Index: include/clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h =================================================================== --- include/clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h +++ include/clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h @@ -198,9 +198,11 @@ DefinedOrUnknownSVal getDerivedRegionValueSymbolVal( SymbolRef parentSymbol, const TypedValueRegion *region); - DefinedSVal getMetadataSymbolVal( - const void *symbolTag, const MemRegion *region, - const Expr *expr, QualType type, unsigned count); + DefinedSVal getMetadataSymbolVal(const void *symbolTag, + const MemRegion *region, + const Expr *expr, QualType type, + const LocationContext *LCtx, + unsigned count); DefinedSVal getFunctionPointer(const FunctionDecl *func); Index: include/clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h =================================================================== --- include/clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h +++ include/clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h @@ -184,15 +184,18 @@ const MemRegion* R; const Stmt *S; QualType T; + const LocationContext *LCtx; unsigned Count; const void *Tag; public: SymbolMetadata(SymbolID sym, const MemRegion* r, const Stmt *s, QualType t, - unsigned count, const void *tag) - : SymbolData(SymbolMetadataKind, sym), R(r), S(s), T(t), Count(count), Tag(tag) {} + const LocationContext *LCtx, unsigned count, const void *tag) + : SymbolData(SymbolMetadataKind, sym), R(r), S(s), T(t), LCtx(LCtx), + Count(count), Tag(tag) {} const MemRegion *getRegion() const { return R; } const Stmt *getStmt() const { return S; } + const LocationContext *getLocationContext() const { return LCtx; } unsigned getCount() const { return Count; } const void *getTag() const { return Tag; } @@ -201,18 +204,19 @@ void dumpToStream(raw_ostream &os) const override; static void Profile(llvm::FoldingSetNodeID& profile, const MemRegion *R, - const Stmt *S, QualType T, unsigned Count, - const void *Tag) { + const Stmt *S, QualType T, const LocationContext *LCtx, + unsigned Count, const void *Tag) { profile.AddInteger((unsigned) SymbolMetadataKind); profile.AddPointer(R); profile.AddPointer(S); profile.Add(T); + profile.AddPointer(LCtx); profile.AddInteger(Count); profile.AddPointer(Tag); } void Profile(llvm::FoldingSetNodeID& profile) override { - Profile(profile, R, S, T, Count, Tag); + Profile(profile, R, S, T, LCtx, Count, Tag); } // Implement isa support. @@ -433,7 +437,9 @@ /// VisitCount can be used to differentiate regions corresponding to /// different loop iterations, thus, making the symbol path-dependent. const SymbolMetadata *getMetadataSymbol(const MemRegion *R, const Stmt *S, - QualType T, unsigned VisitCount, + QualType T, + const LocationContext *LCtx, + unsigned VisitCount, const void *SymbolTag = nullptr); const SymbolCast* getCastSymbol(const SymExpr *Operand, Index: lib/StaticAnalyzer/Checkers/CStringChecker.cpp =================================================================== --- lib/StaticAnalyzer/Checkers/CStringChecker.cpp +++ lib/StaticAnalyzer/Checkers/CStringChecker.cpp @@ -686,6 +686,7 @@ QualType sizeTy = svalBuilder.getContext().getSizeType(); SVal strLength = svalBuilder.getMetadataSymbolVal(CStringChecker::getTag(), MR, Ex, sizeTy, + C.getLocationContext(), C.blockCount()); if (!hypothetical) { Index: lib/StaticAnalyzer/Core/SValBuilder.cpp =================================================================== --- lib/StaticAnalyzer/Core/SValBuilder.cpp +++ lib/StaticAnalyzer/Core/SValBuilder.cpp @@ -182,11 +182,12 @@ DefinedSVal SValBuilder::getMetadataSymbolVal(const void *symbolTag, const MemRegion *region, const Expr *expr, QualType type, + const LocationContext *LCtx, unsigned count) { assert(SymbolManager::canSymbolicate(type) && "Invalid metadata symbol type"); SymbolRef sym = - SymMgr.getMetadataSymbol(region, expr, type, count, symbolTag); + SymMgr.getMetadataSymbol(region, expr, type, LCtx, count, symbolTag); if (Loc::isLocType(type)) return loc::MemRegionVal(MemMgr.getSymbolicRegion(sym)); Index: lib/StaticAnalyzer/Core/SymbolManager.cpp =================================================================== --- lib/StaticAnalyzer/Core/SymbolManager.cpp +++ lib/StaticAnalyzer/Core/SymbolManager.cpp @@ -216,17 +216,18 @@ return cast(SD); } -const SymbolMetadata* +const SymbolMetadata * SymbolManager::getMetadataSymbol(const MemRegion* R, const Stmt *S, QualType T, + const LocationContext *LCtx, unsigned Count, const void *SymbolTag) { llvm::FoldingSetNodeID profile; - SymbolMetadata::Profile(profile, R, S, T, Count, SymbolTag); + SymbolMetadata::Profile(profile, R, S, T, LCtx, Count, SymbolTag); void *InsertPos; SymExpr *SD = DataSet.FindNodeOrInsertPos(profile, InsertPos); if (!SD) { SD = (SymExpr*) BPAlloc.Allocate(); - new (SD) SymbolMetadata(SymbolCounter, R, S, T, Count, SymbolTag); + new (SD) SymbolMetadata(SymbolCounter, R, S, T, LCtx, Count, SymbolTag); DataSet.InsertNode(SD, InsertPos); ++SymbolCounter; } Index: test/Analysis/string.c =================================================================== --- test/Analysis/string.c +++ test/Analysis/string.c @@ -154,6 +154,23 @@ clang_analyzer_eval(strlen(x) < 5); // expected-warning{{FALSE}} } + +size_t strlenWrapper(const char *str) { + return strlen(str); +} + +extern void invalidate(char *s); + +void testStrlenCallee() { + char str[42]; + invalidate(str); + size_t lenBefore = strlenWrapper(str); + invalidate(str); + size_t lenAfter = strlenWrapper(str); + clang_analyzer_eval(lenBefore == lenAfter); // expected-warning{{UNKNOWN}} +} + + //===----------------------------------------------------------------------=== // strnlen() //===----------------------------------------------------------------------===