[analyzer][CallAndMessage] Add checker options for each bug category

[Szelethus]

Summary

As listed in the summary D77846, we have 5 different categories of bugs we're checking for in CallAndMessage. I think the documentation placed in the code explains my thought process behind my decisions quite well.

A non-obvious change I had here is removing the entry for CallAndMessageUnInitRefArg. In fact, I removed the CheckerNameRef typed field back in D77845 (it was dead code), so that checker didn't really exist in any meaningful way anyways.

[martong]

Looks good to me!

clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h

194

I like joke :D But there are people who may not, so, the code would be more pro without it.

clang/lib/StaticAnalyzer/Checkers/CallAndMessageChecker.cpp

64

So, we are not going to have subcheckers, rather options, okay. Perhaps the comment would be more appropriate to be in Checkers.td? (If we can put comments there.)

[martong]

In D77866#1983685, @martong wrote:

Looks good to me!

Just take care of the failures you have with harbourmaster, there seem to be CSA failures with the bot!

[Szelethus]

In D77866#1983690, @martong wrote:

In D77866#1983685, @martong wrote:

Looks good to me!

Just take care of the failures you have with harbourmaster, there seem to be CSA failures with the bot!

That should go away after fixing D75430#inline-708353. Sharp eyes though, thanks!

[balazske]

clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h

194

if (!State)
  State = getState();

is better?

[Szelethus]

clang/lib/StaticAnalyzer/Checkers/CallAndMessageChecker.cpp

64

I prefer it here, Checkers.td is a rarely visited file, and the comments in the test cases all point here where the majority of the work has to be done. Which still isn't much, but this is the bit we should not screw up.

Btw we can totally put comments there, as seen here: D78120

[NoQ]

We (me, Valeriy, Devin)'ve just been talking about this and mostly of agreed that core.CallAndMessage should ideally be removed (at least as a Checkers.td entity) and individual checks moved to the relevant package (null dereference, use of uninitialized value, etc.). It won't hurt backwards compatibility too much because so far there was no reasonable outcome that one might expect from disabling core.CallAndMessage, given that it's a weird mix of completely unrelated checks. The benefit is that disabling, say, null dereference checker will actually disable all null dereference warnings (as opposed to having to additionally disable the ones that come from CallAndMessage).

Also a regular reminder that we wouldn't have had this conversation if we had hashtags instead of packages (#CallAndMessage #NullDereference #C++ #AllPlatforms #UndefinedBehavior #SecurityCritical #PathSensitive #Stable #2012).

[Szelethus]

In D77866#2068394, @NoQ wrote:

We (me, Valeriy, Devin)'ve just been talking about this and mostly of agreed that core.CallAndMessage should ideally be removed (at least as a Checkers.td entity) and individual checks moved to the relevant package (null dereference, use of uninitialized value, etc.). It won't hurt backwards compatibility too much because so far there was no reasonable outcome that one might expect from disabling core.CallAndMessage, given that it's a weird mix of completely unrelated checks. The benefit is that disabling, say, null dereference checker will actually disable all null dereference warnings (as opposed to having to additionally disable the ones that come from CallAndMessage).

Luckily this should be super easy to implement after this patch, and it is totally what I, and most folks on Ericsson's end want this checker to look like. I trust that you've glanced over the comments that justify the tiptoeing creating smaller checkers, and it is a result of a conversation we had that the price on the user would have to pay the way we implement our database is too great.

I'll initialize a new discussion on this on our end, but speaking from my perspective, we should just deal the cost of this and be done with it. However, since sooooo many reports originate from this checker, I wonder whether we should go all the way and make sense out of the hash generation we currently have.

Also a regular reminder that we wouldn't have had this conversation if we had hashtags instead of packages (#CallAndMessage #NullDereference #C++ #AllPlatforms #UndefinedBehavior #SecurityCritical #PathSensitive #Stable #2012).

Could you detail this a bit?

[NoQ]

In D77866#2068484, @Szelethus wrote:

Also a regular reminder that we wouldn't have had this conversation if we had hashtags instead of packages (#CallAndMessage #NullDereference #C++ #AllPlatforms #UndefinedBehavior #SecurityCritical #PathSensitive #Stable #2012).

Could you detail this a bit?

Wait, did i never mention this before?

Like, i mean, the tree of packages that we currently have is a wrong abstraction. We shouldn't be asking the user questions like "Is this checker alpha or unix?" or "Are you looking for a checker for C++ or for finding portability issues?". These are different, independent classifications but our tree-like package structure implicitly assumes that these "or"s are exclusive. We partially mitigate this by introducing conventions for package naming (like "alpha package has the same layout as the root package") but we could achieve the same naturally by simply introducing multiple classifications. The most ad-hoc approach that's better than the current situation would be twitter-like hashtags. A better - stricter but still sufficiently flexible - approach would be to have some actual different classifications: "language:C++ platform:unix stability:alpha severity:undefinedbehavior" etc. Like, these would let the user to make easy single-word -enable-checker/-disable-checker queries like "please disable all null dereference checks (regardless of which individual indivisible checker implements them)" or "please disable all path-sensitive checkers because i want a super quick analysis" or "please only warn me when you've found an actual crash in the program, i don't care about coding convention violations or portability issues".

[xazax.hun]

In D77866#2069144, @NoQ wrote:

Like, i mean, the tree of packages that we currently have is a wrong abstraction.

I totally agree with this.

The most ad-hoc approach that's better than the current situation would be twitter-like hashtags.

While this sounds really good for basic use cases I think it quickly becomes unmanageable for power users. For example, if the user wants to enable undefined behavior related checks but disable null checks how should this affect a check that is tagged with both categories? I am not sure whether using the enable/disable order is user-friendly enough. Moreover, we still need to be able to suppress each check individually (I meant checks as in one checker could implement multiple checks or diagnostics and the checker might not be the right granularity for suppression). I really like the idea of this approach but I wonder how to make this intuitive.

A better - stricter but still sufficiently flexible - approach would be to have some actual different classifications: "language:C++ platform:unix stability:alpha severity:undefinedbehavior" etc.

I do not see a big difference between this method and the tags but I might be missing something.

I really support the idea of having a more intuitive way to handle checks and tags sound promising. But there are a lot of details we need to think about. Nevertheless, I'd love to see a more detailed RFC about the topic if someone has the time/up to it. I think this approach is probably something that the clang-tidy checks could also profit from.

[NoQ]

While this sounds really good for basic use cases I think it quickly becomes unmanageable for power users.

It's strictly better than the current situation because nothing prevents us from keeping the existing checker names as a subset of tags (i.e., #core/#core.CallAndMessage or checker:core/checker:core.CallAndMessage). We don't even need to break backwards compatibility.

I am not sure whether using the enable/disable order is user-friendly enough.

I guess it's either the order or allowing users to write boolean formulas :|

Also if they're so smart why don't they introduce their own categories so that to avoid writing complicated formulas? (checkmate atheists!) (at least that's what i expect IDE developers to do on a regular basis; complicated formulas don't need to be autogenerated from high-level ordinary-user-facing checkboxes).

I'd love to see a more detailed RFC about the topic if someone has the time/up to it.

