[analyzer] Add UnarySymExpr

[martong]

Summary

This patch adds a new descendant to the SymExpr hierarchy. This way, now we
can assign constraints to symbolic unary expressions. This time, only
the unary minus is handled, later patches might extend with other unary
operators.

[martong]

Related false positive: https://github.com/llvm/llvm-project/issues/55241

[steakhal]

Looks great. It'll be a nice addition.

It feels like SymbolCast is a UnarySymExpr, but I like to have a distinct entity for this.

Anyway. There are a lot more places where we visit and handle all SymExpr kinds.
Such as:
SValExplainer, SymbolExpressor, SymbolicRangeInferrer, SimpleSValBuilder::simplifySValOnce()::Simplifier, TypeRetrievingVisitor.

Out of these, I think SValExplainer, SymbolExpressor, and TypeRetrievingVisitor are the crucial ones to have consistent behavior.
On top of these, the rest of them e.g. the constraint manager and simplification just improve the reasoning about these, so they probably can be done incrementally.

clang/include/clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h

321

This is always true, right?

325

I would prefer distinct assertions. This way if it triggers we can know which condition is violated.

352

I see that all the rest of the classes have this comment, but I found them not too useful.

clang/lib/StaticAnalyzer/Core/SValBuilder.cpp

104

I think we should assert that we expect only UO_Minus (-), UO_Not (~).
The rest of the UO_* doesn't seem to be relevant anyway: PostInc, PostDec, PreInc, PreDec, AddrOf, Deref, Plus, LNot, Real, Imag, Extension, Coawait.

clang/lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp

108–109

Also handle it here.

clang/lib/StaticAnalyzer/Core/SymbolManager.cpp

73–76

Have a test for this.

[NoQ]

Looks great!

I suspect you'll catch a few crashes/assertion failures if you run this on real-world code, due to various parts of the static analyzer being startled by the new thing, so I really recommend doing this.

clang/include/clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h

338

LLVM_DUMP_METHOD?

clang/lib/StaticAnalyzer/Core/SValBuilder.cpp

104

Actually, let's put such assertion in the constructor. The earlier we catch the problem the better.

clang/lib/StaticAnalyzer/Core/SymbolManager.cpp

498

Excellent!

[martong]

Thanks for the review guys!

It feels like SymbolCast is a UnarySymExpr, but I like to have a distinct entity for this.

Yes, their implementation is similar, but there are subtle differences.

Anyway. There are a lot more places where we visit and handle all SymExpr kinds.
Such as:
SValExplainer, SymbolExpressor, SymbolicRangeInferrer, SimpleSValBuilder::simplifySValOnce()::Simplifier, TypeRetrievingVisitor.

Out of these, I think SValExplainer, SymbolExpressor, and TypeRetrievingVisitor are the crucial ones to have consistent behavior.
On top of these, the rest of them e.g. the constraint manager and simplification just improve the reasoning about these, so they probably can be done incrementally.

Okay, I've extended the SValExplainer, SymbolExpressor and the Simplifier. TypeRetrievingVisitor uses the virtual getType() function of SymExpr and we override that in UnarySymExpr, so that is already handled. I'd like to handle the constraint manager related things (SymbolicRangeInferrer) in a separate patch.

I suspect you'll catch a few crashes/assertion failures if you run this on real-world code, due to various parts of the static analyzer being startled by the new thing, so I really recommend doing this.

Yeah, I am on it.

clang/include/clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h

321

Yes. Maybe that is not meaningful anymore (since classof is impelented in the class properly). So I've deleted it.

325

Ok, I've split them up.

338

SymbolManager.cpp does that for the base class' function:

LLVM_DUMP_METHOD void SymExpr::dump() const { dumpToStream(llvm::errs()); }

352

I'd like to keep it consistent with the other classes, besides the comment might be useful for newcomers.

clang/lib/StaticAnalyzer/Core/SValBuilder.cpp

104

Ok, I've added the assertion to the ctor.

clang/lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp

108–109

Ok, done.

