[analyzer] Add support for symbolic float expressions

[ddcc]

Summary

With the Z3 constraint manager, symbolic floating-point constraints can also be reasoned about. This commit includes a basic floating-point checker for domain errors with math functions.

[ddcc]

• This patch introduces a virtual overloaded llvm::APFloat getSymVal() for returning the value of known floating-point constants. In the long term, both getSymVal() functions should probably be refactored to return something like a llvm::Constant.
• There are also long-term issues with the flexibility of the SymExpr class. Currently, this patch adds two SymFloatExpr and FloatSymExpr subclasses, but this isn't expressive enough for certain types of symbolic queries. For example, the current implementation checks whether a floating-point value is NaN by comparing whether V == V, which should only be false for NaN. It would be better to add support for special queries for whether a value is NaN, positive infinity, negative infinity, etc.

[ddcc]

Rebase

[ddcc]

Rebase, update tests, fix bugs

[• lirhea]

In D28954#714936, @ddcc wrote:

Rebase, update tests, fix bugs

Excuse me,I want to download full codes of this version,but I have no idea how to do it,can you tell me?
And my system is windows, I haven't install anything about Phabricator.
Thank you!

[ddcc]

In D28954#754478, @lirhea wrote:

In D28954#714936, @ddcc wrote:

Rebase, update tests, fix bugs

Excuse me,I want to download full codes of this version,but I have no idea how to do it,can you tell me?
And my system is windows, I haven't install anything about Phabricator.
Thank you!

You're probably better off waiting for these patches (D28953, D28954, and D28955) to land rather than grabbing the commits, since some of these diffs are old and I haven't had a chance to rebase and retest them yet. But if you want to try them now, you'll need to compile Clang/LLVM from source, since they haven't landed in any release. I'm also not sure how well the CMake bindings for Z3 work on Windows, it's not a platform I've tested. Either grab the raw diffs of these three commits using "download raw diff" from the web interface, or using Arcanist's arc patch commit. Alternatively, I have an older tree with all three commits at https://github.com/ddcc/clang/tree/debug , just revert the debugging commit.

[ddcc]

Rebase, avoid generating floating-point constraints if unsupported by constraint manager

[dcoughlin]

Thanks for the patch, and apologies for the delay reviewing!

Here are some initial comments -- there are more coming.

include/clang/StaticAnalyzer/Core/PathSensitive/BasicValueFactory.h

164

The called overload of Convert() initializes 'To', right? Should it be in an assert()? I'm worried about losing the side effect in non-assert builds.

178

There are multiple checks for overflow or invalid in this file. Can the checks be factored out into a static member function?

include/clang/StaticAnalyzer/Core/PathSensitive/ConstraintManager.h

128–129

What do you think about renaming this to "getSymIntVal" now that we have getSymFloatVal()?

165

The name seems slightly weird. How about "canReasonAboutFloats" or "canReasonAboutFloatingPoint"?

include/clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h

123

Note the 80-column violation here.

include/clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h

579

I don't think we need the 'const SymExpr &lhs' entry point. It seems superfluous and as far as I can tell the analog for getSymIntExpr() is never called and should probably be removed.

lib/StaticAnalyzer/Checkers/BuiltinFunctionChecker.cpp

80

Is there a reason you're not using assumeDual() here?

95

Logical || has control flow implications, which is why it is handled at a higher level. We don't have a good way of representing generalized lazy disjunctive constraints. We can eagerly case split at the top level for disjunction, but this is bad for performance and is usually not needed.

Your trick of using bitwise OR as an ad hoc lazy disjunct seems reasonable here.

lib/StaticAnalyzer/Core/BasicValueFactory.cpp

118

This logic is nearly identical to that in getValue(const llvm::APSInt& X). Can the logic be factored out in some sort of zero-costish abstraction? (Perhaps templatized over the value type?)

lib/StaticAnalyzer/Core/Z3ConstraintManager.cpp

1237

My compiler is complaining about these being uninitialized at line 1251 when both the if and else if guard conditions are false.

[dcoughlin]

This looks like a very solid start!

One area that I'm very worried about is that in various places the analyzer makes assumptions about algebraic simplifications that don't hold for floating point because of NaN and other floating point oddities. I think it really important to write a fairly comprehensive set of tests for these gotchas to make sure we're not applying for floating point. We should test for these both with and without the Z3 solver.

Here are some examples that should all be UNKNOWN (right?) but are not in the current patch, assuming a and b hold unconstrained symbols of floating-point type:

clang_analyzer_eval(a != 4.0 || a == 4.0);
clang_analyzer_eval(a < 4.0 || a >= 4.0);
clang_analyzer_eval((a != b) == !(a == b));
clang_analyzer_eval((a != 4.0) == !(a == 4.0));

include/clang/StaticAnalyzer/Checkers/Checkers.td

155

It is fine to have this in alpha now. What package to do envision this in after it is ready? Is this something that should always be on, or should be opted into on a per-project basis?

lib/StaticAnalyzer/Checkers/FloatingPointMath.cpp

48

I think it would be a better user experience if the diagnostic could (1) mention the function name and (2) tell the programmer what the valid domain is. (1) should be easy. Do you think (2) is feasible for floating point?

106

Can the checking for not NaN be factored out? It looks there is similar checking in multiple places.

lib/StaticAnalyzer/Core/BasicValueFactory.cpp

331

Is this comment correct? Is this really a divide by zero?

I'm also a bit surprised APFloat::divide() doesn't handle this case.

359

Could you add a little more context to this TODO? This way if you don't get around to it someone can pick it up.

lib/StaticAnalyzer/Core/RangeConstraintManager.cpp

416

LLVM style generally discourages putting an 'else' after a return. http://llvm.org/docs/CodingStandards.html#don-t-use-else-after-a-return Here you can just use 'if'.

lib/StaticAnalyzer/Core/SValBuilder.cpp

46

Aren't structs already handled by the isRecordType() disjunct above that makes a compound value? Can you provide more detail in the FIXME about what needs to be fixed?

69

Should this say 'APFloat' in the comment?

lib/StaticAnalyzer/Core/SimpleConstraintManager.cpp

133

I guess this is safe, but it seems quite strange to have operations with side effects inside an assert(). Can you store the return value from convert in a local use and (void)local; to suppress the unused variable diagnostic?

lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp

158

Is this the kind of thing it could eventually be a good idea to issue a diagnostic for?

1093

I'm wondering whether we should rename this method to "getKnownIntValue()" and then just return nullptr here. What are the merits of trapping vs. returning nullptr here?

lib/StaticAnalyzer/Core/Z3ConstraintManager.cpp

1332

I'm wondering whether this assert is too strong. Should it be the responsibility of callers of this method to guarantee that it doesn't fire? If so, can we document the implied precondition for the method?

1783

It is probably easier to maintain if you use:

(void)Status;

here instead of the duplication.

[ddcc]

Revise based on feedback

[ddcc]

As an aside, I think it'd be good to land D28954 and D28955 first, since they affect accuracy and precision of various analyzer parts that this depends on.

Here are some examples that should all be UNKNOWN (right?) but are not in the current patch, assuming a and b hold unconstrained symbols of floating-point type:

Yeah, those should definitely be fixed. In general, I tried to avoid performing simplifications on anything not of floating-point type, particularly in SimpleSValBuilder, but there are probably cases that I've missed.

In your example clang_analyzer_eval(a < 4.0 || a >= 4.0) (and likewise for the rest), the following is happening:

1. At ExprEngineC.cpp:VisitLogicalExpr(), we hit this logical expression for the first time, the introspection fails, and we generate the SVal (((double) (reg_$0<float a>)) >= 4.0E+0) != 0 that is bound to a < 4.0 || a >= 4.0.
2. The next time around, the introspection succeeds, and we generate the SVal 1 S32b that is bound to a < 4.0 || a >= 4.0.
3. Now, when we hit ExprInspectionChecker.cpp:getArgumentValueString(), we retrieve the SVal 1 S32b, and attempt to assert it.
4. Then, we hit SimpleConstraintManager.cpp:assumeAux(), and fall into the nonloc::ConcreteIntKind case. When Assumption is true, we are fine and return the original State, but then when Assumption is false, we return nullptr.
5. Back in ExprInspectionChecker.cpp:getArgumentValueString(), we see StTrue != nullptr and StFalse == nullptr, and we print TRUE instead of UNKNOWN.

I'm not familiar with VisitLogicalExpr() and why integer constants are being bound to the logical expressions. Wouldn't we simply want to assume that the logical expression, when expressed as a symbolic constraint, is either true/false in each respective child state?

include/clang/StaticAnalyzer/Checkers/Checkers.td

155

This checker is a bit of a toy, in that (last I checked) Clang doesn't support the floating-point environment, which is typically used to install global floating-point exception handlers (for e.g. NaN, etc). As a result, there are probably going to lots of false-positives on real codebases.

Additionally, it requires the z3 solver, which probably isn't being built by default in most Linux distributions (and I doubt we're at the point of asking package maintainers to add a dependency for clang on libz3, even for those that do build that package).

So I think it should definitely be optional.

lib/StaticAnalyzer/Checkers/BuiltinFunctionChecker.cpp

80

I'm not sure how assumeDual helps here? The explicit checks isPInf and isNInf implement the short-circuit effect of logical or, whereas omitting them and binding directly to isInf miss the short-circuit effect.

lib/StaticAnalyzer/Core/BasicValueFactory.cpp

118

The tricky part is that there are associate class member variables for each function (APSIntSet and APFloatSet). I can factor out getValue to a template, but then I'd need to introduce a templated helper function with two specializations to retrieve the class member variable for the input template type. I'm not sure if that'd be zero-cost?

331

I don't recall why I wrote this...

lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp

1093

The trapping should be for debugging purposes only, since it is easy to accidentally call the wrong getKnown*Value function without disambiguating on the input type, and this wasn't previously necessary.

lib/StaticAnalyzer/Core/Z3ConstraintManager.cpp

1332

Would you prefer returning nullptr instead?

I guess the question is if calling getSymFloatVal on a non floating-point type implies that the result should be converted to a floating-point type, and if so, whether that should trigger an assertion failure or return a null pointer on failure?

[ddcc]

Drop unnecessary code

include/clang/StaticAnalyzer/Checkers/Checkers.td

 def CastToStructChecker : Checker<"CastToStruct">,
   HelpText<"Check for cast from non-struct pointer to struct pointer">,
   DescFile<"CastToStructChecker.cpp">;
 
 def ConversionChecker : Checker<"Conversion">,
   HelpText<"Loss of sign/precision in implicit conversions">,
   DescFile<"ConversionChecker.cpp">;
 
+def FloatingPointMathChecker : Checker<"FPMath">,
+  HelpText<"Check for domain errors in floating-point math functions">,
+  DescFile<"FloatingPointMath.cpp">;
+
 def IdenticalExprChecker : Checker<"IdenticalExpr">,
   HelpText<"Warn about unintended use of identical expressions in operators">,
   DescFile<"IdenticalExprChecker.cpp">;
 
 def FixedAddressChecker : Checker<"FixedAddr">,
   HelpText<"Check for assignment of a fixed address to a pointer">,
   DescFile<"FixedAddressChecker.cpp">;
 

include/clang/StaticAnalyzer/Core/PathSensitive/BasicValueFactory.h

 //
 //===----------------------------------------------------------------------===//
 
 #ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_BASICVALUEFACTORY_H
 #define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_BASICVALUEFACTORY_H
 
 #include "clang/AST/ASTContext.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/APSIntType.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/StoreRef.h"
-#include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h"
 
 namespace clang {
 namespace ento {
 
 class CompoundValData : public llvm::FoldingSetNode {
   QualType T;
   llvm::ImmutableList<SVal> L;
 
 public:
   CompoundValData(QualType t, llvm::ImmutableList<SVal> l) : T(t), L(l) {
     assert(NonLoc::isCompoundType(t));
   }
 
   typedef llvm::ImmutableList<SVal>::iterator iterator;
   iterator begin() const { return L.begin(); }
   iterator end() const { return L.end(); }
 
-  static void Profile(llvm::FoldingSetNodeID& ID, QualType T,
+  static void Profile(llvm::FoldingSetNodeID &ID, QualType T,
                       llvm::ImmutableList<SVal> L);
 
-  void Profile(llvm::FoldingSetNodeID& ID) { Profile(ID, T, L); }
+  void Profile(llvm::FoldingSetNodeID &ID) { Profile(ID, T, L); }
 };
 
 class LazyCompoundValData : public llvm::FoldingSetNode {
   StoreRef store;
   const TypedValueRegion *region;
+
 public:
   LazyCompoundValData(const StoreRef &st, const TypedValueRegion *r)
       : store(st), region(r) {
     assert(NonLoc::isCompoundType(r->getValueType()));
   }
 
   const void *getStore() const { return store.getStore(); }
   const TypedValueRegion *getRegion() const { return region; }
 
-  static void Profile(llvm::FoldingSetNodeID& ID,
-                      const StoreRef &store,
+  static void Profile(llvm::FoldingSetNodeID &ID, const StoreRef &store,
                       const TypedValueRegion *region);
 
-  void Profile(llvm::FoldingSetNodeID& ID) { Profile(ID, store, region); }
+  void Profile(llvm::FoldingSetNodeID &ID) { Profile(ID, store, region); }
 };
 
-class PointerToMemberData: public llvm::FoldingSetNode {
+class PointerToMemberData : public llvm::FoldingSetNode {
   const DeclaratorDecl *D;
   llvm::ImmutableList<const CXXBaseSpecifier *> L;
 
 public:
   PointerToMemberData(const DeclaratorDecl *D,
                       llvm::ImmutableList<const CXXBaseSpecifier *> L)
       : D(D), L(L) {}
 
   typedef llvm::ImmutableList<const CXXBaseSpecifier *>::iterator iterator;
   iterator begin() const { return L.begin(); }
   iterator end() const { return L.end(); }
 
-  static void Profile(llvm::FoldingSetNodeID& ID, const DeclaratorDecl *D,
+  static void Profile(llvm::FoldingSetNodeID &ID, const DeclaratorDecl *D,
                       llvm::ImmutableList<const CXXBaseSpecifier *> L);
 
-  void Profile(llvm::FoldingSetNodeID& ID) { Profile(ID, D, L); }
-  const DeclaratorDecl *getDeclaratorDecl() const {return D;}
+  void Profile(llvm::FoldingSetNodeID &ID) { Profile(ID, D, L); }
+  const DeclaratorDecl *getDeclaratorDecl() const { return D; }
   llvm::ImmutableList<const CXXBaseSpecifier *> getCXXBaseList() const {
     return L;
   }
 };
 
 class BasicValueFactory {
-  typedef llvm::FoldingSet<llvm::FoldingSetNodeWrapper<llvm::APSInt> >
-          APSIntSetTy;
+  typedef llvm::FoldingSet<llvm::FoldingSetNodeWrapper<llvm::APSInt>>
+  typedef llvm::FoldingSet<llvm::FoldingSetNodeWrapper<llvm::APFloat>>
+      APFloatSetTy;
 
   ASTContext &Ctx;
-  llvm::BumpPtrAllocator& BPAlloc;
+  llvm::BumpPtrAllocator &BPAlloc;
 
-  APSIntSetTy   APSIntSet;
-  void *        PersistentSVals;
-  void *        PersistentSValPairs;
+  APSIntSetTy APSIntSet;
+  APFloatSetTy APFloatSet;
+  void *PersistentSVals;
+  void *PersistentSValPairs;
 
   llvm::ImmutableList<SVal>::Factory SValListFactory;
-  llvm::ImmutableList<const CXXBaseSpecifier*>::Factory CXXBaseListFactory;
-  llvm::FoldingSet<CompoundValData>  CompoundValDataSet;
+  llvm::ImmutableList<const CXXBaseSpecifier *>::Factory CXXBaseListFactory;
+  llvm::FoldingSet<CompoundValData> CompoundValDataSet;
   llvm::FoldingSet<LazyCompoundValData> LazyCompoundValDataSet;
   llvm::FoldingSet<PointerToMemberData> PointerToMemberDataSet;
 
   // This is private because external clients should use the factory
   // method that takes a QualType.
-  const llvm::APSInt& getValue(uint64_t X, unsigned BitWidth, bool isUnsigned);
+  const llvm::APSInt &getValue(uint64_t X, unsigned BitWidth, bool isUnsigned);
 
 public:
   BasicValueFactory(ASTContext &ctx, llvm::BumpPtrAllocator &Alloc)
       : Ctx(ctx), BPAlloc(Alloc), PersistentSVals(nullptr),
         PersistentSValPairs(nullptr), SValListFactory(Alloc),
         CXXBaseListFactory(Alloc) {}
 
   ~BasicValueFactory();
 
   ASTContext &getContext() const { return Ctx; }
 
-  const llvm::APSInt& getValue(const llvm::APSInt& X);
-  const llvm::APSInt& getValue(const llvm::APInt& X, bool isUnsigned);
-  const llvm::APSInt& getValue(uint64_t X, QualType T);
+  const llvm::APSInt &getValue(const llvm::APSInt &X);
+  const llvm::APSInt &getValue(const llvm::APInt &X, bool isUnsigned);
+  const llvm::APSInt &getValue(uint64_t X, QualType T);
 
+  const llvm::APFloat &getValue(const llvm::APFloat &X);
+  const llvm::APFloat &getValue(int64_t X, const llvm::fltSemantics &S);
+
   /// Returns the type of the APSInt used to store values of the given QualType.
   APSIntType getAPSIntType(QualType T) const {
     assert(T->isIntegralOrEnumerationType() || Loc::isLocType(T));
     return APSIntType(Ctx.getIntWidth(T),
                       !T->isSignedIntegerOrEnumerationType());
   }
 
+  // Returns whether the floating-point conversion completed successfully
+  static bool checkFloatConversion(const llvm::APFloat::opStatus Status) {
+    return !(Status & (llvm::APFloat::opOverflow | llvm::APFloat::opInvalidOp));
+  }
+
   /// Convert - Create a new persistent APSInt with the same value as 'From'
   ///  but with the bitwidth and signedness of 'To'.
-  const llvm::APSInt &Convert(const llvm::APSInt& To,
-                              const llvm::APSInt& From) {
+  const llvm::APSInt &Convert(const llvm::APSInt &To,
+                              const llvm::APSInt &From) {
     APSIntType TargetType(To);
     if (TargetType == APSIntType(From))
       return From;
 
     return getValue(TargetType.convert(From));
   }
-  
   const llvm::APSInt &Convert(QualType T, const llvm::APSInt &From) {
     APSIntType TargetType = getAPSIntType(T);
     if (TargetType == APSIntType(From))
       return From;
-    
     return getValue(TargetType.convert(From));
   }
 
-  const llvm::APSInt& getIntValue(uint64_t X, bool isUnsigned) {
+  const llvm::APFloat &Convert(const llvm::APSInt &From,
+                               const llvm::fltSemantics &S) {
+    llvm::APFloat To(S, llvm::APFloat::uninitialized);
+    bool result = Convert(To, From);
+    assert(result && "Failed to convert integer to floating-point!");
+    (void)result;
+    return getValue(To);
+  }
+
+  const llvm::APFloat &Convert(QualType T, const llvm::APFloat &From) {
+    bool lossOfPrecision;
+    llvm::APFloat To = From;
+    bool isOk = checkFloatConversion(
+        To.convert(Ctx.getFloatTypeSemantics(T),
+                   llvm::APFloat::rmNearestTiesToEven, &lossOfPrecision));
+    assert(isOk && "Failed to convert integer to floating-point!");
+    (void)isOk;
+    return getValue(To);
+  }
+
+  /// Fills an existing APFloat with the floating-point representation of an
+  /// APSInt. Returns true if the conversion is successful.
+  static bool Convert(llvm::APFloat &Float, const llvm::APSInt &Int) {
+    // Cannot be represented in destination type, this is undefined behavior
+    return checkFloatConversion(Float.convertFromAPInt(
+        Int, Int.isSigned(), llvm::APFloat::rmNearestTiesToEven));
+  }
+
+  /// Fills an existing APSInt with the integer representation of an
+  /// APFloat. Returns true if the conversion is successful.
+  static bool Convert(llvm::APSInt &Int, const llvm::APFloat &Float) {
+    bool isExact;
+    // Cannot be represented in destination type, this is undefined behavior
+    return checkFloatConversion(Float.convertToInteger(
+        Int, llvm::APFloat::rmNearestTiesToEven, &isExact));
+  }
+
+  const llvm::APSInt &getIntValue(uint64_t X, bool isUnsigned) {
     QualType T = isUnsigned ? Ctx.UnsignedIntTy : Ctx.IntTy;
     return getValue(X, T);
   }
 
-  inline const llvm::APSInt& getMaxValue(const llvm::APSInt &v) {
+  inline const llvm::APSInt &getMaxValue(const llvm::APSInt &v) {
     return getValue(APSIntType(v).getMaxValue());
   }
 
-  inline const llvm::APSInt& getMinValue(const llvm::APSInt &v) {
+  inline const llvm::APSInt &getMinValue(const llvm::APSInt &v) {
     return getValue(APSIntType(v).getMinValue());
   }
 
-  inline const llvm::APSInt& getMaxValue(QualType T) {
+  inline const llvm::APSInt &getMaxValue(QualType T) {
     return getValue(getAPSIntType(T).getMaxValue());
   }
 
-  inline const llvm::APSInt& getMinValue(QualType T) {
+  inline const llvm::APSInt &getMinValue(QualType T) {
     return getValue(getAPSIntType(T).getMinValue());
   }
 
-  inline const llvm::APSInt& Add1(const llvm::APSInt& V) {
+  inline const llvm::APSInt &Add1(const llvm::APSInt &V) {
     llvm::APSInt X = V;
     ++X;
     return getValue(X);
   }
 
-  inline const llvm::APSInt& Sub1(const llvm::APSInt& V) {
+  inline const llvm::APSInt &Sub1(const llvm::APSInt &V) {
     llvm::APSInt X = V;
     --X;
     return getValue(X);
   }
 
-  inline const llvm::APSInt& getZeroWithTypeSize(QualType T) {
+  inline const llvm::APSInt &getZeroWithTypeSize(QualType T) {
     assert(T->isScalarType());
     return getValue(0, Ctx.getTypeSize(T), true);
   }
 
-  inline const llvm::APSInt& getZeroWithPtrWidth(bool isUnsigned = true) {
+  inline const llvm::APSInt &getZeroWithPtrWidth(bool isUnsigned = true) {
     return getValue(0, Ctx.getTypeSize(Ctx.VoidPtrTy), isUnsigned);
   }
 
   inline const llvm::APSInt &getIntWithPtrWidth(uint64_t X, bool isUnsigned) {
     return getValue(X, Ctx.getTypeSize(Ctx.VoidPtrTy), isUnsigned);
   }
 
-  inline const llvm::APSInt& getTruthValue(bool b, QualType T) {
+  inline const llvm::APSInt &getTruthValue(bool b, QualType T) {
     return getValue(b ? 1 : 0, Ctx.getTypeSize(T), false);
   }
 
-  inline const llvm::APSInt& getTruthValue(bool b) {
+  inline const llvm::APSInt &getTruthValue(bool b) {
     return getTruthValue(b, Ctx.getLogicalOperationType());
   }
 
   const CompoundValData *getCompoundValData(QualType T,
                                             llvm::ImmutableList<SVal> Vals);
 
-  const LazyCompoundValData *getLazyCompoundValData(const StoreRef &store,
-                                            const TypedValueRegion *region);
+  const LazyCompoundValData *
+  getLazyCompoundValData(const StoreRef &store, const TypedValueRegion *region);
 
-  const PointerToMemberData *getPointerToMemberData(
-      const DeclaratorDecl *DD,
+  const PointerToMemberData *
+  getPointerToMemberData(const DeclaratorDecl *DD,
                          llvm::ImmutableList<const CXXBaseSpecifier *> L);
 
   llvm::ImmutableList<SVal> getEmptySValList() {
     return SValListFactory.getEmptyList();
   }
 
   llvm::ImmutableList<SVal> prependSVal(SVal X, llvm::ImmutableList<SVal> L) {
     return SValListFactory.add(X, L);
   }
 
   llvm::ImmutableList<const CXXBaseSpecifier *> getEmptyCXXBaseList() {
     return CXXBaseListFactory.getEmptyList();
   }
 
-  llvm::ImmutableList<const CXXBaseSpecifier *> prependCXXBase(
-      const CXXBaseSpecifier *CBS,
+  llvm::ImmutableList<const CXXBaseSpecifier *>
+  prependCXXBase(const CXXBaseSpecifier *CBS,
                  llvm::ImmutableList<const CXXBaseSpecifier *> L) {
     return CXXBaseListFactory.add(CBS, L);
   }
 
-  const clang::ento::PointerToMemberData *accumCXXBase(
-      llvm::iterator_range<CastExpr::path_const_iterator> PathRange,
+  const clang::ento::PointerToMemberData *
+  accumCXXBase(llvm::iterator_range<CastExpr::path_const_iterator> PathRange,
                const nonloc::PointerToMember &PTM);
 
-  const llvm::APSInt* evalAPSInt(BinaryOperator::Opcode Op,
-                                     const llvm::APSInt& V1,
-                                     const llvm::APSInt& V2);
+  const llvm::APSInt *evalAPSInt(BinaryOperator::Opcode Op,
+                                 const llvm::APSInt &V1,
+                                 const llvm::APSInt &V2);
 
-  const std::pair<SVal, uintptr_t>&
-  getPersistentSValWithData(const SVal& V, uintptr_t Data);
+  const llvm::APFloat *evalAPFloat(BinaryOperator::Opcode Op,
+                                   const llvm::APFloat &V1,
+                                   const llvm::APFloat &V2);
+
+  const llvm::APSInt *evalAPFloatComparison(BinaryOperator::Opcode Op,
+                                            const llvm::APFloat &V1,
+                                            const llvm::APFloat &V2);
+
+  const std::pair<SVal, uintptr_t> &getPersistentSValWithData(const SVal &V,
+                                                              uintptr_t Data);
 
-  const std::pair<SVal, SVal>&
-  getPersistentSValPair(const SVal& V1, const SVal& V2);
+  const std::pair<SVal, SVal> &getPersistentSValPair(const SVal &V1,
+                                                     const SVal &V2);
 
-  const SVal* getPersistentSVal(SVal X);
+  const SVal *getPersistentSVal(SVal X);
 };
 
-} // end GR namespace
+} // namespace ento
 
-} // end clang namespace
+} // namespace clang
 
 #endif

include/clang/StaticAnalyzer/Core/PathSensitive/ConstraintManager.h

 
 namespace clang {
 namespace ento {
 
 class SubEngine;
 
 class ConditionTruthVal {
   Optional<bool> Val;
+
 public:
   /// Construct a ConditionTruthVal indicating the constraint is constrained
   /// to either true or false, depending on the boolean value provided.
   ConditionTruthVal(bool constraint) : Val(constraint) {}
 
   /// Construct a ConstraintVal indicating the constraint is underconstrained.
   ConditionTruthVal() {}
 
   /// Return true if the constraint is perfectly constrained to 'true'.
-  bool isConstrainedTrue() const {
-    return Val.hasValue() && Val.getValue();
-  }
+  bool isConstrainedTrue() const { return Val.hasValue() && Val.getValue(); }
 
   /// Return true if the constraint is perfectly constrained to 'false'.
-  bool isConstrainedFalse() const {
-    return Val.hasValue() && !Val.getValue();
-  }
+  bool isConstrainedFalse() const { return Val.hasValue() && !Val.getValue(); }
 
   /// Return true if the constrained is perfectly constrained.
-  bool isConstrained() const {
-    return Val.hasValue();
-  }
+  bool isConstrained() const { return Val.hasValue(); }
 
   /// Return true if the constrained is underconstrained and we do not know
   /// if the constraint is true of value.
-  bool isUnderconstrained() const {
-    return !Val.hasValue();
-  }
+  bool isUnderconstrained() const { return !Val.hasValue(); }
 };
 
 class ConstraintManager {
 public:
   ConstraintManager() : NotifyAssumeClients(true) {}
 
   virtual ~ConstraintManager();
-  virtual ProgramStateRef assume(ProgramStateRef state,
-                                 DefinedSVal Cond,
+  virtual ProgramStateRef assume(ProgramStateRef state, DefinedSVal Cond,
                                  bool Assumption) = 0;
 
   typedef std::pair<ProgramStateRef, ProgramStateRef> ProgramStatePair;
 
   /// Returns a pair of states (StTrue, StFalse) where the given condition is
   /// assumed to be true or false, respectively.
   ProgramStatePair assumeDual(ProgramStateRef State, DefinedSVal Cond) {
     ProgramStateRef StTrue = assume(State, Cond, true);
#endif
       return ProgramStatePair((ProgramStateRef) nullptr, State);
     }
 
     ProgramStateRef StFalse = assume(State, Cond, false);
     if (!StFalse) {
       // We are careful to return the original state, /not/ StTrue,
       // because we want to avoid having callers generate a new node
       // in the ExplodedGraph.
-      return ProgramStatePair(State, (ProgramStateRef)nullptr);
+      return ProgramStatePair(State, (ProgramStateRef) nullptr);
     }
 
     return ProgramStatePair(StTrue, StFalse);
   }
 
   virtual ProgramStateRef assumeInclusiveRange(ProgramStateRef State,
                                                NonLoc Value,
                                                const llvm::APSInt &From,
                                                const llvm::APSInt &To,
                                                bool InBound) = 0;
 
   virtual ProgramStatePair assumeInclusiveRangeDual(ProgramStateRef State,
                                                     NonLoc Value,
                                                     const llvm::APSInt &From,
                                                     const llvm::APSInt &To) {
     ProgramStateRef StInRange =
         assumeInclusiveRange(State, Value, From, To, true);
 
     // If StTrue is infeasible, asserting the falseness of Cond is unnecessary
     // because the existing constraints already establish this.
     if (!StInRange)
-      return ProgramStatePair((ProgramStateRef)nullptr, State);
+      return ProgramStatePair((ProgramStateRef) nullptr, State);
 
     ProgramStateRef StOutOfRange =
         assumeInclusiveRange(State, Value, From, To, false);
     if (!StOutOfRange) {
       // We are careful to return the original state, /not/ StTrue,
       // because we want to avoid having callers generate a new node
       // in the ExplodedGraph.
-      return ProgramStatePair(State, (ProgramStateRef)nullptr);
+      return ProgramStatePair(State, (ProgramStateRef) nullptr);
     }
 
     return ProgramStatePair(StInRange, StOutOfRange);
   }
 
   /// \brief If a symbol is perfectly constrained to a constant, attempt
   /// to return the concrete value.
   ///
   /// Note that a ConstraintManager is not obligated to return a concretized
   /// value for a symbol, even if it is perfectly constrained.
-  virtual const llvm::APSInt* getSymVal(ProgramStateRef state,
+  virtual const llvm::APSInt *getSymIntVal(ProgramStateRef state,
+                                           SymbolRef sym) const {
+    return nullptr;
+  }
+
+  /// \brief If a symbol is perfectly constrained to a constant, attempt
+  /// to return the concrete value.
+  ///
+  /// Note that a ConstraintManager is not obligated to return a concretized
+  /// value for a symbol, even if it is perfectly constrained.
+  virtual const llvm::APFloat *getSymFloatVal(ProgramStateRef state,
                                               SymbolRef sym) const {
     return nullptr;
   }
 
