• Home
  • History
  • Annotate
  • only in /external/clang/include/clang/StaticAnalyzer/Core/BugReporter/
History log of /external/clang/include/clang/StaticAnalyzer/Core/BugReporter/
Revision Date Author Comments (<<< Hide modified files) (Show modified files >>>)
6bcf27bb9a4b5c3f79cb44c0e4654a6d7619ad89 29-May-2014 Stephen Hines <srhines@google.com> Update Clang for 3.5 rebase (r209713).

Change-Id: I8c9133b0f8f776dc915f270b60f94962e771bc83
651f13cea278ec967336033dd032faef0e9fc2ec 24-Apr-2014 Stephen Hines <srhines@google.com> Updated to Clang 3.5a.

Change-Id: I8127eb568f674c2e72635b639a3295381fe8af82
9568d1c45feef22713afa551d06d60a05dc07133 21-Oct-2013 Rafael Espindola <rafael.espindola@gmail.com> Cleanup redundant include.

Patch by Daniel Marjamäki.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@193093 91177308-0d34-0410-b5e6-96231b3b80d8
063820655db8121f0022a7c51458463c7250324c 20-Oct-2013 Benjamin Kramer <benny.kra@googlemail.com> Miscellaneous speling fixes.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@193046 91177308-0d34-0410-b5e6-96231b3b80d8
31b71f3097a338315a144067dde5b160c4e44fc9 07-Oct-2013 Jordan Rose <jordan_rose@apple.com> [analyzer] ArrayRef-ize BugReporter::EmitBasicReport.

No functionality change.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@192114 91177308-0d34-0410-b5e6-96231b3b80d8
edcc199f5861dd8ad1ec3ad1b83512d2a92e515a 04-Oct-2013 Jordan Rose <jordan_rose@apple.com> [analyzer] Replace bug category magic strings with shared constants, take 2.

Re-commit r191910 (reverted in r191936) with layering violation fixed, by
moving the bug categories to StaticAnalyzerCore instead of ...Checkers.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@191937 91177308-0d34-0410-b5e6-96231b3b80d8
10a61586e12fcd94dad877cbcf09cc34aec980d8 04-Oct-2013 Richard Smith <richard-llvm@metafoo.co.uk> Temporarily revert r191910 until the layering violation can be fixed.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@191936 91177308-0d34-0410-b5e6-96231b3b80d8
4587cace907ed9a68256bdae506fbb8d93ac232c 03-Oct-2013 Jordan Rose <jordan_rose@apple.com> [analyzer] Replace bug category magic strings with shared constants.

One small functionality change is to bring the sizeof-pointer checker in
line with the other checkers by making its category be "Logic error"
instead of just "Logic". There should be no other functionality changes.

Patch by Daniel Marjamäki!

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@191910 91177308-0d34-0410-b5e6-96231b3b80d8
5fba5a789a238c29ef811a39a39be722443ec1b1 16-Aug-2013 Jordan Rose <jordan_rose@apple.com> [analyzer] Merge TextPathDiagnostics and ClangDiagPathDiagConsumer.

This once again restores notes to following their associated warnings
in -analyzer-output=text mode. (This is still only intended for use as a
debugging aid.)

One twist is that the warning locations in "regular" analysis output modes
(plist, multi-file-plist, html, and plist-html) are reported at a different
location on the command line than in the output file, since the command
line has no path context. This commit makes -analyzer-output=text behave
like a normal output format, which means that the *command line output
will be different* in -analyzer-text mode. Again, since -analyzer-text is
a debugging aid and lo-fi stand-in for a regular output mode, this change
makes sense.

Along the way, remove a few pieces of stale code related to the path
diagnostic consumers.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@188514 91177308-0d34-0410-b5e6-96231b3b80d8
632182d0e2011a6e21cf9abe34eef5a1f037e7ef 06-Jun-2013 Jordan Rose <jordan_rose@apple.com> [analyzer] Improve debug output for PathDiagnosticPieces.

You can now dump a single PathDiagnosticPiece or PathDiagnosticLocation.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@183367 91177308-0d34-0410-b5e6-96231b3b80d8
d1913d89e2ff3b38bb6293833cfd9d8ead76348e 18-May-2013 Jordan Rose <jordan_rose@apple.com> [analyzer] Add a debug dump for PathPieces, a list of PathDiagnosticPieces.

Originally implemented by Ted, extended by me.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@182186 91177308-0d34-0410-b5e6-96231b3b80d8
d95b70175646829c26344d5f0bda1ec3009f2a5b 17-May-2013 Anna Zaks <ganna@apple.com> [analyzer] Add an option to use the last location in the main source file as the report location.

Previously, we’ve used the last location of the analyzer issue path as the location of the
report. This might not provide the best user experience, when one analyzer a source
file and the issue appears in the header. Introduce an option to use the last location
of the path that is in the main source file as the report location.

New option can be enabled with -analyzer-config report-in-main-source-file=true.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@182058 91177308-0d34-0410-b5e6-96231b3b80d8
7247c88d1e41514a41085f83ebf03dd5220e054a 15-May-2013 David Blaikie <dblaikie@gmail.com> Use only explicit bool conversion operator

The most common (non-buggy) case are where such objects are used as
return expressions in bool-returning functions or as boolean function
arguments. In those cases I've used (& added if necessary) a named
function to provide the equivalent (or sometimes negative, depending on
convenient wording) test.

DiagnosticBuilder kept its implicit conversion operator owing to the
prevalent use of it in return statements.

One bug was found in ExprConstant.cpp involving a comparison of two
PointerUnions (PointerUnion did not previously have an operator==, so
instead both operands were converted to bool & then compared). A test
is included in test/SemaCXX/constant-expression-cxx1y.cpp for the fix
(adding operator== to PointerUnion in LLVM).

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@181869 91177308-0d34-0410-b5e6-96231b3b80d8
15676bec6fa9ad9466d93c163f2d1b8a3f559b3a 04-May-2013 Ted Kremenek <kremenek@apple.com> [analyzer;alternate edges] start experimenting with control flow "barriers" to prevent an edge being optimized away.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@181088 91177308-0d34-0410-b5e6-96231b3b80d8
bb521b8f14ca29ee4e17ae1f9877586ef0bf8378 04-May-2013 Ted Kremenek <kremenek@apple.com> [analyzer; alternate edges] prune edges whose end/begin locations have the same statement parents.

This change required some minor changes to LocationContextMap to have it map
from PathPieces to LocationContexts instead of PathDiagnosticCallPieces to
LocationContexts. These changes are in the other diagnostic
generation logic as well, but are functionally equivalent.

Interestingly, this optimize requires delaying "cleanUpLocation()" until
later; possibly after all edges have been optimized. This is because
we need PathDiagnosticLocations to refer to the semantic entity (e.g. a statement)
as long as possible. Raw source locations tell us nothing about
the semantic relationship between two locations in a path.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@181084 91177308-0d34-0410-b5e6-96231b3b80d8
af2836593979d4973bec5bd21f10eb6cc0d0f3e3 03-May-2013 Ted Kremenek <kremenek@apple.com> [analyzer] Start hacking up alternate control-flow edge generation. WIP. Not guaranteed to do anything useful yet.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@181040 91177308-0d34-0410-b5e6-96231b3b80d8
d306a530fca74e40916121f5583e0545e470b3c4 03-May-2013 Ted Kremenek <kremenek@apple.com> Re-apply 180974 with the build error fixed. This was the result
of a weird merge error with git.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@180981 91177308-0d34-0410-b5e6-96231b3b80d8
ae8c50552df2498130dd33a940d98e0dc4ec26b9 03-May-2013 Rafael Espindola <rafael.espindola@gmail.com> Revert "Change LocationContextMap to be a temporary instead of shared variable in BugReporter."

This reverts commit 180974. It broke the build.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@180979 91177308-0d34-0410-b5e6-96231b3b80d8
c70fac3c52092013b08163187f034b73c94bf3d0 03-May-2013 Ted Kremenek <kremenek@apple.com> Change LocationContextMap to be a temporary instead of shared variable in BugReporter.