Yup, this would absolutely require a discussion.

clang/include/clang/StaticAnalyzer/Checkers/Checkers.td

 def FuchsiaAlpha : Package<"fuchsia">, ParentPackage<Alpha>;
 
 //===----------------------------------------------------------------------===//
 // Core Checkers.
 //===----------------------------------------------------------------------===//
 
 let ParentPackage = Core in {
 
-def DereferenceChecker : Checker<"NullDereference">,
-  HelpText<"Check for dereferences of null pointers">,
+def CallAndMessageModeling : Checker<"CallAndMessageModeling">,
+  HelpText<"Responsible for essential modeling and assumptions after a "
+           "function/method call. For instance, if we can't reason about the "
+           "nullability of the implicit this parameter after a method call, "
+           "this checker conservatively assumes it to be non-null">,
   Documentation<HasDocumentation>;
 
 def CallAndMessageChecker : Checker<"CallAndMessage">,
   HelpText<"Check for logical errors for function calls and Objective-C "
            "message expressions (e.g., uninitialized arguments, null function "
            "pointers)">,
+  CheckerOptions<[
+    CmdLineOption<Boolean,
+                  "FunctionPointer",
+                  "Check whether a called function pointer is null or "
+                  "undefined",
+                  "true",
+                  Released>,
+    CmdLineOption<Boolean,
+                  "ParameterCount",
+                  "Check whether a function was called with the appropriate "
+                  "number of arguments",
+                  "true",
+                  Released>,
+    CmdLineOption<Boolean,
+                  "CXXThisMethodCall",
+                  "Check whether the implicit this parameter is null or "
+                  "undefined upon a method call",
+                  "true",
+                  Released>,
+    CmdLineOption<Boolean,
+                  "CXXDeallocationArg",
+                  "Check whether the argument of operator delete is undefined",
+                  "true",
+                  Released>,
+    CmdLineOption<Boolean,
+                  "ArgInitializedness",
+                  "Check whether any of the pass-by-value parameters is "
+                  "undefined",
+                  "true",
+                  Released>,
+    CmdLineOption<Boolean,
+                  "ArgPointeeInitializedness",
+                  "Check whether the pointee of a pass-by-reference or "
+                  "pass-by-pointer is undefined",
+                  "false",
+                  InAlpha>,
+    CmdLineOption<Boolean,
+                  "NilReceiver",
+                  "Check whether the reciever in the message expression is nil",
+                  "true",
+                  Released>,
+    CmdLineOption<Boolean,
+                  "UndefReceiver",
+                  "Check whether the reciever in the message expression is "
+                  "undefined",
+                  "true",
+                  Released>,
+  ]>,
+  Documentation<HasDocumentation>,
+  Dependencies<[CallAndMessageModeling]>;
+
+def DereferenceChecker : Checker<"NullDereference">,
+  HelpText<"Check for dereferences of null pointers">,
   Documentation<HasDocumentation>;
 
 def NonNullParamChecker : Checker<"NonNullParamChecker">,
   HelpText<"Check for null pointers passed as arguments to a function whose "
            "arguments are references or marked with the 'nonnull' attribute">,
   Documentation<HasDocumentation>;
 
 def VLASizeChecker : Checker<"VLASize">,
def PointerSubChecker : Checker<"PointerSub">,
   HelpText<"Check for pointer subtractions on two pointers pointing to "
            "different memory chunks">,
   Documentation<HasAlphaDocumentation>;
 
 def SizeofPointerChecker : Checker<"SizeofPtr">,
   HelpText<"Warn about unintended use of sizeof() on pointer expressions">,
   Documentation<HasAlphaDocumentation>;
 
-def CallAndMessageUnInitRefArg : Checker<"CallAndMessageUnInitRefArg">,
-  HelpText<"Check for logical errors for function calls and Objective-C "
-           "message expressions (e.g., uninitialized arguments, null function "
-           "pointers, and pointer to undefined variables)">,
-  Dependencies<[CallAndMessageChecker]>,
-  Documentation<HasAlphaDocumentation>;
-
 def TestAfterDivZeroChecker : Checker<"TestAfterDivZero">,
   HelpText<"Check for division by variable that is later compared against 0. "
            "Either the comparison is useless or there is division by zero.">,
   Documentation<HasAlphaDocumentation>;
 
 def DynamicTypeChecker : Checker<"DynamicTypeChecker">,
   HelpText<"Check for cases where the dynamic and the static type of an object "
            "are unrelated.">,

 //===----------------------------------------------------------------------===//
 // APIModeling.
 //===----------------------------------------------------------------------===//
 
 let ParentPackage = APIModeling in {
 
 def StdCLibraryFunctionsChecker : Checker<"StdCLibraryFunctions">,
   HelpText<"Improve modeling of the C standard library functions">,
-  Dependencies<[NonNullParamChecker, CallAndMessageChecker]>,
+  Dependencies<[NonNullParamChecker, CallAndMessageModeling]>,
   CheckerOptions<[
     CmdLineOption<Boolean,
                   "DisplayLoadedSummaries",
                   "If set to true, the checker displays the found summaries "
                   "for the given translation unit.",
                   "false",
                   Released>
   ]>,

clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h

public:
 
   /// Generates a new transition with the given predecessor.
   /// Allows checkers to generate a chain of nodes.
   ///
   /// @param State The state of the generated node.
   /// @param Pred The transition will be generated from the specified Pred node
   ///             to the newly generated node.
   /// @param Tag The tag to uniquely identify the creation site.
-  ExplodedNode *addTransition(ProgramStateRef State,
-                              ExplodedNode *Pred,
+  ExplodedNode *addTransition(ProgramStateRef State, ExplodedNode *Pred,
                               const ProgramPointTag *Tag = nullptr) {
     return addTransitionImpl(State, false, Pred, Tag);
   }
 
   /// Generate a sink node. Generating a sink stops exploration of the
   /// given path. To create a sink node for the purpose of reporting an error,
   /// checkers should use generateErrorNode() instead.
   ExplodedNode *generateSink(ProgramStateRef State, ExplodedNode *Pred,
                              const ProgramPointTag *Tag = nullptr) {
     return addTransitionImpl(State ? State : getState(), true, Pred, Tag);
   }
 
+  /// Add a sink node to the current path of execution, halting analysis.
+  void addSink(ProgramStateRef State = nullptr,
+               const ProgramPointTag *Tag = nullptr) {
+    if (!State)
+      State = getState();
+    addTransition(State, generateSink(State, getPredecessor()));
+  }
+
   /// Generate a transition to a node that will be used to report
   /// an error. This node will be a sink. That is, it will stop exploration of
   /// the given path.
   ///
   /// @param State The state of the generated node.
   /// @param Tag The tag to uniquely identify the creation site. If null,
   ///        the default tag for the checker will be used.
   ExplodedNode *generateErrorNode(ProgramStateRef State = nullptr,

clang/lib/StaticAnalyzer/Checkers/CallAndMessageChecker.cpp

class CallAndMessageChecker
   mutable std::unique_ptr<BugType> BT_msg_undef;
   mutable std::unique_ptr<BugType> BT_objc_prop_undef;
   mutable std::unique_ptr<BugType> BT_objc_subscript_undef;
   mutable std::unique_ptr<BugType> BT_msg_arg;
   mutable std::unique_ptr<BugType> BT_msg_ret;
   mutable std::unique_ptr<BugType> BT_call_few_args;
 
 public:
-  enum CheckKind { CK_CallAndMessageUnInitRefArg, CK_NumCheckKinds };
+  // These correspond with the checker options. Looking at other checkers such
+  // as MallocChecker and CStringChecker, this is similar as to how they pull
+  // off having a modeling class, but emitting diagnostics under a smaller
+  // checker's name that can be safely disabled without disturbing the
+  // underlaying modeling engine.
+  // The reason behind having *checker options* rather then actual *checkers*
+  // here is that CallAndMessage is among the oldest checkers out there, and can
+  // be responsible for the majority of the reports on any given project. This
+  // is obviously not ideal, but changing checker name has the consequence of
+  // changing the issue hashes associated with the reports, and databases
+  // relying on this (CodeChecker, for instance) would suffer greatly.
+  // If we ever end up making changes to the issue hash generation algorithm, or
+  // the warning messages here, we should totally jump on the opportunity to
+  // convert these to actual checkers.
+  enum CheckKind {
+    CK_FunctionPointer,
+    CK_ParameterCount,
+    CK_CXXThisMethodCall,
+    CK_CXXDeallocationArg,
+    CK_ArgInitializedness,
+    CK_ArgPointeeInitializedness,
+    CK_NilReceiver,
+    CK_UndefReceiver,
+    CK_NumCheckKinds
+  };
 