   /// Scan all symbols referenced by the constraints. If the symbol is not
   /// alive, remove it.
   virtual ProgramStateRef removeDeadBindings(ProgramStateRef state,
-                                                 SymbolReaper& SymReaper) = 0;
+                                             SymbolReaper &SymReaper) = 0;
 
-  virtual void print(ProgramStateRef state,
-                     raw_ostream &Out,
-                     const char* nl,
+  virtual void print(ProgramStateRef state, raw_ostream &Out, const char *nl,
                      const char *sep) = 0;
 
   virtual void EndPath(ProgramStateRef state) {}
 
   /// Convenience method to query the state to see if a symbol is null or
   /// not null, or if neither assumption can be made.
   ConditionTruthVal isNull(ProgramStateRef State, SymbolRef Sym) {
     SaveAndRestore<bool> DisableNotify(NotifyAssumeClients, false);
 
     return checkNull(State, Sym);
   }
 
+  /// canReasonAbout - Not all ConstraintManagers can reason about floating-
+  ///  point values.  Instead of first instantiating a floating-point SVal to
+  ///  query whether it is supported, use this to ask directly.
+  virtual bool canReasonAboutFloats() const = 0;
+
 protected:
   /// A flag to indicate that clients should be notified of assumptions.
   /// By default this is the case, but sometimes this needs to be restricted
   /// to avoid infinite recursions within the ConstraintManager.
   ///
   /// Note that this flag allows the ConstraintManager to be re-entrant,
   /// but not thread-safe.
   bool NotifyAssumeClients;

 
 std::unique_ptr<ConstraintManager>
 CreateRangeConstraintManager(ProgramStateManager &statemgr,
                              SubEngine *subengine);
 
 std::unique_ptr<ConstraintManager>
 CreateZ3ConstraintManager(ProgramStateManager &statemgr, SubEngine *subengine);
 
-} // end GR namespace
+} // namespace ento
 
-} // end clang namespace
+} // namespace clang
 
 #endif

include/clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h

 namespace clang {
 
 class CXXBoolLiteralExpr;
 
 namespace ento {
 
 class SValBuilder {
   virtual void anchor();
+
 protected:
   ASTContext &Context;
-  
   /// Manager of APSInt values.
   BasicValueFactory BasicVals;
 
   /// Manages the creation of symbols.
   SymbolManager SymMgr;
 
   /// Manages the creation of memory regions.
   MemRegionManager MemMgr;
 
   ProgramStateManager &StateMgr;
 
   /// The scalar type to use for array indices.
   const QualType ArrayIndexTy;
-  
   /// The width of the scalar type used for array indices.
   const unsigned ArrayIndexWidth;
 
   virtual SVal evalCastFromNonLoc(NonLoc val, QualType castTy) = 0;
   virtual SVal evalCastFromLoc(Loc val, QualType castTy) = 0;
 
 public:
   // FIXME: Make these protected again once RegionStoreManager correctly
   // handles loads from different bound value types.
   virtual SVal dispatchCast(SVal val, QualType castTy) = 0;
 
 public:
   SValBuilder(llvm::BumpPtrAllocator &alloc, ASTContext &context,
               ProgramStateManager &stateMgr)
       : Context(context), BasicVals(context, alloc),
-      SymMgr(context, BasicVals, alloc),
-      MemMgr(context, alloc),
-      StateMgr(stateMgr),
-      ArrayIndexTy(context.LongLongTy),
+        SymMgr(context, BasicVals, alloc), MemMgr(context, alloc),
+        StateMgr(stateMgr), ArrayIndexTy(context.LongLongTy),
         ArrayIndexWidth(context.getTypeSize(ArrayIndexTy)) {}
 
   virtual ~SValBuilder() {}
 
   bool haveSameType(const SymExpr *Sym1, const SymExpr *Sym2) {
     return haveSameType(Sym1->getType(), Sym2->getType());
   }
 
   bool haveSameType(QualType Ty1, QualType Ty2) {
virtual SVal evalBinOpLL(ProgramStateRef state, BinaryOperator::Opcode op,
                            Loc lhs, Loc rhs, QualType resultTy) = 0;
 
   /// Create a new value which represents a binary expression with a memory
   /// location and non-location operands. For example, this would be used to
   /// evaluate a pointer arithmetic operation.
   virtual SVal evalBinOpLN(ProgramStateRef state, BinaryOperator::Opcode op,
                            Loc lhs, NonLoc rhs, QualType resultTy) = 0;
 
-  /// Evaluates a given SVal. If the SVal has only one possible (integer) value,
+  /// Evaluates a given SVal. If the SVal has only one possible integer value,
+  /// that value is returned. Otherwise, returns NULL.
+  virtual const llvm::APSInt *getKnownIntValue(ProgramStateRef state,
+                                            SVal val) = 0;
+
+  /// Evaluates a given SVal. If the SVal has only one possible float value,
   /// that value is returned. Otherwise, returns NULL.
-  virtual const llvm::APSInt *getKnownValue(ProgramStateRef state, SVal val) = 0;
+  virtual const llvm::APFloat *getKnownFloatValue(ProgramStateRef state,
+                                                  SVal val) = 0;
 
   /// Simplify symbolic expressions within a given SVal. Return an SVal
   /// that represents the same value, but is hopefully easier to work with
   /// than the original SVal.
   virtual SVal simplifySVal(ProgramStateRef State, SVal Val) = 0;
-  
   /// Constructs a symbolic expression for two non-location values.
   SVal makeSymExprValNN(ProgramStateRef state, BinaryOperator::Opcode op,
                         NonLoc lhs, NonLoc rhs, QualType resultTy);
 
-  SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op,
-                 SVal lhs, SVal rhs, QualType type);
-  
+  SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op, SVal lhs,
+                 SVal rhs, QualType type);
   DefinedOrUnknownSVal evalEQ(ProgramStateRef state, DefinedOrUnknownSVal lhs,
                               DefinedOrUnknownSVal rhs);
 
   ASTContext &getContext() { return Context; }
   const ASTContext &getContext() const { return Context; }
 
   ProgramStateManager &getStateManager() { return StateMgr; }
-  
   QualType getConditionType() const {
     return Context.getLangOpts().CPlusPlus ? Context.BoolTy : Context.IntTy;
   }
-  
-  QualType getArrayIndexType() const {
-    return ArrayIndexTy;
-  }
+  QualType getArrayIndexType() const { return ArrayIndexTy; }
 
   BasicValueFactory &getBasicValueFactory() { return BasicVals; }
   const BasicValueFactory &getBasicValueFactory() const { return BasicVals; }
 
   SymbolManager &getSymbolManager() { return SymMgr; }
   const SymbolManager &getSymbolManager() const { return SymMgr; }
 
   MemRegionManager &getRegionManager() { return MemMgr; }
   const MemRegionManager &getRegionManager() const { return MemMgr; }
 
   // Forwarding methods to SymbolManager.
 
-  const SymbolConjured* conjureSymbol(const Stmt *stmt,
+  const SymbolConjured *conjureSymbol(const Stmt *stmt,
                                       const LocationContext *LCtx,
-                                      QualType type,
-                                      unsigned visitCount,
+                                      QualType type, unsigned visitCount,
                                       const void *symbolTag = nullptr) {
     return SymMgr.conjureSymbol(stmt, LCtx, type, visitCount, symbolTag);
   }
 
-  const SymbolConjured* conjureSymbol(const Expr *expr,
+  const SymbolConjured *conjureSymbol(const Expr *expr,
                                       const LocationContext *LCtx,
                                       unsigned visitCount,
                                       const void *symbolTag = nullptr) {
     return SymMgr.conjureSymbol(expr, LCtx, visitCount, symbolTag);
   }
 
   /// Construct an SVal representing '0' for the specified type.
   DefinedOrUnknownSVal makeZeroVal(QualType type);
 
   /// Make a unique symbol for value of region.
   DefinedOrUnknownSVal getRegionValueSymbolVal(const TypedValueRegion *region);
 
   /// \brief Create a new symbol with a unique 'name'.
   ///
   /// We resort to conjured symbols when we cannot construct a derived symbol.
   /// The advantage of symbols derived/built from other symbols is that we
   /// preserve the relation between related(or even equivalent) expressions, so
   /// conjured symbols should be used sparingly.
-  DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag,
-                                        const Expr *expr,
+  DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag, const Expr *expr,
                                         const LocationContext *LCtx,
                                         unsigned count);
-  DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag,
-                                        const Expr *expr,
+  DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag, const Expr *expr,
                                         const LocationContext *LCtx,
-                                        QualType type,
-                                        unsigned count);
-  
+                                        QualType type, unsigned count);
   DefinedOrUnknownSVal conjureSymbolVal(const Stmt *stmt,
                                         const LocationContext *LCtx,
-                                        QualType type,
-                                        unsigned visitCount);
+                                        QualType type, unsigned visitCount);
   /// \brief Conjure a symbol representing heap allocated memory region.
   ///
   /// Note, the expression should represent a location.
   DefinedOrUnknownSVal getConjuredHeapSymbolVal(const Expr *E,
                                                 const LocationContext *LCtx,
                                                 unsigned Count);
 
-  DefinedOrUnknownSVal getDerivedRegionValueSymbolVal(
-      SymbolRef parentSymbol, const TypedValueRegion *region);
+  DefinedOrUnknownSVal
+  getDerivedRegionValueSymbolVal(SymbolRef parentSymbol,
+                                 const TypedValueRegion *region);
 
   DefinedSVal getMetadataSymbolVal(const void *symbolTag,
-                                   const MemRegion *region,
-                                   const Expr *expr, QualType type,
-                                   const LocationContext *LCtx,
+                                   const MemRegion *region, const Expr *expr,
+                                   QualType type, const LocationContext *LCtx,
                                    unsigned count);
 
   DefinedSVal getMemberPointer(const DeclaratorDecl *DD);
 
   DefinedSVal getFunctionPointer(const FunctionDecl *func);
-  
   DefinedSVal getBlockPointer(const BlockDecl *block, CanQualType locTy,
                               const LocationContext *locContext,
                               unsigned blockCount);
 
   /// Returns the value of \p E, if it can be determined in a non-path-sensitive
   /// manner.
   ///
   /// If \p E is not a constant or cannot be modeled, returns \c None.
   Optional<SVal> getConstantVal(const Expr *E);
 
   NonLoc makeCompoundVal(QualType type, llvm::ImmutableList<SVal> vals) {
     return nonloc::CompoundVal(BasicVals.getCompoundValData(type, vals));
   }
 
-  NonLoc makeLazyCompoundVal(const StoreRef &store, 
+  NonLoc makeLazyCompoundVal(const StoreRef &store,
                              const TypedValueRegion *region) {
     return nonloc::LazyCompoundVal(
         BasicVals.getLazyCompoundValData(store, region));
   }
 
   NonLoc makePointerToMember(const DeclaratorDecl *DD) {
     return nonloc::PointerToMember(DD);
   }
 
   NonLoc makePointerToMember(const PointerToMemberData *PTMD) {
     return nonloc::PointerToMember(PTMD);
   }
 
   NonLoc makeZeroArrayIndex() {
     return nonloc::ConcreteInt(BasicVals.getValue(0, ArrayIndexTy));
   }
 
   NonLoc makeArrayIndex(uint64_t idx) {
     return nonloc::ConcreteInt(BasicVals.getValue(idx, ArrayIndexTy));
   }
 
   SVal convertToArrayIndex(SVal val);
 
-  nonloc::ConcreteInt makeIntVal(const IntegerLiteral* integer) {
-    return nonloc::ConcreteInt(
-        BasicVals.getValue(integer->getValue(),
-                     integer->getType()->isUnsignedIntegerOrEnumerationType()));
+  nonloc::ConcreteInt makeIntVal(const IntegerLiteral *integer) {
+    return nonloc::ConcreteInt(BasicVals.getValue(
+        integer->getValue(),
   }
 
   nonloc::ConcreteInt makeBoolVal(const ObjCBoolLiteralExpr *boolean) {
     return makeTruthVal(boolean->getValue(), boolean->getType());
   }
 
   nonloc::ConcreteInt makeBoolVal(const CXXBoolLiteralExpr *boolean);
 
-  nonloc::ConcreteInt makeIntVal(const llvm::APSInt& integer) {
+  nonloc::ConcreteInt makeIntVal(const llvm::APSInt &integer) {
     return nonloc::ConcreteInt(BasicVals.getValue(integer));
   }
 
   loc::ConcreteInt makeIntLocVal(const llvm::APSInt &integer) {
     return loc::ConcreteInt(BasicVals.getValue(integer));
   }
 
-  NonLoc makeIntVal(const llvm::APInt& integer, bool isUnsigned) {
+  NonLoc makeIntVal(const llvm::APInt &integer, bool isUnsigned) {
     return nonloc::ConcreteInt(BasicVals.getValue(integer, isUnsigned));
   }
 
   DefinedSVal makeIntVal(uint64_t integer, QualType type) {
     if (Loc::isLocType(type))
       return loc::ConcreteInt(BasicVals.getValue(integer, type));
 
     return nonloc::ConcreteInt(BasicVals.getValue(integer, type));
   }
 
   NonLoc makeIntVal(uint64_t integer, bool isUnsigned) {
     return nonloc::ConcreteInt(BasicVals.getIntValue(integer, isUnsigned));
   }
 
   NonLoc makeIntValWithPtrWidth(uint64_t integer, bool isUnsigned) {
     return nonloc::ConcreteInt(
         BasicVals.getIntWithPtrWidth(integer, isUnsigned));
   }
 
   NonLoc makeLocAsInteger(Loc loc, unsigned bits) {
     return nonloc::LocAsInteger(BasicVals.getPersistentSValWithData(loc, bits));
   }
 
+  nonloc::ConcreteFloat makeFloatVal(const FloatingLiteral *F) {
+    return nonloc::ConcreteFloat(BasicVals.getValue(F->getValue()));
+  }
+
+  nonloc::ConcreteFloat makeFloatVal(const llvm::APFloat &F) {
+    return nonloc::ConcreteFloat(BasicVals.getValue(F));
+  }
+
+  DefinedSVal makeFloatVal(uint64_t V, QualType T) {
+    assert(!Loc::isLocType(T));
+    return nonloc::ConcreteFloat(
+        BasicVals.getValue(V, Context.getFloatTypeSemantics(T)));
+  }
+
   NonLoc makeNonLoc(const SymExpr *lhs, BinaryOperator::Opcode op,
-                    const llvm::APSInt& rhs, QualType type);
+                    const llvm::APSInt &rhs, QualType type);
 
-  NonLoc makeNonLoc(const llvm::APSInt& rhs, BinaryOperator::Opcode op,
+  NonLoc makeNonLoc(const llvm::APSInt &rhs, BinaryOperator::Opcode op,
                     const SymExpr *lhs, QualType type);
 
   NonLoc makeNonLoc(const SymExpr *lhs, BinaryOperator::Opcode op,
+                    const llvm::APFloat &rhs, QualType type);
+
+  NonLoc makeNonLoc(const llvm::APFloat &lhs, BinaryOperator::Opcode op,
+                    const SymExpr *rhs, QualType type);
+
+  NonLoc makeNonLoc(const SymExpr *lhs, BinaryOperator::Opcode op,
                     const SymExpr *rhs, QualType type);
 
   /// \brief Create a NonLoc value for cast.
   NonLoc makeNonLoc(const SymExpr *operand, QualType fromTy, QualType toTy);
 
   nonloc::ConcreteInt makeTruthVal(bool b, QualType type) {
     return nonloc::ConcreteInt(BasicVals.getTruthValue(b, type));
   }
 
   nonloc::ConcreteInt makeTruthVal(bool b) {
     return nonloc::ConcreteInt(BasicVals.getTruthValue(b));
   }
 
   /// Create NULL pointer, with proper pointer bit-width for given address
   /// space.
   /// \param type pointer type.
   Loc makeNullWithType(QualType type) {
     return loc::ConcreteInt(BasicVals.getZeroWithTypeSize(type));
   }
 
-  Loc makeNull() {
-    return loc::ConcreteInt(BasicVals.getZeroWithPtrWidth());
-  }
+  Loc makeNull() { return loc::ConcreteInt(BasicVals.getZeroWithPtrWidth()); }
 
   Loc makeLoc(SymbolRef sym) {
     return loc::MemRegionVal(MemMgr.getSymbolicRegion(sym));
   }
 
-  Loc makeLoc(const MemRegion* region) {
-    return loc::MemRegionVal(region);
-  }
+  Loc makeLoc(const MemRegion *region) { return loc::MemRegionVal(region); }
 
   Loc makeLoc(const AddrLabelExpr *expr) {
     return loc::GotoLabel(expr->getLabel());
   }
 
-  Loc makeLoc(const llvm::APSInt& integer) {
+  Loc makeLoc(const llvm::APSInt &integer) {
     return loc::ConcreteInt(BasicVals.getValue(integer));
   }
 
   /// Return a memory region for the 'this' object reference.
   loc::MemRegionVal getCXXThis(const CXXMethodDecl *D,
                                const StackFrameContext *SFC);
 
   /// Return a memory region for the 'this' object reference.
   loc::MemRegionVal getCXXThis(const CXXRecordDecl *D,
                                const StackFrameContext *SFC);
 };
 
-SValBuilder* createSimpleSValBuilder(llvm::BumpPtrAllocator &alloc,
+SValBuilder *createSimpleSValBuilder(llvm::BumpPtrAllocator &alloc,
                                      ASTContext &context,
                                      ProgramStateManager &stateMgr);
 
-} // end GR namespace
+} // namespace ento
 
-} // end clang namespace
+} // namespace clang
 
 #endif

include/clang/StaticAnalyzer/Core/PathSensitive/SVals.h

public:
   inline bool isUnknownOrUndef() const {
     return getRawKind() <= UnknownValKind;
   }
 
   inline bool isValid() const {
     return getRawKind() > UnknownValKind;
   }
 
+  bool isFloat() const;
+
   bool isConstant() const;
 
   bool isConstant(int I) const;
 
+  bool isConstant(llvm::APFloat &V) const;
+
   bool isZeroConstant() const;
 
   /// hasConjuredSymbol - If this SVal wraps a conjured symbol, return true;
   bool hasConjuredSymbol() const;
 
   /// getAsFunctionDecl - If this SVal is a MemRegionVal and wraps a
   /// CodeTextRegion wrapping a FunctionDecl, return that FunctionDecl.
   /// Otherwise return 0.
public:
   SymExpr::symbol_iterator symbol_begin() const {
     const SymExpr *SE = getAsSymbolicExpression();
     if (SE)
       return SE->symbol_begin();
     else
       return SymExpr::symbol_iterator();
   }
 
-  SymExpr::symbol_iterator symbol_end() const { 
+  SymExpr::symbol_iterator symbol_end() const {
     return SymExpr::symbol_end();
   }
 };
 
 
 class UndefinedVal : public SVal {
 public:
   UndefinedVal() : SVal(UndefinedValKind) {}
 
 private:
   friend class SVal;
   static bool isKind(const SVal& V) {
     return V.getBaseKind() == UndefinedValKind;
   }
 };
 
 class DefinedOrUnknownSVal : public SVal {
 private:
   // We want calling these methods to be a compiler error since they are
   // tautologically false.
   bool isUndef() const = delete;
   bool isValid() const = delete;
-  
 protected:
   DefinedOrUnknownSVal() {}
   explicit DefinedOrUnknownSVal(const void *d, bool isLoc, unsigned ValKind)
     : SVal(d, isLoc, ValKind) {}
-  
   explicit DefinedOrUnknownSVal(BaseKind k, void *D = nullptr)
     : SVal(k, D) {}
-  
 private:
   friend class SVal;
   static bool isKind(const SVal& V) {
     return !V.isUndef();
   }
 };
-  
 class UnknownVal : public DefinedOrUnknownSVal {
 public:
   explicit UnknownVal() : DefinedOrUnknownSVal(UnknownValKind) {}
-  
 private:
   friend class SVal;
   static bool isKind(const SVal &V) {
     return V.getBaseKind() == UnknownValKind;
   }
 };
 
 class DefinedSVal : public DefinedOrUnknownSVal {
protected:
   Loc() {}
   explicit Loc(unsigned SubKind, const void *D)
   : DefinedSVal(const_cast<void*>(D), true, SubKind) {}
 
 public:
   void dumpToStream(raw_ostream &Out) const;
 
   static inline bool isLocType(QualType T) {
-    return T->isAnyPointerType() || T->isBlockPointerType() || 
+    return T->isAnyPointerType() || T->isBlockPointerType() ||
            T->isReferenceType() || T->isNullPtrType();
   }
 
 private:
   friend class SVal;
   static bool isKind(const SVal& V) {
     return V.getBaseKind() == LocKind;
   }
return V.getBaseKind() == NonLocKind &&
            V.getSubKind() == ConcreteIntKind;
   }
 
   static bool isKind(const NonLoc& V) {
     return V.getSubKind() == ConcreteIntKind;
   }
 };
 
+/// \brief Value representing floating-point constant.
+class ConcreteFloat : public NonLoc {
+public:
+  explicit ConcreteFloat(const llvm::APFloat& V) : NonLoc(ConcreteFloatKind, &V) {}
+
+  const llvm::APFloat& getValue() const {
+    return *static_cast<const llvm::APFloat*>(Data);
+  }
+
+  // Transfer functions for binary/unary operations on ConcreteFloats.
+  SVal evalBinOp(SValBuilder &svalBuilder, BinaryOperator::Opcode Op,
+                 const ConcreteFloat& R) const;
+
+  ConcreteFloat evalMinus(SValBuilder &svalBuilder) const;
+
+private:
+  friend class SVal;
+  ConcreteFloat() {}
+  static bool isKind(const SVal& V) {
+    return V.getBaseKind() == NonLocKind &&
+           V.getSubKind() == ConcreteFloatKind;
+  }
+
+  static bool isKind(const NonLoc& V) {
+    return V.getSubKind() == ConcreteFloatKind;
+  }
+};
+
 class LocAsInteger : public NonLoc {
   friend class ento::SValBuilder;
 
   explicit LocAsInteger(const std::pair<SVal, uintptr_t> &data)
       : NonLoc(LocAsIntegerKind, &data) {
     // We do not need to represent loc::ConcreteInt as LocAsInteger,
     // as it'd collapse into a nonloc::ConcreteInt instead.
     assert(data.first.getBaseKind() == LocKind &&

include/clang/StaticAnalyzer/Core/PathSensitive/SVals.def

ABSTRACT_SVAL(DefinedOrUnknownSVal, SVal)
   ABSTRACT_SVAL(DefinedSVal, DefinedOrUnknownSVal)
     ABSTRACT_SVAL_WITH_KIND(Loc, DefinedSVal)
       LOC_SVAL(ConcreteInt, Loc)
       LOC_SVAL(GotoLabel, Loc)
       LOC_SVAL(MemRegionVal, Loc)
     ABSTRACT_SVAL_WITH_KIND(NonLoc, DefinedSVal)
       NONLOC_SVAL(CompoundVal, NonLoc)
       NONLOC_SVAL(ConcreteInt, NonLoc)
+      NONLOC_SVAL(ConcreteFloat, NonLoc)
       NONLOC_SVAL(LazyCompoundVal, NonLoc)
       NONLOC_SVAL(LocAsInteger, NonLoc)
       NONLOC_SVAL(SymbolVal, NonLoc)
       NONLOC_SVAL(PointerToMember, NonLoc)
 
 #undef NONLOC_SVAL
 #undef LOC_SVAL
 #undef ABSTRACT_SVAL_WITH_KIND
 #undef ABSTRACT_SVAL
 #undef BASIC_SVAL

include/clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h

 #include "clang/StaticAnalyzer/Core/PathSensitive/SymExpr.h"
 #include "llvm/ADT/DenseMap.h"
 #include "llvm/ADT/DenseSet.h"
 #include "llvm/ADT/FoldingSet.h"
 #include "llvm/Support/Allocator.h"
 #include "llvm/Support/DataTypes.h"
 
 namespace clang {
-  class ASTContext;
-  class StackFrameContext;
 
 namespace ento {
-  class BasicValueFactory;
-  class SubRegion;
-  class TypedValueRegion;
-  class VarRegion;
 
 ///\brief A symbol representing the value stored at a MemRegion.
 class SymbolRegionValue : public SymbolData {
   const TypedValueRegion *R;
 
 public:
   SymbolRegionValue(SymbolID sym, const TypedValueRegion *r)
       : SymbolData(SymbolRegionValueKind, sym), R(r) {
     assert(r);
     assert(isValidTypeForSymbol(r->getValueType()));
   }
 
-  const TypedValueRegion* getRegion() const { return R; }
+  const TypedValueRegion *getRegion() const { return R; }
 
-  static void Profile(llvm::FoldingSetNodeID& profile, const TypedValueRegion* R) {
-    profile.AddInteger((unsigned) SymbolRegionValueKind);
+  static void Profile(llvm::FoldingSetNodeID &profile,
+                      const TypedValueRegion *R) {
+    profile.AddInteger((unsigned)SymbolRegionValueKind);
     profile.AddPointer(R);
   }
 
-  void Profile(llvm::FoldingSetNodeID& profile) override {
+  void Profile(llvm::FoldingSetNodeID &profile) override {
     Profile(profile, R);
   }
 
   void dumpToStream(raw_ostream &os) const override;
   const MemRegion *getOriginRegion() const override { return getRegion(); }
 
   QualType getType() const override;
 
public:
   const Stmt *getStmt() const { return S; }
   unsigned getCount() const { return Count; }
   const void *getTag() const { return SymbolTag; }
 
   QualType getType() const override;
 
   void dumpToStream(raw_ostream &os) const override;
 
-  static void Profile(llvm::FoldingSetNodeID& profile, const Stmt *S,
+  static void Profile(llvm::FoldingSetNodeID &profile, const Stmt *S,
                       QualType T, unsigned Count, const LocationContext *LCtx,
                       const void *SymbolTag) {
-    profile.AddInteger((unsigned) SymbolConjuredKind);
+    profile.AddInteger((unsigned)SymbolConjuredKind);
     profile.AddPointer(S);
     profile.AddPointer(LCtx);
     profile.Add(T);
     profile.AddInteger(Count);
     profile.AddPointer(SymbolTag);
   }
 
-  void Profile(llvm::FoldingSetNodeID& profile) override {
+  void Profile(llvm::FoldingSetNodeID &profile) override {
     Profile(profile, S, T, Count, LCtx, SymbolTag);
   }
 
   // Implement isa<T> support.
   static inline bool classof(const SymExpr *SE) {
     return SE->getKind() == SymbolConjuredKind;
   }
 };
public:
   SymbolRef getParentSymbol() const { return parentSymbol; }
   const TypedValueRegion *getRegion() const { return R; }
 
   QualType getType() const override;
 
   void dumpToStream(raw_ostream &os) const override;
   const MemRegion *getOriginRegion() const override { return getRegion(); }
 
-  static void Profile(llvm::FoldingSetNodeID& profile, SymbolRef parent,
+  static void Profile(llvm::FoldingSetNodeID &profile, SymbolRef parent,
                       const TypedValueRegion *r) {
-    profile.AddInteger((unsigned) SymbolDerivedKind);
+    profile.AddInteger((unsigned)SymbolDerivedKind);
     profile.AddPointer(r);
     profile.AddPointer(parent);
   }
 
-  void Profile(llvm::FoldingSetNodeID& profile) override {
+  void Profile(llvm::FoldingSetNodeID &profile) override {
     Profile(profile, parentSymbol, R);
   }
 
   // Implement isa<T> support.
   static inline bool classof(const SymExpr *SE) {
     return SE->getKind() == SymbolDerivedKind;
   }
 };
 
 /// SymbolExtent - Represents the extent (size in bytes) of a bounded region.
 ///  Clients should not ask the SymbolManager for a region's extent. Always use
 ///  SubRegion::getExtent instead -- the value returned may not be a symbol.
 class SymbolExtent : public SymbolData {
   const SubRegion *R;
-  
 public:
   SymbolExtent(SymbolID sym, const SubRegion *r)
       : SymbolData(SymbolExtentKind, sym), R(r) {
     assert(r);
   }
 
   const SubRegion *getRegion() const { return R; }
 
   QualType getType() const override;
 
   void dumpToStream(raw_ostream &os) const override;
 
-  static void Profile(llvm::FoldingSetNodeID& profile, const SubRegion *R) {
-    profile.AddInteger((unsigned) SymbolExtentKind);
+  static void Profile(llvm::FoldingSetNodeID &profile, const SubRegion *R) {
+    profile.AddInteger((unsigned)SymbolExtentKind);
     profile.AddPointer(R);
   }
 
-  void Profile(llvm::FoldingSetNodeID& profile) override {
+  void Profile(llvm::FoldingSetNodeID &profile) override {
     Profile(profile, R);
   }
 
   // Implement isa<T> support.
   static inline bool classof(const SymExpr *SE) {
     return SE->getKind() == SymbolExtentKind;
   }
 };
 
 /// SymbolMetadata - Represents path-dependent metadata about a specific region.
 ///  Metadata symbols remain live as long as they are marked as in use before
 ///  dead-symbol sweeping AND their associated regions are still alive.
 ///  Intended for use by checkers.
 class SymbolMetadata : public SymbolData {
-  const MemRegion* R;
+  const MemRegion *R;
   const Stmt *S;
   QualType T;
   const LocationContext *LCtx;
   unsigned Count;
   const void *Tag;
+
 public:
-  SymbolMetadata(SymbolID sym, const MemRegion* r, const Stmt *s, QualType t,
+  SymbolMetadata(SymbolID sym, const MemRegion *r, const Stmt *s, QualType t,
                  const LocationContext *LCtx, unsigned count, const void *tag)
       : SymbolData(SymbolMetadataKind, sym), R(r), S(s), T(t), LCtx(LCtx),
         Count(count), Tag(tag) {
-      assert(r);
-      assert(s);
-      assert(isValidTypeForSymbol(t));
-      assert(LCtx);
-      assert(tag);
-    }
 
   const MemRegion *getRegion() const { return R; }
   const Stmt *getStmt() const { return S; }
   const LocationContext *getLocationContext() const { return LCtx; }
   unsigned getCount() const { return Count; }
   const void *getTag() const { return Tag; }
 
   QualType getType() const override;
 
   void dumpToStream(raw_ostream &os) const override;
 
-  static void Profile(llvm::FoldingSetNodeID& profile, const MemRegion *R,
+  static void Profile(llvm::FoldingSetNodeID &profile, const MemRegion *R,
                       const Stmt *S, QualType T, const LocationContext *LCtx,
                       unsigned Count, const void *Tag) {
-    profile.AddInteger((unsigned) SymbolMetadataKind);
+    profile.AddInteger((unsigned)SymbolMetadataKind);
     profile.AddPointer(R);
     profile.AddPointer(S);
     profile.Add(T);
     profile.AddPointer(LCtx);
     profile.AddInteger(Count);
     profile.AddPointer(Tag);
   }
 
-  void Profile(llvm::FoldingSetNodeID& profile) override {
+  void Profile(llvm::FoldingSetNodeID &profile) override {
     Profile(profile, R, S, T, LCtx, Count, Tag);
   }
 
   // Implement isa<T> support.
   static inline bool classof(const SymExpr *SE) {
     return SE->getKind() == SymbolMetadataKind;
   }
 };
public:
   }
 
   QualType getType() const override { return ToTy; }
 
   const SymExpr *getOperand() const { return Operand; }
 
   void dumpToStream(raw_ostream &os) const override;
 
