[analyzer][MallocChecker][NFC] Document and reorganize some functions

[Szelethus]

Summary

I'm in the process of splitting this checker into multiple other ones, and while I was there, I provided documentation to most functions, and made some static, and in some cases moved them out of class.

This patch merely reorganizes some things, and features no functional change.

In detail:

• Provided documentation, or moved existing documentation in more obvious places.
• Added dividers. (the //===----------===// thing).
• Moved getAllocationFamily, printAllocDeallocName, printExpectedAllocName and printExpectedDeallocName in the global namespace on top of the file where AllocationFamily is declared, as they are very strongly related.
• Moved isReleased and MallocUpdateRefState near RefState's definition for the same reason.
• Realloc modeling was very poor in terms of variable and structure naming, as well as documentation, so I renamed some of them and added much needed docs.
• Moved function IdentifierInfos to a separate struct, and moved isMemFunction, isCMemFunction adn isStandardNewDelete inside it. This makes the patch affect quite a lot of lines, should I extract it to a separate one?
• Moved MallocBugVisitor out of MallocChecker.
• Preferred switches to long else-if branches in some places.
• Neatly organized some RUN: lines.

[Szelethus]

I also have some cool ideas how the split up should go, but I'd like to mature the idea in my head for just a bit longer.

lib/StaticAnalyzer/Checkers/MallocChecker.cpp

24–27

Source: https://reviews.llvm.org/D7905

242–245

Source: http://lists.llvm.org/pipermail/cfe-dev/2018-November/060216.html

432–440

Source:
http://lists.llvm.org/pipermail/cfe-dev/2010-June/009600.html
https://github.com/llvm-mirror/clang/commit/dd0e490c24aeade2c59ca4cae171199f6af9f02e

1355–1359

Source:
https://bugs.llvm.org/show_bug.cgi?id=19102
https://reviews.llvm.org/D4025

[MTC]

Thank you for doing the cleaning that no one else is interested in! Comments is inline below.

lib/StaticAnalyzer/Checkers/MallocChecker.cpp

349

I can't say that abstracting MemFunctionInfo is a perfect solution, for example IsOptimistic and ShouldIncludeOwnershipAnnotatedFunctions are close to each other in the object layout, but they do the same thing, which makes me feel weird. And there are so many MemFunctionInfo. :)

419

CE typo?

425

Personally, ProcessZeroAllocation is like half the story, maybe ProcessZeroAllocCheck or ProcessZeroAllocationCheck is better.

445

Maybe program state or just ProgramState is better?
Same as 462, 476, 507, 575, 593.

589

before realloction typo?

1084

If I not wrong, MemFunctionInfo is mainly a class member of MallocChecker that hold a bunch of memory function identifiers and provide corresponding helper APIs. And we should pick a proper time to initialize it.

I want to known why you call initIdentifierInfo() in checkPostStmt(const CallExpr *E,), this callback is called after checkPreCall(const CallEvent &Call, ) in which we need MemFunctionInfo.

1244

const qualifier missing?

1321

I'm not sure hasNonTrivialConstructorCall() is a good name although you explained it in details in the comments below. And the comments for this function is difficult for me to understand, which is maybe my problem.

And I also think this function doesn't do as much as described in the comments, it is just true if the invoked constructor in \p NE has a parameter - pointer or reference to a record, right?

2403

The parameter name ShouldFreeOnFail is not consistent with the declaration, see line 577.

[Szelethus]

And thank you for helping me along the way! :D

lib/StaticAnalyzer/Checkers/MallocChecker.cpp

349

Well the thinking here was that MallocChecker is seriously overcrowded -- it's a one-tool-to-solve-everything class, and moving these IdentifierInfos in their separate class was pretty much the first step I took: I think it encapsulates a particular task well and eases a lot on MallocChecker. Sure MemFunctionInfo. is reduntant, but each time you see it, it indicates that we're calling a function or using a data member that has no effect on the actual analysis, that we're inquiring about more information about a given function. and nothing more. For a checker that emits warning at seemingly random places wherever, I think this is valuable.

By the way, it also forces almost all similar conditions in a separate line, which is an unexpected, but pleasant help to the untrained eye:

if (Fun == MemFunctionInfo.II_malloc ||
    Fun == MemFunctionInfo.II_whatever)

Nevertheless, this is the only change I'm not 100% confident about, if you and/or others disagree, I'll happily revert it.

349

(leaving a separate inline for a separate topic)
The was this checker abuses checker options isn't nice at all, I agree. I could just rename MallocChecker::IsOptimistic to MallocChecker::ShouldIncludeOwnershipAnnotatedFunctions, and have it passed around as a parameter in MemFunctionInfoTy. Would you prefer that, should you be okay with MemFunctionInfoTy in general?

1084

Well, I'd like to know too! I think lazy initializing this struct creates more problems that it solves, but I wanted to draw a line somewhere in terms of how invasive I'd like to make this patch.

1244

This method was made static.

1321

I admit that I copy-pasted this from the source I provided below, and I overlooked it before posting it here. I very much prefer what you proposed :)

[Szelethus]

lib/StaticAnalyzer/Checkers/MallocChecker.cpp

349

The way* this checker abuses

[MTC]

lib/StaticAnalyzer/Checkers/MallocChecker.cpp

349

Easier said than done :). I have no objection to this change, but I think merge IsOptimistic and ShouldIncludeOwnershipAnnotatedFunctions together is a good idea. This option seems from gabor, he may have new ideas.

1084

How about put the initialization stuff into constructor? Let the constructor do the initialization that it should do, let register*() do its registration, like setting setOptimism and so on.

1244

You are right, sorry for my oversight!

1321

The comments you provided is from the summary of the patch D4025, ayartsev has not updated the summary information in time to adapt to his patch, so I think it is appropriate to extract the summary information when he submitted this patch, see [[ https://github.com/llvm-mirror/clang/commit/2e61d2893934f7b91ca9e2f889a4e4cc9939b05c#diff-ff9160d4628cb9b6186559837c2c8668 | [Analyzer] fix for PR19102 ]]. What do you think?

[Szelethus]

lib/StaticAnalyzer/Checkers/MallocChecker.cpp

1084

Interestingly, MemFunctionInfo is not always initialized, so a performance argument can be made here. I specifically checked whether there's any point in doing this hackery, and the answer is... well, some. I'll probably touch on these in a followup patch.

1244

Actually, I forgot about it 10 times when I re-read the patch, no shame in that :)

1321

Wow, nice detective work there :D Sounds good to me.

[NoQ]

Yay. Wow. Cool. Thanks.

I heard that previously there was an explicit desire to avoid doxygen comments in checkers because they're quite useless because the checker is usually all in one file and doesn't have any clients that are interested in calling its methods directly.

But now that our checkers are split into files and start interacting with each other, this argument no longer holds.

So, well, thanks a lot.

lib/StaticAnalyzer/Checkers/MallocChecker.cpp

16

it's its

23

it's its

283–300

Not now of course, but see also D45458. It'd be great to have call descriptions here, so that it looked like

CallDescription alloca("alloca"),
                win_alloca("win_alloca"),
                malloc("malloc"),
                // ...

..and no initialization necessary later.

(we can even wrap them into a macro so that we didn't have to write names twice).

419

Looks fine. It's the name of the parameter in the doxygen syntax.

589

Seems fine.

1084

Lazy initialization of identifiers is kinda perceived as a fairly worthless optimization. Hence CallDescription.

Also it cannot be done during registration because the AST is not constructed yet at this point. Well, probably it can be done anyway because the empty identifier table is already there in the ASTContext and we can always eagerly add a few items into it, but it still sounds scary.

[Szelethus]

Addressing inline comments.

[Szelethus]

lib/StaticAnalyzer/Checkers/MallocChecker.cpp

1084

I would personally prefer to risk initializing these during registration, but if we're this many comments into this discussion, then I believe it deserves a separate patch.

I'll leave a TODO: in the code.

1321

Umm, yea, I really couldn't come up with a better name. Hopefully the comments both here and at the call site help on this.

[Szelethus]

lib/StaticAnalyzer/Checkers/MallocChecker.cpp

1084

Or just go with CallDescription.

[Szelethus]

Woops, forgot to fix the doc of deallocation functions.

[Szelethus]

Reverted in rC349344.

[Szelethus]

Lit test failures are gone for Windows after reverting this. Will probably deal with this revision after 8.0.0.

[Szelethus]

cfe/trunk/lib/StaticAnalyzer/Checkers/MallocChecker.cpp

3090 ↗

(On Diff #178371)

Praise clangd! This is why the buildbots broke :) checkIfNewOrNewArrayFamily doesn't return false in all cases.

[Szelethus]

Rebase, fix (suspected) error that caused buildbot errors. Hold off commiting in favor checking whether putting CallDescriptionMap in would be too invasive, but really, can't be worse then it already is.

[Szelethus]

In D54823#1675352, @Szelethus wrote:

Rebase, fix (suspected) error that caused buildbot errors. Hold off commiting in favor checking whether putting CallDescriptionMap in would be too invasive, but really, can't be worse then it already is.

Nope. It implies far too heavy changes. I'll land this as is, but will wait a bit as its been a while since the acceptance.

[NoQ]

Is it just me or phabricator somehow refuses to display the changes since the last diff here? That's probably the commit diff is involved somehow. So i'm confused what exactly has changed >.<

[Szelethus]

In D54823#1675604, @NoQ wrote:

Is it just me or phabricator somehow refuses to display the changes since the last diff here? That's probably the commit diff is involved somehow. So i'm confused what exactly has changed >.<

File name change, I'm using the monorepo now.

clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp

3137 ↗

(On Diff #220873)

This was the change.

[Szelethus]

In retrospect, I would have made this patch a little more fragmented (its almost a year old, does it beat the revival of the symbolreaper patch?), but it would be a painful chore to separate at this point, if you dont mind. I have a couple more cooking in the cauldron that are more digestible, so, lesson learned :)

[Szelethus]

Welp, windows builtbots broke again. I'll try to see whats wrong with undef sanitizer, but fear this will end up in a revert.

http://lab.llvm.org:8011/builders/llvm-clang-x86_64-expensive-checks-win/builds/19769/steps/test-check-all/logs/stdio

******************** TEST 'Clang :: Analysis/MismatchedDeallocator-path-notes.cpp' FAILED ********************
Script:
--
: 'RUN: at line 1';   c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\build\bin\clang.exe -cc1 -internal-isystem c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\build\lib\clang\10.0.0\include -nostdsysteminc -analyze -analyzer-constraints=range -analyzer-checker=core,unix.MismatchedDeallocator -analyzer-output=text -verify C:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\test\Analysis\MismatchedDeallocator-path-notes.cpp
: 'RUN: at line 2';   c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\build\bin\clang.exe -cc1 -internal-isystem c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\build\lib\clang\10.0.0\include -nostdsysteminc -analyze -analyzer-constraints=range -analyzer-checker=core,unix.MismatchedDeallocator -analyzer-output=plist C:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\test\Analysis\MismatchedDeallocator-path-notes.cpp -o C:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\build\tools\clang\test\Analysis\Output\MismatchedDeallocator-path-notes.cpp.tmp.plist
: 'RUN: at line 3';   tail -n +11 C:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\build\tools\clang\test\Analysis\Output\MismatchedDeallocator-path-notes.cpp.tmp.plist | grep -Ev '^[[:space:]]*<string>.* version .*</string>[[:space:]]*$|^[[:space:]]*<string>/.*</string>[[:space:]]*$|^[[:space:]]*<string>.:.*</string>[[:space:]]*$' | diff -ub C:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\test\Analysis/copypaste/Inputs/expected-plists/MismatchedDeallocator-path-notes.cpp.plist -
--
Exit Code: 1

Command Output (stdout):
--
$ ":" "RUN: at line 1"
$ "c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\build\bin\clang.exe" "-cc1" "-internal-isystem" "c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\build\lib\clang\10.0.0\include" "-nostdsysteminc" "-analyze" "-analyzer-constraints=range" "-analyzer-checker=core,unix.MismatchedDeallocator" "-analyzer-output=text" "-verify" "C:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\test\Analysis\MismatchedDeallocator-path-notes.cpp"
# command stderr:
error: 'warning' diagnostics expected but not seen: 

  File C:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\test\Analysis\MismatchedDeallocator-path-notes.cpp Line 13: Memory allocated by 'new[]' should be deallocated by 'delete[]', not 'delete'

error: 'note' diagnostics expected but not seen: 

  File C:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\test\Analysis\MismatchedDeallocator-path-notes.cpp Line 7: Memory is allocated

  File C:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\test\Analysis\MismatchedDeallocator-path-notes.cpp Line 10: Calling 'allocIntArray'

  File C:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\test\Analysis\MismatchedDeallocator-path-notes.cpp Line 10 (directive at C:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\test\Analysis\MismatchedDeallocator-path-notes.cpp:11): Returned allocated memory

  File C:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\test\Analysis\MismatchedDeallocator-path-notes.cpp Line 13 (directive at C:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\test\Analysis\MismatchedDeallocator-path-notes.cpp:14): Memory allocated by 'new[]' should be deallocated by 'delete[]', not 'delete'

5 errors generated.


error: command failed with exit status: 1

--

********************
PASS: Clang :: ASTMerge/typedef/test.c (4365 of 49400)
FAIL: Clang :: Analysis/Malloc+MismatchedDeallocator+NewDelete.cpp (4366 of 49400)
******************** TEST 'Clang :: Analysis/Malloc+MismatchedDeallocator+NewDelete.cpp' FAILED ********************
Script:
--
: 'RUN: at line 1';   c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\build\bin\clang.exe -cc1 -internal-isystem c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\build\lib\clang\10.0.0\include -nostdsysteminc -analyze -analyzer-constraints=range -analyzer-checker=core,unix.Malloc,unix.MismatchedDeallocator,cplusplus.NewDelete -std=c++11 -verify C:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\test\Analysis\Malloc+MismatchedDeallocator+NewDelete.cpp
: 'RUN: at line 2';   c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\build\bin\clang.exe -cc1 -internal-isystem c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\build\lib\clang\10.0.0\include -nostdsysteminc -analyze -analyzer-constraints=range -analyzer-checker=core,unix.Malloc,unix.MismatchedDeallocator,cplusplus.NewDelete,cplusplus.NewDeleteLeaks -DLEAKS -std=c++11 -verify C:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\test\Analysis\Malloc+MismatchedDeallocator+NewDelete.cpp
--
Exit Code: 1

Command Output (stdout):
--
$ ":" "RUN: at line 1"
$ "c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\build\bin\clang.exe" "-cc1" "-internal-isystem" "c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\build\lib\clang\10.0.0\include" "-nostdsysteminc" "-analyze" "-analyzer-constraints=range" "-analyzer-checker=core,unix.Malloc,unix.MismatchedDeallocator,cplusplus.NewDelete" "-std=c++11" "-verify" "C:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\test\Analysis\Malloc+MismatchedDeallocator+NewDelete.cpp"
# command stderr:
error: 'warning' diagnostics expected but not seen: 

  File C:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\test\Analysis\Malloc+MismatchedDeallocator+NewDelete.cpp Line 32: Argument to free() is offset by 4 bytes from the start of memory allocated by malloc()

  File C:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\test\Analysis\Malloc+MismatchedDeallocator+NewDelete.cpp Line 72: Argument to operator delete is offset by 4 bytes from the start of memory allocated by 'new'

  File C:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\test\Analysis\Malloc+MismatchedDeallocator+NewDelete.cpp Line 91: Memory allocated by malloc() should be deallocated by free(), not 'delete'

  File C:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\test\Analysis\Malloc+MismatchedDeallocator+NewDelete.cpp Line 106: Memory allocated by 'new[]' should be deallocated by 'delete[]', not 'delete'

4 errors generated.


error: command failed with exit status: 1

--

********************

******************** TEST 'Clang :: Analysis/NewDelete-intersections.mm' FAILED ********************
Script:
--
: 'RUN: at line 1';   c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\build\bin\clang.exe -cc1 -internal-isystem c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\build\lib\clang\10.0.0\include -nostdsysteminc -analyze -analyzer-constraints=range -analyzer-checker=core,cplusplus.NewDelete -std=c++11 -fblocks -verify C:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\test\Analysis\NewDelete-intersections.mm
: 'RUN: at line 2';   c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\build\bin\clang.exe -cc1 -internal-isystem c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\build\lib\clang\10.0.0\include -nostdsysteminc -analyze -analyzer-constraints=range -analyzer-checker=core,cplusplus.NewDelete,cplusplus.NewDeleteLeaks -std=c++11 -DLEAKS -fblocks -verify C:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\test\Analysis\NewDelete-intersections.mm
: 'RUN: at line 3';   c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\build\bin\clang.exe -cc1 -internal-isystem c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\build\lib\clang\10.0.0\include -nostdsysteminc -analyze -analyzer-constraints=range -analyzer-checker=core,cplusplus.NewDelete -std=c++11 -fblocks -DTEST_INLINABLE_ALLOCATORS -verify C:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\test\Analysis\NewDelete-intersections.mm
: 'RUN: at line 4';   c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\build\bin\clang.exe -cc1 -internal-isystem c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\build\lib\clang\10.0.0\include -nostdsysteminc -analyze -analyzer-constraints=range -analyzer-checker=core,cplusplus.NewDelete,cplusplus.NewDeleteLeaks -std=c++11 -DLEAKS -fblocks -DTEST_INLINABLE_ALLOCATORS -verify C:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\test\Analysis\NewDelete-intersections.mm
--
Exit Code: -2147483645

Command Output (stdout):
--
$ ":" "RUN: at line 1"
$ "c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\build\bin\clang.exe" "-cc1" "-internal-isystem" "c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\build\lib\clang\10.0.0\include" "-nostdsysteminc" "-analyze" "-analyzer-constraints=range" "-analyzer-checker=core,cplusplus.NewDelete" "-std=c++11" "-fblocks" "-verify" "C:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\test\Analysis\NewDelete-intersections.mm"
$ ":" "RUN: at line 2"
$ "c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\build\bin\clang.exe" "-cc1" "-internal-isystem" "c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\build\lib\clang\10.0.0\include" "-nostdsysteminc" "-analyze" "-analyzer-constraints=range" "-analyzer-checker=core,cplusplus.NewDelete,cplusplus.NewDeleteLeaks" "-std=c++11" "-DLEAKS" "-fblocks" "-verify" "C:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\test\Analysis\NewDelete-intersections.mm"
# command stderr:
unhandled family

UNREACHABLE executed at C:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\lib\StaticAnalyzer\Checkers\MallocChecker.cpp:1936!

