Vendor import of clang trunk r130700:

http://llvm.org/svn/llvm-project/cfe/trunk@130700
author: dim <dim@FreeBSD.org> 2011-05-02 19:39:53 +0000
committer: dim <dim@FreeBSD.org> 2011-05-02 19:39:53 +0000
commit: 110eaaceddcec790f7e6a5e3bf1261c9aa1e73ab (patch)
tree: 64a10f4c4154739d4a8191d7e1b52ce497f4ebd6 /lib/StaticAnalyzer
parent: a0fb00f9837bd0d2e5948f16f6a6b82a7a628f51 (diff)
download: FreeBSD-src-110eaaceddcec790f7e6a5e3bf1261c9aa1e73ab.zip
FreeBSD-src-110eaaceddcec790f7e6a5e3bf1261c9aa1e73ab.tar.gz
78 files changed, 3286 insertions, 2250 deletions
diff --git a/lib/StaticAnalyzer/Checkers/AdjustedReturnValueChecker.cpp b/lib/StaticAnalyzer/Checkers/AdjustedReturnValueChecker.cpp
index 8832b05..8fc6d2a 100644
--- a/lib/StaticAnalyzer/Checkers/AdjustedReturnValueChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/AdjustedReturnValueChecker.cpp
@@ -13,34 +13,25 @@
 //
 //===----------------------------------------------------------------------===//
 
-#include "InternalChecks.h"
+#include "ClangSACheckers.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
+#include "clang/StaticAnalyzer/Core/CheckerManager.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
-#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
-#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerVisitor.h"
 
 using namespace clang;
 using namespace ento;
 
 namespace {
 class AdjustedReturnValueChecker : 
-    public CheckerVisitor<AdjustedReturnValueChecker> {      
+    public Checker< check::PostStmt<CallExpr> > {
 public:
-  AdjustedReturnValueChecker() {}
-
-  void PostVisitCallExpr(CheckerContext &C, const CallExpr *CE);
-      
-  static void *getTag() {
-    static int x = 0; return &x;
-  }      
+  void checkPostStmt(const CallExpr *CE, CheckerContext &C) const;
 };
 }
 
-void ento::RegisterAdjustedReturnValueChecker(ExprEngine &Eng) {
-  Eng.registerCheck(new AdjustedReturnValueChecker());
-}
-
-void AdjustedReturnValueChecker::PostVisitCallExpr(CheckerContext &C,
-                                                   const CallExpr *CE) {
+void AdjustedReturnValueChecker::checkPostStmt(const CallExpr *CE,
+                                               CheckerContext &C) const {
   
   // Get the result type of the call.
   QualType expectedResultTy = CE->getType();
@@ -94,3 +85,7 @@ void AdjustedReturnValueChecker::PostVisitCallExpr(CheckerContext &C,
     C.generateNode(state->BindExpr(CE, V));
   }
 }
+
+void ento::registerAdjustedReturnValueChecker(CheckerManager &mgr) {
+  mgr.registerChecker<AdjustedReturnValueChecker>();
+}
diff --git a/lib/StaticAnalyzer/Checkers/AnalyzerStatsChecker.cpp b/lib/StaticAnalyzer/Checkers/AnalyzerStatsChecker.cpp
index 7b68887..983427a 100644
--- a/lib/StaticAnalyzer/Checkers/AnalyzerStatsChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/AnalyzerStatsChecker.cpp
@@ -9,13 +9,13 @@
 // This file reports various statistics about analyzer visitation.
 //===----------------------------------------------------------------------===//
 
-#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerVisitor.h"
+#include "ClangSACheckers.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
+#include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ExplodedGraph.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
 
-// FIXME: Restructure checker registration.
-#include "ExperimentalChecks.h"
-
 #include "clang/Basic/SourceManager.h"
 #include "llvm/ADT/SmallPtrSet.h"
 
@@ -23,32 +23,20 @@ using namespace clang;
 using namespace ento;
 
 namespace {
-class AnalyzerStatsChecker : public CheckerVisitor<AnalyzerStatsChecker> {
+class AnalyzerStatsChecker : public Checker<check::EndAnalysis> {
 public:
-  static void *getTag();
-  void VisitEndAnalysis(ExplodedGraph &G, BugReporter &B, ExprEngine &Eng);
-
-private:
-  llvm::SmallPtrSet<const CFGBlock*, 256> reachable;
+  void checkEndAnalysis(ExplodedGraph &G, BugReporter &B,ExprEngine &Eng) const;
 };
 }
 
-void *AnalyzerStatsChecker::getTag() {
-  static int x = 0;
-  return &x;
-}
-
-void ento::RegisterAnalyzerStatsChecker(ExprEngine &Eng) {
-  Eng.registerCheck(new AnalyzerStatsChecker());
-}
-
-void AnalyzerStatsChecker::VisitEndAnalysis(ExplodedGraph &G,
+void AnalyzerStatsChecker::checkEndAnalysis(ExplodedGraph &G,
                                             BugReporter &B,
-                                            ExprEngine &Eng) {
+                                            ExprEngine &Eng) const {
   const CFG *C  = 0;
   const Decl *D = 0;
   const LocationContext *LC = 0;
   const SourceManager &SM = B.getSourceManager();
+  llvm::SmallPtrSet<const CFGBlock*, 256> reachable;
 
   // Iterate over explodedgraph
   for (ExplodedGraph::node_iterator I = G.nodes_begin();
@@ -100,8 +88,8 @@ void AnalyzerStatsChecker::VisitEndAnalysis(ExplodedGraph &G,
   }
   
   output << " -> Total CFGBlocks: " << total << " | Unreachable CFGBlocks: "
-      << unreachable << " | Aborted Block: "
-      << (Eng.wasBlockAborted() ? "yes" : "no")
+      << unreachable << " | Exhausted Block: "
+      << (Eng.wasBlocksExhausted() ? "yes" : "no")
       << " | Empty WorkList: "
       << (Eng.hasEmptyWorkList() ? "yes" : "no");
 
@@ -109,10 +97,10 @@ void AnalyzerStatsChecker::VisitEndAnalysis(ExplodedGraph &G,
       D->getLocation());
 
   // Emit warning for each block we bailed out on
-  typedef CoreEngine::BlocksAborted::const_iterator AbortedIterator;
+  typedef CoreEngine::BlocksExhausted::const_iterator ExhaustedIterator;
   const CoreEngine &CE = Eng.getCoreEngine();
-  for (AbortedIterator I = CE.blocks_aborted_begin(),
-      E = CE.blocks_aborted_end(); I != E; ++I) {
+  for (ExhaustedIterator I = CE.blocks_exhausted_begin(),
+      E = CE.blocks_exhausted_end(); I != E; ++I) {
     const BlockEdge &BE =  I->first;
     const CFGBlock *Exit = BE.getDst();
     const CFGElement &CE = Exit->front();
@@ -121,3 +109,7 @@ void AnalyzerStatsChecker::VisitEndAnalysis(ExplodedGraph &G,
           "stopped analyzing at this point", CS->getStmt()->getLocStart());
   }
 }
+
+void ento::registerAnalyzerStatsChecker(CheckerManager &mgr) {
+  mgr.registerChecker<AnalyzerStatsChecker>();
+}
diff --git a/lib/StaticAnalyzer/Checkers/ArrayBoundChecker.cpp b/lib/StaticAnalyzer/Checkers/ArrayBoundChecker.cpp
index 25e224e..eb9665a 100644
--- a/lib/StaticAnalyzer/Checkers/ArrayBoundChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/ArrayBoundChecker.cpp
@@ -13,7 +13,7 @@
 //===----------------------------------------------------------------------===//
 
 #include "ClangSACheckers.h"
-#include "clang/StaticAnalyzer/Core/CheckerV2.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
@@ -24,7 +24,7 @@ using namespace ento;
 
 namespace {
 class ArrayBoundChecker : 
-    public CheckerV2<check::Location> {
+    public Checker<check::Location> {
   mutable llvm::OwningPtr<BuiltinBug> BT;
 public:
   void checkLocation(SVal l, bool isLoad, CheckerContext &C) const;
diff --git a/lib/StaticAnalyzer/Checkers/ArrayBoundCheckerV2.cpp b/lib/StaticAnalyzer/Checkers/ArrayBoundCheckerV2.cpp
index f803d27..65a6e63 100644
--- a/lib/StaticAnalyzer/Checkers/ArrayBoundCheckerV2.cpp
+++ b/lib/StaticAnalyzer/Checkers/ArrayBoundCheckerV2.cpp
@@ -12,9 +12,11 @@
 //
 //===----------------------------------------------------------------------===//
 
-#include "InternalChecks.h"
+#include "ClangSACheckers.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
+#include "clang/StaticAnalyzer/Core/CheckerManager.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
-#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerVisitor.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
 #include "clang/AST/CharUnits.h"
 
@@ -23,18 +25,16 @@ using namespace ento;
 
 namespace {
 class ArrayBoundCheckerV2 : 
-    public CheckerVisitor<ArrayBoundCheckerV2> {      
-  BuiltinBug *BT;
+    public Checker<check::Location> {
+  mutable llvm::OwningPtr<BuiltinBug> BT;
       
   enum OOB_Kind { OOB_Precedes, OOB_Excedes };
   
   void reportOOB(CheckerContext &C, const GRState *errorState,
-                 OOB_Kind kind);
+                 OOB_Kind kind) const;
       
 public:
-  ArrayBoundCheckerV2() : BT(0) {}
-  static void *getTag() { static int x = 0; return &x; }
-  void visitLocation(CheckerContext &C, const Stmt *S, SVal l, bool isLoad);
+  void checkLocation(SVal l, bool isLoad, CheckerContext &C) const;
 };
 
 // FIXME: Eventually replace RegionRawOffset with this class.
@@ -62,13 +62,24 @@ public:
 };
 }
 
-void ento::RegisterArrayBoundCheckerV2(ExprEngine &Eng) {
-  Eng.registerCheck(new ArrayBoundCheckerV2());
+static SVal computeExtentBegin(SValBuilder &svalBuilder, 
+                               const MemRegion *region) {
+  while (true)
+    switch (region->getKind()) {
+      default:
+        return svalBuilder.makeZeroArrayIndex();        
+      case MemRegion::SymbolicRegionKind:
+        // FIXME: improve this later by tracking symbolic lower bounds
+        // for symbolic regions.
+        return UnknownVal();
+      case MemRegion::ElementRegionKind:
+        region = cast<SubRegion>(region)->getSuperRegion();
+        continue;
+    }
 }
 
-void ArrayBoundCheckerV2::visitLocation(CheckerContext &checkerContext,
-                                        const Stmt *S,
-                                        SVal location, bool isLoad) {
+void ArrayBoundCheckerV2::checkLocation(SVal location, bool isLoad,
+                                        CheckerContext &checkerContext) const {
 
   // NOTE: Instead of using GRState::assumeInBound(), we are prototyping
   // some new logic here that reasons directly about memory region extents.
@@ -89,31 +100,36 @@ void ArrayBoundCheckerV2::visitLocation(CheckerContext &checkerContext,
   if (!rawOffset.getRegion())
     return;
 
-  // CHECK LOWER BOUND: Is byteOffset < 0?  If so, we are doing a load/store
+  // CHECK LOWER BOUND: Is byteOffset < extent begin?  
+  //  If so, we are doing a load/store
   //  before the first valid offset in the memory region.
 
-  SVal lowerBound
-    = svalBuilder.evalBinOpNN(state, BO_LT, rawOffset.getByteOffset(),
-                              svalBuilder.makeZeroArrayIndex(),
-                              svalBuilder.getConditionType());
+  SVal extentBegin = computeExtentBegin(svalBuilder, rawOffset.getRegion());
+  
+  if (isa<NonLoc>(extentBegin)) {
+    SVal lowerBound
+      = svalBuilder.evalBinOpNN(state, BO_LT, rawOffset.getByteOffset(),
+                                cast<NonLoc>(extentBegin),
+                                svalBuilder.getConditionType());
 
-  NonLoc *lowerBoundToCheck = dyn_cast<NonLoc>(&lowerBound);
-  if (!lowerBoundToCheck)
-    return;
+    NonLoc *lowerBoundToCheck = dyn_cast<NonLoc>(&lowerBound);
+    if (!lowerBoundToCheck)
+      return;
     
-  const GRState *state_precedesLowerBound, *state_withinLowerBound;
-  llvm::tie(state_precedesLowerBound, state_withinLowerBound) =
+    const GRState *state_precedesLowerBound, *state_withinLowerBound;
+    llvm::tie(state_precedesLowerBound, state_withinLowerBound) =
       state->assume(*lowerBoundToCheck);
 
-  // Are we constrained enough to definitely precede the lower bound?
-  if (state_precedesLowerBound && !state_withinLowerBound) {
-    reportOOB(checkerContext, state_precedesLowerBound, OOB_Precedes);
-    return;
-  }
+    // Are we constrained enough to definitely precede the lower bound?
+    if (state_precedesLowerBound && !state_withinLowerBound) {
+      reportOOB(checkerContext, state_precedesLowerBound, OOB_Precedes);
+      return;
+    }
   
-  // Otherwise, assume the constraint of the lower bound.
-  assert(state_withinLowerBound);
-  state = state_withinLowerBound;
+    // Otherwise, assume the constraint of the lower bound.
+    assert(state_withinLowerBound);
+    state = state_withinLowerBound;
+  }
   
   do {
     // CHECK UPPER BOUND: Is byteOffset >= extent(baseRegion)?  If so,
@@ -153,14 +169,14 @@ void ArrayBoundCheckerV2::visitLocation(CheckerContext &checkerContext,
 
 void ArrayBoundCheckerV2::reportOOB(CheckerContext &checkerContext,
                                     const GRState *errorState,
-                                    OOB_Kind kind) {
+                                    OOB_Kind kind) const {
   
   ExplodedNode *errorNode = checkerContext.generateSink(errorState);
   if (!errorNode)
     return;
 
   if (!BT)
-    BT = new BuiltinBug("Out-of-bound access");
+    BT.reset(new BuiltinBug("Out-of-bound access"));
 
   // FIXME: This diagnostics are preliminary.  We should get far better
   // diagnostics for explaining buffer overruns.
@@ -237,9 +253,11 @@ RegionRawOffsetV2 RegionRawOffsetV2::computeOffset(const GRState *state,
   while (region) {
     switch (region->getKind()) {
       default: {
-        if (const SubRegion *subReg = dyn_cast<SubRegion>(region))
+        if (const SubRegion *subReg = dyn_cast<SubRegion>(region)) {
+          offset = getValue(offset, svalBuilder);
           if (!offset.isUnknownOrUndef())
             return RegionRawOffsetV2(subReg, offset);
+        }
         return RegionRawOffsetV2();
       }
       case MemRegion::ElementRegionKind: {
@@ -274,4 +292,6 @@ RegionRawOffsetV2 RegionRawOffsetV2::computeOffset(const GRState *state,
 }
 
 
-
+void ento::registerArrayBoundCheckerV2(CheckerManager &mgr) {
+  mgr.registerChecker<ArrayBoundCheckerV2>();
+}
diff --git a/lib/StaticAnalyzer/Checkers/AttrNonNullChecker.cpp b/lib/StaticAnalyzer/Checkers/AttrNonNullChecker.cpp
index e4865b1..d88a111 100644
--- a/lib/StaticAnalyzer/Checkers/AttrNonNullChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/AttrNonNullChecker.cpp
@@ -12,33 +12,27 @@
 //
 //===----------------------------------------------------------------------===//
 
-#include "InternalChecks.h"
+#include "ClangSACheckers.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
+#include "clang/StaticAnalyzer/Core/CheckerManager.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
-#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerVisitor.h"
 
 using namespace clang;
 using namespace ento;
 
 namespace {
 class AttrNonNullChecker
-  : public CheckerVisitor<AttrNonNullChecker> {
-  BugType *BT;
+  : public Checker< check::PreStmt<CallExpr> > {
+  mutable llvm::OwningPtr<BugType> BT;
 public:
-  AttrNonNullChecker() : BT(0) {}
-  static void *getTag() {
-    static int x = 0;
-    return &x;
-  }
-  void PreVisitCallExpr(CheckerContext &C, const CallExpr *CE);
+
+  void checkPreStmt(const CallExpr *CE, CheckerContext &C) const;
 };
 } // end anonymous namespace
 
-void ento::RegisterAttrNonNullChecker(ExprEngine &Eng) {
-  Eng.registerCheck(new AttrNonNullChecker());
-}
-
-void AttrNonNullChecker::PreVisitCallExpr(CheckerContext &C, 
-                                          const CallExpr *CE) {
+void AttrNonNullChecker::checkPreStmt(const CallExpr *CE,
+                                      CheckerContext &C) const {
   const GRState *state = C.getState();
 
   // Check if the callee has a 'nonnull' attribute.
@@ -103,8 +97,8 @@ void AttrNonNullChecker::PreVisitCallExpr(CheckerContext &C,
         // created. Ownership is transferred to the BugReporter object once
         // the BugReport is passed to 'EmitWarning'.
         if (!BT)
-          BT = new BugType("Argument with 'nonnull' attribute passed null",
-                           "API");
+          BT.reset(new BugType("Argument with 'nonnull' attribute passed null",
+                               "API"));
 
         EnhancedBugReport *R =
           new EnhancedBugReport(*BT,
@@ -134,3 +128,7 @@ void AttrNonNullChecker::PreVisitCallExpr(CheckerContext &C,
   // If 'state' has been updated generated a new node.
   C.addTransition(state);
 }
+
+void ento::registerAttrNonNullChecker(CheckerManager &mgr) {
+  mgr.registerChecker<AttrNonNullChecker>();
+}
diff --git a/lib/StaticAnalyzer/Checkers/BasicObjCFoundationChecks.cpp b/lib/StaticAnalyzer/Checkers/BasicObjCFoundationChecks.cpp
index 7aff201..235b400 100644
--- a/lib/StaticAnalyzer/Checkers/BasicObjCFoundationChecks.cpp
+++ b/lib/StaticAnalyzer/Checkers/BasicObjCFoundationChecks.cpp
@@ -13,10 +13,9 @@
 //
 //===----------------------------------------------------------------------===//
 
-#include "BasicObjCFoundationChecks.h"
-
 #include "ClangSACheckers.h"
-#include "clang/StaticAnalyzer/Core/CheckerV2.h"
+#include "clang/Analysis/DomainSpecific/CocoaConventions.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ExplodedGraph.h"
@@ -24,7 +23,6 @@
 #include "clang/StaticAnalyzer/Core/PathSensitive/GRState.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h"
-#include "clang/StaticAnalyzer/Checkers/LocalCheckers.h"
 #include "clang/AST/DeclObjC.h"
 #include "clang/AST/Expr.h"
 #include "clang/AST/ExprObjC.h"
@@ -44,20 +42,21 @@ public:
 // Utility functions.
 //===----------------------------------------------------------------------===//
 
-static const ObjCInterfaceType* GetReceiverType(const ObjCMessage &msg) {
+static const char* GetReceiverNameType(const ObjCMessage &msg) {
   if (const ObjCInterfaceDecl *ID = msg.getReceiverInterface())
-    return ID->getTypeForDecl()->getAs<ObjCInterfaceType>();
-  return NULL;
+    return ID->getIdentifier()->getNameStart();
+  return 0;
 }
 
-static const char* GetReceiverNameType(const ObjCMessage &msg) {
-  if (const ObjCInterfaceType *ReceiverType = GetReceiverType(msg))
-    return ReceiverType->getDecl()->getIdentifier()->getNameStart();
-  return NULL;
-}
+static bool isReceiverClassOrSuperclass(const ObjCInterfaceDecl *ID,
+                                        llvm::StringRef ClassName) {
+  if (ID->getIdentifier()->getName() == ClassName)
+    return true;
 
-static bool isNSString(llvm::StringRef ClassName) {
-  return ClassName == "NSString" || ClassName == "NSMutableString";
+  if (const ObjCInterfaceDecl *Super = ID->getSuperClass())
+    return isReceiverClassOrSuperclass(Super, ClassName);
+
+  return false;
 }
 
 static inline bool isNil(SVal X) {
@@ -69,7 +68,7 @@ static inline bool isNil(SVal X) {
 //===----------------------------------------------------------------------===//
 
 namespace {
-  class NilArgChecker : public CheckerV2<check::PreObjCMessage> {
+  class NilArgChecker : public Checker<check::PreObjCMessage> {
     mutable llvm::OwningPtr<APIMisuse> BT;
 
     void WarnNilArg(CheckerContext &C,
@@ -101,11 +100,11 @@ void NilArgChecker::WarnNilArg(CheckerContext &C,
 
 void NilArgChecker::checkPreObjCMessage(ObjCMessage msg,
                                         CheckerContext &C) const {
-  const ObjCInterfaceType *ReceiverType = GetReceiverType(msg);
-  if (!ReceiverType)
+  const ObjCInterfaceDecl *ID = msg.getReceiverInterface();
+  if (!ID)
     return;
   
-  if (isNSString(ReceiverType->getDecl()->getIdentifier()->getName())) {
+  if (isReceiverClassOrSuperclass(ID, "NSString")) {
     Selector S = msg.getSelector();
     
     if (S.isUnarySelector())
@@ -140,7 +139,7 @@ void NilArgChecker::checkPreObjCMessage(ObjCMessage msg,
 //===----------------------------------------------------------------------===//
 
 namespace {
-class CFNumberCreateChecker : public CheckerV2< check::PreStmt<CallExpr> > {
+class CFNumberCreateChecker : public Checker< check::PreStmt<CallExpr> > {
   mutable llvm::OwningPtr<APIMisuse> BT;
   mutable IdentifierInfo* II;
 public:
@@ -347,7 +346,7 @@ void CFNumberCreateChecker::checkPreStmt(const CallExpr *CE,
 //===----------------------------------------------------------------------===//
 
 namespace {
-class CFRetainReleaseChecker : public CheckerV2< check::PreStmt<CallExpr> > {
+class CFRetainReleaseChecker : public Checker< check::PreStmt<CallExpr> > {
   mutable llvm::OwningPtr<APIMisuse> BT;
   mutable IdentifierInfo *Retain, *Release;
 public:
@@ -429,7 +428,7 @@ void CFRetainReleaseChecker::checkPreStmt(const CallExpr* CE,
 //===----------------------------------------------------------------------===//
 
 namespace {
-class ClassReleaseChecker : public CheckerV2<check::PreObjCMessage> {
+class ClassReleaseChecker : public Checker<check::PreObjCMessage> {
   mutable Selector releaseS;
   mutable Selector retainS;
   mutable Selector autoreleaseS;
@@ -479,6 +478,165 @@ void ClassReleaseChecker::checkPreObjCMessage(ObjCMessage msg,
 }
 
 //===----------------------------------------------------------------------===//
+// Check for passing non-Objective-C types to variadic methods that expect
+// only Objective-C types.
+//===----------------------------------------------------------------------===//
+
+namespace {
+class VariadicMethodTypeChecker : public Checker<check::PreObjCMessage> {
+  mutable Selector arrayWithObjectsS;
+  mutable Selector dictionaryWithObjectsAndKeysS;
+  mutable Selector setWithObjectsS;
+  mutable Selector initWithObjectsS;
+  mutable Selector initWithObjectsAndKeysS;
+  mutable llvm::OwningPtr<BugType> BT;
+
+  bool isVariadicMessage(const ObjCMessage &msg) const;
+
+public:
+  void checkPreObjCMessage(ObjCMessage msg, CheckerContext &C) const;
+};
+}
+
+/// isVariadicMessage - Returns whether the given message is a variadic message,
+/// where all arguments must be Objective-C types.
+bool
+VariadicMethodTypeChecker::isVariadicMessage(const ObjCMessage &msg) const {
+  const ObjCMethodDecl *MD = msg.getMethodDecl();
+  
+  if (!MD || !MD->isVariadic() || isa<ObjCProtocolDecl>(MD->getDeclContext()))
+    return false;
+  
+  Selector S = msg.getSelector();
+  
+  if (msg.isInstanceMessage()) {
+    // FIXME: Ideally we'd look at the receiver interface here, but that's not
+    // useful for init, because alloc returns 'id'. In theory, this could lead
+    // to false positives, for example if there existed a class that had an
+    // initWithObjects: implementation that does accept non-Objective-C pointer
+    // types, but the chance of that happening is pretty small compared to the
+    // gains that this analysis gives.
+    const ObjCInterfaceDecl *Class = MD->getClassInterface();
+
+    // -[NSArray initWithObjects:]
+    if (isReceiverClassOrSuperclass(Class, "NSArray") &&
+        S == initWithObjectsS)
+      return true;
+
+    // -[NSDictionary initWithObjectsAndKeys:]
+    if (isReceiverClassOrSuperclass(Class, "NSDictionary") &&
+        S == initWithObjectsAndKeysS)
+      return true;
+
+    // -[NSSet initWithObjects:]
+    if (isReceiverClassOrSuperclass(Class, "NSSet") &&
+        S == initWithObjectsS)
+      return true;
+  } else {
+    const ObjCInterfaceDecl *Class = msg.getReceiverInterface();
+
+    // -[NSArray arrayWithObjects:]
+    if (isReceiverClassOrSuperclass(Class, "NSArray") &&
+        S == arrayWithObjectsS)
+      return true;
+
+    // -[NSDictionary dictionaryWithObjectsAndKeys:]
+    if (isReceiverClassOrSuperclass(Class, "NSDictionary") &&
+        S == dictionaryWithObjectsAndKeysS)
+      return true;
+
+    // -[NSSet setWithObjects:]
+    if (isReceiverClassOrSuperclass(Class, "NSSet") &&
+        S == setWithObjectsS)
+      return true;
+  }
+
+  return false;
+}
+
+void VariadicMethodTypeChecker::checkPreObjCMessage(ObjCMessage msg,
+                                                    CheckerContext &C) const {
+  if (!BT) {
+    BT.reset(new APIMisuse("Arguments passed to variadic method aren't all "
+                           "Objective-C pointer types"));
+
+    ASTContext &Ctx = C.getASTContext();
+    arrayWithObjectsS = GetUnarySelector("arrayWithObjects", Ctx);
+    dictionaryWithObjectsAndKeysS = 
+      GetUnarySelector("dictionaryWithObjectsAndKeys", Ctx);
+    setWithObjectsS = GetUnarySelector("setWithObjects", Ctx);
+
+    initWithObjectsS = GetUnarySelector("initWithObjects", Ctx);
+    initWithObjectsAndKeysS = GetUnarySelector("initWithObjectsAndKeys", Ctx);
+  }
+
+  if (!isVariadicMessage(msg))
+      return;
+
+  // We are not interested in the selector arguments since they have
+  // well-defined types, so the compiler will issue a warning for them.
+  unsigned variadicArgsBegin = msg.getSelector().getNumArgs();
+
+  // We're not interested in the last argument since it has to be nil or the
+  // compiler would have issued a warning for it elsewhere.
+  unsigned variadicArgsEnd = msg.getNumArgs() - 1;
+
+  if (variadicArgsEnd <= variadicArgsBegin)
+    return;
+
+  // Verify that all arguments have Objective-C types.
+  llvm::Optional<ExplodedNode*> errorNode;
+  const GRState *state = C.getState();
+  
+  for (unsigned I = variadicArgsBegin; I != variadicArgsEnd; ++I) {
+    QualType ArgTy = msg.getArgType(I);
+    if (ArgTy->isObjCObjectPointerType())
+      continue;
+
+    // Block pointers are treaded as Objective-C pointers.
+    if (ArgTy->isBlockPointerType())
+      continue;
+
+    // Ignore pointer constants.
+    if (isa<loc::ConcreteInt>(msg.getArgSVal(I, state)))
+      continue;
+    
+    // Ignore pointer types annotated with 'NSObject' attribute.
+    if (C.getASTContext().isObjCNSObjectType(ArgTy))
+      continue;
+    
+    // Ignore CF references, which can be toll-free bridged.
+    if (cocoa::isCFObjectRef(ArgTy))
+      continue;
+
+    // Generate only one error node to use for all bug reports.
+    if (!errorNode.hasValue()) {
+      errorNode = C.generateNode();
+    }
+
+    if (!errorNode.getValue())
+      continue;
+
+    llvm::SmallString<128> sbuf;
+    llvm::raw_svector_ostream os(sbuf);
+
+    if (const char *TypeName = GetReceiverNameType(msg))
+      os << "Argument to '" << TypeName << "' method '";
+    else
+      os << "Argument to method '";
+
+    os << msg.getSelector().getAsString() 
+      << "' should be an Objective-C pointer type, not '" 
+      << ArgTy.getAsString() << "'";
+
+    RangedBugReport *R = new RangedBugReport(*BT, os.str(),
+                                             errorNode.getValue());
+    R->addRange(msg.getArgSourceRange(I));
+    C.EmitReport(R);
+  }
+}
+
+//===----------------------------------------------------------------------===//
 // Check registration.
 //===----------------------------------------------------------------------===//
 
@@ -497,3 +655,7 @@ void ento::registerCFRetainReleaseChecker(CheckerManager &mgr) {
 void ento::registerClassReleaseChecker(CheckerManager &mgr) {
   mgr.registerChecker<ClassReleaseChecker>();
 }
+
+void ento::registerVariadicMethodTypeChecker(CheckerManager &mgr) {
+  mgr.registerChecker<VariadicMethodTypeChecker>();
+}
diff --git a/lib/StaticAnalyzer/Checkers/BasicObjCFoundationChecks.h b/lib/StaticAnalyzer/Checkers/BasicObjCFoundationChecks.h
deleted file mode 100644
index 92cfb1a..0000000
--- a/lib/StaticAnalyzer/Checkers/BasicObjCFoundationChecks.h
+++ /dev/null
@@ -1,35 +0,0 @@
-//== BasicObjCFoundationChecks.h - Simple Apple-Foundation checks -*- C++ -*--//
-//
-//                     The LLVM Compiler Infrastructure
-//
-// This file is distributed under the University of Illinois Open Source
-// License. See LICENSE.TXT for details.
-//
-//===----------------------------------------------------------------------===//
-//
-//  This file defines BasicObjCFoundationChecks, a class that encapsulates
-//  a set of simple checks to run on Objective-C code using Apple's Foundation
-//  classes.
-//
-//===----------------------------------------------------------------------===//
-
-#ifndef LLVM_CLANG_GR_BASICOBJCFOUNDATIONCHECKS
-#define LLVM_CLANG_GR_BASICOBJCFOUNDATIONCHECKS
-
-namespace clang {
-
-class ASTContext;
-class Decl;
-
-namespace ento {
-
-class BugReporter;
-class ExprEngine;
-
-void RegisterNSErrorChecks(BugReporter& BR, ExprEngine &Eng, const Decl &D);
-
-} // end GR namespace
-
-} // end clang namespace
-
-#endif
diff --git a/lib/StaticAnalyzer/Checkers/BuiltinFunctionChecker.cpp b/lib/StaticAnalyzer/Checkers/BuiltinFunctionChecker.cpp
index 417b015..12ac652 100644
--- a/lib/StaticAnalyzer/Checkers/BuiltinFunctionChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/BuiltinFunctionChecker.cpp
@@ -11,8 +11,10 @@
 //
 //===----------------------------------------------------------------------===//
 
-#include "InternalChecks.h"
-#include "clang/StaticAnalyzer/Core/PathSensitive/Checker.h"
+#include "ClangSACheckers.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
+#include "clang/StaticAnalyzer/Core/CheckerManager.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/Basic/Builtins.h"
 
 using namespace clang;
@@ -20,19 +22,15 @@ using namespace ento;
 
 namespace {
 
-class BuiltinFunctionChecker : public Checker {
+class BuiltinFunctionChecker : public Checker<eval::Call> {
 public:
-  static void *getTag() { static int tag = 0; return &tag; }
-  virtual bool evalCallExpr(CheckerContext &C, const CallExpr *CE);
+  bool evalCall(const CallExpr *CE, CheckerContext &C) const;
 };
 
 }
 
-void ento::RegisterBuiltinFunctionChecker(ExprEngine &Eng) {
-  Eng.registerCheck(new BuiltinFunctionChecker());
-}
-
-bool BuiltinFunctionChecker::evalCallExpr(CheckerContext &C,const CallExpr *CE){
+bool BuiltinFunctionChecker::evalCall(const CallExpr *CE,
+                                      CheckerContext &C) const{
   const GRState *state = C.getState();
   const Expr *Callee = CE->getCallee();
   SVal L = state->getSVal(Callee);
@@ -81,3 +79,7 @@ bool BuiltinFunctionChecker::evalCallExpr(CheckerContext &C,const CallExpr *CE){
 
   return false;
 }
+
+void ento::registerBuiltinFunctionChecker(CheckerManager &mgr) {
+  mgr.registerChecker<BuiltinFunctionChecker>();
+}
diff --git a/lib/StaticAnalyzer/Checkers/CMakeLists.txt b/lib/StaticAnalyzer/Checkers/CMakeLists.txt
index e308396..8dc7f38 100644
--- a/lib/StaticAnalyzer/Checkers/CMakeLists.txt
+++ b/lib/StaticAnalyzer/Checkers/CMakeLists.txt
@@ -27,10 +27,9 @@ add_clang_library(clangStaticAnalyzerCheckers
   DebugCheckers.cpp
   DereferenceChecker.cpp
   DivZeroChecker.cpp
-  ExperimentalChecks.cpp
-  ExprEngine.cpp
   FixedAddressChecker.cpp
   IdempotentOperationChecker.cpp
+  IteratorsChecker.cpp
   LLVMConventionsChecker.cpp
   MacOSXAPIChecker.cpp
   MallocChecker.cpp
diff --git a/lib/StaticAnalyzer/Checkers/CStringChecker.cpp b/lib/StaticAnalyzer/Checkers/CStringChecker.cpp
index 2566e3c..a6a256a 100644
--- a/lib/StaticAnalyzer/Checkers/CStringChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/CStringChecker.cpp
@@ -13,7 +13,7 @@
 //===----------------------------------------------------------------------===//
 
 #include "ClangSACheckers.h"
-#include "clang/StaticAnalyzer/Core/CheckerV2.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
@@ -24,7 +24,7 @@ using namespace clang;
 using namespace ento;
 
 namespace {
-class CStringChecker : public CheckerV2< eval::Call,
+class CStringChecker : public Checker< eval::Call,
                                          check::PreStmt<DeclStmt>,
                                          check::LiveSymbols,
                                          check::DeadSymbols,
@@ -49,11 +49,14 @@ public:
                                           const CallExpr *) const;
 
   void evalMemcpy(CheckerContext &C, const CallExpr *CE) const;
+  void evalMempcpy(CheckerContext &C, const CallExpr *CE) const;
   void evalMemmove(CheckerContext &C, const CallExpr *CE) const;
   void evalBcopy(CheckerContext &C, const CallExpr *CE) const;
-  void evalCopyCommon(CheckerContext &C, const GRState *state,
+  void evalCopyCommon(CheckerContext &C, const CallExpr *CE,
+                      const GRState *state,
                       const Expr *Size, const Expr *Source, const Expr *Dest,
-                      bool Restricted = false) const;
+                      bool Restricted = false,
+                      bool IsMempcpy = false) const;
 
   void evalMemcmp(CheckerContext &C, const CallExpr *CE) const;
 
@@ -66,7 +69,16 @@ public:
   void evalStrncpy(CheckerContext &C, const CallExpr *CE) const;
   void evalStpcpy(CheckerContext &C, const CallExpr *CE) const;
   void evalStrcpyCommon(CheckerContext &C, const CallExpr *CE, bool returnEnd,
-                        bool isStrncpy) const;
+                        bool isBounded, bool isAppending) const;
+
+  void evalStrcat(CheckerContext &C, const CallExpr *CE) const;
+  void evalStrncat(CheckerContext &C, const CallExpr *CE) const;
+
+  void evalStrcmp(CheckerContext &C, const CallExpr *CE) const;
+  void evalStrncmp(CheckerContext &C, const CallExpr *CE) const;
+  void evalStrcasecmp(CheckerContext &C, const CallExpr *CE) const;
+  void evalStrcmpCommon(CheckerContext &C, const CallExpr *CE,
+                        bool isBounded = false, bool ignoreCase = false) const;
 
   // Utility methods
   std::pair<const GRState*, const GRState*>
@@ -81,6 +93,11 @@ public:
   SVal getCStringLength(CheckerContext &C, const GRState *&state,
                         const Expr *Ex, SVal Buf) const;
 
+  const StringLiteral *getCStringLiteral(CheckerContext &C, 
+                                         const GRState *&state,
+                                         const Expr *expr,  
+                                         SVal val) const;
+
   static const GRState *InvalidateBuffer(CheckerContext &C,
                                          const GRState *state,
                                          const Expr *Ex, SVal V);
@@ -275,7 +292,7 @@ const GRState *CStringChecker::CheckBufferAccess(CheckerContext &C,
   NonLoc LastOffset = cast<NonLoc>(svalBuilder.evalBinOpNN(state, BO_Sub,
                                                     *Length, One, sizeTy));
 
-  // Check that the first buffer is sufficently long.
+  // Check that the first buffer is sufficiently long.
   SVal BufStart = svalBuilder.evalCast(BufVal, PtrTy, FirstBuf->getType());
   if (Loc *BufLoc = dyn_cast<Loc>(&BufStart)) {
     SVal BufEnd = svalBuilder.evalBinOpLN(state, BO_Add, *BufLoc,
@@ -581,6 +598,26 @@ SVal CStringChecker::getCStringLength(CheckerContext &C, const GRState *&state,
   }
 }
 
+const StringLiteral *CStringChecker::getCStringLiteral(CheckerContext &C,
+  const GRState *&state, const Expr *expr, SVal val) const {
+
+  // Get the memory region pointed to by the val.
+  const MemRegion *bufRegion = val.getAsRegion();
+  if (!bufRegion)
+    return NULL; 
+
+  // Strip casts off the memory region.
+  bufRegion = bufRegion->StripCasts();
+
+  // Cast the memory region to a string region.
+  const StringRegion *strRegion= dyn_cast<StringRegion>(bufRegion);
+  if (!strRegion)
+    return NULL; 
+
+  // Return the actual string in the string region.
+  return strRegion->getStringLiteral();
+}
+
 const GRState *CStringChecker::InvalidateBuffer(CheckerContext &C,
                                                 const GRState *state,
                                                 const Expr *E, SVal V) {
@@ -655,9 +692,12 @@ bool CStringChecker::SummarizeRegion(llvm::raw_ostream& os, ASTContext& Ctx,
 // evaluation of individual function calls.
 //===----------------------------------------------------------------------===//
 
-void CStringChecker::evalCopyCommon(CheckerContext &C, const GRState *state,
+void CStringChecker::evalCopyCommon(CheckerContext &C, 
+                                    const CallExpr *CE,
+                                    const GRState *state,
                                     const Expr *Size, const Expr *Dest,
-                                    const Expr *Source, bool Restricted) const {
+                                    const Expr *Source, bool Restricted,
+                                    bool IsMempcpy) const {
   // See if the size argument is zero.
   SVal sizeVal = state->getSVal(Size);
   QualType sizeTy = Size->getType();
@@ -665,12 +705,39 @@ void CStringChecker::evalCopyCommon(CheckerContext &C, const GRState *state,
   const GRState *stateZeroSize, *stateNonZeroSize;
   llvm::tie(stateZeroSize, stateNonZeroSize) = assumeZero(C, state, sizeVal, sizeTy);
 
-  // If the size is zero, there won't be any actual memory access.
-  if (stateZeroSize)
+  // Get the value of the Dest.
+  SVal destVal = state->getSVal(Dest);
+
+  // If the size is zero, there won't be any actual memory access, so
+  // just bind the return value to the destination buffer and return.
+  if (stateZeroSize) {
     C.addTransition(stateZeroSize);
+    if (IsMempcpy)
+      state->BindExpr(CE, destVal);
+    else
+      state->BindExpr(CE, sizeVal);
+    return;
+  }
 
   // If the size can be nonzero, we have to check the other arguments.
   if (stateNonZeroSize) {
+
+    // Ensure the destination is not null. If it is NULL there will be a
+    // NULL pointer dereference.
+    state = checkNonNull(C, state, Dest, destVal);
+    if (!state)
+      return;
+
+    // Get the value of the Src.
+    SVal srcVal = state->getSVal(Source);
+    
+    // Ensure the source is not null. If it is NULL there will be a
+    // NULL pointer dereference.
+    state = checkNonNull(C, state, Source, srcVal);
+    if (!state)
+      return;
+
+    // Ensure the buffers do not overlap.
     state = stateNonZeroSize;
     state = CheckBufferAccess(C, state, Size, Dest, Source,
                               /* FirstIsDst = */ true);
@@ -678,6 +745,26 @@ void CStringChecker::evalCopyCommon(CheckerContext &C, const GRState *state,
       state = CheckOverlap(C, state, Size, Dest, Source);
 
     if (state) {
+
+      // If this is mempcpy, get the byte after the last byte copied and 
+      // bind the expr.
+      if (IsMempcpy) {
+        loc::MemRegionVal *destRegVal = dyn_cast<loc::MemRegionVal>(&destVal);
+        
+        // Get the length to copy.
+        SVal lenVal = state->getSVal(Size);
+        NonLoc *lenValNonLoc = dyn_cast<NonLoc>(&lenVal);
+        
+        // Get the byte after the last byte copied.
+        SVal lastElement = C.getSValBuilder().evalBinOpLN(state, BO_Add, 
+                                                          *destRegVal,
+                                                          *lenValNonLoc, 
+                                                          Dest->getType());
+        
+        // The byte after the last byte copied is the return value.
+        state = state->BindExpr(CE, lastElement);
+      }
+
       // Invalidate the destination.
       // FIXME: Even if we can't perfectly model the copy, we should see if we
       // can use LazyCompoundVals to copy the source values into the destination.
@@ -696,7 +783,16 @@ void CStringChecker::evalMemcpy(CheckerContext &C, const CallExpr *CE) const {
   const Expr *Dest = CE->getArg(0);
   const GRState *state = C.getState();
   state = state->BindExpr(CE, state->getSVal(Dest));
-  evalCopyCommon(C, state, CE->getArg(2), Dest, CE->getArg(1), true);
+  evalCopyCommon(C, CE, state, CE->getArg(2), Dest, CE->getArg(1), true);
+}
+
+void CStringChecker::evalMempcpy(CheckerContext &C, const CallExpr *CE) const {
+  // void *mempcpy(void *restrict dst, const void *restrict src, size_t n);
+  // The return value is a pointer to the byte following the last written byte.
+  const Expr *Dest = CE->getArg(0);
+  const GRState *state = C.getState();
+  
+  evalCopyCommon(C, CE, state, CE->getArg(2), Dest, CE->getArg(1), true, true);
 }
 
 void CStringChecker::evalMemmove(CheckerContext &C, const CallExpr *CE) const {
@@ -705,12 +801,13 @@ void CStringChecker::evalMemmove(CheckerContext &C, const CallExpr *CE) const {
   const Expr *Dest = CE->getArg(0);
   const GRState *state = C.getState();
   state = state->BindExpr(CE, state->getSVal(Dest));
-  evalCopyCommon(C, state, CE->getArg(2), Dest, CE->getArg(1));
+  evalCopyCommon(C, CE, state, CE->getArg(2), Dest, CE->getArg(1));
 }
 
 void CStringChecker::evalBcopy(CheckerContext &C, const CallExpr *CE) const {
   // void bcopy(const void *src, void *dst, size_t n);
-  evalCopyCommon(C, C.getState(), CE->getArg(2), CE->getArg(1), CE->getArg(0));
+  evalCopyCommon(C, CE, C.getState(), 
+                 CE->getArg(2), CE->getArg(1), CE->getArg(0));
 }
 
 void CStringChecker::evalMemcmp(CheckerContext &C, const CallExpr *CE) const {
@@ -849,24 +946,50 @@ void CStringChecker::evalstrLengthCommon(CheckerContext &C, const CallExpr *CE,
 
 void CStringChecker::evalStrcpy(CheckerContext &C, const CallExpr *CE) const {
   // char *strcpy(char *restrict dst, const char *restrict src);
-  evalStrcpyCommon(C, CE, /* returnEnd = */ false, /* isStrncpy = */ false);
+  evalStrcpyCommon(C, CE, 
+                   /* returnEnd = */ false, 
+                   /* isBounded = */ false,
+                   /* isAppending = */ false);
 }
 
 void CStringChecker::evalStrncpy(CheckerContext &C, const CallExpr *CE) const {
   // char *strcpy(char *restrict dst, const char *restrict src);
-  evalStrcpyCommon(C, CE, /* returnEnd = */ false, /* isStrncpy = */ true);
+  evalStrcpyCommon(C, CE, 
+                   /* returnEnd = */ false, 
+                   /* isBounded = */ true,
+                   /* isAppending = */ false);
 }
 
 void CStringChecker::evalStpcpy(CheckerContext &C, const CallExpr *CE) const {
   // char *stpcpy(char *restrict dst, const char *restrict src);
-  evalStrcpyCommon(C, CE, /* returnEnd = */ true, /* isStrncpy = */ false);
+  evalStrcpyCommon(C, CE, 
+                   /* returnEnd = */ true, 
+                   /* isBounded = */ false,
+                   /* isAppending = */ false);
+}
+
+void CStringChecker::evalStrcat(CheckerContext &C, const CallExpr *CE) const {
+  //char *strcat(char *restrict s1, const char *restrict s2);
+  evalStrcpyCommon(C, CE, 
+                   /* returnEnd = */ false, 
+                   /* isBounded = */ false,
+                   /* isAppending = */ true);
+}
+
+void CStringChecker::evalStrncat(CheckerContext &C, const CallExpr *CE) const {
+  //char *strncat(char *restrict s1, const char *restrict s2, size_t n);
+  evalStrcpyCommon(C, CE, 
+                   /* returnEnd = */ false, 
+                   /* isBounded = */ true,
+                   /* isAppending = */ true);
 }
 
 void CStringChecker::evalStrcpyCommon(CheckerContext &C, const CallExpr *CE,
-                                      bool returnEnd, bool isStrncpy) const {
+                                      bool returnEnd, bool isBounded,
+                                      bool isAppending) const {
   const GRState *state = C.getState();
 
-  // Check that the destination is non-null
+  // Check that the destination is non-null.
   const Expr *Dst = CE->getArg(0);
   SVal DstVal = state->getSVal(Dst);
 
@@ -888,18 +1011,26 @@ void CStringChecker::evalStrcpyCommon(CheckerContext &C, const CallExpr *CE,
   if (strLength.isUndef())
     return;
 
-  if (isStrncpy) {
-    // Get the max number of characters to copy
+  // If the function is strncpy, strncat, etc... it is bounded.
+  if (isBounded) {
+    // Get the max number of characters to copy.
     const Expr *lenExpr = CE->getArg(2);
     SVal lenVal = state->getSVal(lenExpr);
 
+    // Cast the length to a NonLoc SVal. If it is not a NonLoc then give up.
     NonLoc *strLengthNL = dyn_cast<NonLoc>(&strLength);
+    if (!strLengthNL)
+      return;
+
+    // Cast the max length to a NonLoc SVal. If it is not a NonLoc then give up.
     NonLoc *lenValNL = dyn_cast<NonLoc>(&lenVal);
+    if (!lenValNL)
+      return;
 
     QualType cmpTy = C.getSValBuilder().getContext().IntTy;
     const GRState *stateTrue, *stateFalse;
     
-    // Check if the max number to copy is less than the length of the src
+    // Check if the max number to copy is less than the length of the src.
     llvm::tie(stateTrue, stateFalse) =
       state->assume(cast<DefinedOrUnknownSVal>
                     (C.getSValBuilder().evalBinOpNN(state, BO_GT, 
@@ -913,6 +1044,29 @@ void CStringChecker::evalStrcpyCommon(CheckerContext &C, const CallExpr *CE,
     }    
   }
 
+  // If this is an appending function (strcat, strncat...) then set the
+  // string length to strlen(src) + strlen(dst) since the buffer will
+  // ultimately contain both.
+  if (isAppending) {
+    // Get the string length of the destination, or give up.
+    SVal dstStrLength = getCStringLength(C, state, Dst, DstVal);
+    if (dstStrLength.isUndef())
+      return;
+
+    NonLoc *srcStrLengthNL = dyn_cast<NonLoc>(&strLength);
+    NonLoc *dstStrLengthNL = dyn_cast<NonLoc>(&dstStrLength);
+    
+    // If src or dst cast to NonLoc is NULL, give up.
+    if ((!srcStrLengthNL) || (!dstStrLengthNL))
+      return;
+
+    QualType addTy = C.getSValBuilder().getContext().getSizeType();
+
+    strLength = C.getSValBuilder().evalBinOpNN(state, BO_Add, 
+                                               *srcStrLengthNL, *dstStrLengthNL,
+                                               addTy);
+  }
+
   SVal Result = (returnEnd ? UnknownVal() : DstVal);
 
   // If the destination is a MemRegion, try to check for a buffer overflow and
@@ -958,6 +1112,113 @@ void CStringChecker::evalStrcpyCommon(CheckerContext &C, const CallExpr *CE,
   C.addTransition(state);
 }
 
