[analyzer] Rename trackNullOrUndefValue to trackExpressionValue

[george.karpenkov]

Summary

trackNullOrUndefValue is a long and confusing name,
and it does not actually reflect what the function is doing.
Give a function a new name, with a relatively clear semantics.

Also remove some dead code.

[NoQ]

I'd prefer to keep the word Value in the name, i.e. trackValue() or trackExpressionValue(). It just doesn't make much sense to track the expression itself or find its origin - instead, we're figuring out where did its value come from.

clang/include/clang/StaticAnalyzer/Core/BugReporter/BugReporterVisitors.h

350

Is this intended?

[Szelethus]

clang/include/clang/StaticAnalyzer/Core/BugReporter/BugReporterVisitors.h

348

Is it not the value of an expression?

[NoQ]

Let's commit? :)

clang/include/clang/StaticAnalyzer/Core/BugReporter/BugReporterVisitors.h

348

+1 :)

clang/include/clang/StaticAnalyzer/Core/BugReporter/BugReporterVisitors.h

std::shared_ptr<PathDiagnosticPiece> VisitNode(const ExplodedNode *N,
                                                  BugReport &BR) override;
 
   void finalizeVisitor(BugReporterContext &BRC, const ExplodedNode *EndPathNode,
                        BugReport &BR) override;
 };
 
 namespace bugreporter {
 
-/// Attempts to add visitors to trace a null or undefined value back to its
-/// point of origin, whether it is a symbol constrained to null or an explicit
-/// assignment.
+/// Attempts to add visitors to track expression back to its point of origin.
 ///
 /// \param N A node "downstream" from the evaluation of the statement.
-/// \param S The statement whose value is null or undefined.
+/// \param E The expression which we are finding
 /// \param R The bug report to which visitors should be attached.
 /// \param EnableNullFPSuppression Whether we should employ false positive
 ///         suppression (inlined defensive checks, returned null).
 ///
 /// \return Whether or not the function was able to add visitors for this
 ///         statement. Note that returning \c true does not actually imply
 ///         that any visitors were added.
-bool trackNullOrUndefValue(const ExplodedNode *N, const Stmt *S, BugReport &R,
-                           bool EnableNullFPSuppression = true);
+bool trackExpressionValue(const ExplodedNode *N, const Expr *E, BugReport &R,
 
 const Expr *getDerefExpr(const Stmt *S);
-const Stmt *GetDenomExpr(const ExplodedNode *N);
-const Stmt *GetRetValExpr(const ExplodedNode *N);
-bool isDeclRefExprToReference(const Expr *E);
 
 } // namespace bugreporter
 
 } // namespace ento
 
 } // namespace clang
 
 #endif // LLVM_CLANG_STATICANALYZER_CORE_BUGREPORTER_BUGREPORTERVISITORS_H

clang/lib/StaticAnalyzer/Checkers/BasicObjCFoundationChecks.cpp

void NilArgChecker::generateBugReport(ExplodedNode *N,
                                       SourceRange Range,
                                       const Expr *E,
                                       CheckerContext &C) const {
   if (!BT)
     BT.reset(new APIMisuse(this, "nil argument"));
 
   auto R = llvm::make_unique<BugReport>(*BT, Msg, N);
   R->addRange(Range);
-  bugreporter::trackNullOrUndefValue(N, E, *R);
+  bugreporter::trackExpressionValue(N, E, *R);
   C.emitReport(std::move(R));
 }
 
 void NilArgChecker::checkPreObjCMessage(const ObjCMethodCall &msg,
                                         CheckerContext &C) const {
   const ObjCInterfaceDecl *ID = msg.getReceiverInterface();
   if (!ID)
     return;
if (!stateNonNull) {
 
     SmallString<64> Str;
     raw_svector_ostream OS(Str);
     OS << "Null pointer argument in call to "
        << cast<FunctionDecl>(Call.getDecl())->getName();
 
     auto report = llvm::make_unique<BugReport>(BT, OS.str(), N);
     report->addRange(Call.getArgSourceRange(0));
-    bugreporter::trackNullOrUndefValue(N, Call.getArgExpr(0), *report);
+    bugreporter::trackExpressionValue(N, Call.getArgExpr(0), *report);
     C.emitReport(std::move(report));
     return;
   }
 
