[analyzer] ASTMatchers: Extend with Static Analyzer data types

[Ignotus]

Summary

This is an extension of the existing AST matcher API so that we can
traverse on symbolic values.

[martong]

What is the concrete problem you are trying to solve? Could you please elaborate on why do we need this raw copy of the original ASTMatchers library? Why is it not possible to use the matchers from libAST? I am not sure that a raw copy paste of a whole library is the most appropriate solution to any problem.

[Ignotus]

Thanks for the response!

In D77745#1971595, @martong wrote:

What is the concrete problem you are trying to solve?

Some high-level goals: Deprecate the reachability and cluster analysis of RegionStore. Simplify the checker-writing so obtaining a std::string's StringRegion does not require an ASTMatcher to match for the StringLiteral. It could be used as a base for Aleksei's graph-matcher-based checker-writing concept: http://lists.llvm.org/pipermail/cfe-dev/2018-May/057985.html

Could you please elaborate on why do we need this raw copy of the original ASTMatchers library?

This solution is the most appropriate solution, I believe. There is no common-sense way to adjust the ASTMatchers with our data types. For a single use-case it does not make sense to create another layer on top of the already complex template and macro layer so that we could inherit from the ASTMatchers. Most likely if the community needs Aleksei's work we need a lot more fine-grained matcher logic using the context and state information. With that copy-paste abstraction, we could create our own matcher-logic step by step.

Why is it not possible to use the matchers from libAST?

The goal of ASTMatchers is to glue types together and match them using the class DynTypedNode. We do not use the types which are the ASTMatchers work on, and the ASTMatchers should not be shipped with Static Analyzer types. Every part of the ASTMatchers are type-heavy, please do a Ctrl+F and search for the word SVal. That is the issue in order to re-use the existing facilities.

I am not sure that a raw copy paste of a whole library is the most appropriate solution to any problem.

I could reinvent the copy-pasted part of the ASTMatchers for my own wording and own class-hierarchies, and I could sell it as being my own invention. That would be even more silly than reusing it. It is an exotic way of reusing code, I understand it and I feel embarrassed to do so.

---

@alexfh, @rsmith, would we like to use namespace ento types in the ASTMatchers or we want to create a template-macro-magic layer on top of the template-macro-magic layer to reuse code (if that is even possible)?

[Szelethus]

This looks like quite a change -- did I miss out on a discussion on the mailing list?

For a patch of this scale I'd prefer to have a formal proposal, a problem statement that details the current state of things and why they aren't ideal, a survey of already existing solutions or ideas (Alexey's idea and proof of concept, as you said yourself, seems strongly related, and there are years of discussion about it in the mailing list, should we pick that up?), and then a high level overview of what your approach is like. You seem to aim for a bigger fish then what is found in here, so I suspect it would be great to be on the same page.

Despite your comment to @martong, I, and seemingly many other regular maintainers of the analyzer I talked to seem to be confused about the above mentioned points. I added some folks as reviewers (as well as myself), I have strong confidence in their expertise of the AST matcher library (on which this solution is based) and the static analyzer itself.

[Ignotus]

Thanks for the idea!

In D77745#1971826, @Szelethus wrote:

This looks like quite a change -- did I miss out on a discussion on the mailing list?

No, there is no discussion.

For a patch of this scale I'd prefer to have a formal proposal, a problem statement that details the current state of things and why they aren't ideal, a survey of already existing solutions or ideas (Alexey's idea and proof of concept, as you said yourself, seems strongly related, and there are years of discussion about it in the mailing list, should we pick that up?), and then a high level overview of what your approach is like. You seem to aim for a bigger fish then what is found in here, so I suspect it would be great to be on the same page.

It is a very tiny change for my later patches, which will consist of large changes. None of them need to be discussed because they are my own research project.

Despite your comment to @martong, I, and seemingly many other regular maintainers of the analyzer I talked to seem to be confused about the above mentioned points. I added some folks as reviewers (as well as myself), I have strong confidence in their expertise of the AST matcher library (on which this solution is based) and the static analyzer itself.

Of course this solution is somewhat shameless. I do not like it as well. Given that people seems to refuse this poor man's solution, I will try better. Other than that I am all ears whether we want to pollute the LibASTMatchers with template magic. My goal is not simplicity, but a common-sense solution.

[Ignotus]

This is a minimalist solution. I hope that it will show why it would be near impossible to implement/maintain over-stressed and templated inheritance.

Pros:

• No template magic required for the implementation.
• We can traverse into ASTMatchers so that the expressibility is increased.
• With descending into ASTMatchers we could match parts of the CFG/Environment/ProgramPoint (power user features).

Cons:

• The placing of the implementation is ridiculous.
• We put core logic and maintenance outside of the Static Analyzer's scope.
• Traversing SVals became difficult because we need to forward declare CompoundVal and LazyCompoundVal (not sure how).

[a_sidorin]

Hi, 19n07u5!
It's neat that my research gained some value for community members. Unfortunately, my initial work had a number of design problems that prevented me from upstreaming it. And the first one was module dependencies. The whole dependency picture for graph matchers looks like this:

1. ASTTypeTraits should depend on Static Analyzer (not an option!) because graph types are trying to mimic common DynTypedNodes. This was done to make matchers for graph and AST nodes operate seamlessly but what was good for PoC was not good for upstreaming.
2. ASTMatchers should depend on Static Analyzer (requires massive refactoring). One of the problems here is that Clang can be built without CSA so ASTMatcherInternals.h have to become full of preprocessor guards.
3. ASTMatchers should depend on GraphMatchers and vice versa. While the backward dependency is fine, the direct is required to make matchers like functionDecl(hasPath(....)) work. This is not a problem for this patch, however.

AST should not depend on StaticAnalyzer and should not use its data structures. I was thinking about some mechanism that allows extending ASTNodeKind and DynTypedNodes by adding types that can be located in another modules (by registering them, for example). Unfortunately, I had to abandon this work due to lack of time.
As a result of these issues, I haven't started an RFC for adding the graph node matchers in the mailing list. This discussion is strongly required for such a change. I think the community will suggest some design improvements if we need such a feature. Also feel free to contact me in case of any question regarding this work.

[whisperity]

clang/CMakeLists.txt

469–472

Why is this needed? Given that CLANG_ENABLE_STATIC_ANALYZER is a toggleable option by the user, the definition should be present in the config header <build>/tools/clang/include/clang/Config/config.h:

/* Enable each functionality of modules */
#define CLANG_ENABLE_ARCMT 0
#define CLANG_ENABLE_OBJC_REWRITER 0
#define CLANG_ENABLE_STATIC_ANALYZER 0

(this is from a build on my machine that has CSA turned off.)

One way or another, this config header should find its way to the TUs, and then the defined-ness of the macro should be available without having to manually add the preprocessor flag to the compiler calls.

(Another options related to ARCMT that are in this same CMakeLists file are also present in the confiig header)

clang/include/clang/AST/RecursiveASTVisitor.h

159–160

This here feels like a massive ODR issue just waiting for biting us in the back. We have to think about potential downstream projects, and introducing this new inheritance seems very, very intrusive.

clang/CMakeLists.txt

 add_definitions( -D_GNU_SOURCE )
 
 option(CLANG_BUILD_TOOLS
   "Build the Clang tools. If OFF, just generate build targets." ON)
 
 option(CLANG_ENABLE_ARCMT "Build ARCMT." ON)
 option(CLANG_ENABLE_STATIC_ANALYZER "Build static analyzer." ON)
 
+if(CLANG_ENABLE_STATIC_ANALYZER)
+  add_definitions(-DCLANG_ENABLE_STATIC_ANALYZER)
+endif()
+
 option(CLANG_ENABLE_PROTO_FUZZER "Build Clang protobuf fuzzer." OFF)
 
 if(NOT CLANG_ENABLE_STATIC_ANALYZER AND CLANG_ENABLE_ARCMT)
   message(FATAL_ERROR "Cannot disable static analyzer while enabling ARCMT or Z3")
 endif()
 
 if(CLANG_ENABLE_ARCMT)
   set(CLANG_ENABLE_OBJC_REWRITER ON)

clang/include/clang/AST/ASTTypeTraits.h

 #include "clang/AST/ASTFwd.h"
 #include "clang/AST/NestedNameSpecifier.h"
 #include "clang/AST/TemplateBase.h"
 #include "clang/AST/TypeLoc.h"
 #include "clang/Basic/LLVM.h"
 #include "llvm/ADT/DenseMapInfo.h"
 #include "llvm/Support/AlignOf.h"
 
+#if CLANG_ENABLE_STATIC_ANALYZER
+#include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/SymExpr.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h"
+#endif // CLANG_ENABLE_STATIC_ANALYZER
+
 namespace llvm {
 
 class raw_ostream;
 
 }
 
 namespace clang {
 
public:
   }
 
   /// \{
   /// Construct an identifier for the dynamic type of the node
   static ASTNodeKind getFromNode(const Decl &D);
   static ASTNodeKind getFromNode(const Stmt &S);
   static ASTNodeKind getFromNode(const Type &T);
   static ASTNodeKind getFromNode(const OMPClause &C);
+#if CLANG_ENABLE_STATIC_ANALYZER
+  static ASTNodeKind getFromNode(const ento::SVal &V);
+  static ASTNodeKind getFromNode(const ento::MemRegion &MR);
+  static ASTNodeKind getFromNode(const ento::SymExpr &SE);
+#endif // CLANG_ENABLE_STATIC_ANALYZER
   /// \}
 
   /// Returns \c true if \c this and \c Other represent the same kind.
   bool isSame(ASTNodeKind Other) const {
     return KindId != NKI_None && KindId == Other.KindId;
   }
 
   /// Returns \c true only for the default \c ASTNodeKind()
struct DenseMapInfo {
     static bool isEqual(const ASTNodeKind &LHS, const ASTNodeKind &RHS) {
       return LHS.KindId == RHS.KindId;
     }
   };
 
   /// Check if the given ASTNodeKind identifies a type that offers pointer
   /// identity. This is useful for the fast path in DynTypedNode.
   bool hasPointerIdentity() const {
+#ifndef CLANG_ENABLE_STATIC_ANALYZER
     return KindId > NKI_LastKindWithoutPointerIdentity;
+#else
+    return KindId > NKI_LastKindWithoutPointerIdentity && KindId < NKI_SVal;
+#endif // CLANG_ENABLE_STATIC_ANALYZER
   }
 
 private:
   /// Kind ids.
   ///
   /// Includes all possible base and derived kinds.
   enum NodeKindId {
     NKI_None,

 #define STMT(DERIVED, BASE) NKI_##DERIVED,
 #include "clang/AST/StmtNodes.inc"
     NKI_Type,
 #define TYPE(DERIVED, BASE) NKI_##DERIVED##Type,
 #include "clang/AST/TypeNodes.inc"
     NKI_OMPClause,
 #define OMP_CLAUSE_CLASS(Enum, Str, Class) NKI_##Class,
 #include "llvm/Frontend/OpenMP/OMPKinds.def"
+
+#if CLANG_ENABLE_STATIC_ANALYZER
+    NKI_MemRegion,
+#define REGION(DERIVED, BASE) NKI_##DERIVED,
+#define ABSTRACT_REGION(DERIVED, BASE) REGION(DERIVED, BASE)
+#include "clang/StaticAnalyzer/Core/PathSensitive/Regions.def"
+    NKI_SymExpr,
+#define SYMBOL(DERIVED, BASE) NKI_##DERIVED,
+#define ABSTRACT_SYMBOL(DERIVED, BASE) SYMBOL(DERIVED, BASE)
+#include "clang/StaticAnalyzer/Core/PathSensitive/Symbols.def"
+    NKI_SVal,
+#define BASIC_SVAL(DERIVED, BASE) NKI_##DERIVED,
+#define ABSTRACT_SVAL(DERIVED, BASE) BASIC_SVAL(DERIVED, BASE)
+#define LOC_SVAL(DERIVED, BASE) NKI_loc_##DERIVED,
+#define NONLOC_SVAL(DERIVED, BASE) NKI_nonloc_##DERIVED,
+#include "clang/StaticAnalyzer/Core/PathSensitive/SVals.def"
+#endif // CLANG_ENABLE_STATIC_ANALYZER
+
     NKI_NumberOfKinds
   };
 
   /// Use getFromNodeKind<T>() to construct the kind.
   ASTNodeKind(NodeKindId KindId) : KindId(KindId) {}
 
   /// Returns \c true if \c Base is a base kind of (or same as) \c
   ///   Derived.

