Add LocationContext to members of check::RegionChanges

[NoQ]

Summary

Hi,

I've been working on a checker that uses RegionChanges interface and needed to access to LocationContext. Another change is an easy way to obtain arguments' SVals from StackFrameCtx, with which the function/method has been called. In my opinion having that might prove useful for creating future checkers so I publish it here for review and discussion. Obvoiusly, this needs some improvement, but I'll be more than happy to hear community's opinion about the current version, as I wasn't sure if my changes fit into architecture etc.

Also: this is my first public contribution to clang. so if there are any annoying aspects of it (like the list of subscribers being to broad, bad forma, wrong metadata etc.) - sorry!

[a.sidorin]

Hi Krzysztof!
This change seems useful: I can imagine the situation where we want to ask current LocationContext in this callback. The change looks pretty intrusive but I mostly agree with it. Initially, I have some questions about the implementation of getArgSVal() function (inline comments). I'll add more comments later.

include/clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h

735

Maybe we should put a check that requested StackFrame is our StackFrame or our parent StackFrame here?

741

Unfortunately, this code does not consider the fact that argument values may be overwritten. If we want to get initial values, we should find another way.

[NoQ]

Welcome to phabricator! I agree that having the location context in this callback is useful, and i'm all for reducing boilerplate in various checkers through better API.

include/clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h

231

Because this API becomes more complicated, i think we should add some docstrings here, explaining the meaning of the location context parameter, in particular.

733

Indent.

741

Uhm, yeah, this is in fact a problem!

The purpose of this code is, in fact, to construct SymbolRegionValue for the parameter, so it is equivalent to calling SValBuilder::getRegionValueSymbolVal() over the parameter region, as long as the current StoreManager implementation remains unquestioned.

We could also ask StoreManager to provide a binding for this region from an empty store, maybe extend its API to allow such queries, this would remove the layering violation.

Because this topic getting is rather complicated, it might have been better to make a separate review for this change, originally (no problem now that most of the interested people have already had a look).

[NoQ]

include/clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h

735

Hmm. We should probably add a similar check to getSVal(Ex, LCtx)!- and also check that Ex is an active expression.

Unfortunately, we do not know the current location context within any of these methods, not sure how to implement that.

[zaks.anna]

Hi and welcome to the project!

This patch definitely looks quite complex for a first contribution, so great job at digging through the analyzer internals!

One higher level comment I have is that you should try and split patches whenever possible. For example, in the description, you mention that the patch contains 2 changes:

• extending RegionChanges interface with LocationContext
• adding an easy way to obtain arguments' SVals from StackFrameCtx

Since they are independent changes, please submit them as separate patches. This simplifies the job of the reviewers and anyone who will ever look at this patch in commit history or on phabricator. Also, this ensures that each change has sufficient test coverage. The LLVM Dev policy has a great explanation of the reasoning behind this: http://llvm.org/docs/DeveloperPolicy.html#incremental-development.

How do you plan on testing these changes? The main 2 methods are unit tests and checker regression tests. Since no checker uses these maybe we should only commit them once such checker is added...

I've only started looking at the first change and would like to understand the motivation behind it a bit more.

include/clang/StaticAnalyzer/Core/Checker.h

325

LocationContext can be obtained by calling CallEvent::getLocationContext(). I do not think that adding another parameter here buys us much. Am I missing something?

333

What is the scenario in which you need the context here? The idea is that the checker would be interested in region changes if it is already tracking information in the state. For that check, the information in the state is sufficient. What is your scenario?

Also, For any checker API change, we need to update the CheckerDocumentation.cpp.

[k-wisniewski]

Hi again!

Thanks for review! I'll upload updated version of this patch today in the evening/tomorrow. As Anna suggested I'll split it into two parts - one regarding extraction of argument SVals for StackFrameCtx and another one adding LocationContext to check::RegionChanges interface. I have commented inline on why I think this change is needed.

Cheers!

include/clang/StaticAnalyzer/Core/Checker.h

325

How about the situation when this callback is triggered by something other than a call, like variable assignment? I've tried using that location context and had lots of segfaults as in such cases it appeared to be null. Do you have some info that it should be non-null in such a case?

333

Well I've added it to be consistent with checkRegionChanges, but AFAIK this callback is no longer necessary and there was a discussion about getting rid of it altogether. Maybe it's a good moment ot purge it?

include/clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h

231

Will do!

741

Yeah, as Anna suggested I will split this change and the addition of LocationContext in check::RegionChanges and we should probably continue this discussion there

[NoQ]

include/clang/StaticAnalyzer/Core/Checker.h

325

CallEvent* is optional here - it's there only for invalidations through calls.

333

Environment, which is a significant portion of the state, is essentially unaccessible without a location context.

Call stack is also an important bit of information to any checker that does something special to support/exploit the inlining IPA - there are many checkers that scan the call stack, but so far none of them needed to subscribe to checkRegionChanges; their possible use case may look like "we want an update only if a certain condition was met within the current stack frame".

For the recursion checker, i think, the point is "if current frame is spoiled, we no longer want updates" (which should probably be fixed in the checker patch: even though the callback is broken, it'd take one less action to fix it if we decide to).

[zaks.anna]

include/clang/StaticAnalyzer/Core/Checker.h

325

Ok, makes sense. Have you looked into providing a checker context there? How much more difficult would that be? If that is too difficult, adding LocationContext is good as well.

If Call is optional and LocationContext is not, should the Call parameter be last.

333

I don't recall where that discussion has ended. If the callback is not used, I'd be fine with removing it. (That would need to be a separate patch.)

[NoQ]

include/clang/StaticAnalyzer/Core/Checker.h

325

If we add a CheckerContext, then we may end up calling callbacks that split states within callbacks that split states, and that'd be quite a mess to support.

Right now a checker may trigger checkRegionChanges() within its callback by manipulating the Store, which already leads to callbacks within callbacks, but that's bearable as long as you can't add transitions within the inner callbacks.

