[analyzer] MemoryBlockRegion: Generalize AllocaRegion

[Charusso]

Summary

This patch generalizes the AllocaRegion to store metadata about the
expression of the allocation of a memory block. This information could be
used to apply fix-its to the size expression of the allocation when the
buffer would overflow.

[NoQ]

This patch generalizes the AllocaRegion to store metadata about the expression of the allocation of a memory block.

Mmm, but you can easily obtain that expression from the existing AllocaRegion. I.e., you can obtain the expression on which the memory was allocated, which is an invocation of alloca(). You can always inspect this CallExpr to extract the size argument or the callee declaration, there's no need to store them separately.

Generally, there's no need to add more information to MemRegion and SymExpr objects unless you want to discriminate between different regions/symbols that are currently treated as equal regions/symbols (cf. D21978). If the information is not part of region's/symbol's identity, it shouldn't be their field. You can attach this information to them in a state trait if necessary.

Extent is definitely an example of such information. It's currently implemented via range constraints over SymbolExtent, but i'd much rather have extents implemented as a REGISTER_MAP_WITH_PROGRAMSTATE(Extent, const MemRegion *, SVal) and scrap the virtual methods.

This information could be used to apply fix-its to the size expression of the allocation when the buffer would overflow.

Even if AllocaRegion didn't store the expression, any path-sensitive checker for which such region is "interesting" would have to implement a bug visitor to display the allocation site. Such visitor automatically knows the location of the alloca() expression and can emit the necessary fixits.

clang/test/Analysis/pr22954.c

628

See the other part of the FIXME: But not on the previous line! The symbol is not yet dead on line 628; i specifically left this comment around because this test often gets "fixed" incorrectly.

[Charusso]

Thanks for the notes!

In D68725#1722136, @NoQ wrote:

Generally, there's no need to add more information to MemRegion and SymExpr objects [...]

Well, that was my first idea, then I saw we allow helper-methods inside regions. getExtent() has been deprecated on my side.

Even if AllocaRegion didn't store the expression, any path-sensitive checker for which such region is "interesting" would have to implement a bug visitor to display the allocation site. Such visitor automatically knows the location of the alloca() expression and can emit the necessary fixits.

I would create two type of MemoryBlockRegions, one for expressions: malloc(), one for declarations: std::string str. The rational behind the latter to make CStringChecker as simply StringChecker, with modelling the concept: str.size() is the dynamic size behind VarRegion(str). My idea here to make it similar to getDynamicTypeInfo so I can obtain the allocated memory block's capacity, element count, used size easily in every checker. This information could simplify MallocChecker a lot, because the allocated size of memory could serve the allocation state. The "used size" is heuristically modeled in CStringChecker, so it could be simplified, and my new checker would be interested in the element-count only. Also I am thinking of the InnerBufferChecker could connect to a MemoryBlockRegion as all the views abstracts a block of memory.

This new model is basically a new middle-layer in the hierarchy, for example: std::string str -> VarRegion(str) has a memory block behind the scenes, which belongs to the generic heap. This means, I cannot introduce a new type of MemSpaceRegion, as a memory block is a subset of memory space. Both the Decl and Expr based regions produce dynamically changing stuff, that is why I would use the concept of AllocaRegion with an Expr or a Decl of the allocation as a known identifier.

I cannot write that down: str.size() == getDynamicSize(str) or char *cstr; strlen(cstr) == getDynamicSize(cstr), where the VarRegion being a pointer to the data has a size of a pointer, but I am interested in the block of memory it points to. So, even I could remove the entire AllocaRegion, I think it is great to distinguish between a pointer and a block of memory. Also this entire dynamic-size business would be based on MemoryBlockRegions, which I believe a good way to isolate a new concept with creating new types of regions, and not to stress the current model.

I have mixed feelings how would we model a string, and connect it with the current model. I think that would be neat to express like that:
malloc(str.size() + 1) == MemoryBlockExprRegion(getDynamicSize(MemoryBlockDeclRegion(VarRegion(str))) + 1), I believe.

Here is an example why I am interested in strings. Here is a function from LevelDB which does not inject the null-terminator:
(https://github.com/google/leveldb/blob/master/db/c.cc)

static char* CopyString(const std::string& str) {
  char* result = reinterpret_cast<char*>(malloc(sizeof(char) * str.size()));
  memcpy(result, str.data(), sizeof(char) * str.size());
  return result;
}

The proper way to copy a string is:

static char* CopyString(const std::string& str) {
  char* result = reinterpret_cast<char*>(malloc(str.size() + 1));
  strcpy(result, str.data());
  return result;
}

Also, this would be the first step to handle everything in the string.c test file, which is not the goal. The goal is the size of a memory block.

clang/test/Analysis/pr22954.c

628

Well, this is not on the previous line, but I will mark this as unresolved then. In my mind with that new concept we see that we have an eternal block of memory, which we needs to explicitly free().

[NoQ]

In D68725#1724213, @Charusso wrote:

In D68725#1722136, @NoQ wrote:

Even if AllocaRegion didn't store the expression, any path-sensitive checker for which such region is "interesting" would have to implement a bug visitor to display the allocation site. Such visitor automatically knows the location of the alloca() expression and can emit the necessary fixits.

The rational behind the latter to make CStringChecker as simply StringChecker, with modelling the concept: str.size() is the dynamic size behind VarRegion(str).

We already have SymbolMetadata for that purpose. If you want, you can model the inner buffer of a std::string as a SymbolMetadata of type char * associated with the region of the std::string; in this case the string's capacity is the extend of the symbolic region associated with SymbolMetadata and the string's length is CStringChecker's existing SymbolMetadata of type size_t associated with the same symbolic region.

I don't particularly love SymbolMetadata because i believe it should be associated with symbols rather than with regions-and-points (eg., introduce a symbolic identity for the std::string that gets preserved on copies and associate SymbolMetadata with that identity).

But i believe that we already have enough concepts and tools here, there's no need to introduce more of them.

[Charusso]

In D68725#1726332, @NoQ wrote:

But i believe that we already have enough concepts and tools here, there's no need to introduce more of them.

[Charusso]

In D68725#1726332, @NoQ wrote:

I don't particularly love SymbolMetadata because i believe it should be associated with symbols [...]

That is why I secretly wanted to get rid of that concept, but I am fine with using a generic size map.

clang/include/clang/Analysis/AnalysisDeclContext.h

 
 public:
   ~StackFrameContext() override = default;
 
   const Stmt *getCallSite() const { return CallSite; }
 
   const CFGBlock *getCallSiteBlock() const { return Block; }
 
-  /// Return true if the current LocationContext has no caller context.
-  bool inTopFrame() const override { return getParent() == nullptr;  }
+  unsigned getBlockCount() const { return BlockCount; }
 
   unsigned getIndex() const { return Index; }
 
+  /// Return true if the current LocationContext has no caller context.
+  bool inTopFrame() const override { return getParent() == nullptr; }
+
   void Profile(llvm::FoldingSetNodeID &ID) override;
 
   static void Profile(llvm::FoldingSetNodeID &ID, AnalysisDeclContext *ctx,
                       const LocationContext *parent, const Stmt *s,
                       const CFGBlock *blk, unsigned blockCount, unsigned idx) {
     ProfileCommon(ID, StackFrame, ctx, parent, s);
     ID.AddPointer(blk);
     ID.AddInteger(blockCount);

clang/include/clang/StaticAnalyzer/Checkers/SValExplainer.h

if (R->getSymbol()->getType()
             .getCanonicalType()->getAs<ObjCObjectPointerType>())
       return "object at " + Visit(R->getSymbol());
     // Other heap-based symbolic regions are also special.
     if (isa<HeapSpaceRegion>(R->getMemorySpace()))
       return "heap segment that starts at " + Visit(R->getSymbol());
     return "pointee of " + Visit(R->getSymbol());
   }
 
-  std::string VisitAllocaRegion(const AllocaRegion *R) {
-    return "region allocated by '" + printStmt(R->getExpr()) + "'";
+  std::string VisitMemoryBlockRegion(const MemoryBlockRegion *R) {
+    return "memory block region allocated by '" + printStmt(R->getAllocExpr()) +
+           "'";
   }
 
   std::string VisitCompoundLiteralRegion(const CompoundLiteralRegion *R) {
     return "compound literal " + printStmt(R->getLiteralExpr());
   }
 
   std::string VisitStringRegion(const StringRegion *R) {
     return "string literal " + R->getString();

clang/include/clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h

public:
   const MemRegion *getMostDerivedObjectRegion() const;
 
   /// Check if the region is a subregion of the given region.
   /// Each region is a subregion of itself.
   virtual bool isSubRegionOf(const MemRegion *R) const;
 
   const MemRegion *StripCasts(bool StripBaseAndDerivedCasts = true) const;
 
+  /// getExtent - Returns the size of the region in bytes.
+  virtual DefinedOrUnknownSVal getExtent() const { return UnknownVal(); }
+
+  /// getExtent - Returns the size of the region in bytes.
+  virtual DefinedOrUnknownSVal getExtent(SValBuilder &svalBuilder) const {
+    return UnknownVal();
+  }
+
   /// If this is a symbolic region, returns the region. Otherwise,
   /// goes up the base chain looking for the first symbolic base region.
   const SymbolicRegion *getSymbolicBase() const;
 
   bool hasGlobalsOrParametersStorage() const;
 
   bool hasStackStorage() const;
 
