Revert "[analyzer] Remove constraints on dead symbols as part of removeDeadBindings."

While we definitely want this optimization in the future, we're not
currently handling constraints on symbolic /expressions/ correctly.
These should stay live even if the SymExpr itself is no longer referenced
because could recreate an identical SymExpr later. Only once the SymExpr
can no longer be recreated -- i.e. a component symbol is dead -- can we
safely remove the constraints on it.

This liveness issue is tracked by <rdar://problem/12333297>.

This reverts r163444 / 24c7f98828e039005cff3bd847e7ab404a6a09f8.

llvm-svn: 164275

diff --git a/clang/lib/StaticAnalyzer/Core/ProgramState.cpp b/clang/lib/StaticAnalyzer/Core/ProgramState.cpp
index 56c6c04df0c18d7c8e5e4d966159fc89c6a41d0a..ed128ef00d8b8a0b3d18e12095b0c1af63378a62 100644 (file)
--- a/clang/lib/StaticAnalyzer/Core/ProgramState.cpp
+++ b/clang/lib/StaticAnalyzer/Core/ProgramState.cpp
@@ -106,9 +106,8 @@ ProgramStateManager::removeDeadBindings(ProgramStateRef state,
                                                    SymReaper);
   NewState.setStore(newStore);
   SymReaper.setReapedStore(newStore);
-
-  ProgramStateRef Result = getPersistentState(NewState);
-  return ConstraintMgr->removeDeadBindings(Result, SymReaper);
+  
+  return getPersistentState(NewState);
 }
 
 ProgramStateRef ProgramState::bindCompoundLiteral(const CompoundLiteralExpr *CL,
@@ -687,9 +686,7 @@ bool ProgramState::isTainted(SymbolRef Sym, TaintTagType Kind) const {
   bool Tainted = false;
   for (SymExpr::symbol_iterator SI = Sym->symbol_begin(), SE =Sym->symbol_end();
        SI != SE; ++SI) {
-    if (!isa<SymbolData>(*SI))
-      continue;
-    
+    assert(isa<SymbolData>(*SI));
     const TaintTagType *Tag = get<TaintMap>(*SI);
     Tainted = (Tag && *Tag == Kind);
 

diff --git a/clang/lib/StaticAnalyzer/Core/SymbolManager.cpp b/clang/lib/StaticAnalyzer/Core/SymbolManager.cpp
index 16fc5408f53a8c7a7e44f1f2a09975cc9852f3fe..c21df4c31811bab1215cb93b8c9b9abb0a5446a9 100644 (file)
--- a/clang/lib/StaticAnalyzer/Core/SymbolManager.cpp
+++ b/clang/lib/StaticAnalyzer/Core/SymbolManager.cpp
@@ -117,17 +117,21 @@ bool SymExpr::symbol_iterator::operator!=(const symbol_iterator &X) const {
 
 SymExpr::symbol_iterator::symbol_iterator(const SymExpr *SE) {
   itr.push_back(SE);
+  while (!isa<SymbolData>(itr.back())) expand();
 }
 
 SymExpr::symbol_iterator &SymExpr::symbol_iterator::operator++() {
   assert(!itr.empty() && "attempting to iterate on an 'end' iterator");
-  expand();
+  assert(isa<SymbolData>(itr.back()));
+  itr.pop_back();
+  if (!itr.empty())
+    while (!isa<SymbolData>(itr.back())) expand();
   return *this;
 }
 
 SymbolRef SymExpr::symbol_iterator::operator*() {
   assert(!itr.empty() && "attempting to dereference an 'end' iterator");
-  return itr.back();
+  return cast<SymbolData>(itr.back());
 }
 
 void SymExpr::symbol_iterator::expand() {

diff --git a/clang/test/Analysis/traversal-path-unification.c b/clang/test/Analysis/traversal-path-unification.c
deleted file mode 100644 (file)
index 0a45f48..0000000
--- a/clang/test/Analysis/traversal-path-unification.c
+++ /dev/null
@@ -1,21 +0,0 @@
-// RUN: %clang_cc1 -analyze -analyzer-checker=core,debug.DumpTraversal %s | FileCheck %s
-
-int a();
-int b();
-int c();
-
-void testRemoveDeadBindings() {
-  int i = a();
-  if (i)
-    a();
-  else
-    b();
-
-  // At this point the symbol bound to 'i' is dead.
-  // The effects of a() and b() are identical (they both invalidate globals).
-  // We should unify the two paths here and only get one end-of-path node.
-  c();
-}
-
-// CHECK: --END PATH--
-// CHECK-NOT: --END PATH--
\ No newline at end of file