[analyzer] [NFC] Add a new parameter ProgramStateRef to SValBuilder::evalCast function

[ASDenysPetrov]

Summary

Add ProgramStateRef as a new parameter to SValBuilder::evalCast function and pass the argument through the code.
This patch is a preparatory one and does not change any behavior and serves for further improvements.
It makes future revisions smaller and safer.

[ASDenysPetrov]

Rebased on main.

[ASDenysPetrov]

Missed to add changes in unittests. Fixed.

[ASDenysPetrov]

This is the only revision in the stack which was bypass your attention. It's fairly harmless although a big one. Please, look at it.

clang/include/clang/StaticAnalyzer/Core/PathSensitive/Environment.h

 public:
   using iterator = BindingsTy::iterator;
 
   iterator begin() const { return ExprBindings.begin(); }
   iterator end() const { return ExprBindings.end(); }
 
   /// Fetches the current binding of the expression in the
   /// Environment.
-  SVal getSVal(const EnvironmentEntry &E, SValBuilder &svalBuilder) const;
+  SVal getSVal(ProgramStateRef State, const EnvironmentEntry &E,
+               SValBuilder &svalBuilder) const;
 
   /// Profile - Profile the contents of an Environment object for use
   ///  in a FoldingSet.
   static void Profile(llvm::FoldingSetNodeID& ID, const Environment* env) {
     env->ExprBindings.Profile(ID);
   }
 
   /// Profile - Used to profile the contents of this object for inclusion

clang/include/clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h

inline SVal ProgramState::getLValue(const IndirectFieldDecl *D,
   StoreManager &SM = *getStateManager().StoreMgr;
   for (const auto *I : D->chain()) {
     Base = SM.getLValueField(cast<FieldDecl>(I), Base);
   }
 
   return Base;
 }
 
-inline SVal ProgramState::getLValue(QualType ElementType, SVal Idx, SVal Base) const{
+inline SVal ProgramState::getLValue(QualType ElementType, SVal Idx,
+                                    SVal Base) const {
   if (Optional<NonLoc> N = Idx.getAs<NonLoc>())
-    return getStateManager().StoreMgr->getLValueElement(ElementType, *N, Base);
+    return getStateManager().StoreMgr->getLValueElement(this, ElementType, *N,
+                                                        Base);
   return UnknownVal();
 }
 
 inline SVal ProgramState::getSVal(const Stmt *Ex,
                                   const LocationContext *LCtx) const{
-  return Env.getSVal(EnvironmentEntry(Ex, LCtx),
+  return Env.getSVal(this, EnvironmentEntry(Ex, LCtx),
                      *getStateManager().svalBuilder);
 }
 
 inline SVal
 ProgramState::getSValAsScalarOrLoc(const Stmt *S,
                                    const LocationContext *LCtx) const {
   if (const Expr *Ex = dyn_cast<Expr>(S)) {
     QualType T = Ex->getType();
     if (Ex->isGLValue() || Loc::isLocType(T) ||
         T->isIntegralOrEnumerationType())
       return getSVal(S, LCtx);
   }
 
   return UnknownVal();
 }
 
 inline SVal ProgramState::getRawSVal(Loc LV, QualType T) const {
-  return getStateManager().StoreMgr->getBinding(getStore(), LV, T);
+  return getStateManager().StoreMgr->getBinding(this, getStore(), LV, T);
 }
 
 inline SVal ProgramState::getSVal(const MemRegion* R, QualType T) const {
-  return getStateManager().StoreMgr->getBinding(getStore(),
-                                                loc::MemRegionVal(R),
-                                                T);
+  return getStateManager().StoreMgr->getBinding(this, getStore(),
+                                                loc::MemRegionVal(R), T);
 }
 
 inline BasicValueFactory &ProgramState::getBasicVals() const {
   return getStateManager().getBasicVals();
 }
 
 inline SymbolManager &ProgramState::getSymbolManager() const {
   return getStateManager().getSymbolManager();

clang/include/clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h

protected:
   ProgramStateManager &StateMgr;
 
   /// The scalar type to use for array indices.
   const QualType ArrayIndexTy;
 
   /// The width of the scalar type used for array indices.
   const unsigned ArrayIndexWidth;
 
-  SVal evalCastKind(UndefinedVal V, QualType CastTy, QualType OriginalTy);
-  SVal evalCastKind(UnknownVal V, QualType CastTy, QualType OriginalTy);
-  SVal evalCastKind(Loc V, QualType CastTy, QualType OriginalTy);
-  SVal evalCastKind(NonLoc V, QualType CastTy, QualType OriginalTy);
-  SVal evalCastSubKind(loc::ConcreteInt V, QualType CastTy,
-                       QualType OriginalTy);
-  SVal evalCastSubKind(loc::GotoLabel V, QualType CastTy, QualType OriginalTy);
-  SVal evalCastSubKind(loc::MemRegionVal V, QualType CastTy,
-                       QualType OriginalTy);
-  SVal evalCastSubKind(nonloc::CompoundVal V, QualType CastTy,
-                       QualType OriginalTy);
-  SVal evalCastSubKind(nonloc::ConcreteInt V, QualType CastTy,
-                       QualType OriginalTy);
-  SVal evalCastSubKind(nonloc::LazyCompoundVal V, QualType CastTy,
-                       QualType OriginalTy);
-  SVal evalCastSubKind(nonloc::LocAsInteger V, QualType CastTy,
-                       QualType OriginalTy);
-  SVal evalCastSubKind(nonloc::SymbolVal V, QualType CastTy,
-                       QualType OriginalTy);
-  SVal evalCastSubKind(nonloc::PointerToMember V, QualType CastTy,
+  SVal evalCastKind(ProgramStateRef State, UndefinedVal V, QualType CastTy,
+  SVal evalCastKind(ProgramStateRef State, UnknownVal V, QualType CastTy,
+  SVal evalCastKind(ProgramStateRef State, Loc V, QualType CastTy,
+  SVal evalCastKind(ProgramStateRef State, NonLoc V, QualType CastTy,
+  SVal evalCastSubKind(ProgramStateRef State, loc::ConcreteInt V,
+                       QualType CastTy, QualType OriginalTy);
+  SVal evalCastSubKind(ProgramStateRef State, loc::GotoLabel V, QualType CastTy,
                        QualType OriginalTy);
+  SVal evalCastSubKind(ProgramStateRef State, loc::MemRegionVal V,
+                       QualType CastTy, QualType OriginalTy);
+  SVal evalCastSubKind(ProgramStateRef State, nonloc::CompoundVal V,
+                       QualType CastTy, QualType OriginalTy);
+  SVal evalCastSubKind(ProgramStateRef State, nonloc::ConcreteInt V,
+                       QualType CastTy, QualType OriginalTy);
+  SVal evalCastSubKind(ProgramStateRef State, nonloc::LazyCompoundVal V,
+                       QualType CastTy, QualType OriginalTy);
+  SVal evalCastSubKind(ProgramStateRef State, nonloc::LocAsInteger V,
+                       QualType CastTy, QualType OriginalTy);
+  SVal evalCastSubKind(ProgramStateRef State, nonloc::SymbolVal V,
+                       QualType CastTy, QualType OriginalTy);
+  SVal evalCastSubKind(ProgramStateRef State, nonloc::PointerToMember V,
+                       QualType CastTy, QualType OriginalTy);
 
 public:
   SValBuilder(llvm::BumpPtrAllocator &alloc, ASTContext &context,
               ProgramStateManager &stateMgr)
       : Context(context), BasicVals(context, alloc),
         SymMgr(context, BasicVals, alloc), MemMgr(context, alloc),
         StateMgr(stateMgr), ArrayIndexTy(context.LongLongTy),
         ArrayIndexWidth(context.getTypeSize(ArrayIndexTy)) {}
 
   virtual ~SValBuilder() = default;
 
   bool haveSameType(const SymExpr *Sym1, const SymExpr *Sym2) {
     return haveSameType(Sym1->getType(), Sym2->getType());
   }
 
   bool haveSameType(QualType Ty1, QualType Ty2) {
     // FIXME: Remove the second disjunct when we support symbolic
     // truncation/extension.
     return (Context.getCanonicalType(Ty1) == Context.getCanonicalType(Ty2) ||
             (Ty1->isIntegralOrEnumerationType() &&
              Ty2->isIntegralOrEnumerationType()));
   }
 
-  SVal evalCast(SVal V, QualType CastTy, QualType OriginalTy = QualType{});
+  SVal evalCast(ProgramStateRef State, SVal V, QualType CastTy,
+                QualType OriginalTy = QualType{});
 
   // Handles casts of type CK_IntegralCast.
   SVal evalIntegralCast(ProgramStateRef state, SVal val, QualType castTy,
                         QualType originalType);
 
   virtual SVal evalMinus(NonLoc val) = 0;
 
   virtual SVal evalComplement(NonLoc val) = 0;
public:
   DefinedSVal getBlockPointer(const BlockDecl *block, CanQualType locTy,
                               const LocationContext *locContext,
                               unsigned blockCount);
 
   /// Returns the value of \p E, if it can be determined in a non-path-sensitive
   /// manner.
   ///
   /// If \p E is not a constant or cannot be modeled, returns \c None.
-  Optional<SVal> getConstantVal(const Expr *E);
+  Optional<SVal> getConstantVal(ProgramStateRef State, const Expr *E);
 
   NonLoc makeCompoundVal(QualType type, llvm::ImmutableList<SVal> vals) {
     return nonloc::CompoundVal(BasicVals.getCompoundValData(type, vals));
   }
 
   NonLoc makeLazyCompoundVal(const StoreRef &store,
                              const TypedValueRegion *region) {
     return nonloc::LazyCompoundVal(
public:
   NonLoc makeZeroArrayIndex() {
     return nonloc::ConcreteInt(BasicVals.getValue(0, ArrayIndexTy));
   }
 
   NonLoc makeArrayIndex(uint64_t idx) {
     return nonloc::ConcreteInt(BasicVals.getValue(idx, ArrayIndexTy));
   }
 
-  SVal convertToArrayIndex(SVal val);
+  SVal convertToArrayIndex(ProgramStateRef State, SVal val);
 
   nonloc::ConcreteInt makeIntVal(const IntegerLiteral* integer) {
     return nonloc::ConcreteInt(
         BasicVals.getValue(integer->getValue(),
                      integer->getType()->isUnsignedIntegerOrEnumerationType()));
   }
 
   nonloc::ConcreteInt makeBoolVal(const ObjCBoolLiteralExpr *boolean) {

clang/include/clang/StaticAnalyzer/Core/PathSensitive/Store.h

public:
 
   /// Return the value bound to specified location in a given state.
   /// \param[in] store The store in which to make the lookup.
   /// \param[in] loc The symbolic memory location.
   /// \param[in] T An optional type that provides a hint indicating the
   ///   expected type of the returned value.  This is used if the value is
   ///   lazily computed.
   /// \return The value bound to the location \c loc.
-  virtual SVal getBinding(Store store, Loc loc, QualType T = QualType()) = 0;
+  virtual SVal getBinding(ProgramStateRef State, Store store, Loc loc,
+                          QualType T = QualType()) = 0;
 
   /// Return the default value bound to a region in a given store. The default
   /// binding is the value of sub-regions that were not initialized separately
   /// from their base region. For example, if the structure is zero-initialized
   /// upon construction, this method retrieves the concrete zero value, even if
   /// some or all fields were later overwritten manually. Default binding may be
   /// an unknown, undefined, concrete, or symbolic value.
   /// \param[in] store The store in which to make the lookup.
public:
 
   /// Return a store with the specified value bound to the given location.
   /// \param[in] store The store in which to make the binding.
   /// \param[in] loc The symbolic memory location.
   /// \param[in] val The value to bind to location \c loc.
   /// \return A StoreRef object that contains the same
   ///   bindings as \c store with the addition of having the value specified
   ///   by \c val bound to the location given for \c loc.
-  virtual StoreRef Bind(Store store, Loc loc, SVal val) = 0;
+  virtual StoreRef Bind(ProgramStateRef State, Store store, Loc loc,
+                        SVal val) = 0;
 
   /// Return a store with the specified value bound to all sub-regions of the
   /// region. The region must not have previous bindings. If you need to
   /// invalidate existing bindings, consider invalidateRegions().
   virtual StoreRef BindDefaultInitial(Store store, const MemRegion *R,
                                       SVal V) = 0;
 
   /// Return a store with in which all values within the given region are
public:
   }
 
   virtual SVal getLValueIvar(const ObjCIvarDecl *decl, SVal base);
 
   virtual SVal getLValueField(const FieldDecl *D, SVal Base) {
     return getLValueFieldOrIvar(D, Base);
   }
 
-  virtual SVal getLValueElement(QualType elementType, NonLoc offset, SVal Base);
+  virtual SVal getLValueElement(ProgramStateRef State, QualType elementType,
+                                NonLoc offset, SVal Base);
 
   /// ArrayToPointer - Used by ExprEngine::VistCast to handle implicit
   ///  conversions between arrays and pointers.
   virtual SVal ArrayToPointer(Loc Array, QualType ElementTy) = 0;
 
   /// Evaluates a chain of derived-to-base casts through the path specified in
   /// \p Cast.
   SVal evalDerivedToBase(SVal Derived, const CastExpr *Cast);
public:
 
   const ElementRegion *GetElementZeroRegion(const SubRegion *R, QualType T);
 
   /// castRegion - Used by ExprEngine::VisitCast to handle casts from
   ///  a MemRegion* to a specific location type.  'R' is the region being
   ///  casted and 'CastToTy' the result type of the cast.
   const MemRegion *castRegion(const MemRegion *region, QualType CastToTy);
 
-  virtual StoreRef removeDeadBindings(Store store, const StackFrameContext *LCtx,
+  virtual StoreRef removeDeadBindings(ProgramStateRef State, Store store,
+                                      const StackFrameContext *LCtx,
                                       SymbolReaper &SymReaper) = 0;
 
   virtual bool includedInBindings(Store store,
                                   const MemRegion *region) const = 0;
 
   /// If the StoreManager supports it, increment the reference count of
   /// the specified Store object.
   virtual void incrementReferenceCount(Store store) {}
public:
   ///   region/symbol.
   /// \param[in,out] InvalidatedTopLevel A vector to fill with regions
   ////  explicitly being invalidated. Pass \c NULL if this
   ///   information will not be used.
   /// \param[in,out] Invalidated A vector to fill with any regions being
   ///   invalidated. This should include any regions explicitly invalidated
   ///   even if they do not currently have bindings. Pass \c NULL if this
   ///   information will not be used.
-  virtual StoreRef invalidateRegions(Store store,
-                                  ArrayRef<SVal> Values,
-                                  const Expr *E, unsigned Count,
-                                  const LocationContext *LCtx,
-                                  const CallEvent *Call,
-                                  InvalidatedSymbols &IS,
-                                  RegionAndSymbolInvalidationTraits &ITraits,
-                                  InvalidatedRegions *InvalidatedTopLevel,
-                                  InvalidatedRegions *Invalidated) = 0;
+  virtual StoreRef
+  invalidateRegions(ProgramStateRef State, Store store, ArrayRef<SVal> Values,
+                    const Expr *E, unsigned Count, const LocationContext *LCtx,
+                    const CallEvent *Call, InvalidatedSymbols &IS,
 