[zaks.anna]

include/clang/StaticAnalyzer/Core/Checker.h

325

This argument by itself does not seem to be preventing us from providing CheckerContext. For example, we could disallow splitting states (ex: by setting some flag within the CheckerContext) but still provide most of the convenience APIs.

The advantage of providing CheckerContext is that it is a class that provides access to different analyzer APIs that the checker writer might want to access. It is also familiar and somewhat expected as it is available in most other cases. It might be difficult to pipe enough information to construct it... I suspect that is the reason we do not provide it in this case.

I am OK with the patch as is but it would be good to explore if we could extend this API by providing the full CheckerContext.

[NoQ]

include/clang/StaticAnalyzer/Core/Checker.h

325

Hmm, with this kind of plan we should probably move all transition functionality into a sub-class of CheckerContext(?) So that it was obvious from the signature that some of those are restricted, and some are full-featured.

This definitely sounds like a big task, useful though, maybe a separate patch over all callbacks might be a good idea.

[NoQ]

Seems to become outdated with D27090.

include/clang/StaticAnalyzer/Core/Checker.h

 class RegionChanges {
   template <typename CHECKER>
   static ProgramStateRef 
   _checkRegionChanges(void *checker,
                       ProgramStateRef state,
                       const InvalidatedSymbols *invalidated,
                       ArrayRef<const MemRegion *> Explicits,
                       ArrayRef<const MemRegion *> Regions,
-                      const CallEvent *Call) {
-    return ((const CHECKER *)checker)->checkRegionChanges(state, invalidated,
-                                                      Explicits, Regions, Call);
+                      const CallEvent *Call,
+                      const LocationContext *LCtx) {
+    return ((const CHECKER *) checker)->checkRegionChanges(state, invalidated,
+                                                           Explicits, Regions,
+                                                           Call, LCtx);
   }
   template <typename CHECKER>
   static bool _wantsRegionChangeUpdate(void *checker,
-                                       ProgramStateRef state) {
-    return ((const CHECKER *)checker)->wantsRegionChangeUpdate(state);
+                                       ProgramStateRef state,
+                                       const LocationContext *LCtx) {
+    return ((const CHECKER *) checker)->wantsRegionChangeUpdate(state, LCtx);
   }
 
 public:
   template <typename CHECKER>
   static void _register(CHECKER *checker, CheckerManager &mgr) {
     mgr._registerForRegionChanges(
           CheckerManager::CheckRegionChangesFunc(checker,
                                                  _checkRegionChanges<CHECKER>),

include/clang/StaticAnalyzer/Core/CheckerManager.h

//===----------------------------------------------------------------------===//
   /// precise diagnostics.
   void runCheckersForDeadSymbols(ExplodedNodeSet &Dst,
                                  const ExplodedNodeSet &Src,
                                  SymbolReaper &SymReaper, const Stmt *S,
                                  ExprEngine &Eng,
                                  ProgramPoint::Kind K);
 
   /// \brief True if at least one checker wants to check region changes.
-  bool wantsRegionChangeUpdate(ProgramStateRef state);
+  bool wantsRegionChangeUpdate(ProgramStateRef state, const LocationContext *LCtx);
 
   /// \brief Run checkers for region changes.
   ///
   /// This corresponds to the check::RegionChanges callback.
   /// \param state The current program state.
   /// \param invalidated A set of all symbols potentially touched by the change.
   /// \param ExplicitRegions The regions explicitly requested for invalidation.
   ///   For example, in the case of a function call, these would be arguments.
   /// \param Regions The transitive closure of accessible regions,
   ///   i.e. all regions that may have been touched by this change.
   /// \param Call The call expression wrapper if the regions are invalidated
   ///   by a call.
   ProgramStateRef
   runCheckersForRegionChanges(ProgramStateRef state,
                               const InvalidatedSymbols *invalidated,
                               ArrayRef<const MemRegion *> ExplicitRegions,
                               ArrayRef<const MemRegion *> Regions,
-                              const CallEvent *Call);
+                              const CallEvent *Call,
+                              const LocationContext *LCtx);
 
   /// \brief Run checkers when pointers escape.
   ///
   /// This notifies the checkers about pointer escape, which occurs whenever
   /// the analyzer cannot track the symbol any more. For example, as a
   /// result of assigning a pointer into a global or when it's passed to a 
   /// function call the analyzer cannot model.
   /// 
typedef CheckerFn<void (SymbolReaper &, CheckerContext &)>
       CheckDeadSymbolsFunc;
   
   typedef CheckerFn<void (ProgramStateRef,SymbolReaper &)> CheckLiveSymbolsFunc;
   
   typedef CheckerFn<ProgramStateRef (ProgramStateRef,
                                 const InvalidatedSymbols *symbols,
                                 ArrayRef<const MemRegion *> ExplicitRegions,
                                 ArrayRef<const MemRegion *> Regions,
-                                const CallEvent *Call)>
+                                const CallEvent *Call,
+                                const LocationContext *LCtx)>
       CheckRegionChangesFunc;
   
-  typedef CheckerFn<bool (ProgramStateRef)> WantsRegionChangeUpdateFunc;
+  typedef CheckerFn<bool (ProgramStateRef, const LocationContext *)> WantsRegionChangeUpdateFunc;
 
   typedef CheckerFn<ProgramStateRef (ProgramStateRef,
                                      const InvalidatedSymbols &Escaped,
                                      const CallEvent *Call,
                                      PointerEscapeKind Kind,
                                      RegionAndSymbolInvalidationTraits *ITraits)>
       CheckPointerEscapeFunc;
   

include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h

public:
 
   /// evalAssume - Callback function invoked by the ConstraintManager when
   ///  making assumptions about state values.
   ProgramStateRef processAssume(ProgramStateRef state, SVal cond,
                                 bool assumption) override;
 
   /// wantsRegionChangeUpdate - Called by ProgramStateManager to determine if a
   ///  region change should trigger a processRegionChanges update.
-  bool wantsRegionChangeUpdate(ProgramStateRef state) override;
+  bool wantsRegionChangeUpdate(ProgramStateRef state, const LocationContext *LCtx) override;
 
