[analyzer] Fix some checker's output plist not containing the checker name

[xazax.hun]

Summary

Unfortunately, currently, the analyzer core sets the checker name after the constructor was already run. So if we set the BugType in the constructor, the output plist will not contain a checker name. Right now the idiomatic solution is to create the BugType lazily. This patch updates the some checkers to follow this idiom. I also found some bugs, when some checkers were triggered even if they were not enabled or wrong checker name is emitted to the plist.

In the future probably it would be better to alter the signature of the checkers' constructor to set the name in the constructor so it is possible to create the BugType eagerly.

[NoQ]

Cool. Thanks!

In the future probably it would be better to alter the signature of the checkers' constructor to set the name in the constructor so it is possible to create the BugType eagerly.

Still, should we add an assertion so that we could be sure that every bug type contains a checker name?

[xazax.hun]

• Fix more checkers
• Minor style fixes along the way
• Added an assert to prevent such errors in the future

[xazax.hun]

In D37437#860311, @NoQ wrote:

Cool. Thanks!

In the future probably it would be better to alter the signature of the checkers' constructor to set the name in the constructor so it is possible to create the BugType eagerly.

Still, should we add an assertion so that we could be sure that every bug type contains a checker name?

Sure! I added the assert and discovered lots of other checks that had the same problem. I also discovered some other bugs, e.g.: when a checker was emitting diagnostic even without being turned on or the wrong name is emitted to the plist.

test/Analysis/malloc.c

1723

This test is deleted because the corresponding checker is not even turned on for this file and this warning should not be emitted at all. Emitting this warning with the settings above was a bug.

[xazax.hun]

Ping.

[zaks.anna]

Looks like the need to have the checker name in BugType along with the checker names not being initialized early enough, leads to worse checker-writer experience. Is there a way to ensure that the checker names are set at construction?

lib/StaticAnalyzer/Checkers/BlockInCriticalSectionChecker.cpp

131–137

nit: I prefer to use '{' here since the if body spans multiple lines.

lib/StaticAnalyzer/Checkers/CStringChecker.cpp

308

This seems to be related to the change in the test, correct? In the future, please, split changes like this one into their own separate commits.

[xazax.hun]

• Address review comments.

[xazax.hun]

lib/StaticAnalyzer/Checkers/CStringChecker.cpp

308

Yes. I will do so in the future, thanks.

[zaks.anna]

Just to be clear, since this leads to regression to the checker API, I am asking to look into other ways of solving this problem. For example, is there a way to ensure that the checker names are set at construction?

[xazax.hun]

In D37437#909537, @zaks.anna wrote:

Just to be clear, since this leads to regression to the checker API, I am asking to look into other ways of solving this problem. For example, is there a way to ensure that the checker names are set at construction?

Checkers are instantiated here: https://github.com/llvm-mirror/clang/blob/master/include/clang/StaticAnalyzer/Core/CheckerManager.h#L142
Checkers are created using the default constructor. After the constructor was run we set the name. If we want the checkers to be able to create the BugType with the correct name in the constructor (and not using mutable fields for the BugTypes), we need to add a new constructor parameter to CheckerBase and all the Checkers will need to forward a CheckerName to their base classes. So we need to break the API for every checkers basically. But if you prefer that solution I can rewrite this patch.

[xazax.hun]

@dcoughlin do you have some input on this?

[xazax.hun]

In case you do not like this solution, I uploaded an alternative approach: https://reviews.llvm.org/D41538

[xazax.hun]

https://reviews.llvm.org/D41538 is superior and committed.

include/clang/StaticAnalyzer/Core/BugReporter/BugType.h

 class ExplodedNode;
 class ExprEngine;
 
 class BugType {
 private:
   const CheckName Check;
   const std::string Name;
   const std::string Category;
-  bool SuppressonSink;
+  bool SuppressOnSink;
 
   virtual void anchor();
 public:
-  BugType(class CheckName check, StringRef name, StringRef cat)
-      : Check(check), Name(name), Category(cat), SuppressonSink(false) {}
-  BugType(const CheckerBase *checker, StringRef name, StringRef cat)
-      : Check(checker->getCheckName()), Name(name), Category(cat),
-        SuppressonSink(false) {}
+  BugType(class CheckName Check, StringRef Name, StringRef Cat)
+      : Check(Check), Name(Name), Category(Cat), SuppressOnSink(false) {
+    assert(!getCheckName().empty() && "Check name is not set properly.");
+  }
+  BugType(const CheckerBase *Checker, StringRef Name, StringRef Cat)
+      : Check(Checker->getCheckName()), Name(Name), Category(Cat),
+        SuppressOnSink(false) {
+    assert(!getCheckName().empty() && "Check name is not set properly.");
+  }
   virtual ~BugType() {}
 
   // FIXME: Should these be made strings as well?
   StringRef getName() const { return Name; }
   StringRef getCategory() const { return Category; }
   StringRef getCheckName() const { return Check.getName(); }
 
   /// isSuppressOnSink - Returns true if bug reports associated with this bug
   ///  type should be suppressed if the end node of the report is post-dominated
   ///  by a sink node.
-  bool isSuppressOnSink() const { return SuppressonSink; }
-  void setSuppressOnSink(bool x) { SuppressonSink = x; }
+  bool isSuppressOnSink() const { return SuppressOnSink; }
+  void setSuppressOnSink(bool x) { SuppressOnSink = x; }
 
   virtual void FlushReports(BugReporter& BR);
 };
 
 class BuiltinBug : public BugType {
   const std::string desc;
   void anchor() override;
 public:
   BuiltinBug(class CheckName check, const char *name, const char *description)
       : BugType(check, name, categories::LogicError), desc(description) {}
 