   DefaultBool ChecksEnabled[CK_NumCheckKinds];
+  // The original core.CallAndMessage checker name. This should rather be an
+  // array, as seen in MallocChecker and CStringChecker.
+  CheckerNameRef OriginalName;
 
   void checkPreObjCMessage(const ObjCMethodCall &msg, CheckerContext &C) const;
 
   /// Fill in the return value that results from messaging nil based on the
   /// return type and architecture and diagnose if the return value will be
   /// garbage.
   void checkObjCMessageNil(const ObjCMethodCall &msg, CheckerContext &C) const;
 
void emitNilReceiverBug(CheckerContext &C, const ObjCMethodCall &msg,
                           ExplodedNode *N) const;
 
   void HandleNilReceiver(CheckerContext &C,
                          ProgramStateRef state,
                          const ObjCMethodCall &msg) const;
 
   void LazyInit_BT(const char *desc, std::unique_ptr<BugType> &BT) const {
     if (!BT)
-      BT.reset(new BuiltinBug(this, desc));
+      BT.reset(new BuiltinBug(OriginalName, desc));
   }
   bool uninitRefOrPointer(CheckerContext &C, const SVal &V,
                           SourceRange ArgRange, const Expr *ArgEx,
                           std::unique_ptr<BugType> &BT,
                           const ParmVarDecl *ParamDecl, const char *BD,
                           int ArgumentNumber) const;
 };
 } // end anonymous namespace
default:
     return;
   }
 }
 
 bool CallAndMessageChecker::uninitRefOrPointer(
     CheckerContext &C, const SVal &V, SourceRange ArgRange, const Expr *ArgEx,
     std::unique_ptr<BugType> &BT, const ParmVarDecl *ParamDecl, const char *BD,
     int ArgumentNumber) const {
-  if (!ChecksEnabled[CK_CallAndMessageUnInitRefArg])
+
+  // The pointee being uninitialized is a sign of code smell, not a bug, no need
+  // to sink here.
+  if (!ChecksEnabled[CK_ArgPointeeInitializedness])
     return false;
 
   // No parameter declaration available, i.e. variadic function argument.
   if(!ParamDecl)
     return false;
 
   // If parameter is declared as pointer to const in function declaration,
   // then check if corresponding argument in function call is
bool CallAndMessageChecker::PreVisitProcessArg(CheckerContext &C,
                                                ) const {
   const char *BD = "Uninitialized argument value";
 
   if (uninitRefOrPointer(C, V, ArgRange, ArgEx, BT, ParamDecl, BD,
                          ArgumentNumber))
     return true;
 
   if (V.isUndef()) {
+    if (!ChecksEnabled[CK_ArgInitializedness]) {
+      C.addSink();
+      return true;
+    }
     if (ExplodedNode *N = C.generateErrorNode()) {
       LazyInit_BT(BD, BT);
       // Generate a report for this bug.
       SmallString<200> Buf;
       llvm::raw_svector_ostream Os(Buf);
       describeUninitializedArgumentInCall(Call, ArgumentNumber, Os);
       auto R = std::make_unique<PathSensitiveBugReport>(*BT, Os.str(), N);
 
bool CallAndMessageChecker::PreVisitProcessArg(CheckerContext &C,
 
   if (auto LV = V.getAs<nonloc::LazyCompoundVal>()) {
     const LazyCompoundValData *D = LV->getCVData();
     FindUninitializedField F(C.getState()->getStateManager().getStoreManager(),
                              C.getSValBuilder().getRegionManager(),
                              D->getStore());
 
     if (F.Find(D->getRegion())) {
+      if (!ChecksEnabled[CK_ArgInitializedness]) {
+        C.addSink();
+        return true;
+      }
       if (ExplodedNode *N = C.generateErrorNode()) {
         LazyInit_BT(BD, BT);
         SmallString<512> Str;
         llvm::raw_svector_ostream os(Str);
         os << "Passed-by-value struct argument contains uninitialized data";
 
         if (F.FieldChain.size() == 1)
           os << " (e.g., field: '" << *F.FieldChain[0] << "')";

 ProgramStateRef CallAndMessageChecker::checkFunctionPointerCall(
     const CallExpr *CE, CheckerContext &C, ProgramStateRef State) const {
 
   const Expr *Callee = CE->getCallee()->IgnoreParens();
   const LocationContext *LCtx = C.getLocationContext();
   SVal L = State->getSVal(Callee, LCtx);
 
   if (L.isUndef()) {
+    if (!ChecksEnabled[CK_FunctionPointer]) {
+      C.addSink(State);
+      return nullptr;
+    }
     if (!BT_call_undef)
       BT_call_undef.reset(new BuiltinBug(
-          this, "Called function pointer is an uninitialized pointer value"));
+          OriginalName,
+          "Called function pointer is an uninitialized pointer value"));
     emitBadCall(BT_call_undef.get(), C, Callee);
     return nullptr;
   }
 
   ProgramStateRef StNonNull, StNull;
   std::tie(StNonNull, StNull) = State->assume(L.castAs<DefinedOrUnknownSVal>());
 
   if (StNull && !StNonNull) {
+    if (!ChecksEnabled[CK_FunctionPointer]) {
+      C.addSink(StNull);
+      return nullptr;
+    }
     if (!BT_call_null)
       BT_call_null.reset(new BuiltinBug(
-          this, "Called function pointer is null (null dereference)"));
+          OriginalName, "Called function pointer is null (null dereference)"));
     emitBadCall(BT_call_null.get(), C, Callee);
     return nullptr;
   }
 
   return StNonNull;
 }
 
 ProgramStateRef CallAndMessageChecker::checkParameterCount(
     const CallEvent &Call, CheckerContext &C, ProgramStateRef State) const {
 
   // If we have a function or block declaration, we can make sure we pass
   // enough parameters.
   unsigned Params = Call.parameters().size();
   if (Call.getNumArgs() >= Params)
     return State;
 
+  if (!ChecksEnabled[CK_ParameterCount]) {
+    C.addSink(State);
+    return nullptr;
+  }
+
   ExplodedNode *N = C.generateErrorNode();
   if (!N)
     return nullptr;
 
   LazyInit_BT("Function call with too few arguments", BT_call_few_args);
 
   SmallString<512> Str;
   llvm::raw_svector_ostream os(Str);
ProgramStateRef CallAndMessageChecker::checkParameterCount(
   return nullptr;
 }
 
 ProgramStateRef CallAndMessageChecker::checkCXXMethodCall(
     const CXXInstanceCall *CC, CheckerContext &C, ProgramStateRef State) const {
 