Stack dump:

0.	Program arguments: c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\build\bin\clang.exe -cc1 -internal-isystem c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\build\lib\clang\10.0.0\include -nostdsysteminc -analyze -analyzer-constraints=range -analyzer-checker=core,cplusplus.NewDelete,cplusplus.NewDeleteLeaks -std=c++11 -DLEAKS -fblocks -verify C:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\test\Analysis\NewDelete-intersections.mm 

1.	<eof> parser at end of file

2.	While analyzing stack: 

	#0 Calling testMallocFreeNoWarn

 #0 0x00007ff72dda62dc HandleAbort c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\lib\support\windows\signals.inc:408:0

 #1 0x00007fff25b0bba1 (C:\WINDOWS\SYSTEM32\ucrtbased.dll+0x6bba1)

 #2 0x00007fff25b0d7f9 (C:\WINDOWS\SYSTEM32\ucrtbased.dll+0x6d7f9)

 #3 0x00007ff72dd0c3b3 llvm::llvm_unreachable_internal(char const *,char const *,unsigned int) c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\lib\support\errorhandling.cpp:215:0

 #4 0x00007ff7314adf32 `anonymous namespace'::MallocChecker::getCheckIfTracked c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\lib\staticanalyzer\checkers\mallocchecker.cpp:1937:0

 #5 0x00007ff7314b1459 `anonymous namespace'::MallocChecker::reportLeak c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\lib\staticanalyzer\checkers\mallocchecker.cpp:2571:0

 #6 0x00007ff7314a7442 `anonymous namespace'::MallocChecker::checkDeadSymbols c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\lib\staticanalyzer\checkers\mallocchecker.cpp:2671:0

 #7 0x00007ff7314c0abc clang::ento::check::DeadSymbols::_checkDeadSymbols<class `anonymous namespace'::MallocChecker>(void *,class clang::ento::SymbolReaper &,class clang::ento::CheckerContext &) c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\include\clang\staticanalyzer\core\checker.h:322:0

 #8 0x00007ff731a48242 clang::ento::CheckerFn<void (class clang::ento::SymbolReaper &,class clang::ento::CheckerContext &)>::operator()(class clang::ento::SymbolReaper &,class clang::ento::CheckerContext &)const  c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\include\clang\staticanalyzer\core\checkermanager.h:70:0

 #9 0x00007ff731a61079 `anonymous namespace'::CheckDeadSymbolsContext::runChecker c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\lib\staticanalyzer\core\checkermanager.cpp:578:0

#10 0x00007ff731a2ec1c expandGraphWithCheckers<`anonymous namespace'::CheckDeadSymbolsContext> c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\lib\staticanalyzer\core\checkermanager.cpp:139:0

#11 0x00007ff731a2b208 clang::ento::CheckerManager::runCheckersForDeadSymbols(class clang::ento::ExplodedNodeSet &,class clang::ento::ExplodedNodeSet const &,class clang::ento::SymbolReaper &,class clang::Stmt const *,class clang::ento::ExprEngine &,enum clang::ProgramPoint::Kind) c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\lib\staticanalyzer\core\checkermanager.cpp:592:0

#12 0x00007ff731b84791 clang::ento::ExprEngine::removeDead(class clang::ento::ExplodedNode *,class clang::ento::ExplodedNodeSet &,class clang::Stmt const *,class clang::LocationContext const *,class clang::Stmt const *,enum clang::ProgramPoint::Kind) c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\lib\staticanalyzer\core\exprengine.cpp:739:0

#13 0x00007ff731c47eda clang::ento::ExprEngine::removeDeadOnEndOfFunction(struct clang::ento::NodeBuilderContext &,class clang::ento::ExplodedNode *,class clang::ento::ExplodedNodeSet &) c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\lib\staticanalyzer\core\exprenginecallandreturn.cpp:182:0

#14 0x00007ff731b89683 clang::ento::ExprEngine::processEndOfFunction(struct clang::ento::NodeBuilderContext &,class clang::ento::ExplodedNode *,class clang::ReturnStmt const *) c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\lib\staticanalyzer\core\exprengine.cpp:2320:0

#15 0x00007ff731b77cbf clang::ento::CoreEngine::HandleBlockEdge(class clang::BlockEdge const &,class clang::ento::ExplodedNode *) c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\lib\staticanalyzer\core\coreengine.cpp:259:0

#16 0x00007ff731b79a43 clang::ento::CoreEngine::dispatchWorkItem(class clang::ento::ExplodedNode *,class clang::ProgramPoint,class clang::ento::WorkListUnit const &) c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\lib\staticanalyzer\core\coreengine.cpp:160:0

#17 0x00007ff731b7979d clang::ento::CoreEngine::ExecuteWorkList(class clang::LocationContext const *,unsigned int,class llvm::IntrusiveRefCntPtr<class clang::ento::ProgramState const >) c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\lib\staticanalyzer\core\coreengine.cpp:149:0

#18 0x00007ff7311516c9 clang::ento::ExprEngine::ExecuteWorkList(class clang::LocationContext const *,unsigned int) c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\include\clang\staticanalyzer\core\pathsensitive\exprengine.h:169:0

#19 0x00007ff73113dedf `anonymous namespace'::AnalysisConsumer::RunPathSensitiveChecks c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\lib\staticanalyzer\frontend\analysisconsumer.cpp:827:0

#20 0x00007ff73113dcdf `anonymous namespace'::AnalysisConsumer::HandleCode c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\lib\staticanalyzer\frontend\analysisconsumer.cpp:799:0

#21 0x00007ff73113d892 `anonymous namespace'::AnalysisConsumer::HandleDeclsCallGraph c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\lib\staticanalyzer\frontend\analysisconsumer.cpp:584:0

#22 0x00007ff73113ee0d `anonymous namespace'::AnalysisConsumer::runAnalysisOnTranslationUnit c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\lib\staticanalyzer\frontend\analysisconsumer.cpp:634:0

#23 0x00007ff73113d533 `anonymous namespace'::AnalysisConsumer::HandleTranslationUnit c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\lib\staticanalyzer\frontend\analysisconsumer.cpp:665:0

#24 0x00007ff731d39697 clang::ParseAST(class clang::Sema &,bool,bool) c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\lib\parse\parseast.cpp:178:0

#25 0x00007ff72ef4a03b clang::ASTFrontendAction::ExecuteAction(void) c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\lib\frontend\frontendaction.cpp:1044:0

#26 0x00007ff72ef499cc clang::FrontendAction::Execute(void) c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\lib\frontend\frontendaction.cpp:939:0

#27 0x00007ff72eeace83 clang::CompilerInstance::ExecuteAction(class clang::FrontendAction &) c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\lib\frontend\compilerinstance.cpp:957:0

#28 0x00007ff72f12a343 clang::ExecuteCompilerInvocation(class clang::CompilerInstance *) c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\lib\frontendtool\executecompilerinvocation.cpp:290:0

#29 0x00007ff729b0b4ea cc1_main(class llvm::ArrayRef<char const *>,char const *,void *) c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\tools\driver\cc1_main.cpp:250:0

#30 0x00007ff729af323d ExecuteCC1Tool c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\tools\driver\driver.cpp:309:0

#31 0x00007ff729af3a9b main c:\ps4-buildslave2\llvm-clang-x86_64-expensive-checks-win\llvm\tools\clang\tools\driver\driver.cpp:382:0

#32 0x00007ff733faa784 invoke_main d:\agent\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:79:0

#33 0x00007ff733faa62e __scrt_common_main_seh d:\agent\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288:0

#34 0x00007ff733faa4ee __scrt_common_main d:\agent\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:331:0

#35 0x00007ff733faa819 mainCRTStartup d:\agent\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_main.cpp:17:0

#36 0x00007fff415f7e94 (C:\WINDOWS\System32\KERNEL32.DLL+0x17e94)

#37 0x00007fff424da251 (C:\WINDOWS\SYSTEM32\ntdll.dll+0x6a251)


error: command failed with exit status: 0x80000003

--

********************

edit: Seems like UB. Let's hope the sanitizer catches it, after it finished the painfully slow build.

http://lab.llvm.org:8011/builders/clang-x64-windows-msvc/builds/10848/steps/annotate/logs/stdio

Testing: 
FAIL: Clang :: Analysis/Malloc+MismatchedDeallocator+NewDelete.cpp (234 of 15728)
******************** TEST 'Clang :: Analysis/Malloc+MismatchedDeallocator+NewDelete.cpp' FAILED ********************
Script:
--
: 'RUN: at line 1';   c:\b\slave\clang-x64-windows-msvc\build\build\stage1\bin\clang.exe -cc1 -internal-isystem c:\b\slave\clang-x64-windows-msvc\build\build\stage1\lib\clang\10.0.0\include -nostdsysteminc -analyze -analyzer-constraints=range -analyzer-checker=core,unix.Malloc,unix.MismatchedDeallocator,cplusplus.NewDelete -std=c++11 -verify C:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\test\Analysis\Malloc+MismatchedDeallocator+NewDelete.cpp
: 'RUN: at line 2';   c:\b\slave\clang-x64-windows-msvc\build\build\stage1\bin\clang.exe -cc1 -internal-isystem c:\b\slave\clang-x64-windows-msvc\build\build\stage1\lib\clang\10.0.0\include -nostdsysteminc -analyze -analyzer-constraints=range -analyzer-checker=core,unix.Malloc,unix.MismatchedDeallocator,cplusplus.NewDelete,cplusplus.NewDeleteLeaks -DLEAKS -std=c++11 -verify C:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\test\Analysis\Malloc+MismatchedDeallocator+NewDelete.cpp
--
Exit Code: 1

Command Output (stdout):
--
$ ":" "RUN: at line 1"
$ "c:\b\slave\clang-x64-windows-msvc\build\build\stage1\bin\clang.exe" "-cc1" "-internal-isystem" "c:\b\slave\clang-x64-windows-msvc\build\build\stage1\lib\clang\10.0.0\include" "-nostdsysteminc" "-analyze" "-analyzer-constraints=range" "-analyzer-checker=core,unix.Malloc,unix.MismatchedDeallocator,cplusplus.NewDelete" "-std=c++11" "-verify" "C:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\test\Analysis\Malloc+MismatchedDeallocator+NewDelete.cpp"
# command stderr:
error: 'warning' diagnostics expected but not seen: 

  File C:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\test\Analysis\Malloc+MismatchedDeallocator+NewDelete.cpp Line 32: Argument to free() is offset by 4 bytes from the start of memory allocated by malloc()

  File C:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\test\Analysis\Malloc+MismatchedDeallocator+NewDelete.cpp Line 72: Argument to operator delete is offset by 4 bytes from the start of memory allocated by 'new'

  File C:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\test\Analysis\Malloc+MismatchedDeallocator+NewDelete.cpp Line 91: Memory allocated by malloc() should be deallocated by free(), not 'delete'

  File C:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\test\Analysis\Malloc+MismatchedDeallocator+NewDelete.cpp Line 106: Memory allocated by 'new[]' should be deallocated by 'delete[]', not 'delete'

4 errors generated.


error: command failed with exit status: 1

--

********************
Testing: 
FAIL: Clang :: Analysis/MismatchedDeallocator-path-notes.cpp (244 of 15728)
******************** TEST 'Clang :: Analysis/MismatchedDeallocator-path-notes.cpp' FAILED ********************
Script:
--
: 'RUN: at line 1';   c:\b\slave\clang-x64-windows-msvc\build\build\stage1\bin\clang.exe -cc1 -internal-isystem c:\b\slave\clang-x64-windows-msvc\build\build\stage1\lib\clang\10.0.0\include -nostdsysteminc -analyze -analyzer-constraints=range -analyzer-checker=core,unix.MismatchedDeallocator -analyzer-output=text -verify C:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\test\Analysis\MismatchedDeallocator-path-notes.cpp
: 'RUN: at line 2';   c:\b\slave\clang-x64-windows-msvc\build\build\stage1\bin\clang.exe -cc1 -internal-isystem c:\b\slave\clang-x64-windows-msvc\build\build\stage1\lib\clang\10.0.0\include -nostdsysteminc -analyze -analyzer-constraints=range -analyzer-checker=core,unix.MismatchedDeallocator -analyzer-output=plist C:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\test\Analysis\MismatchedDeallocator-path-notes.cpp -o C:\b\slave\clang-x64-windows-msvc\build\build\stage1\tools\clang\test\Analysis\Output\MismatchedDeallocator-path-notes.cpp.tmp.plist
: 'RUN: at line 3';   tail -n +11 C:\b\slave\clang-x64-windows-msvc\build\build\stage1\tools\clang\test\Analysis\Output\MismatchedDeallocator-path-notes.cpp.tmp.plist | grep -Ev '^[[:space:]]*<string>.* version .*</string>[[:space:]]*$|^[[:space:]]*<string>/.*</string>[[:space:]]*$|^[[:space:]]*<string>.:.*</string>[[:space:]]*$' | diff -ub C:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\test\Analysis/copypaste/Inputs/expected-plists/MismatchedDeallocator-path-notes.cpp.plist -
--
Exit Code: 1

Command Output (stdout):
--
$ ":" "RUN: at line 1"
$ "c:\b\slave\clang-x64-windows-msvc\build\build\stage1\bin\clang.exe" "-cc1" "-internal-isystem" "c:\b\slave\clang-x64-windows-msvc\build\build\stage1\lib\clang\10.0.0\include" "-nostdsysteminc" "-analyze" "-analyzer-constraints=range" "-analyzer-checker=core,unix.MismatchedDeallocator" "-analyzer-output=text" "-verify" "C:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\test\Analysis\MismatchedDeallocator-path-notes.cpp"
# command stderr:
error: 'warning' diagnostics expected but not seen: 

  File C:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\test\Analysis\MismatchedDeallocator-path-notes.cpp Line 13: Memory allocated by 'new[]' should be deallocated by 'delete[]', not 'delete'

error: 'note' diagnostics expected but not seen: 

  File C:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\test\Analysis\MismatchedDeallocator-path-notes.cpp Line 7: Memory is allocated

  File C:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\test\Analysis\MismatchedDeallocator-path-notes.cpp Line 10: Calling 'allocIntArray'

  File C:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\test\Analysis\MismatchedDeallocator-path-notes.cpp Line 10 (directive at C:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\test\Analysis\MismatchedDeallocator-path-notes.cpp:11): Returned allocated memory

  File C:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\test\Analysis\MismatchedDeallocator-path-notes.cpp Line 13 (directive at C:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\test\Analysis\MismatchedDeallocator-path-notes.cpp:14): Memory allocated by 'new[]' should be deallocated by 'delete[]', not 'delete'

5 errors generated.


error: command failed with exit status: 1

--

********************
Testing: 0 
FAIL: Clang :: Analysis/malloc.mm (627 of 15728)
******************** TEST 'Clang :: Analysis/malloc.mm' FAILED ********************
Script:
--
: 'RUN: at line 1';   c:\b\slave\clang-x64-windows-msvc\build\build\stage1\bin\clang.exe -cc1 -internal-isystem c:\b\slave\clang-x64-windows-msvc\build\build\stage1\lib\clang\10.0.0\include -nostdsysteminc -analyze -analyzer-constraints=range -analyzer-checker=core,unix.Malloc -analyzer-store=region -verify -fblocks C:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\test\Analysis\malloc.mm
--
Exit Code: 1

Command Output (stdout):
--
$ ":" "RUN: at line 1"
$ "c:\b\slave\clang-x64-windows-msvc\build\build\stage1\bin\clang.exe" "-cc1" "-internal-isystem" "c:\b\slave\clang-x64-windows-msvc\build\build\stage1\lib\clang\10.0.0\include" "-nostdsysteminc" "-analyze" "-analyzer-constraints=range" "-analyzer-checker=core,unix.Malloc" "-analyzer-store=region" "-verify" "-fblocks" "C:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\test\Analysis\malloc.mm"
# command stderr:
error: 'warning' diagnostics expected but not seen: 

  File C:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\test\Analysis\malloc.mm Line 71: Argument to +dataWithBytesNoCopy:length:freeWhenDone: is offset by 4 bytes from the start of memory allocated by malloc()

1 error generated.


error: command failed with exit status: 1

--

********************
Testing: 0 
FAIL: Clang :: Analysis/NewDelete-intersections.mm (819 of 15728)
******************** TEST 'Clang :: Analysis/NewDelete-intersections.mm' FAILED ********************
Script:
--
: 'RUN: at line 1';   c:\b\slave\clang-x64-windows-msvc\build\build\stage1\bin\clang.exe -cc1 -internal-isystem c:\b\slave\clang-x64-windows-msvc\build\build\stage1\lib\clang\10.0.0\include -nostdsysteminc -analyze -analyzer-constraints=range -analyzer-checker=core,cplusplus.NewDelete -std=c++11 -fblocks -verify C:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\test\Analysis\NewDelete-intersections.mm
: 'RUN: at line 2';   c:\b\slave\clang-x64-windows-msvc\build\build\stage1\bin\clang.exe -cc1 -internal-isystem c:\b\slave\clang-x64-windows-msvc\build\build\stage1\lib\clang\10.0.0\include -nostdsysteminc -analyze -analyzer-constraints=range -analyzer-checker=core,cplusplus.NewDelete,cplusplus.NewDeleteLeaks -std=c++11 -DLEAKS -fblocks -verify C:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\test\Analysis\NewDelete-intersections.mm
: 'RUN: at line 3';   c:\b\slave\clang-x64-windows-msvc\build\build\stage1\bin\clang.exe -cc1 -internal-isystem c:\b\slave\clang-x64-windows-msvc\build\build\stage1\lib\clang\10.0.0\include -nostdsysteminc -analyze -analyzer-constraints=range -analyzer-checker=core,cplusplus.NewDelete -std=c++11 -fblocks -DTEST_INLINABLE_ALLOCATORS -verify C:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\test\Analysis\NewDelete-intersections.mm
: 'RUN: at line 4';   c:\b\slave\clang-x64-windows-msvc\build\build\stage1\bin\clang.exe -cc1 -internal-isystem c:\b\slave\clang-x64-windows-msvc\build\build\stage1\lib\clang\10.0.0\include -nostdsysteminc -analyze -analyzer-constraints=range -analyzer-checker=core,cplusplus.NewDelete,cplusplus.NewDeleteLeaks -std=c++11 -DLEAKS -fblocks -DTEST_INLINABLE_ALLOCATORS -verify C:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\test\Analysis\NewDelete-intersections.mm
--
Exit Code: -2147483645

Command Output (stdout):
--
$ ":" "RUN: at line 1"
$ "c:\b\slave\clang-x64-windows-msvc\build\build\stage1\bin\clang.exe" "-cc1" "-internal-isystem" "c:\b\slave\clang-x64-windows-msvc\build\build\stage1\lib\clang\10.0.0\include" "-nostdsysteminc" "-analyze" "-analyzer-constraints=range" "-analyzer-checker=core,cplusplus.NewDelete" "-std=c++11" "-fblocks" "-verify" "C:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\test\Analysis\NewDelete-intersections.mm"
$ ":" "RUN: at line 2"
$ "c:\b\slave\clang-x64-windows-msvc\build\build\stage1\bin\clang.exe" "-cc1" "-internal-isystem" "c:\b\slave\clang-x64-windows-msvc\build\build\stage1\lib\clang\10.0.0\include" "-nostdsysteminc" "-analyze" "-analyzer-constraints=range" "-analyzer-checker=core,cplusplus.NewDelete,cplusplus.NewDeleteLeaks" "-std=c++11" "-DLEAKS" "-fblocks" "-verify" "C:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\test\Analysis\NewDelete-intersections.mm"
# command stderr:
unhandled family

UNREACHABLE executed at C:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\StaticAnalyzer\Checkers\MallocChecker.cpp:1936!

Stack dump:

0.	Program arguments: c:\b\slave\clang-x64-windows-msvc\build\build\stage1\bin\clang.exe -cc1 -internal-isystem c:\b\slave\clang-x64-windows-msvc\build\build\stage1\lib\clang\10.0.0\include -nostdsysteminc -analyze -analyzer-constraints=range -analyzer-checker=core,cplusplus.NewDelete,cplusplus.NewDeleteLeaks -std=c++11 -DLEAKS -fblocks -verify C:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\test\Analysis\NewDelete-intersections.mm 

1.	<eof> parser at end of file

2.	While analyzing stack: 

	#0 Calling testMallocFreeNoWarn

 #0 0x00007ff6ced316c5 HandleAbort c:\b\slave\clang-x64-windows-msvc\build\llvm.src\lib\support\windows\signals.inc:408:0

 #1 0x00007ffd9003d167 (C:\windows\SYSTEM32\ucrtbase.DLL+0x6d167)

 #2 0x00007ffd9003dff1 (C:\windows\SYSTEM32\ucrtbase.DLL+0x6dff1)

 #3 0x00007ff6cecf6440 llvm::llvm_unreachable_internal(char const *,char const *,unsigned int) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\lib\support\errorhandling.cpp:209:0

 #4 0x00007ff6cfd4e99b `anonymous namespace'::MallocChecker::getCheckIfTracked c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\checkers\mallocchecker.cpp:1936:0

 #5 0x00007ff6cfd53408 `anonymous namespace'::MallocChecker::reportLeak c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\checkers\mallocchecker.cpp:2571:0

 #6 0x00007ff6cfd4a451 `anonymous namespace'::MallocChecker::checkDeadSymbols c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\checkers\mallocchecker.cpp:2670:0

 #7 0x00007ff6cfe80b82 expandGraphWithCheckers<`anonymous namespace'::CheckDeadSymbolsContext> c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\core\checkermanager.cpp:138:0

 #8 0x00007ff6cfe84187 clang::ento::CheckerManager::runCheckersForDeadSymbols(class clang::ento::ExplodedNodeSet &,class clang::ento::ExplodedNodeSet const &,class clang::ento::SymbolReaper &,class clang::Stmt const *,class clang::ento::ExprEngine &,enum clang::ProgramPoint::Kind) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\core\checkermanager.cpp:592:0

 #9 0x00007ff6cfeeea3d clang::ento::ExprEngine::removeDead(class clang::ento::ExplodedNode *,class clang::ento::ExplodedNodeSet &,class clang::Stmt const *,class clang::LocationContext const *,class clang::Stmt const *,enum clang::ProgramPoint::Kind) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\core\exprengine.cpp:739:0

#10 0x00007ff6cff27c29 clang::ento::ExprEngine::removeDeadOnEndOfFunction(struct clang::ento::NodeBuilderContext &,class clang::ento::ExplodedNode *,class clang::ento::ExplodedNodeSet &) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\core\exprenginecallandreturn.cpp:182:0

#11 0x00007ff6cfeed5ad clang::ento::ExprEngine::processEndOfFunction(struct clang::ento::NodeBuilderContext &,class clang::ento::ExplodedNode *,class clang::ReturnStmt const *) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\core\exprengine.cpp:2320:0

#12 0x00007ff6cfed935f clang::ento::CoreEngine::HandleBlockEdge(class clang::BlockEdge const &,class clang::ento::ExplodedNode *) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\core\coreengine.cpp:259:0

#13 0x00007ff6cfeda143 clang::ento::CoreEngine::dispatchWorkItem(class clang::ento::ExplodedNode *,class clang::ProgramPoint,class clang::ento::WorkListUnit const &) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\core\coreengine.cpp:160:0

#14 0x00007ff6cfed8e6b clang::ento::CoreEngine::ExecuteWorkList(class clang::LocationContext const *,unsigned int,class llvm::IntrusiveRefCntPtr<class clang::ento::ProgramState const >) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\core\coreengine.cpp:129:0

#15 0x00007ff6cfc921fd `anonymous namespace'::AnalysisConsumer::RunPathSensitiveChecks c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\frontend\analysisconsumer.cpp:827:0

#16 0x00007ff6cfc91477 `anonymous namespace'::AnalysisConsumer::HandleCode c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\frontend\analysisconsumer.cpp:799:0

#17 0x00007ff6cfc91938 `anonymous namespace'::AnalysisConsumer::HandleDeclsCallGraph c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\frontend\analysisconsumer.cpp:584:0

#18 0x00007ff6cfcb1544 `anonymous namespace'::AnalysisConsumer::runAnalysisOnTranslationUnit c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\frontend\analysisconsumer.cpp:634:0