   BuiltinBug(const CheckerBase *checker, const char *name,
              const char *description)
       : BugType(checker, name, categories::LogicError), desc(description) {}
 
   BuiltinBug(const CheckerBase *checker, const char *name)
       : BugType(checker, name, categories::LogicError), desc(name) {}
 
   StringRef getDescription() const { return desc; }
 };
 
-} // end GR namespace
+} // end ento namespace
 
 } // end clang namespace
 #endif

lib/StaticAnalyzer/Checkers/BlockInCriticalSectionChecker.cpp

 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 
 using namespace clang;
 using namespace ento;
 
 namespace {
 
-class BlockInCriticalSectionChecker : public Checker<check::PostCall,
-                                                     check::PreCall> {
+class BlockInCriticalSectionChecker : public Checker<check::PostCall> {
 
   CallDescription LockFn, UnlockFn, SleepFn, GetcFn, FgetsFn, ReadFn, RecvFn,
                   PthreadLockFn, PthreadTryLockFn, PthreadUnlockFn,
                   MtxLock, MtxTimedLock, MtxTryLock, MtxUnlock;
 
-  std::unique_ptr<BugType> BlockInCritSectionBugType;
+  mutable std::unique_ptr<BugType> BlockInCritSectionBugType;
 
   void reportBlockInCritSection(SymbolRef FileDescSym,
                                 const CallEvent &call,
                                 CheckerContext &C) const;
 
 public:
   BlockInCriticalSectionChecker();
 
   bool isBlockingFunction(const CallEvent &Call) const;
   bool isLockFunction(const CallEvent &Call) const;
   bool isUnlockFunction(const CallEvent &Call) const;
 
-  void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
-
   /// Process unlock.
   /// Process lock.
   /// Process blocking functions (sleep, getc, fgets, read, recv)
   void checkPostCall(const CallEvent &Call, CheckerContext &C) const;
 
 };
 
 } // end anonymous namespace
 
 REGISTER_TRAIT_WITH_PROGRAMSTATE(MutexCounter, unsigned)
 
 BlockInCriticalSectionChecker::BlockInCriticalSectionChecker()
     : LockFn("lock"), UnlockFn("unlock"), SleepFn("sleep"), GetcFn("getc"),
       FgetsFn("fgets"), ReadFn("read"), RecvFn("recv"),
       PthreadLockFn("pthread_mutex_lock"),
       PthreadTryLockFn("pthread_mutex_trylock"),
-      PthreadUnlockFn("pthread_mutex_unlock"),
-      MtxLock("mtx_lock"),
-      MtxTimedLock("mtx_timedlock"),
-      MtxTryLock("mtx_trylock"),
-      MtxUnlock("mtx_unlock") {
-  // Initialize the bug type.
-  BlockInCritSectionBugType.reset(
-      new BugType(this, "Call to blocking function in critical section",
-                        "Blocking Error"));
-}
+      PthreadUnlockFn("pthread_mutex_unlock"), MtxLock("mtx_lock"),
+      MtxTimedLock("mtx_timedlock"), MtxTryLock("mtx_trylock"),
+      MtxUnlock("mtx_unlock") {}
 
 bool BlockInCriticalSectionChecker::isBlockingFunction(const CallEvent &Call) const {
   if (Call.isCalled(SleepFn)
       || Call.isCalled(GetcFn)
       || Call.isCalled(FgetsFn)
       || Call.isCalled(ReadFn)
       || Call.isCalled(RecvFn)) {
     return true;
bool BlockInCriticalSectionChecker::isUnlockFunction(const CallEvent &Call) const {
   if (Call.isCalled(UnlockFn)
        || Call.isCalled(PthreadUnlockFn)
        || Call.isCalled(MtxUnlock)) {
     return true;
   }
   return false;
 }
 
-void BlockInCriticalSectionChecker::checkPreCall(const CallEvent &Call,
-                                                 CheckerContext &C) const {
-}
-
 void BlockInCriticalSectionChecker::checkPostCall(const CallEvent &Call,
                                                   CheckerContext &C) const {
   if (!isBlockingFunction(Call)
       && !isLockFunction(Call)
       && !isUnlockFunction(Call))
     return;
 
   ProgramStateRef State = C.getState();
void BlockInCriticalSectionChecker::reportBlockInCritSection(
   ExplodedNode *ErrNode = C.generateNonFatalErrorNode();
   if (!ErrNode)
     return;
 
   std::string msg;
   llvm::raw_string_ostream os(msg);
   os << "Call to blocking function '" << Call.getCalleeIdentifier()->getName()
      << "' inside of critical section";
-  auto R = llvm::make_unique<BugReport>(*BlockInCritSectionBugType, os.str(), ErrNode);
+  if (!BlockInCritSectionBugType) {
+    BlockInCritSectionBugType.reset(
+        new BugType(this, "Call to blocking function in critical section",
+                    "Blocking Error"));
+  }
+  auto R = llvm::make_unique<BugReport>(*BlockInCritSectionBugType, os.str(),
+                                        ErrNode);
   R->addRange(Call.getSourceRange());
   R->markInteresting(BlockDescSym);
   C.emitReport(std::move(R));
 }
 
 void ento::registerBlockInCriticalSectionChecker(CheckerManager &mgr) {
   mgr.registerChecker<BlockInCriticalSectionChecker>();
 }

lib/StaticAnalyzer/Checkers/CStringChecker.cpp

ProgramStateRef CStringChecker::CheckLocation(CheckerContext &C,
   DefinedOrUnknownSVal Size = Extent.castAs<DefinedOrUnknownSVal>();
 
   // Get the index of the accessed element.
   DefinedOrUnknownSVal Idx = ER->getIndex().castAs<DefinedOrUnknownSVal>();
 