   SVal V = CC->getCXXThisVal();
   if (V.isUndef()) {
+    if (!ChecksEnabled[CK_CXXThisMethodCall]) {
+      C.addSink(State);
+      return nullptr;
+    }
     if (!BT_cxx_call_undef)
-      BT_cxx_call_undef.reset(
-          new BuiltinBug(this, "Called C++ object pointer is uninitialized"));
+      BT_cxx_call_undef.reset(new BuiltinBug(
+          OriginalName, "Called C++ object pointer is uninitialized"));
     emitBadCall(BT_cxx_call_undef.get(), C, CC->getCXXThisExpr());
     return nullptr;
   }
 
   ProgramStateRef StNonNull, StNull;
   std::tie(StNonNull, StNull) = State->assume(V.castAs<DefinedOrUnknownSVal>());
 
   if (StNull && !StNonNull) {
+    if (!ChecksEnabled[CK_CXXThisMethodCall]) {
+      C.addSink(StNull);
+      return nullptr;
+    }
     if (!BT_cxx_call_null)
       BT_cxx_call_null.reset(
-          new BuiltinBug(this, "Called C++ object pointer is null"));
+          new BuiltinBug(OriginalName, "Called C++ object pointer is null"));
     emitBadCall(BT_cxx_call_null.get(), C, CC->getCXXThisExpr());
     return nullptr;
   }
 
   return StNonNull;
 }
 
 ProgramStateRef
 CallAndMessageChecker::checkCXXDeallocation(const CXXDeallocatorCall *DC,
                                             CheckerContext &C,
                                             ProgramStateRef State) const {
   const CXXDeleteExpr *DE = DC->getOriginExpr();
   assert(DE);
   SVal Arg = C.getSVal(DE->getArgument());
   if (!Arg.isUndef())
     return State;
 
+  if (!ChecksEnabled[CK_CXXDeallocationArg]) {
+    C.addSink(State);
+    return nullptr;
+  }
+
   StringRef Desc;
   ExplodedNode *N = C.generateErrorNode();
   if (!N)
     return nullptr;
   if (!BT_cxx_delete_undef)
     BT_cxx_delete_undef.reset(
-        new BuiltinBug(this, "Uninitialized argument value"));
+        new BuiltinBug(OriginalName, "Uninitialized argument value"));
   if (DE->isArrayFormAsWritten())
     Desc = "Argument to 'delete[]' is uninitialized";
   else
     Desc = "Argument to 'delete' is uninitialized";
   BugType *BT = BT_cxx_delete_undef.get();
   auto R = std::make_unique<PathSensitiveBugReport>(*BT, Desc, N);
   bugreporter::trackExpressionValue(N, DE, *R);
   C.emitReport(std::move(R));
void CallAndMessageChecker::checkPreCall(const CallEvent &Call,
   // If we make it here, record our assumptions about the callee.
   C.addTransition(State);
 }
 
 void CallAndMessageChecker::checkPreObjCMessage(const ObjCMethodCall &msg,
                                                 CheckerContext &C) const {
   SVal recVal = msg.getReceiverSVal();
   if (recVal.isUndef()) {
+    if (!ChecksEnabled[CK_UndefReceiver]) {
+      C.addSink();
+      return;
+    }
     if (ExplodedNode *N = C.generateErrorNode()) {
       BugType *BT = nullptr;
       switch (msg.getMessageKind()) {
       case OCM_Message:
         if (!BT_msg_undef)
-          BT_msg_undef.reset(new BuiltinBug(this,
+          BT_msg_undef.reset(new BuiltinBug(OriginalName,
                                             "Receiver in message expression "
                                             "is an uninitialized value"));
         BT = BT_msg_undef.get();
         break;
       case OCM_PropertyAccess:
         if (!BT_objc_prop_undef)
           BT_objc_prop_undef.reset(new BuiltinBug(
-              this, "Property access on an uninitialized object pointer"));
+              OriginalName,
+              "Property access on an uninitialized object pointer"));
         BT = BT_objc_prop_undef.get();
         break;
       case OCM_Subscript:
         if (!BT_objc_subscript_undef)
           BT_objc_subscript_undef.reset(new BuiltinBug(
-              this, "Subscript access on an uninitialized object pointer"));
+              OriginalName,
+              "Subscript access on an uninitialized object pointer"));
         BT = BT_objc_subscript_undef.get();
         break;
       }
       assert(BT && "Unknown message kind.");
 
       auto R = std::make_unique<PathSensitiveBugReport>(*BT, BT->getDescription(), N);
       const ObjCMessageExpr *ME = msg.getOriginExpr();
       R->addRange(ME->getReceiverRange());

 void CallAndMessageChecker::checkObjCMessageNil(const ObjCMethodCall &msg,
                                                 CheckerContext &C) const {
   HandleNilReceiver(C, C.getState(), msg);
 }
 
 void CallAndMessageChecker::emitNilReceiverBug(CheckerContext &C,
                                                const ObjCMethodCall &msg,
                                                ExplodedNode *N) const {
+  if (!ChecksEnabled[CK_NilReceiver]) {
+    C.addSink();
+    return;
+  }
 
   if (!BT_msg_ret)
-    BT_msg_ret.reset(
-        new BuiltinBug(this, "Receiver in message expression is 'nil'"));
+    BT_msg_ret.reset(new BuiltinBug(OriginalName,
+                                    "Receiver in message expression is 'nil'"));
 
   const ObjCMessageExpr *ME = msg.getOriginExpr();
 
   QualType ResTy = msg.getResultType();
 
   SmallString<200> buf;
   llvm::raw_svector_ostream os(buf);
   os << "The receiver of message '";
if (CanRetTy != Ctx.VoidTy && C.getLocationContext()->getParentMap()
     SVal V = C.getSValBuilder().makeZeroVal(RetTy);
     C.addTransition(state->BindExpr(Msg.getOriginExpr(), LCtx, V), &Tag);
     return;
   }
 
   C.addTransition(state);
 }
 
-void ento::registerCallAndMessageChecker(CheckerManager &mgr) {
+void ento::registerCallAndMessageModeling(CheckerManager &mgr) {
   mgr.registerChecker<CallAndMessageChecker>();
 }
 
-bool ento::shouldRegisterCallAndMessageChecker(const CheckerManager &mgr) {
+bool ento::shouldRegisterCallAndMessageModeling(const CheckerManager &mgr) {
   return true;
 }
 
-#define REGISTER_CHECKER(name)                                                 \
-  void ento::register##name(CheckerManager &mgr) {                             \
-    CallAndMessageChecker *checker = mgr.getChecker<CallAndMessageChecker>();  \
-    checker->ChecksEnabled[CallAndMessageChecker::CK_##name] = true;           \
-                                                                               \
-  }                                                                            \
-                                                                               \
-  bool ento::shouldRegister##name(const CheckerManager &mgr) { return true; }
+void ento::registerCallAndMessageChecker(CheckerManager &mgr) {
+  CallAndMessageChecker *checker = mgr.getChecker<CallAndMessageChecker>();
+
+  checker->OriginalName = mgr.getCurrentCheckerName();
+
+#define QUERY_CHECKER_OPTION(OPTION)                                           \
+  checker->ChecksEnabled[CallAndMessageChecker::CK_##OPTION] =                 \
+      mgr.getAnalyzerOptions().getCheckerBooleanOption(                        \
+          mgr.getCurrentCheckerName(), #OPTION);
+
+  QUERY_CHECKER_OPTION(FunctionPointer)
+  QUERY_CHECKER_OPTION(ParameterCount)
+  QUERY_CHECKER_OPTION(CXXThisMethodCall)
+  QUERY_CHECKER_OPTION(CXXDeallocationArg)
+  QUERY_CHECKER_OPTION(ArgInitializedness)
+  QUERY_CHECKER_OPTION(ArgPointeeInitializedness)
+  QUERY_CHECKER_OPTION(NilReceiver)
+  QUERY_CHECKER_OPTION(UndefReceiver)
+}
 
