[analyzer][NFC] Move away from using raw-for loops inside StaticAnalyzer

[steakhal]

Summary

I'm involved with the Static Analyzer for the most part.
I think we should embrace newer language standard features and gradually move forward.

[steakhal]

There remained a few more cases using raw-for loops, but those were slightly more tricky to uplift as they either use weird iterators or employ some fancy look-ahead/behind or iterate in parallel over different sequences etc.
I'll also make a measurement to confirm it doesn't change any reports.

[Szelethus]

But this renders much of my C++98 knowledge obsolete!!!!!11

[steakhal]

The transformations were done by hand. So I'd encourage you all to have a look and find places where it breaks. Also, it might have personal biases about the style I settled with. Feel free to challenge.

[xazax.hun]

clang/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h

501

Is this just a dummy to make sure this satisfies some concepts? I think I comment might be helpful in that case, people might find a noop dereference operator confusing. Same for some other places.

clang/include/clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h

749–750

Do we need these with the addition of referenced_vars?

clang/include/clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h

637–638

Should we remove these?

clang/lib/StaticAnalyzer/Checkers/MallocSizeofChecker.cpp

194–195

clang/lib/StaticAnalyzer/Core/AnalysisManager.cpp

54

Hm, I wonder whether we actually want to use unique_ptrs to make the ownership explicit. Feel free to leave as is in this PR.

clang/lib/StaticAnalyzer/Core/ExprEngineC.cpp

173–177

Might be an issue with Phab, but indent looks strange to me here.

clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp

1190

Ha about using capture_inits?

[donat.nagy]

I don't have concrete remarks, but I would like to note that I'm happy to see this cleanup :)

[steakhal]

clang/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h

501

Yes. I'll add a comment.
This falls into the "weird" iterators category.

clang/include/clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h

749–750

I no longer remember where, but yes. But for sure I went through these to see if I could remove them.

clang/include/clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h

637–638

I'm pretty sure we need these somewhere.
One prominent place is where we dump these into JSONs. We do some fancy iteration there. I'm not sure that is the reason for this particular case.
I'll give it another look to confirm.

clang/lib/StaticAnalyzer/Checkers/MallocSizeofChecker.cpp

194–195

Makes sense.

clang/lib/StaticAnalyzer/Core/AnalysisManager.cpp

54

The ownership model of these consumers is so messed up.
It's not that simple to fix. I was bitten by dangling consumers/graphs so many times now only counting last year.
So, yea. Maybe one day.

clang/lib/StaticAnalyzer/Core/ExprEngineC.cpp

173–177

Thanks for catching this. Indeed. I'll have a look. Probably I messed something up.

clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp

1190

I would count this as a "fancy" iteration as we increment/advance more logical sequences together.

[steakhal]

Fixed remarks, cleaned up residual includes, rebased.
Should be read to land.
Final thoughts?

clang/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h

501

Added comments to both places.

clang/include/clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h

749–750

Now I remember.
The referenced_vars is implemented as llvm::make_range(referenced_vars_begin(), referenced_vars_end()), thus I need those functions as they do quite a bit of work if you check.
So, I kept them.

clang/include/clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h

637–638

This was just an oversight. Removed. Thanks!

clang/lib/StaticAnalyzer/Checkers/TrustNonnullChecker.cpp

72

Oh, I didn't know this is a word :D

clang/lib/StaticAnalyzer/Core/Environment.cpp

29

Removed this extra include.

clang/lib/StaticAnalyzer/Core/ExprEngineC.cpp

173–177

Clang-format went crazy, and I'm using clang-format on save, thus messed this up.
Fixed up manually. Should be good now.

clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp

1190

I had a better idea and llvm::zip all these together.
Check it out, and tell me if you like it more ;)
I certainly do.

[xazax.hun]

I love it, I think we can land this as is. If there are further comments, we can address those in follow-up PRs.

clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp

1190

Nice!

[steakhal]

clang/lib/StaticAnalyzer/Core/AnalysisManager.cpp

54

Fixed by https://reviews.llvm.org/D154478

clang/include/clang/StaticAnalyzer/Core/BugReporter/BugReporter.h

public:
   void FlushReports();
 
   ArrayRef<PathDiagnosticConsumer*> getPathDiagnosticConsumers() {
     return D.getPathDiagnosticConsumers();
   }
 
   /// Iterator over the set of BugReports tracked by the BugReporter.
   using EQClasses_iterator = llvm::FoldingSet<BugReportEquivClass>::iterator;
-  EQClasses_iterator EQClasses_begin() { return EQClasses.begin(); }
-  EQClasses_iterator EQClasses_end() { return EQClasses.end(); }
+  llvm::iterator_range<EQClasses_iterator> equivalenceClasses() {
+    return EQClasses;
+  }
 
   ASTContext &getContext() { return D.getASTContext(); }
 
   const SourceManager &getSourceManager() { return D.getSourceManager(); }
 
   const AnalyzerOptions &getAnalyzerOptions() { return D.getAnalyzerOptions(); }
 
   Preprocessor &getPreprocessor() { return D.getPreprocessor(); }

clang/include/clang/StaticAnalyzer/Core/Checker.h

_checkPointerEscape(void *Checker,
 
     if (!ETraits)
       return ((const CHECKER *)Checker)->checkPointerEscape(State,
                                                             Escaped,
                                                             Call,
                                                             Kind);
 
     InvalidatedSymbols RegularEscape;
-    for (InvalidatedSymbols::const_iterator I = Escaped.begin(),
-                                            E = Escaped.end(); I != E; ++I)
-      if (!ETraits->hasTrait(*I,
-              RegionAndSymbolInvalidationTraits::TK_PreserveContents) &&
-          !ETraits->hasTrait(*I,
-              RegionAndSymbolInvalidationTraits::TK_SuppressEscape))
-        RegularEscape.insert(*I);
+    for (SymbolRef Sym : Escaped)
+      if (!ETraits->hasTrait(
+              Sym, RegionAndSymbolInvalidationTraits::TK_PreserveContents) &&
+          !ETraits->hasTrait(
+              Sym, RegionAndSymbolInvalidationTraits::TK_SuppressEscape))
+        RegularEscape.insert(Sym);
 
     if (RegularEscape.empty())
       return State;
 
     return ((const CHECKER *)Checker)->checkPointerEscape(State,
                                                           RegularEscape,
                                                           Call,
                                                           Kind);
_checkConstPointerEscape(void *Checker,
                       const CallEvent *Call,
                       PointerEscapeKind Kind,
                       RegionAndSymbolInvalidationTraits *ETraits) {
 
     if (!ETraits)
       return State;
 
     InvalidatedSymbols ConstEscape;
-    for (InvalidatedSymbols::const_iterator I = Escaped.begin(),
-                                            E = Escaped.end(); I != E; ++I)
-      if (ETraits->hasTrait(*I,
-              RegionAndSymbolInvalidationTraits::TK_PreserveContents) &&
-          !ETraits->hasTrait(*I,
-              RegionAndSymbolInvalidationTraits::TK_SuppressEscape))
-        ConstEscape.insert(*I);
+    for (SymbolRef Sym : Escaped) {
+      if (ETraits->hasTrait(
+              Sym, RegionAndSymbolInvalidationTraits::TK_PreserveContents) &&
+          !ETraits->hasTrait(
+              Sym, RegionAndSymbolInvalidationTraits::TK_SuppressEscape))
+        ConstEscape.insert(Sym);
+    }
 
     if (ConstEscape.empty())
       return State;
 
     return ((const CHECKER *)Checker)->checkConstPointerEscape(State,
                                                                ConstEscape,
                                                                Call,
                                                                Kind);

clang/include/clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h

public:
 
   /// For a block converted from a C++ lambda, returns the block
   /// VarRegion for the variable holding the captured C++ lambda record.
   const VarRegion *getRegionStoringCapturedLambda() const {
     assert(isConversionFromLambda());
     const BlockDataRegion *BR = getBlockRegion();
     assert(BR && "Block converted from lambda must have a block region");
 
-    auto I = BR->referenced_vars_begin();
-    assert(I != BR->referenced_vars_end());
-
-    return I.getCapturedRegion();
+    auto ReferencedVars = BR->referenced_vars();
+    assert(!ReferencedVars.empty());
+    return ReferencedVars.begin().getCapturedRegion();
   }
 
   RuntimeDefinition getRuntimeDefinition() const override {
     if (!isConversionFromLambda())
       return RuntimeDefinition(getDecl());
 
     // Clang converts lambdas to blocks with an implicit user-defined
     // conversion operator method on the lambda record that looks (roughly)

clang/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h

 #include "clang/Analysis/ProgramPoint.h"
 #include "clang/Basic/LLVM.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/BlockCounter.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ExplodedGraph.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState_Fwd.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/WorkList.h"
 #include "llvm/ADT/SmallVector.h"
+#include "llvm/ADT/iterator_range.h"
 #include "llvm/Support/Casting.h"
 #include <cassert>
 #include <memory>
 #include <utility>
 #include <vector>
 
 namespace clang {
 
public:
   /// it could not be completely analyzed.
   void addAbortedBlock(const ExplodedNode *node, const CFGBlock *block) {
     blocksAborted.push_back(std::make_pair(block, node));
   }
 
   WorkList *getWorkList() const { return WList.get(); }
   WorkList *getCTUWorkList() const { return CTUWList.get(); }
 
-  BlocksExhausted::const_iterator blocks_exhausted_begin() const {
-    return blocksExhausted.begin();
+  auto exhausted_blocks() const {
+    return llvm::iterator_range(blocksExhausted);
   }
 
-  BlocksExhausted::const_iterator blocks_exhausted_end() const {
-    return blocksExhausted.end();
-  }
-
-  BlocksAborted::const_iterator blocks_aborted_begin() const {
-    return blocksAborted.begin();
-  }
-
-  BlocksAborted::const_iterator blocks_aborted_end() const {
-    return blocksAborted.end();
-  }
+  auto aborted_blocks() const { return llvm::iterator_range(blocksAborted); }
 
   /// Enqueue the given set of nodes onto the work list.
   void enqueue(ExplodedNodeSet &Set);
 
   /// Enqueue nodes that were created as a result of processing
   /// a statement onto the work list.
   void enqueue(ExplodedNodeSet &Set, const CFGBlock *Block, unsigned Idx);
 
public:
   class iterator {
     friend class IndirectGotoNodeBuilder;
 
     CFGBlock::const_succ_iterator I;
 
     iterator(CFGBlock::const_succ_iterator i) : I(i) {}
 
   public:
+    const iterator &operator*() const { return *this; }
+
     iterator &operator++() { ++I; return *this; }
     bool operator!=(const iterator &X) const { return I != X.I; }
 
     const LabelDecl *getLabel() const {
       return cast<LabelStmt>((*I)->getLabel())->getDecl();
     }
 
     const CFGBlock *getBlock() const {

clang/include/clang/StaticAnalyzer/Core/PathSensitive/ExplodedGraph.h

 #include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"
 #include "llvm/ADT/ArrayRef.h"
 #include "llvm/ADT/DenseMap.h"
 #include "llvm/ADT/DepthFirstIterator.h"
 #include "llvm/ADT/FoldingSet.h"
 #include "llvm/ADT/GraphTraits.h"
 #include "llvm/ADT/STLExtras.h"
 #include "llvm/ADT/SetVector.h"
+#include "llvm/ADT/iterator_range.h"
 #include "llvm/Support/Allocator.h"
 #include "llvm/Support/Compiler.h"
 #include <cassert>
 #include <cstdint>
 #include <memory>
 #include <optional>
 #include <utility>
 #include <vector>
public:
   using AllNodesTy = llvm::FoldingSet<ExplodedNode>;
   using roots_iterator = NodeVector::iterator;
   using const_roots_iterator = NodeVector::const_iterator;
   using eop_iterator = NodeVector::iterator;
   using const_eop_iterator = NodeVector::const_iterator;
   using node_iterator = AllNodesTy::iterator;
   using const_node_iterator = AllNodesTy::const_iterator;
 
-  node_iterator nodes_begin() { return Nodes.begin(); }
+  llvm::iterator_range<node_iterator> nodes() { return Nodes; }
 
-  node_iterator nodes_end() { return Nodes.end(); }
-
-  const_node_iterator nodes_begin() const { return Nodes.begin(); }
-
-  const_node_iterator nodes_end() const { return Nodes.end(); }
+  llvm::iterator_range<const_node_iterator> nodes() const { return Nodes; }
 
   roots_iterator roots_begin() { return Roots.begin(); }
 
   roots_iterator roots_end() { return Roots.end(); }
 
   const_roots_iterator roots_begin() const { return Roots.begin(); }
 
   const_roots_iterator roots_end() const { return Roots.end(); }

clang/include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h

static std::pair<const ProgramPointTag *, const ProgramPointTag *>
     geteagerlyAssumeBinOpBifurcationTags();
 
   ProgramStateRef handleLValueBitCast(ProgramStateRef state, const Expr *Ex,
                                       const LocationContext *LCtx, QualType T,
                                       QualType ExTy, const CastExpr *CastE,
                                       StmtNodeBuilder &Bldr,
                                       ExplodedNode *Pred);
 
-  void handleUOExtension(ExplodedNodeSet::iterator I,
-                         const UnaryOperator* U,
+  void handleUOExtension(ExplodedNode *N, const UnaryOperator *U,
                          StmtNodeBuilder &Bldr);
 
 public:
   SVal evalBinOp(ProgramStateRef ST, BinaryOperator::Opcode Op,
                  SVal LHS, SVal RHS, QualType T) {
     return svalBuilder.evalBinOp(ST, Op, LHS, RHS, T);
   }
 

clang/include/clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h

 #include "clang/Analysis/AnalysisDeclContext.h"
 #include "clang/Basic/LLVM.h"
 #include "clang/Basic/SourceLocation.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/SymExpr.h"
 #include "llvm/ADT/DenseMap.h"
 #include "llvm/ADT/FoldingSet.h"
 #include "llvm/ADT/PointerIntPair.h"
+#include "llvm/ADT/iterator_range.h"
 #include "llvm/Support/Allocator.h"
 #include "llvm/Support/Casting.h"
 #include <cassert>
 #include <cstdint>
 #include <limits>
 #include <optional>
 #include <string>
 #include <utility>
bool operator!=(const referenced_vars_iterator &I) const {
       return I.R != R;
     }
 
     referenced_vars_iterator &operator++() {
       ++R;
       ++OriginalR;
       return *this;
     }
+
+    const referenced_vars_iterator &operator*() const { return *this; }
   };
 
   /// Return the original region for a captured region, if
   /// one exists. It might return null.
   const VarRegion *getOriginalRegion(const VarRegion *VR) const;
 
   referenced_vars_iterator referenced_vars_begin() const;
   referenced_vars_iterator referenced_vars_end() const;
+  llvm::iterator_range<referenced_vars_iterator> referenced_vars() const;
 
   void dumpToStream(raw_ostream &os) const override;
 
   void Profile(llvm::FoldingSetNodeID& ID) const override;
 
   static bool classof(const MemRegion* R) {
     return R->getKind() == BlockDataRegionKind;
   }

clang/include/clang/StaticAnalyzer/Core/PathSensitive/SMTConstraintManager.h

const llvm::APSInt *getSymVal(ProgramStateRef State,
     llvm_unreachable("Unsupported expression to get symbol value!");
   }
 
   ProgramStateRef removeDeadBindings(ProgramStateRef State,
                                      SymbolReaper &SymReaper) override {
     auto CZ = State->get<ConstraintSMT>();
     auto &CZFactory = State->get_context<ConstraintSMT>();
 
-    for (auto I = CZ.begin(), E = CZ.end(); I != E; ++I) {
-      if (SymReaper.isDead(I->first))
-        CZ = CZFactory.remove(CZ, *I);
+    for (const auto &Entry : CZ) {
+      if (SymReaper.isDead(Entry.first))
+        CZ = CZFactory.remove(CZ, Entry);
     }
 
     return State->set<ConstraintSMT>(CZ);
   }
 
   void printJson(raw_ostream &Out, ProgramStateRef State, const char *NL = "\n",
                  unsigned int Space = 0, bool IsDot = false) const override {
     ConstraintSMTType Constraints = State->get<ConstraintSMT>();

clang/include/clang/StaticAnalyzer/Core/PathSensitive/SVals.h

 
 #include "clang/AST/Expr.h"
 #include "clang/AST/Type.h"
 #include "clang/Basic/LLVM.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/SymExpr.h"
 #include "llvm/ADT/FoldingSet.h"
 #include "llvm/ADT/ImmutableList.h"
 #include "llvm/ADT/PointerUnion.h"
+#include "llvm/ADT/iterator_range.h"
 #include "llvm/Support/Casting.h"
 #include <cassert>
 #include <cstdint>
 #include <optional>
 #include <utility>
 
 //==------------------------------------------------------------------------==//
 //  Base SVal types.
public:
   const MemRegion *getAsRegion() const;
 
   /// printJson - Pretty-prints in JSON format.
   void printJson(raw_ostream &Out, bool AddQuotes) const;
 
   void dumpToStream(raw_ostream &OS) const;
   void dump() const;
 
-  SymExpr::symbol_iterator symbol_begin() const {
-    const SymExpr *SE = getAsSymbol(/*IncludeBaseRegions=*/true);
-    if (SE)
-      return SE->symbol_begin();
-    else
-      return SymExpr::symbol_iterator();
-  }
-
-  SymExpr::symbol_iterator symbol_end() const {
-    return SymExpr::symbol_end();
+  llvm::iterator_range<SymExpr::symbol_iterator> symbols() const {
+    if (const SymExpr *SE = getAsSymbol(/*IncludeBaseRegions=*/true))
+      return SE->symbols();
+    SymExpr::symbol_iterator end{};
+    return llvm::make_range(end, end);
   }
 
   /// Try to get a reasonable type for the given value.
   ///
   /// \returns The best approximation of the value type or Null.
   /// In theory, all symbolic values should be typed, but this function
   /// is still a WIP and might have a few blind spots.
   ///

clang/include/clang/StaticAnalyzer/Core/PathSensitive/SymExpr.h

 
 #ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_SYMEXPR_H
 #define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_SYMEXPR_H
 
 #include "clang/AST/Type.h"
 #include "clang/Basic/LLVM.h"
 #include "llvm/ADT/FoldingSet.h"
 #include "llvm/ADT/SmallVector.h"
+#include "llvm/ADT/iterator_range.h"
 #include <cassert>
 
 namespace clang {
 namespace ento {
 
 class MemRegion;
 
 /// Symbolic value. These values used to capture symbolic execution of
public:
 
     symbol_iterator &operator++();
     const SymExpr *operator*();
 
     bool operator==(const symbol_iterator &X) const;
     bool operator!=(const symbol_iterator &X) const;
   };
 
-  symbol_iterator symbol_begin() const { return symbol_iterator(this); }
-  static symbol_iterator symbol_end() { return symbol_iterator(); }
+  llvm::iterator_range<symbol_iterator> symbols() const {
+    return llvm::make_range(symbol_iterator(this), symbol_iterator());
+  }
 
   virtual unsigned computeComplexity() const = 0;
 
   /// Find the region from which this symbol originates.
   ///
   /// Whenever the symbol was constructed to denote an unknown value of
   /// a certain memory region, return this region. This method
   /// allows checkers to make decisions depending on the origin of the symbol.

clang/include/clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h

 #include "clang/Analysis/AnalysisDeclContext.h"
 #include "clang/Basic/LLVM.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/StoreRef.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/SymExpr.h"
 #include "llvm/ADT/DenseMap.h"
 #include "llvm/ADT/DenseSet.h"
 #include "llvm/ADT/FoldingSet.h"
+#include "llvm/ADT/iterator_range.h"
 #include "llvm/Support/Allocator.h"
 #include <cassert>
 
 namespace clang {
 
 class ASTContext;
 class Stmt;
 
public:
   /// this will keep the symbol alive as long as its associated region is also
   /// live. For other symbols, this has no effect; checkers are not permitted
   /// to influence the life of other symbols. This should be used before any
   /// symbol marking has occurred, i.e. in the MarkLiveSymbols callback.
   void markInUse(SymbolRef sym);
 
   using region_iterator = RegionSetTy::const_iterator;
 
   region_iterator region_begin() const { return LiveRegionRoots.begin(); }
   region_iterator region_end() const { return LiveRegionRoots.end(); }
+  llvm::iterator_range<region_iterator> regions() const {
+    return LiveRegionRoots;
+  }
 
   /// Returns whether or not a symbol has been confirmed dead.
   ///
   /// This should only be called once all marking of dead symbols has completed.
   /// (For checkers, this means only in the checkDeadSymbols callback.)
   bool isDead(SymbolRef sym) {
     return !isLive(sym);
   }

clang/lib/StaticAnalyzer/Checkers/AnalyzerStatsChecker.cpp

 //==--AnalyzerStatsChecker.cpp - Analyzer visitation statistics --*- C++ -*-==//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 // This file reports various statistics about analyzer visitation.
 //===----------------------------------------------------------------------===//
-#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
 #include "clang/AST/DeclObjC.h"
 #include "clang/Basic/SourceManager.h"
+#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
 #include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ExplodedGraph.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
+#include "llvm/ADT/STLExtras.h"
 #include "llvm/ADT/SmallPtrSet.h"
 #include "llvm/ADT/SmallString.h"
 #include "llvm/ADT/Statistic.h"
 #include "llvm/Support/raw_ostream.h"
 #include <optional>
 
 using namespace clang;
 using namespace ento;
void AnalyzerStatsChecker::checkEndAnalysis(ExplodedGraph &G,
 
