[analyzer] Introduce clang_analyzer_dumpSvalType introspection function

[steakhal]

Summary

In some rare cases the type of an SVal might be interesting.
This introspection function exposes this information in tests.

[martong]

clang/lib/StaticAnalyzer/Checkers/ExprInspectionChecker.cpp

268

Would it make sense to call Ty->dump(OS) to a stream and then report the string of the stream?
That way we could see some more information. Or perhaps that could be done in another introspection function.

[steakhal]

clang/lib/StaticAnalyzer/Checkers/ExprInspectionChecker.cpp

268

It's way harder to match on such dumps. Those contain pointer addresses all over the place, making FileChecking a nightmare.

clang/lib/StaticAnalyzer/Checkers/ExprInspectionChecker.cpp

class ExprInspectionChecker
   mutable llvm::DenseMap<const CallExpr *, ReachedStat> ReachedStats;
 
   void analyzerEval(const CallExpr *CE, CheckerContext &C) const;
   void analyzerCheckInlined(const CallExpr *CE, CheckerContext &C) const;
   void analyzerWarnIfReached(const CallExpr *CE, CheckerContext &C) const;
   void analyzerNumTimesReached(const CallExpr *CE, CheckerContext &C) const;
   void analyzerCrash(const CallExpr *CE, CheckerContext &C) const;
   void analyzerWarnOnDeadSymbol(const CallExpr *CE, CheckerContext &C) const;
+  void analyzerDumpSValType(const CallExpr *CE, CheckerContext &C) const;
   void analyzerDump(const CallExpr *CE, CheckerContext &C) const;
   void analyzerExplain(const CallExpr *CE, CheckerContext &C) const;
   void analyzerPrintState(const CallExpr *CE, CheckerContext &C) const;
   void analyzerGetExtent(const CallExpr *CE, CheckerContext &C) const;
   void analyzerDumpExtent(const CallExpr *CE, CheckerContext &C) const;
   void analyzerDumpElementCount(const CallExpr *CE, CheckerContext &C) const;
   void analyzerHashDump(const CallExpr *CE, CheckerContext &C) const;
   void analyzerDenote(const CallExpr *CE, CheckerContext &C) const;
FnCheck Handler =
           .Case("clang_analyzer_warnOnDeadSymbol",
                 &ExprInspectionChecker::analyzerWarnOnDeadSymbol)
           .StartsWith("clang_analyzer_explain",
                       &ExprInspectionChecker::analyzerExplain)
           .Case("clang_analyzer_dumpExtent",
                 &ExprInspectionChecker::analyzerDumpExtent)
           .Case("clang_analyzer_dumpElementCount",
                 &ExprInspectionChecker::analyzerDumpElementCount)
+          .StartsWith("clang_analyzer_dumpSvalType",
+                      &ExprInspectionChecker::analyzerDumpSValType)
           .StartsWith("clang_analyzer_dump",
                       &ExprInspectionChecker::analyzerDump)
           .Case("clang_analyzer_getExtent",
                 &ExprInspectionChecker::analyzerGetExtent)
           .Case("clang_analyzer_printState",
                 &ExprInspectionChecker::analyzerPrintState)
           .Case("clang_analyzer_numTimesReached",
                 &ExprInspectionChecker::analyzerNumTimesReached)
void ExprInspectionChecker::analyzerExplain(const CallExpr *CE,
   if (!Arg)
     return;
 
   SVal V = C.getSVal(Arg);
   SValExplainer Ex(C.getASTContext());
   reportBug(Ex.Visit(V), C);
 }
 
+void ExprInspectionChecker::analyzerDumpSValType(const CallExpr *CE,
+                                                 CheckerContext &C) const {
+  const Expr *Arg = getArgExpr(CE, C);
+  if (!Arg)
+    return;
+
+  QualType Ty = C.getSVal(Arg).getType(C.getASTContext());
+  reportBug(Ty.getAsString(), C);
+}
+
 void ExprInspectionChecker::analyzerDump(const CallExpr *CE,
                                          CheckerContext &C) const {
   const Expr *Arg = getArgExpr(CE, C);
   if (!Arg)
     return;
 
   SVal V = C.getSVal(Arg);
 

clang/test/Analysis/expr-inspection.c

 // RUN: %clang_analyze_cc1 \
 // RUN:  -analyzer-checker=debug.ExprInspection \
 // RUN:  -verify %s 2>&1 | FileCheck %s
 
 // Self-tests for the debug.ExprInspection checker.
 
 void clang_analyzer_dump(int x);
 void clang_analyzer_dump_pointer(int *p);
+void clang_analyzer_dumpSvalType(int x);
+void clang_analyzer_dumpSvalType_pointer(int *p);
 void clang_analyzer_printState(void);
 void clang_analyzer_numTimesReached(void);
 
 void foo(int x) {
   clang_analyzer_dump(x); // expected-warning{{reg_$0<int x>}}
   clang_analyzer_dump(x + (-1)); // expected-warning{{(reg_$0<int x>) - 1}}
+  clang_analyzer_dumpSvalType(x); // expected-warning {{int}}
+
   int y = 1;
   for (; y < 3; ++y) {
     clang_analyzer_numTimesReached(); // expected-warning{{2}}
 
     if (y == 2) {
       int z = x > 13;
       if (!z)
         clang_analyzer_printState();

 
 struct S {
   int x, y;
 };
 
 void test_field_dumps(struct S s, struct S *p) {
   clang_analyzer_dump_pointer(&s.x); // expected-warning{{&s.x}}
   clang_analyzer_dump_pointer(&p->x); // expected-warning{{&SymRegion{reg_$1<struct S * p>}.x}}
+  clang_analyzer_dumpSvalType_pointer(&s.x); // expected-warning {{int *}}
 }