   /// enterStackFrame - Let the StoreManager to do something when execution
   /// engine is about to execute into a callee.
-  StoreRef enterStackFrame(Store store,
+  StoreRef enterStackFrame(ProgramStateRef State, Store store,
                            const CallEvent &Call,
                            const StackFrameContext *CalleeCtx);
 
   /// Finds the transitive closure of symbols within the given region.
   ///
   /// Returns false if the visitor aborted the scan.
   virtual bool scanReachableSymbols(Store S, const MemRegion *R,
                                     ScanReachableSymbols &Visitor) = 0;

clang/lib/StaticAnalyzer/Checkers/CStringChecker.cpp

ProgramStateRef CStringChecker::CheckBufferAccess(CheckerContext &C,
   // Compute the offset of the last element to be accessed: size-1.
   NonLoc One = svalBuilder.makeIntVal(1, SizeTy).castAs<NonLoc>();
   SVal Offset = svalBuilder.evalBinOpNN(State, BO_Sub, *Length, One, SizeTy);
   if (Offset.isUnknown())
     return nullptr;
   NonLoc LastOffset = Offset.castAs<NonLoc>();
 
   // Check that the first buffer is sufficiently long.
-  SVal BufStart =
-      svalBuilder.evalCast(BufVal, PtrTy, Buffer.Expression->getType());
+  SVal BufStart = svalBuilder.evalCast(C.getState(), BufVal, PtrTy,
+                                       Buffer.Expression->getType());
   if (Optional<Loc> BufLoc = BufStart.getAs<Loc>()) {
 
     SVal BufEnd =
         svalBuilder.evalBinOpLN(State, BO_Add, *BufLoc, LastOffset, PtrTy);
 
     State = CheckLocation(C, State, Buffer, BufEnd, Access);
 
     // If the buffer isn't large enough, abort.
ProgramStateRef CStringChecker::CheckOverlap(CheckerContext &C,
   Optional<NonLoc> Length = LengthVal.getAs<NonLoc>();
   if (!Length)
     return state;
 
   // Convert the first buffer's start address to char*.
   // Bail out if the cast fails.
   ASTContext &Ctx = svalBuilder.getContext();
   QualType CharPtrTy = Ctx.getPointerType(Ctx.CharTy);
-  SVal FirstStart =
-      svalBuilder.evalCast(*firstLoc, CharPtrTy, First.Expression->getType());
+  SVal FirstStart = svalBuilder.evalCast(C.getState(), *firstLoc, CharPtrTy,
+                                         First.Expression->getType());
   Optional<Loc> FirstStartLoc = FirstStart.getAs<Loc>();
   if (!FirstStartLoc)
     return state;
 
   // Compute the end of the first buffer. Bail out if THAT fails.
   SVal FirstEnd = svalBuilder.evalBinOpLN(state, BO_Add, *FirstStartLoc,
                                           *Length, CharPtrTy);
   Optional<Loc> FirstEndLoc = FirstEnd.getAs<Loc>();
bool CStringChecker::IsFirstBufInBound(CheckerContext &C,
   // Compute the offset of the last element to be accessed: size-1.
   NonLoc One = svalBuilder.makeIntVal(1, sizeTy).castAs<NonLoc>();
   SVal Offset = svalBuilder.evalBinOpNN(state, BO_Sub, *Length, One, sizeTy);
   if (Offset.isUnknown())
     return true; // cf top comment
   NonLoc LastOffset = Offset.castAs<NonLoc>();
 
   // Check that the first buffer is sufficiently long.
-  SVal BufStart = svalBuilder.evalCast(BufVal, PtrTy, FirstBuf->getType());
+  SVal BufStart =
+      svalBuilder.evalCast(C.getState(), BufVal, PtrTy, FirstBuf->getType());
   Optional<Loc> BufLoc = BufStart.getAs<Loc>();
   if (!BufLoc)
     return true; // cf top comment.
 
   SVal BufEnd =
       svalBuilder.evalBinOpLN(state, BO_Add, *BufLoc, LastOffset, PtrTy);
 
   // Check for out of bound array element access.
if (Offset.isValid() && !Offset.hasSymbolicOffset() &&
     DefinedOrUnknownSVal SizeDV = getDynamicSize(State, BR, svalBuilder);
 
     ProgramStateRef StateWholeReg, StateNotWholeReg;
     std::tie(StateWholeReg, StateNotWholeReg) =
         State->assume(svalBuilder.evalEQ(State, SizeDV, *SizeNL));
 
     // With the semantic of 'memset()', we should convert the CharVal to
     // unsigned char.
-    CharVal = svalBuilder.evalCast(CharVal, Ctx.UnsignedCharTy, Ctx.IntTy);
+    CharVal = svalBuilder.evalCast(C.getState(), CharVal, Ctx.UnsignedCharTy,
+                                   Ctx.IntTy);
 
     ProgramStateRef StateNullChar, StateNonNullChar;
     std::tie(StateNullChar, StateNonNullChar) =
         assumeZero(C, State, CharVal, Ctx.UnsignedCharTy);
 
     if (StateWholeReg && !StateNotWholeReg && StateNullChar &&
         !StateNonNullChar) {
       // If the 'memset()' acts on the whole region of destination buffer and
if (stateNonZeroSize) {
 
     // If this is mempcpy, get the byte after the last byte copied and
     // bind the expr.
     if (IsMempcpy) {
       // Get the byte after the last byte copied.
       SValBuilder &SvalBuilder = C.getSValBuilder();
       ASTContext &Ctx = SvalBuilder.getContext();
       QualType CharPtrTy = Ctx.getPointerType(Ctx.CharTy);
-      SVal DestRegCharVal =
-          SvalBuilder.evalCast(destVal, CharPtrTy, Dest.Expression->getType());
+      SVal DestRegCharVal = SvalBuilder.evalCast(
+          C.getState(), destVal, CharPtrTy, Dest.Expression->getType());
       SVal lastElement = C.getSValBuilder().evalBinOp(
           state, BO_Add, DestRegCharVal, sizeVal, Dest.Expression->getType());
       // If we don't know how much we copied, we can at least
       // conjure a return value for later.
       if (lastElement.isUnknown())
         lastElement = C.getSValBuilder().conjureSymbolVal(nullptr, CE, LCtx,
                                                           C.blockCount());
 
void CStringChecker::evalStrcpyCommon(CheckerContext &C, const CallExpr *CE,
 
   // If the function is strncpy, strncat, etc... it is bounded.
   if (IsBounded) {
     // Get the max number of characters to copy.
     SizeArgExpr lenExpr = {CE->getArg(2), 2};
     SVal lenVal = state->getSVal(lenExpr.Expression, LCtx);
 
     // Protect against misdeclared strncpy().
-    lenVal =
-        svalBuilder.evalCast(lenVal, sizeTy, lenExpr.Expression->getType());
+    lenVal = svalBuilder.evalCast(C.getState(), lenVal, sizeTy,
+                                  lenExpr.Expression->getType());
 
     Optional<NonLoc> lenValNL = lenVal.getAs<NonLoc>();
 
     // If we know both values, we might be able to figure out how much
     // we're copying.
     if (strLengthNL && lenValNL) {
       switch (appendK) {
       case ConcatFnKind::none:

clang/lib/StaticAnalyzer/Checkers/CallAndMessageChecker.cpp

 }
 
 namespace {
 class FindUninitializedField {
 public:
   SmallVector<const FieldDecl *, 10> FieldChain;
 
 private:
+  ProgramStateRef State;
   StoreManager &StoreMgr;
   MemRegionManager &MrMgr;
   Store store;
 
 public:
-  FindUninitializedField(StoreManager &storeMgr, MemRegionManager &mrMgr,
-                         Store s)
-      : StoreMgr(storeMgr), MrMgr(mrMgr), store(s) {}
+  FindUninitializedField(ProgramStateRef State, StoreManager &storeMgr,
+                         MemRegionManager &mrMgr, Store s)
+      : State(State), StoreMgr(storeMgr), MrMgr(mrMgr), store(s) {}
 
   bool Find(const TypedValueRegion *R) {
     QualType T = R->getValueType();
     if (const RecordType *RT = T->getAsStructureType()) {
       const RecordDecl *RD = RT->getDecl()->getDefinition();
       assert(RD && "Referred record has no definition");
       for (const auto *I : RD->fields()) {
         const FieldRegion *FR = MrMgr.getFieldRegion(I, R);
         FieldChain.push_back(I);
         T = I->getType();
         if (T->getAsStructureType()) {
           if (Find(FR))
             return true;
         } else {
-          const SVal &V = StoreMgr.getBinding(store, loc::MemRegionVal(FR));
+          const SVal &V =
+              StoreMgr.getBinding(State, store, loc::MemRegionVal(FR));
           if (V.isUndef())
             return true;
         }
         FieldChain.pop_back();
       }
     }
 
     return false;
if (V.isUndef()) {
     return true;
   }
 
   if (!CheckUninitFields)
     return false;
 
   if (auto LV = V.getAs<nonloc::LazyCompoundVal>()) {
     const LazyCompoundValData *D = LV->getCVData();
-    FindUninitializedField F(C.getState()->getStateManager().getStoreManager(),
-                             C.getSValBuilder().getRegionManager(),
-                             D->getStore());
+    FindUninitializedField F(
+        C.getState(), C.getState()->getStateManager().getStoreManager(),
+        C.getSValBuilder().getRegionManager(), D->getStore());
 
     if (F.Find(D->getRegion())) {
       if (!ChecksEnabled[CK_ArgInitializedness]) {
         C.addSink();
         return true;
       }
       if (ExplodedNode *N = C.generateErrorNode()) {
         LazyInit_BT(BD, BT);

clang/lib/StaticAnalyzer/Checkers/CastValueChecker.cpp

static void addCastTransition(const CallEvent &Call, DefinedOrUnknownSVal DV,
   }
 
   // Store the type and the cast information.
   bool IsKnownCast = CastInfo || IsCheckedCast || CastFromTy == CastToTy;
   if (!IsKnownCast || IsCheckedCast)
     State = setDynamicTypeAndCastInfo(State, MR, CastFromTy, CastToTy,
                                       CastSucceeds);
 
-  SVal V = CastSucceeds ? C.getSValBuilder().evalCast(DV, CastToTy, CastFromTy)
+  SVal V = CastSucceeds ? C.getSValBuilder().evalCast(C.getState(), DV,
+                                                      CastToTy, CastFromTy)
                         : C.getSValBuilder().makeNull();
   C.addTransition(
       State->BindExpr(Call.getOriginExpr(), C.getLocationContext(), V, false),
       getNoteTag(C, CastInfo, CastToTy, Object, CastSucceeds, IsKnownCast));
 }
 
 static void addInstanceOfTransition(const CallEvent &Call,
                                     DefinedOrUnknownSVal DV,

clang/lib/StaticAnalyzer/Checkers/MacOSKeychainAPIChecker.cpp

 /// that value is itself an address, and return the corresponding symbol.
 static SymbolRef getAsPointeeSymbol(const Expr *Expr,
                                     CheckerContext &C) {
   ProgramStateRef State = C.getState();
   SVal ArgV = C.getSVal(Expr);
 
   if (Optional<loc::MemRegionVal> X = ArgV.getAs<loc::MemRegionVal>()) {
     StoreManager& SM = C.getStoreManager();
-    SymbolRef sym = SM.getBinding(State->getStore(), *X).getAsLocSymbol();
+    SymbolRef sym =
+        SM.getBinding(State, State->getStore(), *X).getAsLocSymbol();
     if (sym)
       return sym;
   }
   return nullptr;
 }
 
 // Report deallocator mismatch. Remove the region from tracking - reporting a
 // missing free error after this one is redundant.

clang/lib/StaticAnalyzer/Checkers/StdLibraryFunctionsChecker.cpp

ProgramStateRef StdLibraryFunctionsChecker::ComparisonConstraint::apply(
   QualType T = Summary.getArgType(getArgNo());
   SVal V = getArgSVal(Call, getArgNo());
 
   BinaryOperator::Opcode Op = getOpcode();
   ArgNo OtherArg = getOtherArgNo();
   SVal OtherV = getArgSVal(Call, OtherArg);
   QualType OtherT = Summary.getArgType(OtherArg);
   // Note: we avoid integral promotion for comparison.
-  OtherV = SVB.evalCast(OtherV, T, OtherT);
+  OtherV = SVB.evalCast(C.getState(), OtherV, T, OtherT);
   if (auto CompV = SVB.evalBinOp(State, Op, V, OtherV, CondT)
                        .getAs<DefinedOrUnknownSVal>())
     State = State->assume(*CompV, true);
   return State;
 }
 
 void StdLibraryFunctionsChecker::checkPreCall(const CallEvent &Call,
                                               CheckerContext &C) const {

clang/lib/StaticAnalyzer/Checkers/VLASizeChecker.cpp

ProgramStateRef VLASizeChecker::checkVLA(CheckerContext &C,
   uint64_t KnownSize = 0;
   if (const llvm::APSInt *KV = SVB.getKnownValue(State, ArrSize))
     KnownSize = KV->getZExtValue();
 
   for (const Expr *SizeE : VLASizes) {
     auto SizeD = C.getSVal(SizeE).castAs<DefinedSVal>();
     // Convert the array length to size_t.
     NonLoc IndexLength =
-        SVB.evalCast(SizeD, SizeTy, SizeE->getType()).castAs<NonLoc>();
+        SVB.evalCast(C.getState(), SizeD, SizeTy, SizeE->getType())
+            .castAs<NonLoc>();
     // Multiply the array length by the element size.
     SVal Mul = SVB.evalBinOpNN(State, BO_Mul, ArrSize, IndexLength, SizeTy);
     if (auto MulNonLoc = Mul.getAs<NonLoc>())
       ArrSize = *MulNonLoc;
     else
       // Extent could not be determined.
       return State;
 

clang/lib/StaticAnalyzer/Core/CallEvent.cpp

if (MD->getCanonicalDecl() != getDecl()->getCanonicalDecl()) {
       ThisVal = StateMgr.getStoreManager().attemptDownCast(ThisVal, Ty, Failed);
       if (Failed) {
         // We might have suffered some sort of placement new earlier, so
         // we're constructing in a completely unexpected storage.
         // Fall back to a generic pointer cast for this-value.
         const CXXMethodDecl *StaticMD = cast<CXXMethodDecl>(getDecl());
         const CXXRecordDecl *StaticClass = StaticMD->getParent();
         QualType StaticTy = Ctx.getPointerType(Ctx.getRecordType(StaticClass));
-        ThisVal = SVB.evalCast(ThisVal, Ty, StaticTy);
+        ThisVal = SVB.evalCast(getState(), ThisVal, Ty, StaticTy);
       }
     }
 
     if (!ThisVal.isUnknown())
       Bindings.push_back(std::make_pair(ThisLoc, ThisVal));
   }
 }
 

clang/lib/StaticAnalyzer/Core/CheckerContext.cpp

 
 /// Evaluate comparison and return true if it's known that condition is true
 static bool evalComparison(SVal LHSVal, BinaryOperatorKind ComparisonOp,
                            SVal RHSVal, ProgramStateRef State) {
   if (LHSVal.isUnknownOrUndef())
     return false;
   ProgramStateManager &Mgr = State->getStateManager();
   if (!LHSVal.getAs<NonLoc>()) {
-    LHSVal = Mgr.getStoreManager().getBinding(State->getStore(),
+    LHSVal = Mgr.getStoreManager().getBinding(State, State->getStore(),
                                               LHSVal.castAs<Loc>());
     if (LHSVal.isUnknownOrUndef() || !LHSVal.getAs<NonLoc>())
       return false;
   }
 
