[analyzer] NFC: BugReporter Separation Ep.I.

[NoQ]

Summary

The ultimate goal is to allow Clang-Tidy to reap the benefits of our BugReporter while also not being entirely dependent on the Static Analyzer (eg., be able to get compiled with CLANG_ENABLE_STATIC_ANALYZER=OFF). This would involve eventually moving the basic BugReporter and BugReport/BasicBugReport classes into libAnalysis.

This is the minimal patch that separates the BugReport class into BasicBugReport and PathSensitiveBugReport in a sensible manner and compiles. I looked through all their APIs and made a quick guess on whether they do or do not require path-sensitive reasoning and put them into the respective class based on that.

There's no common base class for the two BugReporters yet.

Checker API breakage was fairly bearable, in most cases i just had to specify whether i want a basic report or a path-sensitive report. Most path-insensitive checkers were already using the EmitBasicReport() wrapper so they are unaffected.

[NoQ]

Most of the patch is boring but here are a few places that i wanted attract attention to.

clang/include/clang/StaticAnalyzer/Core/BugReporter/BugReporter.h

391

Yes, we allow inheriting from these specific BugReport sub-classes, because there turned out to be one checker that was using it.

clang/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountDiagnostics.h

56

I'm not pointing any fingers...

77

...and still not pointing any fingers.

clang/lib/StaticAnalyzer/Core/BugReporter.cpp

2780

I vaguely remember that this pattern is frowned upon. Does anybody want me to extract this into a common non-virtual function?

3053–3054

Same question about extracting into a non-virtual function.

3063–3066

*crosses fingers*

[Szelethus]

Super high level question: CheckerManager knows whether a checker, and I suspect a checker callback is path sensitive or not, do you think we can automate this decision (whether the bug report is path sensitive of syntactic)? For the purposes of clang-tidy, can we say such a thing that if we can't prove a bug report to be path sensitive, it will not be that?

clang/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountDiagnostics.h

56

Mhm, I can see that :^)

[NoQ]

In D66572#1640518, @Szelethus wrote:

Super high level question: CheckerManager knows whether a checker, and I suspect a checker callback is path sensitive or not, do you think we can automate this decision (whether the bug report is path sensitive of syntactic)? For the purposes of clang-tidy, can we say such a thing that if we can't prove a bug report to be path sensitive, it will not be that?

I want to reserve the ability for path-sensitive checkers to occasionally emit path-insensitive reports. This is due to my pipe dream of making a poor man's data flow engine by simply trusting ExprEngine when it says that it has explored all execution paths through a function. Cf. UnreachableCodeChecker, TestAfterDivZeroChecker. There are no other reasons because if we're not presenting a path we must admit that the problem happens on all paths, which implies some sort of must-problem, which implies no proper symbolic execution.

Maybe also we can consider reporting path-insensitive reports when we are about to emit a path-sensitive report but look at the AST at the last minute and it turns out that the problem is entirely local.

[NoQ]

Rebase T__T

[Szelethus]

You got me convinced.

clang/include/clang/StaticAnalyzer/Core/BugReporter/BugReporter.h

389

I think I added a visitor range not long ago?

[NoQ]

clang/include/clang/StaticAnalyzer/Core/BugReporter/BugReporter.h

389

Yup, i just moved it from BugReport to PathSensitiveBugReport.
(hint: this yellow bar on the left of the insertion indicates that, you can also hover it to see where was the code moved from)

[Szelethus]

clang/include/clang/StaticAnalyzer/Core/BugReporter/BugReporter.h

75

Shouldn't we make this an abstract class?

[gribozavr]

Sorry for the silly comments, but my main point is, I guess, that I don't quite understand the design towards which you are refactoring, and to meaningfully review patches I need to be on the same page.

clang/include/clang/StaticAnalyzer/Core/BugReporter/BugReporter.h

75

I'm not sure that intrusive linked list is the right data structure for the job. I'd personally put bug reports into a vector and make a custom data structure if a vector becomes a performance problem.

288

Where can I read about the uniqueing logic? Does it mean that out of two bug reports with the same location only one gets displayed, regardless of other properties?

292–301

I don't think getUniqueingDecl() and getDeclWithIssue() make sense for most ClangTidy checkers.

325

We don't care about MSVC 2013 now.

340

Another location-related method... I guess I would appreciate a more abstract writeup about what BugReport's data model is (in its doc comment).

352

Ranges should be associated with a message.

[NoQ]

clang/include/clang/StaticAnalyzer/Core/BugReporter/BugReporter.h

75

Shouldn't we make this an abstract class?

Mmm, yeah, moved virtual methods from BugReport to BasicBugReport whenever PathSensitiveBugReport immediately overrides them and it looks much better now!

I'm not sure that intrusive linked list is the right data structure for the job.

Me neither, but it seems to be orthogonal to this patch, and this patch is already huge, so i'll do this in a follow-up patch, ok?

288

Added some comments ^^

292–301

getDeclWithIssue() corresponds to the "Function/Method" column we have in our scan-build index page:

This column is not super important but probably kinda nice to have. I don't mind leaving it empty for clang-tidy checks, or possibly auto-detect it post factum when possible (e.g., find the smallest decl in which the warning location is contained).

getUniqueingDecl() is, as far as i understand, only currently used by the issue hash mechanism which governs deduplication across translation units (e.g., we emit a warning against the same header in multiple translation units - it's vital for the static analyzer because it's not uncommon for an execution path that starts in the main file to end in a header). And even then, it's only present in plist output. I'm not convinced it's useful at all. It's likely that we can remove it.

Also clang-tidy checks wouldn't need to specify their UniqueingDecl manually as it silently defaults to their DeclWithIssue.

So basically we have these two methods on the base class for bureaucratic reasons: our existing algorithms handle all kinds of warnings uniformly based on these computed properties of bug reports. I think we should be perfectly fine if some kinds of bug reports return null from them, indicating that "this property doesn't make sense for them". We could instead reinvent protocols on top of our custom RTTI ("does this warning conform to Uniqueable? if so, i'll try to unique it"), but i don't think it's worth the complexity.

325

Woohoo!

352

Mmm, what do you mean?

Currently these ranges are attached to the warning message, path note messages can't have ranges, and extra path-insensitive notes can have a separate set of ranges attached to them by passing them through addNote().

[NoQ]

Fxd.

[NoQ]

Change a hard cast to a soft cast because i suspect that we technically want to allow mixing path-sensitive and path-insensitive bug reports in a single equivalence class. Like, we're not doing it right now but there's nothing that really prevents it.

[NoQ]

clang/include/clang/StaticAnalyzer/Core/BugReporter/BugReporter.h

75

D67024

[gribozavr]

Thank you for the conversation so far! This is not a complete review from me, but I'm trying to avoid branching in too many directions at once.

clang/include/clang/StaticAnalyzer/Core/BugReporter/BugReporter.h

77

Make NoteList private, or eliminate completely?

265

I think using identical names for constructor parameters and member variables is idiomatic in LLVM.

275

What's the difference between description and short description?

What are the expected grammatical conventions? For example, Clang and ClangTidy warning are sentence fragments that start with a lowercase letter and don't end with a period.

283

The primary location of the bug report that points at the undesirable behavior in the code.

UIs should attach the warning description to this location. The warning description should describe bad behavior at this location.

288

Thanks for the comments, but sorry, this one is still unclear.

(1)

// Imagine a ClangTidy checker that finds calls to math functions where it is 

double foo() {
  return sqrt(-1); // warning: 'sqrt' will always return NaN
}

What should be the "decl with issue" here? 'foo' or 'sqrt'?

(2)

#include <vector>
using std::vector; // warning: using names from 'std' is error-prone

(3)

void foo(Foo f) {
  bar(std::move(f)); // warning: passing result of 'std::move' as a const reference argument, no move will actually happen
}

Is it 'foo', 'bar', 'std::move', or the copy constructor of 'Foo'?

292–301

getDeclWithIssue() corresponds to the "Function/Method" column we have in our scan-build index page:

Judging from the screenshot, that column seems to play a function of a human-readable summary of the warning location. Is that correct?

Should we determine it automatically from getLocation()? Is there a use case for getDeclWithIssue() be different from the function/class that getLocation() is pointing into?

(e.g., find the smallest decl in which the warning location is contained).

Oh you are saying the same thing. Why not have it always be auto-detected? Is there a use case for manual curation?

getUniqueingDecl() [...] I'm not convinced it's useful at all. It's likely that we can remove it.

I agree about eliminating it -- actually, replacing it with comparing source locations. In our experience running ClangTidy, uniquing bug reports based on source locations works quite well. Can you give it a go in a separate patch that we can land ahead of time? I see there are only 4 callers of the BugReport constructor that accepts the location.

Also the doc comment is somewhat contradictory. "declarations that ... contains ... the uniqueing location. This is not actively used for uniqueing..."

309

"Add a new note at the end of this path-insensitive report."

314

I'm concerned that PathDiagnosticLocation is too complex of an abstraction for ClangTidy. It might even be too complex for Static Analyzer checkers. It is OK for the Static Analyzer core though.

Take a look at users of addNote -- they use helpers like makeLocation. I don't think that would scale to the number of checkers that we have. The API should be simpler.

324

ArrayRef?

342

s/iterator_range/ArrayRef/?

352

I see. What looks weird to me is that methods related to the warning itself are on BugReport, but notes and fixits are their own data structures. It creates an inconsistent API, and makes notes and fixits feel bolted on.

Do you think it would make sense to change the API to be more uniform?

377

I think the delegation should be done in the opposite way -- getLocation should be the source of truth, and getUniqueingLocation should call getLocation.

450

Could it just be ArrayRef<...> visitors(), without exposing extra typedefs?

[gribozavr]

clang/include/clang/StaticAnalyzer/Core/BugReporter/BugReporter.h

340

What I meant by "data model" is a high-level description like this.

A bug report is one instance of a problem found by a checker. It is similar to a warning in Clang.

A bug report has:

• a description which is ...

• a short description (optional), which is ...

• zero or more ranges, which ...

• zero or more fixits, which provide advice about ...

• zero or more notes, which ...

Each fixit has: ...

Each note has...

[Szelethus]

clang/include/clang/StaticAnalyzer/Core/BugReporter/BugReporter.h

275

I just did some work related to this! For 99% of the cases (and for one, I'm pretty sure this estimate is quite accurate) there is no difference. AFAIK CodeChecker doesnt even use the short description field emitted in the plist output.

There is one checker however that uses it, RetainCount, though I dislike that particular case (the short version is something like "the counter here isn't zero", and the full version is "the counter here is +2"). Could we get rid of this?

As for diagnostic messages, we start with uppercase but dont terminate the sentence.

[Szelethus]

Also, thank you @gribozavr for your comments -- its very nice to have someone review a bigger part of our development interface who is knowledgeable about Clang, but not the this part of the Static Analyzer specifically. Looking at your inlines, these are very fair criticisms, I found (find) these confusing when I just started contributing as well.

[NoQ]

clang/include/clang/StaticAnalyzer/Core/BugReporter/BugReporter.h

352

Hmm, i guess this is an artifact of how path-sensitive checkers usually emits warnings and their respective notes in completely different parts of their code (warnings come from the checker itself, path notes are generated by so-called "bug visitors" which aren't necessarily even a part of the checker).

Generally we need our notes to be attached to their respective warnings; say, in HTML report they need to be displayed on the same HTML page. But yeah, we should make our APIs more uniform because there's an obvious duplication of effort.

I also suspect that we'll need a new API in general, because in the current shape the BugReporter will look fairly alien and overly-complicated to clang-tidy developers that are used to the conciseness of diag() << .... I'm not sure if it'll boil down to providing convenient wrappers or i'll prefer to rewrite our checkers as well. I think we should talk about this separately on the mailing list.

[NoQ]

clang/include/clang/StaticAnalyzer/Core/BugReporter/BugReporter.h

352

http://lists.llvm.org/pipermail/cfe-dev/2019-September/063229.html

Basically, PathDiagnostic is the uniform API that we've been looking for. It's a vector of PathDiagnosticPieces each of which represents a note of certain kind (path note, normal note, control flow note, etc.). BugReporter is a mechanism for converting a BugReport into a PathDiagnostic. For path-sensitive reports this mechanism is extremely sophisticated: the checker only supplies a single ExplodedNode that corresponds to the end of path and the BugReporter automatically adds notes (often dozens of them, sometimes hundreds) to explain the path. For path-insensitive reports the conversion is extremely trivial and therefore there's very little motivation to use the BugReporter when only path-insensitive reports are expected.

[NoQ]

Fix most comments.

Yup, i'm also very grateful for the comments :)

clang/include/clang/StaticAnalyzer/Core/BugReporter/BugReporter.h

275

Added comments that capture the current state of things.

288

Made another attempt at the decl with issue comment :)

292–301

Oh you are saying the same thing. Why not have it always be auto-detected? Is there a use case for manual curation?

I don't think anybody needs manual curation. We just literally always had a good decl to put in there, so i guess that's why we never bothered implementing autodetection so far.

P.S. despite http://lists.llvm.org/pipermail/cfe-dev/2019-September/063229.html this discussion is still relevant, i'll just duplicate these docs to PathDiagnostic.

I agree about eliminating it -- actually, replacing it with comparing source locations. In our experience running ClangTidy, uniquing bug reports based on source locations works quite well.

I'll take a closer look at the current messy state of this thing.

This thing is part of the "issue hash" facility that was supposed to be more than just a uniqueing effort: it was supposed to be stable across changes in the source code under analysis, so that people could easily understand how their commits introduce new issues. Source locations are too granular for that because they easily skew when you add unrelated code above the source location. But the "offset into the current decl" is a much more stable metric. Cf. https://github.com/llvm-mirror/clang/commit/97bfb558f69c09b01a5c1510f08dc91eb62329a7

I don't fully understand how much this was made use of, so i'll take a closer look.

309

Ugh, this whole comment is wrong. We support additional out-of-path notes on path-sensitive reports since basically forever.

314

Yup, absolutely.

Even though i'm abandoning the idea of handing off BugReporter directly to Clang-Tidy, the problem is still going to be there, so i'll try to come up with something in later patches.

340

I guess i'll carry over this comment to the upcoming PathDiagnostic-related patch because we're not handing off BugReporter anyway.

377

Hmm, this annoying SourceManager argument can indeed be removed.

450

Not immediately because when visitors are being actually run the code permits itself to move unique pointers out of this vector and then put it back. So it needs write access (at least in the form of non-const iterators) and it has problems with mutating the container while iterating on top of that (as visitors may add other visitors while they run). So i'd rather not touch it for now.

[NoQ]

Just rebase.

[Szelethus]

This patch set the goal of splitting BugReport into two different report kinds, and I think it did that well. Not only that, we drastically improved the documentation, formalized many things that weren't in the core before, so I wouldn't like you to bear the burdern of never ending rebases (it doesn't make reviewing easier either). Let's work on the rest of the code in a followup patch.

I agree with @gribozavr, we could do better, and should do better. Many core classes in the analyzer feel like everyone just added 1-2 functions, 1-2 branches to get something done quickly, and while those functions in the context of the patch they were added in may have been obvious, it lead us to a cluster on non-descriptive, undocumented, confusing interface and implementation code (n+1 location related functions in this instance). While adding new checkers, better support for C++17 and whatnot is what will ultimately make the end user experience better, I like how we're investing a lot of effort into the health of the codebase nowadays, and I think it'll pay off in the long term.

[Szelethus]

But, of course, let's wait for @gribozavr to give his blessings as well, I'm only accepting because removing/changing other parts of the API seems to deserve a separate revision :)

[gribozavr]

I think this patch is a good improvement, and I don't want to hold it back -- but like we discussed before, and like you wrote on the mailing list, I would want a more simple API for ClangTidy.

clang/include/clang/StaticAnalyzer/Core/BugReporter/BugReporter.h

113

Thanks for the doc comments! Please use three slashes here and in getShortDescription.

131

Thanks for the explanation, just one question -- I don't understand what is meant by "canonical".

The bug can be found in a non-canonical declaration.

void f(); // canonical decl

void f() { // non-canonical decl
  *(int*)0 = 0; // bug
}

141

Replace "is primarily used by" with "For example, leak checker that produces a different primary and uniqueing location. ..."

[NoQ]

clang/include/clang/StaticAnalyzer/Core/BugReporter/BugReporter.h

113

Whoops.

131

Ugh, i somehow keep thinking that the definition, if available, will always be the getCanonicalDecl(), even though i stepped into this a few times already >.<

That's why we have bugs like D57619.

clang/include/clang/StaticAnalyzer/Core/BugReporter/BugReporter.h

 
 /// A mapping from diagnostic consumers to the diagnostics they should
 /// consume.
 using DiagnosticForConsumerMapTy =
     llvm::DenseMap<PathDiagnosticConsumer *, std::unique_ptr<PathDiagnostic>>;
 
 /// This class provides an interface through which checkers can create
 /// individual bug reports.
 class BugReport : public llvm::ilist_node<BugReport> {
 public:
-  using ranges_iterator = const SourceRange *;
-  using VisitorList = SmallVector<std::unique_ptr<BugReporterVisitor>, 8>;
-  using visitor_iterator = VisitorList::iterator;
-  using visitor_range = llvm::iterator_range<visitor_iterator>;
-  using NoteList = SmallVector<std::shared_ptr<PathDiagnosticNotePiece>, 4>;
+  enum class Kind { Basic, PathSensitive };
 
 protected:
   friend class BugReportEquivClass;
   friend class BugReporter;
 
+  Kind K;
   const BugType& BT;
-  const Decl *DeclWithIssue = nullptr;
   std::string ShortDescription;
   std::string Description;
+
+  SmallVector<SourceRange, 4> Ranges;
+  SmallVector<std::shared_ptr<PathDiagnosticNotePiece>, 4> Notes;
+  SmallVector<FixItHint, 4> Fixits;
+
+  BugReport(Kind kind, const BugType &bt, StringRef desc)
+      : K(kind), BT(bt), Description(desc) {}
+
+  BugReport(Kind K, const BugType &BT, StringRef ShortDescription,
+            StringRef Description)
+      : K(K), BT(BT), ShortDescription(ShortDescription),
+        Description(Description) {}
+
+public:
+  virtual ~BugReport() = default;
+
+  Kind getKind() const { return K; }
+
+  const BugType& getBugType() const { return BT; }
+
+  // A verbose warning message that is appropriate for displaying next to
+  // the source code that introduces the problem. The description should be
+  // at least a full sentence starting with a capital letter. The period at
+  // the end of the warning is traditionally omitted. If the description
+  // consists of multiple sentences, periods between the sentences are
+  // encouraged, but the period at the end of the description is still omitted.
+  StringRef getDescription() const { return Description; }
+
+  // A short general warning message that is appropriate for displaying in
+  // the list of all reported bugs. It should describe what kind of bug is found
+  // but does not need to try to go into details of that specific bug.
+  // Grammatical conventions of getDescription() apply here as well.
+  StringRef getShortDescription(bool UseFallback = true) const {
+    if (ShortDescription.empty() && UseFallback)
+      return Description;
+    return ShortDescription;
+  }
+
+  /// The primary location of the bug report that points at the undesirable
+  /// behavior in the code. UIs should attach the warning description to this
+  /// location. The warning description should describe the bad behavior
+  /// at this location.
+  virtual PathDiagnosticLocation getLocation() const = 0;
+
+  /// The smallest canonical declaration that contains the bug location.
+  /// This is purely cosmetic; the declaration can be presented to the user
+  /// but it does not affect whether the report is emitted.
+  virtual const Decl *getDeclWithIssue() const = 0;
+
+  /// Get the location on which the report should be uniqued. Two warnings are
+  /// considered to be equivalent whenever they have the same bug types,
+  /// descriptions, and uniqueing locations. Out of a class of equivalent
+  /// warnings only one gets displayed to the user. For most warnings the
+  /// uniqueing location coincides with their location. A different uniqueing
+  /// location is primarily used by various leak warnings: the warning is placed
+  /// at the location where the last reference to the leaking resource is
+  /// dropped but at the same time these warnings are uniqued by where that
+  /// resource is acquired (allocated).
+  virtual PathDiagnosticLocation getUniqueingLocation() const = 0;
+
+  /// Get the declaration that corresponds to (usually contains) the uniqueing
+  /// location. This is not actively used for uniqueing, i.e. otherwise
+  /// identical reports that have different uniqueing decls will be considered
+  /// equivalent.
+  virtual const Decl *getUniqueingDecl() const = 0;
+
+  /// Add new item to the list of additional notes that need to be attached to
+  /// this report. If the report is path-sensitive, these notes will not be
+  /// displayed as part of the execution path explanation, but will be displayed
+  /// separately. Use bug visitors if you need to add an extra path note.
+  void addNote(StringRef Msg, const PathDiagnosticLocation &Pos,
+               ArrayRef<SourceRange> Ranges = {}) {
+    auto P = std::make_shared<PathDiagnosticNotePiece>(Pos, Msg);
+
+    for (const auto &R : Ranges)
+      P->addRange(R);
+
+    Notes.push_back(std::move(P));
+  }
+
+  ArrayRef<std::shared_ptr<PathDiagnosticNotePiece>> getNotes() {
+    return Notes;
+  }
+
+  /// Add a range to a bug report.
+  ///
+  /// Ranges are used to highlight regions of interest in the source code.
+  /// They should be at the same source code line as the BugReport location.
+  /// By default, the source range of the statement corresponding to the error
+  /// node will be used; add a single invalid range to specify absence of
+  /// ranges.
+  void addRange(SourceRange R) {
+    assert((R.isValid() || Ranges.empty()) && "Invalid range can only be used "
+                           "to specify that the report does not have a range.");
+    Ranges.push_back(R);
+  }
+
+  /// Get the SourceRanges associated with the report.
+  virtual ArrayRef<SourceRange> getRanges() const {
+    return Ranges;
+  }
+
+  /// Add a fix-it hint to the bug report.
+  ///
+  /// Fix-it hints are the suggested edits to the code that would resolve
+  /// the problem explained by the bug report. Fix-it hints should be
+  /// as conservative as possible because it is not uncommon for the user
+  /// to blindly apply all fixits to their project. Note that it is very hard
+  /// to produce a good fix-it hint for most path-sensitive warnings.
+  void addFixItHint(const FixItHint &F) {
+    Fixits.push_back(F);
+  }
+
+  llvm::ArrayRef<FixItHint> getFixits() const { return Fixits; }
+
+  /// Reports are uniqued to ensure that we do not emit multiple diagnostics
+  /// for each bug.
+  virtual void Profile(llvm::FoldingSetNodeID& hash) const = 0;
+};
+
+class BasicBugReport : public BugReport {
   PathDiagnosticLocation Location;
-  PathDiagnosticLocation UniqueingLocation;
-  const Decl *UniqueingDecl;
+  const Decl *DeclWithIssue = nullptr;
 
+public:
+  BasicBugReport(const BugType &bt, StringRef desc, PathDiagnosticLocation l)
+      : BugReport(Kind::Basic, bt, desc), Location(l) {}
+
+  static bool classof(const BugReport *R) {
+    return R->getKind() == Kind::Basic;
+  }
+
+  PathDiagnosticLocation getLocation() const override {
+    assert(Location.isValid());
+    return Location;
+  }
+
+  const Decl *getDeclWithIssue() const override {
+    return DeclWithIssue;
+  }
+
+  PathDiagnosticLocation getUniqueingLocation() const override {
+    return getLocation();
+  }
+
+  const Decl *getUniqueingDecl() const override {
+    return getDeclWithIssue();
+  }
+
+  /// Specifically set the Decl where an issue occurred. This isn't necessary
+  /// for BugReports that cover a path as it will be automatically inferred.
+  void setDeclWithIssue(const Decl *declWithIssue) {
+    DeclWithIssue = declWithIssue;
+  }
+
+  void Profile(llvm::FoldingSetNodeID& hash) const override;
+};
+
+class PathSensitiveBugReport : public BugReport {
+public:
+  using VisitorList = SmallVector<std::unique_ptr<BugReporterVisitor>, 8>;
+  using visitor_iterator = VisitorList::iterator;
+  using visitor_range = llvm::iterator_range<visitor_iterator>;
+
+protected:
+  /// The ExplodedGraph node against which the report was thrown. It corresponds
+  /// to the end of the execution path that demonstrates the bug.
   const ExplodedNode *ErrorNode = nullptr;
-  SmallVector<SourceRange, 4> Ranges;
+
+  /// The range that corresponds to ErrorNode's program point. It is usually
+  /// highlighted in the report.
   const SourceRange ErrorNodeRange;
-  NoteList Notes;
-  SmallVector<FixItHint, 4> Fixits;
+
+  /// Profile to identify equivalent bug reports for error report coalescing.
 
   /// A (stack of) a set of symbols that are registered with this
   /// report as being "interesting", and thus used to help decide which
   /// diagnostics to include when constructing the final path diagnostic.
   /// The stack is largely used by BugReporter when generating PathDiagnostics
   /// for multiple PathDiagnosticConsumers.
   llvm::DenseMap<SymbolRef, bugreporter::TrackingKind> InterestingSymbols;
 
   /// A (stack of) set of regions that are registered with this report as being
   /// "interesting", and thus used to help decide which diagnostics
   /// to include when constructing the final path diagnostic.
   /// The stack is largely used by BugReporter when generating PathDiagnostics
   /// for multiple PathDiagnosticConsumers.
   llvm::DenseMap<const MemRegion *, bugreporter::TrackingKind>
       InterestingRegions;
 
   /// A set of location contexts that correspoind to call sites which should be
   /// considered "interesting".
   llvm::SmallSet<const LocationContext *, 2> InterestingLocationContexts;
 
   /// A set of custom visitors which generate "event" diagnostics at
   /// interesting points in the path.
   VisitorList Callbacks;
 
   /// Used for ensuring the visitors are only added once.
   llvm::FoldingSet<BugReporterVisitor> CallbacksSet;
 
   /// When set, this flag disables all callstack pruning from a diagnostic
   /// path.  This is useful for some reports that want maximum fidelty
   /// when reporting an issue.
   bool DoNotPrunePath = false;
 
   /// Used to track unique reasons why a bug report might be invalid.
   ///
   /// \sa markInvalid
   /// \sa removeInvalidation
   using InvalidationRecord = std::pair<const void *, const void *>;
 
   /// If non-empty, this bug report is likely a false positive and should not be
   /// shown to the user.
   ///
   /// \sa markInvalid
   /// \sa removeInvalidation
   llvm::SmallSet<InvalidationRecord, 4> Invalidations;
 
   /// Conditions we're already tracking.
   llvm::SmallSet<const ExplodedNode *, 4> TrackedConditions;
 
-public:
-  BugReport(const BugType &bt, StringRef desc, const ExplodedNode *errornode)
-      : BT(bt), Description(desc), ErrorNode(errornode),
-        ErrorNodeRange(getStmt() ? getStmt()->getSourceRange()
-                                 : SourceRange()) {}
+  /// Reports with different uniqueing locations are considered to be different
+  /// for the purposes of deduplication.
+  PathDiagnosticLocation UniqueingLocation;
+  const Decl *UniqueingDecl;
 
-  BugReport(const BugType &bt, StringRef shortDesc, StringRef desc,
-            const ExplodedNode *errornode)
-      : BT(bt), ShortDescription(shortDesc), Description(desc),
-        ErrorNode(errornode),
+  const Stmt *getStmt() const;
+
+public:
+  PathSensitiveBugReport(const BugType &bt, StringRef desc,
+                         const ExplodedNode *errorNode)
+      : BugReport(Kind::PathSensitive, bt, desc), ErrorNode(errorNode),
         ErrorNodeRange(getStmt() ? getStmt()->getSourceRange()
                                  : SourceRange()) {}
 
-  BugReport(const BugType &bt, StringRef desc, PathDiagnosticLocation l)
-      : BT(bt), Description(desc), Location(l),
+  PathSensitiveBugReport(const BugType &bt, StringRef shortDesc, StringRef desc,
+                         const ExplodedNode *errorNode)
+      : BugReport(Kind::PathSensitive, bt, shortDesc, desc),
+        ErrorNode(errorNode),
         ErrorNodeRange(getStmt() ? getStmt()->getSourceRange()
                                  : SourceRange()) {}
 
-  /// Create a BugReport with a custom uniqueing location.
+  /// Create a PathSensitiveBugReport with a custom uniqueing location.
   ///
   /// The reports that have the same report location, description, bug type, and
   /// ranges are uniqued - only one of the equivalent reports will be presented
   /// to the user. This method allows to rest the location which should be used
   /// for uniquing reports. For example, memory leaks checker, could set this to
   /// the allocation site, rather then the location where the bug is reported.
-  BugReport(BugType &bt, StringRef desc, const ExplodedNode *errornode,
-            PathDiagnosticLocation LocationToUnique, const Decl *DeclToUnique)
-      : BT(bt), Description(desc), UniqueingLocation(LocationToUnique),
-        UniqueingDecl(DeclToUnique), ErrorNode(errornode),
-        ErrorNodeRange(getStmt() ? getStmt()->getSourceRange()
-                                 : SourceRange()) {}
-
-  virtual ~BugReport() = default;
-
-  const BugType& getBugType() const { return BT; }
-  //BugType& getBugType() { return BT; }
+  PathSensitiveBugReport(BugType &bt, StringRef desc,
+                         const ExplodedNode *errorNode,
+                         PathDiagnosticLocation LocationToUnique,
+                         const Decl *DeclToUnique)
+      : BugReport(Kind::PathSensitive, bt, desc), ErrorNode(errorNode),
+        ErrorNodeRange(getStmt() ? getStmt()->getSourceRange() : SourceRange()),
+        UniqueingLocation(LocationToUnique), UniqueingDecl(DeclToUnique) {
+    assert(errorNode);
+  }
 
-  /// True when the report has an execution path associated with it.
-  ///
-  /// A report is said to be path-sensitive if it was thrown against a
-  /// particular exploded node in the path-sensitive analysis graph.
-  /// Path-sensitive reports have their intermediate path diagnostics
-  /// auto-generated, perhaps with the help of checker-defined visitors,
-  /// and may contain extra notes.
-  /// Path-insensitive reports consist only of a single warning message
-  /// in a specific location, and perhaps extra notes.
-  /// Path-sensitive checkers are allowed to throw path-insensitive reports.
-  bool isPathSensitive() const { return ErrorNode != nullptr; }
+  static bool classof(const BugReport *R) {
+    return R->getKind() == Kind::PathSensitive;
+  }
 
   const ExplodedNode *getErrorNode() const { return ErrorNode; }
 
-  StringRef getDescription() const { return Description; }
-
-  StringRef getShortDescription(bool UseFallback = true) const {
-    if (ShortDescription.empty() && UseFallback)
-      return Description;
-    return ShortDescription;
-  }
-
   /// Indicates whether or not any path pruning should take place
   /// when generating a PathDiagnostic from this BugReport.
   bool shouldPrunePath() const { return !DoNotPrunePath; }
 
   /// Disable all path pruning when generating a PathDiagnostic.
   void disablePathPruning() { DoNotPrunePath = true; }
 
+  /// Get the location on which the report should be uniqued.
+  PathDiagnosticLocation getUniqueingLocation() const override {
+    return UniqueingLocation;
+  }
+
+  /// Get the declaration containing the uniqueing location.
+  const Decl *getUniqueingDecl() const override {
+    return UniqueingDecl;
+  }
+
+  const Decl *getDeclWithIssue() const override;
+
+  ArrayRef<SourceRange> getRanges() const override;
+
+  PathDiagnosticLocation getLocation() const override;
+
   /// Marks a symbol as interesting. Different kinds of interestingness will
   /// be processed differently by visitors (e.g. if the tracking kind is
   /// condition, will append "will be used as a condition" to the message).
   void markInteresting(SymbolRef sym, bugreporter::TrackingKind TKind =
                                           bugreporter::TrackingKind::Thorough);
 
   /// Marks a region as interesting. Different kinds of interestingness will
   /// be processed differently by visitors (e.g. if the tracking kind is
   /// condition, will append "will be used as a condition" to the message).
   void markInteresting(
       const MemRegion *R,
       bugreporter::TrackingKind TKind = bugreporter::TrackingKind::Thorough);
 
   /// Marks a symbolic value as interesting. Different kinds of interestingness
   /// will be processed differently by visitors (e.g. if the tracking kind is
   /// condition, will append "will be used as a condition" to the message).
   void markInteresting(SVal V, bugreporter::TrackingKind TKind =
                                    bugreporter::TrackingKind::Thorough);
   void markInteresting(const LocationContext *LC);
 
   bool isInteresting(SymbolRef sym) const;
   bool isInteresting(const MemRegion *R) const;
   bool isInteresting(SVal V) const;
   bool isInteresting(const LocationContext *LC) const;
public:
   /// responsible for invalidation, and \p Data represents the reason this
   /// visitor decided to invalidate the bug report.
   ///
   /// \sa removeInvalidation
   void markInvalid(const void *Tag, const void *Data) {
     Invalidations.insert(std::make_pair(Tag, Data));
   }
 
