[analyzer][Liveness][NFC] Get rid of statement liveness, because such a thing doesn't exist

[Szelethus]

Summary

The summary and very short discussion in D82122 summarizes whats happening here.

[Szelethus]

I didn't run this on big projects just yet, and judging from the fact that Environment only contained ObjetiveC examples of non-expression statements, I might need a tip on how to test on ObjC code :)

[xazax.hun]

I always wondered if we actually need to track the liveness of exprs at all. We could just kill all subexpr at the end of the full expression without precomputing anything. But I might miss something.

[NoQ]

We could just kill all subexpr at the end of the full expression

I suspect that it would be pretty bad if you, say, kill the condition of the if-statement before picking the branch. Or kill the initializer in the DeclStmt before putting it into the variable (same for CXXCtorInitializer which isn't even a Stmt!).

I might need a tip on how to test on ObjC code :)

Unfortunately i don't have any helpful tips for you :( Such code is not cross-compiled very often. I vaguely remember seeing some Objective-C code in linux software but it's most likely not very modern/representative. So i guess it's on us to inform you of the potential problems.

[xazax.hun]

In D82598#2115656, @NoQ wrote:

We could just kill all subexpr at the end of the full expression

I suspect that it would be pretty bad if you, say, kill the condition of the if-statement before picking the branch. Or kill the initializer in the DeclStmt before putting it into the variable (same for CXXCtorInitializer which isn't even a Stmt!).

I would argue that the end of the full expression is AFTER the if was evaluated in this case. But I do see what you mean, thanks :)

[NoQ]

In D82598#2116373, @xazax.hun wrote:

I suspect that it would be pretty bad if you, say, kill the condition of the if-statement before picking the branch. Or kill the initializer in the DeclStmt before putting it into the variable (same for CXXCtorInitializer which isn't even a Stmt!).

I would argue that the end of the full expression is AFTER the if was evaluated in this case. But I do see what you mean, thanks :)

Well, formally it isn't. The notion of full-expression is defined pretty strictly because that's the moment of time when temporary destructors are invoked. So the language pays a lot of attention to what exactly constitutes an expression, and as of now if-statements don't. In particular, temporary destructors will run before the branch is chosen.

I guess your point is that live expressions analysis could be replaced with imperative cleanup requests from, say, ExprEngine to the Environment. I.e., "We've just finished evaluating the if-statement, now we should actively tell the Environment to remove the condition expression". I guess it could totally work that way, but it'd be pretty hard to not forget such cleanups. Given that we'd also barely ever notice that we forgot one of those, i'm very much in favor of having liveness analysis instead, that would declaratively describe which expressions are live when, so that to automatically guarantee that we always only track what's necessary and never snowball our state with dead expressions.

[xazax.hun]

@Szelethus
The patch looks good to me and I find it a welcome change that should make things easier to understand and maybe even a bit more efficient, I hope this won't break ObjC :) My discussion with Artem is orthogonal to this change.

In D82598#2117432, @NoQ wrote:

Well, formally it isn't.

Right. Sorry for being unclear there.

I guess your point is that live expressions analysis could be replaced with imperative cleanup requests from, say, ExprEngine to the Environment. I.e., "We've just finished evaluating the if-statement, now we should actively tell the Environment to remove the condition expression".

Yes. This is what I am proposing and this is what we did with the lifetime analysis. Unfortunately, I did not have time yet to identify all the cleanup points and I do agree that this is not a trivial task but I felt that this is much more lightweight in terms of memory and computation.

I guess it could totally work that way, but it'd be pretty hard to not forget such cleanups.

I agree.

Given that we'd also barely ever notice that we forgot one of those, i'm very much in favor of having liveness analysis instead, that would declaratively describe which expressions are live when, so that to automatically guarantee that we always only track what's necessary and never snowball our state with dead expressions.

Fair point. I do not remember any problem with the current liveness analysis so I guess if something is not broken do not fix it. We also don't have any evidence of this being a bottleneck.

[Szelethus]

Note to self: rename debug.DumpLiveStmts to debug.DumpLiveExprs. Thanks for the review btw! I don't immediately have something to add to your discussion though :)

[NoQ]

In D82598#2119545, @xazax.hun wrote:

Given that we'd also barely ever notice that we forgot one of those, i'm very much in favor of having liveness analysis instead, that would declaratively describe which expressions are live when, so that to automatically guarantee that we always only track what's necessary and never snowball our state with dead expressions.

Fair point. I do not remember any problem with the current liveness analysis so I guess if something is not broken do not fix it. We also don't have any evidence of this being a bottleneck.

D55566!

[Szelethus]

I chased my own tail for weeks before realizing that there is indeed another instance when a live statement is stored, other then ObjCForCollectionStmt...

void clang_analyzer_eval(bool);

void test_lambda_refcapture() {
  int a = 6;
  [&](int &a) { a = 42; }(a);
  clang_analyzer_eval(a == 42); // expected-warning{{TRUE}}
}

// CHECK: [ B0 (live statements at block exit) ]
// CHECK-EMPTY:
// CHECK-EMPTY:
// CHECK-NEXT: [ B1 (live statements at block exit) ]
// CHECK-EMPTY:
// CHECK-EMPTY:
// CHECK-NEXT: [ B2 (live statements at block exit) ]
// CHECK-EMPTY:
// CHECK-NEXT: CompoundStmt {{.*}}
// CHECK-NEXT: `-BinaryOperator {{.*}} 'int' lvalue '='
// CHECK-NEXT:   |-DeclRefExpr {{.*}} 'int' lvalue ParmVar {{.*}} 'a' 'int &'
// CHECK-NEXT:   `-IntegerLiteral {{.*}} 'int' 42

[xazax.hun]

In D82598#2162239, @Szelethus wrote:

I chased my own tail for weeks before realizing that there is indeed another instance when a live statement is stored, other then ObjCForCollectionStmt...

void clang_analyzer_eval(bool);

void test_lambda_refcapture() {
  int a = 6;
  [&](int &a) { a = 42; }(a);
  clang_analyzer_eval(a == 42); // expected-warning{{TRUE}}
}

Hmm, interesting. I don't really understand why do we need to keep that block live, as we definitely won't use any of the value it provides (since it does not provide a value at all).

I am only doing guessing here, but maybe the side effect of the statement is pruned from the store as soon as it is no longer live?

I might be wrong here, but maybe solving this problem would not be the job of the liveness analysis but we have a bug elsewhere, as this binding should be pruned when a is a dead variable.

[Szelethus]

In D82598#2162496, @xazax.hun wrote:

In D82598#2162239, @Szelethus wrote:

I chased my own tail for weeks before realizing that there is indeed another instance when a live statement is stored, other then ObjCForCollectionStmt...

void clang_analyzer_eval(bool);

void test_lambda_refcapture() {
  int a = 6;
  [&](int &a) { a = 42; }(a);
  clang_analyzer_eval(a == 42); // expected-warning{{TRUE}}
}

Hmm, interesting. I don't really understand why do we need to keep that block live, as we definitely won't use any of the value it provides (since it does not provide a value at all).