[martong]

• Handle UnarySymExpr in SValExplainer
• Handle UnarySymExpr in SymbolExpressor
• Handle UnarySymExpr in SimpleSvalBuilder's Simplifier
• Better assertions
• Handle UO_Not

[steakhal]

clang/lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp

107

I'm not sure if we should rely on SVal::getType(). I think the calling context should pass the type along here.

[martong]

clang/lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp

107

Good point. One example where the type of the SVal is different than the type of the UnaryExpr is here:

void test_x(int x, long y) {
  x = y;  // $x has `long` type
  -x;     // the UnaryExpr `-x` has `int` type
}

Note that if we use support-symbolic-integer-casts=true then there is no such type mismatch because there is in implicit cast modeled at x = y, thus $x type is correctly int.

Anyway, I am going to update evalMinus and evalComplement to take an additional QualType parameter.

clang/lib/StaticAnalyzer/Core/SymbolManager.cpp

73–76

Would be better to add parenthesis around for compound expressions. So expressions like -x where x = a + b should look like -($a + $b) instead of the wrong format -$a + $b. I am going to update.

[martong]

• Add type parameter to evalMinus and evalComplement
• Correct dumpToStream in case of binary sub expressions

[steakhal]

clang/lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp

107

Please add this test with both scenarios with support-symbolic-integer-casts. D125532 will help in demonstrating this.

clang/lib/StaticAnalyzer/Core/SymbolManager.cpp

73–76

Good point!

clang/test/Analysis/unary-sym-expr.c

36

Does it work if you swap x and y?

[martong]

clang/lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp

107

Ahh, unfortunately, if we use the type of the AST's UnaryExpr instead of the operand SVal then we will end up crashing the constraint solver, because of the missing SymbolCast below:

void crash(int b, long c) {
  b = c;
  if (b > 0)                            // $b  is long
    if(-b) // should not crash here     // $-b is int
      ;
  // SymbolicRangeInferrer
  // takes the negated range of $-b (with type int)
  //     getRangeForNegatedSub
  // and takes the range of $b (with type long) and tries to intersect them.
  //     RangeSet VisitSymExpr(SymbolRef Sym)
}

This manifests in the child patch, because that's where we add the support of UnarySymExpr to the solver, so I add a test case there.

[martong]

• Revert "Add type parameter to evalMinus and evalComplement"

[martong]

clang/test/Analysis/unary-sym-expr.c

36

No, that does not. And the reason of that is we cannot handle commutativity (yet).

[steakhal]

clang/test/Analysis/unary-sym-expr.c

36

We could still test it, and put there a FIXME.

[martong]

clang/test/Analysis/unary-sym-expr.c

36

Ok, added a fixme.

clang/include/clang/StaticAnalyzer/Checkers/SValExplainer.h

public:
   // Add the relevant code once it does.
 
   std::string VisitSymSymExpr(const SymSymExpr *S) {
     return "(" + Visit(S->getLHS()) + ") " +
            std::string(BinaryOperator::getOpcodeStr(S->getOpcode())) +
            " (" + Visit(S->getRHS()) + ")";
   }
 
+  std::string VisitUnarySymExpr(const UnarySymExpr *S) {
+    return std::string(UnaryOperator::getOpcodeStr(S->getOpcode())) + " (" +
+           Visit(S->getOperand()) + ")";
+  }
+
   // TODO: SymbolCast doesn't appear in practice.
   // Add the relevant code once it does.
 
   std::string VisitSymbolicRegion(const SymbolicRegion *R) {
     // Explain 'this' object here.
     // TODO: Explain CXXThisRegion itself, find a way to test it.
     if (isThisObject(R))
       return "'this' object";

clang/include/clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h

public:
   /// that represents the same value, but is hopefully easier to work with
   /// than the original SVal.
   virtual SVal simplifySVal(ProgramStateRef State, SVal Val) = 0;
 
   /// Constructs a symbolic expression for two non-location values.
   SVal makeSymExprValNN(BinaryOperator::Opcode op,
                         NonLoc lhs, NonLoc rhs, QualType resultTy);
 
