[analyzer] [NFC] Rename SymbolRef to SymExprRef

[ASDenysPetrov]

Summary

Declaration of SymbolRef is confusing and embarrassing to percept the code easily, especially when working along with symbolic regions, values, expressions (SVal, SymbolVal, SymbolData, etc.). Every time it takes time to recall a correct aliasing in mind. Rename SymbolRef to SymExprRef would have a benefit.

Before:

using SymbolRef = const SymExpr *;

After:

using SymExprRef = const SymExpr *;

P.S. In some files you can see bigger chunks than one-word-renaming. It is just auto-formatting changes.

[OikawaKirie]

Since SymbolRef is just a const SymExpr * in the current codebase, I'd prefer using const SymExpr * directly, just like how MemRegion is used, which would be clearer than both SymbolRef and SymExprRef as far as I am thinking.

Different from ProgramStateRef which is an alias to IntrusiveRefCntPtr, or StoreRef which is a wrapper object, an alias to a const SymExpr * makes no sense to me.

And this is also where I have been confused for a long while.

Or on the opposite, do we also need a similar alias for a const MemRegion *, maybe say MemRegionRef? After all, it is shorter. :-)

[steakhal]

@ASDenysPetrov
Please grep for the SymbolRef and rename the other symbols/comments as well, especially the compound names.

In D89987#2348935, @OikawaKirie wrote:

Since SymbolRef is just a const SymExpr * in the current codebase, I'd prefer using const SymExpr * directly, just like how MemRegion is used, which would be clearer than both SymbolRef and SymExprRef as far as I am thinking.

IMO using SymExprRef is more readable. However, I don't have any strong opinion on this.

Different from ProgramStateRef which is an alias to IntrusiveRefCntPtr, or StoreRef which is a wrapper object, an alias to a const SymExpr * makes no sense to me.
And this is also where I have been confused for a long while.

Or on the opposite, do we also need a similar alias for a const MemRegion *, maybe say MemRegionRef? After all, it is shorter. :-)

Yes, that would make the codebase more consistant.

clang/include/clang/StaticAnalyzer/Core/PathSensitive/SymExpr.h

111

SymbolRefSmallVectorTy -> SymExprRefSmallVectorTy

[ASDenysPetrov]

@OikawaKirie

Different from ProgramStateRef which is an alias to IntrusiveRefCntPtr, or StoreRef which is a wrapper object, an alias to a const SymExpr * makes no sense to me.

Yes. I omit this, because in such case we should go further and rename all those which are not real Ref to Ptr or smth that would emphasise that it's just a pointer alias, not a wrapper or another class.
That's why I prefered to change the name a little in favor of complex approach of renaming all the rest.

And this is also where I have been confused for a long while.

So have been I. The patch is called to make it more clear :)

Thanks to @steakhal comment I investigated more in terms of what other names use Symbol but mean SymExpr. They are:

class SymbolManager;
using SymbolID;
using SymbolDependTy;
class SymbolData;
class SymbolMetadata;
class SymbolReaper;
enum SymbolStatus;
using SymbolSetTy;
using SymbolMapTy;
class SymbolCast;
class SymbolVal;
class symbol_iterator;
etc.

This is not a full list! I also didn't count methods and file names.
There is also a list of objects names which straightly use SymExpr. They are less spread. Mostly they are derived classes:

class BinarySymExprImpl;
class SymIntExpr;
class IntSymExpr;
class SymSymExpr;
some enums, several methods, etc.

As a result we should accurately define the difference between Symbol and SymExpr.
I see the next options:

1. Symbol and SymExpr are different. Leave the names as are. Fix minor mismatches if presented. And follow that definitions.
2. Symbol and SymExpr are the same. SymExpr is a dominant one. Change all the names from Symbol to SymExpr and get rid of Symbol.
3. Symbol and SymExpr are the same. Symbol is a dominant one. Change all the names from SymExpr to Symbol and get rid of SymExpr.
4. Ignore the naming due to loss of git blame (or any other reason) like in an llvm naming rules topic.
5. For now just rename SymbolRef alias as the beggining of the story in scope of 2nd option.

What do you think?

clang/include/clang/StaticAnalyzer/Core/PathSensitive/SymExpr.h

111

Thanks for a reasonable remark!

[steakhal]

In D89987#2349959, @ASDenysPetrov wrote:

@OikawaKirie

Different from ProgramStateRef which is an alias to IntrusiveRefCntPtr, or StoreRef which is a wrapper object, an alias to a const SymExpr * makes no sense to me.

Yes. I omit this, because in such case we should go further and rename all those which are not real Ref to Ptr or smth that would emphasise that it's just a pointer alias, not a wrapper or another class.
That's why I prefered to change the name a little in favor of complex approach of renaming all the rest.

And this is also where I have been confused for a long while.

So have been I. The patch is called to make it more clear :)

Thanks to @steakhal comment I investigated more in terms of what other names use Symbol but mean SymExpr. They are:

class SymbolManager;
using SymbolID;
using SymbolDependTy;
class SymbolData;
class SymbolMetadata;
class SymbolReaper;
enum SymbolStatus;
using SymbolSetTy;
using SymbolMapTy;
class SymbolCast;
class SymbolVal;
class symbol_iterator;
etc.

This is not a full list! I also didn't count methods and file names.
There is also a list of objects names which straightly use SymExpr. They are less spread. Mostly they are derived classes:

class BinarySymExprImpl;
class SymIntExpr;
class IntSymExpr;
class SymSymExpr;
some enums, several methods, etc.

As a result we should accurately define the difference between Symbol and SymExpr.

There are some cases, when Symbol refers to the base-class of the inheritance hierachy. In those cases the renaming would be appropiate.
Though, I'm sure there are cases, when the Symbol refers simply to SymbolData - in which cases we should rename accordingly.

At the previous LLVM SA round table @xazax.hun also mentioned that we could have chosen better names. Maybe it's the time to have consensus about this.

I see the next options:

1. Symbol and SymExpr are different. Leave the names as are. Fix minor mismatches if presented. And follow that definitions.
2. Symbol and SymExpr are the same. SymExpr is a dominant one. Change all the names from Symbol to SymExpr and get rid of Symbol.
3. Symbol and SymExpr are the same. Symbol is a dominant one. Change all the names from SymExpr to Symbol and get rid of SymExpr.
4. Ignore the naming due to loss of git blame (or any other reason) like in an llvm naming rules topic.

Losing git blame would have a signifficant impact in deed, however we always have the option to add the renaming commit to the .git-blame-ignore-revs.
To achieve that, we should probably have a better reason behind it besides simply renaming stuff.

5. For now just rename SymbolRef alias as the beggining of the story in scope of 2nd option.

What do you think?

[NoQ]

Honestly i'd rather eliminate SymExpr and go with Symbol everywhere. It's an overloaded term but appending "Expr" to it doesn't really make it significantly less overloaded. We're also properly namespaced so there wouldn't be any linking issues with the rest of LLVM. "Symbol" is catchy and it's one of the most important concepts to grasp in the static analyzer, i'd love to keep it.

[Szelethus]

In D89987#2350649, @NoQ wrote:

Honestly i'd rather eliminate SymExpr and go with Symbol everywhere. It's an overloaded term but appending "Expr" to it doesn't really make it significantly less overloaded.

Why? I think calling it Symbol would make the situation a lot worse. We have symbolic expressions, values, memory regions, why shouldn't we dedicate a name to each?

"Symbol" is catchy and it's one of the most important concepts to grasp in the static analyzer, i'd love to keep it.

Hmm, am I lacking some prerequisite knowledge that would make sense out of calling this Symbol?

[ASDenysPetrov]

@steakhal

Losing git blame would have a signifficant impact in deed, however we always have the option to add the renaming commit to the .git-blame-ignore-revs.

Using this git feature I can see no more obstacles to implement the renaming. Moreover LLVM repo already has similar instances in .git-blame-ignore-revs.

To achieve that, we should probably have a better reason behind it besides simply renaming stuff.

Untill we start this process we will mix this up every time. So, I would start the renaming with the blame-ignore marking.

Let's answer the question: What bad things can occur if we rename SymbolRef to SymExprRef? The only thing I'm not sure is that the name SymExprRef is not suit enough.

clang/include/clang/StaticAnalyzer/Checkers/SValExplainer.h

public:
   std::string VisitSVal(SVal V) {
     std::string Str;
     llvm::raw_string_ostream OS(Str);
     OS << V;
     return "a value unsupported by the explainer: (" +
            std::string(OS.str()) + ")";
   }
 
-  std::string VisitSymExpr(SymbolRef S) {
+  std::string VisitSymExpr(SymExprRef S) {
     std::string Str;
     llvm::raw_string_ostream OS(Str);
     S->dumpToStream(OS);
     return "a symbolic expression unsupported by the explainer: (" +
            std::string(OS.str()) + ")";
   }
 
   std::string VisitMemRegion(const MemRegion *R) {

clang/include/clang/StaticAnalyzer/Core/BugReporter/BugReporter.h

 /// Constructs a Stack hint for the given symbol.
 ///
 /// The class knows how to construct the stack hint message based on
 /// traversing the CallExpr associated with the call and checking if the given
 /// symbol is returned or is one of the arguments.
 /// The hint can be customized by redefining 'getMessageForX()' methods.
 class StackHintGeneratorForSymbol : public StackHintGenerator {
 private:
-  SymbolRef Sym;
+  SymExprRef Sym;
   std::string Msg;
 
 public:
-  StackHintGeneratorForSymbol(SymbolRef S, StringRef M) : Sym(S), Msg(M) {}
+  StackHintGeneratorForSymbol(SymExprRef S, StringRef M) : Sym(S), Msg(M) {}
   ~StackHintGeneratorForSymbol() override = default;
 
   /// Search the call expression for the symbol Sym and dispatch the
   /// 'getMessageForX()' methods to construct a specific message.
   std::string getMessage(const ExplodedNode *N) override;
 
   /// Produces the message of the following form:
   ///   'Msg via Nth parameter'
protected:
 
   /// Profile to identify equivalent bug reports for error report coalescing.
 
   /// A (stack of) a set of symbols that are registered with this
   /// report as being "interesting", and thus used to help decide which
   /// diagnostics to include when constructing the final path diagnostic.
   /// The stack is largely used by BugReporter when generating PathDiagnostics
   /// for multiple PathDiagnosticConsumers.
-  llvm::DenseMap<SymbolRef, bugreporter::TrackingKind> InterestingSymbols;
+  llvm::DenseMap<SymExprRef, bugreporter::TrackingKind> InterestingSymbols;
 
   /// A (stack of) set of regions that are registered with this report as being
   /// "interesting", and thus used to help decide which diagnostics
   /// to include when constructing the final path diagnostic.
   /// The stack is largely used by BugReporter when generating PathDiagnostics
   /// for multiple PathDiagnosticConsumers.
   llvm::DenseMap<const MemRegion *, bugreporter::TrackingKind>
       InterestingRegions;
public:
 
   ArrayRef<SourceRange> getRanges() const override;
 
   PathDiagnosticLocation getLocation() const override;
 
   /// Marks a symbol as interesting. Different kinds of interestingness will
   /// be processed differently by visitors (e.g. if the tracking kind is
   /// condition, will append "will be used as a condition" to the message).
-  void markInteresting(SymbolRef sym, bugreporter::TrackingKind TKind =
+  void markInteresting(SymExprRef sym, bugreporter::TrackingKind TKind =
                                            bugreporter::TrackingKind::Thorough);
 
   /// Marks a region as interesting. Different kinds of interestingness will
   /// be processed differently by visitors (e.g. if the tracking kind is
   /// condition, will append "will be used as a condition" to the message).
   void markInteresting(
       const MemRegion *R,
       bugreporter::TrackingKind TKind = bugreporter::TrackingKind::Thorough);
 
   /// Marks a symbolic value as interesting. Different kinds of interestingness
   /// will be processed differently by visitors (e.g. if the tracking kind is
   /// condition, will append "will be used as a condition" to the message).
   void markInteresting(SVal V, bugreporter::TrackingKind TKind =
                                    bugreporter::TrackingKind::Thorough);
   void markInteresting(const LocationContext *LC);
 
-  bool isInteresting(SymbolRef sym) const;
+  bool isInteresting(SymExprRef sym) const;
   bool isInteresting(const MemRegion *R) const;
   bool isInteresting(SVal V) const;
   bool isInteresting(const LocationContext *LC) const;
 
   Optional<bugreporter::TrackingKind>
-  getInterestingnessKind(SymbolRef sym) const;
+  getInterestingnessKind(SymExprRef sym) const;
 
   Optional<bugreporter::TrackingKind>
   getInterestingnessKind(const MemRegion *R) const;
 
   Optional<bugreporter::TrackingKind> getInterestingnessKind(SVal V) const;
 
   /// Returns whether or not this report should be considered valid.
   ///

clang/include/clang/StaticAnalyzer/Core/PathSensitive/ConstraintManager.h

virtual ProgramStatePair assumeInclusiveRangeDual(ProgramStateRef State,
     return ProgramStatePair(StInRange, StOutOfRange);
   }
 
   /// If a symbol is perfectly constrained to a constant, attempt
   /// to return the concrete value.
   ///
   /// Note that a ConstraintManager is not obligated to return a concretized
   /// value for a symbol, even if it is perfectly constrained.
-  virtual const llvm::APSInt* getSymVal(ProgramStateRef state,
-                                        SymbolRef sym) const {
+  virtual const llvm::APSInt *getSymVal(ProgramStateRef state,
+                                        SymExprRef sym) const {
     return nullptr;
   }
 
   /// Scan all symbols referenced by the constraints. If the symbol is not
   /// alive, remove it.
   virtual ProgramStateRef removeDeadBindings(ProgramStateRef state,
                                                  SymbolReaper& SymReaper) = 0;
 
   virtual void printJson(raw_ostream &Out, ProgramStateRef State,
                          const char *NL, unsigned int Space,
                          bool IsDot) const = 0;
 
   /// Convenience method to query the state to see if a symbol is null or
   /// not null, or if neither assumption can be made.
-  ConditionTruthVal isNull(ProgramStateRef State, SymbolRef Sym) {
+  ConditionTruthVal isNull(ProgramStateRef State, SymExprRef Sym) {
     SaveAndRestore<bool> DisableNotify(NotifyAssumeClients, false);
 
     return checkNull(State, Sym);
   }
 
 protected:
   /// A flag to indicate that clients should be notified of assumptions.
   /// By default this is the case, but sometimes this needs to be restricted
   /// to avoid infinite recursions within the ConstraintManager.
   ///
   /// Note that this flag allows the ConstraintManager to be re-entrant,
   /// but not thread-safe.
   bool NotifyAssumeClients = true;
 
   /// canReasonAbout - Not all ConstraintManagers can accurately reason about
   ///  all SVal values.  This method returns true if the ConstraintManager can
   ///  reasonably handle a given SVal value.  This is typically queried by
   ///  ExprEngine to determine if the value should be replaced with a
   ///  conjured symbolic value in order to recover some precision.
   virtual bool canReasonAbout(SVal X) const = 0;
 
   /// Returns whether or not a symbol is known to be null ("true"), known to be
   /// non-null ("false"), or may be either ("underconstrained").
-  virtual ConditionTruthVal checkNull(ProgramStateRef State, SymbolRef Sym);
+  virtual ConditionTruthVal checkNull(ProgramStateRef State, SymExprRef Sym);
 };
 
 std::unique_ptr<ConstraintManager>
 CreateRangeConstraintManager(ProgramStateManager &statemgr,
                              ExprEngine *exprengine);
 
 std::unique_ptr<ConstraintManager>
 CreateZ3ConstraintManager(ProgramStateManager &statemgr,
                           ExprEngine *exprengine);
 
 } // namespace ento
 } // namespace clang
 
 #endif // LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CONSTRAINTMANAGER_H

clang/include/clang/StaticAnalyzer/Core/PathSensitive/DynamicType.h

 DynamicTypeInfo getDynamicTypeInfo(ProgramStateRef State, const MemRegion *MR);
 
 /// Get raw dynamic type information for the region \p MR.
 const DynamicTypeInfo *getRawDynamicTypeInfo(ProgramStateRef State,
                                              const MemRegion *MR);
 
 /// Get dynamic type information stored in a class object represented by \p Sym.
 DynamicTypeInfo getClassObjectDynamicTypeInfo(ProgramStateRef State,
-                                              SymbolRef Sym);
+                                              SymExprRef Sym);
 
 /// Get dynamic cast information from \p CastFromTy to \p CastToTy of \p MR.
 const DynamicCastInfo *getDynamicCastInfo(ProgramStateRef State,
                                           const MemRegion *MR,
                                           QualType CastFromTy,
                                           QualType CastToTy);
 
 /// Set dynamic type information of the region; return the new state.
 ProgramStateRef setDynamicTypeInfo(ProgramStateRef State, const MemRegion *MR,
                                    DynamicTypeInfo NewTy);
 
 /// Set dynamic type information of the region; return the new state.
 ProgramStateRef setDynamicTypeInfo(ProgramStateRef State, const MemRegion *MR,
                                    QualType NewTy, bool CanBeSubClassed = true);
 
 /// Set constraint on a type contained in a class object; return the new state.
 ProgramStateRef setClassObjectDynamicTypeInfo(ProgramStateRef State,
-                                              SymbolRef Sym,
+                                              SymExprRef Sym,
                                               DynamicTypeInfo NewTy);
 
 /// Set constraint on a type contained in a class object; return the new state.
 ProgramStateRef setClassObjectDynamicTypeInfo(ProgramStateRef State,
-                                              SymbolRef Sym, QualType NewTy,
+                                              SymExprRef Sym, QualType NewTy,
                                               bool CanBeSubClassed = true);
 
 /// Set dynamic type and cast information of the region; return the new state.
 ProgramStateRef setDynamicTypeAndCastInfo(ProgramStateRef State,
                                           const MemRegion *MR,
                                           QualType CastFromTy,
                                           QualType CastToTy,
                                           bool IsCastSucceeds);

clang/include/clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h

 /// SymbolicRegion - A special, "non-concrete" region. Unlike other region
 ///  classes, SymbolicRegion represents a region that serves as an alias for
 ///  either a real region, a NULL pointer, etc.  It essentially is used to
 ///  map the concept of symbolic values into the domain of regions.  Symbolic
 ///  regions do not need to be typed.
 class SymbolicRegion : public SubRegion {
   friend class MemRegionManager;
 
-  const SymbolRef sym;
+  const SymExprRef sym;
 
-  SymbolicRegion(const SymbolRef s, const MemSpaceRegion *sreg)
+  SymbolicRegion(const SymExprRef s, const MemSpaceRegion *sreg)
       : SubRegion(sreg, SymbolicRegionKind), sym(s) {
     // Because pointer arithmetic is represented by ElementRegion layers,
     // the base symbol here should not contain any arithmetic.
     assert(s && isa<SymbolData>(s));
     assert(s->getType()->isAnyPointerType() ||
            s->getType()->isReferenceType() ||
            s->getType()->isBlockPointerType());
     assert(isa<UnknownSpaceRegion>(sreg) || isa<HeapSpaceRegion>(sreg));
   }
 
 public:
-  SymbolRef getSymbol() const { return sym; }
+  SymExprRef getSymbol() const { return sym; }
 
   bool isBoundable() const override { return true; }
 
   void Profile(llvm::FoldingSetNodeID& ID) const override;
 
-  static void ProfileRegion(llvm::FoldingSetNodeID& ID,
-                            SymbolRef sym,
-                            const MemRegion* superRegion);
+  static void ProfileRegion(llvm::FoldingSetNodeID &ID, SymExprRef sym,
+                            const MemRegion *superRegion);
 
   void dumpToStream(raw_ostream &os) const override;
 
   static bool classof(const MemRegion* R) {
     return R->getKind() == SymbolicRegionKind;
   }
 };
 
getCompoundLiteralRegion(const CompoundLiteralExpr *CL,
                            const LocationContext *LC);
 
   /// getCXXThisRegion - Retrieve the [artificial] region associated with the
   ///  parameter 'this'.
   const CXXThisRegion *getCXXThisRegion(QualType thisPointerTy,
                                         const LocationContext *LC);
 
   /// Retrieve or create a "symbolic" memory region.
-  const SymbolicRegion* getSymbolicRegion(SymbolRef Sym);
+  const SymbolicRegion *getSymbolicRegion(SymExprRef Sym);
 
   /// Return a unique symbolic region belonging to heap memory space.
-  const SymbolicRegion *getSymbolicHeapRegion(SymbolRef sym);
+  const SymbolicRegion *getSymbolicHeapRegion(SymExprRef sym);
 
   const StringRegion *getStringRegion(const StringLiteral *Str);
 
   const ObjCStringRegion *getObjCStringRegion(const ObjCStringLiteral *Str);
 
   /// getVarRegion - Retrieve or create the memory region associated with
   ///  a specified VarDecl and LocationContext.
   const VarRegion *getVarRegion(const VarDecl *VD, const LocationContext *LC);

 // Means for storing region/symbol handling traits.
 //===----------------------------------------------------------------------===//
 
 /// Information about invalidation for a particular region/symbol.
 class RegionAndSymbolInvalidationTraits {
   using StorageTypeForKinds = unsigned char;
 
   llvm::DenseMap<const MemRegion *, StorageTypeForKinds> MRTraitsMap;
-  llvm::DenseMap<SymbolRef, StorageTypeForKinds> SymTraitsMap;
+  llvm::DenseMap<SymExprRef, StorageTypeForKinds> SymTraitsMap;
 
   using const_region_iterator =
       llvm::DenseMap<const MemRegion *, StorageTypeForKinds>::const_iterator;
   using const_symbol_iterator =
-      llvm::DenseMap<SymbolRef, StorageTypeForKinds>::const_iterator;
+      llvm::DenseMap<SymExprRef, StorageTypeForKinds>::const_iterator;
 
 public:
   /// Describes different invalidation traits.
   enum InvalidationKinds {
     /// Tells that a region's contents is not changed.
     TK_PreserveContents = 0x1,
 
     /// Suppress pointer-escaping of a region.
     TK_SuppressEscape = 0x2,
 
     // Do not invalidate super region.
     TK_DoNotInvalidateSuperRegion = 0x4,
 
     /// When applied to a MemSpaceRegion, indicates the entire memory space
     /// should be invalidated.
     TK_EntireMemSpace = 0x8
 
     // Do not forget to extend StorageTypeForKinds if number of traits exceed
     // the number of bits StorageTypeForKinds can store.
   };
 
-  void setTrait(SymbolRef Sym, InvalidationKinds IK);
+  void setTrait(SymExprRef Sym, InvalidationKinds IK);
   void setTrait(const MemRegion *MR, InvalidationKinds IK);
-  bool hasTrait(SymbolRef Sym, InvalidationKinds IK) const;
+  bool hasTrait(SymExprRef Sym, InvalidationKinds IK) const;
   bool hasTrait(const MemRegion *MR, InvalidationKinds IK) const;
 };
 
 //===----------------------------------------------------------------------===//
 // Pretty-printing regions.
 //===----------------------------------------------------------------------===//
 inline raw_ostream &operator<<(raw_ostream &os, const MemRegion *R) {
   R->dumpToStream(os);
   return os;
 }
 
 } // namespace ento
 
 } // namespace clang
 
 #endif // LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_MEMREGION_H

clang/include/clang/StaticAnalyzer/Core/PathSensitive/RangedConstraintManager.h

public:
 
   void print(raw_ostream &os) const;
 
   bool operator==(const RangeSet &other) const {
     return ranges == other.ranges;
   }
 };
 
-using ConstraintMap = llvm::ImmutableMap<SymbolRef, RangeSet>;
+using ConstraintMap = llvm::ImmutableMap<SymExprRef, RangeSet>;
 ConstraintMap getConstraintMap(ProgramStateRef State);
 
 class RangedConstraintManager : public SimpleConstraintManager {
 public:
   RangedConstraintManager(ExprEngine *EE, SValBuilder &SB)
       : SimpleConstraintManager(EE, SB) {}
 
   ~RangedConstraintManager() override;
 
   //===------------------------------------------------------------------===//
   // Implementation for interface from SimpleConstraintManager.
   //===------------------------------------------------------------------===//
 
-  ProgramStateRef assumeSym(ProgramStateRef State, SymbolRef Sym,
+  ProgramStateRef assumeSym(ProgramStateRef State, SymExprRef Sym,
                             bool Assumption) override;
 
-  ProgramStateRef assumeSymInclusiveRange(ProgramStateRef State, SymbolRef Sym,
+  ProgramStateRef assumeSymInclusiveRange(ProgramStateRef State, SymExprRef Sym,
                                           const llvm::APSInt &From,
                                           const llvm::APSInt &To,
                                           bool InRange) override;
 
-  ProgramStateRef assumeSymUnsupported(ProgramStateRef State, SymbolRef Sym,
+  ProgramStateRef assumeSymUnsupported(ProgramStateRef State, SymExprRef Sym,
                                        bool Assumption) override;
 
 protected:
   /// Assume a constraint between a symbolic expression and a concrete integer.
-  virtual ProgramStateRef assumeSymRel(ProgramStateRef State, SymbolRef Sym,
+  virtual ProgramStateRef assumeSymRel(ProgramStateRef State, SymExprRef Sym,
                                        BinaryOperator::Opcode op,
                                        const llvm::APSInt &Int);
 
   //===------------------------------------------------------------------===//
   // Interface that subclasses must implement.
   //===------------------------------------------------------------------===//
 
   // Each of these is of the form "$Sym+Adj <> V", where "<>" is the comparison
   // operation for the method being invoked.
 
-  virtual ProgramStateRef assumeSymNE(ProgramStateRef State, SymbolRef Sym,
+  virtual ProgramStateRef assumeSymNE(ProgramStateRef State, SymExprRef Sym,
                                       const llvm::APSInt &V,
                                       const llvm::APSInt &Adjustment) = 0;
 
-  virtual ProgramStateRef assumeSymEQ(ProgramStateRef State, SymbolRef Sym,
+  virtual ProgramStateRef assumeSymEQ(ProgramStateRef State, SymExprRef Sym,
                                       const llvm::APSInt &V,
                                       const llvm::APSInt &Adjustment) = 0;
 
-  virtual ProgramStateRef assumeSymLT(ProgramStateRef State, SymbolRef Sym,
+  virtual ProgramStateRef assumeSymLT(ProgramStateRef State, SymExprRef Sym,
                                       const llvm::APSInt &V,
                                       const llvm::APSInt &Adjustment) = 0;
 
-  virtual ProgramStateRef assumeSymGT(ProgramStateRef State, SymbolRef Sym,
+  virtual ProgramStateRef assumeSymGT(ProgramStateRef State, SymExprRef Sym,
                                       const llvm::APSInt &V,
                                       const llvm::APSInt &Adjustment) = 0;
 
-  virtual ProgramStateRef assumeSymLE(ProgramStateRef State, SymbolRef Sym,
+  virtual ProgramStateRef assumeSymLE(ProgramStateRef State, SymExprRef Sym,
                                       const llvm::APSInt &V,
                                       const llvm::APSInt &Adjustment) = 0;
 
-  virtual ProgramStateRef assumeSymGE(ProgramStateRef State, SymbolRef Sym,
+  virtual ProgramStateRef assumeSymGE(ProgramStateRef State, SymExprRef Sym,
                                       const llvm::APSInt &V,
                                       const llvm::APSInt &Adjustment) = 0;
 
   virtual ProgramStateRef assumeSymWithinInclusiveRange(
-      ProgramStateRef State, SymbolRef Sym, const llvm::APSInt &From,
+      ProgramStateRef State, SymExprRef Sym, const llvm::APSInt &From,
       const llvm::APSInt &To, const llvm::APSInt &Adjustment) = 0;
 
   virtual ProgramStateRef assumeSymOutsideInclusiveRange(
-      ProgramStateRef State, SymbolRef Sym, const llvm::APSInt &From,
+      ProgramStateRef State, SymExprRef Sym, const llvm::APSInt &From,
       const llvm::APSInt &To, const llvm::APSInt &Adjustment) = 0;
 
   //===------------------------------------------------------------------===//
   // Internal implementation.
   //===------------------------------------------------------------------===//
 private:
-  static void computeAdjustment(SymbolRef &Sym, llvm::APSInt &Adjustment);
+  static void computeAdjustment(SymExprRef &Sym, llvm::APSInt &Adjustment);
 };
 
 } // namespace ento
 } // namespace clang
 
 REGISTER_FACTORY_WITH_PROGRAMSTATE(ConstraintMap)
 
 #endif

clang/include/clang/StaticAnalyzer/Core/PathSensitive/SMTConstraintManager.h

 #define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_SMTCONSTRAINTMANAGER_H
 
 #include "clang/Basic/JsonSupport.h"
 #include "clang/Basic/TargetInfo.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/RangedConstraintManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/SMTConv.h"
 
 typedef llvm::ImmutableSet<
-    std::pair<clang::ento::SymbolRef, const llvm::SMTExpr *>>
+    std::pair<clang::ento::SymExprRef, const llvm::SMTExpr *>>
     ConstraintSMTType;
 REGISTER_TRAIT_WITH_PROGRAMSTATE(ConstraintSMT, ConstraintSMTType)
 
 namespace clang {
 namespace ento {
 
 class SMTConstraintManager : public clang::ento::SimpleConstraintManager {
   mutable llvm::SMTSolverRef Solver = llvm::CreateZ3Solver();
 
 public:
   SMTConstraintManager(clang::ento::ExprEngine *EE,
                        clang::ento::SValBuilder &SB)
       : SimpleConstraintManager(EE, SB) {}
   virtual ~SMTConstraintManager() = default;
 
   //===------------------------------------------------------------------===//
   // Implementation for interface from SimpleConstraintManager.
   //===------------------------------------------------------------------===//
 
-  ProgramStateRef assumeSym(ProgramStateRef State, SymbolRef Sym,
+  ProgramStateRef assumeSym(ProgramStateRef State, SymExprRef Sym,
                             bool Assumption) override {
     ASTContext &Ctx = getBasicVals().getContext();
 
     QualType RetTy;
     bool hasComparison;
 
     llvm::SMTExprRef Exp =
         SMTConv::getExpr(Solver, Ctx, Sym, &RetTy, &hasComparison);
 
     // Create zero comparison for implicit boolean cast, with reversed
     // assumption
     if (!hasComparison && !RetTy->isBooleanType())
       return assumeExpr(
           State, Sym,
           SMTConv::getZeroExpr(Solver, Ctx, Exp, RetTy, !Assumption));
 
     return assumeExpr(State, Sym, Assumption ? Exp : Solver->mkNot(Exp));
   }
 
-  ProgramStateRef assumeSymInclusiveRange(ProgramStateRef State, SymbolRef Sym,
+  ProgramStateRef assumeSymInclusiveRange(ProgramStateRef State, SymExprRef Sym,
                                           const llvm::APSInt &From,
                                           const llvm::APSInt &To,
                                           bool InRange) override {
     ASTContext &Ctx = getBasicVals().getContext();
     return assumeExpr(
         State, Sym, SMTConv::getRangeExpr(Solver, Ctx, Sym, From, To, InRange));
   }
 
-  ProgramStateRef assumeSymUnsupported(ProgramStateRef State, SymbolRef Sym,
+  ProgramStateRef assumeSymUnsupported(ProgramStateRef State, SymExprRef Sym,
                                        bool Assumption) override {
     // Skip anything that is unsupported
     return State;
   }
 
   //===------------------------------------------------------------------===//
   // Implementation for interface from ConstraintManager.
   //===------------------------------------------------------------------===//
 
-  ConditionTruthVal checkNull(ProgramStateRef State, SymbolRef Sym) override {
+  ConditionTruthVal checkNull(ProgramStateRef State, SymExprRef Sym) override {
     ASTContext &Ctx = getBasicVals().getContext();
 
     QualType RetTy;
     // The expression may be casted, so we cannot call getZ3DataExpr() directly
     llvm::SMTExprRef VarExp = SMTConv::getExpr(Solver, Ctx, Sym, &RetTy);
     llvm::SMTExprRef Exp =
         SMTConv::getZeroExpr(Solver, Ctx, VarExp, RetTy, /*Assumption=*/true);
 
ConditionTruthVal checkNull(ProgramStateRef State, SymExprRef Sym) override {
     if (isSat.isConstrainedFalse() && isNotSat.isConstrainedTrue())
       return false;
 
     // Zero may be a solution
     return ConditionTruthVal();
   }
 
   const llvm::APSInt *getSymVal(ProgramStateRef State,
-                                SymbolRef Sym) const override {
+                                SymExprRef Sym) const override {
     BasicValueFactory &BVF = getBasicVals();
     ASTContext &Ctx = BVF.getContext();
 
     if (const SymbolData *SD = dyn_cast<SymbolData>(Sym)) {
       QualType Ty = Sym->getType();
       assert(!Ty->isRealFloatingType());
       llvm::APSInt Value(Ctx.getTypeSize(Ty),
                          !Ty->isSignedIntegerOrEnumerationType());
if (const SymbolData *SD = dyn_cast<SymbolData>(Sym)) {
       if (!isSat.hasValue() || isNotSat.getValue())
         return nullptr;
 
       // This is the only solution, store it
       return &BVF.getValue(Value);
     }
 
     if (const SymbolCast *SC = dyn_cast<SymbolCast>(Sym)) {
-      SymbolRef CastSym = SC->getOperand();
+      SymExprRef CastSym = SC->getOperand();
       QualType CastTy = SC->getType();
       // Skip the void type
       if (CastTy->isVoidType())
         return nullptr;
 
       const llvm::APSInt *Value;
       if (!(Value = getSymVal(State, CastSym)))
         return nullptr;
bool canReasonAbout(SVal X) const override {
     llvm_unreachable("Unsupported expression to reason about!");
   }
 
   /// Dumps SMT formula
   LLVM_DUMP_METHOD void dump() const { Solver->dump(); }
 
 protected:
   // Check whether a new model is satisfiable, and update the program state.
-  virtual ProgramStateRef assumeExpr(ProgramStateRef State, SymbolRef Sym,
+  virtual ProgramStateRef assumeExpr(ProgramStateRef State, SymExprRef Sym,
                                      const llvm::SMTExprRef &Exp) {
     // Check the model, avoid simplifying AST to save time
     if (checkModel(State, Sym, Exp).isConstrainedTrue())
       return State->add<ConstraintSMT>(std::make_pair(Sym, Exp));
 
     return nullptr;
   }
 
if (I != IE) {
         Constraint = Solver->mkAnd(Constraint, I++->second);
       }
 
       Solver->addConstraint(Constraint);
     }
   }
 
   // Generate and check a Z3 model, using the given constraint.
-  ConditionTruthVal checkModel(ProgramStateRef State, SymbolRef Sym,
+  ConditionTruthVal checkModel(ProgramStateRef State, SymExprRef Sym,
                                const llvm::SMTExprRef &Exp) const {
     ProgramStateRef NewState =
         State->add<ConstraintSMT>(std::make_pair(Sym, Exp));
 
     llvm::FoldingSetNodeID ID;
     NewState->get<ConstraintSMT>().Profile(ID);
 
     unsigned hash = ID.ComputeHash();

clang/include/clang/StaticAnalyzer/Core/PathSensitive/SMTConv.h

static inline llvm::SMTExprRef getSymBinExpr(llvm::SMTSolverRef &Solver,
     }
 
     llvm_unreachable("Unsupported BinarySymExpr type!");
   }
 
   // Recursive implementation to unpack and generate symbolic expression.
   // Sets the hasComparison and RetTy parameters. See getExpr().
   static inline llvm::SMTExprRef getSymExpr(llvm::SMTSolverRef &Solver,
-                                            ASTContext &Ctx, SymbolRef Sym,
+                                            ASTContext &Ctx, SymExprRef Sym,
                                             QualType *RetTy,
                                             bool *hasComparison) {
     if (const SymbolData *SD = dyn_cast<SymbolData>(Sym)) {
       if (RetTy)
         *RetTy = Sym->getType();
 
       return fromData(Solver, Ctx, SD);
     }
if (const BinarySymExpr *BSE = dyn_cast<BinarySymExpr>(Sym)) {
       llvm::SMTExprRef Exp =
           getSymBinExpr(Solver, Ctx, BSE, hasComparison, RetTy);
       // Set the hasComparison parameter, in post-order traversal order.
       if (hasComparison)
         *hasComparison = BinaryOperator::isComparisonOp(BSE->getOpcode());
       return Exp;
     }
 
-    llvm_unreachable("Unsupported SymbolRef type!");
+    llvm_unreachable("Unsupported SymExprRef type!");
   }
 
   // Generate an SMTSolverRef that represents the given symbolic expression.
   // Sets the hasComparison parameter if the expression has a comparison
   // operator. Sets the RetTy parameter to the final return type after
   // promotions and casts.
   static inline llvm::SMTExprRef getExpr(llvm::SMTSolverRef &Solver,
-                                         ASTContext &Ctx, SymbolRef Sym,
+                                         ASTContext &Ctx, SymExprRef Sym,
                                          QualType *RetTy = nullptr,
                                          bool *hasComparison = nullptr) {
     if (hasComparison) {
       *hasComparison = false;
     }
 
     return getSymExpr(Solver, Ctx, Sym, RetTy, hasComparison);
   }
static inline llvm::SMTExprRef getZeroExpr(llvm::SMTSolverRef &Solver,
     }
 
     llvm_unreachable("Unsupported type for zero value!");
   }
 
   // Wrapper to generate SMTSolverRef from a range. If From == To, an
   // equality will be created instead.
   static inline llvm::SMTExprRef
-  getRangeExpr(llvm::SMTSolverRef &Solver, ASTContext &Ctx, SymbolRef Sym,
+  getRangeExpr(llvm::SMTSolverRef &Solver, ASTContext &Ctx, SymExprRef Sym,
                const llvm::APSInt &From, const llvm::APSInt &To, bool InRange) {
     // Convert lower bound
     QualType FromTy;
     llvm::APSInt NewFromInt;
     std::tie(NewFromInt, FromTy) = fixAPSInt(Ctx, From);
     llvm::SMTExprRef FromExp =
         Solver->mkBitvector(NewFromInt, NewFromInt.getBitWidth());
 

clang/include/clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h

public:
 
   /// Conjure a symbol representing heap allocated memory region.
   ///
   /// Note, the expression should represent a location.
   DefinedOrUnknownSVal getConjuredHeapSymbolVal(const Expr *E,
                                                 const LocationContext *LCtx,
                                                 unsigned Count);
 
-  DefinedOrUnknownSVal getDerivedRegionValueSymbolVal(
-      SymbolRef parentSymbol, const TypedValueRegion *region);
+  DefinedOrUnknownSVal
+  getDerivedRegionValueSymbolVal(SymExprRef parentSymbol,
+                                 const TypedValueRegion *region);
 
   DefinedSVal getMetadataSymbolVal(const void *symbolTag,
                                    const MemRegion *region,
                                    const Expr *expr, QualType type,
                                    const LocationContext *LCtx,
                                    unsigned count);
 
   DefinedSVal getMemberPointer(const NamedDecl *ND);
public:
   Loc makeNullWithType(QualType type) {
     return loc::ConcreteInt(BasicVals.getZeroWithTypeSize(type));
   }
 
   Loc makeNull() {
     return loc::ConcreteInt(BasicVals.getZeroWithPtrWidth());
   }
 
-  Loc makeLoc(SymbolRef sym) {
+  Loc makeLoc(SymExprRef sym) {
     return loc::MemRegionVal(MemMgr.getSymbolicRegion(sym));
   }
 
   Loc makeLoc(const MemRegion* region) {
     return loc::MemRegionVal(region);
   }
 
   Loc makeLoc(const AddrLabelExpr *expr) {
     return loc::GotoLabel(expr->getLabel());
   }
 
   Loc makeLoc(const llvm::APSInt& integer) {
     return loc::ConcreteInt(BasicVals.getValue(integer));
   }
 
   /// Make an SVal that represents the given symbol. This follows the convention
   /// of representing Loc-type symbols (symbolic pointers and references)
   /// as Loc values wrapping the symbol rather than as plain symbol values.
-  SVal makeSymbolVal(SymbolRef Sym) {
+  SVal makeSymbolVal(SymExprRef Sym) {
     if (Loc::isLocType(Sym->getType()))
       return makeLoc(Sym);
     return nonloc::SymbolVal(Sym);
   }
 
   /// Return a memory region for the 'this' object reference.
   loc::MemRegionVal getCXXThis(const CXXMethodDecl *D,
                                const StackFrameContext *SFC);

clang/include/clang/StaticAnalyzer/Core/PathSensitive/SValVisitor.h

 /// SymExprVisitor - this class implements a simple visitor for SymExpr
 /// subclasses.
 template <typename ImplClass, typename RetTy = void> class SymExprVisitor {
 public:
 
 #define DISPATCH(CLASS) \
     return static_cast<ImplClass *>(this)->Visit ## CLASS(cast<CLASS>(S))
 
-  RetTy Visit(SymbolRef S) {
+  RetTy Visit(SymExprRef S) {
     // Dispatch to VisitSymbolFoo for each SymbolFoo.
     switch (S->getKind()) {
 #define SYMBOL(Id, Parent) \
     case SymExpr::Id ## Kind: DISPATCH(Id);
 #include "clang/StaticAnalyzer/Core/PathSensitive/Symbols.def"
     }
     llvm_unreachable("Unknown SymExpr kind!");
   }
 
   // If the implementation chooses not to implement a certain visit method, fall
   // back on visiting the superclass.
 #define SYMBOL(Id, Parent) RetTy Visit ## Id(const Id *S) { DISPATCH(Parent); }
 #define ABSTRACT_SYMBOL(Id, Parent) SYMBOL(Id, Parent)
 #include "clang/StaticAnalyzer/Core/PathSensitive/Symbols.def"
 
   // Base case, ignore it. :)
-  RetTy VisitSymExpr(SymbolRef S) { return RetTy(); }
+  RetTy VisitSymExpr(SymExprRef S) { return RetTy(); }
 
 #undef DISPATCH
 };
 
 /// MemRegionVisitor - this class implements a simple visitor for MemRegion
 /// subclasses.
 template <typename ImplClass, typename RetTy = void> class MemRegionVisitor {
 public:

clang/include/clang/StaticAnalyzer/Core/PathSensitive/SVals.h

public:
   bool hasConjuredSymbol() const;
 
   /// getAsFunctionDecl - If this SVal is a MemRegionVal and wraps a
   /// CodeTextRegion wrapping a FunctionDecl, return that FunctionDecl.
   /// Otherwise return 0.
   const FunctionDecl *getAsFunctionDecl() const;
 
   /// If this SVal is a location and wraps a symbol, return that
-  ///  SymbolRef. Otherwise return 0.
+  ///  SymExprRef. Otherwise return 0.
   ///
   /// Casts are ignored during lookup.
   /// \param IncludeBaseRegions The boolean that controls whether the search
   /// should continue to the base regions if the region is not symbolic.
-  SymbolRef getAsLocSymbol(bool IncludeBaseRegions = false) const;
+  SymExprRef getAsLocSymbol(bool IncludeBaseRegions = false) const;
 
   /// Get the symbol in the SVal or its base region.
-  SymbolRef getLocSymbolInBase() const;
+  SymExprRef getLocSymbolInBase() const;
 
-  /// If this SVal wraps a symbol return that SymbolRef.
+  /// If this SVal wraps a symbol return that SymExprRef.
   /// Otherwise, return 0.
   ///
   /// Casts are ignored during lookup.
   /// \param IncludeBaseRegions The boolean that controls whether the search
   /// should continue to the base regions if the region is not symbolic.
-  SymbolRef getAsSymbol(bool IncludeBaseRegions = false) const;
+  SymExprRef getAsSymbol(bool IncludeBaseRegions = false) const;
 
   const MemRegion *getAsRegion() const;
 
   /// printJson - Pretty-prints in JSON format.
   void printJson(raw_ostream &Out, bool AddQuotes) const;
 
   void dumpToStream(raw_ostream &OS) const;
   void dump() const;

 //==------------------------------------------------------------------------==//
 
 namespace nonloc {
 
 /// Represents symbolic expression that isn't a location.
 class SymbolVal : public NonLoc {
 public:
   SymbolVal() = delete;
-  SymbolVal(SymbolRef sym) : NonLoc(SymbolValKind, sym) {
+  SymbolVal(SymExprRef sym) : NonLoc(SymbolValKind, sym) {
     assert(sym);
     assert(!Loc::isLocType(sym->getType()));
   }
 
-  SymbolRef getSymbol() const {
-    return (const SymExpr *) Data;
-  }
+  SymExprRef getSymbol() const { return (const SymExpr *)Data; }
 
   bool isExpression() const {
     return !isa<SymbolData>(getSymbol());
   }
 
 private:
   friend class SVal;
 

clang/include/clang/StaticAnalyzer/Core/PathSensitive/SimpleConstraintManager.h

 
 protected:
   //===------------------------------------------------------------------===//
   // Interface that subclasses must implement.
   //===------------------------------------------------------------------===//
 
   /// Given a symbolic expression that can be reasoned about, assume that it is
   /// true/false and generate the new program state.
-  virtual ProgramStateRef assumeSym(ProgramStateRef State, SymbolRef Sym,
+  virtual ProgramStateRef assumeSym(ProgramStateRef State, SymExprRef Sym,
                                     bool Assumption) = 0;
 
   /// Given a symbolic expression within the range [From, To], assume that it is
   /// true/false and generate the new program state.
   /// This function is used to handle case ranges produced by a language
   /// extension for switch case statements.
   virtual ProgramStateRef assumeSymInclusiveRange(ProgramStateRef State,
-                                                  SymbolRef Sym,
+                                                  SymExprRef Sym,
                                                   const llvm::APSInt &From,
                                                   const llvm::APSInt &To,
                                                   bool InRange) = 0;
 
   /// Given a symbolic expression that cannot be reasoned about, assume that
   /// it is zero/nonzero and add it directly to the solver state.
   virtual ProgramStateRef assumeSymUnsupported(ProgramStateRef State,
-                                               SymbolRef Sym,
+                                               SymExprRef Sym,
                                                bool Assumption) = 0;
 
   //===------------------------------------------------------------------===//
   // Internal implementation.
   //===------------------------------------------------------------------===//
 
   SValBuilder &getSValBuilder() const { return SVB; }
   BasicValueFactory &getBasicVals() const { return SVB.getBasicValueFactory(); }

clang/include/clang/StaticAnalyzer/Core/PathSensitive/Store.h

 
 namespace ento {
 
 class CallEvent;
 class ProgramStateManager;
 class ScanReachableSymbols;
 class SymbolReaper;
 
-using InvalidatedSymbols = llvm::DenseSet<SymbolRef>;
+using InvalidatedSymbols = llvm::DenseSet<SymExprRef>;
 
 class StoreManager {
 protected:
   SValBuilder &svalBuilder;
   ProgramStateManager &StateMgr;
 
   /// MRMgr - Manages region objects associated with this StoreManager.
   MemRegionManager &MRMgr;
public:
     virtual ~BindingsHandler();
 
     /// \return whether the iteration should continue.
     virtual bool HandleBinding(StoreManager& SMgr, Store store,
                                const MemRegion *region, SVal val) = 0;
   };
 
   class FindUniqueBinding : public BindingsHandler {
-    SymbolRef Sym;
+    SymExprRef Sym;
     const MemRegion* Binding = nullptr;
     bool First = true;
 
   public:
-    FindUniqueBinding(SymbolRef sym) : Sym(sym) {}
+    FindUniqueBinding(SymExprRef sym) : Sym(sym) {}
 
     explicit operator bool() { return First && Binding; }
 
     bool HandleBinding(StoreManager& SMgr, Store store, const MemRegion* R,
                        SVal val) override;
     const MemRegion *getRegion() { return Binding; }
   };
 

clang/include/clang/StaticAnalyzer/Core/PathSensitive/SymExpr.h

 };
 
 inline raw_ostream &operator<<(raw_ostream &os,
                                const clang::ento::SymExpr *SE) {
   SE->dumpToStream(os);
   return os;
 }
 
-using SymbolRef = const SymExpr *;
-using SymbolRefSmallVectorTy = SmallVector<SymbolRef, 2>;
+using SymExprRef = const SymExpr *;
+using SymbolRefSmallVectorTy = SmallVector<SymExprRef, 2>;
 using SymbolID = unsigned;
 
 /// A symbol representing data which can be stored in a memory location
 /// (region).
 class SymbolData : public SymExpr {
   const SymbolID Sym;
 
   void anchor() override;

clang/include/clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h

public:
   static bool classof(const SymExpr *SE) {
     return SE->getKind() == SymbolConjuredKind;
   }
 };
 
 /// A symbol representing the value of a MemRegion whose parent region has
 /// symbolic value.
 class SymbolDerived : public SymbolData {
-  SymbolRef parentSymbol;
+  SymExprRef parentSymbol;
   const TypedValueRegion *R;
 
 public:
-  SymbolDerived(SymbolID sym, SymbolRef parent, const TypedValueRegion *r)
+  SymbolDerived(SymbolID sym, SymExprRef parent, const TypedValueRegion *r)
       : SymbolData(SymbolDerivedKind, sym), parentSymbol(parent), R(r) {
     assert(parent);
     assert(r);
     assert(isValidTypeForSymbol(r->getValueType()));
   }
 
-  SymbolRef getParentSymbol() const { return parentSymbol; }
+  SymExprRef getParentSymbol() const { return parentSymbol; }
   const TypedValueRegion *getRegion() const { return R; }
 
   QualType getType() const override;
 
   StringRef getKindStr() const override;
 
   void dumpToStream(raw_ostream &os) const override;
   const MemRegion *getOriginRegion() const override { return getRegion(); }
 
-  static void Profile(llvm::FoldingSetNodeID& profile, SymbolRef parent,
+  static void Profile(llvm::FoldingSetNodeID &profile, SymExprRef parent,
                       const TypedValueRegion *r) {
     profile.AddInteger((unsigned) SymbolDerivedKind);
     profile.AddPointer(r);
     profile.AddPointer(parent);
   }
 
   void Profile(llvm::FoldingSetNodeID& profile) override {
     Profile(profile, parentSymbol, R);

 
 /// Represents a symbolic expression like 'x' + 'y'.
 using SymSymExpr = BinarySymExprImpl<const SymExpr *, const SymExpr *,
                                      SymExpr::Kind::SymSymExprKind>;
 
 class SymbolManager {
   using DataSetTy = llvm::FoldingSet<SymExpr>;
   using SymbolDependTy =
-      llvm::DenseMap<SymbolRef, std::unique_ptr<SymbolRefSmallVectorTy>>;
+      llvm::DenseMap<SymExprRef, std::unique_ptr<SymbolRefSmallVectorTy>>;
 
   DataSetTy DataSet;
 
   /// Stores the extra dependencies between symbols: the data should be kept
   /// alive as long as the key is live.
   SymbolDependTy SymbolDependencies;
 
   unsigned SymbolCounter = 0;
public:
 
   const SymbolConjured* conjureSymbol(const Expr *E,
                                       const LocationContext *LCtx,
                                       unsigned VisitCount,
                                       const void *SymbolTag = nullptr) {
     return conjureSymbol(E, LCtx, E->getType(), VisitCount, SymbolTag);
   }
 