Actually, what I said initially is true:

[...] the only non-expression statements it queried are ObjCForCollectionStmts [...]

so I think it'd be okay to simply drop this. Also, its easy to see why this popped up, because... (cont. in inline)

clang/lib/Analysis/LiveVariables.cpp

316–319

..this part of the code caused the issue. Looking at the related CFG,

void test_lambda_refcapture()
 [B2 (ENTRY)]
   Succs (1): B1

 [B1]
   1: 6
   2: int a = 6;
   3: operator()
   4: [B1.3] (ImplicitCastExpr, FunctionToPointerDecay, void (*)(int &) const)
   5: [&](int &a) {
    a = 42;
}
   6: [B1.5]
   7: [B1.6] (ImplicitCastExpr, NoOp, const class (lambda at /home/szelethus/Documents/llvm-project/clang/test/Analysis/live-stmts.cpp:183:3))
   8: a
   9: [B1.7]([B1.8]) (OperatorCall)
  10: clang_analyzer_eval
  11: [B1.10] (ImplicitCastExpr, FunctionToPointerDecay, void (*)(_Bool))
  12: a
  13: [B1.12] (ImplicitCastExpr, LValueToRValue, int)
  14: 42
  15: [B1.13] == [B1.14]
  16: [B1.11]([B1.15])
   Preds (1): B2
   Succs (1): B0

 [B0 (EXIT)]
   Preds (1): B1

its clear that element 5 added the live statement, and I think that that this entire CFG just simply isn't right. Shouldn't we have a distinct element for the assignment?

[xazax.hun]

clang/lib/Analysis/LiveVariables.cpp

316–319

Shouldn't we have a distinct element for the assignment?

Strictly speaking, we have CFGs for a function. The assignment is not in this function, it is in the operator() of the class representing this lambda expression.

So basically, we do have a LambdaExpr to represent the expression, but the body of the lambda is in a separate entity.

[Szelethus]

clang/lib/Analysis/LiveVariables.cpp

316–319

Well, debug.DumpCFG definitely doesn't indulge me with a separate lambda CFG, so I figured this is a (rightful) optimization or compression.

My point is, this entire code snippet is a seriously error prone, best-effort heuristic. Switch casing every small little corner case might be tedious, troublesome in terms of scaling, and I for sure don't want to maintain it 'til eternity, but we have to acknowledge that this isn't a perfect solution either.

[NoQ]

In D82598#2164363, @Szelethus wrote:

Hmm, interesting. I don't really understand why do we need to keep that block live, as we definitely won't use any of the value it provides (since it does not provide a value at all).

Actually, what I said initially is true:

[...] the only non-expression statements it queried are ObjCForCollectionStmts [...]

so I think it'd be okay to simply drop this.

Yeah, that sounds about right; you observed the current behavior to be a counterexample but found no evidence that the current behavior makes any sense.

P.S. We've found an example where ObjCForCollectionStmts break (i.e., your recently added assertion gets hit), i'll reduce and think of a patch. Still shocked this wasn't covered with tests.

clang/lib/Analysis/LiveVariables.cpp

316–319

Well, debug.DumpCFG definitely doesn't indulge me with a separate lambda CFG

Does that mean that checkASTCodeBody doesn't get run on lambda bodies, and neither do any of our path-insensitive checks?

[Szelethus]

Ouch. Let me know how severe this is, because this is a big milestone in my project.

[xazax.hun]

In D82598#2164363, @Szelethus wrote:

Actually, what I said initially is true:

[...] the only non-expression statements it queried are ObjCForCollectionStmts [...]

Btw, sorry. I somehow misunderstood the snippet and tought that the test fails after the change. I am also ok with dropping this.

[NoQ]

Ok, here's the crashing example with ObjCForCollectionStmt. It should be saved as an .mm file and it crashes under pure --analyze.

@interface Item
// ...
@end

@interface Collection
// ...
@end

typedef void (^Blk)();

struct RAII {
  Blk blk;

public:
  RAII(Blk blk): blk(blk) {}
  ~RAII() { blk(); }
};

void foo(Collection *coll) {
  RAII raii(^{});
  for (Item *item in coll) {}
}

The CFG ("allocate a variable, pick the item and put it into that variable, execute the body, repeat"):

The interesting part of the ExplodedGraph:

And here's the FIXME that you're looking for:

...
44 /// Generate a node in \p Bldr for an iteration statement using ObjC
45 /// for-loop iterator.
46 static void populateObjCForDestinationSet(
47     ExplodedNodeSet &dstLocation, SValBuilder &svalBuilder,
48     const ObjCForCollectionStmt *S, const Stmt *elem, SVal elementV,
49     SymbolManager &SymMgr, const NodeBuilderContext *currBldrCtx,
50     StmtNodeBuilder &Bldr, bool hasElements) {
...
56     SVal hasElementsV = svalBuilder.makeTruthVal(hasElements);
57
58     // FIXME: S is not an expression. We should not be binding values to it.
59     ProgramStateRef nextState = state->BindExpr(S, LCtx, hasElementsV);
...

So, like, the engine is conveniently assigning 0 or 1 to the collection-statement in the Environment when the collection is assumed to be empty or not.

It's obviously a hack. This shouldn't be in the Environment. This should have been a GDM trait attached to the collection. Ideally it should also be modeled, i.e. sometimes we do know whether the collection is empty, and it might even be modeled occasionally. But in any case this shouldn't be in the Environment.

[Szelethus]

Thank you so much, you really went out of your way to dig that out! I'll try to patch this somehow.

[Szelethus]

Wow, I never realized I accidentally landed that assert (D82122#2172360), but I guess its great to have that covered. Would you prefer to have that reverted as I'm looking to fix this for good?

[NoQ]

I still wonder what made this statement live in my example. There must have been some non-trivial liveness analysis going on that caused a statement to be live; probably something to do with the C++ destructor elements.

In D82598#2172371, @Szelethus wrote:

Wow, I never realized I accidentally landed that assert (D82122#2172360), but I guess its great to have that covered. Would you prefer to have that reverted as I'm looking to fix this for good?

It doesn't add any actual functionality so i think it makes sense to revert unless you have a quick fix.

Also if the assert is in fact true then i'd rather make a much stronger statement by banning statements from the Environment entirely, as in, like, at compile time by making it accept Expr * instead of Stmt *.

[Szelethus]

In D82598#2172416, @NoQ wrote:

I still wonder what made this statement live in my example. There must have been some non-trivial liveness analysis going on that caused a statement to be live; probably something to do with the C++ destructor elements.

Pushed rG032b78a0762bee129f33e4255ada6d374aa70c71. Mind that no ObjCForCollectionStmt was found in the DumpLiveStms run.