BugReporter is used to process ALL bug reports. By using a shared map,
we are having mappings from different PathDiagnosticPieces to LocationContexts
well beyond the point where we are processing a given report. This
state is inherently error prone, and is analogous to using a global
variable. Instead, just create a temporary map, one per report,
and when we are done with it we throw it away. No extra state.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@180974 91177308-0d34-0410-b5e6-96231b3b80d8
eb9380db6fcc960d4a589f0acb94b0897821d26f 30-Apr-2013 Ted Kremenek <kremenek@apple.com> Just use std::list<> for PathPieces instead of complicated use of ilist.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@180747 91177308-0d34-0410-b5e6-96231b3b80d8
ed866e73bab7733f5226f84c52edefe23d694b2f 30-Apr-2013 Ted Kremenek <kremenek@apple.com> Revert "[analyzer] Change PathPieces to be a wrapper around an ilist of (through indirection) PathDiagnosticPieces."

Jordan rightly pointed out that we can do the same with std::list.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@180746 91177308-0d34-0410-b5e6-96231b3b80d8
7651e53997e20f1e627ffce25ce613f79c48e3e3 30-Apr-2013 Ted Kremenek <kremenek@apple.com> [analyzer] Change PathPieces to be a wrapper around an ilist of (through indirection) PathDiagnosticPieces.

Much of this patch outside of PathDiagnostics.h are just minor
syntactic changes due to the return type for operator* and the like
changing for the iterator, so the real focus should be on
PathPieces itself.

This change is motivated so that we can do efficient insertion
and removal of individual pieces from within a PathPiece, just like
this was a kind of "IR" for static analyzer diagnostics. We
currently implement path transformations by iterating over an
entire PathPiece and making a copy. This isn't very natural for
some algorithms.

We use an ilist here instead of std::list because we want operations
to rip out/insert nodes in place, just like IR manipulation. This
isn't being used yet, but opens the door for more powerful
transformation algorithms on diagnostic paths.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@180741 91177308-0d34-0410-b5e6-96231b3b80d8
0f8579274a010f360a371b53101859d9d6052314 24-Apr-2013 Anna Zaks <ganna@apple.com> [analyzer] Refactor BugReport::getLocation and PathDiagnosticLocation::createEndOfPath for greater code reuse

The 2 functions were computing the same location using different logic (each one had edge case bugs that the other
one did not). Refactor them to rely on the same logic.

The location of the warning reported in text/command line output format will now match that of the plist file.

There is one change in the plist output as well. When reporting an error on a BinaryOperator, we use the location of the
operator instead of the beginning of the BinaryOperator expression. This matches our output on command line and
looks better in most cases.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@180165 91177308-0d34-0410-b5e6-96231b3b80d8
5b90ae7ba05a10a81f107ec1635deb1bd7292936 18-Apr-2013 Anna Zaks <ganna@apple.com> [analyzer] Allow TrackConstraintBRVisitor to work when the value it’s tracking is not live in the last node of the path

We always register the visitor on a node in which the value we are tracking is live and constrained. However,
the visitation can restart at a node, later on the path, in which the value is under constrained because
it is no longer live. Previously, we just silently stopped tracking in that case.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@179731 91177308-0d34-0410-b5e6-96231b3b80d8
84e8a960ad76b3c7ca550b4cc92a1b90ed16d5c1 29-Mar-2013 Anna Zaks <ganna@apple.com> [analyzer] Address Jordan’s review of r178309 - do not register an extra visitor for nil receiver

We can check if the receiver is nil in the node that corresponds to the StmtPoint of the message send.
At that point, the receiver is guaranteed to be live. We will find at least one unreclaimed node due to
my previous commit (look for StmtPoint instead of PostStmt) and the fact that the nil receiver nodes are tagged.

+ a couple of extra tests.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@178381 91177308-0d34-0410-b5e6-96231b3b80d8
aabb4c5eacca6d78ef778f33ec5cd4c755d71a39 29-Mar-2013 Anna Zaks <ganna@apple.com> [analyzer] Apply the suppression rules to the nil receiver only if the value participates in the computation of the nil we warn about.

We should only suppress a bug report if the IDCed or null returned nil value is directly related to the value we are warning about. This was
not the case for nil receivers - we would suppress a bug report that had an IDCed nil receiver on the path regardless of how it’s
related to the warning.

1) Thread EnableNullFPSuppression parameter through the visitors to differentiate between tracking the value which
is directly responsible for the bug and other values that visitors are tracking (ex: general tracking of nil receivers).
2) in trackNullOrUndef specifically address the case when a value of the message send is nil due to the receiver being nil.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@178309 91177308-0d34-0410-b5e6-96231b3b80d8
4a49df3be929d442535d6721ab8a2bbc8a7cd528 27-Mar-2013 Anna Zaks <ganna@apple.com> [analyzer] Ensure that the node NilReceiverBRVisitor is looking for is not reclaimed

The visitor should look for the PreStmt node as the receiver is nil in the PreStmt and this is the node. Also, tag the nil
receiver nodes with a special tag for consistency.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@178152 91177308-0d34-0410-b5e6-96231b3b80d8
85a92cfa52ddf4c45fe2baca4d7fea0bdc5ed103 19-Mar-2013 Jordan Rose <jordan_rose@apple.com> [analyzer] Replace uses of assume() with isNull() in BR visitors.

Also, replace a std::string with a SmallString.

No functionality change.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@177352 91177308-0d34-0410-b5e6-96231b3b80d8
a4bb4f6ca8dd31ad96cb9526a5abe1273f18ff40 14-Mar-2013 Anna Zaks <ganna@apple.com> [analyzer] Change the way in which IDC Visitor decides to kick in and make sure it attaches in the given edge case

In the test case below, the value V is not constrained to 0 in ErrorNode but it is in node N.
So we used to fail to register the Suppression visitor.

We also need to change the way we determine that the Visitor should kick in because the node N belongs to
the ExplodedGraph and might not be on the BugReporter path that the visitor sees. Instead of trying to match the node,
turn on the visitor when we see the last node in which the symbol is ‘0’.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@177121 91177308-0d34-0410-b5e6-96231b3b80d8
0415998dd77986630efe8f1aed633519cc41e1f3 09-Mar-2013 Anna Zaks <ganna@apple.com> [analyzer] Make Suppress IDC checker aware that it might not start from the same node it was registered at

The visitor used to assume that the value it’s tracking is null in the first node it examines. This is not true.
If we are registering the Suppress Inlined Defensive checks visitor while traversing in another visitor
(such as FindlastStoreVisitor). When we restart with the IDC visitor, the invariance of the visitor does
not hold since the symbol we are tracking no longer exists at that point.

I had to pass the ErrorNode when creating the IDC visitor, because, in some cases, node N is
neither the error node nor will be visible along the path (we had not finalized the path at that point
and are dealing with ExplodedGraph.)

We should revisit the other visitors which might not be aware that they might get nodes, which are
later in path than the trigger point.

This suppresses a number of inline defensive checks in JavaScriptCore.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@176756 91177308-0d34-0410-b5e6-96231b3b80d8
cc5dbdae70c6eb2423921f52a35ba4686d2969cf 02-Mar-2013 Anna Zaks <ganna@apple.com> [analyzer] Simple inline defensive checks suppression

Inlining brought a few "null pointer use" false positives, which occur because
the callee defensively checks if a pointer is NULL, whereas the caller knows
that the pointer cannot be NULL in the context of the given call.

This is a first attempt to silence these warnings by tracking the symbolic value
along the execution path in the BugReporter. The new visitor finds the node
in which the symbol was first constrained to NULL. If the node belongs to
a function on the active stack, the warning is reported, otherwise, it is

There are several areas for follow up work, for example:
- How do we differentiate the cases where the first check is followed by
another one, which does happen on the active stack?

Also, this only silences a fraction of null pointer use warnings. For example, it
does not do anything for the cases where NULL was assigned inside a callee.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@176402 91177308-0d34-0410-b5e6-96231b3b80d8
0dd15d78fb0c99faa5df724139ba4c16a9a345c6 24-Feb-2013 Ted Kremenek <kremenek@apple.com> Add "KnownSVal" to represent SVals that cannot be UnknownSVal.