-  const SymbolDerived *getDerivedSymbol(SymbolRef parentSymbol,
+  const SymbolDerived *getDerivedSymbol(SymExprRef parentSymbol,
                                         const TypedValueRegion *R);
 
   const SymbolExtent *getExtentSymbol(const SubRegion *R);
 
   /// Creates a metadata symbol associated with a specific region.
   ///
   /// VisitCount can be used to differentiate regions corresponding to
   /// different loop iterations, thus, making the symbol path-dependent.
public:
 
   QualType getType(const SymExpr *SE) const {
     return SE->getType();
   }
 
   /// Add artificial symbol dependency.
   ///
   /// The dependent symbol should stay alive as long as the primary is alive.
-  void addSymbolDependency(const SymbolRef Primary, const SymbolRef Dependent);
+  void addSymbolDependency(const SymExprRef Primary,
+                           const SymExprRef Dependent);
 
-  const SymbolRefSmallVectorTy *getDependentSymbols(const SymbolRef Primary);
+  const SymbolRefSmallVectorTy *getDependentSymbols(const SymExprRef Primary);
 
   ASTContext &getContext() { return Ctx; }
   BasicValueFactory &getBasicVals() { return BV; }
 };
 
 /// A class responsible for cleaning up unused symbols.
 class SymbolReaper {
   enum SymbolStatus {
     NotProcessed,
     HaveMarkedDependents
   };
 
-  using SymbolSetTy = llvm::DenseSet<SymbolRef>;
-  using SymbolMapTy = llvm::DenseMap<SymbolRef, SymbolStatus>;
+  using SymbolSetTy = llvm::DenseSet<SymExprRef>;
+  using SymbolMapTy = llvm::DenseMap<SymExprRef, SymbolStatus>;
   using RegionSetTy = llvm::DenseSet<const MemRegion *>;
 
   SymbolMapTy TheLiving;
   SymbolSetTy MetadataInUse;
 
   RegionSetTy RegionRoots;
 
   const StackFrameContext *LCtx;
public:
   /// If the stack frame context is NULL, everything on stack is considered
   /// dead.
   SymbolReaper(const StackFrameContext *Ctx, const Stmt *s,
                SymbolManager &symmgr, StoreManager &storeMgr)
       : LCtx(Ctx), Loc(s), SymMgr(symmgr), reapedStore(nullptr, storeMgr) {}
 
   const LocationContext *getLocationContext() const { return LCtx; }
 
-  bool isLive(SymbolRef sym);
+  bool isLive(SymExprRef sym);
   bool isLiveRegion(const MemRegion *region);
   bool isLive(const Expr *ExprVal, const LocationContext *LCtx) const;
   bool isLive(const VarRegion *VR, bool includeStoreBindings = false) const;
 
   /// Unconditionally marks a symbol as live.
   ///
   /// This should never be
   /// used by checkers, only by the state infrastructure such as the store and
   /// environment. Checkers should instead use metadata symbols and markInUse.
-  void markLive(SymbolRef sym);
+  void markLive(SymExprRef sym);
 
   /// Marks a symbol as important to a checker.
   ///
   /// For metadata symbols,
   /// this will keep the symbol alive as long as its associated region is also
   /// live. For other symbols, this has no effect; checkers are not permitted
   /// to influence the life of other symbols. This should be used before any
   /// symbol marking has occurred, i.e. in the MarkLiveSymbols callback.
-  void markInUse(SymbolRef sym);
+  void markInUse(SymExprRef sym);
 
   using region_iterator = RegionSetTy::const_iterator;
 
   region_iterator region_begin() const { return RegionRoots.begin(); }
   region_iterator region_end() const { return RegionRoots.end(); }
 
   /// Returns whether or not a symbol has been confirmed dead.
   ///
   /// This should only be called once all marking of dead symbols has completed.
   /// (For checkers, this means only in the checkDeadSymbols callback.)
-  bool isDead(SymbolRef sym) {
-    return !isLive(sym);
-  }
+  bool isDead(SymExprRef sym) { return !isLive(sym); }
 
   void markLive(const MemRegion *region);
   void markElementIndicesLive(const MemRegion *region);
 
   /// Set to the value of the symbolic store after
   /// StoreManager::removeDeadBindings has been called.
   void setReapedStore(StoreRef st) { reapedStore = st; }
 
 private:
   /// Mark the symbols dependent on the input symbol as live.
-  void markDependentsLive(SymbolRef sym);
+  void markDependentsLive(SymExprRef sym);
 };
 
 class SymbolVisitor {
 protected:
   ~SymbolVisitor() = default;
 
 public:
   SymbolVisitor() = default;
   SymbolVisitor(const SymbolVisitor &) = default;
   SymbolVisitor(SymbolVisitor &&) {}
 
   /// A visitor method invoked by ProgramStateManager::scanReachableSymbols.
   ///
   /// The method returns \c true if symbols should continue be scanned and \c
   /// false otherwise.
-  virtual bool VisitSymbol(SymbolRef sym) = 0;
+  virtual bool VisitSymbol(SymExprRef sym) = 0;
   virtual bool VisitMemRegion(const MemRegion *) { return true; }
 };
 
 } // namespace ento
 
 } // namespace clang
 
 #endif // LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_SYMBOLMANAGER_H

clang/lib/StaticAnalyzer/Checkers/AllocationState.h

 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporterVisitors.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
 
 namespace clang {
 namespace ento {
 
 namespace allocation_state {
 
-ProgramStateRef markReleased(ProgramStateRef State, SymbolRef Sym,
+ProgramStateRef markReleased(ProgramStateRef State, SymExprRef Sym,
                              const Expr *Origin);
 
 /// This function provides an additional visitor that augments the bug report
 /// with information relevant to memory errors caused by the misuse of
 /// AF_InnerBuffer symbols.
-std::unique_ptr<BugReporterVisitor> getInnerPointerBRVisitor(SymbolRef Sym);
+std::unique_ptr<BugReporterVisitor> getInnerPointerBRVisitor(SymExprRef Sym);
 
 /// 'Sym' represents a pointer to the inner buffer of a container object.
 /// This function looks up the memory region of that object in
 /// DanglingInternalBufferChecker's program state map.
-const MemRegion *getContainerObjRegion(ProgramStateRef State, SymbolRef Sym);
+const MemRegion *getContainerObjRegion(ProgramStateRef State, SymExprRef Sym);
 
 } // end namespace allocation_state
 
 } // end namespace ento
 } // end namespace clang
 
 #endif

clang/lib/StaticAnalyzer/Checkers/BasicObjCFoundationChecks.cpp

 }
 
 //===----------------------------------------------------------------------===//
 // Improves the modeling of loops over Cocoa collections.
 //===----------------------------------------------------------------------===//
 
 // The map from container symbol to the container count symbol.
 // We currently will remember the last container count symbol encountered.
-REGISTER_MAP_WITH_PROGRAMSTATE(ContainerCountMap, SymbolRef, SymbolRef)
-REGISTER_MAP_WITH_PROGRAMSTATE(ContainerNonEmptyMap, SymbolRef, bool)
+REGISTER_MAP_WITH_PROGRAMSTATE(ContainerCountMap, SymExprRef, SymExprRef)
+REGISTER_MAP_WITH_PROGRAMSTATE(ContainerNonEmptyMap, SymExprRef, bool)
 
 namespace {
 class ObjCLoopChecker
   : public Checker<check::PostStmt<ObjCForCollectionStmt>,
                    check::PostObjCMessage,
                    check::DeadSymbols,
                    check::PointerEscape > {
   mutable IdentifierInfo *CountSelectorII;
static ProgramStateRef checkElementNonNil(CheckerContext &C,
 
   // Go ahead and assume the value is non-nil.
   SVal Val = State->getSVal(*ElementLoc);
   return State->assume(Val.castAs<DefinedOrUnknownSVal>(), true);
 }
 
 /// Returns NULL state if the collection is known to contain elements
 /// (or is known not to contain elements if the Assumption parameter is false.)
-static ProgramStateRef
-assumeCollectionNonEmpty(CheckerContext &C, ProgramStateRef State,
-                         SymbolRef CollectionS, bool Assumption) {
+static ProgramStateRef assumeCollectionNonEmpty(CheckerContext &C,
+                                                ProgramStateRef State,
+                                                SymExprRef CollectionS,
+                                                bool Assumption) {
   if (!State || !CollectionS)
     return State;
 
-  const SymbolRef *CountS = State->get<ContainerCountMap>(CollectionS);
+  const SymExprRef *CountS = State->get<ContainerCountMap>(CollectionS);
   if (!CountS) {
     const bool *KnownNonEmpty = State->get<ContainerNonEmptyMap>(CollectionS);
     if (!KnownNonEmpty)
       return State->set<ContainerNonEmptyMap>(CollectionS, Assumption);
     return (Assumption == *KnownNonEmpty) ? State : nullptr;
   }
 
   SValBuilder &SvalBuilder = C.getSValBuilder();

 
 static ProgramStateRef
 assumeCollectionNonEmpty(CheckerContext &C, ProgramStateRef State,
                          const ObjCForCollectionStmt *FCS,
                          bool Assumption) {
   if (!State)
     return nullptr;
 
-  SymbolRef CollectionS = C.getSVal(FCS->getCollection()).getAsSymbol();
+  SymExprRef CollectionS = C.getSVal(FCS->getCollection()).getAsSymbol();
   return assumeCollectionNonEmpty(C, State, CollectionS, Assumption);
 }
 
 /// If the fist block edge is a back edge, we are reentering the loop.
 static bool alreadyExecutedAtLeastOneLoopIteration(const ExplodedNode *N,
                                              const ObjCForCollectionStmt *FCS) {
   if (!N)
     return false;
void ObjCLoopChecker::checkPostObjCMessage(const ObjCMethodCall &M,
 
   FoundationClass Class = findKnownClass(ClassID);
   if (Class != FC_NSDictionary &&
       Class != FC_NSArray &&
       Class != FC_NSSet &&
       Class != FC_NSOrderedSet)
     return;
 
-  SymbolRef ContainerS = M.getReceiverSVal().getAsSymbol();
+  SymExprRef ContainerS = M.getReceiverSVal().getAsSymbol();
   if (!ContainerS)
     return;
 
   // If we are processing a call to "count", get the symbolic value returned by
   // a call to "count" and add it to the map.
   if (!isCollectionCountMethod(M, C))
     return;
 
   const Expr *MsgExpr = M.getOriginExpr();
-  SymbolRef CountS = C.getSVal(MsgExpr).getAsSymbol();
+  SymExprRef CountS = C.getSVal(MsgExpr).getAsSymbol();
   if (CountS) {
     ProgramStateRef State = C.getState();
 
     C.getSymbolManager().addSymbolDependency(ContainerS, CountS);
     State = State->set<ContainerCountMap>(ContainerS, CountS);
 
     if (const bool *NonEmpty = State->get<ContainerNonEmptyMap>(ContainerS)) {
       State = State->remove<ContainerNonEmptyMap>(ContainerS);
       State = assumeCollectionNonEmpty(C, State, ContainerS, *NonEmpty);
     }
 
     C.addTransition(State);
   }
 }
 
-static SymbolRef getMethodReceiverIfKnownImmutable(const CallEvent *Call) {
+static SymExprRef getMethodReceiverIfKnownImmutable(const CallEvent *Call) {
   const ObjCMethodCall *Message = dyn_cast_or_null<ObjCMethodCall>(Call);
   if (!Message)
     return nullptr;
 
   const ObjCMethodDecl *MD = Message->getDecl();
   if (!MD)
     return nullptr;
 
static SymExprRef getMethodReceiverIfKnownImmutable(const CallEvent *Call) {
   return Message->getReceiverSVal().getAsSymbol();
 }
 
 ProgramStateRef
 ObjCLoopChecker::checkPointerEscape(ProgramStateRef State,
                                     const InvalidatedSymbols &Escaped,
                                     const CallEvent *Call,
                                     PointerEscapeKind Kind) const {
-  SymbolRef ImmutableReceiver = getMethodReceiverIfKnownImmutable(Call);
+  SymExprRef ImmutableReceiver = getMethodReceiverIfKnownImmutable(Call);
 
   // Remove the invalidated symbols form the collection count map.
   for (InvalidatedSymbols::const_iterator I = Escaped.begin(),
        E = Escaped.end();
        I != E; ++I) {
-    SymbolRef Sym = *I;
+    SymExprRef Sym = *I;
 
     // Don't invalidate this symbol's count if we know the method being called
     // is declared on an immutable class. This isn't completely correct if the
     // receiver is also passed as an argument, but in most uses of NSArray,
     // NSDictionary, etc. this isn't likely to happen in a dangerous way.
     if (Sym == ImmutableReceiver)
       continue;
 
     // The symbol escaped. Pessimistically, assume that the count could have
     // changed.
     State = State->remove<ContainerCountMap>(Sym);
     State = State->remove<ContainerNonEmptyMap>(Sym);
   }
   return State;
 }
 
 void ObjCLoopChecker::checkDeadSymbols(SymbolReaper &SymReaper,
                                        CheckerContext &C) const {
   ProgramStateRef State = C.getState();
 
   // Remove the dead symbols from the collection count map.
   ContainerCountMapTy Tracked = State->get<ContainerCountMap>();
   for (ContainerCountMapTy::iterator I = Tracked.begin(),
                                      E = Tracked.end(); I != E; ++I) {
-    SymbolRef Sym = I->first;
+    SymExprRef Sym = I->first;
     if (SymReaper.isDead(Sym)) {
       State = State->remove<ContainerCountMap>(Sym);
       State = State->remove<ContainerNonEmptyMap>(Sym);
     }
   }
 
   C.addTransition(State);
 }

clang/lib/StaticAnalyzer/Checkers/BlockInCriticalSectionChecker.cpp

class BlockInCriticalSectionChecker : public Checker<check::PostCall> {
   StringRef ClassLockGuard, ClassUniqueLock;
 
   mutable bool IdentifierInfoInitialized;
 
   std::unique_ptr<BugType> BlockInCritSectionBugType;
 
   void initIdentifierInfo(ASTContext &Ctx) const;
 
-  void reportBlockInCritSection(SymbolRef FileDescSym,
-                                const CallEvent &call,
+  void reportBlockInCritSection(SymExprRef FileDescSym, const CallEvent &call,
                                 CheckerContext &C) const;
 
 public:
   BlockInCriticalSectionChecker();
 
   bool isBlockingFunction(const CallEvent &Call) const;
   bool isLockFunction(const CallEvent &Call) const;
   bool isUnlockFunction(const CallEvent &Call) const;
void BlockInCriticalSectionChecker::checkPostCall(const CallEvent &Call,
   unsigned mutexCount = State->get<MutexCounter>();
   if (isUnlockFunction(Call) && mutexCount > 0) {
     State = State->set<MutexCounter>(--mutexCount);
     C.addTransition(State);
   } else if (isLockFunction(Call)) {
     State = State->set<MutexCounter>(++mutexCount);
     C.addTransition(State);
   } else if (mutexCount > 0) {
-    SymbolRef BlockDesc = Call.getReturnValue().getAsSymbol();
+    SymExprRef BlockDesc = Call.getReturnValue().getAsSymbol();
     reportBlockInCritSection(BlockDesc, Call, C);
   }
 }
 
 void BlockInCriticalSectionChecker::reportBlockInCritSection(
-    SymbolRef BlockDescSym, const CallEvent &Call, CheckerContext &C) const {
+    SymExprRef BlockDescSym, const CallEvent &Call, CheckerContext &C) const {
   ExplodedNode *ErrNode = C.generateNonFatalErrorNode();
   if (!ErrNode)
     return;
 
   std::string msg;
   llvm::raw_string_ostream os(msg);
   os << "Call to blocking function '" << Call.getCalleeIdentifier()->getName()
      << "' inside of critical section";

clang/lib/StaticAnalyzer/Checkers/CStringChecker.cpp

void CStringChecker::checkDeadSymbols(SymbolReaper &SR,
   CStringLengthTy Entries = state->get<CStringLength>();
   if (Entries.isEmpty())
     return;
 
   CStringLengthTy::Factory &F = state->get_context<CStringLength>();
   for (CStringLengthTy::iterator I = Entries.begin(), E = Entries.end();
       I != E; ++I) {
     SVal Len = I.getData();
-    if (SymbolRef Sym = Len.getAsSymbol()) {
+    if (SymExprRef Sym = Len.getAsSymbol()) {
       if (SR.isDead(Sym))
         Entries = F.remove(Entries, I.getKey());
     }
   }
 
   state = state->set<CStringLength>(Entries);
   C.addTransition(state);
 }

clang/lib/StaticAnalyzer/Checkers/CheckObjCDealloc.cpp

ProgramStateRef checkPointerEscape(ProgramStateRef State,
                                      const CallEvent *Call,
                                      PointerEscapeKind Kind) const;
   void checkPreStmt(const ReturnStmt *RS, CheckerContext &C) const;
   void checkEndFunction(const ReturnStmt *RS, CheckerContext &Ctx) const;
 
 private:
   void diagnoseMissingReleases(CheckerContext &C) const;
 
-  bool diagnoseExtraRelease(SymbolRef ReleasedValue, const ObjCMethodCall &M,
+  bool diagnoseExtraRelease(SymExprRef ReleasedValue, const ObjCMethodCall &M,
                             CheckerContext &C) const;
 
-  bool diagnoseMistakenDealloc(SymbolRef DeallocedValue,
+  bool diagnoseMistakenDealloc(SymExprRef DeallocedValue,
                                const ObjCMethodCall &M,
                                CheckerContext &C) const;
 
-  SymbolRef getValueReleasedByNillingOut(const ObjCMethodCall &M,
+  SymExprRef getValueReleasedByNillingOut(const ObjCMethodCall &M,
                                           CheckerContext &C) const;
 
-  const ObjCIvarRegion *getIvarRegionForIvarSymbol(SymbolRef IvarSym) const;
-  SymbolRef getInstanceSymbolFromIvarSymbol(SymbolRef IvarSym) const;
+  const ObjCIvarRegion *getIvarRegionForIvarSymbol(SymExprRef IvarSym) const;
+  SymExprRef getInstanceSymbolFromIvarSymbol(SymExprRef IvarSym) const;
 
-  const ObjCPropertyImplDecl*
-  findPropertyOnDeallocatingInstance(SymbolRef IvarSym,
+  const ObjCPropertyImplDecl *
+  findPropertyOnDeallocatingInstance(SymExprRef IvarSym,
                                      CheckerContext &C) const;
 
   ReleaseRequirement
   getDeallocReleaseRequirement(const ObjCPropertyImplDecl *PropImpl) const;
 
   bool isInInstanceDealloc(const CheckerContext &C, SVal &SelfValOut) const;
   bool isInInstanceDealloc(const CheckerContext &C, const LocationContext *LCtx,
                            SVal &SelfValOut) const;
   bool instanceDeallocIsOnStack(const CheckerContext &C,
                                 SVal &InstanceValOut) const;
 
   bool isSuperDeallocMessage(const ObjCMethodCall &M) const;
 
   const ObjCImplDecl *getContainingObjCImpl(const LocationContext *LCtx) const;
 
   const ObjCPropertyDecl *
   findShadowedPropertyDecl(const ObjCPropertyImplDecl *PropImpl) const;
 
-  void transitionToReleaseValue(CheckerContext &C, SymbolRef Value) const;
+  void transitionToReleaseValue(CheckerContext &C, SymExprRef Value) const;
   ProgramStateRef removeValueRequiringRelease(ProgramStateRef State,
-                                              SymbolRef InstanceSym,
-                                              SymbolRef ValueSym) const;
+                                              SymExprRef InstanceSym,
+                                              SymExprRef ValueSym) const;
 
   void initIdentifierInfoAndSelectors(ASTContext &Ctx) const;
 
   bool classHasSeparateTeardown(const ObjCInterfaceDecl *ID) const;
 
   bool isReleasedByCIFilterDealloc(const ObjCPropertyImplDecl *PropImpl) const;
   bool isNibLoadedIvarWithoutRetain(const ObjCPropertyImplDecl *PropImpl) const;
 };
 } // End anonymous namespace.
 
 
 /// Maps from the symbol for a class instance to the set of
 /// symbols remaining that must be released in -dealloc.
-REGISTER_SET_FACTORY_WITH_PROGRAMSTATE(SymbolSet, SymbolRef)
-REGISTER_MAP_WITH_PROGRAMSTATE(UnreleasedIvarMap, SymbolRef, SymbolSet)
-
+REGISTER_SET_FACTORY_WITH_PROGRAMSTATE(SymbolSet, SymExprRef)
+REGISTER_MAP_WITH_PROGRAMSTATE(UnreleasedIvarMap, SymExprRef, SymbolSet)
 
 /// An AST check that diagnose when the class requires a -dealloc method and
 /// is missing one.
 void ObjCDeallocChecker::checkASTDecl(const ObjCImplementationDecl *D,
                                       AnalysisManager &Mgr,
                                       BugReporter &BR) const {
   assert(Mgr.getLangOpts().getGC() != LangOptions::GCOnly);
   assert(!Mgr.getLangOpts().ObjCAutoRefCount);
void ObjCDeallocChecker::checkBeginFunction(
     CheckerContext &C) const {
   initIdentifierInfoAndSelectors(C.getASTContext());
 
   // Only do this if the current method is -dealloc.
   SVal SelfVal;
   if (!isInInstanceDealloc(C, SelfVal))
     return;
 
-  SymbolRef SelfSymbol = SelfVal.getAsSymbol();
+  SymExprRef SelfSymbol = SelfVal.getAsSymbol();
 
   const LocationContext *LCtx = C.getLocationContext();
   ProgramStateRef InitialState = C.getState();
 
   ProgramStateRef State = InitialState;
 
   SymbolSet::Factory &F = State->getStateManager().get_context<SymbolSet>();
 
if (Requirement != ReleaseRequirement::MustRelease)
       continue;
 
     SVal LVal = State->getLValue(PropImpl->getPropertyIvarDecl(), SelfVal);
     Optional<Loc> LValLoc = LVal.getAs<Loc>();
     if (!LValLoc)
       continue;
 
     SVal InitialVal = State->getSVal(LValLoc.getValue());
-    SymbolRef Symbol = InitialVal.getAsSymbol();
+    SymExprRef Symbol = InitialVal.getAsSymbol();
     if (!Symbol || !isa<SymbolRegionValue>(Symbol))
       continue;
 
     // Mark the value as requiring a release.
     RequiredReleases = F.add(RequiredReleases, Symbol);
   }
 
   if (!RequiredReleases.isEmpty()) {
     State = State->set<UnreleasedIvarMap>(SelfSymbol, RequiredReleases);
   }
 
   if (State != InitialState) {
     C.addTransition(State);
   }
 }
 
 /// Given a symbol for an ivar, return the ivar region it was loaded from.
 /// Returns nullptr if the instance symbol cannot be found.
 const ObjCIvarRegion *
-ObjCDeallocChecker::getIvarRegionForIvarSymbol(SymbolRef IvarSym) const {
+ObjCDeallocChecker::getIvarRegionForIvarSymbol(SymExprRef IvarSym) const {
   return dyn_cast_or_null<ObjCIvarRegion>(IvarSym->getOriginRegion());
 }
 
 /// Given a symbol for an ivar, return a symbol for the instance containing
 /// the ivar. Returns nullptr if the instance symbol cannot be found.
-SymbolRef
-ObjCDeallocChecker::getInstanceSymbolFromIvarSymbol(SymbolRef IvarSym) const {
+SymExprRef
+ObjCDeallocChecker::getInstanceSymbolFromIvarSymbol(SymExprRef IvarSym) const {
 
   const ObjCIvarRegion *IvarRegion = getIvarRegionForIvarSymbol(IvarSym);
   if (!IvarRegion)
     return nullptr;
 
   return IvarRegion->getSymbolicBase()->getSymbol();
 }
 
 /// If we are in -dealloc or -dealloc is on the stack, handle the call if it is
 /// a release or a nilling-out property setter.
 void ObjCDeallocChecker::checkPreObjCMessage(
     const ObjCMethodCall &M, CheckerContext &C) const {
   // Only run if -dealloc is on the stack.
   SVal DeallocedInstance;
   if (!instanceDeallocIsOnStack(C, DeallocedInstance))
     return;
 
-  SymbolRef ReleasedValue = nullptr;
+  SymExprRef ReleasedValue = nullptr;
 
   if (M.getSelector() == ReleaseSel) {
     ReleasedValue = M.getReceiverSVal().getAsSymbol();
   } else if (M.getSelector() == DeallocSel && !M.isReceiverSelfOrSuper()) {
     if (diagnoseMistakenDealloc(M.getReceiverSVal().getAsSymbol(), M, C))
       return;
   }
 
void ObjCDeallocChecker::checkPreCall(const CallEvent &Call,
                                       CheckerContext &C) const {
   const IdentifierInfo *II = Call.getCalleeIdentifier();
   if (II != Block_releaseII)
     return;
 
   if (Call.getNumArgs() != 1)
     return;
 
-  SymbolRef ReleasedValue = Call.getArgSVal(0).getAsSymbol();
+  SymExprRef ReleasedValue = Call.getArgSVal(0).getAsSymbol();
   if (!ReleasedValue)
     return;
 
   transitionToReleaseValue(C, ReleasedValue);
 }
 /// If the message was a call to '[super dealloc]', diagnose any missing
 /// releases.
 void ObjCDeallocChecker::checkPostObjCMessage(
ProgramStateRef ObjCDeallocChecker::evalAssume(ProgramStateRef State, SVal Cond,
   if (Assumption) {
     if (OpCode != BO_EQ)
       return State;
   } else {
     if (OpCode != BO_NE)
       return State;
   }
 
-  SymbolRef NullSymbol = nullptr;
+  SymExprRef NullSymbol = nullptr;
   if (auto *SIE = dyn_cast<SymIntExpr>(CondBSE)) {
     const llvm::APInt &RHS = SIE->getRHS();
     if (RHS != 0)
       return State;
     NullSymbol = SIE->getLHS();
   } else if (auto *SIE = dyn_cast<IntSymExpr>(CondBSE)) {
     const llvm::APInt &LHS = SIE->getLHS();
     if (LHS != 0)
       return State;
     NullSymbol = SIE->getRHS();
   } else {
     return State;
   }
 
-  SymbolRef InstanceSymbol = getInstanceSymbolFromIvarSymbol(NullSymbol);
+  SymExprRef InstanceSymbol = getInstanceSymbolFromIvarSymbol(NullSymbol);
   if (!InstanceSymbol)
     return State;
 
   State = removeValueRequiringRelease(State, InstanceSymbol, NullSymbol);
 
   return State;
 }
 
if (!Call || (Call && !Call->isInSystemHeader())) {
       // unless via a call to a system function. System functions are
       // very unlikely to release instance variables on objects passed to them,
       // and are frequently called on 'self' in -dealloc (e.g., to remove
       // observers) -- we want to avoid false negatives from escaping on
       // them.
       State = State->remove<UnreleasedIvarMap>(Sym);
     }
 
-
-    SymbolRef InstanceSymbol = getInstanceSymbolFromIvarSymbol(Sym);
+    SymExprRef InstanceSymbol = getInstanceSymbolFromIvarSymbol(Sym);
     if (!InstanceSymbol)
       continue;
 
     State = removeValueRequiringRelease(State, InstanceSymbol, Sym);
   }
 
   return State;
 }
 
 /// Report any unreleased instance variables for the current instance being
 /// dealloced.
 void ObjCDeallocChecker::diagnoseMissingReleases(CheckerContext &C) const {
   ProgramStateRef State = C.getState();
 
   SVal SelfVal;
   if (!isInInstanceDealloc(C, SelfVal))
     return;
 
   const MemRegion *SelfRegion = SelfVal.castAs<loc::MemRegionVal>().getRegion();
   const LocationContext *LCtx = C.getLocationContext();
 
   ExplodedNode *ErrNode = nullptr;
 
-  SymbolRef SelfSym = SelfVal.getAsSymbol();
+  SymExprRef SelfSym = SelfVal.getAsSymbol();
   if (!SelfSym)
     return;
 
   const SymbolSet *OldUnreleased = State->get<UnreleasedIvarMap>(SelfSym);
   if (!OldUnreleased)
     return;
 
   SymbolSet NewUnreleased = *OldUnreleased;
void ObjCDeallocChecker::diagnoseMissingReleases(CheckerContext &C) const {
   assert(!LCtx->inTopFrame() || State->get<UnreleasedIvarMap>().isEmpty());
 }
 
 /// Given a symbol, determine whether the symbol refers to an ivar on
 /// the top-most deallocating instance. If so, find the property for that
 /// ivar, if one exists. Otherwise return null.
 const ObjCPropertyImplDecl *
 ObjCDeallocChecker::findPropertyOnDeallocatingInstance(
-    SymbolRef IvarSym, CheckerContext &C) const {
+    SymExprRef IvarSym, CheckerContext &C) const {
   SVal DeallocedInstance;
   if (!isInInstanceDealloc(C, DeallocedInstance))
     return nullptr;
 
   // Try to get the region from which the ivar value was loaded.
   auto *IvarRegion = getIvarRegionForIvarSymbol(IvarSym);
   if (!IvarRegion)
     return nullptr;
ObjCDeallocChecker::findPropertyOnDeallocatingInstance(
   const ObjCPropertyImplDecl *PropImpl =
       Container->FindPropertyImplIvarDecl(IvarDecl->getIdentifier());
   return PropImpl;
 }
 
 /// Emits a warning if the current context is -dealloc and ReleasedValue
 /// must not be directly released in a -dealloc. Returns true if a diagnostic
 /// was emitted.
-bool ObjCDeallocChecker::diagnoseExtraRelease(SymbolRef ReleasedValue,
+bool ObjCDeallocChecker::diagnoseExtraRelease(SymExprRef ReleasedValue,
                                               const ObjCMethodCall &M,
                                               CheckerContext &C) const {
   // Try to get the region from which the released value was loaded.
   // Note that, unlike diagnosing for missing releases, here we don't track
   // values that must not be released in the state. This is because even if
   // these values escape, it is still an error under the rules of MRR to
   // release them in -dealloc.
   const ObjCPropertyImplDecl *PropImpl =
bool ObjCDeallocChecker::diagnoseExtraRelease(SymExprRef ReleasedValue,
   C.emitReport(std::move(BR));
 
   return true;
 }
 
 /// Emits a warning if the current context is -dealloc and DeallocedValue
 /// must not be directly dealloced in a -dealloc. Returns true if a diagnostic
 /// was emitted.
-bool ObjCDeallocChecker::diagnoseMistakenDealloc(SymbolRef DeallocedValue,
+bool ObjCDeallocChecker::diagnoseMistakenDealloc(SymExprRef DeallocedValue,
                                                  const ObjCMethodCall &M,
                                                  CheckerContext &C) const {
   // TODO: Apart from unknown/undefined receivers, this may happen when
   // dealloc is called as a class method. Should we warn?
   if (!DeallocedValue)
     return false;
 
   // Find the property backing the instance variable that M
for (DeclContext::lookup_iterator I = R.begin(), E = R.end(); I != E; ++I) {
     }
   }
 
   return nullptr;
 }
 
 /// Add a transition noting the release of the given value.
 void ObjCDeallocChecker::transitionToReleaseValue(CheckerContext &C,
-                                                  SymbolRef Value) const {
+                                                  SymExprRef Value) const {
   assert(Value);
-  SymbolRef InstanceSym = getInstanceSymbolFromIvarSymbol(Value);
+  SymExprRef InstanceSym = getInstanceSymbolFromIvarSymbol(Value);
   if (!InstanceSym)
     return;
   ProgramStateRef InitialState = C.getState();
 
   ProgramStateRef ReleasedState =
       removeValueRequiringRelease(InitialState, InstanceSym, Value);
 
   if (ReleasedState != InitialState) {
     C.addTransition(ReleasedState);
   }
 }
 
 /// Remove the Value requiring a release from the tracked set for
 /// Instance and return the resultant state.
 ProgramStateRef ObjCDeallocChecker::removeValueRequiringRelease(
-    ProgramStateRef State, SymbolRef Instance, SymbolRef Value) const {
+    ProgramStateRef State, SymExprRef Instance, SymExprRef Value) const {
   assert(Instance);
   assert(Value);
   const ObjCIvarRegion *RemovedRegion = getIvarRegionForIvarSymbol(Value);
   if (!RemovedRegion)
     return State;
 
   const SymbolSet *Unreleased = State->get<UnreleasedIvarMap>(Instance);
   if (!Unreleased)
case ObjCPropertyDecl::Assign:
 
     return ReleaseRequirement::MustNotReleaseDirectly;
   }
   llvm_unreachable("Unrecognized setter kind");
 }
 
 /// Returns the released value if M is a call a setter that releases
 /// and nils out its underlying instance variable.
-SymbolRef
+SymExprRef
 ObjCDeallocChecker::getValueReleasedByNillingOut(const ObjCMethodCall &M,
                                                  CheckerContext &C) const {
   SVal ReceiverVal = M.getReceiverSVal();
   if (!ReceiverVal.isValid())
     return nullptr;
 
   if (M.getNumArgs() == 0)
     return nullptr;

clang/lib/StaticAnalyzer/Checkers/ContainerModeling.cpp

                                                           
 };
 
 bool isBeginCall(const FunctionDecl *Func);
 bool isEndCall(const FunctionDecl *Func);
 bool hasSubscriptOperator(ProgramStateRef State, const MemRegion *Reg);
 bool frontModifiable(ProgramStateRef State, const MemRegion *Reg);
 bool backModifiable(ProgramStateRef State, const MemRegion *Reg);
-SymbolRef getContainerBegin(ProgramStateRef State, const MemRegion *Cont);
-SymbolRef getContainerEnd(ProgramStateRef State, const MemRegion *Cont);
+SymExprRef getContainerBegin(ProgramStateRef State, const MemRegion *Cont);
+SymExprRef getContainerEnd(ProgramStateRef State, const MemRegion *Cont);
 ProgramStateRef createContainerBegin(ProgramStateRef State,
                                      const MemRegion *Cont, const Expr *E,
                                      QualType T, const LocationContext *LCtx,
                                      unsigned BlockCount);
 ProgramStateRef createContainerEnd(ProgramStateRef State, const MemRegion *Cont,
                                    const Expr *E, QualType T,
                                    const LocationContext *LCtx,
                                    unsigned BlockCount);
 ProgramStateRef setContainerData(ProgramStateRef State, const MemRegion *Cont,
                                  const ContainerData &CData);
 ProgramStateRef invalidateAllIteratorPositions(ProgramStateRef State,
                                                const MemRegion *Cont);
 ProgramStateRef
 invalidateAllIteratorPositionsExcept(ProgramStateRef State,
-                                     const MemRegion *Cont, SymbolRef Offset,
+                                     const MemRegion *Cont, SymExprRef Offset,
                                      BinaryOperator::Opcode Opc);
 ProgramStateRef invalidateIteratorPositions(ProgramStateRef State,
-                                            SymbolRef Offset,
+                                            SymExprRef Offset,
                                             BinaryOperator::Opcode Opc);
 ProgramStateRef invalidateIteratorPositions(ProgramStateRef State,
-                                            SymbolRef Offset1,
+                                            SymExprRef Offset1,
                                             BinaryOperator::Opcode Opc1,
-                                            SymbolRef Offset2,
+                                            SymExprRef Offset2,
                                             BinaryOperator::Opcode Opc2);
 ProgramStateRef reassignAllIteratorPositions(ProgramStateRef State,
                                              const MemRegion *Cont,
                                              const MemRegion *NewCont);
 ProgramStateRef reassignAllIteratorPositionsUnless(ProgramStateRef State,
                                                    const MemRegion *Cont,
                                                    const MemRegion *NewCont,
-                                                   SymbolRef Offset,
+                                                   SymExprRef Offset,
                                                    BinaryOperator::Opcode Opc);
 ProgramStateRef rebaseSymbolInIteratorPositionsIf(
-    ProgramStateRef State, SValBuilder &SVB, SymbolRef OldSym,
-    SymbolRef NewSym, SymbolRef CondSym, BinaryOperator::Opcode Opc);
-SymbolRef rebaseSymbol(ProgramStateRef State, SValBuilder &SVB, SymbolRef Expr,
-                        SymbolRef OldSym, SymbolRef NewSym);
+    ProgramStateRef State, SValBuilder &SVB, SymExprRef OldSym,
+    SymExprRef NewSym, SymExprRef CondSym, BinaryOperator::Opcode Opc);
+SymExprRef rebaseSymbol(ProgramStateRef State, SValBuilder &SVB,
+                        SymExprRef Expr, SymExprRef OldSym, SymExprRef NewSym);
 bool hasLiveIterators(ProgramStateRef State, const MemRegion *Cont);
 
 } // namespace
 
 void ContainerModeling::checkPostCall(const CallEvent &Call,
                                      CheckerContext &C) const {
   const auto *Func = dyn_cast_or_null<FunctionDecl>(Call.getDecl());
   if (!Func)
if (!Method->getDeclName().isIdentifier())
       continue;
     if (Method->getName() == "push_back" || Method->getName() == "pop_back") {
       return true;
     }
   }
   return false;
 }
 
-SymbolRef getContainerBegin(ProgramStateRef State, const MemRegion *Cont) {
+SymExprRef getContainerBegin(ProgramStateRef State, const MemRegion *Cont) {
   const auto *CDataPtr = getContainerData(State, Cont);
   if (!CDataPtr)
     return nullptr;
 
   return CDataPtr->getBegin();
 }
 
-SymbolRef getContainerEnd(ProgramStateRef State, const MemRegion *Cont) {
+SymExprRef getContainerEnd(ProgramStateRef State, const MemRegion *Cont) {
   const auto *CDataPtr = getContainerData(State, Cont);
   if (!CDataPtr)
     return nullptr;
 
   return CDataPtr->getEnd();
 }
 
 ProgramStateRef createContainerBegin(ProgramStateRef State,
ProgramStateRef invalidateAllIteratorPositions(ProgramStateRef State,
   auto Invalidate = [&](const IteratorPosition &Pos) {
     return Pos.invalidate();
   };
   return processIteratorPositions(State, MatchCont, Invalidate);
 }
 
 ProgramStateRef
 invalidateAllIteratorPositionsExcept(ProgramStateRef State,
-                                     const MemRegion *Cont, SymbolRef Offset,
+                                     const MemRegion *Cont, SymExprRef Offset,
                                      BinaryOperator::Opcode Opc) {
   auto MatchContAndCompare = [&](const IteratorPosition &Pos) {
     return Pos.getContainer() == Cont &&
            !compare(State, Pos.getOffset(), Offset, Opc);
   };
   auto Invalidate = [&](const IteratorPosition &Pos) {
     return Pos.invalidate();
   };
   return processIteratorPositions(State, MatchContAndCompare, Invalidate);
 }
 
 ProgramStateRef invalidateIteratorPositions(ProgramStateRef State,
-                                            SymbolRef Offset,
+                                            SymExprRef Offset,
                                             BinaryOperator::Opcode Opc) {
   auto Compare = [&](const IteratorPosition &Pos) {
     return compare(State, Pos.getOffset(), Offset, Opc);
   };
   auto Invalidate = [&](const IteratorPosition &Pos) {
     return Pos.invalidate();
   };
   return processIteratorPositions(State, Compare, Invalidate);
 }
 
 ProgramStateRef invalidateIteratorPositions(ProgramStateRef State,
-                                            SymbolRef Offset1,
+                                            SymExprRef Offset1,
                                             BinaryOperator::Opcode Opc1,
-                                            SymbolRef Offset2,
+                                            SymExprRef Offset2,
                                             BinaryOperator::Opcode Opc2) {
   auto Compare = [&](const IteratorPosition &Pos) {
     return compare(State, Pos.getOffset(), Offset1, Opc1) &&
            compare(State, Pos.getOffset(), Offset2, Opc2);
   };
   auto Invalidate = [&](const IteratorPosition &Pos) {
     return Pos.invalidate();
   };
auto ReAssign = [&](const IteratorPosition &Pos) {
     return Pos.reAssign(NewCont);
   };
   return processIteratorPositions(State, MatchCont, ReAssign);
 }
 
 ProgramStateRef reassignAllIteratorPositionsUnless(ProgramStateRef State,
                                                    const MemRegion *Cont,
                                                    const MemRegion *NewCont,
-                                                   SymbolRef Offset,
+                                                   SymExprRef Offset,
                                                    BinaryOperator::Opcode Opc) {
   auto MatchContAndCompare = [&](const IteratorPosition &Pos) {
     return Pos.getContainer() == Cont &&
     !compare(State, Pos.getOffset(), Offset, Opc);
   };
   auto ReAssign = [&](const IteratorPosition &Pos) {
     return Pos.reAssign(NewCont);
   };
   return processIteratorPositions(State, MatchContAndCompare, ReAssign);
 }
 
 // This function rebases symbolic expression `OldSym + Int` to `NewSym + Int`,
 // `OldSym - Int` to `NewSym - Int` and  `OldSym` to `NewSym` in any iterator
 // position offsets where `CondSym` is true.
 ProgramStateRef rebaseSymbolInIteratorPositionsIf(
-    ProgramStateRef State, SValBuilder &SVB, SymbolRef OldSym,
-    SymbolRef NewSym, SymbolRef CondSym, BinaryOperator::Opcode Opc) {
+    ProgramStateRef State, SValBuilder &SVB, SymExprRef OldSym,
+    SymExprRef NewSym, SymExprRef CondSym, BinaryOperator::Opcode Opc) {
   auto LessThanEnd = [&](const IteratorPosition &Pos) {
     return compare(State, Pos.getOffset(), CondSym, Opc);
   };
   auto RebaseSymbol = [&](const IteratorPosition &Pos) {
     return Pos.setTo(rebaseSymbol(State, SVB, Pos.getOffset(), OldSym,
                                    NewSym));
   };
   return processIteratorPositions(State, LessThanEnd, RebaseSymbol);
 }
 
 // This function rebases symbolic expression `OldExpr + Int` to `NewExpr + Int`,
 // `OldExpr - Int` to `NewExpr - Int` and  `OldExpr` to `NewExpr` in expression
 // `OrigExpr`.
-SymbolRef rebaseSymbol(ProgramStateRef State, SValBuilder &SVB,
-                       SymbolRef OrigExpr, SymbolRef OldExpr,
-                       SymbolRef NewSym) {
+SymExprRef rebaseSymbol(ProgramStateRef State, SValBuilder &SVB,
+                        SymExprRef OrigExpr, SymExprRef OldExpr,
+                        SymExprRef NewSym) {
   auto &SymMgr = SVB.getSymbolManager();
   auto Diff = SVB.evalBinOpNN(State, BO_Sub, nonloc::SymbolVal(OrigExpr),
                               nonloc::SymbolVal(OldExpr), 
                               SymMgr.getType(OrigExpr));
 
   const auto DiffInt = Diff.getAs<nonloc::ConcreteInt>();
   if (!DiffInt)
     return OrigExpr;

clang/lib/StaticAnalyzer/Checkers/DebugContainerModeling.cpp

if (CE->getNumArgs() == 0) {
     return;
   }
 
   auto State = C.getState();
   const MemRegion *Cont = C.getSVal(CE->getArg(0)).getAsRegion();
   if (Cont) {
     const auto *Data = getContainerData(State, Cont);
     if (Data) {
-      SymbolRef Field = get(Data);
+      SymExprRef Field = get(Data);
       if (Field) {
         State = State->BindExpr(CE, C.getLocationContext(),
                                 nonloc::SymbolVal(Field));
 
         // Progpagate interestingness from the container's data (marked
         // interesting by an `ExprInspection` debug call to the container
         // itself.
         const NoteTag *InterestingTag =

clang/lib/StaticAnalyzer/Checkers/DynamicTypePropagation.cpp

 // ProgramState trait - The type inflation is tracked by DynamicTypeMap. This is
 // an auxiliary map that tracks more information about generic types, because in
 // some cases the most derived type is not the most informative one about the
 // type parameters. This types that are stored for each symbol in this map must
 // be specialized.
 // TODO: In some case the type stored in this map is exactly the same that is
 // stored in DynamicTypeMap. We should no store duplicated information in those
 // cases.
-REGISTER_MAP_WITH_PROGRAMSTATE(MostSpecializedTypeArgsMap, SymbolRef,
+REGISTER_MAP_WITH_PROGRAMSTATE(MostSpecializedTypeArgsMap, SymExprRef,
                                const ObjCObjectPointerType *)
 
 namespace {
 class DynamicTypePropagation:
     public Checker< check::PreCall,
                     check::PostCall,
                     check::DeadSymbols,
                     check::PostStmt<CastExpr>,
class DynamicTypePropagation:
   void initBugType() const {
     if (!ObjCGenericsBugType)
       ObjCGenericsBugType.reset(new BugType(
           GenericCheckName, "Generics", categories::CoreFoundationObjectiveC));
   }
 
   class GenericsBugVisitor : public BugReporterVisitor {
   public:
-    GenericsBugVisitor(SymbolRef S) : Sym(S) {}
+    GenericsBugVisitor(SymExprRef S) : Sym(S) {}
 
     void Profile(llvm::FoldingSetNodeID &ID) const override {
       static int X = 0;
       ID.AddPointer(&X);
       ID.AddPointer(Sym);
     }
 
     PathDiagnosticPieceRef VisitNode(const ExplodedNode *N,
                                      BugReporterContext &BRC,
                                      PathSensitiveBugReport &BR) override;
 
   private:
     // The tracked symbol.
-    SymbolRef Sym;
+    SymExprRef Sym;
   };
 
   void reportGenericsBug(const ObjCObjectPointerType *From,
                          const ObjCObjectPointerType *To, ExplodedNode *N,
-                         SymbolRef Sym, CheckerContext &C,
+                         SymExprRef Sym, CheckerContext &C,
                          const Stmt *ReportedNode = nullptr) const;
 
 public:
   void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
   void checkPostCall(const CallEvent &Call, CheckerContext &C) const;
   void checkPostStmt(const CastExpr *CastE, CheckerContext &C) const;
   void checkPostStmt(const CXXNewExpr *NewE, CheckerContext &C) const;
   void checkDeadSymbols(SymbolReaper &SR, CheckerContext &C) const;
RuntimeType inferReceiverType(const ObjCMethodCall &Message,
   ProgramStateRef State = C.getState();
 
   if (const MemRegion *ReceiverRegion = ReceiverSVal.getAsRegion()) {
     if (DynamicTypeInfo DTI = getDynamicTypeInfo(State, ReceiverRegion)) {
       InferredType = DTI.getType().getCanonicalType();
     }
   }
 
-  if (SymbolRef ReceiverSymbol = ReceiverSVal.getAsSymbol()) {
+  if (SymExprRef ReceiverSymbol = ReceiverSVal.getAsSymbol()) {
     if (InferredType.isNull()) {
       InferredType = ReceiverSymbol->getType();
     }
 
     // If receiver is a Class object, we want to figure out the type it
     // represents.
     if (isObjCClassType(InferredType)) {
       // We actually might have some info on what type is contained in there.