-  /// Return the canonical declaration, be it a method or class, where
-  /// this issue semantically occurred.
-  const Decl *getDeclWithIssue() const;
-
-  /// Specifically set the Decl where an issue occurred.  This isn't necessary
-  /// for BugReports that cover a path as it will be automatically inferred.
-  void setDeclWithIssue(const Decl *declWithIssue) {
-    DeclWithIssue = declWithIssue;
-  }
-
-  /// Add new item to the list of additional notes that need to be attached to
-  /// this path-insensitive report. If you want to add extra notes to a
-  /// path-sensitive report, you need to use a BugReporterVisitor because it
-  /// allows you to specify where exactly in the auto-generated path diagnostic
-  /// the extra note should appear.
-  void addNote(StringRef Msg, const PathDiagnosticLocation &Pos,
-               ArrayRef<SourceRange> Ranges = {},
-               ArrayRef<FixItHint> Fixits = {}) {
-    auto P = std::make_shared<PathDiagnosticNotePiece>(Pos, Msg);
-
-    for (const auto &R : Ranges)
-      P->addRange(R);
-
-    for (const auto &F : Fixits)
-      P->addFixit(F);
-
-    Notes.push_back(std::move(P));
-  }
-
-  virtual const NoteList &getNotes() {
-    return Notes;
-  }
-
-  /// Return the "definitive" location of the reported bug.
-  ///
-  ///  While a bug can span an entire path, usually there is a specific
-  ///  location that can be used to identify where the key issue occurred.
-  ///  This location is used by clients rendering diagnostics.
-  virtual PathDiagnosticLocation getLocation(const SourceManager &SM) const;
-
-  /// Get the location on which the report should be uniqued.
-  PathDiagnosticLocation getUniqueingLocation() const {
-    return UniqueingLocation;
-  }
-
-  /// Get the declaration containing the uniqueing location.
-  const Decl *getUniqueingDecl() const {
-    return UniqueingDecl;
-  }
-
-  const Stmt *getStmt() const;
-
-  /// Add a range to the bug report.
-  ///
-  /// Ranges are used to highlight regions of interest in the source code.
-  /// They should be at the same source code line as the BugReport location.
-  /// By default, the source range of the statement corresponding to the error
-  /// node will be used; add a single invalid range to specify absence of
-  /// ranges.
-  void addRange(SourceRange R) {
-    assert((R.isValid() || Ranges.empty()) && "Invalid range can only be used "
-                           "to specify that the report does not have a range.");
-    Ranges.push_back(R);
-  }
-
-  /// Get the SourceRanges associated with the report.
-  virtual llvm::iterator_range<ranges_iterator> getRanges() const;
-
-  /// Add a fix-it hint to the bug report.
-  ///
-  /// Fix-it hints are the suggested edits to the code that would resolve
-  /// the problem explained by the bug report. Fix-it hints should be
-  /// as conservative as possible because it is not uncommon for the user
-  /// to blindly apply all fixits to their project. Note that it is very hard
-  /// to produce a good fix-it hint for most path-sensitive warnings.
-  void addFixItHint(const FixItHint &F) {
-    Fixits.push_back(F);
-  }
-
-  ArrayRef<FixItHint> getFixits() const { return Fixits; }
+  /// Profile to identify equivalent bug reports for error report coalescing.
+  /// Reports are uniqued to ensure that we do not emit multiple diagnostics
+  /// for each bug.
+  void Profile(llvm::FoldingSetNodeID &hash) const override;
 
   /// Add custom or predefined bug report visitors to this report.
   ///
   /// The visitors should be used when the default trace is not sufficient.
   /// For example, they allow constructing a more elaborate trace.
   /// \sa registerConditionVisitor(), registerTrackNullOrUndefValue(),
   /// registerFindLastStore(), registerNilReceiverVisitor(), and
   /// registerVarDeclsLastStore().
   void addVisitor(std::unique_ptr<BugReporterVisitor> visitor);
 
   /// Remove all visitors attached to this bug report.
   void clearVisitors();
 
   /// Iterators through the custom diagnostic visitors.
   visitor_iterator visitor_begin() { return Callbacks.begin(); }
   visitor_iterator visitor_end() { return Callbacks.end(); }
   visitor_range visitors() { return {visitor_begin(), visitor_end()}; }
 
   /// Notes that the condition of the CFGBlock associated with \p Cond is
   /// being tracked.
   /// \returns false if the condition is already being tracked.
   bool addTrackedCondition(const ExplodedNode *Cond) {
     return TrackedConditions.insert(Cond).second;
   }
-
-  /// Profile to identify equivalent bug reports for error report coalescing.
-  /// Reports are uniqued to ensure that we do not emit multiple diagnostics
-  /// for each bug.
-  virtual void Profile(llvm::FoldingSetNodeID& hash) const;
 };
 
 //===----------------------------------------------------------------------===//
 // BugTypes (collections of related reports).
 //===----------------------------------------------------------------------===//
 
 class BugReportEquivClass : public llvm::FoldingSetNode {
   friend class BugReporter;

 /// The base class is used for generating path-insensitive
 class BugReporter {
 private:
   BugReporterData& D;
 
   /// Generate and flush the diagnostics for the given bug report.
   void FlushReport(BugReportEquivClass& EQ);
 
-  /// Generate the diagnostics for the given bug report.
-  std::unique_ptr<DiagnosticForConsumerMapTy>
-  generateDiagnosticForConsumerMap(BugReport *exampleReport,
-                                   ArrayRef<PathDiagnosticConsumer *> consumers,
-                                   ArrayRef<BugReport *> bugReports);
-
   /// The set of bug reports tracked by the BugReporter.
   llvm::FoldingSet<BugReportEquivClass> EQClasses;
 
   /// A vector of BugReports for tracking the allocated pointers and cleanup.
   std::vector<BugReportEquivClass *> EQClassesVector;
 
 public:
   BugReporter(BugReporterData &d) : D(d) {}
public:
   EQClasses_iterator EQClasses_end() { return EQClasses.end(); }
 
   ASTContext &getContext() { return D.getASTContext(); }
 
   const SourceManager &getSourceManager() { return D.getSourceManager(); }
 
   const AnalyzerOptions &getAnalyzerOptions() { return D.getAnalyzerOptions(); }
 
-  virtual std::unique_ptr<DiagnosticForConsumerMapTy>
-  generatePathDiagnostics(ArrayRef<PathDiagnosticConsumer *> consumers,
-                          ArrayRef<BugReport *> &bugReports) {
-    return {};
-  }
-
   /// Add the given report to the set of reports tracked by BugReporter.
   ///
   /// The reports are usually generated by the checkers. Further, they are
   /// folded based on the profile value, which is done to coalesce similar
   /// reports.
-  void emitReport(std::unique_ptr<BugReport> R);
+  virtual void emitReport(std::unique_ptr<BugReport> R);
 
   void EmitBasicReport(const Decl *DeclWithIssue, const CheckerBase *Checker,
                        StringRef BugName, StringRef BugCategory,
                        StringRef BugStr, PathDiagnosticLocation Loc,
                        ArrayRef<SourceRange> Ranges = None,
                        ArrayRef<FixItHint> Fixits = None);
 
   void EmitBasicReport(const Decl *DeclWithIssue, CheckName CheckName,
                        StringRef BugName, StringRef BugCategory,
                        StringRef BugStr, PathDiagnosticLocation Loc,
                        ArrayRef<SourceRange> Ranges = None,
                        ArrayRef<FixItHint> Fixits = None);
 
 private:
   llvm::StringMap<BugType *> StrBugTypes;
 
   /// Returns a BugType that is associated with the given name and
   /// category.
   BugType *getBugTypeForName(CheckName CheckName, StringRef name,
                              StringRef category);
+
+  virtual BugReport *
+  findReportInEquivalenceClass(BugReportEquivClass &eqClass,
+                               SmallVectorImpl<BugReport *> &bugReports) {
+    return &*eqClass.begin();
+  }
+
+protected:
+  /// Generate the diagnostics for the given bug report.
+  virtual std::unique_ptr<DiagnosticForConsumerMapTy>
+  generateDiagnosticForConsumerMap(BugReport *exampleReport,
+                                   ArrayRef<PathDiagnosticConsumer *> consumers,
+                                   ArrayRef<BugReport *> bugReports);
 };
 
 /// GRBugReporter is used for generating path-sensitive reports.
-class PathSensitiveBugReporter : public BugReporter {
+class PathSensitiveBugReporter final : public BugReporter {
   ExprEngine& Eng;
 
+  BugReport *findReportInEquivalenceClass(
+      BugReportEquivClass &eqClass,
+      SmallVectorImpl<BugReport *> &bugReports) override;
+
+  /// Generate the diagnostics for the given bug report.
+  std::unique_ptr<DiagnosticForConsumerMapTy>
+  generateDiagnosticForConsumerMap(BugReport *exampleReport,
+                                   ArrayRef<PathDiagnosticConsumer *> consumers,
+                                   ArrayRef<BugReport *> bugReports) override;
 public:
   PathSensitiveBugReporter(BugReporterData& d, ExprEngine& eng)
       : BugReporter(d), Eng(eng) {}
 
   /// getGraph - Get the exploded graph created by the analysis engine
   ///  for the analyzed method or function.
   const ExplodedGraph &getGraph() const;
 
   /// getStateManager - Return the state manager used by the analysis
   ///  engine.
   ProgramStateManager &getStateManager() const;
 
   /// \p bugReports A set of bug reports within a *single* equivalence class
   ///
   /// \return A mapping from consumers to the corresponding diagnostics.
   /// Iterates through the bug reports within a single equivalence class,
   /// stops at a first non-invalidated report.
-  std::unique_ptr<DiagnosticForConsumerMapTy>
-  generatePathDiagnostics(ArrayRef<PathDiagnosticConsumer *> consumers,
-                          ArrayRef<BugReport *> &bugReports) override;
+  std::unique_ptr<DiagnosticForConsumerMapTy> generatePathDiagnostics(
+      ArrayRef<PathDiagnosticConsumer *> consumers,
+      ArrayRef<PathSensitiveBugReport *> &bugReports);
+
+  void emitReport(std::unique_ptr<BugReport> R) override;
 };
 
 
 class BugReporterContext {
   PathSensitiveBugReporter &BR;
 
   virtual void anchor();
 

clang/include/clang/StaticAnalyzer/Core/BugReporter/BugReporterVisitors.h

 class BinaryOperator;
 class CFGBlock;
 class DeclRefExpr;
 class Expr;
 class Stmt;
 
 namespace ento {
 
-class BugReport;
+class PathSensitiveBugReport;
 class BugReporterContext;
 class ExplodedNode;
 class MemRegion;
 class PathDiagnosticPiece;
 using PathDiagnosticPieceRef = std::shared_ptr<PathDiagnosticPiece>;
 
 /// BugReporterVisitors are used to add custom diagnostics along a path.
 class BugReporterVisitor : public llvm::FoldingSetNode {
public:
   /// last node should be unique.
   /// Use {@code getEndPath} to customize the note associated with the report
   /// end instead.
   ///
   /// The last parameter can be used to register a new visitor with the given
   /// BugReport while processing a node.
   virtual PathDiagnosticPieceRef VisitNode(const ExplodedNode *Succ,
                                            BugReporterContext &BRC,
-                                           BugReport &BR) = 0;
+                                           PathSensitiveBugReport &BR) = 0;
 
   /// Last function called on the visitor, no further calls to VisitNode
   /// would follow.
   virtual void finalizeVisitor(BugReporterContext &BRC,
                                const ExplodedNode *EndPathNode,
-                               BugReport &BR);
+                               PathSensitiveBugReport &BR);
 
   /// Provide custom definition for the final diagnostic piece on the
   /// path - the piece, which is displayed before the path is expanded.
   ///
   /// NOTE that this function can be implemented on at most one used visitor,
   /// and otherwise it crahes at runtime.
-  virtual PathDiagnosticPieceRef
-  getEndPath(BugReporterContext &BRC, const ExplodedNode *N,
-             BugReport &BR);
+  virtual PathDiagnosticPieceRef getEndPath(BugReporterContext &BRC,
+                                            const ExplodedNode *N,
+                                            PathSensitiveBugReport &BR);
 
   virtual void Profile(llvm::FoldingSetNodeID &ID) const = 0;
 
   /// Generates the default final diagnostic piece.
-  static PathDiagnosticPieceRef getDefaultEndPath(const BugReporterContext &BRC,
-                                                  const ExplodedNode *N,
-                                                  const BugReport &BR);
+  static PathDiagnosticPieceRef
+  getDefaultEndPath(const BugReporterContext &BRC, const ExplodedNode *N,
+                    const PathSensitiveBugReport &BR);
 };
 
 namespace bugreporter {
 
 /// Specifies the type of tracking for an expression.
 enum class TrackingKind {
   /// Default tracking kind -- specifies that as much information should be
   /// gathered about the tracked expression value as possible.

 /// \param E The expression value which we are tracking
 /// \param R The bug report to which visitors should be attached.
 /// \param EnableNullFPSuppression Whether we should employ false positive
 ///         suppression (inlined defensive checks, returned null).
 ///
 /// \return Whether or not the function was able to add visitors for this
 ///         statement. Note that returning \c true does not actually imply
 ///         that any visitors were added.
-bool trackExpressionValue(const ExplodedNode *N, const Expr *E, BugReport &R,
+bool trackExpressionValue(const ExplodedNode *N, const Expr *E,
+                          PathSensitiveBugReport &R,
                           TrackingKind TKind = TrackingKind::Thorough,
                           bool EnableNullFPSuppression = true);
 
 const Expr *getDerefExpr(const Stmt *S);
 
 } // namespace bugreporter
 
 /// Finds last store into the given region,
FindLastStoreBRVisitor(KnownSVal V, const MemRegion *R,
         TKind(TKind), OriginSFC(OriginSFC) {
     assert(R);
   }
 
   void Profile(llvm::FoldingSetNodeID &ID) const override;
 
   PathDiagnosticPieceRef VisitNode(const ExplodedNode *N,
                                    BugReporterContext &BRC,
-                                   BugReport &BR) override;
+                                   PathSensitiveBugReport &BR) override;
 };
 
 class TrackConstraintBRVisitor final : public BugReporterVisitor {
   DefinedSVal Constraint;
   bool Assumption;
   bool IsSatisfied = false;
   bool IsZeroCheck;
 
public:
   void Profile(llvm::FoldingSetNodeID &ID) const override;
 
   /// Return the tag associated with this visitor.  This tag will be used
   /// to make all PathDiagnosticPieces created by this visitor.
   static const char *getTag();
 
   PathDiagnosticPieceRef VisitNode(const ExplodedNode *N,
                                    BugReporterContext &BRC,
-                                   BugReport &BR) override;
+                                   PathSensitiveBugReport &BR) override;
 
 private:
   /// Checks if the constraint is valid in the current state.
   bool isUnderconstrained(const ExplodedNode *N) const;
 };
 
 /// \class NilReceiverBRVisitor
 /// Prints path notes when a message is sent to a nil receiver.
 class NilReceiverBRVisitor final : public BugReporterVisitor {
 public:
   void Profile(llvm::FoldingSetNodeID &ID) const override {
     static int x = 0;
     ID.AddPointer(&x);
   }
 
   PathDiagnosticPieceRef VisitNode(const ExplodedNode *N,
                                    BugReporterContext &BRC,
-                                   BugReport &BR) override;
+                                   PathSensitiveBugReport &BR) override;
 
   /// If the statement is a message send expression with nil receiver, returns
   /// the receiver expression. Returns NULL otherwise.
   static const Expr *getNilReceiver(const Stmt *S, const ExplodedNode *N);
 };
 
 /// Visitor that tries to report interesting diagnostics from conditions.
 class ConditionBRVisitor final : public BugReporterVisitor {
public:
   }
 
   /// Return the tag associated with this visitor.  This tag will be used
   /// to make all PathDiagnosticPieces created by this visitor.
   static const char *getTag();
 
   PathDiagnosticPieceRef VisitNode(const ExplodedNode *N,
                                    BugReporterContext &BRC,
-                                   BugReport &BR) override;
+                                   PathSensitiveBugReport &BR) override;
 
   PathDiagnosticPieceRef VisitNodeImpl(const ExplodedNode *N,
-                                       BugReporterContext &BRC, BugReport &BR);
+                                       BugReporterContext &BRC,
+                                       PathSensitiveBugReport &BR);
 
-  PathDiagnosticPieceRef VisitTerminator(const Stmt *Term,
-                                         const ExplodedNode *N,
-                                         const CFGBlock *SrcBlk,
-                                         const CFGBlock *DstBlk, BugReport &R,
-                                         BugReporterContext &BRC);
+  PathDiagnosticPieceRef
+  VisitTerminator(const Stmt *Term, const ExplodedNode *N,
+                  const CFGBlock *SrcBlk, const CFGBlock *DstBlk,
+                  PathSensitiveBugReport &R, BugReporterContext &BRC);
 
   PathDiagnosticPieceRef VisitTrueTest(const Expr *Cond,
-                                       BugReporterContext &BRC, BugReport &R,
+                                       BugReporterContext &BRC,
+                                       PathSensitiveBugReport &R,
                                        const ExplodedNode *N, bool TookTrue);
 
   PathDiagnosticPieceRef VisitTrueTest(const Expr *Cond, const DeclRefExpr *DR,
-                                       BugReporterContext &BRC, BugReport &R,
+                                       BugReporterContext &BRC,
+                                       PathSensitiveBugReport &R,
                                        const ExplodedNode *N, bool TookTrue,
                                        bool IsAssuming);
 
-  PathDiagnosticPieceRef VisitTrueTest(const Expr *Cond,
-                                       const BinaryOperator *BExpr,
-                                       BugReporterContext &BRC, BugReport &R,
-                                       const ExplodedNode *N, bool TookTrue,
-                                       bool IsAssuming);
+  PathDiagnosticPieceRef
+  VisitTrueTest(const Expr *Cond, const BinaryOperator *BExpr,
+                BugReporterContext &BRC, PathSensitiveBugReport &R,
+                const ExplodedNode *N, bool TookTrue, bool IsAssuming);
 
   PathDiagnosticPieceRef VisitTrueTest(const Expr *Cond, const MemberExpr *ME,
-                                       BugReporterContext &BRC, BugReport &R,
+                                       BugReporterContext &BRC,
+                                       PathSensitiveBugReport &R,
                                        const ExplodedNode *N, bool TookTrue,
                                        bool IsAssuming);
 
   PathDiagnosticPieceRef
   VisitConditionVariable(StringRef LhsString, const Expr *CondVarExpr,
-                         BugReporterContext &BRC, BugReport &R,
+                         BugReporterContext &BRC, PathSensitiveBugReport &R,
                          const ExplodedNode *N, bool TookTrue);
 
   /// Tries to print the value of the given expression.
   ///
   /// \param CondVarExpr The expression to print its value.
   /// \param Out The stream to print.
   /// \param N The node where we encountered the condition.
   /// \param TookTrue Whether we took the \c true branch of the condition.
   ///
   /// \return Whether the print was successful. (The printing is successful if
   ///         we model the value and we could obtain it.)
   bool printValue(const Expr *CondVarExpr, raw_ostream &Out,
                   const ExplodedNode *N, bool TookTrue, bool IsAssuming);
 
   bool patternMatch(const Expr *Ex,
                     const Expr *ParentEx,
                     raw_ostream &Out,
                     BugReporterContext &BRC,
-                    BugReport &R,
+                    PathSensitiveBugReport &R,
                     const ExplodedNode *N,
                     Optional<bool> &prunable,
                     bool IsSameFieldName);
 
   static bool isPieceMessageGeneric(const PathDiagnosticPiece *Piece);
 };
 
 /// Suppress reports that might lead to known false positives.
 ///
 /// Currently this suppresses reports based on locations of bugs.
 class LikelyFalsePositiveSuppressionBRVisitor final
     : public BugReporterVisitor {
 public:
   static void *getTag() {
     static int Tag = 0;
     return static_cast<void *>(&Tag);
   }
 
   void Profile(llvm::FoldingSetNodeID &ID) const override {
     ID.AddPointer(getTag());
   }
 
   PathDiagnosticPieceRef VisitNode(const ExplodedNode *, BugReporterContext &,
-                                   BugReport &) override {
+                                   PathSensitiveBugReport &) override {
     return nullptr;
   }
 
   void finalizeVisitor(BugReporterContext &BRC, const ExplodedNode *N,
-                       BugReport &BR) override;
+                       PathSensitiveBugReport &BR) override;
 };
 
 /// When a region containing undefined value or '0' value is passed
 /// as an argument in a call, marks the call as interesting.
 ///
 /// As a result, BugReporter will not prune the path through the function even
 /// if the region's contents are not modified/accessed by the call.
 class UndefOrNullArgVisitor final : public BugReporterVisitor {
   /// The interesting memory region this visitor is tracking.
   const MemRegion *R;
 
 public:
   UndefOrNullArgVisitor(const MemRegion *InR) : R(InR) {}
 
   void Profile(llvm::FoldingSetNodeID &ID) const override {
     static int Tag = 0;
     ID.AddPointer(&Tag);
     ID.AddPointer(R);
   }
 
   PathDiagnosticPieceRef VisitNode(const ExplodedNode *N,
                                    BugReporterContext &BRC,
-                                   BugReport &BR) override;
+                                   PathSensitiveBugReport &BR) override;
 };
 
 class SuppressInlineDefensiveChecksVisitor final : public BugReporterVisitor {
   /// The symbolic value for which we are tracking constraints.
   /// This value is constrained to null in the end of path.
   DefinedSVal V;
 
   /// Track if we found the node where the constraint was first added.
public:
   void Profile(llvm::FoldingSetNodeID &ID) const override;
 
   /// Return the tag associated with this visitor.  This tag will be used
   /// to make all PathDiagnosticPieces created by this visitor.
   static const char *getTag();
 
   PathDiagnosticPieceRef VisitNode(const ExplodedNode *Succ,
                                    BugReporterContext &BRC,
-                                   BugReport &BR) override;
+                                   PathSensitiveBugReport &BR) override;
 };
 
 /// The bug visitor will walk all the nodes in a path and collect all the
 /// constraints. When it reaches the root node, will create a refutation
 /// manager and check if the constraints are satisfiable
 class FalsePositiveRefutationBRVisitor final : public BugReporterVisitor {
 private:
   /// Holds the constraints in a given path
   ConstraintRangeTy Constraints;
 
 public:
   FalsePositiveRefutationBRVisitor();
 
   void Profile(llvm::FoldingSetNodeID &ID) const override;
 
   PathDiagnosticPieceRef VisitNode(const ExplodedNode *N,
                                    BugReporterContext &BRC,
-                                   BugReport &BR) override;
+                                   PathSensitiveBugReport &BR) override;
 
   void finalizeVisitor(BugReporterContext &BRC, const ExplodedNode *EndPathNode,
-                       BugReport &BR) override;
+                       PathSensitiveBugReport &BR) override;
 };
 
 
 /// The visitor detects NoteTags and displays the event notes they contain.
 class TagVisitor : public BugReporterVisitor {
 public:
   void Profile(llvm::FoldingSetNodeID &ID) const override;
 
   PathDiagnosticPieceRef VisitNode(const ExplodedNode *N,
                                    BugReporterContext &BRC,
-                                   BugReport &R) override;
+                                   PathSensitiveBugReport &R) override;
 };
 
 } // namespace ento
 
 } // namespace clang
 
 #endif // LLVM_CLANG_STATICANALYZER_CORE_BUGREPORTER_BUGREPORTERVISITORS_H

clang/include/clang/StaticAnalyzer/Core/BugReporter/PathDiagnostic.h

static PathDiagnosticLocation createDeclEnd(const LocationContext *LC,
                                                    const SourceManager &SM);
 
   /// Create a location corresponding to the given valid ExplodedNode.
   static PathDiagnosticLocation create(const ProgramPoint &P,
                                        const SourceManager &SMng);
 
   /// Create a location corresponding to the next valid ExplodedNode as end
   /// of path location.
-  static PathDiagnosticLocation createEndOfPath(const ExplodedNode* N,
-                                                const SourceManager &SM);
+  static PathDiagnosticLocation createEndOfPath(const ExplodedNode* N);
 
   /// Convert the given location into a single kind location.
   static PathDiagnosticLocation createSingleLocation(
                                              const PathDiagnosticLocation &PDL);
 
   bool operator==(const PathDiagnosticLocation &X) const {
     return K == X.K && Loc == X.Loc && Range == X.Range;
   }

clang/lib/Analysis/plugins/SampleAnalyzer/MainCallChecker.cpp

void MainCallChecker::checkPreStmt(const CallExpr *CE,
   if (II->isStr("main")) {
     ExplodedNode *N = C.generateErrorNode();
     if (!N)
       return;
 
     if (!BT)
       BT.reset(new BugType(this, "call to main", "example analyzer plugin"));
 
-    std::unique_ptr<BugReport> report =
-        std::make_unique<BugReport>(*BT, BT->getName(), N);
+    auto report =
+        std::make_unique<PathSensitiveBugReport>(*BT, BT->getName(), N);
     report->addRange(Callee->getSourceRange());
     C.emitReport(std::move(report));
   }
 }
 
 // Register plugin!
 extern "C" void clang_registerCheckers(CheckerRegistry &registry) {
   registry.addChecker<MainCallChecker>(
       "example.MainCallChecker", "Disallows calls to functions called main",
       "");
 }
 
 extern "C" const char clang_analyzerAPIVersionString[] =
     CLANG_ANALYZER_API_VERSION_STRING;

clang/lib/StaticAnalyzer/Checkers/ArrayBoundChecker.cpp

if (!BT)
           this, "Out-of-bound array access",
           "Access out-of-bound array element (buffer overflow)"));
 
     // FIXME: It would be nice to eventually make this diagnostic more clear,
     // e.g., by referencing the original declaration or by saying *why* this
     // reference is outside the range.
 
     // Generate a report for this bug.
-    auto report = std::make_unique<BugReport>(*BT, BT->getDescription(), N);
+    auto report =
+        std::make_unique<PathSensitiveBugReport>(*BT, BT->getDescription(), N);
 
     report->addRange(LoadS->getSourceRange());
     C.emitReport(std::move(report));
     return;
   }
 
   // Array bound check succeeded.  From this point forward the array bound
   // should always succeed.

clang/lib/StaticAnalyzer/Checkers/ArrayBoundCheckerV2.cpp

void ArrayBoundCheckerV2::reportOOB(
   case OOB_Excedes:
     os << "(access exceeds upper limit of memory block)";
     break;
   case OOB_Tainted:
     os << "(index is tainted)";
     break;
   }
 
-  auto BR = std::make_unique<BugReport>(*BT, os.str(), errorNode);
+  auto BR = std::make_unique<PathSensitiveBugReport>(*BT, os.str(), errorNode);
   BR->addVisitor(std::move(Visitor));
   checkerContext.emitReport(std::move(BR));
 }
 
 #ifndef NDEBUG
 LLVM_DUMP_METHOD void RegionRawOffsetV2::dump() const {
   dumpToStream(llvm::errs());
 }

clang/lib/StaticAnalyzer/Checkers/BasicObjCFoundationChecks.cpp

 void NilArgChecker::generateBugReport(ExplodedNode *N,
                                       StringRef Msg,
                                       SourceRange Range,
                                       const Expr *E,
                                       CheckerContext &C) const {
   if (!BT)
     BT.reset(new APIMisuse(this, "nil argument"));
 
-  auto R = std::make_unique<BugReport>(*BT, Msg, N);
+  auto R = std::make_unique<PathSensitiveBugReport>(*BT, Msg, N);
   R->addRange(Range);
   bugreporter::trackExpressionValue(N, E, *R);
   C.emitReport(std::move(R));
 }
 
 void NilArgChecker::checkPreObjCMessage(const ObjCMethodCall &msg,
                                         CheckerContext &C) const {
   const ObjCInterfaceDecl *ID = msg.getReceiverInterface();
if (N) {
     else
       os << (PrimitiveTypeSize - CFNumberSize)
       << " bits of the integer value will be "
       << (isCreate ? "lost." : "garbage.");
 
     if (!BT)
       BT.reset(new APIMisuse(this, "Bad use of CFNumber APIs"));
 
-    auto report = std::make_unique<BugReport>(*BT, os.str(), N);
+    auto report = std::make_unique<PathSensitiveBugReport>(*BT, os.str(), N);
     report->addRange(CE->getArg(2)->getSourceRange());
     C.emitReport(std::move(report));
   }
 }
 
 //===----------------------------------------------------------------------===//
 // CFRetain/CFRelease/CFMakeCollectable/CFAutorelease checking for null arguments.
 //===----------------------------------------------------------------------===//
if (!stateNonNull) {
     if (!N)
       return;
 
     SmallString<64> Str;
     raw_svector_ostream OS(Str);
     OS << "Null pointer argument in call to "
        << cast<FunctionDecl>(Call.getDecl())->getName();
 
-    auto report = std::make_unique<BugReport>(BT, OS.str(), N);
+    auto report = std::make_unique<PathSensitiveBugReport>(BT, OS.str(), N);
     report->addRange(Call.getArgSourceRange(0));
     bugreporter::trackExpressionValue(N, Call.getArgExpr(0), *report);
     C.emitReport(std::move(report));
     return;
   }
 
   // From here on, we know the argument is non-null.
   C.addTransition(stateNonNull);
if (ExplodedNode *N = C.generateNonFatalErrorNode()) {
     llvm::raw_svector_ostream os(buf);
 
     os << "The '";
     S.print(os);
     os << "' message should be sent to instances "
           "of class '" << Class->getName()
        << "' and not the class directly";
 
-    auto report = std::make_unique<BugReport>(*BT, os.str(), N);
+    auto report = std::make_unique<PathSensitiveBugReport>(*BT, os.str(), N);
     report->addRange(msg.getSourceRange());
     C.emitReport(std::move(report));
   }
 }
 
 //===----------------------------------------------------------------------===//
 // Check for passing non-Objective-C types to variadic methods that expect
 // only Objective-C types.
for (unsigned I = variadicArgsBegin; I != variadicArgsEnd; ++I) {
     else
       os << "Argument to method '";
 
     msg.getSelector().print(os);
     os << "' should be an Objective-C pointer type, not '";
     ArgTy.print(os, C.getLangOpts());
     os << "'";
 
-    auto R = std::make_unique<BugReport>(*BT, os.str(), errorNode.getValue());
+    auto R = std::make_unique<PathSensitiveBugReport>(*BT, os.str(),
+                                                      errorNode.getValue());
     R->addRange(msg.getArgSourceRange(I));
     C.emitReport(std::move(R));
   }
 }
 
 //===----------------------------------------------------------------------===//
 // Improves the modeling of loops over Cocoa collections.
 //===----------------------------------------------------------------------===//

clang/lib/StaticAnalyzer/Checkers/BlockInCriticalSectionChecker.cpp

void BlockInCriticalSectionChecker::reportBlockInCritSection(
   ExplodedNode *ErrNode = C.generateNonFatalErrorNode();
   if (!ErrNode)
     return;
 
   std::string msg;
   llvm::raw_string_ostream os(msg);
   os << "Call to blocking function '" << Call.getCalleeIdentifier()->getName()
      << "' inside of critical section";
-  auto R = std::make_unique<BugReport>(*BlockInCritSectionBugType, os.str(), ErrNode);
+  auto R = std::make_unique<PathSensitiveBugReport>(*BlockInCritSectionBugType,
+                                                    os.str(), ErrNode);
   R->addRange(Call.getSourceRange());
   R->markInteresting(BlockDescSym);
   C.emitReport(std::move(R));
 }
 
 void ento::registerBlockInCriticalSectionChecker(CheckerManager &mgr) {
   mgr.registerChecker<BlockInCriticalSectionChecker>();
 }
 
 bool ento::shouldRegisterBlockInCriticalSectionChecker(const LangOptions &LO) {
   return true;
 }

clang/lib/StaticAnalyzer/Checkers/BoolAssignmentChecker.cpp

namespace {
   };
 } // end anonymous namespace
 
 void BoolAssignmentChecker::emitReport(ProgramStateRef state,
                                        CheckerContext &C) const {
   if (ExplodedNode *N = C.generateNonFatalErrorNode(state)) {
     if (!BT)
       BT.reset(new BuiltinBug(this, "Assignment of a non-Boolean value"));
-    C.emitReport(std::make_unique<BugReport>(*BT, BT->getDescription(), N));
+
+    C.emitReport(
+        std::make_unique<PathSensitiveBugReport>(*BT, BT->getDescription(), N));
   }
 }
 
 static bool isBooleanType(QualType Ty) {
   if (Ty->isBooleanType()) // C++ or C99
     return true;
 
   if (const TypedefType *TT = Ty->getAs<TypedefType>())

clang/lib/StaticAnalyzer/Checkers/CStringChecker.cpp

void CStringChecker::emitOverlapBug(CheckerContext &C, ProgramStateRef state,
   if (!N)
     return;
 
   if (!BT_Overlap)
     BT_Overlap.reset(new BugType(Filter.CheckNameCStringBufferOverlap,
                                  categories::UnixAPI, "Improper arguments"));
 
