[StaticAnalyzer] Add checking for degenerate base class in MemRegion

[RedDocMD]

Summary

In the function isValidBaseClass() of
clang/lib/StaticAnalyzer/Core/MemRegion.cpp,
added a case to return true when BaseClass and Super refer to
the same CXXRecordDecl. This case arises when a pointer-to-member
field is declared with a static cast from a pointer-to-member of
a sub-class.

[steakhal]

Looks fine to me.
Thank you for addressing this.

[NoQ]

This patch shoots the messenger but someone still needs to conduct a proper investigation. The assertion is losing a lot more of its bug-finding power than necessary to uncover the current cornercase; i really hope to preserve it instead.

[vsavchenko]

In D95307#2518592, @NoQ wrote:

This patch shoots the messenger but someone still needs to conduct a proper investigation. The assertion is losing a lot more of its bug-finding power than necessary to uncover the current cornercase; i really hope to preserve it instead.

You mean the failing assertion from the tests?

[RedDocMD]

In D95307#2519283, @vsavchenko wrote:

In D95307#2518592, @NoQ wrote:

This patch shoots the messenger but someone still needs to conduct a proper investigation. The assertion is losing a lot more of its bug-finding power than necessary to uncover the current cornercase; i really hope to preserve it instead.

You mean the failing assertion from the tests?

Few hours before there was a message saying that there was some buggy commit to the build-bot. Are you referring to the build failure above?

[vsavchenko]

In D95307#2519300, @RedDocMD wrote:

In D95307#2519283, @vsavchenko wrote:

In D95307#2518592, @NoQ wrote:

This patch shoots the messenger but someone still needs to conduct a proper investigation. The assertion is losing a lot more of its bug-finding power than necessary to uncover the current cornercase; i really hope to preserve it instead.

You mean the failing assertion from the tests?

Few hours before there was a message saying that there was some buggy commit to the build-bot. Are you referring to the build failure above?

Yep. TBH I didn't take a good look at the failure, but judging even by the name of the failing test, it looks directly related to the subject of this patch.

[RedDocMD]

Funnily enough, when I run ninja clang-check I don't get any errors.

[vsavchenko]

In D95307#2519309, @RedDocMD wrote:

Funnily enough, when I run ninja clang-check I don't get any errors.

I believe that ninja check-clang is the right command (clang-check is a tool) :-)

[NoQ]

In D95307#2519283, @vsavchenko wrote:

In D95307#2518592, @NoQ wrote:

This patch shoots the messenger but someone still needs to conduct a proper investigation. The assertion is losing a lot more of its bug-finding power than necessary to uncover the current cornercase; i really hope to preserve it instead.

You mean the failing assertion from the tests?

I mean, isValidBaseClass() is a function that's only ever used as part of an assert condition; it has no other purpose. The only thing this patch does is partially disable the assertion. The patch also disables a lot more of the assertion than necessary for it to not fail on the newly added test.

Disabling the assertion has relatively little value on its own because assertions are already disabled in release/production builds of clang. We need to understand whether it is the assertion that's incorrect, or it's the surrounding code that's incorrect. Given that we're performing a derived-to-base cast when such cast is not necessary, that's a good indication that the problem is in the surrounding code, i.e. the behavior implemented in the transfer function isn't a correct abstraction over the actual runtime behavior of the program under analysis. It might be hard to judge because typed pointer values are a pretty questionable abstraction to begin with but i think at least some investigation is justified.

[NoQ]

In D95307#2519597, @vsavchenko wrote:

In D95307#2519309, @RedDocMD wrote:

Funnily enough, when I run ninja clang-check I don't get any errors.

I believe that ninja check-clang is the right command (clang-check is a tool) :-)

Inb4 ninja check-clang-analysis :)

[RedDocMD]

Thanks @NoQ for the tip on the right test command!
My own belief is that this patch is just a hack that squelches the problem, instead of solving it. I am limited by my own inexperience with the codebase and am trying to learn more to help better.

That said, couple of observations that I made while exploring the bug:

1. Referring to loop in line 1119 of SimpleSValBuilder.cpp. This loop is necessary since we need to access the right sub-object. (The test at line 203 in pointer-to-member.cpp is a good demonstration why)
2. However, when we have static casts on the pointer-to-member, this loop is also triggered.

The trouble is that the above two cases behave inconsistently with each other. Consider the following example for case 1:

struct B {
  int f;
};
struct L1 : public B { };
struct R1 : public B { };
struct M : public L1, R1 { };
struct L2 : public M { };
struct R2 : public M { };
struct D2 : public L2, R2 { };

void diamond() {
  M m;

  static_cast<L1 *>(&m)->f = 7;
  static_cast<R1 *>(&m)->f = 16;

  int L1::* pl1 = &B::f;
  int M::* pm_via_l1 = pl1;

  int R1::* pr1 = &B::f;
  int M::* pm_via_r1 = pr1;

  (m.*(pm_via_l1) == 7); 
  (m.*(pm_via_r1) == 16);
}

This behaves correctly. If we run I->getType()->dump() on each iteration of the loop, we get something like this:

RecordType 0x55a70ad60d50 'struct L1'
`-CXXRecord 0x55a70ad60cb8 'L1'
RecordType 0x55a70ad60b20 'struct B'
`-CXXRecord 0x55a70ad60a90 'B'
2 levels of base specifiers
RecordType 0x55a70ad60f50 'struct R1'
`-CXXRecord 0x55a70ad60ec0 'R1'
RecordType 0x55a70ad60b20 'struct B'
`-CXXRecord 0x55a70ad60a90 'B'
2 levels of base specifiers

Running the same analysis for the regressing code:

struct Base {
  int field;
};

struct Derived : public Base {};

void static_cast_test() {
  int Derived::* derived_field = &Derived::field;
  Base base;
  base.field = 5;
  int Base::* base_field = static_cast<int Base::*>(derived_field);
  (base.*base_field == 5);

we get the following dump;

RecordType 0x55676ded06a0 'struct Base'
`-CXXRecord 0x55676ded0610 'Base'
RecordType 0x55676ded06a0 'struct Base'
`-CXXRecord 0x55676ded0610 'Base'
2 base specifier

Clearly, there is a bug elsewhere. The method PointerToMember::begin() returns an iterator to a list of CXXBaseSpecifiers, which according to the docs is for keeping track of static_casts. However, it seems that the base-specifier list is being used for something else. I am not sure in which function introduces this problem. Probably somewhere in the ASTVisitor for the StaticAnalyzer this problem is introduced. I will keep on digging and add more comments.

[RedDocMD]

On further digging as to how pointer-to-members are handled in StaticAnalyzer, I discovered that in BasicValueFactory::accumCXXBase() for the example given in my test produces the two CXXBaseSpecifier` for the pointer-to-member. At line 195, one base specifier is added while the other is added in the loop in 201. The loop accounts for the static_cast while line 195 adds a base specifier from the expression being cast.
This causes the duplication. I will try to update this patch to handle the duplication.

[RedDocMD]

Removing duplication of CXXBaseSpecifiers when they are created for PointerToMember
Removed hackish weakening of assert

[kromanenkov]

Looks like you run formatter on the whole file, maybe narrow down its scope a little? For example, only for the touched function?

[kromanenkov]

clang/lib/StaticAnalyzer/Core/BasicValueFactory.cpp

199

What if we get the situation of the repeated types in the PathRange?

Like Derived --(cast to)-> Base --(cast to)-> Derived --(cast to)-> Base and so on.

Do we need to store the pair of QualType and PathRange index for that case or only type will be enough?

[RedDocMD]

@kromanenkov I guess it won't work then. Thanks for the idea!
Now that I think about it removing duplicates is probably not the right thing to do. The problem arises because the call PTMD->getCXXBaseList() should ideally return the list of previous casts, but instead returns the base class(es) of the struct whose pointer-to-member we are defining.

[RedDocMD]

I clearly am taking the wrong approach to this problem. I will need to reconsider how PointerToMember is actually modelled before solving this problem

[vsavchenko]

In D95307#2532669, @RedDocMD wrote:

I clearly am taking the wrong approach to this problem. I will need to reconsider how PointerToMember is actually modelled before solving this problem

I don't know if this is useful or not, but pointer-to-members used to be void * up until very recently. Here is my change on that topic (and it probably where the bug you're trying to fix initiated): https://reviews.llvm.org/D85817
I thought, it can be useful to see the areas of code where it all happens.

[RedDocMD]

In D95307#2533259, @vsavchenko wrote:

I don't know if this is useful or not, but pointer-to-members used to be void * up until very recently. Here is my change on that topic (and it probably where the bug you're trying to fix initiated): https://reviews.llvm.org/D85817
I thought, it can be useful to see the areas of code where it all happens.