 ///   (3) \p Current <: \p StaticLowerBound <: \p StaticUpperBound
 ///   (4) \p StaticLowerBound <: \p StaticUpperBound <: \p Current
 /// Effect:
 ///   Use getMostInformativeDerivedClass with the upper and lower bound of the
 ///   set {\p StaticLowerBound, \p Current, \p StaticUpperBound}. The computed
 ///   lower bound must be specialized. If the result differs from \p Current or
 ///   \p Current is null, store the result.
 static bool
-storeWhenMoreInformative(ProgramStateRef &State, SymbolRef Sym,
+storeWhenMoreInformative(ProgramStateRef &State, SymExprRef Sym,
                          const ObjCObjectPointerType *const *Current,
                          const ObjCObjectPointerType *StaticLowerBound,
                          const ObjCObjectPointerType *StaticUpperBound,
                          ASTContext &C) {
   // TODO: The above 4 cases are not exhaustive. In particular, it is possible
   // for Current to be incomparable with StaticLowerBound, StaticUpperBound,
   // or both.
   //
void DynamicTypePropagation::checkPostStmt(const CastExpr *CE,
   // methods in the tracked type first.
   OrigObjectPtrType = OrigObjectPtrType->stripObjCKindOfTypeAndQuals(ASTCtxt);
   DestObjectPtrType = DestObjectPtrType->stripObjCKindOfTypeAndQuals(ASTCtxt);
 
   if (OrigObjectPtrType->isUnspecialized() &&
       DestObjectPtrType->isUnspecialized())
     return;
 
-  SymbolRef Sym = C.getSVal(CE).getAsSymbol();
+  SymExprRef Sym = C.getSVal(CE).getAsSymbol();
   if (!Sym)
     return;
 
   const ObjCObjectPointerType *const *TrackedType =
       State->get<MostSpecializedTypeArgsMap>(Sym);
 
   if (isa<ExplicitCastExpr>(CE)) {
     // Treat explicit casts as an indication from the programmer that the
static QualType getReturnTypeForMethod(
   return ResultType;
 }
 
 /// When the receiver has a tracked type, use that type to validate the
 /// argumments of the message expression and the return value.
 void DynamicTypePropagation::checkPreObjCMessage(const ObjCMethodCall &M,
                                                  CheckerContext &C) const {
   ProgramStateRef State = C.getState();
-  SymbolRef Sym = M.getReceiverSVal().getAsSymbol();
+  SymExprRef Sym = M.getReceiverSVal().getAsSymbol();
   if (!Sym)
     return;
 
   const ObjCObjectPointerType *const *TrackedType =
       State->get<MostSpecializedTypeArgsMap>(Sym);
   if (!TrackedType)
     return;
 
for (unsigned i = 0; i < Method->param_size(); i++) {
     const auto *ArgObjectPtrType =
         stripCastsAndSugar(Arg)->getType()->getAs<ObjCObjectPointerType>();
     if (!ParamObjectPtrType || !ArgObjectPtrType)
       continue;
 
     // Check if we have more concrete tracked type that is not a super type of
     // the static argument type.
     SVal ArgSVal = M.getArgSVal(i);
-    SymbolRef ArgSym = ArgSVal.getAsSymbol();
+    SymExprRef ArgSym = ArgSVal.getAsSymbol();
     if (ArgSym) {
       const ObjCObjectPointerType *const *TrackedArgType =
           State->get<MostSpecializedTypeArgsMap>(ArgSym);
       if (TrackedArgType &&
           ASTCtxt.canAssignObjCInterfaces(ArgObjectPtrType, *TrackedArgType)) {
         ArgObjectPtrType = *TrackedArgType;
       }
     }

 /// This method is also used to infer the type information for the return
 /// types.
 // TODO: right now it only tracks generic types. Extend this to track every
 // type in the DynamicTypeMap and diagnose type errors!
 void DynamicTypePropagation::checkPostObjCMessage(const ObjCMethodCall &M,
                                                   CheckerContext &C) const {
   const ObjCMessageExpr *MessageExpr = M.getOriginExpr();
 
-  SymbolRef RetSym = M.getReturnValue().getAsSymbol();
+  SymExprRef RetSym = M.getReturnValue().getAsSymbol();
   if (!RetSym)
     return;
 
   Selector Sel = MessageExpr->getSelector();
   ProgramStateRef State = C.getState();
 
   // Here we try to propagate information on Class objects.
   if (Sel.getAsString() == "class") {
if (RuntimeType ReceiverRuntimeType = inferReceiverType(M, C)) {
 
         C.addTransition(State);
       }
       return;
     }
   }
 
   // Tracking for return types.
-  SymbolRef RecSym = M.getReceiverSVal().getAsSymbol();
+  SymExprRef RecSym = M.getReceiverSVal().getAsSymbol();
   if (!RecSym)
     return;
 
   const ObjCObjectPointerType *const *TrackedType =
       State->get<MostSpecializedTypeArgsMap>(RecSym);
   if (!TrackedType)
     return;
 
void DynamicTypePropagation::checkPostObjCMessage(const ObjCMethodCall &M,
   if (!State->get<MostSpecializedTypeArgsMap>(RetSym)) {
     State = State->set<MostSpecializedTypeArgsMap>(RetSym, ResultPtrType);
     C.addTransition(State, Pred);
   }
 }
 
 void DynamicTypePropagation::reportGenericsBug(
     const ObjCObjectPointerType *From, const ObjCObjectPointerType *To,
-    ExplodedNode *N, SymbolRef Sym, CheckerContext &C,
+    ExplodedNode *N, SymExprRef Sym, CheckerContext &C,
     const Stmt *ReportedNode) const {
   if (!CheckGenerics)
     return;
 
   initBugType();
   SmallString<192> Buf;
   llvm::raw_svector_ostream OS(Buf);
   OS << "Conversion from value of type '";

clang/lib/StaticAnalyzer/Checkers/ExprInspectionChecker.cpp

 public:
   bool evalCall(const CallEvent &Call, CheckerContext &C) const;
   void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const;
   void checkEndAnalysis(ExplodedGraph &G, BugReporter &BR,
                         ExprEngine &Eng) const;
 };
 }
 
-REGISTER_SET_WITH_PROGRAMSTATE(MarkedSymbols, SymbolRef)
-REGISTER_MAP_WITH_PROGRAMSTATE(DenotedSymbols, SymbolRef, const StringLiteral *)
+REGISTER_SET_WITH_PROGRAMSTATE(MarkedSymbols, SymExprRef)
+REGISTER_MAP_WITH_PROGRAMSTATE(DenotedSymbols, SymExprRef,
+                               const StringLiteral *)
 
 bool ExprInspectionChecker::evalCall(const CallEvent &Call,
                                      CheckerContext &C) const {
   const auto *CE = dyn_cast_or_null<CallExpr>(Call.getOriginExpr());
   if (!CE)
     return false;
 
   // These checks should have no effect on the surrounding environment
void ExprInspectionChecker::analyzerPrintState(const CallExpr *CE,
   C.getState()->dump();
 }
 
 void ExprInspectionChecker::analyzerWarnOnDeadSymbol(const CallExpr *CE,
                                                      CheckerContext &C) const {
   if (CE->getNumArgs() == 0)
     return;
   SVal Val = C.getSVal(CE->getArg(0));
-  SymbolRef Sym = Val.getAsSymbol();
+  SymExprRef Sym = Val.getAsSymbol();
   if (!Sym)
     return;
 
   ProgramStateRef State = C.getState();
   State = State->add<MarkedSymbols>(Sym);
   C.addTransition(State);
 }
 
 void ExprInspectionChecker::checkDeadSymbols(SymbolReaper &SymReaper,
                                              CheckerContext &C) const {
   ProgramStateRef State = C.getState();
   const MarkedSymbolsTy &Syms = State->get<MarkedSymbols>();
   ExplodedNode *N = C.getPredecessor();
   for (auto I = Syms.begin(), E = Syms.end(); I != E; ++I) {
-    SymbolRef Sym = *I;
+    SymExprRef Sym = *I;
     if (!SymReaper.isDead(Sym))
       continue;
 
     // The non-fatal error node should be the same for all reports.
     if (ExplodedNode *BugNode = reportBug("SYMBOL DEAD", C))
       N = BugNode;
     State = State->remove<MarkedSymbols>(Sym);
   }
 
   for (auto I : State->get<DenotedSymbols>()) {
-    SymbolRef Sym = I.first;
+    SymExprRef Sym = I.first;
     if (!SymReaper.isLive(Sym))
       State = State->remove<DenotedSymbols>(Sym);
   }
 
   C.addTransition(State, N);
 }
 
 void ExprInspectionChecker::checkEndAnalysis(ExplodedGraph &G, BugReporter &BR,

 void ExprInspectionChecker::analyzerDenote(const CallExpr *CE,
                                            CheckerContext &C) const {
   if (CE->getNumArgs() < 2) {
     reportBug("clang_analyzer_denote() requires a symbol and a string literal",
               C);
     return;
   }
 
-  SymbolRef Sym = C.getSVal(CE->getArg(0)).getAsSymbol();
+  SymExprRef Sym = C.getSVal(CE->getArg(0)).getAsSymbol();
   if (!Sym) {
     reportBug("Not a symbol", C);
     return;
   }
 
   const auto *E = dyn_cast<StringLiteral>(CE->getArg(1)->IgnoreParenCasts());
   if (!E) {
     reportBug("Not a string literal", C);

 void ExprInspectionChecker::analyzerExpress(const CallExpr *CE,
                                             CheckerContext &C) const {
   if (CE->getNumArgs() == 0) {
     reportBug("clang_analyzer_express() requires a symbol", C);
     return;
   }
 
   SVal ArgVal = C.getSVal(CE->getArg(0));
-  SymbolRef Sym = ArgVal.getAsSymbol();
+  SymExprRef Sym = ArgVal.getAsSymbol();
   if (!Sym) {
     reportBug("Not a symbol", C);
     return;
   }
 
   SymbolExpressor V(C.getState());
   auto Str = V.Visit(Sym);
   if (!Str) {

clang/lib/StaticAnalyzer/Checkers/FuchsiaHandleChecker.cpp

 namespace {
 
 static const StringRef HandleTypeName = "zx_handle_t";
 static const StringRef ErrorTypeName = "zx_status_t";
 
 class HandleState {
 private:
   enum class Kind { MaybeAllocated, Allocated, Released, Escaped } K;
-  SymbolRef ErrorSym;
-  HandleState(Kind K, SymbolRef ErrorSym) : K(K), ErrorSym(ErrorSym) {}
+  SymExprRef ErrorSym;
+  HandleState(Kind K, SymExprRef ErrorSym) : K(K), ErrorSym(ErrorSym) {}
 
 public:
   bool operator==(const HandleState &Other) const {
     return K == Other.K && ErrorSym == Other.ErrorSym;
   }
   bool isAllocated() const { return K == Kind::Allocated; }
   bool maybeAllocated() const { return K == Kind::MaybeAllocated; }
   bool isReleased() const { return K == Kind::Released; }
   bool isEscaped() const { return K == Kind::Escaped; }
 
-  static HandleState getMaybeAllocated(SymbolRef ErrorSym) {
+  static HandleState getMaybeAllocated(SymExprRef ErrorSym) {
     return HandleState(Kind::MaybeAllocated, ErrorSym);
   }
   static HandleState getAllocated(ProgramStateRef State, HandleState S) {
     assert(S.maybeAllocated());
     assert(State->getConstraintManager()
                .isNull(State, S.getErrorSym())
                .isConstrained());
     return HandleState(Kind::Allocated, nullptr);
   }
   static HandleState getReleased() {
     return HandleState(Kind::Released, nullptr);
   }
   static HandleState getEscaped() {
     return HandleState(Kind::Escaped, nullptr);
   }
 
-  SymbolRef getErrorSym() const { return ErrorSym; }
+  SymExprRef getErrorSym() const { return ErrorSym; }
 
   void Profile(llvm::FoldingSetNodeID &ID) const {
     ID.AddInteger(static_cast<int>(K));
     ID.AddPointer(ErrorSym);
   }
 
   LLVM_DUMP_METHOD void dump(raw_ostream &OS) const {
     switch (K) {
public:
   void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const;
   ProgramStateRef evalAssume(ProgramStateRef State, SVal Cond,
                              bool Assumption) const;
   ProgramStateRef checkPointerEscape(ProgramStateRef State,
                                      const InvalidatedSymbols &Escaped,
                                      const CallEvent *Call,
                                      PointerEscapeKind Kind) const;
 
-  ExplodedNode *reportLeaks(ArrayRef<SymbolRef> LeakedHandles,
+  ExplodedNode *reportLeaks(ArrayRef<SymExprRef> LeakedHandles,
                             CheckerContext &C, ExplodedNode *Pred) const;
 
-  void reportDoubleRelease(SymbolRef HandleSym, const SourceRange &Range,
+  void reportDoubleRelease(SymExprRef HandleSym, const SourceRange &Range,
                            CheckerContext &C) const;
 
-  void reportUseAfterFree(SymbolRef HandleSym, const SourceRange &Range,
+  void reportUseAfterFree(SymExprRef HandleSym, const SourceRange &Range,
                           CheckerContext &C) const;
 
-  void reportBug(SymbolRef Sym, ExplodedNode *ErrorNode, CheckerContext &C,
+  void reportBug(SymExprRef Sym, ExplodedNode *ErrorNode, CheckerContext &C,
                  const SourceRange *Range, const BugType &Type,
                  StringRef Msg) const;
 
   void printState(raw_ostream &Out, ProgramStateRef State, const char *NL,
                   const char *Sep) const override;
 };
 } // end anonymous namespace
 
-REGISTER_MAP_WITH_PROGRAMSTATE(HStateMap, SymbolRef, HandleState)
+REGISTER_MAP_WITH_PROGRAMSTATE(HStateMap, SymExprRef, HandleState)
 
-static const ExplodedNode *getAcquireSite(const ExplodedNode *N, SymbolRef Sym,
+static const ExplodedNode *getAcquireSite(const ExplodedNode *N, SymExprRef Sym,
                                           CheckerContext &Ctx) {
   ProgramStateRef State = N->getState();
   // When bug type is handle leak, exploded node N does not have state info for
   // leaking handle. Get the predecessor of N instead.
   if (!State->get<HStateMap>(Sym))
     N = N->getFirstPred();
 
   const ExplodedNode *Pred = N;
   while (N) {
     State = N->getState();
     if (!State->get<HStateMap>(Sym)) {
       const HandleState *HState = Pred->getState()->get<HStateMap>(Sym);
       if (HState && (HState->isAllocated() || HState->maybeAllocated()))
         return N;
     }
     Pred = N;
     N = N->getFirstPred();
   }
   return nullptr;
 }
 
 /// Returns the symbols extracted from the argument or null if it cannot be
 /// found.
-static SymbolRef getFuchsiaHandleSymbol(QualType QT, SVal Arg,
+static SymExprRef getFuchsiaHandleSymbol(QualType QT, SVal Arg,
                                          ProgramStateRef State) {
   int PtrToHandleLevel = 0;
   while (QT->isAnyPointerType() || QT->isReferenceType()) {
     ++PtrToHandleLevel;
     QT = QT->getPointeeType();
   }
   if (const auto *HandleType = QT->getAs<TypedefType>()) {
     if (HandleType->getDecl()->getName() != HandleTypeName)
       return nullptr;

 void FuchsiaHandleChecker::checkPreCall(const CallEvent &Call,
                                         CheckerContext &C) const {
   ProgramStateRef State = C.getState();
   const FunctionDecl *FuncDecl = dyn_cast_or_null<FunctionDecl>(Call.getDecl());
   if (!FuncDecl) {
     // Unknown call, escape by value handles. They are not covered by
     // PointerEscape callback.
     for (unsigned Arg = 0; Arg < Call.getNumArgs(); ++Arg) {
-      if (SymbolRef Handle = Call.getArgSVal(Arg).getAsSymbol())
+      if (SymExprRef Handle = Call.getArgSVal(Arg).getAsSymbol())
         State = State->set<HStateMap>(Handle, HandleState::getEscaped());
     }
     C.addTransition(State);
     return;
   }
 
   for (unsigned Arg = 0; Arg < Call.getNumArgs(); ++Arg) {
     if (Arg >= FuncDecl->getNumParams())
       break;
     const ParmVarDecl *PVD = FuncDecl->getParamDecl(Arg);
-    SymbolRef Handle =
+    SymExprRef Handle =
         getFuchsiaHandleSymbol(PVD->getType(), Call.getArgSVal(Arg), State);
     if (!Handle)
       continue;
 
     // Handled in checkPostCall.
     if (hasFuchsiaAttr<ReleaseHandleAttr>(PVD) ||
         hasFuchsiaAttr<AcquireHandleAttr>(PVD))
       continue;
void FuchsiaHandleChecker::checkPostCall(const CallEvent &Call,
                                          CheckerContext &C) const {
   const FunctionDecl *FuncDecl = dyn_cast_or_null<FunctionDecl>(Call.getDecl());
   if (!FuncDecl)
     return;
 
   ProgramStateRef State = C.getState();
 
   std::vector<std::function<std::string(BugReport & BR)>> Notes;
-  SymbolRef ResultSymbol = nullptr;
+  SymExprRef ResultSymbol = nullptr;
   if (const auto *TypeDefTy = FuncDecl->getReturnType()->getAs<TypedefType>())
     if (TypeDefTy->getDecl()->getName() == ErrorTypeName)
       ResultSymbol = Call.getReturnValue().getAsSymbol();
 
   // Function returns an open handle.
   if (hasFuchsiaAttr<AcquireHandleAttr>(FuncDecl)) {
-    SymbolRef RetSym = Call.getReturnValue().getAsSymbol();
+    SymExprRef RetSym = Call.getReturnValue().getAsSymbol();
     Notes.push_back([RetSym, FuncDecl](BugReport &BR) -> std::string {
       auto *PathBR = static_cast<PathSensitiveBugReport *>(&BR);
       if (auto IsInteresting = PathBR->getInterestingnessKind(RetSym)) {
         std::string SBuf;
         llvm::raw_string_ostream OS(SBuf);
         OS << "Function '" << FuncDecl->getDeclName()
            << "' returns an open handle";
         return OS.str();
       } else
         return "";
     });
     State =
         State->set<HStateMap>(RetSym, HandleState::getMaybeAllocated(nullptr));
   }
 
   for (unsigned Arg = 0; Arg < Call.getNumArgs(); ++Arg) {
     if (Arg >= FuncDecl->getNumParams())
       break;
     const ParmVarDecl *PVD = FuncDecl->getParamDecl(Arg);
     unsigned ParamDiagIdx = PVD->getFunctionScopeIndex() + 1;
-    SymbolRef Handle =
+    SymExprRef Handle =
         getFuchsiaHandleSymbol(PVD->getType(), Call.getArgSVal(Arg), State);
     if (!Handle)
       continue;
 
     const HandleState *HState = State->get<HStateMap>(Handle);
     if (HState && HState->isEscaped())
       continue;
     if (hasFuchsiaAttr<ReleaseHandleAttr>(PVD)) {
T = C.getNoteTag([this, Notes{std::move(Notes)}](
         });
   }
   C.addTransition(State, T);
 }
 
 void FuchsiaHandleChecker::checkDeadSymbols(SymbolReaper &SymReaper,
                                             CheckerContext &C) const {
   ProgramStateRef State = C.getState();
-  SmallVector<SymbolRef, 2> LeakedSyms;
+  SmallVector<SymExprRef, 2> LeakedSyms;
   HStateMapTy TrackedHandles = State->get<HStateMap>();
   for (auto &CurItem : TrackedHandles) {
-    SymbolRef ErrorSym = CurItem.second.getErrorSym();
+    SymExprRef ErrorSym = CurItem.second.getErrorSym();
     // Keeping zombie handle symbols. In case the error symbol is dying later
     // than the handle symbol we might produce spurious leak warnings (in case
     // we find out later from the status code that the handle allocation failed
     // in the first place).
     if (!SymReaper.isDead(CurItem.first) ||
         (ErrorSym && !SymReaper.isDead(ErrorSym)))
       continue;
     if (CurItem.second.isAllocated() || CurItem.second.maybeAllocated())
ProgramStateRef FuchsiaHandleChecker::evalAssume(ProgramStateRef State,
   ConstraintManager &Cmr = State->getConstraintManager();
   HStateMapTy TrackedHandles = State->get<HStateMap>();
   for (auto &CurItem : TrackedHandles) {
     ConditionTruthVal HandleVal = Cmr.isNull(State, CurItem.first);
     if (HandleVal.isConstrainedTrue()) {
       // The handle is invalid. We can no longer follow the symbol on this path.
       State = State->remove<HStateMap>(CurItem.first);
     }
-    SymbolRef ErrorSym = CurItem.second.getErrorSym();
+    SymExprRef ErrorSym = CurItem.second.getErrorSym();
     if (!ErrorSym)
       continue;
     ConditionTruthVal ErrorVal = Cmr.isNull(State, ErrorSym);
     if (ErrorVal.isConstrainedTrue()) {
       // Allocation succeeded.
       if (CurItem.second.maybeAllocated())
         State = State->set<HStateMap>(
             CurItem.first, HandleState::getAllocated(State, CurItem.second));
     } else if (ErrorVal.isConstrainedFalse()) {
       // Allocation failed.
       if (CurItem.second.maybeAllocated())
         State = State->remove<HStateMap>(CurItem.first);
     }
   }
   return State;
 }
 
 ProgramStateRef FuchsiaHandleChecker::checkPointerEscape(
     ProgramStateRef State, const InvalidatedSymbols &Escaped,
     const CallEvent *Call, PointerEscapeKind Kind) const {
   const FunctionDecl *FuncDecl =
       Call ? dyn_cast_or_null<FunctionDecl>(Call->getDecl()) : nullptr;
 
-  llvm::DenseSet<SymbolRef> UnEscaped;
+  llvm::DenseSet<SymExprRef> UnEscaped;
   // Not all calls should escape our symbols.
   if (FuncDecl &&
       (Kind == PSK_DirectEscapeOnCall || Kind == PSK_IndirectEscapeOnCall ||
        Kind == PSK_EscapeOutParameters)) {
     for (unsigned Arg = 0; Arg < Call->getNumArgs(); ++Arg) {
       if (Arg >= FuncDecl->getNumParams())
         break;
       const ParmVarDecl *PVD = FuncDecl->getParamDecl(Arg);
-      SymbolRef Handle =
+      SymExprRef Handle =
           getFuchsiaHandleSymbol(PVD->getType(), Call->getArgSVal(Arg), State);
       if (!Handle)
         continue;
       if (hasFuchsiaAttr<UseHandleAttr>(PVD) ||
           hasFuchsiaAttr<ReleaseHandleAttr>(PVD))
         UnEscaped.insert(Handle);
     }
   }
if (const auto *SD = dyn_cast<SymbolDerived>(I.first)) {
         State = State->set<HStateMap>(I.first, HandleState::getEscaped());
     }
   }
 
   return State;
 }
 
 ExplodedNode *
-FuchsiaHandleChecker::reportLeaks(ArrayRef<SymbolRef> LeakedHandles,
+FuchsiaHandleChecker::reportLeaks(ArrayRef<SymExprRef> LeakedHandles,
                                   CheckerContext &C, ExplodedNode *Pred) const {
   ExplodedNode *ErrNode = C.generateNonFatalErrorNode(C.getState(), Pred);
-  for (SymbolRef LeakedHandle : LeakedHandles) {
+  for (SymExprRef LeakedHandle : LeakedHandles) {
     reportBug(LeakedHandle, ErrNode, C, nullptr, LeakBugType,
               "Potential leak of handle");
   }
   return ErrNode;
 }
 
-void FuchsiaHandleChecker::reportDoubleRelease(SymbolRef HandleSym,
+void FuchsiaHandleChecker::reportDoubleRelease(SymExprRef HandleSym,
                                                const SourceRange &Range,
                                                CheckerContext &C) const {
   ExplodedNode *ErrNode = C.generateErrorNode(C.getState());
   reportBug(HandleSym, ErrNode, C, &Range, DoubleReleaseBugType,
             "Releasing a previously released handle");
 }
 
-void FuchsiaHandleChecker::reportUseAfterFree(SymbolRef HandleSym,
+void FuchsiaHandleChecker::reportUseAfterFree(SymExprRef HandleSym,
                                               const SourceRange &Range,
                                               CheckerContext &C) const {
   ExplodedNode *ErrNode = C.generateErrorNode(C.getState());
   reportBug(HandleSym, ErrNode, C, &Range, UseAfterReleaseBugType,
             "Using a previously released handle");
 }
 
-void FuchsiaHandleChecker::reportBug(SymbolRef Sym, ExplodedNode *ErrorNode,
+void FuchsiaHandleChecker::reportBug(SymExprRef Sym, ExplodedNode *ErrorNode,
                                      CheckerContext &C,
                                      const SourceRange *Range,
                                      const BugType &Type, StringRef Msg) const {
   if (!ErrorNode)
     return;
 
   std::unique_ptr<PathSensitiveBugReport> R;
   if (Type.isSuppressOnSink()) {

clang/lib/StaticAnalyzer/Checkers/InnerPointerChecker.cpp

 #include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 
 using namespace clang;
 using namespace ento;
 
 // Associate container objects with a set of raw pointer symbols.
-REGISTER_SET_FACTORY_WITH_PROGRAMSTATE(PtrSet, SymbolRef)
+REGISTER_SET_FACTORY_WITH_PROGRAMSTATE(PtrSet, SymExprRef)
 REGISTER_MAP_WITH_PROGRAMSTATE(RawPtrMap, const MemRegion *, PtrSet)
 
 
 namespace {
 
 class InnerPointerChecker
     : public Checker<check::DeadSymbols, check::PostCall> {
 
   CallDescription AppendFn, AssignFn, ClearFn, CStrFn, DataFn, EraseFn,
       InsertFn, PopBackFn, PushBackFn, ReplaceFn, ReserveFn, ResizeFn,
       ShrinkToFitFn, SwapFn;
 
 public:
   class InnerPointerBRVisitor : public BugReporterVisitor {
-    SymbolRef PtrToBuf;
+    SymExprRef PtrToBuf;
 
   public:
-    InnerPointerBRVisitor(SymbolRef Sym) : PtrToBuf(Sym) {}
+    InnerPointerBRVisitor(SymExprRef Sym) : PtrToBuf(Sym) {}
 
     static void *getTag() {
       static int Tag = 0;
       return &Tag;
     }
 
     void Profile(llvm::FoldingSetNodeID &ID) const override {
       ID.AddPointer(getTag());
     }
 
     virtual PathDiagnosticPieceRef
     VisitNode(const ExplodedNode *N, BugReporterContext &BRC,
               PathSensitiveBugReport &BR) override;
 
     // FIXME: Scan the map once in the visitor's constructor and do a direct
     // lookup by region.
-    bool isSymbolTracked(ProgramStateRef State, SymbolRef Sym) {
+    bool isSymbolTracked(ProgramStateRef State, SymExprRef Sym) {
       RawPtrMapTy Map = State->get<RawPtrMap>();
       for (const auto &Entry : Map) {
         if (Entry.second.contains(Sym))
           return true;
       }
       return false;
     }
   };
if (const auto *ICall = dyn_cast<CXXInstanceCall>(&Call)) {
     // TODO: Do we need these to be typed?
     const auto *ObjRegion = dyn_cast_or_null<TypedValueRegion>(
         ICall->getCXXThisVal().getAsRegion());
     if (!ObjRegion)
       return;
 
     if (Call.isCalled(CStrFn) || Call.isCalled(DataFn)) {
       SVal RawPtr = Call.getReturnValue();
-      if (SymbolRef Sym = RawPtr.getAsSymbol(/*IncludeBaseRegions=*/true)) {
+      if (SymExprRef Sym = RawPtr.getAsSymbol(/*IncludeBaseRegions=*/true)) {
         // Start tracking this raw pointer by adding it to the set of symbols
         // associated with this container object in the program state map.
 
         PtrSet::Factory &F = State->getStateManager().get_context<PtrSet>();
         const PtrSet *SetPtr = State->get<RawPtrMap>(ObjRegion);
         PtrSet Set = SetPtr ? *SetPtr : F.getEmptySet();
         assert(C.wasInlined || !Set.contains(Sym));
         Set = F.add(Set, Sym);
void InnerPointerChecker::checkDeadSymbols(SymbolReaper &SymReaper,
   }
   C.addTransition(State);
 }
 
 namespace clang {
 namespace ento {
 namespace allocation_state {
 
-std::unique_ptr<BugReporterVisitor> getInnerPointerBRVisitor(SymbolRef Sym) {
+std::unique_ptr<BugReporterVisitor> getInnerPointerBRVisitor(SymExprRef Sym) {
   return std::make_unique<InnerPointerChecker::InnerPointerBRVisitor>(Sym);
 }
 
-const MemRegion *getContainerObjRegion(ProgramStateRef State, SymbolRef Sym) {
+const MemRegion *getContainerObjRegion(ProgramStateRef State, SymExprRef Sym) {
   RawPtrMapTy Map = State->get<RawPtrMap>();
   for (const auto &Entry : Map) {
     if (Entry.second.contains(Sym)) {
       return Entry.first;
     }
   }
   return nullptr;
 }

clang/lib/StaticAnalyzer/Checkers/Iterator.h

private:
 
   // Container the iterator belongs to
   const MemRegion *Cont;
 
   // Whether iterator is valid
   const bool Valid;
 
   // Abstract offset
-  const SymbolRef Offset;
+  const SymExprRef Offset;
 
-  IteratorPosition(const MemRegion *C, bool V, SymbolRef Of)
+  IteratorPosition(const MemRegion *C, bool V, SymExprRef Of)
       : Cont(C), Valid(V), Offset(Of) {}
 
 public:
   const MemRegion *getContainer() const { return Cont; }
   bool isValid() const { return Valid; }
-  SymbolRef getOffset() const { return Offset; }
+  SymExprRef getOffset() const { return Offset; }
 
   IteratorPosition invalidate() const {
     return IteratorPosition(Cont, false, Offset);
   }
 
-  static IteratorPosition getPosition(const MemRegion *C, SymbolRef Of) {
+  static IteratorPosition getPosition(const MemRegion *C, SymExprRef Of) {
     return IteratorPosition(C, true, Of);
   }
 
-  IteratorPosition setTo(SymbolRef NewOf) const {
+  IteratorPosition setTo(SymExprRef NewOf) const {
     return IteratorPosition(Cont, Valid, NewOf);
   }
 
   IteratorPosition reAssign(const MemRegion *NewCont) const {
     return IteratorPosition(NewCont, Valid, Offset);
   }
 
   bool operator==(const IteratorPosition &X) const {
void Profile(llvm::FoldingSetNodeID &ID) const {
     ID.AddInteger(Valid);
     ID.Add(Offset);
   }
 };
 
 // Structure to record the symbolic begin and end position of a container
 struct ContainerData {
 private:
-  const SymbolRef Begin, End;
+  const SymExprRef Begin, End;
 
-  ContainerData(SymbolRef B, SymbolRef E) : Begin(B), End(E) {}
+  ContainerData(SymExprRef B, SymExprRef E) : Begin(B), End(E) {}
 
 public:
-  static ContainerData fromBegin(SymbolRef B) {
+  static ContainerData fromBegin(SymExprRef B) {
     return ContainerData(B, nullptr);
   }
 
-  static ContainerData fromEnd(SymbolRef E) {
+  static ContainerData fromEnd(SymExprRef E) {
     return ContainerData(nullptr, E);
   }
 
-  SymbolRef getBegin() const { return Begin; }
-  SymbolRef getEnd() const { return End; }
+  SymExprRef getBegin() const { return Begin; }
+  SymExprRef getEnd() const { return End; }
 
-  ContainerData newBegin(SymbolRef B) const { return ContainerData(B, End); }
+  ContainerData newBegin(SymExprRef B) const { return ContainerData(B, End); }
 
-  ContainerData newEnd(SymbolRef E) const { return ContainerData(Begin, E); }
+  ContainerData newEnd(SymExprRef E) const { return ContainerData(Begin, E); }
 
   bool operator==(const ContainerData &X) const {
     return Begin == X.Begin && End == X.End;
   }
 
   bool operator!=(const ContainerData &X) const {
     return Begin != X.Begin || End != X.End;
   }
 
   void Profile(llvm::FoldingSetNodeID &ID) const {
     ID.Add(Begin);
     ID.Add(End);
   }
 };
 
 class IteratorSymbolMap {};
 class IteratorRegionMap {};
 class ContainerMap {};
 
-using IteratorSymbolMapTy =
-  CLANG_ENTO_PROGRAMSTATE_MAP(SymbolRef, IteratorPosition);
+using IteratorSymbolMapTy = CLANG_ENTO_PROGRAMSTATE_MAP(SymExprRef,
+                                                        IteratorPosition);
 using IteratorRegionMapTy =
   CLANG_ENTO_PROGRAMSTATE_MAP(const MemRegion *, IteratorPosition);
 using ContainerMapTy =
   CLANG_ENTO_PROGRAMSTATE_MAP(const MemRegion *, ContainerData);
 
 } // namespace iterator
 
 template<>

 ProgramStateRef createIteratorPosition(ProgramStateRef State, const SVal &Val,
                                        const MemRegion *Cont, const Stmt* S,
                                        const LocationContext *LCtx,
                                        unsigned blockCount);
 ProgramStateRef advancePosition(ProgramStateRef State,
                                 const SVal &Iter,
                                 OverloadedOperatorKind Op,
                                 const SVal &Distance);
-ProgramStateRef assumeNoOverflow(ProgramStateRef State, SymbolRef Sym,
+ProgramStateRef assumeNoOverflow(ProgramStateRef State, SymExprRef Sym,
                                  long Scale);
-bool compare(ProgramStateRef State, SymbolRef Sym1, SymbolRef Sym2,
+bool compare(ProgramStateRef State, SymExprRef Sym1, SymExprRef Sym2,
              BinaryOperator::Opcode Opc);
 bool compare(ProgramStateRef State, NonLoc NL1, NonLoc NL2,
              BinaryOperator::Opcode Opc);
 
 } // namespace iterator
 } // namespace ento
 } // namespace clang
 
 #endif

clang/lib/StaticAnalyzer/Checkers/Iterator.cpp

 
 // This function tells the analyzer's engine that symbols produced by our
 // checker, most notably iterator positions, are relatively small.
 // A distance between items in the container should not be very large.
 // By assuming that it is within around 1/8 of the address space,
 // we can help the analyzer perform operations on these symbols
 // without being afraid of integer overflows.
 // FIXME: Should we provide it as an API, so that all checkers could use it?
-ProgramStateRef assumeNoOverflow(ProgramStateRef State, SymbolRef Sym,
+ProgramStateRef assumeNoOverflow(ProgramStateRef State, SymExprRef Sym,
                                  long Scale) {
   SValBuilder &SVB = State->getStateManager().getSValBuilder();
   BasicValueFactory &BV = SVB.getBasicValueFactory();
 
   QualType T = Sym->getType();
   assert(T->isSignedIntegerOrEnumerationType());
   APSIntType AT = BV.getAPSIntType(T);
 
if (auto DV = IsCappedFromBelow.getAs<DefinedSVal>()) {
     NewState = NewState->assume(*DV, true);
     if (!NewState)
       return State;
   }
 
   return NewState;
 }
 
-bool compare(ProgramStateRef State, SymbolRef Sym1, SymbolRef Sym2,
+bool compare(ProgramStateRef State, SymExprRef Sym1, SymExprRef Sym2,
              BinaryOperator::Opcode Opc) {
   return compare(State, nonloc::SymbolVal(Sym1), nonloc::SymbolVal(Sym2), Opc);
 }
 
 bool compare(ProgramStateRef State, NonLoc NL1, NonLoc NL2,
              BinaryOperator::Opcode Opc) {
   auto &SVB = State->getStateManager().getSValBuilder();
 

clang/lib/StaticAnalyzer/Checkers/IteratorModeling.cpp

class IteratorModeling
   void handleAdvanceLikeFunction(CheckerContext &C, const CallEvent &Call,
                                  const Expr *OrigExpr,
                                  const AdvanceFn *Handler) const;
 
   void handleComparison(CheckerContext &C, const Expr *CE, SVal RetVal,
                         const SVal &LVal, const SVal &RVal,
                         OverloadedOperatorKind Op) const;
   void processComparison(CheckerContext &C, ProgramStateRef State,
-                         SymbolRef Sym1, SymbolRef Sym2, const SVal &RetVal,
+                         SymExprRef Sym1, SymExprRef Sym2, const SVal &RetVal,
                          OverloadedOperatorKind Op) const;
   void handleIncrement(CheckerContext &C, const SVal &RetVal, const SVal &Iter,
                        bool Postfix) const;
   void handleDecrement(CheckerContext &C, const SVal &RetVal, const SVal &Iter,
                        bool Postfix) const;
   void handleRandomIncrOrDecr(CheckerContext &C, const Expr *CE,
                               OverloadedOperatorKind Op, const SVal &RetVal,
                               const SVal &Iterator, const SVal &Amount) const;
void checkPostStmt(const MaterializeTemporaryExpr *MTE,
                      CheckerContext &C) const;
   void checkLiveSymbols(ProgramStateRef State, SymbolReaper &SR) const;
   void checkDeadSymbols(SymbolReaper &SR, CheckerContext &C) const;
 };
 
 bool isSimpleComparisonOperator(OverloadedOperatorKind OK);
 bool isSimpleComparisonOperator(BinaryOperatorKind OK);
 ProgramStateRef removeIteratorPosition(ProgramStateRef State, const SVal &Val);
-ProgramStateRef relateSymbols(ProgramStateRef State, SymbolRef Sym1,
-                              SymbolRef Sym2, bool Equal);
+ProgramStateRef relateSymbols(ProgramStateRef State, SymExprRef Sym1,
+                              SymExprRef Sym2, bool Equal);
 bool isBoundThroughLazyCompoundVal(const Environment &Env,
                                    const MemRegion *Reg);
 const ExplodedNode *findCallEnter(const ExplodedNode *Node, const Expr *Call);
 
 } // namespace
 
 void IteratorModeling::checkPostCall(const CallEvent &Call,
                                      CheckerContext &C) const {
void IteratorModeling::handleComparison(CheckerContext &C, const Expr *CE,
   } else if (RPos) {
     Cont = RPos->getContainer();
   }
   if (!Cont)
     return;
 
   // At least one of the iterators has recorded positions. If one of them does
   // not then create a new symbol for the offset.
-  SymbolRef Sym;
+  SymExprRef Sym;
   if (!LPos || !RPos) {
     auto &SymMgr = C.getSymbolManager();
     Sym = SymMgr.conjureSymbol(CE, C.getLocationContext(),
                                C.getASTContext().LongTy, C.blockCount());
     State = assumeNoOverflow(State, Sym, 4);
   }
 
   if (!LPos) {
RetVal = nonloc::SymbolVal(SymMgr.conjureSymbol(
         CE, LCtx, C.getASTContext().BoolTy, C.blockCount()));
     State = State->BindExpr(CE, LCtx, RetVal);
   }
 
   processComparison(C, State, LPos->getOffset(), RPos->getOffset(), RetVal, Op);
 }
 
 void IteratorModeling::processComparison(CheckerContext &C,
-                                         ProgramStateRef State, SymbolRef Sym1,
-                                         SymbolRef Sym2, const SVal &RetVal,
+                                         ProgramStateRef State, SymExprRef Sym1,
+                                         SymExprRef Sym2, const SVal &RetVal,
                                          OverloadedOperatorKind Op) const {
   if (const auto TruthVal = RetVal.getAs<nonloc::ConcreteInt>()) {
     if ((State = relateSymbols(State, Sym1, Sym2,
                               (Op == OO_EqualEqual) ==
                                (TruthVal->getValue() != 0)))) {
       C.addTransition(State);
     } else {
       C.generateSink(State, C.getPredecessor());
ProgramStateRef removeIteratorPosition(ProgramStateRef State, const SVal &Val) {
   } else if (const auto Sym = Val.getAsSymbol()) {
     return State->remove<IteratorSymbolMap>(Sym);
   } else if (const auto LCVal = Val.getAs<nonloc::LazyCompoundVal>()) {
     return State->remove<IteratorRegionMap>(LCVal->getRegion());
   }
   return nullptr;
 }
 
-ProgramStateRef relateSymbols(ProgramStateRef State, SymbolRef Sym1,
-                              SymbolRef Sym2, bool Equal) {
+ProgramStateRef relateSymbols(ProgramStateRef State, SymExprRef Sym1,
+                              SymExprRef Sym2, bool Equal) {
   auto &SVB = State->getStateManager().getSValBuilder();
 
   // FIXME: This code should be reworked as follows:
   // 1. Subtract the operands using evalBinOp().
   // 2. Assume that the result doesn't overflow.
   // 3. Compare the result to 0.
   // 4. Assume the result of the comparison.
   const auto comparison =

clang/lib/StaticAnalyzer/Checkers/IteratorRangeChecker.cpp

void IteratorRangeChecker::reportBug(const StringRef &Message, SVal Val,
 
   R->markInteresting(Val);
   R->markInteresting(Pos->getContainer());
   C.emitReport(std::move(R));
 }
 
 namespace {
 
-bool isLess(ProgramStateRef State, SymbolRef Sym1, SymbolRef Sym2);
-bool isGreater(ProgramStateRef State, SymbolRef Sym1, SymbolRef Sym2);
-bool isEqual(ProgramStateRef State, SymbolRef Sym1, SymbolRef Sym2);
+bool isLess(ProgramStateRef State, SymExprRef Sym1, SymExprRef Sym2);
+bool isGreater(ProgramStateRef State, SymExprRef Sym1, SymExprRef Sym2);
+bool isEqual(ProgramStateRef State, SymExprRef Sym1, SymExprRef Sym2);
 
 bool isZero(ProgramStateRef State, const NonLoc &Val) {
   auto &BVF = State->getBasicVals();
   return compare(State, Val,
                  nonloc::ConcreteInt(BVF.getValue(llvm::APSInt::get(0))),
                  BO_EQ);
 }
 
if (End) {
     if (isGreater(State, Pos.getOffset(), End)) {
       return true;
     }
   }
 
   return false;
 }
 
-bool isLess(ProgramStateRef State, SymbolRef Sym1, SymbolRef Sym2) {
+bool isLess(ProgramStateRef State, SymExprRef Sym1, SymExprRef Sym2) {
   return compare(State, Sym1, Sym2, BO_LT);
 }
 
-bool isGreater(ProgramStateRef State, SymbolRef Sym1, SymbolRef Sym2) {
+bool isGreater(ProgramStateRef State, SymExprRef Sym1, SymExprRef Sym2) {
   return compare(State, Sym1, Sym2, BO_GT);
 }
 
-bool isEqual(ProgramStateRef State, SymbolRef Sym1, SymbolRef Sym2) {
+bool isEqual(ProgramStateRef State, SymExprRef Sym1, SymExprRef Sym2) {
   return compare(State, Sym1, Sym2, BO_EQ);
 }
 
 } // namespace
 
 void ento::registerIteratorRangeChecker(CheckerManager &mgr) {
   mgr.registerChecker<IteratorRangeChecker>();
 }
 
 bool ento::shouldRegisterIteratorRangeChecker(const CheckerManager &mgr) {
   return true;
 }

clang/lib/StaticAnalyzer/Checkers/MIGChecker.cpp

 REGISTER_TRAIT_WITH_PROGRAMSTATE(ReleasedParameter, bool)
 // A set of parameters for which the check is suppressed because
 // reference counting is being performed.
 REGISTER_SET_WITH_PROGRAMSTATE(RefCountedParameters, const ParmVarDecl *)
 
 static const ParmVarDecl *getOriginParam(SVal V, CheckerContext &C,
                                          bool IncludeBaseRegions = false) {
   // TODO: We should most likely always include base regions here.
-  SymbolRef Sym = V.getAsSymbol(IncludeBaseRegions);
+  SymExprRef Sym = V.getAsSymbol(IncludeBaseRegions);
   if (!Sym)
     return nullptr;
 
   // If we optimistically assume that the MIG routine never re-uses the storage
   // that was passed to it as arguments when it invalidates it (but at most when
   // it assigns to parameter variables directly), this procedure correctly
   // determines if the value was loaded from the transitive closure of MIG
   // routine arguments in the heap.

clang/lib/StaticAnalyzer/Checkers/MacOSKeychainAPIChecker.cpp

class MacOSKeychainAPIChecker : public Checker<check::PreStmt<CallExpr>,
   mutable std::unique_ptr<BugType> BT;
 
 public:
   /// AllocationState is a part of the checker specific state together with the
   /// MemRegion corresponding to the allocated data.
   struct AllocationState {
     /// The index of the allocator function.
     unsigned int AllocatorIdx;
-    SymbolRef Region;
+    SymExprRef Region;
 
-    AllocationState(const Expr *E, unsigned int Idx, SymbolRef R) :
-      AllocatorIdx(Idx),
-      Region(R) {}
+    AllocationState(const Expr *E, unsigned int Idx, SymExprRef R)
+        : AllocatorIdx(Idx), Region(R) {}
 
     bool operator==(const AllocationState &X) const {
       return (AllocatorIdx == X.AllocatorIdx &&
               Region == X.Region);
     }
 
     void Profile(llvm::FoldingSetNodeID &ID) const {
       ID.AddInteger(AllocatorIdx);
ProgramStateRef checkPointerEscape(ProgramStateRef State,
                                      const CallEvent *Call,
                                      PointerEscapeKind Kind) const;
   ProgramStateRef evalAssume(ProgramStateRef state, SVal Cond,
                              bool Assumption) const;
   void printState(raw_ostream &Out, ProgramStateRef State,
                   const char *NL, const char *Sep) const override;
 
 private:
-  typedef std::pair<SymbolRef, const AllocationState*> AllocationPair;
+  typedef std::pair<SymExprRef, const AllocationState *> AllocationPair;
   typedef SmallVector<AllocationPair, 2> AllocationPairVec;
 
   enum APIKind {
     /// Denotes functions tracked by this checker.
     ValidAPI = 0,
     /// The functions commonly/mistakenly used in place of the given API.
     ErrorAPI = 1,
     /// The functions which may allocate the data. These are tracked to reduce
if (!BT)
                            "API Misuse (Apple)"));
   }
 
   void generateDeallocatorMismatchReport(const AllocationPair &AP,
                                          const Expr *ArgExpr,
                                          CheckerContext &C) const;
 
   /// Find the allocation site for Sym on the path leading to the node N.
-  const ExplodedNode *getAllocationNode(const ExplodedNode *N, SymbolRef Sym,
+  const ExplodedNode *getAllocationNode(const ExplodedNode *N, SymExprRef Sym,
                                         CheckerContext &C) const;
 
   std::unique_ptr<PathSensitiveBugReport>
   generateAllocatedDataNotReleasedReport(const AllocationPair &AP,
                                          ExplodedNode *N,
                                          CheckerContext &C) const;
 
   /// Mark an AllocationPair interesting for diagnostic reporting.
   void markInteresting(PathSensitiveBugReport *R,
                        const AllocationPair &AP) const {
     R->markInteresting(AP.first);
     R->markInteresting(AP.second->Region);
   }
 
   /// The bug visitor which allows us to print extra diagnostics along the
   /// BugReport path. For example, showing the allocation site of the leaked
   /// region.
   class SecKeychainBugVisitor : public BugReporterVisitor {
   protected:
     // The allocated region symbol tracked by the main analysis.
-    SymbolRef Sym;
+    SymExprRef Sym;
 
   public:
-    SecKeychainBugVisitor(SymbolRef S) : Sym(S) {}
+    SecKeychainBugVisitor(SymExprRef S) : Sym(S) {}
 
     void Profile(llvm::FoldingSetNodeID &ID) const override {
       static int X = 0;
       ID.AddPointer(&X);
       ID.AddPointer(Sym);
     }
 
     PathDiagnosticPieceRef VisitNode(const ExplodedNode *N,
                                      BugReporterContext &BRC,
                                      PathSensitiveBugReport &BR) override;
   };
 };
 }
 
 /// ProgramState traits to store the currently allocated (and not yet freed)
 /// symbols. This is a map from the allocated content symbol to the
 /// corresponding AllocationState.
-REGISTER_MAP_WITH_PROGRAMSTATE(AllocatedData,
-                               SymbolRef,
+REGISTER_MAP_WITH_PROGRAMSTATE(AllocatedData, SymExprRef,
                                MacOSKeychainAPIChecker::AllocationState)
 
 static bool isEnclosingFunctionParam(const Expr *E) {
   E = E->IgnoreParenCasts();
   if (const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(E)) {
     const ValueDecl *VD = DRE->getDecl();
     if (isa<ImplicitParamDecl>(VD) || isa<ParmVarDecl>(VD))
       return true;
static bool isBadDeallocationArgument(const MemRegion *Arg) {
   if (!Arg)
     return false;
   return isa<AllocaRegion>(Arg) || isa<BlockDataRegion>(Arg) ||
          isa<TypedRegion>(Arg);
 }
 
 /// Given the address expression, retrieve the value it's pointing to. Assume
 /// that value is itself an address, and return the corresponding symbol.
-static SymbolRef getAsPointeeSymbol(const Expr *Expr,
-                                    CheckerContext &C) {
+static SymExprRef getAsPointeeSymbol(const Expr *Expr, CheckerContext &C) {
   ProgramStateRef State = C.getState();
   SVal ArgV = C.getSVal(Expr);
 
   if (Optional<loc::MemRegionVal> X = ArgV.getAs<loc::MemRegionVal>()) {
     StoreManager& SM = C.getStoreManager();
-    SymbolRef sym = SM.getBinding(State->getStore(), *X).getAsLocSymbol();
+    SymExprRef sym = SM.getBinding(State->getStore(), *X).getAsLocSymbol();
     if (sym)
       return sym;
   }
   return nullptr;
 }
 
 // Report deallocator mismatch. Remove the region from tracking - reporting a
 // missing free error after this one is redundant.
void MacOSKeychainAPIChecker::checkPreStmt(const CallExpr *CE,
   // If it is a call to an allocator function, it could be a double allocation.
   idx = getTrackedFunctionIndex(funName, true);
   if (idx != InvalidIdx) {
     unsigned paramIdx = FunctionsToTrack[idx].Param;
     if (CE->getNumArgs() <= paramIdx)
       return;
 
     const Expr *ArgExpr = CE->getArg(paramIdx);
-    if (SymbolRef V = getAsPointeeSymbol(ArgExpr, C))
+    if (SymExprRef V = getAsPointeeSymbol(ArgExpr, C))
       if (const AllocationState *AS = State->get<AllocatedData>(V)) {
         // Remove the value from the state. The new symbol will be added for
         // tracking when the second allocator is processed in checkPostStmt().
         State = State->remove<AllocatedData>(V);
         ExplodedNode *N = C.generateNonFatalErrorNode(State);
         if (!N)
           return;
         initBugType();
void MacOSKeychainAPIChecker::checkPreStmt(const CallExpr *CE,
   // Check the argument to the deallocator.
   const Expr *ArgExpr = CE->getArg(paramIdx);
   SVal ArgSVal = C.getSVal(ArgExpr);
 
   // Undef is reported by another checker.
   if (ArgSVal.isUndef())
     return;
 
-  SymbolRef ArgSM = ArgSVal.getAsLocSymbol();
+  SymExprRef ArgSM = ArgSVal.getAsLocSymbol();
 
   // If the argument is coming from the heap, globals, or unknown, do not
   // report it.
   bool RegionArgIsBad = false;
   if (!ArgSM) {
     if (!isBadDeallocationArgument(ArgSVal.getAsRegion()))
       return;
     RegionArgIsBad = true;
void MacOSKeychainAPIChecker::checkPostStmt(const CallExpr *CE,
 
   const Expr *ArgExpr = CE->getArg(FunctionsToTrack[idx].Param);
   // If the argument entered as an enclosing function parameter, skip it to
   // avoid false positives.
   if (isEnclosingFunctionParam(ArgExpr) &&
       C.getLocationContext()->getParent() == nullptr)
     return;
 
-  if (SymbolRef V = getAsPointeeSymbol(ArgExpr, C)) {
+  if (SymExprRef V = getAsPointeeSymbol(ArgExpr, C)) {
     // If the argument points to something that's not a symbolic region, it
     // can be:
     //  - unknown (cannot reason about it)
     //  - undefined (already reported by other checker)
     //  - constant (null - should not be tracked,
     //              other constant will generate a compiler warning)
     //  - goto (should be reported by other checker)
 
     // The call return value symbol should stay alive for as long as the
     // allocated value symbol, since our diagnostics depend on the value
     // returned by the call. Ex: Data should only be freed if noErr was
     // returned during allocation.)
-    SymbolRef RetStatusSymbol = C.getSVal(CE).getAsSymbol();
+    SymExprRef RetStatusSymbol = C.getSVal(CE).getAsSymbol();
     C.getSymbolManager().addSymbolDependency(V, RetStatusSymbol);
 
     // Track the allocated value in the checker state.
     State = State->set<AllocatedData>(V, AllocationState(ArgExpr, idx,
                                                          RetStatusSymbol));
     assert(State);
     C.addTransition(State);
   }
 }
 
 // TODO: This logic is the same as in Malloc checker.
-const ExplodedNode *
-MacOSKeychainAPIChecker::getAllocationNode(const ExplodedNode *N,
-                                           SymbolRef Sym,
-                                           CheckerContext &C) const {
+const ExplodedNode *MacOSKeychainAPIChecker::getAllocationNode(
+    const ExplodedNode *N, SymExprRef Sym, CheckerContext &C) const {
   const LocationContext *LeakContext = N->getLocationContext();
   // Walk the ExplodedGraph backwards and find the first node that referred to
   // the tracked symbol.
   const ExplodedNode *AllocNode = N;
 
   while (N) {
     if (!N->getState()->get<AllocatedData>(Sym))
       break;
ProgramStateRef MacOSKeychainAPIChecker::evalAssume(ProgramStateRef State,
   if (!CondBSE)
     return State;
   BinaryOperator::Opcode OpCode = CondBSE->getOpcode();
   if (OpCode != BO_EQ && OpCode != BO_NE)
     return State;
 
   // Match for a restricted set of patterns for cmparison of error codes.
   // Note, the comparisons of type '0 == st' are transformed into SymIntExpr.
-  SymbolRef ReturnSymbol = nullptr;
+  SymExprRef ReturnSymbol = nullptr;
   if (auto *SIE = dyn_cast<SymIntExpr>(CondBSE)) {
     const llvm::APInt &RHS = SIE->getRHS();
     bool ErrorIsReturned = (OpCode == BO_EQ && RHS != NoErr) ||
                            (OpCode == BO_NE && RHS == NoErr);
     if (!Assumption)
       ErrorIsReturned = !ErrorIsReturned;
     if (ErrorIsReturned)
       ReturnSymbol = SIE->getLHS();
ProgramStateRef MacOSKeychainAPIChecker::checkPointerEscape(
     ProgramStateRef State, const InvalidatedSymbols &Escaped,
     const CallEvent *Call, PointerEscapeKind Kind) const {
   // FIXME: This branch doesn't make any sense at all, but it is an overfitted
   // replacement for a previous overfitted code that was making even less sense.
   if (!Call || Call->getDecl())
     return State;
 
   for (auto I : State->get<AllocatedData>()) {
-    SymbolRef Sym = I.first;
+    SymExprRef Sym = I.first;
     if (Escaped.count(Sym))
       State = State->remove<AllocatedData>(Sym);
 
