[analyzer][NFC] Remove useless class BuiltinBug

[donat.nagy]

Summary

...because it provides no useful functionality compared to its base class BugType.

A long time ago there were substantial differences between BugType and BuiltinBug, but they were eliminated by commit 1bd58233 in 2009 (!). Since then the only functionality provided by BuiltinBug was that it specified categories::LogicError as the bug category and it stored an extra data member desc.

This commit sets categories::LogicError as the default value of the third argument (bug category) in the constructors of BugType and replaces use of the desc field with simpler logic.

Note that BugType has a data member Description and a non-virtual method BugType::getDescription() which queries it; these are distinct from the member desc of BuiltinBug and the shadowing method BuiltinBug::getDescription() which queries it. This confusing name collision was a major motivation for the elimination of BuiltinBug.

As this commit touches many files, I avoided functional changes and left behind several FIXME notes on messages that should be improved later.

[donat.nagy]

clang/lib/StaticAnalyzer/Checkers/ArrayBoundCheckerV2.cpp

35–36

This inconsistency is the "original target" of this commit. I wanted to unify the two types of bug report creation ("regular" and tainted) and as I examined the situation I noticed that BuiltinBug isa confusing mess and it's always easy to replace it with BugType.

[xazax.hun]

clang/lib/StaticAnalyzer/Checkers/BoolAssignmentChecker.cpp

27

In case you are down to some additional cleanup efforts, we no longer need lazy initialization for BugTypes. This is an old pattern, we used to need it due to some initialization order problems, but those have been worked around in engine. See the FuchsiaHandleChecker as an example how we do it in newer checks: https://github.com/llvm/llvm-project/blob/ea82a822d990824c58c6fa4b503ca84c4870c940/clang/lib/StaticAnalyzer/Checkers/FuchsiaHandleChecker.cpp#L190

Feel free to ignore this or do it in a follow-up PR.

[donat.nagy]

clang/lib/StaticAnalyzer/Checkers/BoolAssignmentChecker.cpp

27

Great news! I'll keep it in mind and I'll try to do this clean-up if I have enough free time.

[steakhal]

I haven't checked the details, but it makes sense.
It's reassuring that all the tests pass :D, which is good enough for me.

Thanks for the cleanup!

clang/include/clang/StaticAnalyzer/Core/BugReporter/BugType.h

private:
   const std::string Description;
   const std::string Category;
   const CheckerBase *Checker;
   bool SuppressOnSink;
 
   virtual void anchor();
 
 public:
-  BugType(CheckerNameRef CheckerName, StringRef Name, StringRef Cat,
-          bool SuppressOnSink = false)
-      : CheckerName(CheckerName), Description(Name), Category(Cat),
+  BugType(CheckerNameRef CheckerName, StringRef Desc,
+          StringRef Cat = categories::LogicError, bool SuppressOnSink = false)
+      : CheckerName(CheckerName), Description(Desc), Category(Cat),
         Checker(nullptr), SuppressOnSink(SuppressOnSink) {}
-  BugType(const CheckerBase *Checker, StringRef Name, StringRef Cat,
-          bool SuppressOnSink = false)
-      : CheckerName(Checker->getCheckerName()), Description(Name),
+  BugType(const CheckerBase *Checker, StringRef Desc,
+          StringRef Cat = categories::LogicError, bool SuppressOnSink = false)
+      : CheckerName(Checker->getCheckerName()), Description(Desc),
         Category(Cat), Checker(Checker), SuppressOnSink(SuppressOnSink) {}
   virtual ~BugType() = default;
 
   StringRef getDescription() const { return Description; }
   StringRef getCategory() const { return Category; }
   StringRef getCheckerName() const {
     // FIXME: This is a workaround to ensure that the correct checerk name is
     // used. The checker names are set after the constructors are run.
     // In case the BugType object is initialized in the checker's ctor
     // the CheckerName field will be empty. To circumvent this problem we use
     // CheckerBase whenever it is possible.
     StringRef Ret = Checker ? Checker->getCheckerName() : CheckerName;
     assert(!Ret.empty() && "Checker name is not set properly.");
     return Ret;
   }
 
   /// isSuppressOnSink - Returns true if bug reports associated with this bug
   ///  type should be suppressed if the end node of the report is post-dominated
   ///  by a sink node.
   bool isSuppressOnSink() const { return SuppressOnSink; }
 };
 
-class BuiltinBug : public BugType {
-  const std::string desc;
-  void anchor() override;
-public:
-  BuiltinBug(class CheckerNameRef checker, const char *name,
-             const char *description)
-      : BugType(checker, name, categories::LogicError), desc(description) {}
-
-  BuiltinBug(const CheckerBase *checker, const char *name,
-             const char *description)
-      : BugType(checker, name, categories::LogicError), desc(description) {}
-
-  BuiltinBug(class CheckerNameRef checker, const char *name)
-      : BugType(checker, name, categories::LogicError), desc(name) {}
-
-  BuiltinBug(const CheckerBase *checker, const char *name)
-      : BugType(checker, name, categories::LogicError), desc(name) {}
-
-  StringRef getDescription() const { return desc; }
-};
-
 } // namespace ento
 
 } // end clang namespace
 #endif

clang/lib/StaticAnalyzer/Checkers/ArrayBoundChecker.cpp

 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
 
 using namespace clang;
 using namespace ento;
 
 namespace {
 class ArrayBoundChecker :
     public Checker<check::Location> {
-  mutable std::unique_ptr<BuiltinBug> BT;
+  mutable std::unique_ptr<BugType> BT;
 
 public:
   void checkLocation(SVal l, bool isLoad, const Stmt* S,
                      CheckerContext &C) const;
 };
 }
 
 void ArrayBoundChecker::checkLocation(SVal l, bool isLoad, const Stmt* LoadS,
void ArrayBoundChecker::checkLocation(SVal l, bool isLoad, const Stmt* LoadS,
   ProgramStateRef StInBound, StOutBound;
   std::tie(StInBound, StOutBound) = state->assumeInBoundDual(Idx, ElementCount);
   if (StOutBound && !StInBound) {
     ExplodedNode *N = C.generateErrorNode(StOutBound);
     if (!N)
       return;
 
     if (!BT)
-      BT.reset(new BuiltinBug(
-          this, "Out-of-bound array access",
-          "Access out-of-bound array element (buffer overflow)"));
+      BT.reset(new BugType(this, "Out-of-bound array access"));
 
     // FIXME: It would be nice to eventually make this diagnostic more clear,
     // e.g., by referencing the original declaration or by saying *why* this
     // reference is outside the range.
 
     // Generate a report for this bug.
-    auto report =
-        std::make_unique<PathSensitiveBugReport>(*BT, BT->getDescription(), N);
+    auto report = std::make_unique<PathSensitiveBugReport>(
+        *BT, "Access out-of-bound array element (buffer overflow)", N);
 
     report->addRange(LoadS->getSourceRange());
     C.emitReport(std::move(report));
     return;
   }
 
   // Array bound check succeeded.  From this point forward the array bound
   // should always succeed.

clang/lib/StaticAnalyzer/Checkers/ArrayBoundCheckerV2.cpp

 
 using namespace clang;
 using namespace ento;
 using namespace taint;
 
 namespace {
 class ArrayBoundCheckerV2 :
     public Checker<check::Location> {
-  mutable std::unique_ptr<BuiltinBug> BT;
+  mutable std::unique_ptr<BugType> BT;
   mutable std::unique_ptr<BugType> TaintBT;
 
   enum OOB_Kind { OOB_Precedes, OOB_Excedes };
 
   void reportOOB(CheckerContext &C, ProgramStateRef errorState,
                  OOB_Kind kind) const;
   void reportTaintOOB(CheckerContext &C, ProgramStateRef errorState,
                       SVal TaintedSVal) const;
 
void ArrayBoundCheckerV2::reportOOB(CheckerContext &checkerContext,
                                     ProgramStateRef errorState,
                                     OOB_Kind kind) const {
 
   ExplodedNode *errorNode = checkerContext.generateErrorNode(errorState);
   if (!errorNode)
     return;
 
   if (!BT)
-    BT.reset(new BuiltinBug(this, "Out-of-bound access"));
+    BT.reset(new BugType(this, "Out-of-bound access"));
 
   // FIXME: This diagnostics are preliminary.  We should get far better
   // diagnostics for explaining buffer overruns.
 