 #define STMT(DERIVED, BASE) KIND_TO_KIND_ID(DERIVED)
 #include "clang/AST/StmtNodes.inc"
 #define TYPE(DERIVED, BASE) KIND_TO_KIND_ID(DERIVED##Type)
 #include "clang/AST/TypeNodes.inc"
 #define OMP_CLAUSE_CLASS(Enum, Str, Class) KIND_TO_KIND_ID(Class)
 #include "llvm/Frontend/OpenMP/OMPKinds.def"
 #undef KIND_TO_KIND_ID
 
+#if CLANG_ENABLE_STATIC_ANALYZER
+// Use namespace ento.
+#define KIND_TO_KIND_ID(CLASS)                                                 \
+  template <> struct ASTNodeKind::KindToKindId<ento::CLASS> {                  \
+    static const NodeKindId Id = NKI_##CLASS;                                  \
+  };
+KIND_TO_KIND_ID(SVal)
+KIND_TO_KIND_ID(MemRegion)
+KIND_TO_KIND_ID(SymExpr)
+#define REGION(DERIVED, BASE) KIND_TO_KIND_ID(DERIVED)
+#define ABSTRACT_REGION(DERIVED, BASE) REGION(DERIVED, BASE)
+#include "clang/StaticAnalyzer/Core/PathSensitive/Regions.def"
+#define SYMBOL(DERIVED, BASE) KIND_TO_KIND_ID(DERIVED)
+#define ABSTRACT_SYMBOL(DERIVED, BASE) SYMBOL(DERIVED, BASE)
+#include "clang/StaticAnalyzer/Core/PathSensitive/Symbols.def"
+
+// Use namespace ento::loc and ento::nonloc.
+#define SVAL_KIND_TO_KIND_ID(NAMESPACE, CLASS)                                 \
+  template <> struct ASTNodeKind::KindToKindId<ento::NAMESPACE::CLASS> {       \
+    static const NodeKindId Id = NKI_##NAMESPACE##_##CLASS;                    \
+  };
+#define BASIC_SVAL(DERIVED, BASE) KIND_TO_KIND_ID(DERIVED)
+#define ABSTRACT_SVAL(DERIVED, BASE) BASIC_SVAL(DERIVED, BASE)
+#define LOC_SVAL(DERIVED, BASE) SVAL_KIND_TO_KIND_ID(loc, DERIVED)
+#define NONLOC_SVAL(DERIVED, BASE) SVAL_KIND_TO_KIND_ID(nonloc, DERIVED)
+#include "clang/StaticAnalyzer/Core/PathSensitive/SVals.def"
+#undef KIND_TO_KIND_ID
+#undef SVAL_KIND_TO_KIND_ID
+#endif // CLANG_ENABLE_STATIC_ANALYZER
+
 inline raw_ostream &operator<<(raw_ostream &OS, ASTNodeKind K) {
   OS << K.asStringRef();
   return OS;
 }
 
 /// A dynamically typed AST node container.
 ///
 /// Stores an AST node in a type safe way. This allows writing code that
if (ASTNodeKind::getFromNodeKind<NestedNameSpecifierLoc>().isSame(
       auto NNSLA = getUnchecked<NestedNameSpecifierLoc>();
       auto NNSLB = Other.getUnchecked<NestedNameSpecifierLoc>();
       return std::make_pair(NNSLA.getNestedNameSpecifier(),
                             NNSLA.getOpaqueData()) <
              std::make_pair(NNSLB.getNestedNameSpecifier(),
                             NNSLB.getOpaqueData());
     }
 
+#if CLANG_ENABLE_STATIC_ANALYZER
+    if (ASTNodeKind::getFromNodeKind<ento::SVal>().isBaseOf(NodeKind))
+      return getUnchecked<ento::SVal>() < Other.getUnchecked<ento::SVal>();
+#endif // CLANG_ENABLE_STATIC_ANALYZER
+
     assert(getMemoizationData() && Other.getMemoizationData());
     return getMemoizationData() < Other.getMemoizationData();
   }
   bool operator==(const DynTypedNode &Other) const {
     // DynTypedNode::create() stores the exact kind of the node in NodeKind.
     // If they contain the same node, their NodeKind must be the same.
     if (!NodeKind.isSame(Other.NodeKind))
       return false;
 
     // FIXME: Implement for other types.
     if (ASTNodeKind::getFromNodeKind<QualType>().isSame(NodeKind))
       return getUnchecked<QualType>() == Other.getUnchecked<QualType>();
 
     if (ASTNodeKind::getFromNodeKind<TypeLoc>().isSame(NodeKind))
       return getUnchecked<TypeLoc>() == Other.getUnchecked<TypeLoc>();
 
     if (ASTNodeKind::getFromNodeKind<NestedNameSpecifierLoc>().isSame(NodeKind))
       return getUnchecked<NestedNameSpecifierLoc>() ==
              Other.getUnchecked<NestedNameSpecifierLoc>();
 
+#if CLANG_ENABLE_STATIC_ANALYZER
+    if (ASTNodeKind::getFromNodeKind<ento::SVal>().isBaseOf(NodeKind))
+      return getUnchecked<ento::SVal>() == Other.getUnchecked<ento::SVal>();
+#endif // CLANG_ENABLE_STATIC_ANALYZER
+
     assert(getMemoizationData() && Other.getMemoizationData());
     return getMemoizationData() == Other.getMemoizationData();
   }
   bool operator!=(const DynTypedNode &Other) const {
     return !operator==(Other);
   }
   /// @}
 
static unsigned getHashValue(const DynTypedNode &Val) {
 
       if (ASTNodeKind::getFromNodeKind<NestedNameSpecifierLoc>().isSame(
               Val.NodeKind)) {
         auto NNSL = Val.getUnchecked<NestedNameSpecifierLoc>();
         return llvm::hash_combine(NNSL.getNestedNameSpecifier(),
                                   NNSL.getOpaqueData());
       }
 
+#if CLANG_ENABLE_STATIC_ANALYZER
+      if (ASTNodeKind::getFromNodeKind<ento::SVal>().isBaseOf(Val.NodeKind)) {
+        auto V = Val.getUnchecked<ento::SVal>();
+        return llvm::hash_combine(V.getRawData(), V.getRawKind());
+      }
+#endif // CLANG_ENABLE_STATIC_ANALYZER
+
       assert(Val.getMemoizationData());
       return llvm::hash_value(Val.getMemoizationData());
     }
     static bool isEqual(const DynTypedNode &LHS, const DynTypedNode &RHS) {
       auto Empty = ASTNodeKind::DenseMapInfo::getEmptyKey();
       auto TombStone = ASTNodeKind::DenseMapInfo::getTombstoneKey();
       return (ASTNodeKind::DenseMapInfo::isEqual(LHS.NodeKind, Empty) &&
               ASTNodeKind::DenseMapInfo::isEqual(RHS.NodeKind, Empty)) ||
template <typename T> struct ValueConverter {
     static DynTypedNode create(const T &Node) {
       DynTypedNode Result;
       Result.NodeKind = ASTNodeKind::getFromNodeKind<T>();
       new (Result.Storage.buffer) T(Node);
       return Result;
     }
   };
 
+#if CLANG_ENABLE_STATIC_ANALYZER
+  template <typename T> struct SValConverter {
+    static const T *get(ASTNodeKind NodeKind, const char Storage[]) {
+      if (ASTNodeKind::getFromNodeKind<T>().isBaseOf(NodeKind))
+        return &getUnchecked(NodeKind, Storage);
+      return nullptr;
+    }
+    static const T &getUnchecked(ASTNodeKind NodeKind,
+                                 const char Storage[]) {
+      assert(ASTNodeKind::getFromNodeKind<T>().isBaseOf(NodeKind));
+      return *reinterpret_cast<const T *>(Storage);
+    }
+    static DynTypedNode create(const ento::SVal &Node) {
+      DynTypedNode Result;
+      Result.NodeKind = ASTNodeKind::getFromNode(Node);
+      new (Result.Storage.buffer) ento::SVal(Node);
+      return Result;
+    }
+  };
+#endif // CLANG_ENABLE_STATIC_ANALYZER
+
   ASTNodeKind NodeKind;
 
   /// Stores the data of the node.
   ///
   /// Note that we can store \c Decls, \c Stmts, \c Types,
   /// \c NestedNameSpecifiers and \c CXXCtorInitializer by pointer as they are
   /// guaranteed to be unique pointers pointing to dedicated storage in the AST.
   /// \c QualTypes, \c NestedNameSpecifierLocs, \c TypeLocs and
   /// \c TemplateArguments on the other hand do not have storage or unique
   /// pointers and thus need to be stored by value.
   llvm::AlignedCharArrayUnion<const void *, TemplateArgument,
                               NestedNameSpecifierLoc, QualType,
-                              TypeLoc> Storage;
+#if CLANG_ENABLE_STATIC_ANALYZER
+                              ento::SVal,
+#endif // CLANG_ENABLE_STATIC_ANALYZER
+                              TypeLoc>
+      Storage;
 };
 
 template <typename T>
 struct DynTypedNode::BaseConverter<
     T, std::enable_if_t<std::is_base_of<Decl, T>::value>>
     : public DynCastPtrConverter<T, Decl> {};
 
 template <typename T>

 template <>
 struct DynTypedNode::BaseConverter<QualType,
                                    void> : public ValueConverter<QualType> {};
 
 template <>
 struct DynTypedNode::BaseConverter<
     TypeLoc, void> : public ValueConverter<TypeLoc> {};
 
+#if CLANG_ENABLE_STATIC_ANALYZER
+template <typename T>
+struct DynTypedNode::BaseConverter<
+    T, std::enable_if_t<std::is_base_of<ento::SVal, T>::value>>
+    : public SValConverter<T> {};
+
+template <typename T>
+struct DynTypedNode::BaseConverter<
+    T, std::enable_if_t<std::is_base_of<ento::MemRegion, T>::value>>
+    : public DynCastPtrConverter<T, ento::MemRegion> {};
+
+template <typename T>
+struct DynTypedNode::BaseConverter<
+    T, std::enable_if_t<std::is_base_of<ento::SymExpr, T>::value>>
+    : public DynCastPtrConverter<T, ento::SymExpr> {};
+#endif // CLANG_ENABLE_STATIC_ANALYZER
+
 // The only operation we allow on unsupported types is \c get.
 // This allows to conveniently use \c DynTypedNode when having an arbitrary
 // AST node that is not supported, but prevents misuse - a user cannot create
 // a DynTypedNode from arbitrary types.
 template <typename T, typename EnablerT> struct DynTypedNode::BaseConverter {
   static const T *get(ASTNodeKind NodeKind, const char Storage[]) {
     return NULL;
   }

clang/include/clang/AST/Expr.h

static bool isArithmeticOp(Opcode Op) {
     return Op >= UO_Plus && Op <= UO_LNot;
   }
   bool isArithmeticOp() const { return isArithmeticOp(getOpcode()); }
 
   /// getOpcodeStr - Turn an Opcode enum value into the punctuation char it
   /// corresponds to, e.g. "sizeof" or "[pre]++"
   static StringRef getOpcodeStr(Opcode Op);
 
+  StringRef getOpcodeStr() const { return getOpcodeStr(getOpcode()); }
+
   /// Retrieve the unary opcode that corresponds to the given
   /// overloaded operator.
   static Opcode getOverloadedOpcode(OverloadedOperatorKind OO, bool Postfix);
 
   /// Retrieve the overloaded operator kind that corresponds to
   /// the given unary opcode.
   static OverloadedOperatorKind getOverloadedOperator(Opcode Opc);
 

clang/include/clang/AST/RecursiveASTVisitor.h

 #include "clang/Basic/Specifiers.h"
 #include "llvm/ADT/PointerIntPair.h"
 #include "llvm/ADT/SmallVector.h"
 #include "llvm/Support/Casting.h"
 #include <algorithm>
 #include <cstddef>
 #include <type_traits>
 
+#if CLANG_ENABLE_STATIC_ANALYZER
+#include "clang/StaticAnalyzer/Core/PathSensitive/SADVisitor.h"
+#endif // CLANG_ENABLE_STATIC_ANALYZER
+
 // The following three macros are used for meta programming.  The code
 // using them is responsible for defining macro OPERATOR().
 
 // All unary operators.
 #define UNARYOP_LIST()                                                         \
   OPERATOR(PostInc) OPERATOR(PostDec) OPERATOR(PreInc) OPERATOR(PreDec)        \
       OPERATOR(AddrOf) OPERATOR(Deref) OPERATOR(Plus) OPERATOR(Minus)          \
       OPERATOR(Not) OPERATOR(LNot) OPERATOR(Real) OPERATOR(Imag)               \

 
 // All compound assign operators.
 #define CAO_LIST()                                                             \
   OPERATOR(Mul) OPERATOR(Div) OPERATOR(Rem) OPERATOR(Add) OPERATOR(Sub)        \
       OPERATOR(Shl) OPERATOR(Shr) OPERATOR(And) OPERATOR(Or) OPERATOR(Xor)
 
 namespace clang {
 
+#ifndef TRY_TO
 // A helper macro to implement short-circuiting when recursing.  It
 // invokes CALL_EXPR, which must be a method call, on the derived
 // object (s.t. a user of RecursiveASTVisitor can override the method
 // in CALL_EXPR).
 #define TRY_TO(CALL_EXPR)                                                      \
   do {                                                                         \
     if (!getDerived().CALL_EXPR)                                               \
       return false;                                                            \
   } while (false)
+#endif
 
 /// A class that does preorder or postorder
 /// depth-first traversal on the entire Clang AST and visits each node.
 ///
 /// This class performs three distinct tasks:
 ///   1. traverse the AST (i.e. go to each node);
 ///   2. at a given node, walk up the class hierarchy, starting from
 ///      the node's dynamic type, until the top-most class (e.g. Stmt,

 /// overriding shouldVisitTemplateInstantiations() in the derived class
 /// to return true, in which case all known implicit and explicit
 /// instantiations will be visited at the same time as the pattern
 /// from which they were produced.
 ///
 /// By default, this visitor preorder traverses the AST. If postorder traversal
 /// is needed, the \c shouldTraversePostOrder method needs to be overridden
 /// to return \c true.
-template <typename Derived> class RecursiveASTVisitor {
+template <typename Derived>
+class RecursiveASTVisitor
+#if CLANG_ENABLE_STATIC_ANALYZER
+    : public ento::SADVisitor<Derived>
+#endif // CLANG_ENABLE_STATIC_ANALYZER
+{
 public:
   /// A queue used for performing data recursion over statements.
   /// Parameters involving this type are used to implement data
   /// recursion over Stmts and Exprs within this class, and should
   /// typically not be explicitly specified by derived classes.
   /// The bool bit indicates whether the statement has been traversed or not.
   typedef SmallVectorImpl<llvm::PointerIntPair<Stmt *, 1, bool>>
     DataRecursionQueue;

clang/include/clang/ASTMatchers/ASTMatchFinder.h

public:
   void addMatcher(const NestedNameSpecifierMatcher &NodeMatch,
                   MatchCallback *Action);
   void addMatcher(const NestedNameSpecifierLocMatcher &NodeMatch,
                   MatchCallback *Action);
   void addMatcher(const TypeLocMatcher &NodeMatch,
                   MatchCallback *Action);
   void addMatcher(const CXXCtorInitializerMatcher &NodeMatch,
                   MatchCallback *Action);
+#if CLANG_ENABLE_STATIC_ANALYZER
+  void addMatcher(const SValMatcher &NodeMatch, MatchCallback *Action);
+  void addMatcher(const MemRegionMatcher &NodeMatch, MatchCallback *Action);
+  void addMatcher(const SymExprMatcher &NodeMatch, MatchCallback *Action);
+#endif // CLANG_ENABLE_STATIC_ANALYZER
   /// @}
 
