[analyzer] Make checkEndFunction() give access to the return statement

[NoQ]

Looks great, thanks!

include/clang/StaticAnalyzer/Core/CheckerManager.h

501

:D

include/clang/StaticAnalyzer/Core/Checker.h

public:
   static void _register(CHECKER *checker, CheckerManager &mgr) {
     mgr._registerForBeginFunction(CheckerManager::CheckBeginFunctionFunc(
         checker, _checkBeginFunction<CHECKER>));
   }
 };
 
 class EndFunction {
   template <typename CHECKER>
-  static void _checkEndFunction(void *checker,
+  static void _checkEndFunction(void *checker, const ReturnStmt *RS,
                                 CheckerContext &C) {
-    ((const CHECKER *)checker)->checkEndFunction(C);
+    ((const CHECKER *)checker)->checkEndFunction(RS, C);
   }
 
 public:
   template <typename CHECKER>
   static void _register(CHECKER *checker, CheckerManager &mgr) {
     mgr._registerForEndFunction(
      CheckerManager::CheckEndFunctionFunc(checker, _checkEndFunction<CHECKER>));
   }

include/clang/StaticAnalyzer/Core/CheckerManager.h

void runCheckersForBeginFunction(ExplodedNodeSet &Dst,
                                    const BlockEdge &L,
                                    ExplodedNode *Pred,
                                    ExprEngine &Eng);
 
   /// Run checkers on end of function.
   void runCheckersForEndFunction(NodeBuilderContext &BC,
                                  ExplodedNodeSet &Dst,
                                  ExplodedNode *Pred,
-                                 ExprEngine &Eng);
+                                 ExprEngine &Eng,
+                                 const ReturnStmt *RS);
 
   /// Run checkers for branch condition.
   void runCheckersForBranchCondition(const Stmt *condition,
                                      ExplodedNodeSet &Dst, ExplodedNode *Pred,
                                      ExprEngine &Eng);
 
   /// Run checkers between C++ operator new and constructor calls.
   void runCheckersForNewAllocator(const CXXNewExpr *NE, SVal Target,
using CheckBindFunc =
       CheckerFn<void (const SVal &location, const SVal &val, const Stmt *S,
                       CheckerContext &)>;
   
   using CheckEndAnalysisFunc =
       CheckerFn<void (ExplodedGraph &, BugReporter &, ExprEngine &)>;
 
   using CheckBeginFunctionFunc = CheckerFn<void (CheckerContext &)>;
 
-  using CheckEndFunctionFunc = CheckerFn<void (CheckerContext &)>;
+  using CheckEndFunctionFunc =
+      CheckerFn<void (const ReturnStmt *, CheckerContext &)>;
   
   using CheckBranchConditionFunc =
       CheckerFn<void (const Stmt *, CheckerContext &)>;
 
   using CheckNewAllocatorFunc =
       CheckerFn<void (const CXXNewExpr *, SVal, CheckerContext &)>;
   
   using CheckDeadSymbolsFunc =
//===----------------------------------------------------------------------===//
   void _registerForPostCall(CheckCallFunc checkfn);
 
   void _registerForLocation(CheckLocationFunc checkfn);
 
   void _registerForBind(CheckBindFunc checkfn);
 
   void _registerForEndAnalysis(CheckEndAnalysisFunc checkfn);
 
-  void _registerForBeginFunction(CheckEndFunctionFunc checkfn);
+  void _registerForBeginFunction(CheckBeginFunctionFunc checkfn);
   void _registerForEndFunction(CheckEndFunctionFunc checkfn);
 
   void _registerForBranchCondition(CheckBranchConditionFunc checkfn);
 
   void _registerForNewAllocator(CheckNewAllocatorFunc checkfn);
 
   void _registerForLiveSymbols(CheckLiveSymbolsFunc checkfn);
 

lib/StaticAnalyzer/Checkers/CheckObjCDealloc.cpp

public:
   ProgramStateRef evalAssume(ProgramStateRef State, SVal Cond,
                              bool Assumption) const;
 