   // Root node should have the location context of the top most function.
   const ExplodedNode *GraphRoot = *G.roots_begin();
   const LocationContext *LC = GraphRoot->getLocation().getLocationContext();
 
   const Decl *D = LC->getDecl();
 
   // Iterate over the exploded graph.
-  for (ExplodedGraph::node_iterator I = G.nodes_begin();
-      I != G.nodes_end(); ++I) {
-    const ProgramPoint &P = I->getLocation();
+  for (const ExplodedNode &N : G.nodes()) {
+    const ProgramPoint &P = N.getLocation();
 
     // Only check the coverage in the top level function (optimization).
     if (D != P.getLocationContext()->getDecl())
       continue;
 
     if (std::optional<BlockEntrance> BE = P.getAs<BlockEntrance>()) {
       const CFGBlock *CB = BE->getBlock();
       reachable.insert(CB);
output << " -> Total CFGBlocks: " << total << " | Unreachable CFGBlocks: "
       << (Eng.wasBlocksExhausted() ? "yes" : "no")
       << " | Empty WorkList: "
       << (Eng.hasEmptyWorkList() ? "yes" : "no");
 
   B.EmitBasicReport(D, this, "Analyzer Statistics", "Internal Statistics",
                     output.str(), PathDiagnosticLocation(D, SM));
 
   // Emit warning for each block we bailed out on.
-  typedef CoreEngine::BlocksExhausted::const_iterator ExhaustedIterator;
   const CoreEngine &CE = Eng.getCoreEngine();
-  for (ExhaustedIterator I = CE.blocks_exhausted_begin(),
-      E = CE.blocks_exhausted_end(); I != E; ++I) {
-    const BlockEdge &BE =  I->first;
+  for (const BlockEdge &BE : make_first_range(CE.exhausted_blocks())) {
     const CFGBlock *Exit = BE.getDst();
     if (Exit->empty())
       continue;
     const CFGElement &CE = Exit->front();
     if (std::optional<CFGStmt> CS = CE.getAs<CFGStmt>()) {
       SmallString<128> bufI;
       llvm::raw_svector_ostream outputI(bufI);
       outputI << "(" << NameOfRootFunction << ")" <<

clang/lib/StaticAnalyzer/Checkers/BasicObjCFoundationChecks.cpp

 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CallDescription.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ExplodedGraph.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
+#include "llvm/ADT/STLExtras.h"
 #include "llvm/ADT/SmallString.h"
 #include "llvm/ADT/StringMap.h"
 #include "llvm/Support/raw_ostream.h"
 #include <optional>
 
 using namespace clang;
 using namespace ento;
 using namespace llvm;
if (!N)
     return false;
 
   ProgramPoint P = N->getLocation();
   if (std::optional<BlockEdge> BE = P.getAs<BlockEdge>()) {
     return BE->getSrc()->getLoopTarget() == FCS;
   }
 
   // Keep looking for a block edge.
-  for (ExplodedNode::const_pred_iterator I = N->pred_begin(),
-                                         E = N->pred_end(); I != E; ++I) {
-    if (alreadyExecutedAtLeastOneLoopIteration(*I, FCS))
+  for (const ExplodedNode *N : N->preds()) {
+    if (alreadyExecutedAtLeastOneLoopIteration(N, FCS))
       return true;
   }
 
   return false;
 }
 
 void ObjCLoopChecker::checkPostStmt(const ObjCForCollectionStmt *FCS,
                                     CheckerContext &C) const {

 ProgramStateRef
 ObjCLoopChecker::checkPointerEscape(ProgramStateRef State,
                                     const InvalidatedSymbols &Escaped,
                                     const CallEvent *Call,
                                     PointerEscapeKind Kind) const {
   SymbolRef ImmutableReceiver = getMethodReceiverIfKnownImmutable(Call);
 
   // Remove the invalidated symbols from the collection count map.
-  for (InvalidatedSymbols::const_iterator I = Escaped.begin(),
-       E = Escaped.end();
-       I != E; ++I) {
-    SymbolRef Sym = *I;
-
+  for (SymbolRef Sym : Escaped) {
     // Don't invalidate this symbol's count if we know the method being called
     // is declared on an immutable class. This isn't completely correct if the
     // receiver is also passed as an argument, but in most uses of NSArray,
     // NSDictionary, etc. this isn't likely to happen in a dangerous way.
     if (Sym == ImmutableReceiver)
       continue;
 
     // The symbol escaped. Pessimistically, assume that the count could have
     // changed.
     State = State->remove<ContainerCountMap>(Sym);
     State = State->remove<ContainerNonEmptyMap>(Sym);
   }
   return State;
 }
 
 void ObjCLoopChecker::checkDeadSymbols(SymbolReaper &SymReaper,
                                        CheckerContext &C) const {
   ProgramStateRef State = C.getState();
 
   // Remove the dead symbols from the collection count map.
   ContainerCountMapTy Tracked = State->get<ContainerCountMap>();
-  for (ContainerCountMapTy::iterator I = Tracked.begin(),
-                                     E = Tracked.end(); I != E; ++I) {
-    SymbolRef Sym = I->first;
+  for (SymbolRef Sym : llvm::make_first_range(Tracked)) {
     if (SymReaper.isDead(Sym)) {
       State = State->remove<ContainerCountMap>(Sym);
       State = State->remove<ContainerNonEmptyMap>(Sym);
     }
   }
 
   C.addTransition(State);
 }

clang/lib/StaticAnalyzer/Checkers/CStringChecker.cpp

CStringChecker::checkRegionChanges(ProgramStateRef state,
   CStringLengthTy Entries = state->get<CStringLength>();
   if (Entries.isEmpty())
     return state;
 
   llvm::SmallPtrSet<const MemRegion *, 8> Invalidated;
   llvm::SmallPtrSet<const MemRegion *, 32> SuperRegions;
 
   // First build sets for the changed regions and their super-regions.
-  for (ArrayRef<const MemRegion *>::iterator
-      I = Regions.begin(), E = Regions.end(); I != E; ++I) {
-    const MemRegion *MR = *I;
+  for (const MemRegion *MR : Regions) {
     Invalidated.insert(MR);
 
     SuperRegions.insert(MR);
     while (const SubRegion *SR = dyn_cast<SubRegion>(MR)) {
       MR = SR->getSuperRegion();
       SuperRegions.insert(MR);
     }
   }
 
   CStringLengthTy::Factory &F = state->get_context<CStringLength>();
 
   // Then loop over the entries in the current state.
-  for (CStringLengthTy::iterator I = Entries.begin(),
-      E = Entries.end(); I != E; ++I) {
-    const MemRegion *MR = I.getKey();
-
+  for (const MemRegion *MR : llvm::make_first_range(Entries)) {
     // Is this entry for a super-region of a changed region?
     if (SuperRegions.count(MR)) {
       Entries = F.remove(Entries, MR);
       continue;
     }
 
     // Is this entry for a sub-region of a changed region?
     const MemRegion *Super = MR;
CStringChecker::checkRegionChanges(ProgramStateRef state,
   return state->set<CStringLength>(Entries);
 }
 
 void CStringChecker::checkLiveSymbols(ProgramStateRef state,
     SymbolReaper &SR) const {
   // Mark all symbols in our string length map as valid.
   CStringLengthTy Entries = state->get<CStringLength>();
 
-  for (CStringLengthTy::iterator I = Entries.begin(), E = Entries.end();
-      I != E; ++I) {
-    SVal Len = I.getData();
-
-    for (SymExpr::symbol_iterator si = Len.symbol_begin(),
-        se = Len.symbol_end(); si != se; ++si)
-      SR.markInUse(*si);
+  for (SVal Len : llvm::make_second_range(Entries)) {
+    for (SymbolRef Sym : Len.symbols())
+      SR.markInUse(Sym);
   }
 }
 
 void CStringChecker::checkDeadSymbols(SymbolReaper &SR,
     CheckerContext &C) const {
   ProgramStateRef state = C.getState();
   CStringLengthTy Entries = state->get<CStringLength>();
   if (Entries.isEmpty())
     return;
 
   CStringLengthTy::Factory &F = state->get_context<CStringLength>();
-  for (CStringLengthTy::iterator I = Entries.begin(), E = Entries.end();
-      I != E; ++I) {
-    SVal Len = I.getData();
+  for (auto [Reg, Len] : Entries) {
     if (SymbolRef Sym = Len.getAsSymbol()) {
       if (SR.isDead(Sym))
-        Entries = F.remove(Entries, I.getKey());
+        Entries = F.remove(Entries, Reg);
     }
   }
 
   state = state->set<CStringLength>(Entries);
   C.addTransition(state);
 }
 
 void ento::registerCStringModeling(CheckerManager &Mgr) {

clang/lib/StaticAnalyzer/Checkers/CheckObjCDealloc.cpp

const ObjCPropertyDecl *ObjCDeallocChecker::findShadowedPropertyDecl(
   auto *CatDecl = dyn_cast<ObjCCategoryDecl>(PropDecl->getDeclContext());
 
   // Only class extensions can contain shadowing properties.
   if (!CatDecl || !CatDecl->IsClassExtension())
     return nullptr;
 
   IdentifierInfo *ID = PropDecl->getIdentifier();
   DeclContext::lookup_result R = CatDecl->getClassInterface()->lookup(ID);
-  for (DeclContext::lookup_iterator I = R.begin(), E = R.end(); I != E; ++I) {
-    auto *ShadowedPropDecl = dyn_cast<ObjCPropertyDecl>(*I);
+  for (const NamedDecl *D : R) {
+    auto *ShadowedPropDecl = dyn_cast<ObjCPropertyDecl>(D);
     if (!ShadowedPropDecl)
       continue;
 
     if (ShadowedPropDecl->isInstanceProperty()) {
       assert(ShadowedPropDecl->isReadOnly());
       return ShadowedPropDecl;
     }
   }

clang/lib/StaticAnalyzer/Checkers/DeadStoresChecker.cpp

void ReachableCode::computeReachableBlocks() {
   worklist.push_back(&cfg.getEntry());
 
   while (!worklist.empty()) {
     const CFGBlock *block = worklist.pop_back_val();
     llvm::BitVector::reference isReachable = reachable[block->getBlockID()];
     if (isReachable)
       continue;
     isReachable = true;
-    for (CFGBlock::const_succ_iterator i = block->succ_begin(),
-                                       e = block->succ_end(); i != e; ++i)
-      if (const CFGBlock *succ = *i)
+
+    for (const CFGBlock *succ : block->succs())
+      if (succ)
         worklist.push_back(succ);
   }
 }
 
 static const Expr *
 LookThroughTransitiveAssignmentsAndCommaOperators(const Expr *Ex) {
   while (Ex) {
     Ex = Ex->IgnoreParenCasts();

clang/lib/StaticAnalyzer/Checkers/DebugCheckers.cpp

 
 public:
   void checkEndOfTranslationUnit(const TranslationUnitDecl *TU,
                                  AnalysisManager& mgr,
                                  BugReporter &BR) const {
     const Table &Config = mgr.options.Config;
 
     SmallVector<const Table::MapEntryTy *, 32> Keys;
-    for (Table::const_iterator I = Config.begin(), E = Config.end(); I != E;
-         ++I)
-      Keys.push_back(&*I);
+    for (const auto &Entry : Config)
+      Keys.push_back(&Entry);
     llvm::array_pod_sort(Keys.begin(), Keys.end(), compareEntry);
 
     llvm::errs() << "[config]\n";
     for (unsigned I = 0, E = Keys.size(); I != E; ++I)
       llvm::errs() << Keys[I]->getKey() << " = "
                    << (Keys[I]->second.empty() ? "\"\"" : Keys[I]->second)
                    << '\n';
   }

clang/lib/StaticAnalyzer/Checkers/DynamicTypePropagation.cpp

 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
 #include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/DynamicType.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
+#include "llvm/ADT/STLExtras.h"
 #include <optional>
 
 using namespace clang;
 using namespace ento;
 
 // ProgramState trait - The type inflation is tracked by DynamicTypeMap. This is
 // an auxiliary map that tracks more information about generic types, because in
 // some cases the most derived type is not the most informative one about the

 
 void DynamicTypePropagation::checkDeadSymbols(SymbolReaper &SR,
                                               CheckerContext &C) const {
   ProgramStateRef State = removeDeadTypes(C.getState(), SR);
   State = removeDeadClassObjectTypes(State, SR);
 
   MostSpecializedTypeArgsMapTy TyArgMap =
       State->get<MostSpecializedTypeArgsMap>();
-  for (MostSpecializedTypeArgsMapTy::iterator I = TyArgMap.begin(),
-                                              E = TyArgMap.end();
-       I != E; ++I) {
-    if (SR.isDead(I->first)) {
-      State = State->remove<MostSpecializedTypeArgsMap>(I->first);
+  for (SymbolRef Sym : llvm::make_first_range(TyArgMap)) {
+    if (SR.isDead(Sym)) {
+      State = State->remove<MostSpecializedTypeArgsMap>(Sym);
     }
   }
 
   C.addTransition(State);
 }
 
 static void recordFixedType(const MemRegion *Region, const CXXMethodDecl *MD,
                             CheckerContext &C) {

clang/lib/StaticAnalyzer/Checkers/ExprInspectionChecker.cpp

void ExprInspectionChecker::analyzerWarnOnDeadSymbol(const CallExpr *CE,
   C.addTransition(State);
 }
 
 void ExprInspectionChecker::checkDeadSymbols(SymbolReaper &SymReaper,
                                              CheckerContext &C) const {
   ProgramStateRef State = C.getState();
   const MarkedSymbolsTy &Syms = State->get<MarkedSymbols>();
   ExplodedNode *N = C.getPredecessor();
-  for (auto I = Syms.begin(), E = Syms.end(); I != E; ++I) {
-    SymbolRef Sym = *I;
+  for (SymbolRef Sym : Syms) {
     if (!SymReaper.isDead(Sym))
       continue;
 
     // The non-fatal error node should be the same for all reports.
     if (ExplodedNode *BugNode = reportBug("SYMBOL DEAD", C))
       N = BugNode;
     State = State->remove<MarkedSymbols>(Sym);
   }

clang/lib/StaticAnalyzer/Checkers/FuchsiaHandleChecker.cpp

 
 void FuchsiaHandleChecker::printState(raw_ostream &Out, ProgramStateRef State,
                                       const char *NL, const char *Sep) const {
 
   HStateMapTy StateMap = State->get<HStateMap>();
 
   if (!StateMap.isEmpty()) {
     Out << Sep << "FuchsiaHandleChecker :" << NL;
-    for (HStateMapTy::iterator I = StateMap.begin(), E = StateMap.end(); I != E;
-         ++I) {
-      I.getKey()->dumpToStream(Out);
+    for (const auto &[Sym, HandleState] : StateMap) {
+      Sym->dumpToStream(Out);
       Out << " : ";
-      I.getData().dump(Out);
+      HandleState.dump(Out);
       Out << NL;
     }
   }
 }

clang/lib/StaticAnalyzer/Checkers/IteratorModeling.cpp

 #include "clang/AST/DeclTemplate.h"
 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
 #include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CallDescription.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/DynamicType.h"
+#include "llvm/ADT/STLExtras.h"
 
 #include "Iterator.h"
 
 #include <utility>
 
 using namespace clang;
 using namespace ento;
 using namespace iterator;
void IteratorModeling::checkPostStmt(const MaterializeTemporaryExpr *MTE,
   State = setIteratorPosition(State, C.getSVal(MTE), *Pos);
   C.addTransition(State);
 }
 
 void IteratorModeling::checkLiveSymbols(ProgramStateRef State,
                                         SymbolReaper &SR) const {
   // Keep symbolic expressions of iterator positions alive
   auto RegionMap = State->get<IteratorRegionMap>();
-  for (const auto &Reg : RegionMap) {
-    const auto Offset = Reg.second.getOffset();
-    for (auto i = Offset->symbol_begin(); i != Offset->symbol_end(); ++i)
-      if (isa<SymbolData>(*i))
-        SR.markLive(*i);
+  for (const IteratorPosition &Pos : llvm::make_second_range(RegionMap)) {
+    for (SymbolRef Sym : Pos.getOffset()->symbols())
+      if (isa<SymbolData>(Sym))
+        SR.markLive(Sym);
   }
 
   auto SymbolMap = State->get<IteratorSymbolMap>();
-  for (const auto &Sym : SymbolMap) {
-    const auto Offset = Sym.second.getOffset();
-    for (auto i = Offset->symbol_begin(); i != Offset->symbol_end(); ++i)
-      if (isa<SymbolData>(*i))
-        SR.markLive(*i);
+  for (const IteratorPosition &Pos : llvm::make_second_range(SymbolMap)) {
+    for (SymbolRef Sym : Pos.getOffset()->symbols())
+      if (isa<SymbolData>(Sym))
+        SR.markLive(Sym);
   }
-
 }
 
 void IteratorModeling::checkDeadSymbols(SymbolReaper &SR,
                                         CheckerContext &C) const {
   // Cleanup
   auto State = C.getState();
 
   auto RegionMap = State->get<IteratorRegionMap>();

clang/lib/StaticAnalyzer/Checkers/IvarInvalidationChecker.cpp

 //  Partial invalidor annotation allows to address cases when ivars are
 //  invalidated by other methods, which might or might not be called from
 //  the invalidation method. The checker checks that each invalidation
 //  method and all the partial methods cumulatively invalidate all ivars.
 //    __attribute__((annotate("objc_instance_variable_invalidator_partial")));
 //
 //===----------------------------------------------------------------------===//
 
-#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
 #include "clang/AST/Attr.h"
 #include "clang/AST/DeclObjC.h"
 #include "clang/AST/StmtVisitor.h"
+#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
 #include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
 #include "llvm/ADT/DenseMap.h"
+#include "llvm/ADT/STLExtras.h"
 #include "llvm/ADT/SetVector.h"
 #include "llvm/ADT/SmallString.h"
 
 using namespace clang;
 using namespace ento;
 
 namespace {
 struct ChecksFilter {
struct InvalidationInfo {
 
     bool needsInvalidation() const {
       return !InvalidationMethods.empty();
     }
 
     bool hasMethod(const ObjCMethodDecl *MD) {
       if (IsInvalidated)
         return true;
-      for (MethodSet::iterator I = InvalidationMethods.begin(),
-          E = InvalidationMethods.end(); I != E; ++I) {
-        if (*I == MD) {
+      for (const ObjCMethodDecl *Curr : InvalidationMethods) {
+        if (Curr == MD) {
           IsInvalidated = true;
           return true;
         }
       }
       return false;
     }
   };
 
if (IvarD && IvarD->getContainingInterface() == InterfaceD) {
     }
     // If the ivar is synthesized we still want to track it.
     if (trackIvar(IvarD, TrackedIvars, FirstIvarDecl))
       return IvarD;
   }
 
   // Lookup IVars named "_PropName"or "PropName" among the tracked Ivars.
   StringRef PropName = Prop->getIdentifier()->getName();
-  for (IvarSet::const_iterator I = TrackedIvars.begin(),
-                               E = TrackedIvars.end(); I != E; ++I) {
-    const ObjCIvarDecl *Iv = I->first;
+  for (const ObjCIvarDecl *Iv : llvm::make_first_range(TrackedIvars)) {
     StringRef IvarName = Iv->getName();
 
     if (IvarName == PropName)
       return Iv;
 
     SmallString<128> PropNameWithUnderscore;
     {
       llvm::raw_svector_ostream os(PropNameWithUnderscore);
visit(const ObjCImplementationDecl *ImplD) const {
   MethToIvarMapTy PropSetterToIvarMap;
   MethToIvarMapTy PropGetterToIvarMap;
   PropToIvarMapTy PropertyToIvarMap;
   IvarToPropMapTy IvarToPopertyMap;
 
   ObjCInterfaceDecl::PropertyMap PropMap;
   InterfaceD->collectPropertiesToImplement(PropMap);
 
-  for (ObjCInterfaceDecl::PropertyMap::iterator
-      I = PropMap.begin(), E = PropMap.end(); I != E; ++I) {
-    const ObjCPropertyDecl *PD = I->second;
+  for (const ObjCPropertyDecl *PD : llvm::make_second_range(PropMap)) {
     if (PD->isClassProperty())
       continue;
 
     const ObjCIvarDecl *ID = findPropertyBackingIvar(PD, InterfaceD, Ivars,
                                                      &FirstIvarDecl);
     if (!ID)
       continue;
 
visit(const ObjCImplementationDecl *ImplD) const {
 
   // Find all partial invalidation methods.
   InvalidationInfo PartialInfo;
   containsInvalidationMethod(InterfaceD, PartialInfo, /*LookForPartial*/ true);
 
   // Remove ivars invalidated by the partial invalidation methods. They do not
   // need to be invalidated in the regular invalidation methods.
   bool AtImplementationContainsAtLeastOnePartialInvalidationMethod = false;
-  for (MethodSet::iterator
-      I = PartialInfo.InvalidationMethods.begin(),
-      E = PartialInfo.InvalidationMethods.end(); I != E; ++I) {
-    const ObjCMethodDecl *InterfD = *I;
-
+  for (const ObjCMethodDecl *InterfD : PartialInfo.InvalidationMethods) {
     // Get the corresponding method in the @implementation.
     const ObjCMethodDecl *D = ImplD->getMethod(InterfD->getSelector(),
                                                InterfD->isInstanceMethod());
     if (D && D->hasBody()) {
       AtImplementationContainsAtLeastOnePartialInvalidationMethod = true;
 
       bool CalledAnotherInvalidationMethod = false;
       // The MethodCrowler is going to remove the invalidated ivars.
visit(const ObjCImplementationDecl *ImplD) const {
 