   /// Adds a matcher to execute when running over the AST.
   ///
   /// This is similar to \c addMatcher(), but it uses the dynamic interface. It
   /// is more flexible, but the lost type information enables a caller to pass
   /// a matcher that cannot match anything.
   ///
#endif // CLANG_ENABLE_STATIC_ANALYZER
   /// traversed. Useful for benchmarking.
   /// Each call to FindAll(...) will call the closure once.
   void registerTestCallbackAfterParsing(ParsingDoneTestCallback *ParsingDone);
 
   /// For each \c Matcher<> a \c MatchCallback that will be called
   /// when it matches.
   struct MatchersByType {
     std::vector<std::pair<internal::DynTypedMatcher, MatchCallback *>>
-        DeclOrStmt;
+        BaseMatchers;
     std::vector<std::pair<TypeMatcher, MatchCallback *>> Type;
     std::vector<std::pair<NestedNameSpecifierMatcher, MatchCallback *>>
         NestedNameSpecifier;
     std::vector<std::pair<NestedNameSpecifierLocMatcher, MatchCallback *>>
         NestedNameSpecifierLoc;
     std::vector<std::pair<TypeLocMatcher, MatchCallback *>> TypeLoc;
     std::vector<std::pair<CXXCtorInitializerMatcher, MatchCallback *>> CtorInit;
     /// All the callbacks in one container to simplify iteration.

clang/include/clang/ASTMatchers/ASTMatchers.h

 /// @{
 using DeclarationMatcher = internal::Matcher<Decl>;
 using StatementMatcher = internal::Matcher<Stmt>;
 using TypeMatcher = internal::Matcher<QualType>;
 using TypeLocMatcher = internal::Matcher<TypeLoc>;
 using NestedNameSpecifierMatcher = internal::Matcher<NestedNameSpecifier>;
 using NestedNameSpecifierLocMatcher = internal::Matcher<NestedNameSpecifierLoc>;
 using CXXCtorInitializerMatcher = internal::Matcher<CXXCtorInitializer>;
+#if CLANG_ENABLE_STATIC_ANALYZER
+using SValMatcher = internal::Matcher<ento::SVal>;
+using MemRegionMatcher = internal::Matcher<ento::MemRegion>;
+using SymExprMatcher = internal::Matcher<ento::SymExpr>;
+#endif // CLANG_ENABLE_STATIC_ANALYZER
 /// @}
 
 /// Matches any node.
 ///
 /// Useful when another matcher requires a child matcher, but there's no
 /// additional constraint. This will often be used with an explicit conversion
 /// to an \c internal::Matcher<> type such as \c TypeMatcher.
 ///

 /// Note that when multiple matches are involved via \c forEach* matchers,
 /// \c equalsBoundNodes acts as a filter.
 /// For example:
 /// compoundStmt(
 ///     forEachDescendant(varDecl().bind("d")),
 ///     forEachDescendant(declRefExpr(to(decl(equalsBoundNode("d"))))))
 /// will trigger a match for each combination of variable declaration
 /// and reference to that variable declaration within a compound statement.
+#ifndef CLANG_ENABLE_STATIC_ANALYZER
 AST_POLYMORPHIC_MATCHER_P(equalsBoundNode,
                           AST_POLYMORPHIC_SUPPORTED_TYPES(Stmt, Decl, Type,
                                                           QualType),
-                          std::string, ID) {
+                          std::string, ID)
+#else
+AST_POLYMORPHIC_MATCHER_P(equalsBoundNode,
+                          AST_POLYMORPHIC_SUPPORTED_TYPES(Stmt, Decl, Type,
+                                                          QualType, ento::SVal,
+                                                          ento::MemRegion,
+                                                          ento::SymExpr),
+                          std::string, ID)
+#endif // CLANG_ENABLE_STATIC_ANALYZER
+{
   // FIXME: Figure out whether it makes sense to allow this
   // on any other node types.
   // For *Loc it probably does not make sense, as those seem
   // unique. For NestedNameSepcifier it might make sense, as
   // those also have pointer identity, but I'm not sure whether
   // they're ever reused.
   internal::NotEqualsBoundNodePredicate Predicate;
   Predicate.ID = ID;
AST_POLYMORPHIC_MATCHER_P_OVERLOAD(equals,
                           AST_POLYMORPHIC_SUPPORTED_TYPES(CharacterLiteral,
                                                           CXXBoolLiteralExpr,
                                                           IntegerLiteral),
                           bool, Value, 0) {
   return internal::ValueEqualsMatcher<NodeType, ParamT>(Value)
     .matchesNode(Node);
 }
 
-AST_POLYMORPHIC_MATCHER_P_OVERLOAD(equals,
-                          AST_POLYMORPHIC_SUPPORTED_TYPES(CharacterLiteral,
-                                                          CXXBoolLiteralExpr,
-                                                          IntegerLiteral),
-                          unsigned, Value, 1) {
+#ifndef CLANG_ENABLE_STATIC_ANALYZER
+AST_POLYMORPHIC_MATCHER_P_OVERLOAD(
+    equals,
+    AST_POLYMORPHIC_SUPPORTED_TYPES(CharacterLiteral, CXXBoolLiteralExpr,
+    unsigned, Value, 1)
+#else
+AST_POLYMORPHIC_MATCHER_P_OVERLOAD(
+    equals,
+    AST_POLYMORPHIC_SUPPORTED_TYPES(CharacterLiteral, CXXBoolLiteralExpr,
+                                    IntegerLiteral, ento::nonloc::ConcreteInt,
+                                    ento::loc::ConcreteInt),
+    unsigned, Value, 1)
+#endif // CLANG_ENABLE_STATIC_ANALYZER
+{
   return internal::ValueEqualsMatcher<NodeType, ParamT>(Value)
     .matchesNode(Node);
 }
 
 AST_POLYMORPHIC_MATCHER_P_OVERLOAD(equals,
                           AST_POLYMORPHIC_SUPPORTED_TYPES(CharacterLiteral,
                                                           CXXBoolLiteralExpr,
                                                           FloatingLiteral,
                                                           IntegerLiteral),
                           double, Value, 2) {
   return internal::ValueEqualsMatcher<NodeType, ParamT>(Value)
     .matchesNode(Node);
 }
 
+#if CLANG_ENABLE_STATIC_ANALYZER
+AST_POLYMORPHIC_MATCHER_P_OVERLOAD(
+    equals,
+    AST_POLYMORPHIC_SUPPORTED_TYPES(IntegerLiteral, ento::nonloc::ConcreteInt,
+                                    ento::loc::ConcreteInt),
+    int, Value, 3) {
+  return internal::ValueEqualsMatcher<NodeType, ParamT>(Value).matchesNode(
+      Node);
+}
+#endif // CLANG_ENABLE_STATIC_ANALYZER
+
 /// Matches the operator Name of operator expressions (binary or
 /// unary).
 ///
 /// Example matches a || b (matcher = binaryOperator(hasOperatorName("||")))
 /// \code
 ///   !(a || b)
 /// \endcode
+#ifndef CLANG_ENABLE_STATIC_ANALYZER
 AST_POLYMORPHIC_MATCHER_P(hasOperatorName,
                           AST_POLYMORPHIC_SUPPORTED_TYPES(BinaryOperator,
                                                           UnaryOperator),
-                          std::string, Name) {
-  return Name == Node.getOpcodeStr(Node.getOpcode());
-}
+                          std::string, Name)
+#else
+AST_POLYMORPHIC_MATCHER_P(hasOperatorName,
+                          AST_POLYMORPHIC_SUPPORTED_TYPES(BinaryOperator,
+                                                          UnaryOperator,
+                                                          ento::BinarySymExpr),
+                          std::string, Name)
+#endif // CLANG_ENABLE_STATIC_ANALYZER
+{ return Name == Node.getOpcodeStr(); }
 
 /// Matches operator expressions (binary or unary) that have any of the
 /// specified names.
 ///
 ///    hasAnyOperatorName("+", "-")
 ///  Is equivalent to
 ///    anyOf(hasOperatorName("+"), hasOperatorName("-"))
 extern const internal::VariadicFunction<
     internal::PolymorphicMatcherWithParam1<
         internal::HasAnyOperatorNameMatcher, std::vector<std::string>,
-        AST_POLYMORPHIC_SUPPORTED_TYPES(BinaryOperator, UnaryOperator)>,
+#ifndef CLANG_ENABLE_STATIC_ANALYZER
+        AST_POLYMORPHIC_SUPPORTED_TYPES(BinaryOperator, UnaryOperator)
+#else
+        AST_POLYMORPHIC_SUPPORTED_TYPES(BinaryOperator, UnaryOperator,
+                                        ento::BinarySymExpr)
+#endif // CLANG_ENABLE_STATIC_ANALYZER
+        >,
     StringRef, internal::hasAnyOperatorNameFunc>
     hasAnyOperatorName;
 
 /// Matches all kinds of assignment operators.
 ///
 /// Example 1: matches a += b (matcher = binaryOperator(isAssignmentOperator()))
 /// \code
 ///   if (a == b)

 
 /// Matches if either the left hand side or the right hand side of a
 /// binary operator matches.
 inline internal::Matcher<BinaryOperator> hasEitherOperand(
     const internal::Matcher<Expr> &InnerMatcher) {
   return anyOf(hasLHS(InnerMatcher), hasRHS(InnerMatcher));
 }
 
+#ifdef CLANG_ENABLE_STATIC_ANALYZER
+
+AST_POLYMORPHIC_MATCHER_P_OVERLOAD(
+    hasSymLHS,
+    AST_POLYMORPHIC_SUPPORTED_TYPES(ento::SymIntExpr, ento::SymSymExpr),
+    internal::Matcher<ento::SymExpr>, InnerMatcher, 0) {
+  const ento::SymExpr *LHS = Node.getLHS();
+  return InnerMatcher.matches(*LHS, Finder, Builder);
+}
+
+AST_MATCHER_P_OVERLOAD(ento::IntSymExpr, hasSymLHS,
+                       internal::Matcher<ento::nonloc::ConcreteInt>,
+                       InnerMatcher, 1) {
+  ento::nonloc::ConcreteInt LHS(Node.getLHS());
+  return InnerMatcher.matches(LHS, Finder, Builder);
+}
+
+AST_POLYMORPHIC_MATCHER_P_OVERLOAD(
+    hasSymRHS,
+    AST_POLYMORPHIC_SUPPORTED_TYPES(ento::IntSymExpr, ento::SymSymExpr),
+    internal::Matcher<ento::SymExpr>, InnerMatcher, 0) {
+  const ento::SymExpr *RHS = Node.getLHS();
+  return InnerMatcher.matches(*RHS, Finder, Builder);
+}
+
+AST_MATCHER_P_OVERLOAD(ento::SymIntExpr, hasSymRHS,
+                       internal::Matcher<ento::nonloc::ConcreteInt>,
+                       InnerMatcher, 1) {
+  ento::nonloc::ConcreteInt RHS(Node.getRHS());
+  return InnerMatcher.matches(RHS, Finder, Builder);
+}
+
+#endif // CLANG_ENABLE_STATIC_ANALYZER
+
 /// Matches if the operand of a unary operator matches.
 ///
 /// Example matches true (matcher = hasUnaryOperand(
 ///                                   cxxBoolLiteral(equals(true))))
 /// \code
 ///   !true
 /// \endcode
 AST_MATCHER_P(UnaryOperator, hasUnaryOperand,

 }
 /// Matches if a node equals another node.
 ///
 /// \c Type has pointer identity in the AST.
 AST_MATCHER_P_OVERLOAD(Type, equalsNode, const Type*, Other, 2) {
     return &Node == Other;
 }
 
+#if CLANG_ENABLE_STATIC_ANALYZER
+
+AST_MATCHER_P_OVERLOAD(ento::SVal, equalsNode, ento::SVal, Other, 3) {
+  return Node == Other;
+}
+
+AST_MATCHER_P_OVERLOAD(ento::MemRegion, equalsNode, const ento::MemRegion *,
+                       Other, 4) {
+  return &Node == Other;
+}
+
+AST_MATCHER_P_OVERLOAD(ento::SymExpr, equalsNode, const ento::SymExpr *, Other,
+                       5) {
+  return &Node == Other;
+}
+
+#endif // CLANG_ENABLE_STATIC_ANALYZER
+
 /// @}
 
 /// Matches each case or default statement belonging to the given switch
 /// statement. This matcher may produce multiple matches.
 ///
 /// Given
 /// \code
 ///   switch (1) { case 1: case 2: default: switch (2) { case 3: case 4: ; } }
return llvm::omp::isAllowedClauseForDirective(
       Node.getDirectiveKind(), CKind,
       Finder->getASTContext().getLangOpts().OpenMP);
 }
 
 //----------------------------------------------------------------------------//
 // End OpenMP handling.
 //----------------------------------------------------------------------------//
 