   SmallString<256> buf;
   llvm::raw_svector_ostream os(buf);
   os << "Out of bound memory access ";
   switch (kind) {

clang/lib/StaticAnalyzer/Checkers/BoolAssignmentChecker.cpp

 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include <optional>
 
 using namespace clang;
 using namespace ento;
 
 namespace {
   class BoolAssignmentChecker : public Checker< check::Bind > {
-    mutable std::unique_ptr<BuiltinBug> BT;
+    mutable std::unique_ptr<BugType> BT;
     void emitReport(ProgramStateRef state, CheckerContext &C,
                     bool IsTainted = false) const;
 
   public:
     void checkBind(SVal loc, SVal val, const Stmt *S, CheckerContext &C) const;
   };
 } // end anonymous namespace
 
 void BoolAssignmentChecker::emitReport(ProgramStateRef state, CheckerContext &C,
                                        bool IsTainted) const {
   if (ExplodedNode *N = C.generateNonFatalErrorNode(state)) {
     if (!BT)
-      BT.reset(new BuiltinBug(this, "Assignment of a non-Boolean value"));
+      BT.reset(new BugType(this, "Assignment of a non-Boolean value"));
 
     StringRef Msg = IsTainted ? "Might assign a tainted non-Boolean value"
                               : "Assignment of a non-Boolean value";
     C.emitReport(std::make_unique<PathSensitiveBugReport>(*BT, Msg, N));
   }
 }
 
 static bool isBooleanType(QualType Ty) {

clang/lib/StaticAnalyzer/Checkers/CStringChecker.cpp

void CStringChecker::emitOverlapBug(CheckerContext &C, ProgramStateRef state,
   report->addRange(Second->getSourceRange());
 
   C.emitReport(std::move(report));
 }
 
 void CStringChecker::emitNullArgBug(CheckerContext &C, ProgramStateRef State,
                                     const Stmt *S, StringRef WarningMsg) const {
   if (ExplodedNode *N = C.generateErrorNode(State)) {
-    if (!BT_Null)
-      BT_Null.reset(new BuiltinBug(
-          Filter.CheckNameCStringNullArg, categories::UnixAPI,
-          "Null pointer argument in call to byte string function"));
+    if (!BT_Null) {
+      // FIXME: This call uses the string constant 'categories::UnixAPI' as the
+      // description of the bug; it should be replaced by a real description.
+      BT_Null.reset(
+          new BugType(Filter.CheckNameCStringNullArg, categories::UnixAPI));
+    }
 
-    BuiltinBug *BT = static_cast<BuiltinBug *>(BT_Null.get());
-    auto Report = std::make_unique<PathSensitiveBugReport>(*BT, WarningMsg, N);
+    auto Report =
+        std::make_unique<PathSensitiveBugReport>(*BT_Null, WarningMsg, N);
     Report->addRange(S->getSourceRange());
     if (const auto *Ex = dyn_cast<Expr>(S))
       bugreporter::trackExpressionValue(N, Ex, *Report);
     C.emitReport(std::move(Report));
   }
 }
 
 void CStringChecker::emitUninitializedReadBug(CheckerContext &C,
                                               ProgramStateRef State,
                                               const Expr *E) const {
   if (ExplodedNode *N = C.generateErrorNode(State)) {
     const char *Msg =
         "Bytes string function accesses uninitialized/garbage values";
     if (!BT_UninitRead)
-      BT_UninitRead.reset(
-          new BuiltinBug(Filter.CheckNameCStringUninitializedRead,
-                         "Accessing unitialized/garbage values", Msg));
+      BT_UninitRead.reset(new BugType(Filter.CheckNameCStringUninitializedRead,
+                                      "Accessing unitialized/garbage values"));
 
-    BuiltinBug *BT = static_cast<BuiltinBug *>(BT_UninitRead.get());
-
-    auto Report = std::make_unique<PathSensitiveBugReport>(*BT, Msg, N);
+    auto Report =
+        std::make_unique<PathSensitiveBugReport>(*BT_UninitRead, Msg, N);
     Report->addRange(E->getSourceRange());
     bugreporter::trackExpressionValue(N, E, *Report);
     C.emitReport(std::move(Report));
   }
 }
 
 void CStringChecker::emitOutOfBoundsBug(CheckerContext &C,
                                         ProgramStateRef State, const Stmt *S,
                                         StringRef WarningMsg) const {
   if (ExplodedNode *N = C.generateErrorNode(State)) {
     if (!BT_Bounds)
-      BT_Bounds.reset(new BuiltinBug(
-          Filter.CheckCStringOutOfBounds ? Filter.CheckNameCStringOutOfBounds
-                                         : Filter.CheckNameCStringNullArg,
-          "Out-of-bound array access",
-          "Byte string function accesses out-of-bound array element"));
-
-    BuiltinBug *BT = static_cast<BuiltinBug *>(BT_Bounds.get());
+      BT_Bounds.reset(new BugType(Filter.CheckCStringOutOfBounds
+                                      ? Filter.CheckNameCStringOutOfBounds
+                                  "Out-of-bound array access"));
 
     // FIXME: It would be nice to eventually make this diagnostic more clear,
     // e.g., by referencing the original declaration or by saying *why* this
     // reference is outside the range.
-    auto Report = std::make_unique<PathSensitiveBugReport>(*BT, WarningMsg, N);
+    auto Report =
+        std::make_unique<PathSensitiveBugReport>(*BT_Bounds, WarningMsg, N);
     Report->addRange(S->getSourceRange());
     C.emitReport(std::move(Report));
   }
 }
 
 void CStringChecker::emitNotCStringBug(CheckerContext &C, ProgramStateRef State,
                                        const Stmt *S,
                                        StringRef WarningMsg) const {
   if (ExplodedNode *N = C.generateNonFatalErrorNode(State)) {
-    if (!BT_NotCString)
-      BT_NotCString.reset(new BuiltinBug(
-          Filter.CheckNameCStringNotNullTerm, categories::UnixAPI,
-          "Argument is not a null-terminated string."));
+    if (!BT_NotCString) {
+      // FIXME: This call uses the string constant 'categories::UnixAPI' as the
+      // description of the bug; it should be replaced by a real description.
+      BT_NotCString.reset(
+          new BugType(Filter.CheckNameCStringNotNullTerm, categories::UnixAPI));
+    }
 
     auto Report =
         std::make_unique<PathSensitiveBugReport>(*BT_NotCString, WarningMsg, N);
 
     Report->addRange(S->getSourceRange());
     C.emitReport(std::move(Report));
   }
 }
 
 void CStringChecker::emitAdditionOverflowBug(CheckerContext &C,
                                              ProgramStateRef State) const {
   if (ExplodedNode *N = C.generateErrorNode(State)) {
-    if (!BT_AdditionOverflow)
+    if (!BT_AdditionOverflow) {
+      // FIXME: This call uses the word "API" as the description of the bug;
+      // it should be replaced by a better error message (if this unlikely
+      // situation continues to exist as a separate bug type).
       BT_AdditionOverflow.reset(
-          new BuiltinBug(Filter.CheckNameCStringOutOfBounds, "API",
-                         "Sum of expressions causes overflow."));
+          new BugType(Filter.CheckNameCStringOutOfBounds, "API"));
+    }
 
     // This isn't a great error message, but this should never occur in real
     // code anyway -- you'd have to create a buffer longer than a size_t can
     // represent, which is sort of a contradiction.
     const char *WarningMsg =
         "This expression will create a string whose length is too big to "
         "be represented as a size_t";
 

clang/lib/StaticAnalyzer/Checkers/CallAndMessageChecker.cpp

void emitNilReceiverBug(CheckerContext &C, const ObjCMethodCall &msg,
                           ExplodedNode *N) const;
 
   void HandleNilReceiver(CheckerContext &C,
                          ProgramStateRef state,
                          const ObjCMethodCall &msg) const;
 
   void LazyInit_BT(const char *desc, std::unique_ptr<BugType> &BT) const {
     if (!BT)
-      BT.reset(new BuiltinBug(OriginalName, desc));
+      BT.reset(new BugType(OriginalName, desc));
   }
   bool uninitRefOrPointer(CheckerContext &C, const SVal &V,
                           SourceRange ArgRange, const Expr *ArgEx,
                           std::unique_ptr<BugType> &BT,
                           const ParmVarDecl *ParamDecl, const char *BD,
                           int ArgumentNumber) const;
 };
 } // end anonymous namespace
ProgramStateRef CallAndMessageChecker::checkFunctionPointerCall(
   SVal L = State->getSVal(Callee, LCtx);
 
   if (L.isUndef()) {
     if (!ChecksEnabled[CK_FunctionPointer]) {
       C.addSink(State);
       return nullptr;
     }
     if (!BT_call_undef)
-      BT_call_undef.reset(new BuiltinBug(
+      BT_call_undef.reset(new BugType(
           OriginalName,
           "Called function pointer is an uninitialized pointer value"));
     emitBadCall(BT_call_undef.get(), C, Callee);
     return nullptr;
   }
 