[Szelethus]

Rename the live statements checker to live expressions checker. The test file added in a revert commit changed rather heavily, but it makes sense that these entries are removed IMO. Unless somebody objects, I intend to land this as-is.

[xazax.hun]

So now all of the dependencies are landed and this should be ready for its prime time, right?

clang/docs/analyzer/developer-docs/DebugChecks.rst

- debug.DumpCFG, debug.ViewCFG: Show the CFG generated for each top-level
   function being analyzed.
 
 - debug.DumpDominators: Shows the dominance tree for the CFG of each top-level
   function.
 
 - debug.DumpLiveVars: Show the results of live variable analysis for each
   top-level function being analyzed.
 
-- debug.DumpLiveStmts: Show the results of live statement analysis for each
+- debug.DumpLiveExprs: Show the results of live expression analysis for each
   top-level function being analyzed.
 
 - debug.ViewExplodedGraph: Show the Exploded Graphs generated for the
   analysis of different functions in the input translation unit. When there
   are several functions analyzed, display one graph per function. Beware
   that these graphs may grow very large, even for small functions.
 
 Path Tracking

clang/include/clang/Analysis/Analyses/LiveVariables.h

 class DeclRefExpr;
 class SourceManager;
 
 class LiveVariables : public ManagedAnalysis {
 public:
   class LivenessValues {
   public:
 
-    llvm::ImmutableSet<const Stmt *> liveStmts;
+    llvm::ImmutableSet<const Expr *> liveExprs;
     llvm::ImmutableSet<const VarDecl *> liveDecls;
     llvm::ImmutableSet<const BindingDecl *> liveBindings;
 
     bool equals(const LivenessValues &V) const;
 
     LivenessValues()
-      : liveStmts(nullptr), liveDecls(nullptr), liveBindings(nullptr) {}
+      : liveExprs(nullptr), liveDecls(nullptr), liveBindings(nullptr) {}
 
-    LivenessValues(llvm::ImmutableSet<const Stmt *> LiveStmts,
+    LivenessValues(llvm::ImmutableSet<const Expr *> liveExprs,
                    llvm::ImmutableSet<const VarDecl *> LiveDecls,
                    llvm::ImmutableSet<const BindingDecl *> LiveBindings)
-        : liveStmts(LiveStmts), liveDecls(LiveDecls),
+        : liveExprs(liveExprs), liveDecls(LiveDecls),
           liveBindings(LiveBindings) {}
 
-    bool isLive(const Stmt *S) const;
+    bool isLive(const Expr *E) const;
     bool isLive(const VarDecl *D) const;
 
     friend class LiveVariables;
   };
 
   class Observer {
     virtual void anchor();
   public:
public:
   bool isLive(const CFGBlock *B, const VarDecl *D);
 
   /// Returns true if a variable is live at the beginning of the
   ///  the statement.  This query only works if liveness information
   ///  has been recorded at the statement level (see runOnAllBlocks), and
   ///  only returns liveness information for block-level expressions.
   bool isLive(const Stmt *S, const VarDecl *D);
 
-  /// Returns true the block-level expression "value" is live
+  /// Returns true the block-level expression value is live
   ///  before the given block-level expression (see runOnAllBlocks).
-  bool isLive(const Stmt *Loc, const Stmt *StmtVal);
+  bool isLive(const Stmt *Loc, const Expr *Val);
 
   /// Print to stderr the variable liveness information associated with
   /// each basic block.
   void dumpBlockLiveness(const SourceManager &M);
 
-  /// Print to stderr the statement liveness information associated with
+  /// Print to stderr the expression liveness information associated with
   /// each basic block.
-  void dumpStmtLiveness(const SourceManager &M);
+  void dumpExprLiveness(const SourceManager &M);
 
   void runOnAllBlocks(Observer &obs);
 
   static std::unique_ptr<LiveVariables>
   create(AnalysisDeclContext &analysisContext) {
     return computeLiveness(analysisContext, true);
   }
 

clang/include/clang/StaticAnalyzer/Checkers/Checkers.td

 def ControlDependencyTreeDumper : Checker<"DumpControlDependencies">,
   HelpText<"Print the post control dependency tree for a given CFG">,
   Documentation<NotDocumented>;
 
 def LiveVariablesDumper : Checker<"DumpLiveVars">,
   HelpText<"Print results of live variable analysis">,
   Documentation<NotDocumented>;
 
-def LiveStatementsDumper : Checker<"DumpLiveStmts">,
-  HelpText<"Print results of live statement analysis">,
+def LiveExpressionsDumper : Checker<"DumpLiveExprs">,
+  HelpText<"Print results of live expression analysis">,
   Documentation<NotDocumented>;
 
 def CFGViewer : Checker<"ViewCFG">,
   HelpText<"View Control-Flow Graphs using GraphViz">,
   Documentation<NotDocumented>;
 
 def CFGDumper : Checker<"DumpCFG">,
   HelpText<"Display Control-Flow Graphs">,

clang/include/clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h

public:
   SymbolReaper(const StackFrameContext *Ctx, const Stmt *s,
                SymbolManager &symmgr, StoreManager &storeMgr)
       : LCtx(Ctx), Loc(s), SymMgr(symmgr), reapedStore(nullptr, storeMgr) {}
 
   const LocationContext *getLocationContext() const { return LCtx; }
 
   bool isLive(SymbolRef sym);
   bool isLiveRegion(const MemRegion *region);
-  bool isLive(const Stmt *ExprVal, const LocationContext *LCtx) const;
+  bool isLive(const Expr *ExprVal, const LocationContext *LCtx) const;
   bool isLive(const VarRegion *VR, bool includeStoreBindings = false) const;
 
   /// Unconditionally marks a symbol as live.
   ///
   /// This should never be
   /// used by checkers, only by the state infrastructure such as the store and
   /// environment. Checkers should instead use metadata symbols and markInUse.
   void markLive(SymbolRef sym);

clang/lib/Analysis/LiveVariables.cpp

 #include <vector>
 
 using namespace clang;
 
 namespace {
 class LiveVariablesImpl {
 public:
   AnalysisDeclContext &analysisContext;
-  llvm::ImmutableSet<const Stmt *>::Factory SSetFact;
+  llvm::ImmutableSet<const Expr *>::Factory ESetFact;
   llvm::ImmutableSet<const VarDecl *>::Factory DSetFact;
   llvm::ImmutableSet<const BindingDecl *>::Factory BSetFact;
   llvm::DenseMap<const CFGBlock *, LiveVariables::LivenessValues> blocksEndToLiveness;
   llvm::DenseMap<const CFGBlock *, LiveVariables::LivenessValues> blocksBeginToLiveness;
   llvm::DenseMap<const Stmt *, LiveVariables::LivenessValues> stmtsToLiveness;
   llvm::DenseMap<const DeclRefExpr *, unsigned> inAssignment;
   const bool killAtAssign;
 
   LiveVariables::LivenessValues
   merge(LiveVariables::LivenessValues valsA,
         LiveVariables::LivenessValues valsB);
 