     // This checker is special. Most checkers in fact only track symbols of
     // SymbolConjured type, eg. symbols returned from functions such as
     // malloc(). This checker tracks symbols returned as out-parameters.
     //
     // When a function is evaluated conservatively, the out-parameter's pointee
     // base region gets invalidated with a SymbolConjured. If the base region is
     // larger than the region we're interested in, the value we're interested in
     // would be SymbolDerived based on that SymbolConjured. However, such
     // SymbolDerived will never be listed in the Escaped set when the base
     // region is invalidated because ExprEngine doesn't know which symbols
     // were derived from a given symbol, while there can be infinitely many
     // valid symbols derived from any given symbol.
     //
     // Hence the extra boilerplate: remove the derived symbol when its parent
     // symbol escapes.
     //
     if (const auto *SD = dyn_cast<SymbolDerived>(Sym)) {
-      SymbolRef ParentSym = SD->getParentSymbol();
+      SymExprRef ParentSym = SD->getParentSymbol();
       if (Escaped.count(ParentSym))
         State = State->remove<AllocatedData>(Sym);
     }
   }
   return State;
 }
 
 PathDiagnosticPieceRef

clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp

#define CASE(ID) case ID: OS << #ID; break;
     }
   }
 
   LLVM_DUMP_METHOD void dump() const { dump(llvm::errs()); }
 };
 
 } // end of anonymous namespace
 
-REGISTER_MAP_WITH_PROGRAMSTATE(RegionState, SymbolRef, RefState)
+REGISTER_MAP_WITH_PROGRAMSTATE(RegionState, SymExprRef, RefState)
 
 /// Check if the memory associated with this symbol was released.
-static bool isReleased(SymbolRef Sym, CheckerContext &C);
+static bool isReleased(SymExprRef Sym, CheckerContext &C);
 
 /// Update the RefState to reflect the new memory allocation.
 /// The optional \p RetVal parameter specifies the newly allocated pointer
 /// value; if unspecified, the value of expression \p E is used.
 static ProgramStateRef MallocUpdateRefState(CheckerContext &C, const Expr *E,
                                             ProgramStateRef State,
                                             AllocationFamily Family,
                                             Optional<SVal> RetVal = None);
 
 //===----------------------------------------------------------------------===//
 // The modeling of memory reallocation.
 //
 // The terminology 'toPtr' and 'fromPtr' will be used:
 //   toPtr = realloc(fromPtr, 20);
 //===----------------------------------------------------------------------===//
 
-REGISTER_SET_WITH_PROGRAMSTATE(ReallocSizeZeroSymbols, SymbolRef)
+REGISTER_SET_WITH_PROGRAMSTATE(ReallocSizeZeroSymbols, SymExprRef)
 
 namespace {
 
 /// The state of 'fromPtr' after reallocation is known to have failed.
 enum OwnershipAfterReallocKind {
   // The symbol needs to be freed (e.g.: realloc)
   OAR_ToBeFreedAfterFailure,
   // The symbol has been freed (e.g.: reallocf)

 ///
 /// This is important because realloc may fail, and that needs special modeling.
 /// Whether reallocation failed or not will not be known until later, so we'll
 /// store whether upon failure 'fromPtr' will be freed, or needs to be freed
 /// later, etc.
 struct ReallocPair {
 
   // The 'fromPtr'.
-  SymbolRef ReallocatedSym;
+  SymExprRef ReallocatedSym;
   OwnershipAfterReallocKind Kind;
 
-  ReallocPair(SymbolRef S, OwnershipAfterReallocKind K)
+  ReallocPair(SymExprRef S, OwnershipAfterReallocKind K)
       : ReallocatedSym(S), Kind(K) {}
   void Profile(llvm::FoldingSetNodeID &ID) const {
     ID.AddInteger(Kind);
     ID.AddPointer(ReallocatedSym);
   }
   bool operator==(const ReallocPair &X) const {
     return ReallocatedSym == X.ReallocatedSym &&
            Kind == X.Kind;
   }
 };
 
 } // end of anonymous namespace
 
-REGISTER_MAP_WITH_PROGRAMSTATE(ReallocPairs, SymbolRef, ReallocPair)
+REGISTER_MAP_WITH_PROGRAMSTATE(ReallocPairs, SymExprRef, ReallocPair)
 
 /// Tells if the callee is one of the builtin new/delete operators, including
 /// placement operators and other standard overloads.
 static bool isStandardNewDelete(const FunctionDecl *FD);
 static bool isStandardNewDelete(const CallEvent &Call) {
   if (!Call.getDecl() || !isa<FunctionDecl>(Call.getDecl()))
     return false;
   return isStandardNewDelete(cast<FunctionDecl>(Call.getDecl()));
static ProgramStateRef CallocMem(CheckerContext &C, const CallEvent &Call,
                                    ProgramStateRef State);
 
   /// See if deallocation happens in a suspicious context. If so, escape the
   /// pointers that otherwise would have been deallocated and return true.
   bool suppressDeallocationsInSuspiciousContexts(const CallEvent &Call,
                                                  CheckerContext &C) const;
 
   /// If in \p S  \p Sym is used, check whether \p Sym was already freed.
-  bool checkUseAfterFree(SymbolRef Sym, CheckerContext &C, const Stmt *S) const;
+  bool checkUseAfterFree(SymExprRef Sym, CheckerContext &C,
+                         const Stmt *S) const;
 
   /// If in \p S \p Sym is used, check whether \p Sym was allocated as a zero
   /// sized memory region.
-  void checkUseZeroAllocated(SymbolRef Sym, CheckerContext &C,
+  void checkUseZeroAllocated(SymExprRef Sym, CheckerContext &C,
                              const Stmt *S) const;
 
   /// If in \p S \p Sym is being freed, check whether \p Sym was already freed.
-  bool checkDoubleDelete(SymbolRef Sym, CheckerContext &C) const;
+  bool checkDoubleDelete(SymExprRef Sym, CheckerContext &C) const;
 
   /// Check if the function is known to free memory, or if it is
   /// "interesting" and should be modeled explicitly.
   ///
   /// \param [out] EscapingSymbol A function might not free memory in general,
   ///   but could be known to free a particular symbol. In this case, false is
   ///   returned and the single escaping symbol is returned through the out
   ///   parameter.
   ///
   /// We assume that pointers do not escape through calls to system functions
   /// not handled by this checker.
-  bool mayFreeAnyEscapedMemoryOrIsModeledExplicitly(const CallEvent *Call,
-                                   ProgramStateRef State,
-                                   SymbolRef &EscapingSymbol) const;
+  bool mayFreeAnyEscapedMemoryOrIsModeledExplicitly(
+      const CallEvent *Call, ProgramStateRef State,
+      SymExprRef &EscapingSymbol) const;
 
   /// Implementation of the checkPointerEscape callbacks.
   LLVM_NODISCARD
   ProgramStateRef checkPointerEscapeAux(ProgramStateRef State,
                                         const InvalidatedSymbols &Escaped,
                                         const CallEvent *Call,
                                         PointerEscapeKind Kind,
                                         bool IsConstPointerEscape) const;
 
   // Implementation of the checkPreStmt and checkEndFunction callbacks.
   void checkEscapeOnReturn(const ReturnStmt *S, CheckerContext &C) const;
 
   ///@{
   /// Tells if a given family/call/symbol is tracked by the current checker.
   /// Sets CheckKind to the kind of the checker responsible for this
   /// family/call/symbol.
   Optional<CheckKind> getCheckIfTracked(AllocationFamily Family,
                                         bool IsALeakCheck = false) const;
 
-  Optional<CheckKind> getCheckIfTracked(CheckerContext &C, SymbolRef Sym,
+  Optional<CheckKind> getCheckIfTracked(CheckerContext &C, SymExprRef Sym,
                                         bool IsALeakCheck = false) const;
   ///@}
   static bool SummarizeValue(raw_ostream &os, SVal V);
   static bool SummarizeRegion(raw_ostream &os, const MemRegion *MR);
 
   void HandleNonHeapDealloc(CheckerContext &C, SVal ArgVal, SourceRange Range,
                             const Expr *DeallocExpr,
                             AllocationFamily Family) const;
 
   void HandleFreeAlloca(CheckerContext &C, SVal ArgVal,
                         SourceRange Range) const;
 
   void HandleMismatchedDealloc(CheckerContext &C, SourceRange Range,
                                const Expr *DeallocExpr, const RefState *RS,
-                               SymbolRef Sym, bool OwnershipTransferred) const;
+                               SymExprRef Sym, bool OwnershipTransferred) const;
 
   void HandleOffsetFree(CheckerContext &C, SVal ArgVal, SourceRange Range,
                         const Expr *DeallocExpr, AllocationFamily Family,
                         const Expr *AllocExpr = nullptr) const;
 
   void HandleUseAfterFree(CheckerContext &C, SourceRange Range,
-                          SymbolRef Sym) const;
+                          SymExprRef Sym) const;
 
   void HandleDoubleFree(CheckerContext &C, SourceRange Range, bool Released,
-                        SymbolRef Sym, SymbolRef PrevSym) const;
+                        SymExprRef Sym, SymExprRef PrevSym) const;
 
-  void HandleDoubleDelete(CheckerContext &C, SymbolRef Sym) const;
+  void HandleDoubleDelete(CheckerContext &C, SymExprRef Sym) const;
 
   void HandleUseZeroAlloc(CheckerContext &C, SourceRange Range,
-                          SymbolRef Sym) const;
+                          SymExprRef Sym) const;
 
   void HandleFunctionPtrFree(CheckerContext &C, SVal ArgVal, SourceRange Range,
                              const Expr *FreeExpr,
                              AllocationFamily Family) const;
 
   /// Find the location of the allocation for Sym on the path leading to the
   /// exploded node N.
-  static LeakInfo getAllocationSite(const ExplodedNode *N, SymbolRef Sym,
+  static LeakInfo getAllocationSite(const ExplodedNode *N, SymExprRef Sym,
                                     CheckerContext &C);
 
-  void HandleLeak(SymbolRef Sym, ExplodedNode *N, CheckerContext &C) const;
+  void HandleLeak(SymExprRef Sym, ExplodedNode *N, CheckerContext &C) const;
 
   /// Test if value in ArgVal equals to value in macro `ZERO_SIZE_PTR`.
   bool isArgZERO_SIZE_PTR(ProgramStateRef State, CheckerContext &C,
                           SVal ArgVal) const;
 };
 
 //===----------------------------------------------------------------------===//
 // Definition of MallocBugVisitor.
 //===----------------------------------------------------------------------===//
 
 /// The bug visitor which allows us to print extra diagnostics along the
 /// BugReport path. For example, showing the allocation site of the leaked
 /// region.
 class MallocBugVisitor final : public BugReporterVisitor {
 protected:
   enum NotificationMode { Normal, ReallocationFailed };
 
   // The allocated region symbol tracked by the main analysis.
-  SymbolRef Sym;
+  SymExprRef Sym;
 
   // The mode we are in, i.e. what kind of diagnostics will be emitted.
   NotificationMode Mode;
 
   // A symbol from when the primary region should have been reallocated.
-  SymbolRef FailedReallocSymbol;
+  SymExprRef FailedReallocSymbol;
 
   // A C++ destructor stack frame in which memory was released. Used for
   // miscellaneous false positive suppression.
   const StackFrameContext *ReleaseDestructorLC;
 
   bool IsLeak;
 
 public:
-  MallocBugVisitor(SymbolRef S, bool isLeak = false)
+  MallocBugVisitor(SymExprRef S, bool isLeak = false)
       : Sym(S), Mode(Normal), FailedReallocSymbol(nullptr),
         ReleaseDestructorLC(nullptr), IsLeak(isLeak) {}
 
   static void *getTag() {
     static int Tag = 0;
     return &Tag;
   }
 
PathDiagnosticPieceRef getEndPath(BugReporterContext &BRC,
     return std::make_shared<PathDiagnosticEventPiece>(L, BR.getDescription(),
                                                       false);
   }
 
 private:
   class StackHintGeneratorForReallocationFailed
       : public StackHintGeneratorForSymbol {
   public:
-    StackHintGeneratorForReallocationFailed(SymbolRef S, StringRef M)
+    StackHintGeneratorForReallocationFailed(SymExprRef S, StringRef M)
         : StackHintGeneratorForSymbol(S, M) {}
 
     std::string getMessageForArg(const Expr *ArgE, unsigned ArgIndex) override {
       // Printed parameters start at 1, not 0.
       ++ArgIndex;
 
       SmallString<200> buf;
       llvm::raw_svector_ostream os(buf);
public:
     }
   };
 };
 
 } // end anonymous namespace
 
 // A map from the freed symbol to the symbol representing the return value of
 // the free function.
-REGISTER_MAP_WITH_PROGRAMSTATE(FreeReturnValue, SymbolRef, SymbolRef)
+REGISTER_MAP_WITH_PROGRAMSTATE(FreeReturnValue, SymExprRef, SymExprRef)
 
 namespace {
 class StopTrackingCallback final : public SymbolVisitor {
   ProgramStateRef state;
 
 public:
   StopTrackingCallback(ProgramStateRef st) : state(std::move(st)) {}
   ProgramStateRef getState() const { return state; }
 
-  bool VisitSymbol(SymbolRef sym) override {
+  bool VisitSymbol(SymExprRef sym) override {
     state = state->remove<RegionState>(sym);
     return true;
   }
 };
 } // end anonymous namespace
 
 static bool isStandardNewDelete(const FunctionDecl *FD) {
   if (!FD)
ProgramStateRef MallocChecker::ProcessZeroAllocCheck(
   SValBuilder &SvalBuilder = State->getStateManager().getSValBuilder();
   DefinedSVal Zero =
       SvalBuilder.makeZeroVal(Arg->getType()).castAs<DefinedSVal>();
 
   std::tie(TrueState, FalseState) =
       State->assume(SvalBuilder.evalEQ(State, *DefArgVal, Zero));
 
   if (TrueState && !FalseState) {
-    SymbolRef Sym = RetVal->getAsLocSymbol();
+    SymExprRef Sym = RetVal->getAsLocSymbol();
     if (!Sym)
       return State;
 
     const RefState *RS = State->get<RegionState>(Sym);
     if (RS) {
       if (RS->isAllocated())
         return TrueState->set<RegionState>(Sym,
                                           RefState::getAllocatedOfSizeZero(RS));
static ProgramStateRef MallocUpdateRefState(CheckerContext &C, const Expr *E,
   // Get the return value.
   if (!RetVal)
     RetVal = C.getSVal(E);
 
   // We expect the malloc functions to return a pointer.
   if (!RetVal->getAs<Loc>())
     return nullptr;
 
-  SymbolRef Sym = RetVal->getAsLocSymbol();
+  SymExprRef Sym = RetVal->getAsLocSymbol();
   // This is a return value of a function that was not inlined, such as malloc()
   // or new(). We've checked that in the caller. Therefore, it must be a symbol.
   assert(Sym);
 
   // Set the symbol's state to Allocated.
   return State->set<RegionState>(Sym, RefState::getAllocated(Family, E));
 }
 
if (Call.getNumArgs() < (Num + 1))
     return nullptr;
 
   return FreeMemAux(C, Call.getArgExpr(Num), Call, State, Hold,
                     IsKnownToBeAllocated, Family, ReturnsNullOnFailure);
 }
 
 /// Checks if the previous call to free on the given symbol failed - if free
 /// failed, returns true. Also, returns the corresponding return value symbol.
-static bool didPreviousFreeFail(ProgramStateRef State,
-                                SymbolRef Sym, SymbolRef &RetStatusSymbol) {
-  const SymbolRef *Ret = State->get<FreeReturnValue>(Sym);
+static bool didPreviousFreeFail(ProgramStateRef State, SymExprRef Sym,
+                                SymExprRef &RetStatusSymbol) {
+  const SymExprRef *Ret = State->get<FreeReturnValue>(Sym);
   if (Ret) {
     assert(*Ret && "We should not store the null return symbol");
     ConstraintManager &CMgr = State->getConstraintManager();
     ConditionTruthVal FreeFailed = CMgr.isNull(State, *Ret);
     RetStatusSymbol = *Ret;
     return FreeFailed.isConstrainedTrue();
   }
   return false;
ProgramStateRef MallocChecker::FreeMemAux(
   }
 
   const SymbolicRegion *SrBase = dyn_cast<SymbolicRegion>(R->getBaseRegion());
   // Various cases could lead to non-symbol values here.
   // For now, ignore them.
   if (!SrBase)
     return nullptr;
 
-  SymbolRef SymBase = SrBase->getSymbol();
+  SymExprRef SymBase = SrBase->getSymbol();
   const RefState *RsBase = State->get<RegionState>(SymBase);
-  SymbolRef PreviousRetStatusSymbol = nullptr;
+  SymExprRef PreviousRetStatusSymbol = nullptr;
 
   IsKnownToBeAllocated =
       RsBase && (RsBase->isAllocated() || RsBase->isAllocatedOfSizeZero());
 
   if (RsBase) {
 
     // Memory returned by alloca() shouldn't be freed.
     if (RsBase->getAllocationFamily() == AF_Alloca) {
ProgramStateRef MallocChecker::FreeMemAux(
 
   // Clean out the info on previous call to free return info.
   State = State->remove<FreeReturnValue>(SymBase);
 
   // Keep track of the return value. If it is NULL, we will know that free
   // failed.
   if (ReturnsNullOnFailure) {
     SVal RetVal = C.getSVal(ParentExpr);
-    SymbolRef RetStatusSymbol = RetVal.getAsSymbol();
+    SymExprRef RetStatusSymbol = RetVal.getAsSymbol();
     if (RetStatusSymbol) {
       C.getSymbolManager().addSymbolDependency(SymBase, RetStatusSymbol);
       State = State->set<FreeReturnValue>(SymBase, RetStatusSymbol);
     }
   }
 
   // If we don't know anything about this symbol, a free on it may be totally
   // valid. If this is the case, lets assume that the allocation family of the
MallocChecker::getCheckIfTracked(AllocationFamily Family,
   case AF_None: {
     llvm_unreachable("no family");
   }
   }
   llvm_unreachable("unhandled family");
 }
 
 Optional<MallocChecker::CheckKind>
-MallocChecker::getCheckIfTracked(CheckerContext &C, SymbolRef Sym,
+MallocChecker::getCheckIfTracked(CheckerContext &C, SymExprRef Sym,
                                  bool IsALeakCheck) const {
   if (C.getState()->contains<ReallocSizeZeroSymbols>(Sym))
     return CK_MallocChecker;
 
   const RefState *RS = C.getState()->get<RegionState>(Sym);
   assert(RS);
   return getCheckIfTracked(RS->getAllocationFamily(), IsALeakCheck);
 }
if (ExplodedNode *N = C.generateErrorNode()) {
     R->addRange(Range);
     C.emitReport(std::move(R));
   }
 }
 
 void MallocChecker::HandleMismatchedDealloc(CheckerContext &C,
                                             SourceRange Range,
                                             const Expr *DeallocExpr,
-                                            const RefState *RS, SymbolRef Sym,
+                                            const RefState *RS, SymExprRef Sym,
                                             bool OwnershipTransferred) const {
 
   if (!ChecksEnabled[CK_MismatchedDeallocatorChecker]) {
     C.addSink();
     return;
   }
 
   if (ExplodedNode *N = C.generateErrorNode()) {
void MallocChecker::HandleOffsetFree(CheckerContext &C, SVal ArgVal,
   auto R = std::make_unique<PathSensitiveBugReport>(*BT_OffsetFree[*CheckKind],
                                                     os.str(), N);
   R->markInteresting(MR->getBaseRegion());
   R->addRange(Range);
   C.emitReport(std::move(R));
 }
 
 void MallocChecker::HandleUseAfterFree(CheckerContext &C, SourceRange Range,
-                                       SymbolRef Sym) const {
+                                       SymExprRef Sym) const {
 
   if (!ChecksEnabled[CK_MallocChecker] && !ChecksEnabled[CK_NewDeleteChecker] &&
       !ChecksEnabled[CK_InnerPointerChecker]) {
     C.addSink();
     return;
   }
 
   Optional<MallocChecker::CheckKind> CheckKind = getCheckIfTracked(C, Sym);
if (ExplodedNode *N = C.generateErrorNode()) {
     if (AF == AF_InnerBuffer)
       R->addVisitor(allocation_state::getInnerPointerBRVisitor(Sym));
 
     C.emitReport(std::move(R));
   }
 }
 
 void MallocChecker::HandleDoubleFree(CheckerContext &C, SourceRange Range,
-                                     bool Released, SymbolRef Sym,
-                                     SymbolRef PrevSym) const {
+                                     bool Released, SymExprRef Sym,
+                                     SymExprRef PrevSym) const {
 
   if (!ChecksEnabled[CK_MallocChecker] && !ChecksEnabled[CK_NewDeleteChecker]) {
     C.addSink();
     return;
   }
 
   Optional<MallocChecker::CheckKind> CheckKind = getCheckIfTracked(C, Sym);
   if (!CheckKind.hasValue())
if (ExplodedNode *N = C.generateErrorNode()) {
     R->markInteresting(Sym);
     if (PrevSym)
       R->markInteresting(PrevSym);
     R->addVisitor(std::make_unique<MallocBugVisitor>(Sym));
     C.emitReport(std::move(R));
   }
 }
 
-void MallocChecker::HandleDoubleDelete(CheckerContext &C, SymbolRef Sym) const {
+void MallocChecker::HandleDoubleDelete(CheckerContext &C,
+                                       SymExprRef Sym) const {
 
   if (!ChecksEnabled[CK_NewDeleteChecker]) {
     C.addSink();
     return;
   }
 
   Optional<MallocChecker::CheckKind> CheckKind = getCheckIfTracked(C, Sym);
   if (!CheckKind.hasValue())
if (ExplodedNode *N = C.generateErrorNode()) {
 
     R->markInteresting(Sym);
     R->addVisitor(std::make_unique<MallocBugVisitor>(Sym));
     C.emitReport(std::move(R));
   }
 }
 
 void MallocChecker::HandleUseZeroAlloc(CheckerContext &C, SourceRange Range,
-                                       SymbolRef Sym) const {
+                                       SymExprRef Sym) const {
 
   if (!ChecksEnabled[CK_MallocChecker] && !ChecksEnabled[CK_NewDeleteChecker]) {
     C.addSink();
     return;
   }
 
   Optional<MallocChecker::CheckKind> CheckKind = getCheckIfTracked(C, Sym);
 
if (ProgramStateRef stateFree =
 
     OwnershipAfterReallocKind Kind = OAR_ToBeFreedAfterFailure;
     if (ShouldFreeOnFail)
       Kind = OAR_FreeOnFailure;
     else if (!IsKnownToBeAllocated)
       Kind = OAR_DoNotTrackAfterFailure;
 
     // Get the from and to pointer symbols as in toPtr = realloc(fromPtr, size).
-    SymbolRef FromPtr = arg0Val.getLocSymbolInBase();
+    SymExprRef FromPtr = arg0Val.getLocSymbolInBase();
     SVal RetVal = C.getSVal(CE);
-    SymbolRef ToPtr = RetVal.getAsSymbol();
+    SymExprRef ToPtr = RetVal.getAsSymbol();
     assert(FromPtr && ToPtr &&
            "By this point, FreeMemAux and MallocMemAux should have checked "
            "whether the argument or the return value is symbolic!");
 
     // Record the info about the reallocated symbol so that we could properly
     // process failed reallocation.
     stateRealloc = stateRealloc->set<ReallocPairs>(ToPtr,
                                                    ReallocPair(FromPtr, Kind));
ProgramStateRef MallocChecker::CallocMem(CheckerContext &C,
   SVal zeroVal = svalBuilder.makeZeroVal(svalBuilder.getContext().CharTy);
   SVal TotalSize =
       evalMulForBufferSize(C, Call.getArgExpr(0), Call.getArgExpr(1));
 
   return MallocMemAux(C, Call, TotalSize, zeroVal, State, AF_Malloc);
 }
 
 MallocChecker::LeakInfo MallocChecker::getAllocationSite(const ExplodedNode *N,
-                                                         SymbolRef Sym,
+                                                         SymExprRef Sym,
                                                          CheckerContext &C) {
   const LocationContext *LeakContext = N->getLocationContext();
   // Walk the ExplodedGraph backwards and find the first node that referred to
   // the tracked symbol.
   const ExplodedNode *AllocNode = N;
   const MemRegion *ReferenceRegion = nullptr;
 
   while (N) {
if (NContext == LeakContext ||
         NContext->isParentOf(LeakContext))
       AllocNode = N;
     N = N->pred_empty() ? nullptr : *(N->pred_begin());
   }
 
   return LeakInfo(AllocNode, ReferenceRegion);
 }
 
-void MallocChecker::HandleLeak(SymbolRef Sym, ExplodedNode *N,
+void MallocChecker::HandleLeak(SymExprRef Sym, ExplodedNode *N,
                                CheckerContext &C) const {
 
   if (!ChecksEnabled[CK_MallocChecker] &&
       !ChecksEnabled[CK_NewDeleteLeaksChecker])
     return;
 
   const RefState *RS = C.getState()->get<RegionState>(Sym);
   assert(RS && "cannot leak an untracked symbol");

 void MallocChecker::checkDeadSymbols(SymbolReaper &SymReaper,
                                      CheckerContext &C) const
 {
   ProgramStateRef state = C.getState();
   RegionStateTy OldRS = state->get<RegionState>();
   RegionStateTy::Factory &F = state->get_context<RegionState>();
 
   RegionStateTy RS = OldRS;
-  SmallVector<SymbolRef, 2> Errors;
+  SmallVector<SymExprRef, 2> Errors;
   for (RegionStateTy::iterator I = RS.begin(), E = RS.end(); I != E; ++I) {
     if (SymReaper.isDead(I->first)) {
       if (I->second.isAllocated() || I->second.isAllocatedOfSizeZero())
         Errors.push_back(I->first);
       // Remove the dead symbol from the map.
       RS = F.remove(RS, I->first);
     }
   }
void MallocChecker::checkDeadSymbols(SymbolReaper &SymReaper,
   }
 
   // Generate leak node.
   ExplodedNode *N = C.getPredecessor();
   if (!Errors.empty()) {
     static CheckerProgramPointTag Tag("MallocChecker", "DeadSymbolsLeak");
     N = C.generateNonFatalErrorNode(C.getState(), &Tag);
     if (N) {
-      for (SmallVectorImpl<SymbolRef>::iterator
-           I = Errors.begin(), E = Errors.end(); I != E; ++I) {
+      for (SmallVectorImpl<SymExprRef>::iterator I = Errors.begin(),
+                                                 E = Errors.end();
+           I != E; ++I) {
         HandleLeak(*I, N, C);
       }
     }
   }
 
   C.addTransition(state->set<RegionState>(RS), N);
 }
 
 void MallocChecker::checkPreCall(const CallEvent &Call,
                                  CheckerContext &C) const {
 
   if (const auto *DC = dyn_cast<CXXDeallocatorCall>(&Call)) {
     const CXXDeleteExpr *DE = DC->getOriginExpr();
 
     if (!ChecksEnabled[CK_NewDeleteChecker])
-      if (SymbolRef Sym = C.getSVal(DE->getArgument()).getAsSymbol())
+      if (SymExprRef Sym = C.getSVal(DE->getArgument()).getAsSymbol())
         checkUseAfterFree(Sym, C, DE->getArgument());
 
     if (!isStandardNewDelete(DC->getDecl()))
       return;
 
     ProgramStateRef State = C.getState();
     bool IsKnownToBeAllocated;
     State = FreeMemAux(C, DE->getArgument(), Call, State,
                        /*Hold*/ false, IsKnownToBeAllocated,
                        (DE->isArrayForm() ? AF_CXXNewArray : AF_CXXNew));
 
     C.addTransition(State);
     return;
   }
 
   if (const auto *DC = dyn_cast<CXXDestructorCall>(&Call)) {
-    SymbolRef Sym = DC->getCXXThisVal().getAsSymbol();
+    SymExprRef Sym = DC->getCXXThisVal().getAsSymbol();
     if (!Sym || checkDoubleDelete(Sym, C))
       return;
   }
 
   // We will check for double free in the post visit.
   if (const AnyFunctionCall *FC = dyn_cast<AnyFunctionCall>(&Call)) {
     const FunctionDecl *FD = FC->getDecl();
     if (!FD)
       return;
 
     if (ChecksEnabled[CK_MallocChecker] && isFreeingCall(Call))
       return;
   }
 
   // Check if the callee of a method is deleted.
   if (const CXXInstanceCall *CC = dyn_cast<CXXInstanceCall>(&Call)) {
-    SymbolRef Sym = CC->getCXXThisVal().getAsSymbol();
+    SymExprRef Sym = CC->getCXXThisVal().getAsSymbol();
     if (!Sym || checkUseAfterFree(Sym, C, CC->getCXXThisExpr()))
       return;
   }
 
   // Check arguments for being used after free.
   for (unsigned I = 0, E = Call.getNumArgs(); I != E; ++I) {
     SVal ArgSVal = Call.getArgSVal(I);
     if (ArgSVal.getAs<Loc>()) {
-      SymbolRef Sym = ArgSVal.getAsSymbol();
+      SymExprRef Sym = ArgSVal.getAsSymbol();
       if (!Sym)
         continue;
       if (checkUseAfterFree(Sym, C, Call.getArgExpr(I)))
         return;
     }
   }
 }
 
void MallocChecker::checkEscapeOnReturn(const ReturnStmt *S,
 
   const Expr *E = S->getRetValue();
   if (!E)
     return;
 
   // Check if we are returning a symbol.
   ProgramStateRef State = C.getState();
   SVal RetVal = C.getSVal(E);
-  SymbolRef Sym = RetVal.getAsSymbol();
+  SymExprRef Sym = RetVal.getAsSymbol();
   if (!Sym)
     // If we are returning a field of the allocated struct or an array element,
     // the callee could still free the memory.
     // TODO: This logic should be a part of generic symbol escape callback.
     if (const MemRegion *MR = RetVal.getAsRegion())
       if (isa<FieldRegion>(MR) || isa<ElementRegion>(MR))
         if (const SymbolicRegion *BMR =
               dyn_cast<SymbolicRegion>(MR->getBaseRegion()))
for ( ; I != E; ++I) {
     Regions.push_back(VR);
   }
 
   state =
     state->scanReachableSymbols<StopTrackingCallback>(Regions).getState();
   C.addTransition(state);
 }
 
-static bool isReleased(SymbolRef Sym, CheckerContext &C) {
+static bool isReleased(SymExprRef Sym, CheckerContext &C) {
   assert(Sym);
   const RefState *RS = C.getState()->get<RegionState>(Sym);
   return (RS && RS->isReleased());
 }
 
 bool MallocChecker::suppressDeallocationsInSuspiciousContexts(
     const CallEvent &Call, CheckerContext &C) const {
   if (Call.getNumArgs() == 0)
bool MallocChecker::suppressDeallocationsInSuspiciousContexts(
 
   // We do not model the Integer Set Library's retain-count based allocation.
   if (!FunctionStr.contains("__isl_"))
     return false;
 
   ProgramStateRef State = C.getState();
 
   for (const Expr *Arg : cast<CallExpr>(Call.getOriginExpr())->arguments())
-    if (SymbolRef Sym = C.getSVal(Arg).getAsSymbol())
+    if (SymExprRef Sym = C.getSVal(Arg).getAsSymbol())
       if (const RefState *RS = State->get<RegionState>(Sym))
         State = State->set<RegionState>(Sym, RefState::getEscaped(RS));
 
   C.addTransition(State);
   return true;
 }
 
-bool MallocChecker::checkUseAfterFree(SymbolRef Sym, CheckerContext &C,
+bool MallocChecker::checkUseAfterFree(SymExprRef Sym, CheckerContext &C,
                                       const Stmt *S) const {
 
   if (isReleased(Sym, C)) {
     HandleUseAfterFree(C, S->getSourceRange(), Sym);
     return true;
   }
 
   return false;
 }
 
-void MallocChecker::checkUseZeroAllocated(SymbolRef Sym, CheckerContext &C,
+void MallocChecker::checkUseZeroAllocated(SymExprRef Sym, CheckerContext &C,
                                           const Stmt *S) const {
   assert(Sym);
 
   if (const RefState *RS = C.getState()->get<RegionState>(Sym)) {
     if (RS->isAllocatedOfSizeZero())
       HandleUseZeroAlloc(C, RS->getStmt()->getSourceRange(), Sym);
   }
   else if (C.getState()->contains<ReallocSizeZeroSymbols>(Sym)) {
     HandleUseZeroAlloc(C, S->getSourceRange(), Sym);
   }
 }
 
-bool MallocChecker::checkDoubleDelete(SymbolRef Sym, CheckerContext &C) const {
+bool MallocChecker::checkDoubleDelete(SymExprRef Sym, CheckerContext &C) const {
 
   if (isReleased(Sym, C)) {
     HandleDoubleDelete(C, Sym);
     return true;
   }
   return false;
 }
 
 // Check if the location is a freed symbolic region.
 void MallocChecker::checkLocation(SVal l, bool isLoad, const Stmt *S,
                                   CheckerContext &C) const {
-  SymbolRef Sym = l.getLocSymbolInBase();
+  SymExprRef Sym = l.getLocSymbolInBase();
   if (Sym) {
     checkUseAfterFree(Sym, C, S);
     checkUseZeroAllocated(Sym, C, S);
   }
 }
 
 // If a symbolic region is assumed to NULL (or another constant), stop tracking
 // it - assuming that allocation failed on this path.
ProgramStateRef MallocChecker::evalAssume(ProgramStateRef state,
   ReallocPairsTy RP = state->get<ReallocPairs>();
   for (ReallocPairsTy::iterator I = RP.begin(), E = RP.end(); I != E; ++I) {
     // If the symbol is assumed to be NULL, remove it from consideration.
     ConstraintManager &CMgr = state->getConstraintManager();
     ConditionTruthVal AllocFailed = CMgr.isNull(state, I.getKey());
     if (!AllocFailed.isConstrainedTrue())
       continue;
 
-    SymbolRef ReallocSym = I.getData().ReallocatedSym;
+    SymExprRef ReallocSym = I.getData().ReallocatedSym;
     if (const RefState *RS = state->get<RegionState>(ReallocSym)) {
       if (RS->isReleased()) {
         switch (I.getData().Kind) {
         case OAR_ToBeFreedAfterFailure:
           state = state->set<RegionState>(ReallocSym,
               RefState::getAllocated(RS->getAllocationFamily(), RS->getStmt()));
           break;
         case OAR_DoNotTrackAfterFailure:
           state = state->remove<RegionState>(ReallocSym);
           break;
         default:
           assert(I.getData().Kind == OAR_FreeOnFailure);
         }
       }
     }
     state = state->remove<ReallocPairs>(I.getKey());
   }
 
   return state;
 }
 
 bool MallocChecker::mayFreeAnyEscapedMemoryOrIsModeledExplicitly(
-                                              const CallEvent *Call,
-                                              ProgramStateRef State,
-                                              SymbolRef &EscapingSymbol) const {
+    const CallEvent *Call, ProgramStateRef State,
+    SymExprRef &EscapingSymbol) const {
   assert(Call);
   EscapingSymbol = nullptr;
 
   // For now, assume that any C++ or block call can free memory.
   // TODO: If we want to be more optimistic here, we'll need to make sure that
   // regions escape to C++ containers. They seem to do that even now, but for
   // mysterious reasons.
   if (!(isa<SimpleFunctionCall>(Call) || isa<ObjCMethodCall>(Call)))

 }
 
 ProgramStateRef MallocChecker::checkPointerEscapeAux(
     ProgramStateRef State, const InvalidatedSymbols &Escaped,
     const CallEvent *Call, PointerEscapeKind Kind,
     bool IsConstPointerEscape) const {
   // If we know that the call does not free memory, or we want to process the
   // call later, keep tracking the top level arguments.
-  SymbolRef EscapingSymbol = nullptr;
+  SymExprRef EscapingSymbol = nullptr;
   if (Kind == PSK_DirectEscapeOnCall &&
       !mayFreeAnyEscapedMemoryOrIsModeledExplicitly(Call, State,
                                                     EscapingSymbol) &&
       !EscapingSymbol) {
     return State;
   }
 
   for (InvalidatedSymbols::const_iterator I = Escaped.begin(),
        E = Escaped.end();
        I != E; ++I) {
-    SymbolRef sym = *I;
+    SymExprRef sym = *I;
 
     if (EscapingSymbol && EscapingSymbol != sym)
       continue;
 
     if (const RefState *RS = State->get<RegionState>(sym))
       if (RS->isAllocated() || RS->isAllocatedOfSizeZero())
         if (!IsConstPointerEscape || checkIfNewOrNewArrayFamily(RS))
           State = State->set<RegionState>(sym, RefState::getEscaped(RS));
   }
   return State;
 }
 
 bool MallocChecker::isArgZERO_SIZE_PTR(ProgramStateRef State, CheckerContext &C,
                                        SVal ArgVal) const {
   if (!KernelZeroSizePtrValue)
     KernelZeroSizePtrValue =
         tryExpandAsInteger("ZERO_SIZE_PTR", C.getPreprocessor());
 
   const llvm::APSInt *ArgValKnown =
       C.getSValBuilder().getKnownValue(State, ArgVal);
   return ArgValKnown && *KernelZeroSizePtrValue &&
          ArgValKnown->getSExtValue() == **KernelZeroSizePtrValue;
 }
 
-static SymbolRef findFailedReallocSymbol(ProgramStateRef currState,
+static SymExprRef findFailedReallocSymbol(ProgramStateRef currState,
                                           ProgramStateRef prevState) {
   ReallocPairsTy currMap = currState->get<ReallocPairs>();
   ReallocPairsTy prevMap = prevState->get<ReallocPairs>();
 
   for (const ReallocPairsTy::value_type &Pair : prevMap) {
-    SymbolRef sym = Pair.first;
+    SymExprRef sym = Pair.first;
     if (!currMap.lookup(sym))
       return sym;
   }
 
   return nullptr;
 }
 
 static bool isReferenceCountingPointerDestructor(const CXXDestructorDecl *DD) {
if (isAllocated(RSCurr, RSPrev, S)) {
       Msg = "Memory ownership is transferred";
       StackHint = std::make_unique<StackHintGeneratorForSymbol>(Sym, "");
     } else if (hasReallocFailed(RSCurr, RSPrev, S)) {
       Mode = ReallocationFailed;
       Msg = "Reallocation failed";
       StackHint = std::make_unique<StackHintGeneratorForReallocationFailed>(
           Sym, "Reallocation failed");
 
-      if (SymbolRef sym = findFailedReallocSymbol(state, statePrev)) {
+      if (SymExprRef sym = findFailedReallocSymbol(state, statePrev)) {
         // Is it possible to fail two reallocs WITHOUT testing in between?
         assert((!FailedReallocSymbol || FailedReallocSymbol == sym) &&
           "We only support one failed realloc at a time.");
         BR.markInteresting(sym);
         FailedReallocSymbol = sym;
       }
     }
 
if (!RS.isEmpty()) {
     }
   }
 }
 
 namespace clang {
 namespace ento {
 namespace allocation_state {
 
-ProgramStateRef
-markReleased(ProgramStateRef State, SymbolRef Sym, const Expr *Origin) {
+ProgramStateRef markReleased(ProgramStateRef State, SymExprRef Sym,
+                             const Expr *Origin) {
   AllocationFamily Family = AF_InnerBuffer;
   return State->set<RegionState>(Sym, RefState::getReleased(Family, Origin));
 }
 
 } // end namespace allocation_state
 } // end namespace ento
 } // end namespace clang
 

clang/lib/StaticAnalyzer/Checkers/MoveChecker.cpp

for (auto &E : State->get<TrackedRegionMap>()) {
     if (Region->isSubRegionOf(E.first) && E.second.isReported())
       return true;
   }
   return false;
 }
 
 static const MemRegion *unwrapRValueReferenceIndirection(const MemRegion *MR) {
   if (const auto *SR = dyn_cast_or_null<SymbolicRegion>(MR)) {
-    SymbolRef Sym = SR->getSymbol();
+    SymExprRef Sym = SR->getSymbol();
     if (Sym->getType()->isRValueReferenceType())
       if (const MemRegion *OriginMR = Sym->getOriginRegion())
         return OriginMR;
   }
   return MR;
 }
 
 PathDiagnosticPieceRef

clang/lib/StaticAnalyzer/Checkers/NSErrorChecker.cpp

public:
   NSOrCFErrorDerefChecker() : NSErrorII(nullptr), CFErrorII(nullptr) {}
 
   void checkLocation(SVal loc, bool isLoad, const Stmt *S,
                      CheckerContext &C) const;
   void checkEvent(ImplicitNullDerefEvent event) const;
 };
 }
 
-typedef llvm::ImmutableMap<SymbolRef, unsigned> ErrorOutFlag;
+typedef llvm::ImmutableMap<SymExprRef, unsigned> ErrorOutFlag;
 REGISTER_TRAIT_WITH_PROGRAMSTATE(NSErrorOut, ErrorOutFlag)
 REGISTER_TRAIT_WITH_PROGRAMSTATE(CFErrorOut, ErrorOutFlag)
 
 template <typename T>
 static bool hasFlag(SVal val, ProgramStateRef state) {
-  if (SymbolRef sym = val.getAsSymbol())
+  if (SymExprRef sym = val.getAsSymbol())
     if (const unsigned *attachedFlags = state->get<T>(sym))
       return *attachedFlags;
   return false;
 }
 
 template <typename T>
 static void setFlag(ProgramStateRef state, SVal val, CheckerContext &C) {
   // We tag the symbol that the SVal wraps.
-  if (SymbolRef sym = val.getAsSymbol())
+  if (SymExprRef sym = val.getAsSymbol())
     C.addTransition(state->set<T>(sym, true));
 }
 
 static QualType parameterTypeFromSVal(SVal val, CheckerContext &C) {
   const StackFrameContext * SFC = C.getStackFrame();
   if (Optional<loc::MemRegionVal> X = val.getAs<loc::MemRegionVal>()) {
     const MemRegion* R = X->getRegion();
     if (const VarRegion *VR = R->getAs<VarRegion>())

clang/lib/StaticAnalyzer/Checkers/NullabilityChecker.cpp

void NullabilityChecker::checkBind(SVal L, SVal V, const Stmt *S,
 
   auto ValDefOrUnknown = V.getAs<DefinedOrUnknownSVal>();
   if (!ValDefOrUnknown)
     return;
 
   NullConstraint RhsNullness = getNullConstraint(*ValDefOrUnknown, State);
 
   Nullability ValNullability = Nullability::Unspecified;
-  if (SymbolRef Sym = ValDefOrUnknown->getAsSymbol())
+  if (SymExprRef Sym = ValDefOrUnknown->getAsSymbol())
     ValNullability = getNullabilityAnnotation(Sym->getType());
 
   Nullability LocNullability = getNullabilityAnnotation(LocType);
 
   // If the type of the RHS expression is nonnull, don't warn. This
   // enables explicit suppression with a cast to nonnull.
   Nullability ValueExprTypeLevelNullability = Nullability::Unspecified;
   const Expr *ValueExpr = matchValueExprForBind(S);

clang/lib/StaticAnalyzer/Checkers/ObjCContainersChecker.cpp

class ObjCContainersChecker : public Checker< check::PreStmt<CallExpr>,
                                              check::PointerEscape> {
   mutable std::unique_ptr<BugType> BT;
   inline void initBugType() const {
     if (!BT)
       BT.reset(new BugType(this, "CFArray API",
                            categories::CoreFoundationObjectiveC));
   }
 
-  inline SymbolRef getArraySym(const Expr *E, CheckerContext &C) const {
+  inline SymExprRef getArraySym(const Expr *E, CheckerContext &C) const {
     SVal ArrayRef = C.getSVal(E);
-    SymbolRef ArraySym = ArrayRef.getAsSymbol();
+    SymExprRef ArraySym = ArrayRef.getAsSymbol();
     return ArraySym;
   }
 
   void addSizeInfo(const Expr *Array, const Expr *Size,
                    CheckerContext &C) const;
 
 public:
   /// A tag to id this checker.
   static void *getTag() { static int Tag; return &Tag; }
 
   void checkPostStmt(const CallExpr *CE, CheckerContext &C) const;
   void checkPreStmt(const CallExpr *CE, CheckerContext &C) const;
   ProgramStateRef checkPointerEscape(ProgramStateRef State,
                                      const InvalidatedSymbols &Escaped,
                                      const CallEvent *Call,
                                      PointerEscapeKind Kind) const;
 
   void printState(raw_ostream &OS, ProgramStateRef State,
                   const char *NL, const char *Sep) const override;
 };
 } // end anonymous namespace
 
 // ProgramState trait - a map from array symbol to its state.
-REGISTER_MAP_WITH_PROGRAMSTATE(ArraySizeMap, SymbolRef, DefinedSVal)
+REGISTER_MAP_WITH_PROGRAMSTATE(ArraySizeMap, SymExprRef, DefinedSVal)
 
 void ObjCContainersChecker::addSizeInfo(const Expr *Array, const Expr *Size,
                                         CheckerContext &C) const {
   ProgramStateRef State = C.getState();
   SVal SizeV = C.getSVal(Size);
   // Undefined is reported by another checker.
   if (SizeV.isUnknownOrUndef())
     return;
 
   // Get the ArrayRef symbol.
   SVal ArrayRef = C.getSVal(Array);
-  SymbolRef ArraySym = ArrayRef.getAsSymbol();
+  SymExprRef ArraySym = ArrayRef.getAsSymbol();
   if (!ArraySym)
     return;
 
   C.addTransition(
       State->set<ArraySizeMap>(ArraySym, SizeV.castAs<DefinedSVal>()));
 }
 
 void ObjCContainersChecker::checkPostStmt(const CallExpr *CE,
void ObjCContainersChecker::checkPreStmt(const CallExpr *CE,
 
   // Check the array access.
   if (Name.equals("CFArrayGetValueAtIndex")) {
     ProgramStateRef State = C.getState();
     // Retrieve the size.
     // Find out if we saw this array symbol before and have information about
     // it.
     const Expr *ArrayExpr = CE->getArg(0);
-    SymbolRef ArraySym = getArraySym(ArrayExpr, C);
+    SymExprRef ArraySym = getArraySym(ArrayExpr, C);
     if (!ArraySym)
       return;
 
     const DefinedSVal *Size = State->get<ArraySizeMap>(ArraySym);
 
     if (!Size)
       return;
 

clang/lib/StaticAnalyzer/Checkers/ObjCSelfInitChecker.cpp

enum SelfFlagEnum {
   SelfFlag_None = 0x0,
   /// Value came from 'self'.
   SelfFlag_Self    = 0x1,
   /// Value came from the result of an initializer (e.g. [super init]).
   SelfFlag_InitRes = 0x2
 };
 }
 
-REGISTER_MAP_WITH_PROGRAMSTATE(SelfFlag, SymbolRef, unsigned)
+REGISTER_MAP_WITH_PROGRAMSTATE(SelfFlag, SymExprRef, unsigned)
 REGISTER_TRAIT_WITH_PROGRAMSTATE(CalledInit, bool)
 
 /// A call receiving a reference to 'self' invalidates the object that
 /// 'self' contains. This keeps the "self flags" assigned to the 'self'
 /// object before the call so we can assign them to the new object that 'self'
 /// points to after the call.
 REGISTER_TRAIT_WITH_PROGRAMSTATE(PreCallSelfFlags, unsigned)
 
 static SelfFlagEnum getSelfFlags(SVal val, ProgramStateRef state) {
-  if (SymbolRef sym = val.getAsSymbol())
+  if (SymExprRef sym = val.getAsSymbol())
     if (const unsigned *attachedFlags = state->get<SelfFlag>(sym))
       return (SelfFlagEnum)*attachedFlags;
   return SelfFlag_None;
 }
 
 static SelfFlagEnum getSelfFlags(SVal val, CheckerContext &C) {
   return getSelfFlags(val, C.getState());
 }
 
 static void addSelfFlag(ProgramStateRef state, SVal val,
                         SelfFlagEnum flag, CheckerContext &C) {
   // We tag the symbol that the SVal wraps.
-  if (SymbolRef sym = val.getAsSymbol()) {
+  if (SymExprRef sym = val.getAsSymbol()) {
     state = state->set<SelfFlag>(sym, getSelfFlags(val, state) | flag);
     C.addTransition(state);
   }
 }
 
 static bool hasSelfFlag(SVal val, SelfFlagEnum flag, CheckerContext &C) {
   return getSelfFlags(val, C) & flag;
 }
void ObjCSelfInitChecker::checkBind(SVal loc, SVal val, const Stmt *S,
   if ((isSelfVar(loc, C)) &&
       !hasSelfFlag(val, SelfFlag_InitRes, C) &&
       !hasSelfFlag(val, SelfFlag_Self, C) &&
       !isSelfVar(val, C)) {
 
     // Stop tracking the checker-specific state in the state.
     ProgramStateRef State = C.getState();
     State = State->remove<CalledInit>();
-    if (SymbolRef sym = loc.getAsSymbol())
+    if (SymExprRef sym = loc.getAsSymbol())
       State = State->remove<SelfFlag>(sym);
     C.addTransition(State);
   }
 }
 
 void ObjCSelfInitChecker::printState(raw_ostream &Out, ProgramStateRef State,
                                      const char *NL, const char *Sep) const {
   SelfFlagTy FlagMap = State->get<SelfFlag>();

clang/lib/StaticAnalyzer/Checkers/ObjCSuperDeallocChecker.cpp

public:
 
   void checkLocation(SVal l, bool isLoad, const Stmt *S,
                      CheckerContext &C) const;
 
 private:
 
   void diagnoseCallArguments(const CallEvent &CE, CheckerContext &C) const;
 
-  void reportUseAfterDealloc(SymbolRef Sym, StringRef Desc, const Stmt *S,
+  void reportUseAfterDealloc(SymExprRef Sym, StringRef Desc, const Stmt *S,
                              CheckerContext &C) const;
 };
 
 } // End anonymous namespace.
 