   ProgramStateRef StNonNull, StNull;
   std::tie(StNonNull, StNull) = State->assume(L.castAs<DefinedOrUnknownSVal>());
 
   if (StNull && !StNonNull) {
     if (!ChecksEnabled[CK_FunctionPointer]) {
       C.addSink(StNull);
       return nullptr;
     }
     if (!BT_call_null)
-      BT_call_null.reset(new BuiltinBug(
+      BT_call_null.reset(new BugType(
           OriginalName, "Called function pointer is null (null dereference)"));
     emitBadCall(BT_call_null.get(), C, Callee);
     return nullptr;
   }
 
   return StNonNull;
 }
 
ProgramStateRef CallAndMessageChecker::checkCXXMethodCall(
 
   SVal V = CC->getCXXThisVal();
   if (V.isUndef()) {
     if (!ChecksEnabled[CK_CXXThisMethodCall]) {
       C.addSink(State);
       return nullptr;
     }
     if (!BT_cxx_call_undef)
-      BT_cxx_call_undef.reset(new BuiltinBug(
+      BT_cxx_call_undef.reset(new BugType(
           OriginalName, "Called C++ object pointer is uninitialized"));
     emitBadCall(BT_cxx_call_undef.get(), C, CC->getCXXThisExpr());
     return nullptr;
   }
 
   ProgramStateRef StNonNull, StNull;
   std::tie(StNonNull, StNull) = State->assume(V.castAs<DefinedOrUnknownSVal>());
 
   if (StNull && !StNonNull) {
     if (!ChecksEnabled[CK_CXXThisMethodCall]) {
       C.addSink(StNull);
       return nullptr;
     }
     if (!BT_cxx_call_null)
       BT_cxx_call_null.reset(
-          new BuiltinBug(OriginalName, "Called C++ object pointer is null"));
+          new BugType(OriginalName, "Called C++ object pointer is null"));
     emitBadCall(BT_cxx_call_null.get(), C, CC->getCXXThisExpr());
     return nullptr;
   }
 
   return StNonNull;
 }
 
 ProgramStateRef
CallAndMessageChecker::checkCXXDeallocation(const CXXDeallocatorCall *DC,
   }
 
   StringRef Desc;
   ExplodedNode *N = C.generateErrorNode();
   if (!N)
     return nullptr;
   if (!BT_cxx_delete_undef)
     BT_cxx_delete_undef.reset(
-        new BuiltinBug(OriginalName, "Uninitialized argument value"));
+        new BugType(OriginalName, "Uninitialized argument value"));
   if (DE->isArrayFormAsWritten())
     Desc = "Argument to 'delete[]' is uninitialized";
   else
     Desc = "Argument to 'delete' is uninitialized";
-  BugType *BT = BT_cxx_delete_undef.get();
-  auto R = std::make_unique<PathSensitiveBugReport>(*BT, Desc, N);
+  auto R =
+      std::make_unique<PathSensitiveBugReport>(*BT_cxx_delete_undef, Desc, N);
   bugreporter::trackExpressionValue(N, DE, *R);
   C.emitReport(std::move(R));
   return nullptr;
 }
 
 ProgramStateRef CallAndMessageChecker::checkArgInitializedness(
     const CallEvent &Call, CheckerContext &C, ProgramStateRef State) const {
 
if (!ChecksEnabled[CK_UndefReceiver]) {
       C.addSink();
       return;
     }
     if (ExplodedNode *N = C.generateErrorNode()) {
       BugType *BT = nullptr;
       switch (msg.getMessageKind()) {
       case OCM_Message:
         if (!BT_msg_undef)
-          BT_msg_undef.reset(new BuiltinBug(OriginalName,
-                                            "Receiver in message expression "
-                                            "is an uninitialized value"));
+          BT_msg_undef.reset(new BugType(OriginalName,
         BT = BT_msg_undef.get();
         break;
       case OCM_PropertyAccess:
         if (!BT_objc_prop_undef)
-          BT_objc_prop_undef.reset(new BuiltinBug(
+          BT_objc_prop_undef.reset(new BugType(
               OriginalName,
               "Property access on an uninitialized object pointer"));
         BT = BT_objc_prop_undef.get();
         break;
       case OCM_Subscript:
         if (!BT_objc_subscript_undef)
-          BT_objc_subscript_undef.reset(new BuiltinBug(
+          BT_objc_subscript_undef.reset(new BugType(
               OriginalName,
               "Subscript access on an uninitialized object pointer"));
         BT = BT_objc_subscript_undef.get();
         break;
       }
       assert(BT && "Unknown message kind.");
 
       auto R = std::make_unique<PathSensitiveBugReport>(*BT, BT->getDescription(), N);
void CallAndMessageChecker::emitNilReceiverBug(CheckerContext &C,
                                                const ObjCMethodCall &msg,
                                                ExplodedNode *N) const {
   if (!ChecksEnabled[CK_NilReceiver]) {
     C.addSink();
     return;
   }
 
   if (!BT_msg_ret)
-    BT_msg_ret.reset(new BuiltinBug(OriginalName,
-                                    "Receiver in message expression is 'nil'"));
+    BT_msg_ret.reset(
+        new BugType(OriginalName, "Receiver in message expression is 'nil'"));
 
   const ObjCMessageExpr *ME = msg.getOriginExpr();
 
   QualType ResTy = msg.getResultType();
 
   SmallString<200> buf;
   llvm::raw_svector_ostream os(buf);
   os << "The receiver of message '";

clang/lib/StaticAnalyzer/Checkers/CastSizeChecker.cpp

 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/DynamicExtent.h"
 
 using namespace clang;
 using namespace ento;
 
 namespace {
 class CastSizeChecker : public Checker< check::PreStmt<CastExpr> > {
-  mutable std::unique_ptr<BuiltinBug> BT;
+  mutable std::unique_ptr<BugType> BT;
 
 public:
   void checkPreStmt(const CastExpr *CE, CheckerContext &C) const;
 };
 }
 
 /// Check if we are casting to a struct with a flexible array at the end.
 /// \code
void CastSizeChecker::checkPreStmt(const CastExpr *CE,CheckerContext &C) const {
   if (regionSize % typeSize == 0)
     return;
 
   if (evenFlexibleArraySize(Ctx, regionSize, typeSize, ToPointeeTy))
     return;
 
   if (ExplodedNode *errorNode = C.generateErrorNode()) {
     if (!BT)
-      BT.reset(new BuiltinBug(this, "Cast region with wrong size.",
-                                    "Cast a region whose size is not a multiple"
-                                    " of the destination type size."));
-    auto R = std::make_unique<PathSensitiveBugReport>(*BT, BT->getDescription(),
-                                                      errorNode);
+      BT.reset(new BugType(this, "Cast region with wrong size."));
+    constexpr llvm::StringLiteral Msg =
+        "Cast a region whose size is not a multiple of the destination type "
+        "size.";
+    auto R = std::make_unique<PathSensitiveBugReport>(*BT, Msg, errorNode);
     R->addRange(CE->getSourceRange());
     C.emitReport(std::move(R));
   }
 }
 
 void ento::registerCastSizeChecker(CheckerManager &mgr) {
   mgr.registerChecker<CastSizeChecker>();
 }

clang/lib/StaticAnalyzer/Checkers/ChrootChecker.cpp

 // The state transition:
 // NO_CHROOT ---chroot(path)--> ROOT_CHANGED ---chdir(/) --> JAIL_ENTERED
 //                                  |                               |
 //         ROOT_CHANGED<--chdir(..)--      JAIL_ENTERED<--chdir(..)--
 //                                  |                               |
 //                      bug<--foo()--          JAIL_ENTERED<--foo()--
 class ChrootChecker : public Checker<eval::Call, check::PreCall> {
   // This bug refers to possibly break out of a chroot() jail.
-  mutable std::unique_ptr<BuiltinBug> BT_BreakJail;
+  mutable std::unique_ptr<BugType> BT_BreakJail;
 
   const CallDescription Chroot{{"chroot"}, 1}, Chdir{{"chdir"}, 1};
 
 public:
   ChrootChecker() {}
 
   static void *getTag() {
     static int x;
if (matchesAny(Call, Chroot, Chdir))
     return;
 