   LiveVariables::LivenessValues
   runOnBlock(const CFGBlock *block, LiveVariables::LivenessValues val,
              LiveVariables::Observer *obs = nullptr);
 
   void dumpBlockLiveness(const SourceManager& M);
-  void dumpStmtLiveness(const SourceManager& M);
+  void dumpExprLiveness(const SourceManager& M);
 
   LiveVariablesImpl(AnalysisDeclContext &ac, bool KillAtAssign)
       : analysisContext(ac),
-      SSetFact(false), // Do not canonicalize ImmutableSets by default.
+        ESetFact(false), // Do not canonicalize ImmutableSets by default.
         DSetFact(false), // This is a *major* performance win.
-      BSetFact(false),
-      killAtAssign(KillAtAssign) {}
+        BSetFact(false), killAtAssign(KillAtAssign) {}
 };
-}
+} // namespace
 
 static LiveVariablesImpl &getImpl(void *x) {
   return *((LiveVariablesImpl *) x);
 }
 
 //===----------------------------------------------------------------------===//
 // Operations and queries on LivenessValues.
 //===----------------------------------------------------------------------===//
 
-bool LiveVariables::LivenessValues::isLive(const Stmt *S) const {
-  return liveStmts.contains(S);
+bool LiveVariables::LivenessValues::isLive(const Expr *E) const {
+  return liveExprs.contains(E);
 }
 
 bool LiveVariables::LivenessValues::isLive(const VarDecl *D) const {
   if (const auto *DD = dyn_cast<DecompositionDecl>(D)) {
     bool alive = false;
     for (const BindingDecl *BD : DD->bindings())
       alive |= liveBindings.contains(BD);
     return alive;

 } // namespace
 
 void LiveVariables::Observer::anchor() { }
 
 LiveVariables::LivenessValues
 LiveVariablesImpl::merge(LiveVariables::LivenessValues valsA,
                          LiveVariables::LivenessValues valsB) {
 
-  llvm::ImmutableSetRef<const Stmt *>
-    SSetRefA(valsA.liveStmts.getRootWithoutRetain(), SSetFact.getTreeFactory()),
-    SSetRefB(valsB.liveStmts.getRootWithoutRetain(), SSetFact.getTreeFactory());
-
+  llvm::ImmutableSetRef<const Expr *> SSetRefA(
+      valsA.liveExprs.getRootWithoutRetain(), ESetFact.getTreeFactory()),
+      SSetRefB(valsB.liveExprs.getRootWithoutRetain(),
+               ESetFact.getTreeFactory());
 
   llvm::ImmutableSetRef<const VarDecl *>
     DSetRefA(valsA.liveDecls.getRootWithoutRetain(), DSetFact.getTreeFactory()),
     DSetRefB(valsB.liveDecls.getRootWithoutRetain(), DSetFact.getTreeFactory());
 
   llvm::ImmutableSetRef<const BindingDecl *>
     BSetRefA(valsA.liveBindings.getRootWithoutRetain(), BSetFact.getTreeFactory()),
     BSetRefB(valsB.liveBindings.getRootWithoutRetain(), BSetFact.getTreeFactory());
 
   SSetRefA = mergeSets(SSetRefA, SSetRefB);
   DSetRefA = mergeSets(DSetRefA, DSetRefB);
   BSetRefA = mergeSets(BSetRefA, BSetRefB);
 
   // asImmutableSet() canonicalizes the tree, allowing us to do an easy
   // comparison afterwards.
   return LiveVariables::LivenessValues(SSetRefA.asImmutableSet(),
                                        DSetRefA.asImmutableSet(),
                                        BSetRefA.asImmutableSet());
 }
 
 bool LiveVariables::LivenessValues::equals(const LivenessValues &V) const {
-  return liveStmts == V.liveStmts && liveDecls == V.liveDecls;
+  return liveExprs == V.liveExprs && liveDecls == V.liveDecls;
 }
 
 //===----------------------------------------------------------------------===//
 // Query methods.
 //===----------------------------------------------------------------------===//
 
 static bool isAlwaysAlive(const VarDecl *D) {
   return D->hasGlobalStorage();
 }
 
 bool LiveVariables::isLive(const CFGBlock *B, const VarDecl *D) {
   return isAlwaysAlive(D) || getImpl(impl).blocksEndToLiveness[B].isLive(D);
 }
 
 bool LiveVariables::isLive(const Stmt *S, const VarDecl *D) {
   return isAlwaysAlive(D) || getImpl(impl).stmtsToLiveness[S].isLive(D);
 }
 
-bool LiveVariables::isLive(const Stmt *Loc, const Stmt *S) {
-  return getImpl(impl).stmtsToLiveness[Loc].isLive(S);
+bool LiveVariables::isLive(const Stmt *Loc, const Expr *Val) {
+  return getImpl(impl).stmtsToLiveness[Loc].isLive(Val);
 }
 
 //===----------------------------------------------------------------------===//
 // Dataflow computation.
 //===----------------------------------------------------------------------===//
 
 namespace {
 class TransferFunctions : public StmtVisitor<TransferFunctions> {
if (const VariableArrayType *VAT = dyn_cast<VariableArrayType>(VT))
         return VAT;
 
     ty = VT->getElementType().getTypePtr();
   }
 
   return nullptr;
 }
 
-static const Stmt *LookThroughStmt(const Stmt *S) {
-  while (S) {
-    if (const Expr *Ex = dyn_cast<Expr>(S))
-      S = Ex->IgnoreParens();
-    if (const FullExpr *FE = dyn_cast<FullExpr>(S)) {
-      S = FE->getSubExpr();
+static const Expr *LookThroughExpr(const Expr *E) {
+  while (E) {
+    if (const Expr *Ex = dyn_cast<Expr>(E))
+      E = Ex->IgnoreParens();
+    if (const FullExpr *FE = dyn_cast<FullExpr>(E)) {
+      E = FE->getSubExpr();
       continue;
     }
-    if (const OpaqueValueExpr *OVE = dyn_cast<OpaqueValueExpr>(S)) {
-      S = OVE->getSourceExpr();
+    if (const OpaqueValueExpr *OVE = dyn_cast<OpaqueValueExpr>(E)) {
+      E = OVE->getSourceExpr();
       continue;
     }
     break;
   }
-  return S;
+  return E;
 }
 
-static void AddLiveStmt(llvm::ImmutableSet<const Stmt *> &Set,
-                        llvm::ImmutableSet<const Stmt *>::Factory &F,
-                        const Stmt *S) {
-  Set = F.add(Set, LookThroughStmt(S));
+static void AddLiveExpr(llvm::ImmutableSet<const Expr *> &Set,
+                        llvm::ImmutableSet<const Expr *>::Factory &F,
+                        const Expr *E) {
+  Set = F.add(Set, LookThroughExpr(E));
 }
 
 void TransferFunctions::Visit(Stmt *S) {
   if (observer)
     observer->observeStmt(S, currentBlock, val);
 
