Index: include/clang/Analysis/PathSensitive/GRState.h
===================================================================
--- include/clang/Analysis/PathSensitive/GRState.h	(revision 57106)
+++ include/clang/Analysis/PathSensitive/GRState.h	(working copy)
@@ -342,7 +342,11 @@
   VarRegion* getRegion(const VarDecl* D) {
     return MRMgr.getVarRegion(D);
   }
-  
+
+  AnonTypedRegion* getAnonRegion(const VarDecl* D) {
+    return MRMgr.getAnonTypedRegion(D);
+  }
+
   lval::MemRegionVal getLVal(const VarDecl* D) {
     return lval::MemRegionVal(getRegion(D));
   }
Index: include/clang/Analysis/PathSensitive/MemRegion.h
===================================================================
--- include/clang/Analysis/PathSensitive/MemRegion.h	(revision 57106)
+++ include/clang/Analysis/PathSensitive/MemRegion.h	(working copy)
@@ -105,14 +105,21 @@
 ///  of memory.
 class AnonTypedRegion : public TypedRegion {
   QualType T;
+  const VarDecl* PointedBy;
 
   friend class MemRegionManager;
   
   AnonTypedRegion(QualType t, MemRegion* sreg)
-    : TypedRegion(sreg, AnonTypedRegionKind), T(t) {}
+    : TypedRegion(sreg, AnonTypedRegionKind), T(t), PointedBy(0) {}
 
+  AnonTypedRegion(QualType t, const VarDecl* p, MemRegion* sreg)
+    : TypedRegion(sreg, AnonTypedRegionKind), T(t), PointedBy(p) {}
+
   static void ProfileRegion(llvm::FoldingSetNodeID& ID, QualType T,
-                      const MemRegion* superRegion);
+                            const MemRegion* superRegion);
+
+  static void ProfileRegion(llvm::FoldingSetNodeID& ID, QualType T, 
+                            const VarDecl* PD, const MemRegion* superRegion);
   
 public:
   QualType getType() const { return T; }
@@ -213,6 +220,7 @@
   MemSpaceRegion* globals;
   MemSpaceRegion* stack;
   MemSpaceRegion* heap;
+  MemSpaceRegion* unknown;
   
 public:
   MemRegionManager(llvm::BumpPtrAllocator& a)
@@ -231,6 +239,10 @@
   /// getHeapRegion - Retrieve the memory region associated with the
   ///  generic "heap".
   MemSpaceRegion* getHeapRegion();
+
+  /// getUnknownRegion - Retrieve the memory region associated with unknown
+  /// memory space.
+  MemSpaceRegion* getUnknownRegion();
   
   /// getVarRegion - Retrieve or create the memory region associated with
   ///  a specified VarDecl.  'superRegion' corresponds to the containing
@@ -254,7 +266,16 @@
   ///   object).
   ObjCIvarRegion* getObjCIvarRegion(const ObjCIvarDecl* ivd,
                                     MemRegion* superRegion);
-  
+
+  /// getAnonTypedRegion - Retrieve or create an anonymous memory region. Such
+  /// memory regions can be created by malloc() or assumed as pointed to by a
+  /// function parameter or global variable.
+  AnonTypedRegion* getAnonTypedRegion(const VarDecl* d, MemRegion* superRegion);
+
+  AnonTypedRegion* getAnonTypedRegion(const VarDecl* d) {
+    return getAnonTypedRegion(d, getUnknownRegion());
+  }
+
   bool hasStackStorage(const MemRegion* R);
   