-  static void Profile(llvm::FoldingSetNodeID& ID,
-                      const SymExpr *In, QualType From, QualType To) {
-    ID.AddInteger((unsigned) SymbolCastKind);
+  static void Profile(llvm::FoldingSetNodeID &ID, const SymExpr *In,
+                      QualType From, QualType To) {
+    ID.AddInteger((unsigned)SymbolCastKind);
     ID.AddPointer(In);
     ID.Add(From);
     ID.Add(To);
   }
 
-  void Profile(llvm::FoldingSetNodeID& ID) override {
+  void Profile(llvm::FoldingSetNodeID &ID) override {
     Profile(ID, Operand, FromTy, ToTy);
   }
 
   // Implement isa<T> support.
   static inline bool classof(const SymExpr *SE) {
     return SE->getKind() == SymbolCastKind;
   }
 };
 
-/// \brief Represents a symbolic expression involving a binary operator 
+/// \brief Represents a symbolic expression involving a binary operator
 class BinarySymExpr : public SymExpr {
   BinaryOperator::Opcode Op;
   QualType T;
 
 protected:
   BinarySymExpr(Kind k, BinaryOperator::Opcode op, QualType t)
       : SymExpr(k), Op(op), T(t) {
     assert(classof(this));
static inline bool classof(const SymExpr *SE) {
     Kind k = SE->getKind();
     return k >= BEGIN_BINARYSYMEXPRS && k <= END_BINARYSYMEXPRS;
   }
 };
 
 /// \brief Represents a symbolic expression like 'x' + 3.
 class SymIntExpr : public BinarySymExpr {
   const SymExpr *LHS;
-  const llvm::APSInt& RHS;
+  const llvm::APSInt &RHS;
 
 public:
   SymIntExpr(const SymExpr *lhs, BinaryOperator::Opcode op,
              const llvm::APSInt &rhs, QualType t)
       : BinarySymExpr(SymIntExprKind, op, t), LHS(lhs), RHS(rhs) {
     assert(lhs);
   }
 
   void dumpToStream(raw_ostream &os) const override;
 
   const SymExpr *getLHS() const { return LHS; }
   const llvm::APSInt &getRHS() const { return RHS; }
 
-  static void Profile(llvm::FoldingSetNodeID& ID, const SymExpr *lhs,
-                      BinaryOperator::Opcode op, const llvm::APSInt& rhs,
+  static void Profile(llvm::FoldingSetNodeID &ID, const SymExpr *lhs,
+                      BinaryOperator::Opcode op, const llvm::APSInt &rhs,
                       QualType t) {
-    ID.AddInteger((unsigned) SymIntExprKind);
+    ID.AddInteger((unsigned)SymIntExprKind);
     ID.AddPointer(lhs);
     ID.AddInteger(op);
     ID.AddPointer(&rhs);
     ID.Add(t);
   }
 
-  void Profile(llvm::FoldingSetNodeID& ID) override {
+  void Profile(llvm::FoldingSetNodeID &ID) override {
     Profile(ID, LHS, getOpcode(), RHS, getType());
   }
 
   // Implement isa<T> support.
   static inline bool classof(const SymExpr *SE) {
     return SE->getKind() == SymIntExprKind;
   }
 };
 
 /// \brief Represents a symbolic expression like 3 - 'x'.
 class IntSymExpr : public BinarySymExpr {
-  const llvm::APSInt& LHS;
+  const llvm::APSInt &LHS;
   const SymExpr *RHS;
 
 public:
   IntSymExpr(const llvm::APSInt &lhs, BinaryOperator::Opcode op,
              const SymExpr *rhs, QualType t)
       : BinarySymExpr(IntSymExprKind, op, t), LHS(lhs), RHS(rhs) {
     assert(rhs);
   }
 
   void dumpToStream(raw_ostream &os) const override;
 
   const SymExpr *getRHS() const { return RHS; }
   const llvm::APSInt &getLHS() const { return LHS; }
 
-  static void Profile(llvm::FoldingSetNodeID& ID, const llvm::APSInt& lhs,
+  static void Profile(llvm::FoldingSetNodeID &ID, const llvm::APSInt &lhs,
                       BinaryOperator::Opcode op, const SymExpr *rhs,
                       QualType t) {
-    ID.AddInteger((unsigned) IntSymExprKind);
+    ID.AddInteger((unsigned)IntSymExprKind);
     ID.AddPointer(&lhs);
     ID.AddInteger(op);
     ID.AddPointer(rhs);
     ID.Add(t);
   }
 
-  void Profile(llvm::FoldingSetNodeID& ID) override {
+  void Profile(llvm::FoldingSetNodeID &ID) override {
     Profile(ID, LHS, getOpcode(), RHS, getType());
   }
 
   // Implement isa<T> support.
   static inline bool classof(const SymExpr *SE) {
     return SE->getKind() == IntSymExprKind;
   }
 };
 
+/// \brief Represents a symbolic expression like 'x' + 3.0.
+class SymFloatExpr : public BinarySymExpr {
+  const SymExpr *LHS;
+  const llvm::APFloat &RHS;
+
+public:
+  SymFloatExpr(const SymExpr *lhs, BinaryOperator::Opcode op,
+               const llvm::APFloat &rhs, QualType t)
+      : BinarySymExpr(SymFloatExprKind, op, t), LHS(lhs), RHS(rhs) {}
+
+  void dumpToStream(raw_ostream &os) const override;
+
+  const SymExpr *getLHS() const { return LHS; }
+  const llvm::APFloat &getRHS() const { return RHS; }
+
+  static void Profile(llvm::FoldingSetNodeID &ID, const SymExpr *lhs,
+                      BinaryOperator::Opcode op, const llvm::APFloat &rhs,
+                      QualType t) {
+    ID.AddInteger((unsigned)SymFloatExprKind);
+    ID.AddPointer(lhs);
+    ID.AddInteger(op);
+    ID.AddPointer(&rhs);
+    ID.Add(t);
+  }
+
+  void Profile(llvm::FoldingSetNodeID &ID) override {
+    Profile(ID, LHS, getOpcode(), RHS, getType());
+  }
+
+  // Implement isa<T> support.
+  static inline bool classof(const SymExpr *SE) {
+    return SE->getKind() == SymFloatExprKind;
+  }
+};
+
+/// \brief Represents a symbolic expression like 3.0 - 'x'.
+class FloatSymExpr : public BinarySymExpr {
+  const llvm::APFloat &LHS;
+  const SymExpr *RHS;
+
+public:
+  FloatSymExpr(const llvm::APFloat &lhs, BinaryOperator::Opcode op,
+               const SymExpr *rhs, QualType t)
+      : BinarySymExpr(FloatSymExprKind, op, t), LHS(lhs), RHS(rhs) {}
+
+  void dumpToStream(raw_ostream &os) const override;
+
+  const SymExpr *getRHS() const { return RHS; }
+  const llvm::APFloat &getLHS() const { return LHS; }
+
+  static void Profile(llvm::FoldingSetNodeID &ID, const llvm::APFloat &lhs,
+                      BinaryOperator::Opcode op, const SymExpr *rhs,
+                      QualType t) {
+    ID.AddInteger((unsigned)FloatSymExprKind);
+    ID.AddPointer(&lhs);
+    ID.AddInteger(op);
+    ID.AddPointer(rhs);
+    ID.Add(t);
+  }
+
+  void Profile(llvm::FoldingSetNodeID &ID) override {
+    Profile(ID, LHS, getOpcode(), RHS, getType());
+  }
+
+  // Implement isa<T> support.
+  static inline bool classof(const SymExpr *SE) {
+    return SE->getKind() == FloatSymExprKind;
+  }
+};
+
 /// \brief Represents a symbolic expression like 'x' + 'y'.
 class SymSymExpr : public BinarySymExpr {
   const SymExpr *LHS;
   const SymExpr *RHS;
 
 public:
   SymSymExpr(const SymExpr *lhs, BinaryOperator::Opcode op, const SymExpr *rhs,
              QualType t)
       : BinarySymExpr(SymSymExprKind, op, t), LHS(lhs), RHS(rhs) {
     assert(lhs);
     assert(rhs);
   }
 
   const SymExpr *getLHS() const { return LHS; }
   const SymExpr *getRHS() const { return RHS; }
 
   void dumpToStream(raw_ostream &os) const override;
 
-  static void Profile(llvm::FoldingSetNodeID& ID, const SymExpr *lhs,
-                    BinaryOperator::Opcode op, const SymExpr *rhs, QualType t) {
-    ID.AddInteger((unsigned) SymSymExprKind);
+  static void Profile(llvm::FoldingSetNodeID &ID, const SymExpr *lhs,
+                      BinaryOperator::Opcode op, const SymExpr *rhs,
+                      QualType t) {
+    ID.AddInteger((unsigned)SymSymExprKind);
     ID.AddPointer(lhs);
     ID.AddInteger(op);
     ID.AddPointer(rhs);
     ID.Add(t);
   }
 
-  void Profile(llvm::FoldingSetNodeID& ID) override {
+  void Profile(llvm::FoldingSetNodeID &ID) override {
     Profile(ID, LHS, getOpcode(), RHS, getType());
   }
 
   // Implement isa<T> support.
   static inline bool classof(const SymExpr *SE) {
     return SE->getKind() == SymSymExprKind;
   }
 };
 
 class SymbolManager {
   typedef llvm::FoldingSet<SymExpr> DataSetTy;
-  typedef llvm::DenseMap<SymbolRef, SymbolRefSmallVectorTy*> SymbolDependTy;
+  typedef llvm::DenseMap<SymbolRef, SymbolRefSmallVectorTy *> SymbolDependTy;
 
   DataSetTy DataSet;
   /// Stores the extra dependencies between symbols: the data should be kept
   /// alive as long as the key is live.
   SymbolDependTy SymbolDependencies;
   unsigned SymbolCounter;
-  llvm::BumpPtrAllocator& BPAlloc;
+  llvm::BumpPtrAllocator &BPAlloc;
   BasicValueFactory &BV;
   ASTContext &Ctx;
 
 public:
   SymbolManager(ASTContext &ctx, BasicValueFactory &bv,
-                llvm::BumpPtrAllocator& bpalloc)
-    : SymbolDependencies(16), SymbolCounter(0),
-      BPAlloc(bpalloc), BV(bv), Ctx(ctx) {}
+                llvm::BumpPtrAllocator &bpalloc)
+      : SymbolDependencies(16), SymbolCounter(0), BPAlloc(bpalloc), BV(bv),
+        Ctx(ctx) {}
 
   ~SymbolManager();
 
   static bool canSymbolicate(QualType T);
 
   /// \brief Make a unique symbol for MemRegion R according to its kind.
-  const SymbolRegionValue* getRegionValueSymbol(const TypedValueRegion* R);
+  const SymbolRegionValue *getRegionValueSymbol(const TypedValueRegion *R);
 
-  const SymbolConjured* conjureSymbol(const Stmt *E,
-                                      const LocationContext *LCtx,
-                                      QualType T,
+  const SymbolConjured *conjureSymbol(const Stmt *E,
+                                      const LocationContext *LCtx, QualType T,
                                       unsigned VisitCount,
                                       const void *SymbolTag = nullptr);
 
-  const SymbolConjured* conjureSymbol(const Expr *E,
+  const SymbolConjured *conjureSymbol(const Expr *E,
                                       const LocationContext *LCtx,
                                       unsigned VisitCount,
                                       const void *SymbolTag = nullptr) {
     return conjureSymbol(E, LCtx, E->getType(), VisitCount, SymbolTag);
   }
 
   const SymbolDerived *getDerivedSymbol(SymbolRef parentSymbol,
                                         const TypedValueRegion *R);
 
   const SymbolExtent *getExtentSymbol(const SubRegion *R);
 
   /// \brief Creates a metadata symbol associated with a specific region.
   ///
   /// VisitCount can be used to differentiate regions corresponding to
   /// different loop iterations, thus, making the symbol path-dependent.
   const SymbolMetadata *getMetadataSymbol(const MemRegion *R, const Stmt *S,
                                           QualType T,
                                           const LocationContext *LCtx,
                                           unsigned VisitCount,
                                           const void *SymbolTag = nullptr);
 
-  const SymbolCast* getCastSymbol(const SymExpr *Operand,
-                                  QualType From, QualType To);
+  const SymbolCast *getCastSymbol(const SymExpr *Operand, QualType From,
+                                  QualType To);
 
   const SymIntExpr *getSymIntExpr(const SymExpr *lhs, BinaryOperator::Opcode op,
-                                  const llvm::APSInt& rhs, QualType t);
+                                  const llvm::APSInt &rhs, QualType t);
 
-  const SymIntExpr *getSymIntExpr(const SymExpr &lhs, BinaryOperator::Opcode op,
-                                  const llvm::APSInt& rhs, QualType t) {
-    return getSymIntExpr(&lhs, op, rhs, t);
-  }
-
-  const IntSymExpr *getIntSymExpr(const llvm::APSInt& lhs,
+  const IntSymExpr *getIntSymExpr(const llvm::APSInt &lhs,
+                                  BinaryOperator::Opcode op, const SymExpr *rhs,
+                                  QualType t);
+
+  const SymFloatExpr *getSymFloatExpr(const SymExpr *lhs,
+                                      BinaryOperator::Opcode op,
+                                      const llvm::APFloat &rhs, QualType t);
+
+  const FloatSymExpr *getFloatSymExpr(const llvm::APFloat &lhs,
                                       BinaryOperator::Opcode op,
                                       const SymExpr *rhs, QualType t);
 
   const SymSymExpr *getSymSymExpr(const SymExpr *lhs, BinaryOperator::Opcode op,
                                   const SymExpr *rhs, QualType t);
 
-  QualType getType(const SymExpr *SE) const {
-    return SE->getType();
-  }
+  QualType getType(const SymExpr *SE) const { return SE->getType(); }
 
   /// \brief Add artificial symbol dependency.
   ///
   /// The dependent symbol should stay alive as long as the primary is alive.
   void addSymbolDependency(const SymbolRef Primary, const SymbolRef Dependent);
 
   const SymbolRefSmallVectorTy *getDependentSymbols(const SymbolRef Primary);
 
   ASTContext &getContext() { return Ctx; }
   BasicValueFactory &getBasicVals() { return BV; }
 };
 
 /// \brief A class responsible for cleaning up unused symbols.
 class SymbolReaper {
-  enum SymbolStatus {
-    NotProcessed,
-    HaveMarkedDependents
-  };
+  enum SymbolStatus { NotProcessed, HaveMarkedDependents };
 
   typedef llvm::DenseSet<SymbolRef> SymbolSetTy;
   typedef llvm::DenseMap<SymbolRef, SymbolStatus> SymbolMapTy;
   typedef llvm::DenseSet<const MemRegion *> RegionSetTy;
 
   SymbolMapTy TheLiving;
   SymbolSetTy MetadataInUse;
   SymbolSetTy TheDead;
 
   RegionSetTy RegionRoots;
-  
   const StackFrameContext *LCtx;
   const Stmt *Loc;
-  SymbolManager& SymMgr;
+  SymbolManager &SymMgr;
   StoreRef reapedStore;
   llvm::DenseMap<const MemRegion *, unsigned> includedRegionCache;
 
 public:
   /// \brief Construct a reaper object, which removes everything which is not
   /// live before we execute statement s in the given location context.
   ///
   /// If the statement is NULL, everything is this and parent contexts is
   /// considered live.
   /// If the stack frame context is NULL, everything on stack is considered
   /// dead.
-  SymbolReaper(const StackFrameContext *Ctx, const Stmt *s, SymbolManager& symmgr,
-               StoreManager &storeMgr)
-   : LCtx(Ctx), Loc(s), SymMgr(symmgr),
-     reapedStore(nullptr, storeMgr) {}
+  SymbolReaper(const StackFrameContext *Ctx, const Stmt *s,
+               SymbolManager &symmgr, StoreManager &storeMgr)
+      : LCtx(Ctx), Loc(s), SymMgr(symmgr), reapedStore(nullptr, storeMgr) {}
 
   const LocationContext *getLocationContext() const { return LCtx; }
 
   bool isLive(SymbolRef sym);
   bool isLiveRegion(const MemRegion *region);
   bool isLive(const Stmt *ExprVal, const LocationContext *LCtx) const;
   bool isLive(const VarRegion *VR, bool includeStoreBindings = false) const;
 
public:
   ///  Otherwise, if the symbol cannot be proven live, it is marked as dead.
   ///  Returns true if the symbol is dead, false if live.
   bool maybeDead(SymbolRef sym);
 
   typedef SymbolSetTy::const_iterator dead_iterator;
   dead_iterator dead_begin() const { return TheDead.begin(); }
   dead_iterator dead_end() const { return TheDead.end(); }
 
-  bool hasDeadSymbols() const {
-    return !TheDead.empty();
-  }
-  
+  bool hasDeadSymbols() const { return !TheDead.empty(); }
   typedef RegionSetTy::const_iterator region_iterator;
   region_iterator region_begin() const { return RegionRoots.begin(); }
   region_iterator region_end() const { return RegionRoots.end(); }
 
   /// \brief Returns whether or not a symbol has been confirmed dead.
   ///
   /// This should only be called once all marking of dead symbols has completed.
   /// (For checkers, this means only in the evalDeadSymbols callback.)
-  bool isDead(SymbolRef sym) const {
-    return TheDead.count(sym);
-  }
-  
+  bool isDead(SymbolRef sym) const { return TheDead.count(sym); }
   void markLive(const MemRegion *region);
   void markElementIndicesLive(const MemRegion *region);
-  
   /// \brief Set to the value of the symbolic store after
   /// StoreManager::removeDeadBindings has been called.
   void setReapedStore(StoreRef st) { reapedStore = st; }
 
 private:
   /// Mark the symbols dependent on the input symbol as live.
   void markDependentsLive(SymbolRef sym);
 };
 
 class SymbolVisitor {
 protected:
   ~SymbolVisitor() = default;
 
 public:
   SymbolVisitor() = default;
   SymbolVisitor(const SymbolVisitor &) = default;
   SymbolVisitor(SymbolVisitor &&) {}
 
-  /// \brief A visitor method invoked by ProgramStateManager::scanReachableSymbols.
+  /// \brief A visitor method invoked by
+  /// ProgramStateManager::scanReachableSymbols.
   ///
   /// The method returns \c true if symbols should continue be scanned and \c
   /// false otherwise.
   virtual bool VisitSymbol(SymbolRef sym) = 0;
   virtual bool VisitMemRegion(const MemRegion *region) { return true; }
 };
 
-} // end GR namespace
+} // namespace ento
 
-} // end clang namespace
+} // namespace clang
 
 namespace llvm {
 static inline raw_ostream &operator<<(raw_ostream &os,
                                       const clang::ento::SymExpr *SE) {
   SE->dumpToStream(os);
   return os;
 }
-} // end llvm namespace
+} // namespace llvm
 #endif

include/clang/StaticAnalyzer/Core/PathSensitive/Symbols.def

 
 #ifndef SYMBOL_RANGE
 #define SYMBOL_RANGE(Id, First, Last)
 #endif
 
 ABSTRACT_SYMBOL(BinarySymExpr, SymExpr)
   SYMBOL(IntSymExpr, BinarySymExpr)
   SYMBOL(SymIntExpr, BinarySymExpr)
+  SYMBOL(FloatSymExpr, BinarySymExpr)
+  SYMBOL(SymFloatExpr, BinarySymExpr)
   SYMBOL(SymSymExpr, BinarySymExpr)
 SYMBOL_RANGE(BINARYSYMEXPRS, IntSymExprKind, SymSymExprKind)
 
 SYMBOL(SymbolCast, SymExpr)
 
 ABSTRACT_SYMBOL(SymbolData, SymExpr)
   SYMBOL(SymbolConjured, SymbolData)
   SYMBOL(SymbolDerived, SymbolData)
   SYMBOL(SymbolExtent, SymbolData)
   SYMBOL(SymbolMetadata, SymbolData)
   SYMBOL(SymbolRegionValue, SymbolData)
 SYMBOL_RANGE(SYMBOLS, SymbolConjuredKind, SymbolRegionValueKind)
 
 #undef SYMBOL
 #undef ABSTRACT_SYMBOL
 #undef SYMBOL_RANGE

lib/StaticAnalyzer/Checkers/BuiltinFunctionChecker.cpp

if (!state) {
       C.generateSink(C.getState(), C.getPredecessor());
       return true;
     }
 
     C.addTransition(state);
     return true;
   }
 
+  case Builtin::BI__builtin_inf:
+  case Builtin::BI__builtin_inff:
+  case Builtin::BI__builtin_infl: {
+    SValBuilder &SVB = C.getSValBuilder();
+    ASTContext &Ctx = SVB.getContext();
+    llvm::APFloat Inf = llvm::APFloat::getInf(
+        Ctx.getFloatTypeSemantics(FD->getReturnType()));
+    SVal V = SVB.makeFloatVal(Inf);
+    C.addTransition(state->BindExpr(CE, LCtx, V));
+    return true;
+  }
+
+  // TODO: Model the string argument as well
+  case Builtin::BI__builtin_nan:
+  case Builtin::BI__builtin_nanf:
+  case Builtin::BI__builtin_nanl: {
+    SValBuilder &SVB = C.getSValBuilder();
+    ASTContext &Ctx = SVB.getContext();
+    llvm::APFloat NaN = llvm::APFloat::getQNaN(
+        Ctx.getFloatTypeSemantics(FD->getReturnType()));
+    SVal V = SVB.makeFloatVal(NaN);
+    C.addTransition(state->BindExpr(CE, LCtx, V));
+    return true;
+  }
+
+  case Builtin::BI__builtin_isinf: {
+    SValBuilder &SVB = C.getSValBuilder();
+    ASTContext &Ctx = SVB.getContext();
+    assert(CE->arg_begin() + 1 == CE->arg_end());
+    DefinedOrUnknownSVal V =
+        state->getSVal(*(CE->arg_begin()), LCtx).castAs<DefinedOrUnknownSVal>();
+
+    llvm::APFloat PInf = llvm::APFloat::getInf(
+        Ctx.getFloatTypeSemantics((*(CE->arg_begin()))->getType()), false);
+    DefinedOrUnknownSVal SPInf = SVB.makeFloatVal(PInf);
+    DefinedOrUnknownSVal isPInf = SVB.evalEQ(state, V, SPInf);
+    if (isPInf.isConstant(1)) {
+      C.addTransition(state->BindExpr(CE, LCtx, isPInf));
+      return true;
+    }
+
+    llvm::APFloat NInf = llvm::APFloat::getInf(
+        Ctx.getFloatTypeSemantics((*(CE->arg_begin()))->getType()), true);
+    DefinedOrUnknownSVal SNInf = SVB.makeFloatVal(NInf);
+    DefinedOrUnknownSVal isNInf = SVB.evalEQ(state, V, SNInf);
+    if (isPInf.isZeroConstant() && isNInf.isConstant(1)) {
+      C.addTransition(state->BindExpr(CE, LCtx, isNInf));
+      return true;
+    }
+
+    // TODO: FIXME
+    // This should be BO_LOr for (V == -\inf) || (V == \inf), but logical
+    // operations are handled much earlier during ExplodedGraph generation.
+    // However, since both sides are Boolean/Int1Ty, we can use bitwise or.
+    // If/when this is fixed, also remove the explicit short-circuits above.
+    SVal isInf = SVB.evalBinOp(state, BO_Or, isPInf, isNInf,
+                               SVB.getConditionType());
+    C.addTransition(state->BindExpr(CE, LCtx, isInf));
+    return true;
+  }
+
+  // TODO: FIXME
+  // IEEE-754 changes evaluation of direct comparison to NaN, which makes it
+  // difficult to express NaN constraints for the symbolic executor.
+  // As a workaround, express this as V != V, for which only NaN satisfies.
+  case Builtin::BI__builtin_isnan: {
+    SValBuilder &SVB = C.getSValBuilder();
+    assert(CE->arg_begin() + 1 == CE->arg_end());
+    SVal V = state->getSVal(*(CE->arg_begin()), LCtx);
+    SVal isNaN = SVB.evalBinOp(state, BO_NE, V, V, SVB.getConditionType());
+    C.addTransition(state->BindExpr(CE, LCtx, isNaN));
+    return true;
+  }
+
   case Builtin::BI__builtin_unpredictable:
   case Builtin::BI__builtin_expect:
   case Builtin::BI__builtin_assume_aligned:
   case Builtin::BI__builtin_addressof: {
     // For __builtin_unpredictable, __builtin_expect, and
     // __builtin_assume_aligned, just return the value of the subexpression.
     // __builtin_addressof is going from a reference to a pointer, but those
     // are represented the same way in the analyzer.

lib/StaticAnalyzer/Checkers/CMakeLists.txt

add_clang_library(clangStaticAnalyzerCheckers
   DebugCheckers.cpp
   DereferenceChecker.cpp
   DirectIvarAssignment.cpp
   DivZeroChecker.cpp
   DynamicTypePropagation.cpp
   DynamicTypeChecker.cpp
   ExprInspectionChecker.cpp
   FixedAddressChecker.cpp
+  FloatingPointMath.cpp
   GenericTaintChecker.cpp
   GTestChecker.cpp
   IdenticalExprChecker.cpp
   IteratorChecker.cpp
   IvarInvalidationChecker.cpp
   LLVMConventionsChecker.cpp
   LocalizationChecker.cpp
   MacOSKeychainAPIChecker.cpp

lib/StaticAnalyzer/Checkers/CStringChecker.cpp

if (s1StrLiteral && s2StrLiteral) {
     StringRef s2StrRef = s2StrLiteral->getString();
 
     if (isBounded) {
       // Get the max number of characters to compare.
       const Expr *lenExpr = CE->getArg(2);
       SVal lenVal = state->getSVal(lenExpr, LCtx);
 
       // If the length is known, we can get the right substrings.
-      if (const llvm::APSInt *len = svalBuilder.getKnownValue(state, lenVal)) {
+      if (const llvm::APSInt *len = svalBuilder.getKnownIntValue(state, lenVal)) {
         // Create substrings of each to compare the prefix.
         s1StrRef = s1StrRef.substr(0, (size_t)len->getZExtValue());
         s2StrRef = s2StrRef.substr(0, (size_t)len->getZExtValue());
         canComputeResult = true;
       }
     } else {
       // This is a normal, unbounded strcmp.
       canComputeResult = true;

lib/StaticAnalyzer/Checkers/CastSizeChecker.cpp

if (!R)
     return;
 
   const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(R);
   if (!SR)
     return;
 
   SValBuilder &svalBuilder = C.getSValBuilder();
   SVal extent = SR->getExtent(svalBuilder);
-  const llvm::APSInt *extentInt = svalBuilder.getKnownValue(state, extent);
+  const llvm::APSInt *extentInt = svalBuilder.getKnownIntValue(state, extent);
   if (!extentInt)
     return;
 
   CharUnits regionSize = CharUnits::fromQuantity(extentInt->getSExtValue());
   CharUnits typeSize = C.getASTContext().getTypeSizeInChars(ToPointeeTy);
 