#19 0x00007ff6cfc91db5 `anonymous namespace'::AnalysisConsumer::HandleTranslationUnit c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\frontend\analysisconsumer.cpp:665:0

#20 0x00007ff6cff6a375 clang::ParseAST(class clang::Sema &,bool,bool) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\parse\parseast.cpp:178:0

#21 0x00007ff6cf40350d clang::ASTFrontendAction::ExecuteAction(void) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\frontend\frontendaction.cpp:1044:0

#22 0x00007ff6cf403328 clang::FrontendAction::Execute(void) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\frontend\frontendaction.cpp:939:0

#23 0x00007ff6cf3c7e92 clang::CompilerInstance::ExecuteAction(class clang::FrontendAction &) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\frontend\compilerinstance.cpp:957:0

#24 0x00007ff6cf46544d clang::ExecuteCompilerInvocation(class clang::CompilerInstance *) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\frontendtool\executecompilerinvocation.cpp:290:0

#25 0x00007ff6cd33d900 cc1_main(class llvm::ArrayRef<char const *>,char const *,void *) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\tools\driver\cc1_main.cpp:251:0

#26 0x00007ff6cd3381c5 ExecuteCC1Tool c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\tools\driver\driver.cpp:319:0

#27 0x00007ff6cd33a6ab main c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\tools\driver\driver.cpp:382:0

#28 0x00007ff6d0ae018c __scrt_common_main_seh f:\dd\vctools\crt\vcstartup\src\startup\exe_common.inl:288:0

#29 0x00007ffd987d13f2 (C:\windows\system32\KERNEL32.DLL+0x13f2)

#30 0x00007ffd9b0954f4 (C:\windows\SYSTEM32\ntdll.dll+0x154f4)


error: command failed with exit status: 0x80000003

--

********************
Testing: 0 .
FAIL: Clang :: Analysis/free.c (1014 of 15728)
******************** TEST 'Clang :: Analysis/free.c' FAILED ********************
Script:
--
: 'RUN: at line 1';   c:\b\slave\clang-x64-windows-msvc\build\build\stage1\bin\clang.exe -cc1 -internal-isystem c:\b\slave\clang-x64-windows-msvc\build\build\stage1\lib\clang\10.0.0\include -nostdsysteminc -analyze -analyzer-constraints=range -fblocks -verify C:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\test\Analysis\free.c -analyzer-store=region    -analyzer-checker=core    -analyzer-checker=unix.Malloc
: 'RUN: at line 5';   c:\b\slave\clang-x64-windows-msvc\build\build\stage1\bin\clang.exe -cc1 -internal-isystem c:\b\slave\clang-x64-windows-msvc\build\build\stage1\lib\clang\10.0.0\include -nostdsysteminc -analyze -analyzer-constraints=range -fblocks -verify C:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\test\Analysis\free.c -analyzer-store=region    -analyzer-checker=core    -analyzer-checker=unix.Malloc    -analyzer-config unix.DynamicMemoryModeling:Optimistic=true
--
Exit Code: -2147483645

Command Output (stdout):
--
$ ":" "RUN: at line 1"
$ "c:\b\slave\clang-x64-windows-msvc\build\build\stage1\bin\clang.exe" "-cc1" "-internal-isystem" "c:\b\slave\clang-x64-windows-msvc\build\build\stage1\lib\clang\10.0.0\include" "-nostdsysteminc" "-analyze" "-analyzer-constraints=range" "-fblocks" "-verify" "C:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\test\Analysis\free.c" "-analyzer-store=region" "-analyzer-checker=core" "-analyzer-checker=unix.Malloc"
# command stderr:
unhandled family

UNREACHABLE executed at C:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\StaticAnalyzer\Checkers\MallocChecker.cpp:1936!

Stack dump:

0.	Program arguments: c:\b\slave\clang-x64-windows-msvc\build\build\stage1\bin\clang.exe -cc1 -internal-isystem c:\b\slave\clang-x64-windows-msvc\build\build\stage1\lib\clang\10.0.0\include -nostdsysteminc -analyze -analyzer-constraints=range -fblocks -verify C:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\test\Analysis\free.c -analyzer-store=region -analyzer-checker=core -analyzer-checker=unix.Malloc 

1.	<eof> parser at end of file

2.	While analyzing stack: 

	#0 Calling t11

 #0 0x00007ff6ced316c5 HandleAbort c:\b\slave\clang-x64-windows-msvc\build\llvm.src\lib\support\windows\signals.inc:408:0

 #1 0x00007ffd9003d167 (C:\windows\SYSTEM32\ucrtbase.DLL+0x6d167)

 #2 0x00007ffd9003dff1 (C:\windows\SYSTEM32\ucrtbase.DLL+0x6dff1)

 #3 0x00007ff6cecf6440 llvm::llvm_unreachable_internal(char const *,char const *,unsigned int) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\lib\support\errorhandling.cpp:209:0

 #4 0x00007ff6cfd4e99b `anonymous namespace'::MallocChecker::getCheckIfTracked c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\checkers\mallocchecker.cpp:1936:0

 #5 0x00007ff6cfd53408 `anonymous namespace'::MallocChecker::reportLeak c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\checkers\mallocchecker.cpp:2571:0

 #6 0x00007ff6cfd4a451 `anonymous namespace'::MallocChecker::checkDeadSymbols c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\checkers\mallocchecker.cpp:2670:0

 #7 0x00007ff6cfe80b82 expandGraphWithCheckers<`anonymous namespace'::CheckDeadSymbolsContext> c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\core\checkermanager.cpp:138:0

 #8 0x00007ff6cfe84187 clang::ento::CheckerManager::runCheckersForDeadSymbols(class clang::ento::ExplodedNodeSet &,class clang::ento::ExplodedNodeSet const &,class clang::ento::SymbolReaper &,class clang::Stmt const *,class clang::ento::ExprEngine &,enum clang::ProgramPoint::Kind) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\core\checkermanager.cpp:592:0

 #9 0x00007ff6cfeeea3d clang::ento::ExprEngine::removeDead(class clang::ento::ExplodedNode *,class clang::ento::ExplodedNodeSet &,class clang::Stmt const *,class clang::LocationContext const *,class clang::Stmt const *,enum clang::ProgramPoint::Kind) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\core\exprengine.cpp:739:0

#10 0x00007ff6cff27c29 clang::ento::ExprEngine::removeDeadOnEndOfFunction(struct clang::ento::NodeBuilderContext &,class clang::ento::ExplodedNode *,class clang::ento::ExplodedNodeSet &) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\core\exprenginecallandreturn.cpp:182:0

#11 0x00007ff6cfeed5ad clang::ento::ExprEngine::processEndOfFunction(struct clang::ento::NodeBuilderContext &,class clang::ento::ExplodedNode *,class clang::ReturnStmt const *) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\core\exprengine.cpp:2320:0

#12 0x00007ff6cfed935f clang::ento::CoreEngine::HandleBlockEdge(class clang::BlockEdge const &,class clang::ento::ExplodedNode *) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\core\coreengine.cpp:259:0

#13 0x00007ff6cfeda143 clang::ento::CoreEngine::dispatchWorkItem(class clang::ento::ExplodedNode *,class clang::ProgramPoint,class clang::ento::WorkListUnit const &) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\core\coreengine.cpp:160:0

#14 0x00007ff6cfed8e6b clang::ento::CoreEngine::ExecuteWorkList(class clang::LocationContext const *,unsigned int,class llvm::IntrusiveRefCntPtr<class clang::ento::ProgramState const >) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\core\coreengine.cpp:129:0

#15 0x00007ff6cfc921fd `anonymous namespace'::AnalysisConsumer::RunPathSensitiveChecks c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\frontend\analysisconsumer.cpp:827:0

#16 0x00007ff6cfc91477 `anonymous namespace'::AnalysisConsumer::HandleCode c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\frontend\analysisconsumer.cpp:799:0

#17 0x00007ff6cfc91938 `anonymous namespace'::AnalysisConsumer::HandleDeclsCallGraph c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\frontend\analysisconsumer.cpp:584:0

#18 0x00007ff6cfcb1544 `anonymous namespace'::AnalysisConsumer::runAnalysisOnTranslationUnit c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\frontend\analysisconsumer.cpp:634:0

#19 0x00007ff6cfc91db5 `anonymous namespace'::AnalysisConsumer::HandleTranslationUnit c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\frontend\analysisconsumer.cpp:665:0

#20 0x00007ff6cff6a375 clang::ParseAST(class clang::Sema &,bool,bool) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\parse\parseast.cpp:178:0

#21 0x00007ff6cf40350d clang::ASTFrontendAction::ExecuteAction(void) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\frontend\frontendaction.cpp:1044:0

#22 0x00007ff6cf403328 clang::FrontendAction::Execute(void) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\frontend\frontendaction.cpp:939:0

#23 0x00007ff6cf3c7e92 clang::CompilerInstance::ExecuteAction(class clang::FrontendAction &) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\frontend\compilerinstance.cpp:957:0

#24 0x00007ff6cf46544d clang::ExecuteCompilerInvocation(class clang::CompilerInstance *) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\frontendtool\executecompilerinvocation.cpp:290:0

#25 0x00007ff6cd33d900 cc1_main(class llvm::ArrayRef<char const *>,char const *,void *) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\tools\driver\cc1_main.cpp:251:0

#26 0x00007ff6cd3381c5 ExecuteCC1Tool c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\tools\driver\driver.cpp:319:0

#27 0x00007ff6cd33a6ab main c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\tools\driver\driver.cpp:382:0

#28 0x00007ff6d0ae018c __scrt_common_main_seh f:\dd\vctools\crt\vcstartup\src\startup\exe_common.inl:288:0

#29 0x00007ffd987d13f2 (C:\windows\system32\KERNEL32.DLL+0x13f2)

#30 0x00007ffd9b0954f4 (C:\windows\SYSTEM32\ntdll.dll+0x154f4)


error: command failed with exit status: 0x80000003

--

********************
Testing: 0 .
FAIL: Clang :: Analysis/inner-pointer.cpp (1145 of 15728)
******************** TEST 'Clang :: Analysis/inner-pointer.cpp' FAILED ********************
Script:
--
: 'RUN: at line 1';   c:\b\slave\clang-x64-windows-msvc\build\build\stage1\bin\clang.exe -cc1 -internal-isystem c:\b\slave\clang-x64-windows-msvc\build\build\stage1\lib\clang\10.0.0\include -nostdsysteminc -analyze -analyzer-constraints=range -analyzer-checker=cplusplus.InnerPointer      -Wno-dangling -Wno-dangling-field -Wno-return-stack-address    C:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\test\Analysis\inner-pointer.cpp -analyzer-output=text -verify
--
Exit Code: -2147483645

Command Output (stdout):
--
$ ":" "RUN: at line 1"
$ "c:\b\slave\clang-x64-windows-msvc\build\build\stage1\bin\clang.exe" "-cc1" "-internal-isystem" "c:\b\slave\clang-x64-windows-msvc\build\build\stage1\lib\clang\10.0.0\include" "-nostdsysteminc" "-analyze" "-analyzer-constraints=range" "-analyzer-checker=cplusplus.InnerPointer" "-Wno-dangling" "-Wno-dangling-field" "-Wno-return-stack-address" "C:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\test\Analysis\inner-pointer.cpp" "-analyzer-output=text" "-verify"
# command stderr:
unhandled family

UNREACHABLE executed at C:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\StaticAnalyzer\Checkers\MallocChecker.cpp:1936!

Stack dump:

0.	Program arguments: c:\b\slave\clang-x64-windows-msvc\build\build\stage1\bin\clang.exe -cc1 -internal-isystem c:\b\slave\clang-x64-windows-msvc\build\build\stage1\lib\clang\10.0.0\include -nostdsysteminc -analyze -analyzer-constraints=range -analyzer-checker=cplusplus.InnerPointer -Wno-dangling -Wno-dangling-field -Wno-return-stack-address C:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\test\Analysis\inner-pointer.cpp -analyzer-output=text -verify 

1.	<eof> parser at end of file

2.	While analyzing stack: 

	#0 Calling escape_via_return_local

 #0 0x00007ff6ced316c5 HandleAbort c:\b\slave\clang-x64-windows-msvc\build\llvm.src\lib\support\windows\signals.inc:408:0

 #1 0x00007ffd9003d167 (C:\windows\SYSTEM32\ucrtbase.DLL+0x6d167)

 #2 0x00007ffd9003dff1 (C:\windows\SYSTEM32\ucrtbase.DLL+0x6dff1)

 #3 0x00007ff6cecf6440 llvm::llvm_unreachable_internal(char const *,char const *,unsigned int) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\lib\support\errorhandling.cpp:209:0

 #4 0x00007ff6cfd4e99b `anonymous namespace'::MallocChecker::getCheckIfTracked c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\checkers\mallocchecker.cpp:1936:0

 #5 0x00007ff6cfd47340 `anonymous namespace'::MallocChecker::ReportUseAfterFree c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\checkers\mallocchecker.cpp:2241:0

 #6 0x00007ff6cfd4c6bb `anonymous namespace'::MallocChecker::checkUseAfterFree c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\checkers\mallocchecker.cpp:2841:0

 #7 0x00007ff6cfd4a8fe `anonymous namespace'::MallocChecker::checkEscapeOnReturn c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\checkers\mallocchecker.cpp:2761:0

 #8 0x00007ff6cfe84333 clang::ento::CheckerManager::runCheckersForEndFunction(struct clang::ento::NodeBuilderContext &,class clang::ento::ExplodedNodeSet &,class clang::ento::ExplodedNode *,class clang::ento::ExprEngine &,class clang::ReturnStmt const *) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\core\checkermanager.cpp:458:0

 #9 0x00007ff6cfeed607 clang::ento::ExprEngine::processEndOfFunction(struct clang::ento::NodeBuilderContext &,class clang::ento::ExplodedNode *,class clang::ReturnStmt const *) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\core\exprengine.cpp:2321:0

#10 0x00007ff6cfed935f clang::ento::CoreEngine::HandleBlockEdge(class clang::BlockEdge const &,class clang::ento::ExplodedNode *) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\core\coreengine.cpp:259:0

#11 0x00007ff6cfeda143 clang::ento::CoreEngine::dispatchWorkItem(class clang::ento::ExplodedNode *,class clang::ProgramPoint,class clang::ento::WorkListUnit const &) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\core\coreengine.cpp:160:0

#12 0x00007ff6cfed8e6b clang::ento::CoreEngine::ExecuteWorkList(class clang::LocationContext const *,unsigned int,class llvm::IntrusiveRefCntPtr<class clang::ento::ProgramState const >) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\core\coreengine.cpp:129:0

#13 0x00007ff6cfc921fd `anonymous namespace'::AnalysisConsumer::RunPathSensitiveChecks c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\frontend\analysisconsumer.cpp:827:0

#14 0x00007ff6cfc91477 `anonymous namespace'::AnalysisConsumer::HandleCode c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\frontend\analysisconsumer.cpp:799:0

#15 0x00007ff6cfc91938 `anonymous namespace'::AnalysisConsumer::HandleDeclsCallGraph c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\frontend\analysisconsumer.cpp:584:0

#16 0x00007ff6cfcb1544 `anonymous namespace'::AnalysisConsumer::runAnalysisOnTranslationUnit c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\frontend\analysisconsumer.cpp:634:0

#17 0x00007ff6cfc91db5 `anonymous namespace'::AnalysisConsumer::HandleTranslationUnit c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\frontend\analysisconsumer.cpp:665:0

#18 0x00007ff6cff6a375 clang::ParseAST(class clang::Sema &,bool,bool) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\parse\parseast.cpp:178:0

#19 0x00007ff6cf40350d clang::ASTFrontendAction::ExecuteAction(void) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\frontend\frontendaction.cpp:1044:0

#20 0x00007ff6cf403328 clang::FrontendAction::Execute(void) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\frontend\frontendaction.cpp:939:0

#21 0x00007ff6cf3c7e92 clang::CompilerInstance::ExecuteAction(class clang::FrontendAction &) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\frontend\compilerinstance.cpp:957:0

#22 0x00007ff6cf46544d clang::ExecuteCompilerInvocation(class clang::CompilerInstance *) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\frontendtool\executecompilerinvocation.cpp:290:0

#23 0x00007ff6cd33d900 cc1_main(class llvm::ArrayRef<char const *>,char const *,void *) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\tools\driver\cc1_main.cpp:251:0

#24 0x00007ff6cd3381c5 ExecuteCC1Tool c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\tools\driver\driver.cpp:319:0

#25 0x00007ff6cd33a6ab main c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\tools\driver\driver.cpp:382:0

#26 0x00007ff6d0ae018c __scrt_common_main_seh f:\dd\vctools\crt\vcstartup\src\startup\exe_common.inl:288:0

#27 0x00007ffd987d13f2 (C:\windows\system32\KERNEL32.DLL+0x13f2)

#28 0x00007ffd9b0954f4 (C:\windows\SYSTEM32\ntdll.dll+0x154f4)


error: command failed with exit status: 0x80000003

--

********************
Testing: 0 ..
FAIL: Clang :: Analysis/malloc.c (1324 of 15728)
******************** TEST 'Clang :: Analysis/malloc.c' FAILED ********************
Script:
--
: 'RUN: at line 1';   c:\b\slave\clang-x64-windows-msvc\build\build\stage1\bin\clang.exe -cc1 -internal-isystem c:\b\slave\clang-x64-windows-msvc\build\build\stage1\lib\clang\10.0.0\include -nostdsysteminc -analyze -analyzer-constraints=range -analyzer-store=region -verify C:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\test\Analysis\malloc.c    -analyzer-checker=core    -analyzer-checker=alpha.deadcode.UnreachableCode    -analyzer-checker=alpha.core.CastSize    -analyzer-checker=unix.Malloc    -analyzer-checker=debug.ExprInspection
--
Exit Code: -2147483645

Command Output (stdout):
--
$ ":" "RUN: at line 1"
$ "c:\b\slave\clang-x64-windows-msvc\build\build\stage1\bin\clang.exe" "-cc1" "-internal-isystem" "c:\b\slave\clang-x64-windows-msvc\build\build\stage1\lib\clang\10.0.0\include" "-nostdsysteminc" "-analyze" "-analyzer-constraints=range" "-analyzer-store=region" "-verify" "C:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\test\Analysis\malloc.c" "-analyzer-checker=core" "-analyzer-checker=alpha.deadcode.UnreachableCode" "-analyzer-checker=alpha.core.CastSize" "-analyzer-checker=unix.Malloc" "-analyzer-checker=debug.ExprInspection"
# command stderr:
unhandled family

UNREACHABLE executed at C:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\StaticAnalyzer\Checkers\MallocChecker.cpp:1936!

