llvm
diff --git a/‎clang/include/clang/Analysis/CFG.h‎
Lines changed: 1 addition & 9 deletions b/‎clang/include/clang/Analysis/CFG.h‎
Lines changed: 1 addition & 9 deletions
diff --git a/‎clang/include/clang/StaticAnalyzer/Checkers/SValExplainer.h‎
Lines changed: 1 addition & 10 deletions b/‎clang/include/clang/StaticAnalyzer/Checkers/SValExplainer.h‎
Lines changed: 1 addition & 10 deletions
diff --git a/‎clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h‎
Lines changed: 0 additions & 2 deletions b/‎clang/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h‎
Lines changed: 0 additions & 2 deletions
diff --git a/‎clang/include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h‎
Lines changed: 1 addition & 1 deletion b/‎clang/include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎clang/include/clang/StaticAnalyzer/Core/PathSensitive/LoopWidening.h‎
Lines changed: 1 addition & 2 deletions b/‎clang/include/clang/StaticAnalyzer/Core/PathSensitive/LoopWidening.h‎
Lines changed: 1 addition & 2 deletions
diff --git a/‎clang/include/clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h‎
Lines changed: 7 additions & 8 deletions b/‎clang/include/clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h‎
Lines changed: 7 additions & 8 deletions
diff --git a/‎clang/include/clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h‎
Lines changed: 27 additions & 10 deletions b/‎clang/include/clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h‎
Lines changed: 27 additions & 10 deletions
diff --git a/‎clang/include/clang/StaticAnalyzer/Core/PathSensitive/Store.h‎
Lines changed: 4 additions & 4 deletions b/‎clang/include/clang/StaticAnalyzer/Core/PathSensitive/Store.h‎
Lines changed: 4 additions & 4 deletions
diff --git a/‎clang/include/clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h‎
Lines changed: 22 additions & 49 deletions b/‎clang/include/clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h‎
Lines changed: 22 additions & 49 deletions
@@ -122,8 +122,7 @@ class CFGElement {
     return (Kind) x;
   }
 
-  void dumpToStream(llvm::raw_ostream &OS,
-                    bool TerminateWithNewLine = true) const;
+  void dumpToStream(llvm::raw_ostream &OS) const;
 
   void dump() const {
     dumpToStream(llvm::errs());
@@ -696,11 +695,6 @@ class CFGBlock {
     void dump() const {
       dumpToStream(llvm::errs());
     }
-
-    void Profile(llvm::FoldingSetNodeID &ID) const {
-      ID.AddPointer(Parent);
-      ID.AddInteger(Index);
-    }
   };
 
   template <bool IsReverse, bool IsConst> class ElementRefIterator {
@@ -1196,8 +1190,6 @@ class CFGBlock {
   }
 };
 
-using ConstCFGElementRef = CFGBlock::ConstCFGElementRef;
-
 /// CFGCallback defines methods that should be called when a logical
 /// operator error is found when building the CFG.
 class CFGCallback {
 
@@ -19,7 +19,6 @@
 #include "clang/AST/DeclCXX.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/SValVisitor.h"
 #include "llvm/ADT/StringExtras.h"
-#include "llvm/Support/raw_ostream.h"
 
 namespace clang {
 
@@ -30,13 +29,6 @@ class SValExplainer : public FullSValVisitor<SValExplainer, std::string> {
   ASTContext &ACtx;
   ProgramStateRef State;
 
-  std::string printCFGElementRef(ConstCFGElementRef Elem) {
-    std::string Str;
-    llvm::raw_string_ostream OS(Str);
-    Elem->dumpToStream(OS, /*TerminateWithNewLine=*/false);
-    return Str;
-  }
-
   std::string printStmt(const Stmt *S) {
     std::string Str;
     llvm::raw_string_ostream OS(Str);
@@ -122,8 +114,7 @@ class SValExplainer : public FullSValVisitor<SValExplainer, std::string> {
 
   std::string VisitSymbolConjured(const SymbolConjured *S) {
     return "symbol of type '" + S->getType().getAsString() +
-           "' conjured at CFG element '" +
-           printCFGElementRef(S->getCFGElementRef()) + "'";
+           "' conjured at statement '" + printStmt(S->getStmt()) + "'";
   }
 
   std::string VisitSymbolDerived(const SymbolDerived *S) {
 
@@ -151,8 +151,6 @@ class CheckerContext {
     return Pred->getSVal(S);
   }
 
-  ConstCFGElementRef getCFGElementRef() const { return Eng.getCFGElementRef(); }
-
   /// Returns true if the value of \p E is greater than or equal to \p
   /// Val under unsigned comparison.
   bool isGreaterOrEqual(const Expr *E, unsigned long long Val);
 