   ProgramStateRef checkPointerEscape(ProgramStateRef State,
                                      const InvalidatedSymbols &Escaped,
                                      const CallEvent *Call,
                                      PointerEscapeKind Kind) const;
   void checkPreStmt(const ReturnStmt *RS, CheckerContext &C) const;
-  void checkEndFunction(CheckerContext &Ctx) const;
+  void checkEndFunction(const ReturnStmt *RS, CheckerContext &Ctx) const;
 
 private:
   void diagnoseMissingReleases(CheckerContext &C) const;
 
   bool diagnoseExtraRelease(SymbolRef ReleasedValue, const ObjCMethodCall &M,
                             CheckerContext &C) const;
 
   bool diagnoseMistakenDealloc(SymbolRef DeallocedValue,
void ObjCDeallocChecker::checkPostObjCMessage(
   // the helper method will be recorded before checking.
   if (isSuperDeallocMessage(M))
     diagnoseMissingReleases(C);
 }
 
 /// Check for missing releases even when -dealloc does not call
 /// '[super dealloc]'.
 void ObjCDeallocChecker::checkEndFunction(
-    CheckerContext &C) const {
+    const ReturnStmt *RS, CheckerContext &C) const {
   diagnoseMissingReleases(C);
 }
 
 /// Check for missing releases on early return.
 void ObjCDeallocChecker::checkPreStmt(
     const ReturnStmt *RS, CheckerContext &C) const {
   diagnoseMissingReleases(C);
 }

lib/StaticAnalyzer/Checkers/CheckerDocumentation.cpp

public:
   /// check::BeginFunction
   void checkBeginFunction(CheckerContext &Ctx) const {}
 
   /// Called when the analyzer core reaches the end of a
   /// function being analyzed regardless of whether it is analyzed at the top
   /// level or is inlined.
   ///
   /// check::EndFunction
-  void checkEndFunction(CheckerContext &Ctx) const {}
+  void checkEndFunction(const ReturnStmt *RS, CheckerContext &Ctx) const {}
 
   /// Called after all the paths in the ExplodedGraph reach end of path
   /// - the symbolic execution graph is fully explored.
   ///
   /// This callback should be used in cases when a checker needs to have a
   /// global view of the information generated on all paths. For example, to
   /// compare execution summary/result several paths.
   /// See IdempotentOperationChecker for a usage example.

lib/StaticAnalyzer/Checkers/MisusedMovedObjectChecker.cpp

public:
   bool operator==(const RegionState &X) const { return K == X.K; }
   void Profile(llvm::FoldingSetNodeID &ID) const { ID.AddInteger(K); }
 };
 
 class MisusedMovedObjectChecker
     : public Checker<check::PreCall, check::PostCall, check::EndFunction,
                      check::DeadSymbols, check::RegionChanges> {
 public:
-  void checkEndFunction(CheckerContext &C) const;
+  void checkEndFunction(const ReturnStmt *RS, CheckerContext &C) const;
   void checkPreCall(const CallEvent &MC, CheckerContext &C) const;
   void checkPostCall(const CallEvent &MC, CheckerContext &C) const;
   void checkDeadSymbols(SymbolReaper &SR, CheckerContext &C) const;
   ProgramStateRef
   checkRegionChanges(ProgramStateRef State,
                      const InvalidatedSymbols *Invalidated,
                      ArrayRef<const MemRegion *> ExplicitRegions,
                      ArrayRef<const MemRegion *> Regions,
if (ExplodedNode *N = C.generateNonFatalErrorNode()) {
     C.emitReport(std::move(R));
     return N;
   }
   return nullptr;
 }
 
 // Removing the function parameters' MemRegion from the state. This is needed
 // for PODs where the trivial destructor does not even created nor executed.
-void MisusedMovedObjectChecker::checkEndFunction(CheckerContext &C) const {
+void MisusedMovedObjectChecker::checkEndFunction(const ReturnStmt *RS,
+                                                 CheckerContext &C) const {
   auto State = C.getState();
   TrackedRegionMapTy Objects = State->get<TrackedRegionMap>();
   if (Objects.isEmpty())
     return;
 
   auto LC = C.getLocationContext();
 
   const auto LD = dyn_cast_or_null<FunctionDecl>(LC->getDecl());

lib/StaticAnalyzer/Checkers/RetainCountChecker.cpp

public:
 
   void checkPreStmt(const ReturnStmt *S, CheckerContext &C) const;
   void checkReturnWithRetEffect(const ReturnStmt *S, CheckerContext &C,
                                 ExplodedNode *Pred, RetEffect RE, RefVal X,
                                 SymbolRef Sym, ProgramStateRef state) const;
 
   void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const;
   void checkBeginFunction(CheckerContext &C) const;
-  void checkEndFunction(CheckerContext &C) const;
+  void checkEndFunction(const ReturnStmt *RS, CheckerContext &C) const;
 