+  SVal evalUnaryOp(ProgramStateRef state, UnaryOperator::Opcode opc,
+                 SVal operand, QualType type);
+
   SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op,
                  SVal lhs, SVal rhs, QualType type);
 
   /// \return Whether values in \p lhs and \p rhs are equal at \p state.
   ConditionTruthVal areEqual(ProgramStateRef state, SVal lhs, SVal rhs);
 
   SVal evalEQ(ProgramStateRef state, SVal lhs, SVal rhs);
 
NonLoc makeNonLoc(const SymExpr *lhs, BinaryOperator::Opcode op,
                     const llvm::APSInt& rhs, QualType type);
 
   NonLoc makeNonLoc(const llvm::APSInt& rhs, BinaryOperator::Opcode op,
                     const SymExpr *lhs, QualType type);
 
   NonLoc makeNonLoc(const SymExpr *lhs, BinaryOperator::Opcode op,
                     const SymExpr *rhs, QualType type);
 
+  NonLoc makeNonLoc(const SymExpr *operand, UnaryOperator::Opcode op,
+                    QualType type);
+
   /// Create a NonLoc value for cast.
   NonLoc makeNonLoc(const SymExpr *operand, QualType fromTy, QualType toTy);
 
   nonloc::ConcreteInt makeTruthVal(bool b, QualType type) {
     return nonloc::ConcreteInt(BasicVals.getTruthValue(b, type));
   }
 
   nonloc::ConcreteInt makeTruthVal(bool b) {

clang/include/clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h

public:
   }
 
   // Implement isa<T> support.
   static bool classof(const SymExpr *SE) {
     return SE->getKind() == SymbolCastKind;
   }
 };
 
+/// Represents a symbolic expression involving a unary operator.
+class UnarySymExpr : public SymExpr {
+  const SymExpr *Operand;
+  UnaryOperator::Opcode Op;
+  QualType T;
+
+public:
+  UnarySymExpr(const SymExpr *In, UnaryOperator::Opcode Op, QualType T)
+      : SymExpr(UnarySymExprKind), Operand(In), Op(Op), T(T) {
+    // Note, some unary operators are modeled as a binary operator. E.g. ++x is
+    // modeled as x + 1.
+    assert((Op == UO_Minus || Op == UO_Not) && "non-supported unary expression");
+    // Unary expressions are results of arithmetic. Pointer arithmetic is not
+    // handled by unary expressions, but it is instead handled by applying
+    // sub-regions to regions.
+    assert(isValidTypeForSymbol(T) && "non-valid type for unary symbol");
+    assert(!Loc::isLocType(T) && "unary symbol should be nonloc");
+  }
+
+  unsigned computeComplexity() const override {
+    if (Complexity == 0)
+      Complexity = 1 + Operand->computeComplexity();
+    return Complexity;
+  }
+
+  const SymExpr *getOperand() const { return Operand; }
+  UnaryOperator::Opcode getOpcode() const { return Op; }
+  QualType getType() const override { return T; }
+
+  void dumpToStream(raw_ostream &os) const override;
+
+  static void Profile(llvm::FoldingSetNodeID &ID, const SymExpr *In,
+                      UnaryOperator::Opcode Op, QualType T) {
+    ID.AddInteger((unsigned)UnarySymExprKind);
+    ID.AddPointer(In);
+    ID.AddInteger(Op);
+    ID.Add(T);
+  }
+
+  void Profile(llvm::FoldingSetNodeID &ID) override {
+    Profile(ID, Operand, Op, T);
+  }
+
+  // Implement isa<T> support.
+  static bool classof(const SymExpr *SE) {
+    return SE->getKind() == UnarySymExprKind;
+  }
+};
+
 /// Represents a symbolic expression involving a binary operator
 class BinarySymExpr : public SymExpr {
   BinaryOperator::Opcode Op;
   QualType T;
 
 protected:
   BinarySymExpr(Kind k, BinaryOperator::Opcode op, QualType t)
       : SymExpr(k), Op(op), T(t) {
public:
 
   const IntSymExpr *getIntSymExpr(const llvm::APSInt& lhs,
                                   BinaryOperator::Opcode op,
                                   const SymExpr *rhs, QualType t);
 
   const SymSymExpr *getSymSymExpr(const SymExpr *lhs, BinaryOperator::Opcode op,
                                   const SymExpr *rhs, QualType t);
 