Thank you @vsavchenko. I had actually seen this review by examining the file blames. I don't think the problem is in your review. The trouble is that when the CXXBaseSpecifier list in PointerToMemberData is initialized, it receives a list. That list I suspect contains passed in the base class of the struct. But this list is supposed to be for following static casts. I have to localize that logic.

clang/lib/StaticAnalyzer/Core/BasicValueFactory.cpp

 #include "clang/StaticAnalyzer/Core/PathSensitive/APSIntType.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/Store.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/StoreRef.h"
 #include "llvm/ADT/APSInt.h"
 #include "llvm/ADT/FoldingSet.h"
 #include "llvm/ADT/ImmutableList.h"
 #include "llvm/ADT/STLExtras.h"
+#include "llvm/ADT/SmallPtrSet.h"
 #include <cassert>
 #include <cstdint>
 #include <utility>
 
 using namespace clang;
 using namespace ento;
 
-void CompoundValData::Profile(llvm::FoldingSetNodeID& ID, QualType T,
+void CompoundValData::Profile(llvm::FoldingSetNodeID &ID, QualType T,
                               llvm::ImmutableList<SVal> L) {
   T.Profile(ID);
   ID.AddPointer(L.getInternalPointer());
 }
 
-void LazyCompoundValData::Profile(llvm::FoldingSetNodeID& ID,
+void LazyCompoundValData::Profile(llvm::FoldingSetNodeID &ID,
                                   const StoreRef &store,
                                   const TypedValueRegion *region) {
   ID.AddPointer(store.getStore());
   ID.AddPointer(region);
 }
 
 void PointerToMemberData::Profile(
     llvm::FoldingSetNodeID &ID, const NamedDecl *D,
     llvm::ImmutableList<const CXXBaseSpecifier *> L) {
   ID.AddPointer(D);
   ID.AddPointer(L.getInternalPointer());
 }
 
 using SValData = std::pair<SVal, uintptr_t>;
 using SValPair = std::pair<SVal, SVal>;
 
 namespace llvm {
 
-template<> struct FoldingSetTrait<SValData> {
-  static inline void Profile(const SValData& X, llvm::FoldingSetNodeID& ID) {
+template <> struct FoldingSetTrait<SValData> {
+  static inline void Profile(const SValData &X, llvm::FoldingSetNodeID &ID) {
     X.first.Profile(ID);
-    ID.AddPointer( (void*) X.second);
+    ID.AddPointer((void *)X.second);
   }
 };
 
-template<> struct FoldingSetTrait<SValPair> {
-  static inline void Profile(const SValPair& X, llvm::FoldingSetNodeID& ID) {
+template <> struct FoldingSetTrait<SValPair> {
+  static inline void Profile(const SValPair &X, llvm::FoldingSetNodeID &ID) {
     X.first.Profile(ID);
     X.second.Profile(ID);
   }
 };
 
 } // namespace llvm
 
 using PersistentSValsTy =
     llvm::FoldingSet<llvm::FoldingSetNodeWrapper<SValData>>;
 
 using PersistentSValPairsTy =
     llvm::FoldingSet<llvm::FoldingSetNodeWrapper<SValPair>>;
 
 BasicValueFactory::~BasicValueFactory() {
   // Note that the dstor for the contents of APSIntSet will never be called,
   // so we iterate over the set and invoke the dstor for each APSInt.  This
   // frees an aux. memory allocated to represent very large constants.
   for (const auto &I : APSIntSet)
     I.getValue().~APSInt();
 
-  delete (PersistentSValsTy*) PersistentSVals;
-  delete (PersistentSValPairsTy*) PersistentSValPairs;
+  delete (PersistentSValsTy *)PersistentSVals;
+  delete (PersistentSValPairsTy *)PersistentSValPairs;
 }
 
-const llvm::APSInt& BasicValueFactory::getValue(const llvm::APSInt& X) {
+const llvm::APSInt &BasicValueFactory::getValue(const llvm::APSInt &X) {
   llvm::FoldingSetNodeID ID;
   void *InsertPos;
 
   using FoldNodeTy = llvm::FoldingSetNodeWrapper<llvm::APSInt>;
 
   X.Profile(ID);
-  FoldNodeTy* P = APSIntSet.FindNodeOrInsertPos(ID, InsertPos);
+  FoldNodeTy *P = APSIntSet.FindNodeOrInsertPos(ID, InsertPos);
 
   if (!P) {
-    P = (FoldNodeTy*) BPAlloc.Allocate<FoldNodeTy>();
+    P = (FoldNodeTy *)BPAlloc.Allocate<FoldNodeTy>();
     new (P) FoldNodeTy(X);
     APSIntSet.InsertNode(P, InsertPos);
   }
 
   return *P;
 }
 
-const llvm::APSInt& BasicValueFactory::getValue(const llvm::APInt& X,
+const llvm::APSInt &BasicValueFactory::getValue(const llvm::APInt &X,
                                                 bool isUnsigned) {
   llvm::APSInt V(X, isUnsigned);
   return getValue(V);
 }
 
-const llvm::APSInt& BasicValueFactory::getValue(uint64_t X, unsigned BitWidth,
+const llvm::APSInt &BasicValueFactory::getValue(uint64_t X, unsigned BitWidth,
                                                 bool isUnsigned) {
   llvm::APSInt V(BitWidth, isUnsigned);
   V = X;
   return getValue(V);
 }
 
-const llvm::APSInt& BasicValueFactory::getValue(uint64_t X, QualType T) {
+const llvm::APSInt &BasicValueFactory::getValue(uint64_t X, QualType T) {
   return getValue(getAPSIntType(T).getValue(X));
 }
 
-const CompoundValData*
+const CompoundValData *
 BasicValueFactory::getCompoundValData(QualType T,
                                       llvm::ImmutableList<SVal> Vals) {
   llvm::FoldingSetNodeID ID;
   CompoundValData::Profile(ID, T, Vals);
   void *InsertPos;
 
-  CompoundValData* D = CompoundValDataSet.FindNodeOrInsertPos(ID, InsertPos);
+  CompoundValData *D = CompoundValDataSet.FindNodeOrInsertPos(ID, InsertPos);
 
   if (!D) {
-    D = (CompoundValData*) BPAlloc.Allocate<CompoundValData>();
+    D = (CompoundValData *)BPAlloc.Allocate<CompoundValData>();
     new (D) CompoundValData(T, Vals);
     CompoundValDataSet.InsertNode(D, InsertPos);
   }
 
   return D;
 }
 
-const LazyCompoundValData*
+const LazyCompoundValData *
 BasicValueFactory::getLazyCompoundValData(const StoreRef &store,
                                           const TypedValueRegion *region) {
   llvm::FoldingSetNodeID ID;
   LazyCompoundValData::Profile(ID, store, region);
   void *InsertPos;
 
   LazyCompoundValData *D =
       LazyCompoundValDataSet.FindNodeOrInsertPos(ID, InsertPos);
 
   if (!D) {
-    D = (LazyCompoundValData*) BPAlloc.Allocate<LazyCompoundValData>();
+    D = (LazyCompoundValData *)BPAlloc.Allocate<LazyCompoundValData>();
     new (D) LazyCompoundValData(store, region);
     LazyCompoundValDataSet.InsertNode(D, InsertPos);
   }
 
   return D;
 }
 
 const PointerToMemberData *BasicValueFactory::getPointerToMemberData(
if (PTMDT.isNull() || PTMDT.is<const NamedDecl *>()) {
     PathList = CXXBaseListFactory.getEmptyList();
   } else { // const PointerToMemberData *
     const PointerToMemberData *PTMD = PTMDT.get<const PointerToMemberData *>();
     ND = PTMD->getDeclaratorDecl();
 
     PathList = PTMD->getCXXBaseList();
   }
 
-  for (const auto &I : llvm::reverse(PathRange))
+  llvm::SmallPtrSet<QualType, 32> BaseTypes;
+  for (const auto &BaseSpec : PathList)
+    BaseTypes.insert(BaseSpec->getType());
+
+  for (const auto &I : llvm::reverse(PathRange)) {
+    auto IType = I->getType();
+    if (!BaseTypes.contains(IType)) {
       PathList = prependCXXBase(I, PathList);
+      BaseTypes.insert(IType);
+    }
+  }
   return getPointerToMemberData(ND, PathList);
 }
 
-const llvm::APSInt*
-BasicValueFactory::evalAPSInt(BinaryOperator::Opcode Op,
-                             const llvm::APSInt& V1, const llvm::APSInt& V2) {
+const llvm::APSInt *BasicValueFactory::evalAPSInt(BinaryOperator::Opcode Op,
+                                                  const llvm::APSInt &V1,
+                                                  const llvm::APSInt &V2) {
   switch (Op) {
-    default:
-      llvm_unreachable("Invalid Opcode.");
 
-    case BO_Mul:
-      return &getValue( V1 * V2 );
+    return &getValue(V1 * V2);
 
-    case BO_Div:
-      if (V2 == 0) // Avoid division by zero
-        return nullptr;
-      return &getValue( V1 / V2 );
+    return &getValue(V1 / V2);
 
-    case BO_Rem:
-      if (V2 == 0) // Avoid division by zero
-        return nullptr;
-      return &getValue( V1 % V2 );
+    return &getValue(V1 % V2);
 
-    case BO_Add:
-      return &getValue( V1 + V2 );
+    return &getValue(V1 + V2);
 
-    case BO_Sub:
-      return &getValue( V1 - V2 );
+    return &getValue(V1 - V2);
 
-    case BO_Shl: {
-      // FIXME: This logic should probably go higher up, where we can
-      // test these conditions symbolically.
 