SubRegion(const MemRegion *sReg, Kind k) : MemRegion(k), superRegion(sReg) {
     assert(sReg);
   }
 
 public:
   const MemRegion* getSuperRegion() const {
     return superRegion;
   }
 
-  /// getExtent - Returns the size of the region in bytes.
-  virtual DefinedOrUnknownSVal getExtent(SValBuilder &svalBuilder) const {
-    return UnknownVal();
-  }
-
   MemRegionManager* getMemRegionManager() const override;
 
   bool isSubRegionOf(const MemRegion* R) const override;
 
   static bool classof(const MemRegion* R) {
     return R->getKind() > END_MEMSPACES;
   }
 };
 
 //===----------------------------------------------------------------------===//
 // MemRegion subclasses.
 //===----------------------------------------------------------------------===//
 
-/// AllocaRegion - A region that represents an untyped blob of bytes created
-///  by a call to 'alloca'.
-class AllocaRegion : public SubRegion {
-  friend class MemRegionManager;
-
-  // Block counter. Used to distinguish different pieces of memory allocated by
-  // alloca at the same call site.
-  unsigned Cnt;
-
-  const Expr *Ex;
-
-  AllocaRegion(const Expr *ex, unsigned cnt, const MemSpaceRegion *superRegion)
-      : SubRegion(superRegion, AllocaRegionKind), Cnt(cnt), Ex(ex) {
-    assert(Ex);
-  }
-
-  static void ProfileRegion(llvm::FoldingSetNodeID& ID, const Expr *Ex,
-                            unsigned Cnt, const MemRegion *superRegion);
-
+/// A region that represents a block of memory.
+class MemoryBlockRegion : public SubRegion {
 public:
-  const Expr *getExpr() const { return Ex; }
+  const Expr *getAllocExpr() const { return AllocExpr; }
+  const Decl *getAllocDecl() const { return AllocDecl; }
+  const Expr *getSizeExpr() const { return SizeExpr; }
 
-  bool isBoundable() const override { return true; }
+  DefinedOrUnknownSVal getExtent() const override { return Size; }
+  DefinedOrUnknownSVal getExtent(SValBuilder &) const override { return Size; }
 
-  DefinedOrUnknownSVal getExtent(SValBuilder &svalBuilder) const override;
+  bool isBoundable() const override { return true; }
 
-  void Profile(llvm::FoldingSetNodeID& ID) const override;
+  void Profile(llvm::FoldingSetNodeID &ID) const override;
 
+  static bool classof(const MemRegion *R) {
+    return R->getKind() == MemoryBlockRegionKind;
+  }
+
   void dumpToStream(raw_ostream &os) const override;
 
-  static bool classof(const MemRegion* R) {
-    return R->getKind() == AllocaRegionKind;
+private:
+  MemoryBlockRegion(const Expr *AllocExpr, const Decl *AllocDecl,
+                    const Expr *SizeExpr, DefinedOrUnknownSVal Size,
+                    unsigned BlockCount, const MemSpaceRegion *superRegion)
+      : SubRegion(superRegion, MemoryBlockRegionKind), AllocExpr(AllocExpr),
+        AllocDecl(AllocDecl), SizeExpr(SizeExpr), Size(Size),
+        BlockCount(BlockCount) {
+    assert(AllocExpr || AllocDecl);
   }
+
+  static void ProfileRegion(llvm::FoldingSetNodeID &ID, const Expr *AllocExpr,
+                            const Decl *AllocDecl, const Expr *SizeExpr,
+                            DefinedOrUnknownSVal Size, unsigned BlockCount,
+                            const MemRegion *superRegion);
+
+  const Expr *AllocExpr;
+  const Decl *AllocDecl;
+  const Expr *SizeExpr;
+  DefinedOrUnknownSVal Size;
+  unsigned BlockCount;
+
+  friend class MemRegionManager;
 };
 
 /// TypedRegion - An abstract class representing regions that are typed.
 class TypedRegion : public SubRegion {
   void anchor() override;
 
 protected:
   TypedRegion(const MemRegion *sReg, Kind k) : SubRegion(sReg, k) {

 ///  either a real region, a NULL pointer, etc.  It essentially is used to
 ///  map the concept of symbolic values into the domain of regions.  Symbolic
 ///  regions do not need to be typed.
 class SymbolicRegion : public SubRegion {
   friend class MemRegionManager;
 
   const SymbolRef sym;
 
-  SymbolicRegion(const SymbolRef s, const MemSpaceRegion *sreg)
+  SymbolicRegion(const SymbolRef s, const MemRegion *sreg)
       : SubRegion(sreg, SymbolicRegionKind), sym(s) {
     // Because pointer arithmetic is represented by ElementRegion layers,
     // the base symbol here should not contain any arithmetic.
     assert(s && isa<SymbolData>(s));
     assert(s->getType()->isAnyPointerType() ||
            s->getType()->isReferenceType() ||
            s->getType()->isBlockPointerType());
-    assert(isa<UnknownSpaceRegion>(sreg) || isa<HeapSpaceRegion>(sreg));
+    assert(isa<UnknownSpaceRegion>(sreg) || isa<HeapSpaceRegion>(sreg) ||
+           isa<MemoryBlockRegion>(sreg));
   }
 
 public:
   SymbolRef getSymbol() const { return sym; }
 
   bool isBoundable() const override { return true; }
 
   DefinedOrUnknownSVal getExtent(SValBuilder &svalBuilder) const override;
class VarRegion : public DeclRegion {
   // Constructors and private methods.
   VarRegion(const VarDecl *vd, const MemRegion *sReg)
       : DeclRegion(vd, sReg, VarRegionKind) {
     // VarRegion appears in unknown space when it's a block variable as seen
     // from a block using it, when this block is analyzed at top-level.
     // Other block variables appear within block data regions,
     // which, unlike everything else on this list, are not memory spaces.
     assert(isa<GlobalsSpaceRegion>(sReg) || isa<StackSpaceRegion>(sReg) ||
-           isa<BlockDataRegion>(sReg) || isa<UnknownSpaceRegion>(sReg));
+           isa<BlockDataRegion>(sReg) || isa<UnknownSpaceRegion>(sReg) ||
+           isa<MemoryBlockRegion>(sReg));
   }
 
   static void ProfileRegion(llvm::FoldingSetNodeID& ID, const VarDecl *VD,
                             const MemRegion *superRegion) {
     DeclRegion::ProfileRegion(ID, VD, superRegion, VarRegionKind);
   }
 
 public:

 
 //===----------------------------------------------------------------------===//
 // MemRegionManager - Factory object for creating regions.
 //===----------------------------------------------------------------------===//
 
 class MemRegionManager {
   ASTContext &C;
   llvm::BumpPtrAllocator& A;
+  SValBuilder &SVB;
   llvm::FoldingSet<MemRegion> Regions;
 
   GlobalInternalSpaceRegion *InternalGlobals = nullptr;
   GlobalSystemSpaceRegion *SystemGlobals = nullptr;
   GlobalImmutableSpaceRegion *ImmutableGlobals = nullptr;
 
   llvm::DenseMap<const StackFrameContext *, StackLocalsSpaceRegion *>
     StackLocalsSpaceRegions;
   llvm::DenseMap<const StackFrameContext *, StackArgumentsSpaceRegion *>
     StackArgumentsSpaceRegions;
   llvm::DenseMap<const CodeTextRegion *, StaticGlobalSpaceRegion *>
     StaticsGlobalSpaceRegions;
 
   HeapSpaceRegion *heap = nullptr;
   UnknownSpaceRegion *unknown = nullptr;
   CodeSpaceRegion *code = nullptr;
 
 public:
-  MemRegionManager(ASTContext &c, llvm::BumpPtrAllocator &a) : C(c), A(a) {}
+  MemRegionManager(ASTContext &Ctx, llvm::BumpPtrAllocator &Alloc,
+                   SValBuilder &SVB)
+      : C(Ctx), A(Alloc), SVB(SVB) {}
   ~MemRegionManager();
 
   ASTContext &getContext() { return C; }
 
   llvm::BumpPtrAllocator &getAllocator() { return A; }
 
   /// getStackLocalsRegion - Retrieve the memory region associated with the
   ///  specified stack frame.
public:
   const HeapSpaceRegion *getHeapRegion();
 
   /// getUnknownRegion - Retrieve the memory region associated with unknown
   /// memory space.
   const UnknownSpaceRegion *getUnknownRegion();
 
   const CodeSpaceRegion *getCodeRegion();
 
-  /// getAllocaRegion - Retrieve a region associated with a call to alloca().
-  const AllocaRegion *getAllocaRegion(const Expr *Ex, unsigned Cnt,
-                                      const LocationContext *LC);
-
   /// getCompoundLiteralRegion - Retrieve the region associated with a
   ///  given CompoundLiteral.
   const CompoundLiteralRegion*
   getCompoundLiteralRegion(const CompoundLiteralExpr *CL,
                            const LocationContext *LC);
 