+void CStringChecker::evalStrcmp(CheckerContext &C, const CallExpr *CE) const {
+  //int strcmp(const char *restrict s1, const char *restrict s2);
+  evalStrcmpCommon(C, CE, /* isBounded = */ false, /* ignoreCase = */ false);
+}
+
+void CStringChecker::evalStrncmp(CheckerContext &C, const CallExpr *CE) const {
+  //int strncmp(const char *restrict s1, const char *restrict s2, size_t n);
+  evalStrcmpCommon(C, CE, /* isBounded = */ true, /* ignoreCase = */ false);
+}
+
+void CStringChecker::evalStrcasecmp(CheckerContext &C, 
+                                    const CallExpr *CE) const {
+  //int strcasecmp(const char *restrict s1, const char *restrict s2);
+  evalStrcmpCommon(C, CE, /* isBounded = */ false, /* ignoreCase = */ true);
+}
+
+void CStringChecker::evalStrcmpCommon(CheckerContext &C, const CallExpr *CE,
+                                      bool isBounded, bool ignoreCase) const {
+  const GRState *state = C.getState();
+
+  // Check that the first string is non-null
+  const Expr *s1 = CE->getArg(0);
+  SVal s1Val = state->getSVal(s1);
+  state = checkNonNull(C, state, s1, s1Val);
+  if (!state)
+    return;
+
+  // Check that the second string is non-null.
+  const Expr *s2 = CE->getArg(1);
+  SVal s2Val = state->getSVal(s2);
+  state = checkNonNull(C, state, s2, s2Val);
+  if (!state)
+    return;
+
+  // Get the string length of the first string or give up.
+  SVal s1Length = getCStringLength(C, state, s1, s1Val);
+  if (s1Length.isUndef())
+    return;
+
+  // Get the string length of the second string or give up.
+  SVal s2Length = getCStringLength(C, state, s2, s2Val);
+  if (s2Length.isUndef())
+    return;
+
+  // Get the string literal of the first string.
+  const StringLiteral *s1StrLiteral = getCStringLiteral(C, state, s1, s1Val);
+  if (!s1StrLiteral)
+    return;
+  llvm::StringRef s1StrRef = s1StrLiteral->getString();
+
+  // Get the string literal of the second string.
+  const StringLiteral *s2StrLiteral = getCStringLiteral(C, state, s2, s2Val);
+  if (!s2StrLiteral)
+    return;
+  llvm::StringRef s2StrRef = s2StrLiteral->getString();
+
+  int result;
+  if (isBounded) {
+    // Get the max number of characters to compare.
+    const Expr *lenExpr = CE->getArg(2);
+    SVal lenVal = state->getSVal(lenExpr);
+
+    // Dynamically cast the length to a ConcreteInt. If it is not a ConcreteInt
+    // then give up, otherwise get the value and use it as the bounds.
+    nonloc::ConcreteInt *CI = dyn_cast<nonloc::ConcreteInt>(&lenVal);
+    if (!CI)
+      return;
+    llvm::APSInt lenInt(CI->getValue());
+
+    // Compare using the bounds provided like strncmp() does.
+    if (ignoreCase) {
+      // TODO Implement compare_lower(RHS, n) in LLVM StringRef.
+      // result = s1StrRef.compare_lower(s2StrRef, 
+      //                                 (size_t)lenInt.getLimitedValue());
+
+      // For now, give up.
+      return;
+    } else {
+      // Create substrings of each to compare the prefix.
+      llvm::StringRef s1SubStr = 
+        s1StrRef.substr(0, (size_t)lenInt.getLimitedValue());
+      llvm::StringRef s2SubStr = 
+        s2StrRef.substr(0, (size_t)lenInt.getLimitedValue());
+
+      // Compare the substrings.
+      result = s1SubStr.compare(s2SubStr);
+    }
+  } else {
+    // Compare string 1 to string 2 the same way strcmp() does.
+    if (ignoreCase) {
+      result = s1StrRef.compare_lower(s2StrRef);
+    } else {
+      result = s1StrRef.compare(s2StrRef);
+    }
+  }
+  
+  // Build the SVal of the comparison to bind the return value.
+  SValBuilder &svalBuilder = C.getSValBuilder();
+  QualType intTy = svalBuilder.getContext().IntTy;
+  SVal resultVal = svalBuilder.makeIntVal(result, intTy);
+
+  // Bind the return value of the expression.
+  // Set the return value.
+  state = state->BindExpr(CE, resultVal);
+  C.addTransition(state);
+}
+
 //===----------------------------------------------------------------------===//
 // The driver method, and other Checker callbacks.
 //===----------------------------------------------------------------------===//
@@ -982,13 +1243,19 @@ bool CStringChecker::evalCall(const CallExpr *CE, CheckerContext &C) const {
 
   FnCheck evalFunction = llvm::StringSwitch<FnCheck>(Name)
     .Cases("memcpy", "__memcpy_chk", &CStringChecker::evalMemcpy)
+    .Case("mempcpy", &CStringChecker::evalMempcpy)
     .Cases("memcmp", "bcmp", &CStringChecker::evalMemcmp)
     .Cases("memmove", "__memmove_chk", &CStringChecker::evalMemmove)
     .Cases("strcpy", "__strcpy_chk", &CStringChecker::evalStrcpy)
     .Cases("strncpy", "__strncpy_chk", &CStringChecker::evalStrncpy)
     .Cases("stpcpy", "__stpcpy_chk", &CStringChecker::evalStpcpy)
+    .Cases("strcat", "__strcat_chk", &CStringChecker::evalStrcat)
+    .Cases("strncat", "__strncat_chk", &CStringChecker::evalStrncat)
     .Case("strlen", &CStringChecker::evalstrLength)
     .Case("strnlen", &CStringChecker::evalstrnLength)
+    .Case("strcmp", &CStringChecker::evalStrcmp)
+    .Case("strncmp", &CStringChecker::evalStrncmp)
+    .Case("strcasecmp", &CStringChecker::evalStrcasecmp)
     .Case("bcopy", &CStringChecker::evalBcopy)
     .Default(NULL);
 
diff --git a/lib/StaticAnalyzer/Checkers/CallAndMessageChecker.cpp b/lib/StaticAnalyzer/Checkers/CallAndMessageChecker.cpp
index 415900e..dfe0a0e 100644
--- a/lib/StaticAnalyzer/Checkers/CallAndMessageChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/CallAndMessageChecker.cpp
@@ -12,62 +12,51 @@
 //
 //===----------------------------------------------------------------------===//
 
-#include "InternalChecks.h"
+#include "ClangSACheckers.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
+#include "clang/StaticAnalyzer/Core/CheckerManager.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
+#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
 #include "clang/AST/ParentMap.h"
 #include "clang/Basic/TargetInfo.h"
-#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
-#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerVisitor.h"
 
 using namespace clang;
 using namespace ento;
 
 namespace {
 class CallAndMessageChecker
-  : public CheckerVisitor<CallAndMessageChecker> {
-  BugType *BT_call_null;
-  BugType *BT_call_undef;
-  BugType *BT_call_arg;
-  BugType *BT_msg_undef;
-  BugType *BT_msg_arg;
-  BugType *BT_msg_ret;
+  : public Checker< check::PreStmt<CallExpr>, check::PreObjCMessage > {
+  mutable llvm::OwningPtr<BugType> BT_call_null;
+  mutable llvm::OwningPtr<BugType> BT_call_undef;
+  mutable llvm::OwningPtr<BugType> BT_call_arg;
+  mutable llvm::OwningPtr<BugType> BT_msg_undef;
+  mutable llvm::OwningPtr<BugType> BT_msg_arg;
+  mutable llvm::OwningPtr<BugType> BT_msg_ret;
 public:
-  CallAndMessageChecker() :
-    BT_call_null(0), BT_call_undef(0), BT_call_arg(0),
-    BT_msg_undef(0), BT_msg_arg(0), BT_msg_ret(0) {}
-
-  static void *getTag() {
-    static int x = 0;
-    return &x;
-  }
 
-  void PreVisitCallExpr(CheckerContext &C, const CallExpr *CE);
-  void preVisitObjCMessage(CheckerContext &C, ObjCMessage msg);
-  bool evalNilReceiver(CheckerContext &C, ObjCMessage msg);
+  void checkPreStmt(const CallExpr *CE, CheckerContext &C) const;
+  void checkPreObjCMessage(ObjCMessage msg, CheckerContext &C) const;
 
 private:
-  void PreVisitProcessArgs(CheckerContext &C, CallOrObjCMessage callOrMsg,
-                           const char *BT_desc, BugType *&BT);
-  bool PreVisitProcessArg(CheckerContext &C, SVal V, SourceRange argRange,
-                          const Expr *argEx, const char *BT_desc, BugType *&BT);
+  static void PreVisitProcessArgs(CheckerContext &C,CallOrObjCMessage callOrMsg,
+                             const char *BT_desc, llvm::OwningPtr<BugType> &BT);
+  static bool PreVisitProcessArg(CheckerContext &C, SVal V,SourceRange argRange,
+          const Expr *argEx, const char *BT_desc, llvm::OwningPtr<BugType> &BT);
 
-  void EmitBadCall(BugType *BT, CheckerContext &C, const CallExpr *CE);
+  static void EmitBadCall(BugType *BT, CheckerContext &C, const CallExpr *CE);
   void emitNilReceiverBug(CheckerContext &C, const ObjCMessage &msg,
-                          ExplodedNode *N);
+                          ExplodedNode *N) const;
 
   void HandleNilReceiver(CheckerContext &C, const GRState *state,
-                         ObjCMessage msg);
+                         ObjCMessage msg) const;
 
-  void LazyInit_BT(const char *desc, BugType *&BT) {
+  static void LazyInit_BT(const char *desc, llvm::OwningPtr<BugType> &BT) {
     if (!BT)
-      BT = new BuiltinBug(desc);
+      BT.reset(new BuiltinBug(desc));
   }
 };
 } // end anonymous namespace
 
-void ento::RegisterCallAndMessageChecker(ExprEngine &Eng) {
-  Eng.registerCheck(new CallAndMessageChecker());
-}
-
 void CallAndMessageChecker::EmitBadCall(BugType *BT, CheckerContext &C,
                                         const CallExpr *CE) {
   ExplodedNode *N = C.generateSink();
@@ -83,7 +72,7 @@ void CallAndMessageChecker::EmitBadCall(BugType *BT, CheckerContext &C,
 void CallAndMessageChecker::PreVisitProcessArgs(CheckerContext &C,
                                                 CallOrObjCMessage callOrMsg,
                                                 const char *BT_desc,
-                                                BugType *&BT) {
+                                                llvm::OwningPtr<BugType> &BT) {
   for (unsigned i = 0, e = callOrMsg.getNumArgs(); i != e; ++i)
     if (PreVisitProcessArg(C, callOrMsg.getArgSVal(i),
                            callOrMsg.getArgSourceRange(i), callOrMsg.getArg(i),
@@ -95,7 +84,7 @@ bool CallAndMessageChecker::PreVisitProcessArg(CheckerContext &C,
                                                SVal V, SourceRange argRange,
                                                const Expr *argEx,
                                                const char *BT_desc,
-                                               BugType *&BT) {
+                                               llvm::OwningPtr<BugType> &BT) {
 
   if (V.isUndef()) {
     if (ExplodedNode *N = C.generateSink()) {
@@ -198,25 +187,25 @@ bool CallAndMessageChecker::PreVisitProcessArg(CheckerContext &C,
   return false;
 }
 
-void CallAndMessageChecker::PreVisitCallExpr(CheckerContext &C,
-                                             const CallExpr *CE){
+void CallAndMessageChecker::checkPreStmt(const CallExpr *CE,
+                                         CheckerContext &C) const{
 
   const Expr *Callee = CE->getCallee()->IgnoreParens();
   SVal L = C.getState()->getSVal(Callee);
 
   if (L.isUndef()) {
     if (!BT_call_undef)
-      BT_call_undef =
-        new BuiltinBug("Called function pointer is an uninitalized pointer value");
-    EmitBadCall(BT_call_undef, C, CE);
+      BT_call_undef.reset(new BuiltinBug("Called function pointer is an "
+                                         "uninitalized pointer value"));
+    EmitBadCall(BT_call_undef.get(), C, CE);
     return;
   }
 
   if (isa<loc::ConcreteInt>(L)) {
     if (!BT_call_null)
-      BT_call_null =
-        new BuiltinBug("Called function pointer is null (null dereference)");
-    EmitBadCall(BT_call_null, C, CE);
+      BT_call_null.reset(
+        new BuiltinBug("Called function pointer is null (null dereference)"));
+    EmitBadCall(BT_call_null.get(), C, CE);
   }
 
   PreVisitProcessArgs(C, CallOrObjCMessage(CE, C.getState()),
@@ -224,18 +213,19 @@ void CallAndMessageChecker::PreVisitCallExpr(CheckerContext &C,
                       BT_call_arg);
 }
 
-void CallAndMessageChecker::preVisitObjCMessage(CheckerContext &C,
-                                                ObjCMessage msg) {
+void CallAndMessageChecker::checkPreObjCMessage(ObjCMessage msg,
+                                                CheckerContext &C) const {
 
   const GRState *state = C.getState();
 
   // FIXME: Handle 'super'?
-  if (const Expr *receiver = msg.getInstanceReceiver())
-    if (state->getSVal(receiver).isUndef()) {
+  if (const Expr *receiver = msg.getInstanceReceiver()) {
+    SVal recVal = state->getSVal(receiver);
+    if (recVal.isUndef()) {
       if (ExplodedNode *N = C.generateSink()) {
         if (!BT_msg_undef)
-          BT_msg_undef =
-            new BuiltinBug("Receiver in message expression is an uninitialized value");
+          BT_msg_undef.reset(new BuiltinBug("Receiver in message expression is "
+                                            "an uninitialized value"));
         EnhancedBugReport *R =
           new EnhancedBugReport(*BT_msg_undef, BT_msg_undef->getName(), N);
         R->addRange(receiver->getSourceRange());
@@ -244,7 +234,20 @@ void CallAndMessageChecker::preVisitObjCMessage(CheckerContext &C,
         C.EmitReport(R);
       }
       return;
+    } else {
+      // Bifurcate the state into nil and non-nil ones.
+      DefinedOrUnknownSVal receiverVal = cast<DefinedOrUnknownSVal>(recVal);
+  
+      const GRState *notNilState, *nilState;
+      llvm::tie(notNilState, nilState) = state->assume(receiverVal);
+  
+      // Handle receiver must be nil.
+      if (nilState && !notNilState) {
+        HandleNilReceiver(C, state, msg);
+        return;
+      }
     }
+  }
 
   const char *bugDesc = msg.isPropertySetter() ?
                      "Argument for property setter is an uninitialized value"
@@ -253,20 +256,14 @@ void CallAndMessageChecker::preVisitObjCMessage(CheckerContext &C,
   PreVisitProcessArgs(C, CallOrObjCMessage(msg, state), bugDesc, BT_msg_arg);
 }
 
-bool CallAndMessageChecker::evalNilReceiver(CheckerContext &C,
-                                            ObjCMessage msg) {
-  HandleNilReceiver(C, C.getState(), msg);
-  return true; // Nil receiver is not handled elsewhere.
-}
-
 void CallAndMessageChecker::emitNilReceiverBug(CheckerContext &C,
                                                const ObjCMessage &msg,
-                                               ExplodedNode *N) {
+                                               ExplodedNode *N) const {
 
   if (!BT_msg_ret)
-    BT_msg_ret =
+    BT_msg_ret.reset(
       new BuiltinBug("Receiver in message expression is "
-                     "'nil' and returns a garbage value");
+                     "'nil' and returns a garbage value"));
 
   llvm::SmallString<200> buf;
   llvm::raw_svector_ostream os(buf);
@@ -292,7 +289,7 @@ static bool supportsNilWithFloatRet(const llvm::Triple &triple) {
 
 void CallAndMessageChecker::HandleNilReceiver(CheckerContext &C,
                                               const GRState *state,
-                                              ObjCMessage msg) {
+                                              ObjCMessage msg) const {
   ASTContext &Ctx = C.getASTContext();
 
   // Check the return type of the message expression.  A message to nil will
@@ -356,3 +353,7 @@ void CallAndMessageChecker::HandleNilReceiver(CheckerContext &C,
 
   C.addTransition(state);
 }
+
+void ento::registerCallAndMessageChecker(CheckerManager &mgr) {
+  mgr.registerChecker<CallAndMessageChecker>();
+}
diff --git a/lib/StaticAnalyzer/Checkers/CastSizeChecker.cpp b/lib/StaticAnalyzer/Checkers/CastSizeChecker.cpp
index 6a4506b..585a87d 100644
--- a/lib/StaticAnalyzer/Checkers/CastSizeChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/CastSizeChecker.cpp
@@ -12,7 +12,7 @@
 //
 //===----------------------------------------------------------------------===//
 #include "ClangSACheckers.h"
-#include "clang/StaticAnalyzer/Core/CheckerV2.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
@@ -22,7 +22,7 @@ using namespace clang;
 using namespace ento;
 
 namespace {
-class CastSizeChecker : public CheckerV2< check::PreStmt<CastExpr> > {
+class CastSizeChecker : public Checker< check::PreStmt<CastExpr> > {
   mutable llvm::OwningPtr<BuiltinBug> BT;
 public:
   void checkPreStmt(const CastExpr *CE, CheckerContext &C) const;
diff --git a/lib/StaticAnalyzer/Checkers/CastToStructChecker.cpp b/lib/StaticAnalyzer/Checkers/CastToStructChecker.cpp
index 04cc253..3210b0a 100644
--- a/lib/StaticAnalyzer/Checkers/CastToStructChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/CastToStructChecker.cpp
@@ -14,7 +14,7 @@
 //===----------------------------------------------------------------------===//
 
 #include "ClangSACheckers.h"
-#include "clang/StaticAnalyzer/Core/CheckerV2.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
@@ -23,7 +23,7 @@ using namespace clang;
 using namespace ento;
 
 namespace {
-class CastToStructChecker : public CheckerV2< check::PreStmt<CastExpr> > {
+class CastToStructChecker : public Checker< check::PreStmt<CastExpr> > {
   mutable llvm::OwningPtr<BuiltinBug> BT;
 
 public:
diff --git a/lib/StaticAnalyzer/Checkers/CheckObjCDealloc.cpp b/lib/StaticAnalyzer/Checkers/CheckObjCDealloc.cpp
index ad3bab6..0c693a0 100644
--- a/lib/StaticAnalyzer/Checkers/CheckObjCDealloc.cpp
+++ b/lib/StaticAnalyzer/Checkers/CheckObjCDealloc.cpp
@@ -14,7 +14,7 @@
 //===----------------------------------------------------------------------===//
 
 #include "ClangSACheckers.h"
-#include "clang/StaticAnalyzer/Core/CheckerV2.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/PathDiagnostic.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
@@ -267,7 +267,7 @@ static void checkObjCDealloc(const ObjCImplementationDecl* D,
 //===----------------------------------------------------------------------===//
 
 namespace {
-class ObjCDeallocChecker : public CheckerV2<
+class ObjCDeallocChecker : public Checker<
                                       check::ASTDecl<ObjCImplementationDecl> > {
 public:
   void checkASTDecl(const ObjCImplementationDecl *D, AnalysisManager& mgr,
diff --git a/lib/StaticAnalyzer/Checkers/CheckObjCInstMethSignature.cpp b/lib/StaticAnalyzer/Checkers/CheckObjCInstMethSignature.cpp
index 369ba0b..fec06a9 100644
--- a/lib/StaticAnalyzer/Checkers/CheckObjCInstMethSignature.cpp
+++ b/lib/StaticAnalyzer/Checkers/CheckObjCInstMethSignature.cpp
@@ -14,7 +14,7 @@
 //===----------------------------------------------------------------------===//
 
 #include "ClangSACheckers.h"
-#include "clang/StaticAnalyzer/Core/CheckerV2.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/PathDiagnostic.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
 #include "clang/AST/DeclObjC.h"
@@ -125,7 +125,7 @@ static void CheckObjCInstMethSignature(const ObjCImplementationDecl* ID,
 //===----------------------------------------------------------------------===//
 
 namespace {
-class ObjCMethSigsChecker : public CheckerV2<
+class ObjCMethSigsChecker : public Checker<
                                       check::ASTDecl<ObjCImplementationDecl> > {
 public:
   void checkASTDecl(const ObjCImplementationDecl *D, AnalysisManager& mgr,
diff --git a/lib/StaticAnalyzer/Checkers/CheckSecuritySyntaxOnly.cpp b/lib/StaticAnalyzer/Checkers/CheckSecuritySyntaxOnly.cpp
index 185520c..53810ee 100644
--- a/lib/StaticAnalyzer/Checkers/CheckSecuritySyntaxOnly.cpp
+++ b/lib/StaticAnalyzer/Checkers/CheckSecuritySyntaxOnly.cpp
@@ -12,11 +12,12 @@
 //===----------------------------------------------------------------------===//
 
 #include "ClangSACheckers.h"
-#include "clang/StaticAnalyzer/Core/CheckerV2.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
 #include "clang/Basic/TargetInfo.h"
 #include "clang/AST/StmtVisitor.h"
 #include "llvm/Support/raw_ostream.h"
+#include "llvm/ADT/StringSwitch.h"
 
 using namespace clang;
 using namespace ento;
@@ -33,21 +34,13 @@ static bool isArc4RandomAvailable(const ASTContext &Ctx) {
 namespace {
 class WalkAST : public StmtVisitor<WalkAST> {
   BugReporter &BR;
-  IdentifierInfo *II_gets;
-  IdentifierInfo *II_getpw;
-  IdentifierInfo *II_mktemp;
-  enum { num_rands = 9 };
-  IdentifierInfo *II_rand[num_rands];
-  IdentifierInfo *II_random;
   enum { num_setids = 6 };
   IdentifierInfo *II_setid[num_setids];
 
   const bool CheckRand;
 
 public:
-  WalkAST(BugReporter &br) : BR(br),
-                             II_gets(0), II_getpw(0), II_mktemp(0),
-                             II_rand(), II_random(0), II_setid(),
+  WalkAST(BugReporter &br) : BR(br), II_setid(),
                  CheckRand(isArc4RandomAvailable(BR.getContext())) {}
 
   // Statement visitor methods.
@@ -59,16 +52,22 @@ public:
   void VisitChildren(Stmt *S);
 
   // Helpers.
-  IdentifierInfo *GetIdentifier(IdentifierInfo *& II, const char *str);
+  IdentifierInfo *getIdentifier(IdentifierInfo *& II, const char *str);
+  bool checkCall_strCommon(const CallExpr *CE, const FunctionDecl *FD);
+
+  typedef void (WalkAST::*FnCheck)(const CallExpr *,
+				   const FunctionDecl *);
 
   // Checker-specific methods.
-  void CheckLoopConditionForFloat(const ForStmt *FS);
-  void CheckCall_gets(const CallExpr *CE, const FunctionDecl *FD);
-  void CheckCall_getpw(const CallExpr *CE, const FunctionDecl *FD);
-  void CheckCall_mktemp(const CallExpr *CE, const FunctionDecl *FD);
-  void CheckCall_rand(const CallExpr *CE, const FunctionDecl *FD);
-  void CheckCall_random(const CallExpr *CE, const FunctionDecl *FD);
-  void CheckUncheckedReturnValue(CallExpr *CE);
+  void checkLoopConditionForFloat(const ForStmt *FS);
+  void checkCall_gets(const CallExpr *CE, const FunctionDecl *FD);
+  void checkCall_getpw(const CallExpr *CE, const FunctionDecl *FD);
+  void checkCall_mktemp(const CallExpr *CE, const FunctionDecl *FD);
+  void checkCall_strcpy(const CallExpr *CE, const FunctionDecl *FD);
+  void checkCall_strcat(const CallExpr *CE, const FunctionDecl *FD);
+  void checkCall_rand(const CallExpr *CE, const FunctionDecl *FD);
+  void checkCall_random(const CallExpr *CE, const FunctionDecl *FD);
+  void checkUncheckedReturnValue(CallExpr *CE);
 };
 } // end anonymous namespace
 
@@ -76,7 +75,7 @@ public:
 // Helper methods.
 //===----------------------------------------------------------------------===//
 
-IdentifierInfo *WalkAST::GetIdentifier(IdentifierInfo *& II, const char *str) {
+IdentifierInfo *WalkAST::getIdentifier(IdentifierInfo *& II, const char *str) {
   if (!II)
     II = &BR.getContext().Idents.get(str);
 
@@ -94,15 +93,43 @@ void WalkAST::VisitChildren(Stmt *S) {
 }
 
 void WalkAST::VisitCallExpr(CallExpr *CE) {
-  if (const FunctionDecl *FD = CE->getDirectCallee()) {
-    CheckCall_gets(CE, FD);
-    CheckCall_getpw(CE, FD);
-    CheckCall_mktemp(CE, FD);
-    if (CheckRand) {
-      CheckCall_rand(CE, FD);
-      CheckCall_random(CE, FD);
-    }
-  }
+  // Get the callee.  
+  const FunctionDecl *FD = CE->getDirectCallee();
+
+  if (!FD)
+    return;
+
+  // Get the name of the callee. If it's a builtin, strip off the prefix.
+  IdentifierInfo *II = FD->getIdentifier();
+  if (!II)   // if no identifier, not a simple C function
+    return;
+  llvm::StringRef Name = II->getName();
+  if (Name.startswith("__builtin_"))
+    Name = Name.substr(10);
+
+  // Set the evaluation function by switching on the callee name.
+  FnCheck evalFunction = llvm::StringSwitch<FnCheck>(Name)
+    .Case("gets", &WalkAST::checkCall_gets)
+    .Case("getpw", &WalkAST::checkCall_getpw)
+    .Case("mktemp", &WalkAST::checkCall_mktemp)
+    .Cases("strcpy", "__strcpy_chk", &WalkAST::checkCall_strcpy)
+    .Cases("strcat", "__strcat_chk", &WalkAST::checkCall_strcat)
+    .Case("drand48", &WalkAST::checkCall_rand)
+    .Case("erand48", &WalkAST::checkCall_rand)
+    .Case("jrand48", &WalkAST::checkCall_rand)
+    .Case("lrand48", &WalkAST::checkCall_rand)
+    .Case("mrand48", &WalkAST::checkCall_rand)
+    .Case("nrand48", &WalkAST::checkCall_rand)
+    .Case("lcong48", &WalkAST::checkCall_rand)
+    .Case("rand", &WalkAST::checkCall_rand)
+    .Case("rand_r", &WalkAST::checkCall_rand)
+    .Case("random", &WalkAST::checkCall_random)
+    .Default(NULL);
+
+  // If the callee isn't defined, it is not of security concern.
+  // Check and evaluate the call.
+  if (evalFunction)
+    (this->*evalFunction)(CE, FD);
 
   // Recurse and check children.
   VisitChildren(CE);
@@ -112,13 +139,13 @@ void WalkAST::VisitCompoundStmt(CompoundStmt *S) {
   for (Stmt::child_iterator I = S->child_begin(), E = S->child_end(); I!=E; ++I)
     if (Stmt *child = *I) {
       if (CallExpr *CE = dyn_cast<CallExpr>(child))
-        CheckUncheckedReturnValue(CE);
+        checkUncheckedReturnValue(CE);
       Visit(child);
     }
 }
 
 void WalkAST::VisitForStmt(ForStmt *FS) {
-  CheckLoopConditionForFloat(FS);
+  checkLoopConditionForFloat(FS);
 
   // Recurse and check children.
   VisitChildren(FS);
@@ -131,7 +158,7 @@ void WalkAST::VisitForStmt(ForStmt *FS) {
 //===----------------------------------------------------------------------===//
 
 static const DeclRefExpr*
-GetIncrementedVar(const Expr *expr, const VarDecl *x, const VarDecl *y) {
+getIncrementedVar(const Expr *expr, const VarDecl *x, const VarDecl *y) {
   expr = expr->IgnoreParenCasts();
 
   if (const BinaryOperator *B = dyn_cast<BinaryOperator>(expr)) {
@@ -139,10 +166,10 @@ GetIncrementedVar(const Expr *expr, const VarDecl *x, const VarDecl *y) {
           B->getOpcode() == BO_Comma))
       return NULL;
 
-    if (const DeclRefExpr *lhs = GetIncrementedVar(B->getLHS(), x, y))
+    if (const DeclRefExpr *lhs = getIncrementedVar(B->getLHS(), x, y))
       return lhs;
 
-    if (const DeclRefExpr *rhs = GetIncrementedVar(B->getRHS(), x, y))
+    if (const DeclRefExpr *rhs = getIncrementedVar(B->getRHS(), x, y))
       return rhs;
 
     return NULL;
@@ -155,7 +182,7 @@ GetIncrementedVar(const Expr *expr, const VarDecl *x, const VarDecl *y) {
 
   if (const UnaryOperator *U = dyn_cast<UnaryOperator>(expr))
     return U->isIncrementDecrementOp()
-      ? GetIncrementedVar(U->getSubExpr(), x, y) : NULL;
+      ? getIncrementedVar(U->getSubExpr(), x, y) : NULL;
 
   return NULL;
 }
@@ -164,7 +191,7 @@ GetIncrementedVar(const Expr *expr, const VarDecl *x, const VarDecl *y) {
 ///  use a floating point variable as a loop counter.
 ///  CERT: FLP30-C, FLP30-CPP.
 ///
-void WalkAST::CheckLoopConditionForFloat(const ForStmt *FS) {
+void WalkAST::checkLoopConditionForFloat(const ForStmt *FS) {
   // Does the loop have a condition?
   const Expr *condition = FS->getCond();
 
@@ -211,7 +238,7 @@ void WalkAST::CheckLoopConditionForFloat(const ForStmt *FS) {
     return;
 
   // Does either variable appear in increment?
-  const DeclRefExpr *drInc = GetIncrementedVar(increment, vdLHS, vdRHS);
+  const DeclRefExpr *drInc = getIncrementedVar(increment, vdLHS, vdRHS);
 
   if (!drInc)
     return;
@@ -243,10 +270,7 @@ void WalkAST::CheckLoopConditionForFloat(const ForStmt *FS) {
 // CWE-242: Use of Inherently Dangerous Function
 //===----------------------------------------------------------------------===//
 
-void WalkAST::CheckCall_gets(const CallExpr *CE, const FunctionDecl *FD) {
-  if (FD->getIdentifier() != GetIdentifier(II_gets, "gets"))
-    return;
-
+void WalkAST::checkCall_gets(const CallExpr *CE, const FunctionDecl *FD) {
   const FunctionProtoType *FPT
     = dyn_cast<FunctionProtoType>(FD->getType().IgnoreParens());
   if (!FPT)
@@ -278,10 +302,7 @@ void WalkAST::CheckCall_gets(const CallExpr *CE, const FunctionDecl *FD) {
 // CWE-477: Use of Obsolete Functions
 //===----------------------------------------------------------------------===//
 
-void WalkAST::CheckCall_getpw(const CallExpr *CE, const FunctionDecl *FD) {
-  if (FD->getIdentifier() != GetIdentifier(II_getpw, "getpw"))
-    return;
-
+void WalkAST::checkCall_getpw(const CallExpr *CE, const FunctionDecl *FD) {
   const FunctionProtoType *FPT
     = dyn_cast<FunctionProtoType>(FD->getType().IgnoreParens());
   if (!FPT)
@@ -317,16 +338,13 @@ void WalkAST::CheckCall_getpw(const CallExpr *CE, const FunctionDecl *FD) {
 // CWE-377: Insecure Temporary File
 //===----------------------------------------------------------------------===//
 
-void WalkAST::CheckCall_mktemp(const CallExpr *CE, const FunctionDecl *FD) {
-  if (FD->getIdentifier() != GetIdentifier(II_mktemp, "mktemp"))
-    return;
-
+void WalkAST::checkCall_mktemp(const CallExpr *CE, const FunctionDecl *FD) {
   const FunctionProtoType *FPT
     = dyn_cast<FunctionProtoType>(FD->getType().IgnoreParens());
   if(!FPT)
     return;
 
-  // Verify that the funcion takes a single argument.
+  // Verify that the function takes a single argument.
   if (FPT->getNumArgs() != 1)
     return;
 
@@ -349,32 +367,86 @@ void WalkAST::CheckCall_mktemp(const CallExpr *CE, const FunctionDecl *FD) {
 }
 
 //===----------------------------------------------------------------------===//
-// Check: Linear congruent random number generators should not be used
-// Originally: <rdar://problem/63371000>
-// CWE-338: Use of cryptographically weak prng
+// Check: Any use of 'strcpy' is insecure.
+//
+// CWE-119: Improper Restriction of Operations within 
+// the Bounds of a Memory Buffer 
 //===----------------------------------------------------------------------===//
+void WalkAST::checkCall_strcpy(const CallExpr *CE, const FunctionDecl *FD) {
+  if (!checkCall_strCommon(CE, FD))
+    return;
 
-void WalkAST::CheckCall_rand(const CallExpr *CE, const FunctionDecl *FD) {
-  if (II_rand[0] == NULL) {
-    // This check applies to these functions
-    static const char * const identifiers[num_rands] = {
-      "drand48", "erand48", "jrand48", "lrand48", "mrand48", "nrand48",
-      "lcong48",
-      "rand", "rand_r"
-    };
+  // Issue a warning.
+  SourceRange R = CE->getCallee()->getSourceRange();
+  BR.EmitBasicReport("Potential insecure memory buffer bounds restriction in "
+                     "call 'strcpy'",
+                     "Security",
+                     "Call to function 'strcpy' is insecure as it does not "
+		     "provide bounding of the memory buffer. Replace "
+		     "unbounded copy functions with analogous functions that "
+		     "support length arguments such as 'strncpy'. CWE-119.",
+                     CE->getLocStart(), &R, 1);
+}
+
+//===----------------------------------------------------------------------===//
+// Check: Any use of 'strcat' is insecure.
+//
+// CWE-119: Improper Restriction of Operations within 
+// the Bounds of a Memory Buffer 
+//===----------------------------------------------------------------------===//
+void WalkAST::checkCall_strcat(const CallExpr *CE, const FunctionDecl *FD) {
+  if (!checkCall_strCommon(CE, FD))
+    return;
+
+  // Issue a warning.
+  SourceRange R = CE->getCallee()->getSourceRange();
+  BR.EmitBasicReport("Potential insecure memory buffer bounds restriction in "
+		     "call 'strcat'",
+		     "Security",
+		     "Call to function 'strcat' is insecure as it does not "
+		     "provide bounding of the memory buffer. Replace "
+		     "unbounded copy functions with analogous functions that "
+		     "support length arguments such as 'strncat'. CWE-119.",
+                     CE->getLocStart(), &R, 1);
+}
 
-    for (size_t i = 0; i < num_rands; i++)
-      II_rand[i] = &BR.getContext().Idents.get(identifiers[i]);
+//===----------------------------------------------------------------------===//
+// Common check for str* functions with no bounds parameters.
+//===----------------------------------------------------------------------===//
+bool WalkAST::checkCall_strCommon(const CallExpr *CE, const FunctionDecl *FD) {
+  const FunctionProtoType *FPT
+    = dyn_cast<FunctionProtoType>(FD->getType().IgnoreParens());
+  if (!FPT)
+    return false;
+
+  // Verify the function takes two arguments, three in the _chk version.
+  int numArgs = FPT->getNumArgs();
+  if (numArgs != 2 && numArgs != 3)
+    return false;
+
+  // Verify the type for both arguments.
+  for (int i = 0; i < 2; i++) {
+    // Verify that the arguments are pointers.
+    const PointerType *PT = dyn_cast<PointerType>(FPT->getArgType(i));
+    if (!PT)
+      return false;
+
+    // Verify that the argument is a 'char*'.
+    if (PT->getPointeeType().getUnqualifiedType() != BR.getContext().CharTy)
+      return false;
   }
 
-  const IdentifierInfo *id = FD->getIdentifier();
-  size_t identifierid;
+  return true;
+}
 
-  for (identifierid = 0; identifierid < num_rands; identifierid++)
-    if (id == II_rand[identifierid])
-      break;
+//===----------------------------------------------------------------------===//
+// Check: Linear congruent random number generators should not be used
+// Originally: <rdar://problem/63371000>
+// CWE-338: Use of cryptographically weak prng
+//===----------------------------------------------------------------------===//
 
-  if (identifierid >= num_rands)
+void WalkAST::checkCall_rand(const CallExpr *CE, const FunctionDecl *FD) {
+  if (!CheckRand)
     return;
 
   const FunctionProtoType *FTP
@@ -415,8 +487,8 @@ void WalkAST::CheckCall_rand(const CallExpr *CE, const FunctionDecl *FD) {
 // Originally: <rdar://problem/63371000>
 //===----------------------------------------------------------------------===//
 
-void WalkAST::CheckCall_random(const CallExpr *CE, const FunctionDecl *FD) {
-  if (FD->getIdentifier() != GetIdentifier(II_random, "random"))
+void WalkAST::checkCall_random(const CallExpr *CE, const FunctionDecl *FD) {
+  if (!CheckRand)
     return;
 
   const FunctionProtoType *FTP
@@ -442,7 +514,7 @@ void WalkAST::CheckCall_random(const CallExpr *CE, const FunctionDecl *FD) {
 // Originally: <rdar://problem/6337132>
 //===----------------------------------------------------------------------===//
 
-void WalkAST::CheckUncheckedReturnValue(CallExpr *CE) {
+void WalkAST::checkUncheckedReturnValue(CallExpr *CE) {
   const FunctionDecl *FD = CE->getDirectCallee();
   if (!FD)
     return;
@@ -502,7 +574,7 @@ void WalkAST::CheckUncheckedReturnValue(CallExpr *CE) {
 //===----------------------------------------------------------------------===//
 
 namespace {
-class SecuritySyntaxChecker : public CheckerV2<check::ASTCodeBody> {
+class SecuritySyntaxChecker : public Checker<check::ASTCodeBody> {
 public:
   void checkASTCodeBody(const Decl *D, AnalysisManager& mgr,
                         BugReporter &BR) const {
diff --git a/lib/StaticAnalyzer/Checkers/CheckSizeofPointer.cpp b/lib/StaticAnalyzer/Checkers/CheckSizeofPointer.cpp
index d46ac81..abf53fd 100644
--- a/lib/StaticAnalyzer/Checkers/CheckSizeofPointer.cpp
+++ b/lib/StaticAnalyzer/Checkers/CheckSizeofPointer.cpp
@@ -13,7 +13,7 @@
 //===----------------------------------------------------------------------===//
 
 #include "ClangSACheckers.h"
-#include "clang/StaticAnalyzer/Core/CheckerV2.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
 #include "clang/AST/StmtVisitor.h"
 
@@ -26,7 +26,7 @@ class WalkAST : public StmtVisitor<WalkAST> {
 
 public:
   WalkAST(BugReporter &br) : BR(br) {}
-  void VisitSizeOfAlignOfExpr(SizeOfAlignOfExpr *E);
+  void VisitUnaryExprOrTypeTraitExpr(UnaryExprOrTypeTraitExpr *E);
   void VisitStmt(Stmt *S) { VisitChildren(S); }
   void VisitChildren(Stmt *S);
 };
@@ -39,8 +39,8 @@ void WalkAST::VisitChildren(Stmt *S) {
 }
 
 // CWE-467: Use of sizeof() on a Pointer Type
-void WalkAST::VisitSizeOfAlignOfExpr(SizeOfAlignOfExpr *E) {
-  if (!E->isSizeOf())
+void WalkAST::VisitUnaryExprOrTypeTraitExpr(UnaryExprOrTypeTraitExpr *E) {
+  if (E->getKind() != UETT_SizeOf)
     return;
 
   // If an explicit type is used in the code, usually the coder knows what he is
@@ -72,7 +72,7 @@ void WalkAST::VisitSizeOfAlignOfExpr(SizeOfAlignOfExpr *E) {
 //===----------------------------------------------------------------------===//
 
 namespace {
-class SizeofPointerChecker : public CheckerV2<check::ASTCodeBody> {
+class SizeofPointerChecker : public Checker<check::ASTCodeBody> {
 public:
   void checkASTCodeBody(const Decl *D, AnalysisManager& mgr,
                         BugReporter &BR) const {
diff --git a/lib/StaticAnalyzer/Checkers/Checkers.td b/lib/StaticAnalyzer/Checkers/Checkers.td
index 894b961..1a71fc4 100644
--- a/lib/StaticAnalyzer/Checkers/Checkers.td
+++ b/lib/StaticAnalyzer/Checkers/Checkers.td
@@ -10,204 +10,366 @@
 include "clang/StaticAnalyzer/Checkers/CheckerBase.td"
 
 //===----------------------------------------------------------------------===//
+// Groups.
+//===----------------------------------------------------------------------===//
+
+def AllExperimental : CheckerGroup<"all-experimental">;
+
+//===----------------------------------------------------------------------===//
 // Packages.
 //===----------------------------------------------------------------------===//
 
 def Core : Package<"core">;
-def Cocoa : Package<"cocoa">;
-def Unix : Package<"unix">;
-def MacOSX : Package<"macosx">;
+def CoreBuiltin : Package<"builtin">, InPackage<Core>;
+def CoreUninitialized  : Package<"uninitialized">, InPackage<Core>;
+def CoreExperimental : Package<"experimental">, InPackage<Core>,
+  InGroup<AllExperimental>, Hidden;
 
-def CoreExperimental : Package<"experimental">,
-  InPackage<Core>, Hidden;
+def Cplusplus : Package<"cplusplus">;
+def CplusplusExperimental : Package<"experimental">, InPackage<Cplusplus>,
+  InGroup<AllExperimental>, Hidden;
 
-def CocoaExperimental : Package<"experimental">,
-  InPackage<Cocoa>, Hidden;
+def DeadCode : Package<"deadcode">;
+def DeadCodeExperimental : Package<"experimental">, InPackage<DeadCode>,
+  InGroup<AllExperimental>, Hidden;
 
-def UnixExperimental : Package<"experimental">,
-  InPackage<Unix>, Hidden;
+def Security : Package <"security">;
+def SecurityExperimental : Package<"experimental">, InPackage<Security>,
+  InGroup<AllExperimental>, Hidden;
+
+def Unix : Package<"unix">;
+def UnixExperimental : Package<"experimental">, InPackage<Unix>,
+  InGroup<AllExperimental>, Hidden;
+
+def OSX : Package<"osx">;
+def Cocoa : Package<"cocoa">, InPackage<OSX>;
+def CocoaExperimental : Package<"experimental">, InPackage<Cocoa>,
+  InGroup<AllExperimental>, Hidden;
+def CoreFoundation : Package<"coreFoundation">, InPackage<OSX>;
 
 def LLVM : Package<"llvm">;
 def Debug : Package<"debug">;
 
 //===----------------------------------------------------------------------===//
-// Groups.
+// Core Checkers.
 //===----------------------------------------------------------------------===//
 
-def AllExperimental : CheckerGroup<"all-experimental">,
-  Hidden;
+let ParentPackage = Core in {
 
-//===----------------------------------------------------------------------===//
-// Checkers.
-//===----------------------------------------------------------------------===//
+def DereferenceChecker : Checker<"NullDereference">,
+  HelpText<"Check for dereferences of null pointers">,
+  DescFile<"DereferenceChecker.cpp">;
 
-let ParentPackage = Cocoa in {
+def CallAndMessageChecker : Checker<"CallAndMessage">,
+  HelpText<"Check for logical errors for function calls and Objective-C message expressions (e.g., uninitialized arguments, null function pointers)">,
+  DescFile<"CallAndMessageChecker.cpp">;
 
-def ObjCSelfInitChecker : Checker<"SelfInit">,
-  HelpText<"Check that 'self' is propely initialized inside an initializer method">,
-  DescFile<"ObjCSelfInitChecker.cpp">;
+def AdjustedReturnValueChecker : Checker<"AdjustedReturnValue">,
+  HelpText<"Check to see if the return value of a function call is different than the caller expects (e.g., from calls through function pointers)">,
+  DescFile<"AdjustedReturnValueChecker.cpp">;
 
-def ObjCAtSyncChecker : Checker<"AtSync">,
-  HelpText<"Check for null pointers used as mutexes for @synchronized">,
-  DescFile<"ObjCAtSyncChecker.cpp">;
+def AttrNonNullChecker : Checker<"AttributeNonNull">,
+  HelpText<"Check for null pointers passed as arguments to a function whose arguments are marked with the 'nonnull' attribute">,
+  DescFile<"AttrNonNullChecker.cpp">;
 
-def NilArgChecker : Checker<"NilArg">,
-  HelpText<"Check for prohibited nil arguments to ObjC method calls">,
-  DescFile<"BasicObjCFoundationChecks.cpp">;
+def VLASizeChecker : Checker<"VLASize">,
+  HelpText<"Check for declarations of VLA of undefined or zero size">,
+  DescFile<"VLASizeChecker.cpp">;
 
-def ClassReleaseChecker : Checker<"ClassRelease">,
-  HelpText<"Check for sending 'retain', 'release', or 'autorelease' directly to a Class">,
-  DescFile<"BasicObjCFoundationChecks.cpp">;
+def DivZeroChecker : Checker<"DivideZero">,
+  HelpText<"Check for division by zero">,
+  DescFile<"DivZeroChecker.cpp">;
 
-def NSAutoreleasePoolChecker : Checker<"NSAutoreleasePool">,
-  HelpText<"Warn for subpar uses of NSAutoreleasePool">,
-  DescFile<"NSAutoreleasePoolChecker.cpp">;
+def UndefResultChecker : Checker<"UndefinedBinaryOperatorResult">,
+  HelpText<"Check for undefined results of binary operators">,
+  DescFile<"UndefResultChecker.cpp">;
 
-def ObjCMethSigsChecker : Checker<"MethodSigs">,
-  HelpText<"Warn about Objective-C method signatures with type incompatibilities">,
-  DescFile<"CheckObjCInstMethSignature.cpp">;
+def StackAddrEscapeChecker : Checker<"StackAddressEscape">,
+  HelpText<"Check that addresses to stack memory do not escape the function">,
+  DescFile<"StackAddrEscapeChecker.cpp">;
 
-def ObjCUnusedIvarsChecker : Checker<"UnusedIvars">,
-  HelpText<"Warn about private ivars that are never used">,
-  DescFile<"ObjCUnusedIVarsChecker.cpp">;
+} // end "core"
 
-} // end "cocoa"
+let ParentPackage = CoreExperimental in {
 
-def StackAddrEscapeChecker : Checker<"StackAddrEscape">,
-  InPackage<Core>,
-  HelpText<"Check that addresses to stack memory do not escape the function">,
-  DescFile<"StackAddrEscapeChecker.cpp">;
+def CastSizeChecker : Checker<"CastSize">,
+  HelpText<"Check when casting a malloc'ed type T, whether the size is a multiple of the size of T">,
+  DescFile<"CastSizeChecker.cpp">;
 
-def DeadStoresChecker : Checker<"DeadStores">,
-  InPackage<Core>,
-  HelpText<"Check for values stored to a variables that are never read afterwards">,
-  DescFile<"DeadStoresChecker.cpp">;
+def CastToStructChecker : Checker<"CastToStruct">,
+  HelpText<"Check for cast from non-struct pointer to struct pointer">,
+  DescFile<"CastToStructChecker.cpp">;
 
-def UnixAPIChecker : Checker<"API">,
-  InPackage<Unix>,
-  HelpText<"Check calls to various UNIX/Posix functions">,
-  DescFile<"UnixAPIChecker.cpp">;
+def FixedAddressChecker : Checker<"FixedAddr">,
+  HelpText<"Check for assignment of a fixed address to a pointer">,
+  DescFile<"FixedAddressChecker.cpp">;
 
-def MacOSXAPIChecker : Checker<"API">,
-  InPackage<MacOSX>,
-  HelpText<"Check for proper uses of various Mac OS X APIs">,
-  DescFile<"MacOSXAPIChecker.cpp">;
+def PointerArithChecker : Checker<"PointerArithm">,
+  HelpText<"Check for pointer arithmetic on locations other than array elements">,
+  DescFile<"PointerArithChecker">;
 
-def CFNumberCreateChecker : Checker<"CFNumber">,
-  InPackage<MacOSX>,
-  HelpText<"Check for proper uses of CFNumberCreate">,
-  DescFile<"BasicObjCFoundationChecks.cpp">;
+def PointerSubChecker : Checker<"PointerSub">,
+  HelpText<"Check for pointer subtractions on two pointers pointing to different memory chunks">,
+  DescFile<"PointerSubChecker">;
 
-def CFRetainReleaseChecker : Checker<"CFRetainRelease">,
-  InPackage<MacOSX>,
-  HelpText<"Check for null arguments to CFRetain/CFRelease">,
-  DescFile<"BasicObjCFoundationChecks.cpp">;
+def SizeofPointerChecker : Checker<"SizeofPtr">,
+  HelpText<"Warn about unintended use of sizeof() on pointer expressions">,
+  DescFile<"CheckSizeofPointer.cpp">;
 
-def LLVMConventionsChecker : Checker<"Conventions">,
-  InPackage<LLVM>,
-  HelpText<"Check code for LLVM codebase conventions">,
-  DescFile<"LLVMConventionsChecker.cpp">;
+} // end "core.experimental"
 
-def LiveVariablesDumper : Checker<"DumpLiveVars">,
-  InPackage<Debug>,
-  HelpText<"Print results of live variable analysis">,
-  DescFile<"DebugCheckers.cpp">;
+//===----------------------------------------------------------------------===//
+// Evaluate "builtin" functions.
+//===----------------------------------------------------------------------===//
 
-def CFGViewer : Checker<"ViewCFG">,
-  InPackage<Debug>,
-  HelpText<"View Control-Flow Graphs using GraphViz">,
-  DescFile<"DebugCheckers.cpp">;
+let ParentPackage = CoreBuiltin in {
 
