<div dir="ltr">Hello everyone,<div><br></div><div>I am writing my own checker for Static Analyzer, and when I intended to mark some taints to  the MemRegion, there was a problem that I could not create a new ProgramStateRef with the function :</div><div><br><table class="" style="font-size:13px;font-family:'Lucida Grande',Verdana,Geneva,Arial,sans-serif;line-height:13.52px;border-spacing:0px;padding:0px;color:rgb(0,0,0)"><tbody><tr><td class="" align="right" valign="top" style="margin:4px;border-style:solid none none;border-top-width:1px;border-top-color:rgb(196,207,229);padding:1px 0px 0px 8px;white-space:nowrap;background-color:rgb(249,250,252)"><a class="" href="http://clang.llvm.org/doxygen/namespaceclang_1_1ento.html#a4e45a121820f0d80d8910093dd33a1df" style="color:rgb(70,101,162);font-weight:bold">ProgramStateRef</a> </td><td class="" valign="bottom" style="margin:4px;border-style:solid none none;border-top-width:1px;border-top-color:rgb(196,207,229);padding:1px 0px 0px 8px;width:1132.8px;background-color:rgb(249,250,252)"><a class="" href="http://clang.llvm.org/doxygen/classclang_1_1ento_1_1ProgramState.html#acd4c5e1ba98d0b4ab0d8b7e1d9e7bac6" style="color:rgb(70,101,162);font-weight:bold">addTaint</a> (const <a class="" href="http://clang.llvm.org/doxygen/classclang_1_1ento_1_1MemRegion.html" style="color:rgb(70,101,162);font-weight:bold">MemRegion</a> *R, <a class="" href="http://clang.llvm.org/doxygen/namespaceclang_1_1ento.html#a7b288ea7271a1db7e1686e2e1af03a46" style="color:rgb(70,101,162);font-weight:bold">TaintTagType</a> <a class="" href="http://clang.llvm.org/doxygen/ChrootChecker_8cpp.html#aa10c9e8951b8ccf714a59ec321bdac5b" style="color:rgb(70,101,162);font-weight:bold">Kind</a>=<a class="" href="http://clang.llvm.org/doxygen/namespaceclang_1_1ento.html#ac9b09a57a698d0c12c655945072bbe7b" style="color:rgb(70,101,162);font-weight:bold">TaintTagGeneric</a>) const ,  thus I could not find the tainted MemRegion.</td></tr></tbody></table>And I use it like this:<br><br></div><div>







<p class=""><span class="">void</span> DoubleFetchChecker::checkBind(<span class="">SVal</span> loc, <span class="">SVal</span> val,<span class="">const</span> <span class="">Stmt</span> *StoreE,<span class="">CheckerContext</span> &Ctx) <span class="">const</span>{</p></div><div>







<p class="">    ProgramStateRef state = Ctx.getState();</p>
<p class=""><span class=""></span><span class="">    const</span> MemRegion *mrptr = loc.getAsRegion();</p><p class="">







</p><p class="">    state = state->addTaint(mrptr);</p><p class="">    Ctx.addTransition(state);</p><p class="">}</p><p class="">but when I check it with state->isTainted(mrptr), it failed.  Did I make any mistake when using this function?</p></div><div><br></div><div>Looking forward to your help! Thank you!</div><div><br></div><div><br></div><div>Kind regards</div><div>Pengfei<br><br><table class="" style="font-family:'Lucida Grande',Verdana,Geneva,Arial,sans-serif;font-size:13px;line-height:13.52px;border-spacing:0px;padding:0px;color:rgb(0,0,0)"><tbody><tr><td class="" align="right" valign="top" style="border-style:solid none none;border-top-width:1px;border-top-color:rgb(196,207,229);margin:4px;padding:1px 0px 0px 8px;white-space:nowrap;background-color:rgb(249,250,252)"><br></td><td class="" valign="bottom" style="border-style:solid none none;border-top-width:1px;border-top-color:rgb(196,207,229);margin:4px;padding:1px 0px 0px 8px;width:1132.8px;background-color:rgb(249,250,252)"><br><br><br></td></tr></tbody></table></div></div>