   ProgramStateRef updateSymbol(ProgramStateRef state, SymbolRef sym,
                                RefVal V, ArgEffect E, RefVal::Kind &hasErr,
                                CheckerContext &C) const;
 
   void processNonLeakError(ProgramStateRef St, SourceRange ErrorRange,
                            RefVal::Kind ErrorKind, SymbolRef Sym,
                            CheckerContext &C) const;
if (AE && *AE == DecRef && isGeneralizedObjectRef(Ty))
       state = setRefBinding(state, Sym, RefVal::makeOwned(RetEffect::ObjKind::Generalized, Ty));
     else if (isGeneralizedObjectRef(Ty))
       state = setRefBinding(state, Sym, RefVal::makeNotOwned(RetEffect::ObjKind::Generalized, Ty));
   }
 
   Ctx.addTransition(state);
 }
 
-void RetainCountChecker::checkEndFunction(CheckerContext &Ctx) const {
+void RetainCountChecker::checkEndFunction(const ReturnStmt *RS,
+                                          CheckerContext &Ctx) const {
   ProgramStateRef state = Ctx.getState();
   RefBindingsTy B = state->get<RefBindings>();
   ExplodedNode *Pred = Ctx.getPredecessor();
 
   // Don't process anything within synthesized bodies.
   const LocationContext *LCtx = Pred->getLocationContext();
   if (LCtx->getAnalysisDeclContext()->isBodyAutosynthesized()) {
     assert(!LCtx->inTopFrame()); 

lib/StaticAnalyzer/Checkers/StackAddrEscapeChecker.cpp

enum CheckKind {
     CK_StackAddrAsyncEscapeChecker,
     CK_NumCheckKinds
   };
 
   DefaultBool ChecksEnabled[CK_NumCheckKinds];
 
   void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
   void checkPreStmt(const ReturnStmt *RS, CheckerContext &C) const;
-  void checkEndFunction(CheckerContext &Ctx) const;
+  void checkEndFunction(const ReturnStmt *RS, CheckerContext &Ctx) const;
 
 private:
   void checkReturnedBlockCaptures(const BlockDataRegion &B,
                                   CheckerContext &C) const;
   void checkAsyncExecutedBlockCaptures(const BlockDataRegion &B,
                                        CheckerContext &C) const;
   void EmitStackError(CheckerContext &C, const MemRegion *R,
                       const Expr *RetE) const;
if (isa<BlockDataRegion>(R) &&
         ICE->getCastKind() == CK_CopyAndAutoreleaseBlockObject) {
       return;
     }
   }
 
   EmitStackError(C, R, RetE);
 }
 
-void StackAddrEscapeChecker::checkEndFunction(CheckerContext &Ctx) const {
+void StackAddrEscapeChecker::checkEndFunction(const ReturnStmt *RS,
+                                              CheckerContext &Ctx) const {
   if (!ChecksEnabled[CK_StackAddrEscapeChecker])
     return;
 
   ProgramStateRef State = Ctx.getState();
 
   // Iterate over all bindings to global variables and see if it contains
   // a memory region in the stack space.
   class CallBack : public StoreManager::BindingsHandler {

lib/StaticAnalyzer/Checkers/TestAfterDivZeroChecker.cpp

class TestAfterDivZeroChecker
     : public Checker<check::PreStmt<BinaryOperator>, check::BranchCondition,
                      check::EndFunction> {
   mutable std::unique_ptr<BuiltinBug> DivZeroBug;
   void reportBug(SVal Val, CheckerContext &C) const;
 
 public:
   void checkPreStmt(const BinaryOperator *B, CheckerContext &C) const;
   void checkBranchCondition(const Stmt *Condition, CheckerContext &C) const;
-  void checkEndFunction(CheckerContext &C) const;
+  void checkEndFunction(const ReturnStmt *RS, CheckerContext &C) const;
   void setDivZeroMap(SVal Var, CheckerContext &C) const;
   bool hasDivZeroMap(SVal Var, const CheckerContext &C) const;
   bool isZero(SVal S, CheckerContext &C) const;
 };
 } // end anonymous namespace
 