   // Ignore void, and a few other un-sizeable types.
   if (typeSize.isZero())

lib/StaticAnalyzer/Checkers/FloatingPointMath.cpp

+//=== FloatingPointMathChecker.cpp --------------------------------*- C++
+//-*-===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// This checker evaluates calls to floating-point math functions for domain
+// errors.
+//
+//===----------------------------------------------------------------------===//
+
+#include "ClangSACheckers.h"
+#include "clang/Basic/Builtins.h"
+#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/ConstraintManager.h"
+
+using namespace clang;
+using namespace ento;
+
+namespace {
+class FloatingPointMathChecker : public Checker<check::PreCall> {
+  mutable std::unique_ptr<BuiltinBug> BT;
+
+  void reportError(StringRef Name, StringRef Domain, ProgramStateRef State,
+                   CheckerContext &C) const;
+
+  void inline handleAssumption(StringRef Name, StringRef Domain,
+                               std::pair<ProgramStateRef, ProgramStateRef> P,
+                               ProgramStateRef State, CheckerContext &C) const;
+
+  bool isNaN(SValBuilder &SVB, ProgramStateRef State, SVal V) const;
+
+public:
+  void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
+};
+
+} // end anonymous namespace
+
+void FloatingPointMathChecker::reportError(StringRef Name, StringRef Domain,
+                                           ProgramStateRef State,
+                                           CheckerContext &C) const {
+  if (ExplodedNode *N = C.generateNonFatalErrorNode(State)) {
+    if (!BT) {
+      BT.reset(new BuiltinBug(this, "Domain/range error"));
+    }
+
+    SmallString<100> Str;
+    llvm::raw_svector_ostream OS(Str);
+
+    OS << "Argument value is out of valid domain " << Domain
+       << " for function call to " << Name;
+    C.emitReport(llvm::make_unique<BugReport>(*BT, OS.str(), N));
+  }
+}
+
+void FloatingPointMathChecker::handleAssumption(
+    StringRef Name, StringRef Domain,
+    std::pair<ProgramStateRef, ProgramStateRef> P, ProgramStateRef State,
+    CheckerContext &C) const {
+  ProgramStateRef StT, StF;
+  std::tie(StT, StF) = P;
+
+  if (StF) {
+    reportError(Name, Domain, State, C);
+
+    if (!StT)
+      C.addTransition(StF);
+  }
+
+  if (!StF && StT)
+    C.addTransition(StT);
+}
+
+bool FloatingPointMathChecker::isNaN(SValBuilder &SVB, ProgramStateRef State,
+                                     SVal V) const {
+  SVal notNaN = SVB.evalBinOp(State, BO_EQ, V, V, SVB.getConditionType());
+  return notNaN.isUnknown() || notNaN.isZeroConstant();
+}
+
+void FloatingPointMathChecker::checkPreCall(const CallEvent &Call,
+                                            CheckerContext &C) const {
+  ProgramStateRef State = C.getState();
+  const Decl *D = Call.getDecl();
+  if (!D)
+    return;
+  const FunctionDecl *FD = dyn_cast<FunctionDecl>(D);
+  if (!FD)
+    return;
+
+  ConstraintManager &CM = C.getConstraintManager();
+  SValBuilder &SVB = C.getSValBuilder();
+  BasicValueFactory &BVF = SVB.getBasicValueFactory();
+  ASTContext &Ctx = SVB.getContext();
+  QualType Int32Ty = Ctx.getIntTypeForBitwidth(32, true);
+
+  StringRef Callee = FD->getName();
+  switch (FD->getBuiltinID()) {
+  default:
+    return;
+
+  // acos(x): -1 <= x <= 1
+  case Builtin::BIacos:
+  case Builtin::BIacosf:
+  case Builtin::BIacosl:
+  case Builtin::BIasin:
+  case Builtin::BIasinf:
+  case Builtin::BIasinl:
+  case Builtin::BI__builtin_acos:
+  case Builtin::BI__builtin_acosf:
+  case Builtin::BI__builtin_acosl:
+  case Builtin::BI__builtin_asin:
+  case Builtin::BI__builtin_asinf:
+  case Builtin::BI__builtin_asinl: {
+    assert(Call.getNumArgs() == 1);
+    SVal V = Call.getArgSVal(0);
+    llvm::APSInt From = BVF.getValue(-1, Int32Ty);
+    llvm::APSInt To = BVF.getValue(1, Int32Ty);
+
+    // Skip if known to be NaN, otherwise assume to be not NaN
+    if (isNaN(SVB, State, V))
+      return;
+
+    // This relies on the constraint manager promoting from APSInt to APFloat
+    // because the type of V is floating-point.
+    return handleAssumption(
+        Callee, "[-1, 1]",
+        CM.assumeInclusiveRangeDual(State, V.castAs<NonLoc>(), From, To), State,
+        C);
+  }
+
+  // acosh(x): x >= 1
+  case Builtin::BIacosh:
+  case Builtin::BIacoshf:
+  case Builtin::BIacoshl:
+  case Builtin::BI__builtin_acosh:
+  case Builtin::BI__builtin_acoshf:
+  case Builtin::BI__builtin_acoshl: {
+    StringRef Range = "[1, inf)";
+
+    assert(Call.getNumArgs() == 1);
+    SVal V = Call.getArgSVal(0);
+    llvm::APFloat From = BVF.getValue(
+        1, Ctx.getFloatTypeSemantics(Call.getArgExpr(0)->getType()));
+    DefinedOrUnknownSVal SV = SVB.makeFloatVal(From);
+
+    if (isNaN(SVB, State, V))
+      return;
+
+    SVal isGE = SVB.evalBinOp(State, BO_GE, V, SV, SVB.getConditionType());
+    if (isGE.isZeroConstant())
+      return reportError(Callee, Range, State, C);
+
+    return handleAssumption(Callee, Range,
+                            CM.assumeDual(State, isGE.castAs<DefinedSVal>()),
+                            State, C);
+  }
+
+  // atanh(x): -1 < x < 1
+  case Builtin::BIatanh:
+  case Builtin::BIatanhf:
+  case Builtin::BIatanhl:
+  case Builtin::BI__builtin_atanh:
+  case Builtin::BI__builtin_atanhf:
+  case Builtin::BI__builtin_atanhl: {
+    StringRef Range = "(-1, 1)";
+
+    assert(Call.getNumArgs() == 1);
+    SVal V = Call.getArgSVal(0);
+    llvm::APFloat From = BVF.getValue(
+        -1, Ctx.getFloatTypeSemantics(Call.getArgExpr(0)->getType()));
+    llvm::APFloat To = BVF.getValue(
+        1, Ctx.getFloatTypeSemantics(Call.getArgExpr(0)->getType()));
+
+    if (isNaN(SVB, State, V))
+      return;
+
+    DefinedOrUnknownSVal SFrom = SVB.makeFloatVal(From);
+    SVal isGT = SVB.evalBinOp(State, BO_GT, V, SFrom, SVB.getConditionType());
+    if (isGT.isZeroConstant())
+      return reportError(Callee, Range, State, C);
+
+    DefinedOrUnknownSVal STo = SVB.makeFloatVal(To);
+    SVal isLT = SVB.evalBinOp(State, BO_LT, V, STo, SVB.getConditionType());
+    if (isGT.isConstant(1) && isLT.isZeroConstant())
+      return reportError(Callee, Range, State, C);
+
+    // TODO: FIXME
+    // This should be BO_LAnd, but logical operations are handled much earlier
+    // during ExplodedGraph generation. However, since both sides are
+    // Boolean/Int1Ty, we can use bitwise and.
+    // If/when this is fixed, also remove the explicit short-circuits above.
+    SVal isIR =
+        SVB.evalBinOp(State, BO_And, isGT, isLT, SVB.getConditionType());
+    if (isIR.isZeroConstant())
+      return reportError(Callee, Range, State, C);
+
+    return handleAssumption(Callee, Range,
+                            CM.assumeDual(State, isIR.castAs<DefinedSVal>()),
+                            State, C);
+  }
+
+  // log(x): x >= 0
+  case Builtin::BIlog:
+  case Builtin::BIlogf:
+  case Builtin::BIlogl:
+  case Builtin::BIlog2:
+  case Builtin::BIlog2f:
+  case Builtin::BIlog2l:
+  case Builtin::BIlog10:
+  case Builtin::BIlog10f:
+  case Builtin::BIlog10l:
+  case Builtin::BIsqrt:
+  case Builtin::BIsqrtf:
+  case Builtin::BIsqrtl:
+  case Builtin::BI__builtin_log:
+  case Builtin::BI__builtin_logf:
+  case Builtin::BI__builtin_logl:
+  case Builtin::BI__builtin_log2:
+  case Builtin::BI__builtin_log2f:
+  case Builtin::BI__builtin_log2l:
+  case Builtin::BI__builtin_log10:
+  case Builtin::BI__builtin_log10f:
+  case Builtin::BI__builtin_log10l:
+  case Builtin::BI__builtin_sqrt:
+  case Builtin::BI__builtin_sqrtf:
+  case Builtin::BI__builtin_sqrtl: {
+    StringRef Range = "[0, inf)";
+
+    assert(Call.getNumArgs() == 1);
+    SVal V = Call.getArgSVal(0);
+    llvm::APFloat From = BVF.getValue(
+        0, Ctx.getFloatTypeSemantics(Call.getArgExpr(0)->getType()));
+    DefinedOrUnknownSVal SV = SVB.makeFloatVal(From);
+
+    if (isNaN(SVB, State, V))
+      return;
+
+    SVal isGE = SVB.evalBinOp(State, BO_GE, V, SV, SVB.getConditionType());
+    if (isGE.isZeroConstant())
+      return reportError(Callee, Range, State, C);
+
+    return handleAssumption(Callee, Range,
+                            CM.assumeDual(State, isGE.castAs<DefinedSVal>()),
+                            State, C);
+  }
+
+  // log1p(x): x >= -1
+  case Builtin::BIlog1p:
+  case Builtin::BIlog1pf:
+  case Builtin::BIlog1pl:
+  case Builtin::BI__builtin_log1p:
+  case Builtin::BI__builtin_log1pf:
+  case Builtin::BI__builtin_log1pl: {
+    StringRef Range = "[-1, inf)";
+
+    assert(Call.getNumArgs() == 1);
+    SVal V = Call.getArgSVal(0);
+    llvm::APFloat From = BVF.getValue(
+        -1, Ctx.getFloatTypeSemantics(Call.getArgExpr(0)->getType()));
+    DefinedOrUnknownSVal SV = SVB.makeFloatVal(From);
+
+    if (isNaN(SVB, State, V))
+      return;
+
+    SVal isGE = SVB.evalBinOp(State, BO_GE, V, SV, SVB.getConditionType());
+    if (isGE.isZeroConstant())
+      return reportError(Callee, Range, State, C);
+
+    return handleAssumption(Callee, Range,
+                            CM.assumeDual(State, isGE.castAs<DefinedSVal>()),
+                            State, C);
+  }
+
+  // logb(x): x != 0
+  case Builtin::BIlogb:
+  case Builtin::BIlogbf:
+  case Builtin::BIlogbl:
+  case Builtin::BI__builtin_logb:
+  case Builtin::BI__builtin_logbf:
+  case Builtin::BI__builtin_logbl: {
+    StringRef Range = "(-inf, 0) U (0, inf)";
+
+    assert(Call.getNumArgs() == 1);
+    SVal V = Call.getArgSVal(0);
+    llvm::APFloat From = BVF.getValue(
+        0, Ctx.getFloatTypeSemantics(Call.getArgExpr(0)->getType()));
+    DefinedOrUnknownSVal SV = SVB.makeFloatVal(From);
+
+    SVal isNE = SVB.evalBinOp(State, BO_NE, V, SV, SVB.getConditionType());
+    if (isNE.isZeroConstant())
+      return reportError(Callee, Range, State, C);
+
+    return handleAssumption(Callee, Range,
+                            CM.assumeDual(State, isNE.castAs<DefinedSVal>()),
+                            State, C);
+  }
+
+  // TODO:
+  // pow(x, y) : x > 0 || (x == 0 && y > 0) || (x < 0 && (int) y)
+  // case Builtin::BIpow:
+  // case Builtin::BIpowf:
+  // case Builtin::BIpowl:
+  // case Builtin::BI__builtin_pow:
+  // case Builtin::BI__builtin_powf:
+  // case Builtin::BI__builtin_powl:
+
+  // TODO:
+  // lgamma(x) : x != 0 && !(x < 0 && (int) x)
+  // case Builtin::BIlgamma:
+  // case Builtin::BIlgammaf:
+  // case Builtin::BIlgammal:
+  // case Builtin::BItgamma:
+  // case Builtin::BItgammaf:
+  // case Builtin::BItgammal:
+  // case Builtin::BI__builtin_lgamma:
+  // case Builtin::BI__builtin_lgammaf:
+  // case Builtin::BI__builtin_lgammal:
+  // case Builtin::BI__builtin_tgamma:
+  // case Builtin::BI__builtin_tgammaf:
+  // case Builtin::BI__builtin_tgammal:
+
+  // fmod(x,y) : y != 0
+  case Builtin::BIfmod:
+  case Builtin::BIfmodf:
+  case Builtin::BIfmodl:
+  case Builtin::BIremainder:
+  case Builtin::BIremainderf:
+  case Builtin::BIremainderl:
+  case Builtin::BI__builtin_fmod:
+  case Builtin::BI__builtin_fmodf:
+  case Builtin::BI__builtin_fmodl:
+  case Builtin::BI__builtin_remainder:
+  case Builtin::BI__builtin_remainderf:
+  case Builtin::BI__builtin_remainderl:
+  case Builtin::BI__builtin_remquo:
+  case Builtin::BI__builtin_remquof:
+  case Builtin::BI__builtin_remquol: {
+    StringRef Range = "(-inf, 0) U (0, inf)";
+
+    assert(Call.getNumArgs() >= 2);
+    SVal V = Call.getArgSVal(1);
+    llvm::APFloat From = BVF.getValue(
+        0, Ctx.getFloatTypeSemantics(Call.getArgExpr(1)->getType()));
+    DefinedOrUnknownSVal SV = SVB.makeFloatVal(From);
+
+    SVal isNE = SVB.evalBinOp(State, BO_NE, V, SV, SVB.getConditionType());
+    if (isNE.isZeroConstant())
+      return reportError(Callee, Range, State, C);
+
+    return handleAssumption(Callee, Range,
+                            CM.assumeDual(State, isNE.castAs<DefinedSVal>()),
+                            State, C);
+  }
+  }
+}
+
+void ento::registerFloatingPointMathChecker(CheckerManager &mgr) {
+  mgr.registerChecker<FloatingPointMathChecker>();
+}

lib/StaticAnalyzer/Core/BasicValueFactory.cpp

 
 BasicValueFactory::~BasicValueFactory() {
   // Note that the dstor for the contents of APSIntSet will never be called,
   // so we iterate over the set and invoke the dstor for each APSInt.  This
   // frees an aux. memory allocated to represent very large constants.
   for (APSIntSetTy::iterator I=APSIntSet.begin(), E=APSIntSet.end(); I!=E; ++I)
     I->getValue().~APSInt();
 
+  for (APFloatSetTy::iterator I=APFloatSet.begin(), E=APFloatSet.end(); I!=E; ++I)
+    I->getValue().~APFloat();
+
   delete (PersistentSValsTy*) PersistentSVals;
   delete (PersistentSValPairsTy*) PersistentSValPairs;
 }
 
 const llvm::APSInt& BasicValueFactory::getValue(const llvm::APSInt& X) {
   llvm::FoldingSetNodeID ID;
   void *InsertPos;
   typedef llvm::FoldingSetNodeWrapper<llvm::APSInt> FoldNodeTy;
const llvm::APSInt& BasicValueFactory::getValue(uint64_t X, unsigned BitWidth,
   return getValue(V);
 }
 
 const llvm::APSInt& BasicValueFactory::getValue(uint64_t X, QualType T) {
 
   return getValue(getAPSIntType(T).getValue(X));
 }
 
+const llvm::APFloat &BasicValueFactory::getValue(const llvm::APFloat& X) {
+  llvm::FoldingSetNodeID ID;
+  void *InsertPos;
+  typedef llvm::FoldingSetNodeWrapper<llvm::APFloat> FoldNodeTy;
+
+  X.Profile(ID);
+  FoldNodeTy* P = APFloatSet.FindNodeOrInsertPos(ID, InsertPos);
+
+  if (!P) {
+    P = (FoldNodeTy*) BPAlloc.Allocate<FoldNodeTy>();
+    new (P) FoldNodeTy(X);
+    APFloatSet.InsertNode(P, InsertPos);
+  }
+
+  return *P;
+}
+
+const llvm::APFloat &BasicValueFactory::getValue(int64_t X,
+                                                 const llvm::fltSemantics &S) {
+  return Convert(llvm::APSInt::get(X), S);
+}
+
 const CompoundValData*
 BasicValueFactory::getCompoundValData(QualType T,
                                       llvm::ImmutableList<SVal> Vals) {
 
   llvm::FoldingSetNodeID ID;
   CompoundValData::Profile(ID, T, Vals);
   void *InsertPos;
 

 }
 
 const llvm::APSInt*
 BasicValueFactory::evalAPSInt(BinaryOperator::Opcode Op,
                              const llvm::APSInt& V1, const llvm::APSInt& V2) {
 
   switch (Op) {
     default:
-      assert (false && "Invalid Opcode.");
+      llvm_unreachable("Unrecognized opcode!");
 
     case BO_Mul:
       return &getValue( V1 * V2 );
 
     case BO_Div:
       if (V2 == 0) // Avoid division by zero
         return nullptr;
       return &getValue( V1 / V2 );
switch (Op) {
     case BO_Or:
       return &getValue( V1 | V2 );
 
     case BO_Xor:
       return &getValue( V1 ^ V2 );
   }
 }
 
+const llvm::APFloat*
+BasicValueFactory::evalAPFloat(BinaryOperator::Opcode Op,
+                             const llvm::APFloat& V1, const llvm::APFloat& V2) {
+  llvm::APFloat NewV = V1;
+  llvm::APFloat::opStatus Status = llvm::APFloat::opOK;
+
+  switch (Op) {
+    default:
+      llvm_unreachable("Unrecognized opcode!");
+
+    case BO_Mul:
+      Status = NewV.multiply(V2, llvm::APFloat::rmNearestTiesToEven);
+      if (Status & llvm::APFloat::opOK)
+        return &getValue(NewV);
+      break;
+
+    case BO_Div:
+      Status = NewV.divide(V2, llvm::APFloat::rmNearestTiesToEven);
+      if (Status & llvm::APFloat::opOK)
+        return &getValue(NewV);
+      break;
+
+    case BO_Rem:
+      Status = NewV.remainder(V2);
+      if (Status & llvm::APFloat::opOK)
+        return &getValue(NewV);
+      break;
+
+    case BO_Add:
+      Status = NewV.add(V2, llvm::APFloat::rmNearestTiesToEven);
+      if (Status & llvm::APFloat::opOK)
+        return &getValue(NewV);
+      break;
+
+    case BO_Sub:
+      Status = NewV.subtract(V2, llvm::APFloat::rmNearestTiesToEven);
+      if (Status & llvm::APFloat::opOK)
+        return &getValue(NewV);
+      break;
+  }
+
+  return &getValue(NewV);
+}
+
+const llvm::APSInt*
+BasicValueFactory::evalAPFloatComparison(BinaryOperator::Opcode Op,
+                             const llvm::APFloat& V1, const llvm::APFloat& V2) {
+  llvm::APFloat::cmpResult R = V1.compare(V2);
+  switch (Op) {
+    default:
+      llvm_unreachable("Unrecognized opcode!");
+
+    case BO_LT:
+      return &getTruthValue(R == llvm::APFloat::cmpLessThan);
+
+    case BO_GT:
+      return &getTruthValue(R == llvm::APFloat::cmpGreaterThan);
+
+    case BO_LE:
+      return &getTruthValue(R == llvm::APFloat::cmpLessThan ||
+                            R == llvm::APFloat::cmpEqual);
+
+    case BO_GE:
+      return &getTruthValue(R == llvm::APFloat::cmpGreaterThan ||
+                            R == llvm::APFloat::cmpEqual);
+
+    case BO_EQ:
+      return &getTruthValue(R == llvm::APFloat::cmpEqual);
+
+    case BO_NE:
+      return &getTruthValue(R != llvm::APFloat::cmpEqual);
+  }
+}
 
 const std::pair<SVal, uintptr_t>&
 BasicValueFactory::getPersistentSValWithData(const SVal& V, uintptr_t Data) {
 
   // Lazily create the folding set.
   if (!PersistentSVals) PersistentSVals = new PersistentSValsTy();
 
   llvm::FoldingSetNodeID ID;

lib/StaticAnalyzer/Core/Environment.cpp

case Stmt::SubstNonTypeTemplateParmExprClass:
     llvm_unreachable("Should have been handled by ignoreTransparentExprs");
 
   case Stmt::AddrLabelExprClass:
   case Stmt::CharacterLiteralClass:
   case Stmt::CXXBoolLiteralExprClass:
   case Stmt::CXXScalarValueInitExprClass:
   case Stmt::ImplicitValueInitExprClass:
   case Stmt::IntegerLiteralClass:
+  case Stmt::FloatingLiteralClass:
   case Stmt::ObjCBoolLiteralExprClass:
   case Stmt::CXXNullPtrLiteralExprClass:
   case Stmt::ObjCStringLiteralClass:
   case Stmt::StringLiteralClass:
   case Stmt::TypeTraitExprClass:
     // Known constants; defer to SValBuilder.
     return svalBuilder.getConstantVal(cast<Expr>(S)).getValue();
 

lib/StaticAnalyzer/Core/ProgramState.cpp

 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/SubEngine.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/TaintManager.h"
 #include "llvm/Support/raw_ostream.h"
 
 using namespace clang;
 using namespace ento;
 
-namespace clang { namespace  ento {
+namespace clang {
+namespace ento {
 /// Increments the number of times this state is referenced.
 
 void ProgramStateRetain(const ProgramState *state) {
-  ++const_cast<ProgramState*>(state)->refCount;
+  ++const_cast<ProgramState *>(state)->refCount;
 }
 
 /// Decrement the number of times this state is referenced.
 void ProgramStateRelease(const ProgramState *state) {
   assert(state->refCount > 0);
-  ProgramState *s = const_cast<ProgramState*>(state);
+  ProgramState *s = const_cast<ProgramState *>(state);
   if (--s->refCount == 0) {
     ProgramStateManager &Mgr = s->getStateManager();
     Mgr.StateSet.RemoveNode(s);
     s->~ProgramState();
     Mgr.freeStates.push_back(s);
   }
 }
-}}
+} // namespace ento
+} // namespace clang
 
-ProgramState::ProgramState(ProgramStateManager *mgr, const Environment& env,
+ProgramState::ProgramState(ProgramStateManager *mgr, const Environment &env,
                            StoreRef st, GenericDataMap gdm)
-  : stateMgr(mgr),
-    Env(env),
-    store(st.getStore()),
-    GDM(gdm),
-    refCount(0) {
+    : stateMgr(mgr), Env(env), store(st.getStore()), GDM(gdm), refCount(0) {
   stateMgr->getStoreManager().incrementReferenceCount(store);
 }
 
 ProgramState::ProgramState(const ProgramState &RHS)
-    : llvm::FoldingSetNode(),
-      stateMgr(RHS.stateMgr),
-      Env(RHS.Env),
-      store(RHS.store),
-      GDM(RHS.GDM),
-      refCount(0) {
+    : llvm::FoldingSetNode(), stateMgr(RHS.stateMgr), Env(RHS.Env),
+      store(RHS.store), GDM(RHS.GDM), refCount(0) {
   stateMgr->getStoreManager().incrementReferenceCount(store);
 }
 
 ProgramState::~ProgramState() {
   if (store)
     stateMgr->getStoreManager().decrementReferenceCount(store);
 }
 
 ProgramStateManager::ProgramStateManager(ASTContext &Ctx,
                                          StoreManagerCreator CreateSMgr,
                                          ConstraintManagerCreator CreateCMgr,
                                          llvm::BumpPtrAllocator &alloc,
                                          SubEngine *SubEng)
     : Eng(SubEng), EnvMgr(alloc), GDMFactory(alloc),
       svalBuilder(createSimpleSValBuilder(alloc, Ctx, *this)),
       CallEventMgr(new CallEventManager(alloc)), Alloc(alloc) {
   StoreMgr = (*CreateSMgr)(*this);
   ConstraintMgr = (*CreateCMgr)(*this, SubEng);
 }
 
-
 ProgramStateManager::~ProgramStateManager() {
-  for (GDMContextsTy::iterator I=GDMContexts.begin(), E=GDMContexts.end();
-       I!=E; ++I)
+  for (GDMContextsTy::iterator I = GDMContexts.begin(), E = GDMContexts.end();
+       I != E; ++I)
     I->second.second(I->second.first);
 }
 
 ProgramStateRef
 ProgramStateManager::removeDeadBindings(ProgramStateRef state,
                                         const StackFrameContext *LCtx,
-                                   SymbolReaper& SymReaper) {
+                                        SymbolReaper &SymReaper) {
 
   // This code essentially performs a "mark-and-sweep" of the VariableBindings.
   // The roots are any Block-level exprs and Decls that our liveness algorithm
   // tells us are live.  We then see what Decls they may reference, and keep
   // those around.  This code more than likely can be made faster, and the
   // frequency of which this method is called should be experimented with
   // for optimum performance.
   ProgramState NewState = *state;
 
   NewState.Env = EnvMgr.removeDeadBindings(NewState.Env, SymReaper, state);
 
   // Clean up the store.
-  StoreRef newStore = StoreMgr->removeDeadBindings(NewState.getStore(), LCtx,
-                                                   SymReaper);
+  StoreRef newStore =
+      StoreMgr->removeDeadBindings(NewState.getStore(), LCtx, SymReaper);
   NewState.setStore(newStore);
   SymReaper.setReapedStore(newStore);
 
   ProgramStateRef Result = getPersistentState(NewState);
   return ConstraintMgr->removeDeadBindings(Result, SymReaper);
 }
 
-ProgramStateRef ProgramState::bindLoc(Loc LV,
-                                      SVal V,
+ProgramStateRef ProgramState::bindLoc(Loc LV, SVal V,
                                       const LocationContext *LCtx,
                                       bool notifyChanges) const {
   ProgramStateManager &Mgr = getStateManager();
-  ProgramStateRef newState = makeWithStore(Mgr.StoreMgr->Bind(getStore(),
-                                                             LV, V));
+  ProgramStateRef newState =
+      makeWithStore(Mgr.StoreMgr->Bind(getStore(), LV, V));
   const MemRegion *MR = LV.getAsRegion();
   if (MR && Mgr.getOwningEngine() && notifyChanges)
     return Mgr.getOwningEngine()->processRegionChange(newState, MR, LCtx);
 
   return newState;
 }
 
-ProgramStateRef ProgramState::bindDefault(SVal loc,
-                                          SVal V,
+ProgramStateRef ProgramState::bindDefault(SVal loc, SVal V,
                                           const LocationContext *LCtx) const {
   ProgramStateManager &Mgr = getStateManager();
   const MemRegion *R = loc.castAs<loc::MemRegionVal>().getRegion();
   const StoreRef &newStore = Mgr.StoreMgr->BindDefault(getStore(), R, V);
   ProgramStateRef new_state = makeWithStore(newStore);
-  return Mgr.getOwningEngine() ?
-           Mgr.getOwningEngine()->processRegionChange(new_state, R, LCtx) :
-           new_state;
+  return Mgr.getOwningEngine()
+             ? Mgr.getOwningEngine()->processRegionChange(new_state, R, LCtx)
+             : new_state;
 }
 
 typedef ArrayRef<const MemRegion *> RegionList;
 typedef ArrayRef<SVal> ValueList;
 
-ProgramStateRef
-ProgramState::invalidateRegions(RegionList Regions,
-                             const Expr *E, unsigned Count,
-                             const LocationContext *LCtx,
-                             bool CausedByPointerEscape,
-                             InvalidatedSymbols *IS,
-                             const CallEvent *Call,
-                             RegionAndSymbolInvalidationTraits *ITraits) const {
+ProgramStateRef ProgramState::invalidateRegions(
+    RegionList Regions, const Expr *E, unsigned Count,
+    const LocationContext *LCtx, bool CausedByPointerEscape,
+    InvalidatedSymbols *IS, const CallEvent *Call,
   SmallVector<SVal, 8> Values;
-  for (RegionList::const_iterator I = Regions.begin(),
-                                  End = Regions.end(); I != End; ++I)
+  for (RegionList::const_iterator I = Regions.begin(), End = Regions.end();
+       I != End; ++I)
     Values.push_back(loc::MemRegionVal(*I));
 
   return invalidateRegionsImpl(Values, E, Count, LCtx, CausedByPointerEscape,
                                IS, ITraits, Call);
 }
 
-ProgramStateRef
-ProgramState::invalidateRegions(ValueList Values,
-                             const Expr *E, unsigned Count,
-                             const LocationContext *LCtx,
-                             bool CausedByPointerEscape,
-                             InvalidatedSymbols *IS,
-                             const CallEvent *Call,
-                             RegionAndSymbolInvalidationTraits *ITraits) const {
+ProgramStateRef ProgramState::invalidateRegions(
+    ValueList Values, const Expr *E, unsigned Count,
+    const LocationContext *LCtx, bool CausedByPointerEscape,
+    InvalidatedSymbols *IS, const CallEvent *Call,
 
   return invalidateRegionsImpl(Values, E, Count, LCtx, CausedByPointerEscape,
                                IS, ITraits, Call);
 }
 
-ProgramStateRef
-ProgramState::invalidateRegionsImpl(ValueList Values,
-                                    const Expr *E, unsigned Count,
-                                    const LocationContext *LCtx,
-                                    bool CausedByPointerEscape,
-                                    InvalidatedSymbols *IS,
-                                    RegionAndSymbolInvalidationTraits *ITraits,
-                                    const CallEvent *Call) const {
+ProgramStateRef ProgramState::invalidateRegionsImpl(
+    ValueList Values, const Expr *E, unsigned Count,
+    const LocationContext *LCtx, bool CausedByPointerEscape,
+    InvalidatedSymbols *IS, RegionAndSymbolInvalidationTraits *ITraits,
   ProgramStateManager &Mgr = getStateManager();
-  SubEngine* Eng = Mgr.getOwningEngine();
+  SubEngine *Eng = Mgr.getOwningEngine();
 
   InvalidatedSymbols Invalidated;
   if (!IS)
     IS = &Invalidated;
 
   RegionAndSymbolInvalidationTraits ITraitsLocal;
   if (!ITraits)
     ITraits = &ITraitsLocal;
 
   if (Eng) {
     StoreManager::InvalidatedRegions TopLevelInvalidated;
     StoreManager::InvalidatedRegions Invalidated;
-    const StoreRef &newStore
-    = Mgr.StoreMgr->invalidateRegions(getStore(), Values, E, Count, LCtx, Call,
-                                      *IS, *ITraits, &TopLevelInvalidated,
-                                      &Invalidated);
+    const StoreRef &newStore = Mgr.StoreMgr->invalidateRegions(
+        getStore(), Values, E, Count, LCtx, Call, *IS, *ITraits,
+        &TopLevelInvalidated, &Invalidated);
 
     ProgramStateRef newState = makeWithStore(newStore);
 
     if (CausedByPointerEscape) {
-      newState = Eng->notifyCheckersOfPointerEscape(newState, IS,
-                                                    TopLevelInvalidated,
-                                                    Invalidated, Call,
-                                                    *ITraits);
+      newState = Eng->notifyCheckersOfPointerEscape(
+          newState, IS, TopLevelInvalidated, Invalidated, Call, *ITraits);
     }
 
     return Eng->processRegionChanges(newState, IS, TopLevelInvalidated,
                                      Invalidated, LCtx, Call);
   }
 
   const StoreRef &newStore =
       Mgr.StoreMgr->invalidateRegions(getStore(), Values, E, Count, LCtx, Call,
                                       *IS, *ITraits, nullptr, nullptr);
   return makeWithStore(newStore);
 }
 
 ProgramStateRef ProgramState::killBinding(Loc LV) const {
   assert(!LV.getAs<loc::MemRegionVal>() && "Use invalidateRegion instead.");
 
   Store OldStore = getStore();
   const StoreRef &newStore =
       getStateManager().StoreMgr->killBinding(OldStore, LV);
 
   if (newStore.getStore() == OldStore)
     return this;
 
   return makeWithStore(newStore);
 }
 
 ProgramStateRef
 ProgramState::enterStackFrame(const CallEvent &Call,
                               const StackFrameContext *CalleeCtx) const {
   const StoreRef &NewStore =
       getStateManager().StoreMgr->enterStackFrame(getStore(), Call, CalleeCtx);
   return makeWithStore(NewStore);
 }
 
 SVal ProgramState::getSValAsScalarOrLoc(const MemRegion *R) const {
   // We only want to do fetches from regions that we can actually bind
   // values.  For example, SymbolicRegions of type 'id<...>' cannot
   // have direct bindings (but their can be bindings on their subregions).
   if (!R->isBoundable())
SVal ProgramState::getSVal(Loc location, QualType T) const {
   SVal V = getRawSVal(cast<Loc>(location), T);
 
   // If 'V' is a symbolic value that is *perfectly* constrained to
   // be a constant value, use that value instead to lessen the burden
   // on later analysis stages (so we have less symbolic values to reason
   // about).
   if (!T.isNull()) {
     if (SymbolRef sym = V.getAsSymbol()) {
-      if (const llvm::APSInt *Int = getStateManager()
-                                    .getConstraintManager()
-                                    .getSymVal(this, sym)) {
+      ConstraintManager &CM = getStateManager().getConstraintManager();
+
+      if (sym->getType()->isRealFloatingType()) {
+        if (const llvm::APFloat *Float = CM.getSymFloatVal(this, sym)) {
           // FIXME: Because we don't correctly model (yet) sign-extension
           // and truncation of symbolic values, we need to convert
           // the integer value to the correct signedness and bitwidth.
           //
           // This shows up in the following:
           //
           //   char foo();
           //   unsigned x = foo();
           //   if (x == 54)
           //     ...
           //
           //  The symbolic value stored to 'x' is actually the conjured
           //  symbol for the call to foo(); the type of that symbol is 'char',
           //  not unsigned.
+          const llvm::APFloat &NewV = getBasicVals().Convert(T, *Float);
+
+          assert(!V.getAs<Loc>() && "Loc::ConcreteFloat not supported!");
+          return nonloc::ConcreteFloat(NewV);
+        }
+      } else {
+        if (const llvm::APSInt *Int = CM.getSymIntVal(this, sym)) {
+          // FIXME: Likewise
           const llvm::APSInt &NewV = getBasicVals().Convert(T, *Int);
 
           if (V.getAs<Loc>())
             return loc::ConcreteInt(NewV);
           else
             return nonloc::ConcreteInt(NewV);
         }
       }
     }
+  }
 
   return V;
 }
 
 ProgramStateRef ProgramState::BindExpr(const Stmt *S,
-                                           const LocationContext *LCtx,
-                                           SVal V, bool Invalidate) const{
-  Environment NewEnv =
-    getStateManager().EnvMgr.bindExpr(Env, EnvironmentEntry(S, LCtx), V,
-                                      Invalidate);
+                                       const LocationContext *LCtx, SVal V,
+                                       bool Invalidate) const {
+  Environment NewEnv = getStateManager().EnvMgr.bindExpr(
+      Env, EnvironmentEntry(S, LCtx), V, Invalidate);
   if (NewEnv == Env)
     return this;
 
   ProgramState NewSt = *this;
   NewSt.Env = NewEnv;
   return getStateManager().getPersistentState(NewSt);
 }
 
