[analyzer] Limit Store by region-store-binding-limit

clang/include/clang/StaticAnalyzer/Core/PathSensitive/Store.h

@@ -118,12 +118,12 @@ class StoreManager {
   /// Return a store with the specified value bound to all sub-regions of the
   /// region. The region must not have previous bindings. If you need to
   /// invalidate existing bindings, consider invalidateRegions().
-  virtual StoreRef BindDefaultInitial(Store store, const MemRegion *R,
-                                      SVal V) = 0;
+  virtual BindResult BindDefaultInitial(Store store, const MemRegion *R,
+                                        SVal V) = 0;
 
   /// Return a store with in which all values within the given region are
   /// reset to zero. This method is allowed to overwrite previous bindings.
-  virtual StoreRef BindDefaultZero(Store store, const MemRegion *R) = 0;
+  virtual BindResult BindDefaultZero(Store store, const MemRegion *R) = 0;
 
   /// Create a new store with the specified binding removed.
   /// \param ST the original store, that is the basis for the new store.

clang/lib/StaticAnalyzer/Core/ProgramState.cpp

@@ -111,6 +111,17 @@ ProgramStateRef ProgramStateManager::removeDeadBindingsFromEnvironmentAndStore(
   return getPersistentState(NewState);
 }
 
+static ProgramStateRef escapeFailedToBindValues(ExprEngine &Eng,
+                                                ProgramStateRef State,
+                                                const BindResult &BindRes) {
+  // We must always notify the checkers for failing binds because otherwise they
+  // may keep stale traits for these symbols.
+  // Eg., Malloc checker may report leaks if we failed to bind that symbol.
+  if (BindRes.FailedToBindValues.empty())
+    return State;
+  return Eng.escapeValues(State, BindRes.FailedToBindValues, PSK_EscapeOnBind);
+}
+
 ProgramStateRef ProgramState::bindLoc(Loc LV,
                                       SVal V,
                                       const LocationContext *LCtx,
@@ -119,16 +130,9 @@ ProgramStateRef ProgramState::bindLoc(Loc LV,
   ExprEngine &Eng = Mgr.getOwningEngine();
   BindResult BindRes = Mgr.StoreMgr->Bind(getStore(), LV, V);
   ProgramStateRef State = makeWithStore(BindRes.ResultingStore);
+  State = escapeFailedToBindValues(Eng, State, BindRes);
   const MemRegion *MR = LV.getAsRegion();
 
-  // We must always notify the checkers for failing binds because otherwise they
-  // may keep stale traits for these symbols.
-  // Eg., Malloc checker may report leaks if we failed to bind that symbol.
-  if (!BindRes.FailedToBindValues.empty()) {
-    State =
-        Eng.escapeValues(State, BindRes.FailedToBindValues, PSK_EscapeOnBind);
-  }
-
   if (MR && notifyChanges)
     return Eng.processRegionChange(State, MR, LCtx);
 
@@ -139,19 +143,21 @@ ProgramStateRef
 ProgramState::bindDefaultInitial(SVal loc, SVal V,
                                  const LocationContext *LCtx) const {
   ProgramStateManager &Mgr = getStateManager();
+  ExprEngine &Eng = Mgr.getOwningEngine();
   const MemRegion *R = loc.castAs<loc::MemRegionVal>().getRegion();
-  const StoreRef &newStore = Mgr.StoreMgr->BindDefaultInitial(getStore(), R, V);
-  ProgramStateRef new_state = makeWithStore(newStore);
-  return Mgr.getOwningEngine().processRegionChange(new_state, R, LCtx);
+  BindResult BindRes = Mgr.StoreMgr->BindDefaultInitial(getStore(), R, V);
+  ProgramStateRef State = makeWithStore(BindRes.ResultingStore);
+  State = escapeFailedToBindValues(Eng, State, BindRes);
+  return Mgr.getOwningEngine().processRegionChange(State, R, LCtx);
 }
 
 ProgramStateRef
 ProgramState::bindDefaultZero(SVal loc, const LocationContext *LCtx) const {
   ProgramStateManager &Mgr = getStateManager();
   const MemRegion *R = loc.castAs<loc::MemRegionVal>().getRegion();
-  const StoreRef &newStore = Mgr.StoreMgr->BindDefaultZero(getStore(), R);
-  ProgramStateRef new_state = makeWithStore(newStore);
-  return Mgr.getOwningEngine().processRegionChange(new_state, R, LCtx);
+  BindResult BindRes = Mgr.StoreMgr->BindDefaultZero(getStore(), R);
+  ProgramStateRef State = makeWithStore(BindRes.ResultingStore);
+  return Mgr.getOwningEngine().processRegionChange(State, R, LCtx);
 }
 
 typedef ArrayRef<const MemRegion *> RegionList;