+#if CLANG_ENABLE_STATIC_ANALYZER
+
+//===----------------------------------------------------------------------===//
+// Static Analyzer Data.
+//===----------------------------------------------------------------------===//
+
+//===----------------------------------------------------------------------===//
+// MemRegion.
+//===----------------------------------------------------------------------===//
+
+AST_MATCHER_P(ento::MemRegion, hasBaseRegion,
+              internal::Matcher<ento::MemRegion>, InnerMatcher) {
+  return InnerMatcher.matches(*Node.getBaseRegion(), Finder, Builder);
+}
+
+AST_MATCHER_P(ento::MemRegion, hasSymbolicBase,
+              internal::Matcher<ento::SymbolicRegion>, InnerMatcher) {
+  const ento::SymbolicRegion *SR = Node.getSymbolicBase();
+  return SR && InnerMatcher.matches(*SR, Finder, Builder);
+}
+
+AST_MATCHER_P(ento::MemRegion, hasSuperRegion,
+              internal::Matcher<ento::MemRegion>, InnerMatcher) {
+  const auto *SR = Node.getAs<ento::SubRegion>();
+  return SR && InnerMatcher.matches(*SR->getSuperRegion(), Finder, Builder);
+}
+
+AST_MATCHER_P(ento::MemRegion, hasMostDerivedObjectRegion,
+              internal::Matcher<ento::MemRegion>, InnerMatcher) {
+  return InnerMatcher.matches(*Node.getMostDerivedObjectRegion(), Finder,
+                              Builder);
+}
+
+AST_MATCHER_P(ento::MemRegion, hasMemorySpace,
+              internal::Matcher<ento::MemSpaceRegion>, InnerMatcher) {
+  return InnerMatcher.matches(*Node.getMemorySpace(), Finder, Builder);
+}
+
+AST_MATCHER_P(ento::MemRegion, isSubRegionOf, const ento::MemRegion *, MR) {
+  return Node.isSubRegionOf(MR);
+}
+
+AST_MATCHER_P(ento::VarRegion, hasDecl, internal::Matcher<VarDecl>,
+              InnerMatcher) {
+  return InnerMatcher.matches(*Node.getDecl(), Finder, Builder);
+}
+
+extern const internal::VariadicAllOfMatcher<ento::SVal> sVal;
+template <typename T>
+using SValMatch = const internal::VariadicDynCastAllOfMatcher<ento::SVal, T>;
+extern SValMatch<ento::DefinedSVal> definedSVal;
+extern SValMatch<ento::DefinedOrUnknownSVal> definedOrUnknownSVal;
+extern SValMatch<ento::UndefinedVal> undefinedVal;
+extern SValMatch<ento::UnknownVal> unknownVal;
+extern SValMatch<ento::loc::ConcreteInt> locConcreteInt;
+extern SValMatch<ento::loc::GotoLabel> locGotoLabel;
+extern SValMatch<ento::loc::MemRegionVal> locMemRegionVal;
+extern SValMatch<ento::nonloc::CompoundVal> compoundVal;
+extern SValMatch<ento::nonloc::ConcreteInt> nonLocConcreteInt;
+extern SValMatch<ento::nonloc::LazyCompoundVal> lazyCompoundVal;
+extern SValMatch<ento::nonloc::LocAsInteger> locAsInteger;
+extern SValMatch<ento::nonloc::PointerToMember> pointerToMember;
+extern SValMatch<ento::nonloc::SymbolVal> symbolVal;
+
+extern const internal::VariadicAllOfMatcher<ento::MemRegion> memRegion;
+template <typename T>
+using MemRegionMatch =
+    const internal::VariadicDynCastAllOfMatcher<ento::MemRegion, T>;
+extern MemRegionMatch<ento::AllocaRegion> allocaRegion;
+extern MemRegionMatch<ento::BlockCodeRegion> blockCodeRegion;
+extern MemRegionMatch<ento::BlockDataRegion> blockDataRegion;
+extern MemRegionMatch<ento::CodeTextRegion> codeTextRegion;
+extern MemRegionMatch<ento::CompoundLiteralRegion> compoundLiteralRegion;
+extern MemRegionMatch<ento::CXXBaseObjectRegion> cxxBaseObjectRegion;
+extern MemRegionMatch<ento::CXXDerivedObjectRegion> cxxDerivedObjectRegion;
+extern MemRegionMatch<ento::CXXTempObjectRegion> cxxTempObjectRegion;
+extern MemRegionMatch<ento::CXXThisRegion> cxxThisRegion;
+extern MemRegionMatch<ento::DeclRegion> declRegion;
+extern MemRegionMatch<ento::ElementRegion> elementRegion;
+extern MemRegionMatch<ento::FieldRegion> fieldRegion;
+extern MemRegionMatch<ento::FunctionCodeRegion> functionCodeRegion;
+extern MemRegionMatch<ento::ObjCIvarRegion> objcIvarRegion;
+extern MemRegionMatch<ento::ObjCStringRegion> objcStringRegion;
+extern MemRegionMatch<ento::StringRegion> stringRegion;
+extern MemRegionMatch<ento::SubRegion> subRegion;
+extern MemRegionMatch<ento::SymbolicRegion> symbolicRegion;
+extern MemRegionMatch<ento::TypedRegion> typedRegion;
+extern MemRegionMatch<ento::TypedValueRegion> typedValueRegion;
+extern MemRegionMatch<ento::VarRegion> varRegion;
+
+extern MemRegionMatch<ento::CodeSpaceRegion> codeSpaceRegion;
+extern MemRegionMatch<ento::GlobalImmutableSpaceRegion>
+    globalImmutableSpaceRegion;
+extern MemRegionMatch<ento::GlobalInternalSpaceRegion>
+    globalInternalSpaceRegion;
+extern MemRegionMatch<ento::GlobalSystemSpaceRegion> globalSystemSpaceRegion;
+extern MemRegionMatch<ento::GlobalsSpaceRegion> globalsSpaceRegion;
+extern MemRegionMatch<ento::HeapSpaceRegion> heapSpaceRegion;
+extern MemRegionMatch<ento::MemSpaceRegion> memSpaceRegion;
+extern MemRegionMatch<ento::NonStaticGlobalSpaceRegion>
+    nonStaticGlobalSpaceRegion;
+extern MemRegionMatch<ento::StackSpaceRegion> stackSpaceRegion;
+extern MemRegionMatch<ento::StackArgumentsSpaceRegion>
+    stackArgumentsSpaceRegion;
+extern MemRegionMatch<ento::StackLocalsSpaceRegion> stackLocalsSpaceRegion;
+extern MemRegionMatch<ento::StaticGlobalSpaceRegion> staticGlobalSpaceRegion;
+extern MemRegionMatch<ento::UnknownSpaceRegion> unknownSpaceRegion;
+
+extern const internal::VariadicAllOfMatcher<ento::SymExpr> symExpr;
+template <typename T>
+using SymExprMatch =
+    const internal::VariadicDynCastAllOfMatcher<ento::SymExpr, T>;
+extern SymExprMatch<ento::BinarySymExpr> binarySymExpr;
+extern SymExprMatch<ento::IntSymExpr> intSymExpr;
+extern SymExprMatch<ento::SymIntExpr> symIntExpr;
+extern SymExprMatch<ento::SymSymExpr> symSymExpr;
+extern SymExprMatch<ento::SymbolCast> symbolCast;
+extern SymExprMatch<ento::SymbolConjured> symbolConjured;
+extern SymExprMatch<ento::SymbolData> symbolData;
+extern SymExprMatch<ento::SymbolDerived> symbolDerived;
+extern SymExprMatch<ento::SymbolExtent> symbolExtent;
+extern SymExprMatch<ento::SymbolRegionValue> symbolRegionValue;
+extern SymExprMatch<ento::SymbolMetadata> symbolMetadata;
+
+#endif // CLANG_ENABLE_STATIC_ANALYZER
+
 } // namespace ast_matchers
 } // namespace clang
 
 #endif // LLVM_CLANG_ASTMATCHERS_ASTMATCHERS_H

clang/include/clang/ASTMatchers/ASTMatchersInternal.h

struct IsBaseType {
   static const bool value =
       std::is_same<T, Decl>::value ||
       std::is_same<T, Stmt>::value ||
       std::is_same<T, QualType>::value ||
       std::is_same<T, Type>::value ||
       std::is_same<T, TypeLoc>::value ||
       std::is_same<T, NestedNameSpecifier>::value ||
       std::is_same<T, NestedNameSpecifierLoc>::value ||
+#if CLANG_ENABLE_STATIC_ANALYZER
+      std::is_same<T, ento::SVal>::value ||
+      std::is_same<T, ento::MemRegion>::value ||
+      std::is_same<T, ento::SymExpr>::value ||
+#endif // CLANG_ENABLE_STATIC_ANALYZER
       std::is_same<T, CXXCtorInitializer>::value;
 };
 template <typename T>
 const bool IsBaseType<T>::value;
 
 /// Interface that allows matchers to traverse the AST.
 /// FIXME: Find a better name.
 ///
public:
   bool matchesChildOf(const T &Node, const DynTypedMatcher &Matcher,
                       BoundNodesTreeBuilder *Builder, TraversalKind Traverse,
                       BindKind Bind) {
     static_assert(std::is_base_of<Decl, T>::value ||
                   std::is_base_of<Stmt, T>::value ||
                   std::is_base_of<NestedNameSpecifier, T>::value ||
                   std::is_base_of<NestedNameSpecifierLoc, T>::value ||
                   std::is_base_of<TypeLoc, T>::value ||
+#if CLANG_ENABLE_STATIC_ANALYZER
+                  std::is_base_of<ento::SVal, T>::value ||
+                  std::is_base_of<ento::MemRegion, T>::value ||
+                  std::is_base_of<ento::SymExpr, T>::value ||
+#endif // CLANG_ENABLE_STATIC_ANALYZER
                   std::is_base_of<QualType, T>::value,
                   "unsupported type for recursive matching");
     return matchesChildOf(DynTypedNode::create(Node), getASTContext(), Matcher,
                           Builder, Traverse, Bind);
   }
 
   template <typename T>
   bool matchesDescendantOf(const T &Node,
                            const DynTypedMatcher &Matcher,
                            BoundNodesTreeBuilder *Builder,
                            BindKind Bind) {
     static_assert(std::is_base_of<Decl, T>::value ||
                   std::is_base_of<Stmt, T>::value ||
                   std::is_base_of<NestedNameSpecifier, T>::value ||
                   std::is_base_of<NestedNameSpecifierLoc, T>::value ||
                   std::is_base_of<TypeLoc, T>::value ||
+#if CLANG_ENABLE_STATIC_ANALYZER
+                  std::is_base_of<ento::SVal, T>::value ||
+                  std::is_base_of<ento::MemRegion, T>::value ||
+                  std::is_base_of<ento::SymExpr, T>::value ||
+#endif // CLANG_ENABLE_STATIC_ANALYZER
                   std::is_base_of<QualType, T>::value,
                   "unsupported type for recursive matching");
     return matchesDescendantOf(DynTypedNode::create(Node), getASTContext(),
                                Matcher, Builder, Bind);
   }
 
   // FIXME: Implement support for BindKind.
   template <typename T>
   bool matchesAncestorOf(const T &Node,
                          const DynTypedMatcher &Matcher,
                          BoundNodesTreeBuilder *Builder,
                          AncestorMatchMode MatchMode) {
     static_assert(std::is_base_of<Decl, T>::value ||
                       std::is_base_of<NestedNameSpecifierLoc, T>::value ||
                       std::is_base_of<Stmt, T>::value ||
+#if CLANG_ENABLE_STATIC_ANALYZER
+                      std::is_base_of<ento::SVal, T>::value ||
+                      std::is_base_of<ento::MemRegion, T>::value ||
+                      std::is_base_of<ento::SymExpr, T>::value ||
+#endif // CLANG_ENABLE_STATIC_ANALYZER
                       std::is_base_of<TypeLoc, T>::value,
                   "type not allowed for recursive matching");
     return matchesAncestorOf(DynTypedNode::create(Node), getASTContext(),
                              Matcher, Builder, MatchMode);
   }
 
   virtual ASTContext &getASTContext() const = 0;
 
struct TypeListContainsSuperOf<EmptyTypeList, T> {
   static const bool value = false;
 };
 
 /// A "type list" that contains all types.
 ///
 /// Useful for matchers like \c anything and \c unless.
 using AllNodeBaseTypes =
     TypeList<Decl, Stmt, NestedNameSpecifier, NestedNameSpecifierLoc, QualType,
-             Type, TypeLoc, CXXCtorInitializer>;
+             Type, TypeLoc,
+#if CLANG_ENABLE_STATIC_ANALYZER
+             ento::SVal, ento::MemRegion, ento::SymExpr,
+#endif // CLANG_ENABLE_STATIC_ANALYZER
+             CXXCtorInitializer>;
 
 /// Helper meta-function to extract the argument out of a function of
 ///   type void(Arg).
 ///
 /// See AST_POLYMORPHIC_SUPPORTED_TYPES for details.
 template <class T> struct ExtractFunctionArgMeta;
 template <class T> struct ExtractFunctionArgMeta<void(T)> {
   using type = T;

 
 /// Matches on nodes that have a getValue() method if getValue() equals
 /// the value the ValueEqualsMatcher was constructed with.
 template <typename T, typename ValueT>
 class ValueEqualsMatcher : public SingleNodeMatcherInterface<T> {
   static_assert(std::is_base_of<CharacterLiteral, T>::value ||
                 std::is_base_of<CXXBoolLiteralExpr, T>::value ||
                 std::is_base_of<FloatingLiteral, T>::value ||
+#if CLANG_ENABLE_STATIC_ANALYZER
+                std::is_base_of<ento::loc::ConcreteInt, T>::value ||
+                std::is_base_of<ento::nonloc::ConcreteInt, T>::value ||
+#endif // CLANG_ENABLE_STATIC_ANALYZER
                 std::is_base_of<IntegerLiteral, T>::value,
                 "the node must have a getValue method");
 
 public:
   explicit ValueEqualsMatcher(const ValueT &ExpectedValue)
       : ExpectedValue(ExpectedValue) {}
 
   bool matchesNode(const T &Node) const override {

 
 /// Matches overloaded operators with a specific name.
 ///
 /// The type argument ArgT is not used by this matcher but is used by
 /// PolymorphicMatcherWithParam1 and should be std::vector<std::string>>.
 template <typename T, typename ArgT = std::vector<std::string>>
 class HasAnyOperatorNameMatcher : public SingleNodeMatcherInterface<T> {
   static_assert(std::is_same<T, BinaryOperator>::value ||
+#if CLANG_ENABLE_STATIC_ANALYZER
+                    std::is_base_of<ento::BinarySymExpr, T>::value ||
+#endif // CLANG_ENABLE_STATIC_ANALYZER
                     std::is_same<T, UnaryOperator>::value,
                 "Matcher only supports `BinaryOperator` and `UnaryOperator`");
   static_assert(std::is_same<ArgT, std::vector<std::string>>::value,
                 "Matcher ArgT must be std::vector<std::string>");
 
 public:
   explicit HasAnyOperatorNameMatcher(std::vector<std::string> Names)
       : SingleNodeMatcherInterface<T>(), Names(std::move(Names)) {}
 
   bool matchesNode(const T &Node) const override {
-    StringRef OpName = getOpName(Node);
+    StringRef OpName = Node.getOpcodeStr();
     return llvm::any_of(
         Names, [&](const std::string &Name) { return Name == OpName; });
   }
 