-def CFGDumper : Checker<"DumpCFG">,
-  InPackage<Debug>,
-  HelpText<"Display Control-Flow Graphs">,
-  DescFile<"DebugCheckers.cpp">;
+def NoReturnFunctionChecker : Checker<"NoReturnFunctions">,
+  HelpText<"Evaluate \"panic\" functions that are known to not return to the caller">,
+  DescFile<"NoReturnFunctionChecker.cpp">;
+
+def BuiltinFunctionChecker : Checker<"BuiltinFunctions">,
+  HelpText<"Evaluate compiler builtin functions (e.g., alloca())">,
+  DescFile<"BuiltinFunctionChecker.cpp">;
+
+} // end "core.builtin"
 
 //===----------------------------------------------------------------------===//
-// Hidden experimental checkers.
+// Uninitialized values checkers.
 //===----------------------------------------------------------------------===//
 
-let Group = AllExperimental in {
+let ParentPackage = CoreUninitialized in {
+
+def UndefinedArraySubscriptChecker : Checker<"ArraySubscript">,
+  HelpText<"Check for uninitialized values used as array subscripts">,
+  DescFile<"UndefinedArraySubscriptChecker.cpp">;
+
+def UndefinedAssignmentChecker : Checker<"Assign">,
+  HelpText<"Check for assigning uninitialized values">,
+  DescFile<"UndefinedAssignmentChecker.cpp">;
+
+def UndefBranchChecker : Checker<"Branch">,
+  HelpText<"Check for uninitialized values used as branch conditions">,
+  DescFile<"UndefBranchChecker.cpp">;
+
+def UndefCapturedBlockVarChecker : Checker<"CapturedBlockVariable">,
+  HelpText<"Check for blocks that capture uninitialized values">,
+  DescFile<"UndefCapturedBlockVarChecker.cpp">;
+  
+def ReturnUndefChecker : Checker<"UndefReturn">,
+  HelpText<"Check for uninitialized values being returned to the caller">,
+  DescFile<"ReturnUndefChecker.cpp">;
+
+} // end "core.uninitialized"
+
+//===----------------------------------------------------------------------===//
+// C++ checkers.
+//===----------------------------------------------------------------------===//
+
+let ParentPackage = CplusplusExperimental in {
 
 def CStringChecker : Checker<"CString">,
-  InPackage<CoreExperimental>,
   HelpText<"Check calls to functions in <string.h>">,
   DescFile<"CStringChecker.cpp">;
 
-def UnreachableCodeChecker : Checker<"UnreachableCode">,
-  InPackage<CoreExperimental>,
-  HelpText<"Check unreachable code">,
-  DescFile<"UnreachableCodeChecker.cpp">,
-  Hidden; // Must be specified explicitly in order to run.
+def IteratorsChecker : Checker<"Iterators">,
+  HelpText<"Check improper uses of STL vector iterators">,
+  DescFile<"IteratorsChecker.cpp">;
+
+} // end: "cplusplus.experimental"
+
+//===----------------------------------------------------------------------===//
+// Deadcode checkers.
+//===----------------------------------------------------------------------===//
 
-def IdempotentOperationChecker : Checker<"IdempotentOps">,
-  InPackage<CoreExperimental>,
+let ParentPackage = DeadCode in {
+
+def DeadStoresChecker : Checker<"DeadStores">,
+  HelpText<"Check for values stored to variables that are never read afterwards">,
+  DescFile<"DeadStoresChecker.cpp">;
+
+def IdempotentOperationChecker : Checker<"IdempotentOperations">,
   HelpText<"Warn about idempotent operations">,
   DescFile<"IdempotentOperationChecker.cpp">;
 
-def CastToStructChecker : Checker<"CastToStruct">,
-  InPackage<CoreExperimental>,
-  HelpText<"Check for cast from non-struct pointer to struct pointer">,
-  DescFile<"CastToStructChecker.cpp">;
+} // end DeadCode
 
-def FixedAddressChecker : Checker<"FixedAddr">,
-  InPackage<CoreExperimental>,
-  HelpText<"Check for assignment of a fixed address to a pointer">,
-  DescFile<"FixedAddressChecker.cpp">;
+let ParentPackage = DeadCodeExperimental in {
 
-def PointerArithChecker : Checker<"PointerArithm">,
-  InPackage<CoreExperimental>,
-  HelpText<"Check for pointer arithmetic on locations other than array elements">,
-  DescFile<"PointerArithChecker">;
+def UnreachableCodeChecker : Checker<"UnreachableCode">,
+  HelpText<"Check unreachable code">,
+  DescFile<"UnreachableCodeChecker.cpp">;
 
-def PointerSubChecker : Checker<"PointerSub">,
-  InPackage<CoreExperimental>,
-  HelpText<"Check for pointer subtractions on two pointers pointing to different memory chunks">,
-  DescFile<"PointerSubChecker">;
+} // end "deadcode.experimental"
 
-def SizeofPointerChecker : Checker<"SizeofPtr">,
-  InPackage<CoreExperimental>,
-  HelpText<"Warn about unintended use of sizeof() on pointer expressions">,
-  DescFile<"CheckSizeofPointer.cpp">;
+//===----------------------------------------------------------------------===//
+// Security checkers.
+//===----------------------------------------------------------------------===//
+
+let ParentPackage = SecurityExperimental in {
 
 def SecuritySyntaxChecker : Checker<"SecuritySyntactic">,
-  InPackage<CoreExperimental>,
-  HelpText<"Perform quick security checks that require no data flow">,
+  HelpText<"Perform quick security API checks that require no data flow">,
   DescFile<"CheckSecuritySyntaxOnly.cpp">;
 
+def ArrayBoundChecker : Checker<"ArrayBound">,
+  HelpText<"Warn about buffer overflows (older checker)">,
+  DescFile<"ArrayBoundChecker.cpp">;  
+
+def ArrayBoundCheckerV2 : Checker<"ArrayBoundV2">,
+  HelpText<"Warn about buffer overflows (newer checker)">,
+  DescFile<"ArrayBoundCheckerV2.cpp">;
+
 def ReturnPointerRangeChecker : Checker<"ReturnPtrRange">,
-  InPackage<CoreExperimental>,
   HelpText<"Check for an out-of-bound pointer being returned to callers">,
   DescFile<"ReturnPointerRangeChecker.cpp">;
 
-def ArrayBoundChecker : Checker<"ArrayBound">,
-  InPackage<CoreExperimental>,
-  HelpText<"Check for an out-of-bound pointer being returned to callers">,
-  DescFile<"ArrayBoundChecker.cpp">;
+} // end "security.experimental"
 
-def CastSizeChecker : Checker<"CastSize">,
-  InPackage<CoreExperimental>,
-  HelpText<"Check when casting a malloc'ed type T, whether the size is a multiple of the size of T">,
-  DescFile<"CastSizeChecker.cpp">;
+//===----------------------------------------------------------------------===//
+// Unix API checkers.
+//===----------------------------------------------------------------------===//
 
-def ObjCDeallocChecker : Checker<"Dealloc">,
-  InPackage<CocoaExperimental>,
-  HelpText<"Warn about Objective-C classes that lack a correct implementation of -dealloc">,
-  DescFile<"CheckObjCDealloc.cpp">;
+let ParentPackage = Unix in {
+
+def UnixAPIChecker : Checker<"API">,
+  HelpText<"Check calls to various UNIX/Posix functions">,
+  DescFile<"UnixAPIChecker.cpp">;
+  
+} // end "unix"
+
+let ParentPackage = UnixExperimental in {
 
 def ChrootChecker : Checker<"Chroot">,
-  InPackage<UnixExperimental>,
   HelpText<"Check improper use of chroot">,
   DescFile<"ChrootChecker.cpp">;
 
+def MallocChecker : Checker<"Malloc">,
+  HelpText<"Check for potential memory leaks, double free, and use-after-free problems">,
+  DescFile<"MallocChecker.cpp">;
+
 def PthreadLockChecker : Checker<"PthreadLock">,
-  InPackage<UnixExperimental>,
   HelpText<"Simple lock -> unlock checker">,
   DescFile<"PthreadLockChecker.cpp">;
 
 def StreamChecker : Checker<"Stream">,
-  InPackage<UnixExperimental>,
   HelpText<"Check stream handling functions">,
   DescFile<"StreamChecker.cpp">;
 
+} // end "unix.experimental"
+
+//===----------------------------------------------------------------------===//
+// Mac OS X, Cocoa, and Core Foundation checkers.
+//===----------------------------------------------------------------------===//
+
+let ParentPackage = OSX in {
+
+def MacOSXAPIChecker : Checker<"API">,
+  InPackage<OSX>,
+  HelpText<"Check for proper uses of various Mac OS X APIs">,
+  DescFile<"MacOSXAPIChecker.cpp">;
+
+def OSAtomicChecker : Checker<"AtomicCAS">,
+  InPackage<OSX>,
+  HelpText<"Evaluate calls to OSAtomic functions">,
+  DescFile<"OSAtomicChecker.cpp">;
+
+} // end "macosx"
+
+let ParentPackage = Cocoa in {
+
+def ObjCAtSyncChecker : Checker<"AtSync">,
+  HelpText<"Check for null pointers used as mutexes for @synchronized">,
+  DescFile<"ObjCAtSyncChecker.cpp">;
+
+def NilArgChecker : Checker<"NilArg">,
+  HelpText<"Check for prohibited nil arguments to ObjC method calls">,
+  DescFile<"BasicObjCFoundationChecks.cpp">;
+
+def ClassReleaseChecker : Checker<"ClassRelease">,
+  HelpText<"Check for sending 'retain', 'release', or 'autorelease' directly to a Class">,
+  DescFile<"BasicObjCFoundationChecks.cpp">;
+
+def VariadicMethodTypeChecker : Checker<"VariadicMethodTypes">,
+  HelpText<"Check for passing non-Objective-C types to variadic methods that expect"
+           "only Objective-C types">,
+  DescFile<"BasicObjCFoundationChecks.cpp">;
+
+def NSAutoreleasePoolChecker : Checker<"NSAutoreleasePool">,
+  HelpText<"Warn for suboptimal uses of NSAutoreleasePool in Objective-C GC mode">,
+  DescFile<"NSAutoreleasePoolChecker.cpp">;
+
+def ObjCMethSigsChecker : Checker<"IncompatibleMethodTypes">,
+  HelpText<"Warn about Objective-C method signatures with type incompatibilities">,
+  DescFile<"CheckObjCInstMethSignature.cpp">;
+
+def ObjCUnusedIvarsChecker : Checker<"UnusedIvars">,
+  HelpText<"Warn about private ivars that are never used">,
+  DescFile<"ObjCUnusedIVarsChecker.cpp">;
+ 
+def NSErrorChecker : Checker<"NSError">,
+  HelpText<"Check usage of NSError** parameters">,
+  DescFile<"NSErrorChecker.cpp">;
+
+} // end "cocoa"
+
+let ParentPackage = CocoaExperimental in {
+
+def ObjCSelfInitChecker : Checker<"SelfInit">,
+  HelpText<"Check that 'self' is properly initialized inside an initializer method">,
+  DescFile<"ObjCSelfInitChecker.cpp">;
+
+def ObjCDeallocChecker : Checker<"Dealloc">,
+  HelpText<"Warn about Objective-C classes that lack a correct implementation of -dealloc">,
+  DescFile<"CheckObjCDealloc.cpp">;
+
+} // end "cocoa.experimental"
+
+let ParentPackage = CoreFoundation in {
+
+def CFNumberCreateChecker : Checker<"CFNumber">,
+  HelpText<"Check for proper uses of CFNumberCreate">,
+  DescFile<"BasicObjCFoundationChecks.cpp">;
+
+def CFRetainReleaseChecker : Checker<"CFRetainRelease">,
+  HelpText<"Check for null arguments to CFRetain/CFRelease">,
+  DescFile<"BasicObjCFoundationChecks.cpp">;
+
+def CFErrorChecker : Checker<"CFError">,
+  HelpText<"Check usage of CFErrorRef* parameters">,
+  DescFile<"NSErrorChecker.cpp">;
 }
+
+//===----------------------------------------------------------------------===//
+// Checkers for LLVM development.
+//===----------------------------------------------------------------------===//
+
+def LLVMConventionsChecker : Checker<"Conventions">,
+  InPackage<LLVM>,
+  HelpText<"Check code for LLVM codebase conventions">,
+  DescFile<"LLVMConventionsChecker.cpp">;
+
+//===----------------------------------------------------------------------===//
+// Debugging checkers (for analyzer development).
+//===----------------------------------------------------------------------===//
+
+let ParentPackage = Debug in {
+
+def LiveVariablesDumper : Checker<"DumpLiveVars">,
+  HelpText<"Print results of live variable analysis">,
+  DescFile<"DebugCheckers.cpp">;
+
+def CFGViewer : Checker<"ViewCFG">,
+  HelpText<"View Control-Flow Graphs using GraphViz">,
+  DescFile<"DebugCheckers.cpp">;
+
+def CFGDumper : Checker<"DumpCFG">,
+  HelpText<"Display Control-Flow Graphs">,
+  DescFile<"DebugCheckers.cpp">;
+
+def AnalyzerStatsChecker : Checker<"Stats">,
+  HelpText<"Emit warnings with analyzer statistics">,
+  DescFile<"AnalyzerStatsChecker.cpp">;
+
+} // end "debug"
+
diff --git a/lib/StaticAnalyzer/Checkers/ChrootChecker.cpp b/lib/StaticAnalyzer/Checkers/ChrootChecker.cpp
index b6eef6d..50b57d1 100644
--- a/lib/StaticAnalyzer/Checkers/ChrootChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/ChrootChecker.cpp
@@ -12,7 +12,7 @@
 //===----------------------------------------------------------------------===//
 
 #include "ClangSACheckers.h"
-#include "clang/StaticAnalyzer/Core/CheckerV2.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
@@ -38,7 +38,7 @@ bool isRootChanged(intptr_t k) { return k == ROOT_CHANGED; }
 //         ROOT_CHANGED<--chdir(..)--      JAIL_ENTERED<--chdir(..)--
 //                                  |                               |
 //                      bug<--foo()--          JAIL_ENTERED<--foo()--
-class ChrootChecker : public CheckerV2<eval::Call, check::PreStmt<CallExpr> > {
+class ChrootChecker : public Checker<eval::Call, check::PreStmt<CallExpr> > {
   mutable IdentifierInfo *II_chroot, *II_chdir;
   // This bug refers to possibly break out of a chroot() jail.
   mutable llvm::OwningPtr<BuiltinBug> BT_BreakJail;
diff --git a/lib/StaticAnalyzer/Checkers/ClangSACheckerProvider.cpp b/lib/StaticAnalyzer/Checkers/ClangSACheckerProvider.cpp
index 5c0c950..291f8e0 100644
--- a/lib/StaticAnalyzer/Checkers/ClangSACheckerProvider.cpp
+++ b/lib/StaticAnalyzer/Checkers/ClangSACheckerProvider.cpp
@@ -45,17 +45,54 @@ struct StaticCheckerInfoRec {
   const char *FullName;
   void (*RegFunc)(CheckerManager &mgr);
   const char *HelpText;
+  int GroupIndex;
   bool Hidden;
 };
 
+struct StaticPackageInfoRec {
+  const char *FullName;
+  int GroupIndex;
+  bool Hidden;
+};
+
+struct StaticGroupInfoRec {
+  const char *FullName;
+};
+
 } // end anonymous namespace.
 
+static const StaticPackageInfoRec StaticPackageInfo[] = {
+#define GET_PACKAGES
+#define PACKAGE(FULLNAME, GROUPINDEX, HIDDEN)    \
+  { FULLNAME, GROUPINDEX, HIDDEN },
+#include "Checkers.inc"
+  { 0, -1, 0 }
+#undef PACKAGE
+#undef GET_PACKAGES
+};
+
+static const unsigned NumPackages =   sizeof(StaticPackageInfo)
+                                    / sizeof(StaticPackageInfoRec) - 1;
+
+static const StaticGroupInfoRec StaticGroupInfo[] = {
+#define GET_GROUPS
+#define GROUP(FULLNAME)    \
+  { FULLNAME },
+#include "Checkers.inc"
+  { 0 }
+#undef GROUP
+#undef GET_GROUPS
+};
+
+static const unsigned NumGroups =   sizeof(StaticGroupInfo)
+                                    / sizeof(StaticGroupInfoRec) - 1;
+
 static const StaticCheckerInfoRec StaticCheckerInfo[] = {
 #define GET_CHECKERS
-#define CHECKER(FULLNAME,CLASS,DESCFILE,HELPTEXT,HIDDEN)    \
-  { FULLNAME, register##CLASS, HELPTEXT, HIDDEN },
+#define CHECKER(FULLNAME,CLASS,DESCFILE,HELPTEXT,GROUPINDEX,HIDDEN)    \
+  { FULLNAME, register##CLASS, HELPTEXT, GROUPINDEX, HIDDEN },
 #include "Checkers.inc"
-  { 0, 0, 0, 0}
+  { 0, 0, 0, -1, 0}
 #undef CHECKER
 #undef GET_CHECKERS
 };
@@ -101,8 +138,9 @@ static void collectCheckers(const CheckNameOption *checkName,
 
   if (const short *member = checkName->Members) {
     if (enable) {
-      if (collectHidden || !StaticCheckerInfo[*member].Hidden)
-        checkers.insert(&StaticCheckerInfo[*member]);
+      for (; *member != -1; ++member)
+        if (collectHidden || !StaticCheckerInfo[*member].Hidden)
+          checkers.insert(&StaticCheckerInfo[*member]);
     } else {
       for (; *member != -1; ++member)
         checkers.erase(&StaticCheckerInfo[*member]);
@@ -144,6 +182,48 @@ void ClangSACheckerProvider::registerCheckers(CheckerManager &checkerMgr,
   }
 }
 
+//===----------------------------------------------------------------------===//
+// Printing Help.
+//===----------------------------------------------------------------------===//
+
+static void printPackageOption(llvm::raw_ostream &OS) {
+  // Find the maximum option length.
+  unsigned OptionFieldWidth = 0;
+  for (unsigned i = 0; i != NumPackages; ++i) {
+    // Limit the amount of padding we are willing to give up for alignment.
+    unsigned Length = strlen(StaticPackageInfo[i].FullName);
+    if (Length <= 30)
+      OptionFieldWidth = std::max(OptionFieldWidth, Length);
+  }
+
+  const unsigned InitialPad = 2;
+  for (unsigned i = 0; i != NumPackages; ++i) {
+    const StaticPackageInfoRec &package = StaticPackageInfo[i];
+    const std::string &Option = package.FullName;
+    int Pad = OptionFieldWidth - int(Option.size());
+    OS.indent(InitialPad) << Option;
+
+    if (package.GroupIndex != -1 || package.Hidden) {
+      // Break on long option names.
+      if (Pad < 0) {
+        OS << "\n";
+        Pad = OptionFieldWidth + InitialPad;
+      }
+      OS.indent(Pad + 1) << "[";
+      if (package.GroupIndex != -1) {
+        OS << "Group=" << StaticGroupInfo[package.GroupIndex].FullName;
+        if (package.Hidden)
+          OS << ", ";
+      }
+      if (package.Hidden)
+        OS << "Hidden";
+      OS << "]";
+    }
+
+    OS << "\n";
+  }
+}
+
 typedef std::map<std::string, const StaticCheckerInfoRec *> SortedCheckers;
 
 static void printCheckerOption(llvm::raw_ostream &OS,SortedCheckers &checkers) {
@@ -161,6 +241,7 @@ static void printCheckerOption(llvm::raw_ostream &OS,SortedCheckers &checkers) {
   for (SortedCheckers::iterator
          I = checkers.begin(), E = checkers.end(); I != E; ++I) {
     const std::string &Option = I->first;
+    const StaticCheckerInfoRec &checker = *I->second;
     int Pad = OptionFieldWidth - int(Option.size());
     OS.indent(InitialPad) << Option;
 
@@ -169,11 +250,36 @@ static void printCheckerOption(llvm::raw_ostream &OS,SortedCheckers &checkers) {
       OS << "\n";
       Pad = OptionFieldWidth + InitialPad;
     }
-    OS.indent(Pad + 1) << I->second->HelpText << '\n';
+    OS.indent(Pad + 1) << checker.HelpText;
+
+    if (checker.GroupIndex != -1 || checker.Hidden) {
+      OS << "  [";
+      if (checker.GroupIndex != -1) {
+        OS << "Group=" << StaticGroupInfo[checker.GroupIndex].FullName;
+        if (checker.Hidden)
+          OS << ", ";
+      }
+      if (checker.Hidden)
+        OS << "Hidden";
+      OS << "]";
+    }
+
+    OS << "\n";
   }
 }
 
 void ClangSACheckerProvider::printHelp(llvm::raw_ostream &OS) {
+  OS << "USAGE: -analyzer-checker <CHECKER or PACKAGE or GROUP,...>\n";
+
+  OS << "\nGROUPS:\n";
+  for (unsigned i = 0; i != NumGroups; ++i)
+    OS.indent(2) << StaticGroupInfo[i].FullName << "\n";
+
+  OS << "\nPACKAGES:\n";
+  printPackageOption(OS);
+
+  OS << "\nCHECKERS:\n";
+
   // Sort checkers according to their full name.
   SortedCheckers checkers;
   for (unsigned i = 0; i != NumCheckers; ++i)
diff --git a/lib/StaticAnalyzer/Checkers/ClangSACheckers.h b/lib/StaticAnalyzer/Checkers/ClangSACheckers.h
index 73239f5..5524b0f 100644
--- a/lib/StaticAnalyzer/Checkers/ClangSACheckers.h
+++ b/lib/StaticAnalyzer/Checkers/ClangSACheckers.h
@@ -21,7 +21,7 @@ namespace ento {
 class CheckerManager;
 
 #define GET_CHECKERS
-#define CHECKER(FULLNAME,CLASS,CXXFILE,HELPTEXT,HIDDEN)    \
+#define CHECKER(FULLNAME,CLASS,CXXFILE,HELPTEXT,GROUPINDEX,HIDDEN)    \
   void register##CLASS(CheckerManager &mgr);
 #include "Checkers.inc"
 #undef CHECKER
diff --git a/lib/StaticAnalyzer/Checkers/DeadStoresChecker.cpp b/lib/StaticAnalyzer/Checkers/DeadStoresChecker.cpp
index 3b39372..bc1d823 100644
--- a/lib/StaticAnalyzer/Checkers/DeadStoresChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/DeadStoresChecker.cpp
@@ -13,8 +13,7 @@
 //===----------------------------------------------------------------------===//
 
 #include "ClangSACheckers.h"
-#include "clang/StaticAnalyzer/Core/CheckerV2.h"
-#include "clang/StaticAnalyzer/Checkers/LocalCheckers.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/Analysis/Analyses/LiveVariables.h"
 #include "clang/Analysis/Visitors/CFGRecStmtVisitor.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
@@ -342,7 +341,7 @@ public:
 //===----------------------------------------------------------------------===//
 
 namespace {
-class DeadStoresChecker : public CheckerV2<check::ASTCodeBody> {
+class DeadStoresChecker : public Checker<check::ASTCodeBody> {
 public:
   void checkASTCodeBody(const Decl *D, AnalysisManager& mgr,
                         BugReporter &BR) const {
diff --git a/lib/StaticAnalyzer/Checkers/DebugCheckers.cpp b/lib/StaticAnalyzer/Checkers/DebugCheckers.cpp
index 091d99b..486b7f7 100644
--- a/lib/StaticAnalyzer/Checkers/DebugCheckers.cpp
+++ b/lib/StaticAnalyzer/Checkers/DebugCheckers.cpp
@@ -12,7 +12,7 @@
 //===----------------------------------------------------------------------===//
 
 #include "ClangSACheckers.h"
-#include "clang/StaticAnalyzer/Core/CheckerV2.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
 #include "clang/Analysis/Analyses/LiveVariables.h"
 
@@ -24,7 +24,7 @@ using namespace ento;
 //===----------------------------------------------------------------------===//
 
 namespace {
-class LiveVariablesDumper : public CheckerV2<check::ASTCodeBody> {
+class LiveVariablesDumper : public Checker<check::ASTCodeBody> {
 public:
   void checkASTCodeBody(const Decl *D, AnalysisManager& mgr,
                         BugReporter &BR) const {
@@ -44,7 +44,7 @@ void ento::registerLiveVariablesDumper(CheckerManager &mgr) {
 //===----------------------------------------------------------------------===//
 
 namespace {
-class CFGViewer : public CheckerV2<check::ASTCodeBody> {
+class CFGViewer : public Checker<check::ASTCodeBody> {
 public:
   void checkASTCodeBody(const Decl *D, AnalysisManager& mgr,
                         BugReporter &BR) const {
@@ -64,7 +64,7 @@ void ento::registerCFGViewer(CheckerManager &mgr) {
 //===----------------------------------------------------------------------===//
 
 namespace {
-class CFGDumper : public CheckerV2<check::ASTCodeBody> {
+class CFGDumper : public Checker<check::ASTCodeBody> {
 public:
   void checkASTCodeBody(const Decl *D, AnalysisManager& mgr,
                         BugReporter &BR) const {
diff --git a/lib/StaticAnalyzer/Checkers/DereferenceChecker.cpp b/lib/StaticAnalyzer/Checkers/DereferenceChecker.cpp
index 606ac4a..baaf8b3 100644
--- a/lib/StaticAnalyzer/Checkers/DereferenceChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/DereferenceChecker.cpp
@@ -12,51 +12,31 @@
 //
 //===----------------------------------------------------------------------===//
 
-#include "InternalChecks.h"
+#include "ClangSACheckers.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
+#include "clang/StaticAnalyzer/Core/CheckerManager.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
-#include "clang/StaticAnalyzer/Checkers/DereferenceChecker.h"
-#include "clang/StaticAnalyzer/Core/PathSensitive/Checker.h"
-#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
 
 using namespace clang;
 using namespace ento;
 
 namespace {
-class DereferenceChecker : public Checker {
-  BuiltinBug *BT_null;
-  BuiltinBug *BT_undef;
-  llvm::SmallVector<ExplodedNode*, 2> ImplicitNullDerefNodes;
+class DereferenceChecker
+    : public Checker< check::Location,
+                        EventDispatcher<ImplicitNullDerefEvent> > {
+  mutable llvm::OwningPtr<BuiltinBug> BT_null;
+  mutable llvm::OwningPtr<BuiltinBug> BT_undef;
+
 public:
-  DereferenceChecker() : BT_null(0), BT_undef(0) {}
-  static void *getTag() { static int tag = 0; return &tag; }
-  void visitLocation(CheckerContext &C, const Stmt *S, SVal location,
-                     bool isLoad);
-
-  std::pair<ExplodedNode * const*, ExplodedNode * const*>
-  getImplicitNodes() const {
-    return std::make_pair(ImplicitNullDerefNodes.data(),
-                          ImplicitNullDerefNodes.data() +
-                          ImplicitNullDerefNodes.size());
-  }
-  void AddDerefSource(llvm::raw_ostream &os,
-                      llvm::SmallVectorImpl<SourceRange> &Ranges,
-                      const Expr *Ex, bool loadedFrom = false);
+  void checkLocation(SVal location, bool isLoad, CheckerContext &C) const;
+
+  static void AddDerefSource(llvm::raw_ostream &os,
+                             llvm::SmallVectorImpl<SourceRange> &Ranges,
+                             const Expr *Ex, bool loadedFrom = false);
 };
 } // end anonymous namespace
 
-void ento::RegisterDereferenceChecker(ExprEngine &Eng) {
-  Eng.registerCheck(new DereferenceChecker());
-}
-
-std::pair<ExplodedNode * const *, ExplodedNode * const *>
-ento::GetImplicitNullDereferences(ExprEngine &Eng) {
-  DereferenceChecker *checker = Eng.getChecker<DereferenceChecker>();
-  if (!checker)
-    return std::make_pair((ExplodedNode * const *) 0,
-                          (ExplodedNode * const *) 0);
-  return checker->getImplicitNodes();
-}
-
 void DereferenceChecker::AddDerefSource(llvm::raw_ostream &os,
                                      llvm::SmallVectorImpl<SourceRange> &Ranges,
                                         const Expr *Ex,
@@ -85,13 +65,13 @@ void DereferenceChecker::AddDerefSource(llvm::raw_ostream &os,
   }
 }
 
-void DereferenceChecker::visitLocation(CheckerContext &C, const Stmt *S,
-                                       SVal l, bool isLoad) {
+void DereferenceChecker::checkLocation(SVal l, bool isLoad,
+                                       CheckerContext &C) const {
   // Check for dereference of an undefined value.
   if (l.isUndef()) {
     if (ExplodedNode *N = C.generateSink()) {
       if (!BT_undef)
-        BT_undef = new BuiltinBug("Dereference of undefined pointer value");
+        BT_undef.reset(new BuiltinBug("Dereference of undefined pointer value"));
 
       EnhancedBugReport *report =
         new EnhancedBugReport(*BT_undef, BT_undef->getDescription(), N);
@@ -108,6 +88,7 @@ void DereferenceChecker::visitLocation(CheckerContext &C, const Stmt *S,
   if (!isa<Loc>(location))
     return;
 
+  const Stmt *S = C.getStmt();
   const GRState *state = C.getState();
   const GRState *notNullState, *nullState;
   llvm::tie(notNullState, nullState) = state->assume(location);
@@ -123,7 +104,7 @@ void DereferenceChecker::visitLocation(CheckerContext &C, const Stmt *S,
       // We know that 'location' cannot be non-null.  This is what
       // we call an "explicit" null dereference.
       if (!BT_null)
-        BT_null = new BuiltinBug("Dereference of null pointer");
+        BT_null.reset(new BuiltinBug("Dereference of null pointer"));
 
       llvm::SmallString<100> buf;
       llvm::SmallVector<SourceRange, 2> Ranges;
@@ -195,11 +176,17 @@ void DereferenceChecker::visitLocation(CheckerContext &C, const Stmt *S,
       // Otherwise, we have the case where the location could either be
       // null or not-null.  Record the error node as an "implicit" null
       // dereference.
-      if (ExplodedNode *N = C.generateSink(nullState))
-        ImplicitNullDerefNodes.push_back(N);
+      if (ExplodedNode *N = C.generateSink(nullState)) {
+        ImplicitNullDerefEvent event = { l, isLoad, N, &C.getBugReporter() };
+        dispatchEvent(event);
+      }
     }
   }
 
   // From this point forward, we know that the location is not null.
   C.addTransition(notNullState);
 }
+
+void ento::registerDereferenceChecker(CheckerManager &mgr) {
+  mgr.registerChecker<DereferenceChecker>();
+}
diff --git a/lib/StaticAnalyzer/Checkers/DivZeroChecker.cpp b/lib/StaticAnalyzer/Checkers/DivZeroChecker.cpp
index 20cc904..07fb5aa 100644
--- a/lib/StaticAnalyzer/Checkers/DivZeroChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/DivZeroChecker.cpp
@@ -12,34 +12,25 @@
 //
 //===----------------------------------------------------------------------===//
 
-#include "InternalChecks.h"
+#include "ClangSACheckers.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
+#include "clang/StaticAnalyzer/Core/CheckerManager.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
-#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerVisitor.h"
 
 using namespace clang;
 using namespace ento;
 
 namespace {
-class DivZeroChecker : public CheckerVisitor<DivZeroChecker> {
-  BuiltinBug *BT;
+class DivZeroChecker : public Checker< check::PreStmt<BinaryOperator> > {
+  mutable llvm::OwningPtr<BuiltinBug> BT;
 public:
-  DivZeroChecker() : BT(0) {}  
-  static void *getTag();
-  void PreVisitBinaryOperator(CheckerContext &C, const BinaryOperator *B);
+  void checkPreStmt(const BinaryOperator *B, CheckerContext &C) const;
 };  
 } // end anonymous namespace
 
-void ento::RegisterDivZeroChecker(ExprEngine &Eng) {
-  Eng.registerCheck(new DivZeroChecker());
-}
-
-void *DivZeroChecker::getTag() {
-  static int x;
-  return &x;
-}
-
-void DivZeroChecker::PreVisitBinaryOperator(CheckerContext &C,
-                                            const BinaryOperator *B) {
+void DivZeroChecker::checkPreStmt(const BinaryOperator *B,
+                                  CheckerContext &C) const {
   BinaryOperator::Opcode Op = B->getOpcode();
   if (Op != BO_Div &&
       Op != BO_Rem &&
@@ -67,7 +58,7 @@ void DivZeroChecker::PreVisitBinaryOperator(CheckerContext &C,
   if (stateZero && !stateNotZero) {
     if (ExplodedNode *N = C.generateSink(stateZero)) {
       if (!BT)
-        BT = new BuiltinBug("Division by zero");
+        BT.reset(new BuiltinBug("Division by zero"));
 
       EnhancedBugReport *R = 
         new EnhancedBugReport(*BT, BT->getDescription(), N);
@@ -84,3 +75,7 @@ void DivZeroChecker::PreVisitBinaryOperator(CheckerContext &C,
   // zero denom case for now.
   C.addTransition(stateNotZero);
 }
+
+void ento::registerDivZeroChecker(CheckerManager &mgr) {
+  mgr.registerChecker<DivZeroChecker>();
+}
diff --git a/lib/StaticAnalyzer/Checkers/ExperimentalChecks.cpp b/lib/StaticAnalyzer/Checkers/ExperimentalChecks.cpp
deleted file mode 100644
index 990ba1c0..0000000
--- a/lib/StaticAnalyzer/Checkers/ExperimentalChecks.cpp
+++ /dev/null
@@ -1,26 +0,0 @@
-//=-- ExperimentalChecks.h ----------------------------------------*- C++ -*-=//
-//
-//                     The LLVM Compiler Infrastructure
-//
-// This file is distributed under the University of Illinois Open Source
-// License. See LICENSE.TXT for details.
-//
-//===----------------------------------------------------------------------===//
-//
-//  This file defines functions to instantiate and register experimental
-//  checks in ExprEngine.
-//
-//===----------------------------------------------------------------------===//
-
-#include "InternalChecks.h"
-#include "ExperimentalChecks.h"
-#include "clang/StaticAnalyzer/Checkers/LocalCheckers.h"
-
-using namespace clang;
-using namespace ento;
-
-void ento::RegisterExperimentalChecks(ExprEngine &Eng) {
-  // These are checks that never belong as internal checks
-  // within ExprEngine.
-  RegisterMallocChecker(Eng); // ArrayBoundChecker depends on this.
-}
diff --git a/lib/StaticAnalyzer/Checkers/ExperimentalChecks.h b/lib/StaticAnalyzer/Checkers/ExperimentalChecks.h
deleted file mode 100644
index 1f38ad7..0000000
--- a/lib/StaticAnalyzer/Checkers/ExperimentalChecks.h
+++ /dev/null
@@ -1,31 +0,0 @@
-//=-- ExperimentalChecks.h ----------------------------------------*- C++ -*-=//
-//
-//                     The LLVM Compiler Infrastructure
-//
-// This file is distributed under the University of Illinois Open Source
-// License. See LICENSE.TXT for details.
-//
-//===----------------------------------------------------------------------===//
-//
-//  This file defines functions to instantiate and register experimental
-//  checks in ExprEngine.
-//
-//===----------------------------------------------------------------------===//
-
-#ifndef LLVM_CLANG_GR_ExprEngine_EXPERIMENTAL_CHECKS
-#define LLVM_CLANG_GR_ExprEngine_EXPERIMENTAL_CHECKS
-
-namespace clang {
-
-namespace ento {
-
-class ExprEngine;
-
-void RegisterAnalyzerStatsChecker(ExprEngine &Eng);
-void RegisterMallocChecker(ExprEngine &Eng);
-
-} // end GR namespace
-
-} // end clang namespace
-
-#endif
diff --git a/lib/StaticAnalyzer/Checkers/FixedAddressChecker.cpp b/lib/StaticAnalyzer/Checkers/FixedAddressChecker.cpp
index d7b27b5..d699dee 100644
--- a/lib/StaticAnalyzer/Checkers/FixedAddressChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/FixedAddressChecker.cpp
@@ -14,7 +14,7 @@
 //===----------------------------------------------------------------------===//
 
 #include "ClangSACheckers.h"
-#include "clang/StaticAnalyzer/Core/CheckerV2.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
@@ -24,7 +24,7 @@ using namespace ento;
 
 namespace {
 class FixedAddressChecker 
-  : public CheckerV2< check::PreStmt<BinaryOperator> > {
+  : public Checker< check::PreStmt<BinaryOperator> > {
   mutable llvm::OwningPtr<BuiltinBug> BT;
 
 public:
diff --git a/lib/StaticAnalyzer/Checkers/IdempotentOperationChecker.cpp b/lib/StaticAnalyzer/Checkers/IdempotentOperationChecker.cpp
index 83d9668..b0c07fc 100644
--- a/lib/StaticAnalyzer/Checkers/IdempotentOperationChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/IdempotentOperationChecker.cpp
@@ -46,7 +46,7 @@
 #include "clang/Analysis/CFGStmtMap.h"
 #include "clang/Analysis/Analyses/PseudoConstantAnalysis.h"
 #include "clang/Analysis/Analyses/CFGReachabilityAnalysis.h"
-#include "clang/StaticAnalyzer/Core/CheckerV2.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
@@ -59,14 +59,13 @@
 #include "llvm/ADT/SmallSet.h"
 #include "llvm/ADT/BitVector.h"
 #include "llvm/Support/ErrorHandling.h"
-#include <deque>
 
 using namespace clang;
 using namespace ento;
 
 namespace {
 class IdempotentOperationChecker
-  : public CheckerV2<check::PreStmt<BinaryOperator>,
+  : public Checker<check::PreStmt<BinaryOperator>,
                      check::PostStmt<BinaryOperator>,
                      check::EndAnalysis> {
 public:
@@ -336,10 +335,9 @@ void IdempotentOperationChecker::checkPostStmt(const BinaryOperator *B,
     = cast<StmtPoint>(C.getPredecessor()->getLocation()).getStmt();
   
   // Ignore implicit calls to setters.
-  if (isa<ObjCPropertyRefExpr>(predStmt))
+  if (!isa<BinaryOperator>(predStmt))
     return;
-  
-  assert(isa<BinaryOperator>(predStmt));
+
   Data.explodedNodes.Add(C.getPredecessor());
 }
 
@@ -532,12 +530,12 @@ IdempotentOperationChecker::pathWasCompletelyAnalyzed(AnalysisContext *AC,
                                                       const CFGBlock *CB,
                                                       const CoreEngine &CE) {
 
-  CFGReachabilityAnalysis *CRA = AC->getCFGReachablityAnalysis();
+  CFGReverseBlockReachabilityAnalysis *CRA = AC->getCFGReachablityAnalysis();
   
   // Test for reachability from any aborted blocks to this block
-  typedef CoreEngine::BlocksAborted::const_iterator AbortedIterator;
-  for (AbortedIterator I = CE.blocks_aborted_begin(),
-      E = CE.blocks_aborted_end(); I != E; ++I) {
+  typedef CoreEngine::BlocksExhausted::const_iterator ExhaustedIterator;
+  for (ExhaustedIterator I = CE.blocks_exhausted_begin(),
+      E = CE.blocks_exhausted_end(); I != E; ++I) {
     const BlockEdge &BE =  I->first;
 
     // The destination block on the BlockEdge is the first block that was not
@@ -551,16 +549,25 @@ IdempotentOperationChecker::pathWasCompletelyAnalyzed(AnalysisContext *AC,
     if (destBlock == CB || CRA->isReachable(destBlock, CB))
       return false;
   }
+
+  // Test for reachability from blocks we just gave up on.
+  typedef CoreEngine::BlocksAborted::const_iterator AbortedIterator;
+  for (AbortedIterator I = CE.blocks_aborted_begin(),
+       E = CE.blocks_aborted_end(); I != E; ++I) {
+    const CFGBlock *destBlock = I->first;
+    if (destBlock == CB || CRA->isReachable(destBlock, CB))
+      return false;
+  }
   
   // For the items still on the worklist, see if they are in blocks that
   // can eventually reach 'CB'.
   class VisitWL : public WorkList::Visitor {
     const CFGStmtMap *CBM;
     const CFGBlock *TargetBlock;
-    CFGReachabilityAnalysis &CRA;
+    CFGReverseBlockReachabilityAnalysis &CRA;
   public:
     VisitWL(const CFGStmtMap *cbm, const CFGBlock *targetBlock,
-            CFGReachabilityAnalysis &cra)
+            CFGReverseBlockReachabilityAnalysis &cra)
       : CBM(cbm), TargetBlock(targetBlock), CRA(cra) {}
     virtual bool visit(const WorkListUnit &U) {
       ProgramPoint P = U.getNode()->getLocation();
@@ -580,7 +587,7 @@ IdempotentOperationChecker::pathWasCompletelyAnalyzed(AnalysisContext *AC,
       if (!B)
         return true;
       
-      return CRA.isReachable(B, TargetBlock);
+      return B == TargetBlock || CRA.isReachable(B, TargetBlock);
     }
   };
   VisitWL visitWL(AC->getCFGStmtMap(), CB, *CRA);
@@ -641,9 +648,10 @@ bool IdempotentOperationChecker::CanVary(const Expr *Ex,
     return false;
 