   /// processRegionChanges - Called by ProgramStateManager whenever a change is made
   ///  to the store. Used to update checkers that track region values.
   ProgramStateRef 
   processRegionChanges(ProgramStateRef state,
                        const InvalidatedSymbols *invalidated,
                        ArrayRef<const MemRegion *> ExplicitRegions,
                        ArrayRef<const MemRegion *> Regions,
-                       const CallEvent *Call) override;
+                       const CallEvent *Call,
+                       const LocationContext *LCtx) override;
 
   /// printState - Called by ProgramStateManager to print checker-specific data.
   void printState(raw_ostream &Out, ProgramStateRef State,
                   const char *NL, const char *Sep) override;
 
   ProgramStateManager& getStateManager() override { return StateMgr; }
 
   StoreManager& getStoreManager() { return StateMgr.getStoreManager(); }
protected:
   /// evalBind - Handle the semantics of binding a value to a specific location.
   ///  This method is used by evalStore, VisitDeclStmt, and others.
   void evalBind(ExplodedNodeSet &Dst, const Stmt *StoreE, ExplodedNode *Pred,
                 SVal location, SVal Val, bool atDeclInit = false,
                 const ProgramPoint *PP = nullptr);
 
   /// Call PointerEscape callback when a value escapes as a result of bind.
   ProgramStateRef processPointerEscapedOnBind(ProgramStateRef State,
-                                              SVal Loc, SVal Val) override;
+                                              SVal Loc,
+                                              SVal Val,
+                                              const LocationContext *LCtx) override;
   /// Call PointerEscape callback when a value escapes as a result of
   /// region invalidation.
   /// \param[in] ITraits Specifies invalidation traits for regions/symbols.
   ProgramStateRef notifyCheckersOfPointerEscape(
                            ProgramStateRef State,
                            const InvalidatedSymbols *Invalidated,
                            ArrayRef<const MemRegion *> ExplicitRegions,
                            ArrayRef<const MemRegion *> Regions,

include/clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h

public:
   // Binding and retrieving values to/from the environment and symbolic store.
   //==---------------------------------------------------------------------==//
 
   /// Create a new state by binding the value 'V' to the statement 'S' in the
   /// state's environment.
   ProgramStateRef BindExpr(const Stmt *S, const LocationContext *LCtx,
                                SVal V, bool Invalidate = true) const;
 
   ProgramStateRef bindLoc(Loc location,
                           SVal V,
+                          const LocationContext *LCtx,
                           bool notifyChanges = true) const;
 
-  ProgramStateRef bindLoc(SVal location, SVal V) const;
+  ProgramStateRef bindLoc(SVal location, SVal V, const LocationContext *LCtx) const;
 
-  ProgramStateRef bindDefault(SVal loc, SVal V) const;
+  ProgramStateRef bindDefault(SVal loc, SVal V, const LocationContext *LCtx) const;
 
   ProgramStateRef killBinding(Loc LV) const;
 
   /// \brief Returns the state with bindings for the given regions
   ///  cleared from the store.
   ///
   /// Optionally invalidates global regions as well.
   ///
public:
   SVal getLValue(const FieldDecl *decl, SVal Base) const;
 
   /// Get the lvalue for an indirect field reference.
   SVal getLValue(const IndirectFieldDecl *decl, SVal Base) const;
 
   /// Get the lvalue for an array index.
   SVal getLValue(QualType ElementType, SVal Idx, SVal Base) const;
 
+  /// Get the symbolic value of arguments used in a call
+  /// that created the given stack frame
+  SVal getArgSVal(const StackFrameContext *SFC, const unsigned ArgIdx) const;
+
   /// Returns the SVal bound to the statement 'S' in the state's environment.
   SVal getSVal(const Stmt *S, const LocationContext *LCtx) const;
   
   SVal getSValAsScalarOrLoc(const Stmt *Ex, const LocationContext *LCtx) const;
 
   /// \brief Return the value bound to the specified location.
   /// Returns UnknownVal() if none found.
   SVal getSVal(Loc LV, QualType T = QualType()) const;
if (Val.isUnknown())
     return std::make_pair(this, this);
 
   assert(Val.getAs<NonLoc>() && "Only NonLocs are supported!");
 
   return getStateManager().ConstraintMgr
       ->assumeWithinInclusiveRangeDual(this, Val.castAs<NonLoc>(), From, To);
 }
 
-inline ProgramStateRef ProgramState::bindLoc(SVal LV, SVal V) const {
+inline ProgramStateRef ProgramState::bindLoc(SVal LV, SVal V, const LocationContext *LCtx) const {
   if (Optional<Loc> L = LV.getAs<Loc>())
-    return bindLoc(*L, V);
+    return bindLoc(*L, V, LCtx);
   return this;
 }
 
 inline Loc ProgramState::getLValue(const VarDecl *VD,
                                const LocationContext *LC) const {
   return getStateManager().StoreMgr->getLValueVar(VD, LC);
 }
 

 }
 
 inline SVal ProgramState::getLValue(QualType ElementType, SVal Idx, SVal Base) const{
   if (Optional<NonLoc> N = Idx.getAs<NonLoc>())
     return getStateManager().StoreMgr->getLValueElement(ElementType, *N, Base);
   return UnknownVal();
 }
 