 REGISTER_SET_WITH_PROGRAMSTATE(DivZeroMap, ZeroState)
 
auto R = llvm::make_unique<BugReport>(
         N);
 
     R->addVisitor(llvm::make_unique<DivisionBRVisitor>(Val.getAsSymbol(),
                                                        C.getStackFrame()));
     C.emitReport(std::move(R));
   }
 }
 
-void TestAfterDivZeroChecker::checkEndFunction(CheckerContext &C) const {
+void TestAfterDivZeroChecker::checkEndFunction(const ReturnStmt *RS,
+                                               CheckerContext &C) const {
   ProgramStateRef State = C.getState();
 
   DivZeroMapTy DivZeroes = State->get<DivZeroMap>();
   if (DivZeroes.isEmpty())
     return;
 
   DivZeroMapTy::Factory &F = State->get_context<DivZeroMap>();
   for (llvm::ImmutableSet<ZeroState>::iterator I = DivZeroes.begin(),

lib/StaticAnalyzer/Checkers/TraversalChecker.cpp

 
 namespace {
 class TraversalDumper : public Checker< check::BranchCondition,
                                         check::BeginFunction,
                                         check::EndFunction > {
 public:
   void checkBranchCondition(const Stmt *Condition, CheckerContext &C) const;
   void checkBeginFunction(CheckerContext &C) const;
-  void checkEndFunction(CheckerContext &C) const;
+  void checkEndFunction(const ReturnStmt *RS, CheckerContext &C) const;
 };
 }
 
 void TraversalDumper::checkBranchCondition(const Stmt *Condition,
                                            CheckerContext &C) const {
   // Special-case Objective-C's for-in loop, which uses the entire loop as its
   // condition. We just print the collection expression.
   const Stmt *Parent = dyn_cast<ObjCForCollectionStmt>(Condition);
void TraversalDumper::checkBranchCondition(const Stmt *Condition,
   llvm::outs() << C.getSourceManager().getSpellingLineNumber(Loc) << " "
                << Parent->getStmtClassName() << "\n";
 }
 
 void TraversalDumper::checkBeginFunction(CheckerContext &C) const {
   llvm::outs() << "--BEGIN FUNCTION--\n";
 }
 
-void TraversalDumper::checkEndFunction(CheckerContext &C) const {
+void TraversalDumper::checkEndFunction(const ReturnStmt *RS,
+                                       CheckerContext &C) const {
   llvm::outs() << "--END FUNCTION--\n";
 }
 
 void ento::registerTraversalDumper(CheckerManager &mgr) {
   mgr.registerChecker<TraversalDumper>();
 }
 
 //------------------------------------------------------------------------------

lib/StaticAnalyzer/Checkers/UninitializedObjectChecker.cpp

 
 public:
   // These fields will be initialized when registering the checker.
   bool IsPedantic;
   bool ShouldConvertNotesToWarnings;
 
   UninitializedObjectChecker()
       : BT_uninitField(new BuiltinBug(this, "Uninitialized fields")) {}
-  void checkEndFunction(CheckerContext &C) const;
+  void checkEndFunction(const ReturnStmt *RS, CheckerContext &C) const;
 };
 
 /// Represents a field chain. A field chain is a vector of fields where the
 /// first element of the chain is the object under checking (not stored), and
 /// every other element is a field, and the element that precedes it is the
 /// object that contains it.
 ///
 /// Note that this class is immutable, and new fields may only be added through

 /// even if Field is a captured lambda variable.
 static StringRef getVariableName(const FieldDecl *Field);
 