   // Cases requiring custom logic
-  case Stmt::SizeOfAlignOfExprClass: {
-    const SizeOfAlignOfExpr *SE = cast<const SizeOfAlignOfExpr>(Ex);
-    if (!SE->isSizeOf())
+  case Stmt::UnaryExprOrTypeTraitExprClass: {
+    const UnaryExprOrTypeTraitExpr *SE = 
+                       cast<const UnaryExprOrTypeTraitExpr>(Ex);
+    if (SE->getKind() != UETT_SizeOf)
       return false;
     return SE->getTypeOfArgument()->isVariableArrayType();
   }
diff --git a/lib/StaticAnalyzer/Checkers/InternalChecks.h b/lib/StaticAnalyzer/Checkers/InternalChecks.h
deleted file mode 100644
index e7c38ee..0000000
--- a/lib/StaticAnalyzer/Checkers/InternalChecks.h
+++ /dev/null
@@ -1,48 +0,0 @@
-//=-- InternalChecks.h- Builtin ExprEngine Checks -------------------*- C++ -*-=
-//
-//                     The LLVM Compiler Infrastructure
-//
-// This file is distributed under the University of Illinois Open Source
-// License. See LICENSE.TXT for details.
-//
-//===----------------------------------------------------------------------===//
-//
-//  This file defines functions to instantiate and register the "built-in"
-//  checks in ExprEngine.
-//
-//===----------------------------------------------------------------------===//
-
-#ifndef LLVM_CLANG_GR_ExprEngine_INTERNAL_CHECKS
-#define LLVM_CLANG_GR_ExprEngine_INTERNAL_CHECKS
-
-namespace clang {
-
-namespace ento {
-
-class ExprEngine;
-
-// Foundational checks that handle basic semantics.
-void RegisterAdjustedReturnValueChecker(ExprEngine &Eng);
-void RegisterArrayBoundCheckerV2(ExprEngine &Eng);
-void RegisterAttrNonNullChecker(ExprEngine &Eng);
-void RegisterBuiltinFunctionChecker(ExprEngine &Eng);
-void RegisterCallAndMessageChecker(ExprEngine &Eng);
-void RegisterDereferenceChecker(ExprEngine &Eng);
-void RegisterDivZeroChecker(ExprEngine &Eng);
-void RegisterNoReturnFunctionChecker(ExprEngine &Eng);
-void RegisterReturnUndefChecker(ExprEngine &Eng);
-void RegisterUndefBranchChecker(ExprEngine &Eng);
-void RegisterUndefCapturedBlockVarChecker(ExprEngine &Eng);
-void RegisterUndefResultChecker(ExprEngine &Eng);
-void RegisterUndefinedArraySubscriptChecker(ExprEngine &Eng);
-void RegisterUndefinedAssignmentChecker(ExprEngine &Eng);
-void RegisterVLASizeChecker(ExprEngine &Eng);
-
-// API checks.
-void RegisterOSAtomicChecker(ExprEngine &Eng);
-
-} // end GR namespace
-
-} // end clang namespace
-
-#endif
diff --git a/lib/StaticAnalyzer/Checkers/IteratorsChecker.cpp b/lib/StaticAnalyzer/Checkers/IteratorsChecker.cpp
new file mode 100644
index 0000000..e4e5f54
--- /dev/null
+++ b/lib/StaticAnalyzer/Checkers/IteratorsChecker.cpp
@@ -0,0 +1,582 @@
+//=== IteratorsChecker.cpp - Check for Invalidated Iterators ------*- C++ -*----
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// This defines IteratorsChecker, a number of small checks for conditions
+// leading to invalid iterators being used.
+// FIXME: Currently only supports 'vector' and 'deque'
+//
+//===----------------------------------------------------------------------===//
+
+#include "clang/AST/DeclTemplate.h"
+#include "clang/Basic/SourceManager.h"
+#include "ClangSACheckers.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
+#include "clang/StaticAnalyzer/Core/CheckerManager.h"
+#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/GRStateTrait.h"
+#include "clang/AST/DeclCXX.h"
+#include "clang/AST/Decl.h"
+#include "clang/AST/Type.h"
+#include "clang/AST/PrettyPrinter.h"
+#include "llvm/ADT/SmallPtrSet.h"
+#include "llvm/ADT/StringSwitch.h"
+
+
+using namespace clang;
+using namespace ento;
+
+// This is the state associated with each iterator which includes both the
+// kind of state and the instance used to initialize it.
+// FIXME: add location where invalidated for better error reporting.
+namespace {
+class RefState {
+  enum Kind { BeginValid, EndValid, Invalid, Undefined, Unknown } K;
+  const void *VR;
+
+public:
+  RefState(Kind k, const void *vr) : K(k), VR(vr) {}
+
+  bool isValid() const { return K == BeginValid || K == EndValid; }
+  bool isInvalid() const { return K == Invalid; }
+  bool isUndefined() const { return K == Undefined; }
+  bool isUnknown() const { return K == Unknown; }
+  const MemRegion *getMemRegion() const {
+    if (K == BeginValid || K == EndValid)
+      return(const MemRegion *)VR;
+    return 0;
+  }
+  const MemberExpr *getMemberExpr() const {
+    if (K == Invalid)
+      return(const MemberExpr *)VR;
+    return 0;
+  }
+
+  bool operator==(const RefState &X) const {
+    return K == X.K && VR == X.VR;
+  }
+
+  static RefState getBeginValid(const MemRegion *vr) {
+    assert(vr);
+    return RefState(BeginValid, vr);
+  }
+  static RefState getEndValid(const MemRegion *vr) {
+    assert(vr);
+    return RefState(EndValid, vr);
+  }
+  static RefState getInvalid( const MemberExpr *ME ) {
+    return RefState(Invalid, ME);
+  }
+  static RefState getUndefined( void ) {
+    return RefState(Undefined, 0);
+  }
+  static RefState getUnknown( void ) {
+    return RefState(Unknown, 0);
+  }
+
+  void Profile(llvm::FoldingSetNodeID &ID) const {
+    ID.AddInteger(K);
+    ID.AddPointer(VR);
+  }
+};
+
+enum RefKind { NoKind, VectorKind, VectorIteratorKind };
+
+class IteratorsChecker : 
+    public Checker<check::PreStmt<CXXOperatorCallExpr>,
+                   check::PreStmt<DeclStmt>,
+                   check::PreStmt<CXXMemberCallExpr>,
+                   check::PreStmt<CallExpr> >
+  {
+  // Used when parsing iterators and vectors and deques.
+  BuiltinBug *BT_Invalid, *BT_Undefined, *BT_Incompatible;
+
+public:
+  IteratorsChecker() :
+    BT_Invalid(0), BT_Undefined(0), BT_Incompatible(0)
+  {}
+  static void *getTag() { static int tag; return &tag; }
+    
+  // Checker entry points.
+  void checkPreStmt(const CXXOperatorCallExpr *OCE,
+                    CheckerContext &C) const;
+
+  void checkPreStmt(const DeclStmt *DS,
+                    CheckerContext &C) const;
+
+  void checkPreStmt(const CXXMemberCallExpr *MCE,
+                    CheckerContext &C) const;
+
+  void checkPreStmt(const CallExpr *CE,
+                    CheckerContext &C) const;
+
+private:
+  const GRState *handleAssign(const GRState *state, const Expr *lexp,
+      const Expr *rexp, const LocationContext *LC) const;
+  const GRState *handleAssign(const GRState *state, const MemRegion *MR,
+      const Expr *rexp, const LocationContext *LC) const;
+  const GRState *invalidateIterators(const GRState *state, const MemRegion *MR,
+      const MemberExpr *ME) const;
+  void checkExpr(CheckerContext &C, const Expr *E) const;
+  void checkArgs(CheckerContext &C, const CallExpr *CE) const;
+  const MemRegion *getRegion(const GRState *state, const Expr *E,
+      const LocationContext *LC) const;
+  const DeclRefExpr *getDeclRefExpr(const Expr *E) const;
+};
+
+class IteratorState {
+public:
+  typedef llvm::ImmutableMap<const MemRegion *, RefState> EntryMap;
+};
+} //end anonymous namespace
+
+namespace clang {
+  namespace ento {
+    template <>
+    struct GRStateTrait<IteratorState> 
+      : public GRStatePartialTrait<IteratorState::EntryMap> {
+      static void *GDMIndex() { return IteratorsChecker::getTag(); }
+    };
+  }
+}
+
+void ento::registerIteratorsChecker(CheckerManager &mgr) {
+  mgr.registerChecker<IteratorsChecker>();
+}
+
+// ===============================================
+// Utility functions used by visitor functions
+// ===============================================
+
+// check a templated type for std::vector or std::deque
+static RefKind getTemplateKind(const NamedDecl *td) {
+  const DeclContext *dc = td->getDeclContext();
+  const NamespaceDecl *nameSpace = dyn_cast<NamespaceDecl>(dc);
+  if (!nameSpace || !isa<TranslationUnitDecl>(nameSpace->getDeclContext())
+      || nameSpace->getName() != "std")
+    return NoKind;
+  
+  llvm::StringRef name = td->getName();
+  return llvm::StringSwitch<RefKind>(name)
+    .Cases("vector", "deque", VectorKind)
+    .Default(NoKind);
+}
+
+static RefKind getTemplateKind(const DeclContext *dc) {
+  if (const ClassTemplateSpecializationDecl *td =
+      dyn_cast<ClassTemplateSpecializationDecl>(dc))
+    return getTemplateKind(cast<NamedDecl>(td));
+  return NoKind;
+}
+
+static RefKind getTemplateKind(const TypedefType *tdt) {
+  const TypedefNameDecl *td = tdt->getDecl();
+  RefKind parentKind = getTemplateKind(td->getDeclContext());
+  if (parentKind == VectorKind) {
+    return llvm::StringSwitch<RefKind>(td->getName())
+    .Cases("iterator",
+           "const_iterator",
+           "reverse_iterator", VectorIteratorKind)
+    .Default(NoKind);
+  }
+  return NoKind;
+}
+
+static RefKind getTemplateKind(const TemplateSpecializationType *tsp) {
+  const TemplateName &tname = tsp->getTemplateName();
+  TemplateDecl *td = tname.getAsTemplateDecl();
+  if (!td)
+    return NoKind;
+  return getTemplateKind(td);
+}
+
+static RefKind getTemplateKind(QualType T) {
+  if (const TemplateSpecializationType *tsp = 
+      T->getAs<TemplateSpecializationType>()) {
+    return getTemplateKind(tsp);      
+  }
+  if (const ElaboratedType *ET = dyn_cast<ElaboratedType>(T)) {
+    QualType namedType = ET->getNamedType();
+    if (const TypedefType *tdt = namedType->getAs<TypedefType>()) 
+      return getTemplateKind(tdt);
+    if (const TemplateSpecializationType *tsp = 
+        namedType->getAs<TemplateSpecializationType>()) {
+      return getTemplateKind(tsp);      
+    }
+  }
+  return NoKind;  
+}
+
+// Iterate through our map and invalidate any iterators that were
+// initialized fromt the specified instance MemRegion.
+const GRState *IteratorsChecker::invalidateIterators(const GRState *state,
+                          const MemRegion *MR, const MemberExpr *ME) const {
+  IteratorState::EntryMap Map = state->get<IteratorState>();
+  if (Map.isEmpty())
+    return state;
+
+  // Loop over the entries in the current state.
+  // The key doesn't change, so the map iterators won't change.
+  for (IteratorState::EntryMap::iterator I = Map.begin(), E = Map.end();
+                                                            I != E; ++I) {
+    RefState RS = I.getData();
+    if (RS.getMemRegion() == MR)
+      state = state->set<IteratorState>(I.getKey(), RefState::getInvalid(ME));
+  }
+
+  return state;
+}
+
+// Handle assigning to an iterator where we don't have the LValue MemRegion.
+const GRState *IteratorsChecker::handleAssign(const GRState *state,
+    const Expr *lexp, const Expr *rexp, const LocationContext *LC) const {
+  // Skip the cast if present.
+  if (isa<ImplicitCastExpr>(lexp))
+    lexp = dyn_cast<ImplicitCastExpr>(lexp)->getSubExpr();
+  SVal sv = state->getSVal(lexp);
+  const MemRegion *MR = sv.getAsRegion();
+  if (!MR)
+    return state;
+  RefKind kind = getTemplateKind(lexp->getType());
+
+  // If assigning to a vector, invalidate any iterators currently associated.
+  if (kind == VectorKind)
+    return invalidateIterators(state, MR, 0);
+
+  // Make sure that we are assigning to an iterator.
+  if (getTemplateKind(lexp->getType()) != VectorIteratorKind)
+    return state;
+  return handleAssign(state, MR, rexp, LC);
+}
+
+// handle assigning to an iterator
+const GRState *IteratorsChecker::handleAssign(const GRState *state,
+    const MemRegion *MR, const Expr *rexp, const LocationContext *LC) const {
+  // Assume unknown until we find something definite.
+  state = state->set<IteratorState>(MR, RefState::getUnknown());
+  if (isa<ImplicitCastExpr>(rexp))
+    rexp = dyn_cast<ImplicitCastExpr>(rexp)->getSubExpr();
+  // Need to handle three cases: MemberCall, copy, copy with addition.
+  if (const CallExpr *CE = dyn_cast<CallExpr>(rexp)) {
+    // Handle MemberCall.
+    if (const MemberExpr *ME = dyn_cast<MemberExpr>(CE->getCallee())) {
+      const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(ME->getBase());
+      if (!DRE)
+        return state;
+      // Verify that the type is std::vector<T>.
+      if (getTemplateKind(DRE->getType()) != VectorKind)
+          return state;
+      // Now get the MemRegion associated with the instance.
+      const VarDecl *VD = dyn_cast<VarDecl>(DRE->getDecl());
+      if (!VD)
+        return state;
+      const MemRegion *IMR = state->getRegion(VD, LC);
+      if (!IMR)
+        return state;
+      // Finally, see if it is one of the calls that will create
+      // a valid iterator and mark it if so, else mark as Unknown.
+      llvm::StringRef mName = ME->getMemberDecl()->getName();
+      
+      if (llvm::StringSwitch<bool>(mName)        
+          .Cases("begin", "insert", "erase", true).Default(false)) {
+        return state->set<IteratorState>(MR, RefState::getBeginValid(IMR));
+      }
+      if (mName == "end")
+        return state->set<IteratorState>(MR, RefState::getEndValid(IMR));
+
+      return state->set<IteratorState>(MR, RefState::getUnknown());
+    }
+  }
+  // Handle straight copy from another iterator.
+  if (const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(rexp)) {
+    if (getTemplateKind(DRE->getType()) != VectorIteratorKind)
+      return state;
+    // Now get the MemRegion associated with the instance.
+    const VarDecl *VD = dyn_cast<VarDecl>(DRE->getDecl());
+    if (!VD)
+      return state;
+    const MemRegion *IMR = state->getRegion(VD, LC);
+    if (!IMR)
+      return state;
+    // Get the RefState of the iterator being copied.
+    const RefState *RS = state->get<IteratorState>(IMR);
+    if (!RS)
+      return state;
+    // Use it to set the state of the LValue.
+    return state->set<IteratorState>(MR, *RS);
+  }
+  // If we have operator+ or operator- ...
+  if (const CXXOperatorCallExpr *OCE = dyn_cast<CXXOperatorCallExpr>(rexp)) {
+    OverloadedOperatorKind Kind = OCE->getOperator();
+    if (Kind == OO_Plus || Kind == OO_Minus) {
+      // Check left side of tree for a valid value.
+      state = handleAssign( state, MR, OCE->getArg(0), LC);
+      const RefState *RS = state->get<IteratorState>(MR);
+      // If found, return it.
+      if (!RS->isUnknown())
+        return state;
+      // Otherwise return what we find in the right side.
+      return handleAssign(state, MR, OCE->getArg(1), LC);
+    }
+  }
+  // Fall through if nothing matched.
+  return state;
+}
+
+// Iterate through the arguments looking for an Invalid or Undefined iterator.
+void IteratorsChecker::checkArgs(CheckerContext &C, const CallExpr *CE) const {
+  for (CallExpr::const_arg_iterator I = CE->arg_begin(), E = CE->arg_end();
+       I != E; ++I) {
+    checkExpr(C, *I);
+  }
+}
+
+// Get the DeclRefExpr associated with the expression.
+const DeclRefExpr *IteratorsChecker::getDeclRefExpr(const Expr *E) const {
+  // If it is a CXXConstructExpr, need to get the subexpression.
+  if (const CXXConstructExpr *CE = dyn_cast<CXXConstructExpr>(E)) {
+    if (CE->getNumArgs()== 1) {
+      CXXConstructorDecl *CD = CE->getConstructor();
+      if (CD->isTrivial())
+        E = CE->getArg(0);
+    }
+  }
+  if (isa<ImplicitCastExpr>(E))
+    E = dyn_cast<ImplicitCastExpr>(E)->getSubExpr();
+  // If it isn't one of our types, don't do anything.
+  if (getTemplateKind(E->getType()) != VectorIteratorKind)
+    return NULL;
+  return dyn_cast<DeclRefExpr>(E);
+}
+
+// Get the MemRegion associated with the expresssion.
+const MemRegion *IteratorsChecker::getRegion(const GRState *state,
+    const Expr *E, const LocationContext *LC) const {
+  const DeclRefExpr *DRE = getDeclRefExpr(E);
+  if (!DRE)
+    return NULL;
+  const VarDecl *VD = dyn_cast<VarDecl>(DRE->getDecl());
+  if (!VD)
+    return NULL;
+  // return the MemRegion associated with the iterator
+  return state->getRegion(VD, LC);
+}
+
+// Check the expression and if it is an iterator, generate a diagnostic
+// if the iterator is not valid.
+// FIXME: this method can generate new nodes, and subsequent logic should
+// use those nodes.  We also cannot create multiple nodes at one ProgramPoint
+// with the same tag.
+void IteratorsChecker::checkExpr(CheckerContext &C, const Expr *E) const {
+  const GRState *state = C.getState();
+  const MemRegion *MR = getRegion(state, E,
+                   C.getPredecessor()->getLocationContext());
+  if (!MR)
+    return;
+
+  // Get the state associated with the iterator.
+  const RefState *RS = state->get<IteratorState>(MR);
+  if (!RS)
+    return;
+  if (RS->isInvalid()) {
+    if (ExplodedNode *N = C.generateNode()) {
+      if (!BT_Invalid)
+        // FIXME: We are eluding constness here.
+        const_cast<IteratorsChecker*>(this)->BT_Invalid = new BuiltinBug("");
+
+      std::string msg;
+      const MemberExpr *ME = RS->getMemberExpr();
+      if (ME) {
+        std::string name = ME->getMemberNameInfo().getAsString();
+        msg = "Attempt to use an iterator made invalid by call to '" +
+                                                                  name + "'";
+      }
+      else {
+        msg = "Attempt to use an iterator made invalid by copying another "
+                    "container to its container";
+      }
+
+      EnhancedBugReport *R = new EnhancedBugReport(*BT_Invalid, msg, N);
+      R->addRange(getDeclRefExpr(E)->getSourceRange());
+      C.EmitReport(R);
+    }
+  }
+  else if (RS->isUndefined()) {
+    if (ExplodedNode *N = C.generateNode()) {
+      if (!BT_Undefined)
+        // FIXME: We are eluding constness here.
+        const_cast<IteratorsChecker*>(this)->BT_Undefined =
+          new BuiltinBug("Use of iterator that is not defined");
+
+      EnhancedBugReport *R = new EnhancedBugReport(*BT_Undefined,
+                                           BT_Undefined->getDescription(), N);
+      R->addRange(getDeclRefExpr(E)->getSourceRange());
+      C.EmitReport(R);
+    }
+  }
+}
+
+// ===============================================
+// Path analysis visitor functions
+// ===============================================
+
+// For a generic Call, just check the args for bad iterators.
+void IteratorsChecker::checkPreStmt(const CallExpr *CE,
+                                    CheckerContext &C) const{
+  
+  // FIXME: These checks are to currently work around a bug
+  // in CheckerManager.
+  if (isa<CXXOperatorCallExpr>(CE))
+    return;
+  if (isa<CXXMemberCallExpr>(CE))
+    return;
+
+  checkArgs(C, CE);
+}
+
+// Handle operator calls. First, if it is operator=, check the argument,
+// and handle assigning and set target state appropriately. Otherwise, for
+// other operators, check the args for bad iterators and handle comparisons.
+void IteratorsChecker::checkPreStmt(const CXXOperatorCallExpr *OCE,
+                                    CheckerContext &C) const
+{
+  const LocationContext *LC = C.getPredecessor()->getLocationContext();
+  const GRState *state = C.getState();
+  OverloadedOperatorKind Kind = OCE->getOperator();
+  if (Kind == OO_Equal) {
+    checkExpr(C, OCE->getArg(1));
+    state = handleAssign(state, OCE->getArg(0), OCE->getArg(1), LC);
+    C.addTransition(state);
+    return;
+  }
+  else {
+    checkArgs(C, OCE);
+    // If it is a compare and both are iterators, ensure that they are for
+    // the same container.
+    if (Kind == OO_EqualEqual || Kind == OO_ExclaimEqual ||
+        Kind == OO_Less || Kind == OO_LessEqual ||
+        Kind == OO_Greater || Kind == OO_GreaterEqual) {
+      const MemRegion *MR0, *MR1;
+      MR0 = getRegion(state, OCE->getArg(0), LC);
+      if (!MR0)
+        return;
+      MR1 = getRegion(state, OCE->getArg(1), LC);
+      if (!MR1)
+        return;
+      const RefState *RS0, *RS1;
+      RS0 = state->get<IteratorState>(MR0);
+      if (!RS0)
+        return;
+      RS1 = state->get<IteratorState>(MR1);
+      if (!RS1)
+        return;
+      if (RS0->getMemRegion() != RS1->getMemRegion()) {
+      if (ExplodedNode *N = C.generateNode()) {
+          if (!BT_Incompatible)
+            const_cast<IteratorsChecker*>(this)->BT_Incompatible =
+              new BuiltinBug(
+                      "Cannot compare iterators from different containers");
+
+          EnhancedBugReport *R = new EnhancedBugReport(*BT_Incompatible,
+                                         BT_Incompatible->getDescription(), N);
+          R->addRange(OCE->getSourceRange());
+          C.EmitReport(R);
+        }
+      }
+    }
+  }
+}
+
+// Need to handle DeclStmts to pick up initializing of iterators and to mark
+// uninitialized ones as Undefined.
+void IteratorsChecker::checkPreStmt(const DeclStmt *DS,
+                                    CheckerContext &C) const {
+  const Decl* D = *DS->decl_begin();
+  const VarDecl* VD = dyn_cast<VarDecl>(D);
+  // Only care about iterators.
+  if (getTemplateKind(VD->getType()) != VectorIteratorKind)
+    return;
+
+  // Get the MemRegion associated with the iterator and mark it as Undefined.
+  const GRState *state = C.getState();
+  Loc VarLoc = state->getLValue(VD, C.getPredecessor()->getLocationContext());
+  const MemRegion *MR = VarLoc.getAsRegion();
+  if (!MR)
+    return;
+  state = state->set<IteratorState>(MR, RefState::getUndefined());
+
+  // if there is an initializer, handle marking Valid if a proper initializer
+  const Expr* InitEx = VD->getInit();
+  if (InitEx) {
+    // FIXME: This is too syntactic.  Since 'InitEx' will be analyzed first
+    // it should resolve to an SVal that we can check for validity
+    // *semantically* instead of walking through the AST.
+    if (const CXXConstructExpr *CE = dyn_cast<CXXConstructExpr>(InitEx)) {
+      if (CE->getNumArgs() == 1) {
+        const Expr *E = CE->getArg(0);
+        if (isa<ImplicitCastExpr>(E))
+          InitEx = dyn_cast<ImplicitCastExpr>(E)->getSubExpr();
+        state = handleAssign(state, MR, InitEx,
+                                  C.getPredecessor()->getLocationContext());
+      }
+    }
+  }
+  C.addTransition(state);
+}
+
+
+namespace { struct CalledReserved {}; }
+namespace clang { namespace ento {
+template<> struct GRStateTrait<CalledReserved> 
+    :  public GRStatePartialTrait<llvm::ImmutableSet<const MemRegion*> > {
+  static void *GDMIndex() { static int index = 0; return &index; }
+};
+}}
+
+// on a member call, first check the args for any bad iterators
+// then, check to see if it is a call to a function that will invalidate
+// the iterators
+void IteratorsChecker::checkPreStmt(const CXXMemberCallExpr *MCE,
+                                    CheckerContext &C) const {
+  // Check the arguments.
+  checkArgs(C, MCE);
+  const MemberExpr *ME = dyn_cast<MemberExpr>(MCE->getCallee());
+  if (!ME)
+    return;
+  // Make sure we have the right kind of container.
+  const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(ME->getBase());
+  if (!DRE || getTemplateKind(DRE->getType()) != VectorKind)
+    return;
+  SVal tsv = C.getState()->getSVal(DRE);
+  // Get the MemRegion associated with the container instance.
+  const MemRegion *MR = tsv.getAsRegion();
+  if (!MR)
+    return;
+  // If we are calling a function that invalidates iterators, mark them
+  // appropriately by finding matching instances.
+  const GRState *state = C.getState();
+  llvm::StringRef mName = ME->getMemberDecl()->getName();
+  if (llvm::StringSwitch<bool>(mName)
+      .Cases("insert", "reserve", "push_back", true)
+      .Cases("erase", "pop_back", "clear", "resize", true)
+      .Default(false)) {
+    // If there was a 'reserve' call, assume iterators are good.
+    if (!state->contains<CalledReserved>(MR))
+      state = invalidateIterators(state, MR, ME);
+  }
+  // Keep track of instances that have called 'reserve'
+  // note: do this after we invalidate any iterators by calling 
+  // 'reserve' itself.
+  if (mName == "reserve")
+    state = state->add<CalledReserved>(MR);
+  
+  if (state != C.getState())
+    C.addTransition(state);
+}
+
diff --git a/lib/StaticAnalyzer/Checkers/LLVMConventionsChecker.cpp b/lib/StaticAnalyzer/Checkers/LLVMConventionsChecker.cpp
index 9e3adc8..3d1b5e2 100644
--- a/lib/StaticAnalyzer/Checkers/LLVMConventionsChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/LLVMConventionsChecker.cpp
@@ -13,8 +13,7 @@
 //===----------------------------------------------------------------------===//
 
 #include "ClangSACheckers.h"
-#include "clang/StaticAnalyzer/Core/CheckerV2.h"
-#include "clang/StaticAnalyzer/Checkers/LocalCheckers.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
 #include "clang/AST/DeclTemplate.h"
 #include "clang/AST/StmtVisitor.h"
@@ -57,7 +56,7 @@ static bool IsStdString(QualType T) {
   if (!TT)
     return false;
 
-  const TypedefDecl *TD = TT->getDecl();
+  const TypedefNameDecl *TD = TT->getDecl();
 
   if (!InNamespace(TD, "std"))
     return false;
@@ -289,7 +288,7 @@ void ASTFieldVisitor::ReportError(QualType T) {
 //===----------------------------------------------------------------------===//
 
 namespace {
-class LLVMConventionsChecker : public CheckerV2<
+class LLVMConventionsChecker : public Checker<
                                                 check::ASTDecl<CXXRecordDecl>,
                                                 check::ASTCodeBody > {
 public:
diff --git a/lib/StaticAnalyzer/Checkers/MacOSXAPIChecker.cpp b/lib/StaticAnalyzer/Checkers/MacOSXAPIChecker.cpp
index d70c65a..12ce866 100644
--- a/lib/StaticAnalyzer/Checkers/MacOSXAPIChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/MacOSXAPIChecker.cpp
@@ -16,7 +16,7 @@
 //===----------------------------------------------------------------------===//
 
 #include "ClangSACheckers.h"
-#include "clang/StaticAnalyzer/Core/CheckerV2.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
@@ -30,7 +30,7 @@ using namespace clang;
 using namespace ento;
 
 namespace {
-class MacOSXAPIChecker : public CheckerV2< check::PreStmt<CallExpr> > {
+class MacOSXAPIChecker : public Checker< check::PreStmt<CallExpr> > {
   enum SubChecks {
     DispatchOnce = 0,
     DispatchOnceF,
diff --git a/lib/StaticAnalyzer/Checkers/MallocChecker.cpp b/lib/StaticAnalyzer/Checkers/MallocChecker.cpp
index 794740a..9100215 100644
--- a/lib/StaticAnalyzer/Checkers/MallocChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/MallocChecker.cpp
@@ -12,9 +12,11 @@
 //
 //===----------------------------------------------------------------------===//
 
-#include "ExperimentalChecks.h"
+#include "ClangSACheckers.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
+#include "clang/StaticAnalyzer/Core/CheckerManager.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
-#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerVisitor.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/GRState.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/GRStateTrait.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h"
@@ -62,55 +64,52 @@ public:
 
 class RegionState {};
 
-class MallocChecker : public CheckerVisitor<MallocChecker> {
-  BuiltinBug *BT_DoubleFree;
-  BuiltinBug *BT_Leak;
-  BuiltinBug *BT_UseFree;
-  BuiltinBug *BT_UseRelinquished;
-  BuiltinBug *BT_BadFree;
-  IdentifierInfo *II_malloc, *II_free, *II_realloc, *II_calloc;
+class MallocChecker : public Checker<eval::Call, check::DeadSymbols, check::EndPath, check::PreStmt<ReturnStmt>, check::Location,
+                               check::Bind, eval::Assume> {
+  mutable llvm::OwningPtr<BuiltinBug> BT_DoubleFree;
+  mutable llvm::OwningPtr<BuiltinBug> BT_Leak;
+  mutable llvm::OwningPtr<BuiltinBug> BT_UseFree;
+  mutable llvm::OwningPtr<BuiltinBug> BT_UseRelinquished;
+  mutable llvm::OwningPtr<BuiltinBug> BT_BadFree;
+  mutable IdentifierInfo *II_malloc, *II_free, *II_realloc, *II_calloc;
 
 public:
-  MallocChecker() 
-    : BT_DoubleFree(0), BT_Leak(0), BT_UseFree(0), BT_UseRelinquished(0),
-      BT_BadFree(0),
-      II_malloc(0), II_free(0), II_realloc(0), II_calloc(0) {}
-  static void *getTag();
-  bool evalCallExpr(CheckerContext &C, const CallExpr *CE);
-  void evalDeadSymbols(CheckerContext &C, SymbolReaper &SymReaper);
-  void evalEndPath(EndOfFunctionNodeBuilder &B, void *tag, ExprEngine &Eng);
-  void PreVisitReturnStmt(CheckerContext &C, const ReturnStmt *S);
-  const GRState *evalAssume(const GRState *state, SVal Cond, bool Assumption,
-                            bool *respondsToCallback);
-  void visitLocation(CheckerContext &C, const Stmt *S, SVal l, bool isLoad);
-  virtual void PreVisitBind(CheckerContext &C, const Stmt *StoreE,
-                            SVal location, SVal val);
+  MallocChecker() : II_malloc(0), II_free(0), II_realloc(0), II_calloc(0) {}
+
+  bool evalCall(const CallExpr *CE, CheckerContext &C) const;
+  void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const;
+  void checkEndPath(EndOfFunctionNodeBuilder &B, ExprEngine &Eng) const;
+  void checkPreStmt(const ReturnStmt *S, CheckerContext &C) const;
+  const GRState *evalAssume(const GRState *state, SVal Cond,
+                            bool Assumption) const;
+  void checkLocation(SVal l, bool isLoad, CheckerContext &C) const;
+  void checkBind(SVal location, SVal val, CheckerContext &C) const;
 
 private:
-  void MallocMem(CheckerContext &C, const CallExpr *CE);
-  void MallocMemReturnsAttr(CheckerContext &C, const CallExpr *CE,
-                            const OwnershipAttr* Att);
-  const GRState *MallocMemAux(CheckerContext &C, const CallExpr *CE,
-                              const Expr *SizeEx, SVal Init,
-                              const GRState *state) {
+  static void MallocMem(CheckerContext &C, const CallExpr *CE);
+  static void MallocMemReturnsAttr(CheckerContext &C, const CallExpr *CE,
+                                   const OwnershipAttr* Att);
+  static const GRState *MallocMemAux(CheckerContext &C, const CallExpr *CE,
+                                     const Expr *SizeEx, SVal Init,
+                                     const GRState *state) {
     return MallocMemAux(C, CE, state->getSVal(SizeEx), Init, state);
   }
-  const GRState *MallocMemAux(CheckerContext &C, const CallExpr *CE,
-                              SVal SizeEx, SVal Init,
-                              const GRState *state);
+  static const GRState *MallocMemAux(CheckerContext &C, const CallExpr *CE,
+                                     SVal SizeEx, SVal Init,
+                                     const GRState *state);
 
-  void FreeMem(CheckerContext &C, const CallExpr *CE);
+  void FreeMem(CheckerContext &C, const CallExpr *CE) const;
   void FreeMemAttr(CheckerContext &C, const CallExpr *CE,
-                   const OwnershipAttr* Att);
+                   const OwnershipAttr* Att) const;
   const GRState *FreeMemAux(CheckerContext &C, const CallExpr *CE,
-                            const GRState *state, unsigned Num, bool Hold);
+                           const GRState *state, unsigned Num, bool Hold) const;
 
-  void ReallocMem(CheckerContext &C, const CallExpr *CE);
-  void CallocMem(CheckerContext &C, const CallExpr *CE);
+  void ReallocMem(CheckerContext &C, const CallExpr *CE) const;
+  static void CallocMem(CheckerContext &C, const CallExpr *CE);
   
-  bool SummarizeValue(llvm::raw_ostream& os, SVal V);
-  bool SummarizeRegion(llvm::raw_ostream& os, const MemRegion *MR);
-  void ReportBadFree(CheckerContext &C, SVal ArgVal, SourceRange range);
+  static bool SummarizeValue(llvm::raw_ostream& os, SVal V);
+  static bool SummarizeRegion(llvm::raw_ostream& os, const MemRegion *MR);
+  void ReportBadFree(CheckerContext &C, SVal ArgVal, SourceRange range) const;
 };
 } // end anonymous namespace
 
@@ -121,21 +120,12 @@ namespace ento {
   template <>
   struct GRStateTrait<RegionState> 
     : public GRStatePartialTrait<RegionStateTy> {
-    static void *GDMIndex() { return MallocChecker::getTag(); }
+    static void *GDMIndex() { static int x; return &x; }
   };
 }
 }
 
-void ento::RegisterMallocChecker(ExprEngine &Eng) {
-  Eng.registerCheck(new MallocChecker());
-}
-
-void *MallocChecker::getTag() {
-  static int x;
-  return &x;
-}
-
-bool MallocChecker::evalCallExpr(CheckerContext &C, const CallExpr *CE) {
+bool MallocChecker::evalCall(const CallExpr *CE, CheckerContext &C) const {
   const GRState *state = C.getState();
   const Expr *Callee = CE->getCallee();
   SVal L = state->getSVal(Callee);
@@ -256,7 +246,7 @@ const GRState *MallocChecker::MallocMemAux(CheckerContext &C,
   return state->set<RegionState>(Sym, RefState::getAllocateUnchecked(CE));
 }
 
-void MallocChecker::FreeMem(CheckerContext &C, const CallExpr *CE) {
+void MallocChecker::FreeMem(CheckerContext &C, const CallExpr *CE) const {
   const GRState *state = FreeMemAux(C, CE, C.getState(), 0, false);
 
   if (state)
@@ -264,7 +254,7 @@ void MallocChecker::FreeMem(CheckerContext &C, const CallExpr *CE) {
 }
 
 void MallocChecker::FreeMemAttr(CheckerContext &C, const CallExpr *CE,
-                                const OwnershipAttr* Att) {
+                                const OwnershipAttr* Att) const {
   if (Att->getModule() != "malloc")
     return;
 
@@ -279,7 +269,7 @@ void MallocChecker::FreeMemAttr(CheckerContext &C, const CallExpr *CE,
 
 const GRState *MallocChecker::FreeMemAux(CheckerContext &C, const CallExpr *CE,
                                          const GRState *state, unsigned Num,
-                                         bool Hold) {
+                                         bool Hold) const {
   const Expr *ArgExpr = CE->getArg(Num);
   SVal ArgVal = state->getSVal(ArgExpr);
 
@@ -357,9 +347,9 @@ const GRState *MallocChecker::FreeMemAux(CheckerContext &C, const CallExpr *CE,
   if (RS->isReleased()) {
     if (ExplodedNode *N = C.generateSink()) {
       if (!BT_DoubleFree)
-        BT_DoubleFree
-          = new BuiltinBug("Double free",
-                         "Try to free a memory block that has been released");
+        BT_DoubleFree.reset(
+          new BuiltinBug("Double free",
+                         "Try to free a memory block that has been released"));
       // FIXME: should find where it's freed last time.
       BugReport *R = new BugReport(*BT_DoubleFree, 
                                    BT_DoubleFree->getDescription(), N);
@@ -463,10 +453,10 @@ bool MallocChecker::SummarizeRegion(llvm::raw_ostream& os,
 }
 
 void MallocChecker::ReportBadFree(CheckerContext &C, SVal ArgVal,
-                                  SourceRange range) {
+                                  SourceRange range) const {
   if (ExplodedNode *N = C.generateSink()) {
     if (!BT_BadFree)
-      BT_BadFree = new BuiltinBug("Bad free");
+      BT_BadFree.reset(new BuiltinBug("Bad free"));
     
     llvm::SmallString<100> buf;
     llvm::raw_svector_ostream os(buf);
@@ -500,7 +490,7 @@ void MallocChecker::ReportBadFree(CheckerContext &C, SVal ArgVal,
   }
 }
 
-void MallocChecker::ReallocMem(CheckerContext &C, const CallExpr *CE) {
+void MallocChecker::ReallocMem(CheckerContext &C, const CallExpr *CE) const {
   const GRState *state = C.getState();
   const Expr *arg0Expr = CE->getArg(0);
   DefinedOrUnknownSVal arg0Val 
@@ -511,8 +501,24 @@ void MallocChecker::ReallocMem(CheckerContext &C, const CallExpr *CE) {
   DefinedOrUnknownSVal PtrEQ =
     svalBuilder.evalEQ(state, arg0Val, svalBuilder.makeNull());
 
-  // If the ptr is NULL, the call is equivalent to malloc(size).
-  if (const GRState *stateEqual = state->assume(PtrEQ, true)) {
+  // Get the size argument. If there is no size arg then give up.
+  const Expr *Arg1 = CE->getArg(1);
+  if (!Arg1)
+    return;
+
+  // Get the value of the size argument.
+  DefinedOrUnknownSVal Arg1Val = 
+    cast<DefinedOrUnknownSVal>(state->getSVal(Arg1));
+
+  // Compare the size argument to 0.
+  DefinedOrUnknownSVal SizeZero =
+    svalBuilder.evalEQ(state, Arg1Val,
+                       svalBuilder.makeIntValWithPtrWidth(0, false));
+
+  // If the ptr is NULL and the size is not 0, the call is equivalent to 
+  // malloc(size).
+  const GRState *stateEqual = state->assume(PtrEQ, true);
+  if (stateEqual && state->assume(SizeZero, false)) {
     // Hack: set the NULL symbolic region to released to suppress false warning.
     // In the future we should add more states for allocated regions, e.g., 
     // CheckedNull, CheckedNonNull.
@@ -527,17 +533,17 @@ void MallocChecker::ReallocMem(CheckerContext &C, const CallExpr *CE) {
   }
 
   if (const GRState *stateNotEqual = state->assume(PtrEQ, false)) {
-    const Expr *Arg1 = CE->getArg(1);
-    DefinedOrUnknownSVal Arg1Val = 
-      cast<DefinedOrUnknownSVal>(stateNotEqual->getSVal(Arg1));
-    DefinedOrUnknownSVal SizeZero =
-      svalBuilder.evalEQ(stateNotEqual, Arg1Val,
-                         svalBuilder.makeIntValWithPtrWidth(0, false));
-
+    // If the size is 0, free the memory.
     if (const GRState *stateSizeZero = stateNotEqual->assume(SizeZero, true))
-      if (const GRState *stateFree = FreeMemAux(C, CE, stateSizeZero, 0, false))
-        C.addTransition(stateFree->BindExpr(CE, UndefinedVal(), true));
+      if (const GRState *stateFree = 
+          FreeMemAux(C, CE, stateSizeZero, 0, false)) {
+
+        // Add the state transition to set input pointer argument to be free.
+        C.addTransition(stateFree);
 
+        // Bind the return value to UndefinedVal because it is now free.
+        C.addTransition(stateFree->BindExpr(CE, UndefinedVal(), true));
+      }
     if (const GRState *stateSizeNotZero = stateNotEqual->assume(SizeZero,false))
       if (const GRState *stateFree = FreeMemAux(C, CE, stateSizeNotZero,
                                                 0, false)) {
@@ -562,7 +568,8 @@ void MallocChecker::CallocMem(CheckerContext &C, const CallExpr *CE) {
   C.addTransition(MallocMemAux(C, CE, TotalSize, zeroVal, state));
 }
 
-void MallocChecker::evalDeadSymbols(CheckerContext &C, SymbolReaper &SymReaper)
+void MallocChecker::checkDeadSymbols(SymbolReaper &SymReaper,
+                                     CheckerContext &C) const
 {
   if (!SymReaper.hasDeadSymbols())
     return;
@@ -576,8 +583,8 @@ void MallocChecker::evalDeadSymbols(CheckerContext &C, SymbolReaper &SymReaper)
       if (I->second.isAllocated()) {
         if (ExplodedNode *N = C.generateNode()) {
           if (!BT_Leak)
-            BT_Leak = new BuiltinBug("Memory leak",
-                     "Allocated memory never released. Potential memory leak.");
+            BT_Leak.reset(new BuiltinBug("Memory leak",
+                    "Allocated memory never released. Potential memory leak."));
           // FIXME: where it is allocated.
           BugReport *R = new BugReport(*BT_Leak, BT_Leak->getDescription(), N);
           C.EmitReport(R);
@@ -591,8 +598,8 @@ void MallocChecker::evalDeadSymbols(CheckerContext &C, SymbolReaper &SymReaper)
   C.generateNode(state->set<RegionState>(RS));
 }
 
-void MallocChecker::evalEndPath(EndOfFunctionNodeBuilder &B, void *tag,
-                                ExprEngine &Eng) {
+void MallocChecker::checkEndPath(EndOfFunctionNodeBuilder &B,
+                                 ExprEngine &Eng) const {
   const GRState *state = B.getState();
   RegionStateTy M = state->get<RegionState>();
 
@@ -602,8 +609,8 @@ void MallocChecker::evalEndPath(EndOfFunctionNodeBuilder &B, void *tag,
       ExplodedNode *N = B.generateNode(state);
       if (N) {
         if (!BT_Leak)
-          BT_Leak = new BuiltinBug("Memory leak",
-                     "Allocated memory never released. Potential memory leak.");
+          BT_Leak.reset(new BuiltinBug("Memory leak",
+                    "Allocated memory never released. Potential memory leak."));
         BugReport *R = new BugReport(*BT_Leak, BT_Leak->getDescription(), N);
         Eng.getBugReporter().EmitReport(R);
       }
@@ -611,7 +618,7 @@ void MallocChecker::evalEndPath(EndOfFunctionNodeBuilder &B, void *tag,
   }
 }
 
-void MallocChecker::PreVisitReturnStmt(CheckerContext &C, const ReturnStmt *S) {
+void MallocChecker::checkPreStmt(const ReturnStmt *S, CheckerContext &C) const {
   const Expr *retExpr = S->getRetValue();
   if (!retExpr)
     return;
@@ -634,14 +641,14 @@ void MallocChecker::PreVisitReturnStmt(CheckerContext &C, const ReturnStmt *S) {
 }
 
 const GRState *MallocChecker::evalAssume(const GRState *state, SVal Cond, 
-                                         bool Assumption,
-                                         bool * /* respondsToCallback */) {
+                                         bool Assumption) const {
   // If a symblic region is assumed to NULL, set its state to AllocateFailed.
   // FIXME: should also check symbols assumed to non-null.
 
   RegionStateTy RS = state->get<RegionState>();
 
   for (RegionStateTy::iterator I = RS.begin(), E = RS.end(); I != E; ++I) {
+    // If the symbol is assumed to NULL, this will return an APSInt*.
     if (state->getSymVal(I.getKey()))
       state = state->set<RegionState>(I.getKey(),RefState::getAllocateFailed());
   }
@@ -650,16 +657,15 @@ const GRState *MallocChecker::evalAssume(const GRState *state, SVal Cond,
 }
 
 // Check if the location is a freed symbolic region.
-void MallocChecker::visitLocation(CheckerContext &C, const Stmt *S, SVal l,
-                                  bool isLoad) {
+void MallocChecker::checkLocation(SVal l, bool isLoad,CheckerContext &C) const {
   SymbolRef Sym = l.getLocSymbolInBase();
   if (Sym) {
     const RefState *RS = C.getState()->get<RegionState>(Sym);
     if (RS && RS->isReleased()) {
       if (ExplodedNode *N = C.generateNode()) {
         if (!BT_UseFree)
-          BT_UseFree = new BuiltinBug("Use dynamically allocated memory after"
-                                      " it is freed.");
+          BT_UseFree.reset(new BuiltinBug("Use dynamically allocated memory "
+                                          "after it is freed."));
 
         BugReport *R = new BugReport(*BT_UseFree, BT_UseFree->getDescription(),
                                      N);
@@ -669,10 +675,7 @@ void MallocChecker::visitLocation(CheckerContext &C, const Stmt *S, SVal l,
   }
 }
 
-void MallocChecker::PreVisitBind(CheckerContext &C,
-                                 const Stmt *StoreE,
-                                 SVal location,
-                                 SVal val) {
+void MallocChecker::checkBind(SVal location, SVal val,CheckerContext &C) const {
   // The PreVisitBind implements the same algorithm as already used by the 
   // Objective C ownership checker: if the pointer escaped from this scope by 
   // assignment, let it go.  However, assigning to fields of a stack-storage 
@@ -721,7 +724,7 @@ void MallocChecker::PreVisitBind(CheckerContext &C,
           // We no longer own this pointer.
           notNullState =
             notNullState->set<RegionState>(Sym,
-                                           RefState::getRelinquished(StoreE));
+                                        RefState::getRelinquished(C.getStmt()));
         }
         while (false);
       }
@@ -729,3 +732,7 @@ void MallocChecker::PreVisitBind(CheckerContext &C,
     }
   }
 }
+
+void ento::registerMallocChecker(CheckerManager &mgr) {
+  mgr.registerChecker<MallocChecker>();
+}
diff --git a/lib/StaticAnalyzer/Checkers/NSAutoreleasePoolChecker.cpp b/lib/StaticAnalyzer/Checkers/NSAutoreleasePoolChecker.cpp
index fed6a99..f11db64 100644
--- a/lib/StaticAnalyzer/Checkers/NSAutoreleasePoolChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/NSAutoreleasePoolChecker.cpp
@@ -16,7 +16,7 @@
 //===----------------------------------------------------------------------===//
 
 #include "ClangSACheckers.h"
-#include "clang/StaticAnalyzer/Core/CheckerV2.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
@@ -29,7 +29,7 @@ using namespace ento;
 
 namespace {
 class NSAutoreleasePoolChecker
-  : public CheckerV2<check::PreObjCMessage> {
+  : public Checker<check::PreObjCMessage> {
       
   mutable Selector releaseS;
 
diff --git a/lib/StaticAnalyzer/Checkers/NSErrorChecker.cpp b/lib/StaticAnalyzer/Checkers/NSErrorChecker.cpp
index 7a1b978..63a5917 100644
--- a/lib/StaticAnalyzer/Checkers/NSErrorChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/NSErrorChecker.cpp
@@ -1,4 +1,4 @@
-//=- NSErrorCheckerer.cpp - Coding conventions for uses of NSError -*- C++ -*-==//
+//=- NSErrorChecker.cpp - Coding conventions for uses of NSError -*- C++ -*-==//
 //
 //                     The LLVM Compiler Infrastructure
 //
@@ -15,11 +15,12 @@
 //
 //===----------------------------------------------------------------------===//
 
-#include "clang/StaticAnalyzer/Checkers/LocalCheckers.h"
+#include "ClangSACheckers.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
+#include "clang/StaticAnalyzer/Core/CheckerManager.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/GRStateTrait.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
-#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
-#include "clang/StaticAnalyzer/Checkers/DereferenceChecker.h"
-#include "BasicObjCFoundationChecks.h"
 #include "clang/AST/DeclObjC.h"
 #include "clang/AST/Decl.h"
 #include "llvm/ADT/SmallVector.h"
@@ -27,142 +28,263 @@
 using namespace clang;
 using namespace ento;
 
-namespace {
-class NSErrorChecker : public BugType {
-  const Decl &CodeDecl;
-  const bool isNSErrorWarning;
-  IdentifierInfo * const II;
-  ExprEngine &Eng;
+static bool IsNSError(QualType T, IdentifierInfo *II);
+static bool IsCFError(QualType T, IdentifierInfo *II);
 
-  void CheckSignature(const ObjCMethodDecl& MD, QualType& ResultTy,
-                      llvm::SmallVectorImpl<VarDecl*>& ErrorParams);
+//===----------------------------------------------------------------------===//
+// NSErrorMethodChecker
+//===----------------------------------------------------------------------===//
 
-  void CheckSignature(const FunctionDecl& MD, QualType& ResultTy,
-                      llvm::SmallVectorImpl<VarDecl*>& ErrorParams);
+namespace {
+class NSErrorMethodChecker
+    : public Checker< check::ASTDecl<ObjCMethodDecl> > {
+  mutable IdentifierInfo *II;
 
-  bool CheckNSErrorArgument(QualType ArgTy);
-  bool CheckCFErrorArgument(QualType ArgTy);
+public:
+  NSErrorMethodChecker() : II(0) { }
 
-  void CheckParamDeref(const VarDecl *V, const LocationContext *LC,
-                       const GRState *state, BugReporter& BR);
+  void checkASTDecl(const ObjCMethodDecl *D,
+                    AnalysisManager &mgr, BugReporter &BR) const;
+};
+}
 
-  void EmitRetTyWarning(BugReporter& BR, const Decl& CodeDecl);
+void NSErrorMethodChecker::checkASTDecl(const ObjCMethodDecl *D,
+                                        AnalysisManager &mgr,
+                                        BugReporter &BR) const {
+  if (!D->isThisDeclarationADefinition())
+    return;
+  if (!D->getResultType()->isVoidType())
+    return;
 
-public:
-  NSErrorChecker(const Decl &D, bool isNSError, ExprEngine& eng)
-    : BugType(isNSError ? "NSError** null dereference"
-                        : "CFErrorRef* null dereference",
-              "Coding conventions (Apple)"),
-    CodeDecl(D),
-    isNSErrorWarning(isNSError),
-    II(&eng.getContext().Idents.get(isNSErrorWarning ? "NSError":"CFErrorRef")),
-    Eng(eng) {}
-
-  void FlushReports(BugReporter& BR);
-};
+  if (!II)
+    II = &D->getASTContext().Idents.get("NSError"); 
 
-} // end anonymous namespace
+  bool hasNSError = false;
+  for (ObjCMethodDecl::param_iterator
+         I = D->param_begin(), E = D->param_end(); I != E; ++I)  {
+    if (IsNSError((*I)->getType(), II)) {
+      hasNSError = true;
+      break;
+    }
+  }
 
-void ento::RegisterNSErrorChecks(BugReporter& BR, ExprEngine &Eng,
-                                  const Decl &D) {
-  BR.Register(new NSErrorChecker(D, true, Eng));
-  BR.Register(new NSErrorChecker(D, false, Eng));
+  if (hasNSError) {
+    const char *err = "Method accepting NSError** "
+        "should have a non-void return value to indicate whether or not an "
+        "error occurred";
+    BR.EmitBasicReport("Bad return type when passing NSError**",
+                       "Coding conventions (Apple)", err, D->getLocation());
+  }
 }
 
-void NSErrorChecker::FlushReports(BugReporter& BR) {
-  // Get the analysis engine and the exploded analysis graph.
-  ExplodedGraph& G = Eng.getGraph();
+//===----------------------------------------------------------------------===//
+// CFErrorFunctionChecker
+//===----------------------------------------------------------------------===//
 
-  // Get the ASTContext, which is useful for querying type information.
-  ASTContext &Ctx = BR.getContext();
+namespace {
+class CFErrorFunctionChecker
+    : public Checker< check::ASTDecl<FunctionDecl> > {
+  mutable IdentifierInfo *II;
 
-  QualType ResultTy;
-  llvm::SmallVector<VarDecl*, 5> ErrorParams;
+public:
+  CFErrorFunctionChecker() : II(0) { }
 
-  if (const ObjCMethodDecl* MD = dyn_cast<ObjCMethodDecl>(&CodeDecl))
-    CheckSignature(*MD, ResultTy, ErrorParams);
-  else if (const FunctionDecl* FD = dyn_cast<FunctionDecl>(&CodeDecl))
-    CheckSignature(*FD, ResultTy, ErrorParams);
-  else
-    return;
+  void checkASTDecl(const FunctionDecl *D,
+                    AnalysisManager &mgr, BugReporter &BR) const;
+};
+}
 
-  if (ErrorParams.empty())
+void CFErrorFunctionChecker::checkASTDecl(const FunctionDecl *D,
+                                        AnalysisManager &mgr,
+                                        BugReporter &BR) const {
+  if (!D->isThisDeclarationADefinition())
     return;
+  if (!D->getResultType()->isVoidType())
+    return;
+
+  if (!II)
+    II = &D->getASTContext().Idents.get("CFErrorRef"); 
 
-  if (ResultTy == Ctx.VoidTy) EmitRetTyWarning(BR, CodeDecl);
+  bool hasCFError = false;
+  for (FunctionDecl::param_const_iterator
+         I = D->param_begin(), E = D->param_end(); I != E; ++I)  {
+    if (IsCFError((*I)->getType(), II)) {
+      hasCFError = true;
+      break;
+    }
+  }
 
-  for (ExplodedGraph::roots_iterator RI=G.roots_begin(), RE=G.roots_end();
-       RI!=RE; ++RI) {
-    // Scan the parameters for an implicit null dereference.
-    for (llvm::SmallVectorImpl<VarDecl*>::iterator I=ErrorParams.begin(),
-          E=ErrorParams.end(); I!=E; ++I)
-        CheckParamDeref(*I, (*RI)->getLocationContext(), (*RI)->getState(), BR);
+  if (hasCFError) {
+    const char *err = "Function accepting CFErrorRef* "
+        "should have a non-void return value to indicate whether or not an "
+        "error occurred";
+    BR.EmitBasicReport("Bad return type when passing CFErrorRef*",
+                       "Coding conventions (Apple)", err, D->getLocation());
   }
 }
 
-void NSErrorChecker::EmitRetTyWarning(BugReporter& BR, const Decl& CodeDecl) {
-  std::string sbuf;
-  llvm::raw_string_ostream os(sbuf);
+//===----------------------------------------------------------------------===//
+// NSOrCFErrorDerefChecker
+//===----------------------------------------------------------------------===//
 
-  if (isa<ObjCMethodDecl>(CodeDecl))
-    os << "Method";
-  else
-    os << "Function";
+namespace {
 
-  os << " accepting ";
-  os << (isNSErrorWarning ? "NSError**" : "CFErrorRef*");
-  os << " should have a non-void return value to indicate whether or not an "
-        "error occurred";
+class NSErrorDerefBug : public BugType {
+public:
+  NSErrorDerefBug() : BugType("NSError** null dereference",
+                              "Coding conventions (Apple)") {}
+};
+
+class CFErrorDerefBug : public BugType {
+public:
+  CFErrorDerefBug() : BugType("CFErrorRef* null dereference",
+                              "Coding conventions (Apple)") {}
+};
 
-  BR.EmitBasicReport(isNSErrorWarning
-                     ? "Bad return type when passing NSError**"
-                     : "Bad return type when passing CFError*",
-                     getCategory(), os.str(),
-                     CodeDecl.getLocation());
 }
 
-void
-NSErrorChecker::CheckSignature(const ObjCMethodDecl& M, QualType& ResultTy,
-                             llvm::SmallVectorImpl<VarDecl*>& ErrorParams) {
+namespace {
+class NSOrCFErrorDerefChecker
+    : public Checker< check::Location,
+                        check::Event<ImplicitNullDerefEvent> > {
+  mutable IdentifierInfo *NSErrorII, *CFErrorII;
+public:
+  bool ShouldCheckNSError, ShouldCheckCFError;
+  NSOrCFErrorDerefChecker() : NSErrorII(0), CFErrorII(0),
+                              ShouldCheckNSError(0), ShouldCheckCFError(0) { }
+
+  void checkLocation(SVal loc, bool isLoad, CheckerContext &C) const;
+  void checkEvent(ImplicitNullDerefEvent event) const;
+};
+}
 
-  ResultTy = M.getResultType();
+namespace { struct NSErrorOut {}; }
+namespace { struct CFErrorOut {}; }
+
+typedef llvm::ImmutableMap<SymbolRef, unsigned> ErrorOutFlag;
+
+namespace clang {
+namespace ento {
+  template <>
+  struct GRStateTrait<NSErrorOut> : public GRStatePartialTrait<ErrorOutFlag> {  
+    static void *GDMIndex() { static int index = 0; return &index; }
+  };
+  template <>
+  struct GRStateTrait<CFErrorOut> : public GRStatePartialTrait<ErrorOutFlag> {  
+    static void *GDMIndex() { static int index = 0; return &index; }
+  };
+}
+}
 
-  for (ObjCMethodDecl::param_iterator I=M.param_begin(),
-       E=M.param_end(); I!=E; ++I)  {
+template <typename T>
+static bool hasFlag(SVal val, const GRState *state) {
+  if (SymbolRef sym = val.getAsSymbol())
+    if (const unsigned *attachedFlags = state->get<T>(sym))
+      return *attachedFlags;
+  return false;
+}
 
-    QualType T = (*I)->getType();
+template <typename T>
+static void setFlag(const GRState *state, SVal val, CheckerContext &C) {
+  // We tag the symbol that the SVal wraps.
+  if (SymbolRef sym = val.getAsSymbol())
+    C.addTransition(state->set<T>(sym, true));
+}
 
-    if (isNSErrorWarning) {
-      if (CheckNSErrorArgument(T)) ErrorParams.push_back(*I);
-    }
-    else if (CheckCFErrorArgument(T))
-      ErrorParams.push_back(*I);
+static QualType parameterTypeFromSVal(SVal val, CheckerContext &C) {
+  const StackFrameContext *
+    SFC = C.getPredecessor()->getLocationContext()->getCurrentStackFrame();
+  if (const loc::MemRegionVal* X = dyn_cast<loc::MemRegionVal>(&val)) {
+    const MemRegion* R = X->getRegion();
+    if (const VarRegion *VR = R->getAs<VarRegion>())
+      if (const StackArgumentsSpaceRegion *
+          stackReg = dyn_cast<StackArgumentsSpaceRegion>(VR->getMemorySpace()))
+        if (stackReg->getStackFrame() == SFC)
+          return VR->getValueType();
   }
+
+  return QualType();
 }
 
-void
-NSErrorChecker::CheckSignature(const FunctionDecl& F, QualType& ResultTy,
-                             llvm::SmallVectorImpl<VarDecl*>& ErrorParams) {
+void NSOrCFErrorDerefChecker::checkLocation(SVal loc, bool isLoad,
+                                            CheckerContext &C) const {
+  if (!isLoad)
+    return;
+  if (loc.isUndef() || !isa<Loc>(loc))
+    return;
 
-  ResultTy = F.getResultType();
+  ASTContext &Ctx = C.getASTContext();
+  const GRState *state = C.getState();
 
-  for (FunctionDecl::param_const_iterator I = F.param_begin(),
-                                          E = F.param_end(); I != E; ++I)  {
+  // If we are loading from NSError**/CFErrorRef* parameter, mark the resulting
+  // SVal so that we can later check it when handling the
+  // ImplicitNullDerefEvent event.
+  // FIXME: Cumbersome! Maybe add hook at construction of SVals at start of
+  // function ?
 