   // From here on, we know the argument is non-null.
   C.addTransition(stateNonNull);
 }
 

clang/lib/StaticAnalyzer/Checkers/CStringChecker.cpp

if (ExplodedNode *N = C.generateErrorNode(State)) {
     if (!BT_Null)
       BT_Null.reset(new BuiltinBug(
           Filter.CheckNameCStringNullArg, categories::UnixAPI,
           "Null pointer argument in call to byte string function"));
 
     BuiltinBug *BT = static_cast<BuiltinBug *>(BT_Null.get());
     auto Report = llvm::make_unique<BugReport>(*BT, WarningMsg, N);
     Report->addRange(S->getSourceRange());
-    bugreporter::trackNullOrUndefValue(N, S, *Report);
+    if (const auto *Ex = dyn_cast<Expr>(S))
+      bugreporter::trackExpressionValue(N, Ex, *Report);
     C.emitReport(std::move(Report));
   }
 }
 
 void CStringChecker::emitOutOfBoundsBug(CheckerContext &C,
                                         ProgramStateRef State, const Stmt *S,
                                         StringRef WarningMsg) const {
   if (ExplodedNode *N = C.generateErrorNode(State)) {

clang/lib/StaticAnalyzer/Checkers/CallAndMessageChecker.cpp

void CallAndMessageChecker::emitBadCall(BugType *BT, CheckerContext &C,
   if (!N)
     return;
 
   auto R = llvm::make_unique<BugReport>(*BT, BT->getName(), N);
   if (BadE) {
     R->addRange(BadE->getSourceRange());
     if (BadE->isGLValue())
       BadE = bugreporter::getDerefExpr(BadE);
-    bugreporter::trackNullOrUndefValue(N, BadE, *R);
+    bugreporter::trackExpressionValue(N, BadE, *R);
   }
   C.emitReport(std::move(R));
 }
 
 static void describeUninitializedArgumentInCall(const CallEvent &Call,
                                                 int ArgumentNumber,
                                                 llvm::raw_svector_ostream &Os) {
   switch (Call.getKind()) {
if (const MemRegion *SValMemRegion = V.getAsRegion()) {
     const ProgramStateRef State = C.getState();
     const SVal PSV = State->getSVal(SValMemRegion, C.getASTContext().CharTy);
     if (PSV.isUndef()) {
       if (ExplodedNode *N = C.generateErrorNode()) {
         LazyInit_BT(BD, BT);
         auto R = llvm::make_unique<BugReport>(*BT, Os.str(), N);
         R->addRange(ArgRange);
         if (ArgEx) {
-          bugreporter::trackNullOrUndefValue(N, ArgEx, *R);
+          bugreporter::trackExpressionValue(N, ArgEx, *R);
         }
         C.emitReport(std::move(R));
       }
       return true;
     }
   }
   return false;
 }
if (ExplodedNode *N = C.generateErrorNode()) {
       // Generate a report for this bug.
       SmallString<200> Buf;
       llvm::raw_svector_ostream Os(Buf);
       describeUninitializedArgumentInCall(Call, ArgumentNumber, Os);
       auto R = llvm::make_unique<BugReport>(*BT, Os.str(), N);
 
       R->addRange(ArgRange);
       if (ArgEx)
-        bugreporter::trackNullOrUndefValue(N, ArgEx, *R);
+        bugreporter::trackExpressionValue(N, ArgEx, *R);
       C.emitReport(std::move(R));
     }
     return true;
   }
 
   if (!CheckUninitFields)
     return false;
 
if (F.Find(D->getRegion())) {
           os << "')";
         }
 
         // Generate a report for this bug.
         auto R = llvm::make_unique<BugReport>(*BT, os.str(), N);
         R->addRange(ArgRange);
 
         if (ArgEx)
-          bugreporter::trackNullOrUndefValue(N, ArgEx, *R);
+          bugreporter::trackExpressionValue(N, ArgEx, *R);
         // FIXME: enhance track back for uninitialized value for arbitrary
         // memregions
         C.emitReport(std::move(R));
       }
       return true;
     }
   }
 