   // If jail state is ROOT_CHANGED, generate BugReport.
   void *const* k = C.getState()->FindGDM(ChrootChecker::getTag());
   if (k)
     if (isRootChanged((intptr_t) *k))
       if (ExplodedNode *N = C.generateNonFatalErrorNode()) {
         if (!BT_BreakJail)
-          BT_BreakJail.reset(new BuiltinBug(
-              this, "Break out of jail", "No call of chdir(\"/\") immediately "
-                                         "after chroot"));
-        C.emitReport(std::make_unique<PathSensitiveBugReport>(
-            *BT_BreakJail, BT_BreakJail->getDescription(), N));
+          BT_BreakJail.reset(new BugType(this, "Break out of jail"));
+        constexpr llvm::StringLiteral Msg =
+            "No call of chdir(\"/\") immediately after chroot";
+        C.emitReport(
+            std::make_unique<PathSensitiveBugReport>(*BT_BreakJail, Msg, N));
       }
 }
 
 void ento::registerChrootChecker(CheckerManager &mgr) {
   mgr.registerChecker<ChrootChecker>();
 }
 
 bool ento::shouldRegisterChrootChecker(const CheckerManager &mgr) {
   return true;
 }

clang/lib/StaticAnalyzer/Checkers/ConversionChecker.cpp

 using namespace ento;
 
 namespace {
 class ConversionChecker : public Checker<check::PreStmt<ImplicitCastExpr>> {
 public:
   void checkPreStmt(const ImplicitCastExpr *Cast, CheckerContext &C) const;
 
 private:
-  mutable std::unique_ptr<BuiltinBug> BT;
+  mutable std::unique_ptr<BugType> BT;
 
   bool isLossOfPrecision(const ImplicitCastExpr *Cast, QualType DestType,
                          CheckerContext &C) const;
 
   bool isLossOfSign(const ImplicitCastExpr *Cast, CheckerContext &C) const;
 
   void reportBug(ExplodedNode *N, const Expr *E, CheckerContext &C,
                  const char Msg[]) const;
if (LossOfSign || LossOfPrecision) {
     if (LossOfPrecision)
       reportBug(N, Cast, C, "Loss of precision in implicit conversion");
   }
 }
 
 void ConversionChecker::reportBug(ExplodedNode *N, const Expr *E,
                                   CheckerContext &C, const char Msg[]) const {
   if (!BT)
-    BT.reset(
-        new BuiltinBug(this, "Conversion", "Possible loss of sign/precision."));
+    BT.reset(new BugType(this, "Conversion"));
 
   // Generate a report for this bug.
   auto R = std::make_unique<PathSensitiveBugReport>(*BT, Msg, N);
   bugreporter::trackExpressionValue(N, E, *R);
   C.emitReport(std::move(R));
 }
 
 bool ConversionChecker::isLossOfPrecision(const ImplicitCastExpr *Cast,

clang/lib/StaticAnalyzer/Checkers/DebugCheckers.cpp

 
 //===----------------------------------------------------------------------===//
 // Emits a report for every Stmt that the analyzer visits.
 //===----------------------------------------------------------------------===//
 
 namespace {
 
 class ReportStmts : public Checker<check::PreStmt<Stmt>> {
-  BuiltinBug BT_stmtLoc{this, "Statement"};
+  BugType BT_stmtLoc{this, "Statement"};
 
 public:
   void checkPreStmt(const Stmt *S, CheckerContext &C) const {
     ExplodedNode *Node = C.generateNonFatalErrorNode();
     if (!Node)
       return;
 
     auto Report =

clang/lib/StaticAnalyzer/Checkers/EnumCastOutOfRangeChecker.cpp

 
 // This checker checks CastExpr statements.
 // If the value provided to the cast is one of the values the enumeration can
 // represent, the said value matches the enumeration. If the checker can
 // establish the impossibility of matching it gives a warning.
 // Being conservative, it does not warn if there is slight possibility the
 // value can be matching.
 class EnumCastOutOfRangeChecker : public Checker<check::PreStmt<CastExpr>> {
-  mutable std::unique_ptr<BuiltinBug> EnumValueCastOutOfRange;
+  mutable std::unique_ptr<BugType> EnumValueCastOutOfRange;
   void reportWarning(CheckerContext &C) const;
 
 public:
   void checkPreStmt(const CastExpr *CE, CheckerContext &C) const;
 };
 
 using EnumValueVector = llvm::SmallVector<llvm::APSInt, 6>;
 
 // Collects all of the values an enum can represent (as SVals).
 EnumValueVector getDeclValuesForEnum(const EnumDecl *ED) {
   EnumValueVector DeclValues(
       std::distance(ED->enumerator_begin(), ED->enumerator_end()));
   llvm::transform(ED->enumerators(), DeclValues.begin(),
                  [](const EnumConstantDecl *D) { return D->getInitVal(); });
   return DeclValues;
 }
 } // namespace
 
 void EnumCastOutOfRangeChecker::reportWarning(CheckerContext &C) const {
   if (const ExplodedNode *N = C.generateNonFatalErrorNode()) {
     if (!EnumValueCastOutOfRange)
       EnumValueCastOutOfRange.reset(
-          new BuiltinBug(this, "Enum cast out of range",
-                         "The value provided to the cast expression is not in "
-                         "the valid range of values for the enum"));
+          new BugType(this, "Enum cast out of range"));
+    constexpr llvm::StringLiteral Msg =
+        "The value provided to the cast expression is not in the valid range"
+        " of values for the enum";
     C.emitReport(std::make_unique<PathSensitiveBugReport>(
-        *EnumValueCastOutOfRange, EnumValueCastOutOfRange->getDescription(),
-        N));
+        *EnumValueCastOutOfRange, Msg, N));
   }
 }
 
 void EnumCastOutOfRangeChecker::checkPreStmt(const CastExpr *CE,
                                              CheckerContext &C) const {
 
   // Only perform enum range check on casts where such checks are valid.  For
   // all other cast kinds (where enum range checks are unnecessary or invalid),

clang/lib/StaticAnalyzer/Checkers/FixedAddressChecker.cpp

 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 
 using namespace clang;
 using namespace ento;
 
 namespace {
 class FixedAddressChecker
   : public Checker< check::PreStmt<BinaryOperator> > {
-  mutable std::unique_ptr<BuiltinBug> BT;
+  mutable std::unique_ptr<BugType> BT;
 
 public:
   void checkPreStmt(const BinaryOperator *B, CheckerContext &C) const;
 };
 }
 
 void FixedAddressChecker::checkPreStmt(const BinaryOperator *B,
                                        CheckerContext &C) const {
   // Using a fixed address is not portable because that address will probably
   // not be valid in all environments or platforms.
 
   if (B->getOpcode() != BO_Assign)
     return;
 
   QualType T = B->getType();
   if (!T->isPointerType())
     return;
 
   SVal RV = C.getSVal(B->getRHS());
 
   if (!RV.isConstant() || RV.isZeroConstant())
     return;
 
   if (ExplodedNode *N = C.generateNonFatalErrorNode()) {
+    // FIXME: improve grammar in the following strings:
     if (!BT)
-      BT.reset(
-          new BuiltinBug(this, "Use fixed address",
-                         "Using a fixed address is not portable because that "
-                         "address will probably not be valid in all "
-                         "environments or platforms."));
-    auto R =
-        std::make_unique<PathSensitiveBugReport>(*BT, BT->getDescription(), N);
+      BT.reset(new BugType(this, "Use fixed address"));
+    constexpr llvm::StringLiteral Msg =
+        "Using a fixed address is not portable because that address will "
+        "probably not be valid in all environments or platforms.";
+    auto R = std::make_unique<PathSensitiveBugReport>(*BT, Msg, N);
     R->addRange(B->getRHS()->getSourceRange());
     C.emitReport(std::move(R));
   }
 }
 
 void ento::registerFixedAddressChecker(CheckerManager &mgr) {
   mgr.registerChecker<FixedAddressChecker>();
 }
 
 bool ento::shouldRegisterFixedAddressChecker(const CheckerManager &mgr) {
   return true;
 }

clang/lib/StaticAnalyzer/Checkers/NonNullParamChecker.cpp

NonNullParamChecker::genReportNullAttrNonNull(const ExplodedNode *ErrorNode,
 
   return R;
 }
 
 std::unique_ptr<PathSensitiveBugReport>
 NonNullParamChecker::genReportReferenceToNullPointer(
     const ExplodedNode *ErrorNode, const Expr *ArgE) const {
   if (!BTNullRefArg)
-    BTNullRefArg.reset(new BuiltinBug(this, "Dereference of null pointer"));
+    BTNullRefArg.reset(new BugType(this, "Dereference of null pointer"));
 