   ProgramStateRef StInBound = state->assumeInBound(Idx, Size, true);
   ProgramStateRef StOutBound = state->assumeInBound(Idx, Size, false);
   if (StOutBound && !StInBound) {
+    if (!Filter.CheckCStringOutOfBounds)
+      return state;
+
     ExplodedNode *N = C.generateErrorNode(StOutBound);
     if (!N)
       return nullptr;
 
     if (!BT_Bounds) {
       BT_Bounds.reset(new BuiltinBug(
           Filter.CheckNameCStringOutOfBounds, "Out-of-bound array access",
           "Byte string function accesses out-of-bound array element"));

lib/StaticAnalyzer/Checkers/CheckObjCDealloc.cpp

: public Checker<check::ASTDecl<ObjCImplementationDecl>,
                      check::PointerEscape,
                      check::PreStmt<ReturnStmt>> {
 
   mutable IdentifierInfo *NSObjectII, *SenTestCaseII, *XCTestCaseII,
       *Block_releaseII, *CIFilterII;
 
   mutable Selector DeallocSel, ReleaseSel;
 
-  std::unique_ptr<BugType> MissingReleaseBugType;
-  std::unique_ptr<BugType> ExtraReleaseBugType;
-  std::unique_ptr<BugType> MistakenDeallocBugType;
+  mutable std::unique_ptr<BugType> MissingReleaseBugType;
+  mutable std::unique_ptr<BugType> ExtraReleaseBugType;
+  mutable std::unique_ptr<BugType> MistakenDeallocBugType;
 
 public:
   ObjCDeallocChecker();
 
   void checkASTDecl(const ObjCImplementationDecl *D, AnalysisManager& Mgr,
                     BugReporter &BR) const;
   void checkBeginFunction(CheckerContext &Ctx) const;
   void checkPreObjCMessage(const ObjCMethodCall &M, CheckerContext &C) const;
for (auto *IvarSymbol : *OldUnreleased) {
     if (PropDecl->getSetterKind() == ObjCPropertyDecl::Retain)
       OS << "retained";
     else
       OS << "copied";
 
     OS << " by a synthesized property but not released"
           " before '[super dealloc]'";
 
+    if (!MissingReleaseBugType)
+      MissingReleaseBugType.reset(
+          new BugType(this, "Missing ivar release (leak)",
+                      categories::MemoryCoreFoundationObjectiveC));
+
     std::unique_ptr<BugReport> BR(
         new BugReport(*MissingReleaseBugType, OS.str(), ErrNode));
 
     C.emitReport(std::move(BR));
   }
 
   if (NewUnreleased.isEmpty()) {
     State = State->remove<UnreleasedIvarMap>(SelfSym);
if (isReleasedByCIFilterDealloc(PropImpl)) {
     if (PropDecl->getSetterKind() == ObjCPropertyDecl::Weak)
       OS << "a weak";
     else
       OS << "an assign, readwrite";
 
     OS <<  " property but was released in 'dealloc'";
   }
 
+  if (!ExtraReleaseBugType)
+    ExtraReleaseBugType.reset(
+        new BugType(this, "Extra ivar release",
+                    categories::MemoryCoreFoundationObjectiveC));
+
   std::unique_ptr<BugReport> BR(
       new BugReport(*ExtraReleaseBugType, OS.str(), ErrNode));
   BR->addRange(M.getOriginExpr()->getSourceRange());
 
   C.emitReport(std::move(BR));
 
   return true;
 }
if (!ErrNode)
     return false;
 
   std::string Buf;
   llvm::raw_string_ostream OS(Buf);
 
   OS << "'" << *PropImpl->getPropertyIvarDecl()
      << "' should be released rather than deallocated";
 
+  if (!MistakenDeallocBugType)
+    MistakenDeallocBugType.reset(new BugType(
+        this, "Mistaken dealloc", categories::MemoryCoreFoundationObjectiveC));
+
   std::unique_ptr<BugReport> BR(
       new BugReport(*MistakenDeallocBugType, OS.str(), ErrNode));
   BR->addRange(M.getOriginExpr()->getSourceRange());
 
   C.emitReport(std::move(BR));
 
   return true;
 }
 
 ObjCDeallocChecker::ObjCDeallocChecker()
     : NSObjectII(nullptr), SenTestCaseII(nullptr), XCTestCaseII(nullptr),
-      CIFilterII(nullptr) {
-
-  MissingReleaseBugType.reset(
-      new BugType(this, "Missing ivar release (leak)",
-                  categories::MemoryCoreFoundationObjectiveC));
-
-  ExtraReleaseBugType.reset(
-      new BugType(this, "Extra ivar release",
-                  categories::MemoryCoreFoundationObjectiveC));
-
-  MistakenDeallocBugType.reset(
-      new BugType(this, "Mistaken dealloc",
-                  categories::MemoryCoreFoundationObjectiveC));
-}
+      CIFilterII(nullptr) {}
 
 void ObjCDeallocChecker::initIdentifierInfoAndSelectors(
     ASTContext &Ctx) const {
   if (NSObjectII)
     return;
 
   NSObjectII = &Ctx.Idents.get("NSObject");
   SenTestCaseII = &Ctx.Idents.get("SenTestCase");

lib/StaticAnalyzer/Checkers/IteratorChecker.cpp

 };
 
 class IteratorChecker
     : public Checker<check::PreCall, check::PostCall,
                      check::PostStmt<MaterializeTemporaryExpr>,
                      check::DeadSymbols,
                      eval::Assume> {
 
