Heap postconditions and value snapshots

RFC 0013 adds FunctionSummary::heap, a map from an output path to a HeapDescription. Each description uses result-relative pointer cells and the existing value sources. copy-post names an already represented output object; ordinary copy names an incoming value. This makes shared children and cycles finite and keeps final output values separate from historical stores. Core owns bounds, joins, validation and serialization, without Clang dependencies.

Analysis/DataflowHeap.cpp captures final reachable facts, resolves incoming values before a call replaces them, and materializes the graph into the normal state trackers. A definite alias relation intersects at joins and supports strong updates through local aliases; the existing may-alias relation still governs possible consumes. Copies preserve identity when liveness retires the original local. Failure outcomes restore captured input facts. Projection is limited to eight path steps, 128 field alternatives per description and eight alternatives per cell; lost coverage remains visible. Materialized children remain in their containing graph instead of becoming additional historical stores on the next summary iteration.

Output writes and pointer returns retain conditions on immutable entry values. A call snapshots any guard operand or returned input pointer it can overwrite. This preserves extraction (p = *slot; *slot = NULL; return p) and lazy publication without treating a test of the new cell as a test of its old value. Definite publication guards apply to initialized children; an unconditional later write remains unconditional after a join.

Analysis/DataflowValues.cpp folds allocation sizes using current scalar facts. Before overwriting a scalar used by an extent or string length, it redirects the dependency to an interned allocation-time snapshot. Reusing a snapshot site invalidates the old generation’s dependent facts. The domain remains bounded; RFC 0017 extends these snapshots to every dependency of a typed symbolic expression while retaining affine and relation fast paths.

The current summary version 23 and sidecar version 24 retain heap descriptions, post references and string metadata. ProgramDatabase remaps global references and compares these descriptions as part of normal dependency invalidation. The compiler and tooling whole-program modes share this implementation.