-private:
-  static StringRef getOpName(const UnaryOperator &Node) {
-    return Node.getOpcodeStr(Node.getOpcode());
-  }
-  static StringRef getOpName(const BinaryOperator &Node) {
-    return Node.getOpcodeStr();
-  }
-
   const std::vector<std::string> Names;
 };
 
 using HasOpNameMatcher =
     PolymorphicMatcherWithParam1<HasAnyOperatorNameMatcher,
                                  std::vector<std::string>,
-                                 void(TypeList<BinaryOperator, UnaryOperator>)>;
+#ifndef CLANG_ENABLE_STATIC_ANALYZER
+                                 void(TypeList<BinaryOperator, UnaryOperator>)
+#else
+                                 void(TypeList<BinaryOperator, UnaryOperator,
+                                               ento::BinarySymExpr>)
+#endif // CLANG_ENABLE_STATIC_ANALYZER
+                                 >;
 
 HasOpNameMatcher hasAnyOperatorNameFunc(ArrayRef<const StringRef *> NameRefs);
 
 using HasOverloadOpNameMatcher = PolymorphicMatcherWithParam1<
     HasOverloadedOperatorNameMatcher, std::vector<std::string>,
     void(TypeList<CXXOperatorCallExpr, FunctionDecl>)>;
 
 HasOverloadOpNameMatcher

clang/include/clang/StaticAnalyzer/Core/PathSensitive/SADVisitor.h

+//===--- SADVisitor.h - Static Analyzer Data visitor ------------*- C++ -*-===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+#ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_SADVISITOR_H
+#define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_SADVISITOR_H
+
+#include "clang/Basic/LLVM.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h"
+
+namespace clang {
+namespace ento {
+
+#ifndef TRY_TO
+// A helper macro to implement short-circuiting when recursing.  It
+// invokes CALL_EXPR, which must be a method call, on the derived
+// object (s.t. a user of SADVisitor can override the method
+// in CALL_EXPR).
+#define TRY_TO(CALL_EXPR)                                                      \
+  do {                                                                         \
+    if (!getDerived().CALL_EXPR)                                               \
+      return false;                                                            \
+  } while (false)
+#endif // TRY_TO
+
+template <typename Derived> class SADVisitor {
+public:
+  /// Return a reference to the derived class.
+  Derived &getDerived() { return *static_cast<Derived *>(this); }
+
+  /// Traverse a symbolic value.
+  bool TraverseSVal(SVal V);
+
+  /// Traverse a memory region.
+  bool TraverseMemRegion(const MemRegion *MR);
+
+  /// Traverse a symbolic expression.
+  bool TraverseSymExpr(const SymExpr *SE);
+
+  // SVal.
+  // Declare Traverse*() for all concerete SVal classes.
+#define ABSTRACT_SVAL(Id, Parent)
+#define BASIC_SVAL(Id, Parent)
+#define LOC_SVAL(Id, Parent) bool TraverseLoc##Id(loc::Id V);
+#define NONLOC_SVAL(Id, Parent) bool TraverseNonLoc##Id(nonloc::Id V);
+#include "clang/StaticAnalyzer/Core/PathSensitive/SVals.def"
+
+  // Define empty Visit*() for all SVal classes.
+  bool VisitSVal(SVal V) { return true; }
+#define ABSTRACT_SVAL(Id, Parent)                                              \
+  bool Visit##Id(Id V) { return true; }
+#define BASIC_SVAL(Id, Parent)                                                 \
+  bool Visit##Id(Id V) { return true; }
+#define LOC_SVAL(Id, Parent)                                                   \
+  bool VisitLoc##Id(loc::Id V) { return true; }
+#define NONLOC_SVAL(Id, Parent)                                                \
+  bool VisitNonLoc##Id(nonloc::Id V) { return true; }
+#include "clang/StaticAnalyzer/Core/PathSensitive/SVals.def"
+
+  // MemRegion.
+  // Declare Traverse*() for all concerete MemRegion classes.
+#define ABSTRACT_REGION(Id, Parent)
+#define REGION(Id, Parent) bool Traverse##Id(const Id *MR);
+#include "clang/StaticAnalyzer/Core/PathSensitive/Regions.def"
+
+  // Define empty Visit*() for all MemRegion classes.
+  bool VisitMemRegion(const MemRegion *MR) { return true; }
+#define REGION(Id, Parent)                                                     \
+  bool Visit##Id(const Id *MR) { return true; }
+#define ABSTRACT_REGION(Id, Parent) REGION(Id, Parent)
+#include "clang/StaticAnalyzer/Core/PathSensitive/Regions.def"
+
+  // SymExpr.
+  // Declare Traverse*() for all concerete SymExpr classes.
+#define ABSTRACT_SYMBOL(Id, Parent)
+#define SYMBOL(Id, Parent) bool Traverse##Id(const Id *SE);
+#include "clang/StaticAnalyzer/Core/PathSensitive/Symbols.def"
+
+  // Define empty Visit*() for all SymExpr classes.
+  bool VisitSymExpr(const SymExpr *SE) { return true; }
+#define SYMBOL(Id, Parent)                                                     \
+  bool Visit##Id(const Id *SE) { return true; }
+#define ABSTRACT_SYMBOL(Id, Parent) SYMBOL(Id, Parent)
+#include "clang/StaticAnalyzer/Core/PathSensitive/Symbols.def"
+};
+
+//===----------------------------------------------------------------------===//
+// SVal.
+//===----------------------------------------------------------------------===//
+
+#define DISPATCH(NAME, CLASS)                                                  \
+  return getDerived().Traverse##NAME(V.castAs<CLASS>())
+
+template <typename Derived> bool SADVisitor<Derived>::TraverseSVal(SVal V) {
+  // Use namespace loc and nonloc.
+  switch (V.getBaseKind()) {
+  case SVal::LocKind:
+    switch (V.getSubKind()) {
+#define LOC_SVAL(Id, Parent)                                                   \
+  case loc::Id##Kind:                                                          \
+    DISPATCH(Loc##Id, loc::Id);
+#include "clang/StaticAnalyzer/Core/PathSensitive/SVals.def"
+    }
+  case SVal::NonLocKind:
+    switch (V.getSubKind()) {
+#define NONLOC_SVAL(Id, Parent)                                                \
+  case nonloc::Id##Kind:                                                       \
+    DISPATCH(NonLoc##Id, nonloc::Id);
+#include "clang/StaticAnalyzer/Core/PathSensitive/SVals.def"
+    }
+  default:
+    llvm_unreachable("BASIC_SVAL");
+  }
+  llvm_unreachable("Unhandled SVal");
+}
+
+#undef DISPATCH
+
+#define TRUE_SVAL(TRAVERSE)                                                    \
+  template <typename Derived> bool SADVisitor<Derived>::TRAVERSE {             \
+    return true;                                                               \
+  }
+#define BASIC_SVAL(Id) TRUE_SVAL(Traverse##Id(Id V))
+#define LOC_SVAL(Id) TRUE_SVAL(TraverseLoc##Id(loc::Id V))
+#define NONLOC_SVAL(Id) TRUE_SVAL(TraverseNonLoc##Id(nonloc::Id V))
+LOC_SVAL(ConcreteInt)
+LOC_SVAL(GotoLabel)
+NONLOC_SVAL(ConcreteInt)
+NONLOC_SVAL(LocAsInteger)
+NONLOC_SVAL(PointerToMember)
+#undef NONLOC_SVAL
+#undef LOC_SVAL
+#undef BASIC_SVAL
+#undef TRUE_SVAL
+
+template <typename Derived>
+bool SADVisitor<Derived>::TraverseLocMemRegionVal(loc::MemRegionVal V) {
+  TRY_TO(TraverseMemRegion(V.getRegion()));
+  return true;
+}
+
+template <typename Derived>
+bool SADVisitor<Derived>::TraverseNonLocCompoundVal(nonloc::CompoundVal V) {
+  /* FIXME: Make it work.
+  for (const SVal V : llvm::make_range(V.begin(), V.end()))
+    TRY_TO(TraverseSVal(V));*/
+  return true;
+}
+
+template <typename Derived>
+bool SADVisitor<Derived>::TraverseNonLocLazyCompoundVal(
+    nonloc::LazyCompoundVal V) {
+  /* FIXME: Make it work.
+  TRY_TO(TraverseMemRegion(V.getRegion()));*/
+  return true;
+}
+
+template <typename Derived>
+bool SADVisitor<Derived>::TraverseNonLocSymbolVal(nonloc::SymbolVal V) {
+  TRY_TO(TraverseSymExpr(V.getSymbol()));
+  return true;
+}
+
+//===----------------------------------------------------------------------===//
+// MemRegion.
+//===----------------------------------------------------------------------===//
+
+#define DISPATCH(CLASS) return getDerived().Traverse##CLASS(cast<CLASS>(MR))
+
+template <typename Derived>
+bool SADVisitor<Derived>::TraverseMemRegion(const MemRegion *MR) {
+  switch (MR->getKind()) {
+#define REGION(Id, Parent)                                                     \
+  case MemRegion::Id##Kind:                                                    \
+    DISPATCH(Id);
+#include "clang/StaticAnalyzer/Core/PathSensitive/Regions.def"
+  }
+  llvm_unreachable("Unhandled MemRegion");
+}
+
+#undef DISPATCH
+
+#define REGION(CLASS)                                                          \
+  template <typename Derived>                                                  \
+  bool SADVisitor<Derived>::Traverse##CLASS(const CLASS *MR) {                 \
+    return true;                                                               \
+  }
+REGION(AllocaRegion)
+REGION(BlockCodeRegion)
+REGION(BlockDataRegion)
+REGION(CompoundLiteralRegion)
+REGION(CXXBaseObjectRegion)
+REGION(CXXDerivedObjectRegion)
+REGION(CXXTempObjectRegion)
+REGION(CXXThisRegion)
+REGION(ElementRegion)
+REGION(FieldRegion)
+REGION(FunctionCodeRegion)
+REGION(ObjCIvarRegion)
+REGION(ObjCStringRegion)
+REGION(StringRegion)
+REGION(VarRegion)
+
+REGION(CodeSpaceRegion)
+REGION(GlobalImmutableSpaceRegion)
+REGION(GlobalInternalSpaceRegion)
+REGION(GlobalSystemSpaceRegion)
+REGION(HeapSpaceRegion)
+REGION(StackArgumentsSpaceRegion)
+REGION(StackLocalsSpaceRegion)
+REGION(StaticGlobalSpaceRegion)
+REGION(UnknownSpaceRegion)
+
+template <typename Derived>
+bool SADVisitor<Derived>::TraverseSymbolicRegion(const SymbolicRegion *MR) {
+  TRY_TO(TraverseSymExpr(MR->getSymbol()));
+  return true;
+}
+
+#undef REGION
+
+//===----------------------------------------------------------------------===//
+// SymExpr.
+//===----------------------------------------------------------------------===//
+
+#define DISPATCH(CLASS) return getDerived().Traverse##CLASS(cast<CLASS>(SE))
+
+template <typename Derived>
+bool SADVisitor<Derived>::TraverseSymExpr(const SymExpr *SE) {
+  switch (SE->getKind()) {
+#define SYMBOL(Id, Parent)                                                     \
+  case SymExpr::Id##Kind:                                                      \
+    DISPATCH(Id);
+#include "clang/StaticAnalyzer/Core/PathSensitive/Symbols.def"
+  }
+  llvm_unreachable("Unhandled SymExpr");
+}
+
+#undef DISPATCH
+
+template <typename Derived>
+bool SADVisitor<Derived>::TraverseIntSymExpr(const IntSymExpr *SE) {
+  TRY_TO(TraverseSVal(nonloc::ConcreteInt(SE->getLHS())));
+  TRY_TO(TraverseSymExpr(SE->getRHS()));
+  return true;
+}
+
+template <typename Derived>
+bool SADVisitor<Derived>::TraverseSymIntExpr(const SymIntExpr *SE) {
+  TRY_TO(TraverseSymExpr(SE->getLHS()));
+  TRY_TO(TraverseSVal(nonloc::ConcreteInt(SE->getRHS())));
+  return true;
+}
+
+template <typename Derived>
+bool SADVisitor<Derived>::TraverseSymSymExpr(const SymSymExpr *SE) {
+  TRY_TO(TraverseSymExpr(SE->getLHS()));
+  TRY_TO(TraverseSymExpr(SE->getRHS()));
+  return true;
+}
+
+template <typename Derived>
+bool SADVisitor<Derived>::TraverseSymbolCast(const SymbolCast *SE) {
+  return true;
+}
+
+template <typename Derived>
+bool SADVisitor<Derived>::TraverseSymbolConjured(const SymbolConjured *SE) {
+  return true;
+}
+
+template <typename Derived>
+bool SADVisitor<Derived>::TraverseSymbolDerived(const SymbolDerived *SE) {
+  // FIXME: Match on parent?
+  TRY_TO(TraverseMemRegion(SE->getRegion()));
+  return true;
+}
+
+template <typename Derived>
+bool SADVisitor<Derived>::TraverseSymbolExtent(const SymbolExtent *SE) {
+  TRY_TO(TraverseMemRegion(SE->getRegion()));
+  return true;
+}
+
+template <typename Derived>
+bool SADVisitor<Derived>::TraverseSymbolMetadata(const SymbolMetadata *SE) {
+  TRY_TO(TraverseMemRegion(SE->getRegion()));
+  return true;
+}
+
+template <typename Derived>
+bool SADVisitor<Derived>::TraverseSymbolRegionValue(
+    const SymbolRegionValue *SE) {
+  TRY_TO(TraverseMemRegion(SE->getRegion()));
+  return true;
+}
+
+#undef TRY_TO
+
+} // namespace ento
+} // namespace clang
+
+#endif // LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_SADVISITOR_H

clang/include/clang/StaticAnalyzer/Core/PathSensitive/SVals.h

public:
   bool operator==(const SVal &R) const {
     return getRawKind() == R.getRawKind() && Data == R.Data;
   }
 
   bool operator!=(const SVal &R) const {
     return !(*this == R);
   }
 
+  bool operator<(const SVal &R) const {
+    return getRawKind() < R.getRawKind() && Data < R.Data;
+  }
+
   bool isUnknown() const {
     return getRawKind() == UnknownValKind;
   }
 
   bool isUndef() const {
     return getRawKind() == UndefinedValKind;
   }
 
if (SE)
       return SE->symbol_begin();
     else
       return SymExpr::symbol_iterator();
   }
 