   // Generate a report for this bug.
-  auto report = std::make_unique<BugReport>(
+  auto report = std::make_unique<PathSensitiveBugReport>(
       *BT_Overlap, "Arguments must not be overlapping buffers", N);
   report->addRange(First->getSourceRange());
   report->addRange(Second->getSourceRange());
 
   C.emitReport(std::move(report));
 }
 
 void CStringChecker::emitNullArgBug(CheckerContext &C, ProgramStateRef State,
                                     const Stmt *S, StringRef WarningMsg) const {
   if (ExplodedNode *N = C.generateErrorNode(State)) {
     if (!BT_Null)
       BT_Null.reset(new BuiltinBug(
           Filter.CheckNameCStringNullArg, categories::UnixAPI,
           "Null pointer argument in call to byte string function"));
 
     BuiltinBug *BT = static_cast<BuiltinBug *>(BT_Null.get());
-    auto Report = std::make_unique<BugReport>(*BT, WarningMsg, N);
+    auto Report = std::make_unique<PathSensitiveBugReport>(*BT, WarningMsg, N);
     Report->addRange(S->getSourceRange());
     if (const auto *Ex = dyn_cast<Expr>(S))
       bugreporter::trackExpressionValue(N, Ex, *Report);
     C.emitReport(std::move(Report));
   }
 }
 
 void CStringChecker::emitOutOfBoundsBug(CheckerContext &C,
                                         ProgramStateRef State, const Stmt *S,
                                         StringRef WarningMsg) const {
   if (ExplodedNode *N = C.generateErrorNode(State)) {
     if (!BT_Bounds)
       BT_Bounds.reset(new BuiltinBug(
           Filter.CheckCStringOutOfBounds ? Filter.CheckNameCStringOutOfBounds
                                          : Filter.CheckNameCStringNullArg,
           "Out-of-bound array access",
           "Byte string function accesses out-of-bound array element"));
 
     BuiltinBug *BT = static_cast<BuiltinBug *>(BT_Bounds.get());
 
     // FIXME: It would be nice to eventually make this diagnostic more clear,
     // e.g., by referencing the original declaration or by saying *why* this
     // reference is outside the range.
-    auto Report = std::make_unique<BugReport>(*BT, WarningMsg, N);
+    auto Report = std::make_unique<PathSensitiveBugReport>(*BT, WarningMsg, N);
     Report->addRange(S->getSourceRange());
     C.emitReport(std::move(Report));
   }
 }
 
 void CStringChecker::emitNotCStringBug(CheckerContext &C, ProgramStateRef State,
                                        const Stmt *S,
                                        StringRef WarningMsg) const {
   if (ExplodedNode *N = C.generateNonFatalErrorNode(State)) {
     if (!BT_NotCString)
       BT_NotCString.reset(new BuiltinBug(
           Filter.CheckNameCStringNotNullTerm, categories::UnixAPI,
           "Argument is not a null-terminated string."));
 
-    auto Report = std::make_unique<BugReport>(*BT_NotCString, WarningMsg, N);
+    auto Report =
+        std::make_unique<PathSensitiveBugReport>(*BT_NotCString, WarningMsg, N);
 
     Report->addRange(S->getSourceRange());
     C.emitReport(std::move(Report));
   }
 }
 
 void CStringChecker::emitAdditionOverflowBug(CheckerContext &C,
                                              ProgramStateRef State) const {
   if (ExplodedNode *N = C.generateErrorNode(State)) {
     if (!BT_NotCString)
       BT_NotCString.reset(
           new BuiltinBug(Filter.CheckNameCStringOutOfBounds, "API",
                          "Sum of expressions causes overflow."));
 
     // This isn't a great error message, but this should never occur in real
     // code anyway -- you'd have to create a buffer longer than a size_t can
     // represent, which is sort of a contradiction.
     const char *WarningMsg =
         "This expression will create a string whose length is too big to "
         "be represented as a size_t";
 
-    auto Report = std::make_unique<BugReport>(*BT_NotCString, WarningMsg, N);
+    auto Report =
+        std::make_unique<PathSensitiveBugReport>(*BT_NotCString, WarningMsg, N);
     C.emitReport(std::move(Report));
   }
 }
 
 ProgramStateRef CStringChecker::checkAdditionOverflow(CheckerContext &C,
                                                      ProgramStateRef state,
                                                      NonLoc left,
                                                      NonLoc right) const {

clang/lib/StaticAnalyzer/Checkers/CallAndMessageChecker.cpp

 } // end anonymous namespace
 
 void CallAndMessageChecker::emitBadCall(BugType *BT, CheckerContext &C,
                                         const Expr *BadE) {
   ExplodedNode *N = C.generateErrorNode();
   if (!N)
     return;
 
-  auto R = std::make_unique<BugReport>(*BT, BT->getName(), N);
+  auto R = std::make_unique<PathSensitiveBugReport>(*BT, BT->getName(), N);
   if (BadE) {
     R->addRange(BadE->getSourceRange());
     if (BadE->isGLValue())
       BadE = bugreporter::getDerefExpr(BadE);
     bugreporter::trackExpressionValue(N, BadE, *R);
   }
   C.emitReport(std::move(R));
 }
if(!ParamDecl->getType()->getPointeeType().isConstQualified())
     return false;
 
   if (const MemRegion *SValMemRegion = V.getAsRegion()) {
     const ProgramStateRef State = C.getState();
     const SVal PSV = State->getSVal(SValMemRegion, C.getASTContext().CharTy);
     if (PSV.isUndef()) {
       if (ExplodedNode *N = C.generateErrorNode()) {
         LazyInit_BT(BD, BT);
-        auto R = std::make_unique<BugReport>(*BT, Os.str(), N);
+        auto R = std::make_unique<PathSensitiveBugReport>(*BT, Os.str(), N);
         R->addRange(ArgRange);
         if (ArgEx)
           bugreporter::trackExpressionValue(N, ArgEx, *R);
 
         C.emitReport(std::move(R));
       }
       return true;
     }
bool CallAndMessageChecker::PreVisitProcessArg(CheckerContext &C,
 
   if (V.isUndef()) {
     if (ExplodedNode *N = C.generateErrorNode()) {
       LazyInit_BT(BD, BT);
       // Generate a report for this bug.
       SmallString<200> Buf;
       llvm::raw_svector_ostream Os(Buf);
       describeUninitializedArgumentInCall(Call, ArgumentNumber, Os);
-      auto R = std::make_unique<BugReport>(*BT, Os.str(), N);
+      auto R = std::make_unique<PathSensitiveBugReport>(*BT, Os.str(), N);
 
       R->addRange(ArgRange);
       if (ArgEx)
         bugreporter::trackExpressionValue(N, ArgEx, *R);
       C.emitReport(std::move(R));
     }
     return true;
   }
if (F.Find(D->getRegion())) {
             else
               os << '.';
             os << **DI;
           }
           os << "')";
         }
 
         // Generate a report for this bug.
-        auto R = std::make_unique<BugReport>(*BT, os.str(), N);
+        auto R = std::make_unique<PathSensitiveBugReport>(*BT, os.str(), N);
         R->addRange(ArgRange);
 
         if (ArgEx)
           bugreporter::trackExpressionValue(N, ArgEx, *R);
         // FIXME: enhance track back for uninitialized value for arbitrary
         // memregions
         C.emitReport(std::move(R));
       }
if (Arg.isUndef()) {
     if (!BT_cxx_delete_undef)
       BT_cxx_delete_undef.reset(
           new BuiltinBug(this, "Uninitialized argument value"));
     if (DE->isArrayFormAsWritten())
       Desc = "Argument to 'delete[]' is uninitialized";
     else
       Desc = "Argument to 'delete' is uninitialized";
     BugType *BT = BT_cxx_delete_undef.get();
-    auto R = std::make_unique<BugReport>(*BT, Desc, N);
+    auto R = std::make_unique<PathSensitiveBugReport>(*BT, Desc, N);
     bugreporter::trackExpressionValue(N, DE, *R);
     C.emitReport(std::move(R));
     return;
   }
 }
 
 void CallAndMessageChecker::checkPreCall(const CallEvent &Call,
                                          CheckerContext &C) const {
if (Call.getNumArgs() < Params) {
       } else {
         assert(isa<BlockDecl>(D));
         os << "Block ";
       }
       os << "taking " << Params << " argument"
          << (Params == 1 ? "" : "s") << " is called with fewer ("
          << Call.getNumArgs() << ")";
 
-      C.emitReport(
-          std::make_unique<BugReport>(*BT_call_few_args, os.str(), N));
+      C.emitReport(std::make_unique<PathSensitiveBugReport>(*BT_call_few_args,
+                                                            os.str(), N));
     }
   }
 
   // Don't check for uninitialized field values in arguments if the
   // caller has a body that is available and we have the chance to inline it.
   // This is a hack, but is a reasonable compromise betweens sometimes warning
   // and sometimes not depending on if we decide to inline a function.
   const bool checkUninitFields =
if (ExplodedNode *N = C.generateErrorNode()) {
         if (!BT_objc_subscript_undef)
           BT_objc_subscript_undef.reset(new BuiltinBug(
               this, "Subscript access on an uninitialized object pointer"));
         BT = BT_objc_subscript_undef.get();
         break;
       }
       assert(BT && "Unknown message kind.");
 
-      auto R = std::make_unique<BugReport>(*BT, BT->getName(), N);
+      auto R = std::make_unique<PathSensitiveBugReport>(*BT, BT->getName(), N);
       const ObjCMessageExpr *ME = msg.getOriginExpr();
       R->addRange(ME->getReceiverRange());
 
       // FIXME: getTrackNullOrUndefValueVisitor can't handle "super" yet.
       if (const Expr *ReceiverE = ME->getInstanceReceiver())
         bugreporter::trackExpressionValue(N, ReceiverE, *R);
       C.emitReport(std::move(R));
     }
void CallAndMessageChecker::emitNilReceiverBug(CheckerContext &C,
   if (ResTy->isReferenceType()) {
     os << ", which results in forming a null reference";
   } else {
     os << " and returns a value of type '";
     msg.getResultType().print(os, C.getLangOpts());
     os << "' that will be garbage";
   }
 
-  auto report = std::make_unique<BugReport>(*BT_msg_ret, os.str(), N);
+  auto report =
+      std::make_unique<PathSensitiveBugReport>(*BT_msg_ret, os.str(), N);
   report->addRange(ME->getReceiverRange());
   // FIXME: This won't track "self" in messages to super.
   if (const Expr *receiver = ME->getInstanceReceiver()) {
     bugreporter::trackExpressionValue(N, receiver, *report);
   }
   C.emitReport(std::move(report));
 }
 

clang/lib/StaticAnalyzer/Checkers/CastSizeChecker.cpp

void CastSizeChecker::checkPreStmt(const CastExpr *CE,CheckerContext &C) const {
   if (evenFlexibleArraySize(Ctx, regionSize, typeSize, ToPointeeTy))
     return;
 
   if (ExplodedNode *errorNode = C.generateErrorNode()) {
     if (!BT)
       BT.reset(new BuiltinBug(this, "Cast region with wrong size.",
                                     "Cast a region whose size is not a multiple"
                                     " of the destination type size."));
-    auto R = std::make_unique<BugReport>(*BT, BT->getDescription(), errorNode);
+    auto R = std::make_unique<PathSensitiveBugReport>(*BT, BT->getDescription(),
+                                                      errorNode);
     R->addRange(CE->getSourceRange());
     C.emitReport(std::move(R));
   }
 }
 
 void ento::registerCastSizeChecker(CheckerManager &mgr) {
   mgr.registerChecker<CastSizeChecker>();
 }
 
 bool ento::shouldRegisterCastSizeChecker(const LangOptions &LO) {
   // PR31226: C++ is more complicated than what this checker currently supports.
   // There are derived-to-base casts, there are different rules for 0-size
   // structures, no flexible arrays, etc.
   // FIXME: Disabled on C++ for now.
   return !LO.CPlusPlus;
 }

clang/lib/StaticAnalyzer/Checkers/CheckObjCDealloc.cpp

for (auto *IvarSymbol : *OldUnreleased) {
     if (PropDecl->getSetterKind() == ObjCPropertyDecl::Retain)
       OS << "retained";
     else
       OS << "copied";
 
     OS << " by a synthesized property but not released"
           " before '[super dealloc]'";
 
-    std::unique_ptr<BugReport> BR(
-        new BugReport(*MissingReleaseBugType, OS.str(), ErrNode));
-
+    auto BR = std::make_unique<PathSensitiveBugReport>(*MissingReleaseBugType,
+                                                       OS.str(), ErrNode);
     C.emitReport(std::move(BR));
   }
 
   if (NewUnreleased.isEmpty()) {
     State = State->remove<UnreleasedIvarMap>(SelfSym);
   } else {
     State = State->set<UnreleasedIvarMap>(SelfSym, NewUnreleased);
   }
if (isReleasedByCIFilterDealloc(PropImpl)) {
     if (PropDecl->getSetterKind() == ObjCPropertyDecl::Weak)
       OS << "a weak";
     else
       OS << "an assign, readwrite";
 
     OS <<  " property but was released in 'dealloc'";
   }
 
-  std::unique_ptr<BugReport> BR(
-      new BugReport(*ExtraReleaseBugType, OS.str(), ErrNode));
+  auto BR = std::make_unique<PathSensitiveBugReport>(*ExtraReleaseBugType,
+                                                     OS.str(), ErrNode);
   BR->addRange(M.getOriginExpr()->getSourceRange());
 
   C.emitReport(std::move(BR));
 
   return true;
 }
 
 /// Emits a warning if the current context is -dealloc and DeallocedValue
if (!ErrNode)
     return false;
 
   std::string Buf;
   llvm::raw_string_ostream OS(Buf);
 
   OS << "'" << *PropImpl->getPropertyIvarDecl()
      << "' should be released rather than deallocated";
 
-  std::unique_ptr<BugReport> BR(
-      new BugReport(*MistakenDeallocBugType, OS.str(), ErrNode));
+  auto BR = std::make_unique<PathSensitiveBugReport>(*MistakenDeallocBugType,
+                                                     OS.str(), ErrNode);
   BR->addRange(M.getOriginExpr()->getSourceRange());
 
   C.emitReport(std::move(BR));
 
   return true;
 }
 
 ObjCDeallocChecker::ObjCDeallocChecker()

clang/lib/StaticAnalyzer/Checkers/ChrootChecker.cpp

void ChrootChecker::checkPreCall(const CallEvent &Call,
   void *const* k = C.getState()->FindGDM(ChrootChecker::getTag());
   if (k)
     if (isRootChanged((intptr_t) *k))
       if (ExplodedNode *N = C.generateNonFatalErrorNode()) {
         if (!BT_BreakJail)
           BT_BreakJail.reset(new BuiltinBug(
               this, "Break out of jail", "No call of chdir(\"/\") immediately "
                                          "after chroot"));
-        C.emitReport(std::make_unique<BugReport>(
+        C.emitReport(std::make_unique<PathSensitiveBugReport>(
             *BT_BreakJail, BT_BreakJail->getDescription(), N));
       }
 }
 
 void ento::registerChrootChecker(CheckerManager &mgr) {
   mgr.registerChecker<ChrootChecker>();
 }
 
 bool ento::shouldRegisterChrootChecker(const LangOptions &LO) {
   return true;
 }

clang/lib/StaticAnalyzer/Checkers/CloneChecker.cpp

void CloneChecker::reportClones(
     std::vector<CloneDetector::CloneGroup> &CloneGroups) const {
 
   if (!BT_Exact)
     BT_Exact.reset(new BugType(this, "Exact code clone", "Code clone"));
 
   for (const CloneDetector::CloneGroup &Group : CloneGroups) {
     // We group the clones by printing the first as a warning and all others
     // as a note.
-    auto R = std::make_unique<BugReport>(*BT_Exact, "Duplicate code detected",
-                                          makeLocation(Group.front(), Mgr));
+    auto R = std::make_unique<BasicBugReport>(
+        *BT_Exact, "Duplicate code detected", makeLocation(Group.front(), Mgr));
     R->addRange(Group.front().getSourceRange());
 
     for (unsigned i = 1; i < Group.size(); ++i)
       R->addNote("Similar code here", makeLocation(Group[i], Mgr),
                  Group[i].getSourceRange());
     BR.emitReport(std::move(R));
   }
 }
AnalysisDeclContext *ADC =
       Mgr.getAnalysisDeclContext(ACtx.getTranslationUnitDecl());
 
   for (VariablePattern::SuspiciousClonePair &Pair : Pairs) {
     // FIXME: We are ignoring the suggestions currently, because they are
     // only 50% accurate (even if the second suggestion is unavailable),
     // which may confuse the user.
     // Think how to perform more accurate suggestions?
 
-    auto R = std::make_unique<BugReport>(
+    auto R = std::make_unique<BasicBugReport>(
         *BT_Suspicious,
         "Potential copy-paste error; did you really mean to use '" +
             Pair.FirstCloneInfo.Variable->getNameAsString() + "' here?",
         PathDiagnosticLocation::createBegin(Pair.FirstCloneInfo.Mention, SM,
                                             ADC));
     R->addRange(Pair.FirstCloneInfo.Mention->getSourceRange());
 
     R->addNote("Similar code using '" +

clang/lib/StaticAnalyzer/Checkers/ConversionChecker.cpp

 
 void ConversionChecker::reportBug(ExplodedNode *N, CheckerContext &C,
                                   const char Msg[]) const {
   if (!BT)
     BT.reset(
         new BuiltinBug(this, "Conversion", "Possible loss of sign/precision."));
 
   // Generate a report for this bug.
-  auto R = std::make_unique<BugReport>(*BT, Msg, N);
+  auto R = std::make_unique<PathSensitiveBugReport>(*BT, Msg, N);
   C.emitReport(std::move(R));
 }
 
 bool ConversionChecker::isLossOfPrecision(const ImplicitCastExpr *Cast,
                                           QualType DestType,
                                           CheckerContext &C) const {
   // Don't warn about explicit loss of precision.
   if (Cast->isEvaluatable(C.getASTContext()))

clang/lib/StaticAnalyzer/Checkers/DebugCheckers.cpp

class ReportStmts : public Checker<check::PreStmt<Stmt>> {
   BuiltinBug BT_stmtLoc{this, "Statement"};
 
 public:
   void checkPreStmt(const Stmt *S, CheckerContext &C) const {
     ExplodedNode *Node = C.generateNonFatalErrorNode();
     if (!Node)
       return;
 
-    auto Report = std::make_unique<BugReport>(BT_stmtLoc, "Statement", Node);
+    auto Report =
+        std::make_unique<PathSensitiveBugReport>(BT_stmtLoc, "Statement", Node);
 
     C.emitReport(std::move(Report));
   }
 };
 
 } // end of anonymous namespace
 
 void ento::registerReportStmts(CheckerManager &mgr) {
   mgr.registerChecker<ReportStmts>();
 }
 
 bool ento::shouldRegisterReportStmts(const LangOptions &LO) {
   return true;
 }

clang/lib/StaticAnalyzer/Checkers/DeleteWithNonVirtualDtorChecker.cpp

class DeleteWithNonVirtualDtorChecker
   public:
     DeleteBugVisitor() : Satisfied(false) {}
     void Profile(llvm::FoldingSetNodeID &ID) const override {
       static int X = 0;
       ID.AddPointer(&X);
     }
     PathDiagnosticPieceRef VisitNode(const ExplodedNode *N,
                                      BugReporterContext &BRC,
-                                     BugReport &BR) override;
+                                     PathSensitiveBugReport &BR) override;
 
   private:
     bool Satisfied;
   };
 
 public:
   void checkPreStmt(const CXXDeleteExpr *DE, CheckerContext &C) const;
 };
void DeleteWithNonVirtualDtorChecker::checkPreStmt(const CXXDeleteExpr *DE,
 
   if (!BT)
     BT.reset(new BugType(this,
                          "Destruction of a polymorphic object with no "
                          "virtual destructor",
                          "Logic error"));
 
   ExplodedNode *N = C.generateNonFatalErrorNode();
-  auto R = std::make_unique<BugReport>(*BT, BT->getName(), N);
+  auto R = std::make_unique<PathSensitiveBugReport>(*BT, BT->getName(), N);
 
   // Mark region of problematic base class for later use in the BugVisitor.
   R->markInteresting(BaseClassRegion);
   R->addVisitor(std::make_unique<DeleteBugVisitor>());
   C.emitReport(std::move(R));
 }
 
 PathDiagnosticPieceRef
 DeleteWithNonVirtualDtorChecker::DeleteBugVisitor::VisitNode(
-    const ExplodedNode *N, BugReporterContext &BRC, BugReport &BR) {
+    const ExplodedNode *N, BugReporterContext &BRC,
+    PathSensitiveBugReport &BR) {
   // Stop traversal after the first conversion was found on a path.
   if (Satisfied)
     return nullptr;
 
   const Stmt *S = PathDiagnosticLocation::getStmt(N);
   if (!S)
     return nullptr;
 

clang/lib/StaticAnalyzer/Checkers/DereferenceChecker.cpp

case Stmt::ObjCIvarRefExprClass: {
     AddDerefSource(os, Ranges, IV->getBase()->IgnoreParenCasts(),
                    State.get(), N->getLocationContext(), true);
     break;
   }
   default:
     break;
   }
 
-  auto report = std::make_unique<BugReport>(
+  auto report = std::make_unique<PathSensitiveBugReport>(
       *BT_null, buf.empty() ? BT_null->getDescription() : StringRef(buf), N);
 
   bugreporter::trackExpressionValue(N, bugreporter::getDerefExpr(S), *report);
 
   for (SmallVectorImpl<SourceRange>::iterator
        I = Ranges.begin(), E = Ranges.end(); I!=E; ++I)
     report->addRange(*I);
 
   C.emitReport(std::move(report));
 }
 
 void DereferenceChecker::checkLocation(SVal l, bool isLoad, const Stmt* S,
                                        CheckerContext &C) const {
   // Check for dereference of an undefined value.
   if (l.isUndef()) {
     if (ExplodedNode *N = C.generateErrorNode()) {
       if (!BT_undef)
         BT_undef.reset(
             new BuiltinBug(this, "Dereference of undefined pointer value"));
 
-      auto report =
-          std::make_unique<BugReport>(*BT_undef, BT_undef->getDescription(), N);
+      auto report = std::make_unique<PathSensitiveBugReport>(
+          *BT_undef, BT_undef->getDescription(), N);
       bugreporter::trackExpressionValue(N, bugreporter::getDerefExpr(S), *report);
       C.emitReport(std::move(report));
     }
     return;
   }
 
   DefinedOrUnknownSVal location = l.castAs<DefinedOrUnknownSVal>();
 

clang/lib/StaticAnalyzer/Checkers/DivZeroChecker.cpp

 
 void DivZeroChecker::reportBug(
     const char *Msg, ProgramStateRef StateZero, CheckerContext &C,
     std::unique_ptr<BugReporterVisitor> Visitor) const {
   if (ExplodedNode *N = C.generateErrorNode(StateZero)) {
     if (!BT)
       BT.reset(new BuiltinBug(this, "Division by zero"));
 
-    auto R = std::make_unique<BugReport>(*BT, Msg, N);
+    auto R = std::make_unique<PathSensitiveBugReport>(*BT, Msg, N);
     R->addVisitor(std::move(Visitor));
     bugreporter::trackExpressionValue(N, getDenomExpr(N), *R);
     C.emitReport(std::move(R));
   }
 }
 
 void DivZeroChecker::checkPreStmt(const BinaryOperator *B,
                                   CheckerContext &C) const {

clang/lib/StaticAnalyzer/Checkers/DynamicTypeChecker.cpp

public:
     void Profile(llvm::FoldingSetNodeID &ID) const override {
       static int X = 0;
       ID.AddPointer(&X);
       ID.AddPointer(Reg);
     }
 
     PathDiagnosticPieceRef VisitNode(const ExplodedNode *N,
                                      BugReporterContext &BRC,
-                                     BugReport &BR) override;
+                                     PathSensitiveBugReport &BR) override;
 
   private:
     // The tracked region.
     const MemRegion *Reg;
   };
 
   void reportTypeError(QualType DynamicType, QualType StaticType,
                        const MemRegion *Reg, const Stmt *ReportedNode,
void DynamicTypeChecker::reportTypeError(QualType DynamicType,
   llvm::raw_svector_ostream OS(Buf);
   OS << "Object has a dynamic type '";
   QualType::print(DynamicType.getTypePtr(), Qualifiers(), OS, C.getLangOpts(),
                   llvm::Twine());
   OS << "' which is incompatible with static type '";
   QualType::print(StaticType.getTypePtr(), Qualifiers(), OS, C.getLangOpts(),
                   llvm::Twine());
   OS << "'";
-  std::unique_ptr<BugReport> R(
-      new BugReport(*BT, OS.str(), C.generateNonFatalErrorNode()));
+  auto R = std::make_unique<PathSensitiveBugReport>(
+      *BT, OS.str(), C.generateNonFatalErrorNode());
   R->markInteresting(Reg);
   R->addVisitor(std::make_unique<DynamicTypeBugVisitor>(Reg));
   R->addRange(ReportedNode->getSourceRange());
   C.emitReport(std::move(R));
 }
 
 PathDiagnosticPieceRef DynamicTypeChecker::DynamicTypeBugVisitor::VisitNode(
-    const ExplodedNode *N, BugReporterContext &BRC, BugReport &) {
+    const ExplodedNode *N, BugReporterContext &BRC, PathSensitiveBugReport &) {
   ProgramStateRef State = N->getState();
   ProgramStateRef StatePrev = N->getFirstPred()->getState();
 
   DynamicTypeInfo TrackedType = getDynamicTypeInfo(State, Reg);
   DynamicTypeInfo TrackedTypePrev = getDynamicTypeInfo(StatePrev, Reg);
   if (!TrackedType.isValid())
     return nullptr;
 

clang/lib/StaticAnalyzer/Checkers/DynamicTypePropagation.cpp

public:
     void Profile(llvm::FoldingSetNodeID &ID) const override {
       static int X = 0;
       ID.AddPointer(&X);
       ID.AddPointer(Sym);
     }
 
     PathDiagnosticPieceRef VisitNode(const ExplodedNode *N,
                                      BugReporterContext &BRC,
-                                     BugReport &BR) override;
+                                     PathSensitiveBugReport &BR) override;
 
   private:
     // The tracked symbol.
     SymbolRef Sym;
   };
 
   void reportGenericsBug(const ObjCObjectPointerType *From,
                          const ObjCObjectPointerType *To, ExplodedNode *N,
void DynamicTypePropagation::reportGenericsBug(
   initBugType();
   SmallString<192> Buf;
   llvm::raw_svector_ostream OS(Buf);
   OS << "Conversion from value of type '";
   QualType::print(From, Qualifiers(), OS, C.getLangOpts(), llvm::Twine());
   OS << "' to incompatible type '";
   QualType::print(To, Qualifiers(), OS, C.getLangOpts(), llvm::Twine());
   OS << "'";
-  std::unique_ptr<BugReport> R(
-      new BugReport(*ObjCGenericsBugType, OS.str(), N));
+  auto R = std::make_unique<PathSensitiveBugReport>(*ObjCGenericsBugType,
+                                                    OS.str(), N);
   R->markInteresting(Sym);
   R->addVisitor(std::make_unique<GenericsBugVisitor>(Sym));
   if (ReportedNode)
     R->addRange(ReportedNode->getSourceRange());
   C.emitReport(std::move(R));
 }
 
 PathDiagnosticPieceRef DynamicTypePropagation::GenericsBugVisitor::VisitNode(
-    const ExplodedNode *N, BugReporterContext &BRC, BugReport &BR) {
+    const ExplodedNode *N, BugReporterContext &BRC,
+    PathSensitiveBugReport &BR) {
   ProgramStateRef state = N->getState();
   ProgramStateRef statePrev = N->getFirstPred()->getState();
 
   const ObjCObjectPointerType *const *TrackedType =
       state->get<MostSpecializedTypeArgsMap>(Sym);
   const ObjCObjectPointerType *const *TrackedTypePrev =
       statePrev->get<MostSpecializedTypeArgsMap>(Sym);
   if (!TrackedType)

clang/lib/StaticAnalyzer/Checkers/EnumCastOutOfRangeChecker.cpp

 
 void EnumCastOutOfRangeChecker::reportWarning(CheckerContext &C) const {
   if (const ExplodedNode *N = C.generateNonFatalErrorNode()) {
     if (!EnumValueCastOutOfRange)
       EnumValueCastOutOfRange.reset(
           new BuiltinBug(this, "Enum cast out of range",
                          "The value provided to the cast expression is not in "
                          "the valid range of values for the enum"));
-    C.emitReport(std::make_unique<BugReport>(
+    C.emitReport(std::make_unique<PathSensitiveBugReport>(
         *EnumValueCastOutOfRange, EnumValueCastOutOfRange->getDescription(),
         N));
   }
 }
 
 void EnumCastOutOfRangeChecker::checkPreStmt(const CastExpr *CE,
                                              CheckerContext &C) const {
 

clang/lib/StaticAnalyzer/Checkers/ExprInspectionChecker.cpp

ExplodedNode *ExprInspectionChecker::reportBug(llvm::StringRef Msg,
                                                BugReporter &BR,
                                                ExplodedNode *N) const {
   if (!N)
     return nullptr;
 
   if (!BT)
     BT.reset(new BugType(this, "Checking analyzer assumptions", "debug"));
 
-  BR.emitReport(std::make_unique<BugReport>(*BT, Msg, N));
+  BR.emitReport(std::make_unique<PathSensitiveBugReport>(*BT, Msg, N));
   return N;
 }
 
 void ExprInspectionChecker::analyzerEval(const CallExpr *CE,
                                          CheckerContext &C) const {
   const LocationContext *LC = C.getPredecessor()->getLocationContext();
 
   // A specific instantiation of an inlined function may have more constrained

clang/lib/StaticAnalyzer/Checkers/FixedAddressChecker.cpp

void FixedAddressChecker::checkPreStmt(const BinaryOperator *B,
 
   if (ExplodedNode *N = C.generateNonFatalErrorNode()) {
     if (!BT)
       BT.reset(
           new BuiltinBug(this, "Use fixed address",
                          "Using a fixed address is not portable because that "
                          "address will probably not be valid in all "
                          "environments or platforms."));
-    auto R = std::make_unique<BugReport>(*BT, BT->getDescription(), N);
+    auto R =
+        std::make_unique<PathSensitiveBugReport>(*BT, BT->getDescription(), N);
     R->addRange(B->getRHS()->getSourceRange());
     C.emitReport(std::move(R));
   }
 }
 
 void ento::registerFixedAddressChecker(CheckerManager &mgr) {
   mgr.registerChecker<FixedAddressChecker>();
 }
 
 bool ento::shouldRegisterFixedAddressChecker(const LangOptions &LO) {
   return true;
 }

clang/lib/StaticAnalyzer/Checkers/GenericTaintChecker.cpp

bool GenericTaintChecker::generateReportIfTainted(const Expr *E,
   else if (isTainted(State, E, C.getLocationContext()))
     TaintedSVal = C.getSVal(E);
   else
     return false;
 
   // Generate diagnostic.
   if (ExplodedNode *N = C.generateNonFatalErrorNode()) {
     initBugType();
-    auto report = std::make_unique<BugReport>(*BT, Msg, N);
+    auto report = std::make_unique<PathSensitiveBugReport>(*BT, Msg, N);
     report->addRange(E->getSourceRange());
     report->addVisitor(std::make_unique<TaintBugVisitor>(TaintedSVal));
     C.emitReport(std::move(report));
     return true;
   }
   return false;
 }
 

clang/lib/StaticAnalyzer/Checkers/InnerPointerChecker.cpp

static void *getTag() {
       static int Tag = 0;
       return &Tag;
     }
 
     void Profile(llvm::FoldingSetNodeID &ID) const override {
       ID.AddPointer(getTag());
     }
 
-    virtual PathDiagnosticPieceRef VisitNode(const ExplodedNode *N,
-                                             BugReporterContext &BRC,
-                                             BugReport &BR) override;
+    virtual PathDiagnosticPieceRef
+    VisitNode(const ExplodedNode *N, BugReporterContext &BRC,
+              PathSensitiveBugReport &BR) override;
 
     // FIXME: Scan the map once in the visitor's constructor and do a direct
     // lookup by region.
     bool isSymbolTracked(ProgramStateRef State, SymbolRef Sym) {
       RawPtrMapTy Map = State->get<RawPtrMap>();
       for (const auto Entry : Map) {
         if (Entry.second.contains(Sym))
           return true;
const MemRegion *getContainerObjRegion(ProgramStateRef State, SymbolRef Sym) {
   return nullptr;
 }
 
 } // end namespace allocation_state
 } // end namespace ento
 } // end namespace clang
 
 PathDiagnosticPieceRef InnerPointerChecker::InnerPointerBRVisitor::VisitNode(
-    const ExplodedNode *N, BugReporterContext &BRC, BugReport &) {
+    const ExplodedNode *N, BugReporterContext &BRC, PathSensitiveBugReport &) {
   if (!isSymbolTracked(N->getState(), PtrToBuf) ||
       isSymbolTracked(N->getFirstPred()->getState(), PtrToBuf))
     return nullptr;
 
   const Stmt *S = PathDiagnosticLocation::getStmt(N);
   if (!S)
     return nullptr;
 

clang/lib/StaticAnalyzer/Checkers/IteratorChecker.cpp

if (const auto IntDist = Distance.getAs<nonloc::ConcreteInt>()) {
     State = assumeNoOverflow(State, NewPosSym, 4);
     return Pos.setTo(NewPosSym);
   }
 }
 
 void IteratorChecker::reportOutOfRangeBug(const StringRef &Message,
                                           const SVal &Val, CheckerContext &C,
                                           ExplodedNode *ErrNode) const {
-  auto R = std::make_unique<BugReport>(*OutOfRangeBugType, Message, ErrNode);
+  auto R = std::make_unique<PathSensitiveBugReport>(*OutOfRangeBugType, Message,
+                                                    ErrNode);
   R->markInteresting(Val);
   C.emitReport(std::move(R));
 }
 
 void IteratorChecker::reportMismatchedBug(const StringRef &Message,
                                           const SVal &Val1, const SVal &Val2,
                                           CheckerContext &C,
                                           ExplodedNode *ErrNode) const {
-  auto R = std::make_unique<BugReport>(*MismatchedBugType, Message, ErrNode);
+  auto R = std::make_unique<PathSensitiveBugReport>(*MismatchedBugType, Message,
+                                                    ErrNode);
   R->markInteresting(Val1);
   R->markInteresting(Val2);
   C.emitReport(std::move(R));
 }
 
 void IteratorChecker::reportMismatchedBug(const StringRef &Message,
                                           const SVal &Val, const MemRegion *Reg,
                                           CheckerContext &C,
                                           ExplodedNode *ErrNode) const {
-  auto R = std::make_unique<BugReport>(*MismatchedBugType, Message, ErrNode);
+  auto R = std::make_unique<PathSensitiveBugReport>(*MismatchedBugType, Message,
+                                                    ErrNode);
   R->markInteresting(Val);
   R->markInteresting(Reg);
   C.emitReport(std::move(R));
 }
 
 void IteratorChecker::reportInvalidatedBug(const StringRef &Message,
                                            const SVal &Val, CheckerContext &C,
                                            ExplodedNode *ErrNode) const {
-  auto R = std::make_unique<BugReport>(*InvalidatedBugType, Message, ErrNode);
+  auto R = std::make_unique<PathSensitiveBugReport>(*InvalidatedBugType,
+                                                    Message, ErrNode);
   R->markInteresting(Val);
   C.emitReport(std::move(R));
 }
 
 namespace {
 
 bool isLess(ProgramStateRef State, SymbolRef Sym1, SymbolRef Sym2);
 bool isGreater(ProgramStateRef State, SymbolRef Sym1, SymbolRef Sym2);

clang/lib/StaticAnalyzer/Checkers/LocalizationChecker.cpp

 public:
   NonLocalizedStringBRVisitor(const MemRegion *NonLocalizedString)
       : NonLocalizedString(NonLocalizedString), Satisfied(false) {
     assert(NonLocalizedString);
   }
 
   PathDiagnosticPieceRef VisitNode(const ExplodedNode *Succ,
                                    BugReporterContext &BRC,
-                                   BugReport &BR) override;
+                                   PathSensitiveBugReport &BR) override;
 
   void Profile(llvm::FoldingSetNodeID &ID) const override {
     ID.Add(NonLocalizedString);
   }
 };
 } // End anonymous namespace.
 