-    QualType T = (*I)->getType();
+  QualType parmT = parameterTypeFromSVal(loc, C);
+  if (parmT.isNull())
+    return;
 
-    if (isNSErrorWarning) {
-      if (CheckNSErrorArgument(T)) ErrorParams.push_back(*I);
-    }
-    else if (CheckCFErrorArgument(T))
-      ErrorParams.push_back(*I);
+  if (!NSErrorII)
+    NSErrorII = &Ctx.Idents.get("NSError");
+  if (!CFErrorII)
+    CFErrorII = &Ctx.Idents.get("CFErrorRef");
+
+  if (ShouldCheckNSError && IsNSError(parmT, NSErrorII)) {
+    setFlag<NSErrorOut>(state, state->getSVal(cast<Loc>(loc)), C);
+    return;
+  }
+
+  if (ShouldCheckCFError && IsCFError(parmT, CFErrorII)) {
+    setFlag<CFErrorOut>(state, state->getSVal(cast<Loc>(loc)), C);
+    return;
   }
 }
 
+void NSOrCFErrorDerefChecker::checkEvent(ImplicitNullDerefEvent event) const {
+  if (event.IsLoad)
+    return;
+
+  SVal loc = event.Location;
+  const GRState *state = event.SinkNode->getState();
+  BugReporter &BR = *event.BR;
+
+  bool isNSError = hasFlag<NSErrorOut>(loc, state);
+  bool isCFError = false;
+  if (!isNSError)
+    isCFError = hasFlag<CFErrorOut>(loc, state);
+
+  if (!(isNSError || isCFError))
+    return;
 
-bool NSErrorChecker::CheckNSErrorArgument(QualType ArgTy) {
+  // Storing to possible null NSError/CFErrorRef out parameter.
 
-  const PointerType* PPT = ArgTy->getAs<PointerType>();
+  // Emit an error.
+  std::string err;
+  llvm::raw_string_ostream os(err);
+    os << "Potential null dereference.  According to coding standards ";
+
+  if (isNSError)
+    os << "in 'Creating and Returning NSError Objects' the parameter '";
+  else
+    os << "documented in CoreFoundation/CFError.h the parameter '";
+
+  os  << "' may be null.";
+
+  BugType *bug = 0;
+  if (isNSError)
+    bug = new NSErrorDerefBug();
+  else
+    bug = new CFErrorDerefBug();
+  EnhancedBugReport *report = new EnhancedBugReport(*bug, os.str(),
+                                                    event.SinkNode);
+  BR.EmitReport(report);
+}
+
+static bool IsNSError(QualType T, IdentifierInfo *II) {
+
+  const PointerType* PPT = T->getAs<PointerType>();
   if (!PPT)
     return false;
 
@@ -181,9 +303,8 @@ bool NSErrorChecker::CheckNSErrorArgument(QualType ArgTy) {
   return false;
 }
 
-bool NSErrorChecker::CheckCFErrorArgument(QualType ArgTy) {
-
-  const PointerType* PPT = ArgTy->getAs<PointerType>();
+static bool IsCFError(QualType T, IdentifierInfo *II) {
+  const PointerType* PPT = T->getAs<PointerType>();
   if (!PPT) return false;
 
   const TypedefType* TT = PPT->getPointeeType()->getAs<TypedefType>();
@@ -192,47 +313,16 @@ bool NSErrorChecker::CheckCFErrorArgument(QualType ArgTy) {
   return TT->getDecl()->getIdentifier() == II;
 }
 
-void NSErrorChecker::CheckParamDeref(const VarDecl *Param,
-                                   const LocationContext *LC,
-                                   const GRState *rootState,
-                                   BugReporter& BR) {
-
-  SVal ParamL = rootState->getLValue(Param, LC);
-  const MemRegion* ParamR = cast<loc::MemRegionVal>(ParamL).getRegionAs<VarRegion>();
-  assert (ParamR && "Parameters always have VarRegions.");
-  SVal ParamSVal = rootState->getSVal(ParamR);
-
-  // FIXME: For now assume that ParamSVal is symbolic.  We need to generalize
-  // this later.
-  SymbolRef ParamSym = ParamSVal.getAsLocSymbol();
-  if (!ParamSym)
-    return;
+void ento::registerNSErrorChecker(CheckerManager &mgr) {
+  mgr.registerChecker<NSErrorMethodChecker>();
+  NSOrCFErrorDerefChecker *
+    checker = mgr.registerChecker<NSOrCFErrorDerefChecker>();
+  checker->ShouldCheckNSError = true;
+}
 
-  // Iterate over the implicit-null dereferences.
-  ExplodedNode *const* I,  *const* E;
-  llvm::tie(I, E) = GetImplicitNullDereferences(Eng);
-  for ( ; I != E; ++I) {
-    const GRState *state = (*I)->getState();
-    SVal location = state->getSVal((*I)->getLocationAs<StmtPoint>()->getStmt());
-    if (location.getAsSymbol() != ParamSym)
-      continue;
-
-    // Emit an error.
-    std::string sbuf;
-    llvm::raw_string_ostream os(sbuf);
-      os << "Potential null dereference.  According to coding standards ";
-
-    if (isNSErrorWarning)
-      os << "in 'Creating and Returning NSError Objects' the parameter '";
-    else
-      os << "documented in CoreFoundation/CFError.h the parameter '";
-
-    os << Param << "' may be null.";
-
-    BugReport *report = new BugReport(*this, os.str(), *I);
-    // FIXME: Notable symbols are now part of the report.  We should
-    //  add support for notable symbols in BugReport.
-    //    BR.addNotableSymbol(SV->getSymbol());
-    BR.EmitReport(report);
-  }
+void ento::registerCFErrorChecker(CheckerManager &mgr) {
+  mgr.registerChecker<CFErrorFunctionChecker>();
+  NSOrCFErrorDerefChecker *
+    checker = mgr.registerChecker<NSOrCFErrorDerefChecker>();
+  checker->ShouldCheckCFError = true;
 }
diff --git a/lib/StaticAnalyzer/Checkers/NoReturnFunctionChecker.cpp b/lib/StaticAnalyzer/Checkers/NoReturnFunctionChecker.cpp
index 40040ea..2d0af9c 100644
--- a/lib/StaticAnalyzer/Checkers/NoReturnFunctionChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/NoReturnFunctionChecker.cpp
@@ -12,8 +12,10 @@
 //
 //===----------------------------------------------------------------------===//
 
-#include "InternalChecks.h"
-#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerVisitor.h"
+#include "ClangSACheckers.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
+#include "clang/StaticAnalyzer/Core/CheckerManager.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "llvm/ADT/StringSwitch.h"
 
 using namespace clang;
@@ -21,20 +23,15 @@ using namespace ento;
 
 namespace {
 
-class NoReturnFunctionChecker : public CheckerVisitor<NoReturnFunctionChecker> {
+class NoReturnFunctionChecker : public Checker< check::PostStmt<CallExpr> > {
 public:
-  static void *getTag() { static int tag = 0; return &tag; }
-  void PostVisitCallExpr(CheckerContext &C, const CallExpr *CE);
+  void checkPostStmt(const CallExpr *CE, CheckerContext &C) const;
 };
 
 }
 
-void ento::RegisterNoReturnFunctionChecker(ExprEngine &Eng) {
-  Eng.registerCheck(new NoReturnFunctionChecker());
-}
-
-void NoReturnFunctionChecker::PostVisitCallExpr(CheckerContext &C,
-                                                const CallExpr *CE) {
+void NoReturnFunctionChecker::checkPostStmt(const CallExpr *CE,
+                                            CheckerContext &C) const {
   const GRState *state = C.getState();
   const Expr *Callee = CE->getCallee();
 
@@ -78,3 +75,7 @@ void NoReturnFunctionChecker::PostVisitCallExpr(CheckerContext &C,
   if (BuildSinks)
     C.generateSink(CE);
 }
+
+void ento::registerNoReturnFunctionChecker(CheckerManager &mgr) {
+  mgr.registerChecker<NoReturnFunctionChecker>();
+}
diff --git a/lib/StaticAnalyzer/Checkers/OSAtomicChecker.cpp b/lib/StaticAnalyzer/Checkers/OSAtomicChecker.cpp
index e1126b6..7262bc3 100644
--- a/lib/StaticAnalyzer/Checkers/OSAtomicChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/OSAtomicChecker.cpp
@@ -11,8 +11,10 @@
 //
 //===----------------------------------------------------------------------===//
 
-#include "InternalChecks.h"
-#include "clang/StaticAnalyzer/Core/PathSensitive/Checker.h"
+#include "ClangSACheckers.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
+#include "clang/StaticAnalyzer/Core/CheckerManager.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/Basic/Builtins.h"
 
 using namespace clang;
@@ -20,22 +22,17 @@ using namespace ento;
 
 namespace {
 
-class OSAtomicChecker : public Checker {
+class OSAtomicChecker : public Checker<eval::Call> {
 public:
-  static void *getTag() { static int tag = 0; return &tag; }
-  virtual bool evalCallExpr(CheckerContext &C, const CallExpr *CE);
+  bool evalCall(const CallExpr *CE, CheckerContext &C) const;
 
 private:
-  bool evalOSAtomicCompareAndSwap(CheckerContext &C, const CallExpr *CE);
+  static bool evalOSAtomicCompareAndSwap(CheckerContext &C, const CallExpr *CE);
 };
 
 }
 
-void ento::RegisterOSAtomicChecker(ExprEngine &Eng) {
-  Eng.registerCheck(new OSAtomicChecker());
-}
-
-bool OSAtomicChecker::evalCallExpr(CheckerContext &C,const CallExpr *CE) {
+bool OSAtomicChecker::evalCall(const CallExpr *CE, CheckerContext &C) const {
   const GRState *state = C.getState();
   const Expr *Callee = CE->getCallee();
   SVal L = state->getSVal(Callee);
@@ -130,7 +127,12 @@ bool OSAtomicChecker::evalOSAtomicCompareAndSwap(CheckerContext &C,
 
     ExplodedNode *N = *I;
     const GRState *stateLoad = N->getState();
-    SVal theValueVal_untested = stateLoad->getSVal(theValueExpr);
+
+    // Use direct bindings from the environment since we are forcing a load
+    // from a location that the Environment would typically not be used
+    // to bind a value.
+    SVal theValueVal_untested = stateLoad->getSVal(theValueExpr, true);
+
     SVal oldValueVal_untested = stateLoad->getSVal(oldValueExpr);
 
     // FIXME: Issue an error.
@@ -201,3 +203,7 @@ bool OSAtomicChecker::evalOSAtomicCompareAndSwap(CheckerContext &C,
 
   return true;
 }
+
+void ento::registerOSAtomicChecker(CheckerManager &mgr) {
+  mgr.registerChecker<OSAtomicChecker>();
+}
diff --git a/lib/StaticAnalyzer/Checkers/ObjCAtSyncChecker.cpp b/lib/StaticAnalyzer/Checkers/ObjCAtSyncChecker.cpp
index 7746719..a118049 100644
--- a/lib/StaticAnalyzer/Checkers/ObjCAtSyncChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/ObjCAtSyncChecker.cpp
@@ -13,7 +13,7 @@
 //===----------------------------------------------------------------------===//
 
 #include "ClangSACheckers.h"
-#include "clang/StaticAnalyzer/Core/CheckerV2.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
@@ -25,7 +25,7 @@ using namespace ento;
 
 namespace {
 class ObjCAtSyncChecker
-    : public CheckerV2< check::PreStmt<ObjCAtSynchronizedStmt> > {
+    : public Checker< check::PreStmt<ObjCAtSynchronizedStmt> > {
   mutable llvm::OwningPtr<BuiltinBug> BT_null;
   mutable llvm::OwningPtr<BuiltinBug> BT_undef;
 
diff --git a/lib/StaticAnalyzer/Checkers/ObjCSelfInitChecker.cpp b/lib/StaticAnalyzer/Checkers/ObjCSelfInitChecker.cpp
index 5f32bb8..4c05867 100644
--- a/lib/StaticAnalyzer/Checkers/ObjCSelfInitChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/ObjCSelfInitChecker.cpp
@@ -16,7 +16,7 @@
 // result of an initialization call (e.g. [super init], or [self initWith..])
 // before using 'self' or any instance variable.
 //
-// To perform the required checking, values are tagged wih flags that indicate
+// To perform the required checking, values are tagged with flags that indicate
 // 1) if the object is the one pointed to by 'self', and 2) if the object
 // is the result of an initializer (e.g. [super init]).
 //
@@ -47,12 +47,11 @@
 // http://developer.apple.com/library/mac/#documentation/Cocoa/Conceptual/ObjectiveC/Articles/ocAllocInit.html
 
 #include "ClangSACheckers.h"
-#include "clang/StaticAnalyzer/Core/CheckerV2.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/GRStateTrait.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
-#include "clang/Analysis/DomainSpecific/CocoaConventions.h"
 #include "clang/AST/ParentMap.h"
 
 using namespace clang;
@@ -64,7 +63,7 @@ static bool isInitMessage(const ObjCMessage &msg);
 static bool isSelfVar(SVal location, CheckerContext &C);
 
 namespace {
-class ObjCSelfInitChecker : public CheckerV2<
+class ObjCSelfInitChecker : public Checker<
                                              check::PostObjCMessage,
                                              check::PostStmt<ObjCIvarRefExpr>,
                                              check::PreStmt<ReturnStmt>,
@@ -347,15 +346,11 @@ static bool isSelfVar(SVal location, CheckerContext &C) {
 }
 
 static bool isInitializationMethod(const ObjCMethodDecl *MD) {
-  // Init methods with prefix like '-(id)_init' are private and the requirements
-  // are less strict so we don't check those.
-  return MD->isInstanceMethod() &&
-      cocoa::deriveNamingConvention(MD->getSelector(),
-                                    /*ignorePrefix=*/false) == cocoa::InitRule;
+  return MD->getMethodFamily() == OMF_init;
 }
 
 static bool isInitMessage(const ObjCMessage &msg) {
-  return cocoa::deriveNamingConvention(msg.getSelector()) == cocoa::InitRule;
+  return msg.getMethodFamily() == OMF_init;
 }
 
 //===----------------------------------------------------------------------===//
diff --git a/lib/StaticAnalyzer/Checkers/ObjCUnusedIVarsChecker.cpp b/lib/StaticAnalyzer/Checkers/ObjCUnusedIVarsChecker.cpp
index 6e92498..d78e5ce 100644
--- a/lib/StaticAnalyzer/Checkers/ObjCUnusedIVarsChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/ObjCUnusedIVarsChecker.cpp
@@ -14,7 +14,7 @@
 //===----------------------------------------------------------------------===//
 
 #include "ClangSACheckers.h"
-#include "clang/StaticAnalyzer/Core/CheckerV2.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/PathDiagnostic.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
 #include "clang/AST/ExprObjC.h"
@@ -169,7 +169,7 @@ static void checkObjCUnusedIvar(const ObjCImplementationDecl *D,
 //===----------------------------------------------------------------------===//
 
 namespace {
-class ObjCUnusedIvarsChecker : public CheckerV2<
+class ObjCUnusedIvarsChecker : public Checker<
                                       check::ASTDecl<ObjCImplementationDecl> > {
 public:
   void checkASTDecl(const ObjCImplementationDecl *D, AnalysisManager& mgr,
diff --git a/lib/StaticAnalyzer/Checkers/PointerArithChecker.cpp b/lib/StaticAnalyzer/Checkers/PointerArithChecker.cpp
index 034a2aa..7c21acc 100644
--- a/lib/StaticAnalyzer/Checkers/PointerArithChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/PointerArithChecker.cpp
@@ -13,7 +13,7 @@
 //===----------------------------------------------------------------------===//
 
 #include "ClangSACheckers.h"
-#include "clang/StaticAnalyzer/Core/CheckerV2.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
@@ -23,7 +23,7 @@ using namespace ento;
 
 namespace {
 class PointerArithChecker 
-  : public CheckerV2< check::PreStmt<BinaryOperator> > {
+  : public Checker< check::PreStmt<BinaryOperator> > {
   mutable llvm::OwningPtr<BuiltinBug> BT;
 
 public:
diff --git a/lib/StaticAnalyzer/Checkers/PointerSubChecker.cpp b/lib/StaticAnalyzer/Checkers/PointerSubChecker.cpp
index bf85b95..16ede20 100644
--- a/lib/StaticAnalyzer/Checkers/PointerSubChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/PointerSubChecker.cpp
@@ -14,7 +14,7 @@
 //===----------------------------------------------------------------------===//
 
 #include "ClangSACheckers.h"
-#include "clang/StaticAnalyzer/Core/CheckerV2.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
@@ -24,7 +24,7 @@ using namespace ento;
 
 namespace {
 class PointerSubChecker 
-  : public CheckerV2< check::PreStmt<BinaryOperator> > {
+  : public Checker< check::PreStmt<BinaryOperator> > {
   mutable llvm::OwningPtr<BuiltinBug> BT;
 
 public:
diff --git a/lib/StaticAnalyzer/Checkers/PthreadLockChecker.cpp b/lib/StaticAnalyzer/Checkers/PthreadLockChecker.cpp
index 6c6901f..74199bb 100644
--- a/lib/StaticAnalyzer/Checkers/PthreadLockChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/PthreadLockChecker.cpp
@@ -13,7 +13,7 @@
 //===----------------------------------------------------------------------===//
 
 #include "ClangSACheckers.h"
-#include "clang/StaticAnalyzer/Core/CheckerV2.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
@@ -25,7 +25,7 @@ using namespace ento;
 
 namespace {
 class PthreadLockChecker
-  : public CheckerV2< check::PostStmt<CallExpr> > {
+  : public Checker< check::PostStmt<CallExpr> > {
 public:
   void checkPostStmt(const CallExpr *CE, CheckerContext &C) const;
     
diff --git a/lib/StaticAnalyzer/Checkers/ReturnPointerRangeChecker.cpp b/lib/StaticAnalyzer/Checkers/ReturnPointerRangeChecker.cpp
index 2985156..1729b25 100644
--- a/lib/StaticAnalyzer/Checkers/ReturnPointerRangeChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/ReturnPointerRangeChecker.cpp
@@ -13,7 +13,7 @@
 //===----------------------------------------------------------------------===//
 
 #include "ClangSACheckers.h"
-#include "clang/StaticAnalyzer/Core/CheckerV2.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
@@ -24,7 +24,7 @@ using namespace ento;
 
 namespace {
 class ReturnPointerRangeChecker : 
-    public CheckerV2< check::PreStmt<ReturnStmt> > {
+    public Checker< check::PreStmt<ReturnStmt> > {
   mutable llvm::OwningPtr<BuiltinBug> BT;
 public:
     void checkPreStmt(const ReturnStmt *RS, CheckerContext &C) const;
diff --git a/lib/StaticAnalyzer/Checkers/ReturnUndefChecker.cpp b/lib/StaticAnalyzer/Checkers/ReturnUndefChecker.cpp
index 555eaf4..7c215b7 100644
--- a/lib/StaticAnalyzer/Checkers/ReturnUndefChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/ReturnUndefChecker.cpp
@@ -13,35 +13,26 @@
 //
 //===----------------------------------------------------------------------===//
 
-#include "InternalChecks.h"
+#include "ClangSACheckers.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
+#include "clang/StaticAnalyzer/Core/CheckerManager.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
-#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerVisitor.h"
-#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
 
 using namespace clang;
 using namespace ento;
 
 namespace {
 class ReturnUndefChecker : 
-    public CheckerVisitor<ReturnUndefChecker> {      
-  BuiltinBug *BT;
+    public Checker< check::PreStmt<ReturnStmt> > {
+  mutable llvm::OwningPtr<BuiltinBug> BT;
 public:
-    ReturnUndefChecker() : BT(0) {}
-    static void *getTag();
-    void PreVisitReturnStmt(CheckerContext &C, const ReturnStmt *RS);
+  void checkPreStmt(const ReturnStmt *RS, CheckerContext &C) const;
 };
 }
 
-void ento::RegisterReturnUndefChecker(ExprEngine &Eng) {
-  Eng.registerCheck(new ReturnUndefChecker());
-}
-
-void *ReturnUndefChecker::getTag() {
-  static int x = 0; return &x;
-}
-
-void ReturnUndefChecker::PreVisitReturnStmt(CheckerContext &C,
-                                            const ReturnStmt *RS) {
+void ReturnUndefChecker::checkPreStmt(const ReturnStmt *RS,
+                                      CheckerContext &C) const {
  
   const Expr *RetE = RS->getRetValue();
   if (!RetE)
@@ -56,8 +47,8 @@ void ReturnUndefChecker::PreVisitReturnStmt(CheckerContext &C,
     return;
   
   if (!BT)
-    BT = new BuiltinBug("Garbage return value",
-                        "Undefined or garbage value returned to caller");
+    BT.reset(new BuiltinBug("Garbage return value",
+                            "Undefined or garbage value returned to caller"));
     
   EnhancedBugReport *report = 
     new EnhancedBugReport(*BT, BT->getDescription(), N);
@@ -67,3 +58,7 @@ void ReturnUndefChecker::PreVisitReturnStmt(CheckerContext &C,
 
   C.EmitReport(report);
 }
+
+void ento::registerReturnUndefChecker(CheckerManager &mgr) {
+  mgr.registerChecker<ReturnUndefChecker>();
+}
diff --git a/lib/StaticAnalyzer/Checkers/StackAddrEscapeChecker.cpp b/lib/StaticAnalyzer/Checkers/StackAddrEscapeChecker.cpp
index 6a9a37d..07de870 100644
--- a/lib/StaticAnalyzer/Checkers/StackAddrEscapeChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/StackAddrEscapeChecker.cpp
@@ -13,7 +13,7 @@
 //===----------------------------------------------------------------------===//
 
 #include "ClangSACheckers.h"
-#include "clang/StaticAnalyzer/Core/CheckerV2.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
@@ -24,7 +24,7 @@ using namespace clang;
 using namespace ento;
 
 namespace {
-class StackAddrEscapeChecker : public CheckerV2< check::PreStmt<ReturnStmt>,
+class StackAddrEscapeChecker : public Checker< check::PreStmt<ReturnStmt>,
                                                check::EndPath > {
   mutable llvm::OwningPtr<BuiltinBug> BT_stackleak;
   mutable llvm::OwningPtr<BuiltinBug> BT_returnstack;
diff --git a/lib/StaticAnalyzer/Checkers/StreamChecker.cpp b/lib/StaticAnalyzer/Checkers/StreamChecker.cpp
index d0626b8..711c672 100644
--- a/lib/StaticAnalyzer/Checkers/StreamChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/StreamChecker.cpp
@@ -12,7 +12,7 @@
 //===----------------------------------------------------------------------===//
 
 #include "ClangSACheckers.h"
-#include "clang/StaticAnalyzer/Core/CheckerV2.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
@@ -56,7 +56,7 @@ struct StreamState {
   }
 };
 
-class StreamChecker : public CheckerV2<eval::Call,
+class StreamChecker : public Checker<eval::Call,
                                        check::DeadSymbols,
                                        check::EndPath,
                                        check::PreStmt<ReturnStmt> > {
diff --git a/lib/StaticAnalyzer/Checkers/UndefBranchChecker.cpp b/lib/StaticAnalyzer/Checkers/UndefBranchChecker.cpp
index 14ae9ed..1fb1815 100644
--- a/lib/StaticAnalyzer/Checkers/UndefBranchChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/UndefBranchChecker.cpp
@@ -12,17 +12,19 @@
 //
 //===----------------------------------------------------------------------===//
 
-#include "InternalChecks.h"
+#include "ClangSACheckers.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
+#include "clang/StaticAnalyzer/Core/CheckerManager.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
-#include "clang/StaticAnalyzer/Core/PathSensitive/Checker.h"
 
 using namespace clang;
 using namespace ento;
 
 namespace {
 
-class UndefBranchChecker : public Checker {
-  BuiltinBug *BT;
+class UndefBranchChecker : public Checker<check::BranchCondition> {
+  mutable llvm::OwningPtr<BuiltinBug> BT;
 
   struct FindUndefExpr {
     GRStateManager& VM;
@@ -48,26 +50,15 @@ class UndefBranchChecker : public Checker {
   };
 
 public:
-  UndefBranchChecker() : BT(0) {}
-  static void *getTag();
-  void VisitBranchCondition(BranchNodeBuilder &Builder, ExprEngine &Eng,
-                            const Stmt *Condition, void *tag);
+  void checkBranchCondition(const Stmt *Condition, BranchNodeBuilder &Builder,
+                            ExprEngine &Eng) const;
 };
 
 }
 
-void ento::RegisterUndefBranchChecker(ExprEngine &Eng) {
-  Eng.registerCheck(new UndefBranchChecker());
-}
-
-void *UndefBranchChecker::getTag() {
-  static int x;
-  return &x;
-}
-
-void UndefBranchChecker::VisitBranchCondition(BranchNodeBuilder &Builder, 
-                                              ExprEngine &Eng,
-                                              const Stmt *Condition, void *tag){
+void UndefBranchChecker::checkBranchCondition(const Stmt *Condition,
+                                              BranchNodeBuilder &Builder,
+                                              ExprEngine &Eng) const {
   const GRState *state = Builder.getState();
   SVal X = state->getSVal(Condition);
   if (X.isUndef()) {
@@ -75,7 +66,8 @@ void UndefBranchChecker::VisitBranchCondition(BranchNodeBuilder &Builder,
     if (N) {
       N->markAsSink();
       if (!BT)
-        BT = new BuiltinBug("Branch condition evaluates to a garbage value");
+        BT.reset(
+               new BuiltinBug("Branch condition evaluates to a garbage value"));
 
       // What's going on here: we want to highlight the subexpression of the
       // condition that is the most likely source of the "uninitialized
@@ -118,3 +110,7 @@ void UndefBranchChecker::VisitBranchCondition(BranchNodeBuilder &Builder,
     Builder.markInfeasible(false);
   }
 }
+
+void ento::registerUndefBranchChecker(CheckerManager &mgr) {
+  mgr.registerChecker<UndefBranchChecker>();
+}
diff --git a/lib/StaticAnalyzer/Checkers/UndefCapturedBlockVarChecker.cpp b/lib/StaticAnalyzer/Checkers/UndefCapturedBlockVarChecker.cpp
index 6d3c966..69958d1 100644
--- a/lib/StaticAnalyzer/Checkers/UndefCapturedBlockVarChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/UndefCapturedBlockVarChecker.cpp
@@ -11,8 +11,10 @@
 //
 //===----------------------------------------------------------------------===//
 
-#include "InternalChecks.h"
-#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerVisitor.h"
+#include "ClangSACheckers.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
+#include "clang/StaticAnalyzer/Core/CheckerManager.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
 #include "llvm/Support/raw_ostream.h"
@@ -22,20 +24,14 @@ using namespace ento;
 
 namespace {
 class UndefCapturedBlockVarChecker
-  : public CheckerVisitor<UndefCapturedBlockVarChecker> {
- BugType *BT;
+  : public Checker< check::PostStmt<BlockExpr> > {
+ mutable llvm::OwningPtr<BugType> BT;
 
 public:
-  UndefCapturedBlockVarChecker() : BT(0) {}
-  static void *getTag() { static int tag = 0; return &tag; }
-  void PostVisitBlockExpr(CheckerContext &C, const BlockExpr *BE);
+  void checkPostStmt(const BlockExpr *BE, CheckerContext &C) const;
 };
 } // end anonymous namespace
 
-void ento::RegisterUndefCapturedBlockVarChecker(ExprEngine &Eng) {
-  Eng.registerCheck(new UndefCapturedBlockVarChecker());
-}
-
 static const BlockDeclRefExpr *FindBlockDeclRefExpr(const Stmt *S,
                                                     const VarDecl *VD){
   if (const BlockDeclRefExpr *BR = dyn_cast<BlockDeclRefExpr>(S))
@@ -54,8 +50,8 @@ static const BlockDeclRefExpr *FindBlockDeclRefExpr(const Stmt *S,
 }
 
 void
-UndefCapturedBlockVarChecker::PostVisitBlockExpr(CheckerContext &C,
-                                                 const BlockExpr *BE) {
+UndefCapturedBlockVarChecker::checkPostStmt(const BlockExpr *BE,
+                                            CheckerContext &C) const {
   if (!BE->getBlockDecl()->hasCaptures())
     return;
 
@@ -82,7 +78,7 @@ UndefCapturedBlockVarChecker::PostVisitBlockExpr(CheckerContext &C,
     if (state->getSVal(VR).isUndef())
       if (ExplodedNode *N = C.generateSink()) {
         if (!BT)
-          BT = new BuiltinBug("uninitialized variable captured by block");
+          BT.reset(new BuiltinBug("uninitialized variable captured by block"));
 
         // Generate a bug report.
         llvm::SmallString<128> buf;
@@ -100,3 +96,7 @@ UndefCapturedBlockVarChecker::PostVisitBlockExpr(CheckerContext &C,
       }
   }
 }
+
+void ento::registerUndefCapturedBlockVarChecker(CheckerManager &mgr) {
+  mgr.registerChecker<UndefCapturedBlockVarChecker>();
+}
diff --git a/lib/StaticAnalyzer/Checkers/UndefResultChecker.cpp b/lib/StaticAnalyzer/Checkers/UndefResultChecker.cpp
index 64a3567..7fa3804 100644
--- a/lib/StaticAnalyzer/Checkers/UndefResultChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/UndefResultChecker.cpp
@@ -12,9 +12,11 @@
 //
 //===----------------------------------------------------------------------===//
 
-#include "InternalChecks.h"
+#include "ClangSACheckers.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
+#include "clang/StaticAnalyzer/Core/CheckerManager.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
-#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerVisitor.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
 
 using namespace clang;
@@ -22,23 +24,17 @@ using namespace ento;
 
 namespace {
 class UndefResultChecker 
-  : public CheckerVisitor<UndefResultChecker> {
+  : public Checker< check::PostStmt<BinaryOperator> > {
 
-  BugType *BT;
+  mutable llvm::OwningPtr<BugType> BT;
   
 public:
-  UndefResultChecker() : BT(0) {}
-  static void *getTag() { static int tag = 0; return &tag; }
-  void PostVisitBinaryOperator(CheckerContext &C, const BinaryOperator *B);
+  void checkPostStmt(const BinaryOperator *B, CheckerContext &C) const;
 };
 } // end anonymous namespace
 
-void ento::RegisterUndefResultChecker(ExprEngine &Eng) {
-  Eng.registerCheck(new UndefResultChecker());
-}
-
-void UndefResultChecker::PostVisitBinaryOperator(CheckerContext &C, 
-                                                 const BinaryOperator *B) {
+void UndefResultChecker::checkPostStmt(const BinaryOperator *B,
+                                       CheckerContext &C) const {
   const GRState *state = C.getState();
   if (state->getSVal(B).isUndef()) {
     // Generate an error node.
@@ -47,7 +43,7 @@ void UndefResultChecker::PostVisitBinaryOperator(CheckerContext &C,
       return;
     
     if (!BT)
-      BT = new BuiltinBug("Result of operation is garbage or undefined");
+      BT.reset(new BuiltinBug("Result of operation is garbage or undefined"));
 
     llvm::SmallString<256> sbuf;
     llvm::raw_svector_ostream OS(sbuf);
@@ -85,3 +81,7 @@ void UndefResultChecker::PostVisitBinaryOperator(CheckerContext &C,
     C.EmitReport(report);
   }
 }
+
+void ento::registerUndefResultChecker(CheckerManager &mgr) {
+  mgr.registerChecker<UndefResultChecker>();
+}
diff --git a/lib/StaticAnalyzer/Checkers/UndefinedArraySubscriptChecker.cpp b/lib/StaticAnalyzer/Checkers/UndefinedArraySubscriptChecker.cpp
index ff03448..e51ab20 100644
--- a/lib/StaticAnalyzer/Checkers/UndefinedArraySubscriptChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/UndefinedArraySubscriptChecker.cpp
@@ -12,39 +12,32 @@
 //
 //===----------------------------------------------------------------------===//
 
-#include "InternalChecks.h"
+#include "ClangSACheckers.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
+#include "clang/StaticAnalyzer/Core/CheckerManager.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
-#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerVisitor.h"
 
 using namespace clang;
 using namespace ento;
 
 namespace {
 class UndefinedArraySubscriptChecker
-  : public CheckerVisitor<UndefinedArraySubscriptChecker> {
-  BugType *BT;
+  : public Checker< check::PreStmt<ArraySubscriptExpr> > {
+  mutable llvm::OwningPtr<BugType> BT;
+
 public:
-  UndefinedArraySubscriptChecker() : BT(0) {}
-  static void *getTag() {
-    static int x = 0;
-    return &x;
-  }
-  void PreVisitArraySubscriptExpr(CheckerContext &C, 
-                                  const ArraySubscriptExpr *A);
+  void checkPreStmt(const ArraySubscriptExpr *A, CheckerContext &C) const;
 };
 } // end anonymous namespace
 
-void ento::RegisterUndefinedArraySubscriptChecker(ExprEngine &Eng) {
-  Eng.registerCheck(new UndefinedArraySubscriptChecker());
-}
-
 void 
-UndefinedArraySubscriptChecker::PreVisitArraySubscriptExpr(CheckerContext &C, 
-                                                const ArraySubscriptExpr *A) {
+UndefinedArraySubscriptChecker::checkPreStmt(const ArraySubscriptExpr *A,
+                                             CheckerContext &C) const {
   if (C.getState()->getSVal(A->getIdx()).isUndef()) {
     if (ExplodedNode *N = C.generateSink()) {
       if (!BT)
-        BT = new BuiltinBug("Array subscript is undefined");
+        BT.reset(new BuiltinBug("Array subscript is undefined"));
 
       // Generate a report for this bug.
       EnhancedBugReport *R = new EnhancedBugReport(*BT, BT->getName(), N);
@@ -55,3 +48,7 @@ UndefinedArraySubscriptChecker::PreVisitArraySubscriptExpr(CheckerContext &C,
     }
   }
 }
+
+void ento::registerUndefinedArraySubscriptChecker(CheckerManager &mgr) {
+  mgr.registerChecker<UndefinedArraySubscriptChecker>();
+}
diff --git a/lib/StaticAnalyzer/Checkers/UndefinedAssignmentChecker.cpp b/lib/StaticAnalyzer/Checkers/UndefinedAssignmentChecker.cpp
index e53cbba..28806e3 100644
--- a/lib/StaticAnalyzer/Checkers/UndefinedAssignmentChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/UndefinedAssignmentChecker.cpp
@@ -7,43 +7,32 @@
 //
 //===----------------------------------------------------------------------===//
 //
-// This defines UndefinedAssginmentChecker, a builtin check in ExprEngine that
+// This defines UndefinedAssignmentChecker, a builtin check in ExprEngine that
 // checks for assigning undefined values.
 //
 //===----------------------------------------------------------------------===//
 
-#include "InternalChecks.h"
+#include "ClangSACheckers.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
+#include "clang/StaticAnalyzer/Core/CheckerManager.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
-#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerVisitor.h"
 
 using namespace clang;
 using namespace ento;
 
 namespace {
 class UndefinedAssignmentChecker
-  : public CheckerVisitor<UndefinedAssignmentChecker> {
-  BugType *BT;
+  : public Checker<check::Bind> {
+  mutable llvm::OwningPtr<BugType> BT;
+
 public:
-  UndefinedAssignmentChecker() : BT(0) {}
-  static void *getTag();
-  virtual void PreVisitBind(CheckerContext &C, const Stmt *StoreE,
-                            SVal location, SVal val);
+  void checkBind(SVal location, SVal val, CheckerContext &C) const;
 };
 }
 
-void ento::RegisterUndefinedAssignmentChecker(ExprEngine &Eng){
-  Eng.registerCheck(new UndefinedAssignmentChecker());
-}
-
-void *UndefinedAssignmentChecker::getTag() {
-  static int x = 0;
-  return &x;
-}
-
-void UndefinedAssignmentChecker::PreVisitBind(CheckerContext &C,
-                                              const Stmt *StoreE,
-                                              SVal location,
-                                              SVal val) {
+void UndefinedAssignmentChecker::checkBind(SVal location, SVal val,
+                                           CheckerContext &C) const {
   if (!val.isUndef())
     return;
 
@@ -55,11 +44,12 @@ void UndefinedAssignmentChecker::PreVisitBind(CheckerContext &C,
   const char *str = "Assigned value is garbage or undefined";
 
   if (!BT)
-    BT = new BuiltinBug(str);
+    BT.reset(new BuiltinBug(str));
 
   // Generate a report for this bug.
   const Expr *ex = 0;
 
+  const Stmt *StoreE = C.getStmt();
   while (StoreE) {
     if (const BinaryOperator *B = dyn_cast<BinaryOperator>(StoreE)) {
       if (B->isCompoundAssignmentOp()) {
@@ -92,3 +82,6 @@ void UndefinedAssignmentChecker::PreVisitBind(CheckerContext &C,
   C.EmitReport(R);
 }
 
+void ento::registerUndefinedAssignmentChecker(CheckerManager &mgr) {
+  mgr.registerChecker<UndefinedAssignmentChecker>();
+}
diff --git a/lib/StaticAnalyzer/Checkers/UnixAPIChecker.cpp b/lib/StaticAnalyzer/Checkers/UnixAPIChecker.cpp
index be4fbf6..48d7c36 100644
--- a/lib/StaticAnalyzer/Checkers/UnixAPIChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/UnixAPIChecker.cpp
@@ -13,7 +13,7 @@
 //===----------------------------------------------------------------------===//
 
 #include "ClangSACheckers.h"
-#include "clang/StaticAnalyzer/Core/CheckerV2.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
@@ -27,7 +27,7 @@ using namespace ento;
 using llvm::Optional;
 
 namespace {
-class UnixAPIChecker : public CheckerV2< check::PreStmt<CallExpr> > {
+class UnixAPIChecker : public Checker< check::PreStmt<CallExpr> > {
   enum SubChecks {
     OpenFn = 0,
     PthreadOnceFn = 1,
diff --git a/lib/StaticAnalyzer/Checkers/UnreachableCodeChecker.cpp b/lib/StaticAnalyzer/Checkers/UnreachableCodeChecker.cpp
index 1bc487a..b540bce 100644
--- a/lib/StaticAnalyzer/Checkers/UnreachableCodeChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/UnreachableCodeChecker.cpp
@@ -14,7 +14,7 @@
 //===----------------------------------------------------------------------===//
 
 #include "ClangSACheckers.h"
-#include "clang/StaticAnalyzer/Core/CheckerV2.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ExplodedGraph.h"
@@ -34,7 +34,7 @@ using namespace clang;
 using namespace ento;
 
 namespace {
-class UnreachableCodeChecker : public CheckerV2<check::EndAnalysis> {
+class UnreachableCodeChecker : public Checker<check::EndAnalysis> {
 public:
   void checkEndAnalysis(ExplodedGraph &G, BugReporter &B,
                         ExprEngine &Eng) const;
@@ -112,8 +112,8 @@ void UnreachableCodeChecker::checkEndAnalysis(ExplodedGraph &G,
     // such as llvm_unreachable.
     if (!CB->empty()) {
       CFGElement First = CB->front();
-      if (CFGStmt S = First.getAs<CFGStmt>()) {
-        if (const CallExpr *CE = dyn_cast<CallExpr>(S.getStmt())) {
+      if (const CFGStmt *S = First.getAs<CFGStmt>()) {
+        if (const CallExpr *CE = dyn_cast<CallExpr>(S->getStmt())) {
           if (CE->isBuiltinCall(Ctx) == Builtin::BI__builtin_unreachable)
             continue;
         }
@@ -164,8 +164,8 @@ void UnreachableCodeChecker::FindUnreachableEntryPoints(const CFGBlock *CB,
 // Find the Stmt* in a CFGBlock for reporting a warning
 const Stmt *UnreachableCodeChecker::getUnreachableStmt(const CFGBlock *CB) {
   for (CFGBlock::const_iterator I = CB->begin(), E = CB->end(); I != E; ++I) {
-    if (CFGStmt S = I->getAs<CFGStmt>())
-      return S;
+    if (const CFGStmt *S = I->getAs<CFGStmt>())
+      return S->getStmt();
   }
   if (const Stmt *S = CB->getTerminator())
     return S;
@@ -204,7 +204,7 @@ bool UnreachableCodeChecker::isInvalidPath(const CFGBlock *CB,
   // Run each of the checks on the conditions
   if (containsMacro(cond) || containsEnum(cond)
       || containsStaticLocal(cond) || containsBuiltinOffsetOf(cond)
-      || containsStmt<SizeOfAlignOfExpr>(cond))
+      || containsStmt<UnaryExprOrTypeTraitExpr>(cond))
     return true;
 
   return false;
diff --git a/lib/StaticAnalyzer/Checkers/VLASizeChecker.cpp b/lib/StaticAnalyzer/Checkers/VLASizeChecker.cpp
index ba46e17..875dce2 100644
--- a/lib/StaticAnalyzer/Checkers/VLASizeChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/VLASizeChecker.cpp
@@ -14,32 +14,27 @@
 //
 //===----------------------------------------------------------------------===//
 
-#include "InternalChecks.h"
-#include "clang/AST/CharUnits.h"
+#include "ClangSACheckers.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
+#include "clang/StaticAnalyzer/Core/CheckerManager.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
-#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerVisitor.h"
-#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
+#include "clang/AST/CharUnits.h"
 
 using namespace clang;
 using namespace ento;
 
 namespace {
-class VLASizeChecker : public CheckerVisitor<VLASizeChecker> {
-  BugType *BT_zero;
-  BugType *BT_undef;
+class VLASizeChecker : public Checker< check::PreStmt<DeclStmt> > {
+  mutable llvm::OwningPtr<BugType> BT_zero;
+  mutable llvm::OwningPtr<BugType> BT_undef;
   
 public:
-  VLASizeChecker() : BT_zero(0), BT_undef(0) {}
-  static void *getTag() { static int tag = 0; return &tag; }
-  void PreVisitDeclStmt(CheckerContext &C, const DeclStmt *DS);
+  void checkPreStmt(const DeclStmt *DS, CheckerContext &C) const;
 };
 } // end anonymous namespace
 
-void ento::RegisterVLASizeChecker(ExprEngine &Eng) {
-  Eng.registerCheck(new VLASizeChecker());
-}
-
-void VLASizeChecker::PreVisitDeclStmt(CheckerContext &C, const DeclStmt *DS) {
+void VLASizeChecker::checkPreStmt(const DeclStmt *DS, CheckerContext &C) const {
   if (!DS->isSingleDecl())
     return;
   
@@ -64,8 +59,8 @@ void VLASizeChecker::PreVisitDeclStmt(CheckerContext &C, const DeclStmt *DS) {
       return;
     
     if (!BT_undef)
-      BT_undef = new BuiltinBug("Declared variable-length array (VLA) uses a "
-                                "garbage value as its size");
+      BT_undef.reset(new BuiltinBug("Declared variable-length array (VLA) "
+                                    "uses a garbage value as its size"));
 
     EnhancedBugReport *report =
       new EnhancedBugReport(*BT_undef, BT_undef->getName(), N);
@@ -89,8 +84,8 @@ void VLASizeChecker::PreVisitDeclStmt(CheckerContext &C, const DeclStmt *DS) {
   if (stateZero && !stateNotZero) {
     ExplodedNode* N = C.generateSink(stateZero);
     if (!BT_zero)
-      BT_zero = new BuiltinBug("Declared variable-length array (VLA) has zero "
-                               "size");
+      BT_zero.reset(new BuiltinBug("Declared variable-length array (VLA) has "
+                                   "zero size"));
 
     EnhancedBugReport *report =
       new EnhancedBugReport(*BT_zero, BT_zero->getName(), N);
@@ -136,3 +131,7 @@ void VLASizeChecker::PreVisitDeclStmt(CheckerContext &C, const DeclStmt *DS) {
   // Remember our assumptions!
   C.addTransition(state);
 }
+
+void ento::registerVLASizeChecker(CheckerManager &mgr) {
+  mgr.registerChecker<VLASizeChecker>();
+}
diff --git a/lib/StaticAnalyzer/Core/AggExprVisitor.cpp b/lib/StaticAnalyzer/Core/AggExprVisitor.cpp
index e80cf9b..901190d 100644
--- a/lib/StaticAnalyzer/Core/AggExprVisitor.cpp
+++ b/lib/StaticAnalyzer/Core/AggExprVisitor.cpp
@@ -60,7 +60,7 @@ void AggExprVisitor::VisitCXXConstructExpr(CXXConstructExpr *E) {
 }
 
 void AggExprVisitor::VisitCXXMemberCallExpr(CXXMemberCallExpr *E) {
-  Eng.VisitCXXMemberCallExpr(E, Pred, DstSet);
+  Eng.Visit(E, Pred, DstSet);
 }
 
 void ExprEngine::VisitAggExpr(const Expr *E, const MemRegion *Dest, 
diff --git a/lib/StaticAnalyzer/Core/BasicStore.cpp b/lib/StaticAnalyzer/Core/BasicStore.cpp
index 98365e7..4faa84c 100644
--- a/lib/StaticAnalyzer/Core/BasicStore.cpp
+++ b/lib/StaticAnalyzer/Core/BasicStore.cpp
@@ -429,12 +429,15 @@ StoreRef BasicStoreManager::getInitialStore(const LocationContext *InitLoc) {
   }
 
   if (const CXXMethodDecl *MD = dyn_cast<CXXMethodDecl>(InitLoc->getDecl())) {
-    // For C++ methods add symbolic region for 'this' in initial stack frame.
-    QualType ThisT = MD->getThisType(StateMgr.getContext());
-    MemRegionManager &RegMgr = svalBuilder.getRegionManager();
-    const CXXThisRegion *ThisR = RegMgr.getCXXThisRegion(ThisT, InitLoc);
-    SVal ThisV = svalBuilder.getRegionValueSymbolVal(ThisR);
-    St = Bind(St.getStore(), svalBuilder.makeLoc(ThisR), ThisV);
+    // For C++ non-static member variables, add a symbolic region for 'this' in
+    // the initial stack frame.
+    if (MD->isInstance()) {
+      QualType ThisT = MD->getThisType(StateMgr.getContext());
+      MemRegionManager &RegMgr = svalBuilder.getRegionManager();
+      const CXXThisRegion *ThisR = RegMgr.getCXXThisRegion(ThisT, InitLoc);
+      SVal ThisV = svalBuilder.getRegionValueSymbolVal(ThisR);
+      St = Bind(St.getStore(), svalBuilder.makeLoc(ThisR), ThisV);
+    }
   }
 
   return St;
diff --git a/lib/StaticAnalyzer/Core/BasicValueFactory.cpp b/lib/StaticAnalyzer/Core/BasicValueFactory.cpp
index 6315d83..ae8a04c 100644
--- a/lib/StaticAnalyzer/Core/BasicValueFactory.cpp
+++ b/lib/StaticAnalyzer/Core/BasicValueFactory.cpp
@@ -14,6 +14,7 @@
 //===----------------------------------------------------------------------===//
 
 #include "clang/StaticAnalyzer/Core/PathSensitive/BasicValueFactory.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/Store.h"
 
 using namespace clang;
 using namespace ento;
@@ -25,8 +26,9 @@ void CompoundValData::Profile(llvm::FoldingSetNodeID& ID, QualType T,
 }
 
 void LazyCompoundValData::Profile(llvm::FoldingSetNodeID& ID,
-                                  const void *store,const TypedRegion *region) {
-  ID.AddPointer(store);
+                                  const StoreRef &store,
+                                  const TypedRegion *region) {
+  ID.AddPointer(store.getStore());
   ID.AddPointer(region);
 }
 
@@ -124,7 +126,7 @@ BasicValueFactory::getCompoundValData(QualType T,
 }
 
 const LazyCompoundValData*
-BasicValueFactory::getLazyCompoundValData(const void *store,
+BasicValueFactory::getLazyCompoundValData(const StoreRef &store,
                                           const TypedRegion *region) {
   llvm::FoldingSetNodeID ID;
   LazyCompoundValData::Profile(ID, store, region);
diff --git a/lib/StaticAnalyzer/Core/BugReporter.cpp b/lib/StaticAnalyzer/Core/BugReporter.cpp
index 672982a..8b5d383 100644
--- a/lib/StaticAnalyzer/Core/BugReporter.cpp
+++ b/lib/StaticAnalyzer/Core/BugReporter.cpp
@@ -432,7 +432,7 @@ public:
     else if (const DeclStmt* DS = dyn_cast<DeclStmt>(S)) {
       // FIXME: Eventually CFGs won't have DeclStmts.  Right now we
       //  assume that each DeclStmt has a single Decl.  This invariant
-      //  holds by contruction in the CFG.
+      //  holds by construction in the CFG.
       VD = dyn_cast<VarDecl>(*DS->decl_begin());
     }
 
@@ -859,7 +859,8 @@ class EdgeBuilder {
           default:
             break;
           case Stmt::ParenExprClass:
-            S = cast<ParenExpr>(S)->IgnoreParens();
+          case Stmt::GenericSelectionExprClass:
+            S = cast<Expr>(S)->IgnoreParens();
             firstCharOnly = true;
             continue;
           case Stmt::BinaryConditionalOperatorClass:
@@ -1170,13 +1171,14 @@ static void GenerateExtensivePathDiagnostic(PathDiagnostic& PD,
       }
 
       if (const BlockEntrance *BE = dyn_cast<BlockEntrance>(&P)) {
-        if (CFGStmt S = BE->getFirstElement().getAs<CFGStmt>()) {
-          if (IsControlFlowExpr(S)) {
+        if (const CFGStmt *S = BE->getFirstElement().getAs<CFGStmt>()) {
+          const Stmt *stmt = S->getStmt();
+          if (IsControlFlowExpr(stmt)) {
             // Add the proper context for '&&', '||', and '?'.
-            EB.addContext(S);
+            EB.addContext(stmt);
           }
           else
-            EB.addExtendedContext(PDB.getEnclosingStmtLocation(S).asStmt());
+            EB.addExtendedContext(PDB.getEnclosingStmtLocation(stmt).asStmt());
         }
         
         break;
diff --git a/lib/StaticAnalyzer/Core/CFRefCount.cpp b/lib/StaticAnalyzer/Core/CFRefCount.cpp
index b3721d7..d9b1ce8 100644
--- a/lib/StaticAnalyzer/Core/CFRefCount.cpp
+++ b/lib/StaticAnalyzer/Core/CFRefCount.cpp
@@ -12,7 +12,11 @@
 //
 //===----------------------------------------------------------------------===//
 
+#include "clang/StaticAnalyzer/Core/Checker.h"
+#include "clang/StaticAnalyzer/Core/CheckerManager.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/AST/DeclObjC.h"
+#include "clang/AST/DeclCXX.h"
 #include "clang/AST/StmtVisitor.h"
 #include "clang/Basic/LangOptions.h"
 #include "clang/Basic/SourceManager.h"
@@ -20,7 +24,6 @@
 #include "clang/StaticAnalyzer/Core/BugReporter/PathDiagnostic.h"
 #include "clang/StaticAnalyzer/Checkers/LocalCheckers.h"
 #include "clang/Analysis/DomainSpecific/CocoaConventions.h"
-#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerVisitor.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngineBuilders.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/GRStateTrait.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/TransferFuncs.h"
@@ -1198,7 +1201,7 @@ RetainSummaryManager::updateSummaryFromAnnotations(RetainSummary &Summ,
   // Effects on the parameters.
   unsigned parm_idx = 0;
   for (FunctionDecl::param_const_iterator pi = FD->param_begin(), 
-       pe = FD->param_end(); pi != pe; ++pi) {
+         pe = FD->param_end(); pi != pe; ++pi, ++parm_idx) {
     const ParmVarDecl *pd = *pi;
     if (pd->getAttr<NSConsumedAttr>()) {
       if (!GCEnabled)
@@ -2428,7 +2431,7 @@ CFRefLeakReport::CFRefLeakReport(CFRefBug& D, const CFRefCount &tf,
                                  SymbolRef sym, ExprEngine& Eng)
 : CFRefReport(D, tf, n, sym) {
 
-  // Most bug reports are cached at the location where they occured.
+  // Most bug reports are cached at the location where they occurred.
   // With leaks, we want to unique them by the location where they were
   // allocated, and only report a single path.  To do this, we need to find
   // the allocation site of a piece of tracked memory, which we do via a
@@ -2526,6 +2529,14 @@ void CFRefCount::evalSummary(ExplodedNodeSet& Dst,
       RegionsToInvalidate.push_back(region);
   }
   
+  // Invalidate all instance variables for the callee of a C++ method call.
+  // FIXME: We should be able to do better with inter-procedural analysis.
+  // FIXME: we can probably do better for const versus non-const methods.
+  if (callOrMsg.isCXXCall()) {
+    if (const MemRegion *callee = callOrMsg.getCXXCallee().getAsRegion())
+      RegionsToInvalidate.push_back(callee);
+  }
+  
   for (unsigned idx = 0, e = callOrMsg.getNumArgs(); idx != e; ++idx) {
     SVal V = callOrMsg.getArgSValAsScalarOrLoc(idx);
     SymbolRef Sym = V.getAsLocSymbol();
@@ -2678,11 +2689,14 @@ void CFRefCount::evalSummary(ExplodedNodeSet& Dst,
       // FIXME: We eventually should handle structs and other compound types
       // that are returned by value.
 