This provides a few sundry cleanups, and allows us to provide
a compile-time check for a case that was a runtime assertion.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@175987 91177308-0d34-0410-b5e6-96231b3b80d8
dc84cd5efdd3430efb22546b4ac656aa0540b210 20-Feb-2013 David Blaikie <dblaikie@gmail.com> Include llvm::Optional in clang/Basic/LLVM.h

Post-commit CR feedback from Jordan Rose regarding r175594.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@175679 91177308-0d34-0410-b5e6-96231b3b80d8
9ef9b8540a608a93efaaae1d26d94e8087c30b55 19-Feb-2013 David Blaikie <dblaikie@gmail.com> Use LLVM_DELETED_FUNCTION rather than '// do not implement' comments.

Also removes some redundant DNI comments on function declarations already
using the macro.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@175465 91177308-0d34-0410-b5e6-96231b3b80d8
86ff12c8a8a356ca284ca7687749216fbfd74519 30-Jan-2013 Anna Zaks <ganna@apple.com> [analyzer] Move report false positive suppression to report visitors.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@173956 91177308-0d34-0410-b5e6-96231b3b80d8
dede2fd56d053a114a65ba72583981ce7aab27da 26-Jan-2013 Jordan Rose <jordan_rose@apple.com> [analyzer] bugreporter::getDerefExpr now takes a Stmt, not an ExplodedNode.

This allows it to be used in places where the interesting statement
doesn't match up with the current node. No functionality change.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@173546 91177308-0d34-0410-b5e6-96231b3b80d8
1dfebd9f995066a229c34516eb14bc69c6bcde2c 19-Jan-2013 Anna Zaks <ganna@apple.com> [analyzer] Suppress warnings coming out of macros defined in sys/queue.h

Suppress the warning by just not emitting the report. The sink node
would get generated, which is fine since we did reach a bad state.


Due to the way code is structured in some of these macros, we do not
reason correctly about it and report false positives. Specifically, the
following loop reports a use-after-free. Because of the way the code is
structured inside of the macro, the analyzer assumes that the list can
have cycles, so you end up with use-after-free in the loop, that is
safely deleting elements of the list. (The user does not have a way to
teach the analyzer about shape of data structures.)

SLIST_FOREACH_SAFE(item, &ctx->example_list, example_le, tmpitem) {
if (item->index == 3) { // if you remove each time, no complaints
assert((&ctx->example_list)->slh_first == item);
SLIST_REMOVE(&ctx->example_list, item, example_s, example_le);

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@172883 91177308-0d34-0410-b5e6-96231b3b80d8
cfa88f893915ceb8ae4ce2f17c46c24a4d67502f 12-Jan-2013 Dmitri Gribenko <gribozavr@gmail.com> Remove useless 'llvm::' qualifier from names like StringRef and others that are
brought into 'clang' namespace by clang/Basic/LLVM.h

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@172323 91177308-0d34-0410-b5e6-96231b3b80d8
97bfb558f69c09b01a5c1510f08dc91eb62329a7 08-Jan-2013 Anna Zaks <ganna@apple.com> [analyzer] Include the bug uniqueing location in the issue_hash.

The issue here is that if we have 2 leaks reported at the same line for
which we cannot print the corresponding region info, they will get
treated as the same by issue_hash+description. We need to AUGMENT the
issue_hash with the allocation info to differentiate the two issues.

Add the "hash" (offset from the beginning of a function) representing
allocation site to solve the issue.

We might want to generalize solution in the future when we decide to
track more than just the 2 locations from the diagnostics.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@171825 91177308-0d34-0410-b5e6-96231b3b80d8
afa7cae15b117c4b75794c6c32424953d94b4359 07-Dec-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Fix r168019 to work with unpruned paths as well.

This is the case where the analyzer tries to print out source locations
for code within a synthesized function body, which of course does not have
a valid source location. The previous fix attempted to do this during
diagnostic path pruning, but some diagnostics have pruning disabled, and
so any diagnostic with a path that goes through a synthesized body will
either hit an assertion or emit invalid output.

<rdar://problem/12657843> (again)

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@169631 91177308-0d34-0410-b5e6-96231b3b80d8
30a2e16f6c27f888dd11eba6bbbae1e980078fcb 04-Dec-2012 Chandler Carruth <chandlerc@gmail.com> Sort #include lines for all files under include/...

This is a simpler sort, entirely automatic with the help of
llvm/utils/sort_includes.py -- no manual edits here.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@169238 91177308-0d34-0410-b5e6-96231b3b80d8
55fc873017f10f6f566b182b70f6fc22aefa3464 04-Dec-2012 Chandler Carruth <chandlerc@gmail.com> Sort all of Clang's files under 'lib', and fix up the broken headers

This required manually correcting all of the incorrect main-module
headers I could find, and running the new llvm/utils/sort_includes.py
script over the files.

I also manually added quite a few missing headers that were uncovered by
shuffling the order or moving headers up to be main-module-headers.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@169237 91177308-0d34-0410-b5e6-96231b3b80d8
368f3b070e8cb657a65bfa443d60256676d269e7 15-Nov-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Make sure calls in synthesized functions have valid path locations.

We do this by using the "most recent" good location: if a synthesized
function 'A' calls another function 'B', the path notes for the call to 'B'
will be placed at the same location as the path note for calling 'A'.

Similarly, the call to 'A' will have a note saying "Entered call from...",
and now we just don't emit that (since the user doesn't have a body to look
at anyway).

Previously, we were doing this for the "Calling..." notes, but not for the
"Entered call from..." or "Returning to caller". This caused a crash when
the path entered and then exiting a call within a synthesized body.


git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@168019 91177308-0d34-0410-b5e6-96231b3b80d8
785950e59424dca7ce0081bebf13c0acd2c4fff6 02-Nov-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Rename 'EmitReport' to 'emitReport'.

No functionality change.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@167275 91177308-0d34-0410-b5e6-96231b3b80d8
6a329ee7567cf3267ffab2bc755ea8c773d967e7 29-Oct-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] New option to not suppress null return paths if an argument is null.

Our one basic suppression heuristic is to assume that functions do not
usually return NULL. However, when one of the arguments is NULL it is
suddenly much more likely that NULL is a valid return value. In this case,
we don't suppress the report here, but we do attach /another/ visitor to
go find out if this NULL argument also comes from an inlined function's
error path.

This new behavior, controlled by the 'avoid-suppressing-null-argument-paths'
analyzer-config option, is turned off by default. Turning it on produced
two false positives and no new true positives when running over LLVM/Clang.

This is one of the possible refinements to our suppression heuristics.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@166941 91177308-0d34-0410-b5e6-96231b3b80d8
09f7bf14d25bdc55cb715bc8d40600906848a409 29-Oct-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Use the CallEnter node to get a value for tracked null arguments.

Additionally, don't collect PostStore nodes -- they are often used in
path diagnostics.

Previously, we tried to track null arguments in the same way as any other
null values, but in many cases the necessary nodes had already been
collected (a memory optimization in ExplodedGraph). Now, we fall back to
using the value of the argument at the time of the call, which may not
always match the actual contents of the region, but often will.

This is a precursor to improving our suppression heuristic.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@166940 91177308-0d34-0410-b5e6-96231b3b80d8
b85cce094887ab5cf1c47acfe306e2fb1d3cfbb1 26-Oct-2012 Ted Kremenek <kremenek@apple.com> TrackConstraintBRVisitor and ConditionBRVisitor can emit similar
path notes for cases where a value may be assumed to be null, etc.
Instead of having redundant diagnostics, do a pass over the generated
PathDiagnostic pieces and remove notes from TrackConstraintBRVisitor
that are already covered by ConditionBRVisitor, whose notes tend
to be better.

Fixes <rdar://problem/12252783>

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@166728 91177308-0d34-0410-b5e6-96231b3b80d8
b43d87b0646aa04951056c7e0d1ab9a58eb09f66 12-Oct-2012 Sean Silva <silvas@purdue.edu> Remove pointless classof()'s.

Updates to llvm/Support/Casting.h have rendered these classof()'s

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@165770 91177308-0d34-0410-b5e6-96231b3b80d8
d680b986651227b10f1e307861bc23cc89064161 12-Oct-2012 Sean Silva <silvas@purdue.edu> Add missing classof().