-      if (V2.isSigned() && V2.isNegative())
-        return nullptr;
 
-      uint64_t Amt = V2.getZExtValue();
 
-      if (Amt >= V1.getBitWidth())
-        return nullptr;
 
-      if (!Ctx.getLangOpts().CPlusPlus20) {
-        if (V1.isSigned() && V1.isNegative())
-          return nullptr;
 
-        if (V1.isSigned() && Amt > V1.countLeadingZeros())
-          return nullptr;
-      }
 
-      return &getValue( V1.operator<<( (unsigned) Amt ));
-    }
+    return &getValue(V1.operator<<((unsigned)Amt));
 
-    case BO_Shr: {
-      // FIXME: This logic should probably go higher up, where we can
-      // test these conditions symbolically.
 
-      if (V2.isSigned() && V2.isNegative())
-        return nullptr;
 
-      uint64_t Amt = V2.getZExtValue();
 
-      if (Amt >= V1.getBitWidth())
-        return nullptr;
 
-      return &getValue( V1.operator>>( (unsigned) Amt ));
-    }
+    return &getValue(V1.operator>>((unsigned)Amt));
 
-    case BO_LT:
-      return &getTruthValue( V1 < V2 );
+    return &getTruthValue(V1 < V2);
 
-    case BO_GT:
-      return &getTruthValue( V1 > V2 );
+    return &getTruthValue(V1 > V2);
 
-    case BO_LE:
-      return &getTruthValue( V1 <= V2 );
+    return &getTruthValue(V1 <= V2);
 
-    case BO_GE:
-      return &getTruthValue( V1 >= V2 );
+    return &getTruthValue(V1 >= V2);
 
-    case BO_EQ:
-      return &getTruthValue( V1 == V2 );
+    return &getTruthValue(V1 == V2);
 
-    case BO_NE:
-      return &getTruthValue( V1 != V2 );
+    return &getTruthValue(V1 != V2);
 
-      // Note: LAnd, LOr, Comma are handled specially by higher-level logic.
 
-    case BO_And:
-      return &getValue( V1 & V2 );
+    return &getValue(V1 & V2);
 
-    case BO_Or:
-      return &getValue( V1 | V2 );
+    return &getValue(V1 | V2);
 
-    case BO_Xor:
-      return &getValue( V1 ^ V2 );
+    return &getValue(V1 ^ V2);
   }
 }
 
-const std::pair<SVal, uintptr_t>&
-BasicValueFactory::getPersistentSValWithData(const SVal& V, uintptr_t Data) {
+const std::pair<SVal, uintptr_t> &
+BasicValueFactory::getPersistentSValWithData(const SVal &V, uintptr_t Data) {
   // Lazily create the folding set.
-  if (!PersistentSVals) PersistentSVals = new PersistentSValsTy();
+  if (!PersistentSVals)
+    PersistentSVals = new PersistentSValsTy();
 
   llvm::FoldingSetNodeID ID;
   void *InsertPos;
   V.Profile(ID);
-  ID.AddPointer((void*) Data);
+  ID.AddPointer((void *)Data);
 
-  PersistentSValsTy& Map = *((PersistentSValsTy*) PersistentSVals);
+  PersistentSValsTy &Map = *((PersistentSValsTy *)PersistentSVals);
 
   using FoldNodeTy = llvm::FoldingSetNodeWrapper<SValData>;
 
-  FoldNodeTy* P = Map.FindNodeOrInsertPos(ID, InsertPos);
+  FoldNodeTy *P = Map.FindNodeOrInsertPos(ID, InsertPos);
 
   if (!P) {
-    P = (FoldNodeTy*) BPAlloc.Allocate<FoldNodeTy>();
+    P = (FoldNodeTy *)BPAlloc.Allocate<FoldNodeTy>();
     new (P) FoldNodeTy(std::make_pair(V, Data));
     Map.InsertNode(P, InsertPos);
   }
 
   return P->getValue();
 }
 
-const std::pair<SVal, SVal>&
-BasicValueFactory::getPersistentSValPair(const SVal& V1, const SVal& V2) {
+const std::pair<SVal, SVal> &
+BasicValueFactory::getPersistentSValPair(const SVal &V1, const SVal &V2) {
   // Lazily create the folding set.
-  if (!PersistentSValPairs) PersistentSValPairs = new PersistentSValPairsTy();
+  if (!PersistentSValPairs)
+    PersistentSValPairs = new PersistentSValPairsTy();
 
   llvm::FoldingSetNodeID ID;
   void *InsertPos;
   V1.Profile(ID);
   V2.Profile(ID);
 
-  PersistentSValPairsTy& Map = *((PersistentSValPairsTy*) PersistentSValPairs);
+  PersistentSValPairsTy &Map = *((PersistentSValPairsTy *)PersistentSValPairs);
 
   using FoldNodeTy = llvm::FoldingSetNodeWrapper<SValPair>;
 
-  FoldNodeTy* P = Map.FindNodeOrInsertPos(ID, InsertPos);
+  FoldNodeTy *P = Map.FindNodeOrInsertPos(ID, InsertPos);
 
   if (!P) {
-    P = (FoldNodeTy*) BPAlloc.Allocate<FoldNodeTy>();
+    P = (FoldNodeTy *)BPAlloc.Allocate<FoldNodeTy>();
     new (P) FoldNodeTy(std::make_pair(V1, V2));
     Map.InsertNode(P, InsertPos);
   }
 
   return P->getValue();
 }
 
-const SVal* BasicValueFactory::getPersistentSVal(SVal X) {
+const SVal *BasicValueFactory::getPersistentSVal(SVal X) {
   return &getPersistentSValWithData(X, 0).first;
 }

clang/lib/StaticAnalyzer/Core/MemRegion.cpp

 
 #define DEBUG_TYPE "MemRegion"
 
 //===----------------------------------------------------------------------===//
 // MemRegion Construction.
 //===----------------------------------------------------------------------===//
 
 template <typename RegionTy, typename SuperTy, typename Arg1Ty>
-RegionTy* MemRegionManager::getSubRegion(const Arg1Ty arg1,
+RegionTy *MemRegionManager::getSubRegion(const Arg1Ty arg1,
                                          const SuperTy *superRegion) {
   llvm::FoldingSetNodeID ID;
   RegionTy::ProfileRegion(ID, arg1, superRegion);
   void *InsertPos;
   auto *R = cast_or_null<RegionTy>(Regions.FindNodeOrInsertPos(ID, InsertPos));
 
   if (!R) {
     R = A.Allocate<RegionTy>();
     new (R) RegionTy(arg1, superRegion);
     Regions.InsertNode(R, InsertPos);
   }
 
   return R;
 }
 
 template <typename RegionTy, typename SuperTy, typename Arg1Ty, typename Arg2Ty>
-RegionTy* MemRegionManager::getSubRegion(const Arg1Ty arg1, const Arg2Ty arg2,
+RegionTy *MemRegionManager::getSubRegion(const Arg1Ty arg1, const Arg2Ty arg2,
                                          const SuperTy *superRegion) {
   llvm::FoldingSetNodeID ID;
   RegionTy::ProfileRegion(ID, arg1, arg2, superRegion);
   void *InsertPos;
   auto *R = cast_or_null<RegionTy>(Regions.FindNodeOrInsertPos(ID, InsertPos));
 
   if (!R) {
     R = A.Allocate<RegionTy>();
     new (R) RegionTy(arg1, arg2, superRegion);
     Regions.InsertNode(R, InsertPos);
   }
 
   return R;
 }
 
-template <typename RegionTy, typename SuperTy,
-          typename Arg1Ty, typename Arg2Ty, typename Arg3Ty>
-RegionTy* MemRegionManager::getSubRegion(const Arg1Ty arg1, const Arg2Ty arg2,
+template <typename RegionTy, typename SuperTy, typename Arg1Ty, typename Arg2Ty,
+          typename Arg3Ty>
+RegionTy *MemRegionManager::getSubRegion(const Arg1Ty arg1, const Arg2Ty arg2,
                                          const Arg3Ty arg3,
                                          const SuperTy *superRegion) {
   llvm::FoldingSetNodeID ID;
   RegionTy::ProfileRegion(ID, arg1, arg2, arg3, superRegion);
   void *InsertPos;
   auto *R = cast_or_null<RegionTy>(Regions.FindNodeOrInsertPos(ID, InsertPos));
 
   if (!R) {

 // All regions and their data are BumpPtrAllocated.  No need to call their
 // destructors.
 MemRegionManager::~MemRegionManager() = default;
 