-      QualType T = callOrMsg.getResultType(Eng.getContext());
-      if (Loc::isLocType(T) || (T->isIntegerType() && T->isScalarType())) {
+      // Use the result type from callOrMsg as it automatically adjusts
+      // for methods/functions that return references.
+      QualType resultTy = callOrMsg.getResultType(Eng.getContext());
+      if (Loc::isLocType(resultTy) || 
+            (resultTy->isIntegerType() && resultTy->isScalarType())) {
         unsigned Count = Builder.getCurrentBlockCount();
         SValBuilder &svalBuilder = Eng.getSValBuilder();
-        SVal X = svalBuilder.getConjuredSymbolVal(NULL, Ex, T, Count);
+        SVal X = svalBuilder.getConjuredSymbolVal(NULL, Ex, resultTy, Count);
         state = state->BindExpr(Ex, X, false);
       }
 
@@ -2709,9 +2723,12 @@ void CFRefCount::evalSummary(ExplodedNodeSet& Dst,
       unsigned Count = Builder.getCurrentBlockCount();
       SValBuilder &svalBuilder = Eng.getSValBuilder();
       SymbolRef Sym = svalBuilder.getConjuredSymbol(Ex, Count);
-      QualType RetT = GetReturnType(Ex, svalBuilder.getContext());
+
+      // Use the result type from callOrMsg as it automatically adjusts
+      // for methods/functions that return references.      
+      QualType resultTy = callOrMsg.getResultType(Eng.getContext());
       state = state->set<RefBindings>(Sym, RefVal::makeOwned(RE.getObjKind(),
-                                                            RetT));
+                                                            resultTy));
       state = state->BindExpr(Ex, svalBuilder.makeLoc(Sym), false);
 
       // FIXME: Add a flag to the checker where allocations are assumed to
@@ -2764,11 +2781,17 @@ void CFRefCount::evalCall(ExplodedNodeSet& Dst,
   if (dyn_cast_or_null<BlockDataRegion>(L.getAsRegion())) {
     Summ = Summaries.getPersistentStopSummary();
   }
-  else {
-    const FunctionDecl* FD = L.getAsFunctionDecl();
-    Summ = !FD ? Summaries.getDefaultSummary() :
-                 Summaries.getSummary(FD);
+  else if (const FunctionDecl* FD = L.getAsFunctionDecl()) {
+    Summ = Summaries.getSummary(FD);
+  }
+  else if (const CXXMemberCallExpr *me = dyn_cast<CXXMemberCallExpr>(CE)) {
+    if (const CXXMethodDecl *MD = me->getMethodDecl())
+      Summ = Summaries.getSummary(MD);
+    else
+      Summ = Summaries.getDefaultSummary();    
   }
+  else
+    Summ = Summaries.getDefaultSummary();
 
   assert(Summ);
   evalSummary(Dst, Eng, Builder, CE,
@@ -3395,19 +3418,15 @@ void CFRefCount::ProcessNonLeakError(ExplodedNodeSet& Dst,
 
 namespace {
 class RetainReleaseChecker
-  : public CheckerVisitor<RetainReleaseChecker> {
-  CFRefCount *TF;
+  : public Checker< check::PostStmt<BlockExpr> > {
 public:
-    RetainReleaseChecker(CFRefCount *tf) : TF(tf) {}
-    static void* getTag() { static int x = 0; return &x; }
-
-    void PostVisitBlockExpr(CheckerContext &C, const BlockExpr *BE);
+    void checkPostStmt(const BlockExpr *BE, CheckerContext &C) const;
 };
 } // end anonymous namespace
 
 
-void RetainReleaseChecker::PostVisitBlockExpr(CheckerContext &C,
-                                              const BlockExpr *BE) {
+void RetainReleaseChecker::checkPostStmt(const BlockExpr *BE,
+                                         CheckerContext &C) const {
 
   // Scan the BlockDecRefExprs for any object the retain/release checker
   // may be tracking.
@@ -3510,7 +3529,9 @@ void CFRefCount::RegisterChecks(ExprEngine& Eng) {
   // Register the RetainReleaseChecker with the ExprEngine object.
   // Functionality in CFRefCount will be migrated to RetainReleaseChecker
   // over time.
-  Eng.registerCheck(new RetainReleaseChecker(this));
+  // FIXME: HACK! Remove TransferFuncs and turn all of CFRefCount into fully
+  // using the checker mechanism.
+  Eng.getCheckerManager().registerChecker<RetainReleaseChecker>();
 }
 
 TransferFuncs* ento::MakeCFRefCountTF(ASTContext& Ctx, bool GCEnabled,
diff --git a/lib/StaticAnalyzer/Core/CMakeLists.txt b/lib/StaticAnalyzer/Core/CMakeLists.txt
index 14c636c..089a5cc 100644
--- a/lib/StaticAnalyzer/Core/CMakeLists.txt
+++ b/lib/StaticAnalyzer/Core/CMakeLists.txt
@@ -8,18 +8,19 @@ add_clang_library(clangStaticAnalyzerCore
   BasicConstraintManager.cpp
   BasicStore.cpp
   BasicValueFactory.cpp
+  BlockCounter.cpp
   BugReporter.cpp
   BugReporterVisitors.cpp
   CFRefCount.cpp
-  Checker.cpp
+  CXXExprEngine.cpp
+  CheckerContext.cpp
   CheckerHelpers.cpp
   CheckerManager.cpp
+  CoreEngine.cpp
   Environment.cpp
   ExplodedGraph.cpp
+  ExprEngine.cpp
   FlatStore.cpp
-  BlockCounter.cpp
-  CXXExprEngine.cpp
-  CoreEngine.cpp
   GRState.cpp
   HTMLDiagnostics.cpp
   MemRegion.cpp
diff --git a/lib/StaticAnalyzer/Core/CXXExprEngine.cpp b/lib/StaticAnalyzer/Core/CXXExprEngine.cpp
index 56dfe8c..54cbca0 100644
--- a/lib/StaticAnalyzer/Core/CXXExprEngine.cpp
+++ b/lib/StaticAnalyzer/Core/CXXExprEngine.cpp
@@ -11,6 +11,7 @@
 //
 //===----------------------------------------------------------------------===//
 
+#include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
 #include "clang/AST/DeclCXX.h"
@@ -61,6 +62,34 @@ void ExprEngine::evalArguments(ConstExprIterator AI, ConstExprIterator AE,
   }
 }
 
+void ExprEngine::evalCallee(const CallExpr *callExpr,
+                            const ExplodedNodeSet &src,
+                            ExplodedNodeSet &dest) {
+  
+  const Expr *callee = 0;
+  
+  switch (callExpr->getStmtClass()) {
+    case Stmt::CXXMemberCallExprClass: {
+      // Evaluate the implicit object argument that is the recipient of the
+      // call.
+      callee = cast<CXXMemberCallExpr>(callExpr)->getImplicitObjectArgument();
+      
+      // FIXME: handle member pointers.
+      if (!callee)
+        return;
+
+      break;      
+    }
+    default: {
+      callee = callExpr->getCallee()->IgnoreParens();
+      break;
+    }
+  }
+
+  for (ExplodedNodeSet::iterator i = src.begin(), e = src.end(); i != e; ++i)
+    Visit(callee, *i, dest);
+}
+
 const CXXThisRegion *ExprEngine::getCXXThisRegion(const CXXRecordDecl *D,
                                                  const StackFrameContext *SFC) {
   const Type *T = D->getTypeForDecl();
@@ -95,50 +124,121 @@ void ExprEngine::CreateCXXTemporaryObject(const Expr *Ex, ExplodedNode *Pred,
 }
 
 void ExprEngine::VisitCXXConstructExpr(const CXXConstructExpr *E, 
-                                         const MemRegion *Dest,
-                                         ExplodedNode *Pred,
-                                         ExplodedNodeSet &Dst) {
-  if (!Dest)
-    Dest = svalBuilder.getRegionManager().getCXXTempObjectRegion(E,
-                                                    Pred->getLocationContext());
-
-  if (E->isElidable()) {
-    VisitAggExpr(E->getArg(0), Dest, Pred, Dst);
-    return;
-  }
+                                       const MemRegion *Dest,
+                                       ExplodedNode *Pred,
+                                       ExplodedNodeSet &destNodes) {
 
   const CXXConstructorDecl *CD = E->getConstructor();
   assert(CD);
-
+  
+#if 0
   if (!(CD->isThisDeclarationADefinition() && AMgr.shouldInlineCall()))
     // FIXME: invalidate the object.
     return;
-
+#endif
   
   // Evaluate other arguments.
   ExplodedNodeSet argsEvaluated;
   const FunctionProtoType *FnType = CD->getType()->getAs<FunctionProtoType>();
   evalArguments(E->arg_begin(), E->arg_end(), FnType, Pred, argsEvaluated);
-  // The callee stack frame context used to create the 'this' parameter region.
-  const StackFrameContext *SFC = AMgr.getStackFrame(CD, 
-                                                    Pred->getLocationContext(),
-                                                    E, Builder->getBlock(),
-                                                    Builder->getIndex());
 
-  const CXXThisRegion *ThisR =getCXXThisRegion(E->getConstructor()->getParent(),
-                                               SFC);
-
-  CallEnter Loc(E, SFC, Pred->getLocationContext());
-  for (ExplodedNodeSet::iterator NI = argsEvaluated.begin(),
-                                 NE = argsEvaluated.end(); NI != NE; ++NI) {
-    const GRState *state = GetState(*NI);
-    // Setup 'this' region, so that the ctor is evaluated on the object pointed
-    // by 'Dest'.
-    state = state->bindLoc(loc::MemRegionVal(ThisR), loc::MemRegionVal(Dest));
-    ExplodedNode *N = Builder->generateNode(Loc, state, Pred);
-    if (N)
-      Dst.Add(N);
+#if 0
+  // Is the constructor elidable?
+  if (E->isElidable()) {
+    VisitAggExpr(E->getArg(0), destNodes, Pred, Dst);
+    // FIXME: this is here to force propagation if VisitAggExpr doesn't
+    if (destNodes.empty())
+      destNodes.Add(Pred);
+    return;
+  }
+#endif
+  
+  // Perform the previsit of the constructor.
+  ExplodedNodeSet destPreVisit;
+  getCheckerManager().runCheckersForPreStmt(destPreVisit, argsEvaluated, E, 
+                                            *this);
+  
+  // Evaluate the constructor.  Currently we don't now allow checker-specific
+  // implementations of specific constructors (as we do with ordinary
+  // function calls.  We can re-evaluate this in the future.
+  
+#if 0
+  // Inlining currently isn't fully implemented.
+
+  if (AMgr.shouldInlineCall()) {
+    if (!Dest)
+      Dest =
+        svalBuilder.getRegionManager().getCXXTempObjectRegion(E,
+                                                  Pred->getLocationContext());
+
+    // The callee stack frame context used to create the 'this'
+    // parameter region.
+    const StackFrameContext *SFC = 
+      AMgr.getStackFrame(CD, Pred->getLocationContext(),
+                         E, Builder->getBlock(), Builder->getIndex());
+
+    // Create the 'this' region.
+    const CXXThisRegion *ThisR =
+      getCXXThisRegion(E->getConstructor()->getParent(), SFC);
+
+    CallEnter Loc(E, SFC, Pred->getLocationContext());
+
+
+    for (ExplodedNodeSet::iterator NI = argsEvaluated.begin(),
+                                  NE = argsEvaluated.end(); NI != NE; ++NI) {
+      const GRState *state = GetState(*NI);
+      // Setup 'this' region, so that the ctor is evaluated on the object pointed
+      // by 'Dest'.
+      state = state->bindLoc(loc::MemRegionVal(ThisR), loc::MemRegionVal(Dest));
+      if (ExplodedNode *N = Builder->generateNode(Loc, state, *NI))
+        destNodes.Add(N);
+    }
+  }
+#endif
+  
+  // Default semantics: invalidate all regions passed as arguments.
+  llvm::SmallVector<const MemRegion*, 10> regionsToInvalidate;
+
+  // FIXME: We can have collisions on the conjured symbol if the
+  //  expression *I also creates conjured symbols.  We probably want
+  //  to identify conjured symbols by an expression pair: the enclosing
+  //  expression (the context) and the expression itself.  This should
+  //  disambiguate conjured symbols.
+  unsigned blockCount = Builder->getCurrentBlockCount();
+  
+  // NOTE: Even if RegionsToInvalidate is empty, we must still invalidate
+  //  global variables.
+  ExplodedNodeSet destCall;
+
+  for (ExplodedNodeSet::iterator
+        i = destPreVisit.begin(), e = destPreVisit.end();
+       i != e; ++i)
+  {
+    ExplodedNode *Pred = *i;
+    const GRState *state = GetState(Pred);
+
+    // Accumulate list of regions that are invalidated.
+    for (CXXConstructExpr::const_arg_iterator
+          ai = E->arg_begin(), ae = E->arg_end();
+          ai != ae; ++ai)
+    {
+      SVal val = state->getSVal(*ai);
+      if (const MemRegion *region = val.getAsRegion())
+        regionsToInvalidate.push_back(region);
+    }
+    
+    // Invalidate the regions.    
+    state = state->invalidateRegions(regionsToInvalidate.data(),
+                                     regionsToInvalidate.data() +
+                                     regionsToInvalidate.size(),
+                                     E, blockCount, 0,
+                                     /* invalidateGlobals = */ true);
+    
+    Builder->MakeNode(destCall, E, Pred, state);
   }
+  
+  // Do the post visit.
+  getCheckerManager().runCheckersForPostStmt(destNodes, destCall, E, *this);  
 }
 
 void ExprEngine::VisitCXXDestructor(const CXXDestructorDecl *DD,
@@ -165,105 +265,25 @@ void ExprEngine::VisitCXXDestructor(const CXXDestructorDecl *DD,
     Dst.Add(N);
 }
 
-void ExprEngine::VisitCXXMemberCallExpr(const CXXMemberCallExpr *MCE, 
-                                          ExplodedNode *Pred, 
-                                          ExplodedNodeSet &Dst) {
-  // Get the method type.
-  const FunctionProtoType *FnType = 
-                       MCE->getCallee()->getType()->getAs<FunctionProtoType>();
-  assert(FnType && "Method type not available");
-
-  // Evaluate explicit arguments with a worklist.
-  ExplodedNodeSet argsEvaluated;
-  evalArguments(MCE->arg_begin(), MCE->arg_end(), FnType, Pred, argsEvaluated);
- 
-  // Evaluate the implicit object argument.
-  ExplodedNodeSet AllargsEvaluated;
-  const MemberExpr *ME = dyn_cast<MemberExpr>(MCE->getCallee()->IgnoreParens());
-  if (!ME)
-    return;
-  Expr *ObjArgExpr = ME->getBase();
-  for (ExplodedNodeSet::iterator I = argsEvaluated.begin(), 
-                                 E = argsEvaluated.end(); I != E; ++I) {
-      Visit(ObjArgExpr, *I, AllargsEvaluated);
-  }
-
-  // Now evaluate the call itself.
-  const CXXMethodDecl *MD = cast<CXXMethodDecl>(ME->getMemberDecl());
-  assert(MD && "not a CXXMethodDecl?");
-  evalMethodCall(MCE, MD, ObjArgExpr, Pred, AllargsEvaluated, Dst);
-}
-
-void ExprEngine::VisitCXXOperatorCallExpr(const CXXOperatorCallExpr *C,
-                                            ExplodedNode *Pred,
-                                            ExplodedNodeSet &Dst) {
-  const CXXMethodDecl *MD = dyn_cast_or_null<CXXMethodDecl>(C->getCalleeDecl());
-  if (!MD) {
-    // If the operator doesn't represent a method call treat as regural call.
-    VisitCall(C, Pred, C->arg_begin(), C->arg_end(), Dst);
-    return;
-  }
-
-  // Determine the type of function we're calling (if available).
-  const FunctionProtoType *Proto = NULL;
-  QualType FnType = C->getCallee()->IgnoreParens()->getType();
-  if (const PointerType *FnTypePtr = FnType->getAs<PointerType>())
-    Proto = FnTypePtr->getPointeeType()->getAs<FunctionProtoType>();
-
-  // Evaluate arguments treating the first one (object method is called on)
-  // as alvalue.
-  ExplodedNodeSet argsEvaluated;
-  evalArguments(C->arg_begin(), C->arg_end(), Proto, Pred, argsEvaluated, true);
-
-  // Now evaluate the call itself.
-  evalMethodCall(C, MD, C->getArg(0), Pred, argsEvaluated, Dst);
-}
-
-void ExprEngine::evalMethodCall(const CallExpr *MCE, const CXXMethodDecl *MD,
-                                  const Expr *ThisExpr, ExplodedNode *Pred,
-                                  ExplodedNodeSet &Src, ExplodedNodeSet &Dst) {
-  // Allow checkers to pre-visit the member call.
-  ExplodedNodeSet PreVisitChecks;
-  CheckerVisit(MCE, PreVisitChecks, Src, PreVisitStmtCallback);
-
-  if (!(MD->isThisDeclarationADefinition() && AMgr.shouldInlineCall())) {
-    // FIXME: conservative method call evaluation.
-    CheckerVisit(MCE, Dst, PreVisitChecks, PostVisitStmtCallback);
-    return;
-  }
-
-  const StackFrameContext *SFC = AMgr.getStackFrame(MD, 
-                                                    Pred->getLocationContext(),
-                                                    MCE,
-                                                    Builder->getBlock(), 
-                                                    Builder->getIndex());
-  const CXXThisRegion *ThisR = getCXXThisRegion(MD, SFC);
-  CallEnter Loc(MCE, SFC, Pred->getLocationContext());
-  for (ExplodedNodeSet::iterator I = PreVisitChecks.begin(),
-         E = PreVisitChecks.end(); I != E; ++I) {
-    // Set up 'this' region.
-    const GRState *state = GetState(*I);
-    state = state->bindLoc(loc::MemRegionVal(ThisR), state->getSVal(ThisExpr));
-    Dst.Add(Builder->generateNode(Loc, state, *I));
-  }
-}
-
 void ExprEngine::VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred,
                                    ExplodedNodeSet &Dst) {
-  if (CNE->isArray()) {
-    // FIXME: allocating an array has not been handled.
-    return;
-  }
-
-  unsigned Count = Builder->getCurrentBlockCount();
+  
+  unsigned blockCount = Builder->getCurrentBlockCount();
   DefinedOrUnknownSVal symVal =
-    svalBuilder.getConjuredSymbolVal(NULL, CNE, CNE->getType(), Count);
-  const MemRegion *NewReg = cast<loc::MemRegionVal>(symVal).getRegion();
-
+    svalBuilder.getConjuredSymbolVal(NULL, CNE, CNE->getType(), blockCount);
+  const MemRegion *NewReg = cast<loc::MemRegionVal>(symVal).getRegion();  
   QualType ObjTy = CNE->getType()->getAs<PointerType>()->getPointeeType();
-
   const ElementRegion *EleReg = 
-                         getStoreManager().GetElementZeroRegion(NewReg, ObjTy);
+    getStoreManager().GetElementZeroRegion(NewReg, ObjTy);
+
+  if (CNE->isArray()) {
+    // FIXME: allocating an array requires simulating the constructors.
+    // For now, just return a symbolicated region.
+    const GRState *state = GetState(Pred);
+    state = state->BindExpr(CNE, loc::MemRegionVal(EleReg));
+    MakeNode(Dst, CNE, Pred, state);
+    return;
+  }
 
   // Evaluate constructor arguments.
   const FunctionProtoType *FnType = NULL;
@@ -277,11 +297,39 @@ void ExprEngine::VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred,
   // Initialize the object region and bind the 'new' expression.
   for (ExplodedNodeSet::iterator I = argsEvaluated.begin(), 
                                  E = argsEvaluated.end(); I != E; ++I) {
+
     const GRState *state = GetState(*I);
+    
+    // Accumulate list of regions that are invalidated.
+    // FIXME: Eventually we should unify the logic for constructor
+    // processing in one place.
+    llvm::SmallVector<const MemRegion*, 10> regionsToInvalidate;
+    for (CXXNewExpr::const_arg_iterator
+          ai = CNE->constructor_arg_begin(), ae = CNE->constructor_arg_end();
+          ai != ae; ++ai)
+    {
+      SVal val = state->getSVal(*ai);
+      if (const MemRegion *region = val.getAsRegion())
+        regionsToInvalidate.push_back(region);
+    }
 
     if (ObjTy->isRecordType()) {
-      state = state->invalidateRegion(EleReg, CNE, Count);
+      regionsToInvalidate.push_back(EleReg);
+      // Invalidate the regions.
+      state = state->invalidateRegions(regionsToInvalidate.data(),
+                                       regionsToInvalidate.data() +
+                                       regionsToInvalidate.size(),
+                                       CNE, blockCount, 0,
+                                       /* invalidateGlobals = */ true);
+      
     } else {
+      // Invalidate the regions.
+      state = state->invalidateRegions(regionsToInvalidate.data(),
+                                       regionsToInvalidate.data() +
+                                       regionsToInvalidate.size(),
+                                       CNE, blockCount, 0,
+                                       /* invalidateGlobals = */ true);
+
       if (CNE->hasInitializer()) {
         SVal V = state->getSVal(*CNE->constructor_arg_begin());
         state = state->bindLoc(loc::MemRegionVal(EleReg), V);
diff --git a/lib/StaticAnalyzer/Core/Checker.cpp b/lib/StaticAnalyzer/Core/CheckerContext.cpp
index a014eec..f6fb8f2 100644
--- a/lib/StaticAnalyzer/Core/Checker.cpp
+++ b/lib/StaticAnalyzer/Core/CheckerContext.cpp
@@ -1,4 +1,4 @@
-//== Checker.h - Abstract interface for checkers -----------------*- C++ -*--=//
+//== CheckerContext.cpp - Context info for path-sensitive checkers-----------=//
 //
 //                     The LLVM Compiler Infrastructure
 //
@@ -7,17 +7,15 @@
 //
 //===----------------------------------------------------------------------===//
 //
-//  This file defines Checker and CheckerVisitor, classes used for creating
-//  domain-specific checks.
+//  This file defines CheckerContext that provides contextual info for
+//  path-sensitive checkers.
 //
 //===----------------------------------------------------------------------===//
 
-#include "clang/StaticAnalyzer/Core/PathSensitive/Checker.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 using namespace clang;
 using namespace ento;
 
-Checker::~Checker() {}
-
 CheckerContext::~CheckerContext() {
   // Do we need to autotransition?  'Dst' can get populated in a variety of
   // ways, including 'addTransition()' adding the predecessor node to Dst
diff --git a/lib/StaticAnalyzer/Core/CheckerManager.cpp b/lib/StaticAnalyzer/Core/CheckerManager.cpp
index 75d331a..4a25490 100644
--- a/lib/StaticAnalyzer/Core/CheckerManager.cpp
+++ b/lib/StaticAnalyzer/Core/CheckerManager.cpp
@@ -20,6 +20,32 @@
 using namespace clang;
 using namespace ento;
 
+bool CheckerManager::hasPathSensitiveCheckers() const {
+  return !StmtCheckers.empty()              ||
+         !PreObjCMessageCheckers.empty()    ||
+         !PostObjCMessageCheckers.empty()   ||
+         !LocationCheckers.empty()          ||
+         !BindCheckers.empty()              ||
+         !EndAnalysisCheckers.empty()       ||
+         !EndPathCheckers.empty()           ||
+         !BranchConditionCheckers.empty()   ||
+         !LiveSymbolsCheckers.empty()       ||
+         !DeadSymbolsCheckers.empty()       ||
+         !RegionChangesCheckers.empty()     ||
+         !EvalAssumeCheckers.empty()        ||
+         !EvalCallCheckers.empty();
+}
+
+void CheckerManager::finishedCheckerRegistration() {
+#ifndef NDEBUG
+  // Make sure that for every event that has listeners, there is at least
+  // one dispatcher registered for it.
+  for (llvm::DenseMap<EventTag, EventInfo>::iterator
+         I = Events.begin(), E = Events.end(); I != E; ++I)
+    assert(I->second.HasDispatcher && "No dispatcher registered for an event");
+#endif
+}
+
 //===----------------------------------------------------------------------===//
 // Functions for running checkers for AST traversing..
 //===----------------------------------------------------------------------===//
@@ -205,6 +231,40 @@ void CheckerManager::runCheckersForLocation(ExplodedNodeSet &Dst,
   expandGraphWithCheckers(C, Dst, Src);
 }
 
+namespace {
+  struct CheckBindContext {
+    typedef std::vector<CheckerManager::CheckBindFunc> CheckersTy;
+    const CheckersTy &Checkers;
+    SVal Loc;
+    SVal Val;
+    const Stmt *S;
+    ExprEngine &Eng;
+
+    CheckersTy::const_iterator checkers_begin() { return Checkers.begin(); }
+    CheckersTy::const_iterator checkers_end() { return Checkers.end(); }
+
+    CheckBindContext(const CheckersTy &checkers,
+                     SVal loc, SVal val, const Stmt *s, ExprEngine &eng)
+      : Checkers(checkers), Loc(loc), Val(val), S(s), Eng(eng) { }
+
+    void runChecker(CheckerManager::CheckBindFunc checkFn,
+                    ExplodedNodeSet &Dst, ExplodedNode *Pred) {
+      CheckerContext C(Dst, Eng.getBuilder(), Eng, Pred, checkFn.Checker,
+                       ProgramPoint::PreStmtKind, 0, S);
+      checkFn(Loc, Val, C);
+    }
+  };
+}
+
+/// \brief Run checkers for binding of a value to a location.
+void CheckerManager::runCheckersForBind(ExplodedNodeSet &Dst,
+                                        const ExplodedNodeSet &Src,
+                                        SVal location, SVal val,
+                                        const Stmt *S, ExprEngine &Eng) {
+  CheckBindContext C(BindCheckers, location, val, S, Eng);
+  expandGraphWithCheckers(C, Dst, Src);
+}
+
 void CheckerManager::runCheckersForEndAnalysis(ExplodedGraph &G,
                                                BugReporter &BR,
                                                ExprEngine &Eng) {
@@ -222,6 +282,16 @@ void CheckerManager::runCheckersForEndPath(EndOfFunctionNodeBuilder &B,
   }
 }
 
+/// \brief Run checkers for branch condition.
+void CheckerManager::runCheckersForBranchCondition(const Stmt *condition,
+                                                   BranchNodeBuilder &B,
+                                                   ExprEngine &Eng) {
+  for (unsigned i = 0, e = BranchConditionCheckers.size(); i != e; ++i) {
+    CheckBranchConditionFunc fn = BranchConditionCheckers[i];
+    fn(condition, B, Eng);
+  }
+}
+
 /// \brief Run checkers for live symbols.
 void CheckerManager::runCheckersForLiveSymbols(const GRState *state,
                                                SymbolReaper &SymReaper) {
@@ -287,6 +357,20 @@ CheckerManager::runCheckersForRegionChanges(const GRState *state,
   return state;
 }
 
+/// \brief Run checkers for handling assumptions on symbolic values.
+const GRState *
+CheckerManager::runCheckersForEvalAssume(const GRState *state,
+                                         SVal Cond, bool Assumption) {
+  for (unsigned i = 0, e = EvalAssumeCheckers.size(); i != e; ++i) {
+    // If any checker declares the state infeasible (or if it starts that way),
+    // bail out.
+    if (!state)
+      return NULL;
+    state = EvalAssumeCheckers[i](state, Cond, Assumption);
+  }
+  return state;
+}
+
 /// \brief Run checkers for evaluating a call.
 /// Only one checker will evaluate the call.
 void CheckerManager::runCheckersForEvalCall(ExplodedNodeSet &Dst,
@@ -371,6 +455,10 @@ void CheckerManager::_registerForLocation(CheckLocationFunc checkfn) {
   LocationCheckers.push_back(checkfn);
 }
 
+void CheckerManager::_registerForBind(CheckBindFunc checkfn) {
+  BindCheckers.push_back(checkfn);
+}
+
 void CheckerManager::_registerForEndAnalysis(CheckEndAnalysisFunc checkfn) {
   EndAnalysisCheckers.push_back(checkfn);
 }
@@ -379,6 +467,11 @@ void CheckerManager::_registerForEndPath(CheckEndPathFunc checkfn) {
   EndPathCheckers.push_back(checkfn);
 }
 
+void CheckerManager::_registerForBranchCondition(
+                                             CheckBranchConditionFunc checkfn) {
+  BranchConditionCheckers.push_back(checkfn);
+}
+
 void CheckerManager::_registerForLiveSymbols(CheckLiveSymbolsFunc checkfn) {
   LiveSymbolsCheckers.push_back(checkfn);
 }
@@ -393,6 +486,10 @@ void CheckerManager::_registerForRegionChanges(CheckRegionChangesFunc checkfn,
   RegionChangesCheckers.push_back(info);
 }
 
+void CheckerManager::_registerForEvalAssume(EvalAssumeFunc checkfn) {
+  EvalAssumeCheckers.push_back(checkfn);
+}
+
 void CheckerManager::_registerForEvalCall(EvalCallFunc checkfn) {
   EvalCallCheckers.push_back(checkfn);
 }
diff --git a/lib/StaticAnalyzer/Core/CoreEngine.cpp b/lib/StaticAnalyzer/Core/CoreEngine.cpp
index 08a2068..34cd6e8 100644
--- a/lib/StaticAnalyzer/Core/CoreEngine.cpp
+++ b/lib/StaticAnalyzer/Core/CoreEngine.cpp
@@ -19,8 +19,6 @@
 #include "clang/AST/Expr.h"
 #include "llvm/Support/Casting.h"
 #include "llvm/ADT/DenseMap.h"
-#include <vector>
-#include <queue>
 
 using llvm::cast;
 using llvm::isa;
@@ -310,7 +308,7 @@ void CoreEngine::HandleBlockEdge(const BlockEdge& L, ExplodedNode* Pred) {
   for (llvm::SmallVectorImpl<ExplodedNode*>::const_iterator
        I = nodeBuilder.sinks().begin(), E = nodeBuilder.sinks().end();
        I != E; ++I) {
-    blocksAborted.push_back(std::make_pair(L, *I));
+    blocksExhausted.push_back(std::make_pair(L, *I));
   }
 }
 
@@ -602,6 +600,25 @@ StmtNodeBuilder::generateNodeInternal(const ProgramPoint &Loc,
   return NULL;
 }
 
+// This function generate a new ExplodedNode but not a new branch(block edge).
+ExplodedNode* BranchNodeBuilder::generateNode(const Stmt* Condition,
+                                              const GRState* State) {
+  bool IsNew;
+  
+  ExplodedNode* Succ 
+    = Eng.G->getNode(PostCondition(Condition, Pred->getLocationContext()), State,
+                     &IsNew);
+  
+  Succ->addPredecessor(Pred, *Eng.G);
+  
+  Pred = Succ;
+  
+  if (IsNew) 
+    return Succ;
+  
+  return NULL;
+}
+
 ExplodedNode* BranchNodeBuilder::generateNode(const GRState* State,
                                                 bool branch) {
 
diff --git a/lib/StaticAnalyzer/Core/Environment.cpp b/lib/StaticAnalyzer/Core/Environment.cpp
index 1bffa30..a00f9dc1 100644
--- a/lib/StaticAnalyzer/Core/Environment.cpp
+++ b/lib/StaticAnalyzer/Core/Environment.cpp
@@ -27,7 +27,17 @@ SVal Environment::lookupExpr(const Stmt* E) const {
   return UnknownVal();
 }
 
-SVal Environment::getSVal(const Stmt *E, SValBuilder& svalBuilder) const {
+SVal Environment::getSVal(const Stmt *E, SValBuilder& svalBuilder,
+			  bool useOnlyDirectBindings) const {
+
+  if (useOnlyDirectBindings) {
+    // This branch is rarely taken, but can be exercised by
+    // checkers that explicitly bind values to arbitrary
+    // expressions.  It is crucial that we do not ignore any
+    // expression here, and do a direct lookup.
+    return lookupExpr(E);
+  }
+
   for (;;) {
     switch (E->getStmtClass()) {
       case Stmt::AddrLabelExprClass:
@@ -41,6 +51,10 @@ SVal Environment::getSVal(const Stmt *E, SValBuilder& svalBuilder) const {
         // ParenExprs are no-ops.
         E = cast<ParenExpr>(E)->getSubExpr();
         continue;
+      case Stmt::GenericSelectionExprClass:
+        // GenericSelectionExprs are no-ops.
+        E = cast<GenericSelectionExpr>(E)->getResultExpr();
+        continue;
       case Stmt::CharacterLiteralClass: {
         const CharacterLiteral* C = cast<CharacterLiteral>(E);
         return svalBuilder.makeIntVal(C->getValue(), C->getType());
@@ -60,6 +74,9 @@ SVal Environment::getSVal(const Stmt *E, SValBuilder& svalBuilder) const {
         else
           return svalBuilder.makeIntVal(cast<IntegerLiteral>(E));
       }
+      // For special C0xx nullptr case, make a null pointer SVal.
+      case Stmt::CXXNullPtrLiteralExprClass:
+        return svalBuilder.makeNull();
       case Stmt::ImplicitCastExprClass:
       case Stmt::CXXFunctionalCastExprClass:
       case Stmt::CStyleCastExprClass: {
diff --git a/lib/StaticAnalyzer/Core/ExplodedGraph.cpp b/lib/StaticAnalyzer/Core/ExplodedGraph.cpp
index 2a8364d..fa16fea 100644
--- a/lib/StaticAnalyzer/Core/ExplodedGraph.cpp
+++ b/lib/StaticAnalyzer/Core/ExplodedGraph.cpp
@@ -374,7 +374,7 @@ ExplodedGraph::TrimInternal(const ExplodedNode* const* BeginSources,
         WL2.push_back(*I);
     }
 
-    // Finally, explictly mark all nodes without any successors as sinks.
+    // Finally, explicitly mark all nodes without any successors as sinks.
     if (N->isSink())
       NewN->markAsSink();
   }
diff --git a/lib/StaticAnalyzer/Checkers/ExprEngine.cpp b/lib/StaticAnalyzer/Core/ExprEngine.cpp
index c1b1e65..657420d 100644
--- a/lib/StaticAnalyzer/Checkers/ExprEngine.cpp
+++ b/lib/StaticAnalyzer/Core/ExprEngine.cpp
@@ -13,15 +13,11 @@
 //
 //===----------------------------------------------------------------------===//
 
-// FIXME: Restructure checker registration.
-#include "InternalChecks.h"
-
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngineBuilders.h"
-#include "clang/StaticAnalyzer/Core/PathSensitive/Checker.h"
 #include "clang/AST/CharUnits.h"
 #include "clang/AST/ParentMap.h"
 #include "clang/AST/StmtObjC.h"
@@ -63,278 +59,9 @@ static inline Selector GetNullarySelector(const char* name, ASTContext& Ctx) {
 }
 
 //===----------------------------------------------------------------------===//
-// Checker worklist routines.
-//===----------------------------------------------------------------------===//
-
-void ExprEngine::CheckerVisit(const Stmt *S, ExplodedNodeSet &Dst,
-                                ExplodedNodeSet &Src, CallbackKind Kind) {
-
-  // Determine if we already have a cached 'CheckersOrdered' vector
-  // specifically tailored for the provided <CallbackKind, Stmt kind>.  This
-  // can reduce the number of checkers actually called.
-  CheckersOrdered *CO = &Checkers;
-  llvm::OwningPtr<CheckersOrdered> NewCO;
-
-  // The cache key is made up of the and the callback kind (pre- or post-visit)
-  // and the statement kind.
-  CallbackTag K = GetCallbackTag(Kind, S->getStmtClass());
-
-  CheckersOrdered *& CO_Ref = COCache[K];
-  
-  if (!CO_Ref) {
-    // If we have no previously cached CheckersOrdered vector for this
-    // statement kind, then create one.
-    NewCO.reset(new CheckersOrdered);
-  }
-  else {
-    // Use the already cached set.
-    CO = CO_Ref;
-  }
-  
-  if (CO->empty()) {
-    // If there are no checkers, just delegate to the checker manager.
-    getCheckerManager().runCheckersForStmt(Kind == PreVisitStmtCallback,
-                                           Dst, Src, S, *this);
-    return;
-  }
-
-  ExplodedNodeSet CheckersV1Dst;
-  ExplodedNodeSet Tmp;
-  ExplodedNodeSet *PrevSet = &Src;
-  unsigned checkersEvaluated = 0;
-
-  for (CheckersOrdered::iterator I=CO->begin(), E=CO->end(); I!=E; ++I) {
-    // If all nodes are sunk, bail out early.
-    if (PrevSet->empty())
-      break;
-    ExplodedNodeSet *CurrSet = 0;
-    if (I+1 == E)
-      CurrSet = &CheckersV1Dst;
-    else {
-      CurrSet = (PrevSet == &Tmp) ? &Src : &Tmp;
-      CurrSet->clear();
-    }
-    void *tag = I->first;
-    Checker *checker = I->second;
-    bool respondsToCallback = true;
-
-    for (ExplodedNodeSet::iterator NI = PrevSet->begin(), NE = PrevSet->end();
-         NI != NE; ++NI) {
-
-      checker->GR_Visit(*CurrSet, *Builder, *this, S, *NI, tag,
-                        Kind == PreVisitStmtCallback, respondsToCallback);
-      
-    }
-
-    PrevSet = CurrSet;
-
-    if (NewCO.get()) {
-      ++checkersEvaluated;
-      if (respondsToCallback)
-        NewCO->push_back(*I);
-    }    
-  }
-  
-  // If we built NewCO, check if we called all the checkers.  This is important
-  // so that we know that we accurately determined the entire set of checkers
-  // that responds to this callback.  Note that 'checkersEvaluated' might
-  // not be the same as Checkers.size() if one of the Checkers generates
-  // a sink node.
-  if (NewCO.get() && checkersEvaluated == Checkers.size())
-    CO_Ref = NewCO.take();
-
-  // Don't autotransition.  The CheckerContext objects should do this
-  // automatically.
-
-  getCheckerManager().runCheckersForStmt(Kind == PreVisitStmtCallback,
-                                         Dst, CheckersV1Dst, S, *this);
-}
-
-void ExprEngine::CheckerVisitObjCMessage(const ObjCMessage &msg,
-                                         ExplodedNodeSet &Dst,
-                                         ExplodedNodeSet &Src,
-                                         bool isPrevisit) {
-
-  if (Checkers.empty()) {
-    getCheckerManager().runCheckersForObjCMessage(isPrevisit, Dst, Src, msg,
-                                                  *this);
-    return;
-  }
-
-  ExplodedNodeSet CheckersV1Dst;
-  ExplodedNodeSet Tmp;
-  ExplodedNodeSet *PrevSet = &Src;
-
-  for (CheckersOrdered::iterator I=Checkers.begin(),E=Checkers.end(); I!=E; ++I)
-  {
-    ExplodedNodeSet *CurrSet = 0;
-    if (I+1 == E)
-      CurrSet = &CheckersV1Dst;
-    else {
-      CurrSet = (PrevSet == &Tmp) ? &Src : &Tmp;
-      CurrSet->clear();
-    }
-
-    void *tag = I->first;
-    Checker *checker = I->second;
-
-    for (ExplodedNodeSet::iterator NI = PrevSet->begin(), NE = PrevSet->end();
-         NI != NE; ++NI)
-      checker->GR_visitObjCMessage(*CurrSet, *Builder, *this, msg,
-                                   *NI, tag, isPrevisit);
-
-    // Update which NodeSet is the current one.
-    PrevSet = CurrSet;
-  }
-
-  getCheckerManager().runCheckersForObjCMessage(isPrevisit, Dst, CheckersV1Dst,
-                                                msg, *this);
-}
-
-void ExprEngine::CheckerEvalNilReceiver(const ObjCMessage &msg,
-                                        ExplodedNodeSet &Dst,
-                                        const GRState *state,
-                                        ExplodedNode *Pred) {
-  bool evaluated = false;
-  ExplodedNodeSet DstTmp;
-
-  for (CheckersOrdered::iterator I=Checkers.begin(),E=Checkers.end();I!=E;++I) {
-    void *tag = I->first;
-    Checker *checker = I->second;
-
-    if (checker->GR_evalNilReceiver(DstTmp, *Builder, *this, msg, Pred, state,
-                                    tag)) {
-      evaluated = true;
-      break;
-    } else
-      // The checker didn't evaluate the expr. Restore the Dst.
-      DstTmp.clear();
-  }
-
-  if (evaluated)
-    Dst.insert(DstTmp);
-  else
-    Dst.insert(Pred);
-}
-
-// CheckerEvalCall returns true if one of the checkers processed the node.
-// This may return void when all call evaluation logic goes to some checker
-// in the future.
-bool ExprEngine::CheckerEvalCall(const CallExpr *CE,
-                                   ExplodedNodeSet &Dst,
-                                   ExplodedNode *Pred) {
-  bool evaluated = false;
-  ExplodedNodeSet DstTmp;
-
-  for (CheckersOrdered::iterator I=Checkers.begin(),E=Checkers.end();I!=E;++I) {
-    void *tag = I->first;
-    Checker *checker = I->second;
-
-    if (checker->GR_evalCallExpr(DstTmp, *Builder, *this, CE, Pred, tag)) {
-      evaluated = true;
-      break;
-    } else
-      // The checker didn't evaluate the expr. Restore the DstTmp set.
-      DstTmp.clear();
-  }
-
-  if (evaluated) {
-    Dst.insert(DstTmp);
-    return evaluated;
-  }
-
-  class DefaultEval : public GraphExpander {
-    bool &Evaluated;
-  public:
-    DefaultEval(bool &evaluated) : Evaluated(evaluated) { }
-    virtual void expandGraph(ExplodedNodeSet &Dst, ExplodedNode *Pred) {
-      Evaluated = false;
-      Dst.insert(Pred);
-    }
-  };
-
-  evaluated = true;
-  DefaultEval defaultEval(evaluated);
-  getCheckerManager().runCheckersForEvalCall(Dst, Pred, CE, *this,
-                                             &defaultEval);
-  return evaluated;
-}
-
-// FIXME: This is largely copy-paste from CheckerVisit().  Need to
-// unify.
-void ExprEngine::CheckerVisitBind(const Stmt *StoreE, ExplodedNodeSet &Dst,
-                                    ExplodedNodeSet &Src, SVal location,
-                                    SVal val, bool isPrevisit) {
-
-  if (Checkers.empty()) {
-    Dst.insert(Src);
-    return;
-  }
-
-  ExplodedNodeSet Tmp;
-  ExplodedNodeSet *PrevSet = &Src;
-
-  for (CheckersOrdered::iterator I=Checkers.begin(),E=Checkers.end(); I!=E; ++I)
-  {
-    ExplodedNodeSet *CurrSet = 0;
-    if (I+1 == E)
-      CurrSet = &Dst;
-    else {
-      CurrSet = (PrevSet == &Tmp) ? &Src : &Tmp;
-      CurrSet->clear();
-    }
-
-    void *tag = I->first;
-    Checker *checker = I->second;
-
-    for (ExplodedNodeSet::iterator NI = PrevSet->begin(), NE = PrevSet->end();
-         NI != NE; ++NI)
-      checker->GR_VisitBind(*CurrSet, *Builder, *this, StoreE,
-                            *NI, tag, location, val, isPrevisit);
-
-    // Update which NodeSet is the current one.
-    PrevSet = CurrSet;
-  }
-
-  // Don't autotransition.  The CheckerContext objects should do this
-  // automatically.
-}
-//===----------------------------------------------------------------------===//
 // Engine construction and deletion.
 //===----------------------------------------------------------------------===//
 