Stack dump:

0.	Program arguments: c:\b\slave\clang-x64-windows-msvc\build\build\stage1\bin\clang.exe -cc1 -internal-isystem c:\b\slave\clang-x64-windows-msvc\build\build\stage1\lib\clang\10.0.0\include -nostdsysteminc -analyze -analyzer-constraints=range -analyzer-store=region -verify C:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\test\Analysis\malloc.c -analyzer-checker=core -analyzer-checker=alpha.deadcode.UnreachableCode -analyzer-checker=alpha.core.CastSize -analyzer-checker=unix.Malloc -analyzer-checker=debug.ExprInspection 

1.	<eof> parser at end of file

2.	While analyzing stack: 

	#0 Calling CheckUseZeroWinAllocated2

3.	C:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\test\Analysis\malloc.c:273:10: Error evaluating statement

4.	C:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\test\Analysis\malloc.c:273:10: Error evaluating statement

 #0 0x00007ff6ced316c5 HandleAbort c:\b\slave\clang-x64-windows-msvc\build\llvm.src\lib\support\windows\signals.inc:408:0

 #1 0x00007ffd9003d167 (C:\windows\SYSTEM32\ucrtbase.DLL+0x6d167)

 #2 0x00007ffd9003dff1 (C:\windows\SYSTEM32\ucrtbase.DLL+0x6dff1)

 #3 0x00007ff6cecf6440 llvm::llvm_unreachable_internal(char const *,char const *,unsigned int) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\lib\support\errorhandling.cpp:209:0

 #4 0x00007ff6cfd4e99b `anonymous namespace'::MallocChecker::getCheckIfTracked c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\checkers\mallocchecker.cpp:1936:0

 #5 0x00007ff6cfd47647 `anonymous namespace'::MallocChecker::ReportUseZeroAllocated c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\checkers\mallocchecker.cpp:2335:0

 #6 0x00007ff6cfd40911 clang::ento::check::Location::_checkLocation<class `anonymous namespace'::MallocChecker>(void *,class clang::ento::SVal const &,bool,class clang::Stmt const *,class clang::ento::CheckerContext &) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\include\clang\staticanalyzer\core\checker.h:199:0

 #7 0x00007ff6cfe80f06 expandGraphWithCheckers<`anonymous namespace'::CheckLocationContext> c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\core\checkermanager.cpp:138:0

 #8 0x00007ff6cfe84c12 clang::ento::CheckerManager::runCheckersForLocation(class clang::ento::ExplodedNodeSet &,class clang::ento::ExplodedNodeSet const &,class clang::ento::SVal,bool,class clang::Stmt const *,class clang::Stmt const *,class clang::ento::ExprEngine &) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\core\checkermanager.cpp:359:0

 #9 0x00007ff6cfee7ed7 clang::ento::ExprEngine::evalLocation(class clang::ento::ExplodedNodeSet &,class clang::Stmt const *,class clang::Stmt const *,class clang::ento::ExplodedNode *,class llvm::IntrusiveRefCntPtr<class clang::ento::ProgramState const >,class clang::ento::SVal,bool) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\core\exprengine.cpp:2904:0

#10 0x00007ff6cfee79e2 clang::ento::ExprEngine::evalLoad(class clang::ento::ExplodedNodeSet &,class clang::Expr const *,class clang::Expr const *,class clang::ento::ExplodedNode *,class llvm::IntrusiveRefCntPtr<class clang::ento::ProgramState const >,class clang::ento::SVal,class clang::ProgramPointTag const *,class clang::QualType) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\core\exprengine.cpp:2848:0

#11 0x00007ff6cff332f5 clang::ento::ExprEngine::VisitCast(class clang::CastExpr const *,class clang::Expr const *,class clang::ento::ExplodedNode *,class clang::ento::ExplodedNodeSet &) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\core\exprenginec.cpp:314:0

#12 0x00007ff6cfee1e73 clang::ento::ExprEngine::Visit(class clang::Stmt const *,class clang::ento::ExplodedNode *,class clang::ento::ExplodedNodeSet &) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\core\exprengine.cpp:1697:0

#13 0x00007ff6cfedf594 clang::ento::ExprEngine::ProcessStmt(class clang::Stmt const *,class clang::ento::ExplodedNode *) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\core\exprengine.cpp:791:0

#14 0x00007ff6cfeecb4b clang::ento::ExprEngine::processCFGElement(class clang::CFGElement,class clang::ento::ExplodedNode *,unsigned int,struct clang::ento::NodeBuilderContext *) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\core\exprengine.cpp:637:0

#15 0x00007ff6cfeda43d clang::ento::CoreEngine::dispatchWorkItem(class clang::ento::ExplodedNode *,class clang::ProgramPoint,class clang::ento::WorkListUnit const &) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\core\coreengine.cpp:195:0

#16 0x00007ff6cfed8e6b clang::ento::CoreEngine::ExecuteWorkList(class clang::LocationContext const *,unsigned int,class llvm::IntrusiveRefCntPtr<class clang::ento::ProgramState const >) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\core\coreengine.cpp:129:0

#17 0x00007ff6cfc921fd `anonymous namespace'::AnalysisConsumer::RunPathSensitiveChecks c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\frontend\analysisconsumer.cpp:827:0

#18 0x00007ff6cfc91477 `anonymous namespace'::AnalysisConsumer::HandleCode c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\frontend\analysisconsumer.cpp:799:0

#19 0x00007ff6cfc91938 `anonymous namespace'::AnalysisConsumer::HandleDeclsCallGraph c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\frontend\analysisconsumer.cpp:584:0

#20 0x00007ff6cfcb1544 `anonymous namespace'::AnalysisConsumer::runAnalysisOnTranslationUnit c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\frontend\analysisconsumer.cpp:634:0

#21 0x00007ff6cfc91db5 `anonymous namespace'::AnalysisConsumer::HandleTranslationUnit c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\staticanalyzer\frontend\analysisconsumer.cpp:665:0

#22 0x00007ff6cff6a375 clang::ParseAST(class clang::Sema &,bool,bool) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\parse\parseast.cpp:178:0

#23 0x00007ff6cf40350d clang::ASTFrontendAction::ExecuteAction(void) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\frontend\frontendaction.cpp:1044:0

#24 0x00007ff6cf403328 clang::FrontendAction::Execute(void) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\frontend\frontendaction.cpp:939:0

#25 0x00007ff6cf3c7e92 clang::CompilerInstance::ExecuteAction(class clang::FrontendAction &) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\frontend\compilerinstance.cpp:957:0

#26 0x00007ff6cf46544d clang::ExecuteCompilerInvocation(class clang::CompilerInstance *) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\lib\frontendtool\executecompilerinvocation.cpp:290:0

#27 0x00007ff6cd33d900 cc1_main(class llvm::ArrayRef<char const *>,char const *,void *) c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\tools\driver\cc1_main.cpp:251:0

#28 0x00007ff6cd3381c5 ExecuteCC1Tool c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\tools\driver\driver.cpp:319:0

#29 0x00007ff6cd33a6ab main c:\b\slave\clang-x64-windows-msvc\build\llvm.src\tools\clang\tools\driver\driver.cpp:382:0

#30 0x00007ff6d0ae018c __scrt_common_main_seh f:\dd\vctools\crt\vcstartup\src\startup\exe_common.inl:288:0

#31 0x00007ffd987d13f2 (C:\windows\system32\KERNEL32.DLL+0x13f2)

#32 0x00007ffd9b0954f4 (C:\windows\SYSTEM32\ntdll.dll+0x154f4)


error: command failed with exit status: 0x80000003

--

********************
Testing: 0 .. 10.. 20.. 30.. 40.. 50.. 60.. 70.. 80.. 90.. 
Testing Time: 103.83s
********************
Failing Tests (7):
    Clang :: Analysis/Malloc+MismatchedDeallocator+NewDelete.cpp
    Clang :: Analysis/MismatchedDeallocator-path-notes.cpp
    Clang :: Analysis/NewDelete-intersections.mm
    Clang :: Analysis/free.c
    Clang :: Analysis/inner-pointer.cpp
    Clang :: Analysis/malloc.c
    Clang :: Analysis/malloc.mm

edit2: UBSan found nothing, giving one last shot with MemSan.

edit3: No luck. I'll try to make a windows build happen, but have little faith. If this fails, I'll revert.

edit4: rL372462 seems to have solved the issue. * biiiiiiiiiiiiiiiiig sigh of relief *

lib/StaticAnalyzer/Checkers/MallocChecker.cpp

 //=== MallocChecker.cpp - A malloc/free checker -------------------*- C++ -*--//
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 //
-// This file defines malloc/free checker, which checks for potential memory
-// leaks, double free, and use-after-free problems.
+// This file defines a variety of memory management related checkers, such as
+// leak, double free, and use-after-free.
+//
+// The following checkers are defined here:
+//
+//   * MallocChecker
+//       Despite its name, it models all sorts of memory allocations and
+//       de- or reallocation, including but not limited to malloc, free,
+//       relloc, new, delete. It also reports on a variety of memory misuse
+//       errors.
+//       Many other checkers interact very closely with this checker, in fact,
+//       most are merely options to this one. Other checkers may register
+//       MallocChecker, but do not enable MallocChecker's reports (more details
+//       to follow around its field, ChecksEnabled).
+//       It also has a boolean "Optimistic" checker option, which if set to true
+//       will cause the checker to model user defined memory management related
+//       functions annotated via the attribute ownership_takes, ownership_holds
+//       and ownership_returns.
+//
+//   * NewDeleteChecker
+//       Enables the modeling of new, new[], delete, delete[] in MallocChecker,
+//       and checks for related double-free and use-after-free errors.
+//
+//   * NewDeleteLeaksChecker
+//       Checks for leaks related to new, new[], delete, delete[].
+//       Depends on NewDeleteChecker.
+//
+//   * MismatchedDeallocatorChecker
+//       Enables checking whether memory is deallocated with the correspending
+//       allocation function in MallocChecker, such as malloc() allocated
+//       regions are only freed by free(), new by delete, new[] by delete[].
+//
+//  InnerPointerChecker interacts very closely with MallocChecker, but unlike
+//  the above checkers, it has it's own file, hence the many InnerPointerChecker
+//  related headers and non-static functions.
 //
 //===----------------------------------------------------------------------===//
 
 #include "ClangSACheckers.h"
 #include "InterCheckerAPI.h"
 #include "clang/AST/Attr.h"
 #include "clang/AST/ParentMap.h"
 #include "clang/Basic/SourceManager.h"

 #include "llvm/ADT/StringExtras.h"
 #include "AllocationState.h"
 #include <climits>
 #include <utility>
 
 using namespace clang;
 using namespace ento;
 
+//===----------------------------------------------------------------------===//
+// The types of allocation we're modeling.
+//===----------------------------------------------------------------------===//
+
 namespace {
 
 // Used to check correspondence between allocators and deallocators.
 enum AllocationFamily {
   AF_None,
   AF_Malloc,
   AF_CXXNew,
   AF_CXXNewArray,
   AF_IfNameIndex,
   AF_Alloca,
   AF_InnerBuffer
 };
 
+struct MemFunctionInfoTy;
+
+} // end of anonymous namespace
+
+/// Determine family of a deallocation expression.
+static AllocationFamily getAllocationFamily(
+    const MemFunctionInfoTy &MemFunctionInfo, CheckerContext &C, const Stmt *S);
+
+/// Print names of allocators and deallocators.
+///
+/// \returns true on success.
+static bool printAllocDeallocName(raw_ostream &os, CheckerContext &C,
+                                  const Expr *E);
+
+/// Print expected name of an allocator based on the deallocator's
+/// family derived from the DeallocExpr.
+static void printExpectedAllocName(raw_ostream &os,
+                                   const MemFunctionInfoTy  &MemFunctionInfo,
+                                   CheckerContext &C, const Expr *E);
+
+/// Print expected name of a deallocator based on the allocator's
+/// family.
+static void printExpectedDeallocName(raw_ostream &os, AllocationFamily Family);
+
+//===----------------------------------------------------------------------===//
+// The state of a symbol, in terms of memory management.
+//===----------------------------------------------------------------------===//
+
+namespace {
+
 class RefState {
-  enum Kind { // Reference to allocated memory.
-              Allocated,
-              // Reference to zero-allocated memory.
-              AllocatedOfSizeZero,
-              // Reference to released/freed memory.
-              Released,
-              // The responsibility for freeing resources has transferred from
-              // this reference. A relinquished symbol should not be freed.
-              Relinquished,
-              // We are no longer guaranteed to have observed all manipulations
-              // of this pointer/memory. For example, it could have been
-              // passed as a parameter to an opaque function.
-              Escaped
+  enum Kind {
+    // Reference to allocated memory.
   };
 
   const Stmt *S;
-  unsigned K : 3; // Kind enum, but stored as a bitfield.
-  unsigned Family : 29; // Rest of 32-bit word, currently just an allocation
-                        // family.
 
-  RefState(Kind k, const Stmt *s, unsigned family)
+  Kind K : 3;
+  AllocationFamily Family : 3;
+
+  RefState(Kind k, const Stmt *s, AllocationFamily family)
     : S(s), K(k), Family(family) {
     assert(family != AF_None);
   }
 public:
   bool isAllocated() const { return K == Allocated; }
   bool isAllocatedOfSizeZero() const { return K == AllocatedOfSizeZero; }
   bool isReleased() const { return K == Released; }
   bool isRelinquished() const { return K == Relinquished; }
   bool isEscaped() const { return K == Escaped; }
   AllocationFamily getAllocationFamily() const {
-    return (AllocationFamily)Family;
+    return Family;
   }
   const Stmt *getStmt() const { return S; }
 
   bool operator==(const RefState &X) const {
     return K == X.K && S == X.S && Family == X.Family;
   }
 
-  static RefState getAllocated(unsigned family, const Stmt *s) {
+  static RefState getAllocated(AllocationFamily family, const Stmt *s) {
     return RefState(Allocated, s, family);
   }
   static RefState getAllocatedOfSizeZero(const RefState *RS) {
     return RefState(AllocatedOfSizeZero, RS->getStmt(),
                     RS->getAllocationFamily());
   }
-  static RefState getReleased(unsigned family, const Stmt *s) {
+  static RefState getReleased(AllocationFamily family, const Stmt *s) {
     return RefState(Released, s, family);
   }
-  static RefState getRelinquished(unsigned family, const Stmt *s) {
+  static RefState getRelinquished(AllocationFamily family, const Stmt *s) {
     return RefState(Relinquished, s, family);
   }
   static RefState getEscaped(const RefState *RS) {
     return RefState(Escaped, RS->getStmt(), RS->getAllocationFamily());
   }
 
   void Profile(llvm::FoldingSetNodeID &ID) const {
     ID.AddInteger(K);
     ID.AddPointer(S);
     ID.AddInteger(Family);
   }
 
-  void dump(raw_ostream &OS) const {
-    switch (static_cast<Kind>(K)) {
+  LLVM_DUMP_METHOD void dump(raw_ostream &OS) const {
+    switch (K) {
 #define CASE(ID) case ID: OS << #ID; break;
     CASE(Allocated)
     CASE(AllocatedOfSizeZero)
     CASE(Released)
     CASE(Relinquished)
     CASE(Escaped)
     }
   }
 
   LLVM_DUMP_METHOD void dump() const { dump(llvm::errs()); }
 };
 
-enum ReallocPairKind {
-  RPToBeFreedAfterFailure,
-  // The symbol has been freed when reallocation failed.
-  RPIsFreeOnFailure,
-  // The symbol does not need to be freed after reallocation fails.
-  RPDoNotTrackAfterFailure
+} // end of anonymous namespace
+
+REGISTER_MAP_WITH_PROGRAMSTATE(RegionState, SymbolRef, RefState)
+
+/// Check if the memory associated with this symbol was released.
+static bool isReleased(SymbolRef Sym, CheckerContext &C);
+
+/// Update the RefState to reflect the new memory allocation.
+/// The optional \p RetVal parameter specifies the newly allocated pointer
+/// value; if unspecified, the value of expression \p E is used.
+static ProgramStateRef
+MallocUpdateRefState(CheckerContext &C, const Expr *E, ProgramStateRef State,
+                     AllocationFamily Family = AF_Malloc,
+                     Optional<SVal> RetVal = None);
+
+//===----------------------------------------------------------------------===//
+// The modeling of memory reallocation.
+//
+// The terminology 'toPtr' and 'fromPtr' will be used:
+//   toPtr = realloc(fromPtr, 20);
+//===----------------------------------------------------------------------===//
+
+REGISTER_SET_WITH_PROGRAMSTATE(ReallocSizeZeroSymbols, SymbolRef)
+
+namespace {
+
+/// The state of 'fromPtr' after reallocation is known to have failed.
+enum OwnershipAfterReallocKind {
+  // The symbol needs to be freed (e.g.: realloc)
+  OAR_ToBeFreedAfterFailure,
+  // The symbol has been freed (e.g.: reallocf)
+  OAR_FreeOnFailure,
+  // The symbol doesn't have to freed (e.g.: we aren't sure if, how and where
+  // 'fromPtr' was allocated:
+  //    void Haha(int *ptr) {
+  //      ptr = realloc(ptr, 67);
+  //      // ...
+  //    }
+  // ).
+  OAR_DoNotTrackAfterFailure
 };
 
-/// \class ReallocPair
-/// Stores information about the symbol being reallocated by a call to
-/// 'realloc' to allow modeling failed reallocation later in the path.
+/// Stores information about the 'fromPtr' symbol after reallocation.
+///
+/// This is important because realloc may fail, and that needs special modeling.
+/// Whether reallocation failed or not will not be known until later, so we'll
+/// store whether upon failure 'fromPtr' will be freed, or needs to be freed
+/// later, etc.
 struct ReallocPair {
-  // The symbol which realloc reallocated.
+
+  // The 'fromPtr'.
   SymbolRef ReallocatedSym;
-  ReallocPairKind Kind;
+  OwnershipAfterReallocKind Kind;
 
-  ReallocPair(SymbolRef S, ReallocPairKind K) :
+  ReallocPair(SymbolRef S, OwnershipAfterReallocKind K) :
     ReallocatedSym(S), Kind(K) {}
   void Profile(llvm::FoldingSetNodeID &ID) const {
     ID.AddInteger(Kind);
     ID.AddPointer(ReallocatedSym);
   }
   bool operator==(const ReallocPair &X) const {
     return ReallocatedSym == X.ReallocatedSym &&
            Kind == X.Kind;
   }
 };
 
-typedef std::pair<const ExplodedNode*, const MemRegion*> LeakInfo;
+} // end of anonymous namespace
+
+REGISTER_MAP_WITH_PROGRAMSTATE(ReallocPairs, SymbolRef, ReallocPair)
+
+//===----------------------------------------------------------------------===//
+// Kinds of memory operations, information about resource managing functions.
+//===----------------------------------------------------------------------===//
+
+namespace {
+
+enum class MemoryOperationKind {
+  MOK_Allocate,
+  MOK_Free,
+  MOK_Any
+};
+
+struct MemFunctionInfoTy {
+  /// The value of the MallocChecker:Optimistic is stored in this variable.
+  ///
+  /// In pessimistic mode, the checker assumes that it does not know which
+  /// functions might free the memory.
+  /// In optimistic mode, the checker assumes that all user-defined functions
+  /// which might free a pointer are annotated.
+  DefaultBool ShouldIncludeOwnershipAnnotatedFunctions;
+
+  // TODO: Change these to CallDescription, and get rid of lazy initialization.
+  mutable IdentifierInfo *II_alloca = nullptr, *II_win_alloca = nullptr,
+                         *II_malloc = nullptr, *II_free = nullptr,
+                         *II_realloc = nullptr, *II_calloc = nullptr,
+                         *II_valloc = nullptr, *II_reallocf = nullptr,
+                         *II_strndup = nullptr, *II_strdup = nullptr,
+                         *II_win_strdup = nullptr, *II_kmalloc = nullptr,
+                         *II_if_nameindex = nullptr,
+                         *II_if_freenameindex = nullptr, *II_wcsdup = nullptr,
+                         *II_win_wcsdup = nullptr, *II_g_malloc = nullptr,
+                         *II_g_malloc0 = nullptr, *II_g_realloc = nullptr,
+                         *II_g_try_malloc = nullptr,
+                         *II_g_try_malloc0 = nullptr,
+                         *II_g_try_realloc = nullptr, *II_g_free = nullptr,
+                         *II_g_memdup = nullptr, *II_g_malloc_n = nullptr,
+                         *II_g_malloc0_n = nullptr, *II_g_realloc_n = nullptr,
+                         *II_g_try_malloc_n = nullptr,
+                         *II_g_try_malloc0_n = nullptr,
+                         *II_g_try_realloc_n = nullptr;
+
+  void initIdentifierInfo(ASTContext &C) const;
+
+  ///@{
+  /// Check if this is one of the functions which can allocate/reallocate
+  /// memory pointed to by one of its arguments.
+  bool isMemFunction(const FunctionDecl *FD, ASTContext &C) const;
+  bool isCMemFunction(const FunctionDecl *FD,
+                      ASTContext &C,
+                      AllocationFamily Family,
+                      MemoryOperationKind MemKind) const;
+
+  /// Tells if the callee is one of the builtin new/delete operators, including
+  /// placement operators and other standard overloads.
+  bool isStandardNewDelete(const FunctionDecl *FD, ASTContext &C) const;
+  ///@}
+};
+
+} // end of anonymous namespace
+
+//===----------------------------------------------------------------------===//
+// Definition of the MallocChecker class.
+//===----------------------------------------------------------------------===//
+
+namespace {
 
 class MallocChecker : public Checker<check::DeadSymbols,
                                      check::PointerEscape,
                                      check::ConstPointerEscape,
                                      check::PreStmt<ReturnStmt>,
                                      check::EndFunction,
                                      check::PreCall,
                                      check::PostStmt<CallExpr>,
                                      check::PostStmt<CXXNewExpr>,
                                      check::NewAllocator,
                                      check::PreStmt<CXXDeleteExpr>,
                                      check::PostStmt<BlockExpr>,
                                      check::PostObjCMessage,
                                      check::Location,
-                                     eval::Assume>
-{
+                                     eval::Assume> {
 public:
-  MallocChecker()
-      : II_alloca(nullptr), II_win_alloca(nullptr), II_malloc(nullptr),
-        II_free(nullptr), II_realloc(nullptr), II_calloc(nullptr),
-        II_valloc(nullptr), II_reallocf(nullptr), II_strndup(nullptr),
-        II_strdup(nullptr), II_win_strdup(nullptr), II_kmalloc(nullptr),
-        II_if_nameindex(nullptr), II_if_freenameindex(nullptr),
-        II_wcsdup(nullptr), II_win_wcsdup(nullptr), II_g_malloc(nullptr),
-        II_g_malloc0(nullptr), II_g_realloc(nullptr), II_g_try_malloc(nullptr),
-        II_g_try_malloc0(nullptr), II_g_try_realloc(nullptr),
-        II_g_free(nullptr), II_g_memdup(nullptr), II_g_malloc_n(nullptr),
-        II_g_malloc0_n(nullptr), II_g_realloc_n(nullptr),
-        II_g_try_malloc_n(nullptr), II_g_try_malloc0_n(nullptr),
-        II_g_try_realloc_n(nullptr) {}
+  MemFunctionInfoTy MemFunctionInfo;
 
-  /// In pessimistic mode, the checker assumes that it does not know which
-  /// functions might free the memory.
+  /// Many checkers are essentially built into this one, so enabling them will
+  /// make MallocChecker perform additional modeling and reporting.
   enum CheckKind {
+    /// When a subchecker is enabled but MallocChecker isn't, model memory
+    /// management but do not emit warnings emitted with MallocChecker only
+    /// enabled.
     CK_MallocChecker,
     CK_NewDeleteChecker,
     CK_NewDeleteLeaksChecker,
     CK_MismatchedDeallocatorChecker,
     CK_InnerPointerChecker,
     CK_NumCheckKinds
   };
 