if (!BT_cxx_delete_undef)
       BT_cxx_delete_undef.reset(
           new BuiltinBug(this, "Uninitialized argument value"));
     if (DE->isArrayFormAsWritten())
       Desc = "Argument to 'delete[]' is uninitialized";
     else
       Desc = "Argument to 'delete' is uninitialized";
     BugType *BT = BT_cxx_delete_undef.get();
     auto R = llvm::make_unique<BugReport>(*BT, Desc, N);
-    bugreporter::trackNullOrUndefValue(N, DE, *R);
+    bugreporter::trackExpressionValue(N, DE, *R);
     C.emitReport(std::move(R));
     return;
   }
 }
 
 void CallAndMessageChecker::checkPreCall(const CallEvent &Call,
                                          CheckerContext &C) const {
   ProgramStateRef State = C.getState();
if (ExplodedNode *N = C.generateErrorNode()) {
       assert(BT && "Unknown message kind.");
 
       auto R = llvm::make_unique<BugReport>(*BT, BT->getName(), N);
       const ObjCMessageExpr *ME = msg.getOriginExpr();
       R->addRange(ME->getReceiverRange());
 
       // FIXME: getTrackNullOrUndefValueVisitor can't handle "super" yet.
       if (const Expr *ReceiverE = ME->getInstanceReceiver())
-        bugreporter::trackNullOrUndefValue(N, ReceiverE, *R);
+        bugreporter::trackExpressionValue(N, ReceiverE, *R);
       C.emitReport(std::move(R));
     }
     return;
   }
 }
 
 void CallAndMessageChecker::checkObjCMessageNil(const ObjCMethodCall &msg,
                                                 CheckerContext &C) const {
if (ResTy->isReferenceType()) {
     msg.getResultType().print(os, C.getLangOpts());
     os << "' that will be garbage";
   }
 
   auto report = llvm::make_unique<BugReport>(*BT_msg_ret, os.str(), N);
   report->addRange(ME->getReceiverRange());
   // FIXME: This won't track "self" in messages to super.
   if (const Expr *receiver = ME->getInstanceReceiver()) {
-    bugreporter::trackNullOrUndefValue(N, receiver, *report);
+    bugreporter::trackExpressionValue(N, receiver, *report);
   }
   C.emitReport(std::move(report));
 }
 
 static bool supportsNilWithFloatRet(const llvm::Triple &triple) {
   return (triple.getVendor() == llvm::Triple::Apple &&
           (triple.isiOS() || triple.isWatchOS() ||
            !triple.isMacOSXVersionLT(10,5)));

clang/lib/StaticAnalyzer/Checkers/DereferenceChecker.cpp

static const Expr *getDereferenceExpr(const Stmt *S, bool IsBind=false){
   return E;
 }
 
 static bool suppressReport(const Expr *E) {
   // Do not report dereferences on memory in non-default address spaces.
   return E->getType().getQualifiers().hasAddressSpace();
 }
 
+static bool isDeclRefExprToReference(const Expr *E) {
+  if (const auto *DRE = dyn_cast<DeclRefExpr>(E))
+    return DRE->getDecl()->getType()->isReferenceType();
+  return false;
+}
+
 void DereferenceChecker::reportBug(ProgramStateRef State, const Stmt *S,
                                    CheckerContext &C) const {
   // Generate an error node.
   ExplodedNode *N = C.generateErrorNode(State);
   if (!N)
     return;
 
   // We know that 'location' cannot be non-null.  This is what
case Stmt::UnaryOperatorClass: {
     os << "Dereference of null pointer";
     const UnaryOperator *U = cast<UnaryOperator>(S);
     AddDerefSource(os, Ranges, U->getSubExpr()->IgnoreParens(),
                    State.get(), N->getLocationContext(), true);
     break;
   }
   case Stmt::MemberExprClass: {
     const MemberExpr *M = cast<MemberExpr>(S);
-    if (M->isArrow() || bugreporter::isDeclRefExprToReference(M->getBase())) {
+    if (M->isArrow() || isDeclRefExprToReference(M->getBase())) {
       os << "Access to field '" << M->getMemberNameInfo()
          << "' results in a dereference of a null pointer";
       AddDerefSource(os, Ranges, M->getBase()->IgnoreParenCasts(),
                      State.get(), N->getLocationContext(), true);
     }
     break;
   }
   case Stmt::ObjCIvarRefExprClass: {
     const ObjCIvarRefExpr *IV = cast<ObjCIvarRefExpr>(S);
     os << "Access to instance variable '" << *IV->getDecl()
        << "' results in a dereference of a null pointer";
     AddDerefSource(os, Ranges, IV->getBase()->IgnoreParenCasts(),
                    State.get(), N->getLocationContext(), true);
     break;
   }
   default:
     break;
   }
 
   auto report = llvm::make_unique<BugReport>(
       *BT_null, buf.empty() ? BT_null->getDescription() : StringRef(buf), N);
 