-REGISTER_CHECKER(CallAndMessageUnInitRefArg)
+bool ento::shouldRegisterCallAndMessageChecker(const CheckerManager &mgr) {
+  return true;
+}

clang/test/Analysis/PR40625.cpp

-// RUN: %clang_analyze_cc1 -std=c++11 -analyzer-checker=core,alpha.core.CallAndMessageUnInitRefArg  %s -verify
+// RUN: %clang_analyze_cc1 %s -verify \
+// RUN:   -analyzer-checker=core \
+// RUN:   -analyzer-config core.CallAndMessage:ArgPointeeInitializedness=true
 
 void f(const int *end);
 
 void g(const int (&arrr)[10]) {
   f(arrr); // expected-warning{{1st function call argument is a pointer to uninitialized value}}
 }
 
 void h() {
   int arr[10];
 
   g(arr);
 }

clang/test/Analysis/analyzer-config.c

 // RUN: %clang_analyze_cc1 -analyzer-checker=debug.ConfigDumper > %t 2>&1
 // RUN: FileCheck --input-file=%t %s --match-full-lines
 
-// CHECK: [config]
+// CHECK:      [config]
 // CHECK-NEXT: add-pop-up-notes = true
 // CHECK-NEXT: aggressive-binary-operation-simplification = false
 // CHECK-NEXT: alpha.clone.CloneChecker:IgnoredFilesPattern = ""
 // CHECK-NEXT: alpha.clone.CloneChecker:MinimumCloneComplexity = 50
 // CHECK-NEXT: alpha.clone.CloneChecker:ReportNormalClones = true
 // CHECK-NEXT: alpha.cplusplus.STLAlgorithmModeling:AggressiveStdFindModeling = false
 // CHECK-NEXT: alpha.osx.cocoa.DirectIvarAssignment:AnnotatedFunctions = false
 // CHECK-NEXT: alpha.security.MmapWriteExec:MmapProtExec = 0x04

 // CHECK-NEXT: cfg-conditional-static-initializers = true
 // CHECK-NEXT: cfg-expand-default-aggr-inits = false
 // CHECK-NEXT: cfg-implicit-dtors = true
 // CHECK-NEXT: cfg-lifetime = false
 // CHECK-NEXT: cfg-loopexit = false
 // CHECK-NEXT: cfg-rich-constructors = true
 // CHECK-NEXT: cfg-scopes = false
 // CHECK-NEXT: cfg-temporary-dtors = true
+// CHECK-NEXT: core.CallAndMessage:ArgInitializedness = true
+// CHECK-NEXT: core.CallAndMessage:ArgPointeeInitializedness = false
+// CHECK-NEXT: core.CallAndMessage:CXXDeallocationArg = true
+// CHECK-NEXT: core.CallAndMessage:CXXThisMethodCall = true
+// CHECK-NEXT: core.CallAndMessage:FunctionPointer = true
+// CHECK-NEXT: core.CallAndMessage:NilReceiver = true
+// CHECK-NEXT: core.CallAndMessage:ParameterCount = true
+// CHECK-NEXT: core.CallAndMessage:UndefReceiver = true
 // CHECK-NEXT: cplusplus.Move:WarnOn = KnownsAndLocals
 // CHECK-NEXT: crosscheck-with-z3 = false
 // CHECK-NEXT: ctu-dir = ""
 // CHECK-NEXT: ctu-import-threshold = 100
 // CHECK-NEXT: ctu-index-name = externalDefMap.txt
 // CHECK-NEXT: deadcode.DeadStores:ShowFixIts = false
 // CHECK-NEXT: deadcode.DeadStores:WarnForDeadNestedAssignments = true
 // CHECK-NEXT: debug.AnalysisOrder:* = false

clang/test/Analysis/analyzer-enabled-checkers.c

 // RUN: %clang --analyze %s --target=x86_64-pc-linux-gnu \
 // RUN:   -Xclang -analyzer-list-enabled-checkers \
 // RUN:   -Xclang -analyzer-display-progress \
 // RUN:   2>&1 | FileCheck %s --implicit-check-not=ANALYZE \
 // RUN:                       --implicit-check-not=\.
 
 // CHECK:      OVERVIEW: Clang Static Analyzer Enabled Checkers List
 // CHECK-EMPTY:
 // CHECK-NEXT: core.NonNullParamChecker
-// CHECK-NEXT: core.CallAndMessage
+// CHECK-NEXT: core.CallAndMessageModeling
 // CHECK-NEXT: apiModeling.StdCLibraryFunctions
 // CHECK-NEXT: apiModeling.TrustNonnull
 // CHECK-NEXT: apiModeling.llvm.CastValue
 // CHECK-NEXT: apiModeling.llvm.ReturnValue
+// CHECK-NEXT: core.CallAndMessage
 // CHECK-NEXT: core.DivideZero
 // CHECK-NEXT: core.DynamicTypePropagation
 // CHECK-NEXT: core.NonnilStringConstants
 // CHECK-NEXT: core.NullDereference
 // CHECK-NEXT: core.StackAddrEscapeBase
 // CHECK-NEXT: core.StackAddressEscape
 // CHECK-NEXT: core.UndefinedBinaryOperatorResult
 // CHECK-NEXT: core.VLASize

clang/test/Analysis/call-and-message.c

+// RUN: %clang_analyze_cc1 %s -verify \
+// RUN:   -analyzer-checker=core \
+// RUN:   -analyzer-config core.CallAndMessage:ArgPointeeInitializedness=true \
+// RUN:   -analyzer-output=plist -o %t.plist
+// RUN: cat %t.plist | FileCheck %s
+
+// RUN: %clang_analyze_cc1 %s -verify=no-pointee \
+// RUN:   -analyzer-checker=core \
+// RUN:   -analyzer-config core.CallAndMessage:ArgPointeeInitializedness=false
+
+// no-pointee-no-diagnostics
+
+void doStuff_pointerToConstInt(const int *u){};
+void pointee_uninit() {
+  int i;
+  int *p = &i;
+  doStuff_pointerToConstInt(p); // expected-warning{{1st function call argument is a pointer to uninitialized value [core.CallAndMessage]}}
+}
+
+// TODO: If this hash ever changes, turn
+// core.CallAndMessage:ArgPointeeInitializedness from a checker option into a
+// checker, as described in the CallAndMessage comments!
+// CHECK: <key>issue_hash_content_of_line_in_context</key>
+// CHECK-SAME: <string>97a74322d64dca40aa57303842c745a1</string>