   SValBuilder &Bldr = Mgr.getSValBuilder();
   SVal Eval = Bldr.evalBinOp(State, ComparisonOp, LHSVal, RHSVal,
                              Bldr.getConditionType());

clang/lib/StaticAnalyzer/Core/Environment.cpp

SVal Environment::lookupExpr(const EnvironmentEntry &E) const {
   const SVal* X = ExprBindings.lookup(E);
   if (X) {
     SVal V = *X;
     return V;
   }
   return UnknownVal();
 }
 
-SVal Environment::getSVal(const EnvironmentEntry &Entry,
-                          SValBuilder& svalBuilder) const {
+SVal Environment::getSVal(ProgramStateRef State, const EnvironmentEntry &Entry,
+                          SValBuilder &svalBuilder) const {
   const Stmt *S = Entry.getStmt();
   assert(!isa<ObjCForCollectionStmt>(S) &&
          "Use ExprEngine::hasMoreIteration()!");
   assert((isa<Expr>(S) || isa<ReturnStmt>(S)) &&
          "Environment can only argue about Exprs, since only they express "
          "a value! Any non-expression statement stored in Environment is a "
          "result of a hack!");
   const LocationContext *LCtx = Entry.getLocationContext();
SVal Environment::getSVal(ProgramStateRef State, const EnvironmentEntry &Entry,
   case Stmt::ObjCBoolLiteralExprClass:
   case Stmt::CXXNullPtrLiteralExprClass:
   case Stmt::ObjCStringLiteralClass:
   case Stmt::StringLiteralClass:
   case Stmt::TypeTraitExprClass:
   case Stmt::SizeOfPackExprClass:
   case Stmt::PredefinedExprClass:
     // Known constants; defer to SValBuilder.
-    return svalBuilder.getConstantVal(cast<Expr>(S)).getValue();
+    return svalBuilder.getConstantVal(State, cast<Expr>(S)).getValue();
 
   case Stmt::ReturnStmtClass: {
     const auto *RS = cast<ReturnStmt>(S);
     if (const Expr *RE = RS->getRetValue())
-      return getSVal(EnvironmentEntry(RE, LCtx), svalBuilder);
+      return getSVal(State, EnvironmentEntry(RE, LCtx), svalBuilder);
     return UndefinedVal();
   }
 
   // Handle all other Stmt* using a lookup.
   default:
     return lookupExpr(EnvironmentEntry(S, LCtx));
   }
 }

clang/lib/StaticAnalyzer/Core/ExprEngine.cpp

case Stmt::CXXDefaultInitExprClass: {
         llvm_unreachable("unknown constant wrapper kind");
 
       bool IsTemporary = false;
       if (const auto *MTE = dyn_cast<MaterializeTemporaryExpr>(ArgE)) {
         ArgE = MTE->getSubExpr();
         IsTemporary = true;
       }
 
-      Optional<SVal> ConstantVal = svalBuilder.getConstantVal(ArgE);
+      Optional<SVal> ConstantVal =
+          svalBuilder.getConstantVal(Pred->getState(), ArgE);
       if (!ConstantVal)
         ConstantVal = UnknownVal();
 
       const LocationContext *LCtx = Pred->getLocationContext();
       for (const auto I : PreVisit) {
         ProgramStateRef State = I->getState();
         State = State->BindExpr(S, LCtx, *ConstantVal);
         if (IsTemporary)

clang/lib/StaticAnalyzer/Core/ExprEngineC.cpp

for (ExplodedNodeSet::iterator I = Tmp.begin(), E = Tmp.end(); I != E;
 
       QualType CLHSTy =
         cast<CompoundAssignOperator>(B)->getComputationLHSType();
       CLHSTy = getContext().getCanonicalType(CLHSTy);
 
       QualType LTy = getContext().getCanonicalType(LHS->getType());
 
       // Promote LHS.
-      V = svalBuilder.evalCast(V, CLHSTy, LTy);
+      V = svalBuilder.evalCast(state, V, CLHSTy, LTy);
 
       // Compute the result of the operation.
-      SVal Result = svalBuilder.evalCast(evalBinOp(state, Op, V, RightV, CTy),
-                                         B->getType(), CTy);
+      SVal Result = svalBuilder.evalCast(
+          state, evalBinOp(state, Op, V, RightV, CTy), B->getType(), CTy);
 
       // EXPERIMENTAL: "Conjured" symbols.
       // FIXME: Handle structs.
 
       SVal LHSVal;
 
       if (Result.isUnknown()) {
         // The symbolic value is actually for the type of the left-hand side
         // expression, not the computation type, as this is the value the
         // LValue on the LHS will bind to.
         LHSVal = svalBuilder.conjureSymbolVal(nullptr, B->getRHS(), LCtx, LTy,
                                               currBldrCtx->blockCount());
         // However, we need to convert the symbol to the computation type.
-        Result = svalBuilder.evalCast(LHSVal, CTy, LTy);
+        Result = svalBuilder.evalCast(state, LHSVal, CTy, LTy);
       }
       else {
         // The left-hand side may bind to a different value then the
         // computation type.
-        LHSVal = svalBuilder.evalCast(Result, LTy, CTy);
+        LHSVal = svalBuilder.evalCast(state, Result, LTy, CTy);
       }
 
       // In C++, assignment and compound assignment operators return an
       // lvalue.
       if (B->isGLValue())
         state = state->BindExpr(B, LCtx, location);
       else
         state = state->BindExpr(B, LCtx, Result);
if (T->isLValueReferenceType()) {
     assert(!CastE->getType()->isLValueReferenceType());
     ExTy = getContext().getLValueReferenceType(ExTy);
   } else if (T->isRValueReferenceType()) {
     assert(!CastE->getType()->isRValueReferenceType());
     ExTy = getContext().getRValueReferenceType(ExTy);
   }
   // Delegate to SValBuilder to process.
   SVal OrigV = state->getSVal(Ex, LCtx);
-  SVal V = svalBuilder.evalCast(OrigV, T, ExTy);
+  SVal V = svalBuilder.evalCast(state, OrigV, T, ExTy);
   // Negate the result if we're treating the boolean as a signed i1
   if (CastE->getCastKind() == CK_BooleanToSignedIntegral)
     V = evalMinus(V);
   state = state->BindExpr(CastE, LCtx, V);
   if (V.isUnknown() && !OrigV.isUnknown()) {
     state = escapeValues(state, OrigV, PSK_EscapeOther);
   }
   Bldr.generateNode(CastE, Pred, state);
else {
 
     if (RHSVal.isUndef()) {
       X = RHSVal;
     } else {
       // We evaluate "RHSVal != 0" expression which result in 0 if the value is
       // known to be false, 1 if the value is known to be true and a new symbol
       // when the assumption is unknown.
       nonloc::ConcreteInt Zero(getBasicVals().getValue(0, B->getType()));
-      X = evalBinOp(N->getState(), BO_NE,
-                    svalBuilder.evalCast(RHSVal, B->getType(), RHS->getType()),
-                    Zero, B->getType());
+      X = evalBinOp(
+          N->getState(), BO_NE,
+          svalBuilder.evalCast(state, RHSVal, B->getType(), RHS->getType()),
     }
   }
   Bldr.generateNode(B, Pred, state->BindExpr(B, Pred->getLocationContext(), X));
 }
 
 void ExprEngine::VisitInitListExpr(const InitListExpr *IE,
                                    ExplodedNode *Pred,
                                    ExplodedNodeSet &Dst) {

clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp

void ExprEngine::VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred,
 
   // FIXME: Once we have proper support for CXXConstructExprs inside
   // CXXNewExpr, we need to make sure that the constructed object is not
   // immediately invalidated here. (The placement call should happen before
   // the constructor call anyway.)
   if (FD && FD->isReservedGlobalPlacementOperator()) {
     // Non-array placement new should always return the placement location.
     SVal PlacementLoc = State->getSVal(CNE->getPlacementArg(0), LCtx);
-    Result = svalBuilder.evalCast(PlacementLoc, CNE->getType(),
+    Result = svalBuilder.evalCast(State, PlacementLoc, CNE->getType(),
                                   CNE->getPlacementArg(0)->getType());
   }
 
   // Bind the address of the object, then check to see if we cached out.
   State = State->BindExpr(CNE, LCtx, Result);
   ExplodedNode *NewN = Bldr.generateNode(CNE, Pred, State);
   if (!NewN)
     return;

clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp

if (CE) {
     if (const auto *CNE = dyn_cast<CXXNewExpr>(CE)) {
       // We are currently evaluating a CXXNewAllocator CFGElement. It takes a
       // while to reach the actual CXXNewExpr element from here, so keep the
       // region for later use.
       // Additionally cast the return value of the inlined operator new
       // (which is of type 'void *') to the correct object type.
       SVal AllocV = state->getSVal(CNE, callerCtx);
       AllocV = svalBuilder.evalCast(
-          AllocV, CNE->getType(),
+          state, AllocV, CNE->getType(),
           getContext().getPointerType(getContext().VoidTy));
 
       state = addObjectUnderConstruction(state, CNE, calleeCtx->getParent(),
                                          AllocV);
     }
   }
 
   // Step 3: BindedRetNode -> CleanedNodes

clang/lib/StaticAnalyzer/Core/ProgramState.cpp

ProgramStateRef ProgramStateManager::removeDeadBindingsFromEnvironmentAndStore(
   // those around.  This code more than likely can be made faster, and the
   // frequency of which this method is called should be experimented with
   // for optimum performance.
   ProgramState NewState = *state;
 
   NewState.Env = EnvMgr.removeDeadBindings(NewState.Env, SymReaper, state);
 
   // Clean up the store.
-  StoreRef newStore = StoreMgr->removeDeadBindings(NewState.getStore(), LCtx,
-                                                   SymReaper);
+  StoreRef newStore =
+      StoreMgr->removeDeadBindings(state, NewState.getStore(), LCtx, SymReaper);
   NewState.setStore(newStore);
   SymReaper.setReapedStore(newStore);
 
   return getPersistentState(NewState);
 }
 
 ProgramStateRef ProgramState::bindLoc(Loc LV,
                                       SVal V,
                                       const LocationContext *LCtx,
                                       bool notifyChanges) const {
   ProgramStateManager &Mgr = getStateManager();
-  ProgramStateRef newState = makeWithStore(Mgr.StoreMgr->Bind(getStore(),
-                                                             LV, V));
+  ProgramStateRef newState =
+      makeWithStore(Mgr.StoreMgr->Bind(this, getStore(), LV, V));
   const MemRegion *MR = LV.getAsRegion();
   if (MR && notifyChanges)
     return Mgr.getOwningEngine().processRegionChange(newState, MR, LCtx);
 
   return newState;
 }
 
 ProgramStateRef
if (!IS)
     IS = &InvalidatedSyms;
 
   RegionAndSymbolInvalidationTraits ITraitsLocal;
   if (!ITraits)
     ITraits = &ITraitsLocal;
 
   StoreManager::InvalidatedRegions TopLevelInvalidated;
   StoreManager::InvalidatedRegions Invalidated;
-  const StoreRef &newStore
-  = Mgr.StoreMgr->invalidateRegions(getStore(), Values, E, Count, LCtx, Call,
-                                    *IS, *ITraits, &TopLevelInvalidated,
-                                    &Invalidated);
+  const StoreRef &newStore = Mgr.StoreMgr->invalidateRegions(
+      this, getStore(), Values, E, Count, LCtx, Call, *IS, *ITraits,
+      &TopLevelInvalidated, &Invalidated);
 
   ProgramStateRef newState = makeWithStore(newStore);
 
   if (CausedByPointerEscape) {
     newState = Eng.notifyCheckersOfPointerEscape(newState, IS,
                                                  TopLevelInvalidated,
                                                  Call,
                                                  *ITraits);
if (newStore.getStore() == OldStore)
     return this;
 
   return makeWithStore(newStore);
 }
 
 ProgramStateRef
 ProgramState::enterStackFrame(const CallEvent &Call,
                               const StackFrameContext *CalleeCtx) const {
-  const StoreRef &NewStore =
-    getStateManager().StoreMgr->enterStackFrame(getStore(), Call, CalleeCtx);
+  const StoreRef &NewStore = getStateManager().StoreMgr->enterStackFrame(
+      this, getStore(), Call, CalleeCtx);
   return makeWithStore(NewStore);
 }
 
 SVal ProgramState::getSelfSVal(const LocationContext *LCtx) const {
   const ImplicitParamDecl *SelfDecl = LCtx->getSelfDecl();
   if (!SelfDecl)
     return SVal();
   return getSVal(getRegion(SelfDecl, LCtx));

clang/lib/StaticAnalyzer/Core/RegionStore.cpp

public:
   //===-------------------------------------------------------------------===//
   RegionBindingsRef invalidateGlobalRegion(MemRegion::Kind K,
                                            const Expr *Ex,
                                            unsigned Count,
                                            const LocationContext *LCtx,
                                            RegionBindingsRef B,
                                            InvalidatedRegions *Invalidated);
 
-  StoreRef invalidateRegions(Store store,
-                             ArrayRef<SVal> Values,
-                             const Expr *E, unsigned Count,
-                             const LocationContext *LCtx,
-                             const CallEvent *Call,
-                             InvalidatedSymbols &IS,
+  StoreRef invalidateRegions(ProgramStateRef State, Store store,
+                             ArrayRef<SVal> Values, const Expr *E,
+                             unsigned Count, const LocationContext *LCtx,
+                             const CallEvent *Call, InvalidatedSymbols &IS,
                              RegionAndSymbolInvalidationTraits &ITraits,
                              InvalidatedRegions *Invalidated,
                              InvalidatedRegions *InvalidatedTopLevel) override;
 
   bool scanReachableSymbols(Store S, const MemRegion *R,
                             ScanReachableSymbols &Callbacks) override;
 
   RegionBindingsRef removeSubRegionBindings(RegionBindingsConstRef B,
                                             const SubRegion *R);
 
 public: // Part of public interface to class.
-
-  StoreRef Bind(Store store, Loc LV, SVal V) override {
-    return StoreRef(bind(getRegionBindings(store), LV, V).asStore(), *this);
+  StoreRef Bind(ProgramStateRef State, Store store, Loc LV, SVal V) override {
+    return StoreRef(bind(State, getRegionBindings(store), LV, V).asStore(),
+                    *this);
   }
 
-  RegionBindingsRef bind(RegionBindingsConstRef B, Loc LV, SVal V);
+  RegionBindingsRef bind(ProgramStateRef State, RegionBindingsConstRef B,
+                         Loc LV, SVal V);
 
   // BindDefaultInitial is only used to initialize a region with
   // a default value.
   StoreRef BindDefaultInitial(Store store, const MemRegion *R,
                               SVal V) override {
     RegionBindingsRef B = getRegionBindings(store);
     // Use other APIs when you have to wipe the region that was initialized
     // earlier.
public: // Part of public interface to class.
   ///
   /// This path is used when it seems advantageous to "force" loading the values
   /// within a LazyCompoundVal to bind memberwise to the struct region, rather
   /// than using a Default binding at the base of the entire region. This is a
   /// heuristic attempting to avoid building long chains of LazyCompoundVals.
   ///
   /// \returns The updated store bindings, or \c None if binding non-lazily
   ///          would be too expensive.
-  Optional<RegionBindingsRef> tryBindSmallStruct(RegionBindingsConstRef B,
+  Optional<RegionBindingsRef> tryBindSmallStruct(ProgramStateRef State,
+                                                 RegionBindingsConstRef B,
                                                  const TypedValueRegion *R,
                                                  const RecordDecl *RD,
                                                  nonloc::LazyCompoundVal LCV);
 