-  enum class MemoryOperationKind {
-    MOK_Allocate,
-    MOK_Free,
-    MOK_Any
-  };
-
-  DefaultBool IsOptimistic;
+  using LeakInfo = std::pair<const ExplodedNode*, const MemRegion*>;
 
   DefaultBool ChecksEnabled[CK_NumCheckKinds];
   CheckName CheckNames[CK_NumCheckKinds];
 
   void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
   void checkPostStmt(const CallExpr *CE, CheckerContext &C) const;
   void checkPostStmt(const CXXNewExpr *NE, CheckerContext &C) const;
   void checkNewAllocator(const CXXNewExpr *NE, SVal Target,
private:
   mutable std::unique_ptr<BugType> BT_DoubleDelete;
   mutable std::unique_ptr<BugType> BT_Leak[CK_NumCheckKinds];
   mutable std::unique_ptr<BugType> BT_UseFree[CK_NumCheckKinds];
   mutable std::unique_ptr<BugType> BT_BadFree[CK_NumCheckKinds];
   mutable std::unique_ptr<BugType> BT_FreeAlloca[CK_NumCheckKinds];
   mutable std::unique_ptr<BugType> BT_MismatchedDealloc;
   mutable std::unique_ptr<BugType> BT_OffsetFree[CK_NumCheckKinds];
   mutable std::unique_ptr<BugType> BT_UseZerroAllocated[CK_NumCheckKinds];
-  mutable IdentifierInfo *II_alloca, *II_win_alloca, *II_malloc, *II_free,
-                         *II_realloc, *II_calloc, *II_valloc, *II_reallocf,
-                         *II_strndup, *II_strdup, *II_win_strdup, *II_kmalloc,
-                         *II_if_nameindex, *II_if_freenameindex, *II_wcsdup,
-                         *II_win_wcsdup, *II_g_malloc, *II_g_malloc0,
-                         *II_g_realloc, *II_g_try_malloc, *II_g_try_malloc0,
-                         *II_g_try_realloc, *II_g_free, *II_g_memdup,
-                         *II_g_malloc_n, *II_g_malloc0_n, *II_g_realloc_n,
-                         *II_g_try_malloc_n, *II_g_try_malloc0_n,
-                         *II_g_try_realloc_n;
-  mutable Optional<uint64_t> KernelZeroFlagVal;
-
-  void initIdentifierInfo(ASTContext &C) const;
-
-  /// Determine family of a deallocation expression.
-  AllocationFamily getAllocationFamily(CheckerContext &C, const Stmt *S) const;
-
-  /// Print names of allocators and deallocators.
-  ///
-  /// \returns true on success.
-  bool printAllocDeallocName(raw_ostream &os, CheckerContext &C,
-                             const Expr *E) const;
-
-  /// Print expected name of an allocator based on the deallocator's
-  /// family derived from the DeallocExpr.
-  void printExpectedAllocName(raw_ostream &os, CheckerContext &C,
-                              const Expr *DeallocExpr) const;
-  /// Print expected name of a deallocator based on the allocator's
-  /// family.
-  void printExpectedDeallocName(raw_ostream &os, AllocationFamily Family) const;
 
-  ///@{
-  /// Check if this is one of the functions which can allocate/reallocate memory
-  /// pointed to by one of its arguments.
-  bool isMemFunction(const FunctionDecl *FD, ASTContext &C) const;
-  bool isCMemFunction(const FunctionDecl *FD,
-                      ASTContext &C,
-                      AllocationFamily Family,
-                      MemoryOperationKind MemKind) const;
-  bool isStandardNewDelete(const FunctionDecl *FD, ASTContext &C) const;
-  ///@}
+  // TODO: Remove mutable by moving the initializtaion to the registry function.
+  mutable Optional<uint64_t> KernelZeroFlagVal;
 
   /// Process C++ operator new()'s allocation, which is the part of C++
   /// new-expression that goes before the constructor.
   void processNewAllocation(const CXXNewExpr *NE, CheckerContext &C,
                             SVal Target) const;
 
   /// Perform a zero-allocation check.
-  /// The optional \p RetVal parameter specifies the newly allocated pointer
-  /// value; if unspecified, the value of expression \p E is used.
-  ProgramStateRef ProcessZeroAllocation(CheckerContext &C, const Expr *E,
-                                        const unsigned AllocationSizeArg,
+  ///
+  /// \param [in] E The expression that allocates memory.
+  /// \param [in] IndexOfSizeArg Index of the argument that specifies the size
+  ///   of the memory that needs to be allocated. E.g. for malloc, this would be
+  ///   0.
+  /// \param [in] RetVal Specifies the newly allocated pointer value;
+  ///   if unspecified, the value of expression \p E is used.
+  static ProgramStateRef ProcessZeroAllocCheck(CheckerContext &C, const Expr *E,
+                                               const unsigned IndexOfSizeArg,
                                                ProgramStateRef State,
-                                        Optional<SVal> RetVal = None) const;
+                                               Optional<SVal> RetVal = None);
 
+  /// Model functions with the ownership_returns attribute.
+  ///
+  /// User-defined function may have the ownership_returns attribute, which
+  /// annotates that the function returns with an object that was allocated on
+  /// the heap, and passes the ownertship to the callee.
+  ///
+  ///   void __attribute((ownership_returns(malloc, 1))) *my_malloc(size_t);
+  ///
+  /// It has two parameters:
+  ///   - first: name of the resource (e.g. 'malloc')
+  ///   - (OPTIONAL) second: size of the allocated region
+  ///
+  /// \param [in] CE The expression that allocates memory.
+  /// \param [in] Att The ownership_returns attribute.
+  /// \param [in] State The \c ProgramState right before allocation.
+  /// \returns The ProgramState right after allocation.
   ProgramStateRef MallocMemReturnsAttr(CheckerContext &C,
                                        const CallExpr *CE,
                                        const OwnershipAttr* Att,
                                        ProgramStateRef State) const;
+
+  /// Models memory allocation.
+  ///
+  /// \param [in] CE The expression that allocates memory.
+  /// \param [in] SizeEx Size of the memory that needs to be allocated.
+  /// \param [in] Init The value the allocated memory needs to be initialized.
+  /// with. For example, \c calloc initializes the allocated memory to 0,
+  /// malloc leaves it undefined.
+  /// \param [in] State The \c ProgramState right before allocation.
+  /// \returns The ProgramState right after allocation.
   static ProgramStateRef MallocMemAux(CheckerContext &C, const CallExpr *CE,
                                       const Expr *SizeEx, SVal Init,
                                       ProgramStateRef State,
                                       AllocationFamily Family = AF_Malloc);
+
+  /// Models memory allocation.
+  ///
+  /// \param [in] CE The expression that allocates memory.
+  /// \param [in] Size Size of the memory that needs to be allocated.
+  /// \param [in] Init The value the allocated memory needs to be initialized.
+  /// with. For example, \c calloc initializes the allocated memory to 0,
+  /// malloc leaves it undefined.
+  /// \param [in] State The \c ProgramState right before allocation.
+  /// \returns The ProgramState right after allocation.
   static ProgramStateRef MallocMemAux(CheckerContext &C, const CallExpr *CE,
-                                      SVal SizeEx, SVal Init,
+                                      SVal Size, SVal Init,
                                       ProgramStateRef State,
                                       AllocationFamily Family = AF_Malloc);
 
   static ProgramStateRef addExtentSize(CheckerContext &C, const CXXNewExpr *NE,
                                        ProgramStateRef State, SVal Target);
 
   // Check if this malloc() for special flags. At present that means M_ZERO or
   // __GFP_ZERO (in which case, treat it like calloc).
   llvm::Optional<ProgramStateRef>
   performKernelMalloc(const CallExpr *CE, CheckerContext &C,
                       const ProgramStateRef &State) const;
 
-  /// Update the RefState to reflect the new memory allocation.
-  /// The optional \p RetVal parameter specifies the newly allocated pointer
-  /// value; if unspecified, the value of expression \p E is used.
-  static ProgramStateRef
-  MallocUpdateRefState(CheckerContext &C, const Expr *E, ProgramStateRef State,
-                       AllocationFamily Family = AF_Malloc,
-                       Optional<SVal> RetVal = None);
-
+  /// Model functions with the ownership_takes and ownership_holds attributes.
+  ///
+  /// User-defined function may have the ownership_takes and/or ownership_holds
+  /// attributes, which annotates that the function frees the memory passed as a
+  /// parameter.
+  ///
+  ///   void __attribute((ownership_takes(malloc, 1))) my_free(void *);
+  ///   void __attribute((ownership_holds(malloc, 1))) my_hold(void *);
+  ///
+  /// They have two parameters:
+  ///   - first: name of the resource (e.g. 'malloc')
+  ///   - second: index of the parameter the attribute applies to
+  ///
+  /// \param [in] CE The expression that frees memory.
+  /// \param [in] Att The ownership_takes or ownership_holds attribute.
+  /// \param [in] State The \c ProgramState right before allocation.
+  /// \returns The ProgramState right after allocation.
   ProgramStateRef FreeMemAttr(CheckerContext &C, const CallExpr *CE,
                               const OwnershipAttr* Att,
                               ProgramStateRef State) const;
+
+  /// Models memory deallocation.
+  ///
+  /// \param [in] CE The expression that frees memory.
+  /// \param [in] State The \c ProgramState right before allocation.
+  /// \param [in] Num Index of the argument that needs to be freed. This is
+  ///   normally 0, but for custom free functions it may be different.
+  /// \param [in] Hold Whether the parameter at \p Index has the ownership_holds
+  ///   attribute.
+  /// \param [out] IsKnownToBeAllocated Whether the memory to be freed is known
+  ///   to have been allocated, or in other words, the symbol to be freed was
+  ///   registered as allocated by this checker. In the following case, \c ptr
+  ///   isn't known to be allocated.
+  ///      void Haha(int *ptr) {
+  ///        ptr = realloc(ptr, 67);
+  ///        // ...
+  ///      }
+  /// \param [in] ReturnsNullOnFailure Whether the memory deallocation function
+  ///   we're modeling returns with Null on failure.
+  /// \returns The ProgramState right after allocation.
   ProgramStateRef FreeMemAux(CheckerContext &C, const CallExpr *CE,
-                             ProgramStateRef state, unsigned Num,
+                             ProgramStateRef State, unsigned Num,
                              bool Hold,
-                             bool &ReleasedAllocated,
+                             bool &IsKnownToBeAllocated,
                              bool ReturnsNullOnFailure = false) const;
-  ProgramStateRef FreeMemAux(CheckerContext &C, const Expr *Arg,
+
+  /// Models memory deallocation.
+  ///
+  /// \param [in] ArgExpr The variable who's pointee needs to be freed.
+  /// \param [in] ParentExpr The expression that frees the memory.
+  /// \param [in] State The \c ProgramState right before allocation.
+  ///   normally 0, but for custom free functions it may be different.
+  /// \param [in] Hold Whether the parameter at \p Index has the ownership_holds
+  ///   attribute.
+  /// \param [out] IsKnownToBeAllocated Whether the memory to be freed is known
+  ///   to have been allocated, or in other words, the symbol to be freed was
+  ///   registered as allocated by this checker. In the following case, \c ptr
+  ///   isn't known to be allocated.
+  ///      void Haha(int *ptr) {
+  ///        ptr = realloc(ptr, 67);
+  ///        // ...
+  ///      }
+  /// \param [in] ReturnsNullOnFailure Whether the memory deallocation function
+  ///   we're modeling returns with Null on failure.
+  /// \returns The ProgramState right after allocation.
+  ProgramStateRef FreeMemAux(CheckerContext &C, const Expr *ArgExpr,
                              const Expr *ParentExpr,
                              ProgramStateRef State,
                              bool Hold,
-                             bool &ReleasedAllocated,
+                             bool &IsKnownToBeAllocated,
                              bool ReturnsNullOnFailure = false) const;
 
+  // TODO: Needs some refactoring, as all other deallocation modeling
+  // functions are suffering from out parameters and messy code due to how
+  // realloc is handled.
+  //
+  /// Models memory reallocation.
+  ///
+  /// \param [in] CE The expression that reallocated memory
+  /// \param [in] FreesMemOnFailure Whether if reallocation fails, the supplied
+  ///   memory should be freed.
+  /// \param [in] State The \c ProgramState right before reallocation.
+  /// \param [in] SuffixWithN Whether the reallocation function we're modeling
+  ///   has an '_n' suffix, such as g_realloc_n.
+  /// \returns The ProgramState right after reallocation.
   ProgramStateRef ReallocMemAux(CheckerContext &C, const CallExpr *CE,
-                                bool FreesMemOnFailure,
+                                bool ShouldFreeOnFail,
                                 ProgramStateRef State,
                                 bool SuffixWithN = false) const;
+
+  /// Evaluates the buffer size that needs to be allocated.
+  ///
+  /// \param [in] Blocks The amount of blocks that needs to be allocated.
+  /// \param [in] BlockBytes The size of a block.
+  /// \returns The symbolic value of \p Blocks * \p BlockBytes.
   static SVal evalMulForBufferSize(CheckerContext &C, const Expr *Blocks,
                                    const Expr *BlockBytes);
+
+  /// Models zero initialized array allocation.
+  ///
+  /// \param [in] CE The expression that reallocated memory
+  /// \param [in] State The \c ProgramState right before reallocation.
+  /// \returns The ProgramState right after allocation.
   static ProgramStateRef CallocMem(CheckerContext &C, const CallExpr *CE,
                                    ProgramStateRef State);
 
-  /// Check if the memory associated with this symbol was released.
-  bool isReleased(SymbolRef Sym, CheckerContext &C) const;
-
+  /// If in \p S  \p Sym is used, check whether \p Sym was already freed.
   bool checkUseAfterFree(SymbolRef Sym, CheckerContext &C, const Stmt *S) const;
 
+  /// If in \p S \p Sym is used, check whether \p Sym was allocated as a zero
+  /// sized memory region.
   void checkUseZeroAllocated(SymbolRef Sym, CheckerContext &C,
                              const Stmt *S) const;
 
+  /// If in \p S \p Sym is being freed, check whether \p Sym was already freed.
   bool checkDoubleDelete(SymbolRef Sym, CheckerContext &C) const;
 
-  /// Check if the function is known free memory, or if it is
+  /// Check if the function is known to free memory, or if it is
   /// "interesting" and should be modeled explicitly.
   ///
   /// \param [out] EscapingSymbol A function might not free memory in general,
   ///   but could be known to free a particular symbol. In this case, false is
   ///   returned and the single escaping symbol is returned through the out
   ///   parameter.
   ///
   /// We assume that pointers do not escape through calls to system functions
   /// not handled by this checker.
   bool mayFreeAnyEscapedMemoryOrIsModeledExplicitly(const CallEvent *Call,
                                    ProgramStateRef State,
                                    SymbolRef &EscapingSymbol) const;
 
-  // Implementation of the checkPointerEscape callbacks.
+  /// Implementation of the checkPointerEscape callbacks.
   ProgramStateRef checkPointerEscapeAux(ProgramStateRef State,
                                         const InvalidatedSymbols &Escaped,
                                         const CallEvent *Call,
                                         PointerEscapeKind Kind,
-                                  bool(*CheckRefState)(const RefState*)) const;
+                                        bool IsConstPointerEscape) const;
 
   // Implementation of the checkPreStmt and checkEndFunction callbacks.
   void checkEscapeOnReturn(const ReturnStmt *S, CheckerContext &C) const;
 
   ///@{
   /// Tells if a given family/call/symbol is tracked by the current checker.
   /// Sets CheckKind to the kind of the checker responsible for this
   /// family/call/symbol.
   Optional<CheckKind> getCheckIfTracked(AllocationFamily Family,
                                         bool IsALeakCheck = false) const;
   Optional<CheckKind> getCheckIfTracked(CheckerContext &C,
                                         const Stmt *AllocDeallocStmt,
                                         bool IsALeakCheck = false) const;
   Optional<CheckKind> getCheckIfTracked(CheckerContext &C, SymbolRef Sym,
                                         bool IsALeakCheck = false) const;
   ///@}
   static bool SummarizeValue(raw_ostream &os, SVal V);
   static bool SummarizeRegion(raw_ostream &os, const MemRegion *MR);
+
   void ReportBadFree(CheckerContext &C, SVal ArgVal, SourceRange Range,
                      const Expr *DeallocExpr) const;
   void ReportFreeAlloca(CheckerContext &C, SVal ArgVal,
                         SourceRange Range) const;
   void ReportMismatchedDealloc(CheckerContext &C, SourceRange Range,
                                const Expr *DeallocExpr, const RefState *RS,
                                SymbolRef Sym, bool OwnershipTransferred) const;
   void ReportOffsetFree(CheckerContext &C, SVal ArgVal, SourceRange Range,
private:
   void ReportUseZeroAllocated(CheckerContext &C, SourceRange Range,
                               SymbolRef Sym) const;
 
   void ReportFunctionPointerFree(CheckerContext &C, SVal ArgVal,
                                  SourceRange Range, const Expr *FreeExpr) const;
 
   /// Find the location of the allocation for Sym on the path leading to the
   /// exploded node N.
-  LeakInfo getAllocationSite(const ExplodedNode *N, SymbolRef Sym,
-                             CheckerContext &C) const;
+  static LeakInfo getAllocationSite(const ExplodedNode *N, SymbolRef Sym,
+                                    CheckerContext &C);
+
 
   void reportLeak(SymbolRef Sym, ExplodedNode *N, CheckerContext &C) const;
+};
+
+} // end anonymous namespace
+
+//===----------------------------------------------------------------------===//
+// Definition of MallocBugVisitor.
+//===----------------------------------------------------------------------===//
 
-  /// The bug visitor which allows us to print extra diagnostics along the
-  /// BugReport path. For example, showing the allocation site of the leaked
-  /// region.
-  class MallocBugVisitor final : public BugReporterVisitor {
-  protected:
-    enum NotificationMode {
-      Normal,
-      ReallocationFailed
-    };
 
-    // The allocated region symbol tracked by the main analysis.
-    SymbolRef Sym;
 
-    // The mode we are in, i.e. what kind of diagnostics will be emitted.
-    NotificationMode Mode;
 
-    // A symbol from when the primary region should have been reallocated.
-    SymbolRef FailedReallocSymbol;
 
-    // A C++ destructor stack frame in which memory was released. Used for
-    // miscellaneous false positive suppression.
-    const StackFrameContext *ReleaseDestructorLC;
 
-    bool IsLeak;
 
-  public:
-    MallocBugVisitor(SymbolRef S, bool isLeak = false)
-        : Sym(S), Mode(Normal), FailedReallocSymbol(nullptr),
-          ReleaseDestructorLC(nullptr), IsLeak(isLeak) {}
 
-    static void *getTag() {
-      static int Tag = 0;
-      return &Tag;
-    }
 
-    void Profile(llvm::FoldingSetNodeID &ID) const override {
-      ID.AddPointer(getTag());
-      ID.AddPointer(Sym);
-    }
 
-    inline bool isAllocated(const RefState *S, const RefState *SPrev,
+  /// Did not track -> allocated. Other state (released) -> allocated.
+  static inline bool isAllocated(const RefState *RSCurr, const RefState *RSPrev,
                                  const Stmt *Stmt) {
-      // Did not track -> allocated. Other state (released) -> allocated.
-      return (Stmt && (isa<CallExpr>(Stmt) || isa<CXXNewExpr>(Stmt)) &&
-              (S && (S->isAllocated() || S->isAllocatedOfSizeZero())) &&
-              (!SPrev || !(SPrev->isAllocated() ||
-                           SPrev->isAllocatedOfSizeZero())));
-    }
+            (RSCurr && (RSCurr->isAllocated() ||
+                        RSCurr->isAllocatedOfSizeZero())) &&
+            (!RSPrev || !(RSPrev->isAllocated() ||
+                         RSPrev->isAllocatedOfSizeZero())));
 
-    inline bool isReleased(const RefState *S, const RefState *SPrev,
+  /// Did not track -> released. Other state (allocated) -> released.
+  /// The statement associated with the release might be missing.
+  static inline bool isReleased(const RefState *RSCurr, const RefState *RSPrev,
                                 const Stmt *Stmt) {
-      // Did not track -> released. Other state (allocated) -> released.
-      // The statement associated with the release might be missing.
-      bool IsReleased = (S && S->isReleased()) &&
-                        (!SPrev || !SPrev->isReleased());
-      assert(!IsReleased ||
-             (Stmt && (isa<CallExpr>(Stmt) || isa<CXXDeleteExpr>(Stmt))) ||
-             (!Stmt && S->getAllocationFamily() == AF_InnerBuffer));
-      return IsReleased;
-    }
+    bool IsReleased = (RSCurr && RSCurr->isReleased()) &&
+                      (!RSPrev || !RSPrev->isReleased());
+           (!Stmt && RSCurr->getAllocationFamily() == AF_InnerBuffer));
 
-    inline bool isRelinquished(const RefState *S, const RefState *SPrev,
+  /// Did not track -> relinquished. Other state (allocated) -> relinquished.
+  static inline bool isRelinquished(const RefState *RSCurr,
+                                    const RefState *RSPrev,
                                     const Stmt *Stmt) {
-      // Did not track -> relinquished. Other state (allocated) -> relinquished.
-      return (Stmt && (isa<CallExpr>(Stmt) || isa<ObjCMessageExpr>(Stmt) ||
-                                              isa<ObjCPropertyRefExpr>(Stmt)) &&
-              (S && S->isRelinquished()) &&
-              (!SPrev || !SPrev->isRelinquished()));
-    }
+            (RSCurr && RSCurr->isRelinquished()) &&
+            (!RSPrev || !RSPrev->isRelinquished()));
 