-  bugreporter::trackNullOrUndefValue(N, bugreporter::getDerefExpr(S), *report);
+  bugreporter::trackExpressionValue(N, bugreporter::getDerefExpr(S), *report);
 
   for (SmallVectorImpl<SourceRange>::iterator
        I = Ranges.begin(), E = Ranges.end(); I!=E; ++I)
     report->addRange(*I);
 
   C.emitReport(std::move(report));
 }
 
 void DereferenceChecker::checkLocation(SVal l, bool isLoad, const Stmt* S,
                                        CheckerContext &C) const {
   // Check for dereference of an undefined value.
   if (l.isUndef()) {
     if (ExplodedNode *N = C.generateErrorNode()) {
       if (!BT_undef)
         BT_undef.reset(
             new BuiltinBug(this, "Dereference of undefined pointer value"));
 
       auto report =
           llvm::make_unique<BugReport>(*BT_undef, BT_undef->getDescription(), N);
-      bugreporter::trackNullOrUndefValue(N, bugreporter::getDerefExpr(S),
-                                         *report);
+      bugreporter::trackExpressionValue(N, bugreporter::getDerefExpr(S), *report);
       C.emitReport(std::move(report));
     }
     return;
   }
 
   DefinedOrUnknownSVal location = l.castAs<DefinedOrUnknownSVal>();
 
   // Check for null dereferences.

clang/lib/StaticAnalyzer/Checkers/DivZeroChecker.cpp

class DivZeroChecker : public Checker< check::PreStmt<BinaryOperator> > {
   void reportBug(const char *Msg, ProgramStateRef StateZero, CheckerContext &C,
                  std::unique_ptr<BugReporterVisitor> Visitor = nullptr) const;
 
 public:
   void checkPreStmt(const BinaryOperator *B, CheckerContext &C) const;
 };
 } // end anonymous namespace
 
+static const Expr *getDenomExpr(const ExplodedNode *N) {
+  const Stmt *S = N->getLocationAs<PreStmt>()->getStmt();
+  if (const auto *BE = dyn_cast<BinaryOperator>(S))
+    return BE->getRHS();
+  return nullptr;
+}
+
 void DivZeroChecker::reportBug(
     const char *Msg, ProgramStateRef StateZero, CheckerContext &C,
     std::unique_ptr<BugReporterVisitor> Visitor) const {
   if (ExplodedNode *N = C.generateErrorNode(StateZero)) {
     if (!BT)
       BT.reset(new BuiltinBug(this, "Division by zero"));
 
     auto R = llvm::make_unique<BugReport>(*BT, Msg, N);
     R->addVisitor(std::move(Visitor));
-    bugreporter::trackNullOrUndefValue(N, bugreporter::GetDenomExpr(N), *R);
+    bugreporter::trackExpressionValue(N, getDenomExpr(N), *R);
     C.emitReport(std::move(R));
   }
 }
 
 void DivZeroChecker::checkPreStmt(const BinaryOperator *B,
                                   CheckerContext &C) const {
   BinaryOperator::Opcode Op = B->getOpcode();
   if (Op != BO_Div &&

clang/lib/StaticAnalyzer/Checkers/NonNullParamChecker.cpp

NonNullParamChecker::genReportNullAttrNonNull(const ExplodedNode *ErrorNode,
   if (!BTAttrNonNull)
     BTAttrNonNull.reset(new BugType(
         this, "Argument with 'nonnull' attribute passed null", "API"));
 
   auto R = llvm::make_unique<BugReport>(
       *BTAttrNonNull,
       "Null pointer passed as an argument to a 'nonnull' parameter", ErrorNode);
   if (ArgE)
-    bugreporter::trackNullOrUndefValue(ErrorNode, ArgE, *R);
+    bugreporter::trackExpressionValue(ErrorNode, ArgE, *R);
 
   return R;
 }
 
 std::unique_ptr<BugReport> NonNullParamChecker::genReportReferenceToNullPointer(
     const ExplodedNode *ErrorNode, const Expr *ArgE) const {
   if (!BTNullRefArg)
     BTNullRefArg.reset(new BuiltinBug(this, "Dereference of null pointer"));
 