 //===----------------------------------------------------------------------===//
 // Basic methods.
 //===----------------------------------------------------------------------===//
 
-bool SubRegion::isSubRegionOf(const MemRegion* R) const {
-  const MemRegion* r = this;
+bool SubRegion::isSubRegionOf(const MemRegion *R) const {
+  const MemRegion *r = this;
   do {
     if (r == R)
       return true;
     if (const auto *sr = dyn_cast<SubRegion>(r))
       r = sr->getSuperRegion();
     else
       break;
   } while (r != nullptr);
   return false;
 }
 
 MemRegionManager &SubRegion::getMemRegionManager() const {
-  const SubRegion* r = this;
+  const SubRegion *r = this;
   do {
     const MemRegion *superRegion = r->getSuperRegion();
     if (const auto *sr = dyn_cast<SubRegion>(superRegion)) {
       r = sr;
       continue;
     }
     return superRegion->getMemRegionManager();
   } while (true);
 }
 
 const StackFrameContext *VarRegion::getStackFrame() const {
   const auto *SSR = dyn_cast<StackSpaceRegion>(getMemorySpace());
   return SSR ? SSR->getStackFrame() : nullptr;
 }
 
 ObjCIvarRegion::ObjCIvarRegion(const ObjCIvarDecl *ivd, const SubRegion *sReg)
     : DeclRegion(sReg, ObjCIvarRegionKind), IVD(ivd) {}
 
 const ObjCIvarDecl *ObjCIvarRegion::getDecl() const { return IVD; }
 
-QualType ObjCIvarRegion::getValueType() const {
-  return getDecl()->getType();
-}
+QualType ObjCIvarRegion::getValueType() const { return getDecl()->getType(); }
 
 QualType CXXBaseObjectRegion::getValueType() const {
   return QualType(getDecl()->getTypeForDecl(), 0);
 }
 
 QualType CXXDerivedObjectRegion::getValueType() const {
   return QualType(getDecl()->getTypeForDecl(), 0);
 }

 void ObjCStringRegion::ProfileRegion(llvm::FoldingSetNodeID &ID,
                                      const ObjCStringLiteral *Str,
                                      const MemRegion *superRegion) {
   ID.AddInteger(static_cast<unsigned>(ObjCStringRegionKind));
   ID.AddPointer(Str);
   ID.AddPointer(superRegion);
 }
 
-void AllocaRegion::ProfileRegion(llvm::FoldingSetNodeID& ID,
-                                 const Expr *Ex, unsigned cnt,
-                                 const MemRegion *superRegion) {
+void AllocaRegion::ProfileRegion(llvm::FoldingSetNodeID &ID, const Expr *Ex,
+                                 unsigned cnt, const MemRegion *superRegion) {
   ID.AddInteger(static_cast<unsigned>(AllocaRegionKind));
   ID.AddPointer(Ex);
   ID.AddInteger(cnt);
   ID.AddPointer(superRegion);
 }
 
-void AllocaRegion::Profile(llvm::FoldingSetNodeID& ID) const {
+void AllocaRegion::Profile(llvm::FoldingSetNodeID &ID) const {
   ProfileRegion(ID, Ex, Cnt, superRegion);
 }
 
-void CompoundLiteralRegion::Profile(llvm::FoldingSetNodeID& ID) const {
+void CompoundLiteralRegion::Profile(llvm::FoldingSetNodeID &ID) const {
   CompoundLiteralRegion::ProfileRegion(ID, CL, superRegion);
 }
 
-void CompoundLiteralRegion::ProfileRegion(llvm::FoldingSetNodeID& ID,
+void CompoundLiteralRegion::ProfileRegion(llvm::FoldingSetNodeID &ID,
                                           const CompoundLiteralExpr *CL,
-                                          const MemRegion* superRegion) {
+                                          const MemRegion *superRegion) {
   ID.AddInteger(static_cast<unsigned>(CompoundLiteralRegionKind));
   ID.AddPointer(CL);
   ID.AddPointer(superRegion);
 }
 
 void CXXThisRegion::ProfileRegion(llvm::FoldingSetNodeID &ID,
                                   const PointerType *PT,
                                   const MemRegion *sRegion) {
   ID.AddInteger(static_cast<unsigned>(CXXThisRegionKind));
   ID.AddPointer(PT);
   ID.AddPointer(sRegion);
 }
 
 void CXXThisRegion::Profile(llvm::FoldingSetNodeID &ID) const {
   CXXThisRegion::ProfileRegion(ID, ThisPointerTy, superRegion);
 }
 
 void FieldRegion::Profile(llvm::FoldingSetNodeID &ID) const {
   ProfileRegion(ID, getDecl(), superRegion);
 }
 
-void ObjCIvarRegion::ProfileRegion(llvm::FoldingSetNodeID& ID,
+void ObjCIvarRegion::ProfileRegion(llvm::FoldingSetNodeID &ID,
                                    const ObjCIvarDecl *ivd,
-                                   const MemRegion* superRegion) {
+                                   const MemRegion *superRegion) {
   ID.AddInteger(static_cast<unsigned>(ObjCIvarRegionKind));
   ID.AddPointer(ivd);
   ID.AddPointer(superRegion);
 }
 
 void ObjCIvarRegion::Profile(llvm::FoldingSetNodeID &ID) const {
   ProfileRegion(ID, getDecl(), superRegion);
 }
void ParamVarRegion::ProfileRegion(llvm::FoldingSetNodeID &ID, const Expr *OE,
   ID.AddInteger(Idx);
   ID.AddPointer(SReg);
 }
 
 void ParamVarRegion::Profile(llvm::FoldingSetNodeID &ID) const {
   ProfileRegion(ID, getOriginExpr(), getIndex(), superRegion);
 }
 
-void SymbolicRegion::ProfileRegion(llvm::FoldingSetNodeID& ID, SymbolRef sym,
+void SymbolicRegion::ProfileRegion(llvm::FoldingSetNodeID &ID, SymbolRef sym,
                                    const MemRegion *sreg) {
   ID.AddInteger(static_cast<unsigned>(MemRegion::SymbolicRegionKind));
   ID.Add(sym);
   ID.AddPointer(sreg);
 }
 
-void SymbolicRegion::Profile(llvm::FoldingSetNodeID& ID) const {
+void SymbolicRegion::Profile(llvm::FoldingSetNodeID &ID) const {
   SymbolicRegion::ProfileRegion(ID, sym, getSuperRegion());
 }
 
-void ElementRegion::ProfileRegion(llvm::FoldingSetNodeID& ID,
+void ElementRegion::ProfileRegion(llvm::FoldingSetNodeID &ID,
                                   QualType ElementType, SVal Idx,
-                                  const MemRegion* superRegion) {
+                                  const MemRegion *superRegion) {
   ID.AddInteger(MemRegion::ElementRegionKind);
   ID.Add(ElementType);
   ID.AddPointer(superRegion);
   Idx.Profile(ID);
 }
 
-void ElementRegion::Profile(llvm::FoldingSetNodeID& ID) const {
+void ElementRegion::Profile(llvm::FoldingSetNodeID &ID) const {
   ElementRegion::ProfileRegion(ID, ElementType, Index, superRegion);
 }
 
-void FunctionCodeRegion::ProfileRegion(llvm::FoldingSetNodeID& ID,
-                                       const NamedDecl *FD,
-                                       const MemRegion*) {
+void FunctionCodeRegion::ProfileRegion(llvm::FoldingSetNodeID &ID,
+                                       const NamedDecl *FD, const MemRegion *) {
   ID.AddInteger(MemRegion::FunctionCodeRegionKind);
   ID.AddPointer(FD);
 }
 