   StmtVisitor<TransferFunctions>::Visit(S);
 
-  if (isa<Expr>(S)) {
-    val.liveStmts = LV.SSetFact.remove(val.liveStmts, S);
+  if (const auto *E = dyn_cast<Expr>(S)) {
+    val.liveExprs = LV.ESetFact.remove(val.liveExprs, E);
   }
 
   // Mark all children expressions live.
 
   switch (S->getStmtClass()) {
     default:
       break;
     case Stmt::StmtExprClass: {
       // For statement expressions, look through the compound statement.
       S = cast<StmtExpr>(S)->getSubStmt();
       break;
     }
     case Stmt::CXXMemberCallExprClass: {
       // Include the implicit "this" pointer as being live.
       CXXMemberCallExpr *CE = cast<CXXMemberCallExpr>(S);
       if (Expr *ImplicitObj = CE->getImplicitObjectArgument()) {
-        AddLiveStmt(val.liveStmts, LV.SSetFact, ImplicitObj);
+        AddLiveExpr(val.liveExprs, LV.ESetFact, ImplicitObj);
       }
       break;
     }
     case Stmt::ObjCMessageExprClass: {
       // In calls to super, include the implicit "self" pointer as being live.
       ObjCMessageExpr *CE = cast<ObjCMessageExpr>(S);
       if (CE->getReceiverKind() == ObjCMessageExpr::SuperInstance)
         val.liveDecls = LV.DSetFact.add(val.liveDecls,
                                         LV.analysisContext.getSelfDecl());
       break;
     }
     case Stmt::DeclStmtClass: {
       const DeclStmt *DS = cast<DeclStmt>(S);
       if (const VarDecl *VD = dyn_cast<VarDecl>(DS->getSingleDecl())) {
         for (const VariableArrayType* VA = FindVA(VD->getType());
              VA != nullptr; VA = FindVA(VA->getElementType())) {
-          AddLiveStmt(val.liveStmts, LV.SSetFact, VA->getSizeExpr());
+          AddLiveExpr(val.liveExprs, LV.ESetFact, VA->getSizeExpr());
         }
       }
       break;
     }
     case Stmt::PseudoObjectExprClass: {
       // A pseudo-object operation only directly consumes its result
       // expression.
       Expr *child = cast<PseudoObjectExpr>(S)->getResultExpr();
       if (!child) return;
       if (OpaqueValueExpr *OV = dyn_cast<OpaqueValueExpr>(child))
         child = OV->getSourceExpr();
       child = child->IgnoreParens();
-      val.liveStmts = LV.SSetFact.add(val.liveStmts, child);
+      val.liveExprs = LV.ESetFact.add(val.liveExprs, child);
       return;
     }
 
     // FIXME: These cases eventually shouldn't be needed.
     case Stmt::ExprWithCleanupsClass: {
       S = cast<ExprWithCleanups>(S)->getSubExpr();
       break;
     }
     case Stmt::CXXBindTemporaryExprClass: {
       S = cast<CXXBindTemporaryExpr>(S)->getSubExpr();
       break;
     }
     case Stmt::UnaryExprOrTypeTraitExprClass: {
       // No need to unconditionally visit subexpressions.
       return;
     }
     case Stmt::IfStmtClass: {
       // If one of the branches is an expression rather than a compound
       // statement, it will be bad if we mark it as live at the terminator
       // of the if-statement (i.e., immediately after the condition expression).
-      AddLiveStmt(val.liveStmts, LV.SSetFact, cast<IfStmt>(S)->getCond());
+      AddLiveExpr(val.liveExprs, LV.ESetFact, cast<IfStmt>(S)->getCond());
       return;
     }
     case Stmt::WhileStmtClass: {
       // If the loop body is an expression rather than a compound statement,
       // it will be bad if we mark it as live at the terminator of the loop
       // (i.e., immediately after the condition expression).
-      AddLiveStmt(val.liveStmts, LV.SSetFact, cast<WhileStmt>(S)->getCond());
+      AddLiveExpr(val.liveExprs, LV.ESetFact, cast<WhileStmt>(S)->getCond());
       return;
     }
     case Stmt::DoStmtClass: {
       // If the loop body is an expression rather than a compound statement,
       // it will be bad if we mark it as live at the terminator of the loop
       // (i.e., immediately after the condition expression).
-      AddLiveStmt(val.liveStmts, LV.SSetFact, cast<DoStmt>(S)->getCond());
+      AddLiveExpr(val.liveExprs, LV.ESetFact, cast<DoStmt>(S)->getCond());
       return;
     }
     case Stmt::ForStmtClass: {
       // If the loop body is an expression rather than a compound statement,
       // it will be bad if we mark it as live at the terminator of the loop
       // (i.e., immediately after the condition expression).
-      AddLiveStmt(val.liveStmts, LV.SSetFact, cast<ForStmt>(S)->getCond());
+      AddLiveExpr(val.liveExprs, LV.ESetFact, cast<ForStmt>(S)->getCond());
       return;
     }
 
   }
 
+  // HACK + FIXME: What is this? One could only guess that this is an attempt to
+  // fish for live values, for example, arguments from a call expression.
+  // Maybe we could take inspiration from UninitializedVariable analysis?
   for (Stmt *Child : S->children()) {
-    if (Child)
-      AddLiveStmt(val.liveStmts, LV.SSetFact, Child);
+    if (const auto *E = dyn_cast_or_null<Expr>(Child))
+      AddLiveExpr(val.liveExprs, LV.ESetFact, E);
   }
 }
 
 static bool writeShouldKill(const VarDecl *VD) {
   return VD && !VD->getType()->isReferenceType() &&
     !isAlwaysAlive(VD);
 }
 
 void TransferFunctions::VisitBinaryOperator(BinaryOperator *B) {
VisitUnaryExprOrTypeTraitExpr(UnaryExprOrTypeTraitExpr *UE)
   // does extent the liveness of metadata if 'var' is a VariableArrayType.
   // We handle that special case here.
   if (UE->getKind() != UETT_SizeOf || UE->isArgumentType())
     return;
 
   const Expr *subEx = UE->getArgumentExpr();
   if (subEx->getType()->isVariableArrayType()) {
     assert(subEx->isLValue());
-    val.liveStmts = LV.SSetFact.add(val.liveStmts, subEx->IgnoreParens());
+    val.liveExprs = LV.ESetFact.add(val.liveExprs, subEx->IgnoreParens());
   }
 }
 
 void TransferFunctions::VisitUnaryOperator(UnaryOperator *UO) {
   // Treat ++/-- as a kill.
   // Note we don't actually have to do anything if we don't have an observer,
   // since a ++/-- acts as both a kill and a "use".
   if (!observer)
for (std::vector<const VarDecl*>::iterator di = declVec.begin(),
                    << " <";
       (*di)->getLocation().print(llvm::errs(), M);
       llvm::errs() << ">\n";
     }
   }
   llvm::errs() << "\n";
 }
 