+inline SVal ProgramState::getArgSVal(const StackFrameContext *SFC,
+                              const unsigned ArgIdx) const {
+  const FunctionDecl *FunctionDecl = SFC->getDecl()->getAsFunction();
+  unsigned NumArgs = FunctionDecl->getNumParams();
+  assert(ArgIdx < NumArgs && "Arg access out of range!");
+
+  if (SFC->inTopFrame()) {
+    // if we are in the top frame we don't have any arguments bound in the store
+    // because the call wasn't modeled in the first place.
+    const VarDecl *ArgDecl = FunctionDecl->parameters()[ArgIdx];
+    const Loc ArgLoc = getLValue(ArgDecl, SFC);
+    return getSVal(ArgLoc);
+  } else {
+    // in this case we need to ask the environment as  the arguments' memory
+    // region may have been purged as no longer needed.
+    const Stmt *callSite = SFC->getCallSite();
+    const CallExpr *callSiteExpr = dyn_cast<CallExpr>(callSite);
+    const Expr *argExpr = callSiteExpr->getArg(ArgIdx);
+    return getSVal(argExpr, SFC->getParent());
+  }
+}
+
 inline SVal ProgramState::getSVal(const Stmt *Ex,
                                   const LocationContext *LCtx) const{
   return Env.getSVal(EnvironmentEntry(Ex, LCtx),
                      *getStateManager().svalBuilder);
 }
 
 inline SVal
 ProgramState::getSValAsScalarOrLoc(const Stmt *S,

include/clang/StaticAnalyzer/Core/PathSensitive/SubEngine.h

public:
 
   /// Called by ConstraintManager. Used to call checker-specific
   /// logic for handling assumptions on symbolic values.
   virtual ProgramStateRef processAssume(ProgramStateRef state,
                                        SVal cond, bool assumption) = 0;
 
   /// wantsRegionChangeUpdate - Called by ProgramStateManager to determine if a
   ///  region change should trigger a processRegionChanges update.
-  virtual bool wantsRegionChangeUpdate(ProgramStateRef state) = 0;
+  virtual bool wantsRegionChangeUpdate(ProgramStateRef state,
+                                       const LocationContext *LCtx) = 0;
 
   /// processRegionChanges - Called by ProgramStateManager whenever a change is
   /// made to the store. Used to update checkers that track region values.
   virtual ProgramStateRef 
   processRegionChanges(ProgramStateRef state,
                        const InvalidatedSymbols *invalidated,
                        ArrayRef<const MemRegion *> ExplicitRegions,
                        ArrayRef<const MemRegion *> Regions,
-                       const CallEvent *Call) = 0;
+                       const CallEvent *Call,
+                       const LocationContext *LCtx) = 0;
 
 
   inline ProgramStateRef 
   processRegionChange(ProgramStateRef state,
-                      const MemRegion* MR) {
-    return processRegionChanges(state, nullptr, MR, MR, nullptr);
+                      const MemRegion* MR,
+                      const LocationContext *LCtx) {
+    return processRegionChanges(state, nullptr, MR, MR, nullptr, LCtx);
   }
 
   virtual ProgramStateRef
-  processPointerEscapedOnBind(ProgramStateRef State, SVal Loc, SVal Val) = 0;
+  processPointerEscapedOnBind(ProgramStateRef State, SVal Loc, SVal Val, const LocationContext *LCtx) = 0;
 
   virtual ProgramStateRef
   notifyCheckersOfPointerEscape(ProgramStateRef State,
                            const InvalidatedSymbols *Invalidated,
                            ArrayRef<const MemRegion *> ExplicitRegions,
                            ArrayRef<const MemRegion *> Regions,
                            const CallEvent *Call,
                            RegionAndSymbolInvalidationTraits &HTraits) = 0;

lib/StaticAnalyzer/Checkers/CStringChecker.cpp

public:
   CStringChecksFilter Filter;
 
   static void *getTag() { static int tag; return &tag; }
 
   bool evalCall(const CallExpr *CE, CheckerContext &C) const;
   void checkPreStmt(const DeclStmt *DS, CheckerContext &C) const;
   void checkLiveSymbols(ProgramStateRef state, SymbolReaper &SR) const;
   void checkDeadSymbols(SymbolReaper &SR, CheckerContext &C) const;
-  bool wantsRegionChangeUpdate(ProgramStateRef state) const;
+  bool wantsRegionChangeUpdate(ProgramStateRef state, const LocationContext *LCtx) const;
 
   ProgramStateRef
     checkRegionChanges(ProgramStateRef state,
                        const InvalidatedSymbols *,
                        ArrayRef<const MemRegion *> ExplicitRegions,
                        ArrayRef<const MemRegion *> Regions,
-                       const CallEvent *Call) const;
+                       const CallEvent *Call,
+                       const LocationContext *LCtx) const;
 
   typedef void (CStringChecker::*FnCheck)(CheckerContext &,
                                           const CallExpr *) const;
 
   void evalMemcpy(CheckerContext &C, const CallExpr *CE) const;
   void evalMempcpy(CheckerContext &C, const CallExpr *CE) const;
   void evalMemmove(CheckerContext &C, const CallExpr *CE) const;
   void evalBcopy(CheckerContext &C, const CallExpr *CE) const;
if (Optional<Loc> SearchStrLoc = SearchStrVal.getAs<Loc>()) {
     // Invalidate the search string, representing the change of one delimiter
     // character to NUL.
     State = InvalidateBuffer(C, State, SearchStrPtr, Result,
                              /*IsSourceBuffer*/false, nullptr);
 
     // Overwrite the search string pointer. The new value is either an address
     // further along in the same string, or NULL if there are no more tokens.
     State = State->bindLoc(*SearchStrLoc,
-                           SVB.conjureSymbolVal(getTag(), CE, LCtx, CharPtrTy,
-                                                C.blockCount()));
+                           SVB.conjureSymbolVal(getTag(),
+                                                CE,
+                                                LCtx,
+                                                CharPtrTy,
+                                                C.blockCount()),
+                           LCtx);
   } else {
     assert(SearchStrVal.isUnknown());
     // Conjure a symbolic value. It's the best we can do.
     Result = SVB.conjureSymbolVal(nullptr, CE, LCtx, C.blockCount());
   }
 
   // Set the return value, and finish.
   State = State->BindExpr(CE, LCtx, Result);
DefinedOrUnknownSVal strLength =
         getCStringLength(C, state, Init, StrVal).castAs<DefinedOrUnknownSVal>();
 
     state = state->set<CStringLength>(MR, strLength);
   }
 
   C.addTransition(state);
 }
 
-bool CStringChecker::wantsRegionChangeUpdate(ProgramStateRef state) const {
+bool CStringChecker::wantsRegionChangeUpdate(ProgramStateRef state,
+                                             const LocationContext *LCtx) const {
   CStringLengthTy Entries = state->get<CStringLength>();
   return !Entries.isEmpty();
 }
 