-    inline bool isReallocFailedCheck(const RefState *S, const RefState *SPrev,
+  /// If the expression is not a call, and the state change is
+  /// released -> allocated, it must be the realloc return value
+  /// check. If we have to handle more cases here, it might be cleaner just
+  /// to track this extra bit in the state itself.
+  static inline bool hasReallocFailed(const RefState *RSCurr,
+                                      const RefState *RSPrev,
                                       const Stmt *Stmt) {
-      // If the expression is not a call, and the state change is
-      // released -> allocated, it must be the realloc return value
-      // check. If we have to handle more cases here, it might be cleaner just
-      // to track this extra bit in the state itself.
-      return ((!Stmt || !isa<CallExpr>(Stmt)) &&
-              (S && (S->isAllocated() || S->isAllocatedOfSizeZero())) &&
-              (SPrev && !(SPrev->isAllocated() ||
-                          SPrev->isAllocatedOfSizeZero())));
-    }
+            (RSCurr && (RSCurr->isAllocated() ||
+                        RSCurr->isAllocatedOfSizeZero())) &&
+            (RSPrev && !(RSPrev->isAllocated() ||
+                        RSPrev->isAllocatedOfSizeZero())));
 
-    std::shared_ptr<PathDiagnosticPiece> VisitNode(const ExplodedNode *N,
-                                                   BugReporterContext &BRC,
-                                                   BugReport &BR) override;
 
-    std::shared_ptr<PathDiagnosticPiece>
-    getEndPath(BugReporterContext &BRC, const ExplodedNode *EndPathNode,
-               BugReport &BR) override {
-      if (!IsLeak)
-        return nullptr;
 
-      PathDiagnosticLocation L =
-        PathDiagnosticLocation::createEndOfPath(EndPathNode,
-                                                BRC.getSourceManager());
-      // Do not add the statement itself as a range in case of leak.
-      return std::make_shared<PathDiagnosticEventPiece>(L, BR.getDescription(),
-                                                         false);
-    }
 
-  private:
-    class StackHintGeneratorForReallocationFailed
-        : public StackHintGeneratorForSymbol {
-    public:
-      StackHintGeneratorForReallocationFailed(SymbolRef S, StringRef M)
-        : StackHintGeneratorForSymbol(S, M) {}
 
-      std::string getMessageForArg(const Expr *ArgE,
-                                   unsigned ArgIndex) override {
-        // Printed parameters start at 1, not 0.
-        ++ArgIndex;
 
-        SmallString<200> buf;
-        llvm::raw_svector_ostream os(buf);
 
-        os << "Reallocation of " << ArgIndex << llvm::getOrdinalSuffix(ArgIndex)
-           << " parameter failed";
 
-        return os.str();
-      }
 
-      std::string getMessageForReturn(const CallExpr *CallExpr) override {
-        return "Reallocation of returned value failed";
-      }
-    };
-  };
-};
-} // end anonymous namespace
-
-REGISTER_MAP_WITH_PROGRAMSTATE(RegionState, SymbolRef, RefState)
-REGISTER_MAP_WITH_PROGRAMSTATE(ReallocPairs, SymbolRef, ReallocPair)
-REGISTER_SET_WITH_PROGRAMSTATE(ReallocSizeZeroSymbols, SymbolRef)
 
 // A map from the freed symbol to the symbol representing the return value of
 // the free function.
 REGISTER_MAP_WITH_PROGRAMSTATE(FreeReturnValue, SymbolRef, SymbolRef)
 
 namespace {
 class StopTrackingCallback final : public SymbolVisitor {
   ProgramStateRef state;
 public:
   StopTrackingCallback(ProgramStateRef st) : state(std::move(st)) {}
   ProgramStateRef getState() const { return state; }
 
   bool VisitSymbol(SymbolRef sym) override {
     state = state->remove<RegionState>(sym);
     return true;
   }
 };
 } // end anonymous namespace
 
-void MallocChecker::initIdentifierInfo(ASTContext &Ctx) const {
+//===----------------------------------------------------------------------===//
+// Methods of MemFunctionInfoTy.
+//===----------------------------------------------------------------------===//
+
+void MemFunctionInfoTy::initIdentifierInfo(ASTContext &Ctx) const {
   if (II_malloc)
     return;
   II_alloca = &Ctx.Idents.get("alloca");
   II_malloc = &Ctx.Idents.get("malloc");
   II_free = &Ctx.Idents.get("free");
   II_realloc = &Ctx.Idents.get("realloc");
   II_reallocf = &Ctx.Idents.get("reallocf");
   II_calloc = &Ctx.Idents.get("calloc");
void MemFunctionInfoTy::initIdentifierInfo(ASTContext &Ctx) const {
   II_g_malloc_n = &Ctx.Idents.get("g_malloc_n");
   II_g_malloc0_n = &Ctx.Idents.get("g_malloc0_n");
   II_g_realloc_n = &Ctx.Idents.get("g_realloc_n");
   II_g_try_malloc_n = &Ctx.Idents.get("g_try_malloc_n");
   II_g_try_malloc0_n = &Ctx.Idents.get("g_try_malloc0_n");
   II_g_try_realloc_n = &Ctx.Idents.get("g_try_realloc_n");
 }
 
-bool MallocChecker::isMemFunction(const FunctionDecl *FD, ASTContext &C) const {
+bool MemFunctionInfoTy::isMemFunction(const FunctionDecl *FD,
+                                      ASTContext &C) const {
   if (isCMemFunction(FD, C, AF_Malloc, MemoryOperationKind::MOK_Any))
     return true;
 
   if (isCMemFunction(FD, C, AF_IfNameIndex, MemoryOperationKind::MOK_Any))
     return true;
 
   if (isCMemFunction(FD, C, AF_Alloca, MemoryOperationKind::MOK_Any))
     return true;
 
   if (isStandardNewDelete(FD, C))
     return true;
 
   return false;
 }
 
-bool MallocChecker::isCMemFunction(const FunctionDecl *FD,
+bool MemFunctionInfoTy::isCMemFunction(const FunctionDecl *FD,
                                        ASTContext &C,
                                        AllocationFamily Family,
                                        MemoryOperationKind MemKind) const {
   if (!FD)
     return false;
 
   bool CheckFree = (MemKind == MemoryOperationKind::MOK_Any ||
                     MemKind == MemoryOperationKind::MOK_Free);
   bool CheckAlloc = (MemKind == MemoryOperationKind::MOK_Any ||
                      MemKind == MemoryOperationKind::MOK_Allocate);
 
if (Family == AF_Alloca && CheckAlloc) {
       if (FunI == II_alloca || FunI == II_win_alloca)
         return true;
     }
   }
 
   if (Family != AF_Malloc)
     return false;
 
-  if (IsOptimistic && FD->hasAttrs()) {
+  if (ShouldIncludeOwnershipAnnotatedFunctions && FD->hasAttrs()) {
     for (const auto *I : FD->specific_attrs<OwnershipAttr>()) {
       OwnershipAttr::OwnershipKind OwnKind = I->getOwnKind();
       if(OwnKind == OwnershipAttr::Takes || OwnKind == OwnershipAttr::Holds) {
         if (CheckFree)
           return true;
       } else if (OwnKind == OwnershipAttr::Returns) {
         if (CheckAlloc)
           return true;
       }
     }
   }
 
   return false;
 }
-
-// Tells if the callee is one of the builtin new/delete operators, including
-// placement operators and other standard overloads.
-bool MallocChecker::isStandardNewDelete(const FunctionDecl *FD,
+bool MemFunctionInfoTy::isStandardNewDelete(const FunctionDecl *FD,
                                         ASTContext &C) const {
   if (!FD)
     return false;
 
   OverloadedOperatorKind Kind = FD->getOverloadedOperator();
   if (Kind != OO_New && Kind != OO_Array_New &&
       Kind != OO_Delete && Kind != OO_Array_Delete)
     return false;
 
   // This is standard if and only if it's not defined in a user file.
   SourceLocation L = FD->getLocation();
   // If the header for operator delete is not included, it's still defined
   // in an invalid source location. Check to make sure we don't crash.
   return !L.isValid() || C.getSourceManager().isInSystemHeader(L);
 }
 
+//===----------------------------------------------------------------------===//
+// Methods of MallocChecker and MallocBugVisitor.
+//===----------------------------------------------------------------------===//
+
 llvm::Optional<ProgramStateRef> MallocChecker::performKernelMalloc(
   const CallExpr *CE, CheckerContext &C, const ProgramStateRef &State) const {
   // 3-argument malloc(), as commonly used in {Free,Net,Open}BSD Kernels:
   //
   // void *malloc(unsigned long size, struct malloc_type *mtp, int flags);
   //
   // One of the possible flags is M_ZERO, which means 'give me back an
   // allocation which is already zeroed', like calloc.
void MallocChecker::checkPostStmt(const CallExpr *CE, CheckerContext &C) const {
   if (C.wasInlined)
     return;
 
   const FunctionDecl *FD = C.getCalleeDecl(CE);
   if (!FD)
     return;
 
   ProgramStateRef State = C.getState();
-  bool ReleasedAllocatedMemory = false;
+  bool IsKnownToBeAllocatedMemory = false;
 
   if (FD->getKind() == Decl::Function) {
-    initIdentifierInfo(C.getASTContext());
+    MemFunctionInfo.initIdentifierInfo(C.getASTContext());
     IdentifierInfo *FunI = FD->getIdentifier();
 
-    if (FunI == II_malloc || FunI == II_g_malloc || FunI == II_g_try_malloc) {
-      if (CE->getNumArgs() < 1)
+    if (FunI == MemFunctionInfo.II_malloc ||
+        FunI == MemFunctionInfo.II_g_malloc ||
+        FunI == MemFunctionInfo.II_g_try_malloc) {
+      switch(CE->getNumArgs()) {
+      default:
         return;
-      if (CE->getNumArgs() < 3) {
+      case 1:
+        State = MallocMemAux(C, CE, CE->getArg(0), UndefinedVal(), State);
+        State = ProcessZeroAllocCheck(C, CE, 0, State);
+        break;
+      case 2:
         State = MallocMemAux(C, CE, CE->getArg(0), UndefinedVal(), State);
-        if (CE->getNumArgs() == 1)
-          State = ProcessZeroAllocation(C, CE, 0, State);
-      } else if (CE->getNumArgs() == 3) {
+        break;
+      case 3:
         llvm::Optional<ProgramStateRef> MaybeState =
           performKernelMalloc(CE, C, State);
         if (MaybeState.hasValue())
           State = MaybeState.getValue();
         else
           State = MallocMemAux(C, CE, CE->getArg(0), UndefinedVal(), State);
+        break;
       }
-    } else if (FunI == II_kmalloc) {
+    } else if (FunI == MemFunctionInfo.II_kmalloc) {
       if (CE->getNumArgs() < 1)
         return;
       llvm::Optional<ProgramStateRef> MaybeState =
         performKernelMalloc(CE, C, State);
       if (MaybeState.hasValue())
         State = MaybeState.getValue();
       else
         State = MallocMemAux(C, CE, CE->getArg(0), UndefinedVal(), State);
-    } else if (FunI == II_valloc) {
+    } else if (FunI == MemFunctionInfo.II_valloc) {
       if (CE->getNumArgs() < 1)
         return;
       State = MallocMemAux(C, CE, CE->getArg(0), UndefinedVal(), State);
-      State = ProcessZeroAllocation(C, CE, 0, State);
-    } else if (FunI == II_realloc || FunI == II_g_realloc ||
-               FunI == II_g_try_realloc) {
-      State = ReallocMemAux(C, CE, false, State);
-      State = ProcessZeroAllocation(C, CE, 1, State);
-    } else if (FunI == II_reallocf) {
-      State = ReallocMemAux(C, CE, true, State);
-      State = ProcessZeroAllocation(C, CE, 1, State);
-    } else if (FunI == II_calloc) {
+      State = ProcessZeroAllocCheck(C, CE, 0, State);
+    } else if (FunI == MemFunctionInfo.II_realloc ||
+               FunI == MemFunctionInfo.II_g_realloc ||
+               FunI == MemFunctionInfo.II_g_try_realloc) {
+      State = ReallocMemAux(C, CE, /*ShouldFreeOnFail*/false, State);
+      State = ProcessZeroAllocCheck(C, CE, 1, State);
+    } else if (FunI == MemFunctionInfo.II_reallocf) {
+      State = ReallocMemAux(C, CE, /*ShouldFreeOnFail*/true, State);
+      State = ProcessZeroAllocCheck(C, CE, 1, State);
+    } else if (FunI == MemFunctionInfo.II_calloc) {
       State = CallocMem(C, CE, State);
-      State = ProcessZeroAllocation(C, CE, 0, State);
-      State = ProcessZeroAllocation(C, CE, 1, State);
-    } else if (FunI == II_free || FunI == II_g_free) {
-      State = FreeMemAux(C, CE, State, 0, false, ReleasedAllocatedMemory);
-    } else if (FunI == II_strdup || FunI == II_win_strdup ||
-               FunI == II_wcsdup || FunI == II_win_wcsdup) {
+      State = ProcessZeroAllocCheck(C, CE, 0, State);
+      State = ProcessZeroAllocCheck(C, CE, 1, State);
+    } else if (FunI == MemFunctionInfo.II_free ||
+               FunI == MemFunctionInfo.II_g_free) {
+      State = FreeMemAux(C, CE, State, 0, false, IsKnownToBeAllocatedMemory);
+    } else if (FunI == MemFunctionInfo.II_strdup ||
+               FunI == MemFunctionInfo.II_win_strdup ||
+               FunI == MemFunctionInfo.II_wcsdup ||
+               FunI == MemFunctionInfo.II_win_wcsdup) {
       State = MallocUpdateRefState(C, CE, State);
-    } else if (FunI == II_strndup) {
+    } else if (FunI == MemFunctionInfo.II_strndup) {
       State = MallocUpdateRefState(C, CE, State);
-    } else if (FunI == II_alloca || FunI == II_win_alloca) {
+    } else if (FunI == MemFunctionInfo.II_alloca ||
+               FunI == MemFunctionInfo.II_win_alloca) {
       if (CE->getNumArgs() < 1)
         return;
       State = MallocMemAux(C, CE, CE->getArg(0), UndefinedVal(), State,
                            AF_Alloca);
-      State = ProcessZeroAllocation(C, CE, 0, State);
-    } else if (isStandardNewDelete(FD, C.getASTContext())) {
+      State = ProcessZeroAllocCheck(C, CE, 0, State);
+    } else if (MemFunctionInfo.isStandardNewDelete(FD, C.getASTContext())) {
       // Process direct calls to operator new/new[]/delete/delete[] functions
       // as distinct from new/new[]/delete/delete[] expressions that are
       // processed by the checkPostStmt callbacks for CXXNewExpr and
       // CXXDeleteExpr.
-      OverloadedOperatorKind K = FD->getOverloadedOperator();
-      if (K == OO_New) {
+      switch(FD->getOverloadedOperator()) {
+      case OO_New:
         State = MallocMemAux(C, CE, CE->getArg(0), UndefinedVal(), State,
                              AF_CXXNew);
-        State = ProcessZeroAllocation(C, CE, 0, State);
-      }
-      else if (K == OO_Array_New) {
+        State = ProcessZeroAllocCheck(C, CE, 0, State);
+        break;
+      case OO_Array_New:
         State = MallocMemAux(C, CE, CE->getArg(0), UndefinedVal(), State,
                              AF_CXXNewArray);
-        State = ProcessZeroAllocation(C, CE, 0, State);
-      }
-      else if (K == OO_Delete || K == OO_Array_Delete)
-        State = FreeMemAux(C, CE, State, 0, false, ReleasedAllocatedMemory);
-      else
+        State = ProcessZeroAllocCheck(C, CE, 0, State);
+        break;
+      case OO_Delete:
+      case OO_Array_Delete:
+        State = FreeMemAux(C, CE, State, 0, false, IsKnownToBeAllocatedMemory);
+        break;
+      default:
         llvm_unreachable("not a new/delete operator");
-    } else if (FunI == II_if_nameindex) {
+      }
+    } else if (FunI == MemFunctionInfo.II_if_nameindex) {
       // Should we model this differently? We can allocate a fixed number of
       // elements with zeros in the last one.
       State = MallocMemAux(C, CE, UnknownVal(), UnknownVal(), State,
                            AF_IfNameIndex);
-    } else if (FunI == II_if_freenameindex) {
-      State = FreeMemAux(C, CE, State, 0, false, ReleasedAllocatedMemory);
-    } else if (FunI == II_g_malloc0 || FunI == II_g_try_malloc0) {
+    } else if (FunI == MemFunctionInfo.II_if_freenameindex) {
+      State = FreeMemAux(C, CE, State, 0, false, IsKnownToBeAllocatedMemory);
+    } else if (FunI == MemFunctionInfo.II_g_malloc0 ||
+               FunI == MemFunctionInfo.II_g_try_malloc0) {
       if (CE->getNumArgs() < 1)
         return;
       SValBuilder &svalBuilder = C.getSValBuilder();
       SVal zeroVal = svalBuilder.makeZeroVal(svalBuilder.getContext().CharTy);
       State = MallocMemAux(C, CE, CE->getArg(0), zeroVal, State);
-      State = ProcessZeroAllocation(C, CE, 0, State);
-    } else if (FunI == II_g_memdup) {
+      State = ProcessZeroAllocCheck(C, CE, 0, State);
+    } else if (FunI == MemFunctionInfo.II_g_memdup) {
       if (CE->getNumArgs() < 2)
         return;
       State = MallocMemAux(C, CE, CE->getArg(1), UndefinedVal(), State);
-      State = ProcessZeroAllocation(C, CE, 1, State);
-    } else if (FunI == II_g_malloc_n || FunI == II_g_try_malloc_n ||
-               FunI == II_g_malloc0_n || FunI == II_g_try_malloc0_n) {
+      State = ProcessZeroAllocCheck(C, CE, 1, State);
+    } else if (FunI == MemFunctionInfo.II_g_malloc_n ||
+               FunI == MemFunctionInfo.II_g_try_malloc_n ||
+               FunI == MemFunctionInfo.II_g_malloc0_n ||
+               FunI == MemFunctionInfo.II_g_try_malloc0_n) {
       if (CE->getNumArgs() < 2)
         return;
       SVal Init = UndefinedVal();
-      if (FunI == II_g_malloc0_n || FunI == II_g_try_malloc0_n) {
+      if (FunI == MemFunctionInfo.II_g_malloc0_n ||
+          FunI == MemFunctionInfo.II_g_try_malloc0_n) {
         SValBuilder &SB = C.getSValBuilder();
         Init = SB.makeZeroVal(SB.getContext().CharTy);
       }
       SVal TotalSize = evalMulForBufferSize(C, CE->getArg(0), CE->getArg(1));
       State = MallocMemAux(C, CE, TotalSize, Init, State);
-      State = ProcessZeroAllocation(C, CE, 0, State);
-      State = ProcessZeroAllocation(C, CE, 1, State);
-    } else if (FunI == II_g_realloc_n || FunI == II_g_try_realloc_n) {
+      State = ProcessZeroAllocCheck(C, CE, 0, State);
+      State = ProcessZeroAllocCheck(C, CE, 1, State);
+    } else if (FunI == MemFunctionInfo.II_g_realloc_n ||
+               FunI == MemFunctionInfo.II_g_try_realloc_n) {
       if (CE->getNumArgs() < 3)
         return;
-      State = ReallocMemAux(C, CE, false, State, true);
-      State = ProcessZeroAllocation(C, CE, 1, State);
-      State = ProcessZeroAllocation(C, CE, 2, State);
+      State = ReallocMemAux(C, CE, /*ShouldFreeOnFail*/false, State,
+                            /*SuffixWithN*/true);
+      State = ProcessZeroAllocCheck(C, CE, 1, State);
+      State = ProcessZeroAllocCheck(C, CE, 2, State);
     }
   }
 
-  if (IsOptimistic || ChecksEnabled[CK_MismatchedDeallocatorChecker]) {
+  if (MemFunctionInfo.ShouldIncludeOwnershipAnnotatedFunctions ||
+      ChecksEnabled[CK_MismatchedDeallocatorChecker]) {
     // Check all the attributes, if there are any.
     // There can be multiple of these attributes.
     if (FD->hasAttrs())
       for (const auto *I : FD->specific_attrs<OwnershipAttr>()) {
         switch (I->getOwnKind()) {
         case OwnershipAttr::Returns:
           State = MallocMemReturnsAttr(C, CE, I, State);
           break;
         case OwnershipAttr::Takes:
         case OwnershipAttr::Holds:
           State = FreeMemAttr(C, CE, I, State);
           break;
         }
       }
   }
   C.addTransition(State);
 }
 