 ProgramStateRef ProgramState::assumeInBound(DefinedOrUnknownSVal Idx,
                                             DefinedOrUnknownSVal UpperBound,
                                             bool Assumption,
                                             QualType indexTy) const {
   if (Idx.isUnknown() || UpperBound.isUnknown())
     return this;
 
   // Build an expression for 0 <= Idx < UpperBound.
   // This is the same as Idx + MIN < UpperBound + MIN, if overflow is allowed.
   // FIXME: This should probably be part of SValBuilder.
   ProgramStateManager &SM = getStateManager();
   SValBuilder &svalBuilder = SM.getSValBuilder();
   ASTContext &Ctx = svalBuilder.getContext();
 
   // Get the offset: the minimum value of the array index type.
   BasicValueFactory &BVF = svalBuilder.getBasicValueFactory();
   // FIXME: This should be using ValueManager::ArrayindexTy...somehow.
   if (indexTy.isNull())
     indexTy = Ctx.IntTy;
   nonloc::ConcreteInt Min(BVF.getMinValue(indexTy));
 
   // Adjust the index.
-  SVal newIdx = svalBuilder.evalBinOpNN(this, BO_Add,
-                                        Idx.castAs<NonLoc>(), Min, indexTy);
+  SVal newIdx =
+      svalBuilder.evalBinOpNN(this, BO_Add, Idx.castAs<NonLoc>(), Min, indexTy);
   if (newIdx.isUnknownOrUndef())
     return this;
 
   // Adjust the upper bound.
-  SVal newBound =
-    svalBuilder.evalBinOpNN(this, BO_Add, UpperBound.castAs<NonLoc>(),
-                            Min, indexTy);
+  SVal newBound = svalBuilder.evalBinOpNN(
+      this, BO_Add, UpperBound.castAs<NonLoc>(), Min, indexTy);
 
   if (newBound.isUnknownOrUndef())
     return this;
 
   // Build the actual comparison.
   SVal inBound = svalBuilder.evalBinOpNN(this, BO_LT, newIdx.castAs<NonLoc>(),
                                          newBound.castAs<NonLoc>(), Ctx.IntTy);
   if (inBound.isUnknownOrUndef())
ConditionTruthVal ProgramState::isNull(SVal V) const {
 
   SymbolRef Sym = V.getAsSymbol(/* IncludeBaseRegion */ true);
   if (!Sym)
     return ConditionTruthVal();
 
   return getStateManager().ConstraintMgr->isNull(this, Sym);
 }
 
-ProgramStateRef ProgramStateManager::getInitialState(const LocationContext *InitLoc) {
-  ProgramState State(this,
-                EnvMgr.getInitialEnvironment(),
+ProgramStateRef
+ProgramStateManager::getInitialState(const LocationContext *InitLoc) {
+  ProgramState State(this, EnvMgr.getInitialEnvironment(),
                      StoreMgr->getInitialStore(InitLoc),
                      GDMFactory.getEmptyMap());
 
   return getPersistentState(State);
 }
 
-ProgramStateRef ProgramStateManager::getPersistentStateWithGDM(
-                                                     ProgramStateRef FromState,
-                                                     ProgramStateRef GDMState) {
+ProgramStateRef
+ProgramStateManager::getPersistentStateWithGDM(ProgramStateRef FromState,
   ProgramState NewState(*FromState);
   NewState.GDM = GDMState->GDM;
   return getPersistentState(NewState);
 }
 
 ProgramStateRef ProgramStateManager::getPersistentState(ProgramState &State) {
 
   llvm::FoldingSetNodeID ID;
   State.Profile(ID);
   void *InsertPos;
 
   if (ProgramState *I = StateSet.FindNodeOrInsertPos(ID, InsertPos))
     return I;
 
   ProgramState *newState = nullptr;
   if (!freeStates.empty()) {
     newState = freeStates.back();
     freeStates.pop_back();
-  }
-  else {
-    newState = (ProgramState*) Alloc.Allocate<ProgramState>();
+  } else {
+    newState = (ProgramState *)Alloc.Allocate<ProgramState>();
   }
   new (newState) ProgramState(State);
   StateSet.InsertNode(newState, InsertPos);
   return newState;
 }
 
 ProgramStateRef ProgramState::makeWithStore(const StoreRef &store) const {
   ProgramState NewSt(*this);
if (store)
     stateMgr->getStoreManager().decrementReferenceCount(store);
   store = newStoreStore;
 }
 
 //===----------------------------------------------------------------------===//
 //  State pretty-printing.
 //===----------------------------------------------------------------------===//
 
-void ProgramState::print(raw_ostream &Out,
-                         const char *NL, const char *Sep) const {
+void ProgramState::print(raw_ostream &Out, const char *NL,
+                         const char *Sep) const {
   // Print the store.
   ProgramStateManager &Mgr = getStateManager();
   Mgr.getStoreManager().print(getStore(), Out, NL, Sep);
 
   // Print out the environment.
   Env.print(Out, NL, Sep);
 
   // Print out the constraints.
   Mgr.getConstraintManager().print(this, Out, NL, Sep);
 
   // Print checker-specific data.
   Mgr.getOwningEngine()->printState(Out, this, NL, Sep);
 }
 
 void ProgramState::printDOT(raw_ostream &Out) const {
   print(Out, "\\l", "\\|");
 }
 
-LLVM_DUMP_METHOD void ProgramState::dump() const {
-  print(llvm::errs());
-}
+LLVM_DUMP_METHOD void ProgramState::dump() const { print(llvm::errs()); }
 
-void ProgramState::printTaint(raw_ostream &Out,
-                              const char *NL, const char *Sep) const {
+void ProgramState::printTaint(raw_ostream &Out, const char *NL,
+                              const char *Sep) const {
   TaintMapImpl TM = get<TaintMap>();
 
   if (!TM.isEmpty())
-    Out <<"Tainted Symbols:" << NL;
+    Out << "Tainted Symbols:" << NL;
 
   for (TaintMapImpl::iterator I = TM.begin(), E = TM.end(); I != E; ++I) {
     Out << I->first << " : " << I->second << NL;
   }
 }
 
-void ProgramState::dumpTaint() const {
-  printTaint(llvm::errs());
-}
+void ProgramState::dumpTaint() const { printTaint(llvm::errs()); }
 
 //===----------------------------------------------------------------------===//
 // Generic Data Map.
 //===----------------------------------------------------------------------===//
 
-void *const* ProgramState::FindGDM(void *K) const {
-  return GDM.lookup(K);
-}
+void *const *ProgramState::FindGDM(void *K) const { return GDM.lookup(K); }
 
-void*
-ProgramStateManager::FindGDMContext(void *K,
-                               void *(*CreateContext)(llvm::BumpPtrAllocator&),
-                               void (*DeleteContext)(void*)) {
+void *ProgramStateManager::FindGDMContext(
+    void *K, void *(*CreateContext)(llvm::BumpPtrAllocator &),
+    void (*DeleteContext)(void *)) {
 
-  std::pair<void*, void (*)(void*)>& p = GDMContexts[K];
+  std::pair<void *, void (*)(void *)> &p = GDMContexts[K];
   if (!p.first) {
     p.first = CreateContext(Alloc);
     p.second = DeleteContext;
   }
 
   return p.first;
 }
 
-ProgramStateRef ProgramStateManager::addGDM(ProgramStateRef St, void *Key, void *Data){
+ProgramStateRef ProgramStateManager::addGDM(ProgramStateRef St, void *Key,
+                                            void *Data) {
   ProgramState::GenericDataMap M1 = St->getGDM();
   ProgramState::GenericDataMap M2 = GDMFactory.add(M1, Key, Data);
 
   if (M1 == M2)
     return St;
 
   ProgramState NewSt = *St;
   NewSt.GDM = M2;
   return getPersistentState(NewSt);
 }
 
-ProgramStateRef ProgramStateManager::removeGDM(ProgramStateRef state, void *Key) {
+ProgramStateRef ProgramStateManager::removeGDM(ProgramStateRef state,
+                                               void *Key) {
   ProgramState::GenericDataMap OldM = state->getGDM();
   ProgramState::GenericDataMap NewM = GDMFactory.remove(OldM, Key);
 
   if (NewM == OldM)
     return state;
 
   ProgramState NewState = *state;
   NewState.GDM = NewM;
bool ScanReachableSymbols::scan(nonloc::LazyCompoundVal val) {
   // FIXME: We don't really want to use getBaseRegion() here because pointer
   // arithmetic doesn't apply, but scanReachableSymbols only accepts base
   // regions right now.
   const MemRegion *R = val.getRegion()->getBaseRegion();
   return StoreMgr.scanReachableSymbols(val.getStore(), R, *this);
 }
 
 bool ScanReachableSymbols::scan(nonloc::CompoundVal val) {
-  for (nonloc::CompoundVal::iterator I=val.begin(), E=val.end(); I!=E; ++I)
+  for (nonloc::CompoundVal::iterator I = val.begin(), E = val.end(); I != E;
+       ++I)
     if (!scan(*I))
       return false;
 
   return true;
 }
 
 bool ScanReachableSymbols::scan(const SymExpr *sym) {
   for (SymExpr::symbol_iterator SI = sym->symbol_begin(),
if (isa<MemSpaceRegion>(Super)) {
         return false;
     }
   }
 
   // Regions captured by a block are also implicitly reachable.
   if (const BlockDataRegion *BDR = dyn_cast<BlockDataRegion>(R)) {
     BlockDataRegion::referenced_vars_iterator I = BDR->referenced_vars_begin(),
                                               E = BDR->referenced_vars_end();
-    for ( ; I != E; ++I) {
+    for (; I != E; ++I) {
       if (!scan(I.getCapturedRegion()))
         return false;
     }
   }
 
   return true;
 }
 
-bool ProgramState::scanReachableSymbols(SVal val, SymbolVisitor& visitor) const {
+bool ProgramState::scanReachableSymbols(SVal val,
+                                        SymbolVisitor &visitor) const {
   ScanReachableSymbols S(this, visitor);
   return S.scan(val);
 }
 
 bool ProgramState::scanReachableSymbols(const SVal *I, const SVal *E,
                                         SymbolVisitor &visitor) const {
   ScanReachableSymbols S(this, visitor);
-  for ( ; I != E; ++I) {
+  for (; I != E; ++I) {
     if (!S.scan(*I))
       return false;
   }
   return true;
 }
 
-bool ProgramState::scanReachableSymbols(const MemRegion * const *I,
-                                   const MemRegion * const *E,
+bool ProgramState::scanReachableSymbols(const MemRegion *const *I,
+                                        const MemRegion *const *E,
                                         SymbolVisitor &visitor) const {
   ScanReachableSymbols S(this, visitor);
-  for ( ; I != E; ++I) {
+  for (; I != E; ++I) {
     if (!S.scan(*I))
       return false;
   }
   return true;
 }
 
 ProgramStateRef ProgramState::addTaint(const Stmt *S,
-                                           const LocationContext *LCtx,
-                                           TaintTagType Kind) const {
   if (const Expr *E = dyn_cast_or_null<Expr>(S))
     S = E->IgnoreParens();
 
   return addTaint(getSVal(S, LCtx), Kind);
 }
 
-ProgramStateRef ProgramState::addTaint(SVal V,
-                                       TaintTagType Kind) const {
+ProgramStateRef ProgramState::addTaint(SVal V, TaintTagType Kind) const {
   SymbolRef Sym = V.getAsSymbol();
   if (Sym)
     return addTaint(Sym, Kind);
 
   // If the SVal represents a structure, try to mass-taint all values within the
   // structure. For now it only works efficiently on lazy compound values that
   // were conjured during a conservative evaluation of a function - either as
   // return values of functions that return structures or arrays by value, or as
   // values of structures or arrays passed into the function by reference,
   // directly or through pointer aliasing. Such lazy compound values are
   // characterized by having exactly one binding in their captured store within
   // their parent region, which is a conjured symbol default-bound to the base
   // region of the parent region.
   if (auto LCV = V.getAs<nonloc::LazyCompoundVal>()) {
-    if (Optional<SVal> binding = getStateManager().StoreMgr->getDefaultBinding(*LCV)) {
+    if (Optional<SVal> binding =
+            getStateManager().StoreMgr->getDefaultBinding(*LCV)) {
       if (SymbolRef Sym = binding->getAsSymbol())
         return addPartialTaint(Sym, LCV->getRegion(), Kind);
     }
   }
 
   const MemRegion *R = V.getAsRegion();
   return addTaint(R, Kind);
 }
 
 ProgramStateRef ProgramState::addTaint(const MemRegion *R,
-                                           TaintTagType Kind) const {
   if (const SymbolicRegion *SR = dyn_cast_or_null<SymbolicRegion>(R))
     return addTaint(SR->getSymbol(), Kind);
   return this;
 }
 
-ProgramStateRef ProgramState::addTaint(SymbolRef Sym,
-                                           TaintTagType Kind) const {
+ProgramStateRef ProgramState::addTaint(SymbolRef Sym, TaintTagType Kind) const {
   // If this is a symbol cast, remove the cast before adding the taint. Taint
   // is cast agnostic.
   while (const SymbolCast *SC = dyn_cast<SymbolCast>(Sym))
     Sym = SC->getOperand();
 
   ProgramStateRef NewState = set<TaintMap>(Sym, Kind);
   assert(NewState);
   return NewState;
bool ProgramState::isTainted(const MemRegion *Reg, TaintTagType K) const {
   return false;
 }
 
 bool ProgramState::isTainted(SymbolRef Sym, TaintTagType Kind) const {
   if (!Sym)
     return false;
 
   // Traverse all the symbols this symbol depends on to see if any are tainted.
-  for (SymExpr::symbol_iterator SI = Sym->symbol_begin(), SE =Sym->symbol_end();
+  for (SymExpr::symbol_iterator SI = Sym->symbol_begin(),
+                                SE = Sym->symbol_end();
        SI != SE; ++SI) {
     if (!isa<SymbolData>(*SI))
       continue;
 
     if (const TaintTagType *Tag = get<TaintMap>(*SI)) {
       if (*Tag == Kind)
         return true;
     }
if (const SymbolDerived *SD = dyn_cast<SymbolDerived>(*SI)) {
       if (const TaintedSubRegions *Regs =
               get<DerivedSymTaint>(SD->getParentSymbol())) {
         const TypedValueRegion *R = SD->getRegion();
         for (auto I : *Regs) {
           // FIXME: The logic to identify tainted regions could be more
           // complete. For example, this would not currently identify
           // overlapping fields in a union as tainted. To identify this we can
           // check for overlapping/nested byte offsets.
-          if (Kind == I.second &&
-              (R == I.first || R->isSubRegionOf(I.first)))
+          if (Kind == I.second && (R == I.first || R->isSubRegionOf(I.first)))
             return true;
         }
       }
     }
 
     // If memory region is tainted, data is also tainted.
     if (const SymbolRegionValue *SRV = dyn_cast<SymbolRegionValue>(*SI)) {
       if (isTainted(SRV->getRegion(), Kind))
         return true;
     }
 
     // If this is a SymbolCast from a tainted value, it's also tainted.
     if (const SymbolCast *SC = dyn_cast<SymbolCast>(*SI)) {
       if (isTainted(SC->getOperand(), Kind))
         return true;
     }
   }
 
   return false;
 }
-

lib/StaticAnalyzer/Core/RangeConstraintManager.cpp

RangeConstraintManager(SubEngine *SE, SValBuilder &SVB)
       : RangedConstraintManager(SE, SVB) {}
 
   //===------------------------------------------------------------------===//
   // Implementation for interface from ConstraintManager.
   //===------------------------------------------------------------------===//
 
   bool canReasonAbout(SVal X) const override;
 
+  bool canReasonAboutFloats() const override;
+
   ConditionTruthVal checkNull(ProgramStateRef State, SymbolRef Sym) override;
 
-  const llvm::APSInt *getSymVal(ProgramStateRef State,
+  const llvm::APSInt *getSymIntVal(ProgramStateRef State,
                                    SymbolRef Sym) const override;
 
   ProgramStateRef removeDeadBindings(ProgramStateRef State,
                                      SymbolReaper &SymReaper) override;
 
   void print(ProgramStateRef State, raw_ostream &Out, const char *nl,
              const char *sep) override;
 
   //===------------------------------------------------------------------===//

 
 bool RangeConstraintManager::canReasonAbout(SVal X) const {
   Optional<nonloc::SymbolVal> SymVal = X.getAs<nonloc::SymbolVal>();
   if (!SymVal)
     return true;
 
   const SymExpr *SE = SymVal->getSymbol();
   do {
+    if (SE->getType()->isFloatingType())
+      return false;
+
     if (isa<SymbolData>(SE)) {
       return true;
     }
 
     if (const BinarySymExpr *BSE = dyn_cast<BinarySymExpr>(SE)) {
       BinaryOperator::Opcode Op = BSE->getOpcode();
 
       if (isa<IntSymExpr>(BSE)) {
if (const BinarySymExpr *BSE = dyn_cast<BinarySymExpr>(SE)) {
           continue;
         }
 
         return true;
       }
 
       if (const SymSymExpr *SSE = dyn_cast<SymSymExpr>(BSE)) {
         if (!BinaryOperator::isComparisonOp(Op) ||
             !Loc::isLocType(SSE->getLHS()->getType()) ||
             !Loc::isLocType(SSE->getRHS()->getType())) {
           // We handle Loc <> Loc comparisons, but not (yet) NonLoc <> NonLoc.
           return false;
         }
 
         return canReasonAbout(nonloc::SymbolVal(SSE->getLHS())) &&
                canReasonAbout(nonloc::SymbolVal(SSE->getRHS()));
       }
     }
 
     return false;
   } while (SE);
 
   return true;
 }
 
+bool RangeConstraintManager::canReasonAboutFloats() const { return false; }
+
 ConditionTruthVal RangeConstraintManager::checkNull(ProgramStateRef State,
                                                     SymbolRef Sym) {
   const RangeSet *Ranges = State->get<ConstraintRange>(Sym);
 
   // If we don't have any information about this symbol, it's underconstrained.
   if (!Ranges)
     return ConditionTruthVal();
 
   // If we have a concrete value, see if it's zero.
   if (const llvm::APSInt *Value = Ranges->getConcreteValue())
     return *Value == 0;
 
   BasicValueFactory &BV = getBasicVals();
   APSIntType IntType = BV.getAPSIntType(Sym->getType());
   llvm::APSInt Zero = IntType.getZeroValue();
 
   // Check if zero is in the set of possible values.
   if (Ranges->Intersect(BV, F, Zero, Zero).isEmpty())
     return false;
 
   // Zero is a possible value, but it is not the /only/ possible value.
   return ConditionTruthVal();
 }
 
-const llvm::APSInt *RangeConstraintManager::getSymVal(ProgramStateRef St,
+const llvm::APSInt *RangeConstraintManager::getSymIntVal(ProgramStateRef St,
                                                          SymbolRef Sym) const {
   const ConstraintRangeTy::data_type *T = St->get<ConstraintRange>(Sym);
   return T ? T->getConcreteValue() : nullptr;
 }
 
 /// Scan all symbols referenced by the constraints. If the symbol is not alive
 /// as marked in LSymbols, mark it as dead in DSymbols.
 ProgramStateRef
 RangeConstraintManager::removeDeadBindings(ProgramStateRef State,

lib/StaticAnalyzer/Core/RangedConstraintManager.cpp

if (isa<SymbolData>(Sym)) {
 
     BinaryOperator::Opcode op = SIE->getOpcode();
     if (BinaryOperator::isComparisonOp(op)) {
       if (!Assumption)
         op = BinaryOperator::negateComparisonOp(op);
 
       return assumeSymRel(State, SIE->getLHS(), op, SIE->getRHS());
     }
-
   } else if (const SymSymExpr *SSE = dyn_cast<SymSymExpr>(Sym)) {
     // Translate "a != b" to "(b - a) != 0".
     // We invert the order of the operands as a heuristic for how loop
     // conditions are usually written ("begin != end") as compared to length
     // calculations ("end - begin"). The more correct thing to do would be to
     // canonicalize "a - b" and "b - a", which would allow us to treat
     // "a != b" and "b != a" the same.
     SymbolManager &SymMgr = getSymbolManager();

lib/StaticAnalyzer/Core/RegionStore.cpp

 // Extents for regions.
 //===----------------------------------------------------------------------===//
 
 DefinedOrUnknownSVal
 RegionStoreManager::getSizeInElements(ProgramStateRef state,
                                       const MemRegion *R,
                                       QualType EleTy) {
   SVal Size = cast<SubRegion>(R)->getExtent(svalBuilder);
-  const llvm::APSInt *SizeInt = svalBuilder.getKnownValue(state, Size);
+  const llvm::APSInt *SizeInt = svalBuilder.getKnownIntValue(state, Size);
   if (!SizeInt)
     return UnknownVal();
 
   CharUnits RegionSize = CharUnits::fromQuantity(SizeInt->getSExtValue());
 
   if (Ctx.getAsVariableArrayType(EleTy)) {
     // FIXME: We need to track extra state to properly record the size
     // of VLAs.  Returning UnknownVal here, however, is a stop-gap so that

 RegionBindingsRef
 RegionStoreManager::setImplicitDefaultValue(RegionBindingsConstRef B,
                                             const MemRegion *R,
                                             QualType T) {
   SVal V;
 
   if (Loc::isLocType(T))
     V = svalBuilder.makeNull();
-  else if (T->isIntegralOrEnumerationType())
+  else if (T->isIntegralOrEnumerationType() || T->isRealFloatingType())
     V = svalBuilder.makeZeroVal(T);
   else if (T->isStructureOrClassType() || T->isArrayType()) {
     // Set the default value to a zero constant when it is a structure
     // or array.  The type doesn't really matter.
     V = svalBuilder.makeZeroVal(Ctx.IntTy);
   }
   else {
     // We can't represent values of this type, but we still need to set a value

lib/StaticAnalyzer/Core/SValBuilder.cpp

 
 using namespace clang;
 using namespace ento;
 
 //===----------------------------------------------------------------------===//
 // Basic SVal creation.
 //===----------------------------------------------------------------------===//
 
-void SValBuilder::anchor() { }
+void SValBuilder::anchor() {}
 
 DefinedOrUnknownSVal SValBuilder::makeZeroVal(QualType type) {
   if (Loc::isLocType(type))
     return makeNull();
 
   if (type->isIntegralOrEnumerationType())
     return makeIntVal(0, type);
 
   if (type->isArrayType() || type->isRecordType() || type->isVectorType() ||
       type->isAnyComplexType())
     return makeCompoundVal(type, BasicVals.getEmptySValList());
 
-  // FIXME: Handle floats.
+  if (type->isRealFloatingType())
+    return makeFloatVal(0, type);
+
   return UnknownVal();
 }
 
 NonLoc SValBuilder::makeNonLoc(const SymExpr *lhs, BinaryOperator::Opcode op,
-                                const llvm::APSInt& rhs, QualType type) {
+                               const llvm::APSInt &rhs, QualType type) {
   // The Environment ensures we always get a persistent APSInt in
   // BasicValueFactory, so we don't need to get the APSInt from
   // BasicValueFactory again.
   assert(lhs);
   assert(!Loc::isLocType(type));
   return nonloc::SymbolVal(SymMgr.getSymIntExpr(lhs, op, rhs, type));
 }
 
-NonLoc SValBuilder::makeNonLoc(const llvm::APSInt& lhs,
+NonLoc SValBuilder::makeNonLoc(const llvm::APSInt &lhs,
                                BinaryOperator::Opcode op, const SymExpr *rhs,
                                QualType type) {
   assert(rhs);
   assert(!Loc::isLocType(type));
   return nonloc::SymbolVal(SymMgr.getIntSymExpr(lhs, op, rhs, type));
 }
 
 NonLoc SValBuilder::makeNonLoc(const SymExpr *lhs, BinaryOperator::Opcode op,
+                               const llvm::APFloat &rhs, QualType type) {
+  // The Environment ensures we always get a persistent APFloat in
+  // BasicValueFactory, so we don't need to get the APFloat from
+  // BasicValueFactory again.
+  assert(lhs);
+  assert(!Loc::isLocType(type));
+  return nonloc::SymbolVal(SymMgr.getSymFloatExpr(lhs, op, rhs, type));
+}
+
+NonLoc SValBuilder::makeNonLoc(const llvm::APFloat &lhs,
+                               BinaryOperator::Opcode op, const SymExpr *rhs,
+                               QualType type) {
+  assert(rhs);
+  assert(!Loc::isLocType(type));
+  return nonloc::SymbolVal(SymMgr.getFloatSymExpr(lhs, op, rhs, type));
+}
+
+NonLoc SValBuilder::makeNonLoc(const SymExpr *lhs, BinaryOperator::Opcode op,
                                const SymExpr *rhs, QualType type) {
   assert(lhs && rhs);
   assert(!Loc::isLocType(type));
   return nonloc::SymbolVal(SymMgr.getSymSymExpr(lhs, op, rhs, type));
 }
 
-NonLoc SValBuilder::makeNonLoc(const SymExpr *operand,
-                               QualType fromTy, QualType toTy) {
+NonLoc SValBuilder::makeNonLoc(const SymExpr *operand, QualType fromTy,
+                               QualType toTy) {
   assert(operand);
   assert(!Loc::isLocType(toTy));
   return nonloc::SymbolVal(SymMgr.getCastSymbol(operand, fromTy, toTy));
 }
 
 SVal SValBuilder::convertToArrayIndex(SVal val) {
   if (val.isUnknownOrUndef())
     return val;
 
   // Common case: we have an appropriately sized integer.
   if (Optional<nonloc::ConcreteInt> CI = val.getAs<nonloc::ConcreteInt>()) {
-    const llvm::APSInt& I = CI->getValue();
+    const llvm::APSInt &I = CI->getValue();
     if (I.getBitWidth() == ArrayIndexWidth && I.isSigned())
       return val;
   }
 
   return evalCastFromNonLoc(val.castAs<NonLoc>(), ArrayIndexTy);
 }
 
-nonloc::ConcreteInt SValBuilder::makeBoolVal(const CXXBoolLiteralExpr *boolean){
+nonloc::ConcreteInt
+SValBuilder::makeBoolVal(const CXXBoolLiteralExpr *boolean) {
   return makeTruthVal(boolean->getValue());
 }
 
 DefinedOrUnknownSVal
-SValBuilder::getRegionValueSymbolVal(const TypedValueRegion* region) {
+SValBuilder::getRegionValueSymbolVal(const TypedValueRegion *region) {
   QualType T = region->getValueType();
 
   if (T->isNullPtrType())
     return makeZeroVal(T);
 
   if (!SymbolManager::canSymbolicate(T))
     return UnknownVal();
 
DefinedOrUnknownSVal SValBuilder::conjureSymbolVal(const void *symbolTag,
   SymbolRef sym = SymMgr.conjureSymbol(expr, LCtx, type, count, symbolTag);
 
   if (Loc::isLocType(type))
     return loc::MemRegionVal(MemMgr.getSymbolicRegion(sym));
 
   return nonloc::SymbolVal(sym);
 }
 
-
 DefinedOrUnknownSVal SValBuilder::conjureSymbolVal(const Stmt *stmt,
                                                    const LocationContext *LCtx,
                                                    QualType type,
                                                    unsigned visitCount) {
   if (type->isNullPtrType())
     return makeZeroVal(type);
 
   if (!SymbolManager::canSymbolicate(type))
     return UnknownVal();
 
   SymbolRef sym = SymMgr.conjureSymbol(stmt, LCtx, type, visitCount);
 
   if (Loc::isLocType(type))
     return loc::MemRegionVal(MemMgr.getSymbolicRegion(sym));
 
   return nonloc::SymbolVal(sym);
 }
 
-DefinedOrUnknownSVal
-SValBuilder::getConjuredHeapSymbolVal(const Expr *E,
-                                      const LocationContext *LCtx,
-                                      unsigned VisitCount) {
+DefinedOrUnknownSVal SValBuilder::getConjuredHeapSymbolVal(
+    const Expr *E, const LocationContext *LCtx, unsigned VisitCount) {
   QualType T = E->getType();
   assert(Loc::isLocType(T));
   assert(SymbolManager::canSymbolicate(T));
   if (T->isNullPtrType())
     return makeZeroVal(T);
 
   SymbolRef sym = SymMgr.conjureSymbol(E, LCtx, T, VisitCount);
   return loc::MemRegionVal(MemMgr.getSymbolicHeapRegion(sym));
DefinedSVal SValBuilder::getMetadataSymbolVal(const void *symbolTag,
   if (Loc::isLocType(type))
     return loc::MemRegionVal(MemMgr.getSymbolicRegion(sym));
 
   return nonloc::SymbolVal(sym);
 }
 
 DefinedOrUnknownSVal
 SValBuilder::getDerivedRegionValueSymbolVal(SymbolRef parentSymbol,
-                                             const TypedValueRegion *region) {
   QualType T = region->getValueType();
 
   if (T->isNullPtrType())
     return makeZeroVal(T);
 
   if (!SymbolManager::canSymbolicate(T))
     return UnknownVal();
 
   SymbolRef sym = SymMgr.getDerivedSymbol(parentSymbol, region);
 
   if (Loc::isLocType(T))
     return loc::MemRegionVal(MemMgr.getSymbolicRegion(sym));
 
   return nonloc::SymbolVal(sym);
 }
 
-DefinedSVal SValBuilder::getMemberPointer(const DeclaratorDecl* DD) {
+DefinedSVal SValBuilder::getMemberPointer(const DeclaratorDecl *DD) {
   assert(!DD || isa<CXXMethodDecl>(DD) || isa<FieldDecl>(DD));
 
   if (auto *MD = dyn_cast_or_null<CXXMethodDecl>(DD)) {
     // Sema treats pointers to static member functions as have function pointer
     // type, so return a function pointer for the method.
     // We don't need to play a similar trick for static member fields
     // because these are represented as plain VarDecls and not FieldDecls
     // in the AST.
     if (MD->isStatic())
       return getFunctionPointer(MD);
   }
 
   return nonloc::PointerToMember(DD);
 }
 
 DefinedSVal SValBuilder::getFunctionPointer(const FunctionDecl *func) {
   return loc::MemRegionVal(MemMgr.getFunctionCodeRegion(func));
 }
 
 DefinedSVal SValBuilder::getBlockPointer(const BlockDecl *block,
                                          CanQualType locTy,
                                          const LocationContext *locContext,
                                          unsigned blockCount) {
-  const BlockCodeRegion *BC =
-    MemMgr.getBlockCodeRegion(block, locTy, locContext->getAnalysisDeclContext());
-  const BlockDataRegion *BD = MemMgr.getBlockDataRegion(BC, locContext,
-                                                        blockCount);
+  const BlockCodeRegion *BC = MemMgr.getBlockCodeRegion(
+      block, locTy, locContext->getAnalysisDeclContext());
+  const BlockDataRegion *BD =
+      MemMgr.getBlockDataRegion(BC, locContext, blockCount);
   return loc::MemRegionVal(BD);
 }
 
 /// Return a memory region for the 'this' object reference.
 loc::MemRegionVal SValBuilder::getCXXThis(const CXXMethodDecl *D,
                                           const StackFrameContext *SFC) {
-  return loc::MemRegionVal(getRegionManager().
-                           getCXXThisRegion(D->getThisType(getContext()), SFC));
+  return loc::MemRegionVal(
+      getRegionManager().getCXXThisRegion(D->getThisType(getContext()), SFC));
 }
 