-void FunctionCodeRegion::Profile(llvm::FoldingSetNodeID& ID) const {
+void FunctionCodeRegion::Profile(llvm::FoldingSetNodeID &ID) const {
   FunctionCodeRegion::ProfileRegion(ID, FD, superRegion);
 }
 
-void BlockCodeRegion::ProfileRegion(llvm::FoldingSetNodeID& ID,
+void BlockCodeRegion::ProfileRegion(llvm::FoldingSetNodeID &ID,
                                     const BlockDecl *BD, CanQualType,
                                     const AnalysisDeclContext *AC,
-                                    const MemRegion*) {
+                                    const MemRegion *) {
   ID.AddInteger(MemRegion::BlockCodeRegionKind);
   ID.AddPointer(BD);
 }
 
-void BlockCodeRegion::Profile(llvm::FoldingSetNodeID& ID) const {
+void BlockCodeRegion::Profile(llvm::FoldingSetNodeID &ID) const {
   BlockCodeRegion::ProfileRegion(ID, BD, locTy, AC, superRegion);
 }
 
-void BlockDataRegion::ProfileRegion(llvm::FoldingSetNodeID& ID,
+void BlockDataRegion::ProfileRegion(llvm::FoldingSetNodeID &ID,
                                     const BlockCodeRegion *BC,
                                     const LocationContext *LC,
-                                    unsigned BlkCount,
-                                    const MemRegion *sReg) {
+                                    unsigned BlkCount, const MemRegion *sReg) {
   ID.AddInteger(MemRegion::BlockDataRegionKind);
   ID.AddPointer(BC);
   ID.AddPointer(LC);
   ID.AddInteger(BlkCount);
   ID.AddPointer(sReg);
 }
 
-void BlockDataRegion::Profile(llvm::FoldingSetNodeID& ID) const {
+void BlockDataRegion::Profile(llvm::FoldingSetNodeID &ID) const {
   BlockDataRegion::ProfileRegion(ID, BC, LC, BlockCount, getSuperRegion());
 }
 
 void CXXTempObjectRegion::ProfileRegion(llvm::FoldingSetNodeID &ID,
-                                        Expr const *Ex,
-                                        const MemRegion *sReg) {
+                                        Expr const *Ex, const MemRegion *sReg) {
   ID.AddPointer(Ex);
   ID.AddPointer(sReg);
 }
 
 void CXXTempObjectRegion::Profile(llvm::FoldingSetNodeID &ID) const {
   ProfileRegion(ID, Ex, getSuperRegion());
 }
 
 void CXXBaseObjectRegion::ProfileRegion(llvm::FoldingSetNodeID &ID,
-                                        const CXXRecordDecl *RD,
-                                        bool IsVirtual,
+                                        const CXXRecordDecl *RD, bool IsVirtual,
                                         const MemRegion *SReg) {
   ID.AddPointer(RD);
   ID.AddBoolean(IsVirtual);
   ID.AddPointer(SReg);
 }
 
 void CXXBaseObjectRegion::Profile(llvm::FoldingSetNodeID &ID) const {
   ProfileRegion(ID, getDecl(), isVirtual(), superRegion);

 void CodeTextRegion::anchor() {}
 
 void SubRegion::anchor() {}
 
 //===----------------------------------------------------------------------===//
 // Region pretty-printing.
 //===----------------------------------------------------------------------===//
 
-LLVM_DUMP_METHOD void MemRegion::dump() const {
-  dumpToStream(llvm::errs());
-}
+LLVM_DUMP_METHOD void MemRegion::dump() const { dumpToStream(llvm::errs()); }
 
 std::string MemRegion::getString() const {
   std::string s;
   llvm::raw_string_ostream os(s);
   dumpToStream(os);
   return os.str();
 }
 

 
 void BlockCodeRegion::dumpToStream(raw_ostream &os) const {
   os << "block_code{" << static_cast<const void *>(this) << '}';
 }
 
 void BlockDataRegion::dumpToStream(raw_ostream &os) const {
   os << "block_data{" << BC;
   os << "; ";
-  for (BlockDataRegion::referenced_vars_iterator
-         I = referenced_vars_begin(),
-         E = referenced_vars_end(); I != E; ++I)
-    os << "(" << I.getCapturedRegion() << "<-" <<
-                 I.getOriginalRegion() << ") ";
+  for (BlockDataRegion::referenced_vars_iterator I = referenced_vars_begin(),
+                                                 E = referenced_vars_end();
+       I != E; ++I)
+    os << "(" << I.getCapturedRegion() << "<-" << I.getOriginalRegion() << ") ";
   os << '}';
 }
 
 void CompoundLiteralRegion::dumpToStream(raw_ostream &os) const {
   // FIXME: More elaborate pretty-printing.
-  os << "{ S" << CL->getID(getContext()) <<  " }";
+  os << "{ S" << CL->getID(getContext()) << " }";
 }
 
 void CXXTempObjectRegion::dumpToStream(raw_ostream &os) const {
   os << "temp_object{" << getValueType().getAsString() << ", "
      << "S" << Ex->getID(getContext()) << '}';
 }
 
 void CXXBaseObjectRegion::dumpToStream(raw_ostream &os) const {
   os << "Base{" << superRegion << ',' << getDecl()->getName() << '}';
 }
 
 void CXXDerivedObjectRegion::dumpToStream(raw_ostream &os) const {
   os << "Derived{" << superRegion << ',' << getDecl()->getName() << '}';
 }
 
-void CXXThisRegion::dumpToStream(raw_ostream &os) const {
-  os << "this";
-}
+void CXXThisRegion::dumpToStream(raw_ostream &os) const { os << "this"; }
 
 void ElementRegion::dumpToStream(raw_ostream &os) const {
-  os << "Element{" << superRegion << ','
-     << Index << ',' << getElementType().getAsString() << '}';
+  os << "Element{" << superRegion << ',' << Index << ','
+     << getElementType().getAsString() << '}';
 }
 
 void FieldRegion::dumpToStream(raw_ostream &os) const {
   os << superRegion << "." << *getDecl();
 }
 
 void ObjCIvarRegion::dumpToStream(raw_ostream &os) const {
   os << "Ivar{" << superRegion << ',' << *getDecl() << '}';
assert(PVD &&
          " yet.");
   if (const IdentifierInfo *ID = PVD->getIdentifier()) {
     os << ID->getName();
   } else {
     os << "ParamVarRegion{P" << PVD->getID() << '}';
   }
 }
 
-bool MemRegion::canPrintPretty() const {
-  return canPrintPrettyAsExpr();
-}
+bool MemRegion::canPrintPretty() const { return canPrintPrettyAsExpr(); }
 
-bool MemRegion::canPrintPrettyAsExpr() const {
-  return false;
-}
+bool MemRegion::canPrintPrettyAsExpr() const { return false; }
 
 void MemRegion::printPretty(raw_ostream &os) const {
   assert(canPrintPretty() && "This region cannot be printed pretty.");
   os << "'";
   printPrettyAsExpr(os);
   os << "'";
 }
 

 
 void ParamVarRegion::printPrettyAsExpr(raw_ostream &os) const {
   assert(getDecl() &&
          "`ParamVarRegion` support functions without `Decl` not implemented"
          " yet.");
   os << getDecl()->getName();
 }
 
-bool ObjCIvarRegion::canPrintPrettyAsExpr() const {
-  return true;
-}
+bool ObjCIvarRegion::canPrintPrettyAsExpr() const { return true; }
 
 void ObjCIvarRegion::printPrettyAsExpr(raw_ostream &os) const {
   os << getDecl()->getName();
 }
 
-bool FieldRegion::canPrintPretty() const {
-  return true;
-}
+bool FieldRegion::canPrintPretty() const { return true; }
 
 bool FieldRegion::canPrintPrettyAsExpr() const {
   return superRegion->canPrintPrettyAsExpr();
 }
 
 void FieldRegion::printPrettyAsExpr(raw_ostream &os) const {
   assert(canPrintPrettyAsExpr());
   superRegion->printPrettyAsExpr(os);
   os << "." << getDecl()->getName();
 }
 
 void FieldRegion::printPretty(raw_ostream &os) const {
   if (canPrintPrettyAsExpr()) {
     os << "\'";
     printPrettyAsExpr(os);
     os << "'";
   } else {
-    os << "field " << "\'" << getDecl()->getName() << "'";
+    os << "field "
+       << "\'" << getDecl()->getName() << "'";
   }
 }
 
 bool CXXBaseObjectRegion::canPrintPrettyAsExpr() const {
   return superRegion->canPrintPrettyAsExpr();
 }
 
 void CXXBaseObjectRegion::printPrettyAsExpr(raw_ostream &os) const {
else
     return {};
 }
 
