[analyzer] Add new function `clang_analyzer_value` to ExprInspectionChecker

[ASDenysPetrov]

Summary

Introduce a new function clang_analyzer_value. It emits a report that in turn prints a RangeSet or APSInt associated with SVal. If there is no associated value, prints n/a.

[NoQ]

Looks great!

Maybe clang_analyzer_range() instead?

Please add documentation to https://clang.llvm.org/docs/analyzer/developer-docs/DebugChecks.html

clang/test/Analysis/print-ranges.cpp

2

I suspect this test will crash when clang is built with Z3, because the Z3 constraint manager doesn't implement your new function yet.

[ASDenysPetrov]

In D129498#3644222, @NoQ wrote:

Maybe clang_analyzer_range() instead?

Thanks for the notes, @NoQ .
This was its first name. I refused. First, because it emits concrete integers as well and moreover we can extend it for arrays or strings e.g. Second, the ranges is just an implementation detail and an actual thing we want to see is an associated value.

Please add documentation to https://clang.llvm.org/docs/analyzer/developer-docs/DebugChecks.html

I'll do.

clang/test/Analysis/print-ranges.cpp

2

Agree. Is it enough REQUIRES: no-z3 or to add #ifdef ANALYZER_CM_Z3?

[ASDenysPetrov]

Constrained the test by adding llvm-lit REQUIRES command.
Documented a new function at https://clang.llvm.org/docs/analyzer/developer-docs/DebugChecks.html

[NoQ]

In D129498#3647348, @ASDenysPetrov wrote:

In D129498#3644222, @NoQ wrote:

Maybe clang_analyzer_range() instead?

This was its first name. I refused. First, because it emits concrete integers as well and moreover we can extend it for arrays or strings e.g. Second, the ranges is just an implementation detail and an actual thing we want to see is an associated value.

Ok how about clang_analyzer_constraint()? A concrete value could be thought of as constraint, and so can be range, or anything else any exotic constraint managers may decide to dump.

clang/test/Analysis/print-ranges.cpp

2

That should be good. My personal tradition in such cases is to double-check that this doesn't disable the test entirely.

[martong]

Very good!

In D129498#3650595, @NoQ wrote:

In D129498#3647348, @ASDenysPetrov wrote:

In D129498#3644222, @NoQ wrote:

Maybe clang_analyzer_range() instead?

This was its first name. I refused. First, because it emits concrete integers as well and moreover we can extend it for arrays or strings e.g. Second, the ranges is just an implementation detail and an actual thing we want to see is an associated value.

Ok how about clang_analyzer_constraint()? A concrete value could be thought of as constraint, and so can be range, or anything else any exotic constraint managers may decide to dump.

We associate a value to a variable even if that is unconstrained. That value is the whole range of the variable's type. In this sense, I vote for clang_analyzer_value.

clang/include/clang/StaticAnalyzer/Core/PathSensitive/ConstraintManager.h

126

printValue would be more general than printRange which is unique for the range based constraint manager.

clang/test/Analysis/print-ranges.cpp

1

Don't forget to pin the target/triple.

[ASDenysPetrov]

Stick to name clang_analyzer_value.
Change function name from printRange to printValue.
Make description more precise in the documentation.

[martong]

LGTM

[ASDenysPetrov]

Closed with bc08c3cb7f8e797fee14e96eedd3dc358608ada3

clang/test/Analysis/print-ranges.cpp

1

Why does this specific test need it?

2

I added REQUIRES: z3 it prints Unsupported, then added REQUIRES: no-z3 and it passed.

[martong]

clang/test/Analysis/print-ranges.cpp

1

I thought, the bit widths down below might change with different architectures and some build bots might break because of that.

clang/docs/analyzer/developer-docs/DebugChecks.rst

- ``clang_analyzer_dumpElementCount(a single argument of any type)``
 
   Example usage::
 
     void array() {
       int a[] = {1, 3};
       clang_analyzer_dumpExtent(a);       // expected-warning {{8 S64b}}
       clang_analyzer_dumpElementCount(a); // expected-warning {{2 S64b}}
     }
     
+- ``clang_analyzer_value(a single argument of integer or pointer type)``
+
+  Prints an associated value for the given argument.
+  The value can be represented either as a range set or as a concrete integer.
+  The argument shall be of an integer or pointer type.
+  
+  **Note:** This function will print nothing for clang built with Z3 constraint manager.
+  This may cause crashes of your tests. To manage this use one of the test constraining
+  techniques:
+  
+  * llvm-lit commands ``REQUIRES no-z3`` or ``UNSUPPORTED z3`` `See for details. <https://llvm.org/docs/TestingGuide.html#constraining-test-execution>`_
+  
+  * a preprocessor directive ``#ifndef ANALYZER_CM_Z3``
+  
+  * a clang command argument ``-analyzer-constraints=range``
+
+  Example usage::
+
+    void print(char c, unsigned u) {
+      clang_analyzer_value(c); // expected-warning {{8s:{ [-128, 127] }}}
+      if(u != 42)
+         clang_analyzer_value(u); // expected-warning {{32u:{ [0, 41], [43, 4294967295] }}}
+      else
+         clang_analyzer_value(u); // expected-warning {{32u:42}}
+    }
+
 Statistics
 ==========
 
 The debug.Stats checker collects various information about the analysis of each
 function, such as how many blocks were reached and if the analyzer timed out.
 
 There is also an additional -analyzer-stats flag, which enables various
 statistics within the analyzer engine. Note the Stats checker (which produces at

clang/include/clang/StaticAnalyzer/Core/PathSensitive/ConstraintManager.h

public:
   /// alive, remove it.
   virtual ProgramStateRef removeDeadBindings(ProgramStateRef state,
                                                  SymbolReaper& SymReaper) = 0;
 
   virtual void printJson(raw_ostream &Out, ProgramStateRef State,
                          const char *NL, unsigned int Space,
                          bool IsDot) const = 0;
 
+  virtual void printRange(raw_ostream &Out, ProgramStateRef State,
+                          SymbolRef Sym) {}
+
   /// Convenience method to query the state to see if a symbol is null or
   /// not null, or if neither assumption can be made.
   ConditionTruthVal isNull(ProgramStateRef State, SymbolRef Sym) {
     return checkNull(State, Sym);
   }
 
 protected:
   /// A helper class