   /// getCXXThisRegion - Retrieve the [artificial] region associated with the
   ///  parameter 'this'.
   const CXXThisRegion *getCXXThisRegion(QualType thisPointerTy,
                                         const LocationContext *LC);
 
   /// Retrieve or create a "symbolic" memory region.
   const SymbolicRegion* getSymbolicRegion(SymbolRef Sym);
 
-  /// Return a unique symbolic region belonging to heap memory space.
+  /// \returns A unique symbolic region belonging to the generic "heap".
   const SymbolicRegion *getSymbolicHeapRegion(SymbolRef sym);
 
+  /// \returns A unique symbolic region to a memory block on the heap.
+  const SymbolicRegion *
+  getSymbolicHeapMemoryBlock(SymbolRef Sym, const Expr *AllocExpr,
+                             const Decl *AllocDecl, const Expr *SizeExpr,
+                             DefinedOrUnknownSVal Size, unsigned BlockCount);
+
+  /// \returns A region associated with a block of memory on the stack.
+  const MemoryBlockRegion *
+  getStackMemoryBlockRegion(const Expr *AllocExpr, const Decl *AllocDecl,
+                            const Expr *SizeExpr, DefinedOrUnknownSVal Size,
+                            const LocationContext *LCtx, unsigned BlockCount,
+                            bool IsArgument);
+
   const StringRegion *getStringRegion(const StringLiteral *Str);
 
   const ObjCStringRegion *getObjCStringRegion(const ObjCStringLiteral *Str);
 
   /// getVarRegion - Retrieve or create the memory region associated with
   ///  a specified VarDecl and LocationContext.
   const VarRegion* getVarRegion(const VarDecl *D, const LocationContext *LC);
 
const BlockDataRegion *getBlockDataRegion(const BlockCodeRegion *bc,
                                             unsigned blockCount);
 
   /// Create a CXXTempObjectRegion for temporaries which are lifetime-extended
   /// by static references. This differs from getCXXTempObjectRegion in the
   /// super-region used.
   const CXXTempObjectRegion *getCXXStaticTempObjectRegion(const Expr *Ex);
 
 private:
-  template <typename RegionTy, typename SuperTy,
-            typename Arg1Ty>
-  RegionTy* getSubRegion(const Arg1Ty arg1,
-                         const SuperTy* superRegion);
-
-  template <typename RegionTy, typename SuperTy,
-            typename Arg1Ty, typename Arg2Ty>
-  RegionTy* getSubRegion(const Arg1Ty arg1, const Arg2Ty arg2,
-                         const SuperTy* superRegion);
-
-  template <typename RegionTy, typename SuperTy,
-            typename Arg1Ty, typename Arg2Ty, typename Arg3Ty>
-  RegionTy* getSubRegion(const Arg1Ty arg1, const Arg2Ty arg2,
-                         const Arg3Ty arg3,
-                         const SuperTy* superRegion);
+  template <typename RegionTy, typename... ArgsTy>
+  RegionTy *getSubRegion(ArgsTy &&... Args);
 
   template <typename REG>
   const REG* LazyAllocate(REG*& region);
 
   template <typename REG, typename ARG>
   const REG* LazyAllocate(REG*& region, ARG a);
 };
 

clang/include/clang/StaticAnalyzer/Core/PathSensitive/Regions.def

ABSTRACT_REGION(StackSpaceRegion, MemSpaceRegion)
     REGION(StackArgumentsSpaceRegion, StackSpaceRegion)
     REGION(StackLocalsSpaceRegion, StackSpaceRegion)
     REGION_RANGE(STACK_MEMSPACES, StackArgumentsSpaceRegionKind,
                                   StackLocalsSpaceRegionKind)
   REGION(UnknownSpaceRegion, MemSpaceRegion)
   REGION_RANGE(MEMSPACES, CodeSpaceRegionKind,
                           UnknownSpaceRegionKind)
 ABSTRACT_REGION(SubRegion, MemRegion)
-  REGION(AllocaRegion, SubRegion)
+  REGION(MemoryBlockRegion, SubRegion)
   REGION(SymbolicRegion, SubRegion)
   ABSTRACT_REGION(TypedRegion, SubRegion)
     REGION(BlockDataRegion, TypedRegion)
     ABSTRACT_REGION(CodeTextRegion, TypedRegion)
       REGION(BlockCodeRegion, CodeTextRegion)
       REGION(FunctionCodeRegion, CodeTextRegion)
       REGION_RANGE(CODE_TEXT_REGIONS, BlockCodeRegionKind,
                                       FunctionCodeRegionKind)

clang/include/clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h

public:
   // FIXME: Make these protected again once RegionStoreManager correctly
   // handles loads from different bound value types.
   virtual SVal dispatchCast(SVal val, QualType castTy) = 0;
 
 public:
   SValBuilder(llvm::BumpPtrAllocator &alloc, ASTContext &context,
               ProgramStateManager &stateMgr)
       : Context(context), BasicVals(context, alloc),
-        SymMgr(context, BasicVals, alloc), MemMgr(context, alloc),
+        SymMgr(context, BasicVals, alloc), MemMgr(context, alloc, *this),
         StateMgr(stateMgr), ArrayIndexTy(context.LongLongTy),
         ArrayIndexWidth(context.getTypeSize(ArrayIndexTy)) {}
 
   virtual ~SValBuilder() = default;
 
   bool haveSameType(const SymExpr *Sym1, const SymExpr *Sym2) {
     return haveSameType(Sym1->getType(), Sym2->getType());
   }
DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag,
                                         const LocationContext *LCtx,
                                         QualType type,
                                         unsigned count);
   DefinedOrUnknownSVal conjureSymbolVal(const Stmt *stmt,
                                         const LocationContext *LCtx,
                                         QualType type,
                                         unsigned visitCount);
 
-  /// Conjure a symbol representing heap allocated memory region.
-  ///
-  /// Note, the expression should represent a location.
-  DefinedOrUnknownSVal getConjuredHeapSymbolVal(const Expr *E,
-                                                const LocationContext *LCtx,
-                                                unsigned Count);
+  /// \returns A conjured symbol representing a heap allocated block of memory.
+  /// \note The expression \p AllocExpr should represent a location.
+  DefinedOrUnknownSVal
+  getConjuredHeapSymbolVal(const Expr *AllocExpr, const Decl *AllocDecl,
+                           const Expr *SizeExpr, DefinedOrUnknownSVal Size,
+                           const LocationContext *LCtx, unsigned BlockCount);
+
+  /// \returns A stack allocated block of memory.
+  /// \note The expression \p AllocExpr should represent a location.
+  DefinedOrUnknownSVal getStackSymbolVal(const Expr *AllocExpr,
+                                         const Decl *AllocDecl,
+                                         const Expr *SizeExpr,
+                                         DefinedOrUnknownSVal Size,
+                                         unsigned BlockCount, bool IsArgument);
 
   DefinedOrUnknownSVal getDerivedRegionValueSymbolVal(
       SymbolRef parentSymbol, const TypedValueRegion *region);
 
   DefinedSVal getMetadataSymbolVal(const void *symbolTag,
                                    const MemRegion *region,
                                    const Expr *expr, QualType type,
                                    const LocationContext *LCtx,

clang/lib/StaticAnalyzer/Checkers/BuiltinFunctionChecker.cpp

case Builtin::BI__builtin_addressof: {
     assert (Call.getNumArgs() > 0);
     SVal Arg = Call.getArgSVal(0);
     C.addTransition(state->BindExpr(CE, LCtx, Arg));
     return true;
   }
 
   case Builtin::BI__builtin_alloca_with_align:
   case Builtin::BI__builtin_alloca: {
-    // FIXME: Refactor into StoreManager itself?
-    MemRegionManager& RM = C.getStoreManager().getRegionManager();
-    const AllocaRegion* R =
-      RM.getAllocaRegion(CE, C.blockCount(), C.getLocationContext());
-
     // Set the extent of the region in bytes. This enables us to use the
     // SVal of the argument directly. If we save the extent in bits, we
     // cannot represent values like symbol*8.
     auto Size = Call.getArgSVal(0);
     if (Size.isUndef())
       return true; // Return true to model purity.
 