+  const UnarySymExpr *getUnarySymExpr(const SymExpr *operand,
+                                      UnaryOperator::Opcode op, QualType t);
+
   QualType getType(const SymExpr *SE) const {
     return SE->getType();
   }
 
   /// Add artificial symbol dependency.
   ///
   /// The dependent symbol should stay alive as long as the primary is alive.
   void addSymbolDependency(const SymbolRef Primary, const SymbolRef Dependent);

clang/include/clang/StaticAnalyzer/Core/PathSensitive/Symbols.def

 #ifndef ABSTRACT_SYMBOL
 #define ABSTRACT_SYMBOL(Id, Parent)
 #endif
 
 #ifndef SYMBOL_RANGE
 #define SYMBOL_RANGE(Id, First, Last)
 #endif
 
+SYMBOL(UnarySymExpr, SymExpr)
+
 ABSTRACT_SYMBOL(BinarySymExpr, SymExpr)
   SYMBOL(IntSymExpr, BinarySymExpr)
   SYMBOL(SymIntExpr, BinarySymExpr)
   SYMBOL(SymSymExpr, BinarySymExpr)
 SYMBOL_RANGE(BINARYSYMEXPRS, IntSymExprKind, SymSymExprKind)
 
 SYMBOL(SymbolCast, SymExpr)
 

clang/lib/StaticAnalyzer/Checkers/ExprInspectionChecker.cpp

Optional<std::string> VisitSymSymExpr(const SymSymExpr *S) {
     if (Optional<std::string> Str1 = Visit(S->getLHS()))
       if (Optional<std::string> Str2 = Visit(S->getRHS()))
         return (*Str1 + " " + BinaryOperator::getOpcodeStr(S->getOpcode()) +
                 " " + *Str2)
             .str();
     return None;
   }
 
+  Optional<std::string> VisitUnarySymExpr(const UnarySymExpr *S) {
+    if (Optional<std::string> Str = lookup(S))
+      return Str;
+    if (Optional<std::string> Str = Visit(S->getOperand()))
+      return (UnaryOperator::getOpcodeStr(S->getOpcode()) + *Str).str();
+    return None;
+  }
+
   Optional<std::string> VisitSymbolCast(const SymbolCast *S) {
     if (Optional<std::string> Str = lookup(S))
       return Str;
     if (Optional<std::string> Str = Visit(S->getOperand()))
       return (Twine("(") + S->getType().getAsString() + ")" + *Str).str();
     return None;
   }
 };

clang/lib/StaticAnalyzer/Core/SValBuilder.cpp

 
 NonLoc SValBuilder::makeNonLoc(const SymExpr *lhs, BinaryOperator::Opcode op,
                                const SymExpr *rhs, QualType type) {
   assert(lhs && rhs);
   assert(!Loc::isLocType(type));
   return nonloc::SymbolVal(SymMgr.getSymSymExpr(lhs, op, rhs, type));
 }
 
+NonLoc SValBuilder::makeNonLoc(const SymExpr *operand, UnaryOperator::Opcode op,
+                               QualType type) {
+  assert(operand);
+  assert(!Loc::isLocType(type));
+  return nonloc::SymbolVal(SymMgr.getUnarySymExpr(operand, op, type));
+}
+
 NonLoc SValBuilder::makeNonLoc(const SymExpr *operand,
                                QualType fromTy, QualType toTy) {
   assert(operand);
   assert(!Loc::isLocType(toTy));
   return nonloc::SymbolVal(SymMgr.getCastSymbol(operand, fromTy, toTy));
 }
 