 /// Return a memory region for the 'this' object reference.
 loc::MemRegionVal SValBuilder::getCXXThis(const CXXRecordDecl *D,
                                           const StackFrameContext *SFC) {
   const Type *T = D->getTypeForDecl();
   QualType PT = getContext().getPointerType(QualType(T, 0));
   return loc::MemRegionVal(getRegionManager().getCXXThisRegion(PT, SFC));
Optional<SVal> SValBuilder::getConstantVal(const Expr *E) {
   case Stmt::TypeTraitExprClass: {
     const TypeTraitExpr *TE = cast<TypeTraitExpr>(E);
     return makeTruthVal(TE->getValue(), TE->getType());
   }
 
   case Stmt::IntegerLiteralClass:
     return makeIntVal(cast<IntegerLiteral>(E));
 
+  case Stmt::FloatingLiteralClass:
+    return makeFloatVal(cast<FloatingLiteral>(E));
+
   case Stmt::ObjCBoolLiteralExprClass:
     return makeBoolVal(cast<ObjCBoolLiteralExpr>(E));
 
   case Stmt::CXXNullPtrLiteralExprClass:
     return makeNull();
 
   case Stmt::ImplicitCastExprClass: {
     const CastExpr *CE = cast<CastExpr>(E);
     switch (CE->getCastKind()) {
     default:
       break;
     case CK_ArrayToPointerDecay:
-    case CK_BitCast: {
+    case CK_BitCast:
+    case CK_IntegralToFloating: {
       const Expr *SE = CE->getSubExpr();
       Optional<SVal> Val = getConstantVal(SE);
       if (!Val)
         return None;
       return evalCast(*Val, CE->getType(), SE->getType());
     }
     }
     // FALLTHROUGH
default: {
     return None;
   }
   }
 }
 
 //===----------------------------------------------------------------------===//
 
 SVal SValBuilder::makeSymExprValNN(ProgramStateRef State,
-                                   BinaryOperator::Opcode Op,
-                                   NonLoc LHS, NonLoc RHS,
-                                   QualType ResultTy) {
+                                   BinaryOperator::Opcode Op, NonLoc LHS,
+                                   NonLoc RHS, QualType ResultTy) {
+  ConstraintManager &CM = getStateManager().getConstraintManager();
+
   const SymExpr *symLHS = LHS.getAsSymExpr();
   const SymExpr *symRHS = RHS.getAsSymExpr();
   // TODO: When the Max Complexity is reached, we should conjure a symbol
   // instead of generating an Unknown value and propagate the taint info to it.
   const unsigned MaxComp = 10000; // 100000 28X
 
+  // If constraint manager doesn't support floating-point expressions, skip
+  // generating those constraints.
   if (symLHS && symRHS &&
-      (symLHS->computeComplexity() + symRHS->computeComplexity()) < MaxComp)
+      (symLHS->computeComplexity() + symRHS->computeComplexity()) < MaxComp) {
+    if (!CM.canReasonAboutFloats() && (symLHS->getType()->isFloatingType() ||
+                                       symRHS->getType()->isFloatingType()))
+      return UnknownVal();
     return makeNonLoc(symLHS, Op, symRHS, ResultTy);
+  }
 
-  if (symLHS && symLHS->computeComplexity() < MaxComp)
+  if (symLHS && symLHS->computeComplexity() < MaxComp) {
     if (Optional<nonloc::ConcreteInt> rInt = RHS.getAs<nonloc::ConcreteInt>())
       return makeNonLoc(symLHS, Op, rInt->getValue(), ResultTy);
+    if (Optional<nonloc::ConcreteFloat> rFloat =
+            RHS.getAs<nonloc::ConcreteFloat>()) {
+      if (CM.canReasonAboutFloats())
+        return makeNonLoc(symLHS, Op, rFloat->getValue(), ResultTy);
+    }
+  }
 
-  if (symRHS && symRHS->computeComplexity() < MaxComp)
+  if (symRHS && symRHS->computeComplexity() < MaxComp) {
     if (Optional<nonloc::ConcreteInt> lInt = LHS.getAs<nonloc::ConcreteInt>())
       return makeNonLoc(lInt->getValue(), Op, symRHS, ResultTy);
+    if (Optional<nonloc::ConcreteFloat> lFloat =
+            LHS.getAs<nonloc::ConcreteFloat>()) {
+      if (CM.canReasonAboutFloats())
+        return makeNonLoc(lFloat->getValue(), Op, symRHS, ResultTy);
+    }
+  }
 
   return UnknownVal();
 }
 
-
 SVal SValBuilder::evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op,
                             SVal lhs, SVal rhs, QualType type) {
 
   if (lhs.isUndef() || rhs.isUndef())
     return UndefinedVal();
 
   if (lhs.isUnknown() || rhs.isUnknown())
     return UnknownVal();
DefinedOrUnknownSVal SValBuilder::evalEQ(ProgramStateRef state,
   return evalBinOp(state, BO_EQ, lhs, rhs, getConditionType())
       .castAs<DefinedOrUnknownSVal>();
 }
 
 /// Recursively check if the pointer types are equal modulo const, volatile,
 /// and restrict qualifiers. Also, assume that all types are similar to 'void'.
 /// Assumes the input types are canonical.
 static bool shouldBeModeledWithNoOp(ASTContext &Context, QualType ToTy,
-                                                         QualType FromTy) {
   while (Context.UnwrapSimilarPointerTypes(ToTy, FromTy)) {
     Qualifiers Quals1, Quals2;
     ToTy = Context.getUnqualifiedArrayType(ToTy, Quals1);
     FromTy = Context.getUnqualifiedArrayType(FromTy, Quals2);
 
     // Make sure that non-cvr-qualifiers the other qualifiers (e.g., address
     // spaces) are identical.
     Quals1.removeCVRQualifiers();
if (castTy->isBooleanType()) {
 
     Loc L = val.castAs<nonloc::LocAsInteger>().getLoc();
     return evalCastFromLoc(L, castTy);
   }
 
   // For const casts, casts to void, just propagate the value.
   if (!castTy->isVariableArrayType() && !originalTy->isVariableArrayType())
     if (shouldBeModeledWithNoOp(Context, Context.getPointerType(castTy),
-                                         Context.getPointerType(originalTy)))
       return val;
 
   // Check for casts from pointers to integers.
   if (castTy->isIntegralOrEnumerationType() && Loc::isLocType(originalTy))
     return evalCastFromLoc(val.castAs<Loc>(), castTy);
 
   // Check for casts from integers to pointers.
   if (Loc::isLocType(castTy) && originalTy->isIntegralOrEnumerationType()) {
SVal SValBuilder::evalCast(SVal val, QualType castTy, QualType originalTy) {
   // Just pass through function and block pointers.
   if (originalTy->isBlockPointerType() || originalTy->isFunctionPointerType()) {
     assert(Loc::isLocType(castTy));
     return val;
   }
 
   // Check for casts from array type to another type.
   if (const ArrayType *arrayT =
-                      dyn_cast<ArrayType>(originalTy.getCanonicalType())) {
     // We will always decay to a pointer.
     QualType elemTy = arrayT->getElementType();
     val = StateMgr.ArrayToPointer(val.castAs<Loc>(), elemTy);
 
     // Are we casting from an array to a pointer?  If so just pass on
     // the decayed value.
     if (castTy->isPointerType() || castTy->isReferenceType())
       return val;
SVal SValBuilder::evalCast(SVal val, QualType castTy, QualType originalTy) {
   if (const MemRegion *R = val.getAsRegion()) {
     // Handle other casts of locations to integers.
     if (castTy->isIntegralOrEnumerationType())
       return evalCastFromLoc(loc::MemRegionVal(R), castTy);
 
     // FIXME: We should handle the case where we strip off view layers to get
     //  to a desugared type.
     if (!Loc::isLocType(castTy)) {
-      // FIXME: There can be gross cases where one casts the result of a function
-      // (that returns a pointer) to some other value that happens to fit
-      // within that pointer value.  We currently have no good way to
-      // model such operations.  When this happens, the underlying operation
-      // is that the caller is reasoning about bits.  Conceptually we are
-      // layering a "view" of a location on top of those bits.  Perhaps
-      // we need to be more lazy about mutual possible views, even on an
-      // SVal?  This may be necessary for bit-level reasoning as well.
+      // FIXME: There can be gross cases where one casts the result of a
+      // function (that returns a pointer) to some other value that happens to
+      // fit within that pointer value.  We currently have no good way to model
+      // such operations.  When this happens, the underlying operation is that
+      // the caller is reasoning about bits.  Conceptually we are layering a
+      // "view" of a location on top of those bits.  Perhaps we need to be more
+      // lazy about mutual possible views, even on an SVal?  This may be
+      // necessary for bit-level reasoning as well.
       return UnknownVal();
     }
 
     // We get a symbolic function pointer for a dereference of a function
     // pointer, but it is of function type. Example:
 
     //  struct FPRec {
     //    void (*my_func)(int * x);

lib/StaticAnalyzer/Core/SVals.cpp

 
 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
 #include "clang/AST/ExprObjC.h"
 #include "clang/Basic/IdentifierTable.h"
 #include "llvm/Support/raw_ostream.h"
 #include "clang/AST/DeclCXX.h"
 using namespace clang;
 using namespace ento;
+using llvm::APFloat;
 using llvm::APSInt;
 
 //===----------------------------------------------------------------------===//
 // Symbol iteration within an SVal.
 //===----------------------------------------------------------------------===//
 
 
 //===----------------------------------------------------------------------===//
if (PTMD.is<const DeclaratorDecl *>())
     return nonloc::PointerToMember::iterator();
   return PTMD.get<const PointerToMemberData *>()->end();
 }
 
 //===----------------------------------------------------------------------===//
 // Useful predicates.
 //===----------------------------------------------------------------------===//
 
+bool SVal::isFloat() const {
+  if (Optional<nonloc::SymbolVal> SV = getAs<nonloc::SymbolVal>()) {
+    return SV->getSymbol()->getType()->isRealFloatingType();
+  }
+  return getAs<nonloc::ConcreteFloat>().hasValue();
+}
+
 bool SVal::isConstant() const {
-  return getAs<nonloc::ConcreteInt>() || getAs<loc::ConcreteInt>();
+  return getAs<nonloc::ConcreteInt>() || getAs<loc::ConcreteInt>() ||
+         getAs<nonloc::ConcreteFloat>();
 }
 
 bool SVal::isConstant(int I) const {
   if (Optional<loc::ConcreteInt> LV = getAs<loc::ConcreteInt>())
     return LV->getValue() == I;
   if (Optional<nonloc::ConcreteInt> NV = getAs<nonloc::ConcreteInt>())
     return NV->getValue() == I;
   return false;
 }
 
+bool SVal::isConstant(APFloat &V) const {
+  if (Optional<nonloc::ConcreteFloat> NF = getAs<nonloc::ConcreteFloat>())
+    return NF->getValue().compare(V) == llvm::APFloat::cmpEqual;
+  return false;
+}
+
 bool SVal::isZeroConstant() const {
+  if (Optional<nonloc::ConcreteFloat> NF = getAs<nonloc::ConcreteFloat>())
+    return NF->getValue().isPosZero() || NF->getValue().isNegZero();
   return isConstant(0);
 }
 
 
 //===----------------------------------------------------------------------===//
 // Transfer function dispatch for Non-Locs.
 //===----------------------------------------------------------------------===//
 
nonloc::ConcreteInt::evalComplement(SValBuilder &svalBuilder) const {
   return svalBuilder.makeIntVal(~getValue());
 }
 
 nonloc::ConcreteInt
 nonloc::ConcreteInt::evalMinus(SValBuilder &svalBuilder) const {
   return svalBuilder.makeIntVal(-getValue());
 }
 
+nonloc::ConcreteFloat
+nonloc::ConcreteFloat::evalMinus(SValBuilder &svalBuilder) const {
+  llvm::APFloat Value = getValue();
+  Value.changeSign();
+  return svalBuilder.makeFloatVal(Value);
+}
+
+SVal nonloc::ConcreteFloat::evalBinOp(SValBuilder &svalBuilder,
+                                      BinaryOperator::Opcode Op,
+                                      const nonloc::ConcreteFloat& R) const {
+  if (BinaryOperator::isComparisonOp(Op)) {
+    const llvm::APSInt *V = svalBuilder.getBasicValueFactory().evalAPFloatComparison(
+        Op, getValue(), R.getValue());
+    if (V)
+      return nonloc::ConcreteInt(*V);
+    return UnknownVal();
+  }
+
+  const llvm::APFloat *V = svalBuilder.getBasicValueFactory().evalAPFloat(
+        Op, getValue(), R.getValue());
+    if (V)
+      return nonloc::ConcreteFloat(*V);
+    return UnknownVal();
+}
+
 //===----------------------------------------------------------------------===//
 // Transfer function dispatch for Locs.
 //===----------------------------------------------------------------------===//
 
 SVal loc::ConcreteInt::evalBinOp(BasicValueFactory& BasicVals,
                                  BinaryOperator::Opcode Op,
                                  const loc::ConcreteInt& R) const {
 
case nonloc::ConcreteIntKind: {
       if (C.getValue().isUnsigned())
         os << C.getValue().getZExtValue();
       else
         os << C.getValue().getSExtValue();
       os << ' ' << (C.getValue().isUnsigned() ? 'U' : 'S')
          << C.getValue().getBitWidth() << 'b';
       break;
     }
+    case nonloc::ConcreteFloatKind: {
+      const nonloc::ConcreteFloat& C = castAs<nonloc::ConcreteFloat>();
+      SmallString<24> Chars;
+
+      C.getValue().toString(Chars, 0, 0);
+      os << Chars
+         << ' '
+         << llvm::APFloat::semanticsSizeInBits(C.getValue().getSemantics())
+         << 'b';
+      break;
+    }
     case nonloc::SymbolValKind: {
       os << castAs<nonloc::SymbolVal>().getSymbol();
       break;
     }
     case nonloc::LocAsIntegerKind: {
       const nonloc::LocAsInteger& C = castAs<nonloc::LocAsInteger>();
       os << C.getLoc() << " [as " << C.getNumBits() << " bit integer]";
       break;

lib/StaticAnalyzer/Core/SimpleConstraintManager.cpp

ProgramStateRef SimpleConstraintManager::assume(ProgramStateRef State,
   if (NotifyAssumeClients && SU)
     return SU->processAssume(State, Cond, Assumption);
   return State;
 }
 
 ProgramStateRef SimpleConstraintManager::assumeAux(ProgramStateRef State,
                                                    NonLoc Cond,
                                                    bool Assumption) {
-
-  // We cannot reason about SymSymExprs, and can only reason about some
-  // SymIntExprs.
   if (!canReasonAbout(Cond)) {
     // Just add the constraint to the expression without trying to simplify.
     SymbolRef Sym = Cond.getAsSymExpr();
     assert(Sym);
     return assumeSymUnsupported(State, Sym, Assumption);
   }
 
   switch (Cond.getSubKind()) {
   default:
     llvm_unreachable("'Assume' not implemented for this NonLoc");
 
   case nonloc::SymbolValKind: {
     nonloc::SymbolVal SV = Cond.castAs<nonloc::SymbolVal>();
     SymbolRef Sym = SV.getSymbol();
     assert(Sym);
     return assumeSym(State, Sym, Assumption);
   }
 
+  case nonloc::ConcreteFloatKind: {
+    bool b = !Cond.castAs<nonloc::ConcreteFloat>().getValue().isZero();
+    bool isFeasible = b ? Assumption : !Assumption;
+    return isFeasible ? State : nullptr;
+  }
+
   case nonloc::ConcreteIntKind: {
     bool b = Cond.castAs<nonloc::ConcreteInt>().getValue() != 0;
     bool isFeasible = b ? Assumption : !Assumption;
     return isFeasible ? State : nullptr;
   }
 
   case nonloc::PointerToMemberKind: {
     bool IsNull = !Cond.castAs<nonloc::PointerToMember>().isNullMemberPointer();
default:
     llvm_unreachable("'assumeInclusiveRange' is not implemented"
                      "for this NonLoc");
 
   case nonloc::LocAsIntegerKind:
   case nonloc::SymbolValKind: {
     if (SymbolRef Sym = Value.getAsSymbol())
       return assumeSymInclusiveRange(State, Sym, From, To, InRange);
     return State;
-  } // end switch
+  }
+
+  case nonloc::ConcreteFloatKind: {
+    BasicValueFactory &BVF = getBasicVals();
+
+    const llvm::APFloat &FloatVal =
+        Value.castAs<nonloc::ConcreteFloat>().getValue();
+    llvm::APFloat FromF(FloatVal.getSemantics(), llvm::APFloat::uninitialized);
+    llvm::APFloat ToF(FloatVal.getSemantics(), llvm::APFloat::uninitialized);
+    bool isOk = BVF.Convert(FromF, From);
+    assert(isOk && "Integer failed to convert to float!");
+    (void)isOk;
+    isOk = BVF.Convert(ToF, To);
+    assert(isOk && "Integer failed to convert to float!");
+    (void)isOk;
+    llvm::APFloat::cmpResult CompareFrom = FloatVal.compare(FromF);
+    llvm::APFloat::cmpResult CompareTo = FloatVal.compare(ToF);
+
+    bool IsInRange = (CompareFrom == llvm::APFloat::cmpGreaterThan ||
+                      CompareFrom == llvm::APFloat::cmpEqual) &&
+                     (CompareTo == llvm::APFloat::cmpLessThan ||
+                      CompareTo == llvm::APFloat::cmpEqual);
+    bool isFeasible = (IsInRange == InRange);
+    return isFeasible ? State : nullptr;
+  }
 
   case nonloc::ConcreteIntKind: {
     const llvm::APSInt &IntVal = Value.castAs<nonloc::ConcreteInt>().getValue();
     bool IsInRange = IntVal >= From && IntVal <= To;
     bool isFeasible = (IsInRange == InRange);
     return isFeasible ? State : nullptr;
   }
   } // end switch
 }
 
 } // end of namespace ento
 
 } // end of namespace clang

lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp

 // SimpleSValBuilder.cpp - A basic SValBuilder -----------------------*- C++ -*-
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 //
 //  This file defines SimpleSValBuilder, a basic implementation of SValBuilder.
 //
 //===----------------------------------------------------------------------===//
 
-#include "clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/APSIntType.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/SValVisitor.h"
 
 using namespace clang;
 using namespace ento;
 
 namespace {
 class SimpleSValBuilder : public SValBuilder {
 protected:
   SVal dispatchCast(SVal val, QualType castTy) override;
   SVal evalCastFromNonLoc(NonLoc val, QualType castTy) override;
   SVal evalCastFromLoc(Loc val, QualType castTy) override;
 
 public:
   SimpleSValBuilder(llvm::BumpPtrAllocator &alloc, ASTContext &context,
                     ProgramStateManager &stateMgr)
-                    : SValBuilder(alloc, context, stateMgr) {}
   ~SimpleSValBuilder() override {}
 
   SVal evalMinus(NonLoc val) override;
   SVal evalComplement(NonLoc val) override;
-  SVal evalBinOpNN(ProgramStateRef state, BinaryOperator::Opcode op,
-                   NonLoc lhs, NonLoc rhs, QualType resultTy) override;
-  SVal evalBinOpLL(ProgramStateRef state, BinaryOperator::Opcode op,
-                   Loc lhs, Loc rhs, QualType resultTy) override;
-  SVal evalBinOpLN(ProgramStateRef state, BinaryOperator::Opcode op,
-                   Loc lhs, NonLoc rhs, QualType resultTy) override;
-
-  /// getKnownValue - evaluates a given SVal. If the SVal has only one possible
-  ///  (integer) value, that value is returned. Otherwise, returns NULL.
-  const llvm::APSInt *getKnownValue(ProgramStateRef state, SVal V) override;
+  SVal evalBinOpNN(ProgramStateRef state, BinaryOperator::Opcode op, NonLoc lhs,
+                   NonLoc rhs, QualType resultTy) override;
+  SVal evalBinOpLL(ProgramStateRef state, BinaryOperator::Opcode op, Loc lhs,
+                   Loc rhs, QualType resultTy) override;
+  SVal evalBinOpLN(ProgramStateRef state, BinaryOperator::Opcode op, Loc lhs,
+                   NonLoc rhs, QualType resultTy) override;
+
+  /// getKnownIntValue - evaluates a given SVal. If the SVal has only one possible
+  ///  integer value, that value is returned. Otherwise, returns NULL.
+  const llvm::APSInt *getKnownIntValue(ProgramStateRef state, SVal V) override;
+
+  /// Evaluates a given SVal. If the SVal has only one possible float value,
+  /// that value is returned. Otherwise, returns NULL.
+  const llvm::APFloat *getKnownFloatValue(ProgramStateRef state,
+                                          SVal val) override;
 
   /// Recursively descends into symbolic expressions and replaces symbols
-  /// with their known values (in the sense of the getKnownValue() method).
+  /// with their known values (in the sense of the getKnownIntValue() method).
   SVal simplifySVal(ProgramStateRef State, SVal V) override;
 
   SVal MakeSymIntVal(const SymExpr *LHS, BinaryOperator::Opcode op,
                      const llvm::APSInt &RHS, QualType resultTy);
+
+  SVal MakeSymFloatVal(const SymExpr *LHS, BinaryOperator::Opcode op,
+                       const llvm::APFloat &RHS, QualType resultTy);
 };
 } // end anonymous namespace
 
 SValBuilder *ento::createSimpleSValBuilder(llvm::BumpPtrAllocator &alloc,
                                            ASTContext &context,
                                            ProgramStateManager &stateMgr) {
   return new SimpleSValBuilder(alloc, context, stateMgr);
 }
 
 //===----------------------------------------------------------------------===//
 // Transfer function for Casts.
 //===----------------------------------------------------------------------===//
 
 SVal SimpleSValBuilder::dispatchCast(SVal Val, QualType CastTy) {
   assert(Val.getAs<Loc>() || Val.getAs<NonLoc>());
   return Val.getAs<Loc>() ? evalCastFromLoc(Val.castAs<Loc>(), CastTy)
-                           : evalCastFromNonLoc(Val.castAs<NonLoc>(), CastTy);
 }
 
 SVal SimpleSValBuilder::evalCastFromNonLoc(NonLoc val, QualType castTy) {
   bool isLocType = Loc::isLocType(castTy);
   if (val.getAs<nonloc::PointerToMember>())
     return val;
 
   if (Optional<nonloc::LocAsInteger> LI = val.getAs<nonloc::LocAsInteger>()) {
if (const SymExpr *se = val.getAsSymbolicExpression()) {
     QualType T = Context.getCanonicalType(se->getType());
     // If types are the same or both are integers, ignore the cast.
     // FIXME: Remove this hack when we support symbolic truncation/extension.
     // HACK: If both castTy and T are integers, ignore the cast.  This is
     // not a permanent solution.  Eventually we want to precisely handle
     // extension/truncation of symbolic integers.  This prevents us from losing
     // precision when we assign 'x = y' and 'y' is symbolic and x and y are
     // different integer types.
     if (haveSameType(T, castTy))
       return val;
 
     if (!isLocType)
       return makeNonLoc(se, T, castTy);
     return UnknownVal();
   }
 
-  // If value is a non-integer constant, produce unknown.
-  if (!val.getAs<nonloc::ConcreteInt>())
+  // If value is an unsupported constant, produce unknown.
+  if (!val.getAs<nonloc::ConcreteInt>() && !val.getAs<nonloc::ConcreteFloat>())
     return UnknownVal();
 
   // Handle casts to a boolean type.
   if (castTy->isBooleanType()) {
-    bool b = val.castAs<nonloc::ConcreteInt>().getValue().getBoolValue();
-    return makeTruthVal(b, castTy);
+    if (Optional<nonloc::ConcreteInt> CI = val.getAs<nonloc::ConcreteInt>())
+      return makeTruthVal(CI->getValue().getBoolValue(), castTy);
+    if (Optional<nonloc::ConcreteFloat> CF = val.getAs<nonloc::ConcreteFloat>())
+      return makeTruthVal(!CF->getValue().isZero(), castTy);
   }
 
-  // Only handle casts from integers to integers - if val is an integer constant
-  // being cast to a non-integer type, produce unknown.
+  // Handle casts from integer
+  if (Optional<nonloc::ConcreteInt> CI = val.getAs<nonloc::ConcreteInt>()) {
+    if (castTy->isRealFloatingType()) {
+      if (isLocType)
+        return UnknownVal();
+
+      llvm::APFloat Value(Context.getFloatTypeSemantics(castTy));
+      // Cannot be represented in destination type, this is undefined behavior
+      // TODO: Emit warning for this
+      if (!BasicValueFactory::Convert(Value, CI->getValue()))
+        return UndefinedVal();
+      return makeFloatVal(Value);
+    }
+
+    // Only handle casts from integers to integers - if val is an integer
+    // constant being cast to a non-integer type, produce unknown.
     if (!isLocType && !castTy->isIntegralOrEnumerationType())
       return UnknownVal();
 
-  llvm::APSInt i = val.castAs<nonloc::ConcreteInt>().getValue();
-  BasicVals.getAPSIntType(castTy).apply(i);
+    llvm::APSInt Value = CI->getValue();
+    BasicVals.getAPSIntType(castTy).apply(Value);
+    if (isLocType)
+      return makeIntLocVal(Value);
+    return makeIntVal(Value);
+  }
+
+  // Handle casts from real floating-point
+  if (Optional<nonloc::ConcreteFloat> CF = val.getAs<nonloc::ConcreteFloat>()) {
+    bool lossOfPrecision;
 
+    if (castTy->isIntegralOrEnumerationType()) {
+      llvm::APSInt Value(Context.getTypeSize(castTy),
+                         !castTy->isSignedIntegerOrEnumerationType());
+      // Cannot be represented in destination type, this is undefined behavior
+      // TODO: Emit warning for this
+      if (!BasicValueFactory::Convert(Value, CF->getValue()))
+        return UndefinedVal();
       if (isLocType)
-    return makeIntLocVal(i);
-  else
-    return makeIntVal(i);
+        return makeIntLocVal(Value);
+      return makeIntVal(Value);
+    }
+
+    if (castTy->isRealFloatingType()) {
+      if (isLocType)
+        return UnknownVal();
+
+      llvm::APFloat Value = CF->getValue();
+      llvm::APFloat::opStatus Status =
+          Value.convert(Context.getFloatTypeSemantics(castTy),
+                        llvm::APFloat::rmNearestTiesToEven, &lossOfPrecision);
+      // Cannot be represented in destination type, this is undefined behavior
+      // TODO: Emit warning for this
+      if (Status & (llvm::APFloat::opOverflow | llvm::APFloat::opInvalidOp))
+        return UndefinedVal();
+      return makeFloatVal(Value);
+    }
+
+    return UnknownVal();
+  }
+
+  return UnknownVal();
 }
 
 SVal SimpleSValBuilder::evalCastFromLoc(Loc val, QualType castTy) {
 
   // Casts from pointers -> pointers, just return the lval.
   //
   // Casts from pointers -> references, just return the lval.  These
   //   can be introduced by the frontend for corner cases, e.g
   //   casting from va_list* to __builtin_va_list&.
   //
   if (Loc::isLocType(castTy) || castTy->isReferenceType())
     return val;
 
   // FIXME: Handle transparent unions where a value can be "transparently"
   //  lifted into a union type.
   if (castTy->isUnionType())
     return UnknownVal();
 
   // Casting a Loc to a bool will almost always be true,
   // unless this is a weak function or a symbolic region.
   if (castTy->isBooleanType()) {
     switch (val.getSubKind()) {
-      case loc::MemRegionValKind: {
-        const MemRegion *R = val.castAs<loc::MemRegionVal>().getRegion();
-        if (const FunctionCodeRegion *FTR = dyn_cast<FunctionCodeRegion>(R))
-          if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(FTR->getDecl()))
-            if (FD->isWeak())
-              // FIXME: Currently we are using an extent symbol here,
-              // because there are no generic region address metadata
-              // symbols to use, only content metadata.
-              return nonloc::SymbolVal(SymMgr.getExtentSymbol(FTR));
 
-        if (const SymbolicRegion *SymR = R->getSymbolicBase())
-          return nonloc::SymbolVal(SymR->getSymbol());
 
-        // FALL-THROUGH
-        LLVM_FALLTHROUGH;
-      }
 
-      case loc::GotoLabelKind:
-        // Labels and non-symbolic memory regions are always true.
-        return makeTruthVal(true, castTy);
     }
   }
 
   if (castTy->isIntegralOrEnumerationType()) {
     unsigned BitWidth = Context.getIntWidth(castTy);
 
     if (!val.getAs<loc::ConcreteInt>())
       return makeLocAsInteger(val, BitWidth);

 //===----------------------------------------------------------------------===//
 // Transfer function for unary operators.
 //===----------------------------------------------------------------------===//
 
 SVal SimpleSValBuilder::evalMinus(NonLoc val) {
   switch (val.getSubKind()) {
   case nonloc::ConcreteIntKind:
     return val.castAs<nonloc::ConcreteInt>().evalMinus(*this);
+  case nonloc::ConcreteFloatKind:
+    return val.castAs<nonloc::ConcreteFloat>().evalMinus(*this);
   default:
     return UnknownVal();
   }
 }
 
 SVal SimpleSValBuilder::evalComplement(NonLoc X) {
   switch (X.getSubKind()) {
   case nonloc::ConcreteIntKind:
     return X.castAs<nonloc::ConcreteInt>().evalComplement(*this);
   default:
     return UnknownVal();
   }
 }
 
 //===----------------------------------------------------------------------===//
 // Transfer function for binary operators.
 //===----------------------------------------------------------------------===//
 
 SVal SimpleSValBuilder::MakeSymIntVal(const SymExpr *LHS,
                                       BinaryOperator::Opcode op,
                                       const llvm::APSInt &RHS,
                                       QualType resultTy) {
   bool isIdempotent = false;
 
   // Check for a few special cases with known reductions first.
   switch (op) {
   default:
     // We can't reduce this case; just treat it normally.
     break;
   case BO_Mul:
case BO_Or:
     }
     break;
   }
 
   // Idempotent ops (like a*1) can still change the type of an expression.
   // Wrap the LHS up in a NonLoc again and let evalCastFromNonLoc do the
   // dirty work.
   if (isIdempotent)
-      return evalCastFromNonLoc(nonloc::SymbolVal(LHS), resultTy);
 
   // If we reach this point, the expression cannot be simplified.
   // Make a SymbolVal for the entire expression, after converting the RHS.
   const llvm::APSInt *ConvertedRHS = &RHS;
   if (BinaryOperator::isComparisonOp(op)) {
     // We're looking for a type big enough to compare the symbolic value
     // with the given constant.
     // FIXME: This is an approximation of Sema::UsualArithmeticConversions.
if (ValWidth < TypeWidth) {
         ConvertedRHS = &BasicVals.Convert(SymbolType, RHS);
     }
   } else
     ConvertedRHS = &BasicVals.Convert(resultTy, RHS);
 
   return makeNonLoc(LHS, op, *ConvertedRHS, resultTy);
 }
 
-SVal SimpleSValBuilder::evalBinOpNN(ProgramStateRef state,
+SVal SimpleSValBuilder::MakeSymFloatVal(const SymExpr *LHS,
                                         BinaryOperator::Opcode op,
-                                  NonLoc lhs, NonLoc rhs,
-                                  QualType resultTy)  {
+                                        const llvm::APFloat &RHS,
+                                        QualType resultTy) {
+  ConstraintManager &CM = getStateManager().getConstraintManager();
+  if (!CM.canReasonAboutFloats())
+    return UnknownVal();
+
+  if (RHS.isNaN())
+    return makeTruthVal(op == BO_NE, resultTy);
+
+  const llvm::APFloat *ConvertedRHS = &RHS;
+  return makeNonLoc(LHS, op, *ConvertedRHS, resultTy);
+}
+
+SVal SimpleSValBuilder::evalBinOpNN(ProgramStateRef state,
+                                    BinaryOperator::Opcode op, NonLoc lhs,
+                                    NonLoc rhs, QualType resultTy) {
   NonLoc InputLHS = lhs;
   NonLoc InputRHS = rhs;
 