-  std::unique_ptr<BugType> OutOfRangeBugType;
+  mutable std::unique_ptr<BugType> OutOfRangeBugType;
 
   void handleComparison(CheckerContext &C, const SVal &RetVal, const SVal &LVal,
                         const SVal &RVal, OverloadedOperatorKind Op) const;
   void verifyDereference(CheckerContext &C, const SVal &Val) const;
   void handleEnd(CheckerContext &C, const Expr *CE, const SVal &RetVal,
                  const SVal &Cont) const;
   void assignToContainer(CheckerContext &C, const Expr *CE, const SVal &RetVal,
                          const MemRegion *Cont) const;
   void reportOutOfRangeBug(const StringRef &Message, const SVal &Val,
                            CheckerContext &C, ExplodedNode *ErrNode) const;
 
 public:
-  IteratorChecker();
-
   enum CheckKind {
     CK_IteratorRangeChecker,
     CK_NumCheckKinds
   };
 
   DefaultBool ChecksEnabled[CK_NumCheckKinds];
   CheckName CheckNames[CK_NumCheckKinds];
 
ProgramStateRef relateIteratorPositions(ProgramStateRef State,
                                         bool Equal);
 const ContainerData *getContainerData(ProgramStateRef State,
                                       const MemRegion *Cont);
 ProgramStateRef setContainerData(ProgramStateRef State, const MemRegion *Cont,
                                  const ContainerData &CData);
 bool isOutOfRange(ProgramStateRef State, const IteratorPosition &Pos);
 } // namespace
 
-IteratorChecker::IteratorChecker() {
-  OutOfRangeBugType.reset(
-      new BugType(this, "Iterator out of range", "Misuse of STL APIs"));
-  OutOfRangeBugType->setSuppressOnSink(true);
-}
-
 void IteratorChecker::checkPreCall(const CallEvent &Call,
                                    CheckerContext &C) const {
   // Check for out of range access
   const auto *Func = dyn_cast_or_null<FunctionDecl>(Call.getDecl());
   if (!Func)
     return;
 
   if (Func->isOverloadedOperator()) {
void IteratorChecker::assignToContainer(CheckerContext &C, const Expr *CE,
   State = setIteratorPosition(State, RetVal,
                               IteratorPosition::getPosition(Cont, Sym));
   C.addTransition(State);
 }
 
 void IteratorChecker::reportOutOfRangeBug(const StringRef &Message,
                                           const SVal &Val, CheckerContext &C,
                                           ExplodedNode *ErrNode) const {
+
+  if (!OutOfRangeBugType) {
+    OutOfRangeBugType.reset(
+        new BugType(this, "Iterator out of range", "Misuse of STL APIs"));
+    OutOfRangeBugType->setSuppressOnSink(true);
+  }
   auto R = llvm::make_unique<BugReport>(*OutOfRangeBugType, Message, ErrNode);
   R->markInteresting(Val);
   C.emitReport(std::move(R));
 }
 
 namespace {
 
 bool isGreaterOrEqual(ProgramStateRef State, SymbolRef Sym1, SymbolRef Sym2);

lib/StaticAnalyzer/Checkers/LocalizationChecker.cpp

class NonLocalizedStringChecker
   bool isAnnotatedAsTakingLocalized(const Decl *D) const;
   void reportLocalizationError(SVal S, const CallEvent &M, CheckerContext &C,
                                int argumentNumber = 0) const;
 
   int getLocalizedArgumentForSelector(const IdentifierInfo *Receiver,
                                       Selector S) const;
 
 public:
-  NonLocalizedStringChecker();
-
   // When this parameter is set to true, the checker assumes all
   // methods that return NSStrings are unlocalized. Thus, more false
   // positives will be reported.
   DefaultBool IsAggressive;
 
   void checkPreObjCMessage(const ObjCMethodCall &msg, CheckerContext &C) const;
   void checkPostObjCMessage(const ObjCMethodCall &msg, CheckerContext &C) const;
   void checkPostStmt(const ObjCStringLiteral *SL, CheckerContext &C) const;
   void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
   void checkPostCall(const CallEvent &Call, CheckerContext &C) const;
 };
 
 } // end anonymous namespace
 
 REGISTER_MAP_WITH_PROGRAMSTATE(LocalizedMemMap, const MemRegion *,
                                LocalizedState)
 
-NonLocalizedStringChecker::NonLocalizedStringChecker() {
-  BT.reset(new BugType(this, "Unlocalizable string",
-                       "Localizability Issue (Apple)"));
-}
-
 namespace {
 class NonLocalizedStringBRVisitor final
     : public BugReporterVisitorImpl<NonLocalizedStringBRVisitor> {
 
   const MemRegion *NonLocalizedString;
   bool Satisfied;
 
 public:
void NonLocalizedStringChecker::reportLocalizationError(
   ExplodedNode *ErrNode = C.getPredecessor();
   static CheckerProgramPointTag Tag("NonLocalizedStringChecker",
                                     "UnlocalizedString");
   ErrNode = C.addTransition(C.getState(), C.getPredecessor(), &Tag);
 
   if (!ErrNode)
     return;
 