   SymExpr::symbol_iterator symbol_end() const {
     return SymExpr::symbol_end();
   }
+
+  const void *getRawData() const { return Data; }
 };
 
 inline raw_ostream &operator<<(raw_ostream &os, clang::ento::SVal V) {
   V.dumpToStream(os);
   return os;
 }
 
 class UndefinedVal : public SVal {

clang/include/clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h

 
 public:
   // FIXME: We probably need to make this out-of-line to avoid redundant
   // generation of virtual functions.
   QualType getType() const override { return T; }
 
   BinaryOperator::Opcode getOpcode() const { return Op; }
 
+  StringRef getOpcodeStr() const { return BinaryOperator::getOpcodeStr(Op); };
+
   // Implement isa<T> support.
   static bool classof(const SymExpr *SE) {
     Kind k = SE->getKind();
     return k >= BEGIN_BINARYSYMEXPRS && k <= END_BINARYSYMEXPRS;
   }
 };
 
 /// Represents a symbolic expression like 'x' + 3.

clang/lib/AST/ASTTypeTraits.cpp

 //===----------------------------------------------------------------------===//
 
 #include "clang/AST/ASTTypeTraits.h"
 #include "clang/AST/ASTContext.h"
 #include "clang/AST/DeclCXX.h"
 #include "clang/AST/NestedNameSpecifier.h"
 #include "clang/AST/OpenMPClause.h"
 
+#if CLANG_ENABLE_STATIC_ANALYZER
+#include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h"
+#endif // CLANG_ENABLE_STATIC_ANALYZER
+
 using namespace clang;
 
 const ASTNodeKind::KindInfo ASTNodeKind::AllKindInfo[] = {
   { NKI_None, "<None>" },
   { NKI_None, "TemplateArgument" },
   { NKI_None, "TemplateName" },
   { NKI_None, "NestedNameSpecifierLoc" },
   { NKI_None, "QualType" },
   { NKI_None, "TypeLoc" },
   { NKI_None, "CXXCtorInitializer" },
   { NKI_None, "NestedNameSpecifier" },
   { NKI_None, "Decl" },
 #define DECL(DERIVED, BASE) { NKI_##BASE, #DERIVED "Decl" },
 #include "clang/AST/DeclNodes.inc"
   { NKI_None, "Stmt" },
 #define STMT(DERIVED, BASE) { NKI_##BASE, #DERIVED },
 #include "clang/AST/StmtNodes.inc"
   { NKI_None, "Type" },
 #define TYPE(DERIVED, BASE) { NKI_##BASE, #DERIVED "Type" },
 #include "clang/AST/TypeNodes.inc"
   { NKI_None, "OMPClause" },
 #define OMP_CLAUSE_CLASS(Enum, Str, Class) {NKI_OMPClause, #Class},
 #include "llvm/Frontend/OpenMP/OMPKinds.def"
+
+#if CLANG_ENABLE_STATIC_ANALYZER
+    {NKI_None, "MemRegion"},
+#define REGION(DERIVED, BASE) {NKI_##BASE, #DERIVED},
+#define ABSTRACT_REGION(DERIVED, BASE) REGION(DERIVED, BASE)
+#include "clang/StaticAnalyzer/Core/PathSensitive/Regions.def"
+    {NKI_None, "SymExpr"},
+#define SYMBOL(DERIVED, BASE) {NKI_##BASE, #DERIVED},
+#define ABSTRACT_SYMBOL(DERIVED, BASE) SYMBOL(DERIVED, BASE)
+#include "clang/StaticAnalyzer/Core/PathSensitive/Symbols.def"
+    {NKI_None, "SVal"},
+#define BASIC_SVAL(DERIVED, BASE) {NKI_##BASE, #DERIVED},
+#define ABSTRACT_SVAL(DERIVED, BASE) BASIC_SVAL(DERIVED, BASE)
+#define LOC_SVAL(DERIVED, BASE) {NKI_##BASE, #DERIVED},
+#define NONLOC_SVAL(DERIVED, BASE) {NKI_##BASE, #DERIVED},
+#include "clang/StaticAnalyzer/Core/PathSensitive/SVals.def"
+#endif // CLANG_ENABLE_STATIC_ANALYZER
 };
 
 bool ASTNodeKind::isBaseOf(ASTNodeKind Other, unsigned *Distance) const {
   return isBaseOf(KindId, Other.KindId, Distance);
 }
 
 bool ASTNodeKind::isBaseOf(NodeKindId Base, NodeKindId Derived,
                            unsigned *Distance) {

 #define OMP_CLAUSE_NO_CLASS(Enum, Str)                                         \
   case llvm::omp::Clause::Enum:                                                \
     llvm_unreachable("unexpected OpenMP clause kind");
 #include "llvm/Frontend/OpenMP/OMPKinds.def"
   }
   llvm_unreachable("invalid stmt kind");
 }
 
+#if CLANG_ENABLE_STATIC_ANALYZER
+
+ASTNodeKind ASTNodeKind::getFromNode(const ento::SVal &V) {
+  switch (V.getBaseKind()) {
+#define BASIC_SVAL(DERIVED, BASE)                                              \
+  case ento::SVal::DERIVED##Kind:                                              \
+    return ASTNodeKind(NKI_##DERIVED);
+#include "clang/StaticAnalyzer/Core/PathSensitive/SVals.def"
+  case ento::SVal::NonLocKind: {
+    switch (V.getSubKind()) {
+#define NONLOC_SVAL(DERIVED, BASE)                                             \
+  case ento::nonloc::DERIVED##Kind:                                            \
+    return ASTNodeKind(NKI_nonloc_##DERIVED);
+#include "clang/StaticAnalyzer/Core/PathSensitive/SVals.def"
+    }
+  }
+  case ento::SVal::LocKind: {
+    switch (V.getSubKind()) {
+#define LOC_SVAL(DERIVED, BASE)                                                \
+  case ento::loc::DERIVED##Kind:                                               \
+    return ASTNodeKind(NKI_loc_##DERIVED);
+#include "clang/StaticAnalyzer/Core/PathSensitive/SVals.def"
+    }
+  }
+  }
+  llvm_unreachable("Unhandled SVal");
+}
+
+ASTNodeKind ASTNodeKind::getFromNode(const ento::MemRegion &MR) {
+  switch (MR.getKind()) {
+#define REGION(DERIVED, BASE)                                                  \
+  case ento::MemRegion::DERIVED##Kind:                                         \
+    return ASTNodeKind(NKI_##DERIVED);
+#include "clang/StaticAnalyzer/Core/PathSensitive/Regions.def"
+  }
+  llvm_unreachable("Unhandled MemRegion");
+}
+
+ASTNodeKind ASTNodeKind::getFromNode(const ento::SymExpr &SE) {
+  switch (SE.getKind()) {
+#define SYMBOL(DERIVED, BASE)                                                  \
+  case ento::SymExpr::DERIVED##Kind:                                           \
+    return ASTNodeKind(NKI_##DERIVED);
+#include "clang/StaticAnalyzer/Core/PathSensitive/Symbols.def"
+  }
+  llvm_unreachable("Unhandled SymExpr");
+}
+
+#endif // CLANG_ENABLE_STATIC_ANALYZER
+
 void DynTypedNode::print(llvm::raw_ostream &OS,
                          const PrintingPolicy &PP) const {
   if (const TemplateArgument *TA = get<TemplateArgument>())
     TA->print(PP, OS);
   else if (const TemplateName *TN = get<TemplateName>())
     TN->print(OS, PP);
   else if (const NestedNameSpecifier *NNS = get<NestedNameSpecifier>())
     NNS->print(OS, PP);
   else if (const NestedNameSpecifierLoc *NNSL = get<NestedNameSpecifierLoc>()) {
     if (const NestedNameSpecifier *NNS = NNSL->getNestedNameSpecifier())
       NNS->print(OS, PP);
     else
       OS << "(empty NestedNameSpecifierLoc)";
   } else if (const QualType *QT = get<QualType>())
     QT->print(OS, PP);
   else if (const TypeLoc *TL = get<TypeLoc>())
     TL->getType().print(OS, PP);
   else if (const Decl *D = get<Decl>())
     D->print(OS, PP);
   else if (const Stmt *S = get<Stmt>())
     S->printPretty(OS, nullptr, PP);
   else if (const Type *T = get<Type>())
     QualType(T, 0).print(OS, PP);
+#if CLANG_ENABLE_STATIC_ANALYZER
+  else if (const auto *V = get<ento::SVal>())
+    OS << V;
+  else if (const auto *MR = get<ento::MemRegion>())
+    OS << MR;
+  else if (const auto *SE = get<ento::SymExpr>())
+    OS << SE;
+#endif // CLANG_ENABLE_STATIC_ANALYZER
   else
     OS << "Unable to print values of type " << NodeKind.asStringRef() << "\n";
 }
 
 void DynTypedNode::dump(llvm::raw_ostream &OS, SourceManager &SM) const {
   if (const Decl *D = get<Decl>())
     D->dump(OS);
   else if (const Stmt *S = get<Stmt>())
     S->dump(OS, SM);
   else if (const Type *T = get<Type>())
     T->dump(OS);
+#if CLANG_ENABLE_STATIC_ANALYZER
+  else if (const auto *V = get<ento::SVal>())
+    OS << V;
+  else if (const auto *MR = get<ento::MemRegion>())
+    OS << MR;
+  else if (const auto *SE = get<ento::SymExpr>())
+    OS << SE;
+#endif // CLANG_ENABLE_STATIC_ANALYZER
   else
     OS << "Unable to dump values of type " << NodeKind.asStringRef() << "\n";
 }
 
 SourceRange DynTypedNode::getSourceRange() const {
   if (const CXXCtorInitializer *CCI = get<CXXCtorInitializer>())
     return CCI->getSourceRange();
   if (const NestedNameSpecifierLoc *NNSL = get<NestedNameSpecifierLoc>())

clang/lib/ASTMatchers/ASTMatchFinder.cpp

 #include "clang/AST/RecursiveASTVisitor.h"
 #include "llvm/ADT/DenseMap.h"
 #include "llvm/ADT/StringMap.h"
 #include "llvm/Support/Timer.h"
 #include <deque>
 #include <memory>
 #include <set>
 
+#if CLANG_ENABLE_STATIC_ANALYZER
+#include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/SymExpr.h"
+#endif // CLANG_ENABLE_STATIC_ANALYZER
+
 namespace clang {
 namespace ast_matchers {
 namespace internal {
 namespace {
 
 typedef MatchFinder::MatchCallback MatchCallback;
 
 // The maximum number of memoization entries to store.
else if (const NestedNameSpecifierLoc *NNSLoc =
              DynNode.get<NestedNameSpecifierLoc>())
       traverse(*NNSLoc);
     else if (const QualType *Q = DynNode.get<QualType>())
       traverse(*Q);
     else if (const TypeLoc *T = DynNode.get<TypeLoc>())
       traverse(*T);
     else if (const auto *C = DynNode.get<CXXCtorInitializer>())
       traverse(*C);
+
+#if CLANG_ENABLE_STATIC_ANALYZER
+    else if (const auto *V = DynNode.get<ento::SVal>())
+      traverse(*V);
+    else if (const auto *ME = DynNode.get<ento::MemRegion>())
+      traverse(*ME);
+    else if (const auto *SE = DynNode.get<ento::SymExpr>())
+      traverse(*SE);
+#endif // CLANG_ENABLE_STATIC_ANALYZER
+
     // FIXME: Add other base types after adding tests.
 
     // It's OK to always overwrite the bound nodes, as if there was
     // no match in this recursive branch, the result set is empty
     // anyway.
     *Builder = ResultBindings;
 
     return Matches;
if (!match(*Node->getBody()))
       return false;
 
     return true;
   }
 
   bool shouldVisitTemplateInstantiations() const { return true; }
   bool shouldVisitImplicitCode() const { return true; }
 
+#if CLANG_ENABLE_STATIC_ANALYZER
+  bool TraverseSVal(ento::SVal V) {
+    ScopedIncrement ScopedDepth(&CurrentDepth);
+    if (!match(V))
+      return false;
+    return traverse(V);
+  }
+
+  bool TraverseMemRegion(const ento::MemRegion *MR) {
+    if (!MR)
+      return true;
+    ScopedIncrement ScopedDepth(&CurrentDepth);
+    if (!match(*MR))
+      return false;
+    return traverse(*MR);
+  }
+
+  bool TraverseSymExpr(const ento::SymExpr *SE) {
+    if (!SE)
+      return true;
+    ScopedIncrement ScopedDepth(&CurrentDepth);
+    if (!match(*SE))
+      return false;
+    return traverse(*SE);
+  }
+#endif // CLANG_ENABLE_STATIC_ANALYZER
+
 private:
   // Used for updating the depth during traversal.
   struct ScopedIncrement {
     explicit ScopedIncrement(int *Depth) : Depth(Depth) { ++(*Depth); }
     ~ScopedIncrement() { --(*Depth); }
 
    private:
     int *Depth;
private:
   }
   bool baseTraverse(NestedNameSpecifierLoc NNS) {
     return VisitorBase::TraverseNestedNameSpecifierLoc(NNS);
   }
   bool baseTraverse(const CXXCtorInitializer &CtorInit) {
     return VisitorBase::TraverseConstructorInitializer(
         const_cast<CXXCtorInitializer *>(&CtorInit));
   }
+#if CLANG_ENABLE_STATIC_ANALYZER
+  bool baseTraverse(const ento::SVal &V) {
+    return VisitorBase::TraverseSVal(V);
+  }
+  bool baseTraverse(const ento::MemRegion &MR) {
+    return VisitorBase::TraverseMemRegion(&MR);
+  }
+  bool baseTraverse(const ento::SymExpr &SE) {
+    return VisitorBase::TraverseSymExpr(&SE);
+  }
+#endif // CLANG_ENABLE_STATIC_ANALYZER
 