clang/test/Analysis/call-and-message.cpp

+// RUN: %clang_analyze_cc1 %s -verify=fn-pointer \
+// RUN:   -analyzer-checker=core \
+// RUN:   -analyzer-config core.CallAndMessage:FunctionPointer=true \
+// RUN:   -analyzer-config core.CallAndMessage:ParameterCount=false \
+// RUN:   -analyzer-config core.CallAndMessage:CXXThisMethodCall=false \
+// RUN:   -analyzer-config core.CallAndMessage:CXXDeallocationArg=false \
+// RUN:   -analyzer-config core.CallAndMessage:ArgInitializedness=false \
+// RUN:   -analyzer-config core.CallAndMessage:ArgPointeeInitializedness=false \
+// RUN:   -analyzer-config core.CallAndMessage:NilReceiver=false \
+// RUN:   -analyzer-config core.CallAndMessage:UndefReceiver=false
+
+// RUN: %clang_analyze_cc1 %s -verify=param-count \
+// RUN:   -analyzer-checker=core \
+// RUN:   -analyzer-config core.CallAndMessage:FunctionPointer=false \
+// RUN:   -analyzer-config core.CallAndMessage:ParameterCount=true \
+// RUN:   -analyzer-config core.CallAndMessage:CXXThisMethodCall=false \
+// RUN:   -analyzer-config core.CallAndMessage:CXXDeallocationArg=false \
+// RUN:   -analyzer-config core.CallAndMessage:ArgInitializedness=false \
+// RUN:   -analyzer-config core.CallAndMessage:ArgPointeeInitializedness=false \
+// RUN:   -analyzer-config core.CallAndMessage:NilReceiver=false \
+// RUN:   -analyzer-config core.CallAndMessage:UndefReceiver=false
+
+// RUN: %clang_analyze_cc1 %s -verify=method \
+// RUN:   -analyzer-checker=core \
+// RUN:   -analyzer-config core.CallAndMessage:FunctionPointer=false \
+// RUN:   -analyzer-config core.CallAndMessage:ParameterCount=false \
+// RUN:   -analyzer-config core.CallAndMessage:CXXThisMethodCall=true \
+// RUN:   -analyzer-config core.CallAndMessage:CXXDeallocationArg=false \
+// RUN:   -analyzer-config core.CallAndMessage:ArgInitializedness=false \
+// RUN:   -analyzer-config core.CallAndMessage:ArgPointeeInitializedness=false \
+// RUN:   -analyzer-config core.CallAndMessage:NilReceiver=false \
+// RUN:   -analyzer-config core.CallAndMessage:UndefReceiver=false
+
+// RUN: %clang_analyze_cc1 %s -verify=delete \
+// RUN:   -analyzer-checker=core \
+// RUN:   -analyzer-config core.CallAndMessage:FunctionPointer=false \
+// RUN:   -analyzer-config core.CallAndMessage:ParameterCount=false \
+// RUN:   -analyzer-config core.CallAndMessage:CXXThisMethodCall=false \
+// RUN:   -analyzer-config core.CallAndMessage:CXXDeallocationArg=true \
+// RUN:   -analyzer-config core.CallAndMessage:ArgInitializedness=false \
+// RUN:   -analyzer-config core.CallAndMessage:ArgPointeeInitializedness=false \
+// RUN:   -analyzer-config core.CallAndMessage:NilReceiver=false \
+// RUN:   -analyzer-config core.CallAndMessage:UndefReceiver=false
+
+// RUN: %clang_analyze_cc1 %s -verify=arg-init \
+// RUN:   -analyzer-checker=core \
+// RUN:   -analyzer-config core.CallAndMessage:FunctionPointer=false \
+// RUN:   -analyzer-config core.CallAndMessage:ParameterCount=false \
+// RUN:   -analyzer-config core.CallAndMessage:CXXThisMethodCall=false \
+// RUN:   -analyzer-config core.CallAndMessage:CXXDeallocationArg=false \
+// RUN:   -analyzer-config core.CallAndMessage:ArgInitializedness=true \
+// RUN:   -analyzer-config core.CallAndMessage:ArgPointeeInitializedness=false \
+// RUN:   -analyzer-config core.CallAndMessage:NilReceiver=false \
+// RUN:   -analyzer-config core.CallAndMessage:UndefReceiver=false
+
+// Testing for ArgPointeeInitializedness is in call-and-message.c.
+
+// RUN: %clang_analyze_cc1 %s \
+// RUN:   -verify=fn-pointer,param-count,method,delete,arg-init \
+// RUN:   -analyzer-checker=core \
+// RUN:   -analyzer-output=plist -o %t.plist
+// RUN: cat %t.plist | FileCheck %s
+
+namespace function_pointer {
+using Fn = void (*)();
+
+void uninit() {
+  Fn f;
+  f(); // fn-pointer-warning{{Called function pointer is an uninitialized pointer value [core.CallAndMessage]}}
+}
+
+void null() {
+  Fn f = nullptr;
+  f(); // fn-pointer-warning{{Called function pointer is null (null dereference) [core.CallAndMessage]}}
+}
+
+// TODO: If this hash ever changes, turn
+// core.CallAndMessage:FunctionPointer from a checker option into a
+// checker, as described in the CallAndMessage comments!
+// CHECK: <key>issue_hash_content_of_line_in_context</key>
+// CHECK-SAME: <string>eb2083c01775eef452afa75728dd4d8f</string>
+// CHECK: <key>issue_hash_content_of_line_in_context</key>
+// CHECK-SAME: <string>407c50d9bedd8db28bf34f9411308100</string>
+
+} // namespace function_pointer
+
+namespace wrong_param_count {
+using FnOneParam = void (*)(int);
+using FnTwoParam = void (*)(int, int);
+
+void f(int, int) {}
+
+void wrong_cast() {
+  FnTwoParam f1 = f;
+  FnOneParam f2 = reinterpret_cast<FnOneParam>(f1);
+  f2(5); // param-count-warning{{Function taking 2 arguments is called with fewer (1) [core.CallAndMessage]}}
+}
+
+// TODO: If this hash ever changes, turn
+// core.CallAndMessage:ParameterCount from a checker option into a
+// checker, as described in the CallAndMessage comments!
+// CHECK: <key>issue_hash_content_of_line_in_context</key>
+// CHECK-SAME: <string>9ff0e9b728422017945c9d5a673de223</string>
+} // namespace wrong_param_count
+
+namespace method_call {
+struct A {
+  void m();
+};
+
+void uninit() {
+  A *a;
+  a->m(); // method-warning{{Called C++ object pointer is uninitialized [core.CallAndMessage]}}
+}
+
+// TODO: If this hash ever changes, turn
+// core.CallAndMessage:CXXThisMethodCall from a checker option into a
+// checker, as described in the CallAndMessage comments!
+// CHECK: <key>issue_hash_content_of_line_in_context</key>
+// CHECK-SAME: <string>7bc35c70465837948a3f5018f27b21cd</string>
+
+void null() {
+  A *a = nullptr;
+  a->m(); // method-warning{{Called C++ object pointer is null [core.CallAndMessage]}}
+}
+
+// TODO: If this hash ever changes, turn
+// core.CallAndMessage:CXXThisMethodCall from a checker option into a
+// checker, as described in the CallAndMessage comments!
+// CHECK: <key>issue_hash_content_of_line_in_context</key>
+// CHECK-SAME: <string>8ec260c9ef11d7c51fa872212df1163f</string>
+} // namespace method_call
+
+namespace operator_delete {
+void f() {
+  int *i;
+  delete i; // delete-warning{{Argument to 'delete' is uninitialized [core.CallAndMessage]}}
+}
+
+// TODO: If this hash ever changes, turn
+// core.CallAndMessage:CXXDeallocationArg from a checker option into a
+// checker, as described in the CallAndMessage comments!
+// CHECK: <key>issue_hash_content_of_line_in_context</key>
+// CHECK-SAME: <string>a8ff99ebaa8746457d3e14af8ef7e75c</string>
+} // namespace operator_delete
+
+namespace uninit_arg {
+template <class T>
+void consume(T);
+
+void fundamental_uninit() {
+  int i;
+  consume(i); // arg-init-warning{{1st function call argument is an uninitialized value [core.CallAndMessage]}}
+}
+
+struct A {
+  int i;
+};
+
+void record_uninit() {
+  A a;
+  consume(a); // arg-init-warning{{Passed-by-value struct argument contains uninitialized data (e.g., field: 'i') [core.CallAndMessage]}}
+}
+
+// TODO: If this hash ever changes, turn
+// core.CallAndMessage:ArgInitializedness from a checker option into a
+// checker, as described in the CallAndMessage comments!
+// CHECK: <key>issue_hash_content_of_line_in_context</key>
+// CHECK-SAME: <string>a46bb5c1ee44d4611ffeb13f7f499605</string>
+// CHECK: <key>issue_hash_content_of_line_in_context</key>
+// CHECK-SAME: <string>e0e0d30ea5a7b2e3a71e1931fa0768a5</string>
+} // namespace uninit_arg

