4 files changed, 79 insertions, 8 deletions
diff --git a/lib/Analysis/BuiltinFunctionChecker.cpp b/lib/Analysis/BuiltinFunctionChecker.cpp
new file mode 100644
index 0000000000..a89ad2164b
--- /dev/null
+++ b/lib/Analysis/BuiltinFunctionChecker.cpp
@@ -0,0 +1,76 @@
+//=== BuiltinFunctionChecker.cpp --------------------------------*- C++ -*-===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// This checker evaluates clang builtin functions.
+//
+//===----------------------------------------------------------------------===//
+
+#include "GRExprEngineInternalChecks.h"
+#include "clang/Analysis/PathSensitive/Checker.h"
+#include "clang/Basic/Builtins.h"
+#include "llvm/ADT/StringSwitch.h"
+
+using namespace clang;
+
+namespace {
+
+class BuiltinFunctionChecker : public Checker {
+public:
+  static void *getTag() { static int tag = 0; return &tag; }
+  virtual bool EvalCallExpr(CheckerContext &C, const CallExpr *CE);
+};
+
+}
+
+void clang::RegisterBuiltinFunctionChecker(GRExprEngine &Eng) {
+  Eng.registerCheck(new BuiltinFunctionChecker());
+}
+
+bool BuiltinFunctionChecker::EvalCallExpr(CheckerContext &C,const CallExpr *CE){
+  const GRState *state = C.getState();
+  const Expr *Callee = CE->getCallee();
+  SVal L = state->getSVal(Callee);
+  const FunctionDecl *FD = L.getAsFunctionDecl();
+
+  if (!FD)
+    return false;
+
+  unsigned id = FD->getBuiltinID();
+
+  if (!id)
+    return false;
+
+  switch (id) {
+  case Builtin::BI__builtin_expect: {
+    // For __builtin_expect, just return the value of the subexpression.
+    assert (CE->arg_begin() != CE->arg_end());
+    SVal X = state->getSVal(*(CE->arg_begin()));
+    C.GenerateNode(state->BindExpr(CE, X));
+    return true;
+  }
+
+  case Builtin::BI__builtin_alloca: {
+    // FIXME: Refactor into StoreManager itself?
+    MemRegionManager& RM = C.getStoreManager().getRegionManager();
+    const MemRegion* R =
+      RM.getAllocaRegion(CE, C.getNodeBuilder().getCurrentBlockCount(),
+                         C.getPredecessor()->getLocationContext());
+
+    // Set the extent of the region in bytes. This enables us to use the
+    // SVal of the argument directly. If we save the extent in bits, we
+    // cannot represent values like symbol*8.
+    SVal Extent = state->getSVal(*(CE->arg_begin()));
+    state = C.getStoreManager().setExtent(state, R, Extent);
+    C.GenerateNode(state->BindExpr(CE, loc::MemRegionVal(R)));
+    return true;
+  }
+  }
+
+  return false;
+}
diff --git a/lib/Analysis/CMakeLists.txt b/lib/Analysis/CMakeLists.txt
index d9e4f10cd2..c0d97f85fd 100644
--- a/lib/Analysis/CMakeLists.txt
+++ b/lib/Analysis/CMakeLists.txt
@@ -10,6 +10,7 @@ add_clang_library(clangAnalysis
   BasicValueFactory.cpp
   BugReporter.cpp
   BugReporterVisitors.cpp
+  BuiltinFunctionChecker.cpp
   CFG.cpp
   CFRefCount.cpp
   CallAndMessageChecker.cpp
diff --git a/lib/Analysis/GRExprEngine.cpp b/lib/Analysis/GRExprEngine.cpp
index 8f63128975..c9c419beaa 100644
--- a/lib/Analysis/GRExprEngine.cpp
+++ b/lib/Analysis/GRExprEngine.cpp
@@ -244,6 +244,7 @@ static void RegisterInternalChecks(GRExprEngine &Eng) {
 
   // This is not a checker yet.
   RegisterNoReturnFunctionChecker(Eng);
+  RegisterBuiltinFunctionChecker(Eng);
 }
 
 GRExprEngine::GRExprEngine(AnalysisManager &mgr)
@@ -1669,7 +1670,6 @@ void GRExprEngine::VisitCallRec(CallExpr* CE, ExplodedNode* Pred,
     // Check for the "noreturn" attribute.
 
     SaveAndRestore<bool> OldSink(Builder->BuildSinks);
-    const FunctionDecl* FD = L.getAsFunctionDecl();
 
     ExplodedNodeSet DstTmp3, DstChecker, DstOther;
 
@@ -1677,12 +1677,6 @@ void GRExprEngine::VisitCallRec(CallExpr* CE, ExplodedNode* Pred,
     if (CheckerEvalCall(CE, DstChecker, *DI))
       DstTmp3 = DstChecker;
     else {
-      //MarkNoReturnFunction(FD, CE, state, Builder);
-
-      // Evaluate the call.
-      if (EvalBuiltinFunction(FD, CE, *DI, Dst))
-        continue;
-
       // Dispatch to the plug-in transfer function.
       SaveOr OldHasGen(Builder->HasGeneratedNode);
       Pred = *DI;
@@ -1691,7 +1685,6 @@ void GRExprEngine::VisitCallRec(CallExpr* CE, ExplodedNode* Pred,
       // FIXME: Allow us to chain together transfer functions.
       assert(Builder && "GRStmtNodeBuilder must be defined.");
     
-    
       if (!EvalOSAtomic(DstOther, *this, *Builder, CE, L, Pred))
         getTF().EvalCall(DstOther, *this, *Builder, CE, L, Pred);
 
diff --git a/lib/Analysis/GRExprEngineInternalChecks.h b/lib/Analysis/GRExprEngineInternalChecks.h
index 90442d5840..5950efaa69 100644
--- a/lib/Analysis/GRExprEngineInternalChecks.h
+++ b/lib/Analysis/GRExprEngineInternalChecks.h
@@ -38,6 +38,7 @@ void RegisterUndefBranchChecker(GRExprEngine &Eng);
 void RegisterUndefResultChecker(GRExprEngine &Eng);
 
 void RegisterNoReturnFunctionChecker(GRExprEngine &Eng);
+void RegisterBuiltinFunctionChecker(GRExprEngine &Eng);
 
 } // end clang namespace
 #endif