Somewhat troublingly, without this implemented, the check inside
isa_impl<> would silently use the parent's `classof()` when determining
whether it was okay to downcast from the parent to the child!

Bug analysis:

A build failure after removing the parent's `classof()` initially
alerted me to the bug, after which a little bit of thinking and reading
of the code identified the root cause.

The compiler could be made to prevent this bug from happening if there
were a way to ensure that in the code

template <typename To, typename From, typename Enabler = void>
struct isa_impl {
static inline bool doit(const From &Val) {
return To::classof(&Val);

that `To::classof` is actually inside the class `To`, and not in a base
class. I am not aware of a way to check this in C++. If there is a means
to perform that check, please bring it up on the list and this will be

There is a high likelihood that there are other instances of this same
bug in the codebase.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@165769 91177308-0d34-0410-b5e6-96231b3b80d8
8347d3d45e6f128bba19821f0d2f54cadd4d49bb 22-Sep-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Allow a BugReport to be marked "invalid" during path generation.

This is intended to allow visitors to make decisions about whether a
BugReport is likely a false positive. Currently there are no visitors
making use of this feature, so there are no tests.

When a BugReport is marked invalid, the invalidator must provide a key
that identifies the invaliation (intended to be the visitor type and a
context pointer of some kind). This allows us to reverse the decision
later on. Being able to reverse a decision about invalidation gives us more
flexibility, and allows us to formulate conditions like "this report is
invalid UNLESS the original argument is 'foo'". We can use this to
fine-tune our false-positive suppression (coming soon).

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164446 91177308-0d34-0410-b5e6-96231b3b80d8
615a092a511cd2dfe1a5364ebf5f80e55e33034d 22-Sep-2012 Jordan Rose <jordan_rose@apple.com> Use llvm::getOrdinalSuffix to print ordinal numbers in diagnostics.

Just a refactoring of common infrastructure. No intended functionality change.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164443 91177308-0d34-0410-b5e6-96231b3b80d8
a43df9539644bf1c258e12710cd69d79b0b078cd 21-Sep-2012 Ted Kremenek <kremenek@apple.com> Implement faux-body-synthesis of well-known functions in the static analyzer when
their implementations are unavailable. Start by simulating dispatch_sync().

This change is largely a bunch of plumbing around something very simple. We
use AnalysisDeclContext to conjure up a fake function body (using the
current ASTContext) when one does not exist. This is controlled
under the analyzer-config option "faux-bodies", which is off by default.

The plumbing in this patch is largely to pass the necessary machinery
around. CallEvent needs the AnalysisDeclContextManager to get
the function definition, as one may get conjured up lazily.

BugReporter and PathDiagnosticLocation needed to be relaxed to handle
invalid locations, as the conjured body has no real source locations.
We do some primitive recovery in diagnostic generation to generate
some reasonable locations (for arrows and events), but it can be

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164339 91177308-0d34-0410-b5e6-96231b3b80d8
be2fa7ebf01259b63dc52fe46c8d101c18e72269 18-Sep-2012 Craig Topper <craig.topper@gmail.com> Mark unimplemented copy constructors and copy assignment operators with LLVM_DELETED_FUNCTION.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164102 91177308-0d34-0410-b5e6-96231b3b80d8
fcde83c75ef72da920cfc02e24edeaf36f79f47f 10-Sep-2012 Ted Kremenek <kremenek@apple.com> Have PathDiagnosticPiece::getString() return a StringRef instead
of a std::string.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163488 91177308-0d34-0410-b5e6-96231b3b80d8
9b925ac059089dfe74e3b8fa5effe519fb9ee885 06-Sep-2012 Anna Zaks <ganna@apple.com> [analyzer] Enhance the member expr tracking to account for references.

As per Jordan's suggestion. (Came out of code review for r163261.)

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163269 91177308-0d34-0410-b5e6-96231b3b80d8
3a46f5fd1709f6df03bbb8b0abf84052dc0f39ff 31-Aug-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Ensure that PathDiagnostics profile the same regardless of path.

PathDiagnostics are actually profiled and uniqued independently of the
path on which the bug occurred. This is used to merge diagnostics that
refer to the same issue along different paths, as well as by the plist
diagnostics to reference files created by the HTML diagnostics.

However, there are two problems with the current implementation:

1) The bug description is included in the profile, but some
PathDiagnosticConsumers prefer abbreviated descriptions and some
prefer verbose descriptions. Fixed by including both descriptions in
the PathDiagnostic objects and always using the verbose one in the profile.

2) The "minimal" path generation scheme provides extra information about
which events came from macros that the "extensive" scheme does not.
This resulted not only in different locations for the plist and HTML
diagnostics, but also in diagnostics being uniqued in the plist output
but not in the HTML output. Fixed by storing the "end path" location
explicitly in the PathDiagnostic object, rather than trying to find the
last piece of the path when the diagnostic is requested.

This should hopefully finish unsticking our internal buildbot.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162965 91177308-0d34-0410-b5e6-96231b3b80d8
80de487e03dd0f44e4572e2122ebc1aa6a3961f5 29-Aug-2012 Anna Zaks <ganna@apple.com> [analyzer] Improved diagnostic pruning for calls initializing values.

This heuristic addresses the case when a pointer (or ref) is passed
to a function, which initializes the variable (or sets it to something
other than '0'). On the branch where the inlined function does not
set the value, we report use of undefined value (or NULL pointer
dereference). The access happens in the caller and the path
through the callee would get pruned away with regular path pruning. To
solve this issue, we previously disabled diagnostic pruning completely
on undefined and null pointer dereference checks, which entailed very
verbose diagnostics in most cases. Furthermore, not all of the
undef value checks had the diagnostic pruning disabled.

This patch implements the following heuristic: if we pass a pointer (or
ref) to the region (on which the error is reported) into a function and
it's value is either undef or 'NULL' (and is a pointer), do not prune
the function.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162863 91177308-0d34-0410-b5e6-96231b3b80d8
a1f81bb0e55749a1414b1b5124bb83b9052ff2ac 28-Aug-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Rename addTrackNullOrUndefValueVisitor to trackNullOrUndefValue.

This helper function (in the clang::ento::bugreporter namespace) may add more
than one visitor, but conceptually it's tracking a single use of a null or
undefined value and should do so as best it can.

Also, the BugReport parameter has been made a reference to underscore that
it is non-optional.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162720 91177308-0d34-0410-b5e6-96231b3b80d8
166b7bd43551964d65bcf4918f51a167b8374e2a 28-Aug-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Refactor FindLastStoreBRVisitor to not find the store ahead of time.

As Anna pointed out to me offline, it's a little silly to walk backwards through
the graph to find the store site when BugReporter will do the exact same walk
as part of path diagnostic generation.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162719 91177308-0d34-0410-b5e6-96231b3b80d8
b75e2602e246b44bb285be8cc31166302d77998f 24-Aug-2012 Ted Kremenek <kremenek@apple.com> Rework how PathDiagnosticConsumers pass knowledge of what files they
generated for a given diagnostic to another. Because PathDiagnostics
are specific to a give PathDiagnosticConsumer, store in
a FoldingSet a unique hash for a PathDiagnostic (that will be the same
for the same bug for different PathDiagnosticConsumers) that
stores a list of files generated. This can then be read by the
other PathDiagnosticConsumers.

This fixes breakage in the PLIST-HTML output.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162580 91177308-0d34-0410-b5e6-96231b3b80d8
2b2c49d2ac5adb34f900f7a854a3ad5a6b0dff3c 16-Aug-2012 Ted Kremenek <kremenek@apple.com> Remove "range_iterator" from PathDiagnosticPiece and just use ArrayRef<SourceRange> for ranges. This
removes conceptual clutter, and can allow us to easy migrate to C++11 style for-range loops if we
ever move to using C++11 in Clang.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162029 91177308-0d34-0410-b5e6-96231b3b80d8
c4bac8e376b98d633bb00ee5f510d5e58449753c 16-Aug-2012 Ted Kremenek <kremenek@apple.com> Allow multiple PathDiagnosticConsumers to be used with a BugReporter at the same time.