clang/test/Analysis/call-and-message.m

+// RUN: %clang_analyze_cc1 %s -verify \
+// RUN:   -Wno-objc-root-class \
+// RUN:   -analyzer-checker=core \
+// RUN:   -analyzer-config core.CallAndMessage:FunctionPointer=false \
+// RUN:   -analyzer-config core.CallAndMessage:ParameterCount=false \
+// RUN:   -analyzer-config core.CallAndMessage:CXXThisMethodCall=false \
+// RUN:   -analyzer-config core.CallAndMessage:CXXDeallocationArg=false \
+// RUN:   -analyzer-config core.CallAndMessage:ArgInitializedness=false \
+// RUN:   -analyzer-config core.CallAndMessage:ArgPointeeInitializedness=false \
+// RUN:   -analyzer-config core.CallAndMessage:NilReceiver=false \
+// RUN:   -analyzer-config core.CallAndMessage:UndefReceiver=true \
+// RUN:   -analyzer-output=plist -o %t.plist
+// RUN: cat %t.plist | FileCheck %s
+
+//===----------------------------------------------------------------------===//
+// The following code is reduced using delta-debugging from
+// Foundation.h (Mac OS X).
+//
+// It includes the basic definitions for the test cases below.
+// Not directly including Foundation.h directly makes this test case
+// both svelte and portable to non-Mac platforms.
+//===----------------------------------------------------------------------===//
+
+typedef signed char BOOL;
+typedef unsigned int NSUInteger;
+typedef struct _NSZone NSZone;
+@class NSInvocation, NSMethodSignature, NSCoder, NSString, NSEnumerator;
+@protocol NSObject
+- (BOOL)isEqual:(id)object;
+@end
+@protocol NSCopying
+- (id)copyWithZone:(NSZone *)zone;
+@end
+@protocol NSMutableCopying
+- (id)mutableCopyWithZone:(NSZone *)zone;
+@end
+@protocol NSCoding
+- (void)encodeWithCoder:(NSCoder *)aCoder;
+@end
+@interface NSObject <NSObject> {
+}
+@end
+@class NSString, NSData;
+@class NSString, NSData, NSMutableData, NSMutableDictionary, NSMutableArray;
+typedef struct {
+} NSFastEnumerationState;
+@protocol NSFastEnumeration
+- (NSUInteger)countByEnumeratingWithState:(NSFastEnumerationState *)state objects:(id *)stackbuf count:(NSUInteger)len;
+@end
+@class NSData, NSIndexSet, NSString, NSURL;
+@interface NSArray : NSObject <NSCopying, NSMutableCopying, NSCoding, NSFastEnumeration>
+- (NSUInteger)count;
+@end
+@interface NSArray (NSArrayCreation)
++ (id)array;
+- (NSUInteger)length;
+- (void)addObject:(id)object;
+@end
+extern NSString *const NSUndoManagerCheckpointNotification;
+
+//===----------------------------------------------------------------------===//
+// Test cases.
+//===----------------------------------------------------------------------===//
+
+unsigned f1() {
+  NSString *aString;
+  return [aString length]; // expected-warning {{Receiver in message expression is an uninitialized value [core.CallAndMessage]}}
+}
+
+// TODO: If this hash ever changes, turn core.CallAndMessage:UndefReceiver from
+// a checker option into a checker, as described in the CallAndMessage comments!
+// CHECK: <key>issue_hash_content_of_line_in_context</key>
+// CHECK-SAME: <string>29873175e1cc0a98f7040057279925a0</string>
+
+@interface RDar9241180
+@property(readwrite, assign) id x;
+- (id)testAnalyzer1:(int)y;
+@end
+
+@implementation RDar9241180
+@synthesize x;
+- (id)testAnalyzer1:(int)y {
+  RDar9241180 *o;
+  if (y && o.x) // expected-warning {{Property access on an uninitialized object pointer [core.CallAndMessage]}}
+    return o;
+
+  // TODO: If this hash ever changes, turn core.CallAndMessage:UndefReceiver from
+  // a checker option into a checker, as described in the CallAndMessage comments!
+  // CHECK: <key>issue_hash_content_of_line_in_context</key>
+  // CHECK-SAME: <string>00ddd30796a283de33e662da8449c796</string>
+
+  return o; // expected-warning {{Undefined or garbage value returned to caller [core.uninitialized.UndefReturn]}}
+}
+@end
+
+// CHECK: <key>issue_hash_content_of_line_in_context</key>
+// CHECK-SAME: <string>8d468e24df7d887f4182bf49f5dd8b71</string>
+
+typedef signed char BOOL;
+typedef unsigned int NSUInteger;
+
+@interface Subscriptable : NSObject
+- (void)setObject:(id)obj atIndexedSubscript:(NSUInteger)index;
+- (id)objectAtIndexedSubscript:(NSUInteger)index;
+
+- (void)setObject:(id)obj forKeyedSubscript:(id)key;
+- (id)objectForKeyedSubscript:(id)key;
+@end
+
+@interface Test : Subscriptable
+@end
+
+@implementation Test
+
+// <rdar://problem/9241180> for subscripting
+- (id)testUninitializedObject:(BOOL)keyed {
+  Test *o;
+  if (keyed) {
+    if (o[self]) // expected-warning {{Subscript access on an uninitialized object pointer [core.CallAndMessage]}}
+      return o;  // no-warning (sink)
+  } else {
+    if (o[0])   // expected-warning {{Subscript access on an uninitialized object pointer [core.CallAndMessage]}}
+      return o; // no-warning (sink)
+  }
+  return self;
+}
+@end
+
+// TODO: If this hash ever changes, turn core.CallAndMessage:UndefReceiver from
+// a checker option into a checker, as described in the CallAndMessage comments!
+// CHECK: <key>issue_hash_content_of_line_in_context</key>
+// CHECK-SAME: <string>8d943563d78377fc5dfcd4fdde904e5e</string>
+// CHECK: <key>issue_hash_content_of_line_in_context</key>
+// CHECK-SAME: <string>9a2a9698763d62bed38d91fe5fb4aefd</string>