   auto R = std::make_unique<PathSensitiveBugReport>(
       *BTNullRefArg, "Forming reference to null pointer", ErrorNode);
   if (ArgE) {
     const Expr *ArgEDeref = bugreporter::getDerefExpr(ArgE);
     if (!ArgEDeref)
       ArgEDeref = ArgE;
     bugreporter::trackExpressionValue(ErrorNode, ArgEDeref, *R);

clang/lib/StaticAnalyzer/Checkers/ObjCAtSyncChecker.cpp

 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
 
 using namespace clang;
 using namespace ento;
 
 namespace {
 class ObjCAtSyncChecker
     : public Checker< check::PreStmt<ObjCAtSynchronizedStmt> > {
-  mutable std::unique_ptr<BuiltinBug> BT_null;
-  mutable std::unique_ptr<BuiltinBug> BT_undef;
+  mutable std::unique_ptr<BugType> BT_null;
+  mutable std::unique_ptr<BugType> BT_undef;
 
 public:
   void checkPreStmt(const ObjCAtSynchronizedStmt *S, CheckerContext &C) const;
 };
 } // end anonymous namespace
 
 void ObjCAtSyncChecker::checkPreStmt(const ObjCAtSynchronizedStmt *S,
                                      CheckerContext &C) const {
 
   const Expr *Ex = S->getSynchExpr();
   ProgramStateRef state = C.getState();
   SVal V = C.getSVal(Ex);
 
   // Uninitialized value used for the mutex?
   if (isa<UndefinedVal>(V)) {
     if (ExplodedNode *N = C.generateErrorNode()) {
       if (!BT_undef)
-        BT_undef.reset(new BuiltinBug(this, "Uninitialized value used as mutex "
-                                            "for @synchronized"));
+        BT_undef.reset(new BugType(this, "Uninitialized value used as mutex "
       auto report = std::make_unique<PathSensitiveBugReport>(
           *BT_undef, BT_undef->getDescription(), N);
       bugreporter::trackExpressionValue(N, Ex, *report);
       C.emitReport(std::move(report));
     }
     return;
   }
 
   if (V.isUnknown())
     return;
 
   // Check for null mutexes.
   ProgramStateRef notNullState, nullState;
   std::tie(notNullState, nullState) = state->assume(V.castAs<DefinedSVal>());
 
   if (nullState) {
     if (!notNullState) {
       // Generate an error node.  This isn't a sink since
       // a null mutex just means no synchronization occurs.
       if (ExplodedNode *N = C.generateNonFatalErrorNode(nullState)) {
         if (!BT_null)
-          BT_null.reset(new BuiltinBug(
-              this, "Nil value used as mutex for @synchronized() "
+          BT_null.reset(
+              new BugType(this, "Nil value used as mutex for @synchronized() "
                                 "(no synchronization will occur)"));
         auto report = std::make_unique<PathSensitiveBugReport>(
             *BT_null, BT_null->getDescription(), N);
         bugreporter::trackExpressionValue(N, Ex, *report);
 
         C.emitReport(std::move(report));
         return;
       }
     }

clang/lib/StaticAnalyzer/Checkers/PointerArithChecker.cpp

 //=== PointerArithChecker.cpp - Pointer arithmetic checker -----*- C++ -*--===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
 // This files defines PointerArithChecker, a builtin checker that checks for
 // pointer arithmetic on locations other than array elements.
 //
 //===----------------------------------------------------------------------===//
 
-#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
 #include "clang/AST/DeclCXX.h"
 #include "clang/AST/ExprCXX.h"
+#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
 #include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
+#include "llvm/ADT/StringRef.h"
 
 using namespace clang;
 using namespace ento;
 
 namespace {
 enum class AllocKind {
   SingleObject,
   Array,
class PointerArithChecker
   const MemRegion *getArrayRegion(const MemRegion *Region, bool &Polymorphic,
                                   AllocKind &AKind, CheckerContext &C) const;
   const MemRegion *getPointedRegion(const MemRegion *Region,
                                     CheckerContext &C) const;
   void reportPointerArithMisuse(const Expr *E, CheckerContext &C,
                                 bool PointedNeeded = false) const;
   void initAllocIdentifiers(ASTContext &C) const;
 
-  mutable std::unique_ptr<BuiltinBug> BT_pointerArith;
-  mutable std::unique_ptr<BuiltinBug> BT_polyArray;
+  mutable std::unique_ptr<BugType> BT_pointerArith;
+  mutable std::unique_ptr<BugType> BT_polyArray;
   mutable llvm::SmallSet<IdentifierInfo *, 8> AllocFunctions;
 
 public:
   void checkPreStmt(const UnaryOperator *UOp, CheckerContext &C) const;
   void checkPreStmt(const BinaryOperator *BOp, CheckerContext &C) const;
   void checkPreStmt(const ArraySubscriptExpr *SubExpr, CheckerContext &C) const;
   void checkPreStmt(const CastExpr *CE, CheckerContext &C) const;
   void checkPostStmt(const CastExpr *CE, CheckerContext &C) const;
void PointerArithChecker::reportPointerArithMisuse(const Expr *E,
   bool IsPolymorphic = false;
   AllocKind Kind = AllocKind::Unknown;
   if (const MemRegion *ArrayRegion =
           getArrayRegion(Region, IsPolymorphic, Kind, C)) {
     if (!IsPolymorphic)
       return;
     if (ExplodedNode *N = C.generateNonFatalErrorNode()) {
       if (!BT_polyArray)
-        BT_polyArray.reset(new BuiltinBug(
-            this, "Dangerous pointer arithmetic",
-            "Pointer arithmetic on a pointer to base class is dangerous "
-            "because derived and base class may have different size."));
-      auto R = std::make_unique<PathSensitiveBugReport>(
-          *BT_polyArray, BT_polyArray->getDescription(), N);
+        BT_polyArray.reset(new BugType(this, "Dangerous pointer arithmetic"));
+      constexpr llvm::StringLiteral Msg =
+          "because derived and base class may have different size.";
+      auto R = std::make_unique<PathSensitiveBugReport>(*BT_polyArray, Msg, N);
       R->addRange(E->getSourceRange());
       R->markInteresting(ArrayRegion);
       C.emitReport(std::move(R));
     }
     return;
   }
 
   if (Kind == AllocKind::Reinterpreted)
     return;
 
   // We might not have enough information about symbolic regions.
   if (Kind != AllocKind::SingleObject &&
       Region->getKind() == MemRegion::Kind::SymbolicRegionKind)
     return;
 
   if (ExplodedNode *N = C.generateNonFatalErrorNode()) {
     if (!BT_pointerArith)
-      BT_pointerArith.reset(new BuiltinBug(this, "Dangerous pointer arithmetic",
-                                           "Pointer arithmetic on non-array "
-                                           "variables relies on memory layout, "
-                                           "which is dangerous."));
-    auto R = std::make_unique<PathSensitiveBugReport>(
-        *BT_pointerArith, BT_pointerArith->getDescription(), N);
+      BT_pointerArith.reset(new BugType(this, "Dangerous pointer arithmetic"));
+    constexpr llvm::StringLiteral Msg =
+        "Pointer arithmetic on non-array variables relies on memory layout, "
+        "which is dangerous.";
+    auto R = std::make_unique<PathSensitiveBugReport>(*BT_pointerArith, Msg, N);
     R->addRange(SR);
     R->markInteresting(Region);
     C.emitReport(std::move(R));
   }
 }
 
 void PointerArithChecker::initAllocIdentifiers(ASTContext &C) const {
   if (!AllocFunctions.empty())

clang/lib/StaticAnalyzer/Checkers/PointerSubChecker.cpp

 //
 //===----------------------------------------------------------------------===//
 
 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
 #include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
+#include "llvm/ADT/StringRef.h"
 
 using namespace clang;
 using namespace ento;
 
 namespace {
 class PointerSubChecker
   : public Checker< check::PreStmt<BinaryOperator> > {
-  mutable std::unique_ptr<BuiltinBug> BT;
+  mutable std::unique_ptr<BugType> BT;
 
 public:
   void checkPreStmt(const BinaryOperator *B, CheckerContext &C) const;
 };
 }
 
 void PointerSubChecker::checkPreStmt(const BinaryOperator *B,
                                      CheckerContext &C) const {
if (BaseLR == BaseRR)
     return;
 