-    SValBuilder& svalBuilder = C.getSValBuilder();
-    DefinedOrUnknownSVal Extent = R->getExtent(svalBuilder);
-    DefinedOrUnknownSVal extentMatchesSizeArg =
-      svalBuilder.evalEQ(state, Extent, Size.castAs<DefinedOrUnknownSVal>());
-    state = state->assume(extentMatchesSizeArg, true);
-    assert(state && "The region should not have any previous constraints");
+    SVal V = C.getSValBuilder().getStackSymbolVal(
+        CE, Call.getDecl(), Call.getArgExpr(0),
+        Size.castAs<DefinedOrUnknownSVal>(), C.getLocationContext(),
+        C.blockCount(), /*IsArgument=*/false);
 
-    C.addTransition(state->BindExpr(CE, LCtx, loc::MemRegionVal(R)));
+    C.addTransition(state->BindExpr(CE, LCtx, V));
     return true;
   }
 
   case Builtin::BI__builtin_dynamic_object_size:
   case Builtin::BI__builtin_object_size:
   case Builtin::BI__builtin_constant_p: {
     // This must be resolvable at compile time, so we defer to the constant
     // evaluator for a value.

clang/lib/StaticAnalyzer/Checkers/CStringChecker.cpp

ProgramStateRef CStringChecker::setCStringLength(ProgramStateRef state,
 
   switch (MR->getKind()) {
   case MemRegion::StringRegionKind:
     // FIXME: This can happen if we strcpy() into a string region. This is
     // undefined [C99 6.4.5p6], but we should still warn about it.
     return state;
 
   case MemRegion::SymbolicRegionKind:
-  case MemRegion::AllocaRegionKind:
+  case MemRegion::MemoryBlockRegionKind:
   case MemRegion::VarRegionKind:
   case MemRegion::FieldRegionKind:
   case MemRegion::ObjCIvarRegionKind:
     // These are the types we can currently track string lengths for.
     break;
 
   case MemRegion::ElementRegionKind:
     // FIXME: Handle element regions by upper-bounding the parent region's
case MemRegion::StringRegionKind: {
     // Modifying the contents of string regions is undefined [C99 6.4.5p6],
     // so we can assume that the byte length is the correct C string length.
     SValBuilder &svalBuilder = C.getSValBuilder();
     QualType sizeTy = svalBuilder.getContext().getSizeType();
     const StringLiteral *strLit = cast<StringRegion>(MR)->getStringLiteral();
     return svalBuilder.makeIntVal(strLit->getByteLength(), sizeTy);
   }
   case MemRegion::SymbolicRegionKind:
-  case MemRegion::AllocaRegionKind:
+  case MemRegion::MemoryBlockRegionKind:
   case MemRegion::VarRegionKind:
   case MemRegion::FieldRegionKind:
   case MemRegion::ObjCIvarRegionKind:
     return getCStringLengthForRegion(C, state, Ex, MR, hypothetical);
   case MemRegion::CompoundLiteralRegionKind:
     // FIXME: Can we track this? Is it necessary?
     return UnknownVal();
   case MemRegion::ElementRegionKind:

clang/lib/StaticAnalyzer/Checkers/MacOSKeychainAPIChecker.cpp

unsigned MacOSKeychainAPIChecker::getTrackedFunctionIndex(StringRef Name,
   }
   // The function is not tracked.
   return InvalidIdx;
 }
 
 static bool isBadDeallocationArgument(const MemRegion *Arg) {
   if (!Arg)
     return false;
-  return isa<AllocaRegion>(Arg) || isa<BlockDataRegion>(Arg) ||
+  return isa<MemoryBlockRegion>(Arg) || isa<BlockDataRegion>(Arg) ||
          isa<TypedRegion>(Arg);
 }
 
 /// Given the address expression, retrieve the value it's pointing to. Assume
 /// that value is itself an address, and return the corresponding symbol.
 static SymbolRef getAsPointeeSymbol(const Expr *Expr,
                                     CheckerContext &C) {
   ProgramStateRef State = C.getState();

clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp

private:
   /// \param [in] CE The expression that allocates memory.
   /// \param [in] Size Size of the memory that needs to be allocated.
   /// \param [in] Init The value the allocated memory needs to be initialized.
   /// with. For example, \c calloc initializes the allocated memory to 0,
   /// malloc leaves it undefined.
   /// \param [in] State The \c ProgramState right before allocation.
   /// \returns The ProgramState right after allocation.
   static ProgramStateRef MallocMemAux(CheckerContext &C, const CallExpr *CE,
-                                      SVal Size, SVal Init,
-                                      ProgramStateRef State,
+                                      const Expr *SizeExpr, SVal Size,
+                                      SVal Init, ProgramStateRef State,
                                       AllocationFamily Family = AF_Malloc);
 
   static ProgramStateRef addExtentSize(CheckerContext &C, const CXXNewExpr *NE,
                                        ProgramStateRef State, SVal Target);
 
   // Check if this malloc() for special flags. At present that means M_ZERO or
   // __GFP_ZERO (in which case, treat it like calloc).
   llvm::Optional<ProgramStateRef>
if (FunI == MemFunctionInfo.II_malloc ||
         State = FreeMemAux(C, CE, State, 0, false, IsKnownToBeAllocatedMemory);
         break;
       default:
         llvm_unreachable("not a new/delete operator");
       }
     } else if (FunI == MemFunctionInfo.II_if_nameindex) {
       // Should we model this differently? We can allocate a fixed number of
       // elements with zeros in the last one.
-      State = MallocMemAux(C, CE, UnknownVal(), UnknownVal(), State,
+      State = MallocMemAux(C, CE, /*SizeExpr=*/nullptr, UnknownVal(), UnknownVal(), State,
                            AF_IfNameIndex);
     } else if (FunI == MemFunctionInfo.II_if_freenameindex) {
       State = FreeMemAux(C, CE, State, 0, false, IsKnownToBeAllocatedMemory);
     } else if (FunI == MemFunctionInfo.II_g_malloc0 ||
                FunI == MemFunctionInfo.II_g_try_malloc0) {
       if (CE->getNumArgs() < 1)
         return;
       SValBuilder &svalBuilder = C.getSValBuilder();
if (FunI == MemFunctionInfo.II_malloc ||
         return;
       SVal Init = UndefinedVal();
       if (FunI == MemFunctionInfo.II_g_malloc0_n ||
           FunI == MemFunctionInfo.II_g_try_malloc0_n) {
         SValBuilder &SB = C.getSValBuilder();
         Init = SB.makeZeroVal(SB.getContext().CharTy);
       }
       SVal TotalSize = evalMulForBufferSize(C, CE->getArg(0), CE->getArg(1));
-      State = MallocMemAux(C, CE, TotalSize, Init, State);
+      State = MallocMemAux(C, CE, CE->getArg(0), TotalSize, Init, State);
       State = ProcessZeroAllocCheck(C, CE, 0, State);
       State = ProcessZeroAllocCheck(C, CE, 1, State);
     } else if (FunI == MemFunctionInfo.II_g_realloc_n ||
                FunI == MemFunctionInfo.II_g_try_realloc_n) {
       if (CE->getNumArgs() < 3)
         return;
       State = ReallocMemAux(C, CE, /*ShouldFreeOnFail*/ false, State,
                             /*SuffixWithN*/ true);
MallocChecker::MallocMemReturnsAttr(CheckerContext &C, const CallExpr *CE,
   if (Att->getModule() != MemFunctionInfo.II_malloc)
     return nullptr;
 
   OwnershipAttr::args_iterator I = Att->args_begin(), E = Att->args_end();
   if (I != E) {
     return MallocMemAux(C, CE, CE->getArg(I->getASTIndex()), UndefinedVal(),
                         State);
   }
-  return MallocMemAux(C, CE, UnknownVal(), UndefinedVal(), State);
+  return MallocMemAux(C, CE, /*SizeExpr=*/nullptr, UnknownVal(), UndefinedVal(), State);
 }
 
 ProgramStateRef MallocChecker::MallocMemAux(CheckerContext &C,
                                             const CallExpr *CE,
                                             const Expr *SizeEx, SVal Init,
                                             ProgramStateRef State,
                                             AllocationFamily Family) {
   if (!State)
     return nullptr;
 
-  return MallocMemAux(C, CE, C.getSVal(SizeEx), Init, State, Family);
+  return MallocMemAux(C, CE, SizeEx, C.getSVal(SizeEx), Init, State, Family);
 }
 
 ProgramStateRef MallocChecker::MallocMemAux(CheckerContext &C,
                                             const CallExpr *CE,
-                                           SVal Size, SVal Init,
-                                           ProgramStateRef State,
+                                            const Expr *SizeExpr, SVal Size,
+                                            SVal Init, ProgramStateRef State,
                                             AllocationFamily Family) {
   if (!State)
     return nullptr;
 
   // We expect the malloc functions to return a pointer.
   if (!Loc::isLocType(CE->getType()))
     return nullptr;
 
   // Bind the return value to the symbolic value from the heap region.
   // TODO: We could rewrite post visit to eval call; 'malloc' does not have
   // side effects other than what we model here.
   unsigned Count = C.blockCount();
   SValBuilder &svalBuilder = C.getSValBuilder();
   const LocationContext *LCtx = C.getPredecessor()->getLocationContext();
-  DefinedSVal RetVal = svalBuilder.getConjuredHeapSymbolVal(CE, LCtx, Count)
+  DefinedSVal RetVal = svalBuilder
+                           .getConjuredHeapSymbolVal(
+                               CE, /*AllocDecl=*/nullptr, SizeExpr,
+                               Size.castAs<DefinedOrUnknownSVal>(), LCtx, Count)
                            .castAs<DefinedSVal>();
   State = State->BindExpr(CE, C.getLocationContext(), RetVal);
 
   // Fill the region with the initialization value.
   State = State->bindDefaultInitial(RetVal, Init, LCtx);
 
   // Set the region's extent equal to the Size parameter.
   const SymbolicRegion *R =
       dyn_cast_or_null<SymbolicRegion>(RetVal.getAsRegion());
if (!(isa<UnknownSpaceRegion>(MS) || isa<HeapSpaceRegion>(MS))) {
     // FIXME: at the time this code was written, malloc() regions were
     // represented by conjured symbols, which are all in UnknownSpaceRegion.
     // This means that there isn't actually anything from HeapSpaceRegion
     // that should be freed, even though we allow it here.
     // Of course, free() can work on memory allocated outside the current
     // function, so UnknownSpaceRegion is always a possibility.
     // False negatives are better than false positives.
 