   /// BindStruct - Bind a compound value to a structure.
-  RegionBindingsRef bindStruct(RegionBindingsConstRef B,
-                               const TypedValueRegion* R, SVal V);
+  RegionBindingsRef bindStruct(ProgramStateRef State, RegionBindingsConstRef B,
+                               const TypedValueRegion *R, SVal V);
 
   /// BindVector - Bind a compound value to a vector.
-  RegionBindingsRef bindVector(RegionBindingsConstRef B,
-                               const TypedValueRegion* R, SVal V);
+  RegionBindingsRef bindVector(ProgramStateRef State, RegionBindingsConstRef B,
+                               const TypedValueRegion *R, SVal V);
 
-  RegionBindingsRef bindArray(RegionBindingsConstRef B,
-                              const TypedValueRegion* R,
-                              SVal V);
+  RegionBindingsRef bindArray(ProgramStateRef State, RegionBindingsConstRef B,
+                              const TypedValueRegion *R, SVal V);
 
   /// Clears out all bindings in the given region and assigns a new value
   /// as a Default binding.
   RegionBindingsRef bindAggregate(RegionBindingsConstRef B,
                                   const TypedRegion *R,
                                   SVal DefaultVal);
 
   /// Create a new store with the specified binding removed.
public: // Part of public interface to class.
   ///     return L's binding
   ///   else if L is in killset
   ///     return unknown
   ///   else
   ///     if L is on stack or heap
   ///       return undefined
   ///     else
   ///       return symbolic
-  SVal getBinding(Store S, Loc L, QualType T) override {
-    return getBinding(getRegionBindings(S), L, T);
+  SVal getBinding(ProgramStateRef State, Store S, Loc L, QualType T) override {
+    return getBinding(State, getRegionBindings(S), L, T);
   }
 
   Optional<SVal> getDefaultBinding(Store S, const MemRegion *R) override {
     RegionBindingsRef B = getRegionBindings(S);
     // Default bindings are always applied over a base region so look up the
     // base region's default binding, otherwise the lookup will fail when R
     // is at an offset from R->getBaseRegion().
     return B.getDefaultBinding(R->getBaseRegion());
   }
 
-  SVal getBinding(RegionBindingsConstRef B, Loc L, QualType T = QualType());
+  SVal getBinding(ProgramStateRef State, RegionBindingsConstRef B, Loc L,
+                  QualType T = QualType());
 
-  SVal getBindingForElement(RegionBindingsConstRef B, const ElementRegion *R);
+  SVal getBindingForElement(ProgramStateRef State, RegionBindingsConstRef B,
+                            const ElementRegion *R);
 
-  SVal getBindingForField(RegionBindingsConstRef B, const FieldRegion *R);
+  SVal getBindingForField(ProgramStateRef State, RegionBindingsConstRef B,
+                          const FieldRegion *R);
 
   SVal getBindingForObjCIvar(RegionBindingsConstRef B, const ObjCIvarRegion *R);
 
-  SVal getBindingForVar(RegionBindingsConstRef B, const VarRegion *R);
+  SVal getBindingForVar(ProgramStateRef State, RegionBindingsConstRef B,
+                        const VarRegion *R);
 
   SVal getBindingForLazySymbol(const TypedValueRegion *R);
 
-  SVal getBindingForFieldOrElementCommon(RegionBindingsConstRef B,
+  SVal getBindingForFieldOrElementCommon(ProgramStateRef State,
+                                         RegionBindingsConstRef B,
                                          const TypedValueRegion *R,
                                          QualType Ty);
 
-  SVal getLazyBinding(const SubRegion *LazyBindingRegion,
+  SVal getLazyBinding(ProgramStateRef State, const SubRegion *LazyBindingRegion,
                       RegionBindingsRef LazyBinding);
 
   /// Get bindings for the values in a struct and return a CompoundVal, used
   /// when doing struct copy:
   /// struct s x, y;
   /// x = y;
   /// y's value is retrieved by this method.
   SVal getBindingForStruct(RegionBindingsConstRef B, const TypedValueRegion *R);
public: // Part of public interface to class.
   const SValListTy &getInterestingValues(nonloc::LazyCompoundVal LCV);
 
   //===------------------------------------------------------------------===//
   // State pruning.
   //===------------------------------------------------------------------===//
 
   /// removeDeadBindings - Scans the RegionStore of 'state' for dead values.
   ///  It returns a new Store with these values removed.
-  StoreRef removeDeadBindings(Store store, const StackFrameContext *LCtx,
-                              SymbolReaper& SymReaper) override;
+  StoreRef removeDeadBindings(ProgramStateRef State, Store store,
+                              const StackFrameContext *LCtx,
+                              SymbolReaper &SymReaper) override;
 
   //===------------------------------------------------------------------===//
   // Utility methods.
   //===------------------------------------------------------------------===//
 
   RegionBindingsRef getRegionBindings(Store store) const {
     llvm::PointerIntPair<Store, 1, bool> Ptr;
     Ptr.setFromOpaqueValue(const_cast<void *>(store));
bool AddToWorkList(WorkListElement E, const ClusterBindings *C) {
     WL.push_back(E);
     return true;
   }
 
   bool AddToWorkList(const MemRegion *R) {
     return static_cast<DERIVED*>(this)->AddToWorkList(R);
   }
 
-  void RunWorkList() {
+  void RunWorkList(ProgramStateRef State) {
     while (!WL.empty()) {
       WorkListElement E = WL.pop_back_val();
       const MemRegion *BaseR = E;
 
-      static_cast<DERIVED*>(this)->VisitCluster(BaseR, getCluster(BaseR));
+      static_cast<DERIVED *>(this)->VisitCluster(State, BaseR,
+                                                 getCluster(BaseR));
     }
   }
 
   void VisitAddedToCluster(const MemRegion *baseR, const ClusterBindings &C) {}
-  void VisitCluster(const MemRegion *baseR, const ClusterBindings *C) {}
+  void VisitCluster(ProgramStateRef State, const MemRegion *baseR,
+                    const ClusterBindings *C) {}
 
-  void VisitCluster(const MemRegion *BaseR, const ClusterBindings *C,
-                    bool Flag) {
-    static_cast<DERIVED*>(this)->VisitCluster(BaseR, C);
+  void VisitCluster(ProgramStateRef State, const MemRegion *BaseR,
+                    const ClusterBindings *C, bool Flag) {
+    static_cast<DERIVED *>(this)->VisitCluster(State, BaseR, C);
   }
 };
 }
 
 //===----------------------------------------------------------------------===//
 // Binding invalidation.
 //===----------------------------------------------------------------------===//
 
InvalidateRegionsWorker(RegionStoreManager &rm,
                           InvalidatedSymbols &is,
                           RegionAndSymbolInvalidationTraits &ITraitsIn,
                           StoreManager::InvalidatedRegions *r,
                           GlobalsFilterKind GFK)
      : ClusterAnalysis<InvalidateRegionsWorker>(rm, stateMgr, b),
        Ex(ex), Count(count), LCtx(lctx), IS(is), ITraits(ITraitsIn), Regions(r),
        GlobalsFilter(GFK) {}
 
-  void VisitCluster(const MemRegion *baseR, const ClusterBindings *C);
+  void VisitCluster(ProgramStateRef State, const MemRegion *baseR,
+                    const ClusterBindings *C);
   void VisitBinding(SVal V);
 
   using ClusterAnalysis::AddToWorkList;
 
   bool AddToWorkList(const MemRegion *R);
 
   /// Returns true if all clusters in the memory space for \p Base should be
   /// be invalidated.
for (RegionStoreManager::SValListTy::const_iterator I = Vals.begin(),
                                                         E = Vals.end();
          I != E; ++I)
       VisitBinding(*I);
 
     return;
   }
 }
 
-void InvalidateRegionsWorker::VisitCluster(const MemRegion *baseR,
+void InvalidateRegionsWorker::VisitCluster(ProgramStateRef State,
+                                           const MemRegion *baseR,
                                            const ClusterBindings *C) {
 
   bool PreserveRegionsContents =
       ITraits.hasTrait(baseR,
                        RegionAndSymbolInvalidationTraits::TK_PreserveContents);
 
   if (C) {
     for (ClusterBindings::iterator I = C->begin(), E = C->end(); I != E; ++I)
for (BlockDataRegion::referenced_vars_iterator
         AddToWorkList(VR);
       }
       else if (Loc::isLocType(VR->getValueType())) {
         // Map the current bindings to a Store to retrieve the value
         // of the binding.  If that binding itself is a region, we should
         // invalidate that region.  This is because a block may capture
         // a pointer value, but the thing pointed by that pointer may
         // get invalidated.
-        SVal V = RM.getBinding(B, loc::MemRegionVal(VR));
+        SVal V = RM.getBinding(State, B, loc::MemRegionVal(VR));
         if (Optional<Loc> L = V.getAs<Loc>()) {
           if (const MemRegion *LR = L->getAsRegion())
             AddToWorkList(LR);
         }
       }
     }
     return;
   }
if (const MemRegion *R = V.getAsRegion()) {
       if (TopLevelRegions)
         TopLevelRegions->push_back(R);
       W.AddToWorkList(R);
       continue;
     }
   }
 }
 
-StoreRef
-RegionStoreManager::invalidateRegions(Store store,
-                                     ArrayRef<SVal> Values,
-                                     const Expr *Ex, unsigned Count,
-                                     const LocationContext *LCtx,
-                                     const CallEvent *Call,
-                                     InvalidatedSymbols &IS,
-                                     RegionAndSymbolInvalidationTraits &ITraits,
-                                     InvalidatedRegions *TopLevelRegions,
-                                     InvalidatedRegions *Invalidated) {
+StoreRef RegionStoreManager::invalidateRegions(
+    ProgramStateRef State, Store store, ArrayRef<SVal> Values, const Expr *Ex,
+    unsigned Count, const LocationContext *LCtx, const CallEvent *Call,
+    InvalidatedSymbols &IS, RegionAndSymbolInvalidationTraits &ITraits,
+    InvalidatedRegions *TopLevelRegions, InvalidatedRegions *Invalidated) {
   GlobalsFilterKind GlobalsFilter;
   if (Call) {
     if (Call->isInSystemHeader())
       GlobalsFilter = GFK_SystemOnly;
     else
       GlobalsFilter = GFK_All;
   } else {
     GlobalsFilter = GFK_None;
   }
 
   RegionBindingsRef B = getRegionBindings(store);
   InvalidateRegionsWorker W(*this, StateMgr, B, Ex, Count, LCtx, IS, ITraits,
                             Invalidated, GlobalsFilter);
 
   // Scan the bindings and generate the clusters.
   W.GenerateClusters();
 
   // Add the regions to the worklist.
   populateWorkList(W, Values, TopLevelRegions);
 
-  W.RunWorkList();
+  W.RunWorkList(State);
 
   // Return the new bindings.
   B = W.getRegionBindings();
 
   // For calls, determine which global regions should be invalidated and
   // invalidate them. (Note that function-static and immutable globals are never
   // invalidated by this.)
   // TODO: This could possibly be more precise with modules.
SVal RegionStoreManager::ArrayToPointer(Loc Array, QualType T) {
   NonLoc ZeroIdx = svalBuilder.makeZeroArrayIndex();
   return loc::MemRegionVal(MRMgr.getElementRegion(T, ZeroIdx, R, Ctx));
 }
 
 //===----------------------------------------------------------------------===//
 // Loading values from regions.
 //===----------------------------------------------------------------------===//
 
-SVal RegionStoreManager::getBinding(RegionBindingsConstRef B, Loc L, QualType T) {
+SVal RegionStoreManager::getBinding(ProgramStateRef State,
+                                    RegionBindingsConstRef B, Loc L,
+                                    QualType T) {
   assert(!L.getAs<UnknownVal>() && "location unknown");
   assert(!L.getAs<UndefinedVal>() && "location undefined");
 
   // For access to concrete addresses, return UnknownVal.  Checks
   // for null dereferences (and similar errors) are done by checkers, not
   // the Store.
   // FIXME: We can consider lazily symbolicating such memory, but we really
   // should defer this when we can reason easily about symbolicating arrays
else
       return UnknownVal();
   }
 
   // FIXME: handle Vector types.
   if (RTy->isVectorType())
     return UnknownVal();
 
   if (const FieldRegion* FR = dyn_cast<FieldRegion>(R))
-    return svalBuilder.evalCast(getBindingForField(B, FR), T);
+    return svalBuilder.evalCast(State, getBindingForField(State, B, FR), T);
 
   if (const ElementRegion* ER = dyn_cast<ElementRegion>(R)) {
     // FIXME: Here we actually perform an implicit conversion from the loaded
     // value to the element type.  Eventually we want to compose these values
     // more intelligently.  For example, an 'element' can encompass multiple
     // bound regions (e.g., several bound bytes), or could be a subset of
     // a larger value.
-    return svalBuilder.evalCast(getBindingForElement(B, ER), T);
+    return svalBuilder.evalCast(State, getBindingForElement(State, B, ER), T);
   }
 
   if (const ObjCIvarRegion *IVR = dyn_cast<ObjCIvarRegion>(R)) {
     // FIXME: Here we actually perform an implicit conversion from the loaded
     // value to the ivar type.  What we should model is stores to ivars
     // that blow past the extent of the ivar.  If the address of the ivar is
     // reinterpretted, it is possible we stored a different value that could
     // fit within the ivar.  Either we need to cast these when storing them
     // or reinterpret them lazily (as we do here).
-    return svalBuilder.evalCast(getBindingForObjCIvar(B, IVR), T);
+    return svalBuilder.evalCast(State, getBindingForObjCIvar(B, IVR), T);
   }
 
   if (const VarRegion *VR = dyn_cast<VarRegion>(R)) {
     // FIXME: Here we actually perform an implicit conversion from the loaded
     // value to the variable type.  What we should model is stores to variables
     // that blow past the extent of the variable.  If the address of the
     // variable is reinterpretted, it is possible we stored a different value
     // that could fit within the variable.  Either we need to cast these when
     // storing them or reinterpret them lazily (as we do here).
-    return svalBuilder.evalCast(getBindingForVar(B, VR), T);
+    return svalBuilder.evalCast(State, getBindingForVar(State, B, VR), T);
   }
 
   const SVal *V = B.lookup(R, BindingKey::Direct);
 
   // Check if the region has a binding.
   if (V)
     return *V;
 
if (const ElementRegion *ER = dyn_cast<ElementRegion>(R)) {
     if (Result.second)
       Result.second = MRMgr.getCXXBaseObjectRegionWithSuper(BaseReg,
                                                             Result.second);
   }
 
   return Result;
 }
 
-SVal RegionStoreManager::getBindingForElement(RegionBindingsConstRef B,
-                                              const ElementRegion* R) {
+SVal RegionStoreManager::getBindingForElement(ProgramStateRef State,
+                                              RegionBindingsConstRef B,
+                                              const ElementRegion *R) {
   // Check if the region has a binding.
   if (const Optional<SVal> &V = B.getDirectBinding(R))
     return *V;
 
   const MemRegion* superR = R->getSuperRegion();
 