-static void RegisterInternalChecks(ExprEngine &Eng) {
-  // Register internal "built-in" BugTypes with the BugReporter. These BugTypes
-  // are different than what probably many checks will do since they don't
-  // create BugReports on-the-fly but instead wait until ExprEngine finishes
-  // analyzing a function.  Generation of BugReport objects is done via a call
-  // to 'FlushReports' from BugReporter.
-  // The following checks do not need to have their associated BugTypes
-  // explicitly registered with the BugReporter.  If they issue any BugReports,
-  // their associated BugType will get registered with the BugReporter
-  // automatically.  Note that the check itself is owned by the ExprEngine
-  // object.
-  RegisterAdjustedReturnValueChecker(Eng);
-  // CallAndMessageChecker should be registered before AttrNonNullChecker,
-  // where we assume arguments are not undefined.
-  RegisterCallAndMessageChecker(Eng);
-  RegisterAttrNonNullChecker(Eng);
-  RegisterDereferenceChecker(Eng);
-  RegisterVLASizeChecker(Eng);
-  RegisterDivZeroChecker(Eng);
-  RegisterReturnUndefChecker(Eng);
-  RegisterUndefinedArraySubscriptChecker(Eng);
-  RegisterUndefinedAssignmentChecker(Eng);
-  RegisterUndefBranchChecker(Eng);
-  RegisterUndefCapturedBlockVarChecker(Eng);
-  RegisterUndefResultChecker(Eng);
-
-  // This is not a checker yet.
-  RegisterNoReturnFunctionChecker(Eng);
-  RegisterBuiltinFunctionChecker(Eng);
-  RegisterOSAtomicChecker(Eng);
-}
-
 ExprEngine::ExprEngine(AnalysisManager &mgr, TransferFuncs *tf)
   : AMgr(mgr),
     Engine(*this),
@@ -349,8 +76,6 @@ ExprEngine::ExprEngine(AnalysisManager &mgr, TransferFuncs *tf)
     NSExceptionII(NULL), NSExceptionInstanceRaiseSelectors(NULL),
     RaiseSel(GetNullarySelector("raise", getContext())),
     BR(mgr, *this), TF(tf) {
-  // Register internal checks.
-  RegisterInternalChecks(*this);
 
   // FIXME: Eventually remove the TF object entirely.
   TF->RegisterChecks(*this);
@@ -365,14 +90,6 @@ ExprEngine::ExprEngine(AnalysisManager &mgr, TransferFuncs *tf)
 ExprEngine::~ExprEngine() {
   BR.FlushReports();
   delete [] NSExceptionInstanceRaiseSelectors;
-  
-  // Delete the set of checkers.
-  for (CheckersOrdered::iterator I=Checkers.begin(), E=Checkers.end(); I!=E;++I)
-    delete I->second;
-  
-  for (CheckersOrderedCache::iterator I=COCache.begin(), E=COCache.end();
-       I!=E;++I)
-    delete I->second;
 }
 
 //===----------------------------------------------------------------------===//
@@ -447,51 +164,7 @@ const GRState* ExprEngine::getInitialState(const LocationContext *InitLoc) {
 ///  logic for handling assumptions on symbolic values.
 const GRState *ExprEngine::processAssume(const GRState *state, SVal cond,
                                            bool assumption) {
-  // Determine if we already have a cached 'CheckersOrdered' vector
-  // specifically tailored for processing assumptions.  This
-  // can reduce the number of checkers actually called.
-  CheckersOrdered *CO = &Checkers;
-  llvm::OwningPtr<CheckersOrdered> NewCO;
-
-  CallbackTag K = GetCallbackTag(processAssumeCallback);
-  CheckersOrdered *& CO_Ref = COCache[K];
-
-  if (!CO_Ref) {
-    // If we have no previously cached CheckersOrdered vector for this
-    // statement kind, then create one.
-    NewCO.reset(new CheckersOrdered);
-  }
-  else {
-    // Use the already cached set.
-    CO = CO_Ref;
-  }
-
-  if (!CO->empty()) {
-    // Let the checkers have a crack at the assume before the transfer functions
-    // get their turn.
-    for (CheckersOrdered::iterator I = CO->begin(), E = CO->end(); I!=E; ++I) {
-
-      // If any checker declares the state infeasible (or if it starts that
-      // way), bail out.
-      if (!state)
-        return NULL;
-
-      Checker *C = I->second;
-      bool respondsToCallback = true;
-
-      state = C->evalAssume(state, cond, assumption, &respondsToCallback);
-
-      // Check if we're building the cache of checkers that care about
-      // assumptions.
-      if (NewCO.get() && respondsToCallback)
-        NewCO->push_back(*I);
-    }
-
-    // If we got through all the checkers, and we built a list of those that
-    // care about assumptions, save it.
-    if (NewCO.get())
-      CO_Ref = NewCO.take();
-  }
+  state = getCheckerManager().runCheckersForEvalAssume(state, cond, assumption);
 
   // If the state is infeasible at this point, bail out.
   if (!state)
@@ -501,18 +174,6 @@ const GRState *ExprEngine::processAssume(const GRState *state, SVal cond,
 }
 
 bool ExprEngine::wantsRegionChangeUpdate(const GRState* state) {
-  CallbackTag K = GetCallbackTag(EvalRegionChangesCallback);
-  CheckersOrdered *CO = COCache[K];
-
-  if (!CO)
-    CO = &Checkers;
-
-  for (CheckersOrdered::iterator I = CO->begin(), E = CO->end(); I != E; ++I) {
-    Checker *C = I->second;
-    if (C->wantsRegionChangeUpdate(state))
-      return true;
-  }
-
   return getCheckerManager().wantsRegionChangeUpdate(state);
 }
 
@@ -520,78 +181,30 @@ const GRState *
 ExprEngine::processRegionChanges(const GRState *state,
                                    const MemRegion * const *Begin,
                                    const MemRegion * const *End) {
-  // FIXME: Most of this method is copy-pasted from processAssume.
-
-  // Determine if we already have a cached 'CheckersOrdered' vector
-  // specifically tailored for processing region changes.  This
-  // can reduce the number of checkers actually called.
-  CheckersOrdered *CO = &Checkers;
-  llvm::OwningPtr<CheckersOrdered> NewCO;
-
-  CallbackTag K = GetCallbackTag(EvalRegionChangesCallback);
-  CheckersOrdered *& CO_Ref = COCache[K];
-
-  if (!CO_Ref) {
-    // If we have no previously cached CheckersOrdered vector for this
-    // callback, then create one.
-    NewCO.reset(new CheckersOrdered);
-  }
-  else {
-    // Use the already cached set.
-    CO = CO_Ref;
-  }
-
-  // If there are no checkers, just delegate to the checker manager.
-  if (CO->empty())
-    return getCheckerManager().runCheckersForRegionChanges(state, Begin, End);
-
-  for (CheckersOrdered::iterator I = CO->begin(), E = CO->end(); I != E; ++I) {
-    // If any checker declares the state infeasible (or if it starts that way),
-    // bail out.
-    if (!state)
-      return NULL;
-
-    Checker *C = I->second;
-    bool respondsToCallback = true;
-
-    state = C->EvalRegionChanges(state, Begin, End, &respondsToCallback);
-
-    // See if we're building a cache of checkers that care about region changes.
-    if (NewCO.get() && respondsToCallback)
-      NewCO->push_back(*I);
-  }
-
-  // If we got through all the checkers, and we built a list of those that
-  // care about region changes, save it.
-  if (NewCO.get())
-    CO_Ref = NewCO.take();
-
   return getCheckerManager().runCheckersForRegionChanges(state, Begin, End);
 }
 
 void ExprEngine::processEndWorklist(bool hasWorkRemaining) {
-  for (CheckersOrdered::iterator I = Checkers.begin(), E = Checkers.end();
-       I != E; ++I) {
-    I->second->VisitEndAnalysis(G, BR, *this);
-  }
   getCheckerManager().runCheckersForEndAnalysis(G, BR, *this);
 }
 
 void ExprEngine::processCFGElement(const CFGElement E, 
                                   StmtNodeBuilder& builder) {
   switch (E.getKind()) {
-  case CFGElement::Statement:
-    ProcessStmt(E.getAs<CFGStmt>(), builder);
-    break;
-  case CFGElement::Initializer:
-    ProcessInitializer(E.getAs<CFGInitializer>(), builder);
-    break;
-  case CFGElement::ImplicitDtor:
-    ProcessImplicitDtor(E.getAs<CFGImplicitDtor>(), builder);
-    break;
-  default:
-    // Suppress compiler warning.
-    llvm_unreachable("Unexpected CFGElement kind.");
+    case CFGElement::Invalid:
+      llvm_unreachable("Unexpected CFGElement kind.");
+    case CFGElement::Statement:
+      ProcessStmt(E.getAs<CFGStmt>()->getStmt(), builder);
+      return;
+    case CFGElement::Initializer:
+      ProcessInitializer(E.getAs<CFGInitializer>()->getInitializer(), builder);
+      return;
+    case CFGElement::AutomaticObjectDtor:
+    case CFGElement::BaseDtor:
+    case CFGElement::MemberDtor:
+    case CFGElement::TemporaryDtor:
+      ProcessImplicitDtor(*E.getAs<CFGImplicitDtor>(), builder);
+      return;
   }
 }
 
@@ -615,13 +228,6 @@ void ExprEngine::ProcessStmt(const CFGStmt S, StmtNodeBuilder& builder) {
 
   if (AMgr.shouldPurgeDead()) {
     const GRState *St = EntryNode->getState();
-
-    for (CheckersOrdered::iterator I = Checkers.begin(), E = Checkers.end();
-         I != E; ++I) {
-      Checker *checker = I->second;
-      checker->MarkLiveSymbols(St, SymReaper);
-    }
-
     getCheckerManager().runCheckersForLiveSymbols(St, SymReaper);
 
     const StackFrameContext *SFC = LC->getCurrentStackFrame();
@@ -647,33 +253,7 @@ void ExprEngine::ProcessStmt(const CFGStmt S, StmtNodeBuilder& builder) {
     getTF().evalDeadSymbols(Tmp2, *this, *Builder, EntryNode,
                             CleanedState, SymReaper);
 
-    ExplodedNodeSet checkersV1Tmp;
-    if (Checkers.empty())
-      checkersV1Tmp.insert(Tmp2);
-    else {
-      ExplodedNodeSet Tmp3;
-      ExplodedNodeSet *SrcSet = &Tmp2;
-      for (CheckersOrdered::iterator I = Checkers.begin(), E = Checkers.end();
-           I != E; ++I) {
-        ExplodedNodeSet *DstSet = 0;
-        if (I+1 == E)
-          DstSet = &checkersV1Tmp;
-        else {
-          DstSet = (SrcSet == &Tmp2) ? &Tmp3 : &Tmp2;
-          DstSet->clear();
-        }
-
-        void *tag = I->first;
-        Checker *checker = I->second;
-        for (ExplodedNodeSet::iterator NI = SrcSet->begin(), NE = SrcSet->end();
-             NI != NE; ++NI)
-          checker->GR_evalDeadSymbols(*DstSet, *Builder, *this, currentStmt,
-                                      *NI, SymReaper, tag);
-        SrcSet = DstSet;
-      }
-    }
-
-    getCheckerManager().runCheckersForDeadSymbols(Tmp, checkersV1Tmp,
+    getCheckerManager().runCheckersForDeadSymbols(Tmp, Tmp2,
                                                  SymReaper, currentStmt, *this);
 
     if (!Builder->BuildSinks && !Builder->hasGeneratedNode)
@@ -767,7 +347,7 @@ void ExprEngine::ProcessImplicitDtor(const CFGImplicitDtor D,
                                        StmtNodeBuilder &builder) {
   Builder = &builder;
 
-  switch (D.getDtorKind()) {
+  switch (D.getKind()) {
   case CFGElement::AutomaticObjectDtor:
     ProcessAutomaticObjDtor(cast<CFGAutomaticObjDtor>(D), builder);
     break;
@@ -842,10 +422,8 @@ void ExprEngine::Visit(const Stmt* S, ExplodedNode* Pred,
     // C++ stuff we don't support yet.
     case Stmt::CXXBindTemporaryExprClass:
     case Stmt::CXXCatchStmtClass:
-    case Stmt::CXXDefaultArgExprClass:
     case Stmt::CXXDependentScopeMemberExprClass:
-    case Stmt::ExprWithCleanupsClass:
-    case Stmt::CXXNullPtrLiteralExprClass:
+    case Stmt::CXXForRangeStmtClass:
     case Stmt::CXXPseudoDestructorExprClass:
     case Stmt::CXXTemporaryObjectExprClass:
     case Stmt::CXXThrowExprClass:
@@ -857,20 +435,35 @@ void ExprEngine::Visit(const Stmt* S, ExplodedNode* Pred,
     case Stmt::DependentScopeDeclRefExprClass:
     case Stmt::UnaryTypeTraitExprClass:
     case Stmt::BinaryTypeTraitExprClass:
+    case Stmt::ArrayTypeTraitExprClass:
+    case Stmt::ExpressionTraitExprClass:
     case Stmt::UnresolvedLookupExprClass:
     case Stmt::UnresolvedMemberExprClass:
     case Stmt::CXXNoexceptExprClass:
     case Stmt::PackExpansionExprClass:
     case Stmt::SubstNonTypeTemplateParmPackExprClass:
+    case Stmt::SEHTryStmtClass:
+    case Stmt::SEHExceptStmtClass:
+    case Stmt::SEHFinallyStmtClass:
     {
       SaveAndRestore<bool> OldSink(Builder->BuildSinks);
       Builder->BuildSinks = true;
-      MakeNode(Dst, S, Pred, GetState(Pred));
+      const ExplodedNode *node = MakeNode(Dst, S, Pred, GetState(Pred));
+      Engine.addAbortedBlock(node, Builder->getBlock());
       break;
     }
-      
+    
+    // We don't handle default arguments either yet, but we can fake it
+    // for now by just skipping them.
+    case Stmt::CXXDefaultArgExprClass: {
+      Dst.Add(Pred);
+      break;
+    }
+
     case Stmt::ParenExprClass:
       llvm_unreachable("ParenExprs already handled.");
+    case Stmt::GenericSelectionExprClass:
+      llvm_unreachable("GenericSelectionExprs already handled.");
     // Cases that should never be evaluated simply because they shouldn't
     // appear in the CFG.
     case Stmt::BreakStmtClass:
@@ -879,11 +472,15 @@ void ExprEngine::Visit(const Stmt* S, ExplodedNode* Pred,
     case Stmt::ContinueStmtClass:
     case Stmt::DefaultStmtClass:
     case Stmt::DoStmtClass:
+    case Stmt::ForStmtClass:
     case Stmt::GotoStmtClass:
+    case Stmt::IfStmtClass:
     case Stmt::IndirectGotoStmtClass:
     case Stmt::LabelStmtClass:
     case Stmt::NoStmtClass:
     case Stmt::NullStmtClass:
+    case Stmt::SwitchStmtClass:
+    case Stmt::WhileStmtClass:
       llvm_unreachable("Stmt should not be in analyzer evaluation loop");
       break;
 
@@ -927,8 +524,10 @@ void ExprEngine::Visit(const Stmt* S, ExplodedNode* Pred,
     case Stmt::IntegerLiteralClass:
     case Stmt::CharacterLiteralClass:
     case Stmt::CXXBoolLiteralExprClass:
+    case Stmt::ExprWithCleanupsClass:
     case Stmt::FloatingLiteralClass:
     case Stmt::SizeOfPackExprClass:
+    case Stmt::CXXNullPtrLiteralExprClass:
       Dst.Add(Pred); // No-op. Simply propagate the current state unchanged.
       break;
 
@@ -974,9 +573,10 @@ void ExprEngine::Visit(const Stmt* S, ExplodedNode* Pred,
       break;
     }
 
-    case Stmt::CallExprClass: {
-      const CallExpr* C = cast<CallExpr>(S);
-      VisitCall(C, Pred, C->arg_begin(), C->arg_end(), Dst);
+    case Stmt::CallExprClass:
+    case Stmt::CXXOperatorCallExprClass:
+    case Stmt::CXXMemberCallExprClass: {
+      VisitCallExpr(cast<CallExpr>(S), Pred, Dst);
       break;
     }
 
@@ -988,18 +588,6 @@ void ExprEngine::Visit(const Stmt* S, ExplodedNode* Pred,
       break;
     }
 
-    case Stmt::CXXMemberCallExprClass: {
-      const CXXMemberCallExpr *MCE = cast<CXXMemberCallExpr>(S);
-      VisitCXXMemberCallExpr(MCE, Pred, Dst);
-      break;
-    }
-
-    case Stmt::CXXOperatorCallExprClass: {
-      const CXXOperatorCallExpr *C = cast<CXXOperatorCallExpr>(S);
-      VisitCXXOperatorCallExpr(C, Pred, Dst);
-      break;
-    }
-
     case Stmt::CXXNewExprClass: {
       const CXXNewExpr *NE = cast<CXXNewExpr>(S);
       VisitCXXNewExpr(NE, Pred, Dst);
@@ -1050,12 +638,6 @@ void ExprEngine::Visit(const Stmt* S, ExplodedNode* Pred,
       VisitDeclStmt(cast<DeclStmt>(S), Pred, Dst);
       break;
 
-    case Stmt::ForStmtClass:
-      // This case isn't for branch processing, but for handling the
-      // initialization of a condition variable.
-      VisitCondInit(cast<ForStmt>(S)->getConditionVariable(), S, Pred, Dst);
-      break;
-
     case Stmt::ImplicitCastExprClass:
     case Stmt::CStyleCastExprClass:
     case Stmt::CXXStaticCastExprClass:
@@ -1068,12 +650,6 @@ void ExprEngine::Visit(const Stmt* S, ExplodedNode* Pred,
       break;
     }
 
-    case Stmt::IfStmtClass:
-      // This case isn't for branch processing, but for handling the
-      // initialization of a condition variable.
-      VisitCondInit(cast<IfStmt>(S)->getConditionVariable(), S, Pred, Dst);
-      break;
-
     case Stmt::InitListExprClass:
       VisitInitListExpr(cast<InitListExpr>(S), Pred, Dst);
       break;
@@ -1110,8 +686,9 @@ void ExprEngine::Visit(const Stmt* S, ExplodedNode* Pred,
       VisitOffsetOfExpr(cast<OffsetOfExpr>(S), Pred, Dst);
       break;
 
-    case Stmt::SizeOfAlignOfExprClass:
-      VisitSizeOfAlignOfExpr(cast<SizeOfAlignOfExpr>(S), Pred, Dst);
+    case Stmt::UnaryExprOrTypeTraitExprClass:
+      VisitUnaryExprOrTypeTraitExpr(cast<UnaryExprOrTypeTraitExpr>(S),
+                                    Pred, Dst);
       break;
 
     case Stmt::StmtExprClass: {
@@ -1142,12 +719,6 @@ void ExprEngine::Visit(const Stmt* S, ExplodedNode* Pred,
       return;
     }
 
-    case Stmt::SwitchStmtClass:
-      // This case isn't for branch processing, but for handling the
-      // initialization of a condition variable.
-      VisitCondInit(cast<SwitchStmt>(S)->getConditionVariable(), S, Pred, Dst);
-      break;
-
     case Stmt::UnaryOperatorClass: {
       const UnaryOperator *U = cast<UnaryOperator>(S);
       if (AMgr.shouldEagerlyAssume()&&(U->getOpcode() == UO_LNot)) {
@@ -1159,12 +730,6 @@ void ExprEngine::Visit(const Stmt* S, ExplodedNode* Pred,
         VisitUnaryOperator(U, Pred, Dst);
       break;
     }
-
-    case Stmt::WhileStmtClass:
-      // This case isn't for branch processing, but for handling the
-      // initialization of a condition variable.
-      VisitCondInit(cast<WhileStmt>(S)->getConditionVariable(), S, Pred, Dst);
-      break;
   }
 }
 
@@ -1313,11 +878,7 @@ void ExprEngine::processBranch(const Stmt* Condition, const Stmt* Term,
                                 Condition->getLocStart(),
                                 "Error evaluating branch");
 
-  for (CheckersOrdered::iterator I=Checkers.begin(),E=Checkers.end();I!=E;++I) {
-    void *tag = I->first;
-    Checker *checker = I->second;
-    checker->VisitBranchCondition(builder, *this, Condition, tag);
-  }
+  getCheckerManager().runCheckersForBranchCondition(Condition, builder, *this);
 
   // If the branch condition is undefined, return;
   if (!builder.isFeasible(true) && !builder.isFeasible(false))
@@ -1326,7 +887,7 @@ void ExprEngine::processBranch(const Stmt* Condition, const Stmt* Term,
   const GRState* PrevState = builder.getState();
   SVal X = PrevState->getSVal(Condition);
 
-  if (X.isUnknown()) {
+  if (X.isUnknownOrUndef()) {
     // Give it a chance to recover from unknown.
     if (const Expr *Ex = dyn_cast<Expr>(Condition)) {
       if (Ex->getType()->isIntegerType()) {
@@ -1344,7 +905,7 @@ void ExprEngine::processBranch(const Stmt* Condition, const Stmt* Term,
       }
     }
     // If the condition is still unknown, give up.
-    if (X.isUnknown()) {
+    if (X.isUnknownOrUndef()) {
       builder.generateNode(MarkBranch(PrevState, Term, true), true);
       builder.generateNode(MarkBranch(PrevState, Term, false), false);
       return;
@@ -1441,12 +1002,6 @@ void ExprEngine::VisitGuardedExpr(const Expr* Ex, const Expr* L,
 void ExprEngine::processEndOfFunction(EndOfFunctionNodeBuilder& builder) {
   getTF().evalEndPath(*this, builder);
   StateMgr.EndPath(builder.getState());
-  for (CheckersOrdered::iterator I=Checkers.begin(),E=Checkers.end(); I!=E;++I){
-    void *tag = I->first;
-    Checker *checker = I->second;
-    EndOfFunctionNodeBuilder B = builder.withCheckerTag(tag);
-    checker->evalEndPath(B, tag, *this);
-  }
   getCheckerManager().runCheckersForEndPath(builder, *this);
 }
 
@@ -1473,6 +1028,10 @@ void ExprEngine::processSwitch(SwitchNodeBuilder& builder) {
   bool defaultIsFeasible = I == EI;
 
   for ( ; I != EI; ++I) {
+    // Successor may be pruned out during CFG construction.
+    if (!I.getBlock())
+      continue;
+    
     const CaseStmt* Case = I.getCase();
 
     // Evaluate the LHS of the case value.
@@ -1666,7 +1225,7 @@ void ExprEngine::VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred,
            ProgramPoint::PostLValueKind);
 
   // Post-visit the BlockExpr.
-  CheckerVisit(BE, Dst, Tmp, PostVisitStmtCallback);
+  getCheckerManager().runCheckersForPostStmt(Dst, Tmp, BE, *this);
 }
 
 void ExprEngine::VisitCommonDeclRefExpr(const Expr *Ex, const NamedDecl *D,
@@ -1723,7 +1282,7 @@ void ExprEngine::VisitLvalArraySubscriptExpr(const ArraySubscriptExpr* A,
     ExplodedNodeSet Tmp2;
     Visit(Idx, *I1, Tmp2);     // Evaluate the index.
     ExplodedNodeSet Tmp3;
-    CheckerVisit(A, Tmp3, Tmp2, PreVisitStmtCallback);
+    getCheckerManager().runCheckersForPreStmt(Tmp3, Tmp2, A, *this);
 
     for (ExplodedNodeSet::iterator I2=Tmp3.begin(),E2=Tmp3.end();I2!=E2; ++I2) {
       const GRState* state = GetState(*I2);
@@ -1784,7 +1343,8 @@ void ExprEngine::evalBind(ExplodedNodeSet& Dst, const Stmt* StoreE,
   // Do a previsit of the bind.
   ExplodedNodeSet CheckedSet, Src;
   Src.Add(Pred);
-  CheckerVisitBind(StoreE, CheckedSet, Src, location, Val, true);
+  getCheckerManager().runCheckersForBind(CheckedSet, Src, location, Val, StoreE,
+                                         *this);
 
   for (ExplodedNodeSet::iterator I = CheckedSet.begin(), E = CheckedSet.end();
        I!=E; ++I) {
@@ -1862,7 +1422,8 @@ void ExprEngine::evalStore(ExplodedNodeSet& Dst, const Expr *AssignE,
   if (Tmp.empty())
     return;
 
-  assert(!location.isUndef());
+  if (location.isUndef())
+    return;
 
   SaveAndRestore<ProgramPoint::Kind> OldSPointKind(Builder->PointKind,
                                                    ProgramPoint::PostStoreKind);
@@ -1922,7 +1483,8 @@ void ExprEngine::evalLoadCommon(ExplodedNodeSet& Dst, const Expr *Ex,
   if (Tmp.empty())
     return;
 
-  assert(!location.isUndef());
+  if (location.isUndef())
+    return;
 
   SaveAndRestore<ProgramPoint::Kind> OldSPointKind(Builder->PointKind);
 
@@ -1955,57 +1517,36 @@ void ExprEngine::evalLocation(ExplodedNodeSet &Dst, const Stmt *S,
     return;
   }
 
-  if (Checkers.empty()) {
-    ExplodedNodeSet Src;
-    if (Builder->GetState(Pred) == state) {
-      Src.Add(Pred);
-    } else {
-      // Associate this new state with an ExplodedNode.
-      Src.Add(Builder->generateNode(S, state, Pred));
-    }
-    getCheckerManager().runCheckersForLocation(Dst, Src, location, isLoad, S,
-                                               *this);
-    return;
-  }
-
   ExplodedNodeSet Src;
-  Src.Add(Pred);
-  ExplodedNodeSet CheckersV1Dst;
-  ExplodedNodeSet Tmp;
-  ExplodedNodeSet *PrevSet = &Src;
-
-  for (CheckersOrdered::iterator I=Checkers.begin(),E=Checkers.end(); I!=E; ++I)
-  {
-    ExplodedNodeSet *CurrSet = 0;
-    if (I+1 == E)
-      CurrSet = &CheckersV1Dst;
-    else {
-      CurrSet = (PrevSet == &Tmp) ? &Src : &Tmp;
-      CurrSet->clear();
-    }
-
-    void *tag = I->first;
-    Checker *checker = I->second;
-
-    for (ExplodedNodeSet::iterator NI = PrevSet->begin(), NE = PrevSet->end();
-         NI != NE; ++NI) {
-      // Use the 'state' argument only when the predecessor node is the
-      // same as Pred.  This allows us to catch updates to the state.
-      checker->GR_visitLocation(*CurrSet, *Builder, *this, S, *NI,
-                                *NI == Pred ? state : GetState(*NI),
-                                location, tag, isLoad);
-    }
-
-    // Update which NodeSet is the current one.
-    PrevSet = CurrSet;
+  if (Builder->GetState(Pred) == state) {
+    Src.Add(Pred);
+  } else {
+    // Associate this new state with an ExplodedNode.
+    // FIXME: If I pass null tag, the graph is incorrect, e.g for
+    //   int *p;
+    //   p = 0;
+    //   *p = 0xDEADBEEF;
+    // "p = 0" is not noted as "Null pointer value stored to 'p'" but
+    // instead "int *p" is noted as
+    // "Variable 'p' initialized to a null pointer value"
+    ExplodedNode *N = Builder->generateNode(S, state, Pred, this);
+    Src.Add(N ? N : Pred);
   }
-
-  getCheckerManager().runCheckersForLocation(Dst, CheckersV1Dst, location,
-                                             isLoad, S, *this);
+  getCheckerManager().runCheckersForLocation(Dst, Src, location, isLoad, S,
+                                             *this);
 }
 
 bool ExprEngine::InlineCall(ExplodedNodeSet &Dst, const CallExpr *CE, 
                               ExplodedNode *Pred) {
+  return false;
+  
+  // Inlining isn't correct right now because we:
+  // (a) don't generate CallExit nodes.
+  // (b) we need a way to postpone doing post-visits of CallExprs until
+  // the CallExit.  This means we need CallExits for the non-inline
+  // cases as well.
+  
+#if 0
   const GRState *state = GetState(Pred);
   const Expr *Callee = CE->getCallee();
   SVal L = state->getSVal(Callee);
@@ -2014,6 +1555,29 @@ bool ExprEngine::InlineCall(ExplodedNodeSet &Dst, const CallExpr *CE,
   if (!FD)
     return false;
 
+  // Specially handle CXXMethods.
+  const CXXMethodDecl *methodDecl = 0;
+  
+  switch (CE->getStmtClass()) {
+    default: break;
+    case Stmt::CXXOperatorCallExprClass: {
+      const CXXOperatorCallExpr *opCall = cast<CXXOperatorCallExpr>(CE);
+      methodDecl = 
+        llvm::dyn_cast_or_null<CXXMethodDecl>(opCall->getCalleeDecl());
+      break;
+    }
+    case Stmt::CXXMemberCallExprClass: {
+      const CXXMemberCallExpr *memberCall = cast<CXXMemberCallExpr>(CE);
+      const MemberExpr *memberExpr = 
+        cast<MemberExpr>(memberCall->getCallee()->IgnoreParens());
+      methodDecl = cast<CXXMethodDecl>(memberExpr->getMemberDecl());
+      break;
+    }
+  }
+      
+  
+  
+  
   // Check if the function definition is in the same translation unit.
   if (FD->hasBody(FD)) {
     const StackFrameContext *stackFrame = 
@@ -2041,14 +1605,15 @@ bool ExprEngine::InlineCall(ExplodedNodeSet &Dst, const CallExpr *CE,
     Dst.Add(N);
     return true;
   }
+  
+  // Generate the CallExit node.
 
   return false;
+#endif
 }
 
-void ExprEngine::VisitCall(const CallExpr* CE, ExplodedNode* Pred,
-                             CallExpr::const_arg_iterator AI,
-                             CallExpr::const_arg_iterator AE,
-                             ExplodedNodeSet& Dst) {
+void ExprEngine::VisitCallExpr(const CallExpr* CE, ExplodedNode* Pred,
+                               ExplodedNodeSet& dst) {
 
   // Determine the type of function we're calling (if available).
   const FunctionProtoType *Proto = NULL;
@@ -2056,72 +1621,78 @@ void ExprEngine::VisitCall(const CallExpr* CE, ExplodedNode* Pred,
   if (const PointerType *FnTypePtr = FnType->getAs<PointerType>())
     Proto = FnTypePtr->getPointeeType()->getAs<FunctionProtoType>();
 
-  // Evaluate the arguments.
-  ExplodedNodeSet ArgsEvaluated;
-  evalArguments(CE->arg_begin(), CE->arg_end(), Proto, Pred, ArgsEvaluated);
-
-  // Now process the call itself.
-  ExplodedNodeSet DstTmp;
-  const Expr* Callee = CE->getCallee()->IgnoreParens();
-
-  for (ExplodedNodeSet::iterator NI=ArgsEvaluated.begin(),
-                                 NE=ArgsEvaluated.end(); NI != NE; ++NI) {
-    // Evaluate the callee.
-    ExplodedNodeSet DstTmp2;
-    Visit(Callee, *NI, DstTmp2);
-    // Perform the previsit of the CallExpr, storing the results in DstTmp.
-    CheckerVisit(CE, DstTmp, DstTmp2, PreVisitStmtCallback);
+  // Should the first argument be evaluated as an lvalue?
+  bool firstArgumentAsLvalue = false;
+  switch (CE->getStmtClass()) {
+    case Stmt::CXXOperatorCallExprClass:
+      firstArgumentAsLvalue = true;
+      break;
+    default:
+      break;
   }
+  
+  // Evaluate the arguments.
+  ExplodedNodeSet dstArgsEvaluated;
+  evalArguments(CE->arg_begin(), CE->arg_end(), Proto, Pred, dstArgsEvaluated,
+                firstArgumentAsLvalue);
+
+  // Evaluate the callee.
+  ExplodedNodeSet dstCalleeEvaluated;
+  evalCallee(CE, dstArgsEvaluated, dstCalleeEvaluated);
+
+  // Perform the previsit of the CallExpr.
+  ExplodedNodeSet dstPreVisit;
+  getCheckerManager().runCheckersForPreStmt(dstPreVisit, dstCalleeEvaluated,
+                                            CE, *this);
+    
+  // Now evaluate the call itself.
+  class DefaultEval : public GraphExpander {
+    ExprEngine &Eng;
+    const CallExpr *CE;
+  public:
+    
+    DefaultEval(ExprEngine &eng, const CallExpr *ce)
+      : Eng(eng), CE(ce) {}
+    virtual void expandGraph(ExplodedNodeSet &Dst, ExplodedNode *Pred) {
+      // Should we inline the call?
+      if (Eng.getAnalysisManager().shouldInlineCall() &&
+          Eng.InlineCall(Dst, CE, Pred)) {
+        return;
+      }
 
-  // Finally, evaluate the function call.  We try each of the checkers
-  // to see if the can evaluate the function call.
-  ExplodedNodeSet DstTmp3;
-
-  for (ExplodedNodeSet::iterator DI = DstTmp.begin(), DE = DstTmp.end();
-       DI != DE; ++DI) {
+      StmtNodeBuilder &Builder = Eng.getBuilder();
+      assert(&Builder && "StmtNodeBuilder must be defined.");
 
-    const GRState* state = GetState(*DI);
-    SVal L = state->getSVal(Callee);
+      // Dispatch to the plug-in transfer function.
+      unsigned oldSize = Dst.size();
+      SaveOr OldHasGen(Builder.hasGeneratedNode);
 
-    // FIXME: Add support for symbolic function calls (calls involving
-    //  function pointer values that are symbolic).
-    SaveAndRestore<bool> OldSink(Builder->BuildSinks);
-    ExplodedNodeSet DstChecker;
+      // Dispatch to transfer function logic to handle the call itself.
+      const Expr* Callee = CE->getCallee()->IgnoreParens();
+      const GRState* state = Eng.GetState(Pred);
+      SVal L = state->getSVal(Callee);
+      Eng.getTF().evalCall(Dst, Eng, Builder, CE, L, Pred);
 
-    // If the callee is processed by a checker, skip the rest logic.
-    if (CheckerEvalCall(CE, DstChecker, *DI))
-      DstTmp3.insert(DstChecker);
-    else if (AMgr.shouldInlineCall() && InlineCall(Dst, CE, *DI)) {
-      // Callee is inlined. We shouldn't do post call checking.
-      return;
-    }
-    else {
-      for (ExplodedNodeSet::iterator DI_Checker = DstChecker.begin(),
-           DE_Checker = DstChecker.end();
-           DI_Checker != DE_Checker; ++DI_Checker) {
-
-        // Dispatch to the plug-in transfer function.
-        unsigned oldSize = DstTmp3.size();
-        SaveOr OldHasGen(Builder->hasGeneratedNode);
-        Pred = *DI_Checker;
-
-        // Dispatch to transfer function logic to handle the call itself.
-        // FIXME: Allow us to chain together transfer functions.
-        assert(Builder && "StmtNodeBuilder must be defined.");
-        getTF().evalCall(DstTmp3, *this, *Builder, CE, L, Pred);
-
-        // Handle the case where no nodes where generated.  Auto-generate that
-        // contains the updated state if we aren't generating sinks.
-        if (!Builder->BuildSinks && DstTmp3.size() == oldSize &&
-            !Builder->hasGeneratedNode)
-          MakeNode(DstTmp3, CE, Pred, state);
-      }
+      // Handle the case where no nodes where generated.  Auto-generate that
+      // contains the updated state if we aren't generating sinks.
+      if (!Builder.BuildSinks && Dst.size() == oldSize &&
+          !Builder.hasGeneratedNode)
+        Eng.MakeNode(Dst, CE, Pred, state);
     }
-  }
+  };
+
+  // Finally, evaluate the function call.  We try each of the checkers
+  // to see if the can evaluate the function call.
+  ExplodedNodeSet dstCallEvaluated;
+  DefaultEval defEval(*this, CE);
+  getCheckerManager().runCheckersForEvalCall(dstCallEvaluated,
+                                             dstPreVisit,
+                                             CE, *this, &defEval);
 
   // Finally, perform the post-condition check of the CallExpr and store
   // the created nodes in 'Dst'.
-  CheckerVisit(CE, Dst, DstTmp3, PostVisitStmtCallback);
+  getCheckerManager().runCheckersForPostStmt(dst, dstCallEvaluated, CE,
+                                             *this);
 }
 
 //===----------------------------------------------------------------------===//
@@ -2213,7 +1784,7 @@ void ExprEngine::VisitObjCAtSynchronizedStmt(const ObjCAtSynchronizedStmt *S,
   // Pre-visit the ObjCAtSynchronizedStmt.
   ExplodedNodeSet Tmp;
   Tmp.Add(Pred);
-  CheckerVisit(S, Dst, Tmp, PreVisitStmtCallback);
+  getCheckerManager().runCheckersForPreStmt(Dst, Tmp, S, *this);
 }
 
 //===----------------------------------------------------------------------===//
@@ -2244,7 +1815,7 @@ void ExprEngine::VisitLvalObjCIvarRefExpr(const ObjCIvarRefExpr* Ex,
 
   // Perform the post-condition check of the ObjCIvarRefExpr and store
   // the created nodes in 'Dst'.
-  CheckerVisit(Ex, Dst, dstIvar, PostVisitStmtCallback);
+  getCheckerManager().runCheckersForPostStmt(Dst, dstIvar, Ex, *this);
 }
 
 //===----------------------------------------------------------------------===//
@@ -2414,7 +1985,7 @@ void ExprEngine::VisitObjCMessage(const ObjCMessage &msg,
 
   // Handle the previsits checks.
   ExplodedNodeSet DstPrevisit;
-  CheckerVisitObjCMessage(msg, DstPrevisit, Src, /*isPreVisit=*/true);
+  getCheckerManager().runCheckersForPreObjCMessage(DstPrevisit, Src, msg,*this);
 
   // Proceed with evaluate the message expression.
   ExplodedNodeSet dstEval;
@@ -2430,33 +2001,34 @@ void ExprEngine::VisitObjCMessage(const ObjCMessage &msg,
 
     if (const Expr *Receiver = msg.getInstanceReceiver()) {
       const GRState *state = GetState(Pred);
-
-      // Bifurcate the state into nil and non-nil ones.
-      DefinedOrUnknownSVal receiverVal =
-        cast<DefinedOrUnknownSVal>(state->getSVal(Receiver));
-
-      const GRState *notNilState, *nilState;
-      llvm::tie(notNilState, nilState) = state->assume(receiverVal);
-
-      // There are three cases: can be nil or non-nil, must be nil, must be
-      // non-nil. We handle must be nil, and merge the rest two into non-nil.
-      if (nilState && !notNilState) {
-        CheckerEvalNilReceiver(msg, dstEval, nilState, Pred);
-        continue;
+      SVal recVal = state->getSVal(Receiver);
+      if (!recVal.isUndef()) {
+        // Bifurcate the state into nil and non-nil ones.
+        DefinedOrUnknownSVal receiverVal = cast<DefinedOrUnknownSVal>(recVal);
+    
+        const GRState *notNilState, *nilState;
+        llvm::tie(notNilState, nilState) = state->assume(receiverVal);
+    
+        // There are three cases: can be nil or non-nil, must be nil, must be
+        // non-nil. We ignore must be nil, and merge the rest two into non-nil.
+        if (nilState && !notNilState) {
+          dstEval.insert(Pred);
+          continue;
+        }
+    
+        // Check if the "raise" message was sent.
+        assert(notNilState);
+        if (msg.getSelector() == RaiseSel)
+          RaisesException = true;
+    
+        // Check if we raise an exception.  For now treat these as sinks.
+        // Eventually we will want to handle exceptions properly.
+        if (RaisesException)
+          Builder->BuildSinks = true;
+    
+        // Dispatch to plug-in transfer function.
+        evalObjCMessage(dstEval, msg, Pred, notNilState);
       }
-
-      // Check if the "raise" message was sent.
-      assert(notNilState);
-      if (msg.getSelector() == RaiseSel)
-        RaisesException = true;
-
-      // Check if we raise an exception.  For now treat these as sinks.
-      // Eventually we will want to handle exceptions properly.
-      if (RaisesException)
-        Builder->BuildSinks = true;
-
-      // Dispatch to plug-in transfer function.
-      evalObjCMessage(dstEval, msg, Pred, notNilState);
     }
     else if (const ObjCInterfaceDecl *Iface = msg.getReceiverInterface()) {
       IdentifierInfo* ClsName = Iface->getIdentifier();
@@ -2516,7 +2088,7 @@ void ExprEngine::VisitObjCMessage(const ObjCMessage &msg,
 
   // Finally, perform the post-condition check of the ObjCMessageExpr and store
   // the created nodes in 'Dst'.
-  CheckerVisitObjCMessage(msg, Dst, dstEval, /*isPreVisit=*/false);
+  getCheckerManager().runCheckersForPostObjCMessage(Dst, dstEval, msg, *this);
 }
 
 //===----------------------------------------------------------------------===//
@@ -2529,7 +2101,7 @@ void ExprEngine::VisitCast(const CastExpr *CastE, const Expr *Ex,
   ExplodedNodeSet S1;
   Visit(Ex, Pred, S1);
   ExplodedNodeSet S2;
-  CheckerVisit(CastE, S2, S1, PreVisitStmtCallback);
+  getCheckerManager().runCheckersForPreStmt(S2, S1, CastE, *this);
   
   if (CastE->getCastKind() == CK_LValueToRValue ||
       CastE->getCastKind() == CK_GetObjCProperty) {
@@ -2547,106 +2119,95 @@ void ExprEngine::VisitCast(const CastExpr *CastE, const Expr *Ex,
 
   if (const ExplicitCastExpr *ExCast=dyn_cast_or_null<ExplicitCastExpr>(CastE))
     T = ExCast->getTypeAsWritten();
- 
-#if 0
-  // If we are evaluating the cast in an lvalue context, we implicitly want
-  // the cast to evaluate to a location.
-  if (asLValue) {
-    ASTContext &Ctx = getContext();
-    T = Ctx.getPointerType(Ctx.getCanonicalType(T));
-    ExTy = Ctx.getPointerType(Ctx.getCanonicalType(ExTy));
-  }
-#endif
-
-  switch (CastE->getCastKind()) {
-  case CK_ToVoid:
-    for (ExplodedNodeSet::iterator I = S2.begin(), E = S2.end(); I != E; ++I)
-      Dst.Add(*I);
-    return;
-
-  case CK_LValueToRValue:
-  case CK_NoOp:
-  case CK_FunctionToPointerDecay:
-    for (ExplodedNodeSet::iterator I = S2.begin(), E = S2.end(); I != E; ++I) {
-      // Copy the SVal of Ex to CastE.
-      ExplodedNode *N = *I;
-      const GRState *state = GetState(N);
-      SVal V = state->getSVal(Ex);
-      state = state->BindExpr(CastE, V);
-      MakeNode(Dst, CastE, N, state);
-    }
-    return;
 
-  case CK_GetObjCProperty:
-  case CK_Dependent:
-  case CK_ArrayToPointerDecay:
-  case CK_BitCast:
-  case CK_LValueBitCast:
-  case CK_IntegralCast:
-  case CK_NullToPointer:
-  case CK_IntegralToPointer:
-  case CK_PointerToIntegral:
-  case CK_PointerToBoolean:
-  case CK_IntegralToBoolean:
-  case CK_IntegralToFloating:
-  case CK_FloatingToIntegral:
-  case CK_FloatingToBoolean:
-  case CK_FloatingCast:
-  case CK_FloatingRealToComplex:
-  case CK_FloatingComplexToReal:
-  case CK_FloatingComplexToBoolean:
-  case CK_FloatingComplexCast:
-  case CK_FloatingComplexToIntegralComplex:
-  case CK_IntegralRealToComplex:
-  case CK_IntegralComplexToReal:
-  case CK_IntegralComplexToBoolean:
-  case CK_IntegralComplexCast:
-  case CK_IntegralComplexToFloatingComplex:
-  case CK_AnyPointerToObjCPointerCast:
-  case CK_AnyPointerToBlockPointerCast:
-  
-  case CK_ObjCObjectLValueCast: {
-    // Delegate to SValBuilder to process.
-    for (ExplodedNodeSet::iterator I = S2.begin(), E = S2.end(); I != E; ++I) {
-      ExplodedNode* N = *I;
-      const GRState* state = GetState(N);
-      SVal V = state->getSVal(Ex);
-      V = svalBuilder.evalCast(V, T, ExTy);
-      state = state->BindExpr(CastE, V);
-      MakeNode(Dst, CastE, N, state);
-    }
-    return;
-  }
+  for (ExplodedNodeSet::iterator I = S2.begin(), E = S2.end(); I != E; ++I) {
+    Pred = *I;
 
-  case CK_DerivedToBase:
-  case CK_UncheckedDerivedToBase:
-    // For DerivedToBase cast, delegate to the store manager.
-    for (ExplodedNodeSet::iterator I = S2.begin(), E = S2.end(); I != E; ++I) {
-      ExplodedNode *node = *I;
-      const GRState *state = GetState(node);
-      SVal val = state->getSVal(Ex);
-      val = getStoreManager().evalDerivedToBase(val, T);
-      state = state->BindExpr(CastE, val);
-      MakeNode(Dst, CastE, node, state);
+    switch (CastE->getCastKind()) {
+      case CK_ToVoid:
+        Dst.Add(Pred);
+        continue;
+      case CK_LValueToRValue:
+      case CK_NoOp:
+      case CK_FunctionToPointerDecay: {
+        // Copy the SVal of Ex to CastE.
+        const GRState *state = GetState(Pred);
+        SVal V = state->getSVal(Ex);
+        state = state->BindExpr(CastE, V);
+        MakeNode(Dst, CastE, Pred, state);
+        continue;
+      }
+      case CK_GetObjCProperty:
+      case CK_Dependent:
+      case CK_ArrayToPointerDecay:
+      case CK_BitCast:
+      case CK_LValueBitCast:
+      case CK_IntegralCast:
+      case CK_NullToPointer:
+      case CK_IntegralToPointer:
+      case CK_PointerToIntegral:
+      case CK_PointerToBoolean:
+      case CK_IntegralToBoolean:
+      case CK_IntegralToFloating:
+      case CK_FloatingToIntegral:
+      case CK_FloatingToBoolean:
+      case CK_FloatingCast:
+      case CK_FloatingRealToComplex:
+      case CK_FloatingComplexToReal:
+      case CK_FloatingComplexToBoolean:
+      case CK_FloatingComplexCast:
+      case CK_FloatingComplexToIntegralComplex:
+      case CK_IntegralRealToComplex:
+      case CK_IntegralComplexToReal:
+      case CK_IntegralComplexToBoolean:
+      case CK_IntegralComplexCast:
+      case CK_IntegralComplexToFloatingComplex:
+      case CK_AnyPointerToObjCPointerCast:
+      case CK_AnyPointerToBlockPointerCast:  
+      case CK_ObjCObjectLValueCast: {
+        // Delegate to SValBuilder to process.
+        const GRState* state = GetState(Pred);
+        SVal V = state->getSVal(Ex);
+        V = svalBuilder.evalCast(V, T, ExTy);
+        state = state->BindExpr(CastE, V);
+        MakeNode(Dst, CastE, Pred, state);
+        continue;
+      }
+      case CK_DerivedToBase:
+      case CK_UncheckedDerivedToBase: {
+        // For DerivedToBase cast, delegate to the store manager.
+        const GRState *state = GetState(Pred);
+        SVal val = state->getSVal(Ex);
+        val = getStoreManager().evalDerivedToBase(val, T);
+        state = state->BindExpr(CastE, val);
+        MakeNode(Dst, CastE, Pred, state);
+        continue;
+      }
+      // Various C++ casts that are not handled yet.
+      case CK_Dynamic:
+      case CK_ToUnion:
+      case CK_BaseToDerived:
+      case CK_NullToMemberPointer:
+      case CK_BaseToDerivedMemberPointer:
+      case CK_DerivedToBaseMemberPointer:
+      case CK_UserDefinedConversion:
+      case CK_ConstructorConversion:
+      case CK_VectorSplat:
+      case CK_MemberPointerToBoolean: {
+        // Recover some path-sensitivty by conjuring a new value.
+        QualType resultType = CastE->getType();
+        if (CastE->isLValue())
+          resultType = getContext().getPointerType(resultType);
+
+        SVal result =
+          svalBuilder.getConjuredSymbolVal(NULL, CastE, resultType,
+                                           Builder->getCurrentBlockCount());
+
+        const GRState *state = GetState(Pred)->BindExpr(CastE, result);
+        MakeNode(Dst, CastE, Pred, state);
+        continue;
+      }
     }
-    return;
-
-  // Various C++ casts that are not handled yet.
-  case CK_Dynamic:  
-  case CK_ToUnion:
-  case CK_BaseToDerived:
-  case CK_NullToMemberPointer:
-  case CK_BaseToDerivedMemberPointer:
-  case CK_DerivedToBaseMemberPointer:
-  case CK_UserDefinedConversion:
-  case CK_ConstructorConversion:
-  case CK_VectorSplat:
-  case CK_MemberPointerToBoolean: {
-    SaveAndRestore<bool> OldSink(Builder->BuildSinks);
-    Builder->BuildSinks = true;
-    MakeNode(Dst, CastE, Pred, GetState(Pred));
-    return;
-  }
   }
 }
 
@@ -2702,7 +2263,7 @@ void ExprEngine::VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred,
     Tmp.Add(Pred);
 
   ExplodedNodeSet Tmp2;
-  CheckerVisit(DS, Tmp2, Tmp, PreVisitStmtCallback);
+  getCheckerManager().runCheckersForPreStmt(Tmp2, Tmp, DS, *this);
 
   for (ExplodedNodeSet::iterator I=Tmp2.begin(), E=Tmp2.end(); I!=E; ++I) {
     ExplodedNode *N = *I;
@@ -2741,33 +2302,6 @@ void ExprEngine::VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred,
   }
 }
 
-void ExprEngine::VisitCondInit(const VarDecl *VD, const Stmt *S,
-                                 ExplodedNode *Pred, ExplodedNodeSet& Dst) {
-
-  const Expr* InitEx = VD->getInit();
-  ExplodedNodeSet Tmp;
-  Visit(InitEx, Pred, Tmp);
-
-  for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) {
-    ExplodedNode *N = *I;
-    const GRState *state = GetState(N);
-
-    const LocationContext *LC = N->getLocationContext();
-    SVal InitVal = state->getSVal(InitEx);
-
-    // Recover some path-sensitivity if a scalar value evaluated to
-    // UnknownVal.
-    if (InitVal.isUnknown() ||
-        !getConstraintManager().canReasonAbout(InitVal)) {
-      InitVal = svalBuilder.getConjuredSymbolVal(NULL, InitEx,
-                                            Builder->getCurrentBlockCount());
-    }
-
-    evalBind(Dst, S, N, state,
-             loc::MemRegionVal(state->getRegion(VD, LC)), InitVal, true);
-  }
-}
-
 namespace {
   // This class is used by VisitInitListExpr as an item in a worklist
   // for processing the values contained in an InitListExpr.
@@ -2861,19 +2395,15 @@ void ExprEngine::VisitInitListExpr(const InitListExpr* E, ExplodedNode* Pred,
   assert(0 && "unprocessed InitListExpr type");
 }
 
-/// VisitSizeOfAlignOfExpr - Transfer function for sizeof(type).
-void ExprEngine::VisitSizeOfAlignOfExpr(const SizeOfAlignOfExpr* Ex,
+/// VisitUnaryExprOrTypeTraitExpr - Transfer function for sizeof(type).
+void ExprEngine::VisitUnaryExprOrTypeTraitExpr(
+                                          const UnaryExprOrTypeTraitExpr* Ex,
                                           ExplodedNode* Pred,
                                           ExplodedNodeSet& Dst) {
   QualType T = Ex->getTypeOfArgument();
-  CharUnits amt;
 
-  if (Ex->isSizeOf()) {
-    if (T == getContext().VoidTy) {
-      // sizeof(void) == 1 byte.
-      amt = CharUnits::One();
-    }
-    else if (!T->isConstantSizeType()) {
+  if (Ex->getKind() == UETT_SizeOf) {
+    if (!T->isIncompleteType() && !T->isConstantSizeType()) {
       assert(T->isVariableArrayType() && "Unknown non-constant-sized type.");
 
       // FIXME: Add support for VLA type arguments, not just VLA expressions.
@@ -2914,13 +2444,11 @@ void ExprEngine::VisitSizeOfAlignOfExpr(const SizeOfAlignOfExpr* Ex,
       Dst.Add(Pred);
       return;
     }
-    else {
-      // All other cases.
-      amt = getContext().getTypeSizeInChars(T);
-    }
   }
-  else  // Get alignment of the type.
-    amt = getContext().getTypeAlignInChars(T);
+
+  Expr::EvalResult Result;
+  Ex->Evaluate(Result, getContext());
+  CharUnits amt = CharUnits::fromQuantity(Result.Val.getInt().getZExtValue());
 
   MakeNode(Dst, Ex, Pred,
            GetState(Pred)->BindExpr(Ex,
@@ -3263,7 +2791,7 @@ void ExprEngine::VisitReturnStmt(const ReturnStmt *RS, ExplodedNode *Pred,
   }
 
   ExplodedNodeSet CheckedSet;
-  CheckerVisit(RS, CheckedSet, Src, PreVisitStmtCallback);
+  getCheckerManager().runCheckersForPreStmt(CheckedSet, Src, RS, *this);
 
   for (ExplodedNodeSet::iterator I = CheckedSet.begin(), E = CheckedSet.end();
        I != E; ++I) {
@@ -3305,7 +2833,7 @@ void ExprEngine::VisitBinaryOperator(const BinaryOperator* B,
     Visit(RHS, *I1, Tmp2);
 
     ExplodedNodeSet CheckedSet;
-    CheckerVisit(B, CheckedSet, Tmp2, PreVisitStmtCallback);
+    getCheckerManager().runCheckersForPreStmt(CheckedSet, Tmp2, B, *this);
 
     // With both the LHS and RHS evaluated, process the operation itself.
 