 private:
Index: lib/Analysis/RegionStore.cpp
===================================================================
--- lib/Analysis/RegionStore.cpp	(revision 0)
+++ lib/Analysis/RegionStore.cpp	(revision 0)
@@ -0,0 +1,91 @@
+#include "clang/Analysis/PathSensitive/MemRegion.h"
+#include "clang/Analysis/PathSensitive/GRState.h"
+#include "clang/Analysis/Analyses/LiveVariables.h"
+
+#include "llvm/ADT/ImmutableMap.h"
+#include "llvm/Support/Compiler.h"
+
+using namespace clang;
+
+typedef llvm::ImmutableMap<const MemRegion*, RVal> RegionBindingsTy;
+
+namespace {
+
+class VISIBILITY_HIDDEN RegionStoreManager : public StoreManager {
+  RegionBindingsTy::Factory RBFactory;
+  GRStateManager& StateMgr;
+
+public:
+  RegionStoreManager(GRStateManager& mgr) : StateMgr(mgr) {}
+
+  virtual ~RegionStoreManager() {}
+
+  Store SetRVal(Store St, LVal LV, RVal V);
+
+  Store getInitialStore();
+
+  static inline RegionBindingsTy GetRegionBindings(Store store) {
+   return RegionBindingsTy(static_cast<const RegionBindingsTy::TreeTy*>(store));
+  }
+};
+
+} // end anonymous namespace
+
+Store RegionStoreManager::SetRVal(Store store, LVal LV, RVal V) {
+  assert(LV.getSubKind() == lval::MemRegionKind);
+
+  MemRegion* R = cast<lval::MemRegionVal>(LV).getRegion();
+  
+  if (!R)
+    return store;
+
+  RegionBindingsTy B = GetRegionBindings(store);
+  return V.isUnknown()
+         ? RBFactory.Remove(B, R).getRoot()
+         : RBFactory.Add(B, R, V).getRoot();
+}
+
+Store RegionStoreManager::getInitialStore() {
+  typedef LiveVariables::AnalysisDataTy LVDataTy;
+  LVDataTy& D = StateMgr.getLiveVariables().getAnalysisData();
+
+  Store St = RBFactory.GetEmptyMap().getRoot();
+
+  for (LVDataTy::decl_iterator I=D.begin_decl(), E=D.end_decl(); I != E; ++I) {
+    ScopedDecl* SD = const_cast<ScopedDecl*>(I->first);
+
+    if (VarDecl* VD = dyn_cast<VarDecl>(SD)) {
+      // Punt on static variables for now.
+      if (VD->getStorageClass() == VarDecl::Static)
+        continue;
+
+      QualType T = VD->getType();
+
+      // Handle integers.
+      if (T->isIntegerType()) {
+        MemRegion* R = StateMgr.getRegion(VD);
+        // Initialize globals and parameters to symbolic values.
+        // Initialize local variables to undefined.
+        RVal X = (VD->hasGlobalStorage() || isa<ParmVarDecl>(VD) ||
+                  isa<ImplicitParamDecl>(VD))
+                 ? RVal::GetSymbolValue(StateMgr.getSymbolManager(), VD)
+                 : UndefinedVal();
+
+        St = SetRVal(St, lval::MemRegionVal(R), X);
+      } else if (LVal::IsLValType(T)) {
+        MemRegion* R = StateMgr.getRegion(VD);
+        // Initialize globals and parameters to a pointer to an anonymous
+        // region.
+        if (VD->hasGlobalStorage() || isa<ParmVarDecl>(VD) ||
+            isa<ImplicitParamDecl>(VD)) {
+          MemRegion* PR = StateMgr.getAnonRegion(VD);
+          St = SetRVal(St, lval::MemRegionVal(R), lval::MemRegionVal(PR));
+        } else {
+          // Initialize local variables to undefined.
+          St = SetRVal(St, lval::MemRegionVal(R), UndefinedVal());
+        }
+      }
+    }
+  }
+  return St;
+}
Index: lib/Analysis/MemRegion.cpp
===================================================================
--- lib/Analysis/MemRegion.cpp	(revision 57106)
+++ lib/Analysis/MemRegion.cpp	(working copy)
@@ -29,11 +29,21 @@
                                     const MemRegion* superRegion) {
   ID.AddInteger((unsigned) AnonTypedRegionKind);
   ID.Add(T);
+  ID.AddPointer(0);
   ID.AddPointer(superRegion);
 }
 
+void AnonTypedRegion::ProfileRegion(llvm::FoldingSetNodeID& ID, QualType T,
+                                    const VarDecl* PD, 
+                                    const MemRegion* superRegion) {
+  ID.AddInteger((unsigned) AnonTypedRegionKind);
+  ID.Add(T);
+  ID.AddPointer(PD);
+  ID.AddPointer(superRegion);
+}
+
 void AnonTypedRegion::Profile(llvm::FoldingSetNodeID& ID) const {
-  AnonTypedRegion::ProfileRegion(ID, T, superRegion);
+  AnonTypedRegion::ProfileRegion(ID, T, PointedBy, superRegion);
 }
 
 void DeclRegion::ProfileRegion(llvm::FoldingSetNodeID& ID, const Decl* D,
@@ -92,6 +102,10 @@
   return LazyAllocate(heap);
 }
 
+MemSpaceRegion* MemRegionManager::getUnknownRegion() {
+  return LazyAllocate(unknown);
+}
+
 VarRegion* MemRegionManager::getVarRegion(const VarDecl* d,
                                           MemRegion* superRegion) {
   llvm::FoldingSetNodeID ID;
@@ -138,14 +152,32 @@
   ObjCIvarRegion* R = cast_or_null<ObjCIvarRegion>(data);
   
   if (!R) {
-    R = (ObjCIvarRegion*) A.Allocate<FieldRegion>();
-    new (R) FieldRegion(d, superRegion);
+    R = (ObjCIvarRegion*) A.Allocate<ObjCIvarRegion>();
+    new (R) ObjCIvarRegion(d, superRegion);
     Regions.InsertNode(R, InsertPos);
   }
   
   return R;
 }
 
+AnonTypedRegion* MemRegionManager::getAnonTypedRegion(const VarDecl* d,
+                                                      MemRegion* superRegion) {
+  llvm::FoldingSetNodeID ID;
+  AnonTypedRegion::ProfileRegion(ID, d->getType(), d, superRegion);
+
+  void* InsertPos;
+  MemRegion* data = Regions.FindNodeOrInsertPos(ID, InsertPos);
+  AnonTypedRegion* R = cast_or_null<AnonTypedRegion>(data);
+
+  if (!R) {
+    R = (AnonTypedRegion*) A.Allocate<AnonTypedRegion>();
+    new (R) AnonTypedRegion(d->getType(), d, superRegion);
+    Regions.InsertNode(R, InsertPos);
+  }
+
+  return R;
+}
+
 bool MemRegionManager::hasStackStorage(const MemRegion* R) {
   MemSpaceRegion* S = getStackRegion();