 //===----------------------------------------------------------------------===//
 // MemRegionManager methods.
 //===----------------------------------------------------------------------===//
 
 static DefinedOrUnknownSVal getTypeSize(QualType Ty, ASTContext &Ctx,
-                                          SValBuilder &SVB) {
   CharUnits Size = Ctx.getTypeSizeInChars(Ty);
   QualType SizeTy = SVB.getArrayIndexType();
   return SVB.makeIntVal(Size.getQuantity(), SizeTy);
 }
 
 DefinedOrUnknownSVal MemRegionManager::getStaticSize(const MemRegion *MR,
                                                      SValBuilder &SVB) const {
   const auto *SR = cast<SubRegion>(MR);
DefinedOrUnknownSVal MemRegionManager::getStaticSize(const MemRegion *MR,
   case MemRegion::FunctionCodeRegionKind:
     return nonloc::SymbolVal(SymMgr.getExtentSymbol(SR));
   default:
     llvm_unreachable("Unhandled region");
   }
 }
 
 template <typename REG>
-const REG *MemRegionManager::LazyAllocate(REG*& region) {
+const REG *MemRegionManager::LazyAllocate(REG *&region) {
   if (!region) {
     region = A.Allocate<REG>();
     new (region) REG(*this);
   }
 
   return region;
 }
 
 template <typename REG, typename ARG>
-const REG *MemRegionManager::LazyAllocate(REG*& region, ARG a) {
+const REG *MemRegionManager::LazyAllocate(REG *&region, ARG a) {
   if (!region) {
     region = A.Allocate<REG>();
     new (region) REG(this, a);
   }
 
   return region;
 }
 
-const StackLocalsSpaceRegion*
+const StackLocalsSpaceRegion *
 MemRegionManager::getStackLocalsRegion(const StackFrameContext *STC) {
   assert(STC);
   StackLocalsSpaceRegion *&R = StackLocalsSpaceRegions[STC];
 
   if (R)
     return R;
 
   R = A.Allocate<StackLocalsSpaceRegion>();
MemRegionManager::getStackArgumentsRegion(const StackFrameContext *STC) {
   if (R)
     return R;
 
   R = A.Allocate<StackArgumentsSpaceRegion>();
   new (R) StackArgumentsSpaceRegion(*this, STC);
   return R;
 }
 
-const GlobalsSpaceRegion
-*MemRegionManager::getGlobalsRegion(MemRegion::Kind K,
-                                    const CodeTextRegion *CR) {
+const GlobalsSpaceRegion *
+MemRegionManager::getGlobalsRegion(MemRegion::Kind K,
   if (!CR) {
     if (K == MemRegion::GlobalSystemSpaceRegionKind)
       return LazyAllocate(SystemGlobals);
     if (K == MemRegion::GlobalImmutableSpaceRegionKind)
       return LazyAllocate(ImmutableGlobals);
     assert(K == MemRegion::GlobalInternalSpaceRegionKind);
     return LazyAllocate(InternalGlobals);
   }

 const CodeSpaceRegion *MemRegionManager::getCodeRegion() {
   return LazyAllocate(code);
 }
 
 //===----------------------------------------------------------------------===//
 // Constructing regions.
 //===----------------------------------------------------------------------===//
 
-const StringRegion *MemRegionManager::getStringRegion(const StringLiteral *Str){
+const StringRegion *
+MemRegionManager::getStringRegion(const StringLiteral *Str) {
   return getSubRegion<StringRegion>(
       Str, cast<GlobalInternalSpaceRegion>(getGlobalsRegion()));
 }
 
 const ObjCStringRegion *
-MemRegionManager::getObjCStringRegion(const ObjCStringLiteral *Str){
+MemRegionManager::getObjCStringRegion(const ObjCStringLiteral *Str) {
   return getSubRegion<ObjCStringRegion>(
       Str, cast<GlobalInternalSpaceRegion>(getGlobalsRegion()));
 }
 
 /// Look through a chain of LocationContexts to either find the
 /// StackFrameContext that matches a DeclContext, or find a VarRegion
 /// for a variable captured by a block.
 static llvm::PointerUnion<const StackFrameContext *, const VarRegion *>
 getStackOrCaptureRegionForDeclContext(const LocationContext *LC,
                                       const DeclContext *DC,
                                       const VarDecl *VD) {
   while (LC) {
     if (const auto *SFC = dyn_cast<StackFrameContext>(LC)) {
       if (cast<DeclContext>(SFC->getDecl()) == DC)
         return SFC;
     }
     if (const auto *BC = dyn_cast<BlockInvocationContext>(LC)) {
       const auto *BR = static_cast<const BlockDataRegion *>(BC->getData());
       // FIXME: This can be made more efficient.
       for (BlockDataRegion::referenced_vars_iterator
                I = BR->referenced_vars_begin(),
-           E = BR->referenced_vars_end(); I != E; ++I) {
+               E = BR->referenced_vars_end();
+           I != E; ++I) {
         const TypedValueRegion *OrigR = I.getOriginalRegion();
         if (const auto *VR = dyn_cast<VarRegion>(OrigR)) {
           if (VR->getDecl() == VD)
             return cast<VarRegion>(I.getCapturedRegion());
         }
       }
     }
 
if (D->hasGlobalStorage() && !D->isStaticLocal()) {
     if (Ctx.getSourceManager().isInSystemHeader(D->getLocation())) {
       // Whitelist the system globals which often DO GET modified, assume the
       // rest are immutable.
       if (D->getName().find("errno") != StringRef::npos)
         sReg = getGlobalsRegion(MemRegion::GlobalSystemSpaceRegionKind);
       else
         sReg = getGlobalsRegion(MemRegion::GlobalImmutableSpaceRegionKind);
 
       // Treat other globals as GlobalInternal unless they are constants.
     } else {
       QualType GQT = D->getType();
       const Type *GT = GQT.getTypePtrOrNull();
       // TODO: We could walk the complex types here and see if everything is
       // constified.
       if (GT && GQT.isConstQualified() && GT->isArithmeticType())
         sReg = getGlobalsRegion(MemRegion::GlobalImmutableSpaceRegionKind);
       else
         sReg = getGlobalsRegion();
     }
 
     // Finally handle static locals.
   } else {
     // FIXME: Once we implement scope handling, we will need to properly lookup
     // 'D' to the proper LocationContext.
     const DeclContext *DC = D->getDeclContext();
     llvm::PointerUnion<const StackFrameContext *, const VarRegion *> V =
         getStackOrCaptureRegionForDeclContext(LC, DC, D);
 
-    if (V.is<const VarRegion*>())
-      return V.get<const VarRegion*>();
+    if (V.is<const VarRegion *>())
+      return V.get<const VarRegion *>();
 
     const auto *STC = V.get<const StackFrameContext *>();
 
     if (!STC) {
       // FIXME: Assign a more sensible memory space to static locals
       // we see from within blocks that we analyze as top-level declarations.
       sReg = getUnknownRegion();
     } else {
       if (D->hasLocalStorage()) {
-        sReg = isa<ParmVarDecl>(D) || isa<ImplicitParamDecl>(D)
-               ? static_cast<const MemRegion*>(getStackArgumentsRegion(STC))
-               : static_cast<const MemRegion*>(getStackLocalsRegion(STC));
-      }
-      else {
+        sReg =
+            isa<ParmVarDecl>(D) || isa<ImplicitParamDecl>(D)
+                ? static_cast<const MemRegion *>(getStackArgumentsRegion(STC))
+                : static_cast<const MemRegion *>(getStackLocalsRegion(STC));
+      } else {
         assert(D->isStaticLocal());
         const Decl *STCD = STC->getDecl();
         if (isa<FunctionDecl>(STCD) || isa<ObjCMethodDecl>(STCD))
           sReg = getGlobalsRegion(MemRegion::StaticGlobalSpaceRegionKind,
                                   getFunctionCodeRegion(cast<NamedDecl>(STCD)));
         else if (const auto *BD = dyn_cast<BlockDecl>(STCD)) {
           // FIXME: The fallback type here is totally bogus -- though it should
           // never be queried, it will prevent uniquing with the real
           // BlockCodeRegion. Ideally we'd fix the AST so that we always had a
           // signature.
           QualType T;
           if (const TypeSourceInfo *TSI = BD->getSignatureAsWritten())
             T = TSI->getType();
           if (T.isNull())
             T = getContext().VoidTy;
           if (!T->getAs<FunctionType>())
             T = getContext().getFunctionNoProtoType(T);
           T = getContext().getBlockPointerType(T);
 