 ProgramStateRef
 CStringChecker::checkRegionChanges(ProgramStateRef state,
                                    const InvalidatedSymbols *,
                                    ArrayRef<const MemRegion *> ExplicitRegions,
                                    ArrayRef<const MemRegion *> Regions,
-                                   const CallEvent *Call) const {
+                                   const CallEvent *Call,
+                                   const LocationContext *LCtx) const {
   CStringLengthTy Entries = state->get<CStringLength>();
   if (Entries.isEmpty())
     return state;
 
   llvm::SmallPtrSet<const MemRegion *, 8> Invalidated;
   llvm::SmallPtrSet<const MemRegion *, 32> SuperRegions;
 
   // First build sets for the changed regions and their super-regions.

lib/StaticAnalyzer/Checkers/CXXSelfAssignmentChecker.cpp

void CXXSelfAssignmentChecker::checkBeginFunction(CheckerContext &C) const {
   if (!MD->isCopyAssignmentOperator() && !MD->isMoveAssignmentOperator())
     return;
   auto &State = C.getState();
   auto &SVB = C.getSValBuilder();
   auto ThisVal =
       State->getSVal(SVB.getCXXThis(MD, LCtx->getCurrentStackFrame()));
   auto Param = SVB.makeLoc(State->getRegion(MD->getParamDecl(0), LCtx));
   auto ParamVal = State->getSVal(Param);
-  ProgramStateRef SelfAssignState = State->bindLoc(Param, ThisVal);
+  ProgramStateRef SelfAssignState = State->bindLoc(Param, ThisVal, LCtx);
   C.addTransition(SelfAssignState);
-  ProgramStateRef NonSelfAssignState = State->bindLoc(Param, ParamVal);
+  ProgramStateRef NonSelfAssignState = State->bindLoc(Param, ParamVal, LCtx);
   C.addTransition(NonSelfAssignState);
 }
 
 void ento::registerCXXSelfAssignmentChecker(CheckerManager &Mgr) {
   Mgr.registerChecker<CXXSelfAssignmentChecker>();
 }

lib/StaticAnalyzer/Checkers/MallocChecker.cpp

ProgramStateRef MallocChecker::MallocMemAux(CheckerContext &C,
   unsigned Count = C.blockCount();
   SValBuilder &svalBuilder = C.getSValBuilder();
   const LocationContext *LCtx = C.getPredecessor()->getLocationContext();
   DefinedSVal RetVal = svalBuilder.getConjuredHeapSymbolVal(CE, LCtx, Count)
       .castAs<DefinedSVal>();
   State = State->BindExpr(CE, C.getLocationContext(), RetVal);
 
   // Fill the region with the initialization value.
-  State = State->bindDefault(RetVal, Init);
+  State = State->bindDefault(RetVal, Init, LCtx);
 
   // Set the region's extent equal to the Size parameter.
   const SymbolicRegion *R =
       dyn_cast_or_null<SymbolicRegion>(RetVal.getAsRegion());
   if (!R)
     return nullptr;
   if (Optional<DefinedOrUnknownSVal> DefinedSize =
           Size.getAs<DefinedOrUnknownSVal>()) {

lib/StaticAnalyzer/Checkers/RetainCountChecker.cpp

public:
   ProgramStateRef evalAssume(ProgramStateRef state, SVal Cond,
                                  bool Assumption) const;
 
   ProgramStateRef
   checkRegionChanges(ProgramStateRef state,
                      const InvalidatedSymbols *invalidated,
                      ArrayRef<const MemRegion *> ExplicitRegions,
                      ArrayRef<const MemRegion *> Regions,
-                     const CallEvent *Call) const;
+                     const CallEvent *Call,
+                     const LocationContext* LCtx) const;
 
-  bool wantsRegionChangeUpdate(ProgramStateRef state) const {
+  bool wantsRegionChangeUpdate(ProgramStateRef state, const LocationContext *LCtx) const {
     return true;
   }
 
   void checkPreStmt(const ReturnStmt *S, CheckerContext &C) const;
   void checkReturnWithRetEffect(const ReturnStmt *S, CheckerContext &C,
                                 ExplodedNode *Pred, RetEffect RE, RefVal X,
                                 SymbolRef Sym, ProgramStateRef state) const;
 
if (Optional<loc::MemRegionVal> regionLoc = loc.getAs<loc::MemRegionVal>()) {
     if (!escapes) {
       // To test (3), generate a new state with the binding added.  If it is
       // the same state, then it escapes (since the store cannot represent
       // the binding).
       // Do this only if we know that the store is not supposed to generate the
       // same state.
       SVal StoredVal = state->getSVal(regionLoc->getRegion());
       if (StoredVal != val)
-        escapes = (state == (state->bindLoc(*regionLoc, val)));
+        escapes = (state == (state->bindLoc(*regionLoc, val, C.getLocationContext())));
     }
     if (!escapes) {
       // Case 4: We do not currently model what happens when a symbol is
       // assigned to a struct field, so be conservative here and let the symbol
       // go. TODO: This could definitely be improved upon.
       escapes = !isa<VarRegion>(regionLoc->getRegion());
     }
   }
ProgramStateRef RetainCountChecker::evalAssume(ProgramStateRef state,
   return state;
 }
 