 #define NEW_RECEIVER(receiver)                                                 \
void NonLocalizedStringChecker::reportLocalizationError(
   static CheckerProgramPointTag Tag("NonLocalizedStringChecker",
                                     "UnlocalizedString");
   ExplodedNode *ErrNode = C.addTransition(C.getState(), C.getPredecessor(), &Tag);
 
   if (!ErrNode)
     return;
 
   // Generate the bug report.
-  std::unique_ptr<BugReport> R(new BugReport(
-      *BT, "User-facing text should use localized string macro", ErrNode));
+  auto R = std::make_unique<PathSensitiveBugReport>(
+      *BT, "User-facing text should use localized string macro", ErrNode);
   if (argumentNumber) {
     R->addRange(M.getArgExpr(argumentNumber - 1)->getSourceRange());
   } else {
     R->addRange(M.getSourceRange());
   }
   R->markInteresting(S);
 
   const MemRegion *StringRegion = S.getAsRegion();

 void NonLocalizedStringChecker::checkPostStmt(const ObjCStringLiteral *SL,
                                               CheckerContext &C) const {
   SVal sv = C.getSVal(SL);
   setNonLocalizedState(sv, C);
 }
 
 PathDiagnosticPieceRef
 NonLocalizedStringBRVisitor::VisitNode(const ExplodedNode *Succ,
-                                       BugReporterContext &BRC, BugReport &BR) {
+                                       BugReporterContext &BRC,
+                                       PathSensitiveBugReport &BR) {
   if (Satisfied)
     return nullptr;
 
   Optional<StmtPoint> Point = Succ->getLocation().getAs<StmtPoint>();
   if (!Point.hasValue())
     return nullptr;
 
   auto *LiteralExpr = dyn_cast<ObjCStringLiteral>(Point->getStmt());

clang/lib/StaticAnalyzer/Checkers/MIGChecker.cpp

void MIGChecker::checkReturnAux(const ReturnStmt *RS, CheckerContext &C) const {
   SVal V = C.getSVal(RS);
   if (mayBeSuccess(V, C))
     return;
 
   ExplodedNode *N = C.generateErrorNode();
   if (!N)
     return;
 
-  auto R = std::make_unique<BugReport>(
+  auto R = std::make_unique<PathSensitiveBugReport>(
       BT,
       "MIG callback fails with error after deallocating argument value. "
       "This is a use-after-free vulnerability because the caller will try to "
       "deallocate it again",
       N);
 
   R->addRange(RS->getSourceRange());
   bugreporter::trackExpressionValue(N, RS->getRetValue(), *R,

clang/lib/StaticAnalyzer/Checkers/MPI-Checker/MPIBugReporter.h

public:
     void Profile(llvm::FoldingSetNodeID &ID) const override {
       static int X = 0;
       ID.AddPointer(&X);
       ID.AddPointer(RequestRegion);
     }
 
     PathDiagnosticPieceRef VisitNode(const ExplodedNode *N,
                                      BugReporterContext &BRC,
-                                     BugReport &BR) override;
+                                     PathSensitiveBugReport &BR) override;
 
   private:
     const MemRegion *const RequestRegion;
     bool IsNodeFound = false;
     std::string ErrorText;
   };
 };
 
 } // end of namespace: mpi
 } // end of namespace: ento
 } // end of namespace: clang
 
 #endif

clang/lib/StaticAnalyzer/Checkers/MPI-Checker/MPIBugReporter.cpp

void MPIBugReporter::reportDoubleNonblocking(
     const MemRegion *const RequestRegion,
     const ExplodedNode *const ExplNode,
     BugReporter &BReporter) const {
 
   std::string ErrorText;
   ErrorText = "Double nonblocking on request " +
               RequestRegion->getDescriptiveName() + ". ";
 
-  auto Report = std::make_unique<BugReport>(*DoubleNonblockingBugType,
-                                             ErrorText, ExplNode);
+  auto Report = std::make_unique<PathSensitiveBugReport>(
+      *DoubleNonblockingBugType, ErrorText, ExplNode);
 
   Report->addRange(MPICallEvent.getSourceRange());
   SourceRange Range = RequestRegion->sourceRange();
 
   if (Range.isValid())
     Report->addRange(Range);
 
   Report->addVisitor(std::make_unique<RequestNodeVisitor>(
       RequestRegion, "Request is previously used by nonblocking call here. "));
   Report->markInteresting(RequestRegion);
 
   BReporter.emitReport(std::move(Report));
 }
 
 void MPIBugReporter::reportMissingWait(
     const ento::mpi::Request &Req, const MemRegion *const RequestRegion,
     const ExplodedNode *const ExplNode,
     BugReporter &BReporter) const {
   std::string ErrorText{"Request " + RequestRegion->getDescriptiveName() +
                         " has no matching wait. "};
 
-  auto Report =
-      std::make_unique<BugReport>(*MissingWaitBugType, ErrorText, ExplNode);
+  auto Report = std::make_unique<PathSensitiveBugReport>(*MissingWaitBugType,
+                                                         ErrorText, ExplNode);
 
   SourceRange Range = RequestRegion->sourceRange();
   if (Range.isValid())
     Report->addRange(Range);
   Report->addVisitor(std::make_unique<RequestNodeVisitor>(
       RequestRegion, "Request is previously used by nonblocking call here. "));
   Report->markInteresting(RequestRegion);
 
   BReporter.emitReport(std::move(Report));
 }
 
 void MPIBugReporter::reportUnmatchedWait(
     const CallEvent &CE, const clang::ento::MemRegion *const RequestRegion,
     const ExplodedNode *const ExplNode,
     BugReporter &BReporter) const {
   std::string ErrorText{"Request " + RequestRegion->getDescriptiveName() +
                         " has no matching nonblocking call. "};
 
-  auto Report =
-      std::make_unique<BugReport>(*UnmatchedWaitBugType, ErrorText, ExplNode);
+  auto Report = std::make_unique<PathSensitiveBugReport>(*UnmatchedWaitBugType,
+                                                         ErrorText, ExplNode);
 
   Report->addRange(CE.getSourceRange());
   SourceRange Range = RequestRegion->sourceRange();
   if (Range.isValid())
     Report->addRange(Range);
 
   BReporter.emitReport(std::move(Report));
 }
 
-PathDiagnosticPieceRef MPIBugReporter::RequestNodeVisitor::VisitNode(
-    const ExplodedNode *N, BugReporterContext &BRC, BugReport &BR) {
+PathDiagnosticPieceRef
+MPIBugReporter::RequestNodeVisitor::VisitNode(const ExplodedNode *N,
+                                              BugReporterContext &BRC,
+                                              PathSensitiveBugReport &BR) {
 
   if (IsNodeFound)
     return nullptr;
 
   const Request *const Req = N->getState()->get<RequestMap>(RequestRegion);
   assert(Req && "The region must be tracked and alive, given that we've "
                 "just emitted a report against it");
   const Request *const PrevReq =

clang/lib/StaticAnalyzer/Checkers/MacOSKeychainAPIChecker.cpp

private:
   /// Find the allocation site for Sym on the path leading to the node N.
   const ExplodedNode *getAllocationNode(const ExplodedNode *N, SymbolRef Sym,
                                         CheckerContext &C) const;
 
   std::unique_ptr<BugReport> generateAllocatedDataNotReleasedReport(
       const AllocationPair &AP, ExplodedNode *N, CheckerContext &C) const;
 
   /// Mark an AllocationPair interesting for diagnostic reporting.
-  void markInteresting(BugReport *R, const AllocationPair &AP) const {
+  void markInteresting(PathSensitiveBugReport *R,
+                       const AllocationPair &AP) const {
     R->markInteresting(AP.first);
     R->markInteresting(AP.second->Region);
   }
 
   /// The bug visitor which allows us to print extra diagnostics along the
   /// BugReport path. For example, showing the allocation site of the leaked
   /// region.
   class SecKeychainBugVisitor : public BugReporterVisitor {
   protected:
     // The allocated region symbol tracked by the main analysis.
     SymbolRef Sym;
 
   public:
     SecKeychainBugVisitor(SymbolRef S) : Sym(S) {}
 
     void Profile(llvm::FoldingSetNodeID &ID) const override {
       static int X = 0;
       ID.AddPointer(&X);
       ID.AddPointer(Sym);
     }
 
     PathDiagnosticPieceRef VisitNode(const ExplodedNode *N,
                                      BugReporterContext &BRC,
-                                     BugReport &BR) override;
+                                     PathSensitiveBugReport &BR) override;
   };
 };
 }
 
 /// ProgramState traits to store the currently allocated (and not yet freed)
 /// symbols. This is a map from the allocated content symbol to the
 /// corresponding AllocationState.
 REGISTER_MAP_WITH_PROGRAMSTATE(AllocatedData,
void MacOSKeychainAPIChecker::
   initBugType();
   SmallString<80> sbuf;
   llvm::raw_svector_ostream os(sbuf);
   unsigned int PDeallocIdx =
                FunctionsToTrack[AP.second->AllocatorIdx].DeallocatorIdx;
 
   os << "Deallocator doesn't match the allocator: '"
      << FunctionsToTrack[PDeallocIdx].Name << "' should be used.";
-  auto Report = std::make_unique<BugReport>(*BT, os.str(), N);
+  auto Report = std::make_unique<PathSensitiveBugReport>(*BT, os.str(), N);
   Report->addVisitor(std::make_unique<SecKeychainBugVisitor>(AP.first));
   Report->addRange(ArgExpr->getSourceRange());
   markInteresting(Report.get(), AP);
   C.emitReport(std::move(Report));
 }
 
 void MacOSKeychainAPIChecker::checkPreStmt(const CallExpr *CE,
                                            CheckerContext &C) const {
if (SymbolRef V = getAsPointeeSymbol(ArgExpr, C))
         initBugType();
         SmallString<128> sbuf;
         llvm::raw_svector_ostream os(sbuf);
         unsigned int DIdx = FunctionsToTrack[AS->AllocatorIdx].DeallocatorIdx;
         os << "Allocated data should be released before another call to "
             << "the allocator: missing a call to '"
             << FunctionsToTrack[DIdx].Name
             << "'.";
-        auto Report = std::make_unique<BugReport>(*BT, os.str(), N);
+        auto Report =
+            std::make_unique<PathSensitiveBugReport>(*BT, os.str(), N);
         Report->addVisitor(std::make_unique<SecKeychainBugVisitor>(V));
         Report->addRange(ArgExpr->getSourceRange());
         Report->markInteresting(AS->Region);
         C.emitReport(std::move(Report));
       }
     return;
   }
 
if (RegionArgIsBad) {
     // have entered as an enclosing function parameter.
     if (isEnclosingFunctionParam(ArgExpr))
       return;
 
     ExplodedNode *N = C.generateNonFatalErrorNode(State);
     if (!N)
       return;
     initBugType();
-    auto Report = std::make_unique<BugReport>(
+    auto Report = std::make_unique<PathSensitiveBugReport>(
         *BT, "Trying to free data which has not been allocated.", N);
     Report->addRange(ArgExpr->getSourceRange());
     if (AS)
       Report->markInteresting(AS->Region);
     C.emitReport(std::move(Report));
     return;
   }
 
MacOSKeychainAPIChecker::generateAllocatedDataNotReleasedReport(
   const ExplodedNode *AllocNode = getAllocationNode(N, AP.first, C);
   const Stmt *AllocStmt = PathDiagnosticLocation::getStmt(AllocNode);
 
   if (AllocStmt)
     LocUsedForUniqueing = PathDiagnosticLocation::createBegin(AllocStmt,
                                               C.getSourceManager(),
                                               AllocNode->getLocationContext());
 
-  auto Report =
-      std::make_unique<BugReport>(*BT, os.str(), N, LocUsedForUniqueing,
-                                  AllocNode->getLocationContext()->getDecl());
+  auto Report = std::make_unique<PathSensitiveBugReport>(
+      *BT, os.str(), N, LocUsedForUniqueing,
 
   Report->addVisitor(std::make_unique<SecKeychainBugVisitor>(AP.first));
   markInteresting(Report.get(), AP);
   return Report;
 }
 
 /// If the return symbol is assumed to be error, remove the allocated info
 /// from consideration.
if (const auto *SD = dyn_cast<SymbolDerived>(Sym)) {
         State = State->remove<AllocatedData>(Sym);
     }
   }
   return State;
 }
 
 PathDiagnosticPieceRef
 MacOSKeychainAPIChecker::SecKeychainBugVisitor::VisitNode(
-    const ExplodedNode *N, BugReporterContext &BRC, BugReport &BR) {
+    const ExplodedNode *N, BugReporterContext &BRC,
+    PathSensitiveBugReport &BR) {
   const AllocationState *AS = N->getState()->get<AllocatedData>(Sym);
   if (!AS)
     return nullptr;
   const AllocationState *ASPrev =
       N->getFirstPred()->getState()->get<AllocatedData>(Sym);
   if (ASPrev)
     return nullptr;
 

clang/lib/StaticAnalyzer/Checkers/MacOSXAPIChecker.cpp

void MacOSXAPIChecker::CheckDispatchOnce(CheckerContext &C, const CallExpr *CE,
   ExplodedNode *N = C.generateErrorNode();
   if (!N)
     return;
 
   if (!BT_dispatchOnce)
     BT_dispatchOnce.reset(new BugType(this, "Improper use of 'dispatch_once'",
                                       "API Misuse (Apple)"));
 
-  auto report = std::make_unique<BugReport>(*BT_dispatchOnce, os.str(), N);
+  auto report =
+      std::make_unique<PathSensitiveBugReport>(*BT_dispatchOnce, os.str(), N);
   report->addRange(CE->getArg(0)->getSourceRange());
   C.emitReport(std::move(report));
 }
 
 //===----------------------------------------------------------------------===//
 // Central dispatch function.
 //===----------------------------------------------------------------------===//
 

clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp

inline bool isReallocFailedCheck(const RefState *S, const RefState *SPrev,
       return (
           (!Stmt || !isa<CallExpr>(Stmt)) &&
           (S && (S->isAllocated() || S->isAllocatedOfSizeZero())) &&
           (SPrev && !(SPrev->isAllocated() || SPrev->isAllocatedOfSizeZero())));
     }
 
     PathDiagnosticPieceRef VisitNode(const ExplodedNode *N,
                                      BugReporterContext &BRC,
-                                     BugReport &BR) override;
+                                     PathSensitiveBugReport &BR) override;
 
     PathDiagnosticPieceRef getEndPath(BugReporterContext &BRC,
                                       const ExplodedNode *EndPathNode,
-                                      BugReport &BR) override {
+                                      PathSensitiveBugReport &BR) override {
       if (!IsLeak)
         return nullptr;
 
       PathDiagnosticLocation L =
-        PathDiagnosticLocation::createEndOfPath(EndPathNode,
-                                                BRC.getSourceManager());
+          PathDiagnosticLocation::createEndOfPath(EndPathNode);
       // Do not add the statement itself as a range in case of leak.
       return std::make_shared<PathDiagnosticEventPiece>(L, BR.getDescription(),
                                                          false);
     }
 
   private:
     class StackHintGeneratorForReallocationFailed
         : public StackHintGeneratorForSymbol {
bool Summarized = MR ? SummarizeRegion(os, MR)
                          : SummarizeValue(os, ArgVal);
     if (Summarized)
       os << ", which is not memory allocated by ";
     else
       os << "not memory allocated by ";
 
     printExpectedAllocName(os, C, DeallocExpr);
 
-    auto R = std::make_unique<BugReport>(*BT_BadFree[*CheckKind], os.str(), N);
+    auto R = std::make_unique<PathSensitiveBugReport>(*BT_BadFree[*CheckKind],
+                                                      os.str(), N);
     R->markInteresting(MR);
     R->addRange(Range);
     C.emitReport(std::move(R));
   }
 }
 
 void MallocChecker::ReportFreeAlloca(CheckerContext &C, SVal ArgVal,
                                      SourceRange Range) const {
 
   Optional<MallocChecker::CheckKind> CheckKind;
 
   if (ChecksEnabled[CK_MallocChecker])
     CheckKind = CK_MallocChecker;
   else if (ChecksEnabled[CK_MismatchedDeallocatorChecker])
     CheckKind = CK_MismatchedDeallocatorChecker;
   else
     return;
 
   if (ExplodedNode *N = C.generateErrorNode()) {
     if (!BT_FreeAlloca[*CheckKind])
       BT_FreeAlloca[*CheckKind].reset(new BugType(
           CheckNames[*CheckKind], "Free alloca()", categories::MemoryError));
 
-    auto R = std::make_unique<BugReport>(
+    auto R = std::make_unique<PathSensitiveBugReport>(
         *BT_FreeAlloca[*CheckKind],
         "Memory allocated by alloca() should not be deallocated", N);
     R->markInteresting(ArgVal.getAsRegion());
     R->addRange(Range);
     C.emitReport(std::move(R));
   }
 }
 
if (OwnershipTransferred) {
 
       os << " should be deallocated by ";
         printExpectedDeallocName(os, RS->getAllocationFamily());
 
       if (printAllocDeallocName(DeallocOs, C, DeallocExpr))
         os << ", not " << DeallocOs.str();
     }
 
-    auto R = std::make_unique<BugReport>(*BT_MismatchedDealloc, os.str(), N);
+    auto R = std::make_unique<PathSensitiveBugReport>(*BT_MismatchedDealloc,
+                                                      os.str(), N);
     R->markInteresting(Sym);
     R->addRange(Range);
     R->addVisitor(std::make_unique<MallocBugVisitor>(Sym));
     C.emitReport(std::move(R));
   }
 }
 
 void MallocChecker::ReportOffsetFree(CheckerContext &C, SVal ArgVal,
os << " is offset by "
      << " "
      << ((abs(offsetBytes) > 1) ? "bytes" : "byte")
      << " from the start of ";
   if (AllocExpr && printAllocDeallocName(AllocNameOs, C, AllocExpr))
     os << "memory allocated by " << AllocNameOs.str();
   else
     os << "allocated memory";
 
-  auto R = std::make_unique<BugReport>(*BT_OffsetFree[*CheckKind], os.str(), N);
+  auto R = std::make_unique<PathSensitiveBugReport>(*BT_OffsetFree[*CheckKind],
+                                                    os.str(), N);
   R->markInteresting(MR->getBaseRegion());
   R->addRange(Range);
   C.emitReport(std::move(R));
 }
 
 void MallocChecker::ReportUseAfterFree(CheckerContext &C, SourceRange Range,
                                        SymbolRef Sym) const {
 
void MallocChecker::ReportUseAfterFree(CheckerContext &C, SourceRange Range,
   if (ExplodedNode *N = C.generateErrorNode()) {
     if (!BT_UseFree[*CheckKind])
       BT_UseFree[*CheckKind].reset(new BugType(
           CheckNames[*CheckKind], "Use-after-free", categories::MemoryError));
 
     AllocationFamily AF =
         C.getState()->get<RegionState>(Sym)->getAllocationFamily();
 
-    auto R = std::make_unique<BugReport>(*BT_UseFree[*CheckKind],
+    auto R = std::make_unique<PathSensitiveBugReport>(
+        *BT_UseFree[*CheckKind],
         AF == AF_InnerBuffer
-              ? "Inner pointer of container used after re/deallocation"
-              : "Use of memory after it is freed",
         N);
 
     R->markInteresting(Sym);
     R->addRange(Range);
     R->addVisitor(std::make_unique<MallocBugVisitor>(Sym));
 
     if (AF == AF_InnerBuffer)
       R->addVisitor(allocation_state::getInnerPointerBRVisitor(Sym));
void MallocChecker::ReportDoubleFree(CheckerContext &C, SourceRange Range,
   if (!CheckKind.hasValue())
     return;
 
   if (ExplodedNode *N = C.generateErrorNode()) {
     if (!BT_DoubleFree[*CheckKind])
       BT_DoubleFree[*CheckKind].reset(new BugType(
           CheckNames[*CheckKind], "Double free", categories::MemoryError));
 
-    auto R = std::make_unique<BugReport>(
+    auto R = std::make_unique<PathSensitiveBugReport>(
         *BT_DoubleFree[*CheckKind],
         (Released ? "Attempt to free released memory"
                   : "Attempt to free non-owned memory"),
         N);
     R->addRange(Range);
     R->markInteresting(Sym);
     if (PrevSym)
       R->markInteresting(PrevSym);
if (!CheckKind.hasValue())
     return;
 
   if (ExplodedNode *N = C.generateErrorNode()) {
     if (!BT_DoubleDelete)
       BT_DoubleDelete.reset(new BugType(CheckNames[CK_NewDeleteChecker],
                                         "Double delete",
                                         categories::MemoryError));
 
-    auto R = std::make_unique<BugReport>(
+    auto R = std::make_unique<PathSensitiveBugReport>(
         *BT_DoubleDelete, "Attempt to delete released memory", N);
 
     R->markInteresting(Sym);
     R->addVisitor(std::make_unique<MallocBugVisitor>(Sym));
     C.emitReport(std::move(R));
   }
 }
 
if (!CheckKind.hasValue())
     return;
 
   if (ExplodedNode *N = C.generateErrorNode()) {
     if (!BT_UseZerroAllocated[*CheckKind])
       BT_UseZerroAllocated[*CheckKind].reset(
           new BugType(CheckNames[*CheckKind], "Use of zero allocated",
                       categories::MemoryError));
 
-    auto R = std::make_unique<BugReport>(*BT_UseZerroAllocated[*CheckKind],
-                                         "Use of zero-allocated memory", N);
+    auto R = std::make_unique<PathSensitiveBugReport>(
+        *BT_UseZerroAllocated[*CheckKind], "Use of zero-allocated memory", N);
 
     R->addRange(Range);
     if (Sym) {
       R->markInteresting(Sym);
       R->addVisitor(std::make_unique<MallocBugVisitor>(Sym));
     }
     C.emitReport(std::move(R));
   }
while (const ElementRegion *ER = dyn_cast_or_null<ElementRegion>(MR))
       MR = ER->getSuperRegion();
 
     Os << "Argument to ";
     if (!printAllocDeallocName(Os, C, FreeExpr))
       Os << "deallocator";
 
     Os << " is a function pointer";
 
-    auto R = std::make_unique<BugReport>(*BT_BadFree[*CheckKind], Os.str(), N);
+    auto R = std::make_unique<PathSensitiveBugReport>(*BT_BadFree[*CheckKind],
+                                                      Os.str(), N);
     R->markInteresting(MR);
     R->addRange(Range);
     C.emitReport(std::move(R));
   }
 }
 
 ProgramStateRef MallocChecker::ReallocMemAux(CheckerContext &C,
                                              const CallExpr *CE,
void MallocChecker::reportLeak(SymbolRef Sym, ExplodedNode *N,
   llvm::raw_svector_ostream os(buf);
   if (Region && Region->canPrintPretty()) {
     os << "Potential leak of memory pointed to by ";
     Region->printPretty(os);
   } else {
     os << "Potential memory leak";
   }
 
-  auto R = std::make_unique<BugReport>(
+  auto R = std::make_unique<PathSensitiveBugReport>(
       *BT_Leak[*CheckKind], os.str(), N, LocUsedForUniqueing,
       AllocNode->getLocationContext()->getDecl());
   R->markInteresting(Sym);
   R->addVisitor(std::make_unique<MallocBugVisitor>(Sym, true));
   C.emitReport(std::move(R));
 }
 
 void MallocChecker::checkDeadSymbols(SymbolReaper &SymReaper,
if (N.contains_lower("ptr") || N.contains_lower("pointer")) {
           N.contains_lower("intrusive") || N.contains_lower("shared")) {
         return true;
       }
     }
   }
   return false;
 }
 
-PathDiagnosticPieceRef MallocChecker::MallocBugVisitor::VisitNode(
-    const ExplodedNode *N, BugReporterContext &BRC, BugReport &BR) {
+PathDiagnosticPieceRef
+MallocChecker::MallocBugVisitor::VisitNode(const ExplodedNode *N,
+                                           BugReporterContext &BRC,
+                                           PathSensitiveBugReport &BR) {
 
   ProgramStateRef state = N->getState();
   ProgramStateRef statePrev = N->getFirstPred()->getState();
 
   const RefState *RS = state->get<RegionState>(Sym);
   const RefState *RSPrev = statePrev->get<RegionState>(Sym);
 
   const Stmt *S = PathDiagnosticLocation::getStmt(N);

clang/lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp

if (Call.isCalled(MmapFn) || Call.isCalled(MprotectFn)) {
     if ((Prot & (ProtWrite | ProtExec)) == (ProtWrite | ProtExec)) {
       if (!BT)
         BT.reset(new BugType(this, "W^X check fails, Write Exec prot flags set", "Security"));
 
       ExplodedNode *N = C.generateNonFatalErrorNode();
       if (!N)
         return;
 
-      auto Report = std::make_unique<BugReport>(
+      auto Report = std::make_unique<PathSensitiveBugReport>(
           *BT, "Both PROT_WRITE and PROT_EXEC flags are set. This can "
                "lead to exploitable memory regions, which could be overwritten "
                "with malicious code", N);
       Report->addRange(Call.getArgSourceRange(2));
       C.emitReport(std::move(Report));
     }
   }
 }

clang/lib/StaticAnalyzer/Checkers/MoveChecker.cpp

void Profile(llvm::FoldingSetNodeID &ID) const override {
       // Don't add RD because it's, in theory, uniquely determined by
       // the region. In practice though, it's not always possible to obtain
       // the declaration directly from the region, that's why we store it
       // in the first place.
     }
 
     PathDiagnosticPieceRef VisitNode(const ExplodedNode *N,
                                      BugReporterContext &BRC,
-                                     BugReport &BR) override;
+                                     PathSensitiveBugReport &BR) override;
 
   private:
     const MoveChecker &Chk;
     // The tracked region.
     const MemRegion *Region;
     // The class of the tracked object.
     const CXXRecordDecl *RD;
     // How exactly the object was misused.
if (const auto *SR = dyn_cast_or_null<SymbolicRegion>(MR)) {
     SymbolRef Sym = SR->getSymbol();
     if (Sym->getType()->isRValueReferenceType())
       if (const MemRegion *OriginMR = Sym->getOriginRegion())
         return OriginMR;
   }
   return MR;
 }
 
-PathDiagnosticPieceRef MoveChecker::MovedBugVisitor::VisitNode(
-    const ExplodedNode *N, BugReporterContext &BRC, BugReport &BR) {
+PathDiagnosticPieceRef
+MoveChecker::MovedBugVisitor::VisitNode(const ExplodedNode *N,
+                                        BugReporterContext &BRC,
+                                        PathSensitiveBugReport &BR) {
   // We need only the last move of the reported object's region.
   // The visitor walks the ExplodedGraph backwards.
   if (Found)
     return nullptr;
   ProgramStateRef State = N->getState();
   ProgramStateRef StatePrev = N->getFirstPred()->getState();
   const RegionState *TrackedObject = State->get<TrackedRegionMap>(Region);
   const RegionState *TrackedObjectPrev =
switch(MK) {
         OS << " is moved";
         break;
       case MK_Dereference:
         OS << "Dereference of null smart pointer";
         explainObject(OS, Region, RD, MK);
         break;
     }
 
-    auto R =
-        std::make_unique<BugReport>(*BT, OS.str(), N, LocUsedForUniqueing,
-                                     MoveNode->getLocationContext()->getDecl());
+    auto R = std::make_unique<PathSensitiveBugReport>(
+        *BT, OS.str(), N, LocUsedForUniqueing,
     R->addVisitor(std::make_unique<MovedBugVisitor>(*this, Region, RD, MK));
     C.emitReport(std::move(R));
     return N;
   }
   return nullptr;
 }
 
 void MoveChecker::checkPostCall(const CallEvent &Call,

clang/lib/StaticAnalyzer/Checkers/NSAutoreleasePoolChecker.cpp

BT.reset(new BugType(this, "Use -drain instead of -release",
                          "API Upgrade (Apple)"));
 