   // Allow arithmetic on different symbolic regions.
   if (isa<SymbolicRegion>(BaseLR) || isa<SymbolicRegion>(BaseRR))
     return;
 
   if (ExplodedNode *N = C.generateNonFatalErrorNode()) {
     if (!BT)
-      BT.reset(
-          new BuiltinBug(this, "Pointer subtraction",
-                         "Subtraction of two pointers that do not point to "
-                         "the same memory chunk may cause incorrect result."));
-    auto R =
-        std::make_unique<PathSensitiveBugReport>(*BT, BT->getDescription(), N);
+      BT.reset(new BugType(this, "Pointer subtraction"));
+    constexpr llvm::StringLiteral Msg =
+        "Subtraction of two pointers that do not point to the same memory "
+        "chunk may cause incorrect result.";
+    auto R = std::make_unique<PathSensitiveBugReport>(*BT, Msg, N);
     R->addRange(B->getSourceRange());
     C.emitReport(std::move(R));
   }
 }
 
 void ento::registerPointerSubChecker(CheckerManager &mgr) {
   mgr.registerChecker<PointerSubChecker>();
 }
 
 bool ento::shouldRegisterPointerSubChecker(const CheckerManager &mgr) {
   return true;
 }

clang/lib/StaticAnalyzer/Checkers/ReturnPointerRangeChecker.cpp

 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
 
 using namespace clang;
 using namespace ento;
 
 namespace {
 class ReturnPointerRangeChecker :
     public Checker< check::PreStmt<ReturnStmt> > {
-  mutable std::unique_ptr<BuiltinBug> BT;
+  mutable std::unique_ptr<BugType> BT;
 
 public:
     void checkPreStmt(const ReturnStmt *RS, CheckerContext &C) const;
 };
 }
 
 void ReturnPointerRangeChecker::checkPreStmt(const ReturnStmt *RS,
                                              CheckerContext &C) const {
if (StOutBound && !StInBound) {
     ExplodedNode *N = C.generateErrorNode(StOutBound);
 
     if (!N)
       return;
 
     // FIXME: This bug correspond to CWE-466.  Eventually we should have bug
     // types explicitly reference such exploit categories (when applicable).
     if (!BT)
-      BT.reset(new BuiltinBug(
-          this, "Buffer overflow",
-          "Returned pointer value points outside the original object "
-          "(potential buffer overflow)"));
+      BT.reset(new BugType(this, "Buffer overflow"));
+    constexpr llvm::StringLiteral Msg =
+        "(potential buffer overflow)";
 
     // Generate a report for this bug.
-    auto Report =
-        std::make_unique<PathSensitiveBugReport>(*BT, BT->getDescription(), N);
+    auto Report = std::make_unique<PathSensitiveBugReport>(*BT, Msg, N);
     Report->addRange(RetE->getSourceRange());
 
     const auto ConcreteElementCount = ElementCount.getAs<nonloc::ConcreteInt>();
     const auto ConcreteIdx = Idx.getAs<nonloc::ConcreteInt>();
 
     const auto *DeclR = ER->getSuperRegion()->getAs<DeclRegion>();
 
     if (DeclR)

clang/lib/StaticAnalyzer/Checkers/ReturnUndefChecker.cpp

 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 
 using namespace clang;
 using namespace ento;
 
 namespace {
 class ReturnUndefChecker : public Checker< check::PreStmt<ReturnStmt> > {
-  mutable std::unique_ptr<BuiltinBug> BT_Undef;
-  mutable std::unique_ptr<BuiltinBug> BT_NullReference;
+  mutable std::unique_ptr<BugType> BT_Undef;
+  mutable std::unique_ptr<BugType> BT_NullReference;
 
   void emitUndef(CheckerContext &C, const Expr *RetE) const;
   void checkReference(CheckerContext &C, const Expr *RetE,
                       DefinedOrUnknownSVal RetVal) const;
 public:
   void checkPreStmt(const ReturnStmt *RS, CheckerContext &C) const;
 };
 }
if (RT.isNull())
     return;
 
   if (RT->isReferenceType()) {
     checkReference(C, RetE, RetVal.castAs<DefinedOrUnknownSVal>());
     return;
   }
 }
 
-static void emitBug(CheckerContext &C, BuiltinBug &BT, const Expr *RetE,
-                    const Expr *TrackingE = nullptr) {
+static void emitBug(CheckerContext &C, BugType &BT, StringRef Msg,
+                    const Expr *RetE, const Expr *TrackingE = nullptr) {
   ExplodedNode *N = C.generateErrorNode();
   if (!N)
     return;
 
-  auto Report =
-      std::make_unique<PathSensitiveBugReport>(BT, BT.getDescription(), N);
+  auto Report = std::make_unique<PathSensitiveBugReport>(BT, Msg, N);
 
   Report->addRange(RetE->getSourceRange());
   bugreporter::trackExpressionValue(N, TrackingE ? TrackingE : RetE, *Report);
 
   C.emitReport(std::move(Report));
 }
 
 void ReturnUndefChecker::emitUndef(CheckerContext &C, const Expr *RetE) const {
   if (!BT_Undef)
-    BT_Undef.reset(
-        new BuiltinBug(this, "Garbage return value",
-                       "Undefined or garbage value returned to caller"));
-  emitBug(C, *BT_Undef, RetE);
+    BT_Undef.reset(new BugType(this, "Garbage return value"));
+  emitBug(C, *BT_Undef, "Undefined or garbage value returned to caller", RetE);
 }
 
 void ReturnUndefChecker::checkReference(CheckerContext &C, const Expr *RetE,
                                         DefinedOrUnknownSVal RetVal) const {
   ProgramStateRef StNonNull, StNull;
   std::tie(StNonNull, StNull) = C.getState()->assume(RetVal);
 
   if (StNonNull) {
     // Going forward, assume the location is non-null.
     C.addTransition(StNonNull);
     return;
   }
 
   // The return value is known to be null. Emit a bug report.
   if (!BT_NullReference)
-    BT_NullReference.reset(new BuiltinBug(this, "Returning null reference"));
+    BT_NullReference.reset(new BugType(this, "Returning null reference"));
 
-  emitBug(C, *BT_NullReference, RetE, bugreporter::getDerefExpr(RetE));
+  emitBug(C, *BT_NullReference, BT_NullReference->getDescription(), RetE,
+          bugreporter::getDerefExpr(RetE));
 }
 
 void ento::registerReturnUndefChecker(CheckerManager &mgr) {
   mgr.registerChecker<ReturnUndefChecker>();
 }
 
 bool ento::shouldRegisterReturnUndefChecker(const CheckerManager &mgr) {
   return true;
 }

clang/lib/StaticAnalyzer/Checkers/StackAddrEscapeChecker.cpp

 using namespace clang;
 using namespace ento;
 
 namespace {
 class StackAddrEscapeChecker
     : public Checker<check::PreCall, check::PreStmt<ReturnStmt>,
                      check::EndFunction> {
   mutable IdentifierInfo *dispatch_semaphore_tII = nullptr;
-  mutable std::unique_ptr<BuiltinBug> BT_stackleak;
-  mutable std::unique_ptr<BuiltinBug> BT_returnstack;
-  mutable std::unique_ptr<BuiltinBug> BT_capturedstackasync;
-  mutable std::unique_ptr<BuiltinBug> BT_capturedstackret;
+  mutable std::unique_ptr<BugType> BT_stackleak;
+  mutable std::unique_ptr<BugType> BT_returnstack;
+  mutable std::unique_ptr<BugType> BT_capturedstackasync;
+  mutable std::unique_ptr<BugType> BT_capturedstackret;
 
 public:
   enum CheckKind {
     CK_StackAddrEscapeChecker,
     CK_StackAddrAsyncEscapeChecker,
     CK_NumCheckKinds
   };
 

 
 void StackAddrEscapeChecker::EmitStackError(CheckerContext &C,
                                             const MemRegion *R,
                                             const Expr *RetE) const {
   ExplodedNode *N = C.generateNonFatalErrorNode();
   if (!N)
     return;
   if (!BT_returnstack)
-    BT_returnstack = std::make_unique<BuiltinBug>(
+    BT_returnstack = std::make_unique<BugType>(
         CheckNames[CK_StackAddrEscapeChecker],
         "Return of address to stack-allocated memory");
   // Generate a report for this bug.
   SmallString<128> buf;
   llvm::raw_svector_ostream os(buf);
   SourceRange range = genName(os, R, C.getASTContext());
   os << " returned to caller";
   auto report =
for (const MemRegion *Region : getCapturedStackRegions(B, C)) {
     // and if the block has captured another "inner" block,
     // the "inner" block will be copied as well.
     if (isa<BlockDataRegion>(Region))
       continue;
     ExplodedNode *N = C.generateNonFatalErrorNode();
     if (!N)
       continue;
     if (!BT_capturedstackasync)
-      BT_capturedstackasync = std::make_unique<BuiltinBug>(
+      BT_capturedstackasync = std::make_unique<BugType>(
           CheckNames[CK_StackAddrAsyncEscapeChecker],
           "Address of stack-allocated memory is captured");
     SmallString<128> Buf;
     llvm::raw_svector_ostream Out(Buf);
     SourceRange Range = genName(Out, Region, C.getASTContext());
     Out << " is captured by an asynchronously-executed block";
     auto Report = std::make_unique<PathSensitiveBugReport>(
         *BT_capturedstackasync, Out.str(), N);
     if (Range.isValid())
       Report->addRange(Range);
     C.emitReport(std::move(Report));
   }
 }
 
