1 files changed, 29 insertions, 10 deletions
diff --git a/lib/Checker/Environment.cpp b/lib/Checker/Environment.cpp
index cc71f8569c62..be1a677d9118 100644
--- a/lib/Checker/Environment.cpp
+++ b/lib/Checker/Environment.cpp
@@ -96,6 +96,19 @@ public:
 };
 } // end anonymous namespace
 
+static bool isBlockExprInCallers(const Stmt *E, const LocationContext *LC) {
+  const LocationContext *ParentLC = LC->getParent();
+  while (ParentLC) {
+    CFG &C = *ParentLC->getCFG();
+    if (C.isBlkExpr(E))
+      return true;
+    ParentLC = ParentLC->getParent();
+  }
+
+  return false;
+}
+
+
 // RemoveDeadBindings:
 //  - Remove subexpression bindings.
 //  - Remove dead block expression bindings.
@@ -122,13 +135,27 @@ EnvironmentManager::RemoveDeadBindings(Environment Env, const Stmt *S,
        I != E; ++I) {
 
     const Stmt *BlkExpr = I.getKey();
+    const SVal &X = I.getData();
+
+    // Block-level expressions in callers are assumed always live.
+    if (isBlockExprInCallers(BlkExpr, SymReaper.getLocationContext())) {
+      NewEnv.ExprBindings = F.Add(NewEnv.ExprBindings, BlkExpr, X);
+
+      if (isa<loc::MemRegionVal>(X)) {
+        const MemRegion* R = cast<loc::MemRegionVal>(X).getRegion();
+        DRoots.push_back(R);
+      }
+
+      // Mark all symbols in the block expr's value live.
+      MarkLiveCallback cb(SymReaper);
+      ST->scanReachableSymbols(X, cb);
+      continue;
+    }
 
     // Not a block-level expression?
     if (!C.isBlkExpr(BlkExpr))
       continue;
 
-    const SVal &X = I.getData();
-
     if (SymReaper.isLive(S, BlkExpr)) {
       // Copy the binding to the new map.
       NewEnv.ExprBindings = F.Add(NewEnv.ExprBindings, BlkExpr, X);
@@ -137,14 +164,6 @@ EnvironmentManager::RemoveDeadBindings(Environment Env, const Stmt *S,
       if (isa<loc::MemRegionVal>(X)) {
         const MemRegion* R = cast<loc::MemRegionVal>(X).getRegion();
         DRoots.push_back(R);
-        // Mark the super region of the RX as live.
-        // e.g.: int x; char *y = (char*) &x; if (*y) ...
-        // 'y' => element region. 'x' is its super region.
-        // We only add one level super region for now.
-
-        // FIXME: maybe multiple level of super regions should be added.
-        if (const SubRegion *SR = dyn_cast<SubRegion>(R))
-          DRoots.push_back(SR->getSuperRegion());
       }
 
       // Mark all symbols in the block expr's value live.