 ProgramStateRef
 RetainCountChecker::checkRegionChanges(ProgramStateRef state,
                                     const InvalidatedSymbols *invalidated,
                                     ArrayRef<const MemRegion *> ExplicitRegions,
                                     ArrayRef<const MemRegion *> Regions,
-                                    const CallEvent *Call) const {
+                                    const CallEvent *Call,
+                                    const LocationContext *LCtx) const {
   if (!invalidated)
     return state;
 
   llvm::SmallPtrSet<SymbolRef, 8> WhitelistedSymbols;
   for (ArrayRef<const MemRegion *>::iterator I = ExplicitRegions.begin(),
        E = ExplicitRegions.end(); I != E; ++I) {
     if (const SymbolicRegion *SR = (*I)->StripCasts()->getAs<SymbolicRegion>())
       WhitelistedSymbols.insert(SR->getSymbol());

lib/StaticAnalyzer/Core/CheckerManager.cpp

void CheckerManager::runCheckersForDeadSymbols(ExplodedNodeSet &Dst,
                                                const Stmt *S,
                                                ExprEngine &Eng,
                                                ProgramPoint::Kind K) {
   CheckDeadSymbolsContext C(DeadSymbolsCheckers, SymReaper, S, Eng, K);
   expandGraphWithCheckers(C, Dst, Src);
 }
 
 /// \brief True if at least one checker wants to check region changes.
-bool CheckerManager::wantsRegionChangeUpdate(ProgramStateRef state) {
+bool CheckerManager::wantsRegionChangeUpdate(ProgramStateRef state, const LocationContext *LCtx) {
   for (unsigned i = 0, e = RegionChangesCheckers.size(); i != e; ++i)
-    if (RegionChangesCheckers[i].WantUpdateFn(state))
+    if (RegionChangesCheckers[i].WantUpdateFn(state, LCtx))
       return true;
 
   return false;
 }
 
 /// \brief Run checkers for region changes.
 ProgramStateRef
 CheckerManager::runCheckersForRegionChanges(ProgramStateRef state,
                                     const InvalidatedSymbols *invalidated,
                                     ArrayRef<const MemRegion *> ExplicitRegions,
                                     ArrayRef<const MemRegion *> Regions,
-                                    const CallEvent *Call) {
+                                    const CallEvent *Call,
+                                    const LocationContext *LCtx) {
   for (unsigned i = 0, e = RegionChangesCheckers.size(); i != e; ++i) {
     // If any checker declares the state infeasible (or if it starts that way),
     // bail out.
     if (!state)
       return nullptr;
     state = RegionChangesCheckers[i].CheckFn(state, invalidated,
-                                             ExplicitRegions, Regions, Call);
+                                             ExplicitRegions, Regions,
+                                             Call, LCtx);
   }
   return state;
 }
 
 /// \brief Run checkers to process symbol escape event.
 ProgramStateRef
 CheckerManager::runCheckersForPointerEscape(ProgramStateRef State,
                                    const InvalidatedSymbols &Escaped,

lib/StaticAnalyzer/Core/ExprEngine.cpp

ExprEngine::createTemporaryRegionIfNeeded(ProgramStateRef State,
   if (!TR)
     TR = MRMgr.getCXXTempObjectRegion(Inner, LC);
 
   SVal Reg = loc::MemRegionVal(TR);
 
   if (V.isUnknown())
     V = getSValBuilder().conjureSymbolVal(Result, LC, TR->getValueType(),
                                           currBldrCtx->blockCount());
-  State = State->bindLoc(Reg, V);
+  State = State->bindLoc(Reg, V, LC);
 
   // Re-apply the casts (from innermost to outermost) for type sanity.
   for (SmallVectorImpl<const CastExpr *>::reverse_iterator I = Casts.rbegin(),
                                                            E = Casts.rend();
        I != E; ++I) {
     Reg = StoreMgr.evalDerivedToBase(Reg, *I);
   }
 
   State = State->BindExpr(Result, LC, Reg);
   return State;
 }
 
 //===----------------------------------------------------------------------===//
 // Top-level transfer function logic (Dispatcher).
 //===----------------------------------------------------------------------===//
 
 /// evalAssume - Called by ConstraintManager. Used to call checker-specific
 ///  logic for handling assumptions on symbolic values.
 ProgramStateRef ExprEngine::processAssume(ProgramStateRef state,
                                               SVal cond, bool assumption) {
   return getCheckerManager().runCheckersForEvalAssume(state, cond, assumption);
 }
 
-bool ExprEngine::wantsRegionChangeUpdate(ProgramStateRef state) {
-  return getCheckerManager().wantsRegionChangeUpdate(state);
+bool ExprEngine::wantsRegionChangeUpdate(ProgramStateRef state,
+                                         const LocationContext *LCtx) {
+  return getCheckerManager().wantsRegionChangeUpdate(state, LCtx);
 }
 
 ProgramStateRef
 ExprEngine::processRegionChanges(ProgramStateRef state,
                                  const InvalidatedSymbols *invalidated,
                                  ArrayRef<const MemRegion *> Explicits,
                                  ArrayRef<const MemRegion *> Regions,
-                                 const CallEvent *Call) {
+                                 const CallEvent *Call,
+                                 const LocationContext *LCtx) {
   return getCheckerManager().runCheckersForRegionChanges(state, invalidated,
-                                                      Explicits, Regions, Call);
+                                                         Explicits, Regions,
+                                                         Call, LCtx);
 }
 
 void ExprEngine::printState(raw_ostream &Out, ProgramStateRef State,
                             const char *NL, const char *Sep) {
   getCheckerManager().runCheckersForPrintState(Out, State, NL, Sep);
 }
 
 void ExprEngine::processEndWorklist(bool hasWorkRemaining) {

 } // end anonymous namespace
 
 // A value escapes in three possible cases:
 // (1) We are binding to something that is not a memory region.
 // (2) We are binding to a MemrRegion that does not have stack storage.
 // (3) We are binding to a MemRegion with stack storage that the store
 //     does not understand.
 ProgramStateRef ExprEngine::processPointerEscapedOnBind(ProgramStateRef State,
-                                                        SVal Loc, SVal Val) {
+                                                        SVal Loc,
+                                                        SVal Val,
+                                                        const LocationContext *LCtx) {
   // Are we storing to something that causes the value to "escape"?
   bool escapes = true;
 