   // Check if the region is an element region of a string literal.
   if (const StringRegion *StrR = dyn_cast<StringRegion>(superR)) {
if (VD->getType().isConstQualified() ||
               if (CAT->getSize().sle(i))
                 return UndefinedVal();
 
             // If there is a list, but no init, it must be zero.
             if (i >= InitList->getNumInits())
               return svalBuilder.makeZeroVal(R->getElementType());
 
             if (const Expr *ElemInit = InitList->getInit(i))
-              if (Optional<SVal> V = svalBuilder.getConstantVal(ElemInit))
+              if (Optional<SVal> V =
+                      svalBuilder.getConstantVal(State, ElemInit))
                 return *V;
           }
         }
       }
     }
   }
 
   // Check for loads from a code text region.  For such loads, just give up.
if (baseT->isScalarType()) {
             // Other cases: give up.  We are indexing into a larger object
             // that has some value, but we don't know how to handle that yet.
             return UnknownVal();
           }
         }
       }
     }
   }
-  return getBindingForFieldOrElementCommon(B, R, R->getElementType());
+  return getBindingForFieldOrElementCommon(State, B, R, R->getElementType());
 }
 
-SVal RegionStoreManager::getBindingForField(RegionBindingsConstRef B,
-                                            const FieldRegion* R) {
+SVal RegionStoreManager::getBindingForField(ProgramStateRef State,
+                                            RegionBindingsConstRef B,
+                                            const FieldRegion *R) {
 
   // Check if the region has a binding.
   if (const Optional<SVal> &V = B.getDirectBinding(R))
     return *V;
 
   // Is the field declared constant and has an in-class initializer?
   const FieldDecl *FD = R->getDecl();
   QualType Ty = FD->getType();
   if (Ty.isConstQualified())
     if (const Expr *Init = FD->getInClassInitializer())
-      if (Optional<SVal> V = svalBuilder.getConstantVal(Init))
+      if (Optional<SVal> V = svalBuilder.getConstantVal(State, Init))
         return *V;
 
   // If the containing record was initialized, try to get its constant value.
   const MemRegion* superR = R->getSuperRegion();
   if (const auto *VR = dyn_cast<VarRegion>(superR)) {
     const VarDecl *VD = VR->getDecl();
     QualType RecordVarTy = VD->getType();
     unsigned Index = FD->getFieldIndex();
     // Either the record variable or the field has an initializer that we can
     // trust. We trust initializers of constants and, additionally, respect
     // initializers of globals when analyzing main().
     if (RecordVarTy.isConstQualified() || Ty.isConstQualified() ||
         (B.isMainAnalysis() && VD->hasGlobalStorage()))
       if (const Expr *Init = VD->getAnyInitializer())
         if (const auto *InitList = dyn_cast<InitListExpr>(Init)) {
           if (Index < InitList->getNumInits()) {
             if (const Expr *FieldInit = InitList->getInit(Index))
-              if (Optional<SVal> V = svalBuilder.getConstantVal(FieldInit))
+              if (Optional<SVal> V =
+                      svalBuilder.getConstantVal(State, FieldInit))
                 return *V;
           } else {
             return svalBuilder.makeZeroVal(Ty);
           }
         }
   }
 
-  return getBindingForFieldOrElementCommon(B, R, Ty);
+  return getBindingForFieldOrElementCommon(State, B, R, Ty);
 }
 
 Optional<SVal>
 RegionStoreManager::getBindingForDerivedDefaultValue(RegionBindingsConstRef B,
                                                      const MemRegion *superR,
                                                      const TypedValueRegion *R,
                                                      QualType Ty) {
 
if (val.getAs<nonloc::LazyCompoundVal>() ||
       return val;
 
     llvm_unreachable("Unknown default value");
   }
 
   return None;
 }
 
-SVal RegionStoreManager::getLazyBinding(const SubRegion *LazyBindingRegion,
+SVal RegionStoreManager::getLazyBinding(ProgramStateRef State,
+                                        const SubRegion *LazyBindingRegion,
                                         RegionBindingsRef LazyBinding) {
   SVal Result;
   if (const ElementRegion *ER = dyn_cast<ElementRegion>(LazyBindingRegion))
-    Result = getBindingForElement(LazyBinding, ER);
+    Result = getBindingForElement(State, LazyBinding, ER);
   else
-    Result = getBindingForField(LazyBinding,
+    Result = getBindingForField(State, LazyBinding,
                                 cast<FieldRegion>(LazyBindingRegion));
 
   // FIXME: This is a hack to deal with RegionStore's inability to distinguish a
   // default value for /part/ of an aggregate from a default value for the
   // /entire/ aggregate. The most common case of this is when struct Outer
   // has as its first member a struct Inner, which is copied in from a stack
   // variable. In this case, even if the Outer's default value is symbolic, 0,
   // or unknown, it gets overridden by the Inner's default value of undefined.
   //
   // This is a general problem -- if the Inner is zero-initialized, the Outer
   // will now look zero-initialized. The proper way to solve this is with a
   // new version of RegionStore that tracks the extent of a binding as well
   // as the offset.
   //
   // This hack only takes care of the undefined case because that can very
   // quickly result in a warning.
   if (Result.isUndef())
     Result = UnknownVal();
 
   return Result;
 }
 
-SVal
-RegionStoreManager::getBindingForFieldOrElementCommon(RegionBindingsConstRef B,
-                                                      const TypedValueRegion *R,
-                                                      QualType Ty) {
+SVal RegionStoreManager::getBindingForFieldOrElementCommon(
+    ProgramStateRef State, RegionBindingsConstRef B, const TypedValueRegion *R,
 
   // At this point we have already checked in either getBindingForElement or
   // getBindingForField if 'R' has a direct binding.
 
   // Lazy binding?
   Store lazyBindingStore = nullptr;
   const SubRegion *lazyBindingRegion = nullptr;
   std::tie(lazyBindingStore, lazyBindingRegion) = findLazyBinding(B, R, R);
   if (lazyBindingRegion)
-    return getLazyBinding(lazyBindingRegion,
+    return getLazyBinding(State, lazyBindingRegion,
                           getRegionBindings(lazyBindingStore));
 
   // Record whether or not we see a symbolic index.  That can completely
   // be out of scope of our lookup.
   bool hasSymbolicIndex = false;
 
   // FIXME: This is a hack to deal with RegionStore's inability to distinguish a
   // default value for /part/ of an aggregate from a default value for the
if (const Optional<SVal> &V = B.getDefaultBinding(superR)) {
 
     // Other cases: give up.
     return UnknownVal();
   }
 
   return getBindingForLazySymbol(R);
 }
 
-SVal RegionStoreManager::getBindingForVar(RegionBindingsConstRef B,
+SVal RegionStoreManager::getBindingForVar(ProgramStateRef State,
+                                          RegionBindingsConstRef B,
                                           const VarRegion *R) {
 
   // Check if the region has a binding.
   if (Optional<SVal> V = B.getDirectBinding(R))
     return *V;
 
   if (Optional<SVal> V = B.getDefaultBinding(R))
     return *V;
 
   // Lazily derive a value for the VarRegion.
   const VarDecl *VD = R->getDecl();
   const MemSpaceRegion *MS = R->getMemorySpace();
 
   // Arguments are always symbolic.
   if (isa<StackArgumentsSpaceRegion>(MS))
     return svalBuilder.getRegionValueSymbolVal(R);
 
   // Is 'VD' declared constant?  If so, retrieve the constant value.
   if (VD->getType().isConstQualified()) {
     if (const Expr *Init = VD->getAnyInitializer()) {
-      if (Optional<SVal> V = svalBuilder.getConstantVal(Init))
+      if (Optional<SVal> V = svalBuilder.getConstantVal(State, Init))
         return *V;
 
       // If the variable is const qualified and has an initializer but
       // we couldn't evaluate initializer to a value, treat the value as
       // unknown.
       return UnknownVal();
     }
   }
 
   // This must come after the check for constants because closure-captured
   // constant variables may appear in UnknownSpaceRegion.
   if (isa<UnknownSpaceRegion>(MS))
     return svalBuilder.getRegionValueSymbolVal(R);
 
   if (isa<GlobalsSpaceRegion>(MS)) {
     QualType T = VD->getType();
 
     // If we're in main(), then global initializers have not become stale yet.
     if (B.isMainAnalysis())
       if (const Expr *Init = VD->getAnyInitializer())
-        if (Optional<SVal> V = svalBuilder.getConstantVal(Init))
+        if (Optional<SVal> V = svalBuilder.getConstantVal(State, Init))
           return *V;
 
     // Function-scoped static variables are default-initialized to 0; if they
     // have an initializer, it would have been processed by now.
     // FIXME: This is only true when we're starting analysis from main().
     // We're losing a lot of coverage here.
     if (isa<StaticGlobalSpaceRegion>(MS))
       return svalBuilder.makeZeroVal(T);
if (const MemRegion* R = LV->getRegion())
       return StoreRef(getRegionBindings(ST).removeBinding(R)
                                            .asImmutableMap()
                                            .getRootWithoutRetain(),
                       *this);
 
   return StoreRef(ST, *this);
 }
 
-RegionBindingsRef
-RegionStoreManager::bind(RegionBindingsConstRef B, Loc L, SVal V) {
+RegionBindingsRef RegionStoreManager::bind(ProgramStateRef State,
+                                           RegionBindingsConstRef B, Loc L,
+                                           SVal V) {
   if (L.getAs<loc::ConcreteInt>())
     return B;
 
   // If we get here, the location should be a region.
   const MemRegion *R = L.castAs<loc::MemRegionVal>().getRegion();
 
   // Check if the region is a struct region.
   if (const TypedValueRegion* TR = dyn_cast<TypedValueRegion>(R)) {
     QualType Ty = TR->getValueType();
     if (Ty->isArrayType())
-      return bindArray(B, TR, V);
+      return bindArray(State, B, TR, V);
     if (Ty->isStructureOrClassType())
-      return bindStruct(B, TR, V);
+      return bindStruct(State, B, TR, V);
     if (Ty->isVectorType())
-      return bindVector(B, TR, V);
+      return bindVector(State, B, TR, V);
     if (Ty->isUnionType())
       return bindAggregate(B, TR, V);
   }
 
   if (const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(R)) {
     // Binding directly to a symbolic region should be treated as binding
     // to element 0.
     QualType T = SR->getSymbol()->getType();
else {
     // should know how to default-initialize any value we can symbolicate.
     assert(!SymbolManager::canSymbolicate(T) && "This type is representable");
     V = UnknownVal();
   }
 
   return B.addBinding(R, BindingKey::Default, V);
 }
 
-RegionBindingsRef
-RegionStoreManager::bindArray(RegionBindingsConstRef B,
-                              const TypedValueRegion* R,
+RegionBindingsRef RegionStoreManager::bindArray(ProgramStateRef State,
+                                                RegionBindingsConstRef B,
+                                                const TypedValueRegion *R,
                                                 SVal Init) {
 
   const ArrayType *AT =cast<ArrayType>(Ctx.getCanonicalType(R->getValueType()));
   QualType ElementTy = AT->getElementType();
   Optional<uint64_t> Size;
 
   if (const ConstantArrayType* CAT = dyn_cast<ConstantArrayType>(AT))
     Size = CAT->getSize().getZExtValue();
 
   // Check if the init expr is a literal. If so, bind the rvalue instead.
   // FIXME: It's not responsibility of the Store to transform this lvalue
   // to rvalue. ExprEngine or maybe even CFG should do this before binding.
   if (Optional<loc::MemRegionVal> MRV = Init.getAs<loc::MemRegionVal>()) {
-    SVal V = getBinding(B.asStore(), *MRV, R->getValueType());
+    SVal V = getBinding(State, B.asStore(), *MRV, R->getValueType());
     return bindAggregate(B, R, V);
   }
 
   // Handle lazy compound values.
   if (Init.getAs<nonloc::LazyCompoundVal>())
     return bindAggregate(B, R, Init);
 
   if (Init.isUnknown())
for (; Size.hasValue() ? i < Size.getValue() : true ; ++i, ++VI) {
     // The init list might be shorter than the array length.
     if (VI == VE)
       break;
 
     const NonLoc &Idx = svalBuilder.makeArrayIndex(i);
     const ElementRegion *ER = MRMgr.getElementRegion(ElementTy, Idx, R, Ctx);
 
     if (ElementTy->isStructureOrClassType())
-      NewB = bindStruct(NewB, ER, *VI);
+      NewB = bindStruct(State, NewB, ER, *VI);
     else if (ElementTy->isArrayType())
-      NewB = bindArray(NewB, ER, *VI);
+      NewB = bindArray(State, NewB, ER, *VI);
     else
-      NewB = bind(NewB, loc::MemRegionVal(ER), *VI);
+      NewB = bind(State, NewB, loc::MemRegionVal(ER), *VI);
   }
 
   // If the init list is shorter than the array length (or the array has
   // variable length), set the array default value. Values that are already set
   // are not overwritten.
   if (!Size.hasValue() || i < Size.getValue())
     NewB = setImplicitDefaultValue(NewB, R, ElementTy);
 
   return NewB;
 }
 
-RegionBindingsRef RegionStoreManager::bindVector(RegionBindingsConstRef B,
-                                                 const TypedValueRegion* R,
+RegionBindingsRef RegionStoreManager::bindVector(ProgramStateRef State,
+                                                 RegionBindingsConstRef B,
+                                                 const TypedValueRegion *R,
                                                  SVal V) {
   QualType T = R->getValueType();
   const VectorType *VT = T->castAs<VectorType>(); // Use castAs for typedefs.
 