This fixes several issues:

- removes egregious hack where PlistDiagnosticConsumer would forward to HTMLDiagnosticConsumer,
but diagnostics wouldn't be generated consistently in the same way if PlistDiagnosticConsumer
was used by itself.

- emitting diagnostics to the terminal (using clang's diagnostic machinery) is no longer a special
case, just another PathDiagnosticConsumer. This also magically resolved some duplicate warnings,
as we now use PathDiagnosticConsumer's diagnostic pruning, which has scope for the entire translation
unit, not just the scope of a BugReporter (which is limited to a particular ExprEngine).

As an interesting side-effect, diagnostics emitted to the terminal also have their trailing "." stripped,
just like with diagnostics emitted to plists and HTML. This required some tests to be updated, but now
the tests have higher fidelity with what users will see.

There are some inefficiencies in this patch. We currently generate the report graph (from the ExplodedGraph)
once per PathDiagnosticConsumer, which is a bit wasteful, but that could be pulled up higher in the
logic stack. There is some intended duplication, however, as we now generate different PathDiagnostics (for the same issue)
for different PathDiagnosticConsumers. This is necessary to produce the diagnostics that a particular
consumer expects.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162028 91177308-0d34-0410-b5e6-96231b3b80d8
685379965c1b105ce89cf4f6c60810932b7f4d0d 04-Aug-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] When a symbol is null, we should track its constraints.

Because of this, we would previously emit NO path notes when a parameter
is constrained to null (because there are no stores). Now we show where we
made the assumption, which is much more useful.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@161280 91177308-0d34-0410-b5e6-96231b3b80d8
b0e1badc2a9b8275b48dfb15c6907a282b949b02 04-Aug-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Flatten path diagnostics for text output like we do for HTML.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@161279 91177308-0d34-0410-b5e6-96231b3b80d8
9da59a67a27a4d3fc9d59552f07808a32f85e9d3 04-Aug-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Track null/uninitialized C++ objects used in method calls.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@161278 91177308-0d34-0410-b5e6-96231b3b80d8
183ba8e19d49ab1ae25d3cdd0a19591369c5ab9f 26-Jul-2012 Jordan Rose <jordan_rose@apple.com> [analyzer] Show paths for destructor calls.

This modifies BugReporter and friends to handle CallEnter and CallExitEnd
program points that came from implicit call CFG nodes (read: destructors).

This required some extra handling for nested implicit calls. For example,
the added multiple-inheritance test case has a call graph that looks like this:

***bug here***

In this case we correctly notice that we started in an inlined function
when we reach the CallEnter program point for the second ~SmartPointer.
However, when we reach the next CallEnter (for ~Subclass), we were
accidentally re-using the inner ~SmartPointer call in the diagnostics.

Rather than guess if we saw the corresponding CallExitEnd based on the
contents of the active path, we now just ask the PathDiagnostic if there's
any known stack before popping off the top path.

(A similar issue could have occured without multiple inheritance, but there
wasn't a test case for it.)

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@160804 91177308-0d34-0410-b5e6-96231b3b80d8
ed7948b55fa4b2505f240cc5287137f451172b4c 31-May-2012 Ted Kremenek <kremenek@apple.com> Allow some BugReports to opt-out of PathDiagnostic callstack pruning until we have significantly
improved the pruning heuristics. The current heuristics are pretty good, but they make diagnostics
for uninitialized variables warnings particularly useless in some cases.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157734 91177308-0d34-0410-b5e6-96231b3b80d8
0b3ade86a1c60cf0c7b56aa238aff458eb7f5974 20-Apr-2012 Anna Zaks <ganna@apple.com> [analyzer] Run remove dead bindings right before leaving a function.

This is needed to ensure that we always report issues in the correct
function. For example, leaks are identified when we call remove dead
bindings. In order to make sure we report a callee's leak in the callee,
we have to run the operation in the callee's context.

This change required quite a bit of infrastructure work since:
- We used to only run remove dead bindings before a given statement;
here we need to run it after the last statement in the function. For
this, we added additional Program Point and special mode in the
SymbolReaper to remove all symbols in context lower than the current
- The call exit operation turned into a sequence of nodes, which are
now guarded by CallExitBegin and CallExitEnd nodes for clarity and

(Sorry for the long diff.)

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155244 91177308-0d34-0410-b5e6-96231b3b80d8
6fd4505ad67a186da8cc26fdb493c93fe4937555 05-Apr-2012 Ted Kremenek <kremenek@apple.com> Require that all static analyzer issues have a category. As part of this change,
consolidate some commonly used category strings into global references (more of this can be done, I just did a few).

Fixes <rdar://problem/11191537>.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154121 91177308-0d34-0410-b5e6-96231b3b80d8
07189521a15d9c088216b943649cb9fe231cbb57 04-Apr-2012 Ted Kremenek <kremenek@apple.com> Include the "issue context" (e.g. function or method) where a static analyzer issue occurred in the plist output.

Fixes <rdar://problem/11004527>

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@154030 91177308-0d34-0410-b5e6-96231b3b80d8
4a5f724538cbc275370c9504e8169ce92503256c 01-Apr-2012 Benjamin Kramer <benny.kra@googlemail.com> Analyzer: Store BugReports directly in a ilist instead of adding another layer of inderection with std::list

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153847 91177308-0d34-0410-b5e6-96231b3b80d8
d961ea91e14fdf4047db3e891def9951ee7afde1 24-Mar-2012 Benjamin Kramer <benny.kra@googlemail.com> Don't cast away constness.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153381 91177308-0d34-0410-b5e6-96231b3b80d8
3bc75ca0a636efdc93471c9b6bad43085a22bf3a 24-Mar-2012 Jordy Rose <jediknil@belkadan.com> [analyzer] Restart path diagnostic generation if any of the visitors change the report configuration while walking the path.

This required adding a change count token to BugReport, but also allowed us to ditch ImmutableList as the BugReporterVisitor data type.

Also, remove the hack from MallocChecker, now that visitors appear in the opposite order. This is not exactly a fix, but the common case -- custom diagnostics after generic ones -- is now the default behavior.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153369 91177308-0d34-0410-b5e6-96231b3b80d8
011534973e83db51f49098871186238fc64d5f54 24-Mar-2012 Jordy Rose <jediknil@belkadan.com> [analyzer] Add a clone() method to BugReporterVisitor, so that we'll be able to reset diagnostic generation.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153368 91177308-0d34-0410-b5e6-96231b3b80d8
8fe4525680ce72e90cee3e58b5654e3ae955447f 17-Mar-2012 NAKAMURA Takumi <geek4civic@gmail.com> StaticAnalyzer: Fix abuse of StringRef in r152962.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152982 91177308-0d34-0410-b5e6-96231b3b80d8
fbd58743fa6c793b84ed60a0e2325335a53da6c4 17-Mar-2012 Anna Zaks <ganna@apple.com> [analyzer] Shorten the stack hint diagnostic.

Do not display the standard "Returning from 'foo'", when a stack hint is

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152964 91177308-0d34-0410-b5e6-96231b3b80d8
56a938ff85a444eb3d30d2634d92ce5b1f6fae56 17-Mar-2012 Anna Zaks <ganna@apple.com> [analyzer] Create symbol-aware stack hints (building upon r152837).

The symbol-aware stack hint combines the checker-provided message
with the information about how the symbol was passed to the callee: as
a parameter or a return value.

For malloc, the generated messages look like this :
"Returning from 'foo'; released memory via 1st parameter"
"Returning from 'foo'; allocated memory via 1st parameter"
"Returning from 'foo'; allocated memory returned"
"Returning from 'foo'; reallocation of 1st parameter failed"

(We are yet to handle cases when the symbol is a field in a struct or
an array element.)

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152962 91177308-0d34-0410-b5e6-96231b3b80d8
368a0d565f078666ca5bfb7fe08d04648688e4bc 15-Mar-2012 Anna Zaks <ganna@apple.com> [analyzer] Allow checkers to supply call stack diagnostic hints for the
BugVisitor DiagnosticPieces.