   // Handle trivial case where left-side and right-side are the same.
-  if (lhs == rhs)
+  // Skip floating-point operations, which are not commutative.
+  if (lhs == rhs && !lhs.isFloat())
     switch (op) {
-      default:
-        break;
-      case BO_EQ:
-      case BO_LE:
-      case BO_GE:
-        return makeTruthVal(true, resultTy);
-      case BO_LT:
-      case BO_GT:
-      case BO_NE:
-        return makeTruthVal(false, resultTy);
-      case BO_Xor:
-      case BO_Sub:
-        if (resultTy->isIntegralOrEnumerationType())
-          return makeIntVal(0, resultTy);
-        return evalCastFromNonLoc(makeIntVal(0, /*Unsigned=*/false), resultTy);
-      case BO_Or:
-      case BO_And:
-        return evalCastFromNonLoc(lhs, resultTy);
     }
 
   while (1) {
     switch (lhs.getSubKind()) {
     default:
       return makeSymExprValNN(state, op, lhs, rhs, resultTy);
     case nonloc::PointerToMemberKind: {
       assert(rhs.getSubKind() == nonloc::PointerToMemberKind &&
              "Both SVals should have pointer-to-member-type");
       auto LPTM = lhs.castAs<nonloc::PointerToMember>(),
            RPTM = rhs.castAs<nonloc::PointerToMember>();
       auto LPTMD = LPTM.getPTMData(), RPTMD = RPTM.getPTMData();
       switch (op) {
-        case BO_EQ:
-          return makeTruthVal(LPTMD == RPTMD, resultTy);
-        case BO_NE:
-          return makeTruthVal(LPTMD != RPTMD, resultTy);
-        default:
-          return UnknownVal();
       }
     }
     case nonloc::LocAsIntegerKind: {
       Loc lhsL = lhs.castAs<nonloc::LocAsInteger>().getLoc();
       switch (rhs.getSubKind()) {
-        case nonloc::LocAsIntegerKind:
-          return evalBinOpLL(state, op, lhsL,
-                             rhs.castAs<nonloc::LocAsInteger>().getLoc(),
-                             resultTy);
-        case nonloc::ConcreteIntKind: {
-          // Transform the integer into a location and compare.
-          // FIXME: This only makes sense for comparisons. If we want to, say,
-          // add 1 to a LocAsInteger, we'd better unpack the Loc and add to it,
-          // then pack it back into a LocAsInteger.
-          llvm::APSInt i = rhs.castAs<nonloc::ConcreteInt>().getValue();
-          BasicVals.getAPSIntType(Context.VoidPtrTy).apply(i);
-          return evalBinOpLL(state, op, lhsL, makeLoc(i), resultTy);
-        }
-        default:
-          switch (op) {
-            case BO_EQ:
-              return makeTruthVal(false, resultTy);
-            case BO_NE:
-              return makeTruthVal(true, resultTy);
-            default:
-              // This case also handles pointer arithmetic.
-              return makeSymExprValNN(state, op, InputLHS, InputRHS, resultTy);
-          }
       }
     }
     case nonloc::ConcreteIntKind: {
       llvm::APSInt LHSValue = lhs.castAs<nonloc::ConcreteInt>().getValue();
 
       // If we're dealing with two known constants, just perform the operation.
-      if (const llvm::APSInt *KnownRHSValue = getKnownValue(state, rhs)) {
+      if (const llvm::APSInt *KnownRHSValue = getKnownIntValue(state, rhs)) {
         llvm::APSInt RHSValue = *KnownRHSValue;
         if (BinaryOperator::isComparisonOp(op)) {
           // We're looking for a type big enough to compare the two values.
           // FIXME: This is not correct. char + short will result in a promotion
           // to int. Unfortunately we have lost types by this point.
-          APSIntType CompareType = std::max(APSIntType(LHSValue),
-                                            APSIntType(RHSValue));
+          APSIntType CompareType =
+              std::max(APSIntType(LHSValue), APSIntType(RHSValue));
           CompareType.apply(LHSValue);
           CompareType.apply(RHSValue);
         } else if (!BinaryOperator::isShiftOp(op)) {
           APSIntType IntType = BasicVals.getAPSIntType(resultTy);
           IntType.apply(LHSValue);
           IntType.apply(RHSValue);
         }
 
         const llvm::APSInt *Result =
             BasicVals.evalAPSInt(op, LHSValue, RHSValue);
         if (!Result)
           return UndefinedVal();
 
         return nonloc::ConcreteInt(*Result);
       }
 
       // Swap the left and right sides and flip the operator if doing so
       // allows us to better reason about the expression (this is a form
case nonloc::ConcreteIntKind: {
         // 0<<a and 0>>a
         if (LHSValue == 0)
           return evalCastFromNonLoc(lhs, resultTy);
         return makeSymExprValNN(state, op, InputLHS, InputRHS, resultTy);
       default:
         return makeSymExprValNN(state, op, InputLHS, InputRHS, resultTy);
       }
     }
+    case nonloc::ConcreteFloatKind: {
+      llvm::APFloat LHSValue = lhs.castAs<nonloc::ConcreteFloat>().getValue();
+
+      // If we're dealing with two known constants, just perform the operation.
+      if (const llvm::APFloat *KnownRHSValue = getKnownFloatValue(state, rhs)) {
+        llvm::APFloat RHSValue = *KnownRHSValue;
+
+        if (BinaryOperator::isComparisonOp(op)) {
+          const llvm::APSInt *V =
+              BasicVals.evalAPFloatComparison(op, LHSValue, RHSValue);
+          if (V)
+            return nonloc::ConcreteInt(*V);
+          return UnknownVal();
+        }
+
+        const llvm::APFloat *V = BasicVals.evalAPFloat(op, LHSValue, RHSValue);
+        if (V)
+          return nonloc::ConcreteFloat(*V);
+        return UnknownVal();
+      }
+
+      return makeSymExprValNN(state, op, InputLHS, InputRHS, resultTy);
+    }
     case nonloc::SymbolValKind: {
       // We only handle LHS as simple symbols or SymIntExprs.
       SymbolRef Sym = lhs.castAs<nonloc::SymbolVal>().getSymbol();
 
       // LHS is a symbolic expression.
       if (const SymIntExpr *symIntExpr = dyn_cast<SymIntExpr>(Sym)) {
 
         // Is this a logical not? (!x is represented as x == 0.)
case nonloc::SymbolValKind: {
           case BO_PtrMemI:
             llvm_unreachable("Pointer arithmetic not handled here.");
           case BO_LT:
           case BO_GT:
           case BO_LE:
           case BO_GE:
           case BO_EQ:
           case BO_NE:
-            assert(resultTy->isBooleanType() ||
-                   resultTy == getConditionType());
+            assert(resultTy->isBooleanType() || resultTy == getConditionType());
             assert(symIntExpr->getType()->isBooleanType() ||
                    getContext().hasSameUnqualifiedType(symIntExpr->getType(),
                                                        getConditionType()));
             // Negate the comparison and make a value.
             opc = BinaryOperator::negateComparisonOp(opc);
-            return makeNonLoc(symIntExpr->getLHS(), opc,
-                symIntExpr->getRHS(), resultTy);
+            return makeNonLoc(symIntExpr->getLHS(), opc, symIntExpr->getRHS(),
+                              resultTy);
           }
         }
 
         // For now, only handle expressions whose RHS is a constant.
-        if (const llvm::APSInt *RHSValue = getKnownValue(state, rhs)) {
+        if (const llvm::APSInt *RHSValue = getKnownIntValue(state, rhs)) {
           // If both the LHS and the current expression are additive,
           // fold their constants and try again.
           if (BinaryOperator::isAdditiveOp(op)) {
             BinaryOperator::Opcode lop = symIntExpr->getOpcode();
             if (BinaryOperator::isAdditiveOp(lop)) {
               // Convert the two constants to a common type, then combine them.
 
               // resultTy may not be the best type to convert to, but it's
case nonloc::SymbolValKind: {
       SVal simplifiedLhs = simplifySVal(state, lhs);
       if (simplifiedLhs != lhs)
         if (auto simplifiedLhsAsNonLoc = simplifiedLhs.getAs<NonLoc>()) {
           lhs = *simplifiedLhsAsNonLoc;
           continue;
         }
 
       // Is the RHS a constant?
-      if (const llvm::APSInt *RHSValue = getKnownValue(state, rhs))
+      if (rhs.isFloat()) {
+        if (const llvm::APFloat *RHSValue = getKnownFloatValue(state, rhs))
+          return MakeSymFloatVal(Sym, op, *RHSValue, resultTy);
+      } else {
+        if (const llvm::APSInt *RHSValue = getKnownIntValue(state, rhs))
           return MakeSymIntVal(Sym, op, *RHSValue, resultTy);
+      }
 
       // Give up -- this is not a symbolic expression we can handle.
       return makeSymExprValNN(state, op, InputLHS, InputRHS, resultTy);
     }
     }
   }
 }
 
if (I == RightFD)
       return SVB.makeTruthVal(!leftFirst, resultTy);
   }
 
   llvm_unreachable("Fields not found in parent record's definition");
 }
 
 // FIXME: all this logic will change if/when we have MemRegion::getLocation().
 SVal SimpleSValBuilder::evalBinOpLL(ProgramStateRef state,
-                                  BinaryOperator::Opcode op,
-                                  Loc lhs, Loc rhs,
+                                    BinaryOperator::Opcode op, Loc lhs, Loc rhs,
                                     QualType resultTy) {
   // Only comparisons and subtractions are valid operations on two pointers.
   // See [C99 6.5.5 through 6.5.14] or [C++0x 5.6 through 5.15].
   // However, if a pointer is casted to an integer, evalBinOpNN may end up
   // calling this function with another operation (PR7527). We don't attempt to
   // model this for now, but it could be useful, particularly when the
   // "location" is actually an integer value that's been passed through a void*.
   if (!(BinaryOperator::isComparisonOp(op) || op == BO_Sub))
     return UnknownVal();
case loc::MemRegionValKind: {
     // FIXME: ObjC object pointers always reside on the heap, but currently
     // we treat their memory space as unknown, because symbolic pointers
     // to ObjC objects may alias. There should be a way to construct
     // possibly-aliasing heap-based regions. For instance, MacOSXApiChecker
     // guesses memory space for ObjC object pointers manually instead of
     // relying on us.
     if (LeftBase != RightBase &&
         ((!isa<SymbolicRegion>(LeftBase) && !isa<SymbolicRegion>(RightBase)) ||
-         (isa<HeapSpaceRegion>(LeftMS) || isa<HeapSpaceRegion>(RightMS))) ){
+         (isa<HeapSpaceRegion>(LeftMS) || isa<HeapSpaceRegion>(RightMS)))) {
       switch (op) {
       default:
         return UnknownVal();
       case BO_EQ:
         return makeTruthVal(false, resultTy);
       case BO_NE:
         return makeTruthVal(true, resultTy);
       }
if (RightER && LeftER) {
         return evalBinOpNN(state, op, *LeftIndex, *RightIndex, resultTy);
       }
     }
 
     // Special handling of the FieldRegions, even with symbolic offsets.
     const FieldRegion *RightFR = dyn_cast<FieldRegion>(RightMR);
     const FieldRegion *LeftFR = dyn_cast<FieldRegion>(LeftMR);
     if (RightFR && LeftFR) {
-      SVal R = evalBinOpFieldRegionFieldRegion(LeftFR, RightFR, op, resultTy,
-                                               *this);
+      SVal R =
+          evalBinOpFieldRegionFieldRegion(LeftFR, RightFR, op, resultTy, *this);
       if (!R.isUnknown())
         return R;
     }
 
     // Compare the regions using the raw offsets.
     RegionOffset LeftOffset = LeftMR->getAsOffset();
     RegionOffset RightOffset = RightMR->getAsOffset();
 
     if (LeftOffset.getRegion() != nullptr &&
         LeftOffset.getRegion() == RightOffset.getRegion() &&
         !LeftOffset.hasSymbolicOffset() && !RightOffset.hasSymbolicOffset()) {
       int64_t left = LeftOffset.getOffset();
       int64_t right = RightOffset.getOffset();
 
       switch (op) {
-        default:
-          return UnknownVal();
-        case BO_LT:
-          return makeTruthVal(left < right, resultTy);
-        case BO_GT:
-          return makeTruthVal(left > right, resultTy);
-        case BO_LE:
-          return makeTruthVal(left <= right, resultTy);
-        case BO_GE:
-          return makeTruthVal(left >= right, resultTy);
-        case BO_EQ:
-          return makeTruthVal(left == right, resultTy);
-        case BO_NE:
-          return makeTruthVal(left != right, resultTy);
       }
     }
 
     // At this point we're not going to get a good answer, but we can try
     // conjuring an expression instead.
     SymbolRef LHSSym = lhs.getAsLocSymbol();
     SymbolRef RHSSym = rhs.getAsLocSymbol();
     if (LHSSym && RHSSym)
       return makeNonLoc(LHSSym, op, RHSSym, resultTy);
 
     // If we get here, we have no way of comparing the regions.
     return UnknownVal();
   }
   }
 }
 
 SVal SimpleSValBuilder::evalBinOpLN(ProgramStateRef state,
-                                  BinaryOperator::Opcode op,
-                                  Loc lhs, NonLoc rhs, QualType resultTy) {
+                                    BinaryOperator::Opcode op, Loc lhs,
+                                    NonLoc rhs, QualType resultTy) {
   if (op >= BO_PtrMemD && op <= BO_PtrMemI) {
     if (auto PTMSV = rhs.getAs<nonloc::PointerToMember>()) {
       if (PTMSV->isNullMemberPointer())
         return UndefinedVal();
       if (const FieldDecl *FD = PTMSV->getDeclAs<FieldDecl>()) {
         SVal Result = lhs;
 
         for (const auto &I : *PTMSV)
           Result = StateMgr.getStoreManager().evalDerivedToBase(
-              Result, I->getType(),I->isVirtual());
+              Result, I->getType(), I->isVirtual());
         return state->getLValue(FD, Result);
       }
     }
 
     return rhs;
   }
 
   assert(!BinaryOperator::isComparisonOp(op) &&
if (Optional<loc::ConcreteInt> lhsInt = lhs.getAs<loc::ConcreteInt>()) {
       rightI = rightI.extOrTrunc(leftI.getBitWidth());
 
       // Offset the increment by the pointer size.
       llvm::APSInt Multiplicand(rightI.getBitWidth(), /* isUnsigned */ true);
       rightI *= Multiplicand;
 
       // Compute the adjusted pointer.
       switch (op) {
-        case BO_Add:
-          rightI = leftI + rightI;
-          break;
-        case BO_Sub:
-          rightI = leftI - rightI;
-          break;
-        default:
-          llvm_unreachable("Invalid pointer arithmetic operation");
       }
       return loc::ConcreteInt(getBasicValueFactory().getValue(rightI));
     }
   }
 
   // Handle cases where 'lhs' is a region.
   if (const MemRegion *region = lhs.getAsRegion()) {
     rhs = convertToArrayIndex(rhs).castAs<NonLoc>();
     SVal index = UnknownVal();
     const SubRegion *superR = nullptr;
     // We need to know the type of the pointer in order to add an integer to it.
     // Depending on the type, different amount of bytes is added.
     QualType elementType;
 
     if (const ElementRegion *elemReg = dyn_cast<ElementRegion>(region)) {
       assert(op == BO_Add || op == BO_Sub);
-      index = evalBinOpNN(state, op, elemReg->getIndex(), rhs,
-                          getArrayIndexType());
+      index =
+          evalBinOpNN(state, op, elemReg->getIndex(), rhs, getArrayIndexType());
       superR = cast<SubRegion>(elemReg->getSuperRegion());
       elementType = elemReg->getElementType();
-    }
-    else if (isa<SubRegion>(region)) {
+    } else if (isa<SubRegion>(region)) {
       assert(op == BO_Add || op == BO_Sub);
       index = (op == BO_Add) ? rhs : evalMinus(rhs);
       superR = cast<SubRegion>(region);
       // TODO: Is this actually reliable? Maybe improving our MemRegion
       // hierarchy to provide typed regions for all non-void pointers would be
       // better. For instance, we cannot extend this towards LocAsInteger
       // operations, where result type of the expression is integer.
       if (resultTy->isAnyPointerType())
         elementType = resultTy->getPointeeType();
     }
 
     if (Optional<NonLoc> indexV = index.getAs<NonLoc>()) {
-      return loc::MemRegionVal(MemMgr.getElementRegion(elementType, *indexV,
-                                                       superR, getContext()));
+      return loc::MemRegionVal(
+          MemMgr.getElementRegion(elementType, *indexV, superR, getContext()));
     }
   }
   return UnknownVal();
 }
 
-const llvm::APSInt *SimpleSValBuilder::getKnownValue(ProgramStateRef state,
+const llvm::APSInt *SimpleSValBuilder::getKnownIntValue(ProgramStateRef state,
                                                      SVal V) {
   if (V.isUnknownOrUndef())
     return nullptr;
 
+  if (V.isFloat()) {
+#ifndef NDEBUG
+    assert(false && "Requesting integer value of floating-point type!");
+#endif
+    return nullptr;
+  }
+
   if (Optional<loc::ConcreteInt> X = V.getAs<loc::ConcreteInt>())
     return &X->getValue();
 
   if (Optional<nonloc::ConcreteInt> X = V.getAs<nonloc::ConcreteInt>())
     return &X->getValue();
 
   if (SymbolRef Sym = V.getAsSymbol())
-    return state->getConstraintManager().getSymVal(state, Sym);
+    return state->getConstraintManager().getSymIntVal(state, Sym);
 
   // FIXME: Add support for SymExprs in RangeConstraintManager.
 
   return nullptr;
 }
 
+const llvm::APFloat *
+SimpleSValBuilder::getKnownFloatValue(ProgramStateRef state, SVal V) {
+  if (V.isUnknownOrUndef())
+    return nullptr;
+
+  if (!V.isFloat()) {
+#ifndef NDEBUG
+    assert(false && "Requesting floating-point value of integer type!");
+#endif
+    return nullptr;
+  }
+
+  if (Optional<nonloc::ConcreteFloat> X = V.getAs<nonloc::ConcreteFloat>())
+    return &X->getValue();
+
+  if (SymbolRef Sym = V.getAsSymbol())
+    return state->getConstraintManager().getSymFloatVal(state, Sym);
+
+  if (Optional<NonLoc> NV = V.getAs<NonLoc>())
+    if (SymbolRef Sym = NV->getAsSymExpr())
+      return state->getConstraintManager().getSymFloatVal(state, Sym);
+
+  return nullptr;
+}
+
 SVal SimpleSValBuilder::simplifySVal(ProgramStateRef State, SVal V) {
   // For now, this function tries to constant-fold symbols inside a
   // nonloc::SymbolVal, and does nothing else. More simplifications should
   // be possible, such as constant-folding an index in an ElementRegion.
 
   class Simplifier : public FullSValVisitor<Simplifier, SVal> {
     ProgramStateRef State;
     SValBuilder &SVB;
 
   public:
     Simplifier(ProgramStateRef State)
         : State(State), SVB(State->getStateManager().getSValBuilder()) {}
 
     SVal VisitSymbolData(const SymbolData *S) {
-      if (const llvm::APSInt *I =
-              SVB.getKnownValue(State, nonloc::SymbolVal(S)))
+      if (!S->getType()->isRealFloatingType()) {
+        const llvm::APSInt *I = SVB.getKnownIntValue(State, nonloc::SymbolVal(S));
+        if (I)
           return Loc::isLocType(S->getType()) ? (SVal)SVB.makeIntLocVal(*I)
                                               : (SVal)SVB.makeIntVal(*I);
+      } else {
+        const llvm::APFloat *F =
+            SVB.getKnownFloatValue(State, nonloc::SymbolVal(S));
+        assert(!Loc::isLocType(S->getType()));
+        if (F)
+          return (SVal)SVB.makeFloatVal(*F);
+      }
       return nonloc::SymbolVal(S);
     }
 
     SVal VisitIntSymExpr(const IntSymExpr *S) {
       SVal RHS = Visit(S->getRHS());
       SVal LHS = SVB.makeIntVal(S->getLHS());
       return SVB.evalBinOp(State, S->getOpcode(), LHS, RHS, S->getType());
     }
SVal VisitSymIntExpr(const SymIntExpr *S) {
         }
         RHS = SVB.makeIntLocVal(S->getRHS());
       } else {
         RHS = SVB.makeIntVal(S->getRHS());
       }
       return SVB.evalBinOp(State, S->getOpcode(), LHS, RHS, S->getType());
     }
 
+    SVal VisitSymFloatExpr(const SymFloatExpr *S) {
+      SVal LHS = Visit(S->getLHS());
+      SVal RHS = SVB.makeFloatVal(S->getRHS());
+      return SVB.evalBinOp(State, S->getOpcode(), LHS, RHS, S->getType());
+    }
+
+    SVal VisitFloatSymExpr(const FloatSymExpr *S) {
+      SVal RHS = Visit(S->getRHS());
+      SVal LHS = SVB.makeFloatVal(S->getLHS());
+      return SVB.evalBinOp(State, S->getOpcode(), LHS, RHS, S->getType());
+    }
+
     SVal VisitSymbolCast(const SymbolCast *S) {
       SVal V = Visit(S->getOperand());
       return SVB.evalCast(V, S->getType(), S->getOperand()->getType());
     }
 
     SVal VisitSymSymExpr(const SymSymExpr *S) {
       SVal LHS = Visit(S->getLHS());
       SVal RHS = Visit(S->getRHS());

lib/StaticAnalyzer/Core/SymbolManager.cpp

if (getLHS().isUnsigned())
     os << 'U';
   os << ' '
      << BinaryOperator::getOpcodeStr(getOpcode())
      << " (";
   getRHS()->dumpToStream(os);
   os << ')';
 }
 
+void SymFloatExpr::dumpToStream(raw_ostream &os) const {
+  SmallString<24> Chars;
+  getRHS().toString(Chars, 0, 0);
+
+  os << '(';
+  getLHS()->dumpToStream(os);
+  os << ") "
+     << BinaryOperator::getOpcodeStr(getOpcode()) << ' '
+     << Chars;
+}
+
+void FloatSymExpr::dumpToStream(raw_ostream &os) const {
+  SmallString<24> Chars;
+  getLHS().toString(Chars, 0, 0);
+
+  os << Chars
+     << ' '
+     << BinaryOperator::getOpcodeStr(getOpcode())
+     << " (";
+  getRHS()->dumpToStream(os);
+  os << ')';
+}
+
 void SymSymExpr::dumpToStream(raw_ostream &os) const {
   os << '(';
   getLHS()->dumpToStream(os);
   os << ") "
      << BinaryOperator::getOpcodeStr(getOpcode())
      << " (";
   getRHS()->dumpToStream(os);
   os << ')';
case SymExpr::SymbolCastKind:
       itr.push_back(cast<SymbolCast>(SE)->getOperand());
       return;
     case SymExpr::SymIntExprKind:
       itr.push_back(cast<SymIntExpr>(SE)->getLHS());
       return;
     case SymExpr::IntSymExprKind:
       itr.push_back(cast<IntSymExpr>(SE)->getRHS());
       return;
+    case SymExpr::SymFloatExprKind:
+      itr.push_back(cast<SymFloatExpr>(SE)->getLHS());
+      return;
+    case SymExpr::FloatSymExprKind:
+      itr.push_back(cast<FloatSymExpr>(SE)->getRHS());
+      return;
     case SymExpr::SymSymExprKind: {
       const SymSymExpr *x = cast<SymSymExpr>(SE);
       itr.push_back(x->getLHS());
       itr.push_back(x->getRHS());
       return;
     }
   }
   llvm_unreachable("unhandled expansion case");
if (!data) {
     data = (IntSymExpr*) BPAlloc.Allocate<IntSymExpr>();
     new (data) IntSymExpr(lhs, op, rhs, t);
     DataSet.InsertNode(data, InsertPos);
   }
 
   return cast<IntSymExpr>(data);
 }
 
+const SymFloatExpr *SymbolManager::getSymFloatExpr(const SymExpr *lhs,
+                                                   BinaryOperator::Opcode op,
+                                                   const llvm::APFloat& v,
+                                                   QualType t) {
+  llvm::FoldingSetNodeID ID;
+  SymFloatExpr::Profile(ID, lhs, op, v, t);
+  void *InsertPos;
+  SymExpr *data = DataSet.FindNodeOrInsertPos(ID, InsertPos);
+
+  if (!data) {
+    data = (SymFloatExpr*) BPAlloc.Allocate<SymFloatExpr>();
+    new (data) SymFloatExpr(lhs, op, v, t);
+    DataSet.InsertNode(data, InsertPos);
+  }
+
+  return cast<SymFloatExpr>(data);
+}
+
+const FloatSymExpr *SymbolManager::getFloatSymExpr(const llvm::APFloat& lhs,
+                                                   BinaryOperator::Opcode op,
+                                                   const SymExpr *rhs,
+                                                   QualType t) {
+  llvm::FoldingSetNodeID ID;
+  FloatSymExpr::Profile(ID, lhs, op, rhs, t);
+  void *InsertPos;
+  SymExpr *data = DataSet.FindNodeOrInsertPos(ID, InsertPos);
+
+  if (!data) {
+    data = (FloatSymExpr*) BPAlloc.Allocate<FloatSymExpr>();
+    new (data) FloatSymExpr(lhs, op, rhs, t);
+    DataSet.InsertNode(data, InsertPos);
+  }
+
+  return cast<FloatSymExpr>(data);
+}
+
 const SymSymExpr *SymbolManager::getSymSymExpr(const SymExpr *lhs,
                                                BinaryOperator::Opcode op,
                                                const SymExpr *rhs,
                                                QualType t) {
   llvm::FoldingSetNodeID ID;
   SymSymExpr::Profile(ID, lhs, op, rhs, t);
   void *InsertPos;
   SymExpr *data = DataSet.FindNodeOrInsertPos(ID, InsertPos);
bool SymbolManager::canSymbolicate(QualType T) {
   T = T.getCanonicalType();
 
   if (Loc::isLocType(T))
     return true;
 
   if (T->isIntegralOrEnumerationType())
     return true;
 
+  if (T->isRealFloatingType())
+    return true;
+
   if (T->isRecordType() && !T->isUnionType())
     return true;
 
   return false;
 }
 
 void SymbolManager::addSymbolDependency(const SymbolRef Primary,
                                         const SymbolRef Dependent) {
if (KnownLive)
       MetadataInUse.erase(sym);
     break;
   case SymExpr::SymIntExprKind:
     KnownLive = isLive(cast<SymIntExpr>(sym)->getLHS());
     break;
   case SymExpr::IntSymExprKind:
     KnownLive = isLive(cast<IntSymExpr>(sym)->getRHS());
     break;
+  case SymExpr::SymFloatExprKind:
+    KnownLive = isLive(cast<SymFloatExpr>(sym)->getLHS());
+    break;
+  case SymExpr::FloatSymExprKind:
+    KnownLive = isLive(cast<FloatSymExpr>(sym)->getRHS());
+    break;
   case SymExpr::SymSymExprKind:
     KnownLive = isLive(cast<SymSymExpr>(sym)->getLHS()) &&
                 isLive(cast<SymSymExpr>(sym)->getRHS());
     break;
   case SymExpr::SymbolCastKind:
     KnownLive = isLive(cast<SymbolCast>(sym)->getOperand());
     break;
   }

lib/StaticAnalyzer/Core/Z3ConstraintManager.cpp

public:
   }
 
   //===------------------------------------------------------------------===//
   // Implementation for interface from ConstraintManager.
   //===------------------------------------------------------------------===//
 
   bool canReasonAbout(SVal X) const override;
 
+  bool canReasonAboutFloats() const override;
+
   ConditionTruthVal checkNull(ProgramStateRef State, SymbolRef Sym) override;
 
-  const llvm::APSInt *getSymVal(ProgramStateRef State,
+  const llvm::APSInt *getSymIntVal(ProgramStateRef State,
+                                   SymbolRef Sym) const override;
+
+  const llvm::APFloat *getSymFloatVal(ProgramStateRef State,
                                       SymbolRef Sym) const override;
 
   ProgramStateRef removeDeadBindings(ProgramStateRef St,
                                      SymbolReaper &SymReaper) override;
 
   void print(ProgramStateRef St, raw_ostream &Out, const char *nl,
              const char *sep) override;
 
   //===------------------------------------------------------------------===//
private:
   Z3Expr getZ3BinExpr(const Z3Expr &LHS, QualType LTy,
                       BinaryOperator::Opcode Op, const Z3Expr &RHS,
                       QualType RTy, QualType *RetTy) const;
 
   //===------------------------------------------------------------------===//
   // Helper functions.
   //===------------------------------------------------------------------===//
 
+  // Recover the QualType of an APFloat.
+  // TODO: Refactor to put elsewhere
+  QualType getAPFloatType(const llvm::APFloat &Float) const;
+
   // Recover the QualType of an APSInt.
   // TODO: Refactor to put elsewhere
   QualType getAPSIntType(const llvm::APSInt &Int) const;
 
   // Fix the input APSInt if it is has a bitwidth of 1, and set the type.
   const llvm::APSInt &fixAPSInt(const llvm::APSInt &Int, llvm::APSInt &NewInt,
                                 QualType *Ty = nullptr) const;
 
private:
   // Perform implicit floating-point type conversion.
   // May modify all input parameters.
   // TODO: Refactor to use Sema::handleFloatConversion()
   template <typename T,
             T(doCast)(const T &, QualType, uint64_t, QualType, uint64_t)>
   void doFloatTypeConversion(T &LHS, QualType &LTy, T &RHS,
                              QualType &RTy) const;
 
+  // Callback function for doCast parameter on APFloat type.
+  static llvm::APFloat castAPFloat(const llvm::APFloat &V, QualType ToTy,
+                                   uint64_t ToWidth, QualType FromTy,
+                                   uint64_t FromWidth);
+
   // Callback function for doCast parameter on APSInt type.
   static llvm::APSInt castAPSInt(const llvm::APSInt &V, QualType ToTy,
                                  uint64_t ToWidth, QualType FromTy,
                                  uint64_t FromWidth);
 }; // end class Z3ConstraintManager
 