   auto R = llvm::make_unique<BugReport>(
       *BTNullRefArg, "Forming reference to null pointer", ErrorNode);
   if (ArgE) {
     const Expr *ArgEDeref = bugreporter::getDerefExpr(ArgE);
     if (!ArgEDeref)
       ArgEDeref = ArgE;
-    bugreporter::trackNullOrUndefValue(ErrorNode,
-                                       ArgEDeref,
-                                       *R);
+    bugreporter::trackExpressionValue(ErrorNode, ArgEDeref, *R);
   }
   return R;
 
 }
 
 void ento::registerNonNullParamChecker(CheckerManager &mgr) {
   mgr.registerChecker<NonNullParamChecker>();
 }

clang/lib/StaticAnalyzer/Checkers/NullabilityChecker.cpp

if (Region) {
       R->markInteresting(Region);
       R->addVisitor(llvm::make_unique<NullabilityBugVisitor>(Region));
     }
     if (ValueExpr) {
       R->addRange(ValueExpr->getSourceRange());
       if (Error == ErrorKind::NilAssignedToNonnull ||
           Error == ErrorKind::NilPassedToNonnull ||
           Error == ErrorKind::NilReturnedToNonnull)
-        bugreporter::trackNullOrUndefValue(N, ValueExpr, *R);
+        if (const auto *Ex = dyn_cast<Expr>(ValueExpr))
+          bugreporter::trackExpressionValue(N, Ex, *R);
     }
     BR.emitReport(std::move(R));
   }
 
   /// If an SVal wraps a region that should be tracked, it will return a pointer
   /// to the wrapped region. Otherwise it will return a nullptr.
   const SymbolicRegion *getTrackRegion(SVal Val,
                                        bool CheckSuperRegion = false) const;

clang/lib/StaticAnalyzer/Checkers/ObjCAtSyncChecker.cpp

void ObjCAtSyncChecker::checkPreStmt(const ObjCAtSynchronizedStmt *S,
   // Uninitialized value used for the mutex?
   if (V.getAs<UndefinedVal>()) {
     if (ExplodedNode *N = C.generateErrorNode()) {
       if (!BT_undef)
         BT_undef.reset(new BuiltinBug(this, "Uninitialized value used as mutex "
                                             "for @synchronized"));
       auto report =
           llvm::make_unique<BugReport>(*BT_undef, BT_undef->getDescription(), N);
-      bugreporter::trackNullOrUndefValue(N, Ex, *report);
+      bugreporter::trackExpressionValue(N, Ex, *report);
       C.emitReport(std::move(report));
     }
     return;
   }
 
   if (V.isUnknown())
     return;
 
   // Check for null mutexes.
   ProgramStateRef notNullState, nullState;
   std::tie(notNullState, nullState) = state->assume(V.castAs<DefinedSVal>());
 
   if (nullState) {
     if (!notNullState) {
       // Generate an error node.  This isn't a sink since
       // a null mutex just means no synchronization occurs.
       if (ExplodedNode *N = C.generateNonFatalErrorNode(nullState)) {
         if (!BT_null)
           BT_null.reset(new BuiltinBug(
               this, "Nil value used as mutex for @synchronized() "
                     "(no synchronization will occur)"));
         auto report =
             llvm::make_unique<BugReport>(*BT_null, BT_null->getDescription(), N);
-        bugreporter::trackNullOrUndefValue(N, Ex, *report);
+        bugreporter::trackExpressionValue(N, Ex, *report);
 
         C.emitReport(std::move(report));
         return;
       }
     }
     // Don't add a transition for 'nullState'.  If the value is
     // under-constrained to be null or non-null, assume it is non-null
     // afterwards.

clang/lib/StaticAnalyzer/Checkers/ReturnUndefChecker.cpp

static void emitBug(CheckerContext &C, BuiltinBug &BT, const Expr *RetE,
                     const Expr *TrackingE = nullptr) {
   ExplodedNode *N = C.generateErrorNode();
   if (!N)
     return;
 
   auto Report = llvm::make_unique<BugReport>(BT, BT.getDescription(), N);
 