When checkers create a DiagnosticPieceEvent, they can supply an extra
string, which will be concatenated with the call exit message for every
call on the stack between the diagnostic event and the final bug report.
(This is a simple version, which could be/will be further enhanced.)

For example, this is used in Malloc checker to produce the ",
which allocated memory" in the following example:

static char *malloc_wrapper() { // 2. Entered call from 'use'
return malloc(12); // 3. Memory is allocated

void use() {
char *v;
v = malloc_wrapper(); // 1. Calling 'malloc_wrappers'
// 4. Returning from 'malloc_wrapper', which allocated memory
} // 5. Memory is never released; potential
memory leak

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152837 91177308-0d34-0410-b5e6-96231b3b80d8
3183075ff18449594090aacb1793d66f58a95429 14-Mar-2012 Anna Zaks <ganna@apple.com> [analyzer] A fixup to r152734. Always initialize the flag.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152742 91177308-0d34-0410-b5e6-96231b3b80d8
9373937945e1e075dfa08169eaccc1ad0b31f699 14-Mar-2012 Anna Zaks <ganna@apple.com> [analyzer] Diagnostics: Supply Caller information even if the bug occurs
in the callee.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152734 91177308-0d34-0410-b5e6-96231b3b80d8
76aadc346c3a4c363238a1e1232f324c3355d9e0 09-Mar-2012 Ted Kremenek <kremenek@apple.com> [analyzer] Implement basic path diagnostic pruning based on "interesting" symbols and regions.
Essentially, a bug centers around a story for various symbols and regions. We should only include
the path diagnostic events that relate to those symbols and regions.

The pruning is done by associating a set of interesting symbols and regions with a BugReporter, which
can be modified at BugReport creation or by BugReporterVisitors.

This patch reduces the diagnostics emitted in several of our test cases. I've vetted these as
having desired behavior. The only regression is a missing null check diagnostic for the return
value of realloc() in test/Analysis/malloc-plist.c. This will require some investigation to fix,
and I have added a FIXME to the test case.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152361 91177308-0d34-0410-b5e6-96231b3b80d8
097ebb3d8ce55d1f78a3f1e7a0978dbde5ee2898 06-Mar-2012 Ted Kremenek <kremenek@apple.com> [analyzer] add a diagnostic event when entering a call via inlining, within the callee, and add an edge.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152086 91177308-0d34-0410-b5e6-96231b3b80d8
56d8fd0b8a65a7ccae3669cd650ca443cf24b73e 29-Feb-2012 Ted Kremenek <kremenek@apple.com> [analyzer diagnostics] Refactor filtration for PathDiagnosticConsumers that don't support cross-file diagnostics
into a common place. Currently enable this filtration for Plist diagnostics as well.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@151664 91177308-0d34-0410-b5e6-96231b3b80d8
c89f4b05721f53cfbaf32fc0c4919a4616e68440 29-Feb-2012 Ted Kremenek <kremenek@apple.com> [analyzer diagnostics] start prototyping stripping PathDiagnostics of unnecessary cruft caused by path inlining.

This introduces a concept of a "prunable" PathDiagnosticEvent. Currently this is a flag, but
we may evolve the concept to make this more dynamically inferred.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@151663 91177308-0d34-0410-b5e6-96231b3b80d8
2042fc1f36d471f437023e8899f0c4fadded2341 24-Feb-2012 Ted Kremenek <kremenek@apple.com> Reapply r151317, but when computing the PathDiagnostic profile and size keep into account the nested structure. Also fix a problem with how
inlining impacted Plist diagnostics, and adjust some ranges in the Plist output due to richer information.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@151346 91177308-0d34-0410-b5e6-96231b3b80d8
68fbb3ee8ae374b6505885e907af92b30eef707f 24-Feb-2012 Chad Rosier <mcrosier@apple.com> Revert r151317 - Rework PathDiagnostics creation.. - to appease buildbots.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@151338 91177308-0d34-0410-b5e6-96231b3b80d8
4970ef8e3527ac356c3e9fde0710561fcb63e424 24-Feb-2012 Ted Kremenek <kremenek@apple.com> Rework PathDiagnostic creation so that call stacks are captured by a nested PathDiagnosticCallPiece.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@151317 91177308-0d34-0410-b5e6-96231b3b80d8
ca8e36eb637e232475ef31c3f22d5da907390917 23-Feb-2012 Anna Zaks <ganna@apple.com> [analyzer] Malloc: unique leak reports by allocation site.

When we find two leak reports with the same allocation site, report only
one of them.

Provide a helper method to BugReporter to facilitate this.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@151287 91177308-0d34-0410-b5e6-96231b3b80d8
c93dc7889644293e318e19d82830ea2acc45b678 20-Feb-2012 Dylan Noblesmith <nobled@dreamwidth.org> Basic: import IntrusiveRefCntPtr<> into clang namespace

The class name is long enough without the llvm:: added.
Also bring in RefCountedBase and RefCountedBaseVPTR.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150958 91177308-0d34-0410-b5e6-96231b3b80d8
802e02463b880f53a6e645bde78cc412481ce9e0 08-Feb-2012 Ted Kremenek <kremenek@apple.com> Change PathDiagnosticPieces to be reference counted (simplifying their management), and introduce 'PathPieces' as a common container for PathDiagnosticPieces.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150054 91177308-0d34-0410-b5e6-96231b3b80d8
eb2303c76971f3cc89bbb367ce77564ccb7042c1 08-Feb-2012 Ted Kremenek <kremenek@apple.com> Refactor pieces of PathDiagnostic into its own data structure. No functionality change.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150053 91177308-0d34-0410-b5e6-96231b3b80d8
a6215b93c45ee5931536b57d10b987747143313b 07-Feb-2012 Ted Kremenek <kremenek@apple.com> Create PathDiagnosticCallEnter and PathDiagnosticCallExit, to remark calls in PathDiagnostics from other events. This will
have potential uses later.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@149960 91177308-0d34-0410-b5e6-96231b3b80d8
0cf3d471546251b12bdceff360f66c079c40526c 07-Feb-2012 Ted Kremenek <kremenek@apple.com> Add basic BugReporter support for CallEnter/CallExit. WIP.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@149939 91177308-0d34-0410-b5e6-96231b3b80d8
c6c090d2722dbae27c7623184bed668f7f29fa4b 04-Feb-2012 Benjamin Kramer <benny.kra@googlemail.com> StaticAnalyzer: Remove FixIts from PathDiagnosticPieces.

They were unused and pulled in Diagnostic.h for no reason.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@149779 91177308-0d34-0410-b5e6-96231b3b80d8
bac341346f3c8e713a8f165120fd54b500ee3189 26-Jan-2012 Ted Kremenek <kremenek@apple.com> Rework flushing of diagnostics to PathDiagnosticConsumer. Now all the reports are batched up before being flushed
to the underlying consumer implementation. This allows us to unique reports across analyses to multiple functions (which
shows up with inlining).

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148997 91177308-0d34-0410-b5e6-96231b3b80d8
f660f4b1bedd6b614acf52108894b805b807c50d 10-Jan-2012 Ted Kremenek <kremenek@apple.com> Make PathDiagnosticLocation more resilient to null Stmt pointers.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147854 91177308-0d34-0410-b5e6-96231b3b80d8
d1247c5002ee511e6f6c3c26214221c391d437cd 04-Jan-2012 Ted Kremenek <kremenek@apple.com> Extend ConditionBRVisitor to handle condition variable assignments.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147526 91177308-0d34-0410-b5e6-96231b3b80d8
99ba9e3bd70671f3441fb974895f226a83ce0e66 20-Dec-2011 David Blaikie <dblaikie@gmail.com> Unweaken vtables as per http://llvm.org/docs/CodingStandards.html#ll_virtual_anch

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146959 91177308-0d34-0410-b5e6-96231b3b80d8
1d26f48dc2eea1c07431ca1519d7034a21b9bcff 24-Oct-2011 Ted Kremenek <kremenek@apple.com> Rename AnalysisContext to AnalysisDeclContext. Not only is this name more accurate, but it frees up the name AnalysisContext for other uses.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142782 91177308-0d34-0410-b5e6-96231b3b80d8
ef3643fbbbf66247c5e205497fae0f46e240c143 26-Sep-2011 David Blaikie <dblaikie@gmail.com> Rename PathDiagnosticClient to PathDiagnosticConsumer as per issue 5397

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@140492 91177308-0d34-0410-b5e6-96231b3b80d8
d6471f7c1921c7802804ce3ff6fe9768310f72b9 26-Sep-2011 David Blaikie <dblaikie@gmail.com> Rename Diagnostic to DiagnosticsEngine as per issue 5397

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@140478 91177308-0d34-0410-b5e6-96231b3b80d8
09ca9ef5f92cf4375a19bf7a80d571779c9f370f 21-Sep-2011 Anna Zaks <ganna@apple.com> [analyzer] Fix a bug where PathDiagnosticLocation did not generate a valid range and add asserts to check validity of locations early on. Ignore invalid ranges in PathDiagnosticPiece (they could be added by checker writers).