-          const BlockCodeRegion *BTR =
-            getBlockCodeRegion(BD, Ctx.getCanonicalType(T),
-                               STC->getAnalysisDeclContext());
-          sReg = getGlobalsRegion(MemRegion::StaticGlobalSpaceRegionKind,
-                                  BTR);
-        }
-        else {
+          const BlockCodeRegion *BTR = getBlockCodeRegion(
+              BD, Ctx.getCanonicalType(T), STC->getAnalysisDeclContext());
+          sReg = getGlobalsRegion(MemRegion::StaticGlobalSpaceRegionKind, BTR);
+        } else {
           sReg = getGlobalsRegion();
         }
       }
     }
   }
 
   return getSubRegion<NonParamVarRegion>(D, sReg);
 }

 MemRegionManager::getParamVarRegion(const Expr *OriginExpr, unsigned Index,
                                     const LocationContext *LC) {
   const StackFrameContext *SFC = LC->getStackFrame();
   assert(SFC);
   return getSubRegion<ParamVarRegion>(OriginExpr, Index,
                                       getStackArgumentsRegion(SFC));
 }
 
-const BlockDataRegion *
-MemRegionManager::getBlockDataRegion(const BlockCodeRegion *BC,
-                                     const LocationContext *LC,
-                                     unsigned blockCount) {
+const BlockDataRegion *MemRegionManager::getBlockDataRegion(
+    const BlockCodeRegion *BC, const LocationContext *LC, unsigned blockCount) {
   const MemSpaceRegion *sReg = nullptr;
   const BlockDecl *BD = BC->getDecl();
   if (!BD->hasCaptures()) {
     // This handles 'static' blocks.
     sReg = getGlobalsRegion(MemRegion::GlobalImmutableSpaceRegionKind);
-  }
-  else {
+  } else {
     if (LC) {
       // FIXME: Once we implement scope handling, we want the parent region
       // to be the scope.
       const StackFrameContext *STC = LC->getStackFrame();
       assert(STC);
       sReg = getStackLocalsRegion(STC);
-    }
-    else {
+    } else {
       // We allow 'LC' to be NULL for cases where want BlockDataRegions
       // without context-sensitivity.
       sReg = getUnknownRegion();
     }
   }
 
   return getSubRegion<BlockDataRegion>(BC, LC, blockCount, sReg);
 }
 
 const CXXTempObjectRegion *
 MemRegionManager::getCXXStaticTempObjectRegion(const Expr *Ex) {
   return getSubRegion<CXXTempObjectRegion>(
       Ex, getGlobalsRegion(MemRegion::GlobalInternalSpaceRegionKind, nullptr));
 }
 
-const CompoundLiteralRegion*
+const CompoundLiteralRegion *
 MemRegionManager::getCompoundLiteralRegion(const CompoundLiteralExpr *CL,
                                            const LocationContext *LC) {
   const MemSpaceRegion *sReg = nullptr;
 
   if (CL->isFileScope())
     sReg = getGlobalsRegion();
   else {
     const StackFrameContext *STC = LC->getStackFrame();
     assert(STC);
     sReg = getStackLocalsRegion(STC);
   }
 
   return getSubRegion<CompoundLiteralRegion>(CL, sReg);
 }
 
-const ElementRegion*
+const ElementRegion *
 MemRegionManager::getElementRegion(QualType elementType, NonLoc Idx,
-                                   const SubRegion* superRegion,
-                                   ASTContext &Ctx){
+                                   const SubRegion *superRegion,
+                                   ASTContext &Ctx) {
   QualType T = Ctx.getCanonicalType(elementType).getUnqualifiedType();
 
   llvm::FoldingSetNodeID ID;
   ElementRegion::ProfileRegion(ID, T, Idx, superRegion);
 
   void *InsertPos;
-  MemRegion* data = Regions.FindNodeOrInsertPos(ID, InsertPos);
+  MemRegion *data = Regions.FindNodeOrInsertPos(ID, InsertPos);
   auto *R = cast_or_null<ElementRegion>(data);
 
   if (!R) {
     R = A.Allocate<ElementRegion>();
     new (R) ElementRegion(T, Idx, superRegion);
     Regions.InsertNode(R, InsertPos);
   }
 

 const SymbolicRegion *MemRegionManager::getSymbolicRegion(SymbolRef sym) {
   return getSubRegion<SymbolicRegion>(sym, getUnknownRegion());
 }
 
 const SymbolicRegion *MemRegionManager::getSymbolicHeapRegion(SymbolRef Sym) {
   return getSubRegion<SymbolicRegion>(Sym, getHeapRegion());
 }
 
-const FieldRegion*
+const FieldRegion *
 MemRegionManager::getFieldRegion(const FieldDecl *d,
-                                 const SubRegion* superRegion){
+                                 const SubRegion *superRegion) {
   return getSubRegion<FieldRegion>(d, superRegion);
 }
 
-const ObjCIvarRegion*
+const ObjCIvarRegion *
 MemRegionManager::getObjCIvarRegion(const ObjCIvarDecl *d,
-                                    const SubRegion* superRegion) {
+                                    const SubRegion *superRegion) {
   return getSubRegion<ObjCIvarRegion>(d, superRegion);
 }
 
-const CXXTempObjectRegion*
+const CXXTempObjectRegion *
 MemRegionManager::getCXXTempObjectRegion(Expr const *E,
                                          LocationContext const *LC) {
   const StackFrameContext *SFC = LC->getStackFrame();
   assert(SFC);
   return getSubRegion<CXXTempObjectRegion>(E, getStackLocalsRegion(SFC));
 }
 
 /// Checks whether \p BaseClass is a valid virtual or direct non-virtual base
 /// class of the type of \p Super.
 static bool isValidBaseClass(const CXXRecordDecl *BaseClass,
-                             const TypedValueRegion *Super,
-                             bool IsVirtual) {
+                             const TypedValueRegion *Super, bool IsVirtual) {
   BaseClass = BaseClass->getCanonicalDecl();
 
   const CXXRecordDecl *Class = Super->getValueType()->getAsCXXRecordDecl();
   if (!Class)
     return true;
 
   if (IsVirtual)
     return Class->isVirtuallyDerivedFrom(BaseClass);
 
   for (const auto &I : Class->bases()) {
     if (I.getType()->getAsCXXRecordDecl()->getCanonicalDecl() == BaseClass)
       return true;
   }
 
   return false;
 }
 
-const CXXBaseObjectRegion *
-MemRegionManager::getCXXBaseObjectRegion(const CXXRecordDecl *RD,
-                                         const SubRegion *Super,
-                                         bool IsVirtual) {
+const CXXBaseObjectRegion *MemRegionManager::getCXXBaseObjectRegion(
+    const CXXRecordDecl *RD, const SubRegion *Super, bool IsVirtual) {
   if (isa<TypedValueRegion>(Super)) {
     assert(isValidBaseClass(RD, cast<TypedValueRegion>(Super), IsVirtual));
     (void)&isValidBaseClass;
 
     if (IsVirtual) {
       // Virtual base regions should not be layered, since the layout rules
       // are different.
       while (const auto *Base = dyn_cast<CXXBaseObjectRegion>(Super))
         Super = cast<SubRegion>(Base->getSuperRegion());
       assert(Super && !isa<MemSpaceRegion>(Super));
     }
   }
 
   return getSubRegion<CXXBaseObjectRegion>(RD, IsVirtual, Super);
 }
 
 const CXXDerivedObjectRegion *
 MemRegionManager::getCXXDerivedObjectRegion(const CXXRecordDecl *RD,
                                             const SubRegion *Super) {
   return getSubRegion<CXXDerivedObjectRegion>(RD, Super);
 }
 
-const CXXThisRegion*
+const CXXThisRegion *
 MemRegionManager::getCXXThisRegion(QualType thisPointerTy,
                                    const LocationContext *LC) {
   const auto *PT = thisPointerTy->getAs<PointerType>();
   assert(PT);
   // Inside the body of the operator() of a lambda a this expr might refer to an
   // object in one of the parent location contexts.
   const auto *D = dyn_cast<CXXMethodDecl>(LC->getDecl());
   // FIXME: when operator() of lambda is analyzed as a top level function and
   // 'this' refers to a this to the enclosing scope, there is no right region to
   // return.
   while (!LC->inTopFrame() && (!D || D->isStatic() ||
                                PT != D->getThisType()->getAs<PointerType>())) {
     LC = LC->getParent();
     D = dyn_cast<CXXMethodDecl>(LC->getDecl());
   }
   const StackFrameContext *STC = LC->getStackFrame();
   assert(STC);
   return getSubRegion<CXXThisRegion>(PT, getStackArgumentsRegion(STC));
 }
 