   // Only check if Ivars are invalidated when InstanceVariableInvalidation
   // has been requested.
   if (!Filter.check_InstanceVariableInvalidation)
     return;
 
   // Check that all ivars are invalidated by the invalidation methods.
   bool AtImplementationContainsAtLeastOneInvalidationMethod = false;
-  for (MethodSet::iterator I = Info.InvalidationMethods.begin(),
-                           E = Info.InvalidationMethods.end(); I != E; ++I) {
-    const ObjCMethodDecl *InterfD = *I;
-
+  for (const ObjCMethodDecl *InterfD : Info.InvalidationMethods) {
     // Get the corresponding method in the @implementation.
     const ObjCMethodDecl *D = ImplD->getMethod(InterfD->getSelector(),
                                                InterfD->isInstanceMethod());
     if (D && D->hasBody()) {
       AtImplementationContainsAtLeastOneInvalidationMethod = true;
 
       // Get a copy of ivars needing invalidation.
       IvarSet IvarsI = Ivars;
 
       bool CalledAnotherInvalidationMethod = false;
       MethodCrawler(IvarsI,
                     CalledAnotherInvalidationMethod,
                     PropSetterToIvarMap,
                     PropGetterToIvarMap,
                     PropertyToIvarMap,
                     BR.getContext()).VisitStmt(D->getBody());
       // If another invalidation method was called, trust that full invalidation
       // has occurred.
       if (CalledAnotherInvalidationMethod)
         continue;
 
       // Warn on the ivars that were not invalidated by the method.
-      for (IvarSet::const_iterator
-          I = IvarsI.begin(), E = IvarsI.end(); I != E; ++I)
-        reportIvarNeedsInvalidation(I->first, IvarToPopertyMap, D);
+      for (const ObjCIvarDecl *Ivar : llvm::make_first_range(IvarsI))
+        reportIvarNeedsInvalidation(Ivar, IvarToPopertyMap, D);
     }
   }
 
   // Report an error in case none of the invalidation methods are implemented.
   if (!AtImplementationContainsAtLeastOneInvalidationMethod) {
     if (AtImplementationContainsAtLeastOnePartialInvalidationMethod) {
       // Warn on the ivars that were not invalidated by the prrtial
       // invalidation methods.
-      for (IvarSet::const_iterator
-           I = Ivars.begin(), E = Ivars.end(); I != E; ++I)
-        reportIvarNeedsInvalidation(I->first, IvarToPopertyMap, nullptr);
+      for (const ObjCIvarDecl *Ivar : llvm::make_first_range(Ivars))
+        reportIvarNeedsInvalidation(Ivar, IvarToPopertyMap, nullptr);
     } else {
       // Otherwise, no invalidation methods were implemented.
       reportNoInvalidationMethod(Filter.checkName_InstanceVariableInvalidation,
                                  FirstIvarDecl, IvarToPopertyMap, InterfaceD,
                                  /*MissingDeclaration*/ false);
     }
   }
 }

clang/lib/StaticAnalyzer/Checkers/LocalizationChecker.cpp

 //=- LocalizationChecker.cpp -------------------------------------*- C++ -*-==//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
 //  This file defines a set of checks for localizability including:
 //  1) A checker that warns about uses of non-localized NSStrings passed to
 //     UI methods expecting localized strings
 //  2) A syntactic checker that warns against the bad practice of
 //     not including a comment in NSLocalizedString macros.
 //
 //===----------------------------------------------------------------------===//
 
-#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
 #include "clang/AST/Attr.h"
 #include "clang/AST/Decl.h"
 #include "clang/AST/DeclObjC.h"
 #include "clang/AST/RecursiveASTVisitor.h"
 #include "clang/AST/StmtVisitor.h"
 #include "clang/Lex/Lexer.h"
+#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
 #include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
+#include "llvm/ADT/STLExtras.h"
 #include "llvm/Support/Unicode.h"
 #include <optional>
 
 using namespace clang;
 using namespace ento;
 
 namespace {
 struct LocalizedState {
if (argumentNumber < 0) {
       OD = OD->getSuperClass();
       argumentNumber = getLocalizedArgumentForSelector(OD->getIdentifier(), S);
     }
   }
 
   if (argumentNumber < 0) { // There was no match in UIMethods
     if (const Decl *D = msg.getDecl()) {
       if (const ObjCMethodDecl *OMD = dyn_cast_or_null<ObjCMethodDecl>(D)) {
-        auto formals = OMD->parameters();
-        for (unsigned i = 0, ei = formals.size(); i != ei; ++i) {
-          if (isAnnotatedAsTakingLocalized(formals[i])) {
-            argumentNumber = i;
+        for (auto [Idx, FormalParam] : llvm::enumerate(OMD->parameters())) {
+          if (isAnnotatedAsTakingLocalized(FormalParam)) {
+            argumentNumber = Idx;
             break;
           }
         }
       }
     }
   }
 
   if (argumentNumber < 0) // Still no match

clang/lib/StaticAnalyzer/Checkers/MacOSKeychainAPIChecker.cpp

 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
 #include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
+#include "llvm/ADT/STLExtras.h"
 #include "llvm/ADT/SmallString.h"
 #include "llvm/Support/raw_ostream.h"
 #include <optional>
 
 using namespace clang;
 using namespace ento;
 
 namespace {
bool ErrorIsReturned = (OpCode == BO_EQ && RHS != NoErr) ||
                            (OpCode == BO_NE && RHS == NoErr);
     if (!Assumption)
       ErrorIsReturned = !ErrorIsReturned;
     if (ErrorIsReturned)
       ReturnSymbol = SIE->getLHS();
   }
 
   if (ReturnSymbol)
-    for (auto I = AMap.begin(), E = AMap.end(); I != E; ++I) {
-      if (ReturnSymbol == I->second.Region)
-        State = State->remove<AllocatedData>(I->first);
+    for (auto [Sym, AllocState] : AMap) {
+      if (ReturnSymbol == AllocState.Region)
+        State = State->remove<AllocatedData>(Sym);
     }
 
   return State;
 }
 
 void MacOSKeychainAPIChecker::checkDeadSymbols(SymbolReaper &SR,
                                                CheckerContext &C) const {
   ProgramStateRef State = C.getState();
   AllocatedDataTy AMap = State->get<AllocatedData>();
   if (AMap.isEmpty())
     return;
 
   bool Changed = false;
   AllocationPairVec Errors;
-  for (auto I = AMap.begin(), E = AMap.end(); I != E; ++I) {
-    if (!SR.isDead(I->first))
+  for (const auto &[Sym, AllocState] : AMap) {
+    if (!SR.isDead(Sym))
       continue;
 
     Changed = true;
-    State = State->remove<AllocatedData>(I->first);
+    State = State->remove<AllocatedData>(Sym);
     // If the allocated symbol is null do not report.
     ConstraintManager &CMgr = State->getConstraintManager();
-    ConditionTruthVal AllocFailed = CMgr.isNull(State, I.getKey());
+    ConditionTruthVal AllocFailed = CMgr.isNull(State, Sym);
     if (AllocFailed.isConstrainedTrue())
       continue;
-    Errors.push_back(std::make_pair(I->first, &I->second));
+    Errors.push_back(std::make_pair(Sym, &AllocState));
   }
   if (!Changed) {
     // Generate the new, cleaned up state.
     C.addTransition(State);
     return;
   }
 
   static CheckerProgramPointTag Tag(this, "DeadSymbolsLeak");
void MacOSKeychainAPIChecker::printState(raw_ostream &Out,
                                          ProgramStateRef State,
                                          const char *NL,
                                          const char *Sep) const {
 
   AllocatedDataTy AMap = State->get<AllocatedData>();
 
   if (!AMap.isEmpty()) {
     Out << Sep << "KeychainAPIChecker :" << NL;
-    for (auto I = AMap.begin(), E = AMap.end(); I != E; ++I) {
-      I.getKey()->dumpToStream(Out);
+    for (SymbolRef Sym : llvm::make_first_range(AMap)) {
+      Sym->dumpToStream(Out);
     }
   }
 }
 
 
 void ento::registerMacOSKeychainAPIChecker(CheckerManager &mgr) {
   mgr.registerChecker<MacOSKeychainAPIChecker>();
 }
 
 bool ento::shouldRegisterMacOSKeychainAPIChecker(const CheckerManager &mgr) {
   return true;
 }

clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp

MallocChecker::MallocMemReturnsAttr(CheckerContext &C, const CallEvent &Call,
                                     const OwnershipAttr *Att,
                                     ProgramStateRef State) const {
   if (!State)
     return nullptr;
 
   if (Att->getModule()->getName() != "malloc")
     return nullptr;
 
-  OwnershipAttr::args_iterator I = Att->args_begin(), E = Att->args_end();
-  if (I != E) {
-    return MallocMemAux(C, Call, Call.getArgExpr(I->getASTIndex()),
+  if (!Att->args().empty()) {
+    return MallocMemAux(C, Call,
+                        Call.getArgExpr(Att->args_begin()->getASTIndex()),
                         UndefinedVal(), State, AF_Malloc);
   }
   return MallocMemAux(C, Call, UnknownVal(), UndefinedVal(), State, AF_Malloc);
 }
 
 ProgramStateRef MallocChecker::MallocMemAux(CheckerContext &C,
                                             const CallEvent &Call,
                                             const Expr *SizeEx, SVal Init,
void MallocChecker::checkDeadSymbols(SymbolReaper &SymReaper,
                                      CheckerContext &C) const
 {
   ProgramStateRef state = C.getState();
   RegionStateTy OldRS = state->get<RegionState>();
   RegionStateTy::Factory &F = state->get_context<RegionState>();
 
   RegionStateTy RS = OldRS;
   SmallVector<SymbolRef, 2> Errors;
-  for (RegionStateTy::iterator I = RS.begin(), E = RS.end(); I != E; ++I) {
-    if (SymReaper.isDead(I->first)) {
-      if (I->second.isAllocated() || I->second.isAllocatedOfSizeZero())
-        Errors.push_back(I->first);
+  for (auto [Sym, State] : RS) {
+    if (SymReaper.isDead(Sym)) {
+      if (State.isAllocated() || State.isAllocatedOfSizeZero())
+        Errors.push_back(Sym);
       // Remove the dead symbol from the map.
-      RS = F.remove(RS, I->first);
+      RS = F.remove(RS, Sym);
     }
   }
 
   if (RS == OldRS) {
     // We shouldn't have touched other maps yet.
     assert(state->get<ReallocPairs>() ==
            C.getState()->get<ReallocPairs>());
     assert(state->get<FreeReturnValue>() ==
            C.getState()->get<FreeReturnValue>());
     return;
   }
 
   // Cleanup the Realloc Pairs Map.
   ReallocPairsTy RP = state->get<ReallocPairs>();
-  for (ReallocPairsTy::iterator I = RP.begin(), E = RP.end(); I != E; ++I) {
-    if (SymReaper.isDead(I->first) ||
-        SymReaper.isDead(I->second.ReallocatedSym)) {
-      state = state->remove<ReallocPairs>(I->first);
+  for (auto [Sym, ReallocPair] : RP) {
+    if (SymReaper.isDead(Sym) || SymReaper.isDead(ReallocPair.ReallocatedSym)) {
+      state = state->remove<ReallocPairs>(Sym);
     }
   }
 
   // Cleanup the FreeReturnValue Map.
   FreeReturnValueTy FR = state->get<FreeReturnValue>();
-  for (FreeReturnValueTy::iterator I = FR.begin(), E = FR.end(); I != E; ++I) {
-    if (SymReaper.isDead(I->first) ||
-        SymReaper.isDead(I->second)) {
-      state = state->remove<FreeReturnValue>(I->first);
+  for (auto [Sym, RetSym] : FR) {
+    if (SymReaper.isDead(Sym) || SymReaper.isDead(RetSym)) {
+      state = state->remove<FreeReturnValue>(Sym);
     }
   }
 
   // Generate leak node.
   ExplodedNode *N = C.getPredecessor();
   if (!Errors.empty()) {
     static CheckerProgramPointTag Tag("MallocChecker", "DeadSymbolsLeak");
     N = C.generateNonFatalErrorNode(C.getState(), &Tag);
     if (N) {
-      for (SmallVectorImpl<SymbolRef>::iterator
-           I = Errors.begin(), E = Errors.end(); I != E; ++I) {
-        HandleLeak(*I, N, C);
+      for (SymbolRef Sym : Errors) {
+        HandleLeak(Sym, N, C);
       }
     }
   }
 
   C.addTransition(state->set<RegionState>(RS), N);
 }
 
 void MallocChecker::checkPreCall(const CallEvent &Call,
void MallocChecker::checkPostStmt(const BlockExpr *BE,
   // may be tracking.
   if (!BE->getBlockDecl()->hasCaptures())
     return;
 
   ProgramStateRef state = C.getState();
   const BlockDataRegion *R =
     cast<BlockDataRegion>(C.getSVal(BE).getAsRegion());
 
-  BlockDataRegion::referenced_vars_iterator I = R->referenced_vars_begin(),
-                                            E = R->referenced_vars_end();
-
-  if (I == E)
+  auto ReferencedVars = R->referenced_vars();
+  if (ReferencedVars.empty())
     return;
 
   SmallVector<const MemRegion*, 10> Regions;
   const LocationContext *LC = C.getLocationContext();
   MemRegionManager &MemMgr = C.getSValBuilder().getRegionManager();
 
-  for ( ; I != E; ++I) {
-    const VarRegion *VR = I.getCapturedRegion();
+  for (const auto &Var : ReferencedVars) {
+    const VarRegion *VR = Var.getCapturedRegion();
     if (VR->getSuperRegion() == R) {
       VR = MemMgr.getVarRegion(VR->getDecl(), LC);
     }
     Regions.push_back(VR);
   }
 
   state =
     state->scanReachableSymbols<StopTrackingCallback>(Regions).getState();

 }
 
 // If a symbolic region is assumed to NULL (or another constant), stop tracking
 // it - assuming that allocation failed on this path.
 ProgramStateRef MallocChecker::evalAssume(ProgramStateRef state,
                                               SVal Cond,
                                               bool Assumption) const {
   RegionStateTy RS = state->get<RegionState>();
-  for (RegionStateTy::iterator I = RS.begin(), E = RS.end(); I != E; ++I) {
+  for (SymbolRef Sym : llvm::make_first_range(RS)) {
     // If the symbol is assumed to be NULL, remove it from consideration.
     ConstraintManager &CMgr = state->getConstraintManager();
-    ConditionTruthVal AllocFailed = CMgr.isNull(state, I.getKey());
+    ConditionTruthVal AllocFailed = CMgr.isNull(state, Sym);
     if (AllocFailed.isConstrainedTrue())
-      state = state->remove<RegionState>(I.getKey());
+      state = state->remove<RegionState>(Sym);
   }
 
   // Realloc returns 0 when reallocation fails, which means that we should
   // restore the state of the pointer being reallocated.
   ReallocPairsTy RP = state->get<ReallocPairs>();
-  for (ReallocPairsTy::iterator I = RP.begin(), E = RP.end(); I != E; ++I) {
+  for (auto [Sym, ReallocPair] : RP) {
     // If the symbol is assumed to be NULL, remove it from consideration.
     ConstraintManager &CMgr = state->getConstraintManager();
-    ConditionTruthVal AllocFailed = CMgr.isNull(state, I.getKey());
+    ConditionTruthVal AllocFailed = CMgr.isNull(state, Sym);
     if (!AllocFailed.isConstrainedTrue())
       continue;
 
-    SymbolRef ReallocSym = I.getData().ReallocatedSym;
+    SymbolRef ReallocSym = ReallocPair.ReallocatedSym;
     if (const RefState *RS = state->get<RegionState>(ReallocSym)) {
       if (RS->isReleased()) {
-        switch (I.getData().Kind) {
+        switch (ReallocPair.Kind) {
         case OAR_ToBeFreedAfterFailure:
           state = state->set<RegionState>(ReallocSym,
               RefState::getAllocated(RS->getAllocationFamily(), RS->getStmt()));
           break;
         case OAR_DoNotTrackAfterFailure:
           state = state->remove<RegionState>(ReallocSym);
           break;
         default:
-          assert(I.getData().Kind == OAR_FreeOnFailure);
+          assert(ReallocPair.Kind == OAR_FreeOnFailure);
         }
       }
     }
-    state = state->remove<ReallocPairs>(I.getKey());
+    state = state->remove<ReallocPairs>(Sym);
   }
 
   return state;
 }
 
 bool MallocChecker::mayFreeAnyEscapedMemoryOrIsModeledExplicitly(
                                               const CallEvent *Call,
                                               ProgramStateRef State,
ProgramStateRef MallocChecker::checkPointerEscapeAux(
   SymbolRef EscapingSymbol = nullptr;
   if (Kind == PSK_DirectEscapeOnCall &&
       !mayFreeAnyEscapedMemoryOrIsModeledExplicitly(Call, State,
                                                     EscapingSymbol) &&
       !EscapingSymbol) {
     return State;
   }
 
-  for (InvalidatedSymbols::const_iterator I = Escaped.begin(),
-       E = Escaped.end();
-       I != E; ++I) {
-    SymbolRef sym = *I;
-
+  for (SymbolRef sym : Escaped) {
     if (EscapingSymbol && EscapingSymbol != sym)
       continue;
 
     if (const RefState *RS = State->get<RegionState>(sym))
       if (RS->isAllocated() || RS->isAllocatedOfSizeZero())
         if (!IsConstPointerEscape || checkIfNewOrNewArrayFamily(RS))
           State = State->set<RegionState>(sym, RefState::getEscaped(RS));
   }

 
 void MallocChecker::printState(raw_ostream &Out, ProgramStateRef State,
                                const char *NL, const char *Sep) const {
 
   RegionStateTy RS = State->get<RegionState>();
 
   if (!RS.isEmpty()) {
     Out << Sep << "MallocChecker :" << NL;
-    for (RegionStateTy::iterator I = RS.begin(), E = RS.end(); I != E; ++I) {
-      const RefState *RefS = State->get<RegionState>(I.getKey());
+    for (auto [Sym, Data] : RS) {
+      const RefState *RefS = State->get<RegionState>(Sym);
       AllocationFamily Family = RefS->getAllocationFamily();
       std::optional<MallocChecker::CheckKind> CheckKind =
           getCheckIfTracked(Family);
       if (!CheckKind)
         CheckKind = getCheckIfTracked(Family, true);
 
-      I.getKey()->dumpToStream(Out);
+      Sym->dumpToStream(Out);
       Out << " : ";
-      I.getData().dump(Out);
+      Data.dump(Out);
       if (CheckKind)
         Out << " (" << CheckNames[*CheckKind].getName() << ")";
       Out << NL;
     }
   }
 }
 
 namespace clang {

clang/lib/StaticAnalyzer/Checkers/MallocOverflowSecurityChecker.cpp

void MallocOverflowSecurityChecker::OutputPossibleOverflows(
   if (PossibleMallocOverflows.empty())
     return;
 
   // Delete any possible overflows which have a comparison.
   CheckOverflowOps c(PossibleMallocOverflows, BR.getContext());
   c.Visit(mgr.getAnalysisDeclContext(D)->getBody());
 
   // Output warnings for all overflows that are left.
-  for (CheckOverflowOps::theVecType::iterator
-       i = PossibleMallocOverflows.begin(),
-       e = PossibleMallocOverflows.end();
-       i != e;
-       ++i) {
+  for (const MallocOverflowCheck &Check : PossibleMallocOverflows) {
     BR.EmitBasicReport(
         D, this, "malloc() size overflow", categories::UnixAPI,
         "the computation of the size of the memory allocation may overflow",
-        PathDiagnosticLocation::createOperatorLoc(i->mulop,
+        PathDiagnosticLocation::createOperatorLoc(Check.mulop,
                                                   BR.getSourceManager()),
-        i->mulop->getSourceRange());
+        Check.mulop->getSourceRange());
   }
 }
 
 void MallocOverflowSecurityChecker::checkASTCodeBody(const Decl *D,
                                              AnalysisManager &mgr,
                                              BugReporter &BR) const {
 
   CFG *cfg = mgr.getCFG(D);

clang/lib/StaticAnalyzer/Checkers/MallocSizeofChecker.cpp

 // MallocSizeofChecker.cpp - Check for dubious malloc arguments ---*- C++ -*-=//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
 // Reports inconsistencies between the casted type of the return value of a
 // malloc/calloc/realloc call and the operand of any sizeof expressions
 // contained within its argument(s).
 //
 //===----------------------------------------------------------------------===//
 