+  if (!BT)
+    BT.reset(new BugType(this, "Unlocalizable string",
+                         "Localizability Issue (Apple)"));
+
   // Generate the bug report.
   std::unique_ptr<BugReport> R(new BugReport(
       *BT, "User-facing text should use localized string macro", ErrNode));
   if (argumentNumber) {
     R->addRange(M.getArgExpr(argumentNumber - 1)->getSourceRange());
   } else {
     R->addRange(M.getSourceRange());
   }

lib/StaticAnalyzer/Checkers/MPI-Checker/MPIBugReporter.h

 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
 
 namespace clang {
 namespace ento {
 namespace mpi {
 
 class MPIBugReporter {
 public:
-  MPIBugReporter(const CheckerBase &CB) {
-    UnmatchedWaitBugType.reset(new BugType(&CB, "Unmatched wait", MPIError));
-    DoubleNonblockingBugType.reset(
-        new BugType(&CB, "Double nonblocking", MPIError));
-    MissingWaitBugType.reset(new BugType(&CB, "Missing wait", MPIError));
-  }
-
   /// Report duplicate request use by nonblocking calls without intermediate
   /// wait.
   ///
   /// \param MPICallEvent MPI call that caused the double nonblocking
   /// \param Req request that was used by two nonblocking calls in sequence
   /// \param RequestRegion memory region of the request
   /// \param ExplNode node in the graph the bug appeared at
   /// \param BReporter bug reporter for current context
   void reportDoubleNonblocking(const CallEvent &MPICallEvent,
                                const Request &Req,
                                const MemRegion *const RequestRegion,
                                const ExplodedNode *const ExplNode,
-                              BugReporter &BReporter) const;
+                               BugReporter &BReporter,
+                               const CheckerBase &CB) const;
 
   /// Report a missing wait for a nonblocking call.
   ///
   /// \param Req request that is not matched by a wait
   /// \param RequestRegion memory region of the request
   /// \param ExplNode node in the graph the bug appeared at
   /// \param BReporter bug reporter for current context
   void reportMissingWait(const Request &Req,
                          const MemRegion *const RequestRegion,
                          const ExplodedNode *const ExplNode,
-                         BugReporter &BReporter) const;
+                         BugReporter &BReporter, const CheckerBase &CB) const;
 
   /// Report a wait on a request that has not been used at all before.
   ///
   /// \param CE wait call that uses the request
   /// \param RequestRegion memory region of the request
   /// \param ExplNode node in the graph the bug appeared at
   /// \param BReporter bug reporter for current context
   void reportUnmatchedWait(const CallEvent &CE,
                            const MemRegion *const RequestRegion,
                            const ExplodedNode *const ExplNode,
-                           BugReporter &BReporter) const;
+                           BugReporter &BReporter, const CheckerBase &CB) const;
 
 private:
   const std::string MPIError = "MPI Error";
 
-  // path-sensitive bug types
-  std::unique_ptr<BugType> UnmatchedWaitBugType;
-  std::unique_ptr<BugType> MissingWaitBugType;
-  std::unique_ptr<BugType> DoubleNonblockingBugType;
+  // Path-sensitive bug types.
+  mutable std::unique_ptr<BugType> UnmatchedWaitBugType;
+  mutable std::unique_ptr<BugType> MissingWaitBugType;
+  mutable std::unique_ptr<BugType> DoubleNonblockingBugType;
 
   /// Bug visitor class to find the node where the request region was previously
   /// used in order to include it into the BugReport path.
   class RequestNodeVisitor : public BugReporterVisitorImpl<RequestNodeVisitor> {
   public:
     RequestNodeVisitor(const MemRegion *const MemoryRegion,
                        const std::string &ErrText)
         : RequestRegion(MemoryRegion), ErrorText(ErrText) {}

lib/StaticAnalyzer/Checkers/MPI-Checker/MPIBugReporter.cpp

 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
 
 namespace clang {
 namespace ento {
 namespace mpi {
 
 void MPIBugReporter::reportDoubleNonblocking(
     const CallEvent &MPICallEvent, const ento::mpi::Request &Req,
-    const MemRegion *const RequestRegion,
-    const ExplodedNode *const ExplNode,
-    BugReporter &BReporter) const {
+    const MemRegion *const RequestRegion, const ExplodedNode *const ExplNode,
+    BugReporter &BReporter, const CheckerBase &CB) const {
+  if (!DoubleNonblockingBugType)
+    DoubleNonblockingBugType.reset(
+        new BugType(&CB, "Double nonblocking", MPIError));
 
   std::string ErrorText;
   ErrorText = "Double nonblocking on request " +
               RequestRegion->getDescriptiveName() + ". ";
 
   auto Report = llvm::make_unique<BugReport>(*DoubleNonblockingBugType,
                                              ErrorText, ExplNode);
 
   Report->addRange(MPICallEvent.getSourceRange());
   SourceRange Range = RequestRegion->sourceRange();
 
   if (Range.isValid())
     Report->addRange(Range);
 
   Report->addVisitor(llvm::make_unique<RequestNodeVisitor>(
       RequestRegion, "Request is previously used by nonblocking call here. "));
   Report->markInteresting(RequestRegion);
 
   BReporter.emitReport(std::move(Report));
 }
 
-void MPIBugReporter::reportMissingWait(
-    const ento::mpi::Request &Req, const MemRegion *const RequestRegion,
+void MPIBugReporter::reportMissingWait(const ento::mpi::Request &Req,
+                                       const MemRegion *const RequestRegion,
                                        const ExplodedNode *const ExplNode,
-    BugReporter &BReporter) const {
+                                       BugReporter &BReporter,
+                                       const CheckerBase &CB) const {
+  if (!MissingWaitBugType)
+    MissingWaitBugType.reset(new BugType(&CB, "Missing wait", MPIError));
+
   std::string ErrorText{"Request " + RequestRegion->getDescriptiveName() +
                         " has no matching wait. "};
 
   auto Report =
       llvm::make_unique<BugReport>(*MissingWaitBugType, ErrorText, ExplNode);
 
   SourceRange Range = RequestRegion->sourceRange();
   if (Range.isValid())
     Report->addRange(Range);
   Report->addVisitor(llvm::make_unique<RequestNodeVisitor>(
       RequestRegion, "Request is previously used by nonblocking call here. "));
   Report->markInteresting(RequestRegion);
 