@@ -226,7 +226,7 @@ class ExprEngine {
     return (*G.roots_begin())->getLocation().getLocationContext();
   }
 
-  ConstCFGElementRef getCFGElementRef() const {
+  CFGBlock::ConstCFGElementRef getCFGElementRef() const {
     const CFGBlock *blockPtr = currBldrCtx ? currBldrCtx->getBlock() : nullptr;
     return {blockPtr, currStmtIdx};
   }
 
@@ -27,8 +27,7 @@ namespace ento {
 /// by the loop body in any iteration.
 ProgramStateRef getWidenedLoopState(ProgramStateRef PrevState,
                                     const LocationContext *LCtx,
-                                    unsigned BlockCount,
-                                    ConstCFGElementRef Elem);
+                                    unsigned BlockCount, const Stmt *LoopStmt);
 
 } // end namespace ento
 } // end namespace clang
 
@@ -313,7 +313,7 @@ class ProgramState : public llvm::FoldingSetNode {
   /// be triggered by this event.
   ///
   /// \param Regions the set of regions to be invalidated.
-  /// \param Elem The CFG Element that caused the invalidation.
+  /// \param E the expression that caused the invalidation.
   /// \param BlockCount The number of times the current basic block has been
   ///        visited.
   /// \param CausesPointerEscape the flag is set to true when the invalidation
@@ -325,17 +325,16 @@ class ProgramState : public llvm::FoldingSetNode {
   /// \param ITraits information about special handling for particular regions
   ///        or symbols.
   [[nodiscard]] ProgramStateRef
-  invalidateRegions(ArrayRef<const MemRegion *> Regions,
-                    ConstCFGElementRef Elem, unsigned BlockCount,
-                    const LocationContext *LCtx, bool CausesPointerEscape,
-                    InvalidatedSymbols *IS = nullptr,
+  invalidateRegions(ArrayRef<const MemRegion *> Regions, const Stmt *S,
+                    unsigned BlockCount, const LocationContext *LCtx,
+                    bool CausesPointerEscape, InvalidatedSymbols *IS = nullptr,
                     const CallEvent *Call = nullptr,
                     RegionAndSymbolInvalidationTraits *ITraits = nullptr) const;
 
   [[nodiscard]] ProgramStateRef
-  invalidateRegions(ArrayRef<SVal> Values, ConstCFGElementRef Elem,
-                    unsigned BlockCount, const LocationContext *LCtx,
-                    bool CausesPointerEscape, InvalidatedSymbols *IS = nullptr,
+  invalidateRegions(ArrayRef<SVal> Values, const Stmt *S, unsigned BlockCount,
+                    const LocationContext *LCtx, bool CausesPointerEscape,
+                    InvalidatedSymbols *IS = nullptr,
                     const CallEvent *Call = nullptr,
                     RegionAndSymbolInvalidationTraits *ITraits = nullptr) const;
 
 
@@ -19,7 +19,6 @@
 #include "clang/AST/Expr.h"
 #include "clang/AST/ExprObjC.h"
 #include "clang/AST/Type.h"
-#include "clang/Analysis/CFG.h"
 #include "clang/Basic/LLVM.h"
 #include "clang/Basic/LangOptions.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/BasicValueFactory.h"
@@ -172,11 +171,19 @@ class SValBuilder {
 
   // Forwarding methods to SymbolManager.
 
-  const SymbolConjured *conjureSymbol(ConstCFGElementRef Elem,
+  const SymbolConjured* conjureSymbol(const Stmt *stmt,
                                       const LocationContext *LCtx,
-                                      QualType type, unsigned visitCount,
+                                      QualType type,
+                                      unsigned visitCount,
                                       const void *symbolTag = nullptr) {
-    return SymMgr.conjureSymbol(Elem, LCtx, type, visitCount, symbolTag);
+    return SymMgr.conjureSymbol(stmt, LCtx, type, visitCount, symbolTag);
+  }
+
+  const SymbolConjured* conjureSymbol(const Expr *expr,
+                                      const LocationContext *LCtx,
+                                      unsigned visitCount,
+                                      const void *symbolTag = nullptr) {
+    return SymMgr.conjureSymbol(expr, LCtx, visitCount, symbolTag);
   }
 
   /// Construct an SVal representing '0' for the specified type.
@@ -192,19 +199,29 @@ class SValBuilder {
   /// preserve the relation between related(or even equivalent) expressions, so
   /// conjured symbols should be used sparingly.
   DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag,
-                                        ConstCFGElementRef elem,
+                                        const Expr *expr,
                                         const LocationContext *LCtx,
                                         unsigned count);
-  DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag,
-                                        ConstCFGElementRef elem,
+  DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag, const Stmt *S,
                                         const LocationContext *LCtx,
                                         QualType type, unsigned count);
-  DefinedOrUnknownSVal conjureSymbolVal(ConstCFGElementRef elem,
+  DefinedOrUnknownSVal conjureSymbolVal(const Stmt *stmt,
                                         const LocationContext *LCtx,
-                                        QualType type, unsigned visitCount);
+                                        QualType type,
+                                        unsigned visitCount);
 
   /// Conjure a symbol representing heap allocated memory region.
-  DefinedSVal getConjuredHeapSymbolVal(ConstCFGElementRef elem,
+  ///
+  /// Note, the expression should represent a location.
+  DefinedSVal getConjuredHeapSymbolVal(const Expr *E,
+                                       const LocationContext *LCtx,
+                                       unsigned Count);
+
+  /// Conjure a symbol representing heap allocated memory region.
+  ///
+  /// Note, now, the expression *doesn't* need to represent a location.
+  /// But the type need to!
+  DefinedSVal getConjuredHeapSymbolVal(const Expr *E,
                                        const LocationContext *LCtx,
                                        QualType type, unsigned Count);
 
 
@@ -14,13 +14,13 @@
 #define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_STORE_H
 
 #include "clang/AST/Type.h"
-#include "clang/Basic/LLVM.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState_Fwd.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/StoreRef.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/SymExpr.h"
+#include "clang/Basic/LLVM.h"
 #include "llvm/ADT/ArrayRef.h"
 #include "llvm/ADT/DenseSet.h"
 #include "llvm/ADT/SmallVector.h"
@@ -223,7 +223,7 @@ class StoreManager {
   ///
   /// \param[in] store The initial store.
   /// \param[in] Values The values to invalidate.
-  /// \param[in] Elem The current CFG Element being evaluated. Used to conjure
+  /// \param[in] S The current statement being evaluated. Used to conjure
   ///   symbols to mark the values of invalidated regions.
   /// \param[in] Count The current block count. Used to conjure
   ///   symbols to mark the values of invalidated regions.
@@ -241,8 +241,8 @@ class StoreManager {
   ///   even if they do not currently have bindings. Pass \c NULL if this
   ///   information will not be used.
   virtual StoreRef invalidateRegions(
-      Store store, ArrayRef<SVal> Values, ConstCFGElementRef Elem,
-      unsigned Count, const LocationContext *LCtx, const CallEvent *Call,
+      Store store, ArrayRef<SVal> Values, const Stmt *S, unsigned Count,
+      const LocationContext *LCtx, const CallEvent *Call,
       InvalidatedSymbols &IS, RegionAndSymbolInvalidationTraits &ITraits,
       InvalidatedRegions *TopLevelRegions, InvalidatedRegions *Invalidated) = 0;
 
 
@@ -80,62 +80,29 @@ class SymbolRegionValue : public SymbolData {
 /// A symbol representing the result of an expression in the case when we do
 /// not know anything about what the expression is.
 class SymbolConjured : public SymbolData {
-  ConstCFGElementRef Elem;
+  const Stmt *S;
   QualType T;
   unsigned Count;
   const LocationContext *LCtx;
   const void *SymbolTag;
 
   friend class SymExprAllocator;
-  SymbolConjured(SymbolID sym, ConstCFGElementRef elem,
-                 const LocationContext *lctx, QualType t, unsigned count,
-                 const void *symbolTag)
-      : SymbolData(SymbolConjuredKind, sym), Elem(elem), T(t), Count(count),
+  SymbolConjured(SymbolID sym, const Stmt *s, const LocationContext *lctx,
+                 QualType t, unsigned count, const void *symbolTag)
+      : SymbolData(SymbolConjuredKind, sym), S(s), T(t), Count(count),
         LCtx(lctx), SymbolTag(symbolTag) {
+    // FIXME: 's' might be a nullptr if we're conducting invalidation
+    // that was caused by a destructor call on a temporary object,
+    // which has no statement associated with it.
+    // Due to this, we might be creating the same invalidation symbol for
+    // two different invalidation passes (for two different temporaries).
     assert(lctx);
     assert(isValidTypeForSymbol(t));
   }
 
 public:
-  ConstCFGElementRef getCFGElementRef() const { return Elem; }
-
-  // It might return null.
-  const Stmt *getStmt() const {
-    switch (Elem->getKind()) {
-    case CFGElement::Initializer:
-      return Elem->castAs<CFGInitializer>().getInitializer()->getInit();
-    case CFGElement::ScopeBegin:
-      return Elem->castAs<CFGScopeBegin>().getTriggerStmt();
-    case CFGElement::ScopeEnd:
-      return Elem->castAs<CFGScopeEnd>().getTriggerStmt();
-    case CFGElement::NewAllocator:
-      return Elem->castAs<CFGNewAllocator>().getAllocatorExpr();
-    case CFGElement::LifetimeEnds:
-      return Elem->castAs<CFGLifetimeEnds>().getTriggerStmt();
-    case CFGElement::LoopExit:
-      return Elem->castAs<CFGLoopExit>().getLoopStmt();
-    case CFGElement::Statement:
-      return Elem->castAs<CFGStmt>().getStmt();
-    case CFGElement::Constructor:
-      return Elem->castAs<CFGConstructor>().getStmt();
-    case CFGElement::CXXRecordTypedCall:
-      return Elem->castAs<CFGCXXRecordTypedCall>().getStmt();
-    case CFGElement::AutomaticObjectDtor:
-      return Elem->castAs<CFGAutomaticObjDtor>().getTriggerStmt();
-    case CFGElement::DeleteDtor:
-      return Elem->castAs<CFGDeleteDtor>().getDeleteExpr();
-    case CFGElement::BaseDtor:
-      return nullptr;
-    case CFGElement::MemberDtor:
-      return nullptr;
-    case CFGElement::TemporaryDtor:
-      return Elem->castAs<CFGTemporaryDtor>().getBindTemporaryExpr();
-    case CFGElement::CleanupFunction:
-      return nullptr;
-    }
-    return nullptr;
-  }
-
+  /// It might return null.
+  const Stmt *getStmt() const { return S; }
   unsigned getCount() const { return Count; }
   /// It might return null.
   const void *getTag() const { return SymbolTag; }
@@ -146,19 +113,19 @@ class SymbolConjured : public SymbolData {
 
   void dumpToStream(raw_ostream &os) const override;
 
-  static void Profile(llvm::FoldingSetNodeID &profile, ConstCFGElementRef Elem,
+  static void Profile(llvm::FoldingSetNodeID &profile, const Stmt *S,
                       const LocationContext *LCtx, QualType T, unsigned Count,
                       const void *SymbolTag) {
     profile.AddInteger((unsigned)SymbolConjuredKind);
-    profile.Add(Elem);
+    profile.AddPointer(S);
     profile.AddPointer(LCtx);
     profile.Add(T);
     profile.AddInteger(Count);
     profile.AddPointer(SymbolTag);
   }
 
   void Profile(llvm::FoldingSetNodeID& profile) override {
-    Profile(profile, Elem, LCtx, T, Count, SymbolTag);
+    Profile(profile, S, LCtx, T, Count, SymbolTag);
   }
 
   // Implement isa<T> support.
@@ -566,12 +533,18 @@ class SymbolManager {
   template <typename SymExprT, typename... Args>
   const SymExprT *acquire(Args &&...args);
 
-  const SymbolConjured *conjureSymbol(ConstCFGElementRef Elem,
+  const SymbolConjured *conjureSymbol(const Stmt *E,
                                       const LocationContext *LCtx, QualType T,
                                       unsigned VisitCount,
                                       const void *SymbolTag = nullptr) {
+    return acquire<SymbolConjured>(E, LCtx, T, VisitCount, SymbolTag);
+  }
 
-    return acquire<SymbolConjured>(Elem, LCtx, T, VisitCount, SymbolTag);
+  const SymbolConjured* conjureSymbol(const Expr *E,
+                                      const LocationContext *LCtx,
+                                      unsigned VisitCount,
+                                      const void *SymbolTag = nullptr) {
+    return conjureSymbol(E, LCtx, E->getType(), VisitCount, SymbolTag);
   }
 
   QualType getType(const SymExpr *SE) const {
Original file line number	Diff line number	Diff line change
`@@ -151,8 +151,6 @@ class CheckerContext {`
`151`	`151`	`return Pred->getSVal(S);`
`152`	`152`	`}`
`153`	`153`
`154`		`- ConstCFGElementRef getCFGElementRef() const { return Eng.getCFGElementRef(); }`
`155`		`-`
`156`	`154`	`/// Returns true if the value of \p E is greater than or equal to \p`
`157`	`155`	`/// Val under unsigned comparison.`
`158`	`156`	`bool isGreaterOrEqual(const Expr *E, unsigned long long Val);`
Original file line number	Diff line number	Diff line change
`@@ -226,7 +226,7 @@ class ExprEngine {`
`226`	`226`	`return (*G.roots_begin())->getLocation().getLocationContext();`
`227`	`227`	`}`
`228`	`228`
`229`		`- ConstCFGElementRef getCFGElementRef() const {`
	`229`	`+ CFGBlock::ConstCFGElementRef getCFGElementRef() const {`
`230`	`230`	`const CFGBlock *blockPtr = currBldrCtx ? currBldrCtx->getBlock() : nullptr;`
`231`	`231`	`return {blockPtr, currStmtIdx};`
`232`	`232`	`}`