   Report->addRange(RetE->getSourceRange());
-  bugreporter::trackNullOrUndefValue(N, TrackingE ? TrackingE : RetE, *Report);
+  bugreporter::trackExpressionValue(N, TrackingE ? TrackingE : RetE, *Report);
 
   C.emitReport(std::move(Report));
 }
 
 void ReturnUndefChecker::emitUndef(CheckerContext &C, const Expr *RetE) const {
   if (!BT_Undef)
     BT_Undef.reset(
         new BuiltinBug(this, "Garbage return value",

clang/lib/StaticAnalyzer/Checkers/UndefBranchChecker.cpp

if (N) {
         if (PS->getStmt() == Ex)
           St = PrevN->getState();
 
       FindUndefExpr FindIt(St, Ctx.getLocationContext());
       Ex = FindIt.FindExpr(Ex);
 
       // Emit the bug report.
       auto R = llvm::make_unique<BugReport>(*BT, BT->getDescription(), N);
-      bugreporter::trackNullOrUndefValue(N, Ex, *R);
+      bugreporter::trackExpressionValue(N, Ex, *R);
       R->addRange(Ex->getSourceRange());
 
       Ctx.emitReport(std::move(R));
     }
   }
 }
 
 void ento::registerUndefBranchChecker(CheckerManager &mgr) {
   mgr.registerChecker<UndefBranchChecker>();
 }

clang/lib/StaticAnalyzer/Checkers/UndefResultChecker.cpp

if (Ex) {
         OS << "The result of the '"
            << BinaryOperator::getOpcodeStr(B->getOpcode())
            << "' expression is undefined";
       }
     }
     auto report = llvm::make_unique<BugReport>(*BT, OS.str(), N);
     if (Ex) {
       report->addRange(Ex->getSourceRange());
-      bugreporter::trackNullOrUndefValue(N, Ex, *report);
+      bugreporter::trackExpressionValue(N, Ex, *report);
     }
     else
-      bugreporter::trackNullOrUndefValue(N, B, *report);
+      bugreporter::trackExpressionValue(N, B, *report);
 
     C.emitReport(std::move(report));
   }
 }
 
 void ento::registerUndefResultChecker(CheckerManager &mgr) {
   mgr.registerChecker<UndefResultChecker>();
 }

clang/lib/StaticAnalyzer/Checkers/UndefinedArraySubscriptChecker.cpp

UndefinedArraySubscriptChecker::checkPreStmt(const ArraySubscriptExpr *A,
   if (!N)
     return;
   if (!BT)
     BT.reset(new BuiltinBug(this, "Array subscript is undefined"));
 
   // Generate a report for this bug.
   auto R = llvm::make_unique<BugReport>(*BT, BT->getName(), N);
   R->addRange(A->getIdx()->getSourceRange());
-  bugreporter::trackNullOrUndefValue(N, A->getIdx(), *R);
+  bugreporter::trackExpressionValue(N, A->getIdx(), *R);
   C.emitReport(std::move(R));
 }
 
 void ento::registerUndefinedArraySubscriptChecker(CheckerManager &mgr) {
   mgr.registerChecker<UndefinedArraySubscriptChecker>();
 }

clang/lib/StaticAnalyzer/Checkers/UndefinedAssignmentChecker.cpp

void UndefinedAssignmentChecker::checkBind(SVal location, SVal val,
   }
 
   if (OS.str().empty())
     OS << DefaultMsg;
 
   auto R = llvm::make_unique<BugReport>(*BT, OS.str(), N);
   if (ex) {
     R->addRange(ex->getSourceRange());
-    bugreporter::trackNullOrUndefValue(N, ex, *R);
+    bugreporter::trackExpressionValue(N, ex, *R);
   }
   C.emitReport(std::move(R));
 }
 
 void ento::registerUndefinedAssignmentChecker(CheckerManager &mgr) {
   mgr.registerChecker<UndefinedAssignmentChecker>();
 }

clang/lib/StaticAnalyzer/Checkers/UnixAPIChecker.cpp

LazyInitialize(BT_mallocZero,
                  "Undefined allocation of 0 bytes (CERT MEM04-C; CWE-131)");
 