   BReporter.emitReport(std::move(Report));
 }
 
 void MPIBugReporter::reportUnmatchedWait(
     const CallEvent &CE, const clang::ento::MemRegion *const RequestRegion,
-    const ExplodedNode *const ExplNode,
-    BugReporter &BReporter) const {
+    const ExplodedNode *const ExplNode, BugReporter &BReporter,
+    const CheckerBase &CB) const {
+  if (!UnmatchedWaitBugType)
+    UnmatchedWaitBugType.reset(new BugType(&CB, "Unmatched wait", MPIError));
+
   std::string ErrorText{"Request " + RequestRegion->getDescriptiveName() +
                         " has no matching nonblocking call. "};
 
   auto Report =
       llvm::make_unique<BugReport>(*UnmatchedWaitBugType, ErrorText, ExplNode);
 
   Report->addRange(CE.getSourceRange());
   SourceRange Range = RequestRegion->sourceRange();

lib/StaticAnalyzer/Checkers/MPI-Checker/MPIChecker.h

 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 
 namespace clang {
 namespace ento {
 namespace mpi {
 
 class MPIChecker : public Checker<check::PreCall, check::DeadSymbols> {
 public:
-  MPIChecker() : BReporter(*this) {}
-
-  // path-sensitive callbacks
+  // Path-sensitive callbacks.
   void checkPreCall(const CallEvent &CE, CheckerContext &Ctx) const {
     dynamicInit(Ctx);
     checkUnmatchedWaits(CE, Ctx);
     checkDoubleNonblocking(CE, Ctx);
   }
 
   void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &Ctx) const {
     dynamicInit(Ctx);

lib/StaticAnalyzer/Checkers/MPI-Checker/MPIChecker.cpp

void MPIChecker::checkDoubleNonblocking(const CallEvent &PreCallEvent,
 
   ProgramStateRef State = Ctx.getState();
   const Request *const Req = State->get<RequestMap>(MR);
 
   // double nonblocking detected
   if (Req && Req->CurrentState == Request::State::Nonblocking) {
     ExplodedNode *ErrorNode = Ctx.generateNonFatalErrorNode();
     BReporter.reportDoubleNonblocking(PreCallEvent, *Req, MR, ErrorNode,
-                                      Ctx.getBugReporter());
+                                      Ctx.getBugReporter(), *this);
     Ctx.addTransition(ErrorNode->getState(), ErrorNode);
   }
   // no error
   else {
     State = State->set<RequestMap>(MR, Request::State::Nonblocking);
     Ctx.addTransition(State);
   }
 }
for (const auto &ReqRegion : ReqRegions) {
     State = State->set<RequestMap>(ReqRegion, Request::State::Wait);
     if (!Req) {
       if (!ErrorNode) {
         ErrorNode = Ctx.generateNonFatalErrorNode(State, &Tag);
         State = ErrorNode->getState();
       }
       // A wait has no matching nonblocking call.
       BReporter.reportUnmatchedWait(PreCallEvent, ReqRegion, ErrorNode,
-                                    Ctx.getBugReporter());
+                                    Ctx.getBugReporter(), *this);
     }
   }
 
   if (!ErrorNode) {
     Ctx.addTransition(State);
   } else {
     Ctx.addTransition(State, ErrorNode);
   }
for (const auto &Req : ReqMap) {
     if (!SymReaper.isLiveRegion(Req.first)) {
       if (Req.second.CurrentState == Request::State::Nonblocking) {
 
         if (!ErrorNode) {
           ErrorNode = Ctx.generateNonFatalErrorNode(State, &Tag);
           State = ErrorNode->getState();
         }
         BReporter.reportMissingWait(Req.second, Req.first, ErrorNode,
-                                    Ctx.getBugReporter());
+                                    Ctx.getBugReporter(), *this);
       }
       State = State->remove<RequestMap>(Req.first);
     }
   }
 
   // Transition to update the state regarding removed requests.
   if (!ErrorNode) {
     Ctx.addTransition(State);

lib/StaticAnalyzer/Checkers/MallocChecker.cpp

void ento::registerNewDeleteLeaksChecker(CheckerManager &mgr) {
   MallocChecker *checker = mgr.registerChecker<MallocChecker>();
   checker->IsOptimistic = mgr.getAnalyzerOptions().getBooleanOption(
       "Optimistic", false, checker);
   checker->ChecksEnabled[MallocChecker::CK_NewDeleteLeaksChecker] = true;
   checker->CheckNames[MallocChecker::CK_NewDeleteLeaksChecker] =
       mgr.getCurrentCheckName();
   // We currently treat NewDeleteLeaks checker as a subchecker of NewDelete
   // checker.
-  if (!checker->ChecksEnabled[MallocChecker::CK_NewDeleteChecker])
+  if (!checker->ChecksEnabled[MallocChecker::CK_NewDeleteChecker]) {
     checker->ChecksEnabled[MallocChecker::CK_NewDeleteChecker] = true;
+    // FIXME: This does not set the correct name, but without this workaround
+    //        no name will be set at all.
+    checker->CheckNames[MallocChecker::CK_NewDeleteChecker] =
+        mgr.getCurrentCheckName();
+  }
 }
 
 #define REGISTER_CHECKER(name)                                                 \
   void ento::register##name(CheckerManager &mgr) {                             \
     registerCStringCheckerBasic(mgr);                                          \
     MallocChecker *checker = mgr.registerChecker<MallocChecker>();             \
     checker->IsOptimistic = mgr.getAnalyzerOptions().getBooleanOption(         \
         "Optimistic", false, checker);                                         \
     checker->ChecksEnabled[MallocChecker::CK_##name] = true;                   \
     checker->CheckNames[MallocChecker::CK_##name] = mgr.getCurrentCheckName(); \
   }
 