 // Remember whether [super dealloc] has previously been called on the
-// SymbolRef for the receiver.
-REGISTER_SET_WITH_PROGRAMSTATE(CalledSuperDealloc, SymbolRef)
+// SymExprRef for the receiver.
+REGISTER_SET_WITH_PROGRAMSTATE(CalledSuperDealloc, SymExprRef)
 
 namespace {
 class SuperDeallocBRVisitor final : public BugReporterVisitor {
-  SymbolRef ReceiverSymbol;
+  SymExprRef ReceiverSymbol;
   bool Satisfied;
 
 public:
-  SuperDeallocBRVisitor(SymbolRef ReceiverSymbol)
+  SuperDeallocBRVisitor(SymExprRef ReceiverSymbol)
       : ReceiverSymbol(ReceiverSymbol), Satisfied(false) {}
 
   PathDiagnosticPieceRef VisitNode(const ExplodedNode *Succ,
                                    BugReporterContext &BRC,
                                    PathSensitiveBugReport &BR) override;
 
   void Profile(llvm::FoldingSetNodeID &ID) const override {
     ID.Add(ReceiverSymbol);
   }
 };
 } // End anonymous namespace.
 
 void ObjCSuperDeallocChecker::checkPreObjCMessage(const ObjCMethodCall &M,
                                                   CheckerContext &C) const {
 
   ProgramStateRef State = C.getState();
-  SymbolRef ReceiverSymbol = M.getReceiverSVal().getAsSymbol();
+  SymExprRef ReceiverSymbol = M.getReceiverSVal().getAsSymbol();
   if (!ReceiverSymbol) {
     diagnoseCallArguments(M, C);
     return;
   }
 
   bool AlreadyCalled = State->contains<CalledSuperDealloc>(ReceiverSymbol);
   if (!AlreadyCalled)
     return;

 void ObjCSuperDeallocChecker::checkPostObjCMessage(const ObjCMethodCall &M,
                                                    CheckerContext &C) const {
   // Check for [super dealloc] method call.
   if (!isSuperDeallocMessage(M))
     return;
 
   ProgramStateRef State = C.getState();
   const LocationContext *LC = C.getLocationContext();
-  SymbolRef SelfSymbol = State->getSelfSVal(LC).getAsSymbol();
+  SymExprRef SelfSymbol = State->getSelfSVal(LC).getAsSymbol();
   assert(SelfSymbol && "No receiver symbol at call to [super dealloc]?");
 
   // We add this transition in checkPostObjCMessage to avoid warning when
   // we inline a call to [super dealloc] where the inlined call itself
   // calls [super dealloc].
   State = State->add<CalledSuperDealloc>(SelfSymbol);
   C.addTransition(State);
 }
 
 void ObjCSuperDeallocChecker::checkLocation(SVal L, bool IsLoad, const Stmt *S,
                                   CheckerContext &C) const {
-  SymbolRef BaseSym = L.getLocSymbolInBase();
+  SymExprRef BaseSym = L.getLocSymbolInBase();
   if (!BaseSym)
     return;
 
   ProgramStateRef State = C.getState();
 
   if (!State->contains<CalledSuperDealloc>(BaseSym))
     return;
 
void ObjCSuperDeallocChecker::checkLocation(SVal L, bool IsLoad, const Stmt *S,
   }
 
   reportUseAfterDealloc(BaseSym, Desc, S, C);
 }
 
 /// Report a use-after-dealloc on Sym. If not empty,
 /// Desc will be used to describe the error; otherwise,
 /// a default warning will be used.
-void ObjCSuperDeallocChecker::reportUseAfterDealloc(SymbolRef Sym,
+void ObjCSuperDeallocChecker::reportUseAfterDealloc(SymExprRef Sym,
                                                     StringRef Desc,
                                                     const Stmt *S,
                                                     CheckerContext &C) const {
   // We have a use of self after free.
   // This likely causes a crash, so stop exploring the
   // path by generating a sink.
   ExplodedNode *ErrNode = C.generateErrorNode();
   // If we've already reached this node on another path, return.

 
 /// Diagnose if any of the arguments to CE have already been
 /// dealloc'd.
 void ObjCSuperDeallocChecker::diagnoseCallArguments(const CallEvent &CE,
                                                     CheckerContext &C) const {
   ProgramStateRef State = C.getState();
   unsigned ArgCount = CE.getNumArgs();
   for (unsigned I = 0; I < ArgCount; I++) {
-    SymbolRef Sym = CE.getArgSVal(I).getAsSymbol();
+    SymExprRef Sym = CE.getArgSVal(I).getAsSymbol();
     if (!Sym)
       continue;
 
     if (State->contains<CalledSuperDealloc>(Sym)) {
       reportUseAfterDealloc(Sym, StringRef(), CE.getArgExpr(I), C);
       return;
     }
   }

clang/lib/StaticAnalyzer/Checkers/PthreadLockChecker.cpp

CallDescriptionMap<FnCheck> C11Callbacks = {
       {{"mtx_unlock", 1}, &PthreadLockChecker::ReleaseAnyLock},
 
       // Destroy
       {{"mtx_destroy", 1}, &PthreadLockChecker::DestroyPthreadLock},
   };
 
   ProgramStateRef resolvePossiblyDestroyedMutex(ProgramStateRef state,
                                                 const MemRegion *lockR,
-                                                const SymbolRef *sym) const;
+                                                const SymExprRef *sym) const;
   void reportBug(CheckerContext &C, std::unique_ptr<BugType> BT[],
                  const Expr *MtxExpr, CheckerKind CheckKind,
                  StringRef Desc) const;
 
   // Init.
   void InitAnyLock(const CallEvent &Call, CheckerContext &C,
                    CheckerKind CheckKind) const;
   void InitLockAux(const CallEvent &Call, CheckerContext &C,

 
 // A stack of locks for tracking lock-unlock order.
 REGISTER_LIST_WITH_PROGRAMSTATE(LockSet, const MemRegion *)
 
 // An entry for tracking lock states.
 REGISTER_MAP_WITH_PROGRAMSTATE(LockMap, const MemRegion *, LockState)
 
 // Return values for unresolved calls to pthread_mutex_destroy().
-REGISTER_MAP_WITH_PROGRAMSTATE(DestroyRetVal, const MemRegion *, SymbolRef)
+REGISTER_MAP_WITH_PROGRAMSTATE(DestroyRetVal, const MemRegion *, SymExprRef)
 
 void PthreadLockChecker::checkPostCall(const CallEvent &Call,
                                        CheckerContext &C) const {
   // An additional umbrella check that all functions modeled by this checker
   // are global C functions.
   // TODO: Maybe make this the default behavior of CallDescription
   // with exactly one identifier?
   // FIXME: Try to handle cases when the implementation was inlined rather

 // the 'possibly destroyed' state. There is a short time frame for the
 // programmer to check the return value to see if the lock was successfully
 // destroyed. Before we model the next operation over that lock, we call this
 // function to see if the return value was checked by now and set the lock state
 // - either to destroyed state or back to its previous state.
 
 // In PthreadSemantics, pthread_mutex_destroy() returns zero if the lock is
 // successfully destroyed and it returns a non-zero value otherwise.
-ProgramStateRef PthreadLockChecker::resolvePossiblyDestroyedMutex(
-    ProgramStateRef state, const MemRegion *lockR, const SymbolRef *sym) const {
+ProgramStateRef
+PthreadLockChecker::resolvePossiblyDestroyedMutex(ProgramStateRef state,
+                                                  const MemRegion *lockR,
+                                                  const SymExprRef *sym) const {
   const LockState *lstate = state->get<LockMap>(lockR);
   // Existence in DestroyRetVal ensures existence in LockMap.
   // Existence in Destroyed also ensures that the lock state for lockR is either
   // UntouchedAndPossiblyDestroyed or UnlockedAndPossiblyDestroyed.
   assert(lstate->isUntouchedAndPossiblyDestroyed() ||
          lstate->isUnlockedAndPossiblyDestroyed());
 
   ConstraintManager &CMgr = state->getConstraintManager();
void PthreadLockChecker::AcquireLockAux(const CallEvent &Call,
   if (!ChecksEnabled[CheckKind])
     return;
 
   const MemRegion *lockR = MtxVal.getAsRegion();
   if (!lockR)
     return;
 
   ProgramStateRef state = C.getState();
-  const SymbolRef *sym = state->get<DestroyRetVal>(lockR);
+  const SymExprRef *sym = state->get<DestroyRetVal>(lockR);
   if (sym)
     state = resolvePossiblyDestroyedMutex(state, lockR, sym);
 
   if (const LockState *LState = state->get<LockMap>(lockR)) {
     if (LState->isLocked()) {
       reportBug(C, BT_doublelock, MtxExpr, CheckKind,
                 "This lock has already been acquired");
       return;
void PthreadLockChecker::ReleaseLockAux(const CallEvent &Call,
   if (!ChecksEnabled[CheckKind])
     return;
 
   const MemRegion *lockR = MtxVal.getAsRegion();
   if (!lockR)
     return;
 
   ProgramStateRef state = C.getState();
-  const SymbolRef *sym = state->get<DestroyRetVal>(lockR);
+  const SymExprRef *sym = state->get<DestroyRetVal>(lockR);
   if (sym)
     state = resolvePossiblyDestroyedMutex(state, lockR, sym);
 
   if (const LockState *LState = state->get<LockMap>(lockR)) {
     if (LState->isUnlocked()) {
       reportBug(C, BT_doubleunlock, MtxExpr, CheckKind,
                 "This lock has already been unlocked");
       return;
if (!ChecksEnabled[CheckKind])
     return;
 
   const MemRegion *LockR = MtxVal.getAsRegion();
   if (!LockR)
     return;
 
   ProgramStateRef State = C.getState();
 
-  const SymbolRef *sym = State->get<DestroyRetVal>(LockR);
+  const SymExprRef *sym = State->get<DestroyRetVal>(LockR);
   if (sym)
     State = resolvePossiblyDestroyedMutex(State, LockR, sym);
 
   const LockState *LState = State->get<LockMap>(LockR);
   // Checking the return value of the destroy method only in the case of
   // PthreadSemantics
   if (Semantics == PthreadSemantics) {
     if (!LState || LState->isUnlocked()) {
-      SymbolRef sym = Call.getReturnValue().getAsSymbol();
+      SymExprRef sym = Call.getReturnValue().getAsSymbol();
       if (!sym) {
         State = State->remove<LockMap>(LockR);
         C.addTransition(State);
         return;
       }
       State = State->set<DestroyRetVal>(LockR, sym);
       if (LState && LState->isUnlocked())
         State = State->set<LockMap>(
if (!ChecksEnabled[CheckKind])
     return;
 
   const MemRegion *LockR = MtxVal.getAsRegion();
   if (!LockR)
     return;
 
   ProgramStateRef State = C.getState();
 
-  const SymbolRef *sym = State->get<DestroyRetVal>(LockR);
+  const SymExprRef *sym = State->get<DestroyRetVal>(LockR);
   if (sym)
     State = resolvePossiblyDestroyedMutex(State, LockR, sym);
 
   const struct LockState *LState = State->get<LockMap>(LockR);
   if (!LState || LState->isDestroyed()) {
     State = State->set<LockMap>(LockR, LockState::getUnlocked());
     C.addTransition(State);
     return;

clang/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountChecker.h

public:
   ProgramStateRef
   checkRegionChanges(ProgramStateRef state,
                      const InvalidatedSymbols *invalidated,
                      ArrayRef<const MemRegion *> ExplicitRegions,
                      ArrayRef<const MemRegion *> Regions,
                      const LocationContext* LCtx,
                      const CallEvent *Call) const;
 
-  ExplodedNode* checkReturnWithRetEffect(const ReturnStmt *S, CheckerContext &C,
-                                ExplodedNode *Pred, RetEffect RE, RefVal X,
-                                SymbolRef Sym, ProgramStateRef state) const;
+  ExplodedNode *checkReturnWithRetEffect(const ReturnStmt *S, CheckerContext &C,
+                                         ExplodedNode *Pred, RetEffect RE,
+                                         RefVal X, SymExprRef Sym,
+                                         ProgramStateRef state) const;
 
   void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const;
   void checkBeginFunction(CheckerContext &C) const;
   void checkEndFunction(const ReturnStmt *RS, CheckerContext &C) const;
 
-  ProgramStateRef updateSymbol(ProgramStateRef state, SymbolRef sym,
-                               RefVal V, ArgEffect E, RefVal::Kind &hasErr,
+  ProgramStateRef updateSymbol(ProgramStateRef state, SymExprRef sym, RefVal V,
+                               ArgEffect E, RefVal::Kind &hasErr,
                                CheckerContext &C) const;
 
   const RefCountBug &errorKindToBugKind(RefVal::Kind ErrorKind,
-                                        SymbolRef Sym) const;
+                                        SymExprRef Sym) const;
 
   void processNonLeakError(ProgramStateRef St, SourceRange ErrorRange,
-                           RefVal::Kind ErrorKind, SymbolRef Sym,
+                           RefVal::Kind ErrorKind, SymExprRef Sym,
                            CheckerContext &C) const;
 
   void processObjCLiterals(CheckerContext &C, const Expr *Ex) const;
 
-  ProgramStateRef handleSymbolDeath(ProgramStateRef state,
-                                    SymbolRef sid, RefVal V,
-                                    SmallVectorImpl<SymbolRef> &Leaked) const;
+  ProgramStateRef handleSymbolDeath(ProgramStateRef state, SymExprRef sid,
+                                    RefVal V,
+                                    SmallVectorImpl<SymExprRef> &Leaked) const;
 
-  ProgramStateRef
-  handleAutoreleaseCounts(ProgramStateRef state, ExplodedNode *Pred,
-                          const ProgramPointTag *Tag, CheckerContext &Ctx,
-                          SymbolRef Sym,
+  ProgramStateRef handleAutoreleaseCounts(ProgramStateRef state,
+                                          ExplodedNode *Pred,
+                                          const ProgramPointTag *Tag,
+                                          CheckerContext &Ctx, SymExprRef Sym,
                                           RefVal V,
-                          const ReturnStmt *S=nullptr) const;
+                                          const ReturnStmt *S = nullptr) const;
 
   ExplodedNode *processLeaks(ProgramStateRef state,
-                             SmallVectorImpl<SymbolRef> &Leaked,
+                             SmallVectorImpl<SymExprRef> &Leaked,
                              CheckerContext &Ctx,
                              ExplodedNode *Pred = nullptr) const;
 
   static const CheckerProgramPointTag &getDeallocSentTag() {
     return *DeallocSentTag;
   }
 
   static const CheckerProgramPointTag &getCastFailTag() { return *CastFailTag; }
 
 private:
   /// Perform the necessary checks and state adjustments at the end of the
   /// function.
   /// \p S Return statement, may be null.
   ExplodedNode * processReturn(const ReturnStmt *S, CheckerContext &C) const;
 };
 
 //===----------------------------------------------------------------------===//
 // RefBindings - State used to track object reference counts.
 //===----------------------------------------------------------------------===//
 
-const RefVal *getRefBinding(ProgramStateRef State, SymbolRef Sym);
+const RefVal *getRefBinding(ProgramStateRef State, SymExprRef Sym);
 
 /// Returns true if this stack frame is for an Objective-C method that is a
 /// property getter or setter whose body has been synthesized by the analyzer.
 inline bool isSynthesizedAccessor(const StackFrameContext *SFC) {
   auto Method = dyn_cast_or_null<ObjCMethodDecl>(SFC->getDecl());
   if (!Method || !Method->isPropertyAccessor())
     return false;
 
   return SFC->getAnalysisDeclContext()->isBodyAutosynthesized();
 }
 
 } // end namespace retaincountchecker
 } // end namespace ento
 } // end namespace clang
 
 #endif

clang/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountChecker.cpp

 #include "RetainCountChecker.h"
 #include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
 
 using namespace clang;
 using namespace ento;
 using namespace retaincountchecker;
 
-REGISTER_MAP_WITH_PROGRAMSTATE(RefBindings, SymbolRef, RefVal)
+REGISTER_MAP_WITH_PROGRAMSTATE(RefBindings, SymExprRef, RefVal)
 
 namespace clang {
 namespace ento {
 namespace retaincountchecker {
 
-const RefVal *getRefBinding(ProgramStateRef State, SymbolRef Sym) {
+const RefVal *getRefBinding(ProgramStateRef State, SymExprRef Sym) {
   return State->get<RefBindings>(Sym);
 }
 
 } // end namespace retaincountchecker
 } // end namespace ento
 } // end namespace clang
 
-static ProgramStateRef setRefBinding(ProgramStateRef State, SymbolRef Sym,
+static ProgramStateRef setRefBinding(ProgramStateRef State, SymExprRef Sym,
                                      RefVal Val) {
   assert(Sym != nullptr);
   return State->set<RefBindings>(Sym, Val);
 }
 
-static ProgramStateRef removeRefBinding(ProgramStateRef State, SymbolRef Sym) {
+static ProgramStateRef removeRefBinding(ProgramStateRef State, SymExprRef Sym) {
   return State->remove<RefBindings>(Sym);
 }
 
 void RefVal::print(raw_ostream &Out) const {
   if (!T.isNull())
     Out << "Tracked " << T.getAsString() << " | ";
 
   switch (getKind()) {

 
 namespace {
 class StopTrackingCallback final : public SymbolVisitor {
   ProgramStateRef state;
 public:
   StopTrackingCallback(ProgramStateRef st) : state(std::move(st)) {}
   ProgramStateRef getState() const { return state; }
 
-  bool VisitSymbol(SymbolRef sym) override {
+  bool VisitSymbol(SymExprRef sym) override {
     state = removeRefBinding(state, sym);
     return true;
   }
 };
 } // end anonymous namespace
 
 //===----------------------------------------------------------------------===//
 // Handle statements that may have an effect on refcounts.
case OBC_BridgeRetained:
       AE = AE.withKind(IncRef);
       break;
     case OBC_BridgeTransfer:
       AE = AE.withKind(DecRefBridgedTransferred);
       break;
   }
 
   ProgramStateRef state = C.getState();
-  SymbolRef Sym = C.getSVal(CE).getAsLocSymbol();
+  SymExprRef Sym = C.getSVal(CE).getAsLocSymbol();
   if (!Sym)
     return;
   const RefVal* T = getRefBinding(state, Sym);
   if (!T)
     return;
 
   RefVal::Kind hasErr = (RefVal::Kind) 0;
   state = updateSymbol(state, Sym, *T, AE, hasErr, C);
 
   if (hasErr) {
     // FIXME: If we get an error during a bridge cast, should we report it?
     return;
   }
 
   C.addTransition(state);
 }
 
 void RetainCountChecker::processObjCLiterals(CheckerContext &C,
                                              const Expr *Ex) const {
   ProgramStateRef state = C.getState();
   const ExplodedNode *pred = C.getPredecessor();
   for (const Stmt *Child : Ex->children()) {
     SVal V = pred->getSVal(Child);
-    if (SymbolRef sym = V.getAsSymbol())
+    if (SymExprRef sym = V.getAsSymbol())
       if (const RefVal* T = getRefBinding(state, sym)) {
         RefVal::Kind hasErr = (RefVal::Kind) 0;
         state = updateSymbol(state, sym, *T,
                              ArgEffect(MayEscape, ObjKind::ObjC), hasErr, C);
         if (hasErr) {
           processNonLeakError(state, Child->getSourceRange(), hasErr, sym, C);
           return;
         }
       }
   }
 
   // Return the object as autoreleased.
   //  RetEffect RE = RetEffect::MakeNotOwned(ObjKind::ObjC);
-  if (SymbolRef sym =
+  if (SymExprRef sym =
           state->getSVal(Ex, pred->getLocationContext()).getAsSymbol()) {
     QualType ResultTy = Ex->getType();
     state = setRefBinding(state, sym,
                           RefVal::makeNotOwned(ObjKind::ObjC, ResultTy));
   }
 
   C.addTransition(state);
 }
 
void RetainCountChecker::checkPostStmt(const ObjCDictionaryLiteral *DL,
   processObjCLiterals(C, DL);
 }
 
 void RetainCountChecker::checkPostStmt(const ObjCBoxedExpr *Ex,
                                        CheckerContext &C) const {
   const ExplodedNode *Pred = C.getPredecessor();
   ProgramStateRef State = Pred->getState();
 
-  if (SymbolRef Sym = Pred->getSVal(Ex).getAsSymbol()) {
+  if (SymExprRef Sym = Pred->getSVal(Ex).getAsSymbol()) {
     QualType ResultTy = Ex->getType();
     State = setRefBinding(State, Sym,
                           RefVal::makeNotOwned(ObjKind::ObjC, ResultTy));
   }
 
   C.addTransition(State);
 }
 
 void RetainCountChecker::checkPostStmt(const ObjCIvarRefExpr *IRE,
                                        CheckerContext &C) const {
   Optional<Loc> IVarLoc = C.getSVal(IRE).getAs<Loc>();
   if (!IVarLoc)
     return;
 
   ProgramStateRef State = C.getState();
-  SymbolRef Sym = State->getSVal(*IVarLoc).getAsSymbol();
+  SymExprRef Sym = State->getSVal(*IVarLoc).getAsSymbol();
   if (!Sym || !dyn_cast_or_null<ObjCIvarRegion>(Sym->getOriginRegion()))
     return;
 
   // Accessing an ivar directly is unusual. If we've done that, be more
   // forgiving about what the surrounding code is allowed to do.
 
   QualType Ty = Sym->getType();
   ObjKind Kind;
void RetainCountChecker::checkPostCall(const CallEvent &Call,
                                        CheckerContext &C) const {
   RetainSummaryManager &Summaries = getSummaryManager(C);
 
   // Leave null if no receiver.
   QualType ReceiverType;
   if (const auto *MC = dyn_cast<ObjCMethodCall>(&Call)) {
     if (MC->isInstanceMessage()) {
       SVal ReceiverV = MC->getReceiverSVal();
-      if (SymbolRef Sym = ReceiverV.getAsLocSymbol())
+      if (SymExprRef Sym = ReceiverV.getAsLocSymbol())
         if (const RefVal *T = getRefBinding(C.getState(), Sym))
           ReceiverType = T->getType();
     }
   }
 
   const RetainSummary *Summ = getSummary(Summaries, Call, ReceiverType);
 
   if (C.wasInlined) {
void RetainCountChecker::processSummaryOfInlined(const RetainSummary &Summ,
                                                  const CallEvent &CallOrMsg,
                                                  CheckerContext &C) const {
   ProgramStateRef state = C.getState();
 
   // Evaluate the effect of the arguments.
   for (unsigned idx = 0, e = CallOrMsg.getNumArgs(); idx != e; ++idx) {
     SVal V = CallOrMsg.getArgSVal(idx);
 
-    if (SymbolRef Sym = V.getAsLocSymbol()) {
+    if (SymExprRef Sym = V.getAsLocSymbol()) {
       bool ShouldRemoveBinding = Summ.getArg(idx).getKind() == StopTrackingHard;
       if (const RefVal *T = getRefBinding(state, Sym))
         if (shouldEscapeOSArgumentOnCall(CallOrMsg, idx, T))
           ShouldRemoveBinding = true;
 
       if (ShouldRemoveBinding)
         state = removeRefBinding(state, Sym);
     }
   }
 
   // Evaluate the effect on the message receiver.
   if (const auto *MsgInvocation = dyn_cast<ObjCMethodCall>(&CallOrMsg)) {
-    if (SymbolRef Sym = MsgInvocation->getReceiverSVal().getAsLocSymbol()) {
+    if (SymExprRef Sym = MsgInvocation->getReceiverSVal().getAsLocSymbol()) {
       if (Summ.getReceiverEffect().getKind() == StopTrackingHard) {
         state = removeRefBinding(state, Sym);
       }
     }
   }
 
   // Consult the summary for the return value.
   RetEffect RE = Summ.getRetEffect();
 
-  if (SymbolRef Sym = CallOrMsg.getReturnValue().getAsSymbol()) {
+  if (SymExprRef Sym = CallOrMsg.getReturnValue().getAsSymbol()) {
     if (RE.getKind() == RetEffect::NoRetHard)
       state = removeRefBinding(state, Sym);
   }
 
   C.addTransition(state);
 }
 
 static bool isSmartPtrField(const MemRegion *MR) {
for (unsigned idx = 0, e = CE.getNumArgs(); idx != e; ++idx) {
     ArgEffect AE = Summ.getArg(idx);
 
     auto *ArgRegion = dyn_cast_or_null<TypedValueRegion>(ArgVal.getAsRegion());
     if (!ArgRegion)
       continue;
 
     QualType PointeeTy = ArgRegion->getValueType();
     SVal PointeeVal = State->getSVal(ArgRegion);
-    SymbolRef Pointee = PointeeVal.getAsLocSymbol();
+    SymExprRef Pointee = PointeeVal.getAsLocSymbol();
     if (!Pointee)
       continue;
 
     if (shouldEscapeRegion(ArgRegion))
       continue;
 
     auto makeNotOwnedParameter = [&](ProgramStateRef St) {
       return setRefBinding(St, Pointee,

 void RetainCountChecker::checkSummary(const RetainSummary &Summ,
                                       const CallEvent &CallOrMsg,
                                       CheckerContext &C) const {
   ProgramStateRef state = C.getState();
 
   // Evaluate the effect of the arguments.
   RefVal::Kind hasErr = (RefVal::Kind) 0;
   SourceRange ErrorRange;
-  SymbolRef ErrorSym = nullptr;
+  SymExprRef ErrorSym = nullptr;
 
   // Helper tag for providing diagnostics: indicate whether dealloc was sent
   // at this location.
   bool DeallocSent = false;
 
   for (unsigned idx = 0, e = CallOrMsg.getNumArgs(); idx != e; ++idx) {
     SVal V = CallOrMsg.getArgSVal(idx);
 
     ArgEffect Effect = Summ.getArg(idx);
-    if (SymbolRef Sym = V.getAsLocSymbol()) {
+    if (SymExprRef Sym = V.getAsLocSymbol()) {
       if (const RefVal *T = getRefBinding(state, Sym)) {
 
         if (shouldEscapeOSArgumentOnCall(CallOrMsg, idx, T))
           Effect = ArgEffect(StopTrackingHard, ObjKind::OS);
 
         state = updateSymbol(state, Sym, *T, Effect, hasErr, C);
         if (hasErr) {
           ErrorRange = CallOrMsg.getArgSourceRange(idx);
           ErrorSym = Sym;
           break;
         } else if (Effect.getKind() == Dealloc) {
           DeallocSent = true;
         }
       }
     }
   }
 
   // Evaluate the effect on the message receiver / `this` argument.
   bool ReceiverIsTracked = false;
   if (!hasErr) {
     if (const auto *MsgInvocation = dyn_cast<ObjCMethodCall>(&CallOrMsg)) {
-      if (SymbolRef Sym = MsgInvocation->getReceiverSVal().getAsLocSymbol()) {
+      if (SymExprRef Sym = MsgInvocation->getReceiverSVal().getAsLocSymbol()) {
         if (const RefVal *T = getRefBinding(state, Sym)) {
           ReceiverIsTracked = true;
           state = updateSymbol(state, Sym, *T,
                                Summ.getReceiverEffect(), hasErr, C);
           if (hasErr) {
             ErrorRange = MsgInvocation->getOriginExpr()->getReceiverRange();
             ErrorSym = Sym;
           } else if (Summ.getReceiverEffect().getKind() == Dealloc) {
             DeallocSent = true;
           }
         }
       }
     } else if (const auto *MCall = dyn_cast<CXXMemberCall>(&CallOrMsg)) {
-      if (SymbolRef Sym = MCall->getCXXThisVal().getAsLocSymbol()) {
+      if (SymExprRef Sym = MCall->getCXXThisVal().getAsLocSymbol()) {
         if (const RefVal *T = getRefBinding(state, Sym)) {
           state = updateSymbol(state, Sym, *T, Summ.getThisEffect(),
                                hasErr, C);
           if (hasErr) {
             ErrorRange = MCall->getOriginExpr()->getSourceRange();
             ErrorSym = Sym;
           }
         }
void RetainCountChecker::checkSummary(const RetainSummary &Summ,
 
   if (RE.getKind() == RetEffect::OwnedWhenTrackedReceiver) {
     if (ReceiverIsTracked)
       RE = getSummaryManager(C).getObjAllocRetEffect();
     else
       RE = RetEffect::MakeNoRet();
   }
 
-  if (SymbolRef Sym = CallOrMsg.getReturnValue().getAsSymbol()) {
+  if (SymExprRef Sym = CallOrMsg.getReturnValue().getAsSymbol()) {
     QualType ResultTy = CallOrMsg.getResultType();
     if (RE.notOwned()) {
       const Expr *Ex = CallOrMsg.getOriginExpr();
       assert(Ex);
       ResultTy = GetReturnType(Ex, C.getASTContext());
     }
     if (Optional<RefVal> updatedRefVal = refValFromRetEffect(RE, ResultTy))
       state = setRefBinding(state, Sym, *updatedRefVal);
   }
 
   SmallVector<ProgramStateRef, 2> Out =
       updateOutParameters(state, Summ, CallOrMsg);
 
   for (ProgramStateRef St : Out) {
     if (DeallocSent) {
       C.addTransition(St, C.getPredecessor(), &getDeallocSentTag());
     } else {
       C.addTransition(St);
     }
   }
 }
 
 ProgramStateRef RetainCountChecker::updateSymbol(ProgramStateRef state,
-                                                 SymbolRef sym, RefVal V,
+                                                 SymExprRef sym, RefVal V,
                                                  ArgEffect AE,
                                                  RefVal::Kind &hasErr,
                                                  CheckerContext &C) const {
   bool IgnoreRetainMsg = (bool)C.getASTContext().getLangOpts().ObjCAutoRefCount;
   if (AE.getObjKind() == ObjKind::ObjC && IgnoreRetainMsg) {
     switch (AE.getKind()) {
     default:
       break;
case DecRefAndStopTrackingHard:
       }
       break;
   }
   return setRefBinding(state, sym, V);
 }
 
 const RefCountBug &
 RetainCountChecker::errorKindToBugKind(RefVal::Kind ErrorKind,
-                                       SymbolRef Sym) const {
+                                       SymExprRef Sym) const {
   switch (ErrorKind) {
     case RefVal::ErrorUseAfterRelease:
       return *UseAfterRelease;
     case RefVal::ErrorReleaseNotOwned:
       return *ReleaseNotOwned;
     case RefVal::ErrorDeallocNotOwned:
       if (Sym->getType()->getPointeeCXXRecordDecl())
         return *FreeNotOwned;
       return *DeallocNotOwned;
     default:
       llvm_unreachable("Unhandled error.");
   }
 }
 
 void RetainCountChecker::processNonLeakError(ProgramStateRef St,
                                              SourceRange ErrorRange,
                                              RefVal::Kind ErrorKind,
-                                             SymbolRef Sym,
+                                             SymExprRef Sym,
                                              CheckerContext &C) const {
   // HACK: Ignore retain-count issues on values accessed through ivars,
   // because of cases like this:
   //   [_contentView retain];
   //   [_contentView removeFromSuperview];
   //   [self addSubview:_contentView]; // invalidates 'self'
   //   [_contentView release];
   if (const RefVal *RV = getRefBinding(St, Sym))
ExplodedNode * RetainCountChecker::processReturn(const ReturnStmt *S,
 
   const Expr *RetE = S->getRetValue();
   if (!RetE)
     return Pred;
 
   ProgramStateRef state = C.getState();
   // We need to dig down to the symbolic base here because various
   // custom allocators do sometimes return the symbol with an offset.
-  SymbolRef Sym = state->getSValAsScalarOrLoc(RetE, C.getLocationContext())
+  SymExprRef Sym = state->getSValAsScalarOrLoc(RetE, C.getLocationContext())
                        .getAsLocSymbol(/*IncludeBaseRegions=*/true);
   if (!Sym)
     return Pred;
 
   // Get the reference count binding (if any).
   const RefVal *T = getRefBinding(state, Sym);
   if (!T)
     return Pred;
 
if (!isa<CXXMethodDecl>(FD)) {
       const RetainSummary *Summ = Summaries.getSummary(AnyCall(FD));
       RE = Summ->getRetEffect();
     }
   }
 
   return checkReturnWithRetEffect(S, C, Pred, RE, X, Sym, state);
 }
 
-ExplodedNode * RetainCountChecker::checkReturnWithRetEffect(const ReturnStmt *S,
-                                                  CheckerContext &C,
-                                                  ExplodedNode *Pred,
-                                                  RetEffect RE, RefVal X,
-                                                  SymbolRef Sym,
-                                                  ProgramStateRef state) const {
+ExplodedNode *RetainCountChecker::checkReturnWithRetEffect(
+    const ReturnStmt *S, CheckerContext &C, ExplodedNode *Pred, RetEffect RE,
+    RefVal X, SymExprRef Sym, ProgramStateRef state) const {
   // HACK: Ignore retain-count issues on values accessed through ivars,
   // because of cases like this:
   //   [_contentView retain];
   //   [_contentView removeFromSuperview];
   //   [self addSubview:_contentView]; // invalidates 'self'
   //   [_contentView release];
   if (X.getIvarAccessHistory() != RefVal::IvarAccessHistory::None)
     return Pred;

 ProgramStateRef RetainCountChecker::checkRegionChanges(
     ProgramStateRef state, const InvalidatedSymbols *invalidated,
     ArrayRef<const MemRegion *> ExplicitRegions,
     ArrayRef<const MemRegion *> Regions, const LocationContext *LCtx,
     const CallEvent *Call) const {
   if (!invalidated)
     return state;
 
-  llvm::SmallPtrSet<SymbolRef, 8> WhitelistedSymbols;
+  llvm::SmallPtrSet<SymExprRef, 8> WhitelistedSymbols;
 
   for (const MemRegion *I : ExplicitRegions)
     if (const SymbolicRegion *SR = I->StripCasts()->getAs<SymbolicRegion>())
       WhitelistedSymbols.insert(SR->getSymbol());
 
-  for (SymbolRef sym : *invalidated) {
+  for (SymExprRef sym : *invalidated) {
     if (WhitelistedSymbols.count(sym))
       continue;
     // Remove any existing reference-count binding.
     state = removeRefBinding(state, sym);
   }
   return state;
 }
 
-ProgramStateRef
-RetainCountChecker::handleAutoreleaseCounts(ProgramStateRef state,
-                                            ExplodedNode *Pred,
-                                            const ProgramPointTag *Tag,
-                                            CheckerContext &Ctx,
-                                            SymbolRef Sym,
-                                            RefVal V,
-                                            const ReturnStmt *S) const {
+ProgramStateRef RetainCountChecker::handleAutoreleaseCounts(
+    ProgramStateRef state, ExplodedNode *Pred, const ProgramPointTag *Tag,
+    CheckerContext &Ctx, SymExprRef Sym, RefVal V, const ReturnStmt *S) const {
   unsigned ACnt = V.getAutoreleaseCount();
 
   // No autorelease counts?  Nothing to be done.
   if (!ACnt)
     return state;
 
   unsigned Cnt = V.getCount();
 
if (N) {
     auto R = std::make_unique<RefCountReport>(*OverAutorelease, LOpts, N, Sym,
                                               os.str());
     Ctx.emitReport(std::move(R));
   }
 
   return nullptr;
 }
 
-ProgramStateRef
-RetainCountChecker::handleSymbolDeath(ProgramStateRef state,
-                                      SymbolRef sid, RefVal V,
-                                    SmallVectorImpl<SymbolRef> &Leaked) const {
+ProgramStateRef RetainCountChecker::handleSymbolDeath(
+    ProgramStateRef state, SymExprRef sid, RefVal V,
+    SmallVectorImpl<SymExprRef> &Leaked) const {
   bool hasLeak;
 
   // HACK: Ignore retain-count issues on values accessed through ivars,
   // because of cases like this:
   //   [_contentView retain];
   //   [_contentView removeFromSuperview];
   //   [self addSubview:_contentView]; // invalidates 'self'
   //   [_contentView release];
   if (V.getIvarAccessHistory() != RefVal::IvarAccessHistory::None)
     hasLeak = false;
   else if (V.isOwned())
     hasLeak = true;
   else if (V.isNotOwned() || V.isReturnedOwned())
     hasLeak = (V.getCount() > 0);
   else
     hasLeak = false;
 
   if (!hasLeak)
     return removeRefBinding(state, sid);
 
   Leaked.push_back(sid);
   return setRefBinding(state, sid, V ^ RefVal::ErrorLeak);
 }
 
-ExplodedNode *
-RetainCountChecker::processLeaks(ProgramStateRef state,
-                                 SmallVectorImpl<SymbolRef> &Leaked,
-                                 CheckerContext &Ctx,
-                                 ExplodedNode *Pred) const {
+ExplodedNode *RetainCountChecker::processLeaks(
+    ProgramStateRef state, SmallVectorImpl<SymExprRef> &Leaked,
+    CheckerContext &Ctx, ExplodedNode *Pred) const {
   // Generate an intermediate node representing the leak point.
   ExplodedNode *N = Ctx.addTransition(state, Pred);
   const LangOptions &LOpts = Ctx.getASTContext().getLangOpts();
 
   if (N) {
-    for (SymbolRef L : Leaked) {
+    for (SymExprRef L : Leaked) {
       const RefCountBug &BT = Pred ? *LeakWithinFunction : *LeakAtReturn;
       Ctx.emitReport(std::make_unique<RefLeakReport>(BT, LOpts, N, L, Ctx));
     }
   }
 
   return N;
 }
 
if (!C || SmrMgr.isTrustedReferenceCountImplementation(D))
     return;
 
   ProgramStateRef state = Ctx.getState();
   const RetainSummary *FunctionSummary = SmrMgr.getSummary(*C);
   ArgEffects CalleeSideArgEffects = FunctionSummary->getArgEffects();
 
   for (unsigned idx = 0, e = C->param_size(); idx != e; ++idx) {
     const ParmVarDecl *Param = C->parameters()[idx];
-    SymbolRef Sym = state->getSVal(state->getRegion(Param, LCtx)).getAsSymbol();
+    SymExprRef Sym =
+        state->getSVal(state->getRegion(Param, LCtx)).getAsSymbol();
 
     QualType Ty = Param->getType();
     const ArgEffect *AE = CalleeSideArgEffects.lookup(idx);
     if (AE) {
       ObjKind K = AE->getObjKind();
       if (K == ObjKind::Generalized || K == ObjKind::OS ||
           (TrackNSCFStartParam && (K == ObjKind::ObjC || K == ObjKind::CF))) {
         RefVal NewVal = AE->getKind() == DecRef ? RefVal::makeOwned(K, Ty)
void RetainCountChecker::checkEndFunction(const ReturnStmt *RS,
   // If the current LocationContext has a parent, don't check for leaks.
   // We will do that later.
   // FIXME: we should instead check for imbalances of the retain/releases,
   // and suggest annotations.
   if (LCtx->getParent())
     return;
 
   B = state->get<RefBindings>();
-  SmallVector<SymbolRef, 10> Leaked;
+  SmallVector<SymExprRef, 10> Leaked;
 
   for (auto &I : B)
     state = handleSymbolDeath(state, I.first, I.second, Leaked);
 
   processLeaks(state, Leaked, Ctx, Pred);
 }
 
 void RetainCountChecker::checkDeadSymbols(SymbolReaper &SymReaper,
                                           CheckerContext &C) const {
   ExplodedNode *Pred = C.getPredecessor();
 
   ProgramStateRef state = C.getState();
-  SmallVector<SymbolRef, 10> Leaked;
+  SmallVector<SymExprRef, 10> Leaked;
 
   // Update counts from autorelease pools
   for (const auto &I: state->get<RefBindings>()) {
-    SymbolRef Sym = I.first;
+    SymExprRef Sym = I.first;
     if (SymReaper.isDead(Sym)) {
       static CheckerProgramPointTag Tag(this, "DeadSymbolAutorelease");
       const RefVal &V = I.second;
       state = handleAutoreleaseCounts(state, Pred, &Tag, C, Sym, V);
       if (!state)
         return;
 
       // Fetch the new reference count from the state, and use it to handle
void RetainCountChecker::checkDeadSymbols(SymbolReaper &SymReaper,
   if (!Pred)
     return;
 
   // Now generate a new node that nukes the old bindings.
   // The only bindings left at this point are the leaked symbols.
   RefBindingsTy::Factory &F = state->get_context<RefBindings>();
   RefBindingsTy B = state->get<RefBindings>();
 
-  for (SymbolRef L : Leaked)
+  for (SymExprRef L : Leaked)
     B = F.remove(B, L);
 
   state = state->set<RefBindings>(B);
   C.addTransition(state, Pred);
 }
 
 void RetainCountChecker::printState(raw_ostream &Out, ProgramStateRef State,
                                     const char *NL, const char *Sep) const {

clang/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountDiagnostics.h

 
 private:
   RefCountBugKind BT;
   static StringRef bugTypeToName(RefCountBugKind BT);
 };
 
 class RefCountReport : public PathSensitiveBugReport {
 protected:
-  SymbolRef Sym;
+  SymExprRef Sym;
   bool isLeak = false;
 
 public:
   RefCountReport(const RefCountBug &D, const LangOptions &LOpts,
-              ExplodedNode *n, SymbolRef sym,
-              bool isLeak=false);
+                 ExplodedNode *n, SymExprRef sym, bool isLeak = false);
 
   RefCountReport(const RefCountBug &D, const LangOptions &LOpts,
-              ExplodedNode *n, SymbolRef sym,
-              StringRef endText);
+                 ExplodedNode *n, SymExprRef sym, StringRef endText);
 
   ArrayRef<SourceRange> getRanges() const override {
     if (!isLeak)
       return PathSensitiveBugReport::getRanges();
     return {};
   }
 };
 
 class RefLeakReport : public RefCountReport {
   const MemRegion* AllocBinding;
   const Stmt *AllocStmt;
   PathDiagnosticLocation Location;
 
   // Finds the function declaration where a leak warning for the parameter
   // 'sym' should be raised.
-  void deriveParamLocation(CheckerContext &Ctx, SymbolRef sym);
+  void deriveParamLocation(CheckerContext &Ctx, SymExprRef sym);
   // Finds the location where a leak warning for 'sym' should be raised.
-  void deriveAllocLocation(CheckerContext &Ctx, SymbolRef sym);
+  void deriveAllocLocation(CheckerContext &Ctx, SymExprRef sym);
   // Produces description of a leak warning which is printed on the console.
   void createDescription(CheckerContext &Ctx);
 
 public:
   RefLeakReport(const RefCountBug &D, const LangOptions &LOpts, ExplodedNode *n,
-                SymbolRef sym, CheckerContext &Ctx);
+                SymExprRef sym, CheckerContext &Ctx);
   PathDiagnosticLocation getLocation() const override {
     assert(Location.isValid());
     return Location;
   }
 
   PathDiagnosticLocation getEndOfPath() const {
     return PathSensitiveBugReport::getLocation();
   }
 };
 
 } // end namespace retaincountchecker
 } // end namespace ento
 } // end namespace clang
 
 #endif

clang/lib/StaticAnalyzer/Checkers/RetainCountChecker/RetainCountDiagnostics.cpp

static bool shouldGenerateNote(llvm::raw_string_ostream &os,
   return true;
 }
 
 /// Finds argument index of the out paramter in the call {@code S}
 /// corresponding to the symbol {@code Sym}.
 /// If none found, returns None.
 static Optional<unsigned> findArgIdxOfSymbol(ProgramStateRef CurrSt,
                                              const LocationContext *LCtx,
-                                             SymbolRef &Sym,
+                                             SymExprRef &Sym,
                                              Optional<CallEventRef<>> CE) {
   if (!CE)
     return None;
 
   for (unsigned Idx = 0; Idx < (*CE)->getNumArgs(); Idx++)
     if (const MemRegion *MR = (*CE)->getArgSVal(Idx).getAsRegion())
       if (const auto *TR = dyn_cast<TypedValueRegion>(MR))
         if (CurrSt->getSVal(MR, TR->getValueType()).getAsSymbol() == Sym)
static std::string findAllocatedObjectName(const Stmt *S, QualType QT) {
   if (const auto *CE = dyn_cast<CallExpr>(S))
     if (auto Out = findMetaClassAlloc(CE->getCallee()))
       return *Out;
   return getPrettyTypeName(QT);
 }
 
 static void generateDiagnosticsForCallLike(ProgramStateRef CurrSt,
                                            const LocationContext *LCtx,
-                                           const RefVal &CurrV, SymbolRef &Sym,
+                                           const RefVal &CurrV, SymExprRef &Sym,
                                            const Stmt *S,
                                            llvm::raw_string_ostream &os) {
   CallEventManager &Mgr = CurrSt->getStateManager().getCallEventManager();
   if (const CallExpr *CE = dyn_cast<CallExpr>(S)) {
     // Get the name of the callee (if it is available)
     // from the tracked SVal.
     SVal X = CurrSt->getSValAsScalarOrLoc(CE->getCallee(), LCtx);
     const FunctionDecl *FD = X.getAsFunctionDecl();

 }
 
 namespace clang {
 namespace ento {
 namespace retaincountchecker {
 
 class RefCountReportVisitor : public BugReporterVisitor {
 protected:
-  SymbolRef Sym;
+  SymExprRef Sym;
 
 public:
-  RefCountReportVisitor(SymbolRef sym) : Sym(sym) {}
+  RefCountReportVisitor(SymExprRef sym) : Sym(sym) {}
 
   void Profile(llvm::FoldingSetNodeID &ID) const override {
     static int x = 0;
     ID.AddPointer(&x);
     ID.AddPointer(Sym);
   }
 
   PathDiagnosticPieceRef VisitNode(const ExplodedNode *N,
                                    BugReporterContext &BRC,
                                    PathSensitiveBugReport &BR) override;
 
   PathDiagnosticPieceRef getEndPath(BugReporterContext &BRC,
                                     const ExplodedNode *N,
                                     PathSensitiveBugReport &BR) override;
 };
 
 class RefLeakReportVisitor : public RefCountReportVisitor {
 public:
-  RefLeakReportVisitor(SymbolRef sym) : RefCountReportVisitor(sym) {}
+  RefLeakReportVisitor(SymExprRef sym) : RefCountReportVisitor(sym) {}
 
   PathDiagnosticPieceRef getEndPath(BugReporterContext &BRC,
                                     const ExplodedNode *N,
                                     PathSensitiveBugReport &BR) override;
 };
 
 } // end namespace retaincountchecker
 } // end namespace ento
annotateConsumedSummaryMismatch(const ExplodedNode *N,
   llvm::raw_string_ostream os(sbuf);
   ArrayRef<const ParmVarDecl *> Parameters = Call->parameters();
   for (unsigned I=0; I < Call->getNumArgs() && I < Parameters.size(); ++I) {
     const ParmVarDecl *PVD = Parameters[I];
 
     if (!PVD->hasAttr<OSConsumedAttr>())
       continue;
 
-    if (SymbolRef SR = Call->getArgSVal(I).getAsLocSymbol()) {
+    if (SymExprRef SR = Call->getArgSVal(I).getAsLocSymbol()) {
       const RefVal *CountBeforeCall = getRefBinding(CN->getState(), SR);
       const RefVal *CountAtExit = getRefBinding(N->getState(), SR);
 
       if (!CountBeforeCall || !CountAtExit)
         continue;
 
       unsigned CountBefore = CountBeforeCall->getCount();
       unsigned CountAfter = CountAtExit->getCount();
if (os.str().empty())
     return nullptr;
 
   PathDiagnosticLocation L = PathDiagnosticLocation::create(CallExitLoc, SM);
   return std::make_shared<PathDiagnosticEventPiece>(L, os.str());
 }
 
 /// Annotate the parameter at the analysis entry point.
 static std::shared_ptr<PathDiagnosticEventPiece>
-annotateStartParameter(const ExplodedNode *N, SymbolRef Sym,
+annotateStartParameter(const ExplodedNode *N, SymExprRef Sym,
                        const SourceManager &SM) {
   auto PP = N->getLocationAs<BlockEdge>();
   if (!PP)
     return nullptr;
 
   const CFGBlock *Src = PP->getSrc();
   const RefVal *CurrT = getRefBinding(N->getState(), Sym);
 
struct AllocationInfo {
   AllocationInfo(const ExplodedNode *InN,
                  const MemRegion *InR,
                  const LocationContext *InInterestingMethodContext) :
     N(InN), R(InR), InterestingMethodContext(InInterestingMethodContext) {}
 };
 } // end anonymous namespace
 
 static AllocationInfo GetAllocationSite(ProgramStateManager &StateMgr,
-                                        const ExplodedNode *N, SymbolRef Sym) {
+                                        const ExplodedNode *N, SymExprRef Sym) {
   const ExplodedNode *AllocationNode = N;
   const ExplodedNode *AllocationNodeInCurrentOrParentContext = N;
   const MemRegion *FirstBinding = nullptr;
   const LocationContext *LeakContext = N->getLocationContext();
 
   // The location context of the init method called on the leaked object, if
   // available.
   const LocationContext *InitMethodContext = nullptr;
if (RV->getKind() == RefVal::ErrorLeakReturned) {
     os << " is not referenced later in this execution path and has a retain "
           "count of +" << RV->getCount();
   }
 
   return std::make_shared<PathDiagnosticEventPiece>(L, os.str());
 }
 
 RefCountReport::RefCountReport(const RefCountBug &D, const LangOptions &LOpts,
-                               ExplodedNode *n, SymbolRef sym, bool isLeak)
+                               ExplodedNode *n, SymExprRef sym, bool isLeak)
     : PathSensitiveBugReport(D, D.getDescription(), n), Sym(sym),
       isLeak(isLeak) {
   if (!isLeak)
     addVisitor(std::make_unique<RefCountReportVisitor>(sym));
 }
 
 RefCountReport::RefCountReport(const RefCountBug &D, const LangOptions &LOpts,
-                               ExplodedNode *n, SymbolRef sym,
+                               ExplodedNode *n, SymExprRef sym,
                                StringRef endText)
     : PathSensitiveBugReport(D, D.getDescription(), endText, n) {
 
   addVisitor(std::make_unique<RefCountReportVisitor>(sym));
 }
 
-void RefLeakReport::deriveParamLocation(CheckerContext &Ctx, SymbolRef sym) {
+void RefLeakReport::deriveParamLocation(CheckerContext &Ctx, SymExprRef sym) {
   const SourceManager& SMgr = Ctx.getSourceManager();
 
   if (!sym->getOriginRegion())
     return;
 
   auto *Region = dyn_cast<DeclRegion>(sym->getOriginRegion());
   if (Region) {
     const Decl *PDecl = Region->getDecl();
     if (PDecl && isa<ParmVarDecl>(PDecl)) {
       PathDiagnosticLocation ParamLocation =
           PathDiagnosticLocation::create(PDecl, SMgr);
       Location = ParamLocation;
       UniqueingLocation = ParamLocation;
       UniqueingDecl = Ctx.getLocationContext()->getDecl();
     }
   }
 }
 
-void RefLeakReport::deriveAllocLocation(CheckerContext &Ctx,
-                                          SymbolRef sym) {
+void RefLeakReport::deriveAllocLocation(CheckerContext &Ctx, SymExprRef sym) {
   // Most bug reports are cached at the location where they occurred.
   // With leaks, we want to unique them by the location where they were
   // allocated, and only report a single path.  To do this, we need to find
   // the allocation site of a piece of tracked memory, which we do via a
   // call to GetAllocationSite.  This will walk the ExplodedGraph backwards.
   // Note that this is *not* the trimmed graph; we are guaranteed, however,
   // that all ancestor nodes that represent the allocation site have the
   // same SourceLocation.
void RefLeakReport::createDescription(CheckerContext &Ctx) {
   } else {
 