 //===----------------------------------------------------------------------===//
 //                  Methods for UninitializedObjectChecker.
 //===----------------------------------------------------------------------===//
 
 void UninitializedObjectChecker::checkEndFunction(
-    CheckerContext &Context) const {
+    const ReturnStmt *RS, CheckerContext &Context) const {
 
   const auto *CtorDecl = dyn_cast_or_null<CXXConstructorDecl>(
       Context.getLocationContext()->getDecl());
   if (!CtorDecl)
     return;
 
   if (!CtorDecl->isUserProvided())
     return;

lib/StaticAnalyzer/Checkers/VirtualCallChecker.cpp

class VirtualCallChecker
     : public Checker<check::BeginFunction, check::EndFunction, check::PreCall> {
   mutable std::unique_ptr<BugType> BT;
 
 public:
   // The flag to determine if pure virtual functions should be issued only.
   DefaultBool IsPureOnly;
 
   void checkBeginFunction(CheckerContext &C) const;
-  void checkEndFunction(CheckerContext &C) const;
+  void checkEndFunction(const ReturnStmt *RS, CheckerContext &C) const;
   void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
 
 private:
   void registerCtorDtorCallInState(bool IsBeginFunction,
                                    CheckerContext &C) const;
   void reportBug(StringRef Msg, bool PureError, const MemRegion *Reg,
                  CheckerContext &C) const;
 

 }
 
 // The BeginFunction callback when enter a constructor or a destructor.
 void VirtualCallChecker::checkBeginFunction(CheckerContext &C) const {
   registerCtorDtorCallInState(true, C);
 }
 
 // The EndFunction callback when leave a constructor or a destructor.
-void VirtualCallChecker::checkEndFunction(CheckerContext &C) const {
+void VirtualCallChecker::checkEndFunction(const ReturnStmt *RS,
+                                          CheckerContext &C) const {
   registerCtorDtorCallInState(false, C);
 }
 
 void VirtualCallChecker::checkPreCall(const CallEvent &Call,
                                       CheckerContext &C) const {
   const auto MC = dyn_cast<CXXMemberCall>(&Call);
   if (!MC)
     return;

lib/StaticAnalyzer/Core/CheckerManager.cpp

 }
 
 /// Run checkers for end of path.
 // Note, We do not chain the checker output (like in expandGraphWithCheckers)
 // for this callback since end of path nodes are expected to be final.
 void CheckerManager::runCheckersForEndFunction(NodeBuilderContext &BC,
                                                ExplodedNodeSet &Dst,
                                                ExplodedNode *Pred,
-                                               ExprEngine &Eng) {
+                                               ExprEngine &Eng,
+                                               const ReturnStmt *RS) {
   // We define the builder outside of the loop bacause if at least one checkers
   // creates a sucsessor for Pred, we do not need to generate an
   // autotransition for it.
   NodeBuilder Bldr(Pred, Dst, BC);
   for (const auto checkFn : EndFunctionCheckers) {
     const ProgramPoint &L = BlockEntrance(BC.Block,
                                           Pred->getLocationContext(),
                                           checkFn.Checker);
     CheckerContext C(Bldr, Eng, Pred, L);
-    checkFn(C);
+    checkFn(RS, C);
   }
 }
 
 namespace {
 
   struct CheckBranchConditionContext {
     using CheckersTy = std::vector<CheckerManager::CheckBranchConditionFunc>;
 

lib/StaticAnalyzer/Core/ExprEngine.cpp

void ExprEngine::processEndOfFunction(NodeBuilderContext& BC,
   ExplodedNodeSet Dst;
   if (Pred->getLocationContext()->inTopFrame()) {
     // Remove dead symbols.
     ExplodedNodeSet AfterRemovedDead;
     removeDeadOnEndOfFunction(BC, Pred, AfterRemovedDead);
 
     // Notify checkers.
     for (const auto I : AfterRemovedDead)
-      getCheckerManager().runCheckersForEndFunction(BC, Dst, I, *this);
+      getCheckerManager().runCheckersForEndFunction(BC, Dst, I, *this, RS);
   } else {
-    getCheckerManager().runCheckersForEndFunction(BC, Dst, Pred, *this);
+    getCheckerManager().runCheckersForEndFunction(BC, Dst, Pred, *this, RS);
   }
 
   Engine.enqueueEndOfFunction(Dst, RS);
 }
 
 /// ProcessSwitch - Called by CoreEngine.  Used to generate successor
 ///  nodes by processing the 'effects' of a switch statement.
 void ExprEngine::processSwitch(SwitchNodeBuilder& builder) {