zero));
 }
 
-void transferUnaryNot(const UnaryOperator *UO,
+void transferUnaryNot(const CFGElement &Element, const UnaryOperator *UO,
                       const MatchFinder::MatchResult &M,
                       LatticeTransferState &State) {
   auto [UnaryOpValue, UnaryOpProps, OperandProps] =
       getValueAndSignProperties(UO, M, State);
   if (!UnaryOpValue)
     return;
 
   // a is neg or pos ==> !a is zero
   State.Env.addToFlowCondition(State.Env.makeImplication(
       State.Env.makeOr(*OperandProps.Pos, *OperandProps.Neg),
       *UnaryOpProps.Zero));
 
   // FIXME Handle this logic universally, not just for unary not. But Where to
   // put the generic handler, transferExpr maybe?
   if (auto *UOBoolVal = dyn_cast<BoolValue>(UnaryOpValue)) {
     // !a <==> a is zero
     State.Env.addToFlowCondition(
         State.Env.makeIff(*UOBoolVal, *OperandProps.Zero));
     // !a <==> !a is not zero
     State.Env.addToFlowCondition(
         State.Env.makeIff(*UOBoolVal, State.Env.makeNot(*UnaryOpProps.Zero)));
   }
 }
 
-void transferExpr(const Expr *E, const MatchFinder::MatchResult &M,
+void transferExpr(const CFGElement &Element, const Expr *E,
+                  const MatchFinder::MatchResult &M,
                   LatticeTransferState &State) {
   const ASTContext &Context = *M.Context;
   StorageLocation *Loc = State.Env.getStorageLocation(*E, SkipPast::None);
   if (!Loc) {
     Loc = &State.Env.createStorageLocation(*E);
     State.Env.setStorageLocation(*E, *Loc);
   }
   Value *Val = State.Env.getValue(*Loc);

clang/unittests/Analysis/FlowSensitive/UncheckedOptionalAccessModelTest.cpp

Headers.emplace_back("unchecked_optional_access_test.h", R"(
       #include "std_utility.h"
 
       template <typename T>
       T Make();
     )");
     UncheckedOptionalAccessModelOptions Options{
         /*IgnoreSmartPointerDereference=*/true};
     std::vector<SourceLocation> Diagnostics;
+    UncheckedOptionalAccessDiagnoser Diagnoser(Options);
     llvm::Error Error = checkDataflow<UncheckedOptionalAccessModel>(
         AnalysisInputs<UncheckedOptionalAccessModel>(
             SourceCode, std::move(FuncMatcher),
             [Options](ASTContext &Ctx, Environment &) {
               return UncheckedOptionalAccessModel(Ctx, Options);
             })
             .withPostVisitCFG(
-                [&Diagnostics,
-                 Diagnoser = UncheckedOptionalAccessDiagnoser(Options)](
+                [&Diagnostics, &Diagnoser](
                     ASTContext &Ctx, const CFGElement &Elt,
                     const TypeErasedDataflowAnalysisState &State) mutable {
                   auto EltDiagnostics =
                       Diagnoser.diagnose(Ctx, &Elt, State.Env);
                   llvm::move(EltDiagnostics, std::back_inserter(Diagnostics));
                 })
             .withASTBuildArgs(
                 {"-fsyntax-only", "-std=c++17", "-Wno-undefined-inline"})