     // If we can't figure out the name, just supply the type information.
     os << " of type '" << getPrettyTypeName(Sym->getType()) << "'";
   }
 }
 
 RefLeakReport::RefLeakReport(const RefCountBug &D, const LangOptions &LOpts,
-                             ExplodedNode *n, SymbolRef sym,
+                             ExplodedNode *n, SymExprRef sym,
                              CheckerContext &Ctx)
     : RefCountReport(D, LOpts, n, sym, /*isLeak=*/true) {
 
   deriveAllocLocation(Ctx, sym);
   if (!AllocBinding)
     deriveParamLocation(Ctx, sym);
 
   createDescription(Ctx);
 
   addVisitor(std::make_unique<RefLeakReportVisitor>(sym));
 }

clang/lib/StaticAnalyzer/Checkers/SimpleStreamChecker.cpp

 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include <utility>
 
 using namespace clang;
 using namespace ento;
 
 namespace {
-typedef SmallVector<SymbolRef, 2> SymbolVector;
+typedef SmallVector<SymExprRef, 2> SymbolVector;
 
 struct StreamState {
 private:
   enum Kind { Opened, Closed } K;
   StreamState(Kind InK) : K(InK) { }
 
 public:
   bool isOpened() const { return K == Opened; }
class SimpleStreamChecker : public Checker<check::PostCall,
                                            check::PreCall,
                                            check::DeadSymbols,
                                            check::PointerEscape> {
   CallDescription OpenFn, CloseFn;
 
   std::unique_ptr<BugType> DoubleCloseBugType;
   std::unique_ptr<BugType> LeakBugType;
 
-  void reportDoubleClose(SymbolRef FileDescSym,
-                         const CallEvent &Call,
+  void reportDoubleClose(SymExprRef FileDescSym, const CallEvent &Call,
                          CheckerContext &C) const;
 
-  void reportLeaks(ArrayRef<SymbolRef> LeakedStreams, CheckerContext &C,
+  void reportLeaks(ArrayRef<SymExprRef> LeakedStreams, CheckerContext &C,
                    ExplodedNode *ErrNode) const;
 
   bool guaranteedNotToCloseFile(const CallEvent &Call) const;
 
 public:
   SimpleStreamChecker();
 
   /// Process fopen.
ProgramStateRef checkPointerEscape(ProgramStateRef State,
                                     const CallEvent *Call,
                                     PointerEscapeKind Kind) const;
 };
 
 } // end anonymous namespace
 
 /// The state of the checker is a map from tracked stream symbols to their
 /// state. Let's store it in the ProgramState.
-REGISTER_MAP_WITH_PROGRAMSTATE(StreamMap, SymbolRef, StreamState)
+REGISTER_MAP_WITH_PROGRAMSTATE(StreamMap, SymExprRef, StreamState)
 
 namespace {
 class StopTrackingCallback final : public SymbolVisitor {
   ProgramStateRef state;
 public:
   StopTrackingCallback(ProgramStateRef st) : state(std::move(st)) {}
   ProgramStateRef getState() const { return state; }
 
-  bool VisitSymbol(SymbolRef sym) override {
+  bool VisitSymbol(SymExprRef sym) override {
     state = state->remove<StreamMap>(sym);
     return true;
   }
 };
 } // end anonymous namespace
 
 SimpleStreamChecker::SimpleStreamChecker()
     : OpenFn("fopen"), CloseFn("fclose", 1) {
void SimpleStreamChecker::checkPostCall(const CallEvent &Call,
                                         CheckerContext &C) const {
   if (!Call.isGlobalCFunction())
     return;
 
   if (!Call.isCalled(OpenFn))
     return;
 
   // Get the symbolic value corresponding to the file handle.
-  SymbolRef FileDesc = Call.getReturnValue().getAsSymbol();
+  SymExprRef FileDesc = Call.getReturnValue().getAsSymbol();
   if (!FileDesc)
     return;
 
   // Generate the next transition (an edge in the exploded graph).
   ProgramStateRef State = C.getState();
   State = State->set<StreamMap>(FileDesc, StreamState::getOpened());
   C.addTransition(State);
 }
 
 void SimpleStreamChecker::checkPreCall(const CallEvent &Call,
                                        CheckerContext &C) const {
   if (!Call.isGlobalCFunction())
     return;
 
   if (!Call.isCalled(CloseFn))
     return;
 
   // Get the symbolic value corresponding to the file handle.
-  SymbolRef FileDesc = Call.getArgSVal(0).getAsSymbol();
+  SymExprRef FileDesc = Call.getArgSVal(0).getAsSymbol();
   if (!FileDesc)
     return;
 
   // Check if the stream has already been closed.
   ProgramStateRef State = C.getState();
   const StreamState *SS = State->get<StreamMap>(FileDesc);
   if (SS && SS->isClosed()) {
     reportDoubleClose(FileDesc, Call, C);
     return;
   }
 
   // Generate the next transition, in which the stream is closed.
   State = State->set<StreamMap>(FileDesc, StreamState::getClosed());
   C.addTransition(State);
 }
 
-static bool isLeaked(SymbolRef Sym, const StreamState &SS,
-                     bool IsSymDead, ProgramStateRef State) {
+static bool isLeaked(SymExprRef Sym, const StreamState &SS, bool IsSymDead,
+                     ProgramStateRef State) {
   if (IsSymDead && SS.isOpened()) {
     // If a symbol is NULL, assume that fopen failed on this path.
     // A symbol should only be considered leaked if it is non-null.
     ConstraintManager &CMgr = State->getConstraintManager();
     ConditionTruthVal OpenFailed = CMgr.isNull(State, Sym);
     return !OpenFailed.isConstrainedTrue();
   }
   return false;
 }
 
 void SimpleStreamChecker::checkDeadSymbols(SymbolReaper &SymReaper,
                                            CheckerContext &C) const {
   ProgramStateRef State = C.getState();
   SymbolVector LeakedStreams;
   StreamMapTy TrackedStreams = State->get<StreamMap>();
   for (StreamMapTy::iterator I = TrackedStreams.begin(),
                              E = TrackedStreams.end(); I != E; ++I) {
-    SymbolRef Sym = I->first;
+    SymExprRef Sym = I->first;
     bool IsSymDead = SymReaper.isDead(Sym);
 
     // Collect leaked symbols.
     if (isLeaked(Sym, I->second, IsSymDead, State))
       LeakedStreams.push_back(Sym);
 
     // Remove the dead symbol from the streams map.
     if (IsSymDead)
       State = State->remove<StreamMap>(Sym);
   }
 
   ExplodedNode *N = C.generateNonFatalErrorNode(State);
   if (!N)
     return;
   reportLeaks(LeakedStreams, C, N);
 }
 
-void SimpleStreamChecker::reportDoubleClose(SymbolRef FileDescSym,
+void SimpleStreamChecker::reportDoubleClose(SymExprRef FileDescSym,
                                             const CallEvent &Call,
                                             CheckerContext &C) const {
   // We reached a bug, stop exploring the path here by generating a sink.
   ExplodedNode *ErrNode = C.generateErrorNode();
   // If we've already reached this node on another path, return.
   if (!ErrNode)
     return;
 
   // Generate the report.
   auto R = std::make_unique<PathSensitiveBugReport>(
       *DoubleCloseBugType, "Closing a previously closed file stream", ErrNode);
   R->addRange(Call.getSourceRange());
   R->markInteresting(FileDescSym);
   C.emitReport(std::move(R));
 }
 
-void SimpleStreamChecker::reportLeaks(ArrayRef<SymbolRef> LeakedStreams,
+void SimpleStreamChecker::reportLeaks(ArrayRef<SymExprRef> LeakedStreams,
                                       CheckerContext &C,
                                       ExplodedNode *ErrNode) const {
   // Attach bug reports to the leak node.
   // TODO: Identify the leaked file descriptor.
-  for (SymbolRef LeakedStream : LeakedStreams) {
+  for (SymExprRef LeakedStream : LeakedStreams) {
     auto R = std::make_unique<PathSensitiveBugReport>(
         *LeakBugType, "Opened file is never closed; potential resource leak",
         ErrNode);
     R->markInteresting(LeakedStream);
     C.emitReport(std::move(R));
   }
 }
 
SimpleStreamChecker::checkPointerEscape(ProgramStateRef State,
   // If we know that the call cannot close a file, there is nothing to do.
   if (Kind == PSK_DirectEscapeOnCall && guaranteedNotToCloseFile(*Call)) {
     return State;
   }
 
   for (InvalidatedSymbols::const_iterator I = Escaped.begin(),
                                           E = Escaped.end();
                                           I != E; ++I) {
-    SymbolRef Sym = *I;
+    SymExprRef Sym = *I;
 
     // The symbol escaped. Optimistically, assume that the corresponding file
     // handle will be closed somewhere else.
     State = State->remove<StreamMap>(Sym);
   }
   return State;
 }
 
 void ento::registerSimpleStreamChecker(CheckerManager &mgr) {
   mgr.registerChecker<SimpleStreamChecker>();
 }
 
 // This checker should be enabled regardless of how language options are set.
 bool ento::shouldRegisterSimpleStreamChecker(const CheckerManager &mgr) {
   return true;
 }

clang/lib/StaticAnalyzer/Checkers/StreamChecker.cpp

private:
   /// There will be always a state transition into the passed State,
   /// by the new non-fatal error node or (if failed) a normal transition,
   /// to ensure uniform handling.
   void reportFEofWarning(CheckerContext &C, ProgramStateRef State) const;
 
   /// Emit resource leak warnings for the given symbols.
   /// Createn a non-fatal error node for these, and returns it (if any warnings
   /// were generated). Return value is non-null.
-  ExplodedNode *reportLeaks(const SmallVector<SymbolRef, 2> &LeakedSyms,
+  ExplodedNode *reportLeaks(const SmallVector<SymExprRef, 2> &LeakedSyms,
                             CheckerContext &C, ExplodedNode *Pred) const;
 
   /// Find the description data of the function called by a call event.
   /// Returns nullptr if no function is recognized.
   const FnDescription *lookupFn(const CallEvent &Call) const {
     // Recognize "global C functions" with only integral or pointer arguments
     // (and matching name) as stream functions.
     if (!Call.isGlobalCFunction())
       return nullptr;
     for (auto P : Call.parameters()) {
       QualType T = P->getType();
       if (!T->isIntegralOrEnumerationType() && !T->isPointerType())
         return nullptr;
     }
 
     return FnDescriptions.lookup(Call);
   }
 
   /// Generate a message for BugReporterVisitor if the stored symbol is
   /// marked as interesting by the actual bug report.
   struct NoteFn {
     const CheckerNameRef CheckerName;
-    SymbolRef StreamSym;
+    SymExprRef StreamSym;
     std::string Message;
 
     std::string operator()(PathSensitiveBugReport &BR) const {
       if (BR.isInteresting(StreamSym) &&
           CheckerName == BR.getBugType().getCheckerName())
         return Message;
 
       return "";
     }
   };
 
-  const NoteTag *constructNoteTag(CheckerContext &C, SymbolRef StreamSym,
+  const NoteTag *constructNoteTag(CheckerContext &C, SymExprRef StreamSym,
                                   const std::string &Message) const {
     return C.getNoteTag(NoteFn{getCheckerName(), StreamSym, Message});
   }
 
   /// Searches for the ExplodedNode where the file descriptor was acquired for
   /// StreamSym.
   static const ExplodedNode *getAcquisitionSite(const ExplodedNode *N,
-                                                SymbolRef StreamSym,
+                                                SymExprRef StreamSym,
                                                 CheckerContext &C);
 };
 
 } // end anonymous namespace
 
-REGISTER_MAP_WITH_PROGRAMSTATE(StreamMap, SymbolRef, StreamState)
+REGISTER_MAP_WITH_PROGRAMSTATE(StreamMap, SymExprRef, StreamState)
 
 inline void assertStreamStateOpened(const StreamState *SS) {
   assert(SS->isOpened() &&
          "Previous create of error node for non-opened stream failed?");
 }
 
 const ExplodedNode *StreamChecker::getAcquisitionSite(const ExplodedNode *N,
-                                                      SymbolRef StreamSym,
+                                                      SymExprRef StreamSym,
                                                       CheckerContext &C) {
   ProgramStateRef State = N->getState();
   // When bug type is resource leak, exploded node N may not have state info
   // for leaked file descriptor, but predecessor should have it.
   if (!State->get<StreamMap>(StreamSym))
     N = N->getFirstPred();
 
   const ExplodedNode *Pred = N;

 void StreamChecker::evalFopen(const FnDescription *Desc, const CallEvent &Call,
                               CheckerContext &C) const {
   ProgramStateRef State = C.getState();
   const CallExpr *CE = dyn_cast_or_null<CallExpr>(Call.getOriginExpr());
   if (!CE)
     return;
 
   DefinedSVal RetVal = makeRetVal(C, CE);
-  SymbolRef RetSym = RetVal.getAsSymbol();
+  SymExprRef RetSym = RetVal.getAsSymbol();
   assert(RetSym && "RetVal must be a symbol here.");
 
   State = State->BindExpr(CE, C.getLocationContext(), RetVal);
 
   // Bifurcate the state into two: one with a valid FILE* pointer, the other
   // with a NULL.
   ProgramStateRef StateNotNull, StateNull;
   std::tie(StateNotNull, StateNull) =
void StreamChecker::evalFreopen(const FnDescription *Desc,
   if (!CE)
     return;
 
   Optional<DefinedSVal> StreamVal =
       getStreamArg(Desc, Call).getAs<DefinedSVal>();
   if (!StreamVal)
     return;
 
-  SymbolRef StreamSym = StreamVal->getAsSymbol();
+  SymExprRef StreamSym = StreamVal->getAsSymbol();
   // Do not care about concrete values for stream ("(FILE *)0x12345"?).
   // FIXME: Can be stdin, stdout, stderr such values?
   if (!StreamSym)
     return;
 
   // Do not handle untracked stream. It is probably escaped.
   if (!State->get<StreamMap>(StreamSym))
     return;
void StreamChecker::evalFreopen(const FnDescription *Desc,
   C.addTransition(StateRetNotNull,
                   constructNoteTag(C, StreamSym, "Stream reopened here"));
   C.addTransition(StateRetNull);
 }
 
 void StreamChecker::evalFclose(const FnDescription *Desc, const CallEvent &Call,
                                CheckerContext &C) const {
   ProgramStateRef State = C.getState();
-  SymbolRef Sym = getStreamArg(Desc, Call).getAsSymbol();
+  SymExprRef Sym = getStreamArg(Desc, Call).getAsSymbol();
   if (!Sym)
     return;
 
   const StreamState *SS = State->get<StreamMap>(Sym);
   if (!SS)
     return;
 
   assertStreamStateOpened(SS);
if (!State)
     return;
   State = ensureStreamOpened(StreamVal, C, State);
   if (!State)
     return;
   State = ensureNoFilePositionIndeterminate(StreamVal, C, State);
   if (!State)
     return;
 
-  SymbolRef Sym = StreamVal.getAsSymbol();
+  SymExprRef Sym = StreamVal.getAsSymbol();
   if (Sym && State->get<StreamMap>(Sym)) {
     const StreamState *SS = State->get<StreamMap>(Sym);
     if (SS->ErrorState & ErrorFEof)
       reportFEofWarning(C, State);
   } else {
     C.addTransition(State);
   }
 }
void StreamChecker::preFwrite(const FnDescription *Desc, const CallEvent &Call,
 
   C.addTransition(State);
 }
 
 void StreamChecker::evalFreadFwrite(const FnDescription *Desc,
                                     const CallEvent &Call, CheckerContext &C,
                                     bool IsFread) const {
   ProgramStateRef State = C.getState();
-  SymbolRef StreamSym = getStreamArg(Desc, Call).getAsSymbol();
+  SymExprRef StreamSym = getStreamArg(Desc, Call).getAsSymbol();
   if (!StreamSym)
     return;
 
   const CallExpr *CE = dyn_cast_or_null<CallExpr>(Call.getOriginExpr());
   if (!CE)
     return;
 
   Optional<NonLoc> SizeVal = Call.getArgSVal(1).getAs<NonLoc>();
if (!State)
     return;
 
   C.addTransition(State);
 }
 
 void StreamChecker::evalFseek(const FnDescription *Desc, const CallEvent &Call,
                               CheckerContext &C) const {
   ProgramStateRef State = C.getState();
-  SymbolRef StreamSym = getStreamArg(Desc, Call).getAsSymbol();
+  SymExprRef StreamSym = getStreamArg(Desc, Call).getAsSymbol();
   if (!StreamSym)
     return;
 
   const CallExpr *CE = dyn_cast_or_null<CallExpr>(Call.getOriginExpr());
   if (!CE)
     return;
 
   // Ignore the call if the stream is not tracked.
void StreamChecker::evalFseek(const FnDescription *Desc, const CallEvent &Call,
   C.addTransition(StateNotFailed);
   C.addTransition(StateFailed);
 }
 
 void StreamChecker::evalClearerr(const FnDescription *Desc,
                                  const CallEvent &Call,
                                  CheckerContext &C) const {
   ProgramStateRef State = C.getState();
-  SymbolRef StreamSym = getStreamArg(Desc, Call).getAsSymbol();
+  SymExprRef StreamSym = getStreamArg(Desc, Call).getAsSymbol();
   if (!StreamSym)
     return;
 
   const StreamState *SS = State->get<StreamMap>(StreamSym);
   if (!SS)
     return;
 
   assertStreamStateOpened(SS);
 
   // FilePositionIndeterminate is not cleared.
   State = State->set<StreamMap>(
       StreamSym,
       StreamState::getOpened(Desc, ErrorNone, SS->FilePositionIndeterminate));
   C.addTransition(State);
 }
 
 void StreamChecker::evalFeofFerror(const FnDescription *Desc,
                                    const CallEvent &Call, CheckerContext &C,
                                    const StreamErrorState &ErrorKind) const {
   ProgramStateRef State = C.getState();
-  SymbolRef StreamSym = getStreamArg(Desc, Call).getAsSymbol();
+  SymExprRef StreamSym = getStreamArg(Desc, Call).getAsSymbol();
   if (!StreamSym)
     return;
 
   const CallExpr *CE = dyn_cast_or_null<CallExpr>(Call.getOriginExpr());
   if (!CE)
     return;
 
   const StreamState *SS = State->get<StreamMap>(StreamSym);
void StreamChecker::preDefault(const FnDescription *Desc, const CallEvent &Call,
 
   C.addTransition(State);
 }
 
 void StreamChecker::evalSetFeofFerror(const FnDescription *Desc,
                                       const CallEvent &Call, CheckerContext &C,
                                       const StreamErrorState &ErrorKind) const {
   ProgramStateRef State = C.getState();
-  SymbolRef StreamSym = getStreamArg(Desc, Call).getAsSymbol();
+  SymExprRef StreamSym = getStreamArg(Desc, Call).getAsSymbol();
   assert(StreamSym && "Operation not permitted on non-symbolic stream value.");
   const StreamState *SS = State->get<StreamMap>(StreamSym);
   assert(SS && "Stream should be tracked by the checker.");
   State = State->set<StreamMap>(
       StreamSym, StreamState::getOpened(SS->LastOperation, ErrorKind));
   C.addTransition(State);
 }
 
StreamChecker::ensureStreamNonNull(SVal StreamVal, CheckerContext &C,
   }
 
   return StateNotNull;
 }
 
 ProgramStateRef StreamChecker::ensureStreamOpened(SVal StreamVal,
                                                   CheckerContext &C,
                                                   ProgramStateRef State) const {
-  SymbolRef Sym = StreamVal.getAsSymbol();
+  SymExprRef Sym = StreamVal.getAsSymbol();
   if (!Sym)
     return State;
 
   const StreamState *SS = State->get<StreamMap>(Sym);
   if (!SS)
     return State;
 
   if (SS->isClosed()) {

 
 ProgramStateRef StreamChecker::ensureNoFilePositionIndeterminate(
     SVal StreamVal, CheckerContext &C, ProgramStateRef State) const {
   static const char *BugMessage =
       "File position of the stream might be 'indeterminate' "
       "after a failed operation. "
       "Can cause undefined behavior.";
 
-  SymbolRef Sym = StreamVal.getAsSymbol();
+  SymExprRef Sym = StreamVal.getAsSymbol();
   if (!Sym)
     return State;
 
   const StreamState *SS = State->get<StreamMap>(Sym);
   if (!SS)
     return State;
 
   assert(SS->isOpened() && "First ensure that stream is opened.");
C.emitReport(std::make_unique<PathSensitiveBugReport>(
         "Function has no effect.",
         N));
     return;
   }
   C.addTransition(State);
 }
 
 ExplodedNode *
-StreamChecker::reportLeaks(const SmallVector<SymbolRef, 2> &LeakedSyms,
+StreamChecker::reportLeaks(const SmallVector<SymExprRef, 2> &LeakedSyms,
                            CheckerContext &C, ExplodedNode *Pred) const {
   ExplodedNode *Err = C.generateNonFatalErrorNode(C.getState(), Pred);
   if (!Err)
     return Pred;
 
-  for (SymbolRef LeakSym : LeakedSyms) {
+  for (SymExprRef LeakSym : LeakedSyms) {
     // Resource leaks can result in multiple warning that describe the same kind
     // of programming error:
     //  void f() {
     //    FILE *F = fopen("a.txt");
     //    if (rand()) // state split
     //      return; // warning
     //  } // warning
     // While this isn't necessarily true (leaking the same stream could result
StreamChecker::reportLeaks(const SmallVector<SymExprRef, 2> &LeakedSyms,
 
   return Err;
 }
 
 void StreamChecker::checkDeadSymbols(SymbolReaper &SymReaper,
                                      CheckerContext &C) const {
   ProgramStateRef State = C.getState();
 
-  llvm::SmallVector<SymbolRef, 2> LeakedSyms;
+  llvm::SmallVector<SymExprRef, 2> LeakedSyms;
 
   const StreamMapTy &Map = State->get<StreamMap>();
   for (const auto &I : Map) {
-    SymbolRef Sym = I.first;
+    SymExprRef Sym = I.first;
     const StreamState &SS = I.second;
     if (!SymReaper.isDead(Sym))
       continue;
     if (SS.isOpened())
       LeakedSyms.push_back(Sym);
     State = State->remove<StreamMap>(Sym);
   }
 
   ExplodedNode *N = C.getPredecessor();
   if (!LeakedSyms.empty())
     N = reportLeaks(LeakedSyms, C, N);
 
   C.addTransition(State, N);
 }
 
 ProgramStateRef StreamChecker::checkPointerEscape(
     ProgramStateRef State, const InvalidatedSymbols &Escaped,
     const CallEvent *Call, PointerEscapeKind Kind) const {
   // Check for file-handling system call that is not handled by the checker.
   // FIXME: The checker should be updated to handle all system calls that take
   // 'FILE*' argument. These are now ignored.
   if (Kind == PSK_DirectEscapeOnCall && Call->isInSystemHeader())
     return State;
 
-  for (SymbolRef Sym : Escaped) {
+  for (SymExprRef Sym : Escaped) {
     // The symbol escaped.
     // From now the stream can be manipulated in unknown way to the checker,
     // it is not possible to handle it any more.
     // Optimistically, assume that the corresponding file handle will be closed
     // somewhere else.
     // Remove symbol from state so the following stream calls on this symbol are
     // not handled by the checker.
     State = State->remove<StreamMap>(Sym);

clang/lib/StaticAnalyzer/Checkers/Taint.h

LLVM_NODISCARD ProgramStateRef addTaint(ProgramStateRef State, const Stmt *S,
                                         const LocationContext *LCtx,
                                         TaintTagType Kind = TaintTagGeneric);
 
 /// Create a new state in which the value is marked as tainted.
 LLVM_NODISCARD ProgramStateRef addTaint(ProgramStateRef State, SVal V,
                                         TaintTagType Kind = TaintTagGeneric);
 
 /// Create a new state in which the symbol is marked as tainted.
-LLVM_NODISCARD ProgramStateRef addTaint(ProgramStateRef State, SymbolRef Sym,
+LLVM_NODISCARD ProgramStateRef addTaint(ProgramStateRef State, SymExprRef Sym,
                                         TaintTagType Kind = TaintTagGeneric);
 
 /// Create a new state in which the pointer represented by the region
 /// is marked as tainted.
 LLVM_NODISCARD ProgramStateRef addTaint(ProgramStateRef State,
                                         const MemRegion *R,
                                         TaintTagType Kind = TaintTagGeneric);
 
 LLVM_NODISCARD ProgramStateRef removeTaint(ProgramStateRef State, SVal V);
 
 LLVM_NODISCARD ProgramStateRef removeTaint(ProgramStateRef State,
                                            const MemRegion *R);
 
 LLVM_NODISCARD ProgramStateRef removeTaint(ProgramStateRef State,
-                                           SymbolRef Sym);
+                                           SymExprRef Sym);
 
 /// Create a new state in a which a sub-region of a given symbol is tainted.
 /// This might be necessary when referring to regions that can not have an
 /// individual symbol, e.g. if they are represented by the default binding of
 /// a LazyCompoundVal.
 LLVM_NODISCARD ProgramStateRef addPartialTaint(
-    ProgramStateRef State, SymbolRef ParentSym, const SubRegion *SubRegion,
+    ProgramStateRef State, SymExprRef ParentSym, const SubRegion *SubRegion,
     TaintTagType Kind = TaintTagGeneric);
 
 /// Check if the statement has a tainted value in the given state.
 bool isTainted(ProgramStateRef State, const Stmt *S,
                const LocationContext *LCtx,
                TaintTagType Kind = TaintTagGeneric);
 
 /// Check if the value is tainted in the given state.
 bool isTainted(ProgramStateRef State, SVal V,
                TaintTagType Kind = TaintTagGeneric);
 
 /// Check if the symbol is tainted in the given state.
-bool isTainted(ProgramStateRef State, SymbolRef Sym,
+bool isTainted(ProgramStateRef State, SymExprRef Sym,
                TaintTagType Kind = TaintTagGeneric);
 
 /// Check if the pointer represented by the region is tainted in the given
 /// state.
 bool isTainted(ProgramStateRef State, const MemRegion *Reg,
                TaintTagType Kind = TaintTagGeneric);
 
 void printTaint(ProgramStateRef State, raw_ostream &Out, const char *nl = "\n",

clang/lib/StaticAnalyzer/Checkers/Taint.cpp

 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
 
 using namespace clang;
 using namespace ento;
 using namespace taint;
 
 // Fully tainted symbols.
-REGISTER_MAP_WITH_PROGRAMSTATE(TaintMap, SymbolRef, TaintTagType)
+REGISTER_MAP_WITH_PROGRAMSTATE(TaintMap, SymExprRef, TaintTagType)
 
 // Partially tainted symbols.
 REGISTER_MAP_FACTORY_WITH_PROGRAMSTATE(TaintedSubRegions, const SubRegion *,
                                        TaintTagType)
-REGISTER_MAP_WITH_PROGRAMSTATE(DerivedSymTaint, SymbolRef, TaintedSubRegions)
+REGISTER_MAP_WITH_PROGRAMSTATE(DerivedSymTaint, SymExprRef, TaintedSubRegions)
 
 void taint::printTaint(ProgramStateRef State, raw_ostream &Out, const char *NL,
                        const char *Sep) {
   TaintMapTy TM = State->get<TaintMap>();
 
   if (!TM.isEmpty())
     Out << "Tainted symbols:" << NL;
 
   for (const auto &I : TM)
     Out << I.first << " : " << I.second << NL;
 }
 
 void dumpTaint(ProgramStateRef State) { printTaint(State, llvm::errs()); }
 
 ProgramStateRef taint::addTaint(ProgramStateRef State, const Stmt *S,
                                 const LocationContext *LCtx,
                                 TaintTagType Kind) {
   return addTaint(State, State->getSVal(S, LCtx), Kind);
 }
 
 ProgramStateRef taint::addTaint(ProgramStateRef State, SVal V,
                                 TaintTagType Kind) {
-  SymbolRef Sym = V.getAsSymbol();
+  SymExprRef Sym = V.getAsSymbol();
   if (Sym)
     return addTaint(State, Sym, Kind);
 
   // If the SVal represents a structure, try to mass-taint all values within the
   // structure. For now it only works efficiently on lazy compound values that
   // were conjured during a conservative evaluation of a function - either as
   // return values of functions that return structures or arrays by value, or as
   // values of structures or arrays passed into the function by reference,
   // directly or through pointer aliasing. Such lazy compound values are
   // characterized by having exactly one binding in their captured store within
   // their parent region, which is a conjured symbol default-bound to the base
   // region of the parent region.
   if (auto LCV = V.getAs<nonloc::LazyCompoundVal>()) {
     if (Optional<SVal> binding =
             State->getStateManager().getStoreManager().getDefaultBinding(
                 *LCV)) {
-      if (SymbolRef Sym = binding->getAsSymbol())
+      if (SymExprRef Sym = binding->getAsSymbol())
         return addPartialTaint(State, Sym, LCV->getRegion(), Kind);
     }
   }
 
   const MemRegion *R = V.getAsRegion();
   return addTaint(State, R, Kind);
 }
 
 ProgramStateRef taint::addTaint(ProgramStateRef State, const MemRegion *R,
                                 TaintTagType Kind) {
   if (const SymbolicRegion *SR = dyn_cast_or_null<SymbolicRegion>(R))
     return addTaint(State, SR->getSymbol(), Kind);
   return State;
 }
 
-ProgramStateRef taint::addTaint(ProgramStateRef State, SymbolRef Sym,
+ProgramStateRef taint::addTaint(ProgramStateRef State, SymExprRef Sym,
                                 TaintTagType Kind) {
   // If this is a symbol cast, remove the cast before adding the taint. Taint
   // is cast agnostic.
   while (const SymbolCast *SC = dyn_cast<SymbolCast>(Sym))
     Sym = SC->getOperand();
 
   ProgramStateRef NewState = State->set<TaintMap>(Sym, Kind);
   assert(NewState);
   return NewState;
 }
 
 ProgramStateRef taint::removeTaint(ProgramStateRef State, SVal V) {
-  SymbolRef Sym = V.getAsSymbol();
+  SymExprRef Sym = V.getAsSymbol();
   if (Sym)
     return removeTaint(State, Sym);
 
   const MemRegion *R = V.getAsRegion();
   return removeTaint(State, R);
 }
 
 ProgramStateRef taint::removeTaint(ProgramStateRef State, const MemRegion *R) {
   if (const SymbolicRegion *SR = dyn_cast_or_null<SymbolicRegion>(R))
     return removeTaint(State, SR->getSymbol());
   return State;
 }
 
-ProgramStateRef taint::removeTaint(ProgramStateRef State, SymbolRef Sym) {
+ProgramStateRef taint::removeTaint(ProgramStateRef State, SymExprRef Sym) {
   // If this is a symbol cast, remove the cast before adding the taint. Taint
   // is cast agnostic.
   while (const SymbolCast *SC = dyn_cast<SymbolCast>(Sym))
     Sym = SC->getOperand();
 
   ProgramStateRef NewState = State->remove<TaintMap>(Sym);
   assert(NewState);
   return NewState;
 }
 
 ProgramStateRef taint::addPartialTaint(ProgramStateRef State,
-                                       SymbolRef ParentSym,
+                                       SymExprRef ParentSym,
                                        const SubRegion *SubRegion,
                                        TaintTagType Kind) {
   // Ignore partial taint if the entire parent symbol is already tainted.
   if (const TaintTagType *T = State->get<TaintMap>(ParentSym))
     if (*T == Kind)
       return State;
 
   // Partial taint applies if only a portion of the symbol is tainted.

 
 bool taint::isTainted(ProgramStateRef State, const Stmt *S,
                       const LocationContext *LCtx, TaintTagType Kind) {
   SVal val = State->getSVal(S, LCtx);
   return isTainted(State, val, Kind);
 }
 
 bool taint::isTainted(ProgramStateRef State, SVal V, TaintTagType Kind) {
-  if (SymbolRef Sym = V.getAsSymbol())
+  if (SymExprRef Sym = V.getAsSymbol())
     return isTainted(State, Sym, Kind);
   if (const MemRegion *Reg = V.getAsRegion())
     return isTainted(State, Reg, Kind);
   return false;
 }
 
 bool taint::isTainted(ProgramStateRef State, const MemRegion *Reg,
                       TaintTagType K) {
if (const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(Reg))
     return isTainted(State, SR->getSymbol(), K);
 
   if (const SubRegion *ER = dyn_cast<SubRegion>(Reg))
     return isTainted(State, ER->getSuperRegion(), K);
 
   return false;
 }
 
-bool taint::isTainted(ProgramStateRef State, SymbolRef Sym, TaintTagType Kind) {
+bool taint::isTainted(ProgramStateRef State, SymExprRef Sym,
+                      TaintTagType Kind) {
   if (!Sym)
     return false;
 
   // Traverse all the symbols this symbol depends on to see if any are tainted.
   for (SymExpr::symbol_iterator SI = Sym->symbol_begin(),
                                 SE = Sym->symbol_end();
        SI != SE; ++SI) {
     if (!isa<SymbolData>(*SI))

clang/lib/StaticAnalyzer/Checkers/TaintTesterChecker.cpp

 namespace {
 class TaintTesterChecker : public Checker< check::PostStmt<Expr> > {
 
   mutable std::unique_ptr<BugType> BT;
   void initBugType() const;
 
   /// Given a pointer argument, get the symbol of the value it contains
   /// (points to).
-  SymbolRef getPointedToSymbol(CheckerContext &C,
-                               const Expr* Arg,
+  SymExprRef getPointedToSymbol(CheckerContext &C, const Expr *Arg,
                                 bool IssueWarning = true) const;
 
 public:
   void checkPostStmt(const Expr *E, CheckerContext &C) const;
 };
 }
 
 inline void TaintTesterChecker::initBugType() const {
   if (!BT)

clang/lib/StaticAnalyzer/Checkers/TestAfterDivZeroChecker.cpp

 
 using namespace clang;
 using namespace ento;
 
 namespace {
 
 class ZeroState {
 private:
-  SymbolRef ZeroSymbol;
+  SymExprRef ZeroSymbol;
   unsigned BlockID;
   const StackFrameContext *SFC;
 
 public:
-  ZeroState(SymbolRef S, unsigned B, const StackFrameContext *SFC)
+  ZeroState(SymExprRef S, unsigned B, const StackFrameContext *SFC)
       : ZeroSymbol(S), BlockID(B), SFC(SFC) {}
 
   const StackFrameContext *getStackFrameContext() const { return SFC; }
 
   bool operator==(const ZeroState &X) const {
     return BlockID == X.BlockID && SFC == X.SFC && ZeroSymbol == X.ZeroSymbol;
   }
 
void Profile(llvm::FoldingSetNodeID &ID) const {
     ID.AddInteger(BlockID);
     ID.AddPointer(SFC);
     ID.AddPointer(ZeroSymbol);
   }
 };
 
 class DivisionBRVisitor : public BugReporterVisitor {
 private:
-  SymbolRef ZeroSymbol;
+  SymExprRef ZeroSymbol;
   const StackFrameContext *SFC;
   bool Satisfied;
 
 public:
-  DivisionBRVisitor(SymbolRef ZeroSymbol, const StackFrameContext *SFC)
+  DivisionBRVisitor(SymExprRef ZeroSymbol, const StackFrameContext *SFC)
       : ZeroSymbol(ZeroSymbol), SFC(SFC), Satisfied(false) {}
 
   void Profile(llvm::FoldingSetNodeID &ID) const override {
     ID.Add(ZeroSymbol);
     ID.Add(SFC);
   }
 
   PathDiagnosticPieceRef VisitNode(const ExplodedNode *Succ,
bool TestAfterDivZeroChecker::isZero(SVal S, CheckerContext &C) const {
   if (!DSV)
     return false;
 
   ConstraintManager &CM = C.getConstraintManager();
   return !CM.assume(C.getState(), *DSV, true);
 }
 
 void TestAfterDivZeroChecker::setDivZeroMap(SVal Var, CheckerContext &C) const {
-  SymbolRef SR = Var.getAsSymbol();
+  SymExprRef SR = Var.getAsSymbol();
   if (!SR)
     return;
 
   ProgramStateRef State = C.getState();
   State =
       State->add<DivZeroMap>(ZeroState(SR, C.getBlockID(), C.getStackFrame()));
   C.addTransition(State);
 }
 
 bool TestAfterDivZeroChecker::hasDivZeroMap(SVal Var,
                                             const CheckerContext &C) const {
-  SymbolRef SR = Var.getAsSymbol();
+  SymExprRef SR = Var.getAsSymbol();
   if (!SR)
     return false;
 
   ZeroState ZS(SR, C.getBlockID(), C.getStackFrame());
   return C.getState()->contains<DivZeroMap>(ZS);
 }
 
 void TestAfterDivZeroChecker::reportBug(SVal Val, CheckerContext &C) const {

clang/lib/StaticAnalyzer/Checkers/TrustNonnullChecker.cpp

 using namespace clang;
 using namespace ento;
 
 /// Records implications between symbols.
 /// The semantics is:
 ///    (antecedent != 0) => (consequent != 0)
 /// These implications are then read during the evaluation of the assumption,
 /// and the appropriate antecedents are applied.
-REGISTER_MAP_WITH_PROGRAMSTATE(NonNullImplicationMap, SymbolRef, SymbolRef)
+REGISTER_MAP_WITH_PROGRAMSTATE(NonNullImplicationMap, SymExprRef, SymExprRef)
 
 /// The semantics is:
 ///    (antecedent == 0) => (consequent == 0)
-REGISTER_MAP_WITH_PROGRAMSTATE(NullImplicationMap, SymbolRef, SymbolRef)
+REGISTER_MAP_WITH_PROGRAMSTATE(NullImplicationMap, SymExprRef, SymExprRef)
 
 namespace {
 
 class TrustNonnullChecker : public Checker<check::PostCall,
                                            check::PostObjCMessage,
                                            check::DeadSymbols,
                                            eval::Assume> {
   // Do not try to iterate over symbols with higher complexity.
TrustNonnullChecker(ASTContext &Ctx)
         ObjectForKeySel(getKeywordSelector(Ctx, "objectForKey")),
         SetObjectForKeyedSubscriptSel(
             getKeywordSelector(Ctx, "setObject", "forKeyedSubscript")),
         SetObjectForKeySel(getKeywordSelector(Ctx, "setObject", "forKey")) {}
 
   ProgramStateRef evalAssume(ProgramStateRef State,
                              SVal Cond,
                              bool Assumption) const {
-    const SymbolRef CondS = Cond.getAsSymbol();
+    const SymExprRef CondS = Cond.getAsSymbol();
     if (!CondS || CondS->computeComplexity() > ComplexityThreshold)
       return State;
 
     for (auto B=CondS->symbol_begin(), E=CondS->symbol_end(); B != E; ++B) {
-      const SymbolRef Antecedent = *B;
+      const SymExprRef Antecedent = *B;
       State = addImplication(Antecedent, State, true);
       State = addImplication(Antecedent, State, false);
     }
 
     return State;
   }
 
   void checkPostCall(const CallEvent &Call, CheckerContext &C) const {
if (interfaceHasSuperclass(ID, "NSMutableDictionary") &&
       if (auto L = Msg.getArgSVal(1).getAs<Loc>())
         State = State->assume(*L, /*assumption=*/true);
     }
 
     // Record an implication: index is non-null if the output is non-null.
     if (interfaceHasSuperclass(ID, "NSDictionary") &&
         (Msg.getSelector() == ObjectForKeyedSubscriptSel ||
          Msg.getSelector() == ObjectForKeySel)) {
-      SymbolRef ArgS = Msg.getArgSVal(0).getAsSymbol();
-      SymbolRef RetS = Msg.getReturnValue().getAsSymbol();
+      SymExprRef ArgS = Msg.getArgSVal(0).getAsSymbol();
+      SymExprRef RetS = Msg.getReturnValue().getAsSymbol();
 
       if (ArgS && RetS) {
         // Emulate an implication: the argument is non-null if
         // the return value is non-null.
         State = State->set<NonNullImplicationMap>(RetS, ArgS);
 
         // Conversely, when the argument is null, the return value
         // is definitely null.

 
 private:
 
   /// \returns State with GDM \p MapName where all dead symbols were
   // removed.
   template <typename MapName>
   ProgramStateRef dropDeadFromGDM(SymbolReaper &SymReaper,
                                   ProgramStateRef State) const {
-    for (const std::pair<SymbolRef, SymbolRef> &P : State->get<MapName>())
+    for (const std::pair<SymExprRef, SymExprRef> &P : State->get<MapName>())
       if (!SymReaper.isLive(P.first) || !SymReaper.isLive(P.second))
         State = State->remove<MapName>(P.first);
     return State;
   }
 
   /// \returns Whether we trust the result of the method call to be
   /// a non-null pointer.
   bool isNonNullPtr(const CallEvent &Call, CheckerContext &C) const {
private:
   }
 
 
   /// \return a state with an optional implication added (if exists)
   /// from a map of recorded implications.
   /// If \p Negated is true, checks NullImplicationMap, and assumes
   /// the negation of \p Antecedent.
   /// Checks NonNullImplicationMap and assumes \p Antecedent otherwise.
-  ProgramStateRef addImplication(SymbolRef Antecedent,
+  ProgramStateRef addImplication(SymExprRef Antecedent,
                                  ProgramStateRef InputState,
                                  bool Negated) const {
     if (!InputState)
       return nullptr;
     SValBuilder &SVB = InputState->getStateManager().getSValBuilder();
-    const SymbolRef *Consequent =
+    const SymExprRef *Consequent =
         Negated ? InputState->get<NonNullImplicationMap>(Antecedent)
                 : InputState->get<NullImplicationMap>(Antecedent);
     if (!Consequent)
       return InputState;
 
     SVal AntecedentV = SVB.makeSymbolVal(Antecedent);
     ProgramStateRef State = InputState;
 

clang/lib/StaticAnalyzer/Core/BugReporter.cpp

std::string StackHintGeneratorForSymbol::getMessage(const ExplodedNode *N){
 
   // Check if one of the parameters are set to the interesting symbol.
   unsigned ArgIndex = 0;
   for (CallExpr::const_arg_iterator I = CE->arg_begin(),
                                     E = CE->arg_end(); I != E; ++I, ++ArgIndex){
     SVal SV = N->getSVal(*I);
 
     // Check if the variable corresponding to the symbol is passed by value.
-    SymbolRef AS = SV.getAsLocSymbol();
+    SymExprRef AS = SV.getAsLocSymbol();
     if (AS == Sym) {
       return getMessageForArg(*I, ArgIndex);
     }
 
     // Check if the parameter is a pointer to the symbol.
     if (Optional<loc::MemRegionVal> Reg = SV.getAs<loc::MemRegionVal>()) {
       // Do not attempt to dereference void*.
       if ((*I)->getType()->isVoidPointerType())
         continue;
       SVal PSV = N->getState()->getSVal(Reg->getRegion());
-      SymbolRef AS = PSV.getAsLocSymbol();
+      SymExprRef AS = PSV.getAsLocSymbol();
       if (AS == Sym) {
         return getMessageForArg(*I, ArgIndex);
       }
     }
   }
 
   // Check if we are returning the interesting symbol.
   SVal SV = N->getSVal(CE);
-  SymbolRef RetSym = SV.getAsLocSymbol();
+  SymExprRef RetSym = SV.getAsLocSymbol();
   if (RetSym == Sym) {
     return getMessageForReturn(CE);
   }
 
   return getMessageForSymbolNotFound();
 }
 
 std::string StackHintGeneratorForSymbol::getMessageForArg(const Expr *ArgE,
switch (TKind) {
     }
 
     llvm_unreachable(
         "BugReport::markInteresting currently can only handle 2 different "
         "tracking kinds! Please define what tracking kind should this entitiy"
         "have, if it was already marked as interesting with a different kind!");
 }
 
-void PathSensitiveBugReport::markInteresting(SymbolRef sym,
+void PathSensitiveBugReport::markInteresting(SymExprRef sym,
                                              bugreporter::TrackingKind TKind) {
   if (!sym)
     return;
 
   insertToInterestingnessMap(InterestingSymbols, sym, TKind);
 
   if (const auto *meta = dyn_cast<SymbolMetadata>(sym))
     markInteresting(meta->getRegion(), TKind);
PathSensitiveBugReport::getInterestingnessKind(SVal V) const {
   llvm_unreachable(
       "BugReport::getInterestingnessKind currently can only handle 2 different "
       "tracking kinds! Please define what tracking kind should we return here "
       "when the kind of getAsRegion() and getAsSymbol() is different!");
   return None;
 }
 
 Optional<bugreporter::TrackingKind>
-PathSensitiveBugReport::getInterestingnessKind(SymbolRef sym) const {
+PathSensitiveBugReport::getInterestingnessKind(SymExprRef sym) const {
   if (!sym)
     return None;
   // We don't currently consider metadata symbols to be interesting
   // even if we know their region is interesting. Is that correct behavior?
   auto It = InterestingSymbols.find(sym);
   if (It == InterestingSymbols.end())
     return None;
   return It->getSecond();
if (const auto *SR = dyn_cast<SymbolicRegion>(R))
     return getInterestingnessKind(SR->getSymbol());
   return None;
 }
 
 bool PathSensitiveBugReport::isInteresting(SVal V) const {
   return getInterestingnessKind(V).hasValue();
 }
 
-bool PathSensitiveBugReport::isInteresting(SymbolRef sym) const {
+bool PathSensitiveBugReport::isInteresting(SymExprRef sym) const {
   return getInterestingnessKind(sym).hasValue();
 }
 
 bool PathSensitiveBugReport::isInteresting(const MemRegion *R) const {
   return getInterestingnessKind(R).hasValue();
 }
 
 bool PathSensitiveBugReport::isInteresting(const LocationContext *LC)  const {

clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

void FalsePositiveRefutationBRVisitor::finalizeVisitor(
   addConstraints(EndPathNode, /*OverwriteConstraintsOnExistingSyms=*/true);
 
   // Create a refutation manager
   llvm::SMTSolverRef RefutationSolver = llvm::CreateZ3Solver();
   ASTContext &Ctx = BRC.getASTContext();
 
   // Add constraints to the solver
   for (const auto &I : Constraints) {
-    const SymbolRef Sym = I.first;
+    const SymExprRef Sym = I.first;
     auto RangeIt = I.second.begin();
 
     llvm::SMTExprRef SMTConstraints = SMTConv::getRangeExpr(
         RefutationSolver, Ctx, Sym, RangeIt->From(), RangeIt->To(),
         /*InRange=*/true);
     while ((++RangeIt) != I.second.end()) {
       SMTConstraints = RefutationSolver->mkOr(
           SMTConstraints, SMTConv::getRangeExpr(RefutationSolver, Ctx, Sym,

 void FalsePositiveRefutationBRVisitor::addConstraints(
     const ExplodedNode *N, bool OverwriteConstraintsOnExistingSyms) {
   // Collect new constraints
   ConstraintMap NewCs = getConstraintMap(N->getState());
   ConstraintMap::Factory &CF = N->getState()->get_context<ConstraintMap>();
 
   // Add constraints if we don't have them yet
   for (auto const &C : NewCs) {
-    const SymbolRef &Sym = C.first;
+    const SymExprRef &Sym = C.first;
     if (!Constraints.contains(Sym)) {
       // This symbol is new, just add the constraint.
       Constraints = CF.add(Constraints, Sym, C.second);
     } else if (OverwriteConstraintsOnExistingSyms) {
       // Overwrite the associated constraint of the Symbol.
       Constraints = CF.remove(Constraints, Sym);
       Constraints = CF.add(Constraints, Sym, C.second);
     }

clang/lib/StaticAnalyzer/Core/CallEvent.cpp

SVal AnyCXXConstructorCall::getCXXThisVal() const {
   if (Data)
     return loc::MemRegionVal(static_cast<const MemRegion *>(Data));
   return UnknownVal();
 }
 
 void AnyCXXConstructorCall::getExtraInvalidatedValues(ValueList &Values,
                            RegionAndSymbolInvalidationTraits *ETraits) const {
   SVal V = getCXXThisVal();
-  if (SymbolRef Sym = V.getAsSymbol(true))
+  if (SymExprRef Sym = V.getAsSymbol(true))
     ETraits->setTrait(Sym,
                       RegionAndSymbolInvalidationTraits::TK_SuppressEscape);
   Values.push_back(V);
 }
 
 void AnyCXXConstructorCall::getInitialStackFrameContents(
                                              const StackFrameContext *CalleeCtx,
                                              BindingsTy &Bindings) const {
if (!SupersType.isNull()) {
           SVal SelfVal = getState()->getSelfSVal(getLocationContext());
           // For [self classMethod], return compiler visible declaration.
           if (Receiver == SelfVal.getAsRegion()) {
             return RuntimeDefinition(findDefiningRedecl(E->getMethodDecl()));
           }
 
           // Otherwise, let's check if we know something about the type
           // inside of this class object.
-          if (SymbolRef ReceiverSym = getReceiverSVal().getAsSymbol()) {
+          if (SymExprRef ReceiverSym = getReceiverSVal().getAsSymbol()) {
             DynamicTypeInfo DTI =
                 getClassObjectDynamicTypeInfo(getState(), ReceiverSym);
             if (DTI.isValid()) {
               // Let's use this type for lookup.
               ReceiverT =
                   cast<ObjCObjectType>(DTI.getType().getCanonicalType());
 
               CanBeSubClassed = DTI.canBeASubClass();

clang/lib/StaticAnalyzer/Core/ConstraintManager.cpp

 #include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"
 
 using namespace clang;
 using namespace ento;
 
 ConstraintManager::~ConstraintManager() = default;
 
 static DefinedSVal getLocFromSymbol(const ProgramStateRef &State,
-                                    SymbolRef Sym) {
+                                    SymExprRef Sym) {
   const MemRegion *R =
       State->getStateManager().getRegionManager().getSymbolicRegion(Sym);
   return loc::MemRegionVal(R);
 }
 
 ConditionTruthVal ConstraintManager::checkNull(ProgramStateRef State,
-                                               SymbolRef Sym) {
+                                               SymExprRef Sym) {
   QualType Ty = Sym->getType();
   DefinedSVal V = Loc::isLocType(Ty) ? getLocFromSymbol(State, Sym)
                                      : nonloc::SymbolVal(Sym);
   const ProgramStatePair &P = assumeDual(State, V);
   if (P.first && !P.second)
     return ConditionTruthVal(false);
   if (!P.first && P.second)
     return ConditionTruthVal(true);
   return {};
 }

clang/lib/StaticAnalyzer/Core/DynamicType.cpp

 /// A set factory of dynamic cast informations.
 REGISTER_SET_FACTORY_WITH_PROGRAMSTATE(CastSet, clang::ento::DynamicCastInfo)
 