   // Handle lazy compound values and symbolic values.
   if (V.getAs<nonloc::LazyCompoundVal>() || V.getAs<nonloc::SymbolVal>())
     return bindAggregate(B, R, V);
 
RegionBindingsRef RegionStoreManager::bindVector(ProgramStateRef State,
   for ( ; index != numElements ; ++index) {
     if (VI == VE)
       break;
 
     NonLoc Idx = svalBuilder.makeArrayIndex(index);
     const ElementRegion *ER = MRMgr.getElementRegion(ElemType, Idx, R, Ctx);
 
     if (ElemType->isArrayType())
-      NewB = bindArray(NewB, ER, *VI);
+      NewB = bindArray(State, NewB, ER, *VI);
     else if (ElemType->isStructureOrClassType())
-      NewB = bindStruct(NewB, ER, *VI);
+      NewB = bindStruct(State, NewB, ER, *VI);
     else
-      NewB = bind(NewB, loc::MemRegionVal(ER), *VI);
+      NewB = bind(State, NewB, loc::MemRegionVal(ER), *VI);
   }
   return NewB;
 }
 
-Optional<RegionBindingsRef>
-RegionStoreManager::tryBindSmallStruct(RegionBindingsConstRef B,
-                                       const TypedValueRegion *R,
-                                       const RecordDecl *RD,
-                                       nonloc::LazyCompoundVal LCV) {
+Optional<RegionBindingsRef> RegionStoreManager::tryBindSmallStruct(
+    ProgramStateRef State, RegionBindingsConstRef B, const TypedValueRegion *R,
+    const RecordDecl *RD, nonloc::LazyCompoundVal LCV) {
   FieldVector Fields;
 
   if (const CXXRecordDecl *Class = dyn_cast<CXXRecordDecl>(RD))
     if (Class->getNumBases() != 0 || Class->getNumVBases() != 0)
       return None;
 
   for (const auto *FD : RD->fields()) {
     if (FD->isUnnamedBitfield())
for (const auto *FD : RD->fields()) {
 
     Fields.push_back(FD);
   }
 
   RegionBindingsRef NewB = B;
 
   for (FieldVector::iterator I = Fields.begin(), E = Fields.end(); I != E; ++I){
     const FieldRegion *SourceFR = MRMgr.getFieldRegion(*I, LCV.getRegion());
-    SVal V = getBindingForField(getRegionBindings(LCV.getStore()), SourceFR);
+    SVal V =
+        getBindingForField(State, getRegionBindings(LCV.getStore()), SourceFR);
 
     const FieldRegion *DestFR = MRMgr.getFieldRegion(*I, R);
-    NewB = bind(NewB, loc::MemRegionVal(DestFR), V);
+    NewB = bind(State, NewB, loc::MemRegionVal(DestFR), V);
   }
 
   return NewB;
 }
 
-RegionBindingsRef RegionStoreManager::bindStruct(RegionBindingsConstRef B,
-                                                 const TypedValueRegion* R,
+RegionBindingsRef RegionStoreManager::bindStruct(ProgramStateRef State,
+                                                 RegionBindingsConstRef B,
+                                                 const TypedValueRegion *R,
                                                  SVal V) {
   if (!Features.supportsFields())
     return B;
 
   QualType T = R->getValueType();
   assert(T->isStructureOrClassType());
 
   const RecordType* RT = T->castAs<RecordType>();
   const RecordDecl *RD = RT->getDecl();
 
   if (!RD->isCompleteDefinition())
     return B;
 
   // Handle lazy compound values and symbolic values.
   if (Optional<nonloc::LazyCompoundVal> LCV =
         V.getAs<nonloc::LazyCompoundVal>()) {
-    if (Optional<RegionBindingsRef> NewB = tryBindSmallStruct(B, R, RD, *LCV))
+    if (Optional<RegionBindingsRef> NewB =
+            tryBindSmallStruct(State, B, R, RD, *LCV))
       return *NewB;
     return bindAggregate(B, R, V);
   }
   if (V.getAs<nonloc::SymbolVal>())
     return bindAggregate(B, R, V);
 
   // We may get non-CompoundVal accidentally due to imprecise cast logic or
   // that we are binding symbolic struct value. Kill the field values, and if
for (const auto &B : CRD->bases()) {
       assert(BTy->isStructureOrClassType() && "Base classes must be classes!");
 
       const CXXRecordDecl *BRD = BTy->getAsCXXRecordDecl();
       assert(BRD && "Base classes must be C++ classes!");
 
       const CXXBaseObjectRegion *BR =
           MRMgr.getCXXBaseObjectRegion(BRD, R, /*IsVirtual=*/false);
 
-      NewB = bindStruct(NewB, BR, *VI);
+      NewB = bindStruct(State, NewB, BR, *VI);
 
       ++VI;
     }
   }
 
   RecordDecl::field_iterator FI, FE;
 
   for (FI = RD->field_begin(), FE = RD->field_end(); FI != FE; ++FI) {
 
     if (VI == VE)
       break;
 
     // Skip any unnamed bitfields to stay in sync with the initializers.
     if (FI->isUnnamedBitfield())
       continue;
 
     QualType FTy = FI->getType();
     const FieldRegion* FR = MRMgr.getFieldRegion(*FI, R);
 
     if (FTy->isArrayType())
-      NewB = bindArray(NewB, FR, *VI);
+      NewB = bindArray(State, NewB, FR, *VI);
     else if (FTy->isStructureOrClassType())
-      NewB = bindStruct(NewB, FR, *VI);
+      NewB = bindStruct(State, NewB, FR, *VI);
     else
-      NewB = bind(NewB, loc::MemRegionVal(FR), *VI);
+      NewB = bind(State, NewB, loc::MemRegionVal(FR), *VI);
     ++VI;
   }
 
   // There may be fewer values in the initialize list than the fields of struct.
   if (FI != FE) {
     NewB = NewB.addBinding(R, BindingKey::Default,
                            svalBuilder.makeIntVal(0, false));
   }
RemoveDeadBindingsWorker(RegionStoreManager &rm,
                            ProgramStateManager &stateMgr,
                            RegionBindingsRef b, SymbolReaper &symReaper,
                            const StackFrameContext *LCtx)
     : ClusterAnalysis<RemoveDeadBindingsWorker>(rm, stateMgr, b),
       SymReaper(symReaper), CurrentLCtx(LCtx) {}
 
   // Called by ClusterAnalysis.
   void VisitAddedToCluster(const MemRegion *baseR, const ClusterBindings &C);
-  void VisitCluster(const MemRegion *baseR, const ClusterBindings *C);
+  void VisitCluster(ProgramStateRef State, const MemRegion *baseR,
+                    const ClusterBindings *C);
   using ClusterAnalysis<RemoveDeadBindingsWorker>::VisitCluster;
 
   using ClusterAnalysis::AddToWorkList;
 
   bool AddToWorkList(const MemRegion *R);
 
   bool UpdatePostponed();
   void VisitBinding(SVal V);
const auto *StackReg =
         cast<StackArgumentsSpaceRegion>(TR->getSuperRegion());
     const StackFrameContext *RegCtx = StackReg->getStackFrame();
     if (CurrentLCtx &&
         (RegCtx == CurrentLCtx || RegCtx->isParentOf(CurrentLCtx)))
       AddToWorkList(TR, &C);
   }
 }
 
-void RemoveDeadBindingsWorker::VisitCluster(const MemRegion *baseR,
+void RemoveDeadBindingsWorker::VisitCluster(ProgramStateRef State,
+                                            const MemRegion *baseR,
                                             const ClusterBindings *C) {
   if (!C)
     return;
 
   // Mark the symbol for any SymbolicRegion with live bindings as live itself.
   // This means we should continue to track that symbol.
   if (const SymbolicRegion *SymR = dyn_cast<SymbolicRegion>(baseR))
     SymReaper.markLive(SymR->getSymbol());
if (const SymbolicRegion *SR = *I) {
         *I = nullptr;
       }
     }
   }
 
   return Changed;
 }
 
-StoreRef RegionStoreManager::removeDeadBindings(Store store,
+StoreRef RegionStoreManager::removeDeadBindings(ProgramStateRef State,
+                                                Store store,
                                                 const StackFrameContext *LCtx,
-                                                SymbolReaper& SymReaper) {
+                                                SymbolReaper &SymReaper) {
   RegionBindingsRef B = getRegionBindings(store);
   RemoveDeadBindingsWorker W(*this, StateMgr, B, SymReaper, LCtx);
   W.GenerateClusters();
 
   // Enqueue the region roots onto the worklist.
   for (SymbolReaper::region_iterator I = SymReaper.region_begin(),
        E = SymReaper.region_end(); I != E; ++I) {
     W.AddToWorkList(*I);
   }
 
-  do W.RunWorkList(); while (W.UpdatePostponed());
+  do
+    W.RunWorkList(State);
+  while (W.UpdatePostponed());
 
   // We have now scanned the store, marking reachable regions and symbols
   // as live.  We now remove all the regions that are dead from the store
   // as well as update DSymbols with the set symbols that are now dead.
   for (RegionBindingsRef::iterator I = B.begin(), E = B.end(); I != E; ++I) {
     const MemRegion *Base = I.getKey();
 
     // If the cluster has been visited, we know the region has been marked.

clang/lib/StaticAnalyzer/Core/SValBuilder.cpp

 
 NonLoc SValBuilder::makeNonLoc(const SymExpr *operand,
                                QualType fromTy, QualType toTy) {
   assert(operand);
   assert(!Loc::isLocType(toTy));
   return nonloc::SymbolVal(SymMgr.getCastSymbol(operand, fromTy, toTy));
 }
 
-SVal SValBuilder::convertToArrayIndex(SVal val) {
+SVal SValBuilder::convertToArrayIndex(ProgramStateRef State, SVal val) {
   if (val.isUnknownOrUndef())
     return val;
 
   // Common case: we have an appropriately sized integer.
   if (Optional<nonloc::ConcreteInt> CI = val.getAs<nonloc::ConcreteInt>()) {
     const llvm::APSInt& I = CI->getValue();
     if (I.getBitWidth() == ArrayIndexWidth && I.isSigned())
       return val;
   }
 
-  return evalCast(val, ArrayIndexTy);
+  return evalCast(State, val, ArrayIndexTy);
 }
 
 nonloc::ConcreteInt SValBuilder::makeBoolVal(const CXXBoolLiteralExpr *boolean){
   return makeTruthVal(boolean->getValue());
 }
 
 DefinedOrUnknownSVal
 SValBuilder::getRegionValueSymbolVal(const TypedValueRegion *region) {

 /// Return a memory region for the 'this' object reference.
 loc::MemRegionVal SValBuilder::getCXXThis(const CXXRecordDecl *D,
                                           const StackFrameContext *SFC) {
   const Type *T = D->getTypeForDecl();
   QualType PT = getContext().getPointerType(QualType(T, 0));
   return loc::MemRegionVal(getRegionManager().getCXXThisRegion(PT, SFC));
 }
 
-Optional<SVal> SValBuilder::getConstantVal(const Expr *E) {
+Optional<SVal> SValBuilder::getConstantVal(ProgramStateRef State,
+                                           const Expr *E) {
   E = E->IgnoreParens();
 
   switch (E->getStmtClass()) {
   // Handle expressions that we treat differently from the AST's constant
   // evaluator.
   case Stmt::AddrLabelExprClass:
     return makeLoc(cast<AddrLabelExpr>(E));
 
case Stmt::ImplicitCastExprClass: {
     switch (CE->getCastKind()) {
     default:
       break;
     case CK_ArrayToPointerDecay:
     case CK_IntegralToPointer:
     case CK_NoOp:
     case CK_BitCast: {
       const Expr *SE = CE->getSubExpr();
-      Optional<SVal> Val = getConstantVal(SE);
+      Optional<SVal> Val = getConstantVal(State, SE);
       if (!Val)
         return None;
-      return evalCast(*Val, CE->getType(), SE->getType());
+      return evalCast(State, *Val, CE->getType(), SE->getType());
     }
     }
     // FALLTHROUGH
     LLVM_FALLTHROUGH;
   }
 
   // If we don't have a special case, fall back to the AST's constant evaluator.
   default: {

 
 // Handles casts of type CK_IntegralCast.
 // At the moment, this function will redirect to evalCast, except when the range
 // of the original value is known to be greater than the max of the target type.
 SVal SValBuilder::evalIntegralCast(ProgramStateRef state, SVal val,
                                    QualType castTy, QualType originalTy) {
   // No truncations if target type is big enough.
   if (getContext().getTypeSize(castTy) >= getContext().getTypeSize(originalTy))
-    return evalCast(val, castTy, originalTy);
+    return evalCast(state, val, castTy, originalTy);
 
   SymbolRef se = val.getAsSymbol();
   if (!se) // Let evalCast handle non symbolic expressions.
-    return evalCast(val, castTy, originalTy);
+    return evalCast(state, val, castTy, originalTy);
 
   // Find the maximum value of the target type.
   APSIntType ToType(getContext().getTypeSize(castTy),
                     castTy->isUnsignedIntegerType());
   llvm::APSInt ToTypeMax = ToType.getMaxValue();
   NonLoc ToTypeMaxVal =
       makeIntVal(ToTypeMax.isUnsigned() ? ToTypeMax.getZExtValue()
                                         : ToTypeMax.getSExtValue(),
                  castTy)
           .castAs<NonLoc>();
   // Check the range of the symbol being casted against the maximum value of the
   // target type.
   NonLoc FromVal = val.castAs<NonLoc>();
   QualType CmpTy = getConditionType();
   NonLoc CompVal =
       evalBinOpNN(state, BO_LE, FromVal, ToTypeMaxVal, CmpTy).castAs<NonLoc>();
   ProgramStateRef IsNotTruncated, IsTruncated;
   std::tie(IsNotTruncated, IsTruncated) = state->assume(CompVal);
   if (!IsNotTruncated && IsTruncated) {
     // Symbol is truncated so we evaluate it as a cast.
     NonLoc CastVal = makeNonLoc(se, originalTy, castTy);
     return CastVal;
   }
-  return evalCast(val, castTy, originalTy);
+  return evalCast(state, val, castTy, originalTy);
 }
 
 //===----------------------------------------------------------------------===//
 // Cast methods.
 // `evalCast` is the main method
 // `evalCastKind` and `evalCastSubKind` are helpers
 //===----------------------------------------------------------------------===//
 
 // In case when `OriginalTy.isNull() == true` we cast `V` less accurately.
-SVal SValBuilder::evalCast(SVal V, QualType CastTy,
+SVal SValBuilder::evalCast(ProgramStateRef State, SVal V, QualType CastTy,
                            QualType OriginalTy /*= QualType{}*/) {
   if (CastTy.isNull())
     return V;
 
   CastTy = Context.getCanonicalType(CastTy);
 
   if (!OriginalTy.isNull()) {
     OriginalTy = Context.getCanonicalType(OriginalTy);
if (!CastTy->isVariableArrayType() && !OriginalTy->isVariableArrayType())
         return V;
   }
 
   // Cast SVal according to kinds.
   switch (V.getBaseKind()) {
   default:
     llvm_unreachable("Unknown SVal kind");
   case SVal::UndefinedValKind:
-    return evalCastKind(V.castAs<UndefinedVal>(), CastTy, OriginalTy);
+    return evalCastKind(State, V.castAs<UndefinedVal>(), CastTy, OriginalTy);
   case SVal::UnknownValKind:
-    return evalCastKind(V.castAs<UnknownVal>(), CastTy, OriginalTy);
+    return evalCastKind(State, V.castAs<UnknownVal>(), CastTy, OriginalTy);
   case SVal::LocKind:
-    return evalCastKind(V.castAs<Loc>(), CastTy, OriginalTy);
+    return evalCastKind(State, V.castAs<Loc>(), CastTy, OriginalTy);
   case SVal::NonLocKind:
-    return evalCastKind(V.castAs<NonLoc>(), CastTy, OriginalTy);
+    return evalCastKind(State, V.castAs<NonLoc>(), CastTy, OriginalTy);
   }
 
   llvm_unreachable("Unknown SVal kind");
 }
 
-SVal SValBuilder::evalCastKind(UndefinedVal V, QualType CastTy,
-                               QualType OriginalTy) {
+SVal SValBuilder::evalCastKind(ProgramStateRef State, UndefinedVal V,
+                               QualType CastTy, QualType OriginalTy) {
   return V;
 }
 
-SVal SValBuilder::evalCastKind(UnknownVal V, QualType CastTy,
-                               QualType OriginalTy) {
+SVal SValBuilder::evalCastKind(ProgramStateRef State, UnknownVal V,
+                               QualType CastTy, QualType OriginalTy) {
   return V;
 }
 
-SVal SValBuilder::evalCastKind(Loc V, QualType CastTy, QualType OriginalTy) {
+SVal SValBuilder::evalCastKind(ProgramStateRef State, Loc V, QualType CastTy,
+                               QualType OriginalTy) {
   switch (V.getSubKind()) {
   default:
     llvm_unreachable("Unknown SVal kind");
   case loc::ConcreteIntKind:
-    return evalCastSubKind(V.castAs<loc::ConcreteInt>(), CastTy, OriginalTy);
+    return evalCastSubKind(State, V.castAs<loc::ConcreteInt>(), CastTy,
+                           OriginalTy);
   case loc::GotoLabelKind:
-    return evalCastSubKind(V.castAs<loc::GotoLabel>(), CastTy, OriginalTy);
+    return evalCastSubKind(State, V.castAs<loc::GotoLabel>(), CastTy,
+                           OriginalTy);
   case loc::MemRegionValKind:
-    return evalCastSubKind(V.castAs<loc::MemRegionVal>(), CastTy, OriginalTy);
+    return evalCastSubKind(State, V.castAs<loc::MemRegionVal>(), CastTy,
+                           OriginalTy);
   }
 }
 