   ExplodedNode *N = C.generateNonFatalErrorNode();
   if (!N) {
     assert(0);
     return;
   }
 
-  auto Report = std::make_unique<BugReport>(
-      *BT, "Use -drain instead of -release when using NSAutoreleasePool and "
-           "garbage collection", N);
+  auto Report = std::make_unique<PathSensitiveBugReport>(
+      *BT,
+      "Use -drain instead of -release when using NSAutoreleasePool and "
+      "garbage collection",
+      N);
   Report->addRange(msg.getSourceRange());
   C.emitReport(std::move(Report));
 }
 
 void ento::registerNSAutoreleasePoolChecker(CheckerManager &mgr) {
   mgr.registerChecker<NSAutoreleasePoolChecker>();
 }
 
 bool ento::shouldRegisterNSAutoreleasePoolChecker(const LangOptions &LO) {
   return LO.getGC() != LangOptions::NonGC;
 }

clang/lib/StaticAnalyzer/Checkers/NSErrorChecker.cpp

if (!NSBT)
       NSBT.reset(new NSErrorDerefBug(this));
     bug = NSBT.get();
   }
   else {
     if (!CFBT)
       CFBT.reset(new CFErrorDerefBug(this));
     bug = CFBT.get();
   }
-  BR.emitReport(std::make_unique<BugReport>(*bug, os.str(), event.SinkNode));
+  BR.emitReport(
+      std::make_unique<PathSensitiveBugReport>(*bug, os.str(), event.SinkNode));
 }
 
 static bool IsNSError(QualType T, IdentifierInfo *II) {
 
   const PointerType* PPT = T->getAs<PointerType>();
   if (!PPT)
     return false;
 

clang/lib/StaticAnalyzer/Checkers/NonNullParamChecker.cpp

BTAttrNonNull.reset(new BugType(
         this, "Argument with 'nonnull' attribute passed null", "API"));
 
   llvm::SmallString<256> SBuf;
   llvm::raw_svector_ostream OS(SBuf);
   OS << "Null pointer passed to "
      << IdxOfArg << llvm::getOrdinalSuffix(IdxOfArg)
      << " parameter expecting 'nonnull'";
 
-  auto R = std::make_unique<BugReport>(*BTAttrNonNull, SBuf, ErrorNode);
+  auto R =
+      std::make_unique<PathSensitiveBugReport>(*BTAttrNonNull, SBuf, ErrorNode);
   if (ArgE)
     bugreporter::trackExpressionValue(ErrorNode, ArgE, *R);
 
   return R;
 }
 
 std::unique_ptr<BugReport> NonNullParamChecker::genReportReferenceToNullPointer(
     const ExplodedNode *ErrorNode, const Expr *ArgE) const {
   if (!BTNullRefArg)
     BTNullRefArg.reset(new BuiltinBug(this, "Dereference of null pointer"));
 
-  auto R = std::make_unique<BugReport>(
+  auto R = std::make_unique<PathSensitiveBugReport>(
       *BTNullRefArg, "Forming reference to null pointer", ErrorNode);
   if (ArgE) {
     const Expr *ArgEDeref = bugreporter::getDerefExpr(ArgE);
     if (!ArgEDeref)
       ArgEDeref = ArgE;
     bugreporter::trackExpressionValue(ErrorNode, ArgEDeref, *R);
   }
   return R;

clang/lib/StaticAnalyzer/Checkers/NullabilityChecker.cpp

public:
     void Profile(llvm::FoldingSetNodeID &ID) const override {
       static int X = 0;
       ID.AddPointer(&X);
       ID.AddPointer(Region);
     }
 
     PathDiagnosticPieceRef VisitNode(const ExplodedNode *N,
                                      BugReporterContext &BRC,
-                                     BugReport &BR) override;
+                                     PathSensitiveBugReport &BR) override;
 
   private:
     // The tracked region.
     const MemRegion *Region;
   };
 
   /// When any of the nonnull arguments of the analyzed function is null, do not
   /// report anything and turn off the check.
   ///
   /// When \p SuppressPath is set to true, no more bugs will be reported on this
   /// path by this checker.
   void reportBugIfInvariantHolds(StringRef Msg, ErrorKind Error,
                                  ExplodedNode *N, const MemRegion *Region,
                                  CheckerContext &C,
                                  const Stmt *ValueExpr = nullptr,
                                   bool SuppressPath = false) const;
 
   void reportBug(StringRef Msg, ErrorKind Error, ExplodedNode *N,
                  const MemRegion *Region, BugReporter &BR,
                  const Stmt *ValueExpr = nullptr) const {
     if (!BT)
       BT.reset(new BugType(this, "Nullability", categories::MemoryError));
 
-    auto R = std::make_unique<BugReport>(*BT, Msg, N);
+    auto R = std::make_unique<PathSensitiveBugReport>(*BT, Msg, N);
     if (Region) {
       R->markInteresting(Region);
       R->addVisitor(std::make_unique<NullabilityBugVisitor>(Region));
     }
     if (ValueExpr) {
       R->addRange(ValueExpr->getSourceRange());
       if (Error == ErrorKind::NilAssignedToNonnull ||
           Error == ErrorKind::NilPassedToNonnull ||
if (CheckSuperRegion) {
     if (auto ElementReg = Region->getAs<ElementRegion>())
       return dyn_cast<SymbolicRegion>(ElementReg->getSuperRegion());
   }
 
   return dyn_cast<SymbolicRegion>(Region);
 }
 
 PathDiagnosticPieceRef NullabilityChecker::NullabilityBugVisitor::VisitNode(
-    const ExplodedNode *N, BugReporterContext &BRC, BugReport &BR) {
+    const ExplodedNode *N, BugReporterContext &BRC,
+    PathSensitiveBugReport &BR) {
   ProgramStateRef State = N->getState();
   ProgramStateRef StatePrev = N->getFirstPred()->getState();
 
   const NullabilityState *TrackedNullab = State->get<NullabilityMap>(Region);
   const NullabilityState *TrackedNullabPrev =
       StatePrev->get<NullabilityMap>(Region);
   if (!TrackedNullab)
     return nullptr;

clang/lib/StaticAnalyzer/Checkers/ObjCAtSyncChecker.cpp

void ObjCAtSyncChecker::checkPreStmt(const ObjCAtSynchronizedStmt *S,
   SVal V = C.getSVal(Ex);
 
   // Uninitialized value used for the mutex?
   if (V.getAs<UndefinedVal>()) {
     if (ExplodedNode *N = C.generateErrorNode()) {
       if (!BT_undef)
         BT_undef.reset(new BuiltinBug(this, "Uninitialized value used as mutex "
                                             "for @synchronized"));
-      auto report =
-          std::make_unique<BugReport>(*BT_undef, BT_undef->getDescription(), N);
+      auto report = std::make_unique<PathSensitiveBugReport>(
+          *BT_undef, BT_undef->getDescription(), N);
       bugreporter::trackExpressionValue(N, Ex, *report);
       C.emitReport(std::move(report));
     }
     return;
   }
 
   if (V.isUnknown())
     return;
 
   // Check for null mutexes.
   ProgramStateRef notNullState, nullState;
   std::tie(notNullState, nullState) = state->assume(V.castAs<DefinedSVal>());
 
   if (nullState) {
     if (!notNullState) {
       // Generate an error node.  This isn't a sink since
       // a null mutex just means no synchronization occurs.
       if (ExplodedNode *N = C.generateNonFatalErrorNode(nullState)) {
         if (!BT_null)
           BT_null.reset(new BuiltinBug(
               this, "Nil value used as mutex for @synchronized() "
                     "(no synchronization will occur)"));
-        auto report =
-            std::make_unique<BugReport>(*BT_null, BT_null->getDescription(), N);
+        auto report = std::make_unique<PathSensitiveBugReport>(
+            *BT_null, BT_null->getDescription(), N);
         bugreporter::trackExpressionValue(N, Ex, *report);
 
         C.emitReport(std::move(report));
         return;
       }
     }
     // Don't add a transition for 'nullState'.  If the value is
     // under-constrained to be null or non-null, assume it is non-null

clang/lib/StaticAnalyzer/Checkers/ObjCContainersChecker.cpp

if (Name.equals("CFArrayGetValueAtIndex")) {
     const QualType T = IdxExpr->getType();
     ProgramStateRef StInBound = State->assumeInBound(Idx, *Size, true, T);
     ProgramStateRef StOutBound = State->assumeInBound(Idx, *Size, false, T);
     if (StOutBound && !StInBound) {
       ExplodedNode *N = C.generateErrorNode(StOutBound);
       if (!N)
         return;
       initBugType();
-      auto R = std::make_unique<BugReport>(*BT, "Index is out of bounds", N);
+      auto R = std::make_unique<PathSensitiveBugReport>(
+          *BT, "Index is out of bounds", N);
       R->addRange(IdxExpr->getSourceRange());
       bugreporter::trackExpressionValue(
           N, IdxExpr, *R, bugreporter::TrackingKind::Thorough, false);
       C.emitReport(std::move(R));
       return;
     }
   }
 }

clang/lib/StaticAnalyzer/Checkers/ObjCSelfInitChecker.cpp

void ObjCSelfInitChecker::checkForInvalidSelf(const Expr *E, CheckerContext &C,
   // Generate an error node.
   ExplodedNode *N = C.generateErrorNode();
   if (!N)
     return;
 
   if (!BT)
     BT.reset(new BugType(this, "Missing \"self = [(super or self) init...]\"",
                          categories::CoreFoundationObjectiveC));
-  C.emitReport(std::make_unique<BugReport>(*BT, errorStr, N));
+  C.emitReport(std::make_unique<PathSensitiveBugReport>(*BT, errorStr, N));
 }
 
 void ObjCSelfInitChecker::checkPostObjCMessage(const ObjCMethodCall &Msg,
                                                CheckerContext &C) const {
   // When encountering a message that does initialization (init rule),
   // tag the return value so that we know later on that if self has this value
   // then it is properly initialized.
 

clang/lib/StaticAnalyzer/Checkers/ObjCSuperDeallocChecker.cpp

class SuperDeallocBRVisitor final : public BugReporterVisitor {
   bool Satisfied;
 
 public:
   SuperDeallocBRVisitor(SymbolRef ReceiverSymbol)
       : ReceiverSymbol(ReceiverSymbol), Satisfied(false) {}
 
   PathDiagnosticPieceRef VisitNode(const ExplodedNode *Succ,
                                    BugReporterContext &BRC,
-                                   BugReport &BR) override;
+                                   PathSensitiveBugReport &BR) override;
 
   void Profile(llvm::FoldingSetNodeID &ID) const override {
     ID.Add(ReceiverSymbol);
   }
 };
 } // End anonymous namespace.
 
 void ObjCSuperDeallocChecker::checkPreObjCMessage(const ObjCMethodCall &M,
void ObjCSuperDeallocChecker::reportUseAfterDealloc(SymbolRef Sym,
   // If we've already reached this node on another path, return.
   if (!ErrNode)
     return;
 
   if (Desc.empty())
     Desc = "Use of 'self' after it has been deallocated";
 
   // Generate the report.
-  std::unique_ptr<BugReport> BR(
-      new BugReport(*DoubleSuperDeallocBugType, Desc, ErrNode));
+  auto BR = std::make_unique<PathSensitiveBugReport>(*DoubleSuperDeallocBugType,
+                                                     Desc, ErrNode);
   BR->addRange(S->getSourceRange());
   BR->addVisitor(std::make_unique<SuperDeallocBRVisitor>(Sym));
   C.emitReport(std::move(BR));
 }
 
 /// Diagnose if any of the arguments to CE have already been
 /// dealloc'd.
 void ObjCSuperDeallocChecker::diagnoseCallArguments(const CallEvent &CE,
ObjCSuperDeallocChecker::isSuperDeallocMessage(const ObjCMethodCall &M) const {
   ASTContext &Ctx = M.getState()->getStateManager().getContext();
   initIdentifierInfoAndSelectors(Ctx);
 
   return M.getSelector() == SELdealloc;
 }
 
 PathDiagnosticPieceRef
 SuperDeallocBRVisitor::VisitNode(const ExplodedNode *Succ,
-                                 BugReporterContext &BRC, BugReport &) {
+                                 BugReporterContext &BRC,
+                                 PathSensitiveBugReport &) {
   if (Satisfied)
     return nullptr;
 
   ProgramStateRef State = Succ->getState();
 
   bool CalledNow =
       Succ->getState()->contains<CalledSuperDealloc>(ReceiverSymbol);
   bool CalledBefore =

clang/lib/StaticAnalyzer/Checkers/PaddingChecker.cpp

Os << " (" << BaselinePad.getQuantity() << " padding bytes, where "
        << "Optimal fields order: \n";
     for (const auto *FD : OptimalFieldsOrder)
       Os << FD->getName() << ", \n";
     Os << "consider reordering the fields or adding explicit padding "
           "members.";
 
     PathDiagnosticLocation CELoc =
         PathDiagnosticLocation::create(RD, BR->getSourceManager());
-    auto Report = std::make_unique<BugReport>(*PaddingBug, Os.str(), CELoc);
+    auto Report =
+        std::make_unique<BasicBugReport>(*PaddingBug, Os.str(), CELoc);
     Report->setDeclWithIssue(RD);
     Report->addRange(RD->getSourceRange());
     BR->emitReport(std::move(Report));
   }
 };
 } // namespace
 
 void ento::registerPaddingChecker(CheckerManager &Mgr) {

clang/lib/StaticAnalyzer/Checkers/PointerArithChecker.cpp

if (const MemRegion *ArrayRegion =
     if (!IsPolymorphic)
       return;
     if (ExplodedNode *N = C.generateNonFatalErrorNode()) {
       if (!BT_polyArray)
         BT_polyArray.reset(new BuiltinBug(
             this, "Dangerous pointer arithmetic",
             "Pointer arithmetic on a pointer to base class is dangerous "
             "because derived and base class may have different size."));
-      auto R = std::make_unique<BugReport>(*BT_polyArray,
-                                            BT_polyArray->getDescription(), N);
+      auto R = std::make_unique<PathSensitiveBugReport>(
+          *BT_polyArray, BT_polyArray->getDescription(), N);
       R->addRange(E->getSourceRange());
       R->markInteresting(ArrayRegion);
       C.emitReport(std::move(R));
     }
     return;
   }
 
   if (Kind == AllocKind::Reinterpreted)
     return;
 
   // We might not have enough information about symbolic regions.
   if (Kind != AllocKind::SingleObject &&
       Region->getKind() == MemRegion::Kind::SymbolicRegionKind)
     return;
 
   if (ExplodedNode *N = C.generateNonFatalErrorNode()) {
     if (!BT_pointerArith)
       BT_pointerArith.reset(new BuiltinBug(this, "Dangerous pointer arithmetic",
                                            "Pointer arithmetic on non-array "
                                            "variables relies on memory layout, "
                                            "which is dangerous."));
-    auto R = std::make_unique<BugReport>(*BT_pointerArith,
-                                          BT_pointerArith->getDescription(), N);
+    auto R = std::make_unique<PathSensitiveBugReport>(
+        *BT_pointerArith, BT_pointerArith->getDescription(), N);
     R->addRange(SR);
     R->markInteresting(Region);
     C.emitReport(std::move(R));
   }
 }
 
 void PointerArithChecker::initAllocIdentifiers(ASTContext &C) const {
   if (!AllocFunctions.empty())

clang/lib/StaticAnalyzer/Checkers/PointerSubChecker.cpp

if (isa<SymbolicRegion>(BaseLR) || isa<SymbolicRegion>(BaseRR))
     return;
 
   if (ExplodedNode *N = C.generateNonFatalErrorNode()) {
     if (!BT)
       BT.reset(
           new BuiltinBug(this, "Pointer subtraction",
                          "Subtraction of two pointers that do not point to "
                          "the same memory chunk may cause incorrect result."));
-    auto R = std::make_unique<BugReport>(*BT, BT->getDescription(), N);
+    auto R =
+        std::make_unique<PathSensitiveBugReport>(*BT, BT->getDescription(), N);
     R->addRange(B->getSourceRange());
     C.emitReport(std::move(R));
   }
 }
 
 void ento::registerPointerSubChecker(CheckerManager &mgr) {
   mgr.registerChecker<PointerSubChecker>();
 }
 
 bool ento::shouldRegisterPointerSubChecker(const LangOptions &LO) {
   return true;
 }

clang/lib/StaticAnalyzer/Checkers/PthreadLockChecker.cpp

void PthreadLockChecker::AcquireLock(CheckerContext &C, const CallExpr *CE,
   if (const LockState *LState = state->get<LockMap>(lockR)) {
     if (LState->isLocked()) {
       if (!BT_doublelock)
         BT_doublelock.reset(new BugType(this, "Double locking",
                                         "Lock checker"));
       ExplodedNode *N = C.generateErrorNode();
       if (!N)
         return;
-      auto report = std::make_unique<BugReport>(
+      auto report = std::make_unique<PathSensitiveBugReport>(
           *BT_doublelock, "This lock has already been acquired", N);
       report->addRange(CE->getArg(0)->getSourceRange());
       C.emitReport(std::move(report));
       return;
     } else if (LState->isDestroyed()) {
       reportUseDestroyedBug(C, CE);
       return;
     }
void PthreadLockChecker::ReleaseLock(CheckerContext &C, const CallExpr *CE,
   if (const LockState *LState = state->get<LockMap>(lockR)) {
     if (LState->isUnlocked()) {
       if (!BT_doubleunlock)
         BT_doubleunlock.reset(new BugType(this, "Double unlocking",
                                           "Lock checker"));
       ExplodedNode *N = C.generateErrorNode();
       if (!N)
         return;
-      auto Report = std::make_unique<BugReport>(
+      auto Report = std::make_unique<PathSensitiveBugReport>(
           *BT_doubleunlock, "This lock has already been unlocked", N);
       Report->addRange(CE->getArg(0)->getSourceRange());
       C.emitReport(std::move(Report));
       return;
     } else if (LState->isDestroyed()) {
       reportUseDestroyedBug(C, CE);
       return;
     }
   }
 
   LockSetTy LS = state->get<LockSet>();
 
   // FIXME: Better analysis requires IPA for wrappers.
 
   if (!LS.isEmpty()) {
     const MemRegion *firstLockR = LS.getHead();
     if (firstLockR != lockR) {
       if (!BT_lor)
         BT_lor.reset(new BugType(this, "Lock order reversal", "Lock checker"));
       ExplodedNode *N = C.generateErrorNode();
       if (!N)
         return;
-      auto report = std::make_unique<BugReport>(
+      auto report = std::make_unique<PathSensitiveBugReport>(
           *BT_lor, "This was not the most recently acquired lock. Possible "
                    "lock order reversal", N);
       report->addRange(CE->getArg(0)->getSourceRange());
       C.emitReport(std::move(report));
       return;
     }
     // Record that the lock was released.
     state = state->set<LockSet>(LS.getTail());
void PthreadLockChecker::DestroyLock(CheckerContext &C, const CallExpr *CE,
   }
 
   if (!BT_destroylock)
     BT_destroylock.reset(new BugType(this, "Destroy invalid lock",
                                      "Lock checker"));
   ExplodedNode *N = C.generateErrorNode();
   if (!N)
     return;
-  auto Report = std::make_unique<BugReport>(*BT_destroylock, Message, N);
+  auto Report =
+      std::make_unique<PathSensitiveBugReport>(*BT_destroylock, Message, N);
   Report->addRange(CE->getArg(0)->getSourceRange());
   C.emitReport(std::move(Report));
 }
 
 void PthreadLockChecker::InitLock(CheckerContext &C, const CallExpr *CE,
                                   SVal Lock) const {
 
   const MemRegion *LockR = Lock.getAsRegion();
void PthreadLockChecker::InitLock(CheckerContext &C, const CallExpr *CE,
   }
 
   if (!BT_initlock)
     BT_initlock.reset(new BugType(this, "Init invalid lock",
                                   "Lock checker"));
   ExplodedNode *N = C.generateErrorNode();
   if (!N)
     return;
-  auto Report = std::make_unique<BugReport>(*BT_initlock, Message, N);
+  auto Report =
+      std::make_unique<PathSensitiveBugReport>(*BT_initlock, Message, N);
   Report->addRange(CE->getArg(0)->getSourceRange());
   C.emitReport(std::move(Report));
 }
 
 void PthreadLockChecker::reportUseDestroyedBug(CheckerContext &C,
                                                const CallExpr *CE) const {
   if (!BT_destroylock)
     BT_destroylock.reset(new BugType(this, "Use destroyed lock",
                                      "Lock checker"));
   ExplodedNode *N = C.generateErrorNode();
   if (!N)
     return;
-  auto Report = std::make_unique<BugReport>(
+  auto Report = std::make_unique<PathSensitiveBugReport>(
       *BT_destroylock, "This lock has already been destroyed", N);
   Report->addRange(CE->getArg(0)->getSourceRange());
   C.emitReport(std::move(Report));
 }
 
 void PthreadLockChecker::checkDeadSymbols(SymbolReaper &SymReaper,
                                           CheckerContext &C) const {
   ProgramStateRef State = C.getState();

clang/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountDiagnostics.h

public:
   }
 
 private:
   RefCountBugType BT;
   const CheckerBase *Checker;
   static StringRef bugTypeToName(RefCountBugType BT);
 };
 
-class RefCountReport : public BugReport {
+class RefCountReport : public PathSensitiveBugReport {
 protected:
   SymbolRef Sym;
   bool isLeak = false;
 
 public:
   RefCountReport(const RefCountBug &D, const LangOptions &LOpts,
               ExplodedNode *n, SymbolRef sym,
               bool isLeak=false);
 
   RefCountReport(const RefCountBug &D, const LangOptions &LOpts,
               ExplodedNode *n, SymbolRef sym,
               StringRef endText);
 
-  llvm::iterator_range<ranges_iterator> getRanges() const override {
+  ArrayRef<SourceRange> getRanges() const override {
     if (!isLeak)
-      return BugReport::getRanges();
-    return llvm::make_range(ranges_iterator(), ranges_iterator());
+      return PathSensitiveBugReport::getRanges();
+    return {};
   }
 };
 
 class RefLeakReport : public RefCountReport {
   const MemRegion* AllocBinding;
   const Stmt *AllocStmt;
+  PathDiagnosticLocation Location;
 
   // Finds the function declaration where a leak warning for the parameter
   // 'sym' should be raised.
   void deriveParamLocation(CheckerContext &Ctx, SymbolRef sym);
   // Finds the location where a leak warning for 'sym' should be raised.
   void deriveAllocLocation(CheckerContext &Ctx, SymbolRef sym);
   // Produces description of a leak warning which is printed on the console.
   void createDescription(CheckerContext &Ctx);
 
 public:
   RefLeakReport(const RefCountBug &D, const LangOptions &LOpts, ExplodedNode *n,
                 SymbolRef sym, CheckerContext &Ctx);
 
-  PathDiagnosticLocation getLocation(const SourceManager &SM) const override {
+  PathDiagnosticLocation getLocation() const override {
     assert(Location.isValid());
     return Location;
   }
 };
 
 } // end namespace retaincountchecker
 } // end namespace ento
 } // end namespace clang
 
 #endif

clang/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountDiagnostics.cpp

public:
   void Profile(llvm::FoldingSetNodeID &ID) const override {
     static int x = 0;
     ID.AddPointer(&x);
     ID.AddPointer(Sym);
   }
 
   PathDiagnosticPieceRef VisitNode(const ExplodedNode *N,
                                    BugReporterContext &BRC,
-                                   BugReport &BR) override;
+                                   PathSensitiveBugReport &BR) override;
 
   PathDiagnosticPieceRef getEndPath(BugReporterContext &BRC,
                                     const ExplodedNode *N,
-                                    BugReport &BR) override;
+                                    PathSensitiveBugReport &BR) override;
 };
 
 class RefLeakReportVisitor : public RefCountReportVisitor {
 public:
   RefLeakReportVisitor(SymbolRef sym) : RefCountReportVisitor(sym) {}
 
   PathDiagnosticPieceRef getEndPath(BugReporterContext &BRC,
                                     const ExplodedNode *N,
-                                    BugReport &BR) override;
+                                    PathSensitiveBugReport &BR) override;
 };
 
 } // end namespace retaincountchecker
 } // end namespace ento
 } // end namespace clang
 
 
 /// Find the first node with the parent stack frame.
if (CurrT->getCount() == 1) {
     os << "1, as it is marked as consuming";
   } else {
     assert(CurrT->getCount() == 0);
     os << "0";
   }
   return std::make_shared<PathDiagnosticEventPiece>(L, os.str());
 }
 
-PathDiagnosticPieceRef RefCountReportVisitor::VisitNode(const ExplodedNode *N,
-                                                        BugReporterContext &BRC,
-                                                        BugReport &BR) {
+PathDiagnosticPieceRef
+RefCountReportVisitor::VisitNode(const ExplodedNode *N, BugReporterContext &BRC,
+                                 PathSensitiveBugReport &BR) {
 
   const auto &BT = static_cast<const RefCountBug&>(BR.getBugType());
   const auto *Checker =
       static_cast<const RetainCountChecker *>(BT.getChecker());
 
   bool IsFreeUnowned = BT.getBugType() == RefCountBug::FreeNotOwned ||
                        BT.getBugType() == RefCountBug::DeallocNotOwned;
 
if (AllocationNodeInCurrentOrParentContext &&
     FirstBinding = nullptr;
 
   return AllocationInfo(AllocationNodeInCurrentOrParentContext, FirstBinding,
                         InterestingMethodContext);
 }
 
 PathDiagnosticPieceRef
 RefCountReportVisitor::getEndPath(BugReporterContext &BRC,
-                                  const ExplodedNode *EndN, BugReport &BR) {
+                                  const ExplodedNode *EndN,
+                                  PathSensitiveBugReport &BR) {
   BR.markInteresting(Sym);
   return BugReporterVisitor::getDefaultEndPath(BRC, EndN, BR);
 }
 
 PathDiagnosticPieceRef
 RefLeakReportVisitor::getEndPath(BugReporterContext &BRC,
-                                 const ExplodedNode *EndN, BugReport &BR) {
+                                 const ExplodedNode *EndN,
+                                 PathSensitiveBugReport &BR) {
 
   // Tell the BugReporterContext to report cases when the tracked symbol is
   // assigned to different variables, etc.
   BR.markInteresting(Sym);
 
   // We are reporting a leak.  Walk up the graph to get to the first node where
   // the symbol appeared, and also get the first VarDecl that tracked object
   // is stored to.
   AllocationInfo AllocI = GetAllocationSite(BRC.getStateManager(), EndN, Sym);
 
   const MemRegion* FirstBinding = AllocI.R;
   BR.markInteresting(AllocI.InterestingMethodContext);
 
-  const SourceManager& SM = BRC.getSourceManager();
-
   // Compute an actual location for the leak.  Sometimes a leak doesn't
   // occur at an actual statement (e.g., transition between blocks; end
   // of function) so we need to walk the graph and compute a real location.
   const ExplodedNode *LeakN = EndN;
-  PathDiagnosticLocation L = PathDiagnosticLocation::createEndOfPath(LeakN, SM);
+  PathDiagnosticLocation L = PathDiagnosticLocation::createEndOfPath(LeakN);
 
   std::string sbuf;
   llvm::raw_string_ostream os(sbuf);
 
   os << "Object leaked: ";
 
   Optional<std::string> RegionDescription = describeRegion(FirstBinding);
   if (RegionDescription) {
if (RV->getKind() == RefVal::ErrorLeakReturned) {
     os << " is not referenced later in this execution path and has a retain "
           "count of +" << RV->getCount();
   }
 
   return std::make_shared<PathDiagnosticEventPiece>(L, os.str());
 }
 
 RefCountReport::RefCountReport(const RefCountBug &D, const LangOptions &LOpts,
-                               ExplodedNode *n, SymbolRef sym,
-                               bool isLeak)
-    : BugReport(D, D.getDescription(), n), Sym(sym), isLeak(isLeak) {
+                               ExplodedNode *n, SymbolRef sym, bool isLeak)
+    : PathSensitiveBugReport(D, D.getDescription(), n), Sym(sym),
+      isLeak(isLeak) {
   if (!isLeak)
     addVisitor(std::make_unique<RefCountReportVisitor>(sym));
 }
 
 RefCountReport::RefCountReport(const RefCountBug &D, const LangOptions &LOpts,
                                ExplodedNode *n, SymbolRef sym,
                                StringRef endText)
-    : BugReport(D, D.getDescription(), endText, n) {
+    : PathSensitiveBugReport(D, D.getDescription(), endText, n) {
 
   addVisitor(std::make_unique<RefCountReportVisitor>(sym));
 }
 
 void RefLeakReport::deriveParamLocation(CheckerContext &Ctx, SymbolRef sym) {
   const SourceManager& SMgr = Ctx.getSourceManager();
 
   if (!sym->getOriginRegion())

clang/lib/StaticAnalyzer/Checkers/ReturnPointerRangeChecker.cpp

if (!BT)
           "Returned pointer value points outside the original object "
           "(potential buffer overflow)"));
 
     // FIXME: It would be nice to eventually make this diagnostic more clear,
     // e.g., by referencing the original declaration or by saying *why* this
     // reference is outside the range.
 