-void LiveVariables::dumpStmtLiveness(const SourceManager &M) {
-  getImpl(impl).dumpStmtLiveness(M);
+void LiveVariables::dumpExprLiveness(const SourceManager &M) {
+  getImpl(impl).dumpExprLiveness(M);
 }
 
-void LiveVariablesImpl::dumpStmtLiveness(const SourceManager &M) {
+void LiveVariablesImpl::dumpExprLiveness(const SourceManager &M) {
   // Don't iterate over blockEndsToLiveness directly because it's not sorted.
-  for (auto I : *analysisContext.getCFG()) {
+  for (const CFGBlock *B : *analysisContext.getCFG()) {
 
-    llvm::errs() << "\n[ B" << I->getBlockID()
-                 << " (live statements at block exit) ]\n";
-    for (auto S : blocksEndToLiveness[I].liveStmts) {
+    llvm::errs() << "\n[ B" << B->getBlockID()
+                 << " (live expressions at block exit) ]\n";
+    for (const Expr *E : blocksEndToLiveness[B].liveExprs) {
       llvm::errs() << "\n";
-      S->dump();
+      E->dump();
     }
     llvm::errs() << "\n";
   }
 }
 
 const void *LiveVariables::getTag() { static int x; return &x; }
 const void *RelaxedLiveVariables::getTag() { static int x; return &x; }

clang/lib/StaticAnalyzer/Checkers/DebugCheckers.cpp

bool ento::shouldRegisterLiveVariablesDumper(const CheckerManager &mgr) {
   return true;
 }
 
 //===----------------------------------------------------------------------===//
 // LiveStatementsDumper
 //===----------------------------------------------------------------------===//
 
 namespace {
-class LiveStatementsDumper : public Checker<check::ASTCodeBody> {
+class LiveExpressionsDumper : public Checker<check::ASTCodeBody> {
 public:
   void checkASTCodeBody(const Decl *D, AnalysisManager& Mgr,
                         BugReporter &BR) const {
     if (LiveVariables *L = Mgr.getAnalysis<RelaxedLiveVariables>(D))
-      L->dumpStmtLiveness(Mgr.getSourceManager());
+      L->dumpExprLiveness(Mgr.getSourceManager());
   }
 };
 }
 
-void ento::registerLiveStatementsDumper(CheckerManager &mgr) {
-  mgr.registerChecker<LiveStatementsDumper>();
+void ento::registerLiveExpressionsDumper(CheckerManager &mgr) {
+  mgr.registerChecker<LiveExpressionsDumper>();
 }
 
-bool ento::shouldRegisterLiveStatementsDumper(const CheckerManager &mgr) {
+bool ento::shouldRegisterLiveExpressionsDumper(const CheckerManager &mgr) {
   return true;
 }
 
 //===----------------------------------------------------------------------===//
 // CFGViewer
 //===----------------------------------------------------------------------===//
 
 namespace {

clang/lib/StaticAnalyzer/Core/Environment.cpp

EnvironmentManager::removeDeadBindings(Environment Env,
   MarkLiveCallback CB(SymReaper);
   ScanReachableSymbols RSScaner(ST, CB);
 
   llvm::ImmutableMapRef<EnvironmentEntry, SVal>
     EBMapRef(NewEnv.ExprBindings.getRootWithoutRetain(),
              F.getTreeFactory());
 
   // Iterate over the block-expr bindings.
-  for (Environment::iterator I = Env.begin(), E = Env.end();
-       I != E; ++I) {
+  for (Environment::iterator I = Env.begin(), End = Env.end(); I != End; ++I) {
     const EnvironmentEntry &BlkExpr = I.getKey();
     const SVal &X = I.getData();
 
-    const bool IsBlkExprLive =
-        SymReaper.isLive(BlkExpr.getStmt(), BlkExpr.getLocationContext());
-
-    assert((isa<Expr>(BlkExpr.getStmt()) || !IsBlkExprLive) &&
-           "Only Exprs can be live, LivenessAnalysis argues about the liveness "
-           "of *values*!");
+    const Expr *E = dyn_cast<Expr>(BlkExpr.getStmt());
+    if (!E)
+      continue;
 
-    if (IsBlkExprLive) {
+    if (SymReaper.isLive(E, BlkExpr.getLocationContext())) {
       // Copy the binding to the new map.
       EBMapRef = EBMapRef.add(BlkExpr, X);
 
       // Mark all symbols in the block expr's value live.
       RSScaner.scan(X);
     }
   }
 

clang/lib/StaticAnalyzer/Core/SymbolManager.cpp

bool SymbolReaper::isLive(SymbolRef sym) {
 
   if (KnownLive)
     markLive(sym);
 
   return KnownLive;
 }
 
 bool
-SymbolReaper::isLive(const Stmt *ExprVal, const LocationContext *ELCtx) const {
+SymbolReaper::isLive(const Expr *ExprVal, const LocationContext *ELCtx) const {
   if (LCtx == nullptr)
     return false;
 
   if (LCtx != ELCtx) {
     // If the reaper's location context is a parent of the expression's
     // location context, then the expression value is now "out of scope".
     if (LCtx->isParentOf(ELCtx))
       return false;

clang/test/Analysis/live-stmts.cpp

-// RUN: %clang_analyze_cc1 -w -analyzer-checker=debug.DumpLiveStmts %s 2>&1\
+// RUN: %clang_analyze_cc1 -w -analyzer-checker=debug.DumpLiveExprs %s 2>&1\
 // RUN:   | FileCheck %s
 
 int coin();
 