   SmallString<256> S;
   llvm::raw_svector_ostream os(S);
   os << "Call to '" << fn_name << "' has an allocation size of 0 bytes";
   auto report = llvm::make_unique<BugReport>(*BT_mallocZero, os.str(), N);
 
   report->addRange(arg->getSourceRange());
-  bugreporter::trackNullOrUndefValue(N, arg, *report);
+  bugreporter::trackExpressionValue(N, arg, *report);
   C.emitReport(std::move(report));
 
   return true;
 }
 
 // Does a basic check for 0-sized allocations suitable for most of the below
 // functions (modulo "calloc")
 void UnixAPIChecker::BasicAllocationCheck(CheckerContext &C,

clang/lib/StaticAnalyzer/Checkers/VLASizeChecker.cpp

void VLASizeChecker::reportBug(
   case VLA_Negative:
     os << "has negative size";
     break;
   }
 
   auto report = llvm::make_unique<BugReport>(*BT, os.str(), N);
   report->addVisitor(std::move(Visitor));
   report->addRange(SizeE->getSourceRange());
-  bugreporter::trackNullOrUndefValue(N, SizeE, *report);
+  bugreporter::trackExpressionValue(N, SizeE, *report);
   C.emitReport(std::move(report));
 }
 
 void VLASizeChecker::checkPreStmt(const DeclStmt *DS, CheckerContext &C) const {
   if (!DS->isSingleDecl())
     return;
 
   const VarDecl *VD = dyn_cast<VarDecl>(DS->getSingleDecl());

clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

 
 using namespace clang;
 using namespace ento;
 
 //===----------------------------------------------------------------------===//
 // Utility functions.
 //===----------------------------------------------------------------------===//
 
-bool bugreporter::isDeclRefExprToReference(const Expr *E) {
-  if (const auto *DRE = dyn_cast<DeclRefExpr>(E))
-    return DRE->getDecl()->getType()->isReferenceType();
-  return false;
-}
-
 static const Expr *peelOffPointerArithmetic(const BinaryOperator *B) {
   if (B->isAdditiveOp() && B->getType()->isPointerType()) {
     if (B->getLHS()->getType()->isPointerType()) {
       return B->getLHS();
     } else if (B->getRHS()->getType()->isPointerType()) {
       return B->getRHS();
     }
   }
const Expr *bugreporter::getDerefExpr(const Stmt *S) {
   // our pointer rvalue was loaded.
   if (const auto *CE = dyn_cast<ImplicitCastExpr>(E))
     if (CE->getCastKind() == CK_LValueToRValue)
       E = CE->getSubExpr();
 
   return E;
 }
 
-const Stmt *bugreporter::GetDenomExpr(const ExplodedNode *N) {
-  const Stmt *S = N->getLocationAs<PreStmt>()->getStmt();
-  if (const auto *BE = dyn_cast<BinaryOperator>(S))
-    return BE->getRHS();
-  return nullptr;
-}
-
-const Stmt *bugreporter::GetRetValExpr(const ExplodedNode *N) {
-  const Stmt *S = N->getLocationAs<PostStmt>()->getStmt();
-  if (const auto *RS = dyn_cast<ReturnStmt>(S))
-    return RS->getRetValue();
-  return nullptr;
-}
-
 //===----------------------------------------------------------------------===//
 // Definitions for bug reporter visitors.
 //===----------------------------------------------------------------------===//
 
 std::shared_ptr<PathDiagnosticPiece>
 BugReporterVisitor::getEndPath(BugReporterContext &,
                                const ExplodedNode *, BugReport &) {
   return nullptr;
visitNodeInitial(const ExplodedNode *N,
     // Ignore aggregate rvalues.
     if (V.getAs<nonloc::LazyCompoundVal>() ||
         V.getAs<nonloc::CompoundVal>())
       return nullptr;
 
     RetE = RetE->IgnoreParenCasts();
 
     // If we're returning 0, we should track where that 0 came from.
-    bugreporter::trackNullOrUndefValue(N, RetE, BR, EnableNullFPSuppression);
+    bugreporter::trackExpressionValue(N, RetE, BR, EnableNullFPSuppression);
 
     // Build an appropriate message based on the return value.
     SmallString<64> Msg;
     llvm::raw_svector_ostream Out(Msg);
 
     if (State->isNull(V).isConstrainedTrue()) {
       if (V.getAs<Loc>()) {
 
for (unsigned I = 0, E = Call->getNumArgs(); I != E; ++I) {
       const Expr *ArgE = Call->getArgExpr(I);
       if (!ArgE)
         continue;
 