-SVal SValBuilder::evalCastKind(NonLoc V, QualType CastTy, QualType OriginalTy) {
+SVal SValBuilder::evalCastKind(ProgramStateRef State, NonLoc V, QualType CastTy,
+                               QualType OriginalTy) {
   switch (V.getSubKind()) {
   default:
     llvm_unreachable("Unknown SVal kind");
   case nonloc::CompoundValKind:
-    return evalCastSubKind(V.castAs<nonloc::CompoundVal>(), CastTy, OriginalTy);
+    return evalCastSubKind(State, V.castAs<nonloc::CompoundVal>(), CastTy,
+                           OriginalTy);
   case nonloc::ConcreteIntKind:
-    return evalCastSubKind(V.castAs<nonloc::ConcreteInt>(), CastTy, OriginalTy);
+    return evalCastSubKind(State, V.castAs<nonloc::ConcreteInt>(), CastTy,
+                           OriginalTy);
   case nonloc::LazyCompoundValKind:
-    return evalCastSubKind(V.castAs<nonloc::LazyCompoundVal>(), CastTy,
+    return evalCastSubKind(State, V.castAs<nonloc::LazyCompoundVal>(), CastTy,
                            OriginalTy);
   case nonloc::LocAsIntegerKind:
-    return evalCastSubKind(V.castAs<nonloc::LocAsInteger>(), CastTy,
+    return evalCastSubKind(State, V.castAs<nonloc::LocAsInteger>(), CastTy,
                            OriginalTy);
   case nonloc::SymbolValKind:
-    return evalCastSubKind(V.castAs<nonloc::SymbolVal>(), CastTy, OriginalTy);
+    return evalCastSubKind(State, V.castAs<nonloc::SymbolVal>(), CastTy,
+                           OriginalTy);
   case nonloc::PointerToMemberKind:
-    return evalCastSubKind(V.castAs<nonloc::PointerToMember>(), CastTy,
+    return evalCastSubKind(State, V.castAs<nonloc::PointerToMember>(), CastTy,
                            OriginalTy);
   }
 }
 
-SVal SValBuilder::evalCastSubKind(loc::ConcreteInt V, QualType CastTy,
-                                  QualType OriginalTy) {
+SVal SValBuilder::evalCastSubKind(ProgramStateRef State, loc::ConcreteInt V,
+                                  QualType CastTy, QualType OriginalTy) {
   // Pointer to bool.
   if (CastTy->isBooleanType())
     return makeTruthVal(V.getValue().getBoolValue(), CastTy);
 
   // Pointer to integer.
   if (CastTy->isIntegralOrEnumerationType()) {
     llvm::APSInt Value = V.getValue();
     BasicVals.getAPSIntType(CastTy).apply(Value);
     return makeIntVal(Value);
   }
 
   // Pointer to any pointer.
   if (Loc::isLocType(CastTy))
     return V;
 
   // Pointer to whatever else.
   return UnknownVal();
 }
 
-SVal SValBuilder::evalCastSubKind(loc::GotoLabel V, QualType CastTy,
-                                  QualType OriginalTy) {
+SVal SValBuilder::evalCastSubKind(ProgramStateRef State, loc::GotoLabel V,
+                                  QualType CastTy, QualType OriginalTy) {
   // Pointer to bool.
   if (CastTy->isBooleanType())
     // Labels are always true.
     return makeTruthVal(true, CastTy);
 
   // Pointer to integer.
   if (CastTy->isIntegralOrEnumerationType()) {
     const unsigned BitWidth = Context.getIntWidth(CastTy);
SVal SValBuilder::evalCastSubKind(ProgramStateRef State, loc::GotoLabel V,
   return UnknownVal();
 }
 
 static bool hasSameUnqualifiedPointeeType(QualType ty1, QualType ty2) {
   return ty1->getPointeeType().getCanonicalType().getTypePtr() ==
          ty2->getPointeeType().getCanonicalType().getTypePtr();
 }
 
-SVal SValBuilder::evalCastSubKind(loc::MemRegionVal V, QualType CastTy,
-                                  QualType OriginalTy) {
+SVal SValBuilder::evalCastSubKind(ProgramStateRef State, loc::MemRegionVal V,
+                                  QualType CastTy, QualType OriginalTy) {
   // Pointer to bool.
   if (CastTy->isBooleanType()) {
     const MemRegion *R = V.getRegion();
     if (const FunctionCodeRegion *FTR = dyn_cast<FunctionCodeRegion>(R))
       if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(FTR->getDecl()))
         if (FD->isWeak())
           // FIXME: Currently we are using an extent symbol here,
           // because there are no generic region address metadata
SVal SValBuilder::evalCastSubKind(ProgramStateRef State, loc::MemRegionVal V,
   // such operations.  When this happens, the underlying operation is that
   // the caller is reasoning about bits.  Conceptually we are layering a
   // "view" of a location on top of those bits.  Perhaps we need to be more
   // lazy about mutual possible views, even on an SVal?  This may be
   // necessary for bit-level reasoning as well.
   return UnknownVal();
 }
 
-SVal SValBuilder::evalCastSubKind(nonloc::CompoundVal V, QualType CastTy,
-                                  QualType OriginalTy) {
+SVal SValBuilder::evalCastSubKind(ProgramStateRef State, nonloc::CompoundVal V,
+                                  QualType CastTy, QualType OriginalTy) {
   // Compound to whatever.
   return UnknownVal();
 }
 
-SVal SValBuilder::evalCastSubKind(nonloc::ConcreteInt V, QualType CastTy,
-                                  QualType OriginalTy) {
+SVal SValBuilder::evalCastSubKind(ProgramStateRef State, nonloc::ConcreteInt V,
+                                  QualType CastTy, QualType OriginalTy) {
   auto CastedValue = [V, CastTy, this]() {
     llvm::APSInt Value = V.getValue();
     BasicVals.getAPSIntType(CastTy).apply(Value);
     return Value;
   };
 
   // Integer to bool.
   if (CastTy->isBooleanType())
     return makeTruthVal(V.getValue().getBoolValue(), CastTy);
 
   // Integer to pointer.
   if (CastTy->isIntegralOrEnumerationType())
     return makeIntVal(CastedValue());
 
   // Integer to pointer.
   if (Loc::isLocType(CastTy))
     return makeIntLocVal(CastedValue());
 
   // Pointer to whatever else.
   return UnknownVal();
 }
 
-SVal SValBuilder::evalCastSubKind(nonloc::LazyCompoundVal V, QualType CastTy,
+SVal SValBuilder::evalCastSubKind(ProgramStateRef State,
+                                  nonloc::LazyCompoundVal V, QualType CastTy,
                                   QualType OriginalTy) {
   // Compound to whatever.
   return UnknownVal();
 }
 
-SVal SValBuilder::evalCastSubKind(nonloc::LocAsInteger V, QualType CastTy,
-                                  QualType OriginalTy) {
+SVal SValBuilder::evalCastSubKind(ProgramStateRef State, nonloc::LocAsInteger V,
+                                  QualType CastTy, QualType OriginalTy) {
   Loc L = V.getLoc();
 
   // Pointer as integer to bool.
   if (CastTy->isBooleanType())
-    // Pass to Loc function.
-    return evalCastKind(L, CastTy, OriginalTy);
+    return evalCastKind(State, L, CastTy, OriginalTy);
 
   if (Loc::isLocType(CastTy) && !OriginalTy.isNull() &&
       OriginalTy->isIntegralOrEnumerationType()) {
     if (const MemRegion *R = L.getAsRegion())
       if ((R = StateMgr.getStoreManager().castRegion(R, CastTy)))
         return loc::MemRegionVal(R);
     return L;
   }
 
   // Pointer as integer with region to integer/pointer.
   const MemRegion *R = L.getAsRegion();
   if (!OriginalTy.isNull() && R) {
     if (CastTy->isIntegralOrEnumerationType())
-      return evalCastSubKind(loc::MemRegionVal(R), CastTy, OriginalTy);
+      return evalCastSubKind(State, loc::MemRegionVal(R), CastTy, OriginalTy);
 
     if (Loc::isLocType(CastTy)) {
       assert(Loc::isLocType(OriginalTy) || OriginalTy->isFunctionType() ||
              CastTy->isReferenceType());
       // Delegate to store manager to get the result of casting a region to a
       // different type. If the MemRegion* returned is NULL, this expression
       // Evaluates to UnknownVal.
       if ((R = StateMgr.getStoreManager().castRegion(R, CastTy)))
         return loc::MemRegionVal(R);
     }
   } else {
     if (Loc::isLocType(CastTy)) {
       if (OriginalTy.isNull())
-        return evalCastSubKind(loc::MemRegionVal(R), CastTy, OriginalTy);
+        return evalCastSubKind(State, loc::MemRegionVal(R), CastTy, OriginalTy);
       return L;
     }
 
     SymbolRef SE = nullptr;
     if (R) {
       if (const SymbolicRegion *SR =
               dyn_cast<SymbolicRegion>(R->StripCasts())) {
         SE = SR->getSymbol();
if (!CastTy->isFloatingType() || !SE || SE->getType()->isFloatingType()) {
       return makeLocAsInteger(L, CastSize);
     }
   }
 
   // Pointer as integer to whatever else.
   return UnknownVal();
 }
 
-SVal SValBuilder::evalCastSubKind(nonloc::SymbolVal V, QualType CastTy,
-                                  QualType OriginalTy) {
+SVal SValBuilder::evalCastSubKind(ProgramStateRef State, nonloc::SymbolVal V,
+                                  QualType CastTy, QualType OriginalTy) {
   SymbolRef SE = V.getSymbol();
 
   // Symbol to bool.
   if (!OriginalTy.isNull() && CastTy->isBooleanType()) {
     // Non-float to bool.
     if (Loc::isLocType(OriginalTy) ||
         OriginalTy->isIntegralOrEnumerationType() ||
         OriginalTy->isMemberPointerType()) {
if (!Loc::isLocType(CastTy))
           T->isFloatingType())
         return makeNonLoc(SE, T, CastTy);
   }
 
   // Symbol to pointer and whatever else.
   return UnknownVal();
 }
 
-SVal SValBuilder::evalCastSubKind(nonloc::PointerToMember V, QualType CastTy,
+SVal SValBuilder::evalCastSubKind(ProgramStateRef State,
+                                  nonloc::PointerToMember V, QualType CastTy,
                                   QualType OriginalTy) {
   // Member pointer to whatever.
   return V;
 }

clang/lib/StaticAnalyzer/Core/SimpleConstraintManager.cpp

if (Optional<Loc> LV = Cond.getAs<Loc>()) {
     SValBuilder &SVB = State->getStateManager().getSValBuilder();
     QualType T;
     const MemRegion *MR = LV->getAsRegion();
     if (const TypedRegion *TR = dyn_cast_or_null<TypedRegion>(MR))
       T = TR->getLocationType();
     else
       T = SVB.getContext().VoidPtrTy;
 
-    Cond = SVB.evalCast(*LV, SVB.getContext().BoolTy, T).castAs<DefinedSVal>();
+    Cond = SVB.evalCast(State, *LV, SVB.getContext().BoolTy, T)
+               .castAs<DefinedSVal>();
   }
 
   return assume(State, Cond.castAs<NonLoc>(), Assumption);
 }
 
 ProgramStateRef SimpleConstraintManager::assume(ProgramStateRef State,
                                                 NonLoc Cond, bool Assumption) {
   State = assumeAux(State, Cond, Assumption);

clang/lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp

public:
   /// getKnownValue - evaluates a given SVal. If the SVal has only one possible
   ///  (integer) value, that value is returned. Otherwise, returns NULL.
   const llvm::APSInt *getKnownValue(ProgramStateRef state, SVal V) override;
 
   /// Recursively descends into symbolic expressions and replaces symbols
   /// with their known values (in the sense of the getKnownValue() method).
   SVal simplifySVal(ProgramStateRef State, SVal V) override;
 
-  SVal MakeSymIntVal(const SymExpr *LHS, BinaryOperator::Opcode op,
-                     const llvm::APSInt &RHS, QualType resultTy);
+  SVal MakeSymIntVal(ProgramStateRef State, const SymExpr *LHS,
+                     BinaryOperator::Opcode op, const llvm::APSInt &RHS,
+                     QualType resultTy);
 };
 } // end anonymous namespace
 
 SValBuilder *ento::createSimpleSValBuilder(llvm::BumpPtrAllocator &alloc,
                                            ASTContext &context,
                                            ProgramStateManager &stateMgr) {
   return new SimpleSValBuilder(alloc, context, stateMgr);
 }
default:
     return UnknownVal();
   }
 }
 
 //===----------------------------------------------------------------------===//
 // Transfer function for binary operators.
 //===----------------------------------------------------------------------===//
 
-SVal SimpleSValBuilder::MakeSymIntVal(const SymExpr *LHS,
+SVal SimpleSValBuilder::MakeSymIntVal(ProgramStateRef State, const SymExpr *LHS,
                                       BinaryOperator::Opcode op,
                                       const llvm::APSInt &RHS,
                                       QualType resultTy) {
   bool isIdempotent = false;
 
   // Check for a few special cases with known reductions first.
   switch (op) {
   default:
     // We can't reduce this case; just treat it normally.
     break;
   case BO_Mul:
case BO_Or:
     }
     break;
   }
 
   // Idempotent ops (like a*1) can still change the type of an expression.
   // Wrap the LHS up in a NonLoc again and let evalCast do the
   // dirty work.
   if (isIdempotent)
-    return evalCast(nonloc::SymbolVal(LHS), resultTy);
+    return evalCast(State, nonloc::SymbolVal(LHS), resultTy);
 
   // If we reach this point, the expression cannot be simplified.
   // Make a SymbolVal for the entire expression, after converting the RHS.
   const llvm::APSInt *ConvertedRHS = &RHS;
   if (BinaryOperator::isComparisonOp(op)) {
     // We're looking for a type big enough to compare the symbolic value
     // with the given constant.
     // FIXME: This is an approximation of Sema::UsualArithmeticConversions.
switch (op) {
       case BO_LT:
       case BO_GT:
       case BO_NE:
         return makeTruthVal(false, resultTy);
       case BO_Xor:
       case BO_Sub:
         if (resultTy->isIntegralOrEnumerationType())
           return makeIntVal(0, resultTy);
-        return evalCast(makeIntVal(0, /*isUnsigned=*/false), resultTy);
+        return evalCast(state, makeIntVal(0, /*isUnsigned=*/false), resultTy);
       case BO_Or:
       case BO_And:
-        return evalCast(lhs, resultTy);
+        return evalCast(state, lhs, resultTy);
     }
 
   while (1) {
     switch (lhs.getSubKind()) {
     default:
       return makeSymExprValNN(op, lhs, rhs, resultTy);
     case nonloc::PointerToMemberKind: {
       assert(rhs.getSubKind() == nonloc::PointerToMemberKind &&
case nonloc::ConcreteIntKind: {
       case BO_And:
       case BO_Xor:
       case BO_Or:
         std::swap(lhs, rhs);
         continue;
       case BO_Shr:
         // (~0)>>a
         if (LHSValue.isAllOnesValue() && LHSValue.isSigned())
-          return evalCast(lhs, resultTy);
+          return evalCast(state, lhs, resultTy);
         LLVM_FALLTHROUGH;
       case BO_Shl:
         // 0<<a and 0>>a
         if (LHSValue == 0)
-          return evalCast(lhs, resultTy);
+          return evalCast(state, lhs, resultTy);
         return makeSymExprValNN(op, InputLHS, InputRHS, resultTy);
       case BO_Rem:
         // 0 % x == 0
         if (LHSValue == 0)
           return makeZeroVal(resultTy);
         LLVM_FALLTHROUGH;
       default:
         return makeSymExprValNN(op, InputLHS, InputRHS, resultTy);
case nonloc::SymbolValKind: {
               rhs = nonloc::ConcreteInt(*newRHS);
               lhs = nonloc::SymbolVal(symIntExpr->getLHS());
               op = lop;
               continue;
             }
           }
 