Addresses radar://10124836 and radar://radar10102244.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@140218 91177308-0d34-0410-b5e6-96231b3b80d8
ef70724e66d8ede0edbe260fbcdd9781688bb1fd 21-Sep-2011 Anna Zaks <ganna@apple.com> [analyzer] Refactor PathDiagnosticLocation: Remove SourceRange member from PathDiagnosticLocation - FullSourceLoc Loc and PathDiagnosticRange Range are sufficient.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@140206 91177308-0d34-0410-b5e6-96231b3b80d8
c20f399889f53f74eef0404388de4086b36d2948 21-Sep-2011 Anna Zaks <ganna@apple.com> [analyzer] Refactor PathDiagnosticLocation: Add comments. Remove the last constructor which could allow invalid locations to slip in.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@140200 91177308-0d34-0410-b5e6-96231b3b80d8
bc0a3016b9fd51f84780f0f82fb0f7f2ca93e8ff 21-Sep-2011 Anna Zaks <ganna@apple.com> [analyzer] Remove dead code. (This code is trying to implement the idea that PathDiagnosticClient could implement DiagnosticClient and has been dead for a while).

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@140198 91177308-0d34-0410-b5e6-96231b3b80d8
590dd8e0959d8df5621827768987c4792b74fc06 20-Sep-2011 Anna Zaks <ganna@apple.com> [analyzer] Refactor PathDiagnosticLocation: Make PathDiagnosticLocation(SourceLocation...) private. Most of the effort here goes to making BugReport refer to a PathDiagnosticLocation instead of FullSourceLocation.

(Another step closer to the goal of having Diagnostics which can recover from invalid SourceLocations.)

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@140182 91177308-0d34-0410-b5e6-96231b3b80d8
b66f4867702697f1f097ab95f8a23a39310430e0 20-Sep-2011 Anna Zaks <ganna@apple.com> [analyzer] Refactor PathDiagnosticLocation: Use PointerUnion of LocationContext and AnalysisContext to support creation of PathDiagnosticLocations for checkers which no context sensitivity.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@140162 91177308-0d34-0410-b5e6-96231b3b80d8
e97436732c0f20aa15ecbf92a5f905eee888528f 20-Sep-2011 Anna Zaks <ganna@apple.com> [analyzer] Refactor PathDiagnosticLocation: Lazily query LocationContext for a ParentMap as needed.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@140147 91177308-0d34-0410-b5e6-96231b3b80d8
23803374d8db054192ea6fcb766b87e04f26c8fb 20-Sep-2011 Anna Zaks <ganna@apple.com> [analyzer] Remove LocationContext and a dependency from PathDiagnosticLoaction.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@140146 91177308-0d34-0410-b5e6-96231b3b80d8
b490c4bb01a5a3a86947851fa66823dda32ed012 20-Sep-2011 Anna Zaks <ganna@apple.com> [analyzer] Refactor PathDiagnosticLocation: Pre-compute Range and Location with gen methods on object creation instead of computing on demand. This would allow to remove dependency on the other members which help with construction and might not even be valid at later stages (to be removed later on).

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@140131 91177308-0d34-0410-b5e6-96231b3b80d8
1531bb0c69d9afff6a6434e4cadf345eb628b287 20-Sep-2011 Anna Zaks <ganna@apple.com> [analyzer] Use more create methods in the PathDiagnostic, cleanup.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@140130 91177308-0d34-0410-b5e6-96231b3b80d8
4522e2a9e7fa0313e8e5a388d8f0ab66feccc6af 20-Sep-2011 Anna Zaks <ganna@apple.com> [analyzer] BugReport has a profile method, so reuse it here.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@140100 91177308-0d34-0410-b5e6-96231b3b80d8
0cd59482abd8aec9ed1eaad11f5fe9c1e42639f6 16-Sep-2011 Anna Zaks <ganna@apple.com> [analyzer] Refactor: make PathDiagnosticLocation responsible for validation of SourceLocations (commit 5 of ?):
- Get rid of PathDiagnosticLocation(SourceRange r,..) constructor by providing a bunch of create methods.
- The PathDiagnosticLocation(SourceLocation L,..), which is used by crate methods, will eventually become private.
- Test difference is in the case when the report starts at the beginning of the function. We used to represent that point as a range of the very first token in the first statement. Now, it's just a single location representing the first character of the first statement.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@139932 91177308-0d34-0410-b5e6-96231b3b80d8
4fdf97bf51d2a156cec3232efd6dae110aa02aa0 15-Sep-2011 Anna Zaks <ganna@apple.com> [analyzer] Refactor: make PathDiagnosticLocation responsible for validation of SourceLocations (commit 2 of ?):
- Fix a fixme and move the logic of creating a PathDiagnosticLocation corresponding to a ProgramPoint into a PathDiagnosticLocation constructor.
- Rename PathDiagnosticLocation::create to differentiate from the added constructor.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@139825 91177308-0d34-0410-b5e6-96231b3b80d8
220ac8c175cb1bf9b18d82eefe036995d7a2164d 15-Sep-2011 Anna Zaks <ganna@apple.com> [analyzer] Refactor: make PathDiagnosticLocation responsible for validation of SourceLocations (commit 2 of ?):
- Modify all PathDiagnosticLocation constructors that take Stmt to also requre LocationContext.
- Add a constructor which should be used in case there is no valid statement/location (it will grab the location of the enclosing function).

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@139763 91177308-0d34-0410-b5e6-96231b3b80d8
33e8491d7cf757812b9f8d126e0368c3ac0d2dd6 14-Sep-2011 Anna Zaks <ganna@apple.com> [analyzer] Remove redundant copy constructor.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@139704 91177308-0d34-0410-b5e6-96231b3b80d8
4d353eb8af7324c0ee3736c736668f6c9b162ee0 14-Sep-2011 Anna Zaks <ganna@apple.com> [analyzer] After CFG has been linearized, we can have a situation where an ExpoledNode has an invalid SourceLocation (which has no correspondence in the source code). This commit is the first step to solve this problem.
- It adds LocationContext to the PathDiagnosticLocation object and uses it to lookup the enclosing statement with a valid location.
- So far, the LocationContext is only available when the object is constructed from the ExplodedNode.
- Already found some subtle bugs(in plist-output-alternate.m) where the intermediate diagnostic steps were not previously shown.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@139703 91177308-0d34-0410-b5e6-96231b3b80d8
43f48b0b1bc763dc56db6e01de4fcc44ad389bef 14-Sep-2011 Anna Zaks <ganna@apple.com> [analyzer] Refactor: Make PathDiagnosticLocation responsible for creating a valid object given an ExploadedNode (the same logic can be reused by other checkers).

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@139672 91177308-0d34-0410-b5e6-96231b3b80d8
f5e39ece75b18c9ce19351929d4879ad9731e7f5 28-Aug-2011 Jordy Rose <jediknil@belkadan.com> [analyzer] Header cleanup to decrease coupling (and recompilation). No functionality change.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@138729 91177308-0d34-0410-b5e6-96231b3b80d8
07453ac7b3d46f930733b44a593737bdd98706b6 27-Aug-2011 Ted Kremenek <kremenek@apple.com> [analyzer] Rename current PathDiagnosticClient::HandlePathDiagnostic() to HandlePathDiagnosticImpl(), and slot in new HandlePathDiagnostic() for potentially handling concurrent access to PathDiagnosticClients (in the future).