-    if (isa<AllocaRegion>(R))
+    if (isa<MemoryBlockRegion>(R))
       ReportFreeAlloca(C, ArgVal, ArgExpr->getSourceRange());
     else
       ReportBadFree(C, ArgVal, ArgExpr->getSourceRange(), ParentExpr);
 
     return nullptr;
   }
 
   const SymbolicRegion *SrBase = dyn_cast<SymbolicRegion>(R->getBaseRegion());
ProgramStateRef MallocChecker::ReallocMemAux(CheckerContext &C,
   // We only assume exceptional states if they are definitely true; if the
   // state is under-constrained, assume regular realloc behavior.
   bool PrtIsNull = StatePtrIsNull && !StatePtrNotNull;
   bool SizeIsZero = StateSizeIsZero && !StateSizeNotZero;
 
   // If the ptr is NULL and the size is not 0, the call is equivalent to
   // malloc(size).
   if (PrtIsNull && !SizeIsZero) {
-    ProgramStateRef stateMalloc = MallocMemAux(C, CE, TotalSize,
+    ProgramStateRef stateMalloc = MallocMemAux(C, CE, Arg1, TotalSize,
                                                UndefinedVal(), StatePtrIsNull);
     return stateMalloc;
   }
 
   if (PrtIsNull && SizeIsZero)
     return State;
 
   // Get the from and to pointer symbols as in toPtr = realloc(fromPtr, size).
if (SizeIsZero)
     if (ProgramStateRef stateFree =
             FreeMemAux(C, CE, StateSizeIsZero, 0, false, IsKnownToBeAllocated))
       return stateFree;
 
   // Default behavior.
   if (ProgramStateRef stateFree =
           FreeMemAux(C, CE, State, 0, false, IsKnownToBeAllocated)) {
 
-    ProgramStateRef stateRealloc = MallocMemAux(C, CE, TotalSize,
+    ProgramStateRef stateRealloc = MallocMemAux(C, CE, Arg1, TotalSize,
                                                 UnknownVal(), stateFree);
     if (!stateRealloc)
       return nullptr;
 
     OwnershipAfterReallocKind Kind = OAR_ToBeFreedAfterFailure;
     if (ShouldFreeOnFail)
       Kind = OAR_FreeOnFailure;
     else if (!IsKnownToBeAllocated)
ProgramStateRef MallocChecker::CallocMem(CheckerContext &C, const CallExpr *CE,
 
   if (CE->getNumArgs() < 2)
     return nullptr;
 
   SValBuilder &svalBuilder = C.getSValBuilder();
   SVal zeroVal = svalBuilder.makeZeroVal(svalBuilder.getContext().CharTy);
   SVal TotalSize = evalMulForBufferSize(C, CE->getArg(0), CE->getArg(1));
 
-  return MallocMemAux(C, CE, TotalSize, zeroVal, State);
+  return MallocMemAux(C, CE, CE->getArg(0), TotalSize, zeroVal, State);
 }
 
 MallocChecker::LeakInfo MallocChecker::getAllocationSite(const ExplodedNode *N,
                                                          SymbolRef Sym,
                                                          CheckerContext &C) {
   const LocationContext *LeakContext = N->getLocationContext();
   // Walk the ExplodedGraph backwards and find the first node that referred to
   // the tracked symbol.

clang/lib/StaticAnalyzer/Checkers/StackAddrEscapeChecker.cpp

private:
   static bool isNotInCurrentFrame(const MemRegion *R, CheckerContext &C);
 };
 } // namespace
 
 SourceRange StackAddrEscapeChecker::genName(raw_ostream &os, const MemRegion *R,
                                             ASTContext &Ctx) {
   // Get the base region, stripping away fields and elements.
   R = R->getBaseRegion();
+  if (const SymbolicRegion *SR = R->getSymbolicBase())
+    R = SR->getSuperRegion();
+
   SourceManager &SM = Ctx.getSourceManager();
   SourceRange range;
   os << "Address of ";
 
   // Check if the region is a compound literal.
   if (const auto *CR = dyn_cast<CompoundLiteralRegion>(R)) {
     const CompoundLiteralExpr *CL = CR->getLiteralExpr();
     os << "stack memory associated with a compound literal "
           "declared on line "
        << SM.getExpansionLineNumber(CL->getBeginLoc()) << " returned to caller";
     range = CL->getSourceRange();
-  } else if (const auto *AR = dyn_cast<AllocaRegion>(R)) {
-    const Expr *ARE = AR->getExpr();
-    SourceLocation L = ARE->getBeginLoc();
-    range = ARE->getSourceRange();
+  } else if (const auto *MBR = dyn_cast<MemoryBlockRegion>(R)) {
+    const Expr *AllocExpr = MBR->getAllocExpr();
+    SourceLocation L = AllocExpr->getBeginLoc();
+    range = AllocExpr->getSourceRange();
     os << "stack memory allocated by call to alloca() on line "
        << SM.getExpansionLineNumber(L);
   } else if (const auto *BR = dyn_cast<BlockDataRegion>(R)) {
     const BlockDecl *BD = BR->getCodeRegion()->getDecl();
     SourceLocation L = BD->getBeginLoc();
     range = BD->getSourceRange();
     os << "stack-allocated block declared on line "
        << SM.getExpansionLineNumber(L);

clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

if (auto L = V.getAs<loc::MemRegionVal>()) {
     // FIXME: this is a hack for fixing a later crash when attempting to
     // dereference a void* pointer.
     // We should not try to dereference pointers at all when we don't care
     // what is written inside the pointer.
     bool CanDereference = true;
     if (const auto *SR = L->getRegionAs<SymbolicRegion>()) {
       if (SR->getSymbol()->getType()->getPointeeType()->isVoidType())
         CanDereference = false;
-    } else if (L->getRegionAs<AllocaRegion>())
+    } else if (L->getRegionAs<MemoryBlockRegion>())
       CanDereference = false;
 
     // At this point we are dealing with the region's LValue.
     // However, if the rvalue is a symbolic region, we should track it as well.
     // Try to use the correct type when looking up the value.
     SVal RVal;
     if (ExplodedGraph::isInterestingLValueExpr(Inner))
       RVal = LVState->getRawSVal(L.getValue(), Inner->getType());

clang/lib/StaticAnalyzer/Core/CallEvent.cpp

if (!SupersType.isNull()) {
       ReceiverT = cast<ObjCObjectPointerType>(SupersType);
     } else {
       Receiver = getReceiverSVal().getAsRegion();
       if (!Receiver)
         return {};
 
       DynamicTypeInfo DTI = getDynamicTypeInfo(getState(), Receiver);
       if (!DTI.isValid()) {
-        assert(isa<AllocaRegion>(Receiver) &&
+        assert(isa<MemoryBlockRegion>(Receiver) &&
                "Unhandled untyped region class!");
         return {};
       }
 
       QualType DynType = DTI.getType();
       CanBeSubClassed = DTI.canBeASubClass();
       ReceiverT = dyn_cast<ObjCObjectPointerType>(DynType.getCanonicalType());
 

clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp

if (AMgr.getAnalyzerOptions().MayInlineCXXAllocator) {
     symVal = *getObjectUnderConstruction(State, CNE, LCtx);
     State = finishObjectConstruction(State, CNE, LCtx);
   }
 
   // We assume all standard global 'operator new' functions allocate memory in
   // heap. We realize this is an approximation that might not correctly model
   // a custom global allocator.
   if (symVal.isUnknown()) {
-    if (IsStandardGlobalOpNewFunction)
-      symVal = svalBuilder.getConjuredHeapSymbolVal(CNE, LCtx, blockCount);
-    else
+    if (IsStandardGlobalOpNewFunction) {
+      DefinedOrUnknownSVal Size = UnknownVal();
+      const Expr *SizeExpr = nullptr;
+      if (Optional<const Expr *> TempSizeExpr = CNE->getArraySize()) {
+        SizeExpr = *TempSizeExpr;
+        Size = State->getSVal(SizeExpr, LCtx).castAs<DefinedOrUnknownSVal>();
+      }
+
+      symVal = svalBuilder.getConjuredHeapSymbolVal(
+          CNE, CNE->getOperatorNew(), SizeExpr, Size, LCtx, blockCount);
+    } else {
       symVal = svalBuilder.conjureSymbolVal(nullptr, CNE, LCtx, CNE->getType(),
                                             blockCount);
     }
+  }
 
   CallEventManager &CEMgr = getStateManager().getCallEventManager();
   CallEventRef<CXXAllocatorCall> Call =
     CEMgr.getCXXAllocatorCall(CNE, State, LCtx);
 
   if (!AMgr.getAnalyzerOptions().MayInlineCXXAllocator) {
     // Invalidate placement args.
     // FIXME: Once we figure out how we want allocators to work,

clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp

if (auto RTC = getCurrentCFGElement().getAs<CFGCXXRecordTypedCall>()) {
 
     R = State->getSVal(Target.castAs<Loc>(), E->getType());
   } else {
     // Conjure a symbol if the return value is unknown.
 