 Z3_context Z3Context::ZC;
 
if (isa<SymbolData>(Sym)) {
       break;
     } else if (const SymbolCast *SC = dyn_cast<SymbolCast>(Sym)) {
       Sym = SC->getOperand();
     } else if (const BinarySymExpr *BSE = dyn_cast<BinarySymExpr>(Sym)) {
       if (const SymIntExpr *SIE = dyn_cast<SymIntExpr>(BSE)) {
         Sym = SIE->getLHS();
       } else if (const IntSymExpr *ISE = dyn_cast<IntSymExpr>(BSE)) {
         Sym = ISE->getRHS();
+      } else if (const SymFloatExpr *SFE = dyn_cast<SymFloatExpr>(BSE)) {
+        Sym = SFE->getLHS();
+      } else if (const FloatSymExpr *FSE = dyn_cast<FloatSymExpr>(BSE)) {
+        Sym = FSE->getRHS();
       } else if (const SymSymExpr *SSM = dyn_cast<SymSymExpr>(BSE)) {
         return canReasonAbout(nonloc::SymbolVal(SSM->getLHS())) &&
                canReasonAbout(nonloc::SymbolVal(SSM->getRHS()));
       } else {
         llvm_unreachable("Unsupported binary expression to reason about!");
       }
     } else {
       llvm_unreachable("Unsupported expression to reason about!");
     }
   } while (Sym);
 
   return true;
 }
 
+bool Z3ConstraintManager::canReasonAboutFloats() const { return true; }
+
 ConditionTruthVal Z3ConstraintManager::checkNull(ProgramStateRef State,
                                                  SymbolRef Sym) {
   QualType RetTy;
   // The expression may be casted, so we cannot call getZ3DataExpr() directly
   Z3Expr VarExp = getZ3Expr(Sym, &RetTy);
   Z3Expr Exp = getZ3ZeroExpr(VarExp, RetTy, true);
   // Negate the constraint
   Z3Expr NotExp = getZ3ZeroExpr(VarExp, RetTy, false);
ConditionTruthVal Z3ConstraintManager::checkNull(ProgramStateRef State,
   // Zero is not a solution
   else if (isSat == Z3_L_FALSE && isNotSat == Z3_L_TRUE)
     return false;
 
   // Zero may be a solution
   return ConditionTruthVal();
 }
 
-const llvm::APSInt *Z3ConstraintManager::getSymVal(ProgramStateRef State,
+// TODO: Merge implementation of getSymIntVal() and getSymFloatVal() into one
+// templated function, to avoid weird corner cases when casting back and forth
+const llvm::APSInt *Z3ConstraintManager::getSymIntVal(ProgramStateRef State,
                                                       SymbolRef Sym) const {
   BasicValueFactory &BVF = getBasicVals();
   ASTContext &Ctx = BVF.getContext();
 
   if (const SymbolData *SD = dyn_cast<SymbolData>(Sym)) {
     QualType Ty = Sym->getType();
     assert(!Ty->isRealFloatingType());
     llvm::APSInt Value(Ctx.getTypeSize(Ty),
                        !Ty->isSignedIntegerOrEnumerationType());
if (const SymbolData *SD = dyn_cast<SymbolData>(Sym)) {
     return &BVF.getValue(Value);
   } else if (const SymbolCast *SC = dyn_cast<SymbolCast>(Sym)) {
     SymbolRef CastSym = SC->getOperand();
     QualType CastTy = SC->getType();
     // Skip the void type
     if (CastTy->isVoidType())
       return nullptr;
 
+    // Call the other getSym*Val() function depending on expression type
+    if (CastSym->getType()->isRealFloatingType()) {
+      const llvm::APFloat *Float = getSymFloatVal(State, CastSym);
+      assert(!CastTy->isRealFloatingType());
+      llvm::APSInt Int(Ctx.getTypeSize(CastTy),
+                       !CastTy->isSignedIntegerOrEnumerationType());
+      if (!Float || !BVF.Convert(Int, *Float))
+        return nullptr;
+      return &BVF.getValue(Int);
+    } else {
       const llvm::APSInt *Value;
-    if (!(Value = getSymVal(State, CastSym)))
+      if (!(Value = getSymIntVal(State, CastSym)))
         return nullptr;
-    return &BVF.Convert(SC->getType(), *Value);
+      return &BVF.Convert(CastTy, *Value);
+    }
   } else if (const BinarySymExpr *BSE = dyn_cast<BinarySymExpr>(Sym)) {
+    // Floating-point comparisons produce an integral result
+    if (BinaryOperator::isComparisonOp(BSE->getOpcode()) &&
+        (isa<FloatSymExpr>(BSE) || isa<SymFloatExpr>(BSE) ||
+         (isa<SymSymExpr>(BSE) &&
+          (cast<SymSymExpr>(BSE)->getLHS()->getType()->isFloatingType() ||
+           cast<SymSymExpr>(BSE)->getRHS()->getType()->isFloatingType())))) {
+      const llvm::APFloat *LHS = nullptr, *RHS = nullptr;
+      if (const FloatSymExpr *FSE = dyn_cast<FloatSymExpr>(BSE)) {
+        LHS = &FSE->getLHS();
+        RHS = getSymFloatVal(State, FSE->getRHS());
+      } else if (const SymFloatExpr *SFE = dyn_cast<SymFloatExpr>(BSE)) {
+        LHS = getSymFloatVal(State, SFE->getLHS());
+        RHS = &SFE->getRHS();
+      }
+
+      if (!LHS || !RHS)
+        return nullptr;
+
+      llvm::APFloat ConvertedLHS = *LHS, ConvertedRHS = *RHS;
+      QualType LTy = getAPFloatType(*LHS), RTy = getAPFloatType(*RHS);
+      doFloatTypeConversion<llvm::APFloat, Z3ConstraintManager::castAPFloat>(
+          ConvertedLHS, LTy, ConvertedRHS, RTy);
+      return BVF.evalAPFloatComparison(BSE->getOpcode(), ConvertedLHS,
+                                       ConvertedRHS);
+    }
+
     const llvm::APSInt *LHS, *RHS;
     if (const SymIntExpr *SIE = dyn_cast<SymIntExpr>(BSE)) {
-      LHS = getSymVal(State, SIE->getLHS());
+      LHS = getSymIntVal(State, SIE->getLHS());
       RHS = &SIE->getRHS();
     } else if (const IntSymExpr *ISE = dyn_cast<IntSymExpr>(BSE)) {
       LHS = &ISE->getLHS();
-      RHS = getSymVal(State, ISE->getRHS());
+      RHS = getSymIntVal(State, ISE->getRHS());
     } else if (const SymSymExpr *SSM = dyn_cast<SymSymExpr>(BSE)) {
       // Early termination to avoid expensive call
-      LHS = getSymVal(State, SSM->getLHS());
-      RHS = LHS ? getSymVal(State, SSM->getRHS()) : nullptr;
+      LHS = getSymIntVal(State, SSM->getLHS());
+      RHS = LHS ? getSymIntVal(State, SSM->getRHS()) : nullptr;
     } else {
       llvm_unreachable("Unsupported binary expression to get symbol value!");
     }
 
     if (!LHS || !RHS)
       return nullptr;
 
     llvm::APSInt ConvertedLHS = *LHS, ConvertedRHS = *RHS;
     QualType LTy = getAPSIntType(*LHS), RTy = getAPSIntType(*RHS);
     doIntTypeConversion<llvm::APSInt, Z3ConstraintManager::castAPSInt>(
         ConvertedLHS, LTy, ConvertedRHS, RTy);
     return BVF.evalAPSInt(BSE->getOpcode(), ConvertedLHS, ConvertedRHS);
   }
 
   llvm_unreachable("Unsupported expression to get symbol value!");
 }
 
+const llvm::APFloat *Z3ConstraintManager::getSymFloatVal(ProgramStateRef State,
+                                                         SymbolRef Sym) const {
+  BasicValueFactory &BVF = getBasicVals();
+  ASTContext &Ctx = BVF.getContext();
+
+  if (const SymbolData *SD = dyn_cast<SymbolData>(Sym)) {
+    QualType Ty = Sym->getType();
+    assert(Ty->isRealFloatingType());
+    llvm::APFloat Value(Ctx.getFloatTypeSemantics(Ty));
+
+    Z3Expr Exp = getZ3DataExpr(SD->getSymbolID(), Ty);
+
+    Solver.reset();
+    Solver.addStateConstraints(State);
+
+    // Constraints are unsatisfiable
+    if (Solver.check() != Z3_L_TRUE)
+      return nullptr;
+
+    Z3Model Model = Solver.getModel();
+    // Model does not assign interpretation
+    if (!Model.getInterpretation(Exp, Value))
+      return nullptr;
+
+    // A value has been obtained, check if it is the only value
+    Z3Expr NotExp =
+        Z3Expr::fromFloatBinOp(Exp, BO_NE, Z3Expr::fromAPFloat(Value));
+
+    Solver.addConstraint(NotExp);
+    if (Solver.check() == Z3_L_TRUE)
+      return nullptr;
+
+    // This is the only solution, store it
+    return &BVF.getValue(Value);
+  } else if (const SymbolCast *SC = dyn_cast<SymbolCast>(Sym)) {
+    SymbolRef CastSym = SC->getOperand();
+    QualType CastTy = SC->getType();
+    // Skip the void type
+    if (CastTy->isVoidType())
+      return nullptr;
+
+    // Call the other getSym*Val() function depending on expression type
+    if (!CastSym->getType()->isRealFloatingType()) {
+      const llvm::APSInt *Int = getSymIntVal(State, CastSym);
+      assert(CastTy->isRealFloatingType());
+      llvm::APFloat Float(Ctx.getFloatTypeSemantics(CastTy));
+      if (!Int || !BVF.Convert(Float, *Int))
+        return nullptr;
+      return &BVF.getValue(Float);
+    } else {
+      const llvm::APFloat *Value;
+      if (!(Value = getSymFloatVal(State, CastSym)))
+        return nullptr;
+      return &BVF.Convert(CastTy, *Value);
+    }
+  } else if (const BinarySymExpr *BSE = dyn_cast<BinarySymExpr>(Sym)) {
+    const llvm::APFloat *LHS, *RHS;
+    if (const SymFloatExpr *SIE = dyn_cast<SymFloatExpr>(BSE)) {
+      LHS = getSymFloatVal(State, SIE->getLHS());
+      RHS = &SIE->getRHS();
+    } else if (const FloatSymExpr *ISE = dyn_cast<FloatSymExpr>(BSE)) {
+      LHS = &ISE->getLHS();
+      RHS = getSymFloatVal(State, ISE->getRHS());
+    } else if (const SymSymExpr *SSM = dyn_cast<SymSymExpr>(BSE)) {
+      // Early termination to avoid expensive call
+      LHS = getSymFloatVal(State, SSM->getLHS());
+      RHS = LHS ? getSymFloatVal(State, SSM->getRHS()) : nullptr;
+    } else {
+      llvm_unreachable("Unsupported binary expression to get symbol value!");
+    }
+
+    if (!LHS || !RHS)
+      return nullptr;
+
+    llvm::APFloat ConvertedLHS = *LHS, ConvertedRHS = *RHS;
+    QualType LTy = getAPFloatType(*LHS), RTy = getAPFloatType(*RHS);
+    doFloatTypeConversion<llvm::APFloat, Z3ConstraintManager::castAPFloat>(
+        ConvertedLHS, LTy, ConvertedRHS, RTy);
+    return BVF.evalAPFloat(BSE->getOpcode(), ConvertedLHS, ConvertedRHS);
+  } else {
+    llvm_unreachable("Unsupported expression to get symbol value!");
+  }
+
+  return nullptr;
+}
+
 ProgramStateRef
 Z3ConstraintManager::removeDeadBindings(ProgramStateRef State,
                                         SymbolReaper &SymReaper) {
   ConstraintZ3Ty CZ = State->get<ConstraintZ3>();
   ConstraintZ3Ty::Factory &CZFactory = State->get_context<ConstraintZ3>();
 
   for (ConstraintZ3Ty::iterator I = CZ.begin(), E = CZ.end(); I != E; ++I) {
     if (SymReaper.maybeDead(I->first))
if (const SymIntExpr *SIE = dyn_cast<SymIntExpr>(BSE)) {
     Z3Expr LHS = getZ3SymExpr(SIE->getLHS(), &LTy, hasComparison);
     Z3Expr RHS = Z3Expr::fromAPSInt(fixAPSInt(SIE->getRHS(), NewRInt, &RTy));
     return getZ3BinExpr(LHS, LTy, Op, RHS, RTy, RetTy);
   } else if (const IntSymExpr *ISE = dyn_cast<IntSymExpr>(BSE)) {
     llvm::APSInt NewLInt;
     Z3Expr LHS = Z3Expr::fromAPSInt(fixAPSInt(ISE->getLHS(), NewLInt, &LTy));
     Z3Expr RHS = getZ3SymExpr(ISE->getRHS(), &RTy, hasComparison);
     return getZ3BinExpr(LHS, LTy, Op, RHS, RTy, RetTy);
+  } else if (const SymFloatExpr *SFE = dyn_cast<SymFloatExpr>(BSE)) {
+    RTy = getAPFloatType(SFE->getRHS());
+    Z3Expr LHS = getZ3SymExpr(SFE->getLHS(), &LTy, hasComparison);
+    Z3Expr RHS = Z3Expr::fromAPFloat(SFE->getRHS());
+    return getZ3BinExpr(LHS, LTy, Op, RHS, RTy, RetTy);
+  } else if (const FloatSymExpr *FSE = dyn_cast<FloatSymExpr>(BSE)) {
+    LTy = getAPFloatType(FSE->getLHS());
+    Z3Expr LHS = Z3Expr::fromAPFloat(FSE->getLHS());
+    Z3Expr RHS = getZ3SymExpr(FSE->getRHS(), &RTy, hasComparison);
+    return getZ3BinExpr(LHS, LTy, Op, RHS, RTy, RetTy);
   } else if (const SymSymExpr *SSM = dyn_cast<SymSymExpr>(BSE)) {
     Z3Expr LHS = getZ3SymExpr(SSM->getLHS(), &LTy, hasComparison);
     Z3Expr RHS = getZ3SymExpr(SSM->getRHS(), &RTy, hasComparison);
     return getZ3BinExpr(LHS, LTy, Op, RHS, RTy, RetTy);
   } else {
     llvm_unreachable("Unsupported BinarySymExpr type!");
   }
 }
return LTy->isRealFloatingType()
              : Z3Expr::fromBinOp(NewLHS, Op, NewRHS,
                                  LTy->isSignedIntegerOrEnumerationType());
 }
 
 //===------------------------------------------------------------------===//
 // Helper functions.
 //===------------------------------------------------------------------===//
 
+QualType Z3ConstraintManager::getAPFloatType(const llvm::APFloat &Float) const {
+  ASTContext &Ctx = getBasicVals().getContext();
+  return Ctx.getRealTypeForBitwidth(
+      llvm::APFloat::getSizeInBits(Float.getSemantics()));
+}
+
 QualType Z3ConstraintManager::getAPSIntType(const llvm::APSInt &Int) const {
   ASTContext &Ctx = getBasicVals().getContext();
   return Ctx.getIntTypeForBitwidth(Int.getBitWidth(), Int.isSigned());
 }
 
 const llvm::APSInt &Z3ConstraintManager::fixAPSInt(const llvm::APSInt &Int,
                                                    llvm::APSInt &NewInt,
                                                    QualType *Ty) const {
void Z3ConstraintManager::doFloatTypeConversion(T &LHS, QualType &LTy, T &RHS,
   if (LTy == RTy)
     return;
 
   // If we have two real floating types, convert the smaller operand to the
   // bigger result
   // Note: Safe to skip updating bitwidth because this must terminate
   int order = Ctx.getFloatingTypeOrder(LTy, RTy);
   if (order > 0) {
-    RHS = Z3Expr::fromCast(RHS, LTy, LBitWidth, RTy, RBitWidth);
+    RHS = (*doCast)(RHS, LTy, LBitWidth, RTy, RBitWidth);
     RTy = LTy;
   } else if (order == 0) {
-    LHS = Z3Expr::fromCast(LHS, RTy, RBitWidth, LTy, LBitWidth);
+    LHS = (*doCast)(LHS, RTy, RBitWidth, LTy, LBitWidth);
     LTy = RTy;
   } else {
     llvm_unreachable("Unsupported floating-point type cast!");
   }
 }
 
+llvm::APFloat Z3ConstraintManager::castAPFloat(const llvm::APFloat &V,
+                                               QualType ToTy, uint64_t ToWidth,
+                                               QualType FromTy,
+                                               uint64_t FromWidth) {
+  bool lossOfPrecision;
+  llvm::APFloat To = V;
+  bool isOk =
+      !(To.convert(Z3Expr::getFloatSemantics(ToWidth),
+                   llvm::APFloat::rmNearestTiesToEven, &lossOfPrecision) &
+        (llvm::APFloat::opOverflow | llvm::APFloat::opInvalidOp));
+  assert(isOk && "Failed to convert integer to floating-point!");
+  (void)isOk;
+  return To;
+}
+
 llvm::APSInt Z3ConstraintManager::castAPSInt(const llvm::APSInt &V,
                                              QualType ToTy, uint64_t ToWidth,
                                              QualType FromTy,
                                              uint64_t FromWidth) {
   APSIntType TargetType(ToWidth, !ToTy->isSignedIntegerOrEnumerationType());
   return TargetType.convert(V);
 }
 

test/Analysis/diagnostics/macros.cpp

if (p == nullptr) { // expected-note {{Assuming pointer value is null}}
                       // expected-note@-1 {{Taking true branch}}
     *p = 7;  // expected-warning {{Dereference of null pointer (loaded from variable 'p')}}
              // expected-note@-1 {{Dereference of null pointer (loaded from variable 'p')}}
   }
 }
 
 // There are no path notes on the comparison to float types.
 void testDoubleMacro(double d) {
+#ifdef ANALYZER_CM_Z3
+  if (d == DBL_MAX) { // expected-note {{Assuming 'd' is equal to DBL_MAX}}
+                      // expected-note@-1 {{Taking true branch}}
+#else
   if (d == DBL_MAX) { // expected-note {{Taking true branch}}
-
+#endif
     char *p = NULL; // expected-note {{'p' initialized to a null pointer value}}
     *p = 7;         // expected-warning {{Dereference of null pointer (loaded from variable 'p')}}
                     // expected-note@-1 {{Dereference of null pointer (loaded from variable 'p')}}
   }
 }
 
 void testboolMacro(bool b, int *p) {
   p = nullptr;      // expected-note {{Null pointer value stored to 'p'}}
   if (b == false) { // expected-note {{Assuming the condition is true}}
                     // expected-note@-1 {{Taking true branch}}
     *p = 7;         // expected-warning {{Dereference of null pointer (loaded from variable 'p')}}
                     // expected-note@-1 {{Dereference of null pointer (loaded from variable 'p')}}
   }
 }

test/Analysis/float-rules.c

+// RUN: %clang_analyze_cc1 -analyzer-checker=core.builtin,alpha.core.FPMath,debug.ExprInspection -verify %s
+// REQUIRES: z3
+
+double acos(double x);
+double asin(double x);
+double acosh(double x);
+double atanh(double x);
+double log(double x);
+double log2(double x);
+double log10(double x);
+double log1p(double x);
+double logb(double x);
+double sqrt(double x);
+double fmod(double x, double y);
+double remainder(double x, double y);
+
+double domain1() {
+  double nan = __builtin_nan("");
+  double z = 0.0;
+
+  // -1 <= x <= 1
+  z = acos(-5.0);  // expected-warning{{Argument value is out of valid domain [-1, 1] for function call to acos}}
+  z = acos(5.0);  //expected-warning{{Argument value is out of valid domain [-1, 1] for function call to acos}}
+  z = acos(0.0);  // no-warning
+  z = acos(nan);  // no-warning
+  z = asin(-5.0);  // expected-warning{{Argument value is out of valid domain [-1, 1] for function call to asin}}
+  z = asin(5.0);  // expected-warning{{Argument value is out of valid domain [-1, 1] for function call to asin}}
+  z = asin(0.0);  // no-warning
+  z = asin(nan);  // no-warning
+
+  // x >= 1
+  z = acosh(-5.0);  // expected-warning{{Argument value is out of valid domain [1, inf) for function call to acosh}}
+  z = acosh(-1.0);  // expected-warning{{Argument value is out of valid domain [1, inf) for function call to acosh}}
+  z = acosh(0.0);  // expected-warning{{Argument value is out of valid domain [1, inf) for function call to acosh}}
+  z = acosh(1.0);  // no-warning
+  z = acosh(nan);  // no-warning
+
+  // -1 < x < 1
+  z = atanh(-1.0);  // expected-warning{{Argument value is out of valid domain (-1, 1) for function call to atanh}}
+  z = atanh(1.0);  // expected-warning{{Argument value is out of valid domain (-1, 1) for function call to atanh}}
+  z = atanh(0.0);  // no-warning
+  z = atanh(nan);  // no-warning
+
+  // x >= 0
+  z = log(-1.0);  // expected-warning{{Argument value is out of valid domain [0, inf) for function call to log}}
+  z = log(-0.5);  // expected-warning{{Argument value is out of valid domain [0, inf) for function call to log}}
+  z = log(0.0);  // no-warning
+  z = log(nan);  // no-warning
+  z = log2(-1.0);  // expected-warning{{Argument value is out of valid domain [0, inf) for function call to log2}}
+  z = log2(-0.5);  // expected-warning{{Argument value is out of valid domain [0, inf) for function call to log2}}
+  z = log2(0.0);  // no-warning
+  z = log2(nan);  // no-warning
+  z = log10(-1.0);  // expected-warning{{Argument value is out of valid domain [0, inf) for function call to log10}}
+  z = log10(-0.5);  // expected-warning{{Argument value is out of valid domain [0, inf) for function call to log10}}
+  z = log10(0.0);  // no-warning
+  z = log10(nan);  // no-warning
+  z = sqrt(-1.0);  // expected-warning{{Argument value is out of valid domain [0, inf) for function call to sqrt}}
+  z = sqrt(-0.5);  // expected-warning{{Argument value is out of valid domain [0, inf) for function call to sqrt}}
+  z = sqrt(0.0);  // no-warning
+  z = sqrt(nan);  // no-warning
+
+  // x >= -1
+  z = log1p(-5.0);  // expected-warning{{Argument value is out of valid domain [-1, inf) for function call to log1p}}
+  z = log1p(-1.0);  // no-warning
+  z = log1p(0.0);  // no-warning
+  z = log1p(nan);  // no-warning
+
+  // x != 0
+  z = logb(0.0);  // expected-warning{{Argument value is out of valid domain (-inf, 0) U (0, inf) for function call to logb}}
+  z = logb(-1.0);  // no-warning
+  z = logb(1.0);  // no-warning
+  z = logb(nan);  // no-warning
+
+  return z;
+}
+
+double domain2(double x) {
+  double nan = __builtin_nan("");
+  double z = 0.0;
+
+  // y != 0
+  z = fmod(x, 0.0);  // expected-warning{{Argument value is out of valid domain (-inf, 0) U (0, inf) for function call to fmod}}
+  z = fmod(x, 1.0);  // no-warning
+  z = fmod(x, -1.0);  // no-warning
+  z = fmod(x, nan);  // no-warning
+  z = remainder(x, 0.0);  // expected-warning{{Argument value is out of valid domain (-inf, 0) U (0, inf) for function call to remainder}}
+  z = remainder(x, 1.0);  // no-warning
+  z = remainder(x, -1.0);  // no-warning
+  z = remainder(x, nan);  // no-warning
+
+  return z;
+}
+
+double domain3(double x) {
+  double z = 0.0;
+
+  if (__builtin_isnan(x) || x < 0)
+    return z;
+
+  z = acosh(x);  // expected-warning{{Argument value is out of valid domain [1, inf) for function call to acosh}}
+  z = asin(x);  // expected-warning{{Argument value is out of valid domain [-1, 1] for function call to asin}}
+  z = logb(x);  // expected-warning{{Argument value is out of valid domain (-inf, 0) U (0, inf) for function call to logb}}
+  z = log1p(x);  // no-warning
+  z = log(x);  // no-warning
+
+  return z;
+}

test/Analysis/float.c

+// RUN: %clang_analyze_cc1 -analyzer-checker=core.builtin,debug.ExprInspection -verify %s
+// REQUIRES: z3
+
+void clang_analyzer_eval(int);
+
+void float1() {
+  float z1 = 0.0, z2 = -0.0;
+  clang_analyzer_eval(z1 == z2); // expected-warning{{TRUE}}
+}
+
+void float2(float a, float b) {
+  clang_analyzer_eval(a == b); // expected-warning{{UNKNOWN}}
+  clang_analyzer_eval(a != b); // expected-warning{{UNKNOWN}}
+}
+
+void float3(float a, float b) {
+  if (__builtin_isnan(a) || __builtin_isnan(b) || a < b) {
+    clang_analyzer_eval(a > b); // expected-warning{{FALSE}}
+    clang_analyzer_eval(a == b); // expected-warning{{FALSE}}
+    return;
+  }
+  clang_analyzer_eval(a >= b); // expected-warning{{TRUE}}
+  clang_analyzer_eval(a == b); // expected-warning{{UNKNOWN}}
+}
+
+void float4(float a) {
+  if (__builtin_isnan(a) || a < 0.0f)
+    return;
+  clang_analyzer_eval(a >= 0.0Q); // expected-warning{{TRUE}}
+  clang_analyzer_eval(a >= 0.0F); // expected-warning{{TRUE}}
+  clang_analyzer_eval(a >= 0.0); // expected-warning{{TRUE}}
+  clang_analyzer_eval(a >= 0); // expected-warning{{TRUE}}
+}
+
+void float5() {
+  double value = 1.0;
+  double pinf = __builtin_inf();
+  double ninf = -__builtin_inf();
+  double nan = __builtin_nan("");
+
+  /* NaN */
+  clang_analyzer_eval(__builtin_isnan(value)); // expected-warning{{FALSE}}
+  clang_analyzer_eval(__builtin_isnan(nan)); // expected-warning{{TRUE}}
+
+  clang_analyzer_eval(__builtin_isnan(0.0 / 0.0)); // expected-warning{{TRUE}}
+  clang_analyzer_eval(__builtin_isnan(pinf / ninf)); // expected-warning{{TRUE}}
+  clang_analyzer_eval(__builtin_isnan(pinf / pinf)); // expected-warning{{TRUE}}
+  clang_analyzer_eval(__builtin_isnan(ninf / pinf)); // expected-warning{{TRUE}}
+  clang_analyzer_eval(__builtin_isnan(ninf / ninf)); // expected-warning{{TRUE}}
+
+  clang_analyzer_eval(__builtin_isnan(0.0 * ninf)); // expected-warning{{TRUE}}
+  clang_analyzer_eval(__builtin_isnan(0.0 * pinf)); // expected-warning{{TRUE}}
+  clang_analyzer_eval(__builtin_isnan(ninf * 0.0)); // expected-warning{{TRUE}}
+  clang_analyzer_eval(__builtin_isnan(pinf * 0.0)); // expected-warning{{TRUE}}
+
+  clang_analyzer_eval(__builtin_isnan(nan + value)); // expected-warning{{TRUE}}
+  clang_analyzer_eval(__builtin_isnan(value - nan)); // expected-warning{{TRUE}}
+  clang_analyzer_eval(__builtin_isnan(nan * value)); // expected-warning{{TRUE}}
+  clang_analyzer_eval(__builtin_isnan(value / nan)); // expected-warning{{TRUE}}
+
+  /* Infinity */
+  clang_analyzer_eval(__builtin_isinf(value)); // expected-warning{{FALSE}}
+  clang_analyzer_eval(__builtin_isinf(pinf)); // expected-warning{{TRUE}}
+  clang_analyzer_eval(__builtin_isinf(ninf)); // expected-warning{{TRUE}}
+  clang_analyzer_eval(__builtin_isinf(value / 0.0)); // expected-warning{{TRUE}}
+  clang_analyzer_eval(__builtin_isinf(pinf / 0.0)); // expected-warning{{TRUE}}
+  clang_analyzer_eval(__builtin_isinf(ninf / 0.0)); // expected-warning{{TRUE}}
+  clang_analyzer_eval(value / pinf == 0.0); // expected-warning{{TRUE}}
+  clang_analyzer_eval(value / ninf == 0.0); // expected-warning{{TRUE}}
+
+  /* Zero */
+  clang_analyzer_eval(0.0 == -0.0); // expected-warning{{TRUE}}
+}
+
+void float6(float a, float b) {
+  clang_analyzer_eval(a != 4.0 || a == 4.0); // expected-warning{{UNKNOWN}}
+  clang_analyzer_eval(a < 4.0 || a >= 4.0); // expected-warning{{UNKNOWN}}
+  clang_analyzer_eval((a != b) == !(a == b)); // expected-warning{{UNKNOWN}}
+  clang_analyzer_eval((a != 4.0) == !(a == 4.0)); // expected-warning{{UNKNOWN}}
+}
+
+void mixed() {
+  clang_analyzer_eval(0.0 * 0 == 0.0); // expected-warning{{TRUE}}
+  clang_analyzer_eval(1.0 * 0 == 0.0); // expected-warning{{TRUE}}
+  clang_analyzer_eval(1.0 * 1 == 1.0); // expected-warning{{TRUE}}
+  clang_analyzer_eval((5 * 5) * 1.0 == 25); // expected-warning{{TRUE}}
+}
+
+void nan1(double a) {
+  if (a == a)
+    return;
+  clang_analyzer_eval(__builtin_isnan(a)); // expected-warning{{TRUE}}
+}

test/Analysis/inline.cpp

namespace DefaultArgs {
   double defaultFloatReference(const double &i = 42) {
     return -i;
   }
   double defaultFloatReferenceZero(const double &i = 0) {
     return -i;
   }
 
   void testFloatReference() {
-    clang_analyzer_eval(defaultFloatReference(1) == -1); // expected-warning{{UNKNOWN}}
-    clang_analyzer_eval(defaultFloatReference() == -42); // expected-warning{{UNKNOWN}}
+    clang_analyzer_eval(defaultFloatReference(1) == -1); // expected-warning{{TRUE}}
+    clang_analyzer_eval(defaultFloatReference() == -42); // expected-warning{{TRUE}}
 
-    clang_analyzer_eval(defaultFloatReferenceZero(1) == -1); // expected-warning{{UNKNOWN}}
-    clang_analyzer_eval(defaultFloatReferenceZero() == 0); // expected-warning{{UNKNOWN}}
+    clang_analyzer_eval(defaultFloatReferenceZero(1) == -1); // expected-warning{{TRUE}}
+    clang_analyzer_eval(defaultFloatReferenceZero() == 0); // expected-warning{{TRUE}}
   }
 
   char defaultString(const char *s = "abc") {
     return s[1];
   }
 
   void testString() {
     clang_analyzer_eval(defaultString("xyz") == 'y'); // expected-warning{{TRUE}}

test/Analysis/operator-calls.cpp

LargeOpaque getLargeOpaque() {
     LargeOpaque obj = LargeOpaque();
     obj.x[0] = 1.0;
     return obj;
   }
 
   void test(int coin) {
     // Force a cache-out when we try to conjure a temporary region for the operator call.
     // ...then, don't crash.
-    clang_analyzer_eval(+(coin ? getSmallOpaque() : getSmallOpaque())); // expected-warning{{UNKNOWN}}
-    clang_analyzer_eval(+(coin ? getLargeOpaque() : getLargeOpaque())); // expected-warning{{UNKNOWN}}
+    clang_analyzer_eval(+(coin ? getSmallOpaque() : getSmallOpaque())); // expected-warning{{TRUE}}
+    clang_analyzer_eval(+(coin ? getLargeOpaque() : getLargeOpaque())); // expected-warning{{TRUE}}
   }
 }
 
 namespace SynthesizedAssignment {
   struct A {
     int a;
     A& operator=(A& other) { a = -other.a; return *this; }
     A& operator=(A&& other) { a = other.a+1; return *this; }