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@138713 91177308-0d34-0410-b5e6-96231b3b80d8
14924267950e75c6c1f6fcea39fa507b7168bc39 24-Aug-2011 Anna Zaks <ganna@apple.com> [analyzer] Allow checker writes to specify that no region should be accosiated with the report. (Useful when we report an error on endOfPath or deadSymbols, when the range of the last expression might have nothing to do with the error.)

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@138474 91177308-0d34-0410-b5e6-96231b3b80d8
7f2531cb41448852ec78de90fc1d3c0149c95d7d 22-Aug-2011 Anna Zaks <ganna@apple.com> Static Analyzer Diagnostics: Allow checkers to add ExtraDescriptiveText, now renamed into ExtraText, to the diagnostic without subclassing BugReport.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@138272 91177308-0d34-0410-b5e6-96231b3b80d8
23f395ee1bf4e4aa76b310d896a951799eaca94a 20-Aug-2011 Anna Zaks <ganna@apple.com> Static Analyzer Diagnostics: Move the responsibility for generating the endOfPath diagnostic piece from BugReport to BugReporterVisitor. Switch CFRefCount to use visitors in order to generate the endOfPath piece.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@138184 91177308-0d34-0410-b5e6-96231b3b80d8
dc757b049796949e4b11646445a6598f0bdabd7a 20-Aug-2011 Anna Zaks <ganna@apple.com> Static Analyzer Diagnostics: Switch CFRefCount to using the new visitor API. BugReport no longer needs to inherit from BugReporterVisitor.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@138142 91177308-0d34-0410-b5e6-96231b3b80d8
50bbc165b063155cc23c360deb7b865502e068e2 20-Aug-2011 Anna Zaks <ganna@apple.com> Static Analyzer Diagnostics: Kill the addVisitorCreator(callbackTy, void*) API in favor of addVisitor(BugReporterVisitor*).

1) Create a header file to expose the predefined visitors. And move the parent(BugReporterVisitor) there as well.

2) Remove the registerXXXVisitor functions - the Visitor constructors/getters can be used now to create the object. One exception is registerVarDeclsLastStore(), which registers more then one visitor, so make it static member of FindLastStoreBRVisitor.

3) Modify all the checkers to use the new API.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@138126 91177308-0d34-0410-b5e6-96231b3b80d8
3b030a28cda2b953758507769c1d436bec5ec45e 19-Aug-2011 Anna Zaks <ganna@apple.com> Fix a memory leak in the analyzer - BugReports didn't get freed. Plus, remove invalid assert from the destructor which wasn't called previously due to the leak.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@138027 91177308-0d34-0410-b5e6-96231b3b80d8
8e6431adab313e283a992698f6fc7afe62420999 19-Aug-2011 Anna Zaks <ganna@apple.com> Static Analyzer Diagnostics: Move custom diagnostic visitors from BugReporterContext to BugReport.

One API change: I added BugReporter as an additional parameter to the BugReporterVisitor::VisitNode() method to allow visitors register other visitors with the report on the fly (while processing a node). This functionality is used by NilReceiverVisitor, which registers TrackNullOrUndefValue when the receiver is null.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@138001 91177308-0d34-0410-b5e6-96231b3b80d8
f19eef86422b82e3415c56077f85085e0074e893 18-Aug-2011 Anna Zaks <ganna@apple.com> Fix a regression form r137894. Make sure the custom BugReporterVisitors get registred as they were in EnhancedBugReport. Would be good to add a test for this.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@137917 91177308-0d34-0410-b5e6-96231b3b80d8
e7c4c4ccc6a51c82332382267b84e9d72f229b5e 18-Aug-2011 Anna Zaks <ganna@apple.com> Add more comments for BugReport.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@137901 91177308-0d34-0410-b5e6-96231b3b80d8
b7530a4ca9a7ef62350682bbb374a06de6fdaa9f 18-Aug-2011 Anna Zaks <ganna@apple.com> Remove DiagBugReport by pulling it into its parent BugReport.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@137899 91177308-0d34-0410-b5e6-96231b3b80d8
e172e8b9e7fc67d7d03589af7e92fe777afcf33a 18-Aug-2011 Anna Zaks <ganna@apple.com> Remove EnhancedBugReport and RangedBugReport - pull all the extra functionality they provided into their parent BugReport. The only functional changes are: made getRanges() non const - it adds default range to Ranges if none are supplied, made getStmt() private, which was another FIXME.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@137894 91177308-0d34-0410-b5e6-96231b3b80d8
38ca02ed9495a3c708fafc7d8b7d87a8cfcfe8f3 17-Aug-2011 Anna Zaks <ganna@apple.com> Add a bit more comments to the BugReporter and friends.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@137859 91177308-0d34-0410-b5e6-96231b3b80d8
18c66fdc3c4008d335885695fe36fb5353c5f672 16-Aug-2011 Ted Kremenek <kremenek@apple.com> Rename GRState to ProgramState, and cleanup some code formatting along the way.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@137665 91177308-0d34-0410-b5e6-96231b3b80d8
9c378f705405d37f49795d5e915989de774fe11f 13-Aug-2011 Ted Kremenek <kremenek@apple.com> Cleanup various declarations of 'Stmt*' to be 'Stmt *', etc. in libAnalyzer and libStaticAnalyzer[*]. It was highly inconsistent, and very ugly to look at.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@137537 91177308-0d34-0410-b5e6-96231b3b80d8
993124ecdd44ec1430a3b7f01b22f65bbaadb586 06-Aug-2011 Ted Kremenek <kremenek@apple.com> [analyzer] Start sketching out a new BugReporterVisitor that inspects branches and other expressions to generate interesting path events in diagnostics.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@137012 91177308-0d34-0410-b5e6-96231b3b80d8
686775deca8b8685eb90801495880e3abdd844c2 20-Jul-2011 Chris Lattner <sabre@nondot.org> now that we have a centralized place to do so, add some using declarations for
some common llvm types: stringref and smallvector. This cleans up the codebase
quite a bit.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@135576 91177308-0d34-0410-b5e6-96231b3b80d8
fc8f0e14ad142ed811e90fbd9a30e419e301c717 15-Apr-2011 Chris Lattner <sabre@nondot.org> fix a bunch of comment typos found by codespell. Patch by
Luis Felipe Strano Moraes!

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@129559 91177308-0d34-0410-b5e6-96231b3b80d8
9fc90c1bf7498dc53862156205ab95868b8b849f 14-Mar-2011 Ted Kremenek <kremenek@apple.com> Incorporate source ranges for RangeBugReport when coelescing reports into equivalence classes.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@127604 91177308-0d34-0410-b5e6-96231b3b80d8
404fc3ad6bd844bf8ce70cbf9974ab297704a122 23-Feb-2011 Argyrios Kyrtzidis <akyrtzi@gmail.com> [analyzer] Refactor BugTypes and their ownership model.

-In general, don't have the BugReporter deleting BugTypes, BugTypes will eventually become owned by checkers
and outlive the BugReporter. In the meantime, there will be some leaks since some checkers assume that
the BugTypes they create will be destroyed by the BugReporter.
-Have BugReporter::EmitBasicReport create BugTypes that are reused if the same name & category strings
are passed to EmitBasicReport. These BugTypes are owned and destroyed by the BugReporter.
This allows bugs reported through EmitBasicReport to be coalesced.
-Remove the llvm::FoldingSet<BugReportEquivClass> from BugType and move it into the BugReporter.
For uniquing BugReportEquivClass also use the BugType* so that we can iterate over all of them using only one set.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126272 91177308-0d34-0410-b5e6-96231b3b80d8
9b663716449b618ba0390b1dbebc54fa8e971124 10-Feb-2011 Ted Kremenek <kremenek@apple.com> Split 'include/clang/StaticAnalyzer' into 'include/clang/StaticAnalyzer/Core' and 'include/clang/StaticAnalyzer/Checkers'.

This layout matches lib/StaticAnalyzer, which corresponds to two StaticAnalyzer libraries.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@125251 91177308-0d34-0410-b5e6-96231b3b80d8