Clean up the Checker API a little more, resolving some hidden bugs

along the way.  Important changes:

1) To generate a sink node, use GenerateSink(); GenerateNode() is for
generating regular transitions.  This makes the API clearer and also
allows us to use the 'bool' option to GenerateNode() for a different
purpose.

2) GenerateNode() now automatically adds the generated node to the
destination ExplodedNodeSet (autotransition) unless the client
specifies otherwise with a bool flag.  Several checkers did not call
'addTransition()' after calling 'GenerateNode()', causing the
simulation path to be prematurely culled when a non-fail stop bug was
encountered.

3) Add variants of GenerateNode()/GenerateSink() that take neither a
Stmt* or a GRState*; most callers of GenerateNode() just pass in the
same Stmt* as provided when the CheckerContext object is created; we
can just use that the majority of the time.  This cleanup also allows
us to potentially coelesce the APIs for evaluating branches and
end-of-paths (which currently directly use builders).

4) addTransition() no longer needs to be called except for a few
cases.  We now have a variant of addTransition() that takes a
GRState*; this allows one to propagate the updated state without
caring about generating a new node explicitly.  This nicely cleaned up
a bunch of cases that called autoTransition() with a bunch of
conditional logic surround the call (that common logic has now been
swallowed up by addTransition() itself).


git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@89707 91177308-0d34-0410-b5e6-96231b3b80d8

1 files changed, 5 insertions, 9 deletions

diff --git a/lib/Analysis/MallocChecker.cpp b/lib/Analysis/MallocChecker.cpp
index 995720b1f8..a16125df77 100644
--- a/lib/Analysis/MallocChecker.cpp
+++ b/lib/Analysis/MallocChecker.cpp
@@ -112,9 +112,7 @@ void MallocChecker::MallocMem(CheckerContext &C, const CallExpr *CE) {
   SymbolRef Sym = CallVal.getAsLocSymbol();
   assert(Sym);
   // Set the symbol's state to Allocated.
-  const GRState *AllocState 
-    = state->set<RegionState>(Sym, RefState::getAllocated(CE));
-  C.addTransition(C.GenerateNode(CE, AllocState));
+  C.addTransition(state->set<RegionState>(Sym, RefState::getAllocated(CE)));
 }
 
 void MallocChecker::FreeMem(CheckerContext &C, const CallExpr *CE) {
@@ -128,7 +126,7 @@ void MallocChecker::FreeMem(CheckerContext &C, const CallExpr *CE) {
 
   // Check double free.
   if (RS->isReleased()) {
-    ExplodedNode *N = C.GenerateNode(CE, true);
+    ExplodedNode *N = C.GenerateSink();
     if (N) {
       if (!BT_DoubleFree)
         BT_DoubleFree = new BuiltinBug("Double free",
@@ -144,7 +142,7 @@ void MallocChecker::FreeMem(CheckerContext &C, const CallExpr *CE) {
   // Normal free.
   const GRState *FreedState 
     = state->set<RegionState>(Sym, RefState::getReleased(CE));
-  C.addTransition(C.GenerateNode(CE, FreedState));
+  C.addTransition(FreedState);
 }
 
 void MallocChecker::EvalDeadSymbols(CheckerContext &C, const Stmt *S,
@@ -158,7 +156,7 @@ void MallocChecker::EvalDeadSymbols(CheckerContext &C, const Stmt *S,
       return;
 
     if (RS->isAllocated()) {
-      ExplodedNode *N = C.GenerateNode(S, true);
+      ExplodedNode *N = C.GenerateSink();
       if (N) {
         if (!BT_Leak)
           BT_Leak = new BuiltinBug("Memory leak",
@@ -213,7 +211,5 @@ void MallocChecker::PreVisitReturnStmt(CheckerContext &C, const ReturnStmt *S) {
   if (RS->isAllocated())
     state = state->set<RegionState>(Sym, RefState::getEscaped(S));
 
-  ExplodedNode *N = C.GenerateNode(S, state);
-  if (N)
-    C.addTransition(N);
+  C.addTransition(state);
 }