 void StackAddrEscapeChecker::checkReturnedBlockCaptures(
     const BlockDataRegion &B, CheckerContext &C) const {
   for (const MemRegion *Region : getCapturedStackRegions(B, C)) {
     if (isNotInCurrentFrame(Region, C))
       continue;
     ExplodedNode *N = C.generateNonFatalErrorNode();
     if (!N)
       continue;
     if (!BT_capturedstackret)
-      BT_capturedstackret = std::make_unique<BuiltinBug>(
+      BT_capturedstackret = std::make_unique<BugType>(
           CheckNames[CK_StackAddrEscapeChecker],
           "Address of stack-allocated memory is captured");
     SmallString<128> Buf;
     llvm::raw_svector_ostream Out(Buf);
     SourceRange Range = genName(Out, Region, C.getASTContext());
     Out << " is captured by a returned block";
     auto Report = std::make_unique<PathSensitiveBugReport>(*BT_capturedstackret,
                                                            Out.str(), N);
if (Cb.V.empty())
     return;
 
   // Generate an error node.
   ExplodedNode *N = Ctx.generateNonFatalErrorNode(State);
   if (!N)
     return;
 
   if (!BT_stackleak)
-    BT_stackleak = std::make_unique<BuiltinBug>(
-        CheckNames[CK_StackAddrEscapeChecker],
-        "Stack address stored into global variable",
-        "Stack address was saved into a global variable. "
-        "This is dangerous because the address will become "
-        "invalid after returning from the function");
+    BT_stackleak =
+        std::make_unique<BugType>(CheckNames[CK_StackAddrEscapeChecker],
+                                  "Stack address stored into global variable");
 
   for (const auto &P : Cb.V) {
     const MemRegion *Referrer = P.first;
     const MemRegion *Referred = P.second;
 
     // Generate a report for this bug.
     const StringRef CommonSuffix =
         "upon returning to the caller.  This will be a dangling reference";

clang/lib/StaticAnalyzer/Checkers/TestAfterDivZeroChecker.cpp

public:
   PathDiagnosticPieceRef VisitNode(const ExplodedNode *Succ,
                                    BugReporterContext &BRC,
                                    PathSensitiveBugReport &BR) override;
 };
 
 class TestAfterDivZeroChecker
     : public Checker<check::PreStmt<BinaryOperator>, check::BranchCondition,
                      check::EndFunction> {
-  mutable std::unique_ptr<BuiltinBug> DivZeroBug;
+  mutable std::unique_ptr<BugType> DivZeroBug;
   void reportBug(SVal Val, CheckerContext &C) const;
 
 public:
   void checkPreStmt(const BinaryOperator *B, CheckerContext &C) const;
   void checkBranchCondition(const Stmt *Condition, CheckerContext &C) const;
   void checkEndFunction(const ReturnStmt *RS, CheckerContext &C) const;
   void setDivZeroMap(SVal Var, CheckerContext &C) const;
   bool hasDivZeroMap(SVal Var, const CheckerContext &C) const;
bool TestAfterDivZeroChecker::hasDivZeroMap(SVal Var,
 
   ZeroState ZS(SR, C.getBlockID(), C.getStackFrame());
   return C.getState()->contains<DivZeroMap>(ZS);
 }
 
 void TestAfterDivZeroChecker::reportBug(SVal Val, CheckerContext &C) const {
   if (ExplodedNode *N = C.generateErrorNode(C.getState())) {
     if (!DivZeroBug)
-      DivZeroBug.reset(new BuiltinBug(this, "Division by zero"));
+      DivZeroBug.reset(new BugType(this, "Division by zero"));
 
     auto R = std::make_unique<PathSensitiveBugReport>(
         *DivZeroBug, "Value being compared against zero has already been used "
                      "for division",
         N);
 
     R->addVisitor(std::make_unique<DivisionBRVisitor>(Val.getAsSymbol(),
                                                        C.getStackFrame()));

clang/lib/StaticAnalyzer/Checkers/UndefBranchChecker.cpp

 #include <utility>
 
 using namespace clang;
 using namespace ento;
 
 namespace {
 
 class UndefBranchChecker : public Checker<check::BranchCondition> {
-  mutable std::unique_ptr<BuiltinBug> BT;
+  mutable std::unique_ptr<BugType> BT;
 
   struct FindUndefExpr {
     ProgramStateRef St;
     const LocationContext *LCtx;
 
     FindUndefExpr(ProgramStateRef S, const LocationContext *L)
         : St(std::move(S)), LCtx(L) {}
 
if (isa<ObjCForCollectionStmt>(Condition))
     return;
   SVal X = Ctx.getSVal(Condition);
   if (X.isUndef()) {
     // Generate a sink node, which implicitly marks both outgoing branches as
     // infeasible.
     ExplodedNode *N = Ctx.generateErrorNode();
     if (N) {
       if (!BT)
-        BT.reset(new BuiltinBug(
-            this, "Branch condition evaluates to a garbage value"));
+        BT.reset(
+            new BugType(this, "Branch condition evaluates to a garbage value"));
 
       // What's going on here: we want to highlight the subexpression of the
       // condition that is the most likely source of the "uninitialized
       // branch condition."  We do a recursive walk of the condition's
       // subexpressions and roughly look for the most nested subexpression
       // that binds to Undefined.  We then highlight that expression's range.
 
       // Get the predecessor node and check if is a PostStmt with the Stmt

clang/lib/StaticAnalyzer/Checkers/UndefCapturedBlockVarChecker.cpp

if (VD->hasAttr<BlocksAttr>() || !VD->hasLocalStorage())
       continue;
 
     // Get the VarRegion associated with VD in the local stack frame.
     if (std::optional<UndefinedVal> V =
             state->getSVal(Var.getOriginalRegion()).getAs<UndefinedVal>()) {
       if (ExplodedNode *N = C.generateErrorNode()) {
         if (!BT)
           BT.reset(
-              new BuiltinBug(this, "uninitialized variable captured by block"));
+              new BugType(this, "uninitialized variable captured by block"));
 
         // Generate a bug report.
         SmallString<128> buf;
         llvm::raw_svector_ostream os(buf);
 
         os << "Variable '" << VD->getName()
            << "' is uninitialized when captured by block";
 

clang/lib/StaticAnalyzer/Checkers/UndefResultChecker.cpp

if (C.getSVal(B).isUndef()) {
 
     // Generate an error node.
     ExplodedNode *N = C.generateErrorNode();
     if (!N)
       return;
 
     if (!BT)
       BT.reset(
-          new BuiltinBug(this, "Result of operation is garbage or undefined"));
+          new BugType(this, "Result of operation is garbage or undefined"));
 
     SmallString<256> sbuf;
     llvm::raw_svector_ostream OS(sbuf);
     const Expr *Ex = nullptr;
     bool isLeft = true;
 
     if (C.getSVal(B->getLHS()).isUndef()) {
       Ex = B->getLHS()->IgnoreParenCasts();

clang/lib/StaticAnalyzer/Checkers/UndefinedArraySubscriptChecker.cpp

UndefinedArraySubscriptChecker::checkPreStmt(const ArraySubscriptExpr *A,
   if (const CXXConstructorDecl *Ctor = dyn_cast<CXXConstructorDecl>(D))
     if (Ctor->isDefaulted())
       return;
 
   ExplodedNode *N = C.generateErrorNode();
   if (!N)
     return;
   if (!BT)
-    BT.reset(new BuiltinBug(this, "Array subscript is undefined"));
+    BT.reset(new BugType(this, "Array subscript is undefined"));
 