clang/test/Analysis/call-and-message.mm

+// RUN: %clang_analyze_cc1 %s -verify \
+// RUN:   -analyzer-checker=core \
+// RUN:   -analyzer-config core.CallAndMessage:FunctionPointer=false \
+// RUN:   -analyzer-config core.CallAndMessage:ParameterCount=false \
+// RUN:   -analyzer-config core.CallAndMessage:CXXThisMethodCall=false \
+// RUN:   -analyzer-config core.CallAndMessage:CXXDeallocationArg=false \
+// RUN:   -analyzer-config core.CallAndMessage:ArgInitializedness=false \
+// RUN:   -analyzer-config core.CallAndMessage:ArgPointeeInitializedness=false \
+// RUN:   -analyzer-config core.CallAndMessage:NilReceiver=true \
+// RUN:   -analyzer-config core.CallAndMessage:UndefReceiver=false \
+// RUN:   -analyzer-output=plist -o %t.plist
+// RUN: cat %t.plist | FileCheck %s
+
+@interface Foo
+- (int &)ref;
+@end
+
+Foo *getFoo() { return 0; }
+
+void testNullPointerSuppression() {
+  getFoo().ref = 1;
+}
+
+void testPositiveNullReference() {
+  Foo *x = 0;
+  x.ref = 1; // expected-warning {{The receiver of message 'ref' is nil, which results in forming a null reference [core.CallAndMessage]}}
+}
+
+// TODO: If this hash ever changes, turn core.CallAndMessage:NilReceiver from a
+// checker option into a checker, as described in the CallAndMessage comments!
+// CHECK: <key>issue_hash_content_of_line_in_context</key>
+// CHECK-SAME: <string>abe2e0574dd901094c511bae2f93f926</string>

clang/test/Analysis/exercise-ps.c

-// RUN: %clang_analyze_cc1 -analyzer-checker=core,alpha.core -analyzer-store=region -verify %s
+// RUN: %clang_analyze_cc1 %s -verify \
+// RUN:   -analyzer-checker=core \
+// RUN:   -analyzer-config core.CallAndMessage:ArgPointeeInitializedness=true
 //
 // Just exercise the analyzer on code that has at one point caused issues
 // (i.e., no assertions or crashes).
 
-
 static void f1(const char *x, char *y) {
   while (*x != 0) {
     *y++ = *x++;
   }
 }
 
 // This following case checks that we properly handle typedefs when getting
 // the RvalueType of an ElementRegion.

clang/test/Analysis/reference.mm

-// RUN: %clang_analyze_cc1 -analyzer-checker=core -verify -Wno-null-dereference %s
-
-@interface Foo
-- (int &)ref;
-@end
-
-Foo *getFoo() { return 0; }
-
-void testNullPointerSuppression() {
-  getFoo().ref = 1;
-}
-
-void testPositiveNullReference() {
-  Foo *x = 0;
-  x.ref = 1; // expected-warning {{The receiver of message 'ref' is nil, which results in forming a null reference}}
-}
-

clang/test/Analysis/uninit-const.c

-// RUN: %clang_analyze_cc1 -analyzer-checker=unix.Malloc,core,alpha.core.CallAndMessageUnInitRefArg,debug.ExprInspection -analyzer-output=text -verify %s
+// RUN: %clang_analyze_cc1 -analyzer-output=text -verify %s \
+// RUN:   -analyzer-checker=core \
+// RUN:   -analyzer-checker=unix.Malloc \
+// RUN:   -analyzer-checker=debug.ExprInspection \
+// RUN:   -analyzer-config core.CallAndMessage:ArgPointeeInitializedness=true
 
 void clang_analyzer_warnIfReached();
 
 // Passing uninitialized const data to function
 #include "Inputs/system-header-simulator.h"
 
 typedef __typeof(sizeof(int)) size_t;
 void *malloc(size_t);

clang/test/Analysis/uninit-const.cpp

-// RUN: %clang_analyze_cc1 -analyzer-checker=cplusplus.NewDelete,core,alpha.core.CallAndMessageUnInitRefArg -analyzer-output=text -verify %s
-// RUN: %clang_analyze_cc1 -analyzer-checker=cplusplus.NewDelete,core,alpha.core.CallAndMessageUnInitRefArg -analyzer-output=text -DTEST_INLINABLE_ALLOCATORS -verify %s
+// RUN: %clang_analyze_cc1 -analyzer-output=text -verify %s \
+// RUN:   -analyzer-checker=core \
+// RUN:   -analyzer-checker=cplusplus.NewDelete \
+// RUN:   -analyzer-config core.CallAndMessage:ArgPointeeInitializedness=true
+
+// RUN: %clang_analyze_cc1 -analyzer-output=text -verify %s \
+// RUN:   -DTEST_INLINABLE_ALLOCATORS \
+// RUN:   -analyzer-checker=core \
+// RUN:   -analyzer-checker=cplusplus.NewDelete \
+// RUN:   -analyzer-config core.CallAndMessage:ArgPointeeInitializedness=true
+
 // Passing uninitialized const data to unknown function
 
 #include "Inputs/system-header-simulator-cxx.h"
 
 void doStuff6(const int& c);
 void doStuff4(const int y);
 void doStuff3(int& g);
 void doStuff_uninit(const int *u);

clang/test/Analysis/uninit-msg-expr.m

-// RUN: %clang_analyze_cc1 -analyzer-checker=core -analyzer-store=region -verify %s
-
-//===----------------------------------------------------------------------===//
-// The following code is reduced using delta-debugging from
-// Foundation.h (Mac OS X).
-//
-// It includes the basic definitions for the test cases below.
-// Not directly including Foundation.h directly makes this test case 
-// both svelte and portable to non-Mac platforms.
-//===----------------------------------------------------------------------===//
-
-typedef signed char BOOL;
-typedef unsigned int NSUInteger;
-typedef struct _NSZone NSZone;
-@class NSInvocation, NSMethodSignature, NSCoder, NSString, NSEnumerator;
-@protocol NSObject  - (BOOL)isEqual:(id)object; @end
-@protocol NSCopying  - (id)copyWithZone:(NSZone *)zone; @end
-@protocol NSMutableCopying  - (id)mutableCopyWithZone:(NSZone *)zone; @end
-@protocol NSCoding  - (void)encodeWithCoder:(NSCoder *)aCoder; @end
-@interface NSObject <NSObject> {} @end
-@class NSString, NSData;
-@class NSString, NSData, NSMutableData, NSMutableDictionary, NSMutableArray;
-typedef struct {} NSFastEnumerationState;
-@protocol NSFastEnumeration
-- (NSUInteger)countByEnumeratingWithState:(NSFastEnumerationState *)state objects:(id *)stackbuf count:(NSUInteger)len;
-@end
-@class NSData, NSIndexSet, NSString, NSURL;
-@interface NSArray : NSObject <NSCopying, NSMutableCopying, NSCoding, NSFastEnumeration>
-- (NSUInteger)count;
-@end
-@interface NSArray (NSArrayCreation)
-+ (id)array;
-- (NSUInteger)length;
-- (void)addObject:(id)object;
-@end
-extern NSString * const NSUndoManagerCheckpointNotification;
-
-//===----------------------------------------------------------------------===//
-// Test cases.
-//===----------------------------------------------------------------------===//
-
-unsigned f1() {
-  NSString *aString;
-  return [aString length]; // expected-warning {{Receiver in message expression is an uninitialized value}}
-}
-
-unsigned f2() {
-  NSString *aString = 0;
-  return [aString length]; // no-warning
-}
-
-void f3() {
-  NSMutableArray *aArray = [NSArray array];
-  NSString *aString;
-  [aArray addObject:aString]; // expected-warning {{1st argument in message expression is an uninitialized value}}
-}