           // Otherwise, make a SymIntExpr out of the expression.
-          return MakeSymIntVal(symIntExpr, op, *RHSValue, resultTy);
+          return MakeSymIntVal(state, symIntExpr, op, *RHSValue, resultTy);
         }
       }
 
       // Does the symbolic expression simplify to a constant?
       // If so, "fold" the constant by setting 'lhs' to a ConcreteInt
       // and try again.
       SVal simplifiedLhs = simplifySVal(state, lhs);
       if (simplifiedLhs != lhs)
         if (auto simplifiedLhsAsNonLoc = simplifiedLhs.getAs<NonLoc>()) {
           lhs = *simplifiedLhsAsNonLoc;
           continue;
         }
 
       // Is the RHS a constant?
       if (const llvm::APSInt *RHSValue = getKnownValue(state, rhs))
-        return MakeSymIntVal(Sym, op, *RHSValue, resultTy);
+        return MakeSymIntVal(state, Sym, op, *RHSValue, resultTy);
 
       if (Optional<NonLoc> V = tryRearrange(state, op, lhs, rhs, resultTy))
         return *V;
 
       // Give up -- this is not a symbolic expression we can handle.
       return makeSymExprValNN(op, InputLHS, InputRHS, resultTy);
     }
     }
SVal SimpleSValBuilder::evalBinOpLL(ProgramStateRef state,
 
   case loc::GotoLabelKind:
     // The only thing we know about labels is that they're non-null.
     if (rhs.isZeroConstant()) {
       switch (op) {
       default:
         break;
       case BO_Sub:
-        return evalCast(lhs, resultTy);
+        return evalCast(state, lhs, resultTy);
       case BO_EQ:
       case BO_LE:
       case BO_LT:
         return makeTruthVal(false, resultTy);
       case BO_NE:
       case BO_GT:
       case BO_GE:
         return makeTruthVal(true, resultTy);
if (SymbolRef rSym = rhs.getAsLocSymbol()) {
       return makeNonLoc(rSym, op, lVal, resultTy);
     }
 
     // If both operands are constants, just perform the operation.
     if (Optional<loc::ConcreteInt> rInt = rhs.getAs<loc::ConcreteInt>()) {
       SVal ResultVal =
           lhs.castAs<loc::ConcreteInt>().evalBinOp(BasicVals, op, *rInt);
       if (Optional<NonLoc> Result = ResultVal.getAs<NonLoc>())
-        return evalCast(*Result, resultTy);
+        return evalCast(state, *Result, resultTy);
 
       assert(!ResultVal.getAs<Loc>() && "Loc-Loc ops should not produce Locs");
       return UnknownVal();
     }
 
     // Special case comparisons against NULL.
     // This must come after the test if the RHS is a symbol, which is used to
     // build constraints. The address of any non-symbolic region is guaranteed
case loc::ConcreteIntKind: {
     return UnknownVal();
   }
   case loc::MemRegionValKind: {
     if (Optional<loc::ConcreteInt> rInt = rhs.getAs<loc::ConcreteInt>()) {
       // If one of the operands is a symbol and the other is a constant,
       // build an expression for use by the constraint manager.
       if (SymbolRef lSym = lhs.getAsLocSymbol(true)) {
         if (BinaryOperator::isComparisonOp(op))
-          return MakeSymIntVal(lSym, op, rInt->getValue(), resultTy);
+          return MakeSymIntVal(state, lSym, op, rInt->getValue(), resultTy);
         return UnknownVal();
       }
       // Special case comparisons to NULL.
       // This must come after the test if the LHS is a symbol, which is used to
       // build constraints. The address of any non-symbolic region is guaranteed
       // to be non-NULL.
       if (rInt->isZeroConstant()) {
         if (op == BO_Sub)
-          return evalCast(lhs, resultTy);
+          return evalCast(state, lhs, resultTy);
 
         if (BinaryOperator::isComparisonOp(op)) {
           QualType boolType = getContext().BoolTy;
-          NonLoc l = evalCast(lhs, boolType).castAs<NonLoc>();
+          NonLoc l = evalCast(state, lhs, boolType).castAs<NonLoc>();
           NonLoc r = makeTruthVal(false, boolType).castAs<NonLoc>();
           return evalBinOpNN(state, op, l, r, resultTy);
         }
       }
 
       // Comparing a region to an arbitrary integer is completely unknowable.
       return UnknownVal();
     }
if (RightER && LeftER) {
       if (LeftER->getSuperRegion() == RightER->getSuperRegion() &&
           LeftER->getElementType() == RightER->getElementType()) {
         // Get the left index and cast it to the correct type.
         // If the index is unknown or undefined, bail out here.
         SVal LeftIndexVal = LeftER->getIndex();
         Optional<NonLoc> LeftIndex = LeftIndexVal.getAs<NonLoc>();
         if (!LeftIndex)
           return UnknownVal();
-        LeftIndexVal = evalCast(*LeftIndex, ArrayIndexTy);
+        LeftIndexVal = evalCast(state, *LeftIndex, ArrayIndexTy);
         LeftIndex = LeftIndexVal.getAs<NonLoc>();
         if (!LeftIndex)
           return UnknownVal();
 
         // Do the same for the right index.
         SVal RightIndexVal = RightER->getIndex();
         Optional<NonLoc> RightIndex = RightIndexVal.getAs<NonLoc>();
         if (!RightIndex)
           return UnknownVal();
-        RightIndexVal = evalCast(*RightIndex, ArrayIndexTy);
+        RightIndexVal = evalCast(state, *RightIndex, ArrayIndexTy);
         RightIndex = RightIndexVal.getAs<NonLoc>();
         if (!RightIndex)
           return UnknownVal();
 
         // Actually perform the operation.
         // evalBinOpNN expects the two indexes to already be the right type.
         return evalBinOpNN(state, op, *LeftIndex, *RightIndex, resultTy);
       }
if (Optional<loc::ConcreteInt> lhsInt = lhs.getAs<loc::ConcreteInt>()) {
           llvm_unreachable("Invalid pointer arithmetic operation");
       }
       return loc::ConcreteInt(getBasicValueFactory().getValue(rightI));
     }
   }
 
   // Handle cases where 'lhs' is a region.
   if (const MemRegion *region = lhs.getAsRegion()) {
-    rhs = convertToArrayIndex(rhs).castAs<NonLoc>();
+    rhs = convertToArrayIndex(state, rhs).castAs<NonLoc>();
     SVal index = UnknownVal();
     const SubRegion *superR = nullptr;
     // We need to know the type of the pointer in order to add an integer to it.
     // Depending on the type, different amount of bytes is added.
     QualType elementType;
 
     if (const ElementRegion *elemReg = dyn_cast<ElementRegion>(region)) {
       assert(op == BO_Add || op == BO_Sub);

clang/lib/StaticAnalyzer/Core/Store.cpp

 
 using namespace clang;
 using namespace ento;
 
 StoreManager::StoreManager(ProgramStateManager &stateMgr)
     : svalBuilder(stateMgr.getSValBuilder()), StateMgr(stateMgr),
       MRMgr(svalBuilder.getRegionManager()), Ctx(stateMgr.getContext()) {}
 
-StoreRef StoreManager::enterStackFrame(Store OldStore,
+StoreRef StoreManager::enterStackFrame(ProgramStateRef State, Store OldStore,
                                        const CallEvent &Call,
                                        const StackFrameContext *LCtx) {
   StoreRef Store = StoreRef(OldStore, *this);
 
   SmallVector<CallEvent::FrameBindingTy, 16> InitialBindings;
   Call.getInitialStackFrameContents(LCtx, InitialBindings);
 
   for (const auto &I : InitialBindings)
-    Store = Bind(Store.getStore(), I.first.castAs<Loc>(), I.second);
+    Store = Bind(State, Store.getStore(), I.first.castAs<Loc>(), I.second);
 
   return Store;
 }
 
 const ElementRegion *StoreManager::MakeElementRegion(const SubRegion *Base,
                                                      QualType EleTy,
                                                      uint64_t index) {
   NonLoc idx = svalBuilder.makeArrayIndex(index);
SVal StoreManager::getLValueFieldOrIvar(const Decl *D, SVal Base) {
 
   return loc::MemRegionVal(MRMgr.getFieldRegion(cast<FieldDecl>(D), BaseR));
 }
 
 SVal StoreManager::getLValueIvar(const ObjCIvarDecl *decl, SVal base) {
   return getLValueFieldOrIvar(decl, base);
 }
 
-SVal StoreManager::getLValueElement(QualType elementType, NonLoc Offset,
-                                    SVal Base) {
+SVal StoreManager::getLValueElement(ProgramStateRef State, QualType elementType,
+                                    NonLoc Offset, SVal Base) {
   // If the base is an unknown or undefined value, just return it back.
   // FIXME: For absolute pointer addresses, we just return that value back as
   //  well, although in reality we should return the offset added to that
   //  value. See also the similar FIXME in getLValueFieldOrIvar().
   if (Base.isUnknownOrUndef() || Base.getAs<loc::ConcreteInt>())
     return Base;
 
   if (Base.getAs<loc::GotoLabel>())
     return UnknownVal();
 
   const SubRegion *BaseRegion =
       Base.castAs<loc::MemRegionVal>().getRegionAs<SubRegion>();
 
   // Pointer of any type can be cast and used as array base.
   const auto *ElemR = dyn_cast<ElementRegion>(BaseRegion);
 
   // Convert the offset to the appropriate size and signedness.
-  Offset = svalBuilder.convertToArrayIndex(Offset).castAs<NonLoc>();
+  Offset = svalBuilder.convertToArrayIndex(State, Offset).castAs<NonLoc>();
 
   if (!ElemR) {
     // If the base region is not an ElementRegion, create one.
     // This can happen in the following example:
     //
     //   char *p = __builtin_alloc(10);
     //   p[1] = 8;
     //

clang/unittests/StaticAnalyzer/StoreTest.cpp

void performTest(const Decl *D) override {
     Loc LY1 = loc::MemRegionVal(MRManager.getVarRegion(VDY1, SFC));
 
     Store StInit = SManager.getInitialStore(SFC).getStore();
     SVal Zero = Builder.makeZeroVal(ASTCtxt.IntTy);
     SVal One = Builder.makeIntVal(1, ASTCtxt.IntTy);
     SVal NarrowZero = Builder.makeZeroVal(ASTCtxt.CharTy);
 
     // Bind(Zero)
-    Store StX0 = SManager.Bind(StInit, LX0, Zero).getStore();
-    EXPECT_EQ(Zero, SManager.getBinding(StX0, LX0, ASTCtxt.IntTy));
+    Store StX0 = SManager.Bind(nullptr, StInit, LX0, Zero).getStore();
+    EXPECT_EQ(Zero, SManager.getBinding(nullptr, StX0, LX0, ASTCtxt.IntTy));
 
     // BindDefaultInitial(Zero)
     Store StY0 =
         SManager.BindDefaultInitial(StInit, LY0.getAsRegion(), Zero).getStore();
-    EXPECT_EQ(Zero, SManager.getBinding(StY0, LY0, ASTCtxt.IntTy));
+    EXPECT_EQ(Zero, SManager.getBinding(nullptr, StY0, LY0, ASTCtxt.IntTy));
     EXPECT_EQ(Zero, *SManager.getDefaultBinding(StY0, LY0.getAsRegion()));
 
     // BindDefaultZero()
     Store StZ0 = SManager.BindDefaultZero(StInit, LZ0.getAsRegion()).getStore();
     // BindDefaultZero wipes the region with '0 S8b', not with out Zero.
     // Direct load, however, does give us back the object of the type
     // that we specify for loading.
-    EXPECT_EQ(Zero, SManager.getBinding(StZ0, LZ0, ASTCtxt.IntTy));
+    EXPECT_EQ(Zero, SManager.getBinding(nullptr, StZ0, LZ0, ASTCtxt.IntTy));
     EXPECT_EQ(NarrowZero, *SManager.getDefaultBinding(StZ0, LZ0.getAsRegion()));
 
     // Bind(One)
-    Store StX1 = SManager.Bind(StInit, LX1, One).getStore();
-    EXPECT_EQ(One, SManager.getBinding(StX1, LX1, ASTCtxt.IntTy));
+    Store StX1 = SManager.Bind(nullptr, StInit, LX1, One).getStore();
+    EXPECT_EQ(One, SManager.getBinding(nullptr, StX1, LX1, ASTCtxt.IntTy));
 
     // BindDefaultInitial(One)
     Store StY1 =
         SManager.BindDefaultInitial(StInit, LY1.getAsRegion(), One).getStore();
-    EXPECT_EQ(One, SManager.getBinding(StY1, LY1, ASTCtxt.IntTy));
+    EXPECT_EQ(One, SManager.getBinding(nullptr, StY1, LY1, ASTCtxt.IntTy));
     EXPECT_EQ(One, *SManager.getDefaultBinding(StY1, LY1.getAsRegion()));
   }
 
 public:
   using StoreTestConsumer::StoreTestConsumer;
 };
 
 TEST(Store, VariableBind) {
void performTest(const Decl *D) override {
     // Get value for 'test[0]'
     NonLoc Zero = Builder.makeIntVal(0, false);
     loc::MemRegionVal ZeroElement(
         MRManager.getElementRegion(ASTCtxt.IntTy, Zero, CLRegion, ASTCtxt));
 
     Store StInit = SManager.getInitialStore(SFC).getStore();
     // Let's bind constant 1 to 'test[0]'
     SVal One = Builder.makeIntVal(1, Int);
-    Store StX = SManager.Bind(StInit, ZeroElement, One).getStore();
+    Store StX = SManager.Bind(nullptr, StInit, ZeroElement, One).getStore();
 
     // And make sure that we can read this binding back as it was
-    EXPECT_EQ(One, SManager.getBinding(StX, ZeroElement, Int));
+    EXPECT_EQ(One, SManager.getBinding(nullptr, StX, ZeroElement, Int));
   }
 
 public:
   using StoreTestConsumer::StoreTestConsumer;
 };
 
 TEST(Store, LiteralCompound) {
   EXPECT_TRUE(tooling::runToolOnCode(
       std::make_unique<TestAction<LiteralCompoundConsumer>>(),
       "void foo() { int *test = (int[]){ 1, 2, 3 }; }", "input.c"));
 }
 
 } // namespace
 } // namespace ento
 } // namespace clang