     // Generate a report for this bug.
-    auto report = std::make_unique<BugReport>(*BT, BT->getDescription(), N);
+    auto report =
+        std::make_unique<PathSensitiveBugReport>(*BT, BT->getDescription(), N);
 
     report->addRange(RetE->getSourceRange());
     C.emitReport(std::move(report));
   }
 }
 
 void ento::registerReturnPointerRangeChecker(CheckerManager &mgr) {
   mgr.registerChecker<ReturnPointerRangeChecker>();
 }
 
 bool ento::shouldRegisterReturnPointerRangeChecker(const LangOptions &LO) {
   return true;
 }

clang/lib/StaticAnalyzer/Checkers/ReturnUndefChecker.cpp

 }
 
 static void emitBug(CheckerContext &C, BuiltinBug &BT, const Expr *RetE,
                     const Expr *TrackingE = nullptr) {
   ExplodedNode *N = C.generateErrorNode();
   if (!N)
     return;
 
-  auto Report = std::make_unique<BugReport>(BT, BT.getDescription(), N);
+  auto Report =
+      std::make_unique<PathSensitiveBugReport>(BT, BT.getDescription(), N);
 
   Report->addRange(RetE->getSourceRange());
   bugreporter::trackExpressionValue(N, TrackingE ? TrackingE : RetE, *Report);
 
   C.emitReport(std::move(Report));
 }
 
 void ReturnUndefChecker::emitUndef(CheckerContext &C, const Expr *RetE) const {

clang/lib/StaticAnalyzer/Checkers/SimpleStreamChecker.cpp

void SimpleStreamChecker::reportDoubleClose(SymbolRef FileDescSym,
                                             CheckerContext &C) const {
   // We reached a bug, stop exploring the path here by generating a sink.
   ExplodedNode *ErrNode = C.generateErrorNode();
   // If we've already reached this node on another path, return.
   if (!ErrNode)
     return;
 
   // Generate the report.
-  auto R = std::make_unique<BugReport>(*DoubleCloseBugType,
-      "Closing a previously closed file stream", ErrNode);
+  auto R = std::make_unique<PathSensitiveBugReport>(
+      *DoubleCloseBugType, "Closing a previously closed file stream", ErrNode);
   R->addRange(Call.getSourceRange());
   R->markInteresting(FileDescSym);
   C.emitReport(std::move(R));
 }
 
 void SimpleStreamChecker::reportLeaks(ArrayRef<SymbolRef> LeakedStreams,
                                       CheckerContext &C,
                                       ExplodedNode *ErrNode) const {
   // Attach bug reports to the leak node.
   // TODO: Identify the leaked file descriptor.
   for (SymbolRef LeakedStream : LeakedStreams) {
-    auto R = std::make_unique<BugReport>(*LeakBugType,
-        "Opened file is never closed; potential resource leak", ErrNode);
+    auto R = std::make_unique<PathSensitiveBugReport>(
+        *LeakBugType, "Opened file is never closed; potential resource leak",
+        ErrNode);
     R->markInteresting(LeakedStream);
     C.emitReport(std::move(R));
   }
 }
 
 bool SimpleStreamChecker::guaranteedNotToCloseFile(const CallEvent &Call) const{
   // If it's not in a system header, assume it might close a file.
   if (!Call.isInSystemHeader())

clang/lib/StaticAnalyzer/Checkers/StackAddrEscapeChecker.cpp

void StackAddrEscapeChecker::EmitStackError(CheckerContext &C,
   if (!BT_returnstack)
     BT_returnstack = std::make_unique<BuiltinBug>(
         this, "Return of address to stack-allocated memory");
   // Generate a report for this bug.
   SmallString<128> buf;
   llvm::raw_svector_ostream os(buf);
   SourceRange range = genName(os, R, C.getASTContext());
   os << " returned to caller";
-  auto report = std::make_unique<BugReport>(*BT_returnstack, os.str(), N);
+  auto report =
+      std::make_unique<PathSensitiveBugReport>(*BT_returnstack, os.str(), N);
   report->addRange(RetE->getSourceRange());
   if (range.isValid())
     report->addRange(range);
   C.emitReport(std::move(report));
 }
 
 void StackAddrEscapeChecker::checkAsyncExecutedBlockCaptures(
     const BlockDataRegion &B, CheckerContext &C) const {
if (!N)
       continue;
     if (!BT_capturedstackasync)
       BT_capturedstackasync = std::make_unique<BuiltinBug>(
           this, "Address of stack-allocated memory is captured");
     SmallString<128> Buf;
     llvm::raw_svector_ostream Out(Buf);
     SourceRange Range = genName(Out, Region, C.getASTContext());
     Out << " is captured by an asynchronously-executed block";
-    auto Report =
-        std::make_unique<BugReport>(*BT_capturedstackasync, Out.str(), N);
+    auto Report = std::make_unique<PathSensitiveBugReport>(
+        *BT_capturedstackasync, Out.str(), N);
     if (Range.isValid())
       Report->addRange(Range);
     C.emitReport(std::move(Report));
   }
 }
 
 void StackAddrEscapeChecker::checkReturnedBlockCaptures(
     const BlockDataRegion &B, CheckerContext &C) const {
   for (const MemRegion *Region : getCapturedStackRegions(B, C)) {
     if (isArcManagedBlock(Region, C) || isNotInCurrentFrame(Region, C))
       continue;
     ExplodedNode *N = C.generateNonFatalErrorNode();
     if (!N)
       continue;
     if (!BT_capturedstackret)
       BT_capturedstackret = std::make_unique<BuiltinBug>(
           this, "Address of stack-allocated memory is captured");
     SmallString<128> Buf;
     llvm::raw_svector_ostream Out(Buf);
     SourceRange Range = genName(Out, Region, C.getASTContext());
     Out << " is captured by a returned block";
-    auto Report =
-        std::make_unique<BugReport>(*BT_capturedstackret, Out.str(), N);
+    auto Report = std::make_unique<PathSensitiveBugReport>(*BT_capturedstackret,
+                                                           Out.str(), N);
     if (Range.isValid())
       Report->addRange(Range);
     C.emitReport(std::move(Report));
   }
 }
 
 void StackAddrEscapeChecker::checkPreCall(const CallEvent &Call,
                                           CheckerContext &C) const {
for (const auto &P : Cb.V) {
     if (isa<StaticGlobalSpaceRegion>(P.first->getMemorySpace()))
       Out << "static";
     else
       Out << "global";
     Out << " variable '";
     const VarRegion *VR = cast<VarRegion>(P.first->getBaseRegion());
     Out << *VR->getDecl()
         << "' upon returning to the caller.  This will be a dangling reference";
-    auto Report = std::make_unique<BugReport>(*BT_stackleak, Out.str(), N);
+    auto Report =
+        std::make_unique<PathSensitiveBugReport>(*BT_stackleak, Out.str(), N);
     if (Range.isValid())
       Report->addRange(Range);
 
     Ctx.emitReport(std::move(Report));
   }
 }
 
 void ento::registerStackAddrEscapeBase(CheckerManager &mgr) {

clang/lib/StaticAnalyzer/Checkers/StreamChecker.cpp

if (x >= 0 && x <= 2)
     return;
 
   if (ExplodedNode *N = C.generateNonFatalErrorNode(state)) {
     if (!BT_illegalwhence)
       BT_illegalwhence.reset(
           new BuiltinBug(this, "Illegal whence argument",
                          "The whence argument to fseek() should be "
                          "SEEK_SET, SEEK_END, or SEEK_CUR."));
-    C.emitReport(std::make_unique<BugReport>(
+    C.emitReport(std::make_unique<PathSensitiveBugReport>(
         *BT_illegalwhence, BT_illegalwhence->getDescription(), N));
   }
 }
 
 void StreamChecker::Ftell(CheckerContext &C, const CallExpr *CE) const {
   ProgramStateRef state = C.getState();
   if (!CheckNullStream(C.getSVal(CE->getArg(0)), state, C))
     return;
ProgramStateRef StreamChecker::CheckNullStream(SVal SV, ProgramStateRef state,
   ProgramStateRef stateNotNull, stateNull;
   std::tie(stateNotNull, stateNull) = CM.assumeDual(state, *DV);
 
   if (!stateNotNull && stateNull) {
     if (ExplodedNode *N = C.generateErrorNode(stateNull)) {
       if (!BT_nullfp)
         BT_nullfp.reset(new BuiltinBug(this, "NULL stream pointer",
                                        "Stream pointer might be NULL."));
-      C.emitReport(std::make_unique<BugReport>(
+      C.emitReport(std::make_unique<PathSensitiveBugReport>(
           *BT_nullfp, BT_nullfp->getDescription(), N));
     }
     return nullptr;
   }
   return stateNotNull;
 }
 
 ProgramStateRef StreamChecker::CheckDoubleClose(const CallExpr *CE,
ProgramStateRef StreamChecker::CheckDoubleClose(const CallExpr *CE,
   // Conforming to man-pages
   if (SS->isClosed()) {
     ExplodedNode *N = C.generateErrorNode();
     if (N) {
       if (!BT_doubleclose)
         BT_doubleclose.reset(new BuiltinBug(
             this, "Double fclose", "Try to close a file Descriptor already"
                                    " closed. Cause undefined behaviour."));
-      C.emitReport(std::make_unique<BugReport>(
+      C.emitReport(std::make_unique<PathSensitiveBugReport>(
           *BT_doubleclose, BT_doubleclose->getDescription(), N));
     }
     return nullptr;
   }
 
   // Close the File Descriptor.
   return state->set<StreamMap>(Sym, StreamState::getClosed(CE));
 }
for (const auto &I: Map) {
     ExplodedNode *N = C.generateErrorNode();
     if (!N)
       return;
 
     if (!BT_ResourceLeak)
       BT_ResourceLeak.reset(
           new BuiltinBug(this, "Resource Leak",
                          "Opened File never closed. Potential Resource leak."));
-    C.emitReport(std::make_unique<BugReport>(
+    C.emitReport(std::make_unique<PathSensitiveBugReport>(
         *BT_ResourceLeak, BT_ResourceLeak->getDescription(), N));
   }
 }
 
 void ento::registerStreamChecker(CheckerManager &mgr) {
   mgr.registerChecker<StreamChecker>();
 }
 
 bool ento::shouldRegisterStreamChecker(const LangOptions &LO) {
   return true;
 }

clang/lib/StaticAnalyzer/Checkers/Taint.h

private:
   const SVal V;
 
 public:
   TaintBugVisitor(const SVal V) : V(V) {}
   void Profile(llvm::FoldingSetNodeID &ID) const override { ID.Add(V); }
 
   PathDiagnosticPieceRef VisitNode(const ExplodedNode *N,
                                    BugReporterContext &BRC,
-                                   BugReport &BR) override;
+                                   PathSensitiveBugReport &BR) override;
 };
 
 } // namespace taint
 } // namespace ento
 } // namespace clang
 
 #endif
 

clang/lib/StaticAnalyzer/Checkers/Taint.cpp

for (SymExpr::symbol_iterator SI = Sym->symbol_begin(),
     }
   }
 
   return false;
 }
 
 PathDiagnosticPieceRef TaintBugVisitor::VisitNode(const ExplodedNode *N,
                                                   BugReporterContext &BRC,
-                                                  BugReport &BR) {
+                                                  PathSensitiveBugReport &BR) {
 
   // Find the ExplodedNode where the taint was first introduced
   if (!isTainted(N->getState(), V) ||
       isTainted(N->getFirstPred()->getState(), V))
     return nullptr;
 
   const Stmt *S = PathDiagnosticLocation::getStmt(N);
   if (!S)

clang/lib/StaticAnalyzer/Checkers/TaintTesterChecker.cpp

void TaintTesterChecker::checkPostStmt(const Expr *E,
                                        CheckerContext &C) const {
   ProgramStateRef State = C.getState();
   if (!State)
     return;
 
   if (isTainted(State, E, C.getLocationContext())) {
     if (ExplodedNode *N = C.generateNonFatalErrorNode()) {
       initBugType();
-      auto report = std::make_unique<BugReport>(*BT, "tainted",N);
+      auto report = std::make_unique<PathSensitiveBugReport>(*BT, "tainted", N);
       report->addRange(E->getSourceRange());
       C.emitReport(std::move(report));
     }
   }
 }
 
 void ento::registerTaintTesterChecker(CheckerManager &mgr) {
   mgr.registerChecker<TaintTesterChecker>();
 }
 
 bool ento::shouldRegisterTaintTesterChecker(const LangOptions &LO) {
   return true;
 }

clang/lib/StaticAnalyzer/Checkers/TestAfterDivZeroChecker.cpp

public:
 
   void Profile(llvm::FoldingSetNodeID &ID) const override {
     ID.Add(ZeroSymbol);
     ID.Add(SFC);
   }
 
   PathDiagnosticPieceRef VisitNode(const ExplodedNode *Succ,
                                    BugReporterContext &BRC,
-                                   BugReport &BR) override;
+                                   PathSensitiveBugReport &BR) override;
 };
 
 class TestAfterDivZeroChecker
     : public Checker<check::PreStmt<BinaryOperator>, check::BranchCondition,
                      check::EndFunction> {
   mutable std::unique_ptr<BuiltinBug> DivZeroBug;
   void reportBug(SVal Val, CheckerContext &C) const;
 
 public:
   void checkPreStmt(const BinaryOperator *B, CheckerContext &C) const;
   void checkBranchCondition(const Stmt *Condition, CheckerContext &C) const;
   void checkEndFunction(const ReturnStmt *RS, CheckerContext &C) const;
   void setDivZeroMap(SVal Var, CheckerContext &C) const;
   bool hasDivZeroMap(SVal Var, const CheckerContext &C) const;
   bool isZero(SVal S, CheckerContext &C) const;
 };
 } // end anonymous namespace
 
 REGISTER_SET_WITH_PROGRAMSTATE(DivZeroMap, ZeroState)
 
-PathDiagnosticPieceRef DivisionBRVisitor::VisitNode(const ExplodedNode *Succ,
-                                                    BugReporterContext &BRC,
-                                                    BugReport &BR) {
+PathDiagnosticPieceRef
+DivisionBRVisitor::VisitNode(const ExplodedNode *Succ, BugReporterContext &BRC,
+                             PathSensitiveBugReport &BR) {
   if (Satisfied)
     return nullptr;
 
   const Expr *E = nullptr;
 
   if (Optional<PostStmt> P = Succ->getLocationAs<PostStmt>())
     if (const BinaryOperator *BO = P->getStmtAs<BinaryOperator>()) {
       BinaryOperator::Opcode Op = BO->getOpcode();
bool TestAfterDivZeroChecker::hasDivZeroMap(SVal Var,
   return C.getState()->contains<DivZeroMap>(ZS);
 }
 
 void TestAfterDivZeroChecker::reportBug(SVal Val, CheckerContext &C) const {
   if (ExplodedNode *N = C.generateErrorNode(C.getState())) {
     if (!DivZeroBug)
       DivZeroBug.reset(new BuiltinBug(this, "Division by zero"));
 
-    auto R = std::make_unique<BugReport>(
+    auto R = std::make_unique<PathSensitiveBugReport>(
         *DivZeroBug, "Value being compared against zero has already been used "
                      "for division",
         N);
 
     R->addVisitor(std::make_unique<DivisionBRVisitor>(Val.getAsSymbol(),
                                                        C.getStackFrame()));
     C.emitReport(std::move(R));
   }

clang/lib/StaticAnalyzer/Checkers/UndefBranchChecker.cpp

if (N) {
       if (Optional<PostStmt> PS = P.getAs<PostStmt>())
         if (PS->getStmt() == Ex)
           St = PrevN->getState();
 
       FindUndefExpr FindIt(St, Ctx.getLocationContext());
       Ex = FindIt.FindExpr(Ex);
 
       // Emit the bug report.
-      auto R = std::make_unique<BugReport>(*BT, BT->getDescription(), N);
+      auto R = std::make_unique<PathSensitiveBugReport>(
+          *BT, BT->getDescription(), N);
       bugreporter::trackExpressionValue(N, Ex, *R);
       R->addRange(Ex->getSourceRange());
 
       Ctx.emitReport(std::move(R));
     }
   }
 }
 
 void ento::registerUndefBranchChecker(CheckerManager &mgr) {
   mgr.registerChecker<UndefBranchChecker>();
 }
 
 bool ento::shouldRegisterUndefBranchChecker(const LangOptions &LO) {
   return true;
 }

clang/lib/StaticAnalyzer/Checkers/UndefCapturedBlockVarChecker.cpp

if (Optional<UndefinedVal> V =
 
         // Generate a bug report.
         SmallString<128> buf;
         llvm::raw_svector_ostream os(buf);
 
         os << "Variable '" << VD->getName()
            << "' is uninitialized when captured by block";
 
-        auto R = std::make_unique<BugReport>(*BT, os.str(), N);
+        auto R = std::make_unique<PathSensitiveBugReport>(*BT, os.str(), N);
         if (const Expr *Ex = FindBlockDeclRefExpr(BE->getBody(), VD))
           R->addRange(Ex->getSourceRange());
         R->addVisitor(std::make_unique<FindLastStoreBRVisitor>(
             *V, VR, /*EnableNullFPSuppression*/ false,
             bugreporter::TrackingKind::Thorough));
         R->disablePathPruning();
         // need location of block
         C.emitReport(std::move(R));

clang/lib/StaticAnalyzer/Checkers/UndefResultChecker.cpp

if (Ex) {
            << "\'";
         Ex = B->getLHS();
       } else {
         OS << "The result of the '"
            << BinaryOperator::getOpcodeStr(B->getOpcode())
            << "' expression is undefined";
       }
     }
-    auto report = std::make_unique<BugReport>(*BT, OS.str(), N);
+    auto report = std::make_unique<PathSensitiveBugReport>(*BT, OS.str(), N);
     if (Ex) {
       report->addRange(Ex->getSourceRange());
       bugreporter::trackExpressionValue(N, Ex, *report);
     }
     else
       bugreporter::trackExpressionValue(N, B, *report);
 
     C.emitReport(std::move(report));

clang/lib/StaticAnalyzer/Checkers/UndefinedArraySubscriptChecker.cpp

UndefinedArraySubscriptChecker::checkPreStmt(const ArraySubscriptExpr *A,
 
   ExplodedNode *N = C.generateErrorNode();
   if (!N)
     return;
   if (!BT)
     BT.reset(new BuiltinBug(this, "Array subscript is undefined"));
 
   // Generate a report for this bug.
-  auto R = std::make_unique<BugReport>(*BT, BT->getName(), N);
+  auto R = std::make_unique<PathSensitiveBugReport>(*BT, BT->getName(), N);
   R->addRange(A->getIdx()->getSourceRange());
   bugreporter::trackExpressionValue(N, A->getIdx(), *R);
   C.emitReport(std::move(R));
 }
 
 void ento::registerUndefinedArraySubscriptChecker(CheckerManager &mgr) {
   mgr.registerChecker<UndefinedArraySubscriptChecker>();
 }
 
 bool ento::shouldRegisterUndefinedArraySubscriptChecker(const LangOptions &LO) {
   return true;
 }

clang/lib/StaticAnalyzer/Checkers/UndefinedAssignmentChecker.cpp

while (StoreE) {
     }
 
     break;
   }
 
   if (OS.str().empty())
     OS << DefaultMsg;
 
-  auto R = std::make_unique<BugReport>(*BT, OS.str(), N);
+  auto R = std::make_unique<PathSensitiveBugReport>(*BT, OS.str(), N);
   if (ex) {
     R->addRange(ex->getSourceRange());
     bugreporter::trackExpressionValue(N, ex, *R);
   }
   C.emitReport(std::move(R));
 }
 
 void ento::registerUndefinedAssignmentChecker(CheckerManager &mgr) {
   mgr.registerChecker<UndefinedAssignmentChecker>();
 }
 
 bool ento::shouldRegisterUndefinedAssignmentChecker(const LangOptions &LO) {
   return true;
 }

clang/lib/StaticAnalyzer/Checkers/UninitializedObject/UninitializedObjectChecker.cpp

if (CallSite)
     LocUsedForUniqueing = PathDiagnosticLocation::createBegin(
         CallSite, Context.getSourceManager(), Node->getLocationContext());
 
   // For Plist consumers that don't support notes just yet, we'll convert notes
   // to warnings.
   if (Opts.ShouldConvertNotesToWarnings) {
     for (const auto &Pair : UninitFields) {
 
-      auto Report = std::make_unique<BugReport>(
+      auto Report = std::make_unique<PathSensitiveBugReport>(
           *BT_uninitField, Pair.second, Node, LocUsedForUniqueing,
           Node->getLocationContext()->getDecl());
       Context.emitReport(std::move(Report));
     }
     return;
   }
 
   SmallString<100> WarningBuf;
   llvm::raw_svector_ostream WarningOS(WarningBuf);
   WarningOS << UninitFields.size() << " uninitialized field"
             << (UninitFields.size() == 1 ? "" : "s")
             << " at the end of the constructor call";
 
-  auto Report = std::make_unique<BugReport>(
+  auto Report = std::make_unique<PathSensitiveBugReport>(
       *BT_uninitField, WarningOS.str(), Node, LocUsedForUniqueing,
       Node->getLocationContext()->getDecl());
 
   for (const auto &Pair : UninitFields) {
     Report->addNote(Pair.second,
                     PathDiagnosticLocation::create(Pair.first->getDecl(),
                                                    Context.getSourceManager()));
   }

clang/lib/StaticAnalyzer/Checkers/UnixAPIChecker.cpp

void UnixAPIMisuseChecker::ReportOpenBug(CheckerContext &C,
                                          const char *Msg,
                                          SourceRange SR) const {
   ExplodedNode *N = C.generateErrorNode(State);
   if (!N)
     return;
 
   LazyInitialize(this, BT_open, "Improper use of 'open'");
 
-  auto Report = std::make_unique<BugReport>(*BT_open, Msg, N);
+  auto Report = std::make_unique<PathSensitiveBugReport>(*BT_open, Msg, N);
   Report->addRange(SR);
   C.emitReport(std::move(Report));
 }
 
 void UnixAPIMisuseChecker::CheckOpen(CheckerContext &C,
                                      const CallExpr *CE) const {
   CheckOpenVariant(C, CE, OpenVariant::Open);
 }
else
     os << " stack allocated memory";
   os << " for the \"control\" value.  Using such transient memory for "
   "the control value is potentially dangerous.";
   if (isa<VarRegion>(R) && isa<StackLocalsSpaceRegion>(R->getMemorySpace()))
     os << "  Perhaps you intended to declare the variable as 'static'?";
 
   LazyInitialize(this, BT_pthreadOnce, "Improper use of 'pthread_once'");
 
-  auto report = std::make_unique<BugReport>(*BT_pthreadOnce, os.str(), N);
+  auto report =
+      std::make_unique<PathSensitiveBugReport>(*BT_pthreadOnce, os.str(), N);
   report->addRange(CE->getArg(0)->getSourceRange());
   C.emitReport(std::move(report));
 }
 
 //===----------------------------------------------------------------------===//
 // "calloc", "malloc", "realloc", "reallocf", "alloca" and "valloc"
 // with allocation size 0
 //===----------------------------------------------------------------------===//
if (!N)
     return false;
 
   LazyInitialize(this, BT_mallocZero,
                  "Undefined allocation of 0 bytes (CERT MEM04-C; CWE-131)");
 
   SmallString<256> S;
   llvm::raw_svector_ostream os(S);
   os << "Call to '" << fn_name << "' has an allocation size of 0 bytes";
-  auto report = std::make_unique<BugReport>(*BT_mallocZero, os.str(), N);
+  auto report =
+      std::make_unique<PathSensitiveBugReport>(*BT_mallocZero, os.str(), N);
 
   report->addRange(arg->getSourceRange());
   bugreporter::trackExpressionValue(N, arg, *report);
   C.emitReport(std::move(report));
 
   return true;
 }
 

clang/lib/StaticAnalyzer/Checkers/VLASizeChecker.cpp

void VLASizeChecker::reportBug(
   case VLA_Tainted:
     os << "has tainted size";
     break;
   case VLA_Negative:
     os << "has negative size";
     break;
   }
 
-  auto report = std::make_unique<BugReport>(*BT, os.str(), N);
+  auto report = std::make_unique<PathSensitiveBugReport>(*BT, os.str(), N);
   report->addVisitor(std::move(Visitor));
   report->addRange(SizeE->getSourceRange());
   bugreporter::trackExpressionValue(N, SizeE, *report);
   C.emitReport(std::move(report));
 }
 
 void VLASizeChecker::checkPreStmt(const DeclStmt *DS, CheckerContext &C) const {
   if (!DS->isSingleDecl())

clang/lib/StaticAnalyzer/Checkers/ValistChecker.cpp

ValistBugVisitor(const MemRegion *Reg, bool IsLeak = false)
         : Reg(Reg), IsLeak(IsLeak) {}
     void Profile(llvm::FoldingSetNodeID &ID) const override {
       static int X = 0;
       ID.AddPointer(&X);
       ID.AddPointer(Reg);
     }
     PathDiagnosticPieceRef getEndPath(BugReporterContext &BRC,
                                       const ExplodedNode *EndPathNode,
-                                      BugReport &BR) override {
+                                      PathSensitiveBugReport &BR) override {
       if (!IsLeak)
         return nullptr;
 
-      PathDiagnosticLocation L = PathDiagnosticLocation::createEndOfPath(
-          EndPathNode, BRC.getSourceManager());
+      PathDiagnosticLocation L =
+          PathDiagnosticLocation::createEndOfPath(EndPathNode);
       // Do not add the statement itself as a range in case of leak.
       return std::make_shared<PathDiagnosticEventPiece>(L, BR.getDescription(),
                                                         false);
     }
     PathDiagnosticPieceRef VisitNode(const ExplodedNode *N,
                                      BugReporterContext &BRC,
-                                     BugReport &BR) override;
+                                     PathSensitiveBugReport &BR) override;
 
   private:
     const MemRegion *Reg;
     bool IsLeak;
   };
 };
 
 const SmallVector<ValistChecker::VAListAccepter, 15>
void ValistChecker::reportUninitializedAccess(const MemRegion *VAList,
                                               CheckerContext &C) const {
   if (!ChecksEnabled[CK_Uninitialized])
     return;
   if (ExplodedNode *N = C.generateErrorNode()) {
     if (!BT_uninitaccess)
       BT_uninitaccess.reset(new BugType(CheckNames[CK_Uninitialized],
                                         "Uninitialized va_list",
                                         categories::MemoryError));
-    auto R = std::make_unique<BugReport>(*BT_uninitaccess, Msg, N);
+    auto R = std::make_unique<PathSensitiveBugReport>(*BT_uninitaccess, Msg, N);
     R->markInteresting(VAList);
     R->addVisitor(std::make_unique<ValistBugVisitor>(VAList));
     C.emitReport(std::move(R));
   }
 }
 
 void ValistChecker::reportLeakedVALists(const RegionVector &LeakedVALists,
                                         StringRef Msg1, StringRef Msg2,
for (auto Reg : LeakedVALists) {
     SmallString<100> Buf;
     llvm::raw_svector_ostream OS(Buf);
     OS << Msg1;
     std::string VariableName = Reg->getDescriptiveName();
     if (!VariableName.empty())
       OS << " " << VariableName;
     OS << Msg2;
 
-    auto R = std::make_unique<BugReport>(
+    auto R = std::make_unique<PathSensitiveBugReport>(
         *BT_leakedvalist, OS.str(), N, LocUsedForUniqueing,
         StartNode->getLocationContext()->getDecl());
     R->markInteresting(Reg);
     R->addVisitor(std::make_unique<ValistBugVisitor>(Reg, true));
     C.emitReport(std::move(R));
   }
 }
 
if (!C.getState()->contains<InitializedVALists>(VAList)) {
     return;
   }
   ProgramStateRef State = C.getState();
   State = State->remove<InitializedVALists>(VAList);
   C.addTransition(State);
 }
 
 PathDiagnosticPieceRef ValistChecker::ValistBugVisitor::VisitNode(
-    const ExplodedNode *N, BugReporterContext &BRC, BugReport &) {
+    const ExplodedNode *N, BugReporterContext &BRC, PathSensitiveBugReport &) {
   ProgramStateRef State = N->getState();
   ProgramStateRef StatePrev = N->getFirstPred()->getState();
 
   const Stmt *S = PathDiagnosticLocation::getStmt(N);
   if (!S)
     return nullptr;
 
   StringRef Msg;

clang/lib/StaticAnalyzer/Checkers/VforkChecker.cpp

if (ExplodedNode *N = C.generateErrorNode(C.getState())) {
     SmallString<256> buf;
     llvm::raw_svector_ostream os(buf);
 
     os << What << " is prohibited after a successful vfork";
 
     if (Details)
       os << "; " << Details;
 
-    auto Report = std::make_unique<BugReport>(*BT, os.str(), N);
+    auto Report = std::make_unique<PathSensitiveBugReport>(*BT, os.str(), N);
     // TODO: mark vfork call in BugReportVisitor
     C.emitReport(std::move(Report));
   }
 }
 
 // Detect calls to vfork and split execution appropriately.
 void VforkChecker::checkPostCall(const CallEvent &Call,
                                  CheckerContext &C) const {

clang/lib/StaticAnalyzer/Checkers/VirtualCallChecker.cpp

if (!N)
     return;
 
   const std::unique_ptr<BugType> &BT = IsPure ? BT_Pure : BT_Impure;
   if (!BT) {
     // The respective check is disabled.
     return;
   }
 
-  auto Report = std::make_unique<BugReport>(*BT, OS.str(), N);
+  auto Report = std::make_unique<PathSensitiveBugReport>(*BT, OS.str(), N);
 
   if (ShowFixIts && !IsPure) {
     // FIXME: These hints are valid only when the virtual call is made
     // directly from the constructor/destructor. Otherwise the dispatch
     // will work just fine from other callees, and the fix may break
     // the otherwise correct program.
     FixItHint Fixit = FixItHint::CreateInsertion(
         CE->getBeginLoc(), MD->getParent()->getNameAsString() + "::");

clang/lib/StaticAnalyzer/Core/BugReporter.cpp

 #include <queue>
 #include <string>
 #include <tuple>
 #include <utility>
 #include <vector>
 
 using namespace clang;
 using namespace ento;
+using namespace llvm;
 
 #define DEBUG_TYPE "BugReporter"
 
 STATISTIC(MaxBugClassSize,
           "The maximum number of bug reports in the same equivalence class");
 STATISTIC(MaxValidBugClassSize,
           "The maximum number of bug reports in the same equivalence class "
           "where at least one report is valid (not suppressed)");
public:
   CallWithEntryStack CallStack;
   /// The bug report we're constructing. For ease of use, this field is kept
   /// public, though some "shortcut" getters are provided for commonly used
   /// methods of PathDiagnostic.
   std::unique_ptr<PathDiagnostic> PD;
 
 public:
   PathDiagnosticConstruct(const PathDiagnosticConsumer *PDC,
-                          const ExplodedNode *ErrorNode, const BugReport *R);
+                          const ExplodedNode *ErrorNode,
+                          const PathSensitiveBugReport *R);
 
   /// \returns the location context associated with the current position in the
   /// bug path.
   const LocationContext *getCurrLocationContext() const {
     assert(CurrentNode && "Already reached the root!");
     return CurrentNode->getLocationContext();
   }
 

 /// construction.
 class PathDiagnosticBuilder : public BugReporterContext {
   /// A linear path from the error node to the root.
   std::unique_ptr<const ExplodedGraph> BugPath;
   /// The bug report we're describing. Visitors create their diagnostics with
   /// them being the last entities being able to modify it (for example,
   /// changing interestingness here would cause inconsistencies as to how this
   /// file and visitors construct diagnostics), hence its const.
-  const BugReport *R;
+  const PathSensitiveBugReport *R;
   /// The leaf of the bug path. This isn't the same as the bug reports error
   /// node, which refers to the *original* graph, not the bug path.
   const ExplodedNode *const ErrorNode;
   /// The diagnostic pieces visitors emitted, which is expected to be collected
   /// by the time this builder is constructed.
   std::unique_ptr<const VisitorsDiagnosticsTy> VisitorsDiagnostics;
 
 public:
   /// Find a non-invalidated report for a given equivalence class,  and returns
   /// a PathDiagnosticBuilder able to construct bug reports for different
   /// consumers. Returns None if no valid report is found.
   static Optional<PathDiagnosticBuilder>
-  findValidReport(ArrayRef<BugReport *> &bugReports,
+  findValidReport(ArrayRef<PathSensitiveBugReport *> &bugReports,
                   PathSensitiveBugReporter &Reporter);
 
   PathDiagnosticBuilder(
       BugReporterContext BRC, std::unique_ptr<ExplodedGraph> BugPath,
-      BugReport *r, const ExplodedNode *ErrorNode,
+      PathSensitiveBugReport *r, const ExplodedNode *ErrorNode,
       std::unique_ptr<VisitorsDiagnosticsTy> VisitorsDiagnostics);
 
   /// This function is responsible for generating diagnostic pieces that are
   /// *not* provided by bug report visitors.
   /// These diagnostics may differ depending on the consumer's settings,
   /// and are therefore constructed separately for each consumer.
   ///
   /// There are two path diagnostics generation modes: with adding edges (used
private:
 
   PathDiagnosticLocation
   ExecutionContinues(const PathDiagnosticConstruct &C) const;
 
   PathDiagnosticLocation
   ExecutionContinues(llvm::raw_string_ostream &os,
                      const PathDiagnosticConstruct &C) const;
 
-  const BugReport *getBugReport() const { return R; }
+  const PathSensitiveBugReport *getBugReport() const { return R; }
 };
 
 } // namespace
 
 //===----------------------------------------------------------------------===//
 // Helper routines for walking the ExplodedGraph and fetching statements.
 //===----------------------------------------------------------------------===//
 
for (unsigned i = 0; i < N; ++i) {
     path.push_back(std::move(piece));
   }
 }
 
 /// Recursively scan through a path and prune out calls and macros pieces
 /// that aren't needed.  Return true if afterwards the path contains
 /// "interesting stuff" which means it shouldn't be pruned from the parent path.
 static bool removeUnneededCalls(const PathDiagnosticConstruct &C,
-                                PathPieces &pieces, const BugReport *R,
+                                PathPieces &pieces,
+                                const PathSensitiveBugReport *R,
                                 bool IsInteresting = false) {
   bool containsSomethingInteresting = IsInteresting;
   const unsigned N = pieces.size();
 
   for (unsigned i = 0 ; i < N ; ++i) {
     // Remove the front piece from the path.  If it is still something we
     // want to keep once we are done, we will push it back on the end.
     auto piece = std::move(pieces.front());
if (const Stmt *Term = BSrc->getTerminatorStmt()) {
         PathDiagnosticLocation L(Term, SM, C.getCurrLocationContext());
         addEdgeToPath(C.getActivePath(), PrevLoc, L);
       }
     }
   }
 }
 
 static std::unique_ptr<PathDiagnostic>
-generateEmptyDiagnosticForReport(const BugReport *R, const SourceManager &SM) {
+generateDiagnosticForBasicReport(const BasicBugReport *R) {
   const BugType &BT = R->getBugType();
   return std::make_unique<PathDiagnostic>(
-      R->getBugType().getCheckName(), R->getDeclWithIssue(),
-      R->getBugType().getName(), R->getDescription(),
-      R->getShortDescription(/*UseFallback=*/false), BT.getCategory(),
-      R->getUniqueingLocation(), R->getUniqueingDecl(),
+      BT.getCheckName(), R->getDeclWithIssue(), BT.getName(),
+      R->getDescription(), R->getShortDescription(/*UseFallback=*/false),
+      BT.getCategory(), R->getUniqueingLocation(), R->getUniqueingDecl(),
+      std::make_unique<FilesToLineNumsMap>());
+}
+
+static std::unique_ptr<PathDiagnostic>
+generateEmptyDiagnosticForReport(const PathSensitiveBugReport *R,
+                                 const SourceManager &SM) {
+  const BugType &BT = R->getBugType();
+  return std::make_unique<PathDiagnostic>(
+      BT.getCheckName(), R->getDeclWithIssue(), BT.getName(),
+      R->getDescription(), R->getShortDescription(/*UseFallback=*/false),
+      BT.getCategory(), R->getUniqueingLocation(), R->getUniqueingDecl(),
       findExecutedLines(SM, R->getErrorNode()));
 }
 
 static const Stmt *getStmtParent(const Stmt *S, const ParentMap &PM) {
   if (!S)
     return nullptr;
 
   while (true) {
for (const auto &P : path) {
     unsigned LineNo = Loc.getLineNumber();
     assert(FID.isValid());
     ExecutedLines[FID].insert(LineNo);
   }
 }
 