   // Sets 'Matched' to true if 'Matcher' matches 'Node' and:
   //   0 < CurrentDepth <= MaxDepth.
   //
   // Returns 'true' if traversal should continue after this function
   // returns, i.e. if no match is found or 'Bind' is 'BK_All'.
   template <typename T>
   bool match(const T &Node) {
public:
 
   bool TraverseDecl(Decl *DeclNode);
   bool TraverseStmt(Stmt *StmtNode, DataRecursionQueue *Queue = nullptr);
   bool TraverseType(QualType TypeNode);
   bool TraverseTypeLoc(TypeLoc TypeNode);
   bool TraverseNestedNameSpecifier(NestedNameSpecifier *NNS);
   bool TraverseNestedNameSpecifierLoc(NestedNameSpecifierLoc NNS);
   bool TraverseConstructorInitializer(CXXCtorInitializer *CtorInit);
+#if CLANG_ENABLE_STATIC_ANALYZER
+  bool TraverseSVal(ento::SVal V);
+  bool TraverseMemRegion(const ento::MemRegion *MR);
+  bool TraverseSymExpr(const ento::SymExpr *SE);
+#endif // CLANG_ENABLE_STATIC_ANALYZER
 
   // Matches children or descendants of 'Node' with 'BaseMatcher'.
   bool memoizedMatchesRecursively(const DynTypedNode &Node, ASTContext &Ctx,
                                   const DynTypedMatcher &Matcher,
                                   BoundNodesTreeBuilder *Builder, int MaxDepth,
                                   TraversalKind Traversal, BindKind Bind) {
     // For AST-nodes that don't have an identity, we can't memoize.
     if (!Node.getMemoizationData() || !Builder->isComparable())
if (auto *N = Node.get<Decl>()) {
       match(*N);
     } else if (auto *N = Node.get<NestedNameSpecifierLoc>()) {
       match(*N);
     } else if (auto *N = Node.get<TypeLoc>()) {
       match(*N);
     } else if (auto *N = Node.get<CXXCtorInitializer>()) {
       match(*N);
     }
+#if CLANG_ENABLE_STATIC_ANALYZER
+    else if (auto *N = Node.get<ento::SVal>())
+      match(*N);
+    else if (auto *N = Node.get<ento::MemRegion>())
+      match(*N);
+    else if (auto *N = Node.get<ento::SymExpr>())
+      match(*N);
+#endif // CLANG_ENABLE_STATIC_ANALYZER
   }
 
   template <typename T> void match(const T &Node) {
     matchDispatch(&Node);
   }
 
   // Implements ASTMatchFinder::getASTContext.
   ASTContext &getASTContext() const override { return *ActiveASTContext; }
void matchWithFilter(const DynTypedNode &DynNode) {
     const auto &Filter =
         it != MatcherFiltersMap.end() ? it->second : getFilterForKind(Kind);
 
     if (Filter.empty())
       return;
 
     const bool EnableCheckProfiling = Options.CheckProfiling.hasValue();
     TimeBucketRegion Timer;
-    auto &Matchers = this->Matchers->DeclOrStmt;
+    auto &Matchers = this->Matchers->BaseMatchers;
     for (unsigned short I : Filter) {
       auto &MP = Matchers[I];
       if (EnableCheckProfiling)
         Timer.setBucket(&TimeByBucket[MP.second->getID()]);
       BoundNodesTreeBuilder Builder;
       if (MP.first.matches(DynNode, this, &Builder)) {
         MatchVisitor Visitor(ActiveASTContext, MP.second);
         Builder.visitMatches(&Visitor);
       }
     }
   }
 
   const std::vector<unsigned short> &getFilterForKind(ASTNodeKind Kind) {
     auto &Filter = MatcherFiltersMap[Kind];
-    auto &Matchers = this->Matchers->DeclOrStmt;
+    auto &Matchers = this->Matchers->BaseMatchers;
     assert((Matchers.size() < USHRT_MAX) && "Too many matchers.");
     for (unsigned I = 0, E = Matchers.size(); I != E; ++I) {
       if (Matchers[I].first.canMatchNodesOfKind(Kind)) {
         Filter.push_back(I);
       }
     }
     return Filter;
   }
void matchDispatch(const NestedNameSpecifier *Node) {
     matchWithoutFilter(*Node, Matchers->NestedNameSpecifier);
   }
   void matchDispatch(const NestedNameSpecifierLoc *Node) {
     matchWithoutFilter(*Node, Matchers->NestedNameSpecifierLoc);
   }
   void matchDispatch(const CXXCtorInitializer *Node) {
     matchWithoutFilter(*Node, Matchers->CtorInit);
   }
+#if CLANG_ENABLE_STATIC_ANALYZER
+  void matchDispatch(const ento::SVal *Node) {
+    matchWithFilter(DynTypedNode::create(*Node));
+  }
+  void matchDispatch(const ento::MemRegion *Node) {
+    matchWithFilter(DynTypedNode::create(*Node));
+  }
+  void matchDispatch(const ento::SymExpr *Node) {
+    matchWithFilter(DynTypedNode::create(*Node));
+  }
+#endif // CLANG_ENABLE_STATIC_ANALYZER
   void matchDispatch(const void *) { /* Do nothing. */ }
   /// @}
 
   // Returns whether an ancestor of \p Node matches \p Matcher.
   //
   // The order of matching ((which can lead to different nodes being bound in
   // case there are multiple matches) is breadth first search.
   //
if (!CtorInit)
     return true;
 
   match(*CtorInit);
 
   return RecursiveASTVisitor<MatchASTVisitor>::TraverseConstructorInitializer(
       CtorInit);
 }
 
+#if CLANG_ENABLE_STATIC_ANALYZER
+bool MatchASTVisitor::TraverseSVal(ento::SVal V) {
+  match(V);
+  return RecursiveASTVisitor<MatchASTVisitor>::TraverseSVal(V);
+}
+bool MatchASTVisitor::TraverseMemRegion(const ento::MemRegion *MR) {
+  if (!MR)
+    return true;
+  match(*MR);
+  return RecursiveASTVisitor<MatchASTVisitor>::TraverseMemRegion(MR);
+}
+bool MatchASTVisitor::TraverseSymExpr(const ento::SymExpr *SE) {
+  if (!SE)
+    return true;
+  match(*SE);
+  return RecursiveASTVisitor<MatchASTVisitor>::TraverseSymExpr(SE);
+}
+#endif // CLANG_ENABLE_STATIC_ANALYZER
+
 class MatchASTConsumer : public ASTConsumer {
 public:
   MatchASTConsumer(MatchFinder *Finder,
                    MatchFinder::ParsingDoneTestCallback *ParsingDone)
       : Finder(Finder), ParsingDone(ParsingDone) {}
 
 private:
   void HandleTranslationUnit(ASTContext &Context) override {

 
 MatchFinder::MatchFinder(MatchFinderOptions Options)
     : Options(std::move(Options)), ParsingDone(nullptr) {}
 
 MatchFinder::~MatchFinder() {}
 
 void MatchFinder::addMatcher(const DeclarationMatcher &NodeMatch,
                              MatchCallback *Action) {
-  Matchers.DeclOrStmt.emplace_back(NodeMatch, Action);
+  Matchers.BaseMatchers.emplace_back(NodeMatch, Action);
   Matchers.AllCallbacks.insert(Action);
 }
 
 void MatchFinder::addMatcher(const TypeMatcher &NodeMatch,
                              MatchCallback *Action) {
   Matchers.Type.emplace_back(NodeMatch, Action);
   Matchers.AllCallbacks.insert(Action);
 }
 
 void MatchFinder::addMatcher(const StatementMatcher &NodeMatch,
                              MatchCallback *Action) {
-  Matchers.DeclOrStmt.emplace_back(NodeMatch, Action);
+  Matchers.BaseMatchers.emplace_back(NodeMatch, Action);
   Matchers.AllCallbacks.insert(Action);
 }
 
 void MatchFinder::addMatcher(const NestedNameSpecifierMatcher &NodeMatch,
                              MatchCallback *Action) {
   Matchers.NestedNameSpecifier.emplace_back(NodeMatch, Action);
   Matchers.AllCallbacks.insert(Action);
 }

 }
 
 void MatchFinder::addMatcher(const CXXCtorInitializerMatcher &NodeMatch,
                              MatchCallback *Action) {
   Matchers.CtorInit.emplace_back(NodeMatch, Action);
   Matchers.AllCallbacks.insert(Action);
 }
 
+#if CLANG_ENABLE_STATIC_ANALYZER
+void MatchFinder::addMatcher(const SValMatcher &NodeMatch,
+                             MatchCallback *Action) {
+  Matchers.BaseMatchers.emplace_back(NodeMatch, Action);
+  Matchers.AllCallbacks.insert(Action);
+}
+void MatchFinder::addMatcher(const MemRegionMatcher &NodeMatch,
+                             MatchCallback *Action) {
+  Matchers.BaseMatchers.emplace_back(NodeMatch, Action);
+  Matchers.AllCallbacks.insert(Action);
+}
+void MatchFinder::addMatcher(const SymExprMatcher &NodeMatch,
+                             MatchCallback *Action) {
+  Matchers.BaseMatchers.emplace_back(NodeMatch, Action);
+  Matchers.AllCallbacks.insert(Action);
+}
+#endif // CLANG_ENABLE_STATIC_ANALYZER
+
 bool MatchFinder::addDynamicMatcher(const internal::DynTypedMatcher &NodeMatch,
                                     MatchCallback *Action) {
   if (NodeMatch.canConvertTo<Decl>()) {
     addMatcher(NodeMatch.convertTo<Decl>(), Action);
     return true;
   } else if (NodeMatch.canConvertTo<QualType>()) {
     addMatcher(NodeMatch.convertTo<QualType>(), Action);
     return true;
   } else if (NodeMatch.canConvertTo<Stmt>()) {
     addMatcher(NodeMatch.convertTo<Stmt>(), Action);
     return true;
   } else if (NodeMatch.canConvertTo<NestedNameSpecifier>()) {
     addMatcher(NodeMatch.convertTo<NestedNameSpecifier>(), Action);
     return true;
   } else if (NodeMatch.canConvertTo<NestedNameSpecifierLoc>()) {
     addMatcher(NodeMatch.convertTo<NestedNameSpecifierLoc>(), Action);
     return true;
   } else if (NodeMatch.canConvertTo<TypeLoc>()) {
     addMatcher(NodeMatch.convertTo<TypeLoc>(), Action);
     return true;
   } else if (NodeMatch.canConvertTo<CXXCtorInitializer>()) {
     addMatcher(NodeMatch.convertTo<CXXCtorInitializer>(), Action);
     return true;
   }
+#if CLANG_ENABLE_STATIC_ANALYZER
+  else if (NodeMatch.canConvertTo<ento::SVal>()) {
+    addMatcher(NodeMatch.convertTo<ento::SVal>(), Action);
+    return true;
+  } else if (NodeMatch.canConvertTo<ento::MemRegion>()) {
+    addMatcher(NodeMatch.convertTo<ento::MemRegion>(), Action);
+    return true;
+  } else if (NodeMatch.canConvertTo<ento::SymExpr>()) {
+    addMatcher(NodeMatch.convertTo<ento::SymExpr>(), Action);
+    return true;
+  }
+#endif // CLANG_ENABLE_STATIC_ANALYZER
   return false;
 }
 
 std::unique_ptr<ASTConsumer> MatchFinder::newASTConsumer() {
   return std::make_unique<internal::MatchASTConsumer>(this, ParsingDone);
 }
 
 void MatchFinder::match(const clang::DynTypedNode &Node, ASTContext &Context) {

clang/lib/ASTMatchers/ASTMatchersInternal.cpp

 
 const internal::VariadicDynCastAllOfMatcher<Stmt, OMPExecutableDirective>
     ompExecutableDirective;
 const internal::VariadicDynCastAllOfMatcher<OMPClause, OMPDefaultClause>
     ompDefaultClause;
 const internal::VariadicDynCastAllOfMatcher<Decl, CXXDeductionGuideDecl>
     cxxDeductionGuideDecl;
 