 
 int testThatDumperWorks(int x, int y, int z) {
   return x ? y : z;
 }
-// CHECK: [ B0 (live statements at block exit) ]
+
+// [B5 (ENTRY)]
+//    |
+//    V
+// [B4 (x)] ? [B2 (y)] : [B3 (z)]
+//                \        /
+//                 ---|----
+//                    V
+//                   [B1] --> [B0 (EXIT)]
+//                  return
+
+// CHECK: [ B0 (live expressions at block exit) ]
 // CHECK-EMPTY:
 // CHECK-EMPTY:
-// CHECK: [ B1 (live statements at block exit) ]
+// CHECK: [ B1 (live expressions at block exit) ]
 // CHECK-EMPTY:
 // CHECK-EMPTY:
-// CHECK: [ B2 (live statements at block exit) ]
+// CHECK: [ B2 (live expressions at block exit) ]
 // CHECK-EMPTY:
 // CHECK-NEXT: DeclRefExpr {{.*}} 'y' 'int'
 // CHECK-EMPTY:
 // CHECK-NEXT: DeclRefExpr {{.*}} 'z' 'int'
 // CHECK-EMPTY:
 // CHECK-NEXT: ImplicitCastExpr {{.*}} <IntegralToBoolean>
 // CHECK-NEXT: `-ImplicitCastExpr {{.*}} <LValueToRValue>
 // CHECK-NEXT:   `-DeclRefExpr {{.*}} 'x' 'int'
 // CHECK-EMPTY:
 // CHECK-EMPTY:
-// CHECK: [ B3 (live statements at block exit) ]
+// CHECK: [ B3 (live expressions at block exit) ]
 // CHECK-EMPTY:
 // CHECK-NEXT: DeclRefExpr {{.*}} 'y' 'int'
 // CHECK-EMPTY:
 // CHECK-NEXT: DeclRefExpr {{.*}} 'z' 'int'
 // CHECK-EMPTY:
 // CHECK-NEXT: ImplicitCastExpr {{.*}} <IntegralToBoolean>
 // CHECK-NEXT: `-ImplicitCastExpr {{.*}} <LValueToRValue>
 // CHECK-NEXT:   `-DeclRefExpr {{.*}} 'x' 'int'
-// CHECK: [ B4 (live statements at block exit) ]
+// CHECK: [ B4 (live expressions at block exit) ]
 // CHECK-EMPTY:
 // CHECK-NEXT: DeclRefExpr {{.*}} 'y' 'int'
 // CHECK-EMPTY:
 // CHECK-NEXT: DeclRefExpr {{.*}} 'z' 'int'
 // CHECK-EMPTY:
 // CHECK-NEXT: ImplicitCastExpr {{.*}} <IntegralToBoolean>
 // CHECK-NEXT: `-ImplicitCastExpr {{.*}} <LValueToRValue>
 // CHECK-NEXT:   `-DeclRefExpr {{.*}} 'x' 'int'
 // CHECK-EMPTY:
 // CHECK-EMPTY:
-// CHECK: [ B5 (live statements at block exit) ]
+// CHECK: [ B5 (live expressions at block exit) ]
 // CHECK-EMPTY:
 // CHECK-NEXT: DeclRefExpr {{.*}} 'y' 'int'
 // CHECK-EMPTY:
 // CHECK-NEXT: DeclRefExpr {{.*}} 'z' 'int'
 // CHECK-EMPTY:
 // CHECK-EMPTY:
 
 
 void testIfBranchExpression(bool flag) {
   // No expressions should be carried over from one block to another here.
   while (flag) {
     int e = 1;
     if (true)
       e;
   }
 }
-// CHECK: [ B0 (live statements at block exit) ]
+// CHECK: [ B0 (live expressions at block exit) ]
 // CHECK-EMPTY:
 // CHECK-EMPTY:
-// CHECK: [ B1 (live statements at block exit) ]
+// CHECK: [ B1 (live expressions at block exit) ]
 // CHECK-EMPTY:
 // CHECK-EMPTY:
-// CHECK: [ B2 (live statements at block exit) ]
+// CHECK: [ B2 (live expressions at block exit) ]
 // CHECK-EMPTY:
 // CHECK-EMPTY:
-// CHECK: [ B3 (live statements at block exit) ]
+// CHECK: [ B3 (live expressions at block exit) ]
 // CHECK-EMPTY:
 // CHECK-EMPTY:
-// CHECK: [ B4 (live statements at block exit) ]
+// CHECK: [ B4 (live expressions at block exit) ]
 // CHECK-EMPTY:
 // CHECK-EMPTY:
-// CHECK: [ B5 (live statements at block exit) ]
+// CHECK: [ B5 (live expressions at block exit) ]
 // CHECK-EMPTY:
 // CHECK-EMPTY:
 
 
 void testWhileBodyExpression(bool flag) {
   // No expressions should be carried over from one block to another here.
   while (flag) {
     int e = 1;
     while (coin())
       e;
   }
 }
-// CHECK: [ B0 (live statements at block exit) ]
+// CHECK: [ B0 (live expressions at block exit) ]
 // CHECK-EMPTY:
 // CHECK-EMPTY:
-// CHECK: [ B1 (live statements at block exit) ]
+// CHECK: [ B1 (live expressions at block exit) ]
 // CHECK-EMPTY:
 // CHECK-EMPTY:
-// CHECK: [ B2 (live statements at block exit) ]
+// CHECK: [ B2 (live expressions at block exit) ]
 // CHECK-EMPTY:
 // CHECK-EMPTY:
-// CHECK: [ B3 (live statements at block exit) ]
+// CHECK: [ B3 (live expressions at block exit) ]
 // CHECK-EMPTY:
 // CHECK-EMPTY:
-// CHECK: [ B4 (live statements at block exit) ]
+// CHECK: [ B4 (live expressions at block exit) ]
 // CHECK-EMPTY:
 // CHECK-EMPTY:
-// CHECK: [ B5 (live statements at block exit) ]
+// CHECK: [ B5 (live expressions at block exit) ]
 // CHECK-EMPTY:
 // CHECK-EMPTY:
 
 
 void testDoWhileBodyExpression(bool flag) {
   // No expressions should be carried over from one block to another here.
   while (flag) {
     int e = 1;
     do
       e;
     while (coin());
   }
 }
-// CHECK: [ B0 (live statements at block exit) ]
+// CHECK: [ B0 (live expressions at block exit) ]
 // CHECK-EMPTY:
 // CHECK-EMPTY:
-// CHECK: [ B1 (live statements at block exit) ]
+// CHECK: [ B1 (live expressions at block exit) ]
 // CHECK-EMPTY:
 // CHECK-EMPTY:
-// CHECK: [ B2 (live statements at block exit) ]
+// CHECK: [ B2 (live expressions at block exit) ]
 // CHECK-EMPTY:
 // CHECK-EMPTY:
-// CHECK: [ B3 (live statements at block exit) ]
+// CHECK: [ B3 (live expressions at block exit) ]
 // CHECK-EMPTY:
 // CHECK-EMPTY:
-// CHECK: [ B4 (live statements at block exit) ]
+// CHECK: [ B4 (live expressions at block exit) ]
 // CHECK-EMPTY:
 // CHECK-EMPTY:
-// CHECK: [ B5 (live statements at block exit) ]
+// CHECK: [ B5 (live expressions at block exit) ]
 // CHECK-EMPTY:
 // CHECK-EMPTY:
 
 
 void testForBodyExpression(bool flag) {
   // No expressions should be carried over from one block to another here.
   while (flag) {
     int e = 1;
     for (; coin();)
       e;
   }
 }
-// CHECK: [ B0 (live statements at block exit) ]
+// CHECK: [ B0 (live expressions at block exit) ]
 // CHECK-EMPTY:
 // CHECK-EMPTY:
-// CHECK: [ B1 (live statements at block exit) ]
+// CHECK: [ B1 (live expressions at block exit) ]
 // CHECK-EMPTY:
 // CHECK-EMPTY:
-// CHECK: [ B2 (live statements at block exit) ]
+// CHECK: [ B2 (live expressions at block exit) ]
 // CHECK-EMPTY:
 // CHECK-EMPTY:
-// CHECK: [ B3 (live statements at block exit) ]
+// CHECK: [ B3 (live expressions at block exit) ]
 // CHECK-EMPTY:
 // CHECK-EMPTY:
-// CHECK: [ B4 (live statements at block exit) ]
+// CHECK: [ B4 (live expressions at block exit) ]
 // CHECK-EMPTY:
 // CHECK-EMPTY:
-// CHECK: [ B5 (live statements at block exit) ]
+// CHECK: [ B5 (live expressions at block exit) ]
 // CHECK-EMPTY:
 // CHECK-EMPTY:
 