   // TODO: Move to StoreManager.
   if (Optional<loc::MemRegionVal> regionLoc = Loc.getAs<loc::MemRegionVal>()) {
     escapes = !regionLoc->getRegion()->hasStackStorage();
 
     if (!escapes) {
       // To test (3), generate a new state with the binding added.  If it is
       // the same state, then it escapes (since the store cannot represent
       // the binding).
       // Do this only if we know that the store is not supposed to generate the
       // same state.
       SVal StoredVal = State->getSVal(regionLoc->getRegion());
       if (StoredVal != Val)
-        escapes = (State == (State->bindLoc(*regionLoc, Val)));
+        escapes = (State == (State->bindLoc(*regionLoc, Val, LCtx)));
     }
   }
 
   // If our store can represent the binding and we aren't storing to something
   // that doesn't have local storage then just return and have the simulation
   // state continue as is.
   if (!escapes)
     return State;
void ExprEngine::evalBind(ExplodedNodeSet &Dst, const Stmt *StoreE,
   StmtNodeBuilder Bldr(CheckedSet, Dst, *currBldrCtx);
 
   // If the location is not a 'Loc', it will already be handled by
   // the checkers.  There is nothing left to do.
   if (!location.getAs<Loc>()) {
     const ProgramPoint L = PostStore(StoreE, LC, /*Loc*/nullptr,
                                      /*tag*/nullptr);
     ProgramStateRef state = Pred->getState();
-    state = processPointerEscapedOnBind(state, location, Val);
+    state = processPointerEscapedOnBind(state, location, Val, LC);
     Bldr.generateNode(L, state, Pred);
     return;
   }
 
   for (ExplodedNodeSet::iterator I = CheckedSet.begin(), E = CheckedSet.end();
        I!=E; ++I) {
     ExplodedNode *PredI = *I;
     ProgramStateRef state = PredI->getState();
 
-    state = processPointerEscapedOnBind(state, location, Val);
+    state = processPointerEscapedOnBind(state, location, Val, LC);
 
     // When binding the value, pass on the hint that this is a initialization.
     // For initializations, we do not need to inform clients of region
     // changes.
     state = state->bindLoc(location.castAs<Loc>(),
-                           Val, /* notifyChanges = */ !atDeclInit);
+                           Val, LC, /* notifyChanges = */ !atDeclInit);
 
     const MemRegion *LocReg = nullptr;
     if (Optional<loc::MemRegionVal> LocRegVal =
             location.getAs<loc::MemRegionVal>()) {
       LocReg = LocRegVal->getRegion();
     }
 
     const ProgramPoint L = PostStore(StoreE, LC, LocReg, nullptr);
void ExprEngine::VisitGCCAsmStmt(const GCCAsmStmt *A, ExplodedNode *Pred,
 
   ProgramStateRef state = Pred->getState();
 
   for (const Expr *O : A->outputs()) {
     SVal X = state->getSVal(O, Pred->getLocationContext());
     assert (!X.getAs<NonLoc>());  // Should be an Lval, or unknown, undef.
 
     if (Optional<Loc> LV = X.getAs<Loc>())
-      state = state->bindLoc(*LV, UnknownVal());
+      state = state->bindLoc(*LV, UnknownVal(), Pred->getLocationContext());
   }
 
   Bldr.generateNode(A, Pred, state);
 }
 
 void ExprEngine::VisitMSAsmStmt(const MSAsmStmt *A, ExplodedNode *Pred,
                                 ExplodedNodeSet &Dst) {
   StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);

lib/StaticAnalyzer/Core/ExprEngineC.cpp

for (; I != E; ++I) {
       if (CI != CE) {
         assert(CI->getVariable() == capturedR->getDecl());
         copyExpr = CI->getCopyExpr();
         CI++;
       }
 
       if (capturedR != originalR) {
         SVal originalV;
+        const LocationContext *LCtx = Pred->getLocationContext();
         if (copyExpr) {
-          originalV = State->getSVal(copyExpr, Pred->getLocationContext());
+          originalV = State->getSVal(copyExpr, LCtx);
         } else {
           originalV = State->getSVal(loc::MemRegionVal(originalR));
         }
-        State = State->bindLoc(loc::MemRegionVal(capturedR), originalV);
+        State = State->bindLoc(loc::MemRegionVal(capturedR), originalV, LCtx);
       }
     }
   }
 
   ExplodedNodeSet Tmp;
   StmtNodeBuilder Bldr(Pred, Tmp, *currBldrCtx);
   Bldr.generateNode(BE, Pred,
                     State->BindExpr(BE, Pred->getLocationContext(), V),
void ExprEngine::VisitCompoundLiteralExpr(const CompoundLiteralExpr *CL,
   const Expr *Init = CL->getInitializer();
   SVal V = State->getSVal(CL->getInitializer(), LCtx);
 
   if (isa<CXXConstructExpr>(Init)) {
     // No work needed. Just pass the value up to this expression.
   } else {
     assert(isa<InitListExpr>(Init));
     Loc CLLoc = State->getLValue(CL, LCtx);
-    State = State->bindLoc(CLLoc, V);
+    State = State->bindLoc(CLLoc, V, LCtx);
 
     // Compound literal expressions are a GNU extension in C++.
     // Unlike in C, where CLs are lvalues, in C++ CLs are prvalues,
     // and like temporary objects created by the functional notation T()
     // CLs are destroyed at the end of the containing full-expression.
     // HOWEVER, an rvalue of array type is not something the analyzer can
     // reason about, since we expect all regions to be wrapped in Locs.
     // So we treat array CLs as lvalues as well, knowing that they will decay

lib/StaticAnalyzer/Core/ExprEngineCXX.cpp

if (CE->requiresZeroInitialization()) {
         // to handle random fields of a placement-initialized object picking up
         // old bindings. We might only want to do it when we need to, though.
         // FIXME: This isn't actually correct for arrays -- we need to zero-
         // initialize the entire array, not just the first element -- but our
         // handling of arrays everywhere else is weak as well, so this shouldn't
         // actually make things worse. Placement new makes this tricky as well,
         // since it's then possible to be initializing one part of a multi-
         // dimensional array.
-        State = State->bindDefault(loc::MemRegionVal(Target), ZeroVal);
+        State = State->bindDefault(loc::MemRegionVal(Target), ZeroVal, LCtx);
         Bldr.generateNode(CE, *I, State, /*tag=*/nullptr,
                           ProgramPoint::PreStmtKind);
       }
     }
   }
 