   // Generate a report for this bug.
   auto R = std::make_unique<PathSensitiveBugReport>(*BT, BT->getDescription(), N);
   R->addRange(A->getIdx()->getSourceRange());
   bugreporter::trackExpressionValue(N, A->getIdx(), *R);
   C.emitReport(std::move(R));
 }
 
 void ento::registerUndefinedArraySubscriptChecker(CheckerManager &mgr) {
   mgr.registerChecker<UndefinedArraySubscriptChecker>();
 }
 
 bool ento::shouldRegisterUndefinedArraySubscriptChecker(const CheckerManager &mgr) {
   return true;
 }

clang/lib/StaticAnalyzer/Checkers/UndefinedAssignmentChecker.cpp

void UndefinedAssignmentChecker::checkBind(SVal location, SVal val,
   ExplodedNode *N = C.generateErrorNode();
 
   if (!N)
     return;
 
   static const char *const DefaultMsg =
       "Assigned value is garbage or undefined";
   if (!BT)
-    BT.reset(new BuiltinBug(this, DefaultMsg));
+    BT.reset(new BugType(this, DefaultMsg));
 
   // Generate a report for this bug.
   llvm::SmallString<128> Str;
   llvm::raw_svector_ostream OS(Str);
 
   const Expr *ex = nullptr;
 
   while (StoreE) {

clang/lib/StaticAnalyzer/Checkers/UninitializedObject/UninitializedObjectChecker.cpp

 /// We'll mark fields (and pointee of fields) that are confirmed to be
 /// uninitialized as already analyzed.
 REGISTER_SET_WITH_PROGRAMSTATE(AnalyzedRegions, const MemRegion *)
 
 namespace {
 
 class UninitializedObjectChecker
     : public Checker<check::EndFunction, check::DeadSymbols> {
-  std::unique_ptr<BuiltinBug> BT_uninitField;
+  std::unique_ptr<BugType> BT_uninitField;
 
 public:
   // The fields of this struct will be initialized when registering the checker.
   UninitObjCheckerOptions Opts;
 
   UninitializedObjectChecker()
-      : BT_uninitField(new BuiltinBug(this, "Uninitialized fields")) {}
+      : BT_uninitField(new BugType(this, "Uninitialized fields")) {}
 
   void checkEndFunction(const ReturnStmt *RS, CheckerContext &C) const;
   void checkDeadSymbols(SymbolReaper &SR, CheckerContext &C) const;
 };
 
 /// A basic field type, that is not a pointer or a reference, it's dynamic and
 /// static type is the same.
 class RegularField final : public FieldNode {

clang/lib/StaticAnalyzer/Checkers/VforkChecker.cpp

 
 using namespace clang;
 using namespace ento;
 
 namespace {
 
 class VforkChecker : public Checker<check::PreCall, check::PostCall,
                                     check::Bind, check::PreStmt<ReturnStmt>> {
-  mutable std::unique_ptr<BuiltinBug> BT;
+  mutable std::unique_ptr<BugType> BT;
   mutable llvm::SmallSet<const IdentifierInfo *, 10> VforkAllowlist;
   mutable const IdentifierInfo *II_vfork;
 
   static bool isChildProcess(const ProgramStateRef State);
 
   bool isVforkCall(const Decl *D, CheckerContext &C) const;
   bool isCallExplicitelyAllowed(const IdentifierInfo *II,
                                 CheckerContext &C) const;
bool VforkChecker::isCallExplicitelyAllowed(const IdentifierInfo *II,
 
   return VforkAllowlist.count(II);
 }
 
 void VforkChecker::reportBug(const char *What, CheckerContext &C,
                              const char *Details) const {
   if (ExplodedNode *N = C.generateErrorNode(C.getState())) {
     if (!BT)
-      BT.reset(new BuiltinBug(this,
-                              "Dangerous construct in a vforked process"));
+      BT.reset(new BugType(this, "Dangerous construct in a vforked process"));
 
     SmallString<256> buf;
     llvm::raw_svector_ostream os(buf);
 
     os << What << " is prohibited after a successful vfork";
 
     if (Details)
       os << "; " << Details;

clang/lib/StaticAnalyzer/Core/BugReporter.cpp

 }
 
 //===----------------------------------------------------------------------===//
 // Methods for BugType and subclasses.
 //===----------------------------------------------------------------------===//
 
 void BugType::anchor() {}
 
-void BuiltinBug::anchor() {}
-
 //===----------------------------------------------------------------------===//
 // Methods for BugReport and subclasses.
 //===----------------------------------------------------------------------===//
 
 LLVM_ATTRIBUTE_USED static bool
 isDependency(const CheckerRegistryData &Registry, StringRef CheckerName) {
   for (const std::pair<StringRef, StringRef> &Pair : Registry.Dependencies) {
     if (Pair.second == CheckerName)

clang/unittests/StaticAnalyzer/CallEventTest.cpp

void reportBug(const CheckerBase *Checker, const CallEvent &Call,
   C.getBugReporter().EmitBasicReport(
       nullptr, Checker, "", categories::LogicError, WarningMsg,
       PathDiagnosticLocation(Call.getOriginExpr(), C.getSourceManager(),
                              C.getLocationContext()),
       {});
 }
 
 class CXXDeallocatorChecker : public Checker<check::PreCall> {
-  std::unique_ptr<BuiltinBug> BT_uninitField;
+  std::unique_ptr<BugType> BT_uninitField;
 
 public:
   CXXDeallocatorChecker()
-      : BT_uninitField(new BuiltinBug(this, "CXXDeallocator")) {}
+      : BT_uninitField(new BugType(this, "CXXDeallocator")) {}
 
   void checkPreCall(const CallEvent &Call, CheckerContext &C) const {
     const auto *DC = dyn_cast<CXXDeallocatorCall>(&Call);
     if (!DC) {
       return;
     }
 
     SmallString<100> WarningBuf;

clang/unittests/StaticAnalyzer/FalsePositiveRefutationBRVisitorTest.cpp

 #include "gtest/gtest.h"
 
 namespace clang {
 namespace ento {
 namespace {
 
 class FalsePositiveGenerator : public Checker<eval::Call> {
   using Self = FalsePositiveGenerator;
-  const BuiltinBug FalsePositiveGeneratorBug{this, "FalsePositiveGenerator"};
+  const BugType FalsePositiveGeneratorBug{this, "FalsePositiveGenerator"};
   using HandlerFn = bool (Self::*)(const CallEvent &Call,
                                    CheckerContext &) const;
   CallDescriptionMap<HandlerFn> Callbacks = {
       {{{"reachedWithContradiction"}, 0}, &Self::reachedWithContradiction},
       {{{"reachedWithNoContradiction"}, 0}, &Self::reachedWithNoContradiction},
       {{{"reportIfCanBeTrue"}, 1}, &Self::reportIfCanBeTrue},
   };
 

clang/unittests/StaticAnalyzer/RegisterCustomCheckersTest.cpp

 }
 
 //===----------------------------------------------------------------------===//
 // Unsatisfied checker dependency
 //===----------------------------------------------------------------------===//
 
 class CheckerRegistrationOrderPrinter
     : public Checker<check::PreStmt<DeclStmt>> {
-  std::unique_ptr<BuiltinBug> BT =
-      std::make_unique<BuiltinBug>(this, "Registration order");
+  std::unique_ptr<BugType> BT =
+      std::make_unique<BugType>(this, "Registration order");
 
 public:
   void checkPreStmt(const DeclStmt *DS, CheckerContext &C) const {
     ExplodedNode *N = nullptr;
     N = C.generateErrorNode();
     llvm::SmallString<200> Buf;
     llvm::raw_svector_ostream OS(Buf);
     C.getAnalysisManager()

 void addCheckerRegistrationOrderPrinter(CheckerRegistry &Registry) {
   Registry.addChecker(registerCheckerRegistrationOrderPrinter,
                       shouldRegisterCheckerRegistrationOrderPrinter,
                       "test.RegistrationOrder", "Description", "", false);
 }
 
 #define UNITTEST_CHECKER(CHECKER_NAME, DIAG_MSG)                               \
   class CHECKER_NAME : public Checker<check::PreStmt<DeclStmt>> {              \
-    std::unique_ptr<BuiltinBug> BT =                                           \
-        std::make_unique<BuiltinBug>(this, DIAG_MSG);                          \
+    std::unique_ptr<BugType> BT = std::make_unique<BugType>(this, DIAG_MSG);   \
                                                                                \
   public:                                                                      \
     void checkPreStmt(const DeclStmt *DS, CheckerContext &C) const {}          \
   };                                                                           \
                                                                                \
   void register##CHECKER_NAME(CheckerManager &mgr) {                           \
     mgr.registerChecker<CHECKER_NAME>();                                       \
   }                                                                            \