 // Performs a 0-sized allocations check.
-ProgramStateRef MallocChecker::ProcessZeroAllocation(
-    CheckerContext &C, const Expr *E, const unsigned AllocationSizeArg,
-    ProgramStateRef State, Optional<SVal> RetVal) const {
+ProgramStateRef MallocChecker::ProcessZeroAllocCheck(
+    CheckerContext &C, const Expr *E, const unsigned IndexOfSizeArg,
+    ProgramStateRef State, Optional<SVal> RetVal) {
   if (!State)
     return nullptr;
 
   if (!RetVal)
     RetVal = C.getSVal(E);
 
   const Expr *Arg = nullptr;
 
   if (const CallExpr *CE = dyn_cast<CallExpr>(E)) {
-    Arg = CE->getArg(AllocationSizeArg);
+    Arg = CE->getArg(IndexOfSizeArg);
   }
   else if (const CXXNewExpr *NE = dyn_cast<CXXNewExpr>(E)) {
     if (NE->isArray())
       Arg = NE->getArraySize();
     else
       return State;
   }
   else
static QualType getDeepPointeeType(QualType T) {
   QualType Result = T, PointeeType = T->getPointeeType();
   while (!PointeeType.isNull()) {
     Result = PointeeType;
     PointeeType = PointeeType->getPointeeType();
   }
   return Result;
 }
 
-static bool treatUnusedNewEscaped(const CXXNewExpr *NE) {
+/// \returns true if the constructor invoked by \p NE has an argument of a
+/// pointer/reference to a record type.
+static bool hasNonTrivialConstructorCall(const CXXNewExpr *NE) {
 
   const CXXConstructExpr *ConstructE = NE->getConstructExpr();
   if (!ConstructE)
     return false;
 
   if (!NE->getAllocatedType()->getAsCXXRecordDecl())
     return false;
 
   const CXXConstructorDecl *CtorD = ConstructE->getConstructor();
 
static bool hasNonTrivialConstructorCall(const CXXNewExpr *NE) {
   }
 
   return false;
 }
 
 void MallocChecker::processNewAllocation(const CXXNewExpr *NE,
                                          CheckerContext &C,
                                          SVal Target) const {
-  if (!isStandardNewDelete(NE->getOperatorNew(), C.getASTContext()))
+  if (!MemFunctionInfo.isStandardNewDelete(NE->getOperatorNew(),
+                                           C.getASTContext()))
     return;
 
   ParentMap &PM = C.getLocationContext()->getParentMap();
-  if (!PM.isConsumedExpr(NE) && treatUnusedNewEscaped(NE))
+
+  // Non-trivial constructors have a chance to escape 'this', but marking all
+  // invocations of trivial constructors as escaped would cause too great of
+  // reduction of true positives, so let's just do that for constructors that
+  // have an argument of a pointer-to-record type.
+  if (!PM.isConsumedExpr(NE) && hasNonTrivialConstructorCall(NE))
     return;
 
   ProgramStateRef State = C.getState();
   // The return value from operator new is bound to a specified initialization
   // value (if any) and we don't want to loose this value. So we call
   // MallocUpdateRefState() instead of MallocMemAux() which breakes the
   // existing binding.
   State = MallocUpdateRefState(C, NE, State, NE->isArray() ? AF_CXXNewArray
                                                            : AF_CXXNew, Target);
   State = addExtentSize(C, NE, State, Target);
-  State = ProcessZeroAllocation(C, NE, 0, State, Target);
+  State = ProcessZeroAllocCheck(C, NE, 0, State, Target);
   C.addTransition(State);
 }
 
 void MallocChecker::checkPostStmt(const CXXNewExpr *NE,
                                   CheckerContext &C) const {
   if (!C.getAnalysisManager().getAnalyzerOptions().mayInlineCXXAllocator())
     processNewAllocation(NE, C, C.getSVal(NE));
 }

 
 void MallocChecker::checkPreStmt(const CXXDeleteExpr *DE,
                                  CheckerContext &C) const {
 
   if (!ChecksEnabled[CK_NewDeleteChecker])
     if (SymbolRef Sym = C.getSVal(DE->getArgument()).getAsSymbol())
       checkUseAfterFree(Sym, C, DE->getArgument());
 
-  if (!isStandardNewDelete(DE->getOperatorDelete(), C.getASTContext()))
+  if (!MemFunctionInfo.isStandardNewDelete(DE->getOperatorDelete(),
+                                           C.getASTContext()))
     return;
 
   ProgramStateRef State = C.getState();
-  bool ReleasedAllocated;
+  bool IsKnownToBeAllocated;
   State = FreeMemAux(C, DE->getArgument(), DE, State,
-                     /*Hold*/false, ReleasedAllocated);
+                     /*Hold*/false, IsKnownToBeAllocated);
 
   C.addTransition(State);
 }
 
 static bool isKnownDeallocObjCMethodName(const ObjCMethodCall &Call) {
   // If the first selector piece is one of the names below, assume that the
   // object takes ownership of the memory, promising to eventually deallocate it
   // with free().
void MallocChecker::checkPostObjCMessage(const ObjCMethodCall &Call,
 
   if (!isKnownDeallocObjCMethodName(Call))
     return;
 
   if (Optional<bool> FreeWhenDone = getFreeWhenDoneArg(Call))
     if (!*FreeWhenDone)
       return;
 
-  bool ReleasedAllocatedMemory;
+  bool IsKnownToBeAllocatedMemory;
   ProgramStateRef State = FreeMemAux(C, Call.getArgExpr(0),
                                      Call.getOriginExpr(), C.getState(),
-                                     /*Hold=*/true, ReleasedAllocatedMemory,
+                                     /*Hold=*/true, IsKnownToBeAllocatedMemory,
                                      /*RetNullOnFailure=*/true);
 
   C.addTransition(State);
 }
 
 ProgramStateRef
 MallocChecker::MallocMemReturnsAttr(CheckerContext &C, const CallExpr *CE,
                                     const OwnershipAttr *Att,
                                     ProgramStateRef State) const {
   if (!State)
     return nullptr;
 
-  if (Att->getModule() != II_malloc)
+  if (Att->getModule() != MemFunctionInfo.II_malloc)
     return nullptr;
 
   OwnershipAttr::args_iterator I = Att->args_begin(), E = Att->args_end();
   if (I != E) {
     return MallocMemAux(C, CE, CE->getArg(I->getASTIndex()), UndefinedVal(),
                         State);
   }
   return MallocMemAux(C, CE, UnknownVal(), UndefinedVal(), State);
if (Optional<DefinedOrUnknownSVal> DefinedSize =
 
     State = State->assume(extentMatchesSize, true);
     assert(State);
   }
 
   return MallocUpdateRefState(C, CE, State, Family);
 }
 
-ProgramStateRef MallocChecker::MallocUpdateRefState(CheckerContext &C,
-                                                    const Expr *E,
-                                                    ProgramStateRef State,
-                                                    AllocationFamily Family,
-                                                    Optional<SVal> RetVal) {
+static ProgramStateRef
+MallocUpdateRefState(CheckerContext &C, const Expr *E, ProgramStateRef State,
+                     AllocationFamily Family, Optional<SVal> RetVal) {
   if (!State)
     return nullptr;
 
   // Get the return value.
   if (!RetVal)
     RetVal = C.getSVal(E);
 
   // We expect the malloc functions to return a pointer.

 
 ProgramStateRef MallocChecker::FreeMemAttr(CheckerContext &C,
                                            const CallExpr *CE,
                                            const OwnershipAttr *Att,
                                            ProgramStateRef State) const {
   if (!State)
     return nullptr;
 
-  if (Att->getModule() != II_malloc)
+  if (Att->getModule() != MemFunctionInfo.II_malloc)
     return nullptr;
 
-  bool ReleasedAllocated = false;
+  bool IsKnownToBeAllocated = false;
 
   for (const auto &Arg : Att->args()) {
     ProgramStateRef StateI = FreeMemAux(
         C, CE, State, Arg.getASTIndex(),
-        Att->getOwnKind() == OwnershipAttr::Holds, ReleasedAllocated);
+        Att->getOwnKind() == OwnershipAttr::Holds, IsKnownToBeAllocated);
     if (StateI)
       State = StateI;
   }
   return State;
 }
 
 ProgramStateRef MallocChecker::FreeMemAux(CheckerContext &C,
                                           const CallExpr *CE,
                                           ProgramStateRef State,
                                           unsigned Num,
                                           bool Hold,
-                                          bool &ReleasedAllocated,
+                                          bool &IsKnownToBeAllocated,
                                           bool ReturnsNullOnFailure) const {
   if (!State)
     return nullptr;
 
   if (CE->getNumArgs() < (Num + 1))
     return nullptr;
 
   return FreeMemAux(C, CE->getArg(Num), CE, State, Hold,
-                    ReleasedAllocated, ReturnsNullOnFailure);
+                    IsKnownToBeAllocated, ReturnsNullOnFailure);
 }
 
 /// Checks if the previous call to free on the given symbol failed - if free
 /// failed, returns true. Also, returns the corresponding return value symbol.
 static bool didPreviousFreeFail(ProgramStateRef State,
                                 SymbolRef Sym, SymbolRef &RetStatusSymbol) {
   const SymbolRef *Ret = State->get<FreeReturnValue>(Sym);
   if (Ret) {
     assert(*Ret && "We should not store the null return symbol");
     ConstraintManager &CMgr = State->getConstraintManager();
     ConditionTruthVal FreeFailed = CMgr.isNull(State, *Ret);
     RetStatusSymbol = *Ret;
     return FreeFailed.isConstrainedTrue();
   }
   return false;
 }
 
-AllocationFamily MallocChecker::getAllocationFamily(CheckerContext &C,
-                                                    const Stmt *S) const {
+static AllocationFamily getAllocationFamily(
+  const MemFunctionInfoTy  &MemFunctionInfo, CheckerContext &C, const Stmt *S) {
+
   if (!S)
     return AF_None;
 
   if (const CallExpr *CE = dyn_cast<CallExpr>(S)) {
     const FunctionDecl *FD = C.getCalleeDecl(CE);
 
     if (!FD)
       FD = dyn_cast<FunctionDecl>(CE->getCalleeDecl());
 
     ASTContext &Ctx = C.getASTContext();
 
-    if (isCMemFunction(FD, Ctx, AF_Malloc, MemoryOperationKind::MOK_Any))
+    if (MemFunctionInfo.isCMemFunction(FD, Ctx, AF_Malloc, MemoryOperationKind::MOK_Any))
       return AF_Malloc;
 
-    if (isStandardNewDelete(FD, Ctx)) {
+    if (MemFunctionInfo.isStandardNewDelete(FD, Ctx)) {
       OverloadedOperatorKind Kind = FD->getOverloadedOperator();
       if (Kind == OO_New || Kind == OO_Delete)
         return AF_CXXNew;
       else if (Kind == OO_Array_New || Kind == OO_Array_Delete)
         return AF_CXXNewArray;
     }
 
-    if (isCMemFunction(FD, Ctx, AF_IfNameIndex, MemoryOperationKind::MOK_Any))
+    if (MemFunctionInfo.isCMemFunction(FD, Ctx, AF_IfNameIndex,
+                                       MemoryOperationKind::MOK_Any))
       return AF_IfNameIndex;
 
-    if (isCMemFunction(FD, Ctx, AF_Alloca, MemoryOperationKind::MOK_Any))
+    if (MemFunctionInfo.isCMemFunction(FD, Ctx, AF_Alloca,
+                                       MemoryOperationKind::MOK_Any))
       return AF_Alloca;
 
     return AF_None;
   }
 
   if (const CXXNewExpr *NE = dyn_cast<CXXNewExpr>(S))
     return NE->isArray() ? AF_CXXNewArray : AF_CXXNew;
 
   if (const CXXDeleteExpr *DE = dyn_cast<CXXDeleteExpr>(S))
     return DE->isArrayForm() ? AF_CXXNewArray : AF_CXXNew;
 
   if (isa<ObjCMessageExpr>(S))
     return AF_Malloc;
 
   return AF_None;
 }
 
-bool MallocChecker::printAllocDeallocName(raw_ostream &os, CheckerContext &C,
-                                          const Expr *E) const {
+static bool printAllocDeallocName(raw_ostream &os, CheckerContext &C,
+                                  const Expr *E) {
   if (const CallExpr *CE = dyn_cast<CallExpr>(E)) {
     // FIXME: This doesn't handle indirect calls.
     const FunctionDecl *FD = CE->getDirectCallee();
     if (!FD)
       return false;
 
     os << *FD;
     if (!FD->isOverloadedOperator())
os << "'"
        << getOperatorSpelling(DE->getOperatorDelete()->getOverloadedOperator())
        << "'";
     return true;
   }
 
   return false;
 }
 
-void MallocChecker::printExpectedAllocName(raw_ostream &os, CheckerContext &C,
-                                           const Expr *E) const {
-  AllocationFamily Family = getAllocationFamily(C, E);
+static void printExpectedAllocName(raw_ostream &os,
+                                   const MemFunctionInfoTy  &MemFunctionInfo,
+                                   CheckerContext &C, const Expr *E) {
+  AllocationFamily Family = getAllocationFamily(MemFunctionInfo, C, E);
 
   switch(Family) {
     case AF_Malloc: os << "malloc()"; return;
     case AF_CXXNew: os << "'new'"; return;
     case AF_CXXNewArray: os << "'new[]'"; return;
     case AF_IfNameIndex: os << "'if_nameindex()'"; return;
     case AF_InnerBuffer: os << "container-specific allocator"; return;
     case AF_Alloca:
     case AF_None: llvm_unreachable("not a deallocation expression");
   }
 }
 
-void MallocChecker::printExpectedDeallocName(raw_ostream &os,
-                                             AllocationFamily Family) const {
+static void printExpectedDeallocName(raw_ostream &os, AllocationFamily Family) {
   switch(Family) {
     case AF_Malloc: os << "free()"; return;
     case AF_CXXNew: os << "'delete'"; return;
     case AF_CXXNewArray: os << "'delete[]'"; return;
     case AF_IfNameIndex: os << "'if_freenameindex()'"; return;
     case AF_InnerBuffer: os << "container-specific deallocator"; return;
     case AF_Alloca:
     case AF_None: llvm_unreachable("suspicious argument");
   }
 }
 
 ProgramStateRef MallocChecker::FreeMemAux(CheckerContext &C,
                                           const Expr *ArgExpr,
                                           const Expr *ParentExpr,
                                           ProgramStateRef State,
                                           bool Hold,
-                                          bool &ReleasedAllocated,
+                                          bool &IsKnownToBeAllocated,
                                           bool ReturnsNullOnFailure) const {
 
   if (!State)
     return nullptr;
 
   SVal ArgVal = C.getSVal(ArgExpr);
   if (!ArgVal.getAs<DefinedOrUnknownSVal>())
     return nullptr;
ProgramStateRef MallocChecker::FreeMemAux(CheckerContext &C,
   // For now, ignore them.
   if (!SrBase)
     return nullptr;
 
   SymbolRef SymBase = SrBase->getSymbol();
   const RefState *RsBase = State->get<RegionState>(SymBase);
   SymbolRef PreviousRetStatusSymbol = nullptr;
 
+  IsKnownToBeAllocated = RsBase && (RsBase->isAllocated() ||
+                                    RsBase->isAllocatedOfSizeZero());
+
   if (RsBase) {
 
     // Memory returned by alloca() shouldn't be freed.
     if (RsBase->getAllocationFamily() == AF_Alloca) {
       ReportFreeAlloca(C, ArgVal, ArgExpr->getSourceRange());
       return nullptr;
     }
 
     // Check for double free first.
     if ((RsBase->isReleased() || RsBase->isRelinquished()) &&
         !didPreviousFreeFail(State, SymBase, PreviousRetStatusSymbol)) {
       ReportDoubleFree(C, ParentExpr->getSourceRange(), RsBase->isReleased(),
                        SymBase, PreviousRetStatusSymbol);
       return nullptr;
 
     // If the pointer is allocated or escaped, but we are now trying to free it,
     // check that the call to free is proper.
     } else if (RsBase->isAllocated() || RsBase->isAllocatedOfSizeZero() ||
                RsBase->isEscaped()) {
 
       // Check if an expected deallocation function matches the real one.
       bool DeallocMatchesAlloc =
-        RsBase->getAllocationFamily() == getAllocationFamily(C, ParentExpr);
+        RsBase->getAllocationFamily() ==
+                            getAllocationFamily(MemFunctionInfo, C, ParentExpr);
       if (!DeallocMatchesAlloc) {
         ReportMismatchedDealloc(C, ArgExpr->getSourceRange(),
                                 ParentExpr, RsBase, SymBase, Hold);
         return nullptr;
       }
 
       // Check if the memory location being freed is the actual location
       // allocated, or an offset.
if (RsBase) {
     }
   }
 
   if (SymBase->getType()->isFunctionPointerType()) {
     ReportFunctionPointerFree(C, ArgVal, ArgExpr->getSourceRange(), ParentExpr);
     return nullptr;
   }
 
-  ReleasedAllocated = (RsBase != nullptr) && (RsBase->isAllocated() ||
-                                              RsBase->isAllocatedOfSizeZero());
-
   // Clean out the info on previous call to free return info.
   State = State->remove<FreeReturnValue>(SymBase);
 
   // Keep track of the return value. If it is NULL, we will know that free
   // failed.
   if (ReturnsNullOnFailure) {
     SVal RetVal = C.getSVal(ParentExpr);
     SymbolRef RetStatusSymbol = RetVal.getAsSymbol();
     if (RetStatusSymbol) {
       C.getSymbolManager().addSymbolDependency(SymBase, RetStatusSymbol);
       State = State->set<FreeReturnValue>(SymBase, RetStatusSymbol);
     }
   }
 
   AllocationFamily Family = RsBase ? RsBase->getAllocationFamily()
-                                   : getAllocationFamily(C, ParentExpr);
+                          : getAllocationFamily(MemFunctionInfo, C, ParentExpr);
   // Normal free.
   if (Hold)
     return State->set<RegionState>(SymBase,
                                    RefState::getRelinquished(Family,
                                                              ParentExpr));
 
   return State->set<RegionState>(SymBase,
                                  RefState::getReleased(Family, ParentExpr));
MallocChecker::getCheckIfTracked(AllocationFamily Family,
   }
   llvm_unreachable("unhandled family");
 }
 
 Optional<MallocChecker::CheckKind>
 MallocChecker::getCheckIfTracked(CheckerContext &C,
                                  const Stmt *AllocDeallocStmt,
                                  bool IsALeakCheck) const {
-  return getCheckIfTracked(getAllocationFamily(C, AllocDeallocStmt),
-                           IsALeakCheck);
+  return getCheckIfTracked(
+      getAllocationFamily(MemFunctionInfo, C, AllocDeallocStmt), IsALeakCheck);
 }
 
 Optional<MallocChecker::CheckKind>
 MallocChecker::getCheckIfTracked(CheckerContext &C, SymbolRef Sym,
                                  bool IsALeakCheck) const {
   if (C.getState()->contains<ReallocSizeZeroSymbols>(Sym))
     return CK_MallocChecker;
 
if (ExplodedNode *N = C.generateErrorNode()) {
     os << " is ";
     bool Summarized = MR ? SummarizeRegion(os, MR)
                          : SummarizeValue(os, ArgVal);
     if (Summarized)
       os << ", which is not memory allocated by ";
     else
       os << "not memory allocated by ";
 
-    printExpectedAllocName(os, C, DeallocExpr);
+    printExpectedAllocName(os, MemFunctionInfo, C, DeallocExpr);
 
     auto R = llvm::make_unique<BugReport>(*BT_BadFree[*CheckKind], os.str(), N);
     R->markInteresting(MR);
     R->addRange(Range);
     C.emitReport(std::move(R));
   }
 }
 
if (ExplodedNode *N = C.generateErrorNode()) {
     R->markInteresting(MR);
     R->addRange(Range);
     C.emitReport(std::move(R));
   }
 }
 
 ProgramStateRef MallocChecker::ReallocMemAux(CheckerContext &C,
                                              const CallExpr *CE,
-                                             bool FreesOnFail,
+                                             bool ShouldFreeOnFail,
                                              ProgramStateRef State,
                                              bool SuffixWithN) const {
   if (!State)
     return nullptr;
 
   if (SuffixWithN && CE->getNumArgs() < 3)
     return nullptr;
   else if (CE->getNumArgs() < 2)
ProgramStateRef MallocChecker::ReallocMemAux(CheckerContext &C,
   // Get the from and to pointer symbols as in toPtr = realloc(fromPtr, size).
   assert(!PrtIsNull);
   SymbolRef FromPtr = arg0Val.getAsSymbol();
   SVal RetVal = C.getSVal(CE);
   SymbolRef ToPtr = RetVal.getAsSymbol();
   if (!FromPtr || !ToPtr)
     return nullptr;
 
-  bool ReleasedAllocated = false;
+  bool IsKnownToBeAllocated = false;
 
   // If the size is 0, free the memory.
   if (SizeIsZero)
-    if (ProgramStateRef stateFree = FreeMemAux(C, CE, StateSizeIsZero, 0,
-                                               false, ReleasedAllocated)){
-      // The semantics of the return value are:
-      // If size was equal to 0, either NULL or a pointer suitable to be passed
-      // to free() is returned. We just free the input pointer and do not add
-      // any constrains on the output pointer.
+    if (ProgramStateRef stateFree = FreeMemAux(C, CE, StateSizeIsZero, 0,
+                                               false, IsKnownToBeAllocated))
       return stateFree;
-    }
 