 SVal SValBuilder::convertToArrayIndex(SVal val) {
SVal SValBuilder::makeSymExprValNN(BinaryOperator::Opcode Op,
 
   if (symRHS && symRHS->computeComplexity() < MaxComp)
     if (Optional<nonloc::ConcreteInt> lInt = LHS.getAs<nonloc::ConcreteInt>())
       return makeNonLoc(lInt->getValue(), Op, symRHS, ResultTy);
 
   return UnknownVal();
 }
 
+SVal SValBuilder::evalUnaryOp(ProgramStateRef state, UnaryOperator::Opcode opc,
+                 SVal operand, QualType type) {
+  auto OpN = operand.getAs<NonLoc>();
+  if (!OpN)
+    return UnknownVal();
+
+  if (opc == UO_Minus)
+    return evalMinus(*OpN);
+  if (opc == UO_Not)
+    return evalComplement(*OpN);
+  llvm_unreachable("Unexpected unary operator");
+}
+
 SVal SValBuilder::evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op,
                             SVal lhs, SVal rhs, QualType type) {
   if (lhs.isUndef() || rhs.isUndef())
     return UndefinedVal();
 
   if (lhs.isUnknown() || rhs.isUnknown())
     return UnknownVal();
 

clang/lib/StaticAnalyzer/Core/SimpleSValBuilder.cpp

 //===----------------------------------------------------------------------===//
 // Transfer function for unary operators.
 //===----------------------------------------------------------------------===//
 
 SVal SimpleSValBuilder::evalMinus(NonLoc val) {
   switch (val.getSubKind()) {
   case nonloc::ConcreteIntKind:
     return val.castAs<nonloc::ConcreteInt>().evalMinus(*this);
+  case nonloc::SymbolValKind:
+    return makeNonLoc(val.castAs<nonloc::SymbolVal>().getSymbol(), UO_Minus,
+                      val.getType(Context));
   default:
     return UnknownVal();
   }
 }
 
 SVal SimpleSValBuilder::evalComplement(NonLoc X) {
   switch (X.getSubKind()) {
   case nonloc::ConcreteIntKind:
     return X.castAs<nonloc::ConcreteInt>().evalComplement(*this);
+  case nonloc::SymbolValKind:
+    return makeNonLoc(X.castAs<nonloc::SymbolVal>().getSymbol(), UO_Not,
+                      X.getType(Context));
   default:
     return UnknownVal();
   }
 }
 
 //===----------------------------------------------------------------------===//
 // Transfer function for binary operators.
 //===----------------------------------------------------------------------===//
 
 SVal SimpleSValBuilder::MakeSymIntVal(const SymExpr *LHS,
SVal VisitSymSymExpr(const SymSymExpr *S) {
 
       if (isUnchanged(S->getLHS(), LHS) && isUnchanged(S->getRHS(), RHS))
         return skip(S);
 
       return cache(
           S, SVB.evalBinOp(State, S->getOpcode(), LHS, RHS, S->getType()));
     }
 
+    // FIXME add VisitSymbolCast
+
+    SVal VisitUnarySymExpr(const UnarySymExpr *S) {
+      auto I = Cached.find(S);
+      if (I != Cached.end())
+        return I->second;
+      SVal Op = getConstOrVisit(S->getOperand());
+      if (isUnchanged(S->getOperand(), Op))
+        return skip(S);
+
+      return cache(
+          S, SVB.evalUnaryOp(State, S->getOpcode(), Op, S->getType()));
+    }
+
     SVal VisitSymExpr(SymbolRef S) { return nonloc::SymbolVal(S); }
 
     SVal VisitMemRegion(const MemRegion *R) { return loc::MemRegionVal(R); }
 
     SVal VisitNonLocSymbolVal(nonloc::SymbolVal V) {
       // Simplification is much more costly than computing complexity.
       // For high complexity, it may be not worth it.
       return Visit(V.getSymbol());

clang/lib/StaticAnalyzer/Core/SymbolManager.cpp

 }
 
 void SymbolCast::dumpToStream(raw_ostream &os) const {
   os << '(' << ToTy << ") (";
   Operand->dumpToStream(os);
   os << ')';
 }
 