+#if CLANG_ENABLE_STATIC_ANALYZER
+
+const internal::VariadicAllOfMatcher<ento::SVal> sVal;
+template <typename T>
+using SValMatch = const internal::VariadicDynCastAllOfMatcher<ento::SVal, T>;
+SValMatch<ento::DefinedSVal> definedSVal;
+SValMatch<ento::DefinedOrUnknownSVal> definedOrUnknownSVal;
+SValMatch<ento::UndefinedVal> undefinedVal;
+SValMatch<ento::UnknownVal> unknownVal;
+SValMatch<ento::loc::ConcreteInt> locConcreteInt;
+SValMatch<ento::loc::GotoLabel> locGotoLabel;
+SValMatch<ento::loc::MemRegionVal> locMemRegionVal;
+SValMatch<ento::nonloc::CompoundVal> compoundVal;
+SValMatch<ento::nonloc::ConcreteInt> nonLocConcreteInt;
+SValMatch<ento::nonloc::LazyCompoundVal> lazyCompoundVal;
+SValMatch<ento::nonloc::LocAsInteger> locAsInteger;
+SValMatch<ento::nonloc::PointerToMember> pointerToMember;
+SValMatch<ento::nonloc::SymbolVal> symbolVal;
+
+const internal::VariadicAllOfMatcher<ento::MemRegion> memRegion;
+template <typename T>
+using MemRegionMatch =
+    const internal::VariadicDynCastAllOfMatcher<ento::MemRegion, T>;
+MemRegionMatch<ento::AllocaRegion> allocaRegion;
+MemRegionMatch<ento::BlockCodeRegion> blockCodeRegion;
+MemRegionMatch<ento::BlockDataRegion> blockDataRegion;
+MemRegionMatch<ento::CodeTextRegion> codeTextRegion;
+MemRegionMatch<ento::CompoundLiteralRegion> compoundLiteralRegion;
+MemRegionMatch<ento::CXXBaseObjectRegion> cxxBaseObjectRegion;
+MemRegionMatch<ento::CXXDerivedObjectRegion> cxxDerivedObjectRegion;
+MemRegionMatch<ento::CXXTempObjectRegion> cxxTempObjectRegion;
+MemRegionMatch<ento::CXXThisRegion> cxxThisRegion;
+MemRegionMatch<ento::DeclRegion> declRegion;
+MemRegionMatch<ento::ElementRegion> elementRegion;
+MemRegionMatch<ento::FieldRegion> fieldRegion;
+MemRegionMatch<ento::FunctionCodeRegion> functionCodeRegion;
+MemRegionMatch<ento::ObjCIvarRegion> objcIvarRegion;
+MemRegionMatch<ento::ObjCStringRegion> objcStringRegion;
+MemRegionMatch<ento::StringRegion> stringRegion;
+MemRegionMatch<ento::SubRegion> subRegion;
+MemRegionMatch<ento::SymbolicRegion> symbolicRegion;
+MemRegionMatch<ento::TypedRegion> typedRegion;
+MemRegionMatch<ento::TypedValueRegion> typedValueRegion;
+MemRegionMatch<ento::VarRegion> varRegion;
+
+MemRegionMatch<ento::CodeSpaceRegion> codeSpaceRegion;
+MemRegionMatch<ento::GlobalImmutableSpaceRegion> globalImmutableSpaceRegion;
+MemRegionMatch<ento::GlobalInternalSpaceRegion> globalInternalSpaceRegion;
+MemRegionMatch<ento::GlobalSystemSpaceRegion> globalSystemSpaceRegion;
+MemRegionMatch<ento::GlobalsSpaceRegion> globalsSpaceRegion;
+MemRegionMatch<ento::HeapSpaceRegion> heapSpaceRegion;
+MemRegionMatch<ento::MemSpaceRegion> memSpaceRegion;
+MemRegionMatch<ento::NonStaticGlobalSpaceRegion> nonStaticGlobalSpaceRegion;
+MemRegionMatch<ento::StackSpaceRegion> stackSpaceRegion;
+MemRegionMatch<ento::StackArgumentsSpaceRegion> stackArgumentsSpaceRegion;
+MemRegionMatch<ento::StackLocalsSpaceRegion> stackLocalsSpaceRegion;
+MemRegionMatch<ento::StaticGlobalSpaceRegion> staticGlobalSpaceRegion;
+MemRegionMatch<ento::UnknownSpaceRegion> unknownSpaceRegion;
+
+const internal::VariadicAllOfMatcher<ento::SymExpr> symExpr;
+template <typename T>
+using SymExprMatch =
+    const internal::VariadicDynCastAllOfMatcher<ento::SymExpr, T>;
+SymExprMatch<ento::BinarySymExpr> binarySymExpr;
+SymExprMatch<ento::IntSymExpr> intSymExpr;
+SymExprMatch<ento::SymIntExpr> symIntExpr;
+SymExprMatch<ento::SymSymExpr> symSymExpr;
+SymExprMatch<ento::SymbolCast> symbolCast;
+SymExprMatch<ento::SymbolData> symbolData;
+SymExprMatch<ento::SymbolConjured> symbolConjured;
+SymExprMatch<ento::SymbolDerived> symbolDerived;
+SymExprMatch<ento::SymbolExtent> symbolExtent;
+SymExprMatch<ento::SymbolMetadata> symbolMetadata;
+SymExprMatch<ento::SymbolRegionValue> symbolRegionValue;
+
+#endif // CLANG_ENABLE_STATIC_ANALYZER
+
 } // end namespace ast_matchers
 } // end namespace clang

clang/unittests/StaticAnalyzer/CMakeLists.txt

 set(LLVM_LINK_COMPONENTS
   FrontendOpenMP
   Support
   )
 
 add_clang_unittest(StaticAnalysisTests
   AnalyzerOptionsTest.cpp
   CallDescriptionTest.cpp
+  MatcherTest.cpp
   StoreTest.cpp
   RegisterCustomCheckersTest.cpp
   SymbolReaperTest.cpp
   )
 
 clang_target_link_libraries(StaticAnalysisTests
   PRIVATE
   clangBasic

clang/unittests/StaticAnalyzer/MatcherTest.h

+//===- unittests/StaticAnalyzer/MatcherTest.h - Matcher test helper -------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+#include "Reusables.h"
+#include "clang/AST/ASTTypeTraits.h"
+#include "clang/ASTMatchers/ASTMatchFinder.h"
+#include "clang/ASTMatchers/ASTMatchers.h"
+#include "clang/ASTMatchers/ASTMatchersInternal.h"
+#include "clang/Tooling/Tooling.h"
+#include "gtest/gtest.h"
+
+namespace clang {
+namespace ento {
+
+using namespace ast_matchers;
+
+template <typename MatcherTy> struct MatchContext {
+  MatchContext(const MatcherTy &Matcher, StringRef VarDeclName,
+               unsigned ExpectedMatchCount)
+      : Matcher(Matcher), VarDeclName(VarDeclName),
+        ExpectedMatchCount(ExpectedMatchCount), IsFound(false) {}
+  const MatcherTy &Matcher;
+  StringRef VarDeclName;
+  unsigned ExpectedMatchCount;
+  bool IsFound;
+};
+
+template <typename T> class Consumer : public ExprEngineConsumer {
+public:
+  Consumer(CompilerInstance &CI, MatchContext<T> &MC)
+      : ExprEngineConsumer(CI), MC(MC) {}
+
+  bool HandleTopLevelDecl(DeclGroupRef DG) override {
+    const auto *FD = dyn_cast<FunctionDecl>(DG.getSingleDecl());
+    if (!FD || !FD->isDefined())
+      return false;
+
+    const StackFrameContext *SFC =
+        Eng.getAnalysisDeclContextManager().getStackFrame(FD);
+    Eng.ExecuteWorkList(SFC);
+
+    ProgramStateRef State =
+        Eng.getCoreEngine().getWorkList()->dequeue().getNode()->getState();
+
+    const auto *VD = findDeclByName<VarDecl>(FD, MC.VarDeclName);
+    SVal V = State->getSVal(State->getRegion(VD, SFC));
+
+    auto Match = match(MC.Matcher, V, Eng.getContext());
+
+    if (MC.ExpectedMatchCount > 0 && Match.size() == 0) {
+      llvm::errs() << "\nTried to match on: '" << V
+                   << "'.\nNo match found.\n\n";
+      return true;
+    }
+
+    if (MC.ExpectedMatchCount == 0 && Match.size() > 0) {
+      llvm::errs() << "\nTried to match on: '" << V
+                   << "'.\nExpected no matches, but '" << Match.size()
+                   << "' match found.\n\n";
+      return true;
+    }
+
+    if (MC.ExpectedMatchCount > 0 && Match.size() != MC.ExpectedMatchCount) {
+      llvm::errs() << "\nTried to match on: '" << V << "'.\n";
+
+      if (MC.ExpectedMatchCount == 1)
+        llvm::errs() << "Multiple matches found (" << Match.size() << ").\n";
+      else
+        llvm::errs() << "Expected '" << MC.ExpectedMatchCount
+                     << "' matches, but '" << Match.size() << "' found.\n\n";
+      return true;
+    }
+
+    MC.IsFound = true;
+    return true;
+  }
+
+private:
+  MatchContext<T> &MC;
+};
+
+template <typename T> class Action : public ASTFrontendAction {
+public:
+  Action(MatchContext<T> &MC) : MC(MC) {}
+
+  std::unique_ptr<ASTConsumer> CreateASTConsumer(CompilerInstance &CI,
+                                                 StringRef) override {
+    return std::make_unique<Consumer<T>>(CI, MC);
+  }
+
+private:
+  MatchContext<T> &MC;
+};
+
+template <typename T>
+testing::AssertionResult testMatch(StringRef Code, const T &Matcher,
+                                   StringRef VarDeclName,
+                                   unsigned ExpectedMatchCount) {
+  MatchContext<T> MC(Matcher, VarDeclName, ExpectedMatchCount);
+
+  if (!tooling::runToolOnCode(std::make_unique<Action<T>>(MC), Code))
+    return testing::AssertionFailure() << "Unable to run.\n";
+
+  return MC.IsFound ? testing::AssertionSuccess() : testing::AssertionFailure();
+}
+
+template <typename T>
+testing::AssertionResult match(StringRef Code, StringRef VarDeclName,
+                               const T &Matcher) {
+  return testMatch(Code, Matcher, VarDeclName, /*ExpectedMatchCount=*/1);
+}
+
+template <typename T>
+testing::AssertionResult not_match(StringRef Code, StringRef VarDeclName,
+                                   const T &Matcher) {
+  return testMatch(Code, Matcher, VarDeclName, /*ExpectedMatchCount=*/0);
+}
+
+template <typename T>
+testing::AssertionResult multi_match(StringRef Code, StringRef VarDeclName,
+                                     unsigned ExpectedMatchCount,
+                                     const T &Matcher) {
+  return testMatch(Code, Matcher, VarDeclName, ExpectedMatchCount);
+}
+
+} // namespace ento
+} // namespace clang

clang/unittests/StaticAnalyzer/MatcherTest.cpp

+//===- unittests/StaticAnalyzer/MatcherTest.cpp ---------------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+#include "MatcherTest.h"
+#include "clang/ASTMatchers/ASTMatchFinder.h"
+#include "clang/ASTMatchers/ASTMatchers.h"
+#include "clang/Tooling/Tooling.h"
+#include "gtest/gtest.h"
+
+namespace clang {
+namespace ento {
+
+using namespace ast_matchers;
+
+TEST(SValMatcher, RawSValMatch) {
+  EXPECT_TRUE(match("void f() { int x = 13; }", "x", sVal()));
+}
+
+TEST(SValMatcher, SValHas) {
+  EXPECT_TRUE(
+      match("void f(int a) { int x = a + 13; }", "x", sVal(has(symIntExpr()))));
+  EXPECT_TRUE(match("void f(int x) {}", "x", sVal(has(symbolRegionValue()))));
+}
+
+TEST(SValMatcher, SValDescendant) {
+  EXPECT_TRUE(match("void f() { int x = 13; }", "x", nonLocConcreteInt()));
+  EXPECT_TRUE(match("void f(int a) { int x = a + 13; }", "x",
+                    sVal(hasDescendant(nonLocConcreteInt()))));
+  EXPECT_TRUE(not_match("void f() { int x = 13; }", "x",
+                        sVal(hasDescendant(nonLocConcreteInt()))));
+}
+
+TEST(SymExprMatcher, RawSymExprMatch) {
+  EXPECT_TRUE(match("void f(int a) { int x = a + 13; };", "x",
+                    symbolVal(has(symExpr()))));
+  EXPECT_TRUE(not_match("void f(int a) { int x = a + 13; };", "x", symExpr()));
+}
+
+TEST(SymExprMatcher, SymExprDescendant) {
+  EXPECT_TRUE(match("void f(int a) { int x = a + 13; }", "x",
+                    symbolVal(has(symIntExpr(allOf(
+                        hasDescendant(symbolRegionValue()),
+                        hasDescendant(nonLocConcreteInt(equals(13)))))))));
+}
+
+TEST(SymExprMatcher, IntSymExprNotExist) {
+  EXPECT_TRUE(
+      not_match("void f(int a) { int x = 13 + a; }", "x", intSymExpr()));
+}
+
+TEST(SymExprMatcher, SymExprHasOperator) {
+  EXPECT_TRUE(
+      match("void f(int a) { int x = a + 13; }", "x",
+            symbolVal(has(symIntExpr(hasSymLHS(symbolRegionValue()),
+                                     hasSymRHS(nonLocConcreteInt(equals(13))),
+                                     hasOperatorName("+"))))));
+}
+
+TEST(SymExprMatcher, SymExprHasAnyOperator) {
+  EXPECT_TRUE(not_match("void f(int a) { int x = a + 13; }", "x",
+                        symIntExpr(hasAnyOperatorName("*", "/"))));
+}
+
+TEST(MemRegionMatcher, RawMemRegionMatch) {
+  EXPECT_TRUE(match("void f(int a) { int x = a; }", "x",
+                    symbolVal(has(symbolRegionValue(has(memRegion()))))));
+  EXPECT_TRUE(not_match("void f(int a) { int x = a; }", "x", memRegion()));
+  EXPECT_TRUE(
+      not_match("void f(int a) { int x = a; }", "x", symbolRegionValue()));
+  EXPECT_TRUE(
+      not_match("void f(int a) { int x = a; }", "x", locMemRegionVal()));
+}
+
+TEST(MemRegionMatcher, MemorySpace) {
+  EXPECT_TRUE(match("void f(int a) { int x = a; }", "x",
+                    symbolVal(has(symbolRegionValue(has(memRegion(
+                        hasMemorySpace(stackArgumentsSpaceRegion()))))))));
+  EXPECT_TRUE(match(
+      "int main(int argc, char *argv[]) { char *x = argv[0]; }", "x",
+      locMemRegionVal(has(memRegion(hasMemorySpace(unknownSpaceRegion()))))));
+}
+
+TEST(MemRegionMatcher, MemRegionHierarchy) {
+  // &SymRegion{reg_$2<char * Element{SymRegion{reg_$1<char ** argv>},0,char*}>}
+  // SymRegion(ElementRegion(SymRegion(VarRegion())))
+  EXPECT_TRUE(match("int main(int argc, char *argv[]) { char *x = argv[0]; }",
+                    "x",
+                    locMemRegionVal(has(symbolicRegion(has(symbolRegionValue(
+                        has(elementRegion(hasSymbolicBase(symbolicRegion(
+                            has(symbolRegionValue(has(varRegion()))))))))))))));
+}
+
+TEST(MemRegionMatcher, MemRegionTraversing) {
+  // &SymRegion{reg_$2<char * Element{SymRegion{reg_$1<char ** argv>},0,char*}>}
+  // SymRegion(ElementRegion(SymRegion(VarRegion())))
+  EXPECT_TRUE(
+      multi_match("int main(int argc, char *argv[]) { char *x = argv[0]; }",
+                  "x", 2, sVal(forEachDescendant(symbolicRegion().bind("r")))));
+  EXPECT_TRUE(
+      multi_match("int main(int argc, char *argv[]) { char *x = argv[0]; }",
+                  "x", 4, sVal(forEachDescendant(subRegion().bind("r")))));
+}
+
+TEST(MemRegionMatcher, DescendIntoASTMatcher) {
+  // &SymRegion{reg_$2<char * Element{SymRegion{reg_$1<char ** argv>},0,char*}>}
+  // SymRegion(ElementRegion(SymRegion(VarRegion())))
+  EXPECT_TRUE(
+      match("int main(int argc, char *argv[]) { char *x = argv[0]; }", "x",
+            sVal(hasDescendant(elementRegion(hasSymbolicBase(
+                hasDescendant(varRegion(hasDecl(hasName("argv"))))))))));
+}
+
+} // namespace ento
+} // namespace clang