   // Default behavior.
   if (ProgramStateRef stateFree =
-        FreeMemAux(C, CE, State, 0, false, ReleasedAllocated)) {
+        FreeMemAux(C, CE, State, 0, false, IsKnownToBeAllocated)) {
 
     ProgramStateRef stateRealloc = MallocMemAux(C, CE, TotalSize,
                                                 UnknownVal(), stateFree);
     if (!stateRealloc)
       return nullptr;
 
-    ReallocPairKind Kind = RPToBeFreedAfterFailure;
-    if (FreesOnFail)
-      Kind = RPIsFreeOnFailure;
-    else if (!ReleasedAllocated)
-      Kind = RPDoNotTrackAfterFailure;
+    OwnershipAfterReallocKind Kind = OAR_ToBeFreedAfterFailure;
+    if (ShouldFreeOnFail)
+      Kind = OAR_FreeOnFailure;
+    else if (!IsKnownToBeAllocated)
+      Kind = OAR_DoNotTrackAfterFailure;
 
     // Record the info about the reallocated symbol so that we could properly
     // process failed reallocation.
     stateRealloc = stateRealloc->set<ReallocPairs>(ToPtr,
                                                    ReallocPair(FromPtr, Kind));
     // The reallocated symbol should stay alive for as long as the new symbol.
     C.getSymbolManager().addSymbolDependency(ToPtr, FromPtr);
     return stateRealloc;
ProgramStateRef MallocChecker::CallocMem(CheckerContext &C, const CallExpr *CE,
 
   SValBuilder &svalBuilder = C.getSValBuilder();
   SVal zeroVal = svalBuilder.makeZeroVal(svalBuilder.getContext().CharTy);
   SVal TotalSize = evalMulForBufferSize(C, CE->getArg(0), CE->getArg(1));
 
   return MallocMemAux(C, CE, TotalSize, zeroVal, State);
 }
 
-LeakInfo
+MallocChecker::LeakInfo
 MallocChecker::getAllocationSite(const ExplodedNode *N, SymbolRef Sym,
-                                 CheckerContext &C) const {
+                                 CheckerContext &C) {
   const LocationContext *LeakContext = N->getLocationContext();
   // Walk the ExplodedGraph backwards and find the first node that referred to
   // the tracked symbol.
   const ExplodedNode *AllocNode = N;
   const MemRegion *ReferenceRegion = nullptr;
 
   while (N) {
     ProgramStateRef State = N->getState();
void MallocChecker::checkPreCall(const CallEvent &Call,
   // We will check for double free in the post visit.
   if (const AnyFunctionCall *FC = dyn_cast<AnyFunctionCall>(&Call)) {
     const FunctionDecl *FD = FC->getDecl();
     if (!FD)
       return;
 
     ASTContext &Ctx = C.getASTContext();
     if (ChecksEnabled[CK_MallocChecker] &&
-        (isCMemFunction(FD, Ctx, AF_Malloc, MemoryOperationKind::MOK_Free) ||
-         isCMemFunction(FD, Ctx, AF_IfNameIndex,
+        (MemFunctionInfo.isCMemFunction(FD, Ctx, AF_Malloc,
+                                        MemoryOperationKind::MOK_Free) ||
+         MemFunctionInfo.isCMemFunction(FD, Ctx, AF_IfNameIndex,
                                         MemoryOperationKind::MOK_Free)))
       return;
   }
 
   // Check if the callee of a method is deleted.
   if (const CXXInstanceCall *CC = dyn_cast<CXXInstanceCall>(&Call)) {
     SymbolRef Sym = CC->getCXXThisVal().getAsSymbol();
     if (!Sym || checkUseAfterFree(Sym, C, CC->getCXXThisExpr()))
       return;
for ( ; I != E; ++I) {
     Regions.push_back(VR);
   }
 
   state =
     state->scanReachableSymbols<StopTrackingCallback>(Regions).getState();
   C.addTransition(state);
 }
 
-bool MallocChecker::isReleased(SymbolRef Sym, CheckerContext &C) const {
+static bool isReleased(SymbolRef Sym, CheckerContext &C) {
   assert(Sym);
   const RefState *RS = C.getState()->get<RegionState>(Sym);
   return (RS && RS->isReleased());
 }
 
 bool MallocChecker::checkUseAfterFree(SymbolRef Sym, CheckerContext &C,
                                       const Stmt *S) const {
 
for (ReallocPairsTy::iterator I = RP.begin(), E = RP.end(); I != E; ++I) {
     ConstraintManager &CMgr = state->getConstraintManager();
     ConditionTruthVal AllocFailed = CMgr.isNull(state, I.getKey());
     if (!AllocFailed.isConstrainedTrue())
       continue;
 
     SymbolRef ReallocSym = I.getData().ReallocatedSym;
     if (const RefState *RS = state->get<RegionState>(ReallocSym)) {
       if (RS->isReleased()) {
-        if (I.getData().Kind == RPToBeFreedAfterFailure)
+        switch(I.getData().Kind) {
+        case OAR_ToBeFreedAfterFailure:
           state = state->set<RegionState>(ReallocSym,
               RefState::getAllocated(RS->getAllocationFamily(), RS->getStmt()));
-        else if (I.getData().Kind == RPDoNotTrackAfterFailure)
+          break;
+        case OAR_DoNotTrackAfterFailure:
           state = state->remove<RegionState>(ReallocSym);
-        else
-          assert(I.getData().Kind == RPIsFreeOnFailure);
+          break;
+        default:
+          assert(I.getData().Kind == OAR_FreeOnFailure);
+        }
       }
     }
     state = state->remove<ReallocPairs>(I.getKey());
   }
 
   return state;
 }
 
bool MallocChecker::mayFreeAnyEscapedMemoryOrIsModeledExplicitly(
   const FunctionDecl *FD = cast<SimpleFunctionCall>(Call)->getDecl();
   if (!FD)
     return true;
 
   ASTContext &ASTC = State->getStateManager().getContext();
 
   // If it's one of the allocation functions we can reason about, we model
   // its behavior explicitly.
-  if (isMemFunction(FD, ASTC))
+  if (MemFunctionInfo.isMemFunction(FD, ASTC))
     return false;
 
   // If it's not a system call, assume it frees memory.
   if (!Call->isInSystemHeader())
     return true;
 
   // White list the system functions whose arguments escape.
   const IdentifierInfo *II = FD->getIdentifier();
bool MallocChecker::mayFreeAnyEscapedMemoryOrIsModeledExplicitly(
   if (Call->argumentsMayEscape())
     return true;
 
   // Otherwise, assume that the function does not free memory.
   // Most system calls do not free the memory.
   return false;
 }
 
-static bool retTrue(const RefState *RS) {
-  return true;
-}
-
 static bool checkIfNewOrNewArrayFamily(const RefState *RS) {
   return (RS->getAllocationFamily() == AF_CXXNewArray ||
           RS->getAllocationFamily() == AF_CXXNew);
 }
 
 ProgramStateRef MallocChecker::checkPointerEscape(ProgramStateRef State,
                                              const InvalidatedSymbols &Escaped,
                                              const CallEvent *Call,
                                              PointerEscapeKind Kind) const {
-  return checkPointerEscapeAux(State, Escaped, Call, Kind, &retTrue);
+  return checkPointerEscapeAux(State, Escaped, Call, Kind,
+                               /*IsConstPointerEscape*/ false);
 }
 
 ProgramStateRef MallocChecker::checkConstPointerEscape(ProgramStateRef State,
                                               const InvalidatedSymbols &Escaped,
                                               const CallEvent *Call,
                                               PointerEscapeKind Kind) const {
+  // If a const pointer escapes, it may not be freed(), but it could be deleted.
   return checkPointerEscapeAux(State, Escaped, Call, Kind,
-                               &checkIfNewOrNewArrayFamily);
+                               /*IsConstPointerEscape*/ true);
 }
 
-ProgramStateRef MallocChecker::checkPointerEscapeAux(ProgramStateRef State,
+ProgramStateRef MallocChecker::checkPointerEscapeAux(
+                                              ProgramStateRef State,
                                               const InvalidatedSymbols &Escaped,
                                               const CallEvent *Call,
                                               PointerEscapeKind Kind,
-                                  bool(*CheckRefState)(const RefState*)) const {
+                                              bool IsConstPointerEscape) const {
   // If we know that the call does not free memory, or we want to process the
   // call later, keep tracking the top level arguments.
   SymbolRef EscapingSymbol = nullptr;
   if (Kind == PSK_DirectEscapeOnCall &&
       !mayFreeAnyEscapedMemoryOrIsModeledExplicitly(Call, State,
                                                     EscapingSymbol) &&
       !EscapingSymbol) {
     return State;
   }
 
   for (InvalidatedSymbols::const_iterator I = Escaped.begin(),
        E = Escaped.end();
        I != E; ++I) {
     SymbolRef sym = *I;
 
     if (EscapingSymbol && EscapingSymbol != sym)
       continue;
 
     if (const RefState *RS = State->get<RegionState>(sym)) {
-      if ((RS->isAllocated() || RS->isAllocatedOfSizeZero()) &&
-          CheckRefState(RS)) {
+      if ((RS->isAllocated() || RS->isAllocatedOfSizeZero())) {
+        if (!IsConstPointerEscape || checkIfNewOrNewArrayFamily(RS)) {
           State = State->remove<RegionState>(sym);
           State = State->set<RegionState>(sym, RefState::getEscaped(RS));
         }
       }
     }
+  }
   return State;
 }
 
 static SymbolRef findFailedReallocSymbol(ProgramStateRef currState,
                                          ProgramStateRef prevState) {
   ReallocPairsTy currMap = currState->get<ReallocPairs>();
   ReallocPairsTy prevMap = prevState->get<ReallocPairs>();
 
-  for (ReallocPairsTy::iterator I = prevMap.begin(), E = prevMap.end();
-       I != E; ++I) {
-    SymbolRef sym = I.getKey();
+  for (const ReallocPairsTy::value_type &Pair : prevMap) {
+    SymbolRef sym = Pair.first;
     if (!currMap.lookup(sym))
       return sym;
   }
 
   return nullptr;
 }
 
 static bool isReferenceCountingPointerDestructor(const CXXDestructorDecl *DD) {
   if (const IdentifierInfo *II = DD->getParent()->getIdentifier()) {
     StringRef N = II->getName();
     if (N.contains_lower("ptr") || N.contains_lower("pointer")) {
       if (N.contains_lower("ref") || N.contains_lower("cnt") ||
           N.contains_lower("intrusive") || N.contains_lower("shared")) {
         return true;
       }
     }
   }
   return false;
 }
 
-std::shared_ptr<PathDiagnosticPiece> MallocChecker::MallocBugVisitor::VisitNode(
+std::shared_ptr<PathDiagnosticPiece> MallocBugVisitor::VisitNode(
     const ExplodedNode *N, BugReporterContext &BRC, BugReport &BR) {
 
   ProgramStateRef state = N->getState();
   ProgramStateRef statePrev = N->getFirstPred()->getState();
 
-  const RefState *RS = state->get<RegionState>(Sym);
+  const RefState *RSCurr = state->get<RegionState>(Sym);
   const RefState *RSPrev = statePrev->get<RegionState>(Sym);
 
   const Stmt *S = PathDiagnosticLocation::getStmt(N);
   // When dealing with containers, we sometimes want to give a note
   // even if the statement is missing.
-  if (!S && (!RS || RS->getAllocationFamily() != AF_InnerBuffer))
+  if (!S && (!RSCurr || RSCurr->getAllocationFamily() != AF_InnerBuffer))
     return nullptr;
 
   const LocationContext *CurrentLC = N->getLocationContext();
 
   // If we find an atomic fetch_add or fetch_sub within the destructor in which
   // the pointer was released (before the release), this is likely a destructor
   // of a shared pointer.
   // Because we don't model atomics, and also because we don't know that the
std::shared_ptr<PathDiagnosticPiece> MallocBugVisitor::VisitNode(
 
   // Find out if this is an interesting point and what is the kind.
   StringRef Msg;
   StackHintGeneratorForSymbol *StackHint = nullptr;
   SmallString<256> Buf;
   llvm::raw_svector_ostream OS(Buf);
 
   if (Mode == Normal) {
-    if (isAllocated(RS, RSPrev, S)) {
+    if (isAllocated(RSCurr, RSPrev, S)) {
       Msg = "Memory is allocated";
       StackHint = new StackHintGeneratorForSymbol(Sym,
                                                   "Returned allocated memory");
-    } else if (isReleased(RS, RSPrev, S)) {
-      const auto Family = RS->getAllocationFamily();
+    } else if (isReleased(RSCurr, RSPrev, S)) {
+      const auto Family = RSCurr->getAllocationFamily();
       switch (Family) {
         case AF_Alloca:
         case AF_Malloc:
         case AF_CXXNew:
         case AF_CXXNewArray:
         case AF_IfNameIndex:
           Msg = "Memory is released";
           StackHint = new StackHintGeneratorForSymbol(Sym,
                                               "Returning; memory was released");
           break;
         case AF_InnerBuffer: {
           const MemRegion *ObjRegion =
               allocation_state::getContainerObjRegion(statePrev, Sym);
           const auto *TypedRegion = cast<TypedValueRegion>(ObjRegion);
           QualType ObjTy = TypedRegion->getValueType();
           OS << "Inner buffer of '" << ObjTy.getAsString() << "' ";
 
           if (N->getLocation().getKind() == ProgramPoint::PostImplicitCallKind) {
             OS << "deallocated by call to destructor";
             StackHint = new StackHintGeneratorForSymbol(Sym,
                                       "Returning; inner buffer was deallocated");
           } else {
             OS << "reallocated by call to '";
-            const Stmt *S = RS->getStmt();
+            const Stmt *S = RSCurr->getStmt();
             if (const auto *MemCallE = dyn_cast<CXXMemberCallExpr>(S)) {
               OS << MemCallE->getMethodDecl()->getNameAsString();
             } else if (const auto *OpCallE = dyn_cast<CXXOperatorCallExpr>(S)) {
               OS << OpCallE->getDirectCallee()->getNameAsString();
             } else if (const auto *CallE = dyn_cast<CallExpr>(S)) {
               auto &CEMgr = BRC.getStateManager().getCallEventManager();
               CallEventRef<> Call = CEMgr.getSimpleCall(CallE, state, CurrentLC);
               const auto *D = dyn_cast_or_null<NamedDecl>(Call->getDecl());
if (isAllocated(RSCurr, RSPrev, S)) {
             // inside a destructor of a shared pointer, because it's fairly hard
             // to pass the information that the pointer indeed needs to be
             // released into it. So we're only interested in the innermost
             // destructor.
             FoundAnyDestructor = true;
           }
         }
       }
-    } else if (isRelinquished(RS, RSPrev, S)) {
+    } else if (isRelinquished(RSCurr, RSPrev, S)) {
       Msg = "Memory ownership is transferred";
       StackHint = new StackHintGeneratorForSymbol(Sym, "");
-    } else if (isReallocFailedCheck(RS, RSPrev, S)) {
+    } else if (hasReallocFailed(RSCurr, RSPrev, S)) {
       Mode = ReallocationFailed;
       Msg = "Reallocation failed";
       StackHint = new StackHintGeneratorForReallocationFailed(Sym,
                                                        "Reallocation failed");
 
       if (SymbolRef sym = findFailedReallocSymbol(state, statePrev)) {
         // Is it possible to fail two reallocs WITHOUT testing in between?
         assert((!FailedReallocSymbol || FailedReallocSymbol == sym) &&
std::shared_ptr<PathDiagnosticPiece> MallocBugVisitor::VisitNode(
 
   if (Msg.empty())
     return nullptr;
   assert(StackHint);
 
   // Generate the extra diagnostic.
   PathDiagnosticLocation Pos;
   if (!S) {
-    assert(RS->getAllocationFamily() == AF_InnerBuffer);
+    assert(RSCurr->getAllocationFamily() == AF_InnerBuffer);
     auto PostImplCall = N->getLocation().getAs<PostImplicitCall>();
     if (!PostImplCall)
       return nullptr;
     Pos = PathDiagnosticLocation(PostImplCall->getLocation(),
                                  BRC.getSourceManager());
   } else {
     Pos = PathDiagnosticLocation(S, BRC.getSourceManager(),
                                  N->getLocationContext());

 
 } // end namespace allocation_state
 } // end namespace ento
 } // end namespace clang
 
 void ento::registerNewDeleteLeaksChecker(CheckerManager &mgr) {
   registerCStringCheckerBasic(mgr);
   MallocChecker *checker = mgr.registerChecker<MallocChecker>();
-  checker->IsOptimistic = mgr.getAnalyzerOptions().getCheckerBooleanOption(
+
+  checker->MemFunctionInfo.ShouldIncludeOwnershipAnnotatedFunctions =
+      mgr.getAnalyzerOptions().getCheckerBooleanOption(
                                                   "Optimistic", false, checker);
+
   checker->ChecksEnabled[MallocChecker::CK_NewDeleteLeaksChecker] = true;
   checker->CheckNames[MallocChecker::CK_NewDeleteLeaksChecker] =
       mgr.getCurrentCheckName();
   // We currently treat NewDeleteLeaks checker as a subchecker of NewDelete
   // checker.
   if (!checker->ChecksEnabled[MallocChecker::CK_NewDeleteChecker]) {
     checker->ChecksEnabled[MallocChecker::CK_NewDeleteChecker] = true;
     // FIXME: This does not set the correct name, but without this workaround
     //        no name will be set at all.
     checker->CheckNames[MallocChecker::CK_NewDeleteChecker] =
         mgr.getCurrentCheckName();
   }
 }
 
 // Intended to be used in InnerPointerChecker to register the part of
 // MallocChecker connected to it.
 void ento::registerInnerPointerCheckerAux(CheckerManager &mgr) {
-    registerCStringCheckerBasic(mgr);
-    MallocChecker *checker = mgr.registerChecker<MallocChecker>();
-    checker->IsOptimistic = mgr.getAnalyzerOptions().getCheckerBooleanOption(
+
+  checker->MemFunctionInfo.ShouldIncludeOwnershipAnnotatedFunctions =
+      mgr.getAnalyzerOptions().getCheckerBooleanOption(
                                                   "Optimistic", false, checker);
-    checker->ChecksEnabled[MallocChecker::CK_InnerPointerChecker] = true;
-    checker->CheckNames[MallocChecker::CK_InnerPointerChecker] =
-        mgr.getCurrentCheckName();
+
 }
 
 #define REGISTER_CHECKER(name)                                                 \
   void ento::register##name(CheckerManager &mgr) {                             \
     registerCStringCheckerBasic(mgr);                                          \
     MallocChecker *checker = mgr.registerChecker<MallocChecker>();             \
-    checker->IsOptimistic = mgr.getAnalyzerOptions().getCheckerBooleanOption(  \
-        "Optimistic", false, checker);                                         \
+    checker->MemFunctionInfo.ShouldIncludeOwnershipAnnotatedFunctions =        \
+        mgr.getAnalyzerOptions().getCheckerBooleanOption(                      \
+                                                 "Optimistic", false, checker);\
     checker->ChecksEnabled[MallocChecker::CK_##name] = true;                   \
     checker->CheckNames[MallocChecker::CK_##name] = mgr.getCurrentCheckName(); \
   }
 
 REGISTER_CHECKER(MallocChecker)
 REGISTER_CHECKER(NewDeleteChecker)
 REGISTER_CHECKER(MismatchedDeallocatorChecker)

test/Analysis/malloc-annotations.c

-// RUN: %clang_analyze_cc1 -analyzer-checker=core,alpha.deadcode.UnreachableCode,alpha.core.CastSize,unix.Malloc -analyzer-store=region -verify -analyzer-config unix.Malloc:Optimistic=true %s
+// RUN: %clang_analyze_cc1 -analyzer-store=region -verify %s \
+// RUN:   -analyzer-checker=core \
+// RUN:   -analyzer-checker=alpha.deadcode.UnreachableCode \
+// RUN:   -analyzer-checker=alpha.core.CastSize,unix.Malloc \
+// RUN:   -analyzer-config unix.Malloc:Optimistic=true
 typedef __typeof(sizeof(int)) size_t;
 void *malloc(size_t);
 void free(void *);
 void *realloc(void *ptr, size_t size);
 void *calloc(size_t nmemb, size_t size);
 void __attribute((ownership_returns(malloc))) *my_malloc(size_t);
 void __attribute((ownership_takes(malloc, 1))) my_free(void *);
 void my_freeBoth(void *, void *)

test/Analysis/malloc.c

-// RUN: %clang_analyze_cc1 -analyzer-checker=core,alpha.deadcode.UnreachableCode,alpha.core.CastSize,unix.Malloc,debug.ExprInspection -analyzer-store=region -verify %s
+// RUN: %clang_analyze_cc1 -analyzer-store=region -verify %s \
+// RUN:   -analyzer-checker=core \
+// RUN:   -analyzer-checker=alpha.deadcode.UnreachableCode \
+// RUN:   -analyzer-checker=alpha.core.CastSize \
+// RUN:   -analyzer-checker=unix.Malloc \
+// RUN:   -analyzer-checker=debug.ExprInspection
 
 #include "Inputs/system-header-simulator.h"
 
 void clang_analyzer_eval(int);
 
 // Without -fms-compatibility, wchar_t isn't a builtin type. MSVC defines
 // _WCHAR_T_DEFINED if wchar_t is available. Microsoft recommends that you use
 // the builtin type: "Using the typedef version can cause portability