-#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
 #include "clang/AST/StmtVisitor.h"
 #include "clang/AST/TypeLoc.h"
+#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
 #include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
 #include "llvm/ADT/SmallString.h"
+#include "llvm/ADT/iterator_range.h"
 #include "llvm/Support/raw_ostream.h"
 
 using namespace clang;
 using namespace ento;
 
 namespace {
 
 typedef std::pair<const TypeSourceInfo *, const CallExpr *> TypeCallPair;

 
 class MallocSizeofChecker : public Checker<check::ASTCodeBody> {
 public:
   void checkASTCodeBody(const Decl *D, AnalysisManager& mgr,
                         BugReporter &BR) const {
     AnalysisDeclContext *ADC = mgr.getAnalysisDeclContext(D);
     CastedAllocFinder Finder(&BR.getContext());
     Finder.Visit(D->getBody());
-    for (CastedAllocFinder::CallVec::iterator i = Finder.Calls.begin(),
-         e = Finder.Calls.end(); i != e; ++i) {
-      QualType CastedType = i->CastedExpr->getType();
+    for (const auto &CallRec : Finder.Calls) {
+      QualType CastedType = CallRec.CastedExpr->getType();
       if (!CastedType->isPointerType())
         continue;
       QualType PointeeType = CastedType->getPointeeType();
       if (PointeeType->isVoidType())
         continue;
 
-      for (CallExpr::const_arg_iterator ai = i->AllocCall->arg_begin(),
-           ae = i->AllocCall->arg_end(); ai != ae; ++ai) {
-        if (!(*ai)->getType()->isIntegralOrUnscopedEnumerationType())
+      for (const Expr *Arg : make_range(CallRec.AllocCall->arg_begin(),
+                                        CallRec.AllocCall->arg_end())) {
+        if (!Arg->getType()->isIntegralOrUnscopedEnumerationType())
           continue;
 
         SizeofFinder SFinder;
-        SFinder.Visit(*ai);
+        SFinder.Visit(Arg);
         if (SFinder.Sizeofs.size() != 1)
           continue;
 
         QualType SizeofType = SFinder.Sizeofs[0]->getTypeOfArgument();
 
         if (typesCompatible(BR.getContext(), PointeeType, SizeofType))
           continue;
 
         // If the argument to sizeof is an array, the result could be a
         // pointer to any array element.
         if (compatibleWithArrayType(BR.getContext(), PointeeType, SizeofType))
           continue;
 
         const TypeSourceInfo *TSI = nullptr;
-        if (i->CastedExprParent.is<const VarDecl *>()) {
-          TSI =
-              i->CastedExprParent.get<const VarDecl *>()->getTypeSourceInfo();
+        if (CallRec.CastedExprParent.is<const VarDecl *>()) {
+          TSI = CallRec.CastedExprParent.get<const VarDecl *>()
+                    ->getTypeSourceInfo();
         } else {
-          TSI = i->ExplicitCastType;
+          TSI = CallRec.ExplicitCastType;
         }
 
         SmallString<64> buf;
         llvm::raw_svector_ostream OS(buf);
 
         OS << "Result of ";
-        const FunctionDecl *Callee = i->AllocCall->getDirectCallee();
+        const FunctionDecl *Callee = CallRec.AllocCall->getDirectCallee();
         if (Callee && Callee->getIdentifier())
           OS << '\'' << Callee->getIdentifier()->getName() << '\'';
         else
           OS << "call";
         OS << " is converted to a pointer of type '" << PointeeType
            << "', which is incompatible with "
            << "sizeof operand type '" << SizeofType << "'";
         SmallVector<SourceRange, 4> Ranges;
-        Ranges.push_back(i->AllocCall->getCallee()->getSourceRange());
+        Ranges.push_back(CallRec.AllocCall->getCallee()->getSourceRange());
         Ranges.push_back(SFinder.Sizeofs[0]->getSourceRange());
         if (TSI)
           Ranges.push_back(TSI->getTypeLoc().getSourceRange());
 
-        PathDiagnosticLocation L =
-            PathDiagnosticLocation::createBegin(i->AllocCall->getCallee(),
-                BR.getSourceManager(), ADC);
+        PathDiagnosticLocation L = PathDiagnosticLocation::createBegin(
+            CallRec.AllocCall->getCallee(), BR.getSourceManager(), ADC);
 
         BR.EmitBasicReport(D, this, "Allocator sizeof operand mismatch",
                            categories::UnixAPI, OS.str(), L, Ranges);
       }
     }
   }
 };
 

clang/lib/StaticAnalyzer/Checkers/NullabilityChecker.cpp

 #include "clang/Analysis/AnyCall.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
 #include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerHelpers.h"
 
+#include "llvm/ADT/STLExtras.h"
 #include "llvm/ADT/StringExtras.h"
 #include "llvm/Support/Path.h"
 
 using namespace clang;
 using namespace ento;
 
 namespace {
 
void NullabilityChecker::reportBugIfInvariantHolds(
   reportBug(Msg, Error, CK, N, Region, C.getBugReporter(), ValueExpr);
 }
 
 /// Cleaning up the program state.
 void NullabilityChecker::checkDeadSymbols(SymbolReaper &SR,
                                           CheckerContext &C) const {
   ProgramStateRef State = C.getState();
   NullabilityMapTy Nullabilities = State->get<NullabilityMap>();
-  for (NullabilityMapTy::iterator I = Nullabilities.begin(),
-                                  E = Nullabilities.end();
-       I != E; ++I) {
-    const auto *Region = I->first->getAs<SymbolicRegion>();
+  for (const MemRegion *Reg : llvm::make_first_range(Nullabilities)) {
+    const auto *Region = Reg->getAs<SymbolicRegion>();
     assert(Region && "Non-symbolic region is tracked.");
     if (SR.isDead(Region->getSymbol())) {
-      State = State->remove<NullabilityMap>(I->first);
+      State = State->remove<NullabilityMap>(Reg);
     }
   }
 
   // When an object goes out of scope, we can free the history associated
   // with any property accesses on that object
   PropertyAccessesMapTy PropertyAccesses = State->get<PropertyAccessesMap>();
-  for (PropertyAccessesMapTy::iterator I = PropertyAccesses.begin(),
-                                       E = PropertyAccesses.end();
-       I != E; ++I) {
-    const MemRegion *ReceiverRegion = I->first.first;
+  for (ObjectPropPair PropKey : llvm::make_first_range(PropertyAccesses)) {
+    const MemRegion *ReceiverRegion = PropKey.first;
     if (!SR.isLiveRegion(ReceiverRegion)) {
-      State = State->remove<PropertyAccessesMap>(I->first);
+      State = State->remove<PropertyAccessesMap>(PropKey);
     }
   }
 
   // When one of the nonnull arguments are constrained to be null, nullability
   // preconditions are violated. It is not enough to check this only when we
   // actually report an error, because at that time interesting symbols might be
   // reaped.
   if (checkInvariantViolation(State, C.getPredecessor(), C))

 
 // The return value of a property access is typically a temporary value which
 // will not be tracked in a persistent manner by the analyzer.  We use
 // evalAssume() in order to immediately record constraints on those temporaries
 // at the time they are imposed (e.g. by a nil-check conditional).
 ProgramStateRef NullabilityChecker::evalAssume(ProgramStateRef State, SVal Cond,
                                                bool Assumption) const {
   PropertyAccessesMapTy PropertyAccesses = State->get<PropertyAccessesMap>();
-  for (PropertyAccessesMapTy::iterator I = PropertyAccesses.begin(),
-                                       E = PropertyAccesses.end();
-       I != E; ++I) {
-    if (!I->second.isConstrainedNonnull) {
-      ConditionTruthVal IsNonNull = State->isNonNull(I->second.Value);
+  for (auto [PropKey, PropVal] : PropertyAccesses) {
+    if (!PropVal.isConstrainedNonnull) {
+      ConditionTruthVal IsNonNull = State->isNonNull(PropVal.Value);
       if (IsNonNull.isConstrainedTrue()) {
-        ConstrainedPropertyVal Replacement = I->second;
+        ConstrainedPropertyVal Replacement = PropVal;
         Replacement.isConstrainedNonnull = true;
-        State = State->set<PropertyAccessesMap>(I->first, Replacement);
+        State = State->set<PropertyAccessesMap>(PropKey, Replacement);
       } else if (IsNonNull.isConstrainedFalse()) {
         // Space optimization: no point in tracking constrained-null cases
-        State = State->remove<PropertyAccessesMap>(I->first);
+        State = State->remove<PropertyAccessesMap>(PropKey);
       }
     }
   }
 
   return State;
 }
 
 /// Calculate the nullability of the result of a message expr based on the
Out << Sep << NL
         << "Nullability invariant was violated, warnings suppressed." << NL;
 
   if (B.isEmpty())
     return;
 
   if (!State->get<InvariantViolated>())
     Out << Sep << NL;
 
-  for (NullabilityMapTy::iterator I = B.begin(), E = B.end(); I != E; ++I) {
-    Out << I->first << " : ";
-    I->second.print(Out);
+  for (auto [Region, State] : B) {
+    Out << Region << " : ";
+    State.print(Out);
     Out << NL;
   }
 }
 
 void ento::registerNullabilityBase(CheckerManager &mgr) {
   mgr.registerChecker<NullabilityChecker>();
 }
 

clang/lib/StaticAnalyzer/Checkers/ObjCMissingSuperCallChecker.cpp

 }
 
 void ObjCSuperCallChecker::fillSelectors(ASTContext &Ctx,
                                          ArrayRef<SelectorDescriptor> Sel,
                                          StringRef ClassName) const {
   llvm::SmallPtrSet<Selector, 16> &ClassSelectors =
       SelectorsForClass[ClassName];
   // Fill the Selectors SmallSet with all selectors we want to check.
-  for (ArrayRef<SelectorDescriptor>::iterator I = Sel.begin(), E = Sel.end();
-       I != E; ++I) {
-    SelectorDescriptor Descriptor = *I;
+  for (SelectorDescriptor Descriptor : Sel) {
     assert(Descriptor.ArgumentCount <= 1); // No multi-argument selectors yet.
 
     // Get the selector.
     IdentifierInfo *II = &Ctx.Idents.get(Descriptor.SelectorName);
 
     Selector Sel = Ctx.Selectors.getSelector(Descriptor.ArgumentCount, &II);
     ClassSelectors.insert(Sel);
   }

clang/lib/StaticAnalyzer/Checkers/ObjCSelfInitChecker.cpp

if (PreCallFlags != SelfFlag_None) {
     }
     if (PreCallFlags & SelfFlag_InitRes) {
       Out << "  An argument of the current call came from an init method."
           << NL;
     }
   }
 
   Out << NL;
-  for (SelfFlagTy::iterator I = FlagMap.begin(), E = FlagMap.end();
-       I != E; ++I) {
-    Out << I->first << " : ";
+  for (auto [Sym, Flag] : FlagMap) {
+    Out << Sym << " : ";
 
-    if (I->second == SelfFlag_None)
+    if (Flag == SelfFlag_None)
       Out << "none";
 
-    if (I->second & SelfFlag_Self)
+    if (Flag & SelfFlag_Self)
       Out << "self variable";
 
-    if (I->second & SelfFlag_InitRes) {
-      if (I->second != SelfFlag_InitRes)
+    if (Flag & SelfFlag_InitRes) {
+      if (Flag != SelfFlag_InitRes)
         Out << " | ";
       Out << "result of init method";
     }
 
     Out << NL;
   }
 }
 

clang/lib/StaticAnalyzer/Checkers/ObjCUnusedIVarsChecker.cpp

 //==- ObjCUnusedIVarsChecker.cpp - Check for unused ivars --------*- C++ -*-==//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
 //  This file defines a CheckObjCUnusedIvars, a checker that
 //  analyzes an Objective-C class's interface/implementation to determine if it
 //  has any ivars that are never accessed.
 //
 //===----------------------------------------------------------------------===//
 
-#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
-#include "clang/Analysis/PathDiagnostic.h"
 #include "clang/AST/Attr.h"
 #include "clang/AST/DeclObjC.h"
 #include "clang/AST/Expr.h"
 #include "clang/AST/ExprObjC.h"
+#include "clang/Analysis/PathDiagnostic.h"
 #include "clang/Basic/LangOptions.h"
 #include "clang/Basic/SourceManager.h"
+#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
 #include "clang/StaticAnalyzer/Core/Checker.h"
+#include "llvm/ADT/STLExtras.h"
 
 using namespace clang;
 using namespace ento;
 
 enum IVarState { Unused, Used };
 typedef llvm::DenseMap<const ObjCIvarDecl*,IVarState> IvarUsageMap;
 
 static void Scan(IvarUsageMap& M, const Stmt *S) {
static void Scan(IvarUsageMap& M, const Stmt *S) {
 
   // Blocks can reference an instance variable of a class.
   if (const BlockExpr *BE = dyn_cast<BlockExpr>(S)) {
     Scan(M, BE->getBody());
     return;
   }
 
   if (const PseudoObjectExpr *POE = dyn_cast<PseudoObjectExpr>(S))
-    for (PseudoObjectExpr::const_semantics_iterator
-        i = POE->semantics_begin(), e = POE->semantics_end(); i != e; ++i) {
-      const Expr *sub = *i;
+    for (const Expr *sub : POE->semantics()) {
       if (const OpaqueValueExpr *OVE = dyn_cast<OpaqueValueExpr>(sub))
         sub = OVE->getSourceExpr();
       Scan(M, sub);
     }
 
   for (const Stmt *SubStmt : S->children())
     Scan(M, SubStmt);
 }
static void checkObjCUnusedIvar(const ObjCImplementationDecl *D,
   if (M.empty())
     return;
 
   // Now scan the implementation declaration.
   Scan(M, D);
 
   // Any potentially unused ivars?
   bool hasUnused = false;
-  for (IvarUsageMap::iterator I = M.begin(), E = M.end(); I!=E; ++I)
-    if (I->second == Unused) {
+  for (IVarState State : llvm::make_second_range(M))
+    if (State == Unused) {
       hasUnused = true;
       break;
     }
 
   if (!hasUnused)
     return;
 
   // We found some potentially unused ivars.  Scan the entire translation unit
   // for functions inside the @implementation that reference these ivars.
   // FIXME: In the future hopefully we can just use the lexical DeclContext
   // to go from the ObjCImplementationDecl to the lexically "nested"
   // C functions.
   const SourceManager &SM = BR.getSourceManager();
   Scan(M, D->getDeclContext(), SM.getFileID(D->getLocation()), SM);
 
   // Find ivars that are unused.
-  for (IvarUsageMap::iterator I = M.begin(), E = M.end(); I!=E; ++I)
-    if (I->second == Unused) {
+  for (auto [Ivar, State] : M)
+    if (State == Unused) {
       std::string sbuf;
       llvm::raw_string_ostream os(sbuf);
-      os << "Instance variable '" << *I->first << "' in class '" << *ID
+      os << "Instance variable '" << *Ivar << "' in class '" << *ID
          << "' is never used by the methods in its @implementation "
             "(although it may be used by category methods).";
 
       PathDiagnosticLocation L =
-        PathDiagnosticLocation::create(I->first, BR.getSourceManager());
+          PathDiagnosticLocation::create(Ivar, BR.getSourceManager());
       BR.EmitBasicReport(D, Checker, "Unused instance variable", "Optimization",
                          os.str(), L);
     }
 }
 
 //===----------------------------------------------------------------------===//
 // ObjCUnusedIvarsChecker
 //===----------------------------------------------------------------------===//

clang/lib/StaticAnalyzer/Checkers/PointerArithChecker.cpp

 REGISTER_MAP_WITH_PROGRAMSTATE(RegionState, const MemRegion *, AllocKind)
 
 void PointerArithChecker::checkDeadSymbols(SymbolReaper &SR,
                                            CheckerContext &C) const {
   // TODO: intentional leak. Some information is garbage collected too early,
   // see http://reviews.llvm.org/D14203 for further information.
   /*ProgramStateRef State = C.getState();
   RegionStateTy RegionStates = State->get<RegionState>();
-  for (RegionStateTy::iterator I = RegionStates.begin(), E = RegionStates.end();
-       I != E; ++I) {
-    if (!SR.isLiveRegion(I->first))
-      State = State->remove<RegionState>(I->first);
+  for (const MemRegion *Reg: llvm::make_first_range(RegionStates)) {
+    if (!SR.isLiveRegion(Reg))
+      State = State->remove<RegionState>(Reg);
   }
   C.addTransition(State);*/
 }
 
 AllocKind PointerArithChecker::getKindOfNewOp(const CXXNewExpr *NE,
                                               const FunctionDecl *FD) const {
   // This checker try not to assume anything about placement and overloaded
   // new to avoid false positives.

clang/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountChecker.cpp

void RetainCountChecker::checkPostStmt(const BlockExpr *BE,
   // Scan the BlockDecRefExprs for any object the retain count checker
   // may be tracking.
   if (!BE->getBlockDecl()->hasCaptures())
     return;
 
   ProgramStateRef state = C.getState();
   auto *R = cast<BlockDataRegion>(C.getSVal(BE).getAsRegion());
 
-  BlockDataRegion::referenced_vars_iterator I = R->referenced_vars_begin(),
-                                            E = R->referenced_vars_end();
-
-  if (I == E)
+  auto ReferencedVars = R->referenced_vars();
+  if (ReferencedVars.empty())
     return;
 
   // FIXME: For now we invalidate the tracking of all symbols passed to blocks
   // via captured variables, even though captured variables result in a copy
   // and in implicit increment/decrement of a retain count.
   SmallVector<const MemRegion*, 10> Regions;
   const LocationContext *LC = C.getLocationContext();
   MemRegionManager &MemMgr = C.getSValBuilder().getRegionManager();
 
-  for ( ; I != E; ++I) {
-    const VarRegion *VR = I.getCapturedRegion();
+  for (auto Var : ReferencedVars) {
+    const VarRegion *VR = Var.getCapturedRegion();
     if (VR->getSuperRegion() == R) {
       VR = MemMgr.getVarRegion(VR->getDecl(), LC);
     }
     Regions.push_back(VR);
   }
 
   state = state->scanReachableSymbols<StopTrackingCallback>(Regions).getState();
   C.addTransition(state);

clang/lib/StaticAnalyzer/Checkers/SimpleStreamChecker.cpp

static bool isLeaked(SymbolRef Sym, const StreamState &SS,
   return false;
 }
 
 void SimpleStreamChecker::checkDeadSymbols(SymbolReaper &SymReaper,
                                            CheckerContext &C) const {
   ProgramStateRef State = C.getState();
   SymbolVector LeakedStreams;
   StreamMapTy TrackedStreams = State->get<StreamMap>();
-  for (StreamMapTy::iterator I = TrackedStreams.begin(),
-                             E = TrackedStreams.end(); I != E; ++I) {
-    SymbolRef Sym = I->first;
+  for (auto [Sym, StreamStatus] : TrackedStreams) {
     bool IsSymDead = SymReaper.isDead(Sym);
 
     // Collect leaked symbols.
-    if (isLeaked(Sym, I->second, IsSymDead, State))
+    if (isLeaked(Sym, StreamStatus, IsSymDead, State))
       LeakedStreams.push_back(Sym);
 
     // Remove the dead symbol from the streams map.
     if (IsSymDead)
       State = State->remove<StreamMap>(Sym);
   }
 
   ExplodedNode *N = C.generateNonFatalErrorNode(State);
SimpleStreamChecker::checkPointerEscape(ProgramStateRef State,
                                         const InvalidatedSymbols &Escaped,
                                         const CallEvent *Call,
                                         PointerEscapeKind Kind) const {
   // If we know that the call cannot close a file, there is nothing to do.
   if (Kind == PSK_DirectEscapeOnCall && guaranteedNotToCloseFile(*Call)) {
     return State;
   }
 
-  for (InvalidatedSymbols::const_iterator I = Escaped.begin(),
-                                          E = Escaped.end();
-                                          I != E; ++I) {
-    SymbolRef Sym = *I;
-
+  for (SymbolRef Sym : Escaped) {
     // The symbol escaped. Optimistically, assume that the corresponding file
     // handle will be closed somewhere else.
     State = State->remove<StreamMap>(Sym);
   }
   return State;
 }
 
 void ento::registerSimpleStreamChecker(CheckerManager &mgr) {
   mgr.registerChecker<SimpleStreamChecker>();
 }
 
 // This checker should be enabled regardless of how language options are set.
 bool ento::shouldRegisterSimpleStreamChecker(const CheckerManager &mgr) {
   return true;
 }

clang/lib/StaticAnalyzer/Checkers/SmartPtrModeling.cpp

 #include "clang/StaticAnalyzer/Core/PathSensitive/CallDescription.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerHelpers.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/SymExpr.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h"
+#include "llvm/ADT/STLExtras.h"
 #include "llvm/ADT/StringMap.h"
 #include "llvm/Support/ErrorHandling.h"
 #include <optional>
 #include <string>
 
 using namespace clang;
 using namespace ento;
 
RegionMap = removeTrackedSubregions(RegionMap, RegionMapFactory,
                                         Region->getBaseRegion());
   return State->set<TrackedRegionMap>(RegionMap);
 }
 
 void SmartPtrModeling::checkLiveSymbols(ProgramStateRef State,
                                         SymbolReaper &SR) const {
   // Marking tracked symbols alive
   TrackedRegionMapTy TrackedRegions = State->get<TrackedRegionMap>();
-  for (auto I = TrackedRegions.begin(), E = TrackedRegions.end(); I != E; ++I) {
-    SVal Val = I->second;
-    for (auto si = Val.symbol_begin(), se = Val.symbol_end(); si != se; ++si) {
-      SR.markLive(*si);
+  for (SVal Val : llvm::make_second_range(TrackedRegions)) {
+    for (SymbolRef Sym : Val.symbols()) {
+      SR.markLive(Sym);
     }
   }
 }
 
 void SmartPtrModeling::handleReset(const CallEvent &Call,
                                    CheckerContext &C) const {
   ProgramStateRef State = C.getState();
   const auto *IC = dyn_cast<CXXInstanceCall>(&Call);

clang/lib/StaticAnalyzer/Checkers/StackAddrEscapeChecker.cpp

bool StackAddrEscapeChecker::isSemaphoreCaptured(const BlockDecl &B) const {
   }
   return false;
 }
 