 REGISTER_CHECKER(MallocChecker)
 REGISTER_CHECKER(NewDeleteChecker)
 REGISTER_CHECKER(MismatchedDeallocatorChecker)

lib/StaticAnalyzer/Checkers/ObjCSuperDeallocChecker.cpp

 namespace {
 class ObjCSuperDeallocChecker
     : public Checker<check::PostObjCMessage, check::PreObjCMessage,
                      check::PreCall, check::Location> {
 
   mutable IdentifierInfo *IIdealloc, *IINSObject;
   mutable Selector SELdealloc;
 
-  std::unique_ptr<BugType> DoubleSuperDeallocBugType;
+  mutable std::unique_ptr<BugType> DoubleSuperDeallocBugType;
 
   void initIdentifierInfoAndSelectors(ASTContext &Ctx) const;
 
   bool isSuperDeallocMessage(const ObjCMethodCall &M) const;
 
 public:
   ObjCSuperDeallocChecker();
   void checkPostObjCMessage(const ObjCMethodCall &M, CheckerContext &C) const;
void ObjCSuperDeallocChecker::reportUseAfterDealloc(SymbolRef Sym,
   ExplodedNode *ErrNode = C.generateErrorNode();
   // If we've already reached this node on another path, return.
   if (!ErrNode)
     return;
 
   if (Desc.empty())
     Desc = "Use of 'self' after it has been deallocated";
 
+  if (!DoubleSuperDeallocBugType)
+    DoubleSuperDeallocBugType.reset(
+        new BugType(this, "[super dealloc] should not be called more than once",
+                    categories::CoreFoundationObjectiveC));
+
   // Generate the report.
   std::unique_ptr<BugReport> BR(
       new BugReport(*DoubleSuperDeallocBugType, Desc, ErrNode));
   BR->addRange(S->getSourceRange());
   BR->addVisitor(llvm::make_unique<SuperDeallocBRVisitor>(Sym));
   C.emitReport(std::move(BR));
 }
 
for (unsigned I = 0; I < ArgCount; I++) {
     if (State->contains<CalledSuperDealloc>(Sym)) {
       reportUseAfterDealloc(Sym, StringRef(), CE.getArgExpr(I), C);
       return;
     }
   }
 }
 
 ObjCSuperDeallocChecker::ObjCSuperDeallocChecker()
-    : IIdealloc(nullptr), IINSObject(nullptr) {
-
-  DoubleSuperDeallocBugType.reset(
-      new BugType(this, "[super dealloc] should not be called more than once",
-                  categories::CoreFoundationObjectiveC));
-}
+    : IIdealloc(nullptr), IINSObject(nullptr) {}
 
 void
 ObjCSuperDeallocChecker::initIdentifierInfoAndSelectors(ASTContext &Ctx) const {
   if (IIdealloc)
     return;
 
   IIdealloc = &Ctx.Idents.get("dealloc");
   IINSObject = &Ctx.Idents.get("NSObject");
ObjCSuperDeallocChecker::isSuperDeallocMessage(const ObjCMethodCall &M) const {
   initIdentifierInfoAndSelectors(Ctx);
 
   return M.getSelector() == SELdealloc;
 }
 
 std::shared_ptr<PathDiagnosticPiece>
 SuperDeallocBRVisitor::VisitNode(const ExplodedNode *Succ,
                                  const ExplodedNode *Pred,
-                                 BugReporterContext &BRC, BugReport &BR) {
+                                 BugReporterContext &BRC, BugReport &) {
   if (Satisfied)
     return nullptr;
 
   ProgramStateRef State = Succ->getState();
 
   bool CalledNow =
       Succ->getState()->contains<CalledSuperDealloc>(ReceiverSymbol);
   bool CalledBefore =

lib/StaticAnalyzer/Checkers/SimpleStreamChecker.cpp

 };
 
 class SimpleStreamChecker : public Checker<check::PostCall,
                                            check::PreCall,
                                            check::DeadSymbols,
                                            check::PointerEscape> {
   CallDescription OpenFn, CloseFn;
 
-  std::unique_ptr<BugType> DoubleCloseBugType;
-  std::unique_ptr<BugType> LeakBugType;
+  mutable std::unique_ptr<BugType> DoubleCloseBugType;
+  mutable std::unique_ptr<BugType> LeakBugType;
 
   void reportDoubleClose(SymbolRef FileDescSym,
                          const CallEvent &Call,
                          CheckerContext &C) const;
 
   void reportLeaks(ArrayRef<SymbolRef> LeakedStreams, CheckerContext &C,
                    ExplodedNode *ErrNode) const;
 
public:
   bool VisitSymbol(SymbolRef sym) override {
     state = state->remove<StreamMap>(sym);
     return true;
   }
 };
 } // end anonymous namespace
 
 SimpleStreamChecker::SimpleStreamChecker()
-    : OpenFn("fopen"), CloseFn("fclose", 1) {
-  // Initialize the bug types.
-  DoubleCloseBugType.reset(
-      new BugType(this, "Double fclose", "Unix Stream API Error"));
-
-  LeakBugType.reset(
-      new BugType(this, "Resource Leak", "Unix Stream API Error"));
-  // Sinks are higher importance bugs as well as calls to assert() or exit(0).
-  LeakBugType->setSuppressOnSink(true);
-}
+    : OpenFn("fopen"), CloseFn("fclose", 1) {}
 
 void SimpleStreamChecker::checkPostCall(const CallEvent &Call,
                                         CheckerContext &C) const {
   if (!Call.isGlobalCFunction())
     return;
 
   if (!Call.isCalled(OpenFn))
     return;
void SimpleStreamChecker::reportDoubleClose(SymbolRef FileDescSym,
                                             const CallEvent &Call,
                                             CheckerContext &C) const {
   // We reached a bug, stop exploring the path here by generating a sink.
   ExplodedNode *ErrNode = C.generateErrorNode();
   // If we've already reached this node on another path, return.
   if (!ErrNode)
     return;
 