     // See if we need to conjure a heap pointer instead of
     // a regular unknown pointer.
     bool IsHeapPointer = false;
-    if (const auto *CNE = dyn_cast<CXXNewExpr>(E))
-      if (CNE->getOperatorNew()->isReplaceableGlobalAllocationFunction()) {
-        // FIXME: Delegate this to evalCall in MallocChecker?
-        IsHeapPointer = true;
-      }
+    const auto *CNE = dyn_cast<CXXNewExpr>(E);
+    if (CNE && CNE->getOperatorNew()->isReplaceableGlobalAllocationFunction()) {
 
-    R = IsHeapPointer ? svalBuilder.getConjuredHeapSymbolVal(E, LCtx, Count)
-                      : svalBuilder.conjureSymbolVal(nullptr, E, LCtx, ResultTy,
-                                                     Count);
+    DefinedOrUnknownSVal Size = UnknownVal();
+    const Expr *SizeExpr = nullptr;
+    if (CNE) {
+      if (Optional<const Expr *> TempSizeExpr = CNE->getArraySize()) {
+        SizeExpr = *TempSizeExpr;
+        Size = State->getSVal(SizeExpr, LCtx).castAs<DefinedOrUnknownSVal>();
+      }
+    }
+
+    R = IsHeapPointer
+            ? svalBuilder.getConjuredHeapSymbolVal(
+                  E, CNE ? CNE->getOperatorNew() : nullptr, SizeExpr, Size,
+                  LCtx, Count)
+            : svalBuilder.conjureSymbolVal(nullptr, E, LCtx, ResultTy, Count);
   }
   return State->BindExpr(E, LCtx, R);
 }
 
 // Conservatively evaluate call by invalidating regions and binding
 // a conjured return value.
 void ExprEngine::conservativeEvalCall(const CallEvent &Call, NodeBuilder &Bldr,
                                       ExplodedNode *Pred,

clang/lib/StaticAnalyzer/Core/MemRegion.cpp

 using namespace ento;
 
 #define DEBUG_TYPE "MemRegion"
 
 //===----------------------------------------------------------------------===//
 // MemRegion Construction.
 //===----------------------------------------------------------------------===//
 
-template <typename RegionTy, typename SuperTy, typename Arg1Ty>
-RegionTy* MemRegionManager::getSubRegion(const Arg1Ty arg1,
-                                         const SuperTy *superRegion) {
+template <typename RegionTy, typename... ArgsTy>
+RegionTy *MemRegionManager::getSubRegion(ArgsTy &&... Args) {
   llvm::FoldingSetNodeID ID;
-  RegionTy::ProfileRegion(ID, arg1, superRegion);
+  RegionTy::ProfileRegion(ID, std::forward<ArgsTy>(Args)...);
   void *InsertPos;
   auto *R = cast_or_null<RegionTy>(Regions.FindNodeOrInsertPos(ID, InsertPos));
 
   if (!R) {
     R = A.Allocate<RegionTy>();
-    new (R) RegionTy(arg1, superRegion);
-    Regions.InsertNode(R, InsertPos);
-  }
-
-  return R;
-}
-
-template <typename RegionTy, typename SuperTy, typename Arg1Ty, typename Arg2Ty>
-RegionTy* MemRegionManager::getSubRegion(const Arg1Ty arg1, const Arg2Ty arg2,
-                                         const SuperTy *superRegion) {
-  llvm::FoldingSetNodeID ID;
-  RegionTy::ProfileRegion(ID, arg1, arg2, superRegion);
-  void *InsertPos;
-  auto *R = cast_or_null<RegionTy>(Regions.FindNodeOrInsertPos(ID, InsertPos));
-
-  if (!R) {
-    R = A.Allocate<RegionTy>();
-    new (R) RegionTy(arg1, arg2, superRegion);
-    Regions.InsertNode(R, InsertPos);
-  }
-
-  return R;
-}
-
-template <typename RegionTy, typename SuperTy,
-          typename Arg1Ty, typename Arg2Ty, typename Arg3Ty>
-RegionTy* MemRegionManager::getSubRegion(const Arg1Ty arg1, const Arg2Ty arg2,
-                                         const Arg3Ty arg3,
-                                         const SuperTy *superRegion) {
-  llvm::FoldingSetNodeID ID;
-  RegionTy::ProfileRegion(ID, arg1, arg2, arg3, superRegion);
-  void *InsertPos;
-  auto *R = cast_or_null<RegionTy>(Regions.FindNodeOrInsertPos(ID, InsertPos));
-
-  if (!R) {
-    R = A.Allocate<RegionTy>();
-    new (R) RegionTy(arg1, arg2, arg3, superRegion);
+    new (R) RegionTy(std::forward<ArgsTy>(Args)...);
     Regions.InsertNode(R, InsertPos);
   }
 
   return R;
 }
 
 //===----------------------------------------------------------------------===//
 // Object destruction.
if (Extent.isZeroConstant()) {
 
     if (isa<ConstantArrayType>(T))
       return UnknownVal();
   }
 
   return Extent;
 }
 
-DefinedOrUnknownSVal AllocaRegion::getExtent(SValBuilder &svalBuilder) const {
-  return nonloc::SymbolVal(svalBuilder.getSymbolManager().getExtentSymbol(this));
-}
-
 DefinedOrUnknownSVal SymbolicRegion::getExtent(SValBuilder &svalBuilder) const {
   return nonloc::SymbolVal(svalBuilder.getSymbolManager().getExtentSymbol(this));
 }
 
 DefinedOrUnknownSVal StringRegion::getExtent(SValBuilder &svalBuilder) const {
   return svalBuilder.makeIntVal(getStringLiteral()->getByteLength()+1,
                                 svalBuilder.getArrayIndexType());
 }

 void ObjCStringRegion::ProfileRegion(llvm::FoldingSetNodeID &ID,
                                      const ObjCStringLiteral *Str,
                                      const MemRegion *superRegion) {
   ID.AddInteger(static_cast<unsigned>(ObjCStringRegionKind));
   ID.AddPointer(Str);
   ID.AddPointer(superRegion);
 }
 
-void AllocaRegion::ProfileRegion(llvm::FoldingSetNodeID& ID,
-                                 const Expr *Ex, unsigned cnt,
-                                 const MemRegion *superRegion) {
-  ID.AddInteger(static_cast<unsigned>(AllocaRegionKind));
-  ID.AddPointer(Ex);
-  ID.AddInteger(cnt);
+void MemoryBlockRegion::ProfileRegion(
+    llvm::FoldingSetNodeID &ID, const Expr *AllocExpr, const Decl *AllocDecl,
+    const Expr *SizeExpr, DefinedOrUnknownSVal Size, unsigned BlockCount,
+  ID.AddInteger(static_cast<unsigned>(MemoryBlockRegionKind));
+  ID.AddPointer(AllocExpr);
+  ID.AddPointer(AllocDecl);
+  ID.AddPointer(SizeExpr);
+  ID.Add(Size);
+  ID.AddInteger(BlockCount);
   ID.AddPointer(superRegion);
 }
 
-void AllocaRegion::Profile(llvm::FoldingSetNodeID& ID) const {
-  ProfileRegion(ID, Ex, Cnt, superRegion);
+void MemoryBlockRegion::Profile(llvm::FoldingSetNodeID &ID) const {
+  ProfileRegion(ID, AllocExpr, AllocDecl, SizeExpr, Size, BlockCount,
+                superRegion);
 }
 
 void CompoundLiteralRegion::Profile(llvm::FoldingSetNodeID& ID) const {
   CompoundLiteralRegion::ProfileRegion(ID, CL, superRegion);
 }
 
 void CompoundLiteralRegion::ProfileRegion(llvm::FoldingSetNodeID& ID,
                                           const CompoundLiteralExpr *CL,
std::string MemRegion::getString() const {
   dumpToStream(os);
   return os.str();
 }
 
 void MemRegion::dumpToStream(raw_ostream &os) const {
   os << "<Unknown Region>";
 }
 
-void AllocaRegion::dumpToStream(raw_ostream &os) const {
-  os << "alloca{S" << Ex->getID(getContext()) << ',' << Cnt << '}';
+void MemoryBlockRegion::dumpToStream(raw_ostream &os) const {
+  os << "memory_block{";
+
+  if (AllocExpr)
+    os << 'S' << AllocExpr->getID(getContext());
+  else
+    os << "no stmt";
+  os << ',';
+
+  if (AllocDecl)
+    os << 'D' << AllocDecl->getID();
+  else
+    os << "no decl";
+
+  os << ',' << Size << ',' << BlockCount << '}';
 }
 
 void FunctionCodeRegion::dumpToStream(raw_ostream &os) const {
   os << "code{" << getDecl()->getDeclName().getAsString() << '}';
 }
 
 void BlockCodeRegion::dumpToStream(raw_ostream &os) const {
   os << "block_code{" << static_cast<const void *>(this) << '}';