+void clang_analyzer_eval(bool);
+
+void test_lambda_refcapture() {
+  int a = 6;
+  [&](int &a) { a = 42; }(a);
+  clang_analyzer_eval(a == 42); // expected-warning{{TRUE}}
+}
+
+// CHECK: [ B0 (live expressions at block exit) ]
+// CHECK-EMPTY:
+// CHECK-EMPTY:
+// CHECK-NEXT: [ B1 (live expressions at block exit) ]
+// CHECK-EMPTY:
+// CHECK-EMPTY:
+// CHECK-NEXT: [ B2 (live expressions at block exit) ]
+// CHECK-EMPTY:
+// CHECK-EMPTY:

clang/test/Analysis/live-stmts.mm

 // RUN: %clang_analyze_cc1 -w -fblocks %s \
-// RUN:   -analyzer-checker=debug.DumpLiveStmts \
+// RUN:   -analyzer-checker=debug.DumpLiveExprs \
 // RUN:   2>&1 | FileCheck %s
 
 @interface Item
 // ...
 @end
 
 @interface Collection
 // ...
 @end
 
 typedef void (^Blk)();
 
 struct RAII {
   Blk blk;
 
 public:
   RAII(Blk blk): blk(blk) {}
 
-// CHECK: [ B0 (live statements at block exit) ]
+// CHECK: [ B0 (live expressions at block exit) ]
 // CHECK-EMPTY:
 // CHECK-EMPTY:
-// CHECK-NEXT: [ B1 (live statements at block exit) ]
+// CHECK-NEXT: [ B1 (live expressions at block exit) ]
 // CHECK-EMPTY:
 // CHECK-EMPTY:
-// CHECK-NEXT: [ B2 (live statements at block exit) ]
+// CHECK-NEXT: [ B2 (live expressions at block exit) ]
 // CHECK-EMPTY:
 // CHECK-EMPTY:
 
   ~RAII() { blk(); }
 
-// CHECK-NEXT: [ B0 (live statements at block exit) ]
+// CHECK-NEXT: [ B0 (live expressions at block exit) ]
 // CHECK-EMPTY:
 // CHECK-EMPTY:
-// CHECK-NEXT: [ B1 (live statements at block exit) ]
+// CHECK-NEXT: [ B1 (live expressions at block exit) ]
 // CHECK-EMPTY:
 // CHECK-EMPTY:
-// CHECK-NEXT: [ B2 (live statements at block exit) ]
+// CHECK-NEXT: [ B2 (live expressions at block exit) ]
 // CHECK-EMPTY:
 // CHECK-EMPTY:
 };
 
 void foo(Collection *coll) {
   RAII raii(^{});
   for (Item *item in coll) {}
 }
-// CHECK-NEXT: [ B0 (live statements at block exit) ]
+// CHECK-NEXT: [ B0 (live expressions at block exit) ]
 // CHECK-EMPTY:
 // CHECK-EMPTY:
-// CHECK-NEXT: [ B1 (live statements at block exit) ]
+// CHECK-NEXT: [ B1 (live expressions at block exit) ]
 // CHECK-EMPTY:
 // CHECK-EMPTY:
-// CHECK-NEXT: [ B2 (live statements at block exit) ]
-// CHECK-EMPTY:
-// CHECK-NEXT: DeclStmt {{.*}}
-// CHECK-NEXT: `-VarDecl {{.*}}  item 'Item *'
+// CHECK-NEXT: [ B2 (live expressions at block exit) ]
 // CHECK-EMPTY:
 // CHECK-NEXT: ImplicitCastExpr {{.*}} 'Collection *' <LValueToRValue>
 // CHECK-NEXT: `-DeclRefExpr {{.*}} 'Collection *' lvalue ParmVar {{.*}} 'coll' 'Collection *'
 // CHECK-EMPTY:
-// CHECK-NEXT: CompoundStmt {{.*}}
-// CHECK-EMPTY:
 // CHECK-EMPTY:
-// CHECK-NEXT: [ B3 (live statements at block exit) ]
-// CHECK-EMPTY:
-// CHECK-NEXT: DeclStmt {{.*}}
-// CHECK-NEXT: `-VarDecl {{.*}}  item 'Item *'
+// CHECK-NEXT: [ B3 (live expressions at block exit) ]
 // CHECK-EMPTY:
 // CHECK-NEXT: ImplicitCastExpr {{.*}} 'Collection *' <LValueToRValue>
 // CHECK-NEXT: `-DeclRefExpr {{.*}} 'Collection *' lvalue ParmVar {{.*}} 'coll' 'Collection *'
 // CHECK-EMPTY:
-// CHECK-NEXT: CompoundStmt {{.*}}
-// CHECK-EMPTY:
 // CHECK-EMPTY:
-// CHECK-NEXT: [ B4 (live statements at block exit) ]
-// CHECK-EMPTY:
-// CHECK-NEXT: DeclStmt {{.*}}
-// CHECK-NEXT: `-VarDecl {{.*}}  item 'Item *'
+// CHECK-NEXT: [ B4 (live expressions at block exit) ]
 // CHECK-EMPTY:
 // CHECK-NEXT: ImplicitCastExpr {{.*}} 'Collection *' <LValueToRValue>
 // CHECK-NEXT: `-DeclRefExpr {{.*}} 'Collection *' lvalue ParmVar {{.*}} 'coll' 'Collection *'
 // CHECK-EMPTY:
-// CHECK-NEXT: CompoundStmt {{.*}}
-// CHECK-EMPTY:
-// CHECK-EMPTY:
-// CHECK-NEXT: [ B5 (live statements at block exit) ]
-// CHECK-EMPTY:
-// CHECK-NEXT: DeclStmt {{.*}}
-// CHECK-NEXT: `-VarDecl {{.*}}  item 'Item *'
 // CHECK-EMPTY:
-// CHECK-NEXT: CompoundStmt {{.*}}
+// CHECK-NEXT: [ B5 (live expressions at block exit) ]
 // CHECK-EMPTY:
 // CHECK-EMPTY:
-// CHECK-NEXT: [ B0 (live statements at block exit) ]
+// CHECK-NEXT: [ B0 (live expressions at block exit) ]
 // CHECK-EMPTY:
 // CHECK-EMPTY:
-// CHECK-NEXT: [ B1 (live statements at block exit) ]
+// CHECK-NEXT: [ B1 (live expressions at block exit) ]
 // CHECK-EMPTY:
 // CHECK-EMPTY: