made to RegionStore (and related classes) in order to handle some
analyzer failures involving casts and manipulation of symbolic memory.

The root of the change is in StoreManager::CastRegion().  Instead of
using ad hoc heuristics to decide when to layer an ElementRegion on a
casted MemRegion, we now always layer an ElementRegion when the cast
type is different than the original type of the region.  This carries
the current cast information associated with a region around without
resorting to the error prone recording of "casted types" in GRState.

Along with this new policy of layering ElementRegions, I added a new
algorithm to strip away existing ElementRegions when they simply
represented casts of a base memory object.  This algorithm computes
the raw "byte offset" that an ElementRegion represents from the base
region, and allows the new ElementRegion to be based off that offset.
The added benefit is that this naturally handles a series of casts of
a MemRegion without building up a set of redundant ElementRegions
(thus canonicalizing the region view).

Other related changes that cascaded from this one (as tests were
failing in RegionStore):

- Revamped RegionStoreManager::InvalidateRegion() to completely remove
  all bindings and default values from a region and all subregions.
  Now invalidated fields are not bound directly to new symbolic
  values; instead the base region has a "default" symbol value from
  which "derived symbols" can be created.  The main advantage of this
  approach is that it allows us to invalidate a region hierarchy and
  then lazily instantiate new values no matter how deep the hierarchy
  went (i.e., regardless of the number of field accesses,
  e.g. x->f->y->z->...).  The previous approach did not do this.

- Slightly reworked RegionStoreManager::RemoveDeadBindings() to also
  incorporate live symbols and live regions that do not have direct
  bindings but also have "default values" used for lazy instantiation.
  The changes to 'InvalidateRegion' revealed that these were necessary
  in order to achieve lazy instantiation of values in the region store
  with those bindings being removed too early.

- The changes to InvalidateRegion() and RemoveDeadBindings() revealed
  a serious bug in 'getSubRegionMap()' where not all region -> subregion
  relationships involved in actually bindings (explicit and implicit)
  were being recorded.  This has been fixed by using a worklist algorithm
  to iteratively fill in the region map.

- Added special support to RegionStoreManager::Bind()/Retrieve() to handle
  OSAtomicCompareAndSwap in light of the new 'CastRegion' changes and the
  layering of ElementRegions.

- Fixed a bug in SymbolReaper::isLive() where derived symbols were not
  being marked live if the symbol they were derived from was also live.
  This fix was critical for getting lazy instantiation in RegionStore
  to work.

- Tidied up the implementation of ValueManager::getXXXSymbolVal() methods
  to use SymbolManager::canSymbolicate() to decide whether or not a
  symbol should be symbolicated.

- 'test/Analysis/misc-ps-xfail.m' now passes; that test case has been
  moved to 'test/Analysis/misc-ps.m'.

- Tweaked some pretty-printing of MemRegions, and implemented
  'ElementRegion::getRawOffset()' for use with the CastRegion changes.

llvm-svn: 77782

Temporarily disable out-of-bounds checking.  The current checking logic will not work quite right with the changes I'm about to commit.

llvm-svn: 77779

llvm-svn: 77651

llvm-svn: 77589

Move all components creation code into AnalysisConsumer::DigestAnalyzerOptions().

llvm-svn: 77585

llvm-svn: 77577

AnalysisContext.

llvm-svn: 77563

  Type::getAsReferenceType() -> Type::getAs<ReferenceType>()
  Type::getAsRecordType() -> Type::getAs<RecordType>()
  Type::getAsPointerType() -> Type::getAs<PointerType>()
  Type::getAsBlockPointerType() -> Type::getAs<BlockPointerType>()
  Type::getAsLValueReferenceType() -> Type::getAs<LValueReferenceType>()
  Type::getAsRValueReferenceType() -> Type::getAs<RValueReferenceType>()
  Type::getAsMemberPointerType() -> Type::getAs<MemberPointerType>()
  Type::getAsReferenceType() -> Type::getAs<ReferenceType>()
  Type::getAsTagType() -> Type::getAs<TagType>()
  
And remove Type::getAsReferenceType(), etc.

This change is similar to one I made a couple weeks ago, but that was partly
reverted pending some additional design discussion. With Doug's pending smart
pointer changes for Types, it seemed natural to take this approach.

llvm-svn: 77510

OldCastRegion used), and the associated command line option
'-analyzer-store=old-basic-cast'.

llvm-svn: 77509

we don't care about ElementRegions layered on top of a base region.

llvm-svn: 77484

in StoreManager to RegionStoreManager, and create a special, highly reduced
version in BasicStoreManager.

These changes are in preparation for future RegionStore-specific changes to
InvalidateRegion.

llvm-svn: 77483

index 0.  This will be used for refinements to InvalidateRegion and CastRegion.

llvm-svn: 77481

llvm-svn: 77479

llvm-svn: 77447

could cause false positives if any the subexpressions had side-effects. These
initializers weren't evaluated because the StoreManager would need to handle
them, but that's an orthogonal problem of whether or not the StoreManager can
handle the binding.

llvm-svn: 77361

was created but not added to the destination NodeSet.  This fixes PR 4630.

llvm-svn: 77353

valid SourceLocation.

llvm-svn: 77280

calls to noreturn function pointers when CFG building.

llvm-svn: 77089

llvm-svn: 77012

if the DeclRefExpr is a float, not just either argument.

llvm-svn: 76998

llvm-svn: 76955

TryEvaluateBool instead of using a raw 'int'.  This avoids any
confusion of how 'int' converts to bool, and makes the resultant code
easier to read.

Condense a bunch of 'addSuccessor()' calls in 'if ... else' to use the
ternary operator instead.

llvm-svn: 76947

llvm-svn: 76940

llvm-svn: 76924

llvm-svn: 76911

llvm-svn: 76905

llvm-svn: 76901

This implements <rdar://problem/6336718> and checks for CERT secure coding
advisory FLP30-C.

llvm-svn: 76900

 - Root is the main function or 0.
 - ExternalCallingNode has edges to all external functions.

llvm-svn: 76876

 - change the DenseMap used in callgraph to std::map, since DenseMap cannot
   be used with mapped_iterator and friends.

llvm-svn: 76874

--- Reverse-merging r76831 into '.':
U    include/clang/Analysis/PathSensitive/GRExprEngine.h
U    lib/Analysis/GRExprEngine.cpp

llvm-svn: 76851

llvm-svn: 76833

llvm-svn: 76831

llvm-svn: 76814

Educate GRExprEngine::VisitGraph() about 'PreStmt'.

Mark the constructor of 'PostStmt' to be explicit, preventing implicit
conversions and the selection of the wrong 'generateNode' method in
GRStmtNodeBuilder.

Constify a bunch of arguments, which falls out of the changes to ProgramPoint.

llvm-svn: 76809

'Checker' interface. An updated test case illustrates that after calling a
function with the 'nonnull' attribute we now register the fact that the passed
pointer must be non-null. This retention of information was not possible with
the previously used GRSimpleAPICheck interface.

llvm-svn: 76797

llvm-svn: 76795

Add a 'previsit' stage (that dispatches to registered Checkers) when evaluating the effects of CallExprs.

llvm-svn: 76794

llvm-svn: 76792

BugReporter API.  No real functionality change.

llvm-svn: 76760