From: Jordan Rose <jordan_rose@apple.com>
Date: Thu, 20 Sep 2012 01:54:56 +0000 (+0000)
Subject: Revert "[analyzer] Remove constraints on dead symbols as part of removeDeadBindings."
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=8e289bb59c5c1c29900604b86238c3088f506782;p=clang

Revert "[analyzer] Remove constraints on dead symbols as part of removeDeadBindings."

While we definitely want this optimization in the future, we're not
currently handling constraints on symbolic /expressions/ correctly.
These should stay live even if the SymExpr itself is no longer referenced
because could recreate an identical SymExpr later. Only once the SymExpr
can no longer be recreated -- i.e. a component symbol is dead -- can we
safely remove the constraints on it.

This liveness issue is tracked by <rdar://problem/12333297>.

This reverts r163444 / 24c7f98828e039005cff3bd847e7ab404a6a09f8.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@164275 91177308-0d34-0410-b5e6-96231b3b80d8
---

diff --git a/lib/StaticAnalyzer/Core/ProgramState.cpp b/lib/StaticAnalyzer/Core/ProgramState.cpp
index 56c6c04df0..ed128ef00d 100644
--- a/lib/StaticAnalyzer/Core/ProgramState.cpp
+++ b/lib/StaticAnalyzer/Core/ProgramState.cpp
@@ -106,9 +106,8 @@ ProgramStateManager::removeDeadBindings(ProgramStateRef state,
                                                    SymReaper);
   NewState.setStore(newStore);
   SymReaper.setReapedStore(newStore);
-
-  ProgramStateRef Result = getPersistentState(NewState);
-  return ConstraintMgr->removeDeadBindings(Result, SymReaper);
+  
+  return getPersistentState(NewState);
 }
 
 ProgramStateRef ProgramState::bindCompoundLiteral(const CompoundLiteralExpr *CL,
@@ -687,9 +686,7 @@ bool ProgramState::isTainted(SymbolRef Sym, TaintTagType Kind) const {
   bool Tainted = false;
   for (SymExpr::symbol_iterator SI = Sym->symbol_begin(), SE =Sym->symbol_end();
        SI != SE; ++SI) {
-    if (!isa<SymbolData>(*SI))
-      continue;
-    
+    assert(isa<SymbolData>(*SI));
     const TaintTagType *Tag = get<TaintMap>(*SI);
     Tainted = (Tag && *Tag == Kind);
 
diff --git a/lib/StaticAnalyzer/Core/SymbolManager.cpp b/lib/StaticAnalyzer/Core/SymbolManager.cpp
index 16fc5408f5..c21df4c318 100644
--- a/lib/StaticAnalyzer/Core/SymbolManager.cpp
+++ b/lib/StaticAnalyzer/Core/SymbolManager.cpp
@@ -117,17 +117,21 @@ bool SymExpr::symbol_iterator::operator!=(const symbol_iterator &X) const {
 
 SymExpr::symbol_iterator::symbol_iterator(const SymExpr *SE) {
   itr.push_back(SE);
+  while (!isa<SymbolData>(itr.back())) expand();
 }
 
 SymExpr::symbol_iterator &SymExpr::symbol_iterator::operator++() {
   assert(!itr.empty() && "attempting to iterate on an 'end' iterator");
-  expand();
+  assert(isa<SymbolData>(itr.back()));
+  itr.pop_back();
+  if (!itr.empty())
+    while (!isa<SymbolData>(itr.back())) expand();
   return *this;
 }
 
 SymbolRef SymExpr::symbol_iterator::operator*() {
   assert(!itr.empty() && "attempting to dereference an 'end' iterator");
-  return itr.back();
+  return cast<SymbolData>(itr.back());
 }
 
 void SymExpr::symbol_iterator::expand() {
diff --git a/test/Analysis/traversal-path-unification.c b/test/Analysis/traversal-path-unification.c
deleted file mode 100644
index 0a45f48a01..0000000000
--- a/test/Analysis/traversal-path-unification.c
+++ /dev/null
@@ -1,21 +0,0 @@
-// RUN: %clang_cc1 -analyze -analyzer-checker=core,debug.DumpTraversal %s | FileCheck %s
-
-int a();
-int b();
-int c();
-
-void testRemoveDeadBindings() {
-  int i = a();
-  if (i)
-    a();
-  else
-    b();
-
-  // At this point the symbol bound to 'i' is dead.
-  // The effects of a() and b() are identical (they both invalidate globals).
-  // We should unify the two paths here and only get one end-of-path node.
-  c();
-}
-
-// CHECK: --END PATH--
-// CHECK-NOT: --END PATH--
\ No newline at end of file