 }
 
 void ObjCStringRegion::dumpToStream(raw_ostream &os) const {
   assert(Str != nullptr && "Expecting non-null ObjCStringLiteral");
   Str->printPretty(os, nullptr, PrintingPolicy(getContext().getLangOpts()));
 }
 
 void SymbolicRegion::dumpToStream(raw_ostream &os) const {
-  if (isa<HeapSpaceRegion>(getSuperRegion()))
+  if (isa<HeapSpaceRegion>(getSuperRegion()->getMemorySpace()))
     os << "Heap";
   os << "SymRegion{" << sym << '}';
 }
 
 void VarRegion::dumpToStream(raw_ostream &os) const {
   const auto *VD = cast<VarDecl>(D);
   if (const IdentifierInfo *ID = VD->getIdentifier())
     os << ID->getName();

 }
 
 const VarRegion* MemRegionManager::getVarRegion(const VarDecl *D,
                                                 const LocationContext *LC) {
   D = D->getCanonicalDecl();
   const MemRegion *sReg = nullptr;
 
   if (D->hasGlobalStorage() && !D->isStaticLocal()) {
-
     // First handle the globals defined in system headers.
     if (C.getSourceManager().isInSystemHeader(D->getLocation())) {
       // Whitelist the system globals which often DO GET modified, assume the
       // rest are immutable.
       if (D->getName().find("errno") != StringRef::npos)
         sReg = getGlobalsRegion(MemRegion::GlobalSystemSpaceRegionKind);
       else
         sReg = getGlobalsRegion(MemRegion::GlobalImmutableSpaceRegionKind);
// Finally handle static locals.
     const auto *STC = V.get<const StackFrameContext *>();
 
     if (!STC) {
       // FIXME: Assign a more sensible memory space to static locals
       // we see from within blocks that we analyze as top-level declarations.
       sReg = getUnknownRegion();
     } else {
       if (D->hasLocalStorage()) {
-        sReg = isa<ParmVarDecl>(D) || isa<ImplicitParamDecl>(D)
-               ? static_cast<const MemRegion*>(getStackArgumentsRegion(STC))
-               : static_cast<const MemRegion*>(getStackLocalsRegion(STC));
+        const Expr *SizeExpr = nullptr;
+        if (D->getType()->isArrayType())
+          if (const TypeSourceInfo *TSI = D->getTypeSourceInfo())
+            if (const auto ATL = TSI->getTypeLoc().getAs<ArrayTypeLoc>())
+              SizeExpr = ATL.getSizeExpr();
+
+        bool IsArgument = isa<ParmVarDecl>(D) || isa<ImplicitParamDecl>(D);
+        if (IsArgument)
+          sReg = getStackArgumentsRegion(STC);
+        else
+          sReg = getStackLocalsRegion(STC);
+
+        if (SizeExpr) {
+          // Create a temporary 'VarRegion' to obtain the extent.
+          const VarRegion *TempVR = getSubRegion<VarRegion>(D, sReg);
+          sReg = getStackMemoryBlockRegion(nullptr, D, SizeExpr,
+                                           TempVR->getExtent(SVB), STC,
+                                           STC->getBlockCount(), IsArgument);
         }
-      else {
+      } else {
         assert(D->isStaticLocal());
         const Decl *STCD = STC->getDecl();
         if (isa<FunctionDecl>(STCD) || isa<ObjCMethodDecl>(STCD))
           sReg = getGlobalsRegion(MemRegion::StaticGlobalSpaceRegionKind,
                                   getFunctionCodeRegion(cast<NamedDecl>(STCD)));
         else if (const auto *BD = dyn_cast<BlockDecl>(STCD)) {
           // FIXME: The fallback type here is totally bogus -- though it should
           // never be queried, it will prevent uniquing with the real

 const SymbolicRegion *MemRegionManager::getSymbolicRegion(SymbolRef sym) {
   return getSubRegion<SymbolicRegion>(sym, getUnknownRegion());
 }
 
 const SymbolicRegion *MemRegionManager::getSymbolicHeapRegion(SymbolRef Sym) {
   return getSubRegion<SymbolicRegion>(Sym, getHeapRegion());
 }
 
+const SymbolicRegion *MemRegionManager::getSymbolicHeapMemoryBlock(
+    SymbolRef Sym, const Expr *AllocExpr, const Decl *AllocDecl,
+    const Expr *SizeExpr, DefinedOrUnknownSVal Size, unsigned BlockCount) {
+  return getSubRegion<SymbolicRegion>(
+      Sym, getSubRegion<MemoryBlockRegion>(AllocExpr, AllocDecl, SizeExpr, Size,
+                                           BlockCount, getHeapRegion()));
+}
+
+const MemoryBlockRegion *MemRegionManager::getStackMemoryBlockRegion(
+    const Expr *AllocExpr, const Decl *AllocDecl, const Expr *SizeExpr,
+    DefinedOrUnknownSVal Size, const LocationContext *LCtx, unsigned BlockCount,
+    bool IsArgument) {
+  const StackFrameContext *STC = LCtx->getStackFrame();
+  assert(STC);
+
+  const MemSpaceRegion *SuperR = nullptr;
+  if (IsArgument)
+    SuperR = getStackArgumentsRegion(STC);
+  else
+    SuperR = getStackLocalsRegion(STC);
+
+  return getSubRegion<MemoryBlockRegion>(AllocExpr, AllocDecl, SizeExpr, Size,
+                                         BlockCount, SuperR);
+}
+
 const FieldRegion*
 MemRegionManager::getFieldRegion(const FieldDecl *d,
                                  const SubRegion* superRegion){
   return getSubRegion<FieldRegion>(d, superRegion);
 }
 
 const ObjCIvarRegion*
 MemRegionManager::getObjCIvarRegion(const ObjCIvarDecl *d,
while (!LC->inTopFrame() && (!D || D->isStatic() ||
     LC = LC->getParent();
     D = dyn_cast<CXXMethodDecl>(LC->getDecl());
   }
   const StackFrameContext *STC = LC->getStackFrame();
   assert(STC);
   return getSubRegion<CXXThisRegion>(PT, getStackArgumentsRegion(STC));
 }
 
-const AllocaRegion*
-MemRegionManager::getAllocaRegion(const Expr *E, unsigned cnt,
-                                  const LocationContext *LC) {
-  const StackFrameContext *STC = LC->getStackFrame();
-  assert(STC);
-  return getSubRegion<AllocaRegion>(E, cnt, getStackLocalsRegion(STC));
-}
-
 const MemSpaceRegion *MemRegion::getMemorySpace() const {
   const MemRegion *R = this;
   const auto *SR = dyn_cast<SubRegion>(this);
 
   while (SR) {
     R = SR->getSuperRegion();
     SR = dyn_cast<SubRegion>(R);
   }
while (true) {
     case MemRegion::BlockDataRegionKind:
       // These will never have bindings, but may end up having values requested
       // if the user does some strange casting.
       if (Offset != 0)
         SymbolicOffsetBase = R;
       goto Finish;
 
     case MemRegion::SymbolicRegionKind:
-    case MemRegion::AllocaRegionKind:
+    case MemRegion::MemoryBlockRegionKind:
     case MemRegion::CompoundLiteralRegionKind:
     case MemRegion::CXXThisRegionKind:
     case MemRegion::StringRegionKind:
     case MemRegion::ObjCStringRegionKind:
     case MemRegion::VarRegionKind:
     case MemRegion::CXXTempObjectRegionKind:
       // Usual base regions.
       goto Finish;

clang/lib/StaticAnalyzer/Core/RegionStore.cpp

void InvalidateRegionsWorker::VisitCluster(const MemRegion *baseR,
   // Nothing else should be done in the case when we preserve regions context.
   if (PreserveRegionsContents)
     return;
 
   // Otherwise, we have a normal data region. Record that we touched the region.
   if (Regions)
     Regions->push_back(baseR);
 
-  if (isa<AllocaRegion>(baseR) || isa<SymbolicRegion>(baseR)) {
+  if (isa<MemoryBlockRegion>(baseR) || isa<SymbolicRegion>(baseR)) {
     // Invalidate the region by setting its default value to
     // conjured symbol. The type of the symbol is irrelevant.
     DefinedOrUnknownSVal V =
       svalBuilder.conjureSymbolVal(baseR, Ex, LCtx, Ctx.IntTy, Count);
     B = B.addBinding(baseR, BindingKey::Default, V);
     return;
   }
 

clang/lib/StaticAnalyzer/Core/SValBuilder.cpp

DefinedOrUnknownSVal SValBuilder::conjureSymbolVal(const Stmt *stmt,
   SymbolRef sym = SymMgr.conjureSymbol(stmt, LCtx, type, visitCount);
 
   if (Loc::isLocType(type))
     return loc::MemRegionVal(MemMgr.getSymbolicRegion(sym));
 
   return nonloc::SymbolVal(sym);
 }
 
-DefinedOrUnknownSVal
-SValBuilder::getConjuredHeapSymbolVal(const Expr *E,
-                                      const LocationContext *LCtx,
-                                      unsigned VisitCount) {
-  QualType T = E->getType();
-  assert(Loc::isLocType(T));
-  assert(SymbolManager::canSymbolicate(T));
-  if (T->isNullPtrType())
-    return makeZeroVal(T);
+DefinedOrUnknownSVal SValBuilder::getConjuredHeapSymbolVal(
+    const Expr *AllocExpr, const Decl *AllocDecl, const Expr *SizeExpr,
+    DefinedOrUnknownSVal Size, const LocationContext *LCtx,
+    unsigned BlockCount) {
+  QualType Ty = AllocExpr->getType();
+  assert(Loc::isLocType(Ty));
+  assert(SymbolManager::canSymbolicate(Ty));
+  if (Ty->isNullPtrType())
+    return makeZeroVal(Ty);
+
+  SymbolRef Sym = SymMgr.conjureSymbol(AllocExpr, LCtx, Ty, BlockCount);
+  return loc::MemRegionVal(MemMgr.getSymbolicHeapMemoryBlock(
+      Sym, AllocExpr, AllocDecl, SizeExpr, Size, BlockCount));
+}
 