 SmallVector<const MemRegion *, 4>
 StackAddrEscapeChecker::getCapturedStackRegions(const BlockDataRegion &B,
                                                 CheckerContext &C) {
   SmallVector<const MemRegion *, 4> Regions;
-  BlockDataRegion::referenced_vars_iterator I = B.referenced_vars_begin();
-  BlockDataRegion::referenced_vars_iterator E = B.referenced_vars_end();
-  for (; I != E; ++I) {
-    SVal Val = C.getState()->getSVal(I.getCapturedRegion());
+  for (auto Var : B.referenced_vars()) {
+    SVal Val = C.getState()->getSVal(Var.getCapturedRegion());
     const MemRegion *Region = Val.getAsRegion();
     if (Region && isa<StackSpaceRegion>(Region->getMemorySpace()))
       Regions.push_back(Region);
   }
   return Regions;
 }
 
 void StackAddrEscapeChecker::EmitStackError(CheckerContext &C,

clang/lib/StaticAnalyzer/Checkers/StdLibraryFunctionsChecker.cpp

 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
 #include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerHelpers.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/DynamicExtent.h"
+#include "llvm/ADT/STLExtras.h"
 #include "llvm/ADT/SmallString.h"
 #include "llvm/ADT/StringExtras.h"
 
 #include <optional>
 #include <string>
 
 using namespace clang;
 using namespace clang::ento;
void StdLibraryFunctionsChecker::appendOutOfRangeDesc(llvm::APSInt RMin,
   }
 }
 
 void StdLibraryFunctionsChecker::RangeConstraint::applyOnWithinRange(
     BasicValueFactory &BVF, QualType ArgT, const RangeApplyFunction &F) const {
   if (Ranges.empty())
     return;
 
-  const IntRangeVector &R = getRanges();
-  size_t E = R.size();
-  for (size_t I = 0; I != E; ++I) {
-    const llvm::APSInt &Min = BVF.getValue(R[I].first, ArgT);
-    const llvm::APSInt &Max = BVF.getValue(R[I].second, ArgT);
+  for (auto [Start, End] : getRanges()) {
+    const llvm::APSInt &Min = BVF.getValue(Start, ArgT);
+    const llvm::APSInt &Max = BVF.getValue(End, ArgT);
     assert(Min <= Max);
     if (!F(Min, Max))
       return;
   }
 }
 
 void StdLibraryFunctionsChecker::RangeConstraint::applyOnOutOfRange(
     BasicValueFactory &BVF, QualType ArgT, const RangeApplyFunction &F) const {
bool StdLibraryFunctionsChecker::Signature::matches(
   // Check the return type.
   if (!isIrrelevant(RetTy)) {
     QualType FDRetTy = RemoveRestrict(FD->getReturnType().getCanonicalType());
     if (RetTy != FDRetTy)
       return false;
   }
 
   // Check the argument types.
-  for (size_t I = 0, E = ArgTys.size(); I != E; ++I) {
-    QualType ArgTy = ArgTys[I];
+  for (auto [Idx, ArgTy] : llvm::enumerate(ArgTys)) {
     if (isIrrelevant(ArgTy))
       continue;
     QualType FDArgTy =
-        RemoveRestrict(FD->getParamDecl(I)->getType().getCanonicalType());
+        RemoveRestrict(FD->getParamDecl(Idx)->getType().getCanonicalType());
     if (ArgTy != FDArgTy)
       return false;
   }
 
   return true;
 }
 
 std::optional<StdLibraryFunctionsChecker::Summary>

clang/lib/StaticAnalyzer/Checkers/Taint.cpp

std::vector<SymbolRef> taint::getTaintedSymbolsImpl(ProgramStateRef State,
                                                     SymbolRef Sym,
                                                     TaintTagType Kind,
                                                     bool returnFirstOnly) {
   std::vector<SymbolRef> TaintedSymbols;
   if (!Sym)
     return TaintedSymbols;
 
   // Traverse all the symbols this symbol depends on to see if any are tainted.
-  for (SymExpr::symbol_iterator SI = Sym->symbol_begin(),
-                                SE = Sym->symbol_end();
-       SI != SE; ++SI) {
-    if (!isa<SymbolData>(*SI))
+  for (SymbolRef SubSym : Sym->symbols()) {
+    if (!isa<SymbolData>(SubSym))
       continue;
 
-    if (const TaintTagType *Tag = State->get<TaintMap>(*SI)) {
+    if (const TaintTagType *Tag = State->get<TaintMap>(SubSym)) {
       if (*Tag == Kind) {
-        TaintedSymbols.push_back(*SI);
+        TaintedSymbols.push_back(SubSym);
         if (returnFirstOnly)
           return TaintedSymbols; // return early if needed
       }
     }
 
-    if (const auto *SD = dyn_cast<SymbolDerived>(*SI)) {
+    if (const auto *SD = dyn_cast<SymbolDerived>(SubSym)) {
       // If this is a SymbolDerived with a tainted parent, it's also tainted.
       std::vector<SymbolRef> TaintedParents = getTaintedSymbolsImpl(
           State, SD->getParentSymbol(), Kind, returnFirstOnly);
       llvm::append_range(TaintedSymbols, TaintedParents);
       if (returnFirstOnly && !TaintedSymbols.empty())
         return TaintedSymbols; // return early if needed
 
       // If this is a SymbolDerived with the same parent symbol as another
if (const auto *SD = dyn_cast<SymbolDerived>(SubSym)) {
             if (returnFirstOnly && !TaintedSymbols.empty())
               return TaintedSymbols; // return early if needed
           }
         }
       }
     }
 
     // If memory region is tainted, data is also tainted.
-    if (const auto *SRV = dyn_cast<SymbolRegionValue>(*SI)) {
+    if (const auto *SRV = dyn_cast<SymbolRegionValue>(SubSym)) {
       std::vector<SymbolRef> TaintedRegions =
           getTaintedSymbolsImpl(State, SRV->getRegion(), Kind, returnFirstOnly);
       llvm::append_range(TaintedSymbols, TaintedRegions);
       if (returnFirstOnly && !TaintedSymbols.empty())
         return TaintedSymbols; // return early if needed
     }
 
     // If this is a SymbolCast from a tainted value, it's also tainted.
-    if (const auto *SC = dyn_cast<SymbolCast>(*SI)) {
+    if (const auto *SC = dyn_cast<SymbolCast>(SubSym)) {
       std::vector<SymbolRef> TaintedCasts =
           getTaintedSymbolsImpl(State, SC->getOperand(), Kind, returnFirstOnly);
       llvm::append_range(TaintedSymbols, TaintedCasts);
       if (returnFirstOnly && !TaintedSymbols.empty())
         return TaintedSymbols; // return early if needed
     }
   }
   return TaintedSymbols;
 }
 No newline at end of file

clang/lib/StaticAnalyzer/Checkers/TestAfterDivZeroChecker.cpp

void TestAfterDivZeroChecker::checkEndFunction(const ReturnStmt *,
                                                CheckerContext &C) const {
   ProgramStateRef State = C.getState();
 
   DivZeroMapTy DivZeroes = State->get<DivZeroMap>();
   if (DivZeroes.isEmpty())
     return;
 
   DivZeroMapTy::Factory &F = State->get_context<DivZeroMap>();
-  for (llvm::ImmutableSet<ZeroState>::iterator I = DivZeroes.begin(),
-                                               E = DivZeroes.end();
-       I != E; ++I) {
-    ZeroState ZS = *I;
+  for (const ZeroState &ZS : DivZeroes) {
     if (ZS.getStackFrameContext() == C.getStackFrame())
       DivZeroes = F.remove(DivZeroes, ZS);
   }
   C.addTransition(State->set<DivZeroMap>(DivZeroes));
 }
 
 void TestAfterDivZeroChecker::checkPreStmt(const BinaryOperator *B,
                                            CheckerContext &C) const {

clang/lib/StaticAnalyzer/Checkers/TrustNonnullChecker.cpp

public:
 
   ProgramStateRef evalAssume(ProgramStateRef State,
                              SVal Cond,
                              bool Assumption) const {
     const SymbolRef CondS = Cond.getAsSymbol();
     if (!CondS || CondS->computeComplexity() > ComplexityThreshold)
       return State;
 
-    for (auto B=CondS->symbol_begin(), E=CondS->symbol_end(); B != E; ++B) {
-      const SymbolRef Antecedent = *B;
+    for (SymbolRef Antecedent : CondS->symbols()) {
       State = addImplication(Antecedent, State, true);
       State = addImplication(Antecedent, State, false);
     }
 
     return State;
   }
 
   void checkPostCall(const CallEvent &Call, CheckerContext &C) const {

clang/lib/StaticAnalyzer/Checkers/UndefCapturedBlockVarChecker.cpp

 UndefCapturedBlockVarChecker::checkPostStmt(const BlockExpr *BE,
                                             CheckerContext &C) const {
   if (!BE->getBlockDecl()->hasCaptures())
     return;
 
   ProgramStateRef state = C.getState();
   auto *R = cast<BlockDataRegion>(C.getSVal(BE).getAsRegion());
 
-  BlockDataRegion::referenced_vars_iterator I = R->referenced_vars_begin(),
-                                            E = R->referenced_vars_end();
-
-  for (; I != E; ++I) {
+  for (auto Var : R->referenced_vars()) {
     // This VarRegion is the region associated with the block; we need
     // the one associated with the encompassing context.
-    const VarRegion *VR = I.getCapturedRegion();
+    const VarRegion *VR = Var.getCapturedRegion();
     const VarDecl *VD = VR->getDecl();
 
     if (VD->hasAttr<BlocksAttr>() || !VD->hasLocalStorage())
       continue;
 
     // Get the VarRegion associated with VD in the local stack frame.
     if (std::optional<UndefinedVal> V =
-            state->getSVal(I.getOriginalRegion()).getAs<UndefinedVal>()) {
+            state->getSVal(Var.getOriginalRegion()).getAs<UndefinedVal>()) {
       if (ExplodedNode *N = C.generateErrorNode()) {
         if (!BT)
           BT.reset(
               new BuiltinBug(this, "uninitialized variable captured by block"));
 
         // Generate a bug report.
         SmallString<128> buf;
         llvm::raw_svector_ostream os(buf);

clang/lib/StaticAnalyzer/Checkers/UnreachableCodeChecker.cpp

void UnreachableCodeChecker::checkEndAnalysis(ExplodedGraph &G,
   if (Eng.hasWorkRemaining())
     return;
 
   const Decl *D = nullptr;
   CFG *C = nullptr;
   const ParentMap *PM = nullptr;
   const LocationContext *LC = nullptr;
   // Iterate over ExplodedGraph
-  for (ExplodedGraph::node_iterator I = G.nodes_begin(), E = G.nodes_end();
-      I != E; ++I) {
-    const ProgramPoint &P = I->getLocation();
+  for (const ExplodedNode &N : G.nodes()) {
+    const ProgramPoint &P = N.getLocation();
     LC = P.getLocationContext();
     if (!LC->inTopFrame())
       continue;
 
     if (!D)
       D = LC->getAnalysisDeclContext()->getDecl();
 
     // Save the CFG if we don't have it already
void UnreachableCodeChecker::checkEndAnalysis(ExplodedGraph &G,
   // Don't do anything for template instantiations.  Proving that code
   // in a template instantiation is unreachable means proving that it is
   // unreachable in all instantiations.
   if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(D))
     if (FD->isTemplateInstantiation())
       return;
 
   // Find CFGBlocks that were not covered by any node
-  for (CFG::const_iterator I = C->begin(), E = C->end(); I != E; ++I) {
-    const CFGBlock *CB = *I;
+  for (const CFGBlock *CB : *C) {
     // Check if the block is unreachable
     if (reachable.count(CB->getBlockID()))
       continue;
 
     // Check if the block is empty (an artificial block)
     if (isEmptyCFGBlock(CB))
       continue;
 

 }
 
 // Recursively finds the entry point(s) for this dead CFGBlock.
 void UnreachableCodeChecker::FindUnreachableEntryPoints(const CFGBlock *CB,
                                                         CFGBlocksSet &reachable,
                                                         CFGBlocksSet &visited) {
   visited.insert(CB->getBlockID());
 
-  for (CFGBlock::const_pred_iterator I = CB->pred_begin(), E = CB->pred_end();
-      I != E; ++I) {
-    if (!*I)
+  for (const CFGBlock *PredBlock : CB->preds()) {
+    if (!PredBlock)
       continue;
 
-    if (!reachable.count((*I)->getBlockID())) {
+    if (!reachable.count(PredBlock->getBlockID())) {
       // If we find an unreachable predecessor, mark this block as reachable so
       // we don't report this block
       reachable.insert(CB->getBlockID());
-      if (!visited.count((*I)->getBlockID()))
+      if (!visited.count(PredBlock->getBlockID()))
         // If we haven't previously visited the unreachable predecessor, recurse
-        FindUnreachableEntryPoints(*I, reachable, visited);
+        FindUnreachableEntryPoints(PredBlock, reachable, visited);
     }
   }
 }
 
 // Find the Stmt* in a CFGBlock for reporting a warning
 const Stmt *UnreachableCodeChecker::getUnreachableStmt(const CFGBlock *CB) {
-  for (CFGBlock::const_iterator I = CB->begin(), E = CB->end(); I != E; ++I) {
-    if (std::optional<CFGStmt> S = I->getAs<CFGStmt>()) {
+  for (const CFGElement &Elem : *CB) {
+    if (std::optional<CFGStmt> S = Elem.getAs<CFGStmt>()) {
       if (!isa<DeclStmt>(S->getStmt()))
         return S->getStmt();
     }
   }
-  if (const Stmt *S = CB->getTerminatorStmt())
-    return S;
-  else
-    return nullptr;
+  return CB->getTerminatorStmt();
 }
 
 // Determines if the path to this CFGBlock contained an element that infers this
 // block is a false positive. We assume that FindUnreachableEntryPoints has
 // already marked only the entry points to any dead code, so we need only to
 // find the condition that led to this block (the predecessor of this block.)
 // There will never be more than one predecessor.
 bool UnreachableCodeChecker::isInvalidPath(const CFGBlock *CB,

clang/lib/StaticAnalyzer/Core/AnalysisManager.cpp

AnalysisManager::AnalysisManager(ASTContext &ASTCtx, Preprocessor &PP,
   AnaCtxMgr.getCFGBuildOptions().setAllAlwaysAdd();
   AnaCtxMgr.getCFGBuildOptions().OmitImplicitValueInitializers = true;
   AnaCtxMgr.getCFGBuildOptions().AddCXXDefaultInitExprInAggregates =
       Options.ShouldIncludeDefaultInitForAggregates;
 }
 
 AnalysisManager::~AnalysisManager() {
   FlushDiagnostics();
-  for (PathDiagnosticConsumers::iterator I = PathConsumers.begin(),
-       E = PathConsumers.end(); I != E; ++I) {
-    delete *I;
+  for (PathDiagnosticConsumer *Consumer : PathConsumers) {
+    delete Consumer;
   }
 }
 
 void AnalysisManager::FlushDiagnostics() {
   PathDiagnosticConsumer::FilesMade filesMade;
-  for (PathDiagnosticConsumers::iterator I = PathConsumers.begin(),
-       E = PathConsumers.end();
-       I != E; ++I) {
-    (*I)->FlushDiagnostics(&filesMade);
+  for (PathDiagnosticConsumer *Consumer : PathConsumers) {
+    Consumer->FlushDiagnostics(&filesMade);
   }
 }

clang/lib/StaticAnalyzer/Core/BugReporter.cpp

std::string StackHintGeneratorForSymbol::getMessage(const ExplodedNode *N){
 
   // FIXME: Use CallEvent to abstract this over all calls.
   const Stmt *CallSite = CExit.getCalleeContext()->getCallSite();
   const auto *CE = dyn_cast_or_null<CallExpr>(CallSite);
   if (!CE)
     return {};
 
   // Check if one of the parameters are set to the interesting symbol.
-  unsigned ArgIndex = 0;
-  for (CallExpr::const_arg_iterator I = CE->arg_begin(),
-                                    E = CE->arg_end(); I != E; ++I, ++ArgIndex){
-    SVal SV = N->getSVal(*I);
+  for (auto [Idx, ArgExpr] : llvm::enumerate(CE->arguments())) {
+    SVal SV = N->getSVal(ArgExpr);
 
     // Check if the variable corresponding to the symbol is passed by value.
     SymbolRef AS = SV.getAsLocSymbol();
     if (AS == Sym) {
-      return getMessageForArg(*I, ArgIndex);
+      return getMessageForArg(ArgExpr, Idx);
     }
 
     // Check if the parameter is a pointer to the symbol.
     if (std::optional<loc::MemRegionVal> Reg = SV.getAs<loc::MemRegionVal>()) {
       // Do not attempt to dereference void*.
-      if ((*I)->getType()->isVoidPointerType())
+      if (ArgExpr->getType()->isVoidPointerType())
         continue;
       SVal PSV = N->getState()->getSVal(Reg->getRegion());
       SymbolRef AS = PSV.getAsLocSymbol();
       if (AS == Sym) {
-        return getMessageForArg(*I, ArgIndex);
+        return getMessageForArg(ArgExpr, Idx);
       }
     }
   }
 
   // Check if we are returning the interesting symbol.
   SVal SV = N->getSVal(CE);
   SymbolRef RetSym = SV.getAsLocSymbol();
   if (RetSym == Sym) {

clang/lib/StaticAnalyzer/Core/Environment.cpp

 
 #include "clang/StaticAnalyzer/Core/PathSensitive/Environment.h"
 #include "clang/AST/Expr.h"
 #include "clang/AST/ExprCXX.h"
 #include "clang/AST/PrettyPrinter.h"
 #include "clang/AST/Stmt.h"
 #include "clang/AST/StmtObjC.h"
 #include "clang/Analysis/AnalysisDeclContext.h"
+#include "clang/Basic/JsonSupport.h"
 #include "clang/Basic/LLVM.h"
 #include "clang/Basic/LangOptions.h"
-#include "clang/Basic/JsonSupport.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/SymExpr.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h"
 #include "llvm/ADT/ImmutableMap.h"
+#include "llvm/ADT/STLExtras.h"
 #include "llvm/ADT/SmallPtrSet.h"
 #include "llvm/Support/Casting.h"
 #include "llvm/Support/ErrorHandling.h"
 #include "llvm/Support/raw_ostream.h"
 #include <cassert>
 
 using namespace clang;
 using namespace ento;

clang/lib/StaticAnalyzer/Core/ExplodedGraph.cpp

while (!WL2.empty()) {
     if (N->Preds.empty())
       G->addRoot(NewN);
 
     // In the case that some of the intended predecessors of NewN have already
     // been created, we should hook them up as predecessors.
 
     // Walk through the predecessors of 'N' and hook up their corresponding
     // nodes in the new graph (if any) to the freshly created node.
-    for (ExplodedNode::pred_iterator I = N->Preds.begin(), E = N->Preds.end();
-         I != E; ++I) {
-      Pass2Ty::iterator PI = Pass2.find(*I);
+    for (const ExplodedNode *Pred : N->Preds) {
+      Pass2Ty::iterator PI = Pass2.find(Pred);
       if (PI == Pass2.end())
         continue;
 
       NewN->addPredecessor(const_cast<ExplodedNode *>(PI->second), *G);
     }
 
     // In the case that some of the intended successors of NewN have already
     // been created, we should hook them up as successors.  Otherwise, enqueue
     // the new nodes from the original graph that should have nodes created
     // in the new graph.
-    for (ExplodedNode::succ_iterator I = N->Succs.begin(), E = N->Succs.end();
-         I != E; ++I) {
-      Pass2Ty::iterator PI = Pass2.find(*I);
+    for (const ExplodedNode *Succ : N->Succs) {
+      Pass2Ty::iterator PI = Pass2.find(Succ);
       if (PI != Pass2.end()) {
         const_cast<ExplodedNode *>(PI->second)->addPredecessor(NewN, *G);
         continue;
       }
 
       // Enqueue nodes to the worklist that were marked during pass 1.
-      if (Pass1.count(*I))
-        WL2.push_back(*I);
+      if (Pass1.count(Succ))
+        WL2.push_back(Succ);
     }
   }
 
   return G;
 }

clang/lib/StaticAnalyzer/Core/ExprEngine.cpp

 #include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/Store.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/SymExpr.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h"
 #include "llvm/ADT/APSInt.h"
 #include "llvm/ADT/DenseMap.h"
 #include "llvm/ADT/ImmutableMap.h"
 #include "llvm/ADT/ImmutableSet.h"
+#include "llvm/ADT/STLExtras.h"
 #include "llvm/ADT/SmallVector.h"
 #include "llvm/ADT/Statistic.h"
 #include "llvm/Support/Casting.h"
 #include "llvm/Support/Compiler.h"
 #include "llvm/Support/DOTGraphTraits.h"
 #include "llvm/Support/ErrorHandling.h"
 #include "llvm/Support/GraphWriter.h"
 #include "llvm/Support/SaveAndRestore.h"
static const Stmt *ResolveCondition(const Stmt *Condition,
   // For logical operations, we still have the case where some branches
   // use the traditional "merge" approach and others sink the branch
   // directly into the basic blocks representing the logical operation.
   // We need to distinguish between those two cases here.
 