@@ -3432,16 +2960,7 @@ void ExprEngine::VisitBinaryOperator(const BinaryOperator* B,
     }
   }
 
-  CheckerVisit(B, Dst, Tmp3, PostVisitStmtCallback);
-}
-
-//===----------------------------------------------------------------------===//
-// Checker registration/lookup.
-//===----------------------------------------------------------------------===//
-
-Checker *ExprEngine::lookupChecker(void *tag) const {
-  CheckerMap::const_iterator I = CheckerM.find(tag);
-  return (I == CheckerM.end()) ? NULL : Checkers[I->second].second;
+  getCheckerManager().runCheckersForPostStmt(Dst, Tmp3, B, *this);
 }
 
 //===----------------------------------------------------------------------===//
diff --git a/lib/StaticAnalyzer/Core/FlatStore.cpp b/lib/StaticAnalyzer/Core/FlatStore.cpp
index 99a5ead..7bdca6b 100644
--- a/lib/StaticAnalyzer/Core/FlatStore.cpp
+++ b/lib/StaticAnalyzer/Core/FlatStore.cpp
@@ -90,6 +90,19 @@ StoreManager *ento::CreateFlatStoreManager(GRStateManager &StMgr) {
 }
 
 SVal FlatStoreManager::Retrieve(Store store, Loc L, QualType T) {
+  // For access to concrete addresses, return UnknownVal.  Checks
+  // for null dereferences (and similar errors) are done by checkers, not
+  // the Store.
+  // FIXME: We can consider lazily symbolicating such memory, but we really
+  // should defer this when we can reason easily about symbolicating arrays
+  // of bytes.
+  if (isa<loc::ConcreteInt>(L)) {
+    return UnknownVal();
+  }
+  if (!isa<loc::MemRegionVal>(L)) {
+    return UnknownVal();
+  }
+
   const MemRegion *R = cast<loc::MemRegionVal>(L).getRegion();
   RegionInterval RI = RegionToInterval(R);
   // FIXME: FlatStore should handle regions with unknown intervals.
diff --git a/lib/StaticAnalyzer/Core/ObjCMessage.cpp b/lib/StaticAnalyzer/Core/ObjCMessage.cpp
index 2e370d6..c005819 100644
--- a/lib/StaticAnalyzer/Core/ObjCMessage.cpp
+++ b/lib/StaticAnalyzer/Core/ObjCMessage.cpp
@@ -37,6 +37,35 @@ Selector ObjCMessage::getSelector() const {
   return propE->getGetterSelector();
 }
 
+ObjCMethodFamily ObjCMessage::getMethodFamily() const {
+  assert(isValid() && "This ObjCMessage is uninitialized!");
+  // Case 1.  Explicit message send.
+  if (const ObjCMessageExpr *msgE = dyn_cast<ObjCMessageExpr>(MsgOrPropE))
+    return msgE->getMethodFamily();
+
+  const ObjCPropertyRefExpr *propE = cast<ObjCPropertyRefExpr>(MsgOrPropE);
+
+  // Case 2.  Reference to implicit property.
+  if (propE->isImplicitProperty()) {
+    if (isPropertySetter())
+      return propE->getImplicitPropertySetter()->getMethodFamily();
+    else
+      return propE->getImplicitPropertyGetter()->getMethodFamily();
+  }
+
+  // Case 3.  Reference to explicit property.
+  const ObjCPropertyDecl *prop = propE->getExplicitProperty();
+  if (isPropertySetter()) {
+    if (prop->getSetterMethodDecl())
+      return prop->getSetterMethodDecl()->getMethodFamily();
+    return prop->getSetterName().getMethodFamily();
+  } else {
+    if (prop->getGetterMethodDecl())
+      return prop->getGetterMethodDecl()->getMethodFamily();
+    return prop->getGetterName().getMethodFamily();
+  }
+}
+
 const ObjCMethodDecl *ObjCMessage::getMethodDecl() const {
   assert(isValid() && "This ObjCMessage is uninitialized!");
   if (const ObjCMessageExpr *msgE = dyn_cast<ObjCMessageExpr>(MsgOrPropE))
@@ -80,13 +109,27 @@ const Expr *ObjCMessage::getArgExpr(unsigned i) const {
 }
 
 QualType CallOrObjCMessage::getResultType(ASTContext &ctx) const {
+  QualType resultTy;
+  bool isLVal = false;
+
   if (CallE) {
+    isLVal = CallE->isLValue();
     const Expr *Callee = CallE->getCallee();
     if (const FunctionDecl *FD = State->getSVal(Callee).getAsFunctionDecl())
-      return FD->getResultType();
-    return CallE->getType();
+      resultTy = FD->getResultType();
+    else
+      resultTy = CallE->getType();
+  }
+  else {
+    isLVal = isa<ObjCMessageExpr>(Msg.getOriginExpr()) &&
+             Msg.getOriginExpr()->isLValue();
+    resultTy = Msg.getResultType(ctx);
   }
-  return Msg.getResultType(ctx);
+
+  if (isLVal)
+    resultTy = ctx.getPointerType(resultTy);
+
+  return resultTy;
 }
 
 SVal CallOrObjCMessage::getArgSValAsScalarOrLoc(unsigned i) const {
@@ -97,3 +140,10 @@ SVal CallOrObjCMessage::getArgSValAsScalarOrLoc(unsigned i) const {
     return Msg.getArgSVal(i, State);
   return UnknownVal();
 }
+
+SVal CallOrObjCMessage::getCXXCallee() const {
+  assert(isCXXCall());
+  const Expr *callee =
+    cast<CXXMemberCallExpr>(CallE)->getImplicitObjectArgument();
+  return State->getSVal(callee);  
+}
diff --git a/lib/StaticAnalyzer/Core/RegionStore.cpp b/lib/StaticAnalyzer/Core/RegionStore.cpp
index 19e0e12..4522f97 100644
--- a/lib/StaticAnalyzer/Core/RegionStore.cpp
+++ b/lib/StaticAnalyzer/Core/RegionStore.cpp
@@ -337,6 +337,9 @@ public: // Part of public interface to class.
 
   SVal RetrieveFieldOrElementCommon(Store store, const TypedRegion *R,
                                     QualType Ty, const MemRegion *superR);
+  
+  SVal RetrieveLazyBinding(const MemRegion *lazyBindingRegion,
+                           Store lazyBindingStore);
 
   /// Retrieve the values in a struct and return a CompoundVal, used when doing
   /// struct copy:
@@ -355,7 +358,8 @@ public: // Part of public interface to class.
 
   /// Get the state and region whose binding this region R corresponds to.
   std::pair<Store, const MemRegion*>
-  GetLazyBinding(RegionBindings B, const MemRegion *R);
+  GetLazyBinding(RegionBindings B, const MemRegion *R,
+                 const MemRegion *originalRegion);
 
   StoreRef CopyLazyBindings(nonloc::LazyCompoundVal V, Store store,
                             const TypedRegion *R);
@@ -684,11 +688,11 @@ void invalidateRegionsWorker::VisitBaseRegion(const MemRegion *baseR) {
   QualType T = TR->getValueType();
 
     // Invalidate the binding.
-  if (T->isStructureType()) {
+  if (T->isStructureOrClassType()) {
     // Invalidate the region by setting its default value to
     // conjured symbol. The type of the symbol is irrelavant.
-    DefinedOrUnknownSVal V = svalBuilder.getConjuredSymbolVal(baseR, Ex, Ctx.IntTy,
-                                                         Count);
+    DefinedOrUnknownSVal V =
+      svalBuilder.getConjuredSymbolVal(baseR, Ex, Ctx.IntTy, Count);
     B = RM.addBinding(B, baseR, BindingKey::Default, V);
     return;
   }
@@ -976,15 +980,20 @@ SVal RegionStoreManager::Retrieve(Store store, Loc L, QualType T) {
 }
 
 std::pair<Store, const MemRegion *>
-RegionStoreManager::GetLazyBinding(RegionBindings B, const MemRegion *R) {
-  if (Optional<SVal> OV = getDirectBinding(B, R))
-    if (const nonloc::LazyCompoundVal *V =
-        dyn_cast<nonloc::LazyCompoundVal>(OV.getPointer()))
-      return std::make_pair(V->getStore(), V->getRegion());
-
+RegionStoreManager::GetLazyBinding(RegionBindings B, const MemRegion *R,
+                                   const MemRegion *originalRegion) {
+  
+  if (originalRegion != R) {
+    if (Optional<SVal> OV = getDefaultBinding(B, R)) {
+      if (const nonloc::LazyCompoundVal *V =
+          dyn_cast<nonloc::LazyCompoundVal>(OV.getPointer()))
+        return std::make_pair(V->getStore(), V->getRegion());
+    }
+  }
+  
   if (const ElementRegion *ER = dyn_cast<ElementRegion>(R)) {
     const std::pair<Store, const MemRegion *> &X =
-      GetLazyBinding(B, ER->getSuperRegion());
+      GetLazyBinding(B, ER->getSuperRegion(), originalRegion);
 
     if (X.second)
       return std::make_pair(X.first,
@@ -992,7 +1001,7 @@ RegionStoreManager::GetLazyBinding(RegionBindings B, const MemRegion *R) {
   }
   else if (const FieldRegion *FR = dyn_cast<FieldRegion>(R)) {
     const std::pair<Store, const MemRegion *> &X =
-      GetLazyBinding(B, FR->getSuperRegion());
+      GetLazyBinding(B, FR->getSuperRegion(), originalRegion);
 
     if (X.second)
       return std::make_pair(X.first,
@@ -1003,12 +1012,13 @@ RegionStoreManager::GetLazyBinding(RegionBindings B, const MemRegion *R) {
   else if (const CXXBaseObjectRegion *baseReg = 
                             dyn_cast<CXXBaseObjectRegion>(R)) {
     const std::pair<Store, const MemRegion *> &X =
-      GetLazyBinding(B, baseReg->getSuperRegion());
+      GetLazyBinding(B, baseReg->getSuperRegion(), originalRegion);
     
     if (X.second)
       return std::make_pair(X.first,
                      MRMgr.getCXXBaseObjectRegionWithSuper(baseReg, X.second));
   }
+
   // The NULL MemRegion indicates an non-existent lazy binding. A NULL Store is
   // possible for a valid lazy binding.
   return std::make_pair((Store) 0, (const MemRegion *) 0);
@@ -1098,14 +1108,19 @@ RegionStoreManager::RetrieveDerivedDefaultValue(RegionBindings B,
                                                 QualType Ty) {
 
   if (const Optional<SVal> &D = getDefaultBinding(B, superR)) {
-    if (SymbolRef parentSym = D->getAsSymbol())
+    const SVal &val = D.getValue();
+    if (SymbolRef parentSym = val.getAsSymbol())
       return svalBuilder.getDerivedRegionValueSymbolVal(parentSym, R);
 
-    if (D->isZeroConstant())
+    if (val.isZeroConstant())
       return svalBuilder.makeZeroVal(Ty);
 
-    if (D->isUnknownOrUndef())
-      return *D;
+    if (val.isUnknownOrUndef())
+      return val;
+
+    // Lazy bindings are handled later.
+    if (isa<nonloc::LazyCompoundVal>(val))
+      return Optional<SVal>();
 
     assert(0 && "Unknown default value");
   }
@@ -1113,6 +1128,15 @@ RegionStoreManager::RetrieveDerivedDefaultValue(RegionBindings B,
   return Optional<SVal>();
 }
 
+SVal RegionStoreManager::RetrieveLazyBinding(const MemRegion *lazyBindingRegion,
+                                             Store lazyBindingStore) {
+  if (const ElementRegion *ER = dyn_cast<ElementRegion>(lazyBindingRegion))
+    return RetrieveElement(lazyBindingStore, ER);
+  
+  return RetrieveField(lazyBindingStore,
+                       cast<FieldRegion>(lazyBindingRegion));
+}
+                                        
 SVal RegionStoreManager::RetrieveFieldOrElementCommon(Store store,
                                                       const TypedRegion *R,
                                                       QualType Ty,
@@ -1140,14 +1164,10 @@ SVal RegionStoreManager::RetrieveFieldOrElementCommon(Store store,
   // Lazy binding?
   Store lazyBindingStore = NULL;
   const MemRegion *lazyBindingRegion = NULL;
-  llvm::tie(lazyBindingStore, lazyBindingRegion) = GetLazyBinding(B, R);
+  llvm::tie(lazyBindingStore, lazyBindingRegion) = GetLazyBinding(B, R, R);
 
-  if (lazyBindingRegion) {
-    if (const ElementRegion *ER = dyn_cast<ElementRegion>(lazyBindingRegion))
-      return RetrieveElement(lazyBindingStore, ER);
-    return RetrieveField(lazyBindingStore,
-                         cast<FieldRegion>(lazyBindingRegion));
-  }
+  if (lazyBindingRegion)
+    return RetrieveLazyBinding(lazyBindingRegion, lazyBindingStore);
 
   if (R->hasStackNonParametersStorage()) {
     if (const ElementRegion *ER = dyn_cast<ElementRegion>(R)) {
@@ -1250,12 +1270,12 @@ SVal RegionStoreManager::RetrieveLazySymbol(const TypedRegion *R) {
 SVal RegionStoreManager::RetrieveStruct(Store store, const TypedRegion* R) {
   QualType T = R->getValueType();
   assert(T->isStructureOrClassType());
-  return svalBuilder.makeLazyCompoundVal(store, R);
+  return svalBuilder.makeLazyCompoundVal(StoreRef(store, *this), R);
 }
 
 SVal RegionStoreManager::RetrieveArray(Store store, const TypedRegion * R) {
   assert(Ctx.getAsConstantArrayType(R->getValueType()));
-  return svalBuilder.makeLazyCompoundVal(store, R);
+  return svalBuilder.makeLazyCompoundVal(StoreRef(store, *this), R);
 }
 
 //===----------------------------------------------------------------------===//
@@ -1378,7 +1398,8 @@ StoreRef RegionStoreManager::BindArray(Store store, const TypedRegion* R,
 
     // Treat the string as a lazy compound value.
     nonloc::LazyCompoundVal LCV =
-      cast<nonloc::LazyCompoundVal>(svalBuilder.makeLazyCompoundVal(store, S));
+      cast<nonloc::LazyCompoundVal>(svalBuilder.
+                                makeLazyCompoundVal(StoreRef(store, *this), S));
     return CopyLazyBindings(LCV, store, R);
   }
 
@@ -1529,7 +1550,7 @@ StoreRef RegionStoreManager::CopyLazyBindings(nonloc::LazyCompoundVal V,
 
   // Now copy the bindings.  This amounts to just binding 'V' to 'R'.  This
   // results in a zero-copy algorithm.
-  return StoreRef(addBinding(B, R, BindingKey::Direct,
+  return StoreRef(addBinding(B, R, BindingKey::Default,
                              V).getRootWithoutRetain(), *this);
 }
 
diff --git a/lib/StaticAnalyzer/Core/SValBuilder.cpp b/lib/StaticAnalyzer/Core/SValBuilder.cpp
index b0fd497..71f2b4a 100644
--- a/lib/StaticAnalyzer/Core/SValBuilder.cpp
+++ b/lib/StaticAnalyzer/Core/SValBuilder.cpp
@@ -25,12 +25,12 @@ using namespace ento;
 // Basic SVal creation.
 //===----------------------------------------------------------------------===//
 
-DefinedOrUnknownSVal SValBuilder::makeZeroVal(QualType T) {
-  if (Loc::isLocType(T))
+DefinedOrUnknownSVal SValBuilder::makeZeroVal(QualType type) {
+  if (Loc::isLocType(type))
     return makeNull();
 
-  if (T->isIntegerType())
-    return makeIntVal(0, T);
+  if (type->isIntegerType())
+    return makeIntVal(0, type);
 
   // FIXME: Handle floats.
   // FIXME: Handle structs.
@@ -39,44 +39,44 @@ DefinedOrUnknownSVal SValBuilder::makeZeroVal(QualType T) {
 
 
 NonLoc SValBuilder::makeNonLoc(const SymExpr *lhs, BinaryOperator::Opcode op,
-                                const llvm::APSInt& v, QualType T) {
+                                const llvm::APSInt& rhs, QualType type) {
   // The Environment ensures we always get a persistent APSInt in
   // BasicValueFactory, so we don't need to get the APSInt from
   // BasicValueFactory again.
-  assert(!Loc::isLocType(T));
-  return nonloc::SymExprVal(SymMgr.getSymIntExpr(lhs, op, v, T));
+  assert(!Loc::isLocType(type));
+  return nonloc::SymExprVal(SymMgr.getSymIntExpr(lhs, op, rhs, type));
 }
 
 NonLoc SValBuilder::makeNonLoc(const SymExpr *lhs, BinaryOperator::Opcode op,
-                                const SymExpr *rhs, QualType T) {
+                               const SymExpr *rhs, QualType type) {
   assert(SymMgr.getType(lhs) == SymMgr.getType(rhs));
-  assert(!Loc::isLocType(T));
-  return nonloc::SymExprVal(SymMgr.getSymSymExpr(lhs, op, rhs, T));
+  assert(!Loc::isLocType(type));
+  return nonloc::SymExprVal(SymMgr.getSymSymExpr(lhs, op, rhs, type));
 }
 
 
-SVal SValBuilder::convertToArrayIndex(SVal V) {
-  if (V.isUnknownOrUndef())
-    return V;
+SVal SValBuilder::convertToArrayIndex(SVal val) {
+  if (val.isUnknownOrUndef())
+    return val;
 
   // Common case: we have an appropriately sized integer.
-  if (nonloc::ConcreteInt* CI = dyn_cast<nonloc::ConcreteInt>(&V)) {
+  if (nonloc::ConcreteInt* CI = dyn_cast<nonloc::ConcreteInt>(&val)) {
     const llvm::APSInt& I = CI->getValue();
     if (I.getBitWidth() == ArrayIndexWidth && I.isSigned())
-      return V;
+      return val;
   }
 
-  return evalCastNL(cast<NonLoc>(V), ArrayIndexTy);
+  return evalCastFromNonLoc(cast<NonLoc>(val), ArrayIndexTy);
 }
 
 DefinedOrUnknownSVal 
-SValBuilder::getRegionValueSymbolVal(const TypedRegion* R) {
-  QualType T = R->getValueType();
+SValBuilder::getRegionValueSymbolVal(const TypedRegion* region) {
+  QualType T = region->getValueType();
 
   if (!SymbolManager::canSymbolicate(T))
     return UnknownVal();
 
-  SymbolRef sym = SymMgr.getRegionValueSymbol(R);
+  SymbolRef sym = SymMgr.getRegionValueSymbol(region);
 
   if (Loc::isLocType(T))
     return loc::MemRegionVal(MemMgr.getSymbolicRegion(sym));
@@ -84,15 +84,15 @@ SValBuilder::getRegionValueSymbolVal(const TypedRegion* R) {
   return nonloc::SymbolVal(sym);
 }
 
-DefinedOrUnknownSVal SValBuilder::getConjuredSymbolVal(const void *SymbolTag,
-                                                        const Expr *E,
-                                                        unsigned Count) {
-  QualType T = E->getType();
+DefinedOrUnknownSVal SValBuilder::getConjuredSymbolVal(const void *symbolTag,
+                                                       const Expr *expr,
+                                                       unsigned count) {
+  QualType T = expr->getType();
 
   if (!SymbolManager::canSymbolicate(T))
     return UnknownVal();
 
-  SymbolRef sym = SymMgr.getConjuredSymbol(E, Count, SymbolTag);
+  SymbolRef sym = SymMgr.getConjuredSymbol(expr, count, symbolTag);
 
   if (Loc::isLocType(T))
     return loc::MemRegionVal(MemMgr.getSymbolicRegion(sym));
@@ -100,31 +100,32 @@ DefinedOrUnknownSVal SValBuilder::getConjuredSymbolVal(const void *SymbolTag,
   return nonloc::SymbolVal(sym);
 }
 
-DefinedOrUnknownSVal SValBuilder::getConjuredSymbolVal(const void *SymbolTag,
-                                                        const Expr *E,
-                                                        QualType T,
-                                                        unsigned Count) {
+DefinedOrUnknownSVal SValBuilder::getConjuredSymbolVal(const void *symbolTag,
+                                                       const Expr *expr,
+                                                       QualType type,
+                                                       unsigned count) {
   
-  if (!SymbolManager::canSymbolicate(T))
+  if (!SymbolManager::canSymbolicate(type))
     return UnknownVal();
 
-  SymbolRef sym = SymMgr.getConjuredSymbol(E, T, Count, SymbolTag);
+  SymbolRef sym = SymMgr.getConjuredSymbol(expr, type, count, symbolTag);
 
-  if (Loc::isLocType(T))
+  if (Loc::isLocType(type))
     return loc::MemRegionVal(MemMgr.getSymbolicRegion(sym));
 
   return nonloc::SymbolVal(sym);
 }
 
-DefinedSVal SValBuilder::getMetadataSymbolVal(const void *SymbolTag,
-                                               const MemRegion *MR,
-                                               const Expr *E, QualType T,
-                                               unsigned Count) {
-  assert(SymbolManager::canSymbolicate(T) && "Invalid metadata symbol type");
+DefinedSVal SValBuilder::getMetadataSymbolVal(const void *symbolTag,
+                                              const MemRegion *region,
+                                              const Expr *expr, QualType type,
+                                              unsigned count) {
+  assert(SymbolManager::canSymbolicate(type) && "Invalid metadata symbol type");
 
-  SymbolRef sym = SymMgr.getMetadataSymbol(MR, E, T, Count, SymbolTag);
+  SymbolRef sym =
+      SymMgr.getMetadataSymbol(region, expr, type, count, symbolTag);
 
-  if (Loc::isLocType(T))
+  if (Loc::isLocType(type))
     return loc::MemRegionVal(MemMgr.getSymbolicRegion(sym));
 
   return nonloc::SymbolVal(sym);
@@ -132,13 +133,13 @@ DefinedSVal SValBuilder::getMetadataSymbolVal(const void *SymbolTag,
 
 DefinedOrUnknownSVal
 SValBuilder::getDerivedRegionValueSymbolVal(SymbolRef parentSymbol,
-                                             const TypedRegion *R) {
-  QualType T = R->getValueType();
+                                             const TypedRegion *region) {
+  QualType T = region->getValueType();
 
   if (!SymbolManager::canSymbolicate(T))
     return UnknownVal();
 
-  SymbolRef sym = SymMgr.getDerivedSymbol(parentSymbol, R);
+  SymbolRef sym = SymMgr.getDerivedSymbol(parentSymbol, region);
 
   if (Loc::isLocType(T))
     return loc::MemRegionVal(MemMgr.getSymbolicRegion(sym));
@@ -146,53 +147,53 @@ SValBuilder::getDerivedRegionValueSymbolVal(SymbolRef parentSymbol,
   return nonloc::SymbolVal(sym);
 }
 
-DefinedSVal SValBuilder::getFunctionPointer(const FunctionDecl* FD) {
-  return loc::MemRegionVal(MemMgr.getFunctionTextRegion(FD));
+DefinedSVal SValBuilder::getFunctionPointer(const FunctionDecl* func) {
+  return loc::MemRegionVal(MemMgr.getFunctionTextRegion(func));
 }
 
-DefinedSVal SValBuilder::getBlockPointer(const BlockDecl *D,
-                                          CanQualType locTy,
-                                          const LocationContext *LC) {
+DefinedSVal SValBuilder::getBlockPointer(const BlockDecl *block,
+                                         CanQualType locTy,
+                                         const LocationContext *locContext) {
   const BlockTextRegion *BC =
-    MemMgr.getBlockTextRegion(D, locTy, LC->getAnalysisContext());
-  const BlockDataRegion *BD = MemMgr.getBlockDataRegion(BC, LC);
+    MemMgr.getBlockTextRegion(block, locTy, locContext->getAnalysisContext());
+  const BlockDataRegion *BD = MemMgr.getBlockDataRegion(BC, locContext);
   return loc::MemRegionVal(BD);
 }
 
 //===----------------------------------------------------------------------===//
 
-SVal SValBuilder::evalBinOp(const GRState *ST, BinaryOperator::Opcode Op,
-                          SVal L, SVal R, QualType T) {
+SVal SValBuilder::evalBinOp(const GRState *state, BinaryOperator::Opcode op,
+                            SVal lhs, SVal rhs, QualType type) {
 
-  if (L.isUndef() || R.isUndef())
+  if (lhs.isUndef() || rhs.isUndef())
     return UndefinedVal();
 
-  if (L.isUnknown() || R.isUnknown())
+  if (lhs.isUnknown() || rhs.isUnknown())
     return UnknownVal();
 
-  if (isa<Loc>(L)) {
-    if (isa<Loc>(R))
-      return evalBinOpLL(ST, Op, cast<Loc>(L), cast<Loc>(R), T);
+  if (isa<Loc>(lhs)) {
+    if (isa<Loc>(rhs))
+      return evalBinOpLL(state, op, cast<Loc>(lhs), cast<Loc>(rhs), type);
 
-    return evalBinOpLN(ST, Op, cast<Loc>(L), cast<NonLoc>(R), T);
+    return evalBinOpLN(state, op, cast<Loc>(lhs), cast<NonLoc>(rhs), type);
   }
 
-  if (isa<Loc>(R)) {
+  if (isa<Loc>(rhs)) {
     // Support pointer arithmetic where the addend is on the left
     // and the pointer on the right.
-    assert(Op == BO_Add);
+    assert(op == BO_Add);
 
     // Commute the operands.
-    return evalBinOpLN(ST, Op, cast<Loc>(R), cast<NonLoc>(L), T);
+    return evalBinOpLN(state, op, cast<Loc>(rhs), cast<NonLoc>(lhs), type);
   }
 
-  return evalBinOpNN(ST, Op, cast<NonLoc>(L), cast<NonLoc>(R), T);
+  return evalBinOpNN(state, op, cast<NonLoc>(lhs), cast<NonLoc>(rhs), type);
 }
 
-DefinedOrUnknownSVal SValBuilder::evalEQ(const GRState *ST,
-                                       DefinedOrUnknownSVal L,
-                                       DefinedOrUnknownSVal R) {
-  return cast<DefinedOrUnknownSVal>(evalBinOp(ST, BO_EQ, L, R,
+DefinedOrUnknownSVal SValBuilder::evalEQ(const GRState *state,
+                                         DefinedOrUnknownSVal lhs,
+                                         DefinedOrUnknownSVal rhs) {
+  return cast<DefinedOrUnknownSVal>(evalBinOp(state, BO_EQ, lhs, rhs,
                                               Context.IntTy));
 }
 
@@ -213,11 +214,11 @@ SVal SValBuilder::evalCast(SVal val, QualType castTy, QualType originalTy) {
   
   // Check for casts from integers to integers.
   if (castTy->isIntegerType() && originalTy->isIntegerType())
-    return evalCastNL(cast<NonLoc>(val), castTy);
+    return evalCastFromNonLoc(cast<NonLoc>(val), castTy);
 
   // Check for casts from pointers to integers.
   if (castTy->isIntegerType() && Loc::isLocType(originalTy))
-    return evalCastL(cast<Loc>(val), castTy);
+    return evalCastFromLoc(cast<Loc>(val), castTy);
 
   // Check for casts from integers to pointers.
   if (Loc::isLocType(castTy) && originalTy->isIntegerType()) {
@@ -256,7 +257,7 @@ SVal SValBuilder::evalCast(SVal val, QualType castTy, QualType originalTy) {
     // need the original decayed type.
     //    QualType elemTy = cast<ArrayType>(originalTy)->getElementType();
     //    QualType pointerTy = C.getPointerType(elemTy);
-    return evalCastL(cast<Loc>(val), castTy);
+    return evalCastFromLoc(cast<Loc>(val), castTy);
   }
 
   // Check for casts from a region to a specific type.
@@ -305,6 +306,6 @@ SVal SValBuilder::evalCast(SVal val, QualType castTy, QualType originalTy) {
 
 DispatchCast:
   // All other cases.
-  return isa<Loc>(val) ? evalCastL(cast<Loc>(val), castTy)
-                       : evalCastNL(cast<NonLoc>(val), castTy);
+  return isa<Loc>(val) ? evalCastFromLoc(cast<Loc>(val), castTy)
+                       : evalCastFromNonLoc(cast<NonLoc>(val), castTy);
 }
diff --git a/lib/StaticAnalyzer/Core/SimpleConstraintManager.cpp b/lib/StaticAnalyzer/Core/SimpleConstraintManager.cpp
index e0b61ab..1ee694e 100644
--- a/lib/StaticAnalyzer/Core/SimpleConstraintManager.cpp
+++ b/lib/StaticAnalyzer/Core/SimpleConstraintManager.cpp
@@ -15,7 +15,6 @@
 #include "SimpleConstraintManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/GRState.h"
-#include "clang/StaticAnalyzer/Core/PathSensitive/Checker.h"
 
 namespace clang {
 
diff --git a/lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp b/lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp
index 9a46bd6..5d80251 100644
--- a/lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp
+++ b/lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp
@@ -20,8 +20,8 @@ using namespace ento;
 namespace {
 class SimpleSValBuilder : public SValBuilder {
 protected:
-  virtual SVal evalCastNL(NonLoc val, QualType castTy);
-  virtual SVal evalCastL(Loc val, QualType castTy);
+  virtual SVal evalCastFromNonLoc(NonLoc val, QualType castTy);
+  virtual SVal evalCastFromLoc(Loc val, QualType castTy);
 
 public:
   SimpleSValBuilder(llvm::BumpPtrAllocator &alloc, ASTContext &context,
@@ -57,7 +57,7 @@ SValBuilder *ento::createSimpleSValBuilder(llvm::BumpPtrAllocator &alloc,
 // Transfer function for Casts.
 //===----------------------------------------------------------------------===//
 
-SVal SimpleSValBuilder::evalCastNL(NonLoc val, QualType castTy) {
+SVal SimpleSValBuilder::evalCastFromNonLoc(NonLoc val, QualType castTy) {
 
   bool isLocType = Loc::isLocType(castTy);
 
@@ -106,7 +106,7 @@ SVal SimpleSValBuilder::evalCastNL(NonLoc val, QualType castTy) {
     return makeIntVal(i);
 }
 
-SVal SimpleSValBuilder::evalCastL(Loc val, QualType castTy) {
+SVal SimpleSValBuilder::evalCastFromLoc(Loc val, QualType castTy) {
 
   // Casts from pointers -> pointers, just return the lval.
   //
@@ -255,11 +255,12 @@ SVal SimpleSValBuilder::MakeSymIntVal(const SymExpr *LHS,
   }
 
   // Idempotent ops (like a*1) can still change the type of an expression.
-  // Wrap the LHS up in a NonLoc again and let evalCastNL do the dirty work.
+  // Wrap the LHS up in a NonLoc again and let evalCastFromNonLoc do the
+  // dirty work.
   if (isIdempotent) {
     if (SymbolRef LHSSym = dyn_cast<SymbolData>(LHS))
-      return evalCastNL(nonloc::SymbolVal(LHSSym), resultTy);
-    return evalCastNL(nonloc::SymExprVal(LHS), resultTy);
+      return evalCastFromNonLoc(nonloc::SymbolVal(LHSSym), resultTy);
+    return evalCastFromNonLoc(nonloc::SymExprVal(LHS), resultTy);
   }
 
   // If we reach this point, the expression cannot be simplified.
@@ -289,7 +290,7 @@ SVal SimpleSValBuilder::evalBinOpNN(const GRState *state,
         return makeIntVal(0, resultTy);
       case BO_Or:
       case BO_And:
-        return evalCastNL(lhs, resultTy);
+        return evalCastFromNonLoc(lhs, resultTy);
     }
 
   while (1) {
@@ -552,7 +553,7 @@ SVal SimpleSValBuilder::evalBinOpLL(const GRState *state,
       default:
         break;
       case BO_Sub:
-        return evalCastL(lhs, resultTy);
+        return evalCastFromLoc(lhs, resultTy);
       case BO_EQ:
       case BO_LE:
       case BO_LT:
@@ -588,7 +589,7 @@ SVal SimpleSValBuilder::evalBinOpLL(const GRState *state,
       SVal ResultVal = cast<loc::ConcreteInt>(lhs).evalBinOp(BasicVals, op,
                                                              *rInt);
       if (Loc *Result = dyn_cast<Loc>(&ResultVal))
-        return evalCastL(*Result, resultTy);
+        return evalCastFromLoc(*Result, resultTy);
       else
         return UnknownVal();
     }
@@ -633,7 +634,7 @@ SVal SimpleSValBuilder::evalBinOpLL(const GRState *state,
         default:
           break;
         case BO_Sub:
-          return evalCastL(lhs, resultTy);
+          return evalCastFromLoc(lhs, resultTy);
         case BO_EQ:
         case BO_LT:
         case BO_LE:
@@ -698,7 +699,7 @@ SVal SimpleSValBuilder::evalBinOpLL(const GRState *state,
         NonLoc *LeftIndex = dyn_cast<NonLoc>(&LeftIndexVal);
         if (!LeftIndex)
           return UnknownVal();
-        LeftIndexVal = evalCastNL(*LeftIndex, resultTy);
+        LeftIndexVal = evalCastFromNonLoc(*LeftIndex, resultTy);
         LeftIndex = dyn_cast<NonLoc>(&LeftIndexVal);
         if (!LeftIndex)
           return UnknownVal();
@@ -708,7 +709,7 @@ SVal SimpleSValBuilder::evalBinOpLL(const GRState *state,
         NonLoc *RightIndex = dyn_cast<NonLoc>(&RightIndexVal);
         if (!RightIndex)
           return UnknownVal();
-        RightIndexVal = evalCastNL(*RightIndex, resultTy);
+        RightIndexVal = evalCastFromNonLoc(*RightIndex, resultTy);
         RightIndex = dyn_cast<NonLoc>(&RightIndexVal);
         if (!RightIndex)
           return UnknownVal();
@@ -872,7 +873,8 @@ SVal SimpleSValBuilder::evalBinOpLN(const GRState *state,
     QualType elementType;
 
     if (const ElementRegion *elemReg = dyn_cast<ElementRegion>(region)) {
-      index = evalBinOpNN(state, BO_Add, elemReg->getIndex(), rhs,
+      assert(op == BO_Add || op == BO_Sub);
+      index = evalBinOpNN(state, op, elemReg->getIndex(), rhs,
                           getArrayIndexType());
       superR = elemReg->getSuperRegion();
       elementType = elemReg->getElementType();
diff --git a/lib/StaticAnalyzer/Core/Store.cpp b/lib/StaticAnalyzer/Core/Store.cpp
index 7225170..b936738 100644
--- a/lib/StaticAnalyzer/Core/Store.cpp
+++ b/lib/StaticAnalyzer/Core/Store.cpp
@@ -230,9 +230,9 @@ SVal StoreManager::CastRetrievedVal(SVal V, const TypedRegion *R,
   }
   
   if (const Loc *L = dyn_cast<Loc>(&V))
-    return svalBuilder.evalCastL(*L, castTy);
+    return svalBuilder.evalCastFromLoc(*L, castTy);
   else if (const NonLoc *NL = dyn_cast<NonLoc>(&V))
-    return svalBuilder.evalCastNL(*NL, castTy);
+    return svalBuilder.evalCastFromNonLoc(*NL, castTy);
   
   return V;
 }
diff --git a/lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp b/lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp
index e3e7ee9..fe6e1fd 100644
--- a/lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp
+++ b/lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp
@@ -17,8 +17,6 @@
 #include "clang/AST/DeclCXX.h"
 #include "clang/AST/DeclObjC.h"
 #include "clang/AST/ParentMap.h"
-#include "clang/Analysis/Analyses/LiveVariables.h"
-#include "clang/Analysis/Analyses/UninitializedValues.h"
 #include "clang/Analysis/CFG.h"
 #include "clang/StaticAnalyzer/Frontend/CheckerRegistration.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
@@ -30,12 +28,6 @@
 #include "clang/StaticAnalyzer/Core/PathSensitive/TransferFuncs.h"
 #include "clang/StaticAnalyzer/Core/PathDiagnosticClients.h"
 
-// FIXME: Restructure checker registration.
-#include "../Checkers/ClangSACheckers.h"
-#include "../Checkers/ExperimentalChecks.h"
-#include "../Checkers/InternalChecks.h"
-#include "../Checkers/BasicObjCFoundationChecks.h"
-
 #include "clang/Basic/FileManager.h"
 #include "clang/Basic/SourceManager.h"
 #include "clang/Frontend/AnalyzerOptions.h"
@@ -70,20 +62,6 @@ namespace {
 
 class AnalysisConsumer : public ASTConsumer {
 public:
-  typedef void (*CodeAction)(AnalysisConsumer &C, AnalysisManager &M, Decl *D);
-  typedef void (*TUAction)(AnalysisConsumer &C, AnalysisManager &M,
-                           TranslationUnitDecl &TU);
-
-private:
-  typedef std::vector<CodeAction> Actions;
-  typedef std::vector<TUAction> TUActions;
-
-  Actions FunctionActions;
-  Actions ObjCMethodActions;
-  Actions ObjCImplementationActions;
-  Actions CXXMethodActions;
-
-public:
   ASTContext* Ctx;
   const Preprocessor &PP;
   const std::string OutDir;
@@ -163,16 +141,6 @@ public:
     }
   }
 
-  void addCodeAction(CodeAction action) {
-    FunctionActions.push_back(action);
-    ObjCMethodActions.push_back(action);
-    CXXMethodActions.push_back(action);
-  }
-
-  void addObjCImplementationAction(CodeAction action) {
-    ObjCImplementationActions.push_back(action);
-  }
-
   virtual void Initialize(ASTContext &Context) {
     Ctx = &Context;
     checkerMgr.reset(registerCheckers(Opts, PP.getLangOptions(),
@@ -194,7 +162,7 @@ public:
   virtual void HandleTranslationUnit(ASTContext &C);
   void HandleDeclContext(ASTContext &C, DeclContext *dc);
 
-  void HandleCode(Decl *D, Actions& actions);
+  void HandleCode(Decl *D);
 };
 } // end anonymous namespace
 
@@ -228,23 +196,25 @@ void AnalysisConsumer::HandleDeclContext(ASTContext &C, DeclContext *dc) {
               FD->getDeclName().getAsString() != Opts.AnalyzeSpecificFunction)
             break;
           DisplayFunction(FD);
-          HandleCode(FD, FunctionActions);
+          HandleCode(FD);
         }
         break;
       }
         
       case Decl::ObjCImplementation: {
         ObjCImplementationDecl* ID = cast<ObjCImplementationDecl>(*I);
-        HandleCode(ID, ObjCImplementationActions);
+        HandleCode(ID);
         
         for (ObjCImplementationDecl::method_iterator MI = ID->meth_begin(), 
              ME = ID->meth_end(); MI != ME; ++MI) {
+          checkerMgr->runCheckersOnASTDecl(*MI, *Mgr, BR);
+
           if ((*MI)->isThisDeclarationADefinition()) {
             if (!Opts.AnalyzeSpecificFunction.empty() &&
                 Opts.AnalyzeSpecificFunction != (*MI)->getSelector().getAsString())
               break;
             DisplayFunction(*MI);
-            HandleCode(*MI, ObjCMethodActions);
+            HandleCode(*MI);
           }
         }
         break;
@@ -279,9 +249,12 @@ static void FindBlocks(DeclContext *D, llvm::SmallVectorImpl<Decl*> &WL) {
       FindBlocks(DC, WL);
 }
 
-void AnalysisConsumer::HandleCode(Decl *D, Actions& actions) {
+static void ActionObjCMemChecker(AnalysisConsumer &C, AnalysisManager& mgr,
+                                 Decl *D);
+
+void AnalysisConsumer::HandleCode(Decl *D) {
 
-  // Don't run the actions if an error has occured with parsing the file.
+  // Don't run the actions if an error has occurred with parsing the file.
   Diagnostic &Diags = PP.getDiagnostics();
   if (Diags.hasErrorOccurred() || Diags.hasFatalErrorOccurred())
     return;
@@ -306,27 +279,17 @@ void AnalysisConsumer::HandleCode(Decl *D, Actions& actions) {
   BugReporter BR(*Mgr);
   for (llvm::SmallVectorImpl<Decl*>::iterator WI=WL.begin(), WE=WL.end();
        WI != WE; ++WI)
-    if ((*WI)->hasBody())
+    if ((*WI)->hasBody()) {
       checkerMgr->runCheckersOnASTBody(*WI, *Mgr, BR);
-
-  for (Actions::iterator I = actions.begin(), E = actions.end(); I != E; ++I)
-    for (llvm::SmallVectorImpl<Decl*>::iterator WI=WL.begin(), WE=WL.end();
-         WI != WE; ++WI)
-      (*I)(*this, *Mgr, *WI);
+      if (checkerMgr->hasPathSensitiveCheckers())
+        ActionObjCMemChecker(*this, *Mgr, *WI);
+    }
 }
 
 //===----------------------------------------------------------------------===//
-// Analyses
+// Path-sensitive checking.
 //===----------------------------------------------------------------------===//
 
-static void ActionWarnUninitVals(AnalysisConsumer &C, AnalysisManager& mgr,
-                                 Decl *D) {
-  if (CFG* c = mgr.getCFG(D)) {
-    CheckUninitializedValues(*c, mgr.getASTContext(), mgr.getDiagnostic());
-  }
-}
-
-
 static void ActionExprEngine(AnalysisConsumer &C, AnalysisManager& mgr,
                                Decl *D,
                                TransferFuncs* tf) {
@@ -340,18 +303,6 @@ static void ActionExprEngine(AnalysisConsumer &C, AnalysisManager& mgr,
     return;
   ExprEngine Eng(mgr, TF.take());
 
-  RegisterNSErrorChecks(Eng.getBugReporter(), Eng, *D);
-
-  if (C.Opts.EnableExperimentalChecks)
-    RegisterExperimentalChecks(Eng);
-
-  if (C.Opts.BufferOverflows)
-    RegisterArrayBoundCheckerV2(Eng);
-
-  // Enable AnalyzerStatsChecker if it was given as an argument
-  if (C.Opts.AnalyzerStats)
-    RegisterAnalyzerStatsChecker(Eng);
-
   // Set the graph auditor.
   llvm::OwningPtr<ExplodedNode::Auditor> Auditor;
   if (mgr.shouldVisualizeUbigraph()) {
@@ -414,16 +365,6 @@ ASTConsumer* ento::CreateAnalysisConsumer(const Preprocessor& pp,
                                            const AnalyzerOptions& Opts) {
   llvm::OwningPtr<AnalysisConsumer> C(new AnalysisConsumer(pp, OutDir, Opts));
 
-  for (unsigned i = 0; i < Opts.AnalysisList.size(); ++i)
-    switch (Opts.AnalysisList[i]) {
-#define ANALYSIS(NAME, CMD, DESC, SCOPE)\
-    case NAME:\
-      C->add ## SCOPE ## Action(&Action ## NAME);\
-      break;
-#include "clang/Frontend/Analyses.def"
-    default: break;
-    }
-
   // Last, disable the effects of '-Werror' when using the AnalysisConsumer.
   pp.getDiagnostics().setWarningsAsErrors(false);
 
diff --git a/lib/StaticAnalyzer/Frontend/CheckerRegistration.cpp b/lib/StaticAnalyzer/Frontend/CheckerRegistration.cpp
index 677e20c..d7edc7e 100644
--- a/lib/StaticAnalyzer/Frontend/CheckerRegistration.cpp
+++ b/lib/StaticAnalyzer/Frontend/CheckerRegistration.cpp
@@ -43,6 +43,8 @@ CheckerManager *ento::registerCheckers(const AnalyzerOptions &opts,
 
   // FIXME: Load CheckerProviders from plugins.
 
+  checkerMgr->finishedCheckerRegistration();
+
   for (unsigned i = 0, e = checkerOpts.size(); i != e; ++i) {
     if (checkerOpts[i].isUnclaimed())
       diags.Report(diag::warn_unkwown_analyzer_checker)
@@ -55,9 +57,6 @@ CheckerManager *ento::registerCheckers(const AnalyzerOptions &opts,
 void ento::printCheckerHelp(llvm::raw_ostream &OS) {
   OS << "OVERVIEW: Clang Static Analyzer Checkers List\n";
   OS << '\n';
-  OS << "USAGE: -analyzer-checker <check1,check2,...>\n";
-  OS << '\n';
-  OS << "CHECKERS:\n";
 
   llvm::OwningPtr<CheckerProvider> provider(createClangSACheckerProvider());
   provider->printHelp(OS);
author	dim <dim@FreeBSD.org>	2011-05-02 19:39:53 +0000
committer	dim <dim@FreeBSD.org>	2011-05-02 19:39:53 +0000
commit	110eaaceddcec790f7e6a5e3bf1261c9aa1e73ab (patch)
tree	64a10f4c4154739d4a8191d7e1b52ce497f4ebd6 /lib/StaticAnalyzer
parent	a0fb00f9837bd0d2e5948f16f6a6b82a7a628f51 (diff)
download	FreeBSD-src-110eaaceddcec790f7e6a5e3bf1261c9aa1e73ab.zip FreeBSD-src-110eaaceddcec790f7e6a5e3bf1261c9aa1e73ab.tar.gz