+void UnarySymExpr::dumpToStream(raw_ostream &os) const {
+  os << UnaryOperator::getOpcodeStr(Op);
+  bool Binary = isa<BinarySymExpr>(Operand);
+  if (Binary)
+    os << '(';
+  Operand->dumpToStream(os);
+  if (Binary)
+    os << ')';
+}
+
 void SymbolConjured::dumpToStream(raw_ostream &os) const {
   os << getKindStr() << getSymbolID() << '{' << T << ", LC" << LCtx->getID();
   if (S)
     os << ", S" << S->getID(LCtx->getDecl()->getASTContext());
   else
     os << ", no stmt";
   os << ", #" << Count << '}';
 }
switch (SE->getKind()) {
     case SymExpr::SymbolConjuredKind:
     case SymExpr::SymbolDerivedKind:
     case SymExpr::SymbolExtentKind:
     case SymExpr::SymbolMetadataKind:
       return;
     case SymExpr::SymbolCastKind:
       itr.push_back(cast<SymbolCast>(SE)->getOperand());
       return;
+    case SymExpr::UnarySymExprKind:
+      itr.push_back(cast<UnarySymExpr>(SE)->getOperand());
+      return;
     case SymExpr::SymIntExprKind:
       itr.push_back(cast<SymIntExpr>(SE)->getLHS());
       return;
     case SymExpr::IntSymExprKind:
       itr.push_back(cast<IntSymExpr>(SE)->getRHS());
       return;
     case SymExpr::SymSymExprKind: {
       const auto *x = cast<SymSymExpr>(SE);
if (!data) {
     data = (SymSymExpr*) BPAlloc.Allocate<SymSymExpr>();
     new (data) SymSymExpr(lhs, op, rhs, t);
     DataSet.InsertNode(data, InsertPos);
   }
 
   return cast<SymSymExpr>(data);
 }
 
+const UnarySymExpr *SymbolManager::getUnarySymExpr(const SymExpr *Operand,
+                                                   UnaryOperator::Opcode Opc,
+                                                   QualType T) {
+  llvm::FoldingSetNodeID ID;
+  UnarySymExpr::Profile(ID, Operand, Opc, T);
+  void *InsertPos;
+  SymExpr *data = DataSet.FindNodeOrInsertPos(ID, InsertPos);
+  if (!data) {
+    data = (UnarySymExpr *)BPAlloc.Allocate<UnarySymExpr>();
+    new (data) UnarySymExpr(Operand, Opc, T);
+    DataSet.InsertNode(data, InsertPos);
+  }
+
+  return cast<UnarySymExpr>(data);
+}
+
 QualType SymbolConjured::getType() const {
   return T;
 }
 
 QualType SymbolDerived::getType() const {
   return R->getValueType();
 }
 
case SymExpr::IntSymExprKind:
     break;
   case SymExpr::SymSymExprKind:
     KnownLive = isLive(cast<SymSymExpr>(sym)->getLHS()) &&
                 isLive(cast<SymSymExpr>(sym)->getRHS());
     break;
   case SymExpr::SymbolCastKind:
     KnownLive = isLive(cast<SymbolCast>(sym)->getOperand());
     break;
+  case SymExpr::UnarySymExprKind:
+    KnownLive = isLive(cast<UnarySymExpr>(sym)->getOperand());
+    break;
   }
 
   if (KnownLive)
     markLive(sym);
 
   return KnownLive;
 }
 

clang/test/Analysis/explain-svals.cpp

if (!s.s2[7].x) {
     // FIXME: we need to be explaining '1' rather than '0' here; not explainer bug.
     clang_analyzer_explain(s.s2[7].x + 1); // expected-warning-re{{{{^concrete memory address '0'$}}}}
   }
 }
 