 PathDiagnosticConstruct::PathDiagnosticConstruct(
     const PathDiagnosticConsumer *PDC, const ExplodedNode *ErrorNode,
-    const BugReport *R)
+    const PathSensitiveBugReport *R)
     : Consumer(PDC), CurrentNode(ErrorNode),
       SM(CurrentNode->getCodeDecl().getASTContext().getSourceManager()),
       PD(generateEmptyDiagnosticForReport(R, getSourceManager())) {
   LCM[&PD->getActivePath()] = ErrorNode->getLocationContext();
 }
 
 PathDiagnosticBuilder::PathDiagnosticBuilder(
     BugReporterContext BRC, std::unique_ptr<ExplodedGraph> BugPath,
-    BugReport *r, const ExplodedNode *ErrorNode,
+    PathSensitiveBugReport *r, const ExplodedNode *ErrorNode,
     std::unique_ptr<VisitorsDiagnosticsTy> VisitorsDiagnostics)
     : BugReporterContext(BRC), BugPath(std::move(BugPath)), R(r),
       ErrorNode(ErrorNode),
       VisitorsDiagnostics(std::move(VisitorsDiagnostics)) {}
 
 std::unique_ptr<PathDiagnostic>
 PathDiagnosticBuilder::generate(const PathDiagnosticConsumer *PDC) const {
   PathDiagnosticConstruct Construct(PDC, ErrorNode, R);
 
   const SourceManager &SM = getSourceManager();
-  const BugReport *R = getBugReport();
   const AnalyzerOptions &Opts = getAnalyzerOptions();
   StringRef ErrorTag = ErrorNode->getLocation().getTag()->getTagDescription();
 
   // See whether we need to silence the checker/package.
   // FIXME: This will not work if the report was emitted with an incorrect tag.
   for (const std::string &CheckerOrPackage : Opts.SilencedCheckersAndPackages) {
     if (ErrorTag.startswith(CheckerOrPackage))
       return nullptr;

 void BugType::anchor() {}
 
 void BuiltinBug::anchor() {}
 
 //===----------------------------------------------------------------------===//
 // Methods for BugReport and subclasses.
 //===----------------------------------------------------------------------===//
 
-void BugReport::addVisitor(std::unique_ptr<BugReporterVisitor> visitor) {
+void PathSensitiveBugReport::addVisitor(
+    std::unique_ptr<BugReporterVisitor> visitor) {
   if (!visitor)
     return;
 
   llvm::FoldingSetNodeID ID;
   visitor->Profile(ID);
 
   void *InsertPos = nullptr;
   if (CallbacksSet.FindNodeOrInsertPos(ID, InsertPos)) {
     return;
   }
 
   Callbacks.push_back(std::move(visitor));
 }
 
-void BugReport::clearVisitors() {
+void PathSensitiveBugReport::clearVisitors() {
   Callbacks.clear();
 }
 
-const Decl *BugReport::getDeclWithIssue() const {
-  if (DeclWithIssue)
-    return DeclWithIssue;
-
+const Decl *PathSensitiveBugReport::getDeclWithIssue() const {
   const ExplodedNode *N = getErrorNode();
   if (!N)
     return nullptr;
 
   const LocationContext *LC = N->getLocationContext();
   return LC->getStackFrame()->getDecl();
 }
 
-void BugReport::Profile(llvm::FoldingSetNodeID& hash) const {
+void BasicBugReport::Profile(llvm::FoldingSetNodeID& hash) const {
+  hash.AddInteger(static_cast<int>(getKind()));
+  hash.AddPointer(&BT);
+  hash.AddString(Description);
+  assert(Location.isValid());
+  Location.Profile(hash);
+
+  for (SourceRange range : Ranges) {
+    if (!range.isValid())
+      continue;
+    hash.AddInteger(range.getBegin().getRawEncoding());
+    hash.AddInteger(range.getEnd().getRawEncoding());
+  }
+}
+
+void PathSensitiveBugReport::Profile(llvm::FoldingSetNodeID &hash) const {
+  hash.AddInteger(static_cast<int>(getKind()));
   hash.AddPointer(&BT);
   hash.AddString(Description);
   PathDiagnosticLocation UL = getUniqueingLocation();
   if (UL.isValid()) {
     UL.Profile(hash);
-  } else if (Location.isValid()) {
-    Location.Profile(hash);
   } else {
     assert(ErrorNode);
     hash.AddPointer(GetCurrentOrPreviousStmt(ErrorNode));
   }
 
   for (SourceRange range : Ranges) {
     if (!range.isValid())
       continue;
static void insertToInterestingnessMap(
   }
 
   llvm_unreachable(
       "BugReport::markInteresting currently can only handle 2 different "
       "tracking kinds! Please define what tracking kind should this entitiy"
       "have, if it was already marked as interesting with a different kind!");
 }
 
-void BugReport::markInteresting(SymbolRef sym,
+void PathSensitiveBugReport::markInteresting(SymbolRef sym,
                                              bugreporter::TrackingKind TKind) {
   if (!sym)
     return;
 
   insertToInterestingnessMap(InterestingSymbols, sym, TKind);
 
   if (const auto *meta = dyn_cast<SymbolMetadata>(sym))
     markInteresting(meta->getRegion(), TKind);
 }
 
-void BugReport::markInteresting(const MemRegion *R,
+void PathSensitiveBugReport::markInteresting(const MemRegion *R,
                                              bugreporter::TrackingKind TKind) {
   if (!R)
     return;
 
   R = R->getBaseRegion();
   insertToInterestingnessMap(InterestingRegions, R, TKind);
 
   if (const auto *SR = dyn_cast<SymbolicRegion>(R))
     markInteresting(SR->getSymbol(), TKind);
 }
 
-void BugReport::markInteresting(SVal V, bugreporter::TrackingKind TKind) {
+void PathSensitiveBugReport::markInteresting(SVal V,
+                                             bugreporter::TrackingKind TKind) {
   markInteresting(V.getAsRegion(), TKind);
   markInteresting(V.getAsSymbol(), TKind);
 }
 
-void BugReport::markInteresting(const LocationContext *LC) {
+void PathSensitiveBugReport::markInteresting(const LocationContext *LC) {
   if (!LC)
     return;
   InterestingLocationContexts.insert(LC);
 }
 
 Optional<bugreporter::TrackingKind>
-BugReport::getInterestingnessKind(SVal V) const {
+PathSensitiveBugReport::getInterestingnessKind(SVal V) const {
   auto RKind = getInterestingnessKind(V.getAsRegion());
   auto SKind = getInterestingnessKind(V.getAsSymbol());
   if (!RKind)
     return SKind;
   if (!SKind)
     return RKind;
 
   // If either is marked with throrough tracking, return that, we wouldn't like
   // to downplay a note's importance by 'only' mentioning it as a condition.
   switch(*RKind) {
     case bugreporter::TrackingKind::Thorough:
       return RKind;
     case bugreporter::TrackingKind::Condition:
       return SKind;
   }
 
   llvm_unreachable(
       "BugReport::getInterestingnessKind currently can only handle 2 different "
       "tracking kinds! Please define what tracking kind should we return here "
       "when the kind of getAsRegion() and getAsSymbol() is different!");
   return None;
 }
 
 Optional<bugreporter::TrackingKind>
-BugReport::getInterestingnessKind(SymbolRef sym) const {
+PathSensitiveBugReport::getInterestingnessKind(SymbolRef sym) const {
   if (!sym)
     return None;
   // We don't currently consider metadata symbols to be interesting
   // even if we know their region is interesting. Is that correct behavior?
   auto It = InterestingSymbols.find(sym);
   if (It == InterestingSymbols.end())
     return None;
   return It->getSecond();
 }
 
 Optional<bugreporter::TrackingKind>
-BugReport::getInterestingnessKind(const MemRegion *R) const {
+PathSensitiveBugReport::getInterestingnessKind(const MemRegion *R) const {
   if (!R)
     return None;
 
   R = R->getBaseRegion();
   auto It = InterestingRegions.find(R);
   if (It != InterestingRegions.end())
     return It->getSecond();
 
   if (const auto *SR = dyn_cast<SymbolicRegion>(R))
     return getInterestingnessKind(SR->getSymbol());
   return None;
 }
 
-bool BugReport::isInteresting(SVal V) const {
+bool PathSensitiveBugReport::isInteresting(SVal V) const {
   return getInterestingnessKind(V).hasValue();
 }
 
-bool BugReport::isInteresting(SymbolRef sym) const {
+bool PathSensitiveBugReport::isInteresting(SymbolRef sym) const {
   return getInterestingnessKind(sym).hasValue();
 }
 
-bool BugReport::isInteresting(const MemRegion *R) const {
+bool PathSensitiveBugReport::isInteresting(const MemRegion *R) const {
   return getInterestingnessKind(R).hasValue();
 }
 
-bool BugReport::isInteresting(const LocationContext *LC)  const {
+bool PathSensitiveBugReport::isInteresting(const LocationContext *LC)  const {
   if (!LC)
     return false;
   return InterestingLocationContexts.count(LC);
 }
 
-const Stmt *BugReport::getStmt() const {
+const Stmt *PathSensitiveBugReport::getStmt() const {
   if (!ErrorNode)
     return nullptr;
 
   ProgramPoint ProgP = ErrorNode->getLocation();
   const Stmt *S = nullptr;
 
   if (Optional<BlockEntrance> BE = ProgP.getAs<BlockEntrance>()) {
     CFGBlock &Exit = ProgP.getLocationContext()->getCFG()->getExit();
     if (BE->getBlock() == &Exit)
       S = GetPreviousStmt(ErrorNode);
   }
   if (!S)
     S = PathDiagnosticLocation::getStmt(ErrorNode);
 
   return S;
 }
 
-llvm::iterator_range<BugReport::ranges_iterator> BugReport::getRanges() const {
+ArrayRef<SourceRange>
+PathSensitiveBugReport::getRanges() const {
   // If no custom ranges, add the range of the statement corresponding to
   // the error node.
-  if (Ranges.empty()) {
-    if (dyn_cast_or_null<Expr>(getStmt()))
-      return llvm::make_range(&ErrorNodeRange, &ErrorNodeRange + 1);
-    return llvm::make_range(ranges_iterator(), ranges_iterator());
-  }
-
-  // User-specified absence of range info.
-  if (Ranges.size() == 1 && !Ranges.begin()->isValid())
-    return llvm::make_range(ranges_iterator(), ranges_iterator());
-
-  return llvm::make_range(Ranges.begin(), Ranges.end());
-}
+  if (Ranges.empty() && isa_and_nonnull<Expr>(getStmt()))
+      return ErrorNodeRange;
 
-PathDiagnosticLocation BugReport::getLocation(const SourceManager &SM) const {
-  if (ErrorNode) {
-    assert(!Location.isValid() &&
-     "Either Location or ErrorNode should be specified but not both.");
-    return PathDiagnosticLocation::createEndOfPath(ErrorNode, SM);
-  }
+  return Ranges;
 
-  assert(Location.isValid());
-  return Location;
+PathDiagnosticLocation
+PathSensitiveBugReport::getLocation() const {
+  return PathDiagnosticLocation::createEndOfPath(ErrorNode);
 }
 
 //===----------------------------------------------------------------------===//
 // Methods for BugReporter and subclasses.
 //===----------------------------------------------------------------------===//
 
 const ExplodedGraph &PathSensitiveBugReporter::getGraph() const {
   return Eng.getGraph();

 
 namespace {
 
 /// A wrapper around an ExplodedGraph that contains a single path from the root
 /// to the error node.
 class BugPathInfo {
 public:
   std::unique_ptr<ExplodedGraph> BugPath;
-  BugReport *Report;
+  PathSensitiveBugReport *Report;
   const ExplodedNode *ErrorNode;
 };
 
 /// A wrapper around an ExplodedGraph whose leafs are all error nodes. Can
 /// conveniently retrieve bug paths from a single error node to the root.
 class BugPathGetter {
   std::unique_ptr<ExplodedGraph> TrimmedGraph;
 
   using PriorityMapTy = llvm::DenseMap<const ExplodedNode *, unsigned>;
 
   /// Assign each node with its distance from the root.
   PriorityMapTy PriorityMap;
 
   /// Since the getErrorNode() or BugReport refers to the original ExplodedGraph,
   /// we need to pair it to the error node of the constructed trimmed graph.
-  using ReportNewNodePair = std::pair<BugReport *, const ExplodedNode *>;
+  using ReportNewNodePair =
+      std::pair<PathSensitiveBugReport *, const ExplodedNode *>;
   SmallVector<ReportNewNodePair, 32> ReportNodes;
 
   BugPathInfo CurrentBugPath;
 
   /// A helper class for sorting ExplodedNodes by priority.
   template <bool Descending>
   class PriorityCompare {
     const PriorityMapTy &PriorityMap;
public:
     bool operator()(const ReportNewNodePair &LHS,
                     const ReportNewNodePair &RHS) const {
       return (*this)(LHS.second, RHS.second);
     }
   };
 
 public:
   BugPathGetter(const ExplodedGraph *OriginalGraph,
-                ArrayRef<BugReport *> &bugReports);
+                ArrayRef<PathSensitiveBugReport *> &bugReports);
 
   BugPathInfo *getNextBugPath();
 };
 
 } // namespace
 
 BugPathGetter::BugPathGetter(const ExplodedGraph *OriginalGraph,
-                             ArrayRef<BugReport *> &bugReports) {
+                             ArrayRef<PathSensitiveBugReport *> &bugReports) {
   SmallVector<const ExplodedNode *, 32> Nodes;
   for (const auto I : bugReports) {
     assert(I->isValid() &&
            "We only allow BugReporterVisitors and BugReporter itself to "
            "invalidate reports!");
     Nodes.emplace_back(I->getErrorNode());
   }
 
   // The trimmed graph is created in the body of the constructor to ensure
   // that the DenseMaps have been initialized already.
   InterExplodedGraphMap ForwardMap;
   TrimmedGraph = OriginalGraph->trim(Nodes, &ForwardMap);
 
   // Find the (first) error node in the trimmed graph.  We just need to consult
   // the node map which maps from nodes in the original graph to nodes
   // in the new graph.
   llvm::SmallPtrSet<const ExplodedNode *, 32> RemainingNodes;
 
-  for (BugReport *Report : bugReports) {
+  for (PathSensitiveBugReport *Report : bugReports) {
     const ExplodedNode *NewNode = ForwardMap.lookup(Report->getErrorNode());
     assert(NewNode &&
            "Failed to construct a trimmed graph that contains this error "
            "node!");
     ReportNodes.emplace_back(Report, NewNode);
     RemainingNodes.insert(NewNode);
   }
 
static void CompactMacroExpandedPieces(PathPieces &path,
 
   path.insert(path.end(), Pieces.begin(), Pieces.end());
 }
 
 /// Generate notes from all visitors.
 /// Notes associated with {@code ErrorNode} are generated using
 /// {@code getEndPath}, and the rest are generated with {@code VisitNode}.
 static std::unique_ptr<VisitorsDiagnosticsTy>
-generateVisitorsDiagnostics(BugReport *R, const ExplodedNode *ErrorNode,
+generateVisitorsDiagnostics(PathSensitiveBugReport *R,
+                            const ExplodedNode *ErrorNode,
                             BugReporterContext &BRC) {
   std::unique_ptr<VisitorsDiagnosticsTy> Notes =
       std::make_unique<VisitorsDiagnosticsTy>();
-  BugReport::VisitorList visitors;
+  PathSensitiveBugReport::VisitorList visitors;
 
   // Run visitors on all nodes starting from the node *before* the last one.
   // The last node is reserved for notes generated with {@code getEndPath}.
   const ExplodedNode *NextNode = ErrorNode->getFirstPred();
   while (NextNode) {
 
     // At each iteration, move all visitors from report to visitor list. This is
     // important, because the Profile() functions of the visitors make sure that
if (!R->isValid())
       break;
 
     NextNode = Pred;
   }
 
   return Notes;
 }
 
-Optional<PathDiagnosticBuilder>
-PathDiagnosticBuilder::findValidReport(ArrayRef<BugReport *> &bugReports,
-                                       PathSensitiveBugReporter &Reporter) {
+Optional<PathDiagnosticBuilder> PathDiagnosticBuilder::findValidReport(
+    ArrayRef<PathSensitiveBugReport *> &bugReports,
 
   BugPathGetter BugGraph(&Reporter.getGraph(), bugReports);
 
   while (BugPathInfo *BugPath = BugGraph.getNextBugPath()) {
     // Find the BugReport with the original location.
-    BugReport *R = BugPath->Report;
+    PathSensitiveBugReport *R = BugPath->Report;
     assert(R && "No original report found for sliced graph.");
     assert(R->isValid() && "Report selected by trimmed graph marked invalid.");
     const ExplodedNode *ErrorNode = BugPath->ErrorNode;
 
     // Register refutation visitors first, if they mark the bug invalid no
     // further analysis is required
     R->addVisitor(std::make_unique<LikelyFalsePositiveSuppressionBRVisitor>());
 
Optional<PathDiagnosticBuilder> PathDiagnosticBuilder::findValidReport(
   }
 
   return {};
 }
 
 std::unique_ptr<DiagnosticForConsumerMapTy>
 PathSensitiveBugReporter::generatePathDiagnostics(
     ArrayRef<PathDiagnosticConsumer *> consumers,
-    ArrayRef<BugReport *> &bugReports) {
+    ArrayRef<PathSensitiveBugReport *> &bugReports) {
   assert(!bugReports.empty());
 
   auto Out = std::make_unique<DiagnosticForConsumerMapTy>();
 
   Optional<PathDiagnosticBuilder> PDB =
       PathDiagnosticBuilder::findValidReport(bugReports, *this);
 
   if (PDB) {
     for (PathDiagnosticConsumer *PC : consumers) {
       if (std::unique_ptr<PathDiagnostic> PD = PDB->generate(PC)) {
         (*Out)[PC] = std::move(PD);
       }
     }
   }
 
   return Out;
 }
 
 void BugReporter::emitReport(std::unique_ptr<BugReport> R) {
-  if (const ExplodedNode *E = R->getErrorNode()) {
-    // An error node must either be a sink or have a tag, otherwise
-    // it could get reclaimed before the path diagnostic is created.
-    assert((E->isSink() || E->getLocation().getTag()) &&
-            "Error node must either be a sink or have a tag");
-
-    const AnalysisDeclContext *DeclCtx =
-        E->getLocationContext()->getAnalysisDeclContext();
-    // The source of autosynthesized body can be handcrafted AST or a model
-    // file. The locations from handcrafted ASTs have no valid source locations
-    // and have to be discarded. Locations from model files should be preserved
-    // for processing and reporting.
-    if (DeclCtx->isBodyAutosynthesized() &&
-        !DeclCtx->isBodyAutosynthesizedFromModelFile())
-      return;
-  }
-
-  bool ValidSourceLoc = R->getLocation(getSourceManager()).isValid();
+  bool ValidSourceLoc = R->getLocation().isValid();
   assert(ValidSourceLoc);
   // If we mess up in a release build, we'd still prefer to just drop the bug
   // instead of trying to go on.
   if (!ValidSourceLoc)
     return;
 
   // Compute the bug report's hash to determine its equivalence class.
   llvm::FoldingSetNodeID ID;
   R->Profile(ID);
 
   // Lookup the equivance class.  If there isn't one, create it.
   void *InsertPos;
   BugReportEquivClass* EQ = EQClasses.FindNodeOrInsertPos(ID, InsertPos);
 
   if (!EQ) {
     EQ = new BugReportEquivClass(std::move(R));
     EQClasses.InsertNode(EQ, InsertPos);
     EQClassesVector.push_back(EQ);
   } else
     EQ->AddReport(std::move(R));
 }
 
+void PathSensitiveBugReporter::emitReport(std::unique_ptr<BugReport> R) {
+  if (auto PR = dyn_cast<PathSensitiveBugReport>(R.get()))
+    if (const ExplodedNode *E = PR->getErrorNode()) {
+      // An error node must either be a sink or have a tag, otherwise
+      // it could get reclaimed before the path diagnostic is created.
+      assert((E->isSink() || E->getLocation().getTag()) &&
+             "Error node must either be a sink or have a tag");
+
+      const AnalysisDeclContext *DeclCtx =
+          E->getLocationContext()->getAnalysisDeclContext();
+      // The source of autosynthesized body can be handcrafted AST or a model
+      // file. The locations from handcrafted ASTs have no valid source
+      // locations and have to be discarded. Locations from model files should
+      // be preserved for processing and reporting.
+      if (DeclCtx->isBodyAutosynthesized() &&
+          !DeclCtx->isBodyAutosynthesizedFromModelFile())
+        return;
+    }
+
+  BugReporter::emitReport(std::move(R));
+}
+
 //===----------------------------------------------------------------------===//
 // Emitting reports in equivalence classes.
 //===----------------------------------------------------------------------===//
 
 namespace {
 
 struct FRIEC_WLItem {
   const ExplodedNode *N;
   ExplodedNode::const_succ_iterator I, E;
 
   FRIEC_WLItem(const ExplodedNode *n)
       : N(n), I(N->succ_begin()), E(N->succ_end()) {}
 };
 
 } // namespace
 
-static BugReport *
-FindReportInEquivalenceClass(BugReportEquivClass& EQ,
-                             SmallVectorImpl<BugReport*> &bugReports) {
+BugReport *PathSensitiveBugReporter::findReportInEquivalenceClass(
+    BugReportEquivClass &EQ, SmallVectorImpl<BugReport *> &bugReports) {
   BugReportEquivClass::iterator I = EQ.begin(), E = EQ.end();
   assert(I != E);
   const BugType& BT = I->getBugType();
 
   // If we don't need to suppress any of the nodes because they are
   // post-dominated by a sink, simply add all the nodes in the equivalence class
   // to 'Nodes'.  Any of the reports will serve as a "representative" report.
   if (!BT.isSuppressOnSink()) {
     BugReport *R = &*I;
     for (auto &I : EQ) {
-      const ExplodedNode *N = I.getErrorNode();
-      if (N) {
-        R = &I;
-        bugReports.push_back(R);
+      if (auto *PR = dyn_cast<PathSensitiveBugReport>(&I)) {
+        R = PR;
+        bugReports.push_back(PR);
       }
     }
     return R;
   }
 
   // For bug reports that should be suppressed when all paths are post-dominated
   // by a sink node, iterate through the reports in the equivalence class
   // until we find one that isn't post-dominated (if one exists).  We use a
   // DFS traversal of the ExplodedGraph to find a non-sink node.  We could write
   // this as a recursive function, but we don't want to risk blowing out the
   // stack for very long paths.
   BugReport *exampleReport = nullptr;
 
   for (; I != E; ++I) {
-    const ExplodedNode *errorNode = I->getErrorNode();
-
-    if (!errorNode)
+    auto *R = dyn_cast<PathSensitiveBugReport>(&*I);
+    if (!R)
       continue;
+
+    const ExplodedNode *errorNode = R->getErrorNode();
     if (errorNode->isSink()) {
       llvm_unreachable(
            "BugType::isSuppressSink() should not be 'true' for sink end nodes");
     }
     // No successors?  By definition this nodes isn't post-dominated by a sink.
     if (errorNode->succ_empty()) {
-      bugReports.push_back(&*I);
+      bugReports.push_back(R);
       if (!exampleReport)
-        exampleReport = &*I;
+        exampleReport = R;
       continue;
     }
 
     // See if we are in a no-return CFG block. If so, treat this similarly
     // to being post-dominated by a sink. This works better when the analysis
     // is incomplete and we have never reached the no-return function call(s)
     // that we'd inevitably bump into on this path.
     if (const CFGBlock *ErrorB = errorNode->getCFGBlock())
while (!WL.empty()) {
       assert(!WI.N->succ_empty());
 
       for (; WI.I != WI.E; ++WI.I) {
         const ExplodedNode *Succ = *WI.I;
         // End-of-path node?
         if (Succ->succ_empty()) {
           // If we found an end-of-path node that is not a sink.
           if (!Succ->isSink()) {
-            bugReports.push_back(&*I);
+            bugReports.push_back(R);
             if (!exampleReport)
-              exampleReport = &*I;
+              exampleReport = R;
             WL.clear();
             break;
           }
           // Found a sink?  Continue on to the next successor.
           continue;
         }
         // Mark the successor as visited.  If it hasn't been explored,
         // enqueue it to the DFS worklist.
BugReport *PathSensitiveBugReporter::findReportInEquivalenceClass(
 
   // ExampleReport will be NULL if all the nodes in the equivalence class
   // were post-dominated by sinks.
   return exampleReport;
 }
 
 void BugReporter::FlushReport(BugReportEquivClass& EQ) {
   SmallVector<BugReport*, 10> bugReports;
-  BugReport *report = FindReportInEquivalenceClass(EQ, bugReports);
+  BugReport *report = findReportInEquivalenceClass(EQ, bugReports);
   if (!report)
     return;
 
   ArrayRef<PathDiagnosticConsumer*> Consumers = getPathDiagnosticConsumers();
   std::unique_ptr<DiagnosticForConsumerMapTy> Diagnostics =
       generateDiagnosticForConsumerMap(report, Consumers, bugReports);
 
   for (auto &P : *Diagnostics) {
     PathDiagnosticConsumer *Consumer = P.first;
     std::unique_ptr<PathDiagnostic> &PD = P.second;
 
     // If the path is empty, generate a single step path with the location
     // of the issue.
     if (PD->path.empty()) {
-      PathDiagnosticLocation L = report->getLocation(getSourceManager());
+      PathDiagnosticLocation L = report->getLocation();
       auto piece = std::make_unique<PathDiagnosticEventPiece>(
         L, report->getDescription());
       for (SourceRange Range : report->getRanges())
         piece->addRange(Range);
       PD->setEndOfPath(std::move(piece));
     }
 
     PathPieces &Pieces = PD->getMutablePieces();
while (N) {
 
     N = N->getFirstPred();
   }
   return ExecutedLines;
 }
 
 std::unique_ptr<DiagnosticForConsumerMapTy>
 BugReporter::generateDiagnosticForConsumerMap(
-    BugReport *report, ArrayRef<PathDiagnosticConsumer *> consumers,
+    BugReport *exampleReport, ArrayRef<PathDiagnosticConsumer *> consumers,
     ArrayRef<BugReport *> bugReports) {
-
-  if (!report->isPathSensitive()) {
-    auto Out = std::make_unique<DiagnosticForConsumerMapTy>();
-    for (auto *Consumer : consumers)
-      (*Out)[Consumer] = generateEmptyDiagnosticForReport(report,
-                                                          getSourceManager());
-    return Out;
-  }
+  auto *basicReport = cast<BasicBugReport>(exampleReport);
+    (*Out)[Consumer] = generateDiagnosticForBasicReport(basicReport);
 
+std::unique_ptr<DiagnosticForConsumerMapTy>
+PathSensitiveBugReporter::generateDiagnosticForConsumerMap(
+    BugReport *exampleReport, ArrayRef<PathDiagnosticConsumer *> consumers,
+    ArrayRef<BugReport *> bugReports) {
+  std::vector<BasicBugReport *> BasicBugReports;
+  std::vector<PathSensitiveBugReport *> PathSensitiveBugReports;
+  if (isa<BasicBugReport>(exampleReport))
+    return BugReporter::generateDiagnosticForConsumerMap(exampleReport,
+                                                         consumers, bugReports);
+
   // Generate the full path sensitive diagnostic, using the generation scheme
   // specified by the PathDiagnosticConsumer. Note that we have to generate
   // path diagnostics even for consumers which do not support paths, because
   // the BugReporterVisitors may mark this bug as a false positive.
   assert(!bugReports.empty());
   MaxBugClassSize.updateMax(bugReports.size());
-  std::unique_ptr<DiagnosticForConsumerMapTy> Out =
-    generatePathDiagnostics(consumers, bugReports);
+
+  // Avoid copying the whole array because there may be a lot of reports.
+  ArrayRef<PathSensitiveBugReport *> convertedArrayOfReports(
+      reinterpret_cast<PathSensitiveBugReport *const *>(&*bugReports.begin()),
+      reinterpret_cast<PathSensitiveBugReport *const *>(&*bugReports.end()));
+  std::unique_ptr<DiagnosticForConsumerMapTy> Out = generatePathDiagnostics(
+      consumers, convertedArrayOfReports);
 
   if (Out->empty())
     return Out;
 
   MaxValidBugClassSize.updateMax(bugReports.size());
 
   // Examine the report and see if the last piece is in a header. Reset the
   // report location to the last piece in the main source file.

 void BugReporter::EmitBasicReport(const Decl *DeclWithIssue,
                                   CheckName CheckName,
                                   StringRef name, StringRef category,
                                   StringRef str, PathDiagnosticLocation Loc,
                                   ArrayRef<SourceRange> Ranges,
                                   ArrayRef<FixItHint> Fixits) {
   // 'BT' is owned by BugReporter.
   BugType *BT = getBugTypeForName(CheckName, name, category);
-  auto R = std::make_unique<BugReport>(*BT, str, Loc);
+  auto R = std::make_unique<BasicBugReport>(*BT, str, Loc);
   R->setDeclWithIssue(DeclWithIssue);
   for (const auto &SR : Ranges)
     R->addRange(SR);
   for (const auto &FH : Fixits)
     R->addFixItHint(FH);
   emitReport(std::move(R));
 }
 

clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

getConcreteIntegerValue(const Expr *CondVarExpr, const ExplodedNode *N) {
   if (Optional<SVal> V = getSValForVar(CondVarExpr, N))
     if (auto CI = V->getAs<nonloc::ConcreteInt>())
       return &CI->getValue();
   return None;
 }
 
 static bool isVarAnInterestingCondition(const Expr *CondVarExpr,
                                         const ExplodedNode *N,
-                                        const BugReport *B) {
+                                        const PathSensitiveBugReport *B) {
   // Even if this condition is marked as interesting, it isn't *that*
   // interesting if it didn't happen in a nested stackframe, the user could just
   // follow the arrows.
   if (!B->getErrorNode()->getStackFrame()->isParentOf(N->getStackFrame()))
     return false;
 
   if (Optional<SVal> V = getSValForVar(CondVarExpr, N))
     if (Optional<bugreporter::TrackingKind> K = B->getInterestingnessKind(*V))
       return *K == bugreporter::TrackingKind::Condition;
 
   return false;
 }
 
 static bool isInterestingExpr(const Expr *E, const ExplodedNode *N,
-                              const BugReport *B) {
+                              const PathSensitiveBugReport *B) {
   if (Optional<SVal> V = getSValForVar(E, N))
     return B->getInterestingnessKind(*V).hasValue();
   return false;
 }
 
 /// \return name of the macro inside the location \p Loc.
 static StringRef getMacroName(SourceLocation Loc,
     BugReporterContext &BRC) {

 }
 
 //===----------------------------------------------------------------------===//
 // Implementation of BugReporterVisitor.
 //===----------------------------------------------------------------------===//
 
 PathDiagnosticPieceRef BugReporterVisitor::getEndPath(BugReporterContext &,
                                                       const ExplodedNode *,
-                                                      BugReport &) {
+                                                      PathSensitiveBugReport &) {
   return nullptr;
 }
 
 void BugReporterVisitor::finalizeVisitor(BugReporterContext &,
-                                         const ExplodedNode *, BugReport &) {}
+                                         const ExplodedNode *,
+                                         PathSensitiveBugReport &) {}
 
 PathDiagnosticPieceRef
 BugReporterVisitor::getDefaultEndPath(const BugReporterContext &BRC,
                                       const ExplodedNode *EndPathNode,
-                                      const BugReport &BR) {
-  PathDiagnosticLocation L = PathDiagnosticLocation::createEndOfPath(
-      EndPathNode, BRC.getSourceManager());
+                                      const PathSensitiveBugReport &BR) {
+  PathDiagnosticLocation L =
+      PathDiagnosticLocation::createEndOfPath(EndPathNode);
 
   const auto &Ranges = BR.getRanges();
 