 /// A map from symbols to cast informations.
 REGISTER_MAP_WITH_PROGRAMSTATE(DynamicCastMap, const clang::ento::MemRegion *,
                                CastSet)
 
 // A map from Class object symbols to the most likely pointed-to type.
-REGISTER_MAP_WITH_PROGRAMSTATE(DynamicClassObjectMap, clang::ento::SymbolRef,
+REGISTER_MAP_WITH_PROGRAMSTATE(DynamicClassObjectMap, clang::ento::SymExprRef,
                                clang::ento::DynamicTypeInfo)
 
 namespace clang {
 namespace ento {
 
 DynamicTypeInfo getDynamicTypeInfo(ProgramStateRef State, const MemRegion *MR) {
   MR = MR->StripCasts();
 
   // Look up the dynamic type in the GDM.
   if (const DynamicTypeInfo *DTI = State->get<DynamicTypeMap>(MR))
     return *DTI;
 
   // Otherwise, fall back to what we know about the region.
   if (const auto *TR = dyn_cast<TypedRegion>(MR))
     return DynamicTypeInfo(TR->getLocationType(), /*CanBeSub=*/false);
 
   if (const auto *SR = dyn_cast<SymbolicRegion>(MR)) {
-    SymbolRef Sym = SR->getSymbol();
+    SymExprRef Sym = SR->getSymbol();
     return DynamicTypeInfo(Sym->getType());
   }
 
   return {};
 }
 
 const DynamicTypeInfo *getRawDynamicTypeInfo(ProgramStateRef State,
                                              const MemRegion *MR) {
const DynamicCastInfo *getDynamicCastInfo(ProgramStateRef State,
   for (const DynamicCastInfo &Cast : *Lookup)
     if (Cast.equals(CastFromTy, CastToTy))
       return &Cast;
 
   return nullptr;
 }
 
 DynamicTypeInfo getClassObjectDynamicTypeInfo(ProgramStateRef State,
-                                              SymbolRef Sym) {
+                                              SymExprRef Sym) {
   const DynamicTypeInfo *DTI = State->get<DynamicClassObjectMap>(Sym);
   return DTI ? *DTI : DynamicTypeInfo{};
 }
 
 ProgramStateRef setDynamicTypeInfo(ProgramStateRef State, const MemRegion *MR,
                                    DynamicTypeInfo NewTy) {
   State = State->set<DynamicTypeMap>(MR->StripCasts(), NewTy);
   assert(State);
ProgramStateRef setDynamicTypeAndCastInfo(ProgramStateRef State,
   Set = F.add(Set, {CastFromTy, CastToTy, ResultKind});
   State = State->set<DynamicCastMap>(MR, Set);
 
   assert(State);
   return State;
 }
 
 ProgramStateRef setClassObjectDynamicTypeInfo(ProgramStateRef State,
-                                              SymbolRef Sym,
+                                              SymExprRef Sym,
                                               DynamicTypeInfo NewTy) {
   State = State->set<DynamicClassObjectMap>(Sym, NewTy);
   return State;
 }
 
 ProgramStateRef setClassObjectDynamicTypeInfo(ProgramStateRef State,
-                                              SymbolRef Sym, QualType NewTy,
+                                              SymExprRef Sym, QualType NewTy,
                                               bool CanBeSubClassed) {
   return setClassObjectDynamicTypeInfo(State, Sym,
                                        DynamicTypeInfo(NewTy, CanBeSubClassed));
 }
 
 static bool isLive(SymbolReaper &SR, const MemRegion *MR) {
   return SR.isLiveRegion(MR);
 }
 
-static bool isLive(SymbolReaper &SR, SymbolRef Sym) { return SR.isLive(Sym); }
+static bool isLive(SymbolReaper &SR, SymExprRef Sym) { return SR.isLive(Sym); }
 
 template <typename MapTy>
 static ProgramStateRef removeDeadImpl(ProgramStateRef State, SymbolReaper &SR) {
   const auto &Map = State->get<MapTy>();
 
   for (const auto &Elem : Map)
     if (!isLive(SR, Elem.first))
       State = State->remove<MapTy>(Elem.first);

clang/lib/StaticAnalyzer/Core/Environment.cpp

 namespace {
 
 class MarkLiveCallback final : public SymbolVisitor {
   SymbolReaper &SymReaper;
 
 public:
   MarkLiveCallback(SymbolReaper &symreaper) : SymReaper(symreaper) {}
 
-  bool VisitSymbol(SymbolRef sym) override {
+  bool VisitSymbol(SymExprRef sym) override {
     SymReaper.markLive(sym);
     return true;
   }
 
   bool VisitMemRegion(const MemRegion *R) override {
     SymReaper.markLive(R);
     return true;
   }

clang/lib/StaticAnalyzer/Core/ExprEngine.cpp

assert(K == ProgramPoint::PostStmtPurgeDeadSymbolsKind &&
            "Use PostStmtPurgeDeadSymbolsKind for clearing a LocationContext");
     LC = LC->getParent();
   }
 
   const StackFrameContext *SFC = LC ? LC->getStackFrame() : nullptr;
   SymbolReaper SymReaper(SFC, ReferenceStmt, SymMgr, getStoreManager());
 
   for (auto I : CleanedState->get<ObjectsUnderConstruction>()) {
-    if (SymbolRef Sym = I.second.getAsSymbol())
+    if (SymExprRef Sym = I.second.getAsSymbol())
       SymReaper.markLive(Sym);
     if (const MemRegion *MR = I.second.getAsRegion())
       SymReaper.markLive(MR);
   }
 
   getCheckerManager().runCheckersForLiveSymbols(CleanedState, SymReaper);
 
   // Create a state in which dead bindings are removed from the environment
class CollectReachableSymbolsCallback final : public SymbolVisitor {
     InvalidatedSymbols &Symbols;
 
   public:
     explicit CollectReachableSymbolsCallback(InvalidatedSymbols &Symbols)
         : Symbols(Symbols) {}
 
     const InvalidatedSymbols &getSymbols() const { return Symbols; }
 
-    bool VisitSymbol(SymbolRef Sym) override {
+    bool VisitSymbol(SymExprRef Sym) override {
       Symbols.insert(Sym);
       return true;
     }
   };
   InvalidatedSymbols Symbols;
   CollectReachableSymbolsCallback CallBack(Symbols);
   for (SVal V : Vs)
     State->scanReachableSymbols(V, CallBack);

clang/lib/StaticAnalyzer/Core/ExprEngineObjC.cpp

if (auto MV = elementV.getAs<loc::MemRegionVal>())
         // FIXME: The proper thing to do is to really iterate over the
         //  container.  We will do this with dispatch logic to the store.
         //  For now, just 'conjure' up a symbolic value.
         QualType T = R->getValueType();
         assert(Loc::isLocType(T));
 
         SVal V;
         if (hasElements) {
-          SymbolRef Sym = SymMgr.conjureSymbol(elem, LCtx, T,
-                                               currBldrCtx->blockCount());
+          SymExprRef Sym =
+              SymMgr.conjureSymbol(elem, LCtx, T, currBldrCtx->blockCount());
           V = svalBuilder.makeLoc(Sym);
         } else {
           V = svalBuilder.makeIntVal(0, T);
         }
 
         nextState = nextState->bindLoc(elementV, V, LCtx);
       }
 

clang/lib/StaticAnalyzer/Core/MemRegion.cpp

void ParamVarRegion::ProfileRegion(llvm::FoldingSetNodeID &ID, const Expr *OE,
   ID.AddInteger(Idx);
   ID.AddPointer(SReg);
 }
 
 void ParamVarRegion::Profile(llvm::FoldingSetNodeID &ID) const {
   ProfileRegion(ID, getOriginExpr(), getIndex(), superRegion);
 }
 
-void SymbolicRegion::ProfileRegion(llvm::FoldingSetNodeID& ID, SymbolRef sym,
+void SymbolicRegion::ProfileRegion(llvm::FoldingSetNodeID &ID, SymExprRef sym,
                                    const MemRegion *sreg) {
   ID.AddInteger(static_cast<unsigned>(MemRegion::SymbolicRegionKind));
   ID.Add(sym);
   ID.AddPointer(sreg);
 }
 
 void SymbolicRegion::Profile(llvm::FoldingSetNodeID& ID) const {
   SymbolicRegion::ProfileRegion(ID, sym, getSuperRegion());

 
 const BlockCodeRegion *
 MemRegionManager::getBlockCodeRegion(const BlockDecl *BD, CanQualType locTy,
                                      AnalysisDeclContext *AC) {
   return getSubRegion<BlockCodeRegion>(BD, locTy, AC, getCodeRegion());
 }
 
 /// getSymbolicRegion - Retrieve or create a "symbolic" memory region.
-const SymbolicRegion *MemRegionManager::getSymbolicRegion(SymbolRef sym) {
+const SymbolicRegion *MemRegionManager::getSymbolicRegion(SymExprRef sym) {
   return getSubRegion<SymbolicRegion>(sym, getUnknownRegion());
 }
 
-const SymbolicRegion *MemRegionManager::getSymbolicHeapRegion(SymbolRef Sym) {
+const SymbolicRegion *MemRegionManager::getSymbolicHeapRegion(SymExprRef Sym) {
   return getSubRegion<SymbolicRegion>(Sym, getHeapRegion());
 }
 
 const FieldRegion*
 MemRegionManager::getFieldRegion(const FieldDecl *d,
                                  const SubRegion* superRegion){
   return getSubRegion<FieldRegion>(d, superRegion);
 }
const VarRegion *BlockDataRegion::getOriginalRegion(const VarRegion *R) const {
   }
   return nullptr;
 }
 
 //===----------------------------------------------------------------------===//
 // RegionAndSymbolInvalidationTraits
 //===----------------------------------------------------------------------===//
 
-void RegionAndSymbolInvalidationTraits::setTrait(SymbolRef Sym,
+void RegionAndSymbolInvalidationTraits::setTrait(SymExprRef Sym,
                                                  InvalidationKinds IK) {
   SymTraitsMap[Sym] |= IK;
 }
 
 void RegionAndSymbolInvalidationTraits::setTrait(const MemRegion *MR,
                                                  InvalidationKinds IK) {
   assert(MR);
   if (const auto *SR = dyn_cast<SymbolicRegion>(MR))
     setTrait(SR->getSymbol(), IK);
   else
     MRTraitsMap[MR] |= IK;
 }
 
-bool RegionAndSymbolInvalidationTraits::hasTrait(SymbolRef Sym,
+bool RegionAndSymbolInvalidationTraits::hasTrait(SymExprRef Sym,
                                                  InvalidationKinds IK) const {
   const_symbol_iterator I = SymTraitsMap.find(Sym);
   if (I != SymTraitsMap.end())
     return I->second & IK;
 
   return false;
 }
 

clang/lib/StaticAnalyzer/Core/ProgramState.cpp

SVal ProgramState::getSVal(Loc location, QualType T) const {
 
   // If 'V' is a symbolic value that is *perfectly* constrained to
   // be a constant value, use that value instead to lessen the burden
   // on later analysis stages (so we have less symbolic values to reason
   // about).
   // We only go into this branch if we can convert the APSInt value we have
   // to the type of T, which is not always the case (e.g. for void).
   if (!T.isNull() && (T->isIntegralOrEnumerationType() || Loc::isLocType(T))) {
-    if (SymbolRef sym = V.getAsSymbol()) {
+    if (SymExprRef sym = V.getAsSymbol()) {
       if (const llvm::APSInt *Int = getStateManager()
                                     .getConstraintManager()
                                     .getSymVal(this, sym)) {
         // FIXME: Because we don't correctly model (yet) sign-extension
         // and truncation of symbolic values, we need to convert
         // the integer value to the correct signedness and bitwidth.
         //
         // This shows up in the following:

 
 ConditionTruthVal ProgramState::isNull(SVal V) const {
   if (V.isZeroConstant())
     return true;
 
   if (V.isConstant())
     return false;
 
-  SymbolRef Sym = V.getAsSymbol(/* IncludeBaseRegion */ true);
+  SymExprRef Sym = V.getAsSymbol(/* IncludeBaseRegion */ true);
   if (!Sym)
     return ConditionTruthVal();
 
   return getStateManager().ConstraintMgr->isNull(this, Sym);
 }
 
 ProgramStateRef ProgramStateManager::getInitialState(const LocationContext *InitLoc) {
   ProgramState State(this,
bool ScanReachableSymbols::scan(SVal val) {
 
   if (Optional<nonloc::LazyCompoundVal> X =
           val.getAs<nonloc::LazyCompoundVal>())
     return scan(*X);
 
   if (Optional<nonloc::LocAsInteger> X = val.getAs<nonloc::LocAsInteger>())
     return scan(X->getLoc());
 
-  if (SymbolRef Sym = val.getAsSymbol())
+  if (SymExprRef Sym = val.getAsSymbol())
     return scan(Sym);
 
   if (Optional<nonloc::CompoundVal> X = val.getAs<nonloc::CompoundVal>())
     return scan(*X);
 
   return true;
 }
 

clang/lib/StaticAnalyzer/Core/RangeConstraintManager.cpp

else
       os << ", ";
 
     os << '[' << i->From().toString(10) << ", " << i->To().toString(10)
        << ']';
   }
   os << " }";
 }
 
-REGISTER_SET_FACTORY_WITH_PROGRAMSTATE(SymbolSet, SymbolRef)
+REGISTER_SET_FACTORY_WITH_PROGRAMSTATE(SymbolSet, SymExprRef)
 
 namespace {
 class EquivalenceClass;
 } // end anonymous namespace
 
-REGISTER_MAP_WITH_PROGRAMSTATE(ClassMap, SymbolRef, EquivalenceClass)
+REGISTER_MAP_WITH_PROGRAMSTATE(ClassMap, SymExprRef, EquivalenceClass)
 REGISTER_MAP_WITH_PROGRAMSTATE(ClassMembers, EquivalenceClass, SymbolSet)
 REGISTER_MAP_WITH_PROGRAMSTATE(ConstraintRange, EquivalenceClass, RangeSet)
 
 REGISTER_SET_FACTORY_WITH_PROGRAMSTATE(ClassSet, EquivalenceClass)
 REGISTER_MAP_WITH_PROGRAMSTATE(DisequalityMap, EquivalenceClass, ClassSet)
 
 namespace {
 /// This class encapsulates a set of symbols equal to each other.

 ///   * "Merge operation" merges two classes into one.  It is the main operation
 ///     to produce non-trivial classes.
 ///     If, at some point, we can assume that two symbols from two distinct
 ///     classes are equal, we can merge these classes.
 class EquivalenceClass : public llvm::FoldingSetNode {
 public:
   /// Find equivalence class for the given symbol in the given state.
   LLVM_NODISCARD static inline EquivalenceClass find(ProgramStateRef State,
-                                                     SymbolRef Sym);
+                                                     SymExprRef Sym);
 
   /// Merge classes for the given symbols and return a new state.
   LLVM_NODISCARD static inline ProgramStateRef
   merge(BasicValueFactory &BV, RangeSet::Factory &F, ProgramStateRef State,
-        SymbolRef First, SymbolRef Second);
+        SymExprRef First, SymExprRef Second);
   // Merge this class with the given class and return a new state.
   LLVM_NODISCARD inline ProgramStateRef merge(BasicValueFactory &BV,
                                               RangeSet::Factory &F,
                                               ProgramStateRef State,
                                               EquivalenceClass Other);
 
   /// Return a set of class members for the given state.
   LLVM_NODISCARD inline SymbolSet getClassMembers(ProgramStateRef State);
   /// Return true if the current class is trivial in the given state.
   LLVM_NODISCARD inline bool isTrivial(ProgramStateRef State);
   /// Return true if the current class is trivial and its only member is dead.
   LLVM_NODISCARD inline bool isTriviallyDead(ProgramStateRef State,
                                              SymbolReaper &Reaper);
 
   LLVM_NODISCARD static inline ProgramStateRef
   markDisequal(BasicValueFactory &BV, RangeSet::Factory &F,
-               ProgramStateRef State, SymbolRef First, SymbolRef Second);
+               ProgramStateRef State, SymExprRef First, SymExprRef Second);
   LLVM_NODISCARD static inline ProgramStateRef
   markDisequal(BasicValueFactory &BV, RangeSet::Factory &F,
                ProgramStateRef State, EquivalenceClass First,
                EquivalenceClass Second);
   LLVM_NODISCARD inline ProgramStateRef
   markDisequal(BasicValueFactory &BV, RangeSet::Factory &F,
                ProgramStateRef State, EquivalenceClass Other) const;
   LLVM_NODISCARD static inline ClassSet
-  getDisequalClasses(ProgramStateRef State, SymbolRef Sym);
+  getDisequalClasses(ProgramStateRef State, SymExprRef Sym);
   LLVM_NODISCARD inline ClassSet
   getDisequalClasses(ProgramStateRef State) const;
   LLVM_NODISCARD inline ClassSet
   getDisequalClasses(DisequalityMapTy Map, ClassSet::Factory &Factory) const;
 
   LLVM_NODISCARD static inline Optional<bool>
-  areEqual(ProgramStateRef State, SymbolRef First, SymbolRef Second);
+  areEqual(ProgramStateRef State, SymExprRef First, SymExprRef Second);
 
   /// Check equivalence data for consistency.
   LLVM_NODISCARD LLVM_ATTRIBUTE_UNUSED static bool
   isClassDataConsistent(ProgramStateRef State);
 
   LLVM_NODISCARD QualType getType() const {
     return getRepresentativeSymbol()->getType();
   }
public:
 
   static void Profile(llvm::FoldingSetNodeID &ID, uintptr_t CID) {
     ID.AddInteger(CID);
   }
 
   void Profile(llvm::FoldingSetNodeID &ID) const { Profile(ID, this->ID); }
 
 private:
-  /* implicit */ EquivalenceClass(SymbolRef Sym)
+  /* implicit */ EquivalenceClass(SymExprRef Sym)
       : ID(reinterpret_cast<uintptr_t>(Sym)) {}
 
   /// This function is intended to be used ONLY within the class.
   /// The fact that ID is a pointer to a symbol is an implementation detail
   /// and should stay that way.
   /// In the current implementation, we use it to retrieve the only member
   /// of the trivial class.
-  SymbolRef getRepresentativeSymbol() const {
-    return reinterpret_cast<SymbolRef>(ID);
+  SymExprRef getRepresentativeSymbol() const {
+    return reinterpret_cast<SymExprRef>(ID);
   }
   static inline SymbolSet::Factory &getMembersFactory(ProgramStateRef State);
 
   inline ProgramStateRef mergeImpl(BasicValueFactory &BV, RangeSet::Factory &F,
                                    ProgramStateRef State, SymbolSet Members,
                                    EquivalenceClass Other,
                                    SymbolSet OtherMembers);
   static inline void

 //===----------------------------------------------------------------------===//
 
 LLVM_NODISCARD inline const RangeSet *getConstraint(ProgramStateRef State,
                                                     EquivalenceClass Class) {
   return State->get<ConstraintRange>(Class);
 }
 
 LLVM_NODISCARD inline const RangeSet *getConstraint(ProgramStateRef State,
-                                                    SymbolRef Sym) {
+                                                    SymExprRef Sym) {
   return getConstraint(State, EquivalenceClass::find(State, Sym));
 }
 
 //===----------------------------------------------------------------------===//
 //                       Equality/diseqiality abstraction
 //===----------------------------------------------------------------------===//
 
 /// A small helper structure representing symbolic equality.
 ///
 /// Equality check can have different forms (like a == b or a - b) and this
 /// class encapsulates those away if the only thing the user wants to check -
 /// whether it's equality/diseqiality or not and have an easy access to the
 /// compared symbols.
 struct EqualityInfo {
 public:
-  SymbolRef Left, Right;
+  SymExprRef Left, Right;
   // true for equality and false for disequality.
   bool IsEquality = true;
 
   void invert() { IsEquality = !IsEquality; }
   /// Extract equality information from the given symbol and the constants.
   ///
   /// This function assumes the following expression Sym + Adjustment != Int.
   /// It is a default because the most widespread case of the equality check
   /// is (A == B) + 0 != 0.
-  static Optional<EqualityInfo> extract(SymbolRef Sym, const llvm::APSInt &Int,
+  static Optional<EqualityInfo> extract(SymExprRef Sym, const llvm::APSInt &Int,
                                         const llvm::APSInt &Adjustment) {
     // As of now, the only equality form supported is Sym + 0 != 0.
     if (!Int.isNullValue() || !Adjustment.isNullValue())
       return llvm::None;
 
     return extract(Sym);
   }
   /// Extract equality information from the given symbol.
-  static Optional<EqualityInfo> extract(SymbolRef Sym) {
+  static Optional<EqualityInfo> extract(SymExprRef Sym) {
     return EqualityExtractor().Visit(Sym);
   }
 
 private:
   class EqualityExtractor
       : public SymExprVisitor<EqualityExtractor, Optional<EqualityInfo>> {
   public:
     Optional<EqualityInfo> VisitSymSymExpr(const SymSymExpr *Sym) const {

 public:
   template <class SourceType>
   static RangeSet inferRange(BasicValueFactory &BV, RangeSet::Factory &F,
                              ProgramStateRef State, SourceType Origin) {
     SymbolicRangeInferrer Inferrer(BV, F, State);
     return Inferrer.infer(Origin);
   }
 
-  RangeSet VisitSymExpr(SymbolRef Sym) {
+  RangeSet VisitSymExpr(SymExprRef Sym) {
     // If we got to this function, the actual type of the symbolic
     // expression is not supported for advanced inference.
     // In this case, we simply backoff to the default "let's simply
     // infer the range from the expression's type".
     return infer(Sym->getType());
   }
 
   RangeSet VisitSymIntExpr(const SymIntExpr *Sym) {
private:
   ///
   /// It's not a real "inference", but is here for operating with
   /// sub-expressions in a more polymorphic manner.
   RangeSet inferAs(const llvm::APSInt &Val, QualType) {
     return {RangeFactory, Val};
   }
 
   /// Infer range information from symbol in the context of the given type.
-  RangeSet inferAs(SymbolRef Sym, QualType DestType) {
+  RangeSet inferAs(SymExprRef Sym, QualType DestType) {
     QualType ActualType = Sym->getType();
     // Check that we can reason about the symbol at all.
     if (ActualType->isIntegralOrEnumerationType() ||
         Loc::isLocType(ActualType)) {
       return infer(Sym);
     }
     // Otherwise, let's simply infer from the destination type.
     // We couldn't figure out nothing else about that expression.
     return infer(DestType);
   }
 
-  RangeSet infer(SymbolRef Sym) {
+  RangeSet infer(SymExprRef Sym) {
     if (Optional<RangeSet> ConstraintBasedRange = intersect(
             ValueFactory, RangeFactory, getConstraint(State, Sym),
             // If Sym is a difference of symbols A - B, then maybe we have range
             // set stored for B - A.
             //
             // If we have range set stored for both A - B and B - A then
             // calculate the effective range set by intersecting the range set
             // for A - B and the negated range set of B - A.
RangeSet assumeNonZero(RangeSet Domain, QualType T) {
     return Domain.Delete(ValueFactory, RangeFactory, IntType.getZeroValue());
   }
 
   // FIXME: Once SValBuilder supports unary minus, we should use SValBuilder to
   //        obtain the negated symbolic expression instead of constructing the
   //        symbol manually. This will allow us to support finding ranges of not
   //        only negated SymSymExpr-type expressions, but also of other, simpler
   //        expressions which we currently do not know how to negate.
-  Optional<RangeSet> getRangeForNegatedSub(SymbolRef Sym) {
+  Optional<RangeSet> getRangeForNegatedSub(SymExprRef Sym) {
     if (const SymSymExpr *SSE = dyn_cast<SymSymExpr>(Sym)) {
       if (SSE->getOpcode() == BO_Sub) {
         QualType T = Sym->getType();
 
         // Do not negate unsigned ranges
         if (!T->isUnsignedIntegerOrEnumerationType() &&
             !T->isSignedIntegerOrEnumerationType())
           return llvm::None;
 
         SymbolManager &SymMgr = State->getSymbolManager();
-        SymbolRef NegatedSym =
+        SymExprRef NegatedSym =
             SymMgr.getSymSymExpr(SSE->getRHS(), BO_Sub, SSE->getLHS(), T);
 
         if (const RangeSet *NegatedRange = getConstraint(State, NegatedSym)) {
           return NegatedRange->Negate(ValueFactory, RangeFactory);
         }
       }
     }
     return llvm::None;
   }
 
   // Returns ranges only for binary comparison operators (except <=>)
   // when left and right operands are symbolic values.
   // Finds any other comparisons with the same operands.
   // Then do logical calculations and refuse impossible branches.
   // E.g. (x < y) and (x > y) at the same time are impossible.
   // E.g. (x >= y) and (x != y) at the same time makes (x > y) true only.
   // E.g. (x == y) and (y == x) are just reversed but the same.
   // It covers all possible combinations (see CmpOpTable description).
   // Note that `x` and `y` can also stand for subexpressions,
   // not only for actual symbols.
-  Optional<RangeSet> getRangeForComparisonSymbol(SymbolRef Sym) {
+  Optional<RangeSet> getRangeForComparisonSymbol(SymExprRef Sym) {
     const auto *SSE = dyn_cast<SymSymExpr>(Sym);
     if (!SSE)
       return llvm::None;
 
     BinaryOperatorKind CurrentOP = SSE->getOpcode();
 
     // We currently do not support <=> (C++20).
     if (!BinaryOperator::isComparisonOp(CurrentOP) || (CurrentOP == BO_Cmp))
for (size_t i = 0; i < CmpOpTable.getCmpOpCount(); ++i) {
 
       return (BranchState == OperatorRelationsTable::True) ? getTrueRange(T)
                                                            : getFalseRange(T);
     }
 
     return llvm::None;
   }
 
-  Optional<RangeSet> getRangeForEqualities(SymbolRef Sym) {
+  Optional<RangeSet> getRangeForEqualities(SymExprRef Sym) {
     Optional<EqualityInfo> Equality = EqualityInfo::extract(Sym);
 
     if (!Equality)
       return llvm::None;
 
     if (Optional<bool> AreEqual = EquivalenceClass::areEqual(
             State, Equality->Left, Equality->Right)) {
       if (*AreEqual == Equality->IsEquality) {
bool haveEqualConstraints(ProgramStateRef S1,
     //       so comparing constraint ranges and class maps should be
     //       sufficient.
     return S1->get<ConstraintRange>() == S2->get<ConstraintRange>() &&
            S1->get<ClassMap>() == S2->get<ClassMap>();
   }
 
   bool canReasonAbout(SVal X) const override;
 
-  ConditionTruthVal checkNull(ProgramStateRef State, SymbolRef Sym) override;
+  ConditionTruthVal checkNull(ProgramStateRef State, SymExprRef Sym) override;
 
   const llvm::APSInt *getSymVal(ProgramStateRef State,
-                                SymbolRef Sym) const override;
+                                SymExprRef Sym) const override;
 
   ProgramStateRef removeDeadBindings(ProgramStateRef State,
                                      SymbolReaper &SymReaper) override;
 
   void printJson(raw_ostream &Out, ProgramStateRef State, const char *NL = "\n",
                  unsigned int Space = 0, bool IsDot = false) const override;
 
   //===------------------------------------------------------------------===//
   // Implementation for interface from RangedConstraintManager.
   //===------------------------------------------------------------------===//
 
-  ProgramStateRef assumeSymNE(ProgramStateRef State, SymbolRef Sym,
+  ProgramStateRef assumeSymNE(ProgramStateRef State, SymExprRef Sym,
                               const llvm::APSInt &V,
                               const llvm::APSInt &Adjustment) override;
 
-  ProgramStateRef assumeSymEQ(ProgramStateRef State, SymbolRef Sym,
+  ProgramStateRef assumeSymEQ(ProgramStateRef State, SymExprRef Sym,
                               const llvm::APSInt &V,
                               const llvm::APSInt &Adjustment) override;
 
-  ProgramStateRef assumeSymLT(ProgramStateRef State, SymbolRef Sym,
+  ProgramStateRef assumeSymLT(ProgramStateRef State, SymExprRef Sym,
                               const llvm::APSInt &V,
                               const llvm::APSInt &Adjustment) override;
 
-  ProgramStateRef assumeSymGT(ProgramStateRef State, SymbolRef Sym,
+  ProgramStateRef assumeSymGT(ProgramStateRef State, SymExprRef Sym,
                               const llvm::APSInt &V,
                               const llvm::APSInt &Adjustment) override;
 
-  ProgramStateRef assumeSymLE(ProgramStateRef State, SymbolRef Sym,
+  ProgramStateRef assumeSymLE(ProgramStateRef State, SymExprRef Sym,
                               const llvm::APSInt &V,
                               const llvm::APSInt &Adjustment) override;
 
-  ProgramStateRef assumeSymGE(ProgramStateRef State, SymbolRef Sym,
+  ProgramStateRef assumeSymGE(ProgramStateRef State, SymExprRef Sym,
                               const llvm::APSInt &V,
                               const llvm::APSInt &Adjustment) override;
 
   ProgramStateRef assumeSymWithinInclusiveRange(
-      ProgramStateRef State, SymbolRef Sym, const llvm::APSInt &From,
+      ProgramStateRef State, SymExprRef Sym, const llvm::APSInt &From,
       const llvm::APSInt &To, const llvm::APSInt &Adjustment) override;
 
   ProgramStateRef assumeSymOutsideInclusiveRange(
-      ProgramStateRef State, SymbolRef Sym, const llvm::APSInt &From,
+      ProgramStateRef State, SymExprRef Sym, const llvm::APSInt &From,
       const llvm::APSInt &To, const llvm::APSInt &Adjustment) override;
 
 private:
   RangeSet::Factory F;
 
-  RangeSet getRange(ProgramStateRef State, SymbolRef Sym);
+  RangeSet getRange(ProgramStateRef State, SymExprRef Sym);
   RangeSet getRange(ProgramStateRef State, EquivalenceClass Class);
 
-  RangeSet getSymLTRange(ProgramStateRef St, SymbolRef Sym,
+  RangeSet getSymLTRange(ProgramStateRef St, SymExprRef Sym,
                          const llvm::APSInt &Int,
                          const llvm::APSInt &Adjustment);
-  RangeSet getSymGTRange(ProgramStateRef St, SymbolRef Sym,
+  RangeSet getSymGTRange(ProgramStateRef St, SymExprRef Sym,
                          const llvm::APSInt &Int,
                          const llvm::APSInt &Adjustment);
-  RangeSet getSymLERange(ProgramStateRef St, SymbolRef Sym,
+  RangeSet getSymLERange(ProgramStateRef St, SymExprRef Sym,
                          const llvm::APSInt &Int,
                          const llvm::APSInt &Adjustment);
   RangeSet getSymLERange(llvm::function_ref<RangeSet()> RS,
                          const llvm::APSInt &Int,
                          const llvm::APSInt &Adjustment);
-  RangeSet getSymGERange(ProgramStateRef St, SymbolRef Sym,
+  RangeSet getSymGERange(ProgramStateRef St, SymExprRef Sym,
                          const llvm::APSInt &Int,
                          const llvm::APSInt &Adjustment);
 
   //===------------------------------------------------------------------===//
   // Equality tracking implementation
   //===------------------------------------------------------------------===//
 
   ProgramStateRef trackEQ(RangeSet NewConstraint, ProgramStateRef State,
-                          SymbolRef Sym, const llvm::APSInt &Int,
+                          SymExprRef Sym, const llvm::APSInt &Int,
                           const llvm::APSInt &Adjustment) {
     return track<true>(NewConstraint, State, Sym, Int, Adjustment);
   }
 
   ProgramStateRef trackNE(RangeSet NewConstraint, ProgramStateRef State,
-                          SymbolRef Sym, const llvm::APSInt &Int,
+                          SymExprRef Sym, const llvm::APSInt &Int,
                           const llvm::APSInt &Adjustment) {
     return track<false>(NewConstraint, State, Sym, Int, Adjustment);
   }
 
   template <bool EQ>
   ProgramStateRef track(RangeSet NewConstraint, ProgramStateRef State,
-                        SymbolRef Sym, const llvm::APSInt &Int,
+                        SymExprRef Sym, const llvm::APSInt &Int,
                         const llvm::APSInt &Adjustment) {
     if (NewConstraint.isEmpty())
       // This is an infeasible assumption.
       return nullptr;
 
     ProgramStateRef NewState = setConstraint(State, Sym, NewConstraint);
     if (auto Equality = EqualityInfo::extract(Sym, Int, Adjustment)) {
       // If the original assumption is not Sym + Adjustment !=/</> Int,
       // we should invert IsEquality flag.
       Equality->IsEquality = Equality->IsEquality != EQ;
       return track(NewState, *Equality);
     }
 
     return NewState;
   }
 
   ProgramStateRef track(ProgramStateRef State, EqualityInfo ToTrack) {
     if (ToTrack.IsEquality) {
       return trackEquality(State, ToTrack.Left, ToTrack.Right);
     }
     return trackDisequality(State, ToTrack.Left, ToTrack.Right);
   }
 
-  ProgramStateRef trackDisequality(ProgramStateRef State, SymbolRef LHS,
-                                   SymbolRef RHS) {
+  ProgramStateRef trackDisequality(ProgramStateRef State, SymExprRef LHS,
+                                   SymExprRef RHS) {
     return EquivalenceClass::markDisequal(getBasicVals(), F, State, LHS, RHS);
   }
 
-  ProgramStateRef trackEquality(ProgramStateRef State, SymbolRef LHS,
-                                SymbolRef RHS) {
+  ProgramStateRef trackEquality(ProgramStateRef State, SymExprRef LHS,
+                                SymExprRef RHS) {
     return EquivalenceClass::merge(getBasicVals(), F, State, LHS, RHS);
   }
 
   LLVM_NODISCARD inline ProgramStateRef setConstraint(ProgramStateRef State,
                                                       EquivalenceClass Class,
                                                       RangeSet Constraint) {
     ConstraintRangeTy Constraints = State->get<ConstraintRange>();
     ConstraintRangeTy::Factory &CF = State->get_context<ConstraintRange>();
if (const llvm::APSInt *Point = Constraint.getConcreteValue())
             getRange(State, DisequalClass).Delete(getBasicVals(), F, *Point);
         Constraints = CF.add(Constraints, DisequalClass, UpdatedConstraint);
       }
 
     return State->set<ConstraintRange>(Constraints);
   }
 
   LLVM_NODISCARD inline ProgramStateRef
-  setConstraint(ProgramStateRef State, SymbolRef Sym, RangeSet Constraint) {
+  setConstraint(ProgramStateRef State, SymExprRef Sym, RangeSet Constraint) {
     return setConstraint(State, EquivalenceClass::find(State, Sym), Constraint);
   }
 };
 
 } // end anonymous namespace
 
 std::unique_ptr<ConstraintManager>
 ento::CreateRangeConstraintManager(ProgramStateManager &StMgr,
                                    ExprEngine *Eng) {
   return std::make_unique<RangeConstraintManager>(Eng, StMgr.getSValBuilder());
 }
 
 ConstraintMap ento::getConstraintMap(ProgramStateRef State) {
   ConstraintMap::Factory &F = State->get_context<ConstraintMap>();
   ConstraintMap Result = F.getEmptyMap();
 
   ConstraintRangeTy Constraints = State->get<ConstraintRange>();
   for (std::pair<EquivalenceClass, RangeSet> ClassConstraint : Constraints) {
     EquivalenceClass Class = ClassConstraint.first;
     SymbolSet ClassMembers = Class.getClassMembers(State);
     assert(!ClassMembers.isEmpty() &&
            "Class must always have at least one member!");
 
-    SymbolRef Representative = *ClassMembers.begin();
+    SymExprRef Representative = *ClassMembers.begin();
     Result = F.add(Result, Representative, ClassConstraint.second);
   }
 
   return Result;
 }
 
 //===----------------------------------------------------------------------===//
 //                     EqualityClass implementation details
 //===----------------------------------------------------------------------===//
 
 inline EquivalenceClass EquivalenceClass::find(ProgramStateRef State,
-                                               SymbolRef Sym) {
+                                               SymExprRef Sym) {
   // We store far from all Symbol -> Class mappings
   if (const EquivalenceClass *NontrivialClass = State->get<ClassMap>(Sym))
     return *NontrivialClass;
 
   // This is a trivial class of Sym.
   return Sym;
 }
 
 inline ProgramStateRef EquivalenceClass::merge(BasicValueFactory &BV,
                                                RangeSet::Factory &F,
                                                ProgramStateRef State,
-                                               SymbolRef First,
-                                               SymbolRef Second) {
+                                               SymExprRef First,
+                                               SymExprRef Second) {
   EquivalenceClass FirstClass = find(State, First);
   EquivalenceClass SecondClass = find(State, Second);
 
   return FirstClass.merge(BV, F, State, SecondClass);
 }
 
 inline ProgramStateRef EquivalenceClass::merge(BasicValueFactory &BV,
                                                RangeSet::Factory &F,
EquivalenceClass::mergeImpl(BasicValueFactory &ValueFactory,
   DisequalityMapTy DisequalityInfo = State->get<DisequalityMap>();
   DisequalityMapTy::Factory &DF = State->get_context<DisequalityMap>();
 
   ClassSet::Factory &CF = State->get_context<ClassSet>();
   SymbolSet::Factory &F = getMembersFactory(State);
 
   // 2. Merge members of the Other class into the current class.
   SymbolSet NewClassMembers = MyMembers;
-  for (SymbolRef Sym : OtherMembers) {
+  for (SymExprRef Sym : OtherMembers) {
     NewClassMembers = F.add(NewClassMembers, Sym);
     // *this is now the class for all these new symbols.
     Classes = CMF.add(Classes, Sym, *this);
   }
 
   // 3. Adjust member mapping.
   //
   // No need in tracking members of a now-dissolved class.

 bool EquivalenceClass::isTriviallyDead(ProgramStateRef State,
                                        SymbolReaper &Reaper) {
   return isTrivial(State) && Reaper.isDead(getRepresentativeSymbol());
 }
 
 inline ProgramStateRef EquivalenceClass::markDisequal(BasicValueFactory &VF,
                                                       RangeSet::Factory &RF,
                                                       ProgramStateRef State,
-                                                      SymbolRef First,
-                                                      SymbolRef Second) {
+                                                      SymExprRef First,
+                                                      SymExprRef Second) {
   return markDisequal(VF, RF, State, find(State, First), find(State, Second));
 }
 
 inline ProgramStateRef EquivalenceClass::markDisequal(BasicValueFactory &VF,
                                                       RangeSet::Factory &RF,
                                                       ProgramStateRef State,
                                                       EquivalenceClass First,
                                                       EquivalenceClass Second) {
if (const llvm::APSInt *Point = SecondConstraint->getConcreteValue()) {
           VF, RF, State, First.getRepresentativeSymbol());
 
       FirstConstraint = FirstConstraint.Delete(VF, RF, *Point);
       Constraints = CRF.add(Constraints, First, FirstConstraint);
     }
 }
 
 inline Optional<bool> EquivalenceClass::areEqual(ProgramStateRef State,
-                                                 SymbolRef FirstSym,
-                                                 SymbolRef SecondSym) {
+                                                 SymExprRef FirstSym,
+                                                 SymExprRef SecondSym) {
   EquivalenceClass First = find(State, FirstSym);
   EquivalenceClass Second = find(State, SecondSym);
 
   // The same equivalence class => symbols are equal.
   if (First == Second)
     return true;
 
   // Let's check if we know anything about these two classes being not equal to
   // each other.
   ClassSet DisequalToFirst = First.getDisequalClasses(State);
   if (DisequalToFirst.contains(Second))
     return false;
 
   // It is not clear.
   return llvm::None;
 }
 
 inline ClassSet EquivalenceClass::getDisequalClasses(ProgramStateRef State,
-                                                     SymbolRef Sym) {
+                                                     SymExprRef Sym) {
   return find(State, Sym).getDisequalClasses(State);
 }
 
 inline ClassSet
 EquivalenceClass::getDisequalClasses(ProgramStateRef State) const {
   return getDisequalClasses(State->get<DisequalityMap>(),
                             State->get_context<ClassSet>());
 }
 
 inline ClassSet
 EquivalenceClass::getDisequalClasses(DisequalityMapTy Map,
                                      ClassSet::Factory &Factory) const {
   if (const ClassSet *DisequalClasses = Map.lookup(*this))
     return *DisequalClasses;
 
   return Factory.getEmptySet();
 }
 
 bool EquivalenceClass::isClassDataConsistent(ProgramStateRef State) {
   ClassMembersTy Members = State->get<ClassMembers>();
 
   for (std::pair<EquivalenceClass, SymbolSet> ClassMembersPair : Members) {
-    for (SymbolRef Member : ClassMembersPair.second) {
+    for (SymExprRef Member : ClassMembersPair.second) {
       // Every member of the class should have a mapping back to the class.
       if (find(State, Member) == ClassMembersPair.first) {
         continue;
       }
 
       return false;
     }
   }
if (SymVal && SymVal->isExpression()) {
 
     return false;
   }
 
   return true;
 }
 
 ConditionTruthVal RangeConstraintManager::checkNull(ProgramStateRef State,
-                                                    SymbolRef Sym) {
+                                                    SymExprRef Sym) {
   const RangeSet *Ranges = getConstraint(State, Sym);
 
   // If we don't have any information about this symbol, it's underconstrained.
   if (!Ranges)
     return ConditionTruthVal();
 
   // If we have a concrete value, see if it's zero.
   if (const llvm::APSInt *Value = Ranges->getConcreteValue())
     return *Value == 0;
 
   BasicValueFactory &BV = getBasicVals();
   APSIntType IntType = BV.getAPSIntType(Sym->getType());
   llvm::APSInt Zero = IntType.getZeroValue();
 
   // Check if zero is in the set of possible values.
   if (Ranges->Intersect(BV, F, Zero, Zero).isEmpty())
     return false;
 
   // Zero is a possible value, but it is not the /only/ possible value.
   return ConditionTruthVal();
 }
 
 const llvm::APSInt *RangeConstraintManager::getSymVal(ProgramStateRef St,
-                                                      SymbolRef Sym) const {
+                                                      SymExprRef Sym) const {
   const RangeSet *T = getConstraint(St, Sym);
   return T ? T->getConcreteValue() : nullptr;
 }
 
 //===----------------------------------------------------------------------===//
 //                Remove dead symbols from existing constraints
 //===----------------------------------------------------------------------===//
 
for (std::pair<EquivalenceClass, RangeSet> ClassConstraintPair :
     EquivalenceClass Class = ClassConstraintPair.first;
     if (Class.isTriviallyDead(State, SymReaper)) {
       // If this class is trivial, we can remove its constraints right away.
       removeDeadClass(Class);
     }
   }
 
   // 2. We don't need to track classes for dead symbols.
-  for (std::pair<SymbolRef, EquivalenceClass> SymbolClassPair : Map) {
-    SymbolRef Sym = SymbolClassPair.first;
+  for (std::pair<SymExprRef, EquivalenceClass> SymbolClassPair : Map) {
+    SymExprRef Sym = SymbolClassPair.first;
 
     if (SymReaper.isDead(Sym)) {
       ClassMapChanged = true;
       NewMap = ClassFactory.remove(NewMap, Sym);
     }
   }
 
   // 3. Remove dead members from classes and remove dead non-trivial classes
   //    and their constraints.
   for (std::pair<EquivalenceClass, SymbolSet> ClassMembersPair :
        ClassMembersMap) {
     EquivalenceClass Class = ClassMembersPair.first;
     SymbolSet LiveMembers = ClassMembersPair.second;
     bool MembersChanged = false;
 
-    for (SymbolRef Member : ClassMembersPair.second) {
+    for (SymExprRef Member : ClassMembersPair.second) {
       if (SymReaper.isDead(Member)) {
         MembersChanged = true;
         LiveMembers = SetFactory.remove(LiveMembers, Member);
       }
     }
 
     // Check if the class changed.
     if (!MembersChanged)
if (DisequalitiesChanged)
     State = State->set<DisequalityMap>(Disequalities);
 
   assert(EquivalenceClass::isClassDataConsistent(State));
 
   return State;
 }
 
 RangeSet RangeConstraintManager::getRange(ProgramStateRef State,
-                                          SymbolRef Sym) {
+                                          SymExprRef Sym) {
   return SymbolicRangeInferrer::inferRange(getBasicVals(), F, State, Sym);
 }
 
 RangeSet RangeConstraintManager::getRange(ProgramStateRef State,
                                           EquivalenceClass Class) {
   return SymbolicRangeInferrer::inferRange(getBasicVals(), F, State, Class);
 }
 
 //===------------------------------------------------------------------------===
 // assumeSymX methods: protected interface for RangeConstraintManager.
 //===------------------------------------------------------------------------===/
 
 // The syntax for ranges below is mathematical, using [x, y] for closed ranges
 // and (x, y) for open ranges. These ranges are modular, corresponding with
 // a common treatment of C integer overflow. This means that these methods
 // do not have to worry about overflow; RangeSet::Intersect can handle such a
 // "wraparound" range.
 // As an example, the range [UINT_MAX-1, 3) contains five values: UINT_MAX-1,
 // UINT_MAX, 0, 1, and 2.
 
 ProgramStateRef
-RangeConstraintManager::assumeSymNE(ProgramStateRef St, SymbolRef Sym,
+RangeConstraintManager::assumeSymNE(ProgramStateRef St, SymExprRef Sym,
                                     const llvm::APSInt &Int,
                                     const llvm::APSInt &Adjustment) {
   // Before we do any real work, see if the value can even show up.
   APSIntType AdjustmentType(Adjustment);
   if (AdjustmentType.testInRange(Int, true) != APSIntType::RTR_Within)
     return St;
 
   llvm::APSInt Point = AdjustmentType.convert(Int) - Adjustment;
 
   RangeSet New = getRange(St, Sym).Delete(getBasicVals(), F, Point);
 
   return trackNE(New, St, Sym, Int, Adjustment);
 }
 
 ProgramStateRef
-RangeConstraintManager::assumeSymEQ(ProgramStateRef St, SymbolRef Sym,
+RangeConstraintManager::assumeSymEQ(ProgramStateRef St, SymExprRef Sym,
                                     const llvm::APSInt &Int,
                                     const llvm::APSInt &Adjustment) {
   // Before we do any real work, see if the value can even show up.
   APSIntType AdjustmentType(Adjustment);
   if (AdjustmentType.testInRange(Int, true) != APSIntType::RTR_Within)
     return nullptr;
 
   // [Int-Adjustment, Int-Adjustment]
   llvm::APSInt AdjInt = AdjustmentType.convert(Int) - Adjustment;
   RangeSet New = getRange(St, Sym).Intersect(getBasicVals(), F, AdjInt, AdjInt);
 
   return trackEQ(New, St, Sym, Int, Adjustment);
 }
 
 RangeSet RangeConstraintManager::getSymLTRange(ProgramStateRef St,
-                                               SymbolRef Sym,
+                                               SymExprRef Sym,
                                                const llvm::APSInt &Int,
                                                const llvm::APSInt &Adjustment) {
   // Before we do any real work, see if the value can even show up.
   APSIntType AdjustmentType(Adjustment);
   switch (AdjustmentType.testInRange(Int, true)) {
   case APSIntType::RTR_Below:
     return F.getEmptySet();
   case APSIntType::RTR_Within:
RangeSet RangeConstraintManager::getSymLTRange(ProgramStateRef St,
   llvm::APSInt Lower = Min - Adjustment;
   llvm::APSInt Upper = ComparisonVal - Adjustment;
   --Upper;
 
   return getRange(St, Sym).Intersect(getBasicVals(), F, Lower, Upper);
 }
 
 ProgramStateRef
-RangeConstraintManager::assumeSymLT(ProgramStateRef St, SymbolRef Sym,
+RangeConstraintManager::assumeSymLT(ProgramStateRef St, SymExprRef Sym,
                                     const llvm::APSInt &Int,
                                     const llvm::APSInt &Adjustment) {
   RangeSet New = getSymLTRange(St, Sym, Int, Adjustment);
   return trackNE(New, St, Sym, Int, Adjustment);
 }
 
 RangeSet RangeConstraintManager::getSymGTRange(ProgramStateRef St,
-                                               SymbolRef Sym,
+                                               SymExprRef Sym,
                                                const llvm::APSInt &Int,
                                                const llvm::APSInt &Adjustment) {
   // Before we do any real work, see if the value can even show up.
   APSIntType AdjustmentType(Adjustment);
   switch (AdjustmentType.testInRange(Int, true)) {
   case APSIntType::RTR_Below:
     return getRange(St, Sym);
   case APSIntType::RTR_Within:
RangeSet RangeConstraintManager::getSymGTRange(ProgramStateRef St,
   llvm::APSInt Lower = ComparisonVal - Adjustment;
   llvm::APSInt Upper = Max - Adjustment;
   ++Lower;
 
   return getRange(St, Sym).Intersect(getBasicVals(), F, Lower, Upper);
 }
 
 ProgramStateRef
-RangeConstraintManager::assumeSymGT(ProgramStateRef St, SymbolRef Sym,
+RangeConstraintManager::assumeSymGT(ProgramStateRef St, SymExprRef Sym,
                                     const llvm::APSInt &Int,
                                     const llvm::APSInt &Adjustment) {
   RangeSet New = getSymGTRange(St, Sym, Int, Adjustment);
   return trackNE(New, St, Sym, Int, Adjustment);
 }
 
 RangeSet RangeConstraintManager::getSymGERange(ProgramStateRef St,
-                                               SymbolRef Sym,
+                                               SymExprRef Sym,
                                                const llvm::APSInt &Int,
                                                const llvm::APSInt &Adjustment) {
   // Before we do any real work, see if the value can even show up.
   APSIntType AdjustmentType(Adjustment);
   switch (AdjustmentType.testInRange(Int, true)) {
   case APSIntType::RTR_Below:
     return getRange(St, Sym);
   case APSIntType::RTR_Within:
RangeSet RangeConstraintManager::getSymGERange(ProgramStateRef St,
   llvm::APSInt Max = AdjustmentType.getMaxValue();
   llvm::APSInt Lower = ComparisonVal - Adjustment;
   llvm::APSInt Upper = Max - Adjustment;
 
   return getRange(St, Sym).Intersect(getBasicVals(), F, Lower, Upper);
 }
 
 ProgramStateRef
-RangeConstraintManager::assumeSymGE(ProgramStateRef St, SymbolRef Sym,
+RangeConstraintManager::assumeSymGE(ProgramStateRef St, SymExprRef Sym,
                                     const llvm::APSInt &Int,
                                     const llvm::APSInt &Adjustment) {
   RangeSet New = getSymGERange(St, Sym, Int, Adjustment);
   return New.isEmpty() ? nullptr : setConstraint(St, Sym, New);
 }
 
 RangeSet
 RangeConstraintManager::getSymLERange(llvm::function_ref<RangeSet()> RS,
RangeConstraintManager::getSymLERange(llvm::function_ref<RangeSet()> RS,
   llvm::APSInt Min = AdjustmentType.getMinValue();
   llvm::APSInt Lower = Min - Adjustment;
   llvm::APSInt Upper = ComparisonVal - Adjustment;
 
   return RS().Intersect(getBasicVals(), F, Lower, Upper);
 }
 
 RangeSet RangeConstraintManager::getSymLERange(ProgramStateRef St,
-                                               SymbolRef Sym,
+                                               SymExprRef Sym,
                                                const llvm::APSInt &Int,
                                                const llvm::APSInt &Adjustment) {
   return getSymLERange([&] { return getRange(St, Sym); }, Int, Adjustment);
 }
 
 ProgramStateRef
-RangeConstraintManager::assumeSymLE(ProgramStateRef St, SymbolRef Sym,
+RangeConstraintManager::assumeSymLE(ProgramStateRef St, SymExprRef Sym,
                                     const llvm::APSInt &Int,
                                     const llvm::APSInt &Adjustment) {
   RangeSet New = getSymLERange(St, Sym, Int, Adjustment);
   return New.isEmpty() ? nullptr : setConstraint(St, Sym, New);
 }
 
 ProgramStateRef RangeConstraintManager::assumeSymWithinInclusiveRange(
-    ProgramStateRef State, SymbolRef Sym, const llvm::APSInt &From,
+    ProgramStateRef State, SymExprRef Sym, const llvm::APSInt &From,
     const llvm::APSInt &To, const llvm::APSInt &Adjustment) {
   RangeSet New = getSymGERange(State, Sym, From, Adjustment);
   if (New.isEmpty())
     return nullptr;
   RangeSet Out = getSymLERange([&] { return New; }, To, Adjustment);
   return Out.isEmpty() ? nullptr : setConstraint(State, Sym, Out);
 }
 
 ProgramStateRef RangeConstraintManager::assumeSymOutsideInclusiveRange(
-    ProgramStateRef State, SymbolRef Sym, const llvm::APSInt &From,
+    ProgramStateRef State, SymExprRef Sym, const llvm::APSInt &From,
     const llvm::APSInt &To, const llvm::APSInt &Adjustment) {
   RangeSet RangeLT = getSymLTRange(State, Sym, From, Adjustment);
   RangeSet RangeGT = getSymGTRange(State, Sym, To, Adjustment);
   RangeSet New(RangeLT.addRange(F, RangeGT));
   return New.isEmpty() ? nullptr : setConstraint(State, Sym, New);
 }
 
 //===----------------------------------------------------------------------===//
void RangeConstraintManager::printJson(raw_ostream &Out, ProgramStateRef State,
 
   ++Space;
   Out << '[' << NL;
   bool First = true;
   for (std::pair<EquivalenceClass, RangeSet> P : Constraints) {
     SymbolSet ClassMembers = P.first.getClassMembers(State);
 
     // We can print the same constraint for every class member.
-    for (SymbolRef ClassMember : ClassMembers) {
+    for (SymExprRef ClassMember : ClassMembers) {
       if (First) {
         First = false;
       } else {
         Out << ',';
         Out << NL;
       }
       Indent(Out, Space, IsDot)
           << "{ \"symbol\": \"" << ClassMember << "\", \"range\": \"";

clang/lib/StaticAnalyzer/Core/RangedConstraintManager.cpp

 
 namespace clang {
 
 namespace ento {
 
 RangedConstraintManager::~RangedConstraintManager() {}
 
 ProgramStateRef RangedConstraintManager::assumeSym(ProgramStateRef State,
-                                                   SymbolRef Sym,
+                                                   SymExprRef Sym,
                                                    bool Assumption) {
   // Handle SymbolData.
   if (isa<SymbolData>(Sym)) {
     return assumeSymUnsupported(State, Sym, Assumption);
 
     // Handle symbolic expression.
   } else if (const SymIntExpr *SIE = dyn_cast<SymIntExpr>(Sym)) {
     // We can only simplify expressions whose RHS is an integer.
if (Loc::isLocType(SSE->getLHS()->getType()) &&
       // We invert the order of the operands as a heuristic for how loop
       // conditions are usually written ("begin != end") as compared to length
       // calculations ("end - begin"). The more correct thing to do would be to
       // canonicalize "a - b" and "b - a", which would allow us to treat
       // "a != b" and "b != a" the same.
 