   // The invariants are still shifting, but it is possible that the
   // last element in a CFGBlock is not a CFGStmt.  Look for the last
   // CFGStmt as the value of the condition.
-  CFGBlock::const_reverse_iterator I = B->rbegin(), E = B->rend();
-  for (; I != E; ++I) {
-    CFGElement Elem = *I;
+  for (CFGElement Elem : llvm::reverse(*B)) {
     std::optional<CFGStmt> CS = Elem.getAs<CFGStmt>();
     if (!CS)
       continue;
     const Stmt *LastStmt = CS->getStmt();
     assert(LastStmt == Condition || LastStmt == getRightmostLeaf(Condition));
     return LastStmt;
   }
   llvm_unreachable("could not resolve condition");
void ExprEngine::processIndirectGoto(IndirectGotoNodeBuilder &builder) {
   //   (3) We have no clue about the label.  Dispatch to all targets.
   //
 
   using iterator = IndirectGotoNodeBuilder::iterator;
 
   if (std::optional<loc::GotoLabel> LV = V.getAs<loc::GotoLabel>()) {
     const LabelDecl *L = LV->getLabel();
 
-    for (iterator I = builder.begin(), E = builder.end(); I != E; ++I) {
-      if (I.getLabel() == L) {
-        builder.generateNode(I, state);
+    for (iterator Succ : builder) {
+      if (Succ.getLabel() == L) {
+        builder.generateNode(Succ, state);
         return;
       }
     }
 
     llvm_unreachable("No block with label.");
   }
 
   if (isa<UndefinedVal, loc::ConcreteInt>(V)) {
     // Dispatch to the first target and mark it as a sink.
     //ExplodedNode* N = builder.generateNode(builder.begin(), state, true);
     // FIXME: add checker visit.
     //    UndefBranches.insert(N);
     return;
   }
 
   // This is really a catch-all.  We don't support symbolics yet.
   // FIXME: Implement dispatch for symbolic pointers.
 
-  for (iterator I = builder.begin(), E = builder.end(); I != E; ++I)
-    builder.generateNode(I, state);
+  for (iterator Succ : builder)
+    builder.generateNode(Succ, state);
 }
 
 void ExprEngine::processBeginOfFunction(NodeBuilderContext &BC,
                                         ExplodedNode *Pred,
                                         ExplodedNodeSet &Dst,
                                         const BlockEdge &L) {
   SaveAndRestore<const NodeBuilderContext *> NodeContextRAII(currBldrCtx, &BC);
   getCheckerManager().runCheckersForBeginFunction(Dst, L, Pred, *this);

 template<>
 struct DOTGraphTraits<ExplodedGraph*> : public DefaultDOTGraphTraits {
   DOTGraphTraits (bool isSimple = false) : DefaultDOTGraphTraits(isSimple) {}
 
   static bool nodeHasBugReport(const ExplodedNode *N) {
     BugReporter &BR = static_cast<ExprEngine &>(
       N->getState()->getStateManager().getOwningEngine()).getBugReporter();
 
-    const auto EQClasses =
-        llvm::make_range(BR.EQClasses_begin(), BR.EQClasses_end());
-
-    for (const auto &EQ : EQClasses) {
-      for (const auto &I : EQ.getReports()) {
-        const auto *PR = dyn_cast<PathSensitiveBugReport>(I.get());
+    for (const auto &Class : BR.equivalenceClasses()) {
+      for (const auto &Report : Class.getReports()) {
+        const auto *PR = dyn_cast<PathSensitiveBugReport>(Report.get());
         if (!PR)
           continue;
         const ExplodedNode *EN = PR->getErrorNode();
         if (EN->getState() == N->getState() &&
             EN->getLocation() == N->getLocation())
           return true;
       }
     }
void ExprEngine::ViewGraph(ArrayRef<const ExplodedNode *> Nodes) {
   llvm::DisplayGraph(Filename, false, llvm::GraphProgram::DOT);
 }
 
 std::string ExprEngine::DumpGraph(bool trim, StringRef Filename) {
   if (trim) {
     std::vector<const ExplodedNode *> Src;
 
     // Iterate through the reports and get their nodes.
-    for (BugReporter::EQClasses_iterator
-           EI = BR.EQClasses_begin(), EE = BR.EQClasses_end(); EI != EE; ++EI) {
+    for (const auto &Class : BR.equivalenceClasses()) {
       const auto *R =
-          dyn_cast<PathSensitiveBugReport>(EI->getReports()[0].get());
+          dyn_cast<PathSensitiveBugReport>(Class.getReports()[0].get());
       if (!R)
         continue;
       const auto *N = const_cast<ExplodedNode *>(R->getErrorNode());
       Src.push_back(N);
     }
     return DumpGraph(Src, Filename);
   }
 

clang/lib/StaticAnalyzer/Core/ExprEngineC.cpp

 //=-- ExprEngineC.cpp - ExprEngine support for C expressions ----*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
 //  This file defines ExprEngine's support for C expressions.
 //
 //===----------------------------------------------------------------------===//
 
-#include "clang/AST/ExprCXX.h"
 #include "clang/AST/DeclCXX.h"
+#include "clang/AST/ExprCXX.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
 #include <optional>
 
 using namespace clang;
 using namespace ento;
 using llvm::APSInt;
 
for (ExplodedNodeSet::iterator it=CheckedSet.begin(), ei=CheckedSet.end();
     }
 
     // Perform a load (the LHS).  This performs the checks for
     // null dereferences, and so on.
     ExplodedNodeSet Tmp;
     SVal location = LeftV;
     evalLoad(Tmp, B, LHS, *it, state, location);
 
-    for (ExplodedNodeSet::iterator I = Tmp.begin(), E = Tmp.end(); I != E;
-         ++I) {
+    for (ExplodedNode *N : Tmp) {
 
-      state = (*I)->getState();
-      const LocationContext *LCtx = (*I)->getLocationContext();
+        state = N->getState();
+        const LocationContext *LCtx = N->getLocationContext();
         SVal V = state->getSVal(LHS, LCtx);
 
         // Get the computation type.
         QualType CTy =
             cast<CompoundAssignOperator>(B)->getComputationResultType();
         CTy = getContext().getCanonicalType(CTy);
 
         QualType CLHSTy =
             cast<CompoundAssignOperator>(B)->getComputationLHSType();
         CLHSTy = getContext().getCanonicalType(CLHSTy);
 
         QualType LTy = getContext().getCanonicalType(LHS->getType());
 
         // Promote LHS.
         V = svalBuilder.evalCast(V, CLHSTy, LTy);
 
         // Compute the result of the operation.
         SVal Result = svalBuilder.evalCast(evalBinOp(state, Op, V, RightV, CTy),
                                            B->getType(), CTy);
 
         // EXPERIMENTAL: "Conjured" symbols.
         // FIXME: Handle structs.
 
         SVal LHSVal;
 
         if (Result.isUnknown()) {
         // The symbolic value is actually for the type of the left-hand side
         // expression, not the computation type, as this is the value the
         // LValue on the LHS will bind to.
         LHSVal = svalBuilder.conjureSymbolVal(nullptr, B->getRHS(), LCtx, LTy,
                                               currBldrCtx->blockCount());
         // However, we need to convert the symbol to the computation type.
         Result = svalBuilder.evalCast(LHSVal, CTy, LTy);
-      }
-      else {
+        } else {
         // The left-hand side may bind to a different value then the
         // computation type.
         LHSVal = svalBuilder.evalCast(Result, LTy, CTy);
         }
 
       // In C++, assignment and compound assignment operators return an
       // lvalue.
       if (B->isGLValue())
         state = state->BindExpr(B, LCtx, location);
       else
         state = state->BindExpr(B, LCtx, Result);
 
-      evalStore(Tmp2, B, LHS, *I, state, location, LHSVal);
+      evalStore(Tmp2, B, LHS, N, state, location, LHSVal);
     }
   }
 
   // FIXME: postvisits eventually go in ::Visit()
   getCheckerManager().runCheckersForPostStmt(Dst, Tmp2, B, *this);
 }
 
 void ExprEngine::VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred,
void ExprEngine::VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred,
 
   ProgramStateRef State = Pred->getState();
 
   // If we created a new MemRegion for the block, we should explicitly bind
   // the captured variables.
   if (const BlockDataRegion *BDR =
       dyn_cast_or_null<BlockDataRegion>(V.getAsRegion())) {
 
-    BlockDataRegion::referenced_vars_iterator I = BDR->referenced_vars_begin(),
-                                              E = BDR->referenced_vars_end();
-
+    auto ReferencedVars = BDR->referenced_vars();
     auto CI = BD->capture_begin();
     auto CE = BD->capture_end();
-    for (; I != E; ++I) {
-      const VarRegion *capturedR = I.getCapturedRegion();
-      const TypedValueRegion *originalR = I.getOriginalRegion();
+    for (auto Var : ReferencedVars) {
+      const VarRegion *capturedR = Var.getCapturedRegion();
+      const TypedValueRegion *originalR = Var.getOriginalRegion();
 
       // If the capture had a copy expression, use the result of evaluating
       // that expression, otherwise use the original value.
       // We rely on the invariant that the block declaration's capture variables
       // are a prefix of the BlockDataRegion's referenced vars (which may include
       // referenced globals, etc.) to enable fast lookup of the capture for a
       // given referenced var.
       const Expr *copyExpr = nullptr;

 void ExprEngine::VisitCast(const CastExpr *CastE, const Expr *Ex,
                            ExplodedNode *Pred, ExplodedNodeSet &Dst) {
 
   ExplodedNodeSet dstPreStmt;
   getCheckerManager().runCheckersForPreStmt(dstPreStmt, Pred, CastE, *this);
 
   if (CastE->getCastKind() == CK_LValueToRValue ||
       CastE->getCastKind() == CK_LValueToRValueBitCast) {
-    for (ExplodedNodeSet::iterator I = dstPreStmt.begin(), E = dstPreStmt.end();
-         I!=E; ++I) {
-      ExplodedNode *subExprNode = *I;
+    for (ExplodedNode *subExprNode : dstPreStmt) {
       ProgramStateRef state = subExprNode->getState();
       const LocationContext *LCtx = subExprNode->getLocationContext();
       evalLoad(Dst, CastE, CastE, subExprNode, state, state->getSVal(Ex, LCtx));
     }
     return;
   }
 
   // All other casts.
   QualType T = CastE->getType();
   QualType ExTy = Ex->getType();
 
   if (const ExplicitCastExpr *ExCast=dyn_cast_or_null<ExplicitCastExpr>(CastE))
     T = ExCast->getTypeAsWritten();
 
   StmtNodeBuilder Bldr(dstPreStmt, Dst, *currBldrCtx);
-  for (ExplodedNodeSet::iterator I = dstPreStmt.begin(), E = dstPreStmt.end();
-       I != E; ++I) {
-
-    Pred = *I;
+  for (ExplodedNode *Pred : dstPreStmt) {
     ProgramStateRef state = Pred->getState();
     const LocationContext *LCtx = Pred->getLocationContext();
 
     switch (CastE->getCastKind()) {
       case CK_LValueToRValue:
       case CK_LValueToRValueBitCast:
         llvm_unreachable("LValueToRValue casts handled earlier.");
       case CK_ToVoid:
VisitUnaryExprOrTypeTraitExpr(const UnaryExprOrTypeTraitExpr *Ex,
   ExplodedNodeSet CheckedSet;
   getCheckerManager().runCheckersForPreStmt(CheckedSet, Pred, Ex, *this);
 
   ExplodedNodeSet EvalSet;
   StmtNodeBuilder Bldr(CheckedSet, EvalSet, *currBldrCtx);
 
   QualType T = Ex->getTypeOfArgument();
 
-  for (ExplodedNodeSet::iterator I = CheckedSet.begin(), E = CheckedSet.end();
-       I != E; ++I) {
+  for (ExplodedNode *N : CheckedSet) {
     if (Ex->getKind() == UETT_SizeOf) {
       if (!T->isIncompleteType() && !T->isConstantSizeType()) {
         assert(T->isVariableArrayType() && "Unknown non-constant-sized type.");
 
         // FIXME: Add support for VLA type arguments and VLA expressions.
         // When that happens, we should probably refactor VLASizeChecker's code.
         continue;
       } else if (T->getAs<ObjCObjectType>()) {
         // Some code tries to take the sizeof an ObjCObjectType, relying that
         // the compiler has laid out its representation.  Just report Unknown
         // for these.
         continue;
       }
     }
 
     APSInt Value = Ex->EvaluateKnownConstInt(getContext());
     CharUnits amt = CharUnits::fromQuantity(Value.getZExtValue());
 
-    ProgramStateRef state = (*I)->getState();
-    state = state->BindExpr(Ex, (*I)->getLocationContext(),
-                            svalBuilder.makeIntVal(amt.getQuantity(),
-                                                   Ex->getType()));
-    Bldr.generateNode(Ex, *I, state);
+    ProgramStateRef state = N->getState();
+    state = state->BindExpr(
+        Ex, N->getLocationContext(),
+        svalBuilder.makeIntVal(amt.getQuantity(), Ex->getType()));
+    Bldr.generateNode(Ex, N, state);
   }
 
   getCheckerManager().runCheckersForPostStmt(Dst, EvalSet, Ex, *this);
 }
 
-void ExprEngine::handleUOExtension(ExplodedNodeSet::iterator I,
-                                   const UnaryOperator *U,
+void ExprEngine::handleUOExtension(ExplodedNode *N, const UnaryOperator *U,
                                    StmtNodeBuilder &Bldr) {
   // FIXME: We can probably just have some magic in Environment::getSVal()
   // that propagates values, instead of creating a new node here.
   //
   // Unary "+" is a no-op, similar to a parentheses.  We still have places
   // where it may be a block-level expression, so we need to
   // generate an extra node that just propagates the value of the
   // subexpression.
   const Expr *Ex = U->getSubExpr()->IgnoreParens();
-  ProgramStateRef state = (*I)->getState();
-  const LocationContext *LCtx = (*I)->getLocationContext();
-  Bldr.generateNode(U, *I, state->BindExpr(U, LCtx,
-                                           state->getSVal(Ex, LCtx)));
+  ProgramStateRef state = N->getState();
+  const LocationContext *LCtx = N->getLocationContext();
+  Bldr.generateNode(U, N, state->BindExpr(U, LCtx, state->getSVal(Ex, LCtx)));
 }
 
 void ExprEngine::VisitUnaryOperator(const UnaryOperator* U, ExplodedNode *Pred,
                                     ExplodedNodeSet &Dst) {
   // FIXME: Prechecks eventually go in ::Visit().
   ExplodedNodeSet CheckedSet;
   getCheckerManager().runCheckersForPreStmt(CheckedSet, Pred, U, *this);
 
   ExplodedNodeSet EvalSet;
   StmtNodeBuilder Bldr(CheckedSet, EvalSet, *currBldrCtx);
 
-  for (ExplodedNodeSet::iterator I = CheckedSet.begin(), E = CheckedSet.end();
-       I != E; ++I) {
+  for (ExplodedNode *N : CheckedSet) {
     switch (U->getOpcode()) {
     default: {
-      Bldr.takeNodes(*I);
+      Bldr.takeNodes(N);
       ExplodedNodeSet Tmp;
-      VisitIncrementDecrementOperator(U, *I, Tmp);
+      VisitIncrementDecrementOperator(U, N, Tmp);
       Bldr.addNodes(Tmp);
       break;
     }
     case UO_Real: {
       const Expr *Ex = U->getSubExpr()->IgnoreParens();
 
       // FIXME: We don't have complex SValues yet.
       if (Ex->getType()->isAnyComplexType()) {
         // Just report "Unknown."
         break;
       }
 
       // For all other types, UO_Real is an identity operation.
       assert (U->getType() == Ex->getType());
-      ProgramStateRef state = (*I)->getState();
-      const LocationContext *LCtx = (*I)->getLocationContext();
-      Bldr.generateNode(U, *I, state->BindExpr(U, LCtx,
-                                               state->getSVal(Ex, LCtx)));
+      ProgramStateRef state = N->getState();
+      const LocationContext *LCtx = N->getLocationContext();
+      Bldr.generateNode(U, N,
+                        state->BindExpr(U, LCtx, state->getSVal(Ex, LCtx)));
       break;
     }
 
     case UO_Imag: {
       const Expr *Ex = U->getSubExpr()->IgnoreParens();
       // FIXME: We don't have complex SValues yet.
       if (Ex->getType()->isAnyComplexType()) {
         // Just report "Unknown."
         break;
       }
       // For all other types, UO_Imag returns 0.
-      ProgramStateRef state = (*I)->getState();
-      const LocationContext *LCtx = (*I)->getLocationContext();
+      ProgramStateRef state = N->getState();
+      const LocationContext *LCtx = N->getLocationContext();
       SVal X = svalBuilder.makeZeroVal(Ex->getType());
-      Bldr.generateNode(U, *I, state->BindExpr(U, LCtx, X));
+      Bldr.generateNode(U, N, state->BindExpr(U, LCtx, X));
       break;
     }
 
     case UO_AddrOf: {
       // Process pointer-to-member address operation.
       const Expr *Ex = U->getSubExpr()->IgnoreParens();
       if (const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(Ex)) {
         const ValueDecl *VD = DRE->getDecl();
 
         if (isa<CXXMethodDecl, FieldDecl, IndirectFieldDecl>(VD)) {
-          ProgramStateRef State = (*I)->getState();
-          const LocationContext *LCtx = (*I)->getLocationContext();
+          ProgramStateRef State = N->getState();
+          const LocationContext *LCtx = N->getLocationContext();
           SVal SV = svalBuilder.getMemberPointer(cast<NamedDecl>(VD));
-          Bldr.generateNode(U, *I, State->BindExpr(U, LCtx, SV));
+          Bldr.generateNode(U, N, State->BindExpr(U, LCtx, SV));
           break;
         }
       }
       // Explicitly proceed with default handler for this case cascade.
-      handleUOExtension(I, U, Bldr);
+      handleUOExtension(N, U, Bldr);
       break;
     }
     case UO_Plus:
       assert(!U->isGLValue());
       [[fallthrough]];
     case UO_Deref:
     case UO_Extension: {
-      handleUOExtension(I, U, Bldr);
+      handleUOExtension(N, U, Bldr);
       break;
     }
 
     case UO_LNot:
     case UO_Minus:
     case UO_Not: {
       assert (!U->isGLValue());
       const Expr *Ex = U->getSubExpr()->IgnoreParens();
-      ProgramStateRef state = (*I)->getState();
-      const LocationContext *LCtx = (*I)->getLocationContext();
+      ProgramStateRef state = N->getState();
+      const LocationContext *LCtx = N->getLocationContext();
 
       // Get the value of the subexpression.
       SVal V = state->getSVal(Ex, LCtx);
 
       if (V.isUnknownOrUndef()) {
-        Bldr.generateNode(U, *I, state->BindExpr(U, LCtx, V));
+        Bldr.generateNode(U, N, state->BindExpr(U, LCtx, V));
         break;
       }
 
       switch (U->getOpcode()) {
         default:
           llvm_unreachable("Invalid Opcode.");
         case UO_Not:
           // FIXME: Do we need to handle promotions?
case UO_Not: {
           } else {
           nonloc::ConcreteInt X(getBasicVals().getValue(0, Ex->getType()));
           Result = evalBinOp(state, BO_EQ, V.castAs<NonLoc>(), X, U->getType());
           }
 
           state = state->BindExpr(U, LCtx, Result);
           break;
       }
-      Bldr.generateNode(U, *I, state);
+      Bldr.generateNode(U, N, state);
       break;
     }
     }
   }
 
   getCheckerManager().runCheckersForPostStmt(Dst, EvalSet, U, *this);
 }
 
void ExprEngine::VisitIncrementDecrementOperator(const UnaryOperator* U,
   SVal loc = state->getSVal(Ex, LCtx);
 
   // Perform a load.
   ExplodedNodeSet Tmp;
   evalLoad(Tmp, U, Ex, Pred, state, loc);
 
   ExplodedNodeSet Dst2;
   StmtNodeBuilder Bldr(Tmp, Dst2, *currBldrCtx);
-  for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end();I!=E;++I) {
-
-    state = (*I)->getState();
-    assert(LCtx == (*I)->getLocationContext());
+  for (ExplodedNode *N : Tmp) {
+    state = N->getState();
+    assert(LCtx == N->getLocationContext());
     SVal V2_untested = state->getSVal(Ex, LCtx);
 
     // Propagate unknown and undefined values.
     if (V2_untested.isUnknownOrUndef()) {
       state = state->BindExpr(U, LCtx, V2_untested);
 
       // Perform the store, so that the uninitialized value detection happens.
-      Bldr.takeNodes(*I);
+      Bldr.takeNodes(N);
       ExplodedNodeSet Dst3;
-      evalStore(Dst3, U, Ex, *I, state, loc, V2_untested);
+      evalStore(Dst3, U, Ex, N, state, loc, V2_untested);
       Bldr.addNodes(Dst3);
 
       continue;
     }
     DefinedSVal V2 = V2_untested.castAs<DefinedSVal>();
 
     // Handle all other values.
     BinaryOperator::Opcode Op = U->isIncrementOp() ? BO_Add : BO_Sub;
for (ExplodedNode *N : Tmp) {
     // Since the lvalue-to-rvalue conversion is explicit in the AST,
     // we bind an l-value if the operator is prefix and an lvalue (in C++).
     if (U->isGLValue())
       state = state->BindExpr(U, LCtx, loc);
     else
       state = state->BindExpr(U, LCtx, U->isPostfix() ? V2 : Result);
 
     // Perform the store.
-    Bldr.takeNodes(*I);
+    Bldr.takeNodes(N);
     ExplodedNodeSet Dst3;
-    evalStore(Dst3, U, Ex, *I, state, loc, Result);
+    evalStore(Dst3, U, Ex, N, state, loc, Result);
     Bldr.addNodes(Dst3);
   }
   Dst.insert(Dst2);
 }

clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp

if (std::optional<Loc> L = V.getAs<Loc>())
     V = Pred->getState()->getSVal(*L);
   else
     assert(V.isUnknownOrUndef());
 
   const Expr *CallExpr = Call.getOriginExpr();
   evalBind(Dst, CallExpr, Pred, ThisVal, V, true);
 
   PostStmt PS(CallExpr, LCtx);
-  for (ExplodedNodeSet::iterator I = Dst.begin(), E = Dst.end();
-       I != E; ++I) {
-    ProgramStateRef State = (*I)->getState();
+  for (ExplodedNode *N : Dst) {
+    ProgramStateRef State = N->getState();
     if (AlwaysReturnsLValue)
       State = State->BindExpr(CallExpr, LCtx, ThisVal);
     else
       State = bindReturnValue(Call, LCtx, State);
-    Bldr.generateNode(PS, State, *I);
+    Bldr.generateNode(PS, State, N);
   }
 }
 
 SVal ExprEngine::makeElementRegion(ProgramStateRef State, SVal LValue,
                                    QualType &Ty, bool &IsArray, unsigned Idx) {
   SValBuilder &SVB = State->getStateManager().getSValBuilder();
   ASTContext &Ctx = SVB.getContext();
 
void ExprEngine::handleConstructor(const Expr *E,
 
   ExplodedNodeSet DstPreVisit;
   getCheckerManager().runCheckersForPreStmt(DstPreVisit, Pred, E, *this);
 
   ExplodedNodeSet PreInitialized;
   if (CE) {
     // FIXME: Is it possible and/or useful to do this before PreStmt?
     StmtNodeBuilder Bldr(DstPreVisit, PreInitialized, *currBldrCtx);
-    for (ExplodedNodeSet::iterator I = DstPreVisit.begin(),
-                                   E = DstPreVisit.end();
-         I != E; ++I) {
-      ProgramStateRef State = (*I)->getState();
+    for (ExplodedNode *N : DstPreVisit) {
+      ProgramStateRef State = N->getState();
       if (CE->requiresZeroInitialization()) {
         // FIXME: Once we properly handle constructors in new-expressions, we'll
         // need to invalidate the region before setting a default value, to make
         // sure there aren't any lingering bindings around. This probably needs
         // to happen regardless of whether or not the object is zero-initialized
         // to handle random fields of a placement-initialized object picking up
         // old bindings. We might only want to do it when we need to, though.
         // FIXME: This isn't actually correct for arrays -- we need to zero-
         // initialize the entire array, not just the first element -- but our
         // handling of arrays everywhere else is weak as well, so this shouldn't
         // actually make things worse. Placement new makes this tricky as well,
         // since it's then possible to be initializing one part of a multi-
         // dimensional array.
         State = State->bindDefaultZero(Target, LCtx);
       }
 
-      Bldr.generateNode(CE, *I, State, /*tag=*/nullptr,
+      Bldr.generateNode(CE, N, State, /*tag=*/nullptr,
                         ProgramPoint::PreStmtKind);
     }
   } else {
     PreInitialized = DstPreVisit;
   }
 
   ExplodedNodeSet DstPreCall;
   getCheckerManager().runCheckersForPreCall(DstPreCall, PreInitialized,
                                             *Call, *this);
 
   ExplodedNodeSet DstEvaluated;
 
   if (CE && CE->getConstructor()->isTrivial() &&
       CE->getConstructor()->isCopyOrMoveConstructor() &&
       !CallOpts.IsArrayCtorOrDtor) {
     StmtNodeBuilder Bldr(DstPreCall, DstEvaluated, *currBldrCtx);
     // FIXME: Handle other kinds of trivial constructors as well.
-    for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end();
-         I != E; ++I)
-      performTrivialCopy(Bldr, *I, *Call);
+    for (ExplodedNode *N : DstPreCall)
+      performTrivialCopy(Bldr, N, *Call);
 
   } else {
-    for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end();
-         I != E; ++I)
-      getCheckerManager().runCheckersForEvalCall(DstEvaluated, *I, *Call, *this,
+    for (ExplodedNode *N : DstPreCall)
+      getCheckerManager().runCheckersForEvalCall(DstEvaluated, N, *Call, *this,
                                                  CallOpts);
   }
 
   // If the CFG was constructed without elements for temporary destructors
   // and the just-called constructor created a temporary object then
   // stop exploration if the temporary object has a noreturn constructor.
   // This can lose coverage because the destructor, if it were present
   // in the CFG, would be called at the end of the full expression or
PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(),
                                 "Error evaluating destructor");
 
   ExplodedNodeSet DstPreCall;
   getCheckerManager().runCheckersForPreCall(DstPreCall, Pred,
                                             *Call, *this);
 
   ExplodedNodeSet DstInvalidated;
   StmtNodeBuilder Bldr(DstPreCall, DstInvalidated, *currBldrCtx);
-  for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end();
-       I != E; ++I)
-    defaultEvalCall(Bldr, *I, *Call, CallOpts);
+  for (ExplodedNode *N : DstPreCall)
+    defaultEvalCall(Bldr, N, *Call, CallOpts);
 
   getCheckerManager().runCheckersForPostCall(Dst, DstInvalidated,
                                              *Call, *this);
 }
 
 void ExprEngine::VisitCXXNewAllocatorCall(const CXXNewExpr *CNE,
                                           ExplodedNode *Pred,
                                           ExplodedNodeSet &Dst) {
void ExprEngine::VisitLambdaExpr(const LambdaExpr *LE, ExplodedNode *Pred,
   SVal V = loc::MemRegionVal(R);
 
   ProgramStateRef State = Pred->getState();
 
   // If we created a new MemRegion for the lambda, we should explicitly bind
   // the captures.
   unsigned Idx = 0;
   CXXRecordDecl::field_iterator CurField = LE->getLambdaClass()->field_begin();
-  for (LambdaExpr::const_capture_init_iterator i = LE->capture_init_begin(),
-                                               e = LE->capture_init_end();
-       i != e; ++i, ++CurField, ++Idx) {
+  for (auto i = LE->capture_init_begin(), e = LE->capture_init_end(); i != e;
+       ++i, ++CurField, ++Idx) {
     FieldDecl *FieldForCapture = *CurField;
     SVal FieldLoc = State->getLValue(FieldForCapture, V);
 
     SVal InitVal;
     if (!FieldForCapture->hasCapturedVLAType()) {
       const Expr *InitExpr = *i;
 
       assert(InitExpr && "Capture missing initialization expression");

clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp

if (LastSt && Blk && AMgr.options.AnalysisPurgeOpt != PurgeNone) {
     removeDead(BindedRetNode, CleanedNodes, nullptr, calleeCtx,
                calleeCtx->getAnalysisDeclContext()->getBody(),
                ProgramPoint::PostStmtPurgeDeadSymbolsKind);
     currBldrCtx = nullptr;
   } else {
     CleanedNodes.Add(CEBNode);
   }
 
-  for (ExplodedNodeSet::iterator I = CleanedNodes.begin(),
-                                 E = CleanedNodes.end(); I != E; ++I) {
-
+  for (ExplodedNode *N : CleanedNodes) {
     // Step 4: Generate the CallExit and leave the callee's context.
     // CleanedNodes -> CEENode
     CallExitEnd Loc(calleeCtx, callerCtx);
     bool isNew;
-    ProgramStateRef CEEState = (*I == CEBNode) ? state : (*I)->getState();
+    ProgramStateRef CEEState = (N == CEBNode) ? state : N->getState();
 
     ExplodedNode *CEENode = G.getNode(Loc, CEEState, false, &isNew);
-    CEENode->addPredecessor(*I, G);
+    CEENode->addPredecessor(N, G);
     if (!isNew)
       return;
 
     // Step 5: Perform the post-condition check of the CallExpr and enqueue the
     // result onto the work list.
     // CEENode -> Dst -> WorkList
     NodeBuilderContext Ctx(Engine, calleeCtx->getCallSiteBlock(), CEENode);
     SaveAndRestore<const NodeBuilderContext *> NBCSave(currBldrCtx, &Ctx);
void ExprEngine::VisitCallExpr(const CallExpr *CE, ExplodedNode *Pred,
   // all the checks.
   CallEventManager &CEMgr = getStateManager().getCallEventManager();
   CallEventRef<> CallTemplate = CEMgr.getSimpleCall(
       CE, Pred->getState(), Pred->getLocationContext(), getCFGElementRef());
 
   // Evaluate the function call.  We try each of the checkers
   // to see if the can evaluate the function call.
   ExplodedNodeSet dstCallEvaluated;
-  for (ExplodedNodeSet::iterator I = dstPreVisit.begin(), E = dstPreVisit.end();
-       I != E; ++I) {
-    evalCall(dstCallEvaluated, *I, *CallTemplate);
+  for (ExplodedNode *N : dstPreVisit) {
+    evalCall(dstCallEvaluated, N, *CallTemplate);
   }
 
   // Finally, perform the post-condition check of the CallExpr and store
   // the created nodes in 'Dst'.
   // Note that if the call was inlined, dstCallEvaluated will be empty.
   // The post-CallExpr check will occur in processCallExit.
   getCheckerManager().runCheckersForPostStmt(dst, dstCallEvaluated, CE,
                                              *this);

clang/lib/StaticAnalyzer/Core/HTMLDiagnostics.cpp

for (const auto &Piece : path) {
            << LineNumber << ", column " << ColumnNumber << "</a><br />"
            << P->getString() << "</td></tr>";
         ++NumExtraPieces;
       }
     }
 
     // Output any other meta data.
 
-    for (PathDiagnostic::meta_iterator I = D.meta_begin(), E = D.meta_end();
-         I != E; ++I) {
-      os << "<tr><td></td><td>" << html::EscapeText(*I) << "</td></tr>\n";
+    for (const std::string &Metadata :
+         llvm::make_range(D.meta_begin(), D.meta_end())) {
+      os << "<tr><td></td><td>" << html::EscapeText(Metadata) << "</td></tr>\n";
     }
 
     os << R"<<<(
 </table>
 <!-- REPORTSUMMARYEXTRA -->
 <h3>Annotated Source Code</h3>
 <p>Press <a href="#" onclick="toggleHelp(); return false;">'?'</a>
    to see keyboard shortcuts</p>

clang/lib/StaticAnalyzer/Core/MemRegion.cpp

 #include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h"
 #include "llvm/ADT/APInt.h"
 #include "llvm/ADT/FoldingSet.h"
 #include "llvm/ADT/PointerUnion.h"
 #include "llvm/ADT/SmallString.h"
 #include "llvm/ADT/StringRef.h"
 #include "llvm/ADT/Twine.h"
+#include "llvm/ADT/iterator_range.h"
 #include "llvm/Support/Allocator.h"
 #include "llvm/Support/Casting.h"
 #include "llvm/Support/CheckedArithmetic.h"
 #include "llvm/Support/Compiler.h"
 #include "llvm/Support/Debug.h"
 #include "llvm/Support/ErrorHandling.h"
 #include "llvm/Support/raw_ostream.h"
 #include <cassert>

 
 void BlockCodeRegion::dumpToStream(raw_ostream &os) const {
   os << "block_code{" << static_cast<const void *>(this) << '}';
 }
 
 void BlockDataRegion::dumpToStream(raw_ostream &os) const {
   os << "block_data{" << BC;
   os << "; ";
-  for (BlockDataRegion::referenced_vars_iterator
-         I = referenced_vars_begin(),
-         E = referenced_vars_end(); I != E; ++I)
-    os << "(" << I.getCapturedRegion() << "<-" <<
-                 I.getOriginalRegion() << ") ";
+  for (auto Var : referenced_vars())
+    os << "(" << Var.getCapturedRegion() << "<-" << Var.getOriginalRegion()
+       << ") ";
   os << '}';
 }
 
 void CompoundLiteralRegion::dumpToStream(raw_ostream &os) const {
   // FIXME: More elaborate pretty-printing.
   os << "{ S" << CL->getID(getContext()) <<  " }";
 }
 
getStackOrCaptureRegionForDeclContext(const LocationContext *LC,
   while (LC) {
     if (const auto *SFC = dyn_cast<StackFrameContext>(LC)) {
       if (cast<DeclContext>(SFC->getDecl()) == DC)
         return SFC;
     }
     if (const auto *BC = dyn_cast<BlockInvocationContext>(LC)) {
       const auto *BR = static_cast<const BlockDataRegion *>(BC->getData());
       // FIXME: This can be made more efficient.
-      for (BlockDataRegion::referenced_vars_iterator
-           I = BR->referenced_vars_begin(),
-           E = BR->referenced_vars_end(); I != E; ++I) {
-        const TypedValueRegion *OrigR = I.getOriginalRegion();
+      for (auto Var : BR->referenced_vars()) {
+        const TypedValueRegion *OrigR = Var.getOriginalRegion();
         if (const auto *VR = dyn_cast<VarRegion>(OrigR)) {
           if (VR->getDecl() == VD)
-            return cast<VarRegion>(I.getCapturedRegion());
+            return cast<VarRegion>(Var.getCapturedRegion());
         }
       }
     }
 
     LC = LC->getParent();
   }
   return (const StackFrameContext *)nullptr;
 }
BlockDataRegion::referenced_vars_end() const {
 
   auto *VecOriginal =
       static_cast<BumpVector<const MemRegion *> *>(OriginalVars);
 
   return BlockDataRegion::referenced_vars_iterator(Vec->end(),
                                                    VecOriginal->end());
 }
 
+llvm::iterator_range<BlockDataRegion::referenced_vars_iterator>
+BlockDataRegion::referenced_vars() const {
+  return llvm::make_range(referenced_vars_begin(), referenced_vars_end());
+}
+
 const VarRegion *BlockDataRegion::getOriginalRegion(const VarRegion *R) const {
-  for (referenced_vars_iterator I = referenced_vars_begin(),
-                                E = referenced_vars_end();
-       I != E; ++I) {
+  for (const auto &I : referenced_vars()) {
     if (I.getCapturedRegion() == R)
       return I.getOriginalRegion();
   }
   return nullptr;
 }
 
 //===----------------------------------------------------------------------===//
 // RegionAndSymbolInvalidationTraits

clang/lib/StaticAnalyzer/Core/PlistDiagnostics.cpp

assert(P.getFixits().size() == 0 &&
          "Fixits on call pieces are not implemented yet!");
 }
 
 void PlistPrinter::ReportMacroSubPieces(raw_ostream &o,
                                         const PathDiagnosticMacroPiece& P,
                                         unsigned indent, unsigned depth) {
   MacroPieces.push_back(&P);
 
-  for (PathPieces::const_iterator I = P.subPieces.begin(),
-                                  E = P.subPieces.end();
-       I != E; ++I) {
-    ReportPiece(o, **I, indent, depth, /*includeControlFlow*/ false);
+  for (const auto &SubPiece : P.subPieces) {
+    ReportPiece(o, *SubPiece, indent, depth, /*includeControlFlow*/ false);
   }
 
   assert(P.getFixits().size() == 0 &&
          "Fixits on constrol flow pieces are not implemented yet!");
 }
 
 void PlistPrinter::ReportMacroExpansions(raw_ostream &o, unsigned indent) {
 
static void printCoverage(const PathDiagnostic *D,
   unsigned IndentLevel = InputIndentLevel;
 
   Indent(o, IndentLevel) << "<key>ExecutedLines</key>\n";
   Indent(o, IndentLevel) << "<dict>\n";
   IndentLevel++;
 
   // Mapping from file IDs to executed lines.
   const FilesToLineNumsMap &ExecutedLines = D->getExecutedLines();
-  for (auto I = ExecutedLines.begin(), E = ExecutedLines.end(); I != E; ++I) {
-    unsigned FileKey = AddFID(FM, Fids, I->first);
+  for (const auto &[FID, Lines] : ExecutedLines) {
+    unsigned FileKey = AddFID(FM, Fids, FID);
     Indent(o, IndentLevel) << "<key>" << FileKey << "</key>\n";
     Indent(o, IndentLevel) << "<array>\n";
     IndentLevel++;
-    for (unsigned LineNo : I->second) {
+    for (unsigned LineNo : Lines) {
       Indent(o, IndentLevel);
       EmitInteger(o, LineNo) << "\n";
     }
     IndentLevel--;
     Indent(o, IndentLevel) << "</array>\n";
   }
   IndentLevel--;
   Indent(o, IndentLevel) << "</dict>\n";
if (FirstNonNote != Path.begin()) {
 
     o << "   </array>\n";
   }
 
   o << "   <key>path</key>\n";
 
   o << "   <array>\n";
 
-  for (PathPieces::const_iterator E = Path.end(); I != E; ++I)
-    Printer.ReportDiag(o, **I);
+  for (const auto &Piece : llvm::make_range(I, Path.end()))
+    Printer.ReportDiag(o, *Piece);
 
   o << "   </array>\n";
 
   if (!DiagOpts.ShouldDisplayMacroExpansions)
     return;
 
   o << "   <key>macro_expansions</key>\n"
        "   <array>\n";

clang/lib/StaticAnalyzer/Core/ProgramState.cpp

 ProgramState::invalidateRegions(RegionList Regions,
                              const Expr *E, unsigned Count,
                              const LocationContext *LCtx,
                              bool CausedByPointerEscape,
                              InvalidatedSymbols *IS,
                              const CallEvent *Call,
                              RegionAndSymbolInvalidationTraits *ITraits) const {
   SmallVector<SVal, 8> Values;
-  for (RegionList::const_iterator I = Regions.begin(),
-                                  End = Regions.end(); I != End; ++I)
-    Values.push_back(loc::MemRegionVal(*I));
+  for (const MemRegion *Reg : Regions)
+    Values.push_back(loc::MemRegionVal(Reg));
 
   return invalidateRegionsImpl(Values, E, Count, LCtx, CausedByPointerEscape,
                                IS, ITraits, Call);
 }
 
 ProgramStateRef
 ProgramState::invalidateRegions(ValueList Values,
                              const Expr *E, unsigned Count,
bool ScanReachableSymbols::scan(nonloc::LazyCompoundVal val) {
   // FIXME: We don't really want to use getBaseRegion() here because pointer
   // arithmetic doesn't apply, but scanReachableSymbols only accepts base
   // regions right now.
   const MemRegion *R = val.getRegion()->getBaseRegion();
   return StoreMgr.scanReachableSymbols(val.getStore(), R, *this);
 }
 
 bool ScanReachableSymbols::scan(nonloc::CompoundVal val) {
-  for (nonloc::CompoundVal::iterator I=val.begin(), E=val.end(); I!=E; ++I)
-    if (!scan(*I))
+  for (SVal V : val)
+    if (!scan(V))
       return false;
 
   return true;
 }
 
 bool ScanReachableSymbols::scan(const SymExpr *sym) {
-  for (SymExpr::symbol_iterator SI = sym->symbol_begin(),
-                                SE = sym->symbol_end();
-       SI != SE; ++SI) {
-    bool wasVisited = !visited.insert(*SI).second;
+  for (SymbolRef SubSym : sym->symbols()) {
+    bool wasVisited = !visited.insert(SubSym).second;
     if (wasVisited)
       continue;
 
-    if (!visitor.VisitSymbol(*SI))
+    if (!visitor.VisitSymbol(SubSym))
       return false;
   }
 
   return true;
 }
 
 bool ScanReachableSymbols::scan(SVal val) {
   if (std::optional<loc::MemRegionVal> X = val.getAs<loc::MemRegionVal>())
if (isa<MemSpaceRegion>(Super)) {
       StoreManager &StoreMgr = state->getStateManager().getStoreManager();
       if (!StoreMgr.scanReachableSymbols(state->getStore(), SR, *this))
         return false;
     }
   }
 
   // Regions captured by a block are also implicitly reachable.
   if (const BlockDataRegion *BDR = dyn_cast<BlockDataRegion>(R)) {
-    BlockDataRegion::referenced_vars_iterator I = BDR->referenced_vars_begin(),
-                                              E = BDR->referenced_vars_end();
-    for ( ; I != E; ++I) {
-      if (!scan(I.getCapturedRegion()))
+    for (auto Var : BDR->referenced_vars()) {
+      if (!scan(Var.getCapturedRegion()))
         return false;
     }
   }
 
   return true;
 }
 
 bool ProgramState::scanReachableSymbols(SVal val, SymbolVisitor& visitor) const {

clang/lib/StaticAnalyzer/Core/RegionStore.cpp

 #include "clang/Basic/TargetInfo.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
 #include "llvm/ADT/ImmutableMap.h"
+#include "llvm/ADT/STLExtras.h"
 #include "llvm/Support/raw_ostream.h"
 #include <optional>
 #include <utility>
 
 using namespace clang;
 using namespace ento;
 
 //===----------------------------------------------------------------------===//
public:
   }
 
   bool isMainAnalysis() const {
     return IsMainAnalysis;
   }
 
   void printJson(raw_ostream &Out, const char *NL = "\n",
                  unsigned int Space = 0, bool IsDot = false) const {
-    for (iterator I = begin(); I != end(); ++I) {
+    for (iterator I = begin(), E = end(); I != E; ++I) {
       // TODO: We might need a .printJson for I.getKey() as well.
       Indent(Out, Space, IsDot)
           << "{ \"cluster\": \"" << I.getKey() << "\", \"pointer\": \""
           << (const void *)I.getKey() << "\", \"items\": [" << NL;
 
       ++Space;
       const ClusterBindings &CB = I.getData();
-      for (ClusterBindings::iterator CI = CB.begin(); CI != CB.end(); ++CI) {
+      for (ClusterBindings::iterator CI = CB.begin(), CE = CB.end(); CI != CE;
+           ++CI) {
         Indent(Out, Space, IsDot) << "{ " << CI.getKey() << ", \"value\": ";
         CI.getData().printJson(Out, /*AddQuotes=*/true);
         Out << " }";
-        if (std::next(CI) != CB.end())
+        if (std::next(CI) != CE)
           Out << ',';
         Out << NL;
       }
 
       --Space;
       Indent(Out, Space, IsDot) << "]}";
-      if (std::next(I) != end())
+      if (std::next(I) != E)
         Out << ',';
       Out << NL;
     }
   }
 
   LLVM_DUMP_METHOD void dump() const { printJson(llvm::errs()); }
 };
 } // end anonymous namespace
return RegionBindingsRef(
         Ptr.getInt());
   }
 
   void printJson(raw_ostream &Out, Store S, const char *NL = "\n",
                  unsigned int Space = 0, bool IsDot = false) const override;
 
   void iterBindings(Store store, BindingsHandler& f) override {
     RegionBindingsRef B = getRegionBindings(store);
-    for (RegionBindingsRef::iterator I = B.begin(), E = B.end(); I != E; ++I) {
-      const ClusterBindings &Cluster = I.getData();
-      for (ClusterBindings::iterator CI = Cluster.begin(), CE = Cluster.end();
-           CI != CE; ++CI) {
-        const BindingKey &K = CI.getKey();
-        if (!K.isDirect())
+    for (const auto &[Region, Cluster] : B) {
+      for (const auto &[Key, Value] : Cluster) {
+        if (!Key.isDirect())
           continue;
-        if (const SubRegion *R = dyn_cast<SubRegion>(K.getRegion())) {
+        if (const SubRegion *R = dyn_cast<SubRegion>(Key.getRegion())) {
           // FIXME: Possibly incorporate the offset?
-          if (!f.HandleBinding(*this, store, R, CI.getData()))
+          if (!f.HandleBinding(*this, store, R, Value))
             return;
         }
       }
     }
   }
 };
 
 } // end anonymous namespace
if (std::optional<nonloc::ConcreteInt> ExtentCI =
     assert(ExtentInt.isNonNegative() || ExtentInt.isUnsigned());
     // Extents are in bytes but region offsets are in bits. Be careful!
     Length = ExtentInt.getLimitedValue() * SVB.getContext().getCharWidth();
   } else if (const FieldRegion *FR = dyn_cast<FieldRegion>(Top)) {
     if (FR->getDecl()->isBitField())
       Length = FR->getDecl()->getBitWidthValue(SVB.getContext());
   }
 
-  for (ClusterBindings::iterator I = Cluster.begin(), E = Cluster.end();
-       I != E; ++I) {
-    BindingKey NextKey = I.getKey();
+  for (const auto &StoreEntry : Cluster) {
+    BindingKey NextKey = StoreEntry.first;
     if (NextKey.getRegion() == TopKey.getRegion()) {
       // FIXME: This doesn't catch the case where we're really invalidating a
       // region with a symbolic offset. Example:
       //      R: points[i].y
       //   Next: points[0].x
 
       if (NextKey.getOffset() > TopKey.getOffset() &&
           NextKey.getOffset() - TopKey.getOffset() < Length) {
         // Case 1: The next binding is inside the region we're invalidating.
         // Include it.
-        Bindings.push_back(*I);
+        Bindings.push_back(StoreEntry);
 
       } else if (NextKey.getOffset() == TopKey.getOffset()) {
         // Case 2: The next binding is at the same offset as the region we're
         // invalidating. In this case, we need to leave default bindings alone,
         // since they may be providing a default value for a regions beyond what
         // we're invalidating.
         // FIXME: This is probably incorrect; consider invalidating an outer
         // struct whose first field is bound to a LazyCompoundVal.
         if (IncludeAllDefaultBindings || NextKey.isDirect())
-          Bindings.push_back(*I);
+          Bindings.push_back(StoreEntry);
       }
 
     } else if (NextKey.hasSymbolicOffset()) {
       const MemRegion *Base = NextKey.getConcreteOffsetRegion();
       if (Top->isSubRegionOf(Base) && Top != Base) {
         // Case 3: The next key is symbolic and we just changed something within
         // its concrete region. We don't know if the binding is still valid, so
         // we'll be conservative and include it.
         if (IncludeAllDefaultBindings || NextKey.isDirect())
           if (isCompatibleWithFields(NextKey, FieldsInSymbolicSubregions))
-            Bindings.push_back(*I);
+            Bindings.push_back(StoreEntry);
       } else if (const SubRegion *BaseSR = dyn_cast<SubRegion>(Base)) {
         // Case 4: The next key is symbolic, but we changed a known
         // super-region. In this case the binding is certainly included.
         if (BaseSR->isSubRegionOf(Top))
           if (isCompatibleWithFields(NextKey, FieldsInSymbolicSubregions))
-            Bindings.push_back(*I);
+            Bindings.push_back(StoreEntry);
       }
     }
   }
 }
 
 static void
 collectSubRegionBindings(SmallVectorImpl<BindingPair> &Bindings,
                          SValBuilder &SVB, const ClusterBindings &Cluster,
if (!Cluster) {
     return B;
   }
 
   SmallVector<BindingPair, 32> Bindings;
   collectSubRegionBindings(Bindings, svalBuilder, *Cluster, Top, TopKey,
                            /*IncludeAllDefaultBindings=*/false);
 
   ClusterBindingsRef Result(*Cluster, CBFactory);
-  for (SmallVectorImpl<BindingPair>::const_iterator I = Bindings.begin(),
-                                                    E = Bindings.end();
-       I != E; ++I)
-    Result = Result.remove(I->first);
+  for (BindingKey Key : llvm::make_first_range(Bindings))
+    Result = Result.remove(Key);
 
   // If we're invalidating a region with a symbolic offset, we need to make sure
   // we don't treat the base region as uninitialized anymore.
   // FIXME: This isn't very precise; see the example in
   // collectSubRegionBindings.
   if (TopKey.hasSymbolicOffset()) {
     const SubRegion *Concrete = TopKey.getConcreteOffsetRegion();
     Result = Result.add(BindingKey::Make(Concrete, BindingKey::Default),

 void InvalidateRegionsWorker::VisitCluster(const MemRegion *baseR,
                                            const ClusterBindings *C) {
 
   bool PreserveRegionsContents =
       ITraits.hasTrait(baseR,
                        RegionAndSymbolInvalidationTraits::TK_PreserveContents);
 
   if (C) {
-    for (ClusterBindings::iterator I = C->begin(), E = C->end(); I != E; ++I)
-      VisitBinding(I.getData());
+    for (SVal Val : llvm::make_second_range(*C))
+      VisitBinding(Val);
 
     // Invalidate regions contents.
     if (!PreserveRegionsContents)
       B = B.remove(baseR);
   }
 
   if (const auto *TO = dyn_cast<TypedValueRegion>(baseR)) {
     if (const auto *RD = TO->getValueType()->getAsCXXRecordDecl()) {
if (const auto *RD = TO->getValueType()->getAsCXXRecordDecl()) {
         }
       }
     }
   }
 
   // BlockDataRegion?  If so, invalidate captured variables that are passed
   // by reference.
   if (const BlockDataRegion *BR = dyn_cast<BlockDataRegion>(baseR)) {
-    for (BlockDataRegion::referenced_vars_iterator
-         BI = BR->referenced_vars_begin(), BE = BR->referenced_vars_end() ;
-         BI != BE; ++BI) {
-      const VarRegion *VR = BI.getCapturedRegion();
+    for (auto Var : BR->referenced_vars()) {
+      const VarRegion *VR = Var.getCapturedRegion();
       const VarDecl *VD = VR->getDecl();
       if (VD->hasAttr<BlocksAttr>() || !VD->hasLocalStorage()) {
         AddToWorkList(VR);
       }
       else if (Loc::isLocType(VR->getValueType())) {
         // Map the current bindings to a Store to retrieve the value
         // of the binding.  If that binding itself is a region, we should
         // invalidate that region.  This is because a block may capture
if (doNotInvalidateSuperRegion) {
       // or have a symbolic offset.
       if (!SuperR)
         goto conjure_default;
 
       const ClusterBindings *C = B.lookup(SuperR);
       if (!C)
         goto conjure_default;
 
-      for (ClusterBindings::iterator I = C->begin(), E = C->end(); I != E;
-           ++I) {
-        const BindingKey &BK = I.getKey();
+      for (const auto &[BK, V] : *C) {
         std::optional<uint64_t> ROffset =
             BK.hasSymbolicOffset() ? std::optional<uint64_t>() : BK.getOffset();
 
         // Check offset is not symbolic and within array's boundaries.
         // Handles arrays of 0 elements and of 0-sized elements as well.
         if (!ROffset ||
             ((*ROffset >= LowerOffset && *ROffset < UpperOffset) ||
              (UpperOverflow &&
               (*ROffset >= LowerOffset || *ROffset < UpperOffset)) ||
              (LowerOffset == UpperOffset && *ROffset == LowerOffset))) {
-          B = B.removeBinding(I.getKey());
+          B = B.removeBinding(BK);
           // Bound symbolic regions need to be invalidated for dead symbol
           // detection.
-          SVal V = I.getData();
           const MemRegion *R = V.getAsRegion();
           if (isa_and_nonnull<SymbolicRegion>(R))
             VisitBinding(V);
         }
       }
     }
   conjure_default:
       // Set the default value of the array to conjured symbol.
if (Invalidated)
     Invalidated->push_back(GS);
 
   return B;
 }
 
 void RegionStoreManager::populateWorkList(InvalidateRegionsWorker &W,
                                           ArrayRef<SVal> Values,
                                           InvalidatedRegions *TopLevelRegions) {
-  for (ArrayRef<SVal>::iterator I = Values.begin(),
-                                E = Values.end(); I != E; ++I) {
-    SVal V = *I;
-    if (std::optional<nonloc::LazyCompoundVal> LCS =
-            V.getAs<nonloc::LazyCompoundVal>()) {
-
+  for (SVal V : Values) {
+    if (auto LCS = V.getAs<nonloc::LazyCompoundVal>()) {
       for (SVal S : getInterestingValues(*LCS))
         if (const MemRegion *R = S.getAsRegion())
           W.AddToWorkList(R);
 
       continue;
     }
 
     if (const MemRegion *R = V.getAsRegion()) {
RegionStoreManager::getInterestingValues(nonloc::LazyCompoundVal LCV) {
   // values to return.
   const ClusterBindings *Cluster = B.lookup(LazyR->getBaseRegion());
   if (!Cluster)
     return (LazyBindingsMap[LCV.getCVData()] = std::move(List));
 
   SmallVector<BindingPair, 32> Bindings;
   collectSubRegionBindings(Bindings, svalBuilder, *Cluster, LazyR,
                            /*IncludeAllDefaultBindings=*/true);
-  for (SmallVectorImpl<BindingPair>::const_iterator I = Bindings.begin(),
-                                                    E = Bindings.end();
-       I != E; ++I) {
-    SVal V = I->second;
+  for (SVal V : llvm::make_second_range(Bindings)) {
     if (V.isUnknownOrUndef() || V.isConstant())
       continue;
 
     if (auto InnerLCV = V.getAs<nonloc::LazyCompoundVal>()) {
       const SValListTy &InnerList = getInterestingValues(*InnerLCV);
       List.insert(List.end(), InnerList.begin(), InnerList.end());
     }
 
for (const auto *FD : RD->fields()) {
     if (!(Ty->isScalarType() || Ty->isReferenceType()))
       return std::nullopt;
 
     Fields.push_back(FD);
   }
 
   RegionBindingsRef NewB = B;
 
-  for (FieldVector::iterator I = Fields.begin(), E = Fields.end(); I != E; ++I){
-    const FieldRegion *SourceFR = MRMgr.getFieldRegion(*I, LCV.getRegion());
+  for (const FieldDecl *Field : Fields) {
+    const FieldRegion *SourceFR = MRMgr.getFieldRegion(Field, LCV.getRegion());
     SVal V = getBindingForField(getRegionBindings(LCV.getStore()), SourceFR);
 
-    const FieldRegion *DestFR = MRMgr.getFieldRegion(*I, R);
+    const FieldRegion *DestFR = MRMgr.getFieldRegion(Field, R);
     NewB = bind(NewB, loc::MemRegionVal(DestFR), V);
   }
 
   return NewB;
 }
 
 RegionBindingsRef RegionStoreManager::bindStruct(RegionBindingsConstRef B,
                                                  const TypedValueRegion *R,
void RemoveDeadBindingsWorker::VisitCluster(const MemRegion *baseR,
   if (!C)
     return;
 
   // Mark the symbol for any SymbolicRegion with live bindings as live itself.
   // This means we should continue to track that symbol.
   if (const SymbolicRegion *SymR = dyn_cast<SymbolicRegion>(baseR))
     SymReaper.markLive(SymR->getSymbol());
 
-  for (ClusterBindings::iterator I = C->begin(), E = C->end(); I != E; ++I) {
+  for (const auto &[Key, Val] : *C) {
     // Element index of a binding key is live.
-    SymReaper.markElementIndicesLive(I.getKey().getRegion());
+    SymReaper.markElementIndicesLive(Key.getRegion());
 
-    VisitBinding(I.getData());
+    VisitBinding(Val);
   }
 }
 
 void RemoveDeadBindingsWorker::VisitBinding(SVal V) {
   // Is it a LazyCompoundVal? All referenced regions are live as well.
   // The LazyCompoundVal itself is not live but should be readable.
   if (auto LCS = V.getAs<nonloc::LazyCompoundVal>()) {
     SymReaper.markLazilyCopied(LCS->getRegion());
void RemoveDeadBindingsWorker::VisitBinding(SVal V) {
 
   // If V is a region, then add it to the worklist.
   if (const MemRegion *R = V.getAsRegion()) {
     AddToWorkList(R);
     SymReaper.markLive(R);
 
     // All regions captured by a block are also live.
     if (const BlockDataRegion *BR = dyn_cast<BlockDataRegion>(R)) {
-      BlockDataRegion::referenced_vars_iterator I = BR->referenced_vars_begin(),
-                                                E = BR->referenced_vars_end();
-      for ( ; I != E; ++I)
-        AddToWorkList(I.getCapturedRegion());
+      for (auto Var : BR->referenced_vars())
+        AddToWorkList(Var.getCapturedRegion());
     }
   }
 
 
   // Update the set of live symbols.
-  for (auto SI = V.symbol_begin(), SE = V.symbol_end(); SI!=SE; ++SI)
-    SymReaper.markLive(*SI);
+  for (SymbolRef Sym : V.symbols())
+    SymReaper.markLive(Sym);
 }
 
 bool RemoveDeadBindingsWorker::UpdatePostponed() {
   // See if any postponed SymbolicRegions are actually live now, after
   // having done a scan.
   bool Changed = false;
 
-  for (auto I = Postponed.begin(), E = Postponed.end(); I != E; ++I) {
-    if (const SymbolicRegion *SR = *I) {
-      if (SymReaper.isLive(SR->getSymbol())) {
-        Changed |= AddToWorkList(SR);
-        *I = nullptr;
-      }
+  for (const SymbolicRegion *SR : Postponed) {
+      SR = nullptr;
     }
   }
 
   return Changed;
 }
 
 StoreRef RegionStoreManager::removeDeadBindings(Store store,
                                                 const StackFrameContext *LCtx,
                                                 SymbolReaper& SymReaper) {
   RegionBindingsRef B = getRegionBindings(store);
   RemoveDeadBindingsWorker W(*this, StateMgr, B, SymReaper, LCtx);
   W.GenerateClusters();
 
   // Enqueue the region roots onto the worklist.
-  for (SymbolReaper::region_iterator I = SymReaper.region_begin(),
-       E = SymReaper.region_end(); I != E; ++I) {
-    W.AddToWorkList(*I);
+  for (const MemRegion *Reg : SymReaper.regions()) {
+    W.AddToWorkList(Reg);
   }
 
   do W.RunWorkList(); while (W.UpdatePostponed());
 
   // We have now scanned the store, marking reachable regions and symbols
   // as live.  We now remove all the regions that are dead from the store
   // as well as update DSymbols with the set symbols that are now dead.
-  for (RegionBindingsRef::iterator I = B.begin(), E = B.end(); I != E; ++I) {
-    const MemRegion *Base = I.getKey();
-
+  for (const MemRegion *Base : llvm::make_first_range(B)) {
     // If the cluster has been visited, we know the region has been marked.
     // Otherwise, remove the dead entry.
     if (!W.isVisited(Base))
       B = B.remove(Base);
   }
 
   return StoreRef(B.asStore(), *this);
 }

clang/lib/StaticAnalyzer/Core/Store.cpp

 SVal StoreManager::evalDerivedToBase(SVal Derived, const CastExpr *Cast) {
   // Early return to avoid doing the wrong thing in the face of
   // reinterpret_cast.
   if (!regionMatchesCXXRecordType(Derived, Cast->getSubExpr()->getType()))
     return UnknownVal();
 
   // Walk through the cast path to create nested CXXBaseRegions.
   SVal Result = Derived;
-  for (CastExpr::path_const_iterator I = Cast->path_begin(),
-                                     E = Cast->path_end();
-       I != E; ++I) {
-    Result = evalDerivedToBase(Result, (*I)->getType(), (*I)->isVirtual());
+  for (const CXXBaseSpecifier *Base : Cast->path()) {
+    Result = evalDerivedToBase(Result, Base->getType(), Base->isVirtual());
   }
   return Result;
 }
 
 SVal StoreManager::evalDerivedToBase(SVal Derived, const CXXBasePath &Path) {
   // Walk through the path to create nested CXXBaseRegions.
   SVal Result = Derived;
   for (const auto &I : Path)

clang/lib/StaticAnalyzer/Core/SymbolManager.cpp

void SymbolReaper::markLazilyCopied(const clang::ento::MemRegion *region) {
   LazilyCopiedRegionRoots.insert(region->getBaseRegion());
 }
 
 void SymbolReaper::markElementIndicesLive(const MemRegion *region) {
   for (auto SR = dyn_cast<SubRegion>(region); SR;
        SR = dyn_cast<SubRegion>(SR->getSuperRegion())) {
     if (const auto ER = dyn_cast<ElementRegion>(SR)) {
       SVal Idx = ER->getIndex();
-      for (auto SI = Idx.symbol_begin(), SE = Idx.symbol_end(); SI != SE; ++SI)
-        markLive(*SI);
+      for (SymbolRef Sym : Idx.symbols())
+        markLive(Sym);
     }
   }
 }
 
 void SymbolReaper::markInUse(SymbolRef sym) {
   if (isa<SymbolMetadata>(sym))
     MetadataInUse.insert(sym);
 }

clang/lib/StaticAnalyzer/Core/TextDiagnostics.cpp

auto reportPiece = [&](unsigned ID, FullSourceLoc Loc, StringRef String,
 
         if (llvm::Error Err = Repls.add(Repl)) {
           llvm::errs() << "Error applying replacement " << Repl.toString()
                        << ": " << Err << "\n";
         }
       }
     };
 
-    for (std::vector<const PathDiagnostic *>::iterator I = Diags.begin(),
-         E = Diags.end();
-         I != E; ++I) {
-      const PathDiagnostic *PD = *I;
+    for (const PathDiagnostic *PD : Diags) {
       std::string WarningMsg = (DiagOpts.ShouldDisplayDiagnosticName
                                     ? " [" + PD->getCheckerName() + "]"
                                     : "")
                                    .str();
 
       reportPiece(WarnID, PD->getLocation().asLocation(),
                   (PD->getShortDescription() + WarningMsg).str(),
                   PD->path.back()->getRanges(), PD->path.back()->getFixits());

clang/lib/StaticAnalyzer/Frontend/ModelConsumer.cpp

 #include "clang/AST/DeclGroup.h"
 
 using namespace clang;
 using namespace ento;
 
 ModelConsumer::ModelConsumer(llvm::StringMap<Stmt *> &Bodies)
     : Bodies(Bodies) {}
 
-bool ModelConsumer::HandleTopLevelDecl(DeclGroupRef D) {
-  for (DeclGroupRef::iterator I = D.begin(), E = D.end(); I != E; ++I) {
-
+bool ModelConsumer::HandleTopLevelDecl(DeclGroupRef DeclGroup) {
+  for (const Decl *D : DeclGroup) {
     // Only interested in definitions.
-    const FunctionDecl *func = llvm::dyn_cast<FunctionDecl>(*I);
+    const auto *func = llvm::dyn_cast<FunctionDecl>(D);
     if (func && func->hasBody()) {
       Bodies.insert(std::make_pair(func->getName(), func->getBody()));
     }
   }
   return true;
 }