-const AllocaRegion*
+const AllocaRegion *
 MemRegionManager::getAllocaRegion(const Expr *E, unsigned cnt,
                                   const LocationContext *LC) {
   const StackFrameContext *STC = LC->getStackFrame();
   assert(STC);
   return getSubRegion<AllocaRegion>(E, cnt, getStackLocalsRegion(STC));
 }
 
 const MemSpaceRegion *MemRegion::getMemorySpace() const {

 }
 
 bool MemRegion::hasStackParametersStorage() const {
   return isa<StackArgumentsSpaceRegion>(getMemorySpace());
 }
 
 bool MemRegion::hasGlobalsOrParametersStorage() const {
   const MemSpaceRegion *MS = getMemorySpace();
-  return isa<StackArgumentsSpaceRegion>(MS) ||
-         isa<GlobalsSpaceRegion>(MS);
+  return isa<StackArgumentsSpaceRegion>(MS) || isa<GlobalsSpaceRegion>(MS);
 }
 
 // getBaseRegion strips away all elements and fields, and get the base region
 // of them.
 const MemRegion *MemRegion::getBaseRegion() const {
   const MemRegion *R = this;
   while (true) {
     switch (R->getKind()) {
-      case MemRegion::ElementRegionKind:
-      case MemRegion::FieldRegionKind:
-      case MemRegion::ObjCIvarRegionKind:
-      case MemRegion::CXXBaseObjectRegionKind:
-      case MemRegion::CXXDerivedObjectRegionKind:
-        R = cast<SubRegion>(R)->getSuperRegion();
-        continue;
-      default:
-        break;
     }
     break;
   }
   return R;
 }
 
 // getgetMostDerivedObjectRegion gets the region of the root class of a C++
 // class hierarchy.
 const MemRegion *MemRegion::getMostDerivedObjectRegion() const {
   const MemRegion *R = this;
   while (const auto *BR = dyn_cast<CXXBaseObjectRegion>(R))
     R = BR->getSuperRegion();
   return R;
 }
 
-bool MemRegion::isSubRegionOf(const MemRegion *) const {
-  return false;
-}
+bool MemRegion::isSubRegionOf(const MemRegion *) const { return false; }
 
 //===----------------------------------------------------------------------===//
 // View handling.
 //===----------------------------------------------------------------------===//
 
 const MemRegion *MemRegion::StripCasts(bool StripBaseAndDerivedCasts) const {
   const MemRegion *R = this;
   while (true) {
case MemRegion::FieldRegionKind: {
       // Don't bother calculating precise offsets if we already have a
       // symbolic offset somewhere in the chain.
       if (SymbolicOffsetBase)
         continue;
 
       // Get the field number.
       unsigned idx = 0;
       for (RecordDecl::field_iterator FI = RD->field_begin(),
-             FE = RD->field_end(); FI != FE; ++FI, ++idx) {
+                                      FE = RD->field_end();
+           FI != FE; ++FI, ++idx) {
         if (FR->getDecl() == *FI)
           break;
       }
       const ASTRecordLayout &Layout = R->getContext().getASTRecordLayout(RD);
       // This is offset in bits.
       Offset += Layout.getFieldOffset(idx);
       break;
     }
     }
   }
 
- Finish:
   if (SymbolicOffsetBase)
     return RegionOffset(SymbolicOffsetBase, RegionOffset::Symbolic);
   return RegionOffset(R, Offset);
 }
 
 RegionOffset MemRegion::getAsOffset() const {
   if (!cachedOffset)
     cachedOffset = calculateOffset(this);
   return *cachedOffset;
 }
 
 //===----------------------------------------------------------------------===//
 // BlockDataRegion
 //===----------------------------------------------------------------------===//
 
 std::pair<const VarRegion *, const VarRegion *>
 BlockDataRegion::getCaptureRegions(const VarDecl *VD) {
   MemRegionManager &MemMgr = getMemRegionManager();
   const VarRegion *VR = nullptr;
   const VarRegion *OriginalVR = nullptr;
 
   if (!VD->hasAttr<BlocksAttr>() && VD->hasLocalStorage()) {
     VR = MemMgr.getNonParamVarRegion(VD, this);
     OriginalVR = MemMgr.getVarRegion(VD, LC);
-  }
-  else {
+  } else {
     if (LC) {
       VR = MemMgr.getVarRegion(VD, LC);
       OriginalVR = VR;
-    }
-    else {
+    } else {
       VR = MemMgr.getNonParamVarRegion(VD, MemMgr.getUnknownRegion());
       OriginalVR = MemMgr.getVarRegion(VD, LC);
     }
   }
   return std::make_pair(VR, OriginalVR);
 }
 
 void BlockDataRegion::LazyInitializeReferencedVars() {
   if (ReferencedVars)
     return;
 
   AnalysisDeclContext *AC = getCodeRegion()->getAnalysisDeclContext();
   const auto &ReferencedBlockVars = AC->getReferencedBlockVars(BC->getDecl());
   auto NumBlockVars =
       std::distance(ReferencedBlockVars.begin(), ReferencedBlockVars.end());
 
   if (NumBlockVars == 0) {
-    ReferencedVars = (void*) 0x1;
+    ReferencedVars = (void *)0x1;
     return;
   }
 
   MemRegionManager &MemMgr = getMemRegionManager();
   llvm::BumpPtrAllocator &A = MemMgr.getAllocator();
   BumpVectorContext BC(A);
 
   using VarVec = BumpVector<const MemRegion *>;
void BlockDataRegion::LazyInitializeReferencedVars() {
   }
 
   ReferencedVars = BV;
   OriginalVars = BVOriginal;
 }
 
 BlockDataRegion::referenced_vars_iterator
 BlockDataRegion::referenced_vars_begin() const {
-  const_cast<BlockDataRegion*>(this)->LazyInitializeReferencedVars();
+  const_cast<BlockDataRegion *>(this)->LazyInitializeReferencedVars();
 
   auto *Vec = static_cast<BumpVector<const MemRegion *> *>(ReferencedVars);
 
-  if (Vec == (void*) 0x1)
+  if (Vec == (void *)0x1)
     return BlockDataRegion::referenced_vars_iterator(nullptr, nullptr);
 
   auto *VecOriginal =
       static_cast<BumpVector<const MemRegion *> *>(OriginalVars);
 
   return BlockDataRegion::referenced_vars_iterator(Vec->begin(),
                                                    VecOriginal->begin());
 }
 
 BlockDataRegion::referenced_vars_iterator
 BlockDataRegion::referenced_vars_end() const {
-  const_cast<BlockDataRegion*>(this)->LazyInitializeReferencedVars();
+  const_cast<BlockDataRegion *>(this)->LazyInitializeReferencedVars();
 
   auto *Vec = static_cast<BumpVector<const MemRegion *> *>(ReferencedVars);
 
-  if (Vec == (void*) 0x1)
+  if (Vec == (void *)0x1)
     return BlockDataRegion::referenced_vars_iterator(nullptr, nullptr);
 
   auto *VecOriginal =
       static_cast<BumpVector<const MemRegion *> *>(OriginalVars);
 
   return BlockDataRegion::referenced_vars_iterator(Vec->end(),
                                                    VecOriginal->end());
 }

clang/test/Analysis/pointer-to-member.cpp

void double_diamond() {
 
   clang_analyzer_eval(d2.*(static_cast<int D2::*>(static_cast<int L2::*>(static_cast<int L1::*>(&B::f)))) == 1); // expected-warning {{TRUE}}
   clang_analyzer_eval(d2.*(static_cast<int D2::*>(static_cast<int R2::*>(static_cast<int L1::*>(&B::f)))) == 2); // expected-warning {{TRUE}}
   clang_analyzer_eval(d2.*(static_cast<int D2::*>(static_cast<int L2::*>(static_cast<int R1::*>(&B::f)))) == 3); // expected-warning {{TRUE}}
   clang_analyzer_eval(d2.*(static_cast<int D2::*>(static_cast<int R2::*>(static_cast<int R1::*>(&B::f)))) == 4); // expected-warning {{TRUE}}
 }
 } // end of testPointerToMemberDiamond namespace
 
+namespace testPointerToMemberViaStaticCast {
+// From bug #48739
+struct Base {
+  int field;
+};
+
+struct Derived : public Base {};
+
+void static_cast_test() {
+  int Derived::*derived_field = &Derived::field;
+  Base base;
+  base.field = 5;
+  int Base::*base_field = static_cast<int Base::*>(derived_field);
+  clang_analyzer_eval(base.*base_field == 5); // expected-warning {{TRUE}}
+}
+} // namespace testPointerToMemberViaStaticCast
+
 namespace testAnonymousMember {
 struct A {
   int a;
   struct {
     int b;
     int c;
   };
   struct {