       SymbolManager &SymMgr = getSymbolManager();
       QualType DiffTy = SymMgr.getContext().getPointerDiffType();
-      SymbolRef Subtraction =
+      SymExprRef Subtraction =
           SymMgr.getSymSymExpr(SSE->getRHS(), BO_Sub, SSE->getLHS(), DiffTy);
 
       const llvm::APSInt &Zero = getBasicVals().getValue(0, DiffTy);
       Op = BinaryOperator::reverseComparisonOp(Op);
       if (!Assumption)
         Op = BinaryOperator::negateComparisonOp(Op);
       return assumeSymRel(State, Subtraction, Op, Zero);
     }
 
     if (BinaryOperator::isEqualityOp(Op)) {
       SymbolManager &SymMgr = getSymbolManager();
 
       QualType ExprType = SSE->getType();
-      SymbolRef CanonicalEquality =
+      SymExprRef CanonicalEquality =
           SymMgr.getSymSymExpr(SSE->getLHS(), BO_EQ, SSE->getRHS(), ExprType);
 
       bool WasEqual = SSE->getOpcode() == BO_EQ;
       bool IsExpectedEqual = WasEqual == Assumption;
 
       const llvm::APSInt &Zero = getBasicVals().getValue(0, ExprType);
 
       if (IsExpectedEqual) {
         return assumeSymNE(State, CanonicalEquality, Zero, Zero);
       }
 
       return assumeSymEQ(State, CanonicalEquality, Zero, Zero);
     }
   }
 
   // If we get here, there's nothing else we can do but treat the symbol as
   // opaque.
   return assumeSymUnsupported(State, Sym, Assumption);
 }
 
 ProgramStateRef RangedConstraintManager::assumeSymInclusiveRange(
-    ProgramStateRef State, SymbolRef Sym, const llvm::APSInt &From,
+    ProgramStateRef State, SymExprRef Sym, const llvm::APSInt &From,
     const llvm::APSInt &To, bool InRange) {
   // Get the type used for calculating wraparound.
   BasicValueFactory &BVF = getBasicVals();
   APSIntType WraparoundType = BVF.getAPSIntType(Sym->getType());
 
   llvm::APSInt Adjustment = WraparoundType.getZeroValue();
-  SymbolRef AdjustedSym = Sym;
+  SymExprRef AdjustedSym = Sym;
   computeAdjustment(AdjustedSym, Adjustment);
 
   // Convert the right-hand side integer as necessary.
   APSIntType ComparisonType = std::max(WraparoundType, APSIntType(From));
   llvm::APSInt ConvertedFrom = ComparisonType.convert(From);
   llvm::APSInt ConvertedTo = ComparisonType.convert(To);
 
   // Prefer unsigned comparisons.
   if (ComparisonType.getBitWidth() == WraparoundType.getBitWidth() &&
       ComparisonType.isUnsigned() && !WraparoundType.isUnsigned())
     Adjustment.setIsSigned(false);
 
   if (InRange)
     return assumeSymWithinInclusiveRange(State, AdjustedSym, ConvertedFrom,
                                          ConvertedTo, Adjustment);
   return assumeSymOutsideInclusiveRange(State, AdjustedSym, ConvertedFrom,
                                         ConvertedTo, Adjustment);
 }
 
 ProgramStateRef
 RangedConstraintManager::assumeSymUnsupported(ProgramStateRef State,
-                                              SymbolRef Sym, bool Assumption) {
+                                              SymExprRef Sym, bool Assumption) {
   BasicValueFactory &BVF = getBasicVals();
   QualType T = Sym->getType();
 
   // Non-integer types are not supported.
   if (!T->isIntegralOrEnumerationType())
     return State;
 
   // Reverse the operation and add directly to state.
   const llvm::APSInt &Zero = BVF.getValue(0, T);
   if (Assumption)
     return assumeSymNE(State, Sym, Zero, Zero);
   else
     return assumeSymEQ(State, Sym, Zero, Zero);
 }
 
 ProgramStateRef RangedConstraintManager::assumeSymRel(ProgramStateRef State,
-                                                      SymbolRef Sym,
+                                                      SymExprRef Sym,
                                                       BinaryOperator::Opcode Op,
                                                       const llvm::APSInt &Int) {
   assert(BinaryOperator::isComparisonOp(Op) &&
          "Non-comparison ops should be rewritten as comparisons to zero.");
 
   // Simplification: translate an assume of a constraint of the form
   // "(exp comparison_op expr) != 0" to true into an assume of
   // "exp comparison_op expr" to true. (And similarly, an assume of the form
ProgramStateRef RangedConstraintManager::assumeSymRel(ProgramStateRef State,
   case BO_LT:
     return assumeSymLT(State, Sym, ConvertedInt, Adjustment);
 
   case BO_LE:
     return assumeSymLE(State, Sym, ConvertedInt, Adjustment);
   } // end switch
 }
 
-void RangedConstraintManager::computeAdjustment(SymbolRef &Sym,
+void RangedConstraintManager::computeAdjustment(SymExprRef &Sym,
                                                 llvm::APSInt &Adjustment) {
   // Is it a "($sym+constant1)" expression?
   if (const SymIntExpr *SE = dyn_cast<SymIntExpr>(Sym)) {
     BinaryOperator::Opcode Op = SE->getOpcode();
     if (Op == BO_Add || Op == BO_Sub) {
       Sym = SE->getLHS();
       Adjustment = APSIntType(Adjustment).convert(SE->getRHS());
 

clang/lib/StaticAnalyzer/Core/RegionStore.cpp

bool InvalidateRegionsWorker::AddToWorkList(const MemRegion *R) {
   bool doNotInvalidateSuperRegion = ITraits.hasTrait(
       R, RegionAndSymbolInvalidationTraits::TK_DoNotInvalidateSuperRegion);
   const MemRegion *BaseR = doNotInvalidateSuperRegion ? R : R->getBaseRegion();
   return AddToWorkList(WorkListElement(BaseR), getCluster(BaseR));
 }
 
 void InvalidateRegionsWorker::VisitBinding(SVal V) {
   // A symbol?  Mark it touched by the invalidation.
-  if (SymbolRef Sym = V.getAsSymbol())
+  if (SymExprRef Sym = V.getAsSymbol())
     IS.insert(Sym);
 
   if (const MemRegion *R = V.getAsRegion()) {
     AddToWorkList(R);
     return;
   }
 
   // Is it a LazyCompoundVal?  All references get invalidated as well.
SVal RegionStoreManager::getBindingForElement(RegionBindingsConstRef B,
   if (const TypedValueRegion *baseR =
         dyn_cast_or_null<TypedValueRegion>(O.getRegion())) {
     QualType baseT = baseR->getValueType();
     if (baseT->isScalarType()) {
       QualType elemT = R->getElementType();
       if (elemT->isScalarType()) {
         if (Ctx.getTypeSizeInChars(baseT) >= Ctx.getTypeSizeInChars(elemT)) {
           if (const Optional<SVal> &V = B.getDirectBinding(superR)) {
-            if (SymbolRef parentSym = V->getAsSymbol())
+            if (SymExprRef parentSym = V->getAsSymbol())
               return svalBuilder.getDerivedRegionValueSymbolVal(parentSym, R);
 
             if (V->isUnknownOrUndef())
               return *V;
             // Other cases: give up.  We are indexing into a larger object
             // that has some value, but we don't know how to handle that yet.
             return UnknownVal();
           }

 Optional<SVal>
 RegionStoreManager::getBindingForDerivedDefaultValue(RegionBindingsConstRef B,
                                                      const MemRegion *superR,
                                                      const TypedValueRegion *R,
                                                      QualType Ty) {
 
   if (const Optional<SVal> &D = B.getDefaultBinding(superR)) {
     const SVal &val = D.getValue();
-    if (SymbolRef parentSym = val.getAsSymbol())
+    if (SymExprRef parentSym = val.getAsSymbol())
       return svalBuilder.getDerivedRegionValueSymbolVal(parentSym, R);
 
     if (val.isZeroConstant())
       return svalBuilder.makeZeroVal(Ty);
 
     if (val.isUnknownOrUndef())
       return val;
 
SVal RegionStoreManager::getBindingForObjCIvar(RegionBindingsConstRef B,
   // Check if the region has a binding.
   if (const Optional<SVal> &V = B.getDirectBinding(R))
     return *V;
 
   const MemRegion *superR = R->getSuperRegion();
 
   // Check if the super region has a default binding.
   if (const Optional<SVal> &V = B.getDefaultBinding(superR)) {
-    if (SymbolRef parentSym = V->getAsSymbol())
+    if (SymExprRef parentSym = V->getAsSymbol())
       return svalBuilder.getDerivedRegionValueSymbolVal(parentSym, R);
 
     // Other cases: give up.
     return UnknownVal();
   }
 
   return getBindingForLazySymbol(R);
 }

clang/lib/StaticAnalyzer/Core/SValBuilder.cpp

SValBuilder::getRegionValueSymbolVal(const TypedValueRegion *region) {
   QualType T = region->getValueType();
 
   if (T->isNullPtrType())
     return makeZeroVal(T);
 
   if (!SymbolManager::canSymbolicate(T))
     return UnknownVal();
 
-  SymbolRef sym = SymMgr.getRegionValueSymbol(region);
+  SymExprRef sym = SymMgr.getRegionValueSymbol(region);
 
   if (Loc::isLocType(T))
     return loc::MemRegionVal(MemMgr.getSymbolicRegion(sym));
 
   return nonloc::SymbolVal(sym);
 }
 
 DefinedOrUnknownSVal SValBuilder::conjureSymbolVal(const void *SymbolTag,
DefinedOrUnknownSVal SValBuilder::conjureSymbolVal(const void *symbolTag,
                                                    QualType type,
                                                    unsigned count) {
   if (type->isNullPtrType())
     return makeZeroVal(type);
 
   if (!SymbolManager::canSymbolicate(type))
     return UnknownVal();
 
-  SymbolRef sym = SymMgr.conjureSymbol(expr, LCtx, type, count, symbolTag);
+  SymExprRef sym = SymMgr.conjureSymbol(expr, LCtx, type, count, symbolTag);
 
   if (Loc::isLocType(type))
     return loc::MemRegionVal(MemMgr.getSymbolicRegion(sym));
 
   return nonloc::SymbolVal(sym);
 }
 
 DefinedOrUnknownSVal SValBuilder::conjureSymbolVal(const Stmt *stmt,
                                                    const LocationContext *LCtx,
                                                    QualType type,
                                                    unsigned visitCount) {
   if (type->isNullPtrType())
     return makeZeroVal(type);
 
   if (!SymbolManager::canSymbolicate(type))
     return UnknownVal();
 
-  SymbolRef sym = SymMgr.conjureSymbol(stmt, LCtx, type, visitCount);
+  SymExprRef sym = SymMgr.conjureSymbol(stmt, LCtx, type, visitCount);
 
   if (Loc::isLocType(type))
     return loc::MemRegionVal(MemMgr.getSymbolicRegion(sym));
 
   return nonloc::SymbolVal(sym);
 }
 
 DefinedOrUnknownSVal
 SValBuilder::getConjuredHeapSymbolVal(const Expr *E,
                                       const LocationContext *LCtx,
                                       unsigned VisitCount) {
   QualType T = E->getType();
   assert(Loc::isLocType(T));
   assert(SymbolManager::canSymbolicate(T));
   if (T->isNullPtrType())
     return makeZeroVal(T);
 
-  SymbolRef sym = SymMgr.conjureSymbol(E, LCtx, T, VisitCount);
+  SymExprRef sym = SymMgr.conjureSymbol(E, LCtx, T, VisitCount);
   return loc::MemRegionVal(MemMgr.getSymbolicHeapRegion(sym));
 }
 
 DefinedSVal SValBuilder::getMetadataSymbolVal(const void *symbolTag,
                                               const MemRegion *region,
                                               const Expr *expr, QualType type,
                                               const LocationContext *LCtx,
                                               unsigned count) {
   assert(SymbolManager::canSymbolicate(type) && "Invalid metadata symbol type");
 
-  SymbolRef sym =
+  SymExprRef sym =
       SymMgr.getMetadataSymbol(region, expr, type, LCtx, count, symbolTag);
 
   if (Loc::isLocType(type))
     return loc::MemRegionVal(MemMgr.getSymbolicRegion(sym));
 
   return nonloc::SymbolVal(sym);
 }
 
 DefinedOrUnknownSVal
-SValBuilder::getDerivedRegionValueSymbolVal(SymbolRef parentSymbol,
-                                             const TypedValueRegion *region) {
+SValBuilder::getDerivedRegionValueSymbolVal(SymExprRef parentSymbol,
   QualType T = region->getValueType();
 
   if (T->isNullPtrType())
     return makeZeroVal(T);
 
   if (!SymbolManager::canSymbolicate(T))
     return UnknownVal();
 
-  SymbolRef sym = SymMgr.getDerivedSymbol(parentSymbol, region);
+  SymExprRef sym = SymMgr.getDerivedSymbol(parentSymbol, region);
 
   if (Loc::isLocType(T))
     return loc::MemRegionVal(MemMgr.getSymbolicRegion(sym));
 
   return nonloc::SymbolVal(sym);
 }
 
 DefinedSVal SValBuilder::getMemberPointer(const NamedDecl *ND) {
default: {
     return None;
   }
   }
 }
 
 SVal SValBuilder::makeSymExprValNN(BinaryOperator::Opcode Op,
                                    NonLoc LHS, NonLoc RHS,
                                    QualType ResultTy) {
-  SymbolRef symLHS = LHS.getAsSymbol();
-  SymbolRef symRHS = RHS.getAsSymbol();
+  SymExprRef symLHS = LHS.getAsSymbol();
+  SymExprRef symRHS = RHS.getAsSymbol();
 
   // TODO: When the Max Complexity is reached, we should conjure a symbol
   // instead of generating an Unknown value and propagate the taint info to it.
   const unsigned MaxComp = StateMgr.getOwningEngine()
                                .getAnalysisManager()
                                .options.MaxSymbolComplexity;
 
   if (symLHS && symRHS &&

 // At the moment, this function will redirect to evalCast, except when the range
 // of the original value is known to be greater than the max of the target type.
 SVal SValBuilder::evalIntegralCast(ProgramStateRef state, SVal val,
                                    QualType castTy, QualType originalTy) {
   // No truncations if target type is big enough.
   if (getContext().getTypeSize(castTy) >= getContext().getTypeSize(originalTy))
     return evalCast(val, castTy, originalTy);
 
-  SymbolRef se = val.getAsSymbol();
+  SymExprRef se = val.getAsSymbol();
   if (!se) // Let evalCast handle non symbolic expressions.
     return evalCast(val, castTy, originalTy);
 
   // Find the maximum value of the target type.
   APSIntType ToType(getContext().getTypeSize(castTy),
                     castTy->isUnsignedIntegerType());
   llvm::APSInt ToTypeMax = ToType.getMaxValue();
   NonLoc ToTypeMaxVal =
if (castTy->isBooleanType()) {
     if (val.isUnknownOrUndef())
       return val;
     if (val.isConstant())
       return makeTruthVal(!val.isZeroConstant(), castTy);
     if (!Loc::isLocType(originalTy) &&
         !originalTy->isIntegralOrEnumerationType() &&
         !originalTy->isMemberPointerType())
       return UnknownVal();
-    if (SymbolRef Sym = val.getAsSymbol(true)) {
+    if (SymExprRef Sym = val.getAsSymbol(true)) {
       BasicValueFactory &BVF = getBasicValueFactory();
       // FIXME: If we had a state here, we could see if the symbol is known to
       // be zero, but we don't.
       return makeNonLoc(Sym, BO_NE, BVF.getValue(0, Sym->getType()), castTy);
     }
     // Loc values are not always true, they could be weakly linked functions.
     if (Optional<Loc> L = val.getAs<Loc>())
       return evalCastFromLoc(*L, castTy);

clang/lib/StaticAnalyzer/Core/SVals.cpp

 //===----------------------------------------------------------------------===//
 
 //===----------------------------------------------------------------------===//
 // Utility methods.
 //===----------------------------------------------------------------------===//
 
 bool SVal::hasConjuredSymbol() const {
   if (Optional<nonloc::SymbolVal> SV = getAs<nonloc::SymbolVal>()) {
-    SymbolRef sym = SV->getSymbol();
+    SymExprRef sym = SV->getSymbol();
     if (isa<SymbolConjured>(sym))
       return true;
   }
 
   if (Optional<loc::MemRegionVal> RV = getAs<loc::MemRegionVal>()) {
     const MemRegion *R = RV->getRegion();
     if (const auto *SR = dyn_cast<SymbolicRegion>(R)) {
-      SymbolRef sym = SR->getSymbol();
+      SymExprRef sym = SR->getSymbol();
       if (isa<SymbolConjured>(sym))
         return true;
     }
   }
 
   return false;
 }
 
 const FunctionDecl *SVal::getAsFunctionDecl() const {
   if (Optional<loc::MemRegionVal> X = getAs<loc::MemRegionVal>()) {
     const MemRegion* R = X->getRegion();
     if (const FunctionCodeRegion *CTR = R->getAs<FunctionCodeRegion>())
       if (const auto *FD = dyn_cast<FunctionDecl>(CTR->getDecl()))
         return FD;
   }
 
   if (auto X = getAs<nonloc::PointerToMember>()) {
     if (const auto *MD = dyn_cast_or_null<CXXMethodDecl>(X->getDecl()))
       return MD;
   }
   return nullptr;
 }
 
 /// If this SVal is a location (subclasses Loc) and wraps a symbol,
-/// return that SymbolRef.  Otherwise return 0.
+/// return that SymExprRef.  Otherwise return 0.
 ///
 /// Implicit casts (ex: void* -> char*) can turn Symbolic region into Element
 /// region. If that is the case, gets the underlining region.
 /// When IncludeBaseRegions is set to true and the SubRegion is non-symbolic,
 /// the first symbolic parent region is returned.
-SymbolRef SVal::getAsLocSymbol(bool IncludeBaseRegions) const {
-  // FIXME: should we consider SymbolRef wrapped in CodeTextRegion?
+SymExprRef SVal::getAsLocSymbol(bool IncludeBaseRegions) const {
+  // FIXME: should we consider SymExprRef wrapped in CodeTextRegion?
   if (Optional<nonloc::LocAsInteger> X = getAs<nonloc::LocAsInteger>())
     return X->getLoc().getAsLocSymbol(IncludeBaseRegions);
 
   if (Optional<loc::MemRegionVal> X = getAs<loc::MemRegionVal>()) {
     const MemRegion *R = X->getRegion();
     if (const SymbolicRegion *SymR = IncludeBaseRegions ?
                                       R->getSymbolicBase() :
                                       dyn_cast<SymbolicRegion>(R->StripCasts()))
       return SymR->getSymbol();
   }
   return nullptr;
 }
 
 /// Get the symbol in the SVal or its base region.
-SymbolRef SVal::getLocSymbolInBase() const {
+SymExprRef SVal::getLocSymbolInBase() const {
   Optional<loc::MemRegionVal> X = getAs<loc::MemRegionVal>();
 
   if (!X)
     return nullptr;
 
   const MemRegion *R = X->getRegion();
 
   while (const auto *SR = dyn_cast<SubRegion>(R)) {
     if (const auto *SymR = dyn_cast<SymbolicRegion>(SR))
       return SymR->getSymbol();
     else
       R = SR->getSuperRegion();
   }
 
   return nullptr;
 }
 
-/// If this SVal wraps a symbol return that SymbolRef.
+/// If this SVal wraps a symbol return that SymExprRef.
 /// Otherwise, return 0.
 ///
 /// Casts are ignored during lookup.
 /// \param IncludeBaseRegions The boolean that controls whether the search
 /// should continue to the base regions if the region is not symbolic.
-SymbolRef SVal::getAsSymbol(bool IncludeBaseRegions) const {
-  // FIXME: should we consider SymbolRef wrapped in CodeTextRegion?
+SymExprRef SVal::getAsSymbol(bool IncludeBaseRegions) const {
+  // FIXME: should we consider SymExprRef wrapped in CodeTextRegion?
   if (Optional<nonloc::SymbolVal> X = getAs<nonloc::SymbolVal>())
     return X->getSymbol();
 
   return getAsLocSymbol(IncludeBaseRegions);
 }
 
 const MemRegion *SVal::getAsRegion() const {
   if (Optional<loc::MemRegionVal> X = getAs<loc::MemRegionVal>())

clang/lib/StaticAnalyzer/Core/SimpleConstraintManager.cpp

 ProgramStateRef SimpleConstraintManager::assumeAux(ProgramStateRef State,
                                                    NonLoc Cond,
                                                    bool Assumption) {
 
   // We cannot reason about SymSymExprs, and can only reason about some
   // SymIntExprs.
   if (!canReasonAbout(Cond)) {
     // Just add the constraint to the expression without trying to simplify.
-    SymbolRef Sym = Cond.getAsSymbol();
+    SymExprRef Sym = Cond.getAsSymbol();
     assert(Sym);
     return assumeSymUnsupported(State, Sym, Assumption);
   }
 
   switch (Cond.getSubKind()) {
   default:
     llvm_unreachable("'Assume' not implemented for this NonLoc");
 
   case nonloc::SymbolValKind: {
     nonloc::SymbolVal SV = Cond.castAs<nonloc::SymbolVal>();
-    SymbolRef Sym = SV.getSymbol();
+    SymExprRef Sym = SV.getSymbol();
     assert(Sym);
     return assumeSym(State, Sym, Assumption);
   }
 
   case nonloc::ConcreteIntKind: {
     bool b = Cond.castAs<nonloc::ConcreteInt>().getValue() != 0;
     bool isFeasible = b ? Assumption : !Assumption;
     return isFeasible ? State : nullptr;
ProgramStateRef SimpleConstraintManager::assumeInclusiveRange(
     const llvm::APSInt &To, bool InRange) {
 
   assert(From.isUnsigned() == To.isUnsigned() &&
          From.getBitWidth() == To.getBitWidth() &&
          "Values should have same types!");
 
   if (!canReasonAbout(Value)) {
     // Just add the constraint to the expression without trying to simplify.
-    SymbolRef Sym = Value.getAsSymbol();
+    SymExprRef Sym = Value.getAsSymbol();
     assert(Sym);
     return assumeSymInclusiveRange(State, Sym, From, To, InRange);
   }
 
   switch (Value.getSubKind()) {
   default:
     llvm_unreachable("'assumeInclusiveRange' is not implemented"
                      "for this NonLoc");
 
   case nonloc::LocAsIntegerKind:
   case nonloc::SymbolValKind: {
-    if (SymbolRef Sym = Value.getAsSymbol())
+    if (SymExprRef Sym = Value.getAsSymbol())
       return assumeSymInclusiveRange(State, Sym, From, To, InRange);
     return State;
   } // end switch
 
   case nonloc::ConcreteIntKind: {
     const llvm::APSInt &IntVal = Value.castAs<nonloc::ConcreteInt>().getValue();
     bool IsInRange = IntVal >= From && IntVal <= To;
     bool isFeasible = (IsInRange == InRange);
     return isFeasible ? State : nullptr;
   }
   } // end switch
 }
 
 } // end of namespace ento
 
 } // end of namespace clang

clang/lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp

if (isLocType)
       return LI->getLoc();
     // FIXME: Correctly support promotions/truncations.
     unsigned castSize = Context.getIntWidth(castTy);
     if (castSize == LI->getNumBits())
       return val;
     return makeLocAsInteger(LI->getLoc(), castSize);
   }
 
-  if (SymbolRef se = val.getAsSymbol()) {
+  if (SymExprRef se = val.getAsSymbol()) {
     QualType T = Context.getCanonicalType(se->getType());
     // If types are the same or both are integers, ignore the cast.
     // FIXME: Remove this hack when we support symbolic truncation/extension.
     // HACK: If both castTy and T are integers, ignore the cast.  This is
     // not a permanent solution.  Eventually we want to precisely handle
     // extension/truncation of symbolic integers.  This prevents us from losing
     // precision when we assign 'x = y' and 'y' is symbolic and x and y are
     // different integer types.
if (BinaryOperator::isComparisonOp(op)) {
     }
   } else
     ConvertedRHS = &BasicVals.Convert(resultTy, RHS);
 
   return makeNonLoc(LHS, op, *ConvertedRHS, resultTy);
 }
 
 // See if Sym is known to be a relation Rel with Bound.
-static bool isInRelation(BinaryOperator::Opcode Rel, SymbolRef Sym,
+static bool isInRelation(BinaryOperator::Opcode Rel, SymExprRef Sym,
                          llvm::APSInt Bound, ProgramStateRef State) {
   SValBuilder &SVB = State->getStateManager().getSValBuilder();
   SVal Result =
       SVB.evalBinOpNN(State, Rel, nonloc::SymbolVal(Sym),
                       nonloc::ConcreteInt(Bound), SVB.getConditionType());
   if (auto DV = Result.getAs<DefinedSVal>()) {
     return !State->assume(*DV, false);
   }
   return false;
 }
 
 // See if Sym is known to be within [min/4, max/4], where min and max
 // are the bounds of the symbol's integral type. With such symbols,
 // some manipulations can be performed without the risk of overflow.
 // assume() doesn't cause infinite recursion because we should be dealing
 // with simpler symbols on every recursive call.
-static bool isWithinConstantOverflowBounds(SymbolRef Sym,
+static bool isWithinConstantOverflowBounds(SymExprRef Sym,
                                            ProgramStateRef State) {
   SValBuilder &SVB = State->getStateManager().getSValBuilder();
   BasicValueFactory &BV = SVB.getBasicValueFactory();
 
   QualType T = Sym->getType();
   assert(T->isSignedIntegerOrEnumerationType() &&
          "This only works with signed integers!");
   APSIntType AT = BV.getAPSIntType(T);
 
   llvm::APSInt Max = AT.getMaxValue() / AT.getValue(4), Min = -Max;
   return isInRelation(BO_LE, Sym, Max, State) &&
          isInRelation(BO_GE, Sym, Min, State);
 }
 
 // Same for the concrete integers: see if I is within [min/4, max/4].
 static bool isWithinConstantOverflowBounds(llvm::APSInt I) {
   APSIntType AT(I);
   assert(!AT.isUnsigned() &&
          "This only works with signed integers!");
 
   llvm::APSInt Max = AT.getMaxValue() / AT.getValue(4), Min = -Max;
   return (I <= Max) && (I >= -Max);
 }
 
-static std::pair<SymbolRef, llvm::APSInt>
-decomposeSymbol(SymbolRef Sym, BasicValueFactory &BV) {
+static std::pair<SymExprRef, llvm::APSInt>
+decomposeSymbol(SymExprRef Sym, BasicValueFactory &BV) {
   if (const auto *SymInt = dyn_cast<SymIntExpr>(Sym))
     if (BinaryOperator::isAdditiveOp(SymInt->getOpcode()))
       return std::make_pair(SymInt->getLHS(),
                             (SymInt->getOpcode() == BO_Add) ?
                             (SymInt->getRHS()) :
                             (-SymInt->getRHS()));
 
   // Fail to decompose: "reduce" the problem to the "$x + 0" case.
   return std::make_pair(Sym, BV.getValue(0, Sym->getType()));
 }
 
 // Simplify "(LSym + LInt) Op (RSym + RInt)" assuming all values are of the
 // same signed integral type and no overflows occur (which should be checked
 // by the caller).
 static NonLoc doRearrangeUnchecked(ProgramStateRef State,
-                                   BinaryOperator::Opcode Op,
-                                   SymbolRef LSym, llvm::APSInt LInt,
-                                   SymbolRef RSym, llvm::APSInt RInt) {
+                                   BinaryOperator::Opcode Op, SymExprRef LSym,
+                                   llvm::APSInt LInt, SymExprRef RSym,
+                                   llvm::APSInt RInt) {
   SValBuilder &SVB = State->getStateManager().getSValBuilder();
   BasicValueFactory &BV = SVB.getBasicValueFactory();
   SymbolManager &SymMgr = SVB.getSymbolManager();
 
   QualType SymTy = LSym->getType();
   assert(SymTy == RSym->getType() &&
          "Symbols are not of the same type!");
   assert(APSIntType(LInt) == BV.getAPSIntType(SymTy) &&
else
     llvm_unreachable("Operation not suitable for unchecked rearrangement!");
 
   // FIXME: Can we use assume() without getting into an infinite recursion?
   if (LSym == RSym)
     return SVB.evalBinOpNN(State, Op, nonloc::ConcreteInt(LInt),
                            nonloc::ConcreteInt(RInt), ResultTy)
         .castAs<NonLoc>();
 
-  SymbolRef ResultSym = nullptr;
+  SymExprRef ResultSym = nullptr;
   BinaryOperator::Opcode ResultOp;
   llvm::APSInt ResultInt;
   if (BinaryOperator::isComparisonOp(Op)) {
     // Prefer comparing to a non-negative number.
     // FIXME: Maybe it'd be better to have consistency in
     // "$x - $y" vs. "$y - $x" because those are solver's keys.
     if (LInt > RInt) {
       ResultSym = SymMgr.getSymSymExpr(RSym, BO_Sub, LSym, SymTy);
static NonLoc doRearrangeUnchecked(ProgramStateRef State,
   return nonloc::SymbolVal(
       SymMgr.getSymIntExpr(ResultSym, ResultOp, PersistentResultInt, ResultTy));
 }
 
 // Rearrange if symbol type matches the result type and if the operator is a
 // comparison operator, both symbol and constant must be within constant
 // overflow bounds.
 static bool shouldRearrange(ProgramStateRef State, BinaryOperator::Opcode Op,
-                            SymbolRef Sym, llvm::APSInt Int, QualType Ty) {
+                            SymExprRef Sym, llvm::APSInt Int, QualType Ty) {
   return Sym->getType() == Ty &&
     (!BinaryOperator::isComparisonOp(Op) ||
      (isWithinConstantOverflowBounds(Sym, State) &&
       isWithinConstantOverflowBounds(Int)));
 }
 
 static Optional<NonLoc> tryRearrange(ProgramStateRef State,
                                      BinaryOperator::Opcode Op, NonLoc Lhs,
                                      NonLoc Rhs, QualType ResultTy) {
   ProgramStateManager &StateMgr = State->getStateManager();
   SValBuilder &SVB = StateMgr.getSValBuilder();
 
   // We expect everything to be of the same type - this type.
   QualType SingleTy;
 
   auto &Opts =
     StateMgr.getOwningEngine().getAnalysisManager().getAnalyzerOptions();
 
   // FIXME: After putting complexity threshold to the symbols we can always
   //        rearrange additive operations but rearrange comparisons only if
   //        option is set.
   if(!Opts.ShouldAggressivelySimplifyBinaryOperation)
     return None;
 
-  SymbolRef LSym = Lhs.getAsSymbol();
+  SymExprRef LSym = Lhs.getAsSymbol();
   if (!LSym)
     return None;
 
   if (BinaryOperator::isComparisonOp(Op)) {
     SingleTy = LSym->getType();
     if (ResultTy != SVB.getConditionType())
       return None;
     // Initialize SingleTy later with a symbol's type.
   } else if (BinaryOperator::isAdditiveOp(Op)) {
     SingleTy = ResultTy;
     if (LSym->getType() != SingleTy)
       return None;
   } else {
     // Don't rearrange other operations.
     return None;
   }
 
   assert(!SingleTy.isNull() && "We should have figured out the type by now!");
 
   // Rearrange signed symbolic expressions only
   if (!SingleTy->isSignedIntegerOrEnumerationType())
     return None;
 
-  SymbolRef RSym = Rhs.getAsSymbol();
+  SymExprRef RSym = Rhs.getAsSymbol();
   if (!RSym || RSym->getType() != SingleTy)
     return None;
 
   BasicValueFactory &BV = State->getBasicVals();
   llvm::APSInt LInt, RInt;
   std::tie(LSym, LInt) = decomposeSymbol(LSym, BV);
   std::tie(RSym, RInt) = decomposeSymbol(RSym, BV);
   if (!shouldRearrange(State, Op, LSym, LInt, SingleTy) ||
case nonloc::LocAsIntegerKind: {
           // add 1 to a LocAsInteger, we'd better unpack the Loc and add to it,
           // then pack it back into a LocAsInteger.
           llvm::APSInt i = rhs.castAs<nonloc::ConcreteInt>().getValue();
           // If the region has a symbolic base, pay attention to the type; it
           // might be coming from a non-default address space. For non-symbolic
           // regions it doesn't matter that much because such comparisons would
           // most likely evaluate to concrete false anyway. FIXME: We might
           // still need to handle the non-comparison case.
-          if (SymbolRef lSym = lhs.getAsLocSymbol(true))
+          if (SymExprRef lSym = lhs.getAsLocSymbol(true))
             BasicVals.getAPSIntType(lSym->getType()).apply(i);
           else
             BasicVals.getAPSIntType(Context.VoidPtrTy).apply(i);
           return evalBinOpLL(state, op, lhsL, makeLoc(i), resultTy);
         }
         default:
           switch (op) {
             case BO_EQ:
case nonloc::ConcreteIntKind: {
           return makeZeroVal(resultTy);
         LLVM_FALLTHROUGH;
       default:
         return makeSymExprValNN(op, InputLHS, InputRHS, resultTy);
       }
     }
     case nonloc::SymbolValKind: {
       // We only handle LHS as simple symbols or SymIntExprs.
-      SymbolRef Sym = lhs.castAs<nonloc::SymbolVal>().getSymbol();
+      SymExprRef Sym = lhs.castAs<nonloc::SymbolVal>().getSymbol();
 
       // LHS is a symbolic expression.
       if (const SymIntExpr *symIntExpr = dyn_cast<SymIntExpr>(Sym)) {
 
         // Is this a logical not? (!x is represented as x == 0.)
         if (op == BO_EQ && rhs.isZeroConstant()) {
           // We know how to negate certain expressions. Simplify them here.
 
case loc::GotoLabelKind:
     // on the ABI).
     // FIXME: we can probably do a comparison against other MemRegions, though.
     // FIXME: is there a way to tell if two labels refer to the same location?
     return UnknownVal();
 
   case loc::ConcreteIntKind: {
     // If one of the operands is a symbol and the other is a constant,
     // build an expression for use by the constraint manager.
-    if (SymbolRef rSym = rhs.getAsLocSymbol()) {
+    if (SymExprRef rSym = rhs.getAsLocSymbol()) {
       // We can only build expressions with symbols on the left,
       // so we need a reversible operator.
       if (!BinaryOperator::isComparisonOp(op) || op == BO_Cmp)
         return UnknownVal();
 
       const llvm::APSInt &lVal = lhs.castAs<loc::ConcreteInt>().getValue();
       op = BinaryOperator::reverseComparisonOp(op);
       return makeNonLoc(rSym, op, lVal, resultTy);
case loc::ConcreteIntKind: {
     // Comparing an arbitrary integer to a region or label address is
     // completely unknowable.
     return UnknownVal();
   }
   case loc::MemRegionValKind: {
     if (Optional<loc::ConcreteInt> rInt = rhs.getAs<loc::ConcreteInt>()) {
       // If one of the operands is a symbol and the other is a constant,
       // build an expression for use by the constraint manager.
-      if (SymbolRef lSym = lhs.getAsLocSymbol(true)) {
+      if (SymExprRef lSym = lhs.getAsLocSymbol(true)) {
         if (BinaryOperator::isComparisonOp(op))
           return MakeSymIntVal(lSym, op, rInt->getValue(), resultTy);
         return UnknownVal();
       }
       // Special case comparisons to NULL.
       // This must come after the test if the LHS is a symbol, which is used to
       // build constraints. The address of any non-symbolic region is guaranteed
       // to be non-NULL.
if (LeftOffset.getRegion() != nullptr &&
           return makeTruthVal(left == right, resultTy);
         case BO_NE:
           return makeTruthVal(left != right, resultTy);
       }
     }
 
     // At this point we're not going to get a good answer, but we can try
     // conjuring an expression instead.
-    SymbolRef LHSSym = lhs.getAsLocSymbol();
-    SymbolRef RHSSym = rhs.getAsLocSymbol();
+    SymExprRef LHSSym = lhs.getAsLocSymbol();
+    SymExprRef RHSSym = rhs.getAsLocSymbol();
     if (LHSSym && RHSSym)
       return makeNonLoc(LHSSym, op, RHSSym, resultTy);
 
     // If we get here, we have no way of comparing the regions.
     return UnknownVal();
   }
   }
 }
if (V.isUnknownOrUndef())
     return nullptr;
 
   if (Optional<loc::ConcreteInt> X = V.getAs<loc::ConcreteInt>())
     return &X->getValue();
 
   if (Optional<nonloc::ConcreteInt> X = V.getAs<nonloc::ConcreteInt>())
     return &X->getValue();
 
-  if (SymbolRef Sym = V.getAsSymbol())
+  if (SymExprRef Sym = V.getAsSymbol())
     return state->getConstraintManager().getSymVal(state, Sym);
 
   // FIXME: Add support for SymExprs.
   return nullptr;
 }
 
 SVal SimpleSValBuilder::simplifySVal(ProgramStateRef State, SVal V) {
   // For now, this function tries to constant-fold symbols inside a
   // nonloc::SymbolVal, and does nothing else. More simplifications should
   // be possible, such as constant-folding an index in an ElementRegion.
 
   class Simplifier : public FullSValVisitor<Simplifier, SVal> {
     ProgramStateRef State;
     SValBuilder &SVB;
 
     // Cache results for the lifetime of the Simplifier. Results change every
     // time new constraints are added to the program state, which is the whole
     // point of simplifying, and for that very reason it's pointless to maintain
     // the same cache for the duration of the whole analysis.
-    llvm::DenseMap<SymbolRef, SVal> Cached;
+    llvm::DenseMap<SymExprRef, SVal> Cached;
 
-    static bool isUnchanged(SymbolRef Sym, SVal Val) {
+    static bool isUnchanged(SymExprRef Sym, SVal Val) {
       return Sym == Val.getAsSymbol();
     }
 
-    SVal cache(SymbolRef Sym, SVal V) {
+    SVal cache(SymExprRef Sym, SVal V) {
       Cached[Sym] = V;
       return V;
     }
 
-    SVal skip(SymbolRef Sym) {
-      return cache(Sym, SVB.makeSymbolVal(Sym));
-    }
+    SVal skip(SymExprRef Sym) { return cache(Sym, SVB.makeSymbolVal(Sym)); }
 
   public:
     Simplifier(ProgramStateRef State)
         : State(State), SVB(State->getStateManager().getSValBuilder()) {}
 
     SVal VisitSymbolData(const SymbolData *S) {
       // No cache here.
       if (const llvm::APSInt *I =
SVal VisitSymIntExpr(const SymIntExpr *S) {
       // figure out if it should be treated as a Loc or as a NonLoc.
       // So make our guess by recalling that we cannot multiply pointers
       // or compare a pointer to an integer.
       if (Loc::isLocType(S->getLHS()->getType()) &&
           BinaryOperator::isComparisonOp(S->getOpcode())) {
         // The usual conversion of $sym to &SymRegion{$sym}, as they have
         // the same meaning for Loc-type symbols, but the latter form
         // is preferred in SVal computations for being Loc itself.
-        if (SymbolRef Sym = LHS.getAsSymbol()) {
+        if (SymExprRef Sym = LHS.getAsSymbol()) {
           assert(Loc::isLocType(Sym->getType()));
           LHS = SVB.makeLoc(Sym);
         }
         RHS = SVB.makeIntLocVal(S->getRHS());
       } else {
         RHS = SVB.makeIntVal(S->getRHS());
       }
 
SVal VisitSymSymExpr(const SymSymExpr *S) {
       SVal RHS = Visit(S->getRHS());
       if (isUnchanged(S->getLHS(), LHS) && isUnchanged(S->getRHS(), RHS))
         return skip(S);
 
       return cache(
           S, SVB.evalBinOp(State, S->getOpcode(), LHS, RHS, S->getType()));
     }
 
-    SVal VisitSymExpr(SymbolRef S) { return nonloc::SymbolVal(S); }
+    SVal VisitSymExpr(SymExprRef S) { return nonloc::SymbolVal(S); }
 
     SVal VisitMemRegion(const MemRegion *R) { return loc::MemRegionVal(R); }
 
     SVal VisitNonLocSymbolVal(nonloc::SymbolVal V) {
       // Simplification is much more costly than computing complexity.
       // For high complexity, it may be not worth it.
       return Visit(V.getSymbol());
     }

clang/lib/StaticAnalyzer/Core/Store.cpp

if (castTy.isNull() || V.isUnknownOrUndef())
     return V;
 
   // The dispatchCast() call below would convert the int into a float.
   // What we want, however, is a bit-by-bit reinterpretation of the int
   // as a float, which usually yields nothing garbage. For now skip casts
   // from ints to floats.
   // TODO: What other combinations of types are affected?
   if (castTy->isFloatingType()) {
-    SymbolRef Sym = V.getAsSymbol();
+    SymExprRef Sym = V.getAsSymbol();
     if (Sym && !Sym->getType()->isFloatingType())
       return UnknownVal();
   }
 
   // When retrieving symbolic pointer and expecting a non-void pointer,
   // wrap them into element regions of the expected type if necessary.
   // SValBuilder::dispatchCast() doesn't do that, but it is necessary to
   // make sure that the retrieved value makes sense, because there's no other

 }
 
 StoreManager::BindingsHandler::~BindingsHandler() = default;
 
 bool StoreManager::FindUniqueBinding::HandleBinding(StoreManager& SMgr,
                                                     Store store,
                                                     const MemRegion* R,
                                                     SVal val) {
-  SymbolRef SymV = val.getAsLocSymbol();
+  SymExprRef SymV = val.getAsLocSymbol();
   if (!SymV || SymV != Sym)
     return true;
 
   if (Binding) {
     First = false;
     return false;
   }
   else
     Binding = R;
 
   return true;
 }

clang/lib/StaticAnalyzer/Core/SymbolManager.cpp

 }
 
 SymExpr::symbol_iterator &SymExpr::symbol_iterator::operator++() {
   assert(!itr.empty() && "attempting to iterate on an 'end' iterator");
   expand();
   return *this;
 }
 
-SymbolRef SymExpr::symbol_iterator::operator*() {
+SymExprRef SymExpr::symbol_iterator::operator*() {
   assert(!itr.empty() && "attempting to dereference an 'end' iterator");
   return itr.back();
 }
 
 void SymExpr::symbol_iterator::expand() {
   const SymExpr *SE = itr.pop_back_val();
 
   switch (SE->getKind()) {
if (!SD) {
     new (SD) SymbolConjured(SymbolCounter, E, LCtx, T, Count, SymbolTag);
     DataSet.InsertNode(SD, InsertPos);
     ++SymbolCounter;
   }
 
   return cast<SymbolConjured>(SD);
 }
 
-const SymbolDerived*
-SymbolManager::getDerivedSymbol(SymbolRef parentSymbol,
+const SymbolDerived *
+SymbolManager::getDerivedSymbol(SymExprRef parentSymbol,
                                 const TypedValueRegion *R) {
   llvm::FoldingSetNodeID profile;
   SymbolDerived::Profile(profile, parentSymbol, R);
   void *InsertPos;
   SymExpr *SD = DataSet.FindNodeOrInsertPos(profile, InsertPos);
   if (!SD) {
     SD = (SymExpr*) BPAlloc.Allocate<SymbolDerived>();
     new (SD) SymbolDerived(SymbolCounter, parentSymbol, R);
if (T->isIntegralOrEnumerationType())
     return true;
 
   if (T->isRecordType() && !T->isUnionType())
     return true;
 
   return false;
 }
 
-void SymbolManager::addSymbolDependency(const SymbolRef Primary,
-                                        const SymbolRef Dependent) {
+void SymbolManager::addSymbolDependency(const SymExprRef Primary,
+                                        const SymExprRef Dependent) {
   auto &dependencies = SymbolDependencies[Primary];
   if (!dependencies) {
     dependencies = std::make_unique<SymbolRefSmallVectorTy>();
   }
   dependencies->push_back(Dependent);
 }
 
-const SymbolRefSmallVectorTy *SymbolManager::getDependentSymbols(
-                                                     const SymbolRef Primary) {
+const SymbolRefSmallVectorTy *
+SymbolManager::getDependentSymbols(const SymExprRef Primary) {
   SymbolDependTy::const_iterator I = SymbolDependencies.find(Primary);
   if (I == SymbolDependencies.end())
     return nullptr;
   return I->second.get();
 }
 
-void SymbolReaper::markDependentsLive(SymbolRef sym) {
+void SymbolReaper::markDependentsLive(SymExprRef sym) {
   // Do not mark dependents more then once.
   SymbolMapTy::iterator LI = TheLiving.find(sym);
   assert(LI != TheLiving.end() && "The primary symbol is not live.");
   if (LI->second == HaveMarkedDependents)
     return;
   LI->second = HaveMarkedDependents;
 
   if (const SymbolRefSmallVectorTy *Deps = SymMgr.getDependentSymbols(sym)) {
     for (const auto I : *Deps) {
       if (TheLiving.find(I) != TheLiving.end())
         continue;
       markLive(I);
     }
   }
 }
 
-void SymbolReaper::markLive(SymbolRef sym) {
+void SymbolReaper::markLive(SymExprRef sym) {
   TheLiving[sym] = NotProcessed;
   markDependentsLive(sym);
 }
 
 void SymbolReaper::markLive(const MemRegion *region) {
   RegionRoots.insert(region->getBaseRegion());
   markElementIndicesLive(region);
 }
 
 void SymbolReaper::markElementIndicesLive(const MemRegion *region) {
   for (auto SR = dyn_cast<SubRegion>(region); SR;
        SR = dyn_cast<SubRegion>(SR->getSuperRegion())) {
     if (const auto ER = dyn_cast<ElementRegion>(SR)) {
       SVal Idx = ER->getIndex();
       for (auto SI = Idx.symbol_begin(), SE = Idx.symbol_end(); SI != SE; ++SI)
         markLive(*SI);
     }
   }
 }
 
-void SymbolReaper::markInUse(SymbolRef sym) {
+void SymbolReaper::markInUse(SymExprRef sym) {
   if (isa<SymbolMetadata>(sym))
     MetadataInUse.insert(sym);
 }
 
 bool SymbolReaper::isLiveRegion(const MemRegion *MR) {
   // TODO: For now, liveness of a memory region is equivalent to liveness of its
   // base region. In fact we can do a bit better: say, if a particular FieldDecl
   // is not used later in the path, we can diagnose a leak of a value within
if (isa<MemSpaceRegion>(MR))
     return true;
 
   if (isa<CodeTextRegion>(MR))
     return true;
 
   return false;
 }
 
-bool SymbolReaper::isLive(SymbolRef sym) {
+bool SymbolReaper::isLive(SymExprRef sym) {
   if (TheLiving.count(sym)) {
     markDependentsLive(sym);
     return true;
   }
 
   bool KnownLive;
 
   switch (sym->getKind()) {