-  SymbolRef sym = SymMgr.conjureSymbol(E, LCtx, T, VisitCount);
-  return loc::MemRegionVal(MemMgr.getSymbolicHeapRegion(sym));
+DefinedOrUnknownSVal
+SValBuilder::getStackSymbolVal(const Expr *AllocExpr, const Decl *AllocDecl,
+                               const Expr *SizeExpr, DefinedOrUnknownSVal Size,
+                               const LocationContext *LCtx, unsigned BlockCount,
+                               bool IsArgument) {
+  return loc::MemRegionVal(MemMgr.getStackMemoryBlockRegion(
+      AllocExpr, AllocDecl, SizeExpr, Size, LCtx, BlockCount, IsArgument));
 }
 
 DefinedSVal SValBuilder::getMetadataSymbolVal(const void *symbolTag,
                                               const MemRegion *region,
                                               const Expr *expr, QualType type,
                                               const LocationContext *LCtx,
                                               unsigned count) {
   assert(SymbolManager::canSymbolicate(type) && "Invalid metadata symbol type");

clang/lib/StaticAnalyzer/Core/Store.cpp

switch (R->getKind()) {
     }
 
     case MemRegion::FunctionCodeRegionKind:
     case MemRegion::BlockCodeRegionKind:
     case MemRegion::BlockDataRegionKind:
     case MemRegion::StringRegionKind:
       // FIXME: Need to handle arbitrary downcasts.
     case MemRegion::SymbolicRegionKind:
-    case MemRegion::AllocaRegionKind:
+    case MemRegion::MemoryBlockRegionKind:
     case MemRegion::CompoundLiteralRegionKind:
     case MemRegion::FieldRegionKind:
     case MemRegion::ObjCIvarRegionKind:
     case MemRegion::ObjCStringRegionKind:
     case MemRegion::VarRegionKind:
     case MemRegion::CXXTempObjectRegionKind:
     case MemRegion::CXXBaseObjectRegionKind:
     case MemRegion::CXXDerivedObjectRegionKind:
SVal StoreManager::getLValueElement(QualType elementType, NonLoc Offset,
 
   if (!ElemR) {
     // If the base region is not an ElementRegion, create one.
     // This can happen in the following example:
     //
     //   char *p = __builtin_alloc(10);
     //   p[1] = 8;
     //
-    //  Observe that 'p' binds to an AllocaRegion.
+    //  Observe that 'p' binds to a 'MemoryBlockRegion'.
     return loc::MemRegionVal(MRMgr.getElementRegion(elementType, Offset,
                                                     BaseRegion, Ctx));
   }
 
   SVal BaseIdx = ElemR->getIndex();
 
   if (!BaseIdx.getAs<nonloc::ConcreteInt>())
     return UnknownVal();

clang/lib/StaticAnalyzer/Core/SymbolManager.cpp

bool SymbolReaper::isLiveRegion(const MemRegion *MR) {
   if (const auto *SR = dyn_cast<SymbolicRegion>(MR))
     return isLive(SR->getSymbol());
 
   if (const auto *VR = dyn_cast<VarRegion>(MR))
     return isLive(VR, true);
 
   // FIXME: This is a gross over-approximation. What we really need is a way to
   // tell if anything still refers to this region. Unlike SymbolicRegions,
-  // AllocaRegions don't have associated symbols, though, so we don't actually
-  // have a way to track their liveness.
-  if (isa<AllocaRegion>(MR))
+  // MemoryBlockRegions don't have associated symbols, though, so we don't
+  // actually have a way to track their liveness.
+  if (isa<MemoryBlockRegion>(MR))
     return true;
 
   if (isa<CXXThisRegion>(MR))
     return true;
 
   if (isa<MemSpaceRegion>(MR))
     return true;
 

clang/test/Analysis/array-struct.c

 
 // Struct variable in lvalue context.
 // Assign UnknownVal to the whole struct.
 void f5() {
   struct s data;
   g1(&data);
 }
 
-// AllocaRegion test.
+// MemoryBlockRegion test.
 void f6() {
   char *p;
   p = __builtin_alloca(10); 
   g(p);
   char c = *p;
   p[1] = 'a';
   // Test if RegionStore::EvalBinOp converts the alloca region to element
   // region.

clang/test/Analysis/exercise-ps.c

 void_typedef f2_helper();
 static void f2(void *buf) {
   F12_typedef* x;
   x = f2_helper();
   memcpy((&x[1]), (buf), 1); // expected-warning{{implicitly declaring library function 'memcpy' with type 'void *(void *, const void *}} \
   // expected-note{{include the header <string.h> or explicitly provide a declaration for 'memcpy'}}
 }
 
-// AllocaRegion is untyped. Void pointer isn't of much help either. Before
+// MemoryBlockRegion is untyped. Void pointer isn't of much help either. Before
 // realizing that the value is undefined, we need to somehow figure out
 // what type of value do we expect.
 void f3(void *dest) {
   void *src = __builtin_alloca(5);
   memcpy(dest, src, 1); // expected-warning{{2nd function call argument is a pointer to uninitialized value}}
 }

clang/test/Analysis/explain-svals.cpp

 namespace {
 class C {
   int x[10];
 
 public:
   void test_5(int i) {
     clang_analyzer_explain(this); // expected-warning-re{{{{^pointer to 'this' object$}}}}
     clang_analyzer_explain(&x[i]); // expected-warning-re{{{{^pointer to element of type 'int' with index 'argument 'i'' of field 'x' of 'this' object$}}}}
-    clang_analyzer_explain(__builtin_alloca(i)); // expected-warning-re{{{{^pointer to region allocated by '__builtin_alloca\(i\)'$}}}}
+    clang_analyzer_explain(__builtin_alloca(i)); // expected-warning-re{{{{^pointer to memory block region allocated by '__builtin_alloca\(i\)'$}}}}
   }
 };
 } // end of anonymous namespace
 
 void test_6() {
   clang_analyzer_explain(conjure_S()); // expected-warning-re{{{{^lazily frozen compound value of temporary object constructed at statement 'conjure_S\(\)'$}}}}
   clang_analyzer_explain(conjure_S().z); // expected-warning-re{{{{^value derived from \(symbol of type 'int' conjured at statement 'conjure_S\(\)'\) for field 'z' of temporary object constructed at statement 'conjure_S\(\)'$}}}}
 }

clang/test/Analysis/pr22954.c

int f29(int i, int j, int k, int l, int m) {
   clang_analyzer_eval(m29[1].s3[1] == 1); // expected-warning{{UNKNOWN}}
   clang_analyzer_eval(m29[1].s3[2] == 1); // expected-warning{{UNKNOWN}}
   clang_analyzer_eval(m29[1].s3[3] == 1); // expected-warning{{UNKNOWN}}
   clang_analyzer_eval(m29[i].s3[0] == 1); // expected-warning{{UNKNOWN}}
   clang_analyzer_eval(m29[i].s3[1] == 1); // expected-warning{{UNKNOWN}}
   clang_analyzer_eval(m29[i].s3[2] == 1); // expected-warning{{UNKNOWN}}
   clang_analyzer_eval(m29[i].s3[3] == 1); // expected-warning{{UNKNOWN}}
   clang_analyzer_eval(m29[j].s3[k] == 1); // expected-warning{{TRUE}}
+  // expected-warning@-1 {{Potential leak of memory pointed to by field 's4'}}
   clang_analyzer_eval(l29->s1[m] == 2); // expected-warning{{UNKNOWN}}
-  // FIXME: Should warn that m29[i].s4 leaks. But not on the previous line,
-  // because l29 and m29 alias.
   return 0;
 }
 
 // Test unions' fields.
 union uu {
   char x;
   char s1[4];
 };

clang/www/analyzer/implicit_checks.html

 
 <tr><td><div class="namedescr expandable"><span class="name">
 core.builtin.BuiltinFunctions</span><span class="lang">
 (C)</span><div class="descr">
 Evaluate compiler builtin functions (e.g., <code>alloca()</code>)</div></div></td>
 <td><div class="exampleContainer expandable">
 <div class="example"><pre>
 void test(int x) {
-  int *p = (int *)__builtin_alloca(8);
-    // evaluates to AllocaRegion
+  int *p = (int *)__builtin_alloca(8); // Evaluates to 'MemoryBlockRegion'.
 
-  if(__builtin_expect(x > 10, 0)) // evaluates to 'x > 10'
+  if(__builtin_expect(x > 10, 0))      // Evaluates to 'x > 10'.
     x = 0;
 }
 </pre></div></div></td></tr>
 
 
 <tr><td><div class="namedescr expandable"><span class="name">
 core.builtin.NoReturnFunctions</span><span class="lang">
 (C, ObjC)</span><div class="descr">