   ExplodedNodeSet DstPreCall;
   getCheckerManager().runCheckersForPreCall(DstPreCall, PreInitialized,
if (!VD) {
     Dst.Add(Pred);
     return;
   }
 
   const LocationContext *LCtx = Pred->getLocationContext();
   SVal V = svalBuilder.conjureSymbolVal(CS, LCtx, VD->getType(),
                                         currBldrCtx->blockCount());
   ProgramStateRef state = Pred->getState();
-  state = state->bindLoc(state->getLValue(VD, LCtx), V);
+  state = state->bindLoc(state->getLValue(VD, LCtx), V, LCtx);
 
   StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
   Bldr.generateNode(CS, Pred, state);
 }
 
 void ExprEngine::VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred,
                                     ExplodedNodeSet &Dst) {
   StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
for (LambdaExpr::const_capture_init_iterator i = LE->capture_init_begin(),
     } else {
       // The field stores the length of a captured variable-length array.
       // These captures don't have initialization expressions; instead we
       // get the length from the VLAType size expression.
       Expr *SizeExpr = FieldForCapture->getCapturedVLAType()->getSizeExpr();
       InitVal = State->getSVal(SizeExpr, LocCtxt);
     }
 
-    State = State->bindLoc(FieldLoc, InitVal);
+    State = State->bindLoc(FieldLoc, InitVal, LocCtxt);
   }
 
   // Decay the Loc into an RValue, because there might be a
   // MaterializeTemporaryExpr node above this one which expects the bound value
   // to be an RValue.
   SVal LambdaRVal = State->getSVal(R);
 
   ExplodedNodeSet Tmp;

lib/StaticAnalyzer/Core/ExprEngineObjC.cpp

if (Optional<loc::MemRegionVal> MV = elementV.getAs<loc::MemRegionVal>())
         // FIXME: The proper thing to do is to really iterate over the
         //  container.  We will do this with dispatch logic to the store.
         //  For now, just 'conjure' up a symbolic value.
         QualType T = R->getValueType();
         assert(Loc::isLocType(T));
         SymbolRef Sym = SymMgr.conjureSymbol(elem, LCtx, T,
                                              currBldrCtx->blockCount());
         SVal V = svalBuilder.makeLoc(Sym);
-        hasElems = hasElems->bindLoc(elementV, V);
+        hasElems = hasElems->bindLoc(elementV, V, LCtx);
 
         // Bind the location to 'nil' on the false branch.
         SVal nilV = svalBuilder.makeIntVal(0, T);
-        noElems = noElems->bindLoc(elementV, nilV);
+        noElems = noElems->bindLoc(elementV, nilV, LCtx);
       }
 
     // Create the new nodes.
     Bldr.generateNode(S, Pred, hasElems);
     Bldr.generateNode(S, Pred, noElems);
   }
 
   // Finally, run any custom checkers.

lib/StaticAnalyzer/Core/ProgramState.cpp

StoreRef newStore = StoreMgr->removeDeadBindings(NewState.getStore(), LCtx,
                                                    SymReaper);
   NewState.setStore(newStore);
   SymReaper.setReapedStore(newStore);
 
   ProgramStateRef Result = getPersistentState(NewState);
   return ConstraintMgr->removeDeadBindings(Result, SymReaper);
 }
 
-ProgramStateRef ProgramState::bindLoc(Loc LV, SVal V, bool notifyChanges) const {
+ProgramStateRef ProgramState::bindLoc(Loc LV,
+                                      SVal V,
+                                      const LocationContext *LCtx,
+                                      bool notifyChanges) const {
   ProgramStateManager &Mgr = getStateManager();
   ProgramStateRef newState = makeWithStore(Mgr.StoreMgr->Bind(getStore(),
                                                              LV, V));
   const MemRegion *MR = LV.getAsRegion();
   if (MR && Mgr.getOwningEngine() && notifyChanges)
-    return Mgr.getOwningEngine()->processRegionChange(newState, MR);
+    return Mgr.getOwningEngine()->processRegionChange(newState, MR, LCtx);
 
   return newState;
 }
 
-ProgramStateRef ProgramState::bindDefault(SVal loc, SVal V) const {
+ProgramStateRef ProgramState::bindDefault(SVal loc,
+                                          SVal V,
+                                          const LocationContext *LCtx) const {
   ProgramStateManager &Mgr = getStateManager();
   const MemRegion *R = loc.castAs<loc::MemRegionVal>().getRegion();
   const StoreRef &newStore = Mgr.StoreMgr->BindDefault(getStore(), R, V);
   ProgramStateRef new_state = makeWithStore(newStore);
   return Mgr.getOwningEngine() ?
-           Mgr.getOwningEngine()->processRegionChange(new_state, R) :
+           Mgr.getOwningEngine()->processRegionChange(new_state, R, LCtx) :
            new_state;
 }
 
 typedef ArrayRef<const MemRegion *> RegionList;
 typedef ArrayRef<SVal> ValueList;
 
 ProgramStateRef
 ProgramState::invalidateRegions(RegionList Regions,
if (Eng) {
     if (CausedByPointerEscape) {
       newState = Eng->notifyCheckersOfPointerEscape(newState, IS,
                                                     TopLevelInvalidated,
                                                     Invalidated, Call,
                                                     *ITraits);
     }
 
     return Eng->processRegionChanges(newState, IS, TopLevelInvalidated,
-                                     Invalidated, Call);
+                                     Invalidated, Call, LCtx);
   }
 
   const StoreRef &newStore =
   Mgr.StoreMgr->invalidateRegions(getStore(), Values, E, Count, LCtx, Call,
                                   *IS, *ITraits, nullptr, nullptr);
   return makeWithStore(newStore);
 }