       // Is it possible for this argument to be non-null?
       if (!State->isNull(*ArgV).isConstrainedTrue())
         continue;
 
-      if (bugreporter::trackNullOrUndefValue(N, ArgE, BR,
-                                             EnableNullFPSuppression))
+      if (bugreporter::trackExpressionValue(N, ArgE, BR, EnableNullFPSuppression))
         ShouldInvalidate = false;
 
       // If we /can't/ track the null pointer, we should err on the side of
       // false negatives, and continue towards marking this report invalid.
       // (We will still look at the other arguments, though.)
     }
 
     return nullptr;
FindLastStoreBRVisitor::VisitNode(const ExplodedNode *Succ,
 
   // If we have an expression that provided the value, try to track where it
   // came from.
   if (InitE) {
     if (V.isUndef() ||
         V.getAs<loc::ConcreteInt>() || V.getAs<nonloc::ConcreteInt>()) {
       if (!IsParam)
         InitE = InitE->IgnoreParenCasts();
-      bugreporter::trackNullOrUndefValue(StoreSite, InitE, BR,
-                                         EnableNullFPSuppression);
+      bugreporter::trackExpressionValue(StoreSite, InitE, BR,
     }
     ReturnVisitor::addVisitorIfNecessary(StoreSite, InitE->IgnoreParenCasts(),
                                          BR, EnableNullFPSuppression);
   }
 
   // Okay, we've found the binding. Emit an appropriate message.
   SmallString<256> sbuf;
   llvm::raw_svector_ostream os(sbuf);
static const ExplodedNode* findNodeForExpression(const ExplodedNode *N,
   while (N) {
     if (PathDiagnosticLocation::getStmt(N) == Inner)
       return N;
     N = N->getFirstPred();
   }
   return N;
 }
 
-bool bugreporter::trackNullOrUndefValue(const ExplodedNode *InputNode,
-                                        const Stmt *InputS,
-                                        BugReport &report,
-                                        bool EnableNullFPSuppression) {
-  if (!InputS || !InputNode || !isa<Expr>(InputS))
+bool bugreporter::trackExpressionValue(const ExplodedNode *InputNode,
+                                  const Expr *E,
+  if (!E || !InputNode)
     return false;
 
-  const Expr *Inner = peelOffOuterExpr(cast<Expr>(InputS), InputNode);
+  const Expr *Inner = peelOffOuterExpr(E, InputNode);
   const ExplodedNode *LVNode = findNodeForExpression(InputNode, Inner);
   if (!LVNode)
     return false;
 
   ProgramStateRef LVState = LVNode->getState();
 
   // The message send could be nil due to the receiver being nil.
   // At this point in the path, the receiver should be live since we are at the
   // message send expr. If it is nil, start tracking it.
   if (const Expr *Receiver = NilReceiverBRVisitor::getNilReceiver(Inner, LVNode))
-    trackNullOrUndefValue(LVNode, Receiver, report, EnableNullFPSuppression);
+    trackExpressionValue(LVNode, Receiver, report, EnableNullFPSuppression);
 
   // See if the expression we're interested refers to a variable.
   // If so, we can track both its contents and constraints on its value.
   if (Inner && ExplodedGraph::isInterestingLValueExpr(Inner)) {
     SVal LVal = LVNode->getSVal(Inner);
 
     const MemRegion *RR = getLocationRegionIfReference(Inner, LVNode);
     bool LVIsNull = LVState->isNull(LVal).isConstrainedTrue();
NilReceiverBRVisitor::VisitNode(const ExplodedNode *N,
   else {
     OS << "No method is called";
   }
   OS << " because the receiver is nil";
 
   // The receiver was nil, and hence the method was skipped.
   // Register a BugReporterVisitor to issue a message telling us how
   // the receiver was null.
-  bugreporter::trackNullOrUndefValue(N, Receiver, BR,
-                                     /*EnableNullFPSuppression*/ false);
+  bugreporter::trackExpressionValue(N, Receiver, BR,
   // Issue a message saying that the method was skipped.
   PathDiagnosticLocation L(Receiver, BRC.getSourceManager(),
                                      N->getLocationContext());
   return std::make_shared<PathDiagnosticEventPiece>(L, OS.str());
 }
 
 // Registers every VarDecl inside a Stmt with a last store visitor.
 void FindLastStoreBRVisitor::registerStatementVarDecls(BugReport &BR,