 void test_4(int x, int y) {
   int z;
   static int stat;
+  clang_analyzer_explain(-x);    // expected-warning-re{{{{^\- \(argument 'x'\)$}}}}
   clang_analyzer_explain(x + 1); // expected-warning-re{{{{^\(argument 'x'\) \+ 1$}}}}
   clang_analyzer_explain(1 + y); // expected-warning-re{{{{^\(argument 'y'\) \+ 1$}}}}
   clang_analyzer_explain(x + y); // expected-warning-re{{{{^\(argument 'x'\) \+ \(argument 'y'\)$}}}}
   clang_analyzer_explain(z); // expected-warning-re{{{{^undefined value$}}}}
   clang_analyzer_explain(&z); // expected-warning-re{{{{^pointer to local variable 'z'$}}}}
   clang_analyzer_explain(stat); // expected-warning-re{{{{^signed 32-bit integer '0'$}}}}
   clang_analyzer_explain(&stat); // expected-warning-re{{{{^pointer to static local variable 'stat'$}}}}
   clang_analyzer_explain(stat_glob); // expected-warning-re{{{{^initial value of global variable 'stat_glob'$}}}}

clang/test/Analysis/expr-inspection.cpp

 void foo(int x, unsigned y) {
   clang_analyzer_denote(); // expected-warning{{clang_analyzer_denote() requires a symbol and a string literal}}
   clang_analyzer_express(); // expected-warning{{Missing argument}}
 
   clang_analyzer_denote(x); // expected-warning{{clang_analyzer_denote() requires a symbol and a string literal}}
   clang_analyzer_express(x); // expected-warning{{Unable to express}}
 
   clang_analyzer_denote(x, "$x");
+  clang_analyzer_express(-x); // expected-warning{{-$x}}
+
   clang_analyzer_denote(y, "$y");
   clang_analyzer_express(x + y); // expected-warning{{$x + $y}}
 
   clang_analyzer_denote(1, "$z");     // expected-warning{{Not a symbol}}
   clang_analyzer_express(1);     // expected-warning{{Not a symbol}}
 
   clang_analyzer_denote(x + 1, "$w");
   clang_analyzer_express(x + 1); // expected-warning{{$w}}
   clang_analyzer_express(y + 1); // expected-warning{{$y + 1U}}
 }

clang/test/Analysis/unary-sym-expr.c

+// RUN: %clang_analyze_cc1 %s \
+// RUN:   -analyzer-checker=core,debug.ExprInspection \
+// RUN:   -analyzer-config eagerly-assume=false \
+// RUN:   -verify
+
+void clang_analyzer_eval(int);
+void clang_analyzer_dump(int);
+
+int test(int x, int y) {
+
+  clang_analyzer_dump(-x);       // expected-warning{{-reg_$0<int x>}}
+  clang_analyzer_dump(~x);       // expected-warning{{~reg_$0<int x>}}
+  int z = x + y;
+  clang_analyzer_dump(-z);       // expected-warning{{-((reg_$0<int x>) + (reg_$1<int y>))}}
+  clang_analyzer_dump(-(x + y)); // expected-warning{{-((reg_$0<int x>) + (reg_$1<int y>))}}
+  clang_analyzer_dump(-x + y);   // expected-warning{{(-reg_$0<int x>) + (reg_$1<int y>)}}
+
+  if (-x == 0) {
+    clang_analyzer_eval(-x == 0); // expected-warning{{TRUE}}
+    clang_analyzer_eval(-x > 0);  // expected-warning{{FALSE}}
+    clang_analyzer_eval(-x < 0);  // expected-warning{{FALSE}}
+  }
+  if (~y == 0) {
+    clang_analyzer_eval(~y == 0); // expected-warning{{TRUE}}
+    clang_analyzer_eval(~y > 0);  // expected-warning{{FALSE}}
+    clang_analyzer_eval(~y < 0);  // expected-warning{{FALSE}}
+  }
+  (void)(x);
+  return 42;
+}
+
+void test_svalbuilder_simplification(int x, int y) {
+  if (x + y != 3)
+    return;
+  clang_analyzer_eval(-(x + y) == -3); // expected-warning{{TRUE}}
+}