[analyzer] SValExplainer: Support ObjC ivars and __block variables.

[NoQ]

Summary

This looked useful for D25909 at first, but i hesitated to rely on the explainer for composing the error messages. Still, i hope that with some work it might amount to something, so i decided to share the patch anyway.

[NoQ]

Decided to go ahead and commit as r288260.

include/clang/StaticAnalyzer/Checkers/SValExplainer.h

public:
   // TODO: SymbolCast doesn't appear in practice.
   // Add the relevant code once it does.
 
   std::string VisitSymbolicRegion(const SymbolicRegion *R) {
     // Explain 'this' object here.
     // TODO: Explain CXXThisRegion itself, find a way to test it.
     if (isThisObject(R))
       return "'this' object";
+    // Objective-C objects are not normal symbolic regions. At least,
+    // they're always on the heap.
+    if (R->getSymbol()->getType()
+            .getCanonicalType()->getAs<ObjCObjectPointerType>())
+      return "object at " + Visit(R->getSymbol());
+    // Other heap-based symbolic regions are also special.
+    if (isa<HeapSpaceRegion>(R->getMemorySpace()))
+      return "heap segment that starts at " + Visit(R->getSymbol());
     return "pointee of " + Visit(R->getSymbol());
   }
 
   std::string VisitAllocaRegion(const AllocaRegion *R) {
     return "region allocated by '" + printStmt(R->getExpr()) + "'";
   }
 
   std::string VisitCompoundLiteralRegion(const CompoundLiteralRegion *R) {
std::string VisitElementRegion(const ElementRegion *R) {
     return OS.str();
   }
 
   std::string VisitVarRegion(const VarRegion *R) {
     const VarDecl *VD = R->getDecl();
     std::string Name = VD->getQualifiedNameAsString();
     if (isa<ParmVarDecl>(VD))
       return "parameter '" + Name + "'";
+    else if (VD->hasAttr<BlocksAttr>())
+      return "block variable '" + Name + "'";
     else if (VD->hasLocalStorage())
       return "local variable '" + Name + "'";
     else if (VD->isStaticLocal())
       return "static local variable '" + Name + "'";
     else if (VD->hasGlobalStorage())
       return "global variable '" + Name + "'";
     else
       llvm_unreachable("A variable is either local or global");
   }
 
+  std::string VisitObjCIvarRegion(const ObjCIvarRegion *R) {
+    return "instance variable '" + R->getDecl()->getNameAsString() + "' of " +
+           Visit(R->getSuperRegion());
+  }
+
   std::string VisitFieldRegion(const FieldRegion *R) {
     return "field '" + R->getDecl()->getNameAsString() + "' of " +
            Visit(R->getSuperRegion());
   }
 
   std::string VisitCXXTempObjectRegion(const CXXTempObjectRegion *R) {
     return "temporary object constructed at statement '" +
            printStmt(R->getExpr()) + "'";

test/Analysis/explain-svals.cpp

 void test_2(char *ptr, int ext) {
   clang_analyzer_explain((void *) "asdf"); // expected-warning-re{{{{^pointer to element of type 'char' with index 0 of string literal "asdf"$}}}}
   clang_analyzer_explain(strlen(ptr)); // expected-warning-re{{{{^metadata of type 'unsigned long' tied to pointee of argument 'ptr'$}}}}
   clang_analyzer_explain(conjure()); // expected-warning-re{{{{^symbol of type 'int' conjured at statement 'conjure\(\)'$}}}}
   clang_analyzer_explain(glob); // expected-warning-re{{{{^value derived from \(symbol of type 'int' conjured at statement 'conjure\(\)'\) for global variable 'glob'$}}}}
   clang_analyzer_explain(glob_ptr); // expected-warning-re{{{{^value derived from \(symbol of type 'int' conjured at statement 'conjure\(\)'\) for global variable 'glob_ptr'$}}}}
   clang_analyzer_explain(clang_analyzer_getExtent(ptr)); // expected-warning-re{{{{^extent of pointee of argument 'ptr'$}}}}
   int *x = new int[ext];
-  clang_analyzer_explain(x); // expected-warning-re{{{{^pointer to element of type 'int' with index 0 of pointee of symbol of type 'int \*' conjured at statement 'new int \[ext\]'$}}}}
+  clang_analyzer_explain(x); // expected-warning-re{{{{^pointer to element of type 'int' with index 0 of heap segment that starts at symbol of type 'int \*' conjured at statement 'new int \[ext\]'$}}}}
   // Sic! What gets computed is the extent of the element-region.
   clang_analyzer_explain(clang_analyzer_getExtent(x)); // expected-warning-re{{{{^signed 32-bit integer '4'$}}}}
   delete[] x;
 }
 
 void test_3(S s) {
   clang_analyzer_explain(&s); // expected-warning-re{{{{^pointer to parameter 's'$}}}}
   clang_analyzer_explain(s.z); // expected-warning-re{{{{^initial value of field 'z' of parameter 's'$}}}}

test/Analysis/explain-svals.m

+// RUN: %clang_cc1 -w -triple i386-apple-darwin10 -fblocks -analyze -analyzer-checker=core.builtin,debug.ExprInspection -verify %s
+
+#include "Inputs/system-header-simulator-objc.h"
+
+void clang_analyzer_explain(void *);
+
+@interface Object : NSObject {
+@public
+  Object *x;
+}
+@end
+
+void test_1(Object *p) {
+  clang_analyzer_explain(p); // expected-warning-re{{{{^argument 'p'$}}}}
+  clang_analyzer_explain(p->x); // expected-warning-re{{{{^initial value of instance variable 'x' of object at argument 'p'$}}}}
+  Object *q = [[Object alloc] init];
+  clang_analyzer_explain(q); // expected-warning-re{{{{^symbol of type 'Object \*' conjured at statement '\[\[Object alloc\] init\]'$}}}}
+  clang_analyzer_explain(q->x); // expected-warning-re{{{{^initial value of instance variable 'x' of object at symbol of type 'Object \*' conjured at statement '\[\[Object alloc\] init\]'$}}}}
+}
+
+void test_2() {
+  __block int x;
+  ^{
+    clang_analyzer_explain(&x); // expected-warning-re{{{{^pointer to block variable 'x'$}}}}
+  };
+  clang_analyzer_explain(&x); // expected-warning-re{{{{^pointer to block variable 'x'$}}}}
+}