+  if (!DoubleCloseBugType)
+    DoubleCloseBugType.reset(
+        new BugType(this, "Double fclose", "Unix Stream API Error"));
+
   // Generate the report.
   auto R = llvm::make_unique<BugReport>(*DoubleCloseBugType,
       "Closing a previously closed file stream", ErrNode);
   R->addRange(Call.getSourceRange());
   R->markInteresting(FileDescSym);
   C.emitReport(std::move(R));
 }
 
 void SimpleStreamChecker::reportLeaks(ArrayRef<SymbolRef> LeakedStreams,
                                       CheckerContext &C,
                                       ExplodedNode *ErrNode) const {
+
+  if (!LeakBugType) {
+    LeakBugType.reset(
+        new BugType(this, "Resource Leak", "Unix Stream API Error"));
+    // Sinks are higher importance bugs as well as calls to assert() or exit(0).
+    LeakBugType->setSuppressOnSink(true);
+  }
   // Attach bug reports to the leak node.
   // TODO: Identify the leaked file descriptor.
   for (SymbolRef LeakedStream : LeakedStreams) {
     auto R = llvm::make_unique<BugReport>(*LeakBugType,
         "Opened file is never closed; potential resource leak", ErrNode);
     R->markInteresting(LeakedStream);
     C.emitReport(std::move(R));
   }

lib/StaticAnalyzer/Checkers/ValistChecker.cpp

private:
   StringRef getVariableNameFromRegion(const MemRegion *Reg) const;
   const ExplodedNode *getStartCallSite(const ExplodedNode *N,
                                        const MemRegion *Reg) const;
 
   void reportUninitializedAccess(const MemRegion *VAList, StringRef Msg,
                                  CheckerContext &C) const;
   void reportLeakedVALists(const RegionVector &LeakedVALists, StringRef Msg1,
                            StringRef Msg2, CheckerContext &C, ExplodedNode *N,
-                           bool ForceReport = false) const;
+                           bool ReportUninit = false) const;
 
   void checkVAListStartCall(const CallEvent &Call, CheckerContext &C,
                             bool IsCopy) const;
   void checkVAListEndCall(const CallEvent &Call, CheckerContext &C) const;
 
   class ValistBugVisitor : public BugReporterVisitorImpl<ValistBugVisitor> {
   public:
     ValistBugVisitor(const MemRegion *Reg, bool IsLeak = false)
if (ExplodedNode *N = C.generateErrorNode()) {
     R->addVisitor(llvm::make_unique<ValistBugVisitor>(VAList));
     C.emitReport(std::move(R));
   }
 }
 
 void ValistChecker::reportLeakedVALists(const RegionVector &LeakedVALists,
                                         StringRef Msg1, StringRef Msg2,
                                         CheckerContext &C, ExplodedNode *N,
-                                        bool ForceReport) const {
+                                        bool ReportUninit) const {
   if (!(ChecksEnabled[CK_Unterminated] ||
-        (ChecksEnabled[CK_Uninitialized] && ForceReport)))
+        (ChecksEnabled[CK_Uninitialized] && ReportUninit)))
     return;
   for (auto Reg : LeakedVALists) {
     if (!BT_leakedvalist) {
-      BT_leakedvalist.reset(new BugType(CheckNames[CK_Unterminated],
-                                        "Leaked va_list",
-                                        categories::MemoryError));
+      BT_leakedvalist.reset(new BugType(
+          CheckNames[ReportUninit ? CK_Uninitialized : CK_Unterminated],
+          "Leaked va_list", categories::MemoryError));
       BT_leakedvalist->setSuppressOnSink(true);
     }
 
     const ExplodedNode *StartNode = getStartCallSite(N, Reg);
     PathDiagnosticLocation LocUsedForUniqueing;
 
     if (const Stmt *StartCallStmt = PathDiagnosticLocation::getStmt(StartNode))
       LocUsedForUniqueing = PathDiagnosticLocation::createBegin(
void ValistChecker::checkVAListEndCall(const CallEvent &Call,
   }
   ProgramStateRef State = C.getState();
   State = State->remove<InitializedVALists>(VAList);
   C.addTransition(State);
 }
 
 std::shared_ptr<PathDiagnosticPiece> ValistChecker::ValistBugVisitor::VisitNode(
     const ExplodedNode *N, const ExplodedNode *PrevN, BugReporterContext &BRC,
-    BugReport &BR) {
+    BugReport &) {
   ProgramStateRef State = N->getState();
   ProgramStateRef StatePrev = PrevN->getState();
 
   const Stmt *S = PathDiagnosticLocation::getStmt(N);
   if (!S)
     return nullptr;
 
   StringRef Msg;

test/Analysis/malloc.c

void *smallocWarn(size_t size) {
   if (size == 2) {
     return malloc(1);
   }
   else {
     return malloc(size);
   }
 }
 
-char *dupstrWarn(const char *s) {
-  const int len = strlen(s);
-  char *p = (char*) smallocWarn(len + 1);
-  strcpy(p, s); // expected-warning{{String copy function overflows destination buffer}}
-  return p;
-}
-
 int *radar15580979() {
   int *data = (int *)malloc(32);
   int *p = data ?: (int*)malloc(32); // no warning
   return p;
 }
 
 // Some data structures may hold onto the pointer and free it later.
 void testEscapeThroughSystemCallTakingVoidPointer1(void *queue) {