   // Only add the statement itself as a range if we didn't specify any
   // special ranges for this report.
   auto P = std::make_shared<PathDiagnosticEventPiece>(
       L, BR.getDescription(), Ranges.begin() == Ranges.end());
   for (SourceRange Range : Ranges)
public:
 
   void *getTag() const {
     static int Tag = 0;
     return static_cast<void *>(&Tag);
   }
 
   PathDiagnosticPieceRef VisitNode(const ExplodedNode *N,
                                    BugReporterContext &BR,
-                                   BugReport &R) override;
+                                   PathSensitiveBugReport &R) override;
 
 private:
   /// Attempts to find the region of interest in a given record decl,
   /// by either following the base classes or fields.
   /// Dereferences fields up to a given recursion limit.
   /// Note that \p Vec is passed by value, leading to quadratic copying cost,
   /// but it's OK in practice since its length is limited to DEREFERENCE_LIMIT.
   /// \return A chain fields leading to the region of interest or None.
private:
   /// the path in the current stack frame which modify \c RegionOfInterest.
   void findModifyingFrames(const ExplodedNode *N);
 
   /// Consume the information on the no-store stack frame in order to
   /// either emit a note or suppress the report enirely.
   /// \return Diagnostics piece for region not modified in the current function,
   /// if it decides to emit one.
   PathDiagnosticPieceRef
-  maybeEmitNote(BugReport &R, const CallEvent &Call, const ExplodedNode *N,
-                const RegionVector &FieldChain, const MemRegion *MatchedRegion,
-                StringRef FirstElement, bool FirstIsReferenceType,
-                unsigned IndirectionLevel);
+  maybeEmitNote(PathSensitiveBugReport &R, const CallEvent &Call,
+                const ExplodedNode *N, const RegionVector &FieldChain,
+                const MemRegion *MatchedRegion, StringRef FirstElement,
+                bool FirstIsReferenceType, unsigned IndirectionLevel);
 
   /// Pretty-print region \p MatchedRegion to \p os.
   /// \return Whether printing succeeded.
   bool prettyPrintRegionName(StringRef FirstElement, bool FirstIsReferenceType,
                              const MemRegion *MatchedRegion,
                              const RegionVector &FieldChain,
                              int IndirectionLevel,
                              llvm::raw_svector_ostream &os);
if (const RecordDecl *RRD = PT->getAsRecordDecl())
       if (Optional<RegionVector> Out =
               findRegionOfInterestInRecord(RRD, State, VR, VecF, depth + 1))
         return Out;
   }
 
   return None;
 }
 
-PathDiagnosticPieceRef NoStoreFuncVisitor::VisitNode(const ExplodedNode *N,
-                                                     BugReporterContext &BR,
-                                                     BugReport &R) {
+PathDiagnosticPieceRef
+NoStoreFuncVisitor::VisitNode(const ExplodedNode *N, BugReporterContext &BR,
+                              PathSensitiveBugReport &R) {
 
   const LocationContext *Ctx = N->getLocationContext();
   const StackFrameContext *SCtx = Ctx->getStackFrame();
   ProgramStateRef State = N->getState();
   auto CallExitLoc = N->getLocationAs<CallExitBegin>();
 
   // No diagnostic if region was modified inside the frame.
   if (!CallExitLoc || isRegionOfInterestModifiedInFrame(N))
do {
     N = N->getFirstPred();
   } while (N);
 }
 
 static llvm::StringLiteral WillBeUsedForACondition =
     ", which participates in a condition later";
 
 PathDiagnosticPieceRef NoStoreFuncVisitor::maybeEmitNote(
-    BugReport &R, const CallEvent &Call, const ExplodedNode *N,
+    PathSensitiveBugReport &R, const CallEvent &Call, const ExplodedNode *N,
     const RegionVector &FieldChain, const MemRegion *MatchedRegion,
     StringRef FirstElement, bool FirstIsReferenceType,
     unsigned IndirectionLevel) {
   // Optimistically suppress uninitialized value bugs that result
   // from system headers having a chance to initialize the value
   // but failing to do so. It's too unlikely a system header's fault.
   // It's much more likely a situation in which the function has a failure
   // mode that the user decided not to check. If we want to hunt such
class MacroNullReturnSuppressionVisitor final : public BugReporterVisitor {
   bool WasModified = false;
 
 public:
   MacroNullReturnSuppressionVisitor(const SubRegion *R, const SVal V)
       : RegionOfInterest(R), ValueAtDereference(V) {}
 
   PathDiagnosticPieceRef VisitNode(const ExplodedNode *N,
                                    BugReporterContext &BRC,
-                                   BugReport &BR) override {
+                                   PathSensitiveBugReport &BR) override {
     if (WasModified)
       return nullptr;
 
     auto BugPoint = BR.getErrorNode()->getLocation().getAs<StmtPoint>();
     if (!BugPoint)
       return nullptr;
 
     const SourceManager &SMgr = BRC.getSourceManager();
PathDiagnosticPieceRef VisitNode(const ExplodedNode *N,
     if (wasRegionOfInterestModifiedAt(RegionOfInterest, N, ValueAtDereference))
       WasModified = true;
 
     return nullptr;
   }
 
   static void addMacroVisitorIfNecessary(
         const ExplodedNode *N, const MemRegion *R,
-        bool EnableNullFPSuppression, BugReport &BR,
+        bool EnableNullFPSuppression, PathSensitiveBugReport &BR,
         const SVal V) {
     AnalyzerOptions &Options = N->getState()->getAnalysisManager().options;
     if (EnableNullFPSuppression &&
         Options.ShouldSuppressNullReturnPaths && V.getAs<Loc>())
       BR.addVisitor(std::make_unique<MacroNullReturnSuppressionVisitor>(
               R->getAs<SubRegion>(), V));
   }
 
public:
   /// Adds a ReturnVisitor if the given statement represents a call that was
   /// inlined.
   ///
   /// This will search back through the ExplodedGraph, starting from the given
   /// node, looking for when the given statement was processed. If it turns out
   /// the statement is a call that was inlined, we add the visitor to the
   /// bug report, so it can print a note later.
   static void addVisitorIfNecessary(const ExplodedNode *Node, const Stmt *S,
-                                    BugReport &BR,
+                                    PathSensitiveBugReport &BR,
                                     bool InEnableNullFPSuppression,
                                     bugreporter::TrackingKind TKind) {
     if (!CallEvent::isCallStmt(S))
       return;
 
     // First, find when we processed the statement.
     // If we work with a 'CXXNewExpr' that is going to be purged away before
     // its call take place. We would catch that purge in the last condition
static void addVisitorIfNecessary(const ExplodedNode *Node, const Stmt *S,
 
     BR.addVisitor(std::make_unique<ReturnVisitor>(CalleeContext,
                                                    EnableNullFPSuppression,
                                                    Options, TKind));
   }
 
   PathDiagnosticPieceRef visitNodeInitial(const ExplodedNode *N,
                                           BugReporterContext &BRC,
-                                          BugReport &BR) {
+                                          PathSensitiveBugReport &BR) {
     // Only print a message at the interesting return statement.
     if (N->getLocationContext() != CalleeSFC)
       return nullptr;
 
     Optional<StmtPoint> SP = N->getLocationAs<StmtPoint>();
     if (!SP)
       return nullptr;
 
PathDiagnosticPieceRef visitNodeInitial(const ExplodedNode *N,
     else
       BR.markInteresting(CalleeSFC);
 
     return EventPiece;
   }
 
   PathDiagnosticPieceRef visitNodeMaybeUnsuppress(const ExplodedNode *N,
                                                   BugReporterContext &BRC,
-                                                  BugReport &BR) {
-#ifndef NDEBUG
+                                                  PathSensitiveBugReport &BR) {
     assert(Options.ShouldAvoidSuppressingNullArgumentPaths);
-#endif
 
     // Are we at the entry node for this call?
     Optional<CallEnter> CE = N->getLocationAs<CallEnter>();
     if (!CE)
       return nullptr;
 
     if (CE->getCalleeContext() != CalleeSFC)
       return nullptr;
for (unsigned I = 0, E = Call->getNumArgs(); I != E; ++I) {
       // (We will still look at the other arguments, though.)
     }
 
     return nullptr;
   }
 
   PathDiagnosticPieceRef VisitNode(const ExplodedNode *N,
                                    BugReporterContext &BRC,
-                                   BugReport &BR) override {
+                                   PathSensitiveBugReport &BR) override {
     switch (Mode) {
     case Initial:
       return visitNodeInitial(N, BRC, BR);
     case MaybeUnsuppress:
       return visitNodeMaybeUnsuppress(N, BRC, BR);
     case Satisfied:
       return nullptr;
     }
 
     llvm_unreachable("Invalid visit mode!");
   }
 
   void finalizeVisitor(BugReporterContext &, const ExplodedNode *,
-                       BugReport &BR) override {
+                       PathSensitiveBugReport &BR) override {
     if (EnableNullFPSuppression && ShouldInvalidate)
       BR.markInvalid(ReturnVisitor::getTag(), CalleeSFC);
   }
 };
 
 } // end of anonymous namespace
 
 //===----------------------------------------------------------------------===//
static void showBRParamDiagnostics(llvm::raw_svector_ostream& os,
   os << " via " << Idx << llvm::getOrdinalSuffix(Idx) << " parameter";
   if (VR->canPrintPretty()) {
     os << " ";
     VR->printPretty(os);
   }
 }
 
 /// Show default diagnostics for storing bad region.
-static void showBRDefaultDiagnostics(llvm::raw_svector_ostream& os,
-    const MemRegion *R,
-    SVal V) {
+static void showBRDefaultDiagnostics(llvm::raw_svector_ostream &os,
+                                     const MemRegion *R, SVal V) {
   if (V.getAs<loc::ConcreteInt>()) {
     bool b = false;
     if (R->isBoundable()) {
       if (const auto *TR = dyn_cast<TypedValueRegion>(R)) {
         if (TR->getValueType()->isObjCObjectPointerType()) {
           os << "nil object reference stored";
           b = true;
         }
static void showBRDefaultDiagnostics(llvm::raw_svector_ostream &os,
   if (R->canPrintPretty()) {
     os << " to ";
     R->printPretty(os);
   }
 }
 
 PathDiagnosticPieceRef
 FindLastStoreBRVisitor::VisitNode(const ExplodedNode *Succ,
-                                  BugReporterContext &BRC, BugReport &BR) {
+                                  BugReporterContext &BRC,
+                                  PathSensitiveBugReport &BR) {
   if (Satisfied)
     return nullptr;
 
   const ExplodedNode *StoreSite = nullptr;
   const ExplodedNode *Pred = Succ->getFirstPred();
   const Expr *InitE = nullptr;
   bool IsParam = false;
 

 }
 
 bool TrackConstraintBRVisitor::isUnderconstrained(const ExplodedNode *N) const {
   if (IsZeroCheck)
     return N->getState()->isNull(Constraint).isUnderconstrained();
   return (bool)N->getState()->assume(Constraint, !Assumption);
 }
 
-PathDiagnosticPieceRef
-TrackConstraintBRVisitor::VisitNode(const ExplodedNode *N,
-                                    BugReporterContext &BRC, BugReport &) {
+PathDiagnosticPieceRef TrackConstraintBRVisitor::VisitNode(
+    const ExplodedNode *N, BugReporterContext &BRC, PathSensitiveBugReport &) {
   const ExplodedNode *PrevN = N->getFirstPred();
   if (IsSatisfied)
     return nullptr;
 
   // Start tracking after we see the first state in which the value is
   // constrained.
   if (!IsTrackingTurnedOn)
     if (!isUnderconstrained(N))
void SuppressInlineDefensiveChecksVisitor::Profile(
   ID.AddPointer(&id);
   ID.Add(V);
 }
 
 const char *SuppressInlineDefensiveChecksVisitor::getTag() {
   return "IDCVisitor";
 }
 
-PathDiagnosticPieceRef SuppressInlineDefensiveChecksVisitor::VisitNode(
-    const ExplodedNode *Succ, BugReporterContext &BRC, BugReport &BR) {
+PathDiagnosticPieceRef
+SuppressInlineDefensiveChecksVisitor::VisitNode(const ExplodedNode *Succ,
+                                                BugReporterContext &BRC,
+                                                PathSensitiveBugReport &BR) {
   const ExplodedNode *Pred = Succ->getFirstPred();
   if (IsSatisfied)
     return nullptr;
 
   // Start tracking after we see the first state in which the value is null.
   if (!IsTrackingTurnedOn)
     if (Succ->getState()->isNull(V).isConstrainedTrue())
       IsTrackingTurnedOn = true;
public:
 
   void Profile(llvm::FoldingSetNodeID &ID) const override {
     static int x = 0;
     ID.AddPointer(&x);
   }
 
   PathDiagnosticPieceRef VisitNode(const ExplodedNode *N,
                                    BugReporterContext &BRC,
-                                   BugReport &BR) override;
+                                   PathSensitiveBugReport &BR) override;
 };
 } // end of anonymous namespace
 
 static std::shared_ptr<PathDiagnosticEventPiece>
 constructDebugPieceForTrackedCondition(const Expr *Cond,
                                        const ExplodedNode *N,
                                        BugReporterContext &BRC) {
 
static bool isAssertlikeBlock(const CFGBlock *B, ASTContext &Context) {
   if (const Stmt *ElseCond = Else->getTerminatorCondition())
     if (const auto *BinOp = dyn_cast<BinaryOperator>(ElseCond))
       if (BinOp->isLogicalOp())
         return isAssertlikeBlock(Else, Context);
 
   return false;
 }
 
-PathDiagnosticPieceRef TrackControlDependencyCondBRVisitor::VisitNode(
-    const ExplodedNode *N, BugReporterContext &BRC, BugReport &BR) {
+PathDiagnosticPieceRef
+TrackControlDependencyCondBRVisitor::VisitNode(const ExplodedNode *N,
+                                               BugReporterContext &BRC,
+                                               PathSensitiveBugReport &BR) {
   // We can only reason about control dependencies within the same stack frame.
   if (Origin->getStackFrame() != N->getStackFrame())
     return nullptr;
 
   CFGBlock *NB = const_cast<CFGBlock *>(N->getCFGBlock());
 
   // Skip if we already inspected this block.
   if (!VisitedBlocks.insert(NB).second)
while (N) {
     if (PathDiagnosticLocation::getStmt(N) == Inner)
       return N;
     N = N->getFirstPred();
   }
   return N;
 }
 
 bool bugreporter::trackExpressionValue(const ExplodedNode *InputNode,
-                                       const Expr *E, BugReport &report,
+                                       const Expr *E,
+                                       PathSensitiveBugReport &report,
                                        bugreporter::TrackingKind TKind,
                                        bool EnableNullFPSuppression) {
 
   if (!E || !InputNode)
     return false;
 
   const Expr *Inner = peelOffOuterExpr(E, InputNode);
   const ExplodedNode *LVNode = findNodeForExpression(InputNode, Inner);
if (const Expr *Receiver = ME->getInstanceReceiver()) {
     ProgramStateRef state = N->getState();
     SVal V = N->getSVal(Receiver);
     if (state->isNull(V).isConstrainedTrue())
       return Receiver;
   }
   return nullptr;
 }
 
-PathDiagnosticPieceRef NilReceiverBRVisitor::VisitNode(const ExplodedNode *N,
-                                                       BugReporterContext &BRC,
-                                                       BugReport &BR) {
+PathDiagnosticPieceRef
+NilReceiverBRVisitor::VisitNode(const ExplodedNode *N, BugReporterContext &BRC,
+                                PathSensitiveBugReport &BR) {
   Optional<PreStmt> P = N->getLocationAs<PreStmt>();
   if (!P)
     return nullptr;
 
   const Stmt *S = P->getStmt();
   const Expr *Receiver = getNilReceiver(S, N);
   if (!Receiver)
     return nullptr;

 //===----------------------------------------------------------------------===//
 // Visitor that tries to report interesting diagnostics from conditions.
 //===----------------------------------------------------------------------===//
 
 /// Return the tag associated with this visitor.  This tag will be used
 /// to make all PathDiagnosticPieces created by this visitor.
 const char *ConditionBRVisitor::getTag() { return "ConditionBRVisitor"; }
 
-PathDiagnosticPieceRef ConditionBRVisitor::VisitNode(const ExplodedNode *N,
-                                                     BugReporterContext &BRC,
-                                                     BugReport &BR) {
+PathDiagnosticPieceRef
+ConditionBRVisitor::VisitNode(const ExplodedNode *N, BugReporterContext &BRC,
+                              PathSensitiveBugReport &BR) {
   auto piece = VisitNodeImpl(N, BRC, BR);
   if (piece) {
     piece->setTag(getTag());
     if (auto *ev = dyn_cast<PathDiagnosticEventPiece>(piece.get()))
       ev->setPrunable(true, /* override */ false);
   }
   return piece;
 }
 
 PathDiagnosticPieceRef
 ConditionBRVisitor::VisitNodeImpl(const ExplodedNode *N,
-                                  BugReporterContext &BRC, BugReport &BR) {
+                                  BugReporterContext &BRC,
+                                  PathSensitiveBugReport &BR) {
   ProgramPoint ProgPoint = N->getLocation();
   const std::pair<const ProgramPointTag *, const ProgramPointTag *> &Tags =
       ExprEngine::geteagerlyAssumeBinOpBifurcationTags();
 
   // If an assumption was made on a branch, it should be caught
   // here by looking at the state transition.
   if (Optional<BlockEdge> BE = ProgPoint.getAs<BlockEdge>()) {
     const CFGBlock *SrcBlock = BE->getSrc();
if (Optional<PostStmt> PS = ProgPoint.getAs<PostStmt>()) {
     return VisitTrueTest(cast<Expr>(PS->getStmt()), BRC, BR, N, TookTrue);
   }
 
   return nullptr;
 }
 
 PathDiagnosticPieceRef ConditionBRVisitor::VisitTerminator(
     const Stmt *Term, const ExplodedNode *N, const CFGBlock *srcBlk,
-    const CFGBlock *dstBlk, BugReport &R, BugReporterContext &BRC) {
+    const CFGBlock *dstBlk, PathSensitiveBugReport &R,
+    BugReporterContext &BRC) {
   const Expr *Cond = nullptr;
 
   // In the code below, Term is a CFG terminator and Cond is a branch condition
   // expression upon which the decision is made on this terminator.
   //
   // For example, in "if (x == 0)", the "if (x == 0)" statement is a terminator,
   // and "x == 0" is the respective condition.
   //
PathDiagnosticPieceRef ConditionBRVisitor::VisitTerminator(
   assert(Cond);
   assert(srcBlk->succ_size() == 2);
   const bool TookTrue = *(srcBlk->succ_begin()) == dstBlk;
   return VisitTrueTest(Cond, BRC, R, N, TookTrue);
 }
 
 PathDiagnosticPieceRef
 ConditionBRVisitor::VisitTrueTest(const Expr *Cond, BugReporterContext &BRC,
-                                  BugReport &R, const ExplodedNode *N,
-                                  bool TookTrue) {
+                                  PathSensitiveBugReport &R,
+                                  const ExplodedNode *N, bool TookTrue) {
   ProgramStateRef CurrentState = N->getState();
   ProgramStateRef PrevState = N->getFirstPred()->getState();
   const LocationContext *LCtx = N->getLocationContext();
 
   // If the constraint information is changed between the current and the
   // previous program state we assuming the newly seen constraint information.
   // If we cannot evaluate the condition (and the constraints are the same)
   // the analyzer has no information about the value and just assuming it.
ConditionBRVisitor::VisitTrueTest(const Expr *Cond, BugReporterContext &BRC,
   return std::make_shared<PathDiagnosticEventPiece>(
       Loc, TookTrue ? GenericTrueMessage : GenericFalseMessage);
 }
 
 bool ConditionBRVisitor::patternMatch(const Expr *Ex,
                                       const Expr *ParentEx,
                                       raw_ostream &Out,
                                       BugReporterContext &BRC,
-                                      BugReport &report,
+                                      PathSensitiveBugReport &report,
                                       const ExplodedNode *N,
                                       Optional<bool> &prunable,
                                       bool IsSameFieldName) {
   const Expr *OriginalExpr = Ex;
   Ex = Ex->IgnoreParenCasts();
 
   if (isa<GNUNullExpr>(Ex) || isa<ObjCBoolLiteralExpr>(Ex) ||
       isa<CXXBoolLiteralExpr>(Ex) || isa<IntegerLiteral>(Ex) ||
else
           << '\'';
   }
 
   return false;
 }
 
 PathDiagnosticPieceRef ConditionBRVisitor::VisitTrueTest(
     const Expr *Cond, const BinaryOperator *BExpr, BugReporterContext &BRC,
-    BugReport &R, const ExplodedNode *N, bool TookTrue, bool IsAssuming) {
+    PathSensitiveBugReport &R, const ExplodedNode *N, bool TookTrue,
+    bool IsAssuming) {
   bool shouldInvert = false;
   Optional<bool> shouldPrune;
 
   // Check if the field name of the MemberExprs is ambiguous. Example:
   // " 'a.d' is equal to 'h.d' " in 'test/Analysis/null-deref-path-notes.cpp'.
   bool IsSameFieldName = false;
   const auto *LhsME = dyn_cast<MemberExpr>(BExpr->getLHS()->IgnoreParenCasts());
   const auto *RhsME = dyn_cast<MemberExpr>(BExpr->getRHS()->IgnoreParenCasts());
PathDiagnosticPieceRef ConditionBRVisitor::VisitTrueTest(
   auto event = std::make_shared<PathDiagnosticEventPiece>(Loc, Message);
   if (shouldPrune.hasValue())
     event->setPrunable(shouldPrune.getValue());
   return event;
 }
 
 PathDiagnosticPieceRef ConditionBRVisitor::VisitConditionVariable(
     StringRef LhsString, const Expr *CondVarExpr, BugReporterContext &BRC,
-    BugReport &report, const ExplodedNode *N, bool TookTrue) {
+    PathSensitiveBugReport &report, const ExplodedNode *N, bool TookTrue) {
   // FIXME: If there's already a constraint tracker for this variable,
   // we shouldn't emit anything here (c.f. the double note in
   // test/Analysis/inlining/path-notes.c)
   SmallString<256> buf;
   llvm::raw_svector_ostream Out(buf);
   Out << "Assuming " << LhsString << " is ";
 
   if (!printValue(CondVarExpr, Out, N, TookTrue, /*IsAssuming=*/true))
PathDiagnosticPieceRef ConditionBRVisitor::VisitConditionVariable(
   if (isInterestingExpr(CondVarExpr, N, &report))
     event->setPrunable(false);
 
   return event;
 }
 
 PathDiagnosticPieceRef ConditionBRVisitor::VisitTrueTest(
     const Expr *Cond, const DeclRefExpr *DRE, BugReporterContext &BRC,
-    BugReport &report, const ExplodedNode *N, bool TookTrue, bool IsAssuming) {
+    PathSensitiveBugReport &report, const ExplodedNode *N, bool TookTrue,
+    bool IsAssuming) {
   const auto *VD = dyn_cast<VarDecl>(DRE->getDecl());
   if (!VD)
     return nullptr;
 
   SmallString<256> Buf;
   llvm::raw_svector_ostream Out(Buf);
 
   Out << (IsAssuming ? "Assuming '" : "'") << VD->getDeclName() << "' is ";
PathDiagnosticPieceRef ConditionBRVisitor::VisitTrueTest(
   if (isInterestingExpr(DRE, N, &report))
     event->setPrunable(false);
 
   return std::move(event);
 }
 
 PathDiagnosticPieceRef ConditionBRVisitor::VisitTrueTest(
     const Expr *Cond, const MemberExpr *ME, BugReporterContext &BRC,
-    BugReport &report, const ExplodedNode *N, bool TookTrue, bool IsAssuming) {
+    PathSensitiveBugReport &report, const ExplodedNode *N, bool TookTrue,
+    bool IsAssuming) {
   SmallString<256> Buf;
   llvm::raw_svector_ostream Out(Buf);
 
   Out << (IsAssuming ? "Assuming field '" : "Field '")
       << ME->getMemberDecl()->getName() << "' is ";
 
   if (!printValue(ME, Out, N, TookTrue, IsAssuming))
     return nullptr;
return Piece->getString() == GenericTrueMessage ||
          Piece->getString() == GenericFalseMessage;
 }
 
 //===----------------------------------------------------------------------===//
 // Implementation of LikelyFalsePositiveSuppressionBRVisitor.
 //===----------------------------------------------------------------------===//
 
 void LikelyFalsePositiveSuppressionBRVisitor::finalizeVisitor(
-    BugReporterContext &BRC, const ExplodedNode *N, BugReport &BR) {
+    BugReporterContext &BRC, const ExplodedNode *N,
+    PathSensitiveBugReport &BR) {
   // Here we suppress false positives coming from system headers. This list is
   // based on known issues.
   const AnalyzerOptions &Options = BRC.getAnalyzerOptions();
   const Decl *D = N->getLocationContext()->getDecl();
 
   if (AnalysisDeclContext::isInStdNamespace(D)) {
     // Skip reports within the 'std' namespace. Although these can sometimes be
     // the user's fault, we currently don't report them very well, and
if (Options.ShouldSuppressFromCXXStandardLibrary) {
         }
       }
     }
   }
 
   // Skip reports within the sys/queue.h macros as we do not have the ability to
   // reason about data structure shapes.
   const SourceManager &SM = BRC.getSourceManager();
-  FullSourceLoc Loc = BR.getLocation(SM).asLocation();
+  FullSourceLoc Loc = BR.getLocation().asLocation();
   while (Loc.isMacroID()) {
     Loc = Loc.getSpellingLoc();
     if (SM.getFilename(Loc).endswith("sys/queue.h")) {
       BR.markInvalid(getTag(), nullptr);
       return;
     }
   }
 }
 
 //===----------------------------------------------------------------------===//
 // Implementation of UndefOrNullArgVisitor.
 //===----------------------------------------------------------------------===//
 
-PathDiagnosticPieceRef UndefOrNullArgVisitor::VisitNode(const ExplodedNode *N,
-                                                        BugReporterContext &BRC,
-                                                        BugReport &BR) {
+PathDiagnosticPieceRef
+UndefOrNullArgVisitor::VisitNode(const ExplodedNode *N, BugReporterContext &BRC,
+                                 PathSensitiveBugReport &BR) {
   ProgramStateRef State = N->getState();
   ProgramPoint ProgLoc = N->getLocation();
 
   // We are only interested in visiting CallEnter nodes.
   Optional<CallEnter> CEnter = ProgLoc.getAs<CallEnter>();
   if (!CEnter)
     return nullptr;
 

 //===----------------------------------------------------------------------===//
 // Implementation of FalsePositiveRefutationBRVisitor.
 //===----------------------------------------------------------------------===//
 
 FalsePositiveRefutationBRVisitor::FalsePositiveRefutationBRVisitor()
     : Constraints(ConstraintRangeTy::Factory().getEmptyMap()) {}
 
 void FalsePositiveRefutationBRVisitor::finalizeVisitor(
-    BugReporterContext &BRC, const ExplodedNode *EndPathNode, BugReport &BR) {
+    BugReporterContext &BRC, const ExplodedNode *EndPathNode,
+    PathSensitiveBugReport &BR) {
   // Collect new constraints
   VisitNode(EndPathNode, BRC, BR);
 
   // Create a refutation manager
   llvm::SMTSolverRef RefutationSolver = llvm::CreateZ3Solver();
   ASTContext &Ctx = BRC.getASTContext();
 
   // Add constraints to the solver
void FalsePositiveRefutationBRVisitor::finalizeVisitor(
   Optional<bool> isSat = RefutationSolver->check();
   if (!isSat.hasValue())
     return;
 
   if (!isSat.getValue())
     BR.markInvalid("Infeasible constraints", EndPathNode->getLocationContext());
 }
 
-PathDiagnosticPieceRef
-FalsePositiveRefutationBRVisitor::VisitNode(const ExplodedNode *N,
-                                            BugReporterContext &, BugReport &) {
+PathDiagnosticPieceRef FalsePositiveRefutationBRVisitor::VisitNode(
+    const ExplodedNode *N, BugReporterContext &, PathSensitiveBugReport &) {
   // Collect new constraints
   const ConstraintRangeTy &NewCs = N->getState()->get<ConstraintRange>();
   ConstraintRangeTy::Factory &CF =
       N->getState()->get_context<ConstraintRange>();
 
   // Add constraints if we don't have them yet
   for (auto const &C : NewCs) {
     const SymbolRef &Sym = C.first;

 
 void TagVisitor::Profile(llvm::FoldingSetNodeID &ID) const {
   static int Tag = 0;
   ID.AddPointer(&Tag);
 }
 
 PathDiagnosticPieceRef TagVisitor::VisitNode(const ExplodedNode *N,
                                              BugReporterContext &BRC,
-                                             BugReport &R) {
+                                             PathSensitiveBugReport &R) {
   ProgramPoint PP = N->getLocation();
   const NoteTag *T = dyn_cast_or_null<NoteTag>(PP.getTag());
   if (!T)
     return nullptr;
 
   if (Optional<std::string> Msg = T->generateMessage(BRC, R)) {
     PathDiagnosticLocation Loc =
         PathDiagnosticLocation::create(PP, BRC.getSourceManager());
     auto Piece = std::make_shared<PathDiagnosticEventPiece>(Loc, *Msg);
     Piece->setPrunable(T->isPrunable());
     return Piece;
   }
 
   return nullptr;
 }

clang/lib/StaticAnalyzer/Core/ExprEngine.cpp

struct DOTGraphTraits<ExplodedGraph*> : public DefaultDOTGraphTraits {
   static bool nodeHasBugReport(const ExplodedNode *N) {
     BugReporter &BR = static_cast<ExprEngine &>(
       N->getState()->getStateManager().getOwningEngine()).getBugReporter();
 
     const auto EQClasses =
         llvm::make_range(BR.EQClasses_begin(), BR.EQClasses_end());
 
     for (const auto &EQ : EQClasses) {
-      for (const BugReport &Report : EQ) {
-        if (Report.getErrorNode()->getState() == N->getState() &&
-            Report.getErrorNode()->getLocation() == N->getLocation())
+      for (const BugReport &R : EQ) {
+        const auto *PR = dyn_cast<PathSensitiveBugReport>(&R);
+        if (!PR)
+          continue;
+        const ExplodedNode *EN = PR->getErrorNode();
+        if (EN->getState() == N->getState() &&
+            EN->getLocation() == N->getLocation())
           return true;
       }
     }
     return false;
   }
 
   /// \p PreCallback: callback before break.
   /// \p PostCallback: callback after break.

 std::string ExprEngine::DumpGraph(bool trim, StringRef Filename) {
 #ifndef NDEBUG
   if (trim) {
     std::vector<const ExplodedNode *> Src;
 
     // Iterate through the reports and get their nodes.
     for (BugReporter::EQClasses_iterator
            EI = BR.EQClasses_begin(), EE = BR.EQClasses_end(); EI != EE; ++EI) {
-      const auto *N = const_cast<ExplodedNode *>(EI->begin()->getErrorNode());
-      if (N) Src.push_back(N);
+      const auto *R = dyn_cast<PathSensitiveBugReport>(&*EI->begin());
+      if (!R)
+        continue;
+      const auto *N = const_cast<ExplodedNode *>(R->getErrorNode());
+      Src.push_back(N);
     }
     return DumpGraph(Src, Filename);
   } else {
     return llvm::WriteGraph(&G, "ExprEngine", /*ShortNames=*/false,
                      /*Title=*/"Exploded Graph", /*Filename=*/Filename);
   }
 #endif
   llvm::errs() << "Warning: dumping graph requires assertions" << "\n";

clang/lib/StaticAnalyzer/Core/PathDiagnostic.cpp

if (const Stmt *S = getStmt(N)) {
       return S;
     }
   }
 
   return nullptr;
 }
 
 PathDiagnosticLocation
-  PathDiagnosticLocation::createEndOfPath(const ExplodedNode *N,
-                                          const SourceManager &SM) {
+PathDiagnosticLocation::createEndOfPath(const ExplodedNode *N) {
   assert(N && "Cannot create a location with a null node.");
   const Stmt *S = getStmt(N);
   const LocationContext *LC = N->getLocationContext();
+  SourceManager &SM =
+      N->getState()->getStateManager().getContext().getSourceManager();
 
   if (!S) {
     // If this is an implicit call, return the implicit call point location.
     if (Optional<PreImplicitCall> PIE = N->getLocationAs<PreImplicitCall>())
       return PathDiagnosticLocation(PIE->getLocation(), SM);
     if (auto FE = N->getLocationAs<FunctionExitPoint>()) {
       if (const ReturnStmt *RS = FE->getStmt())
         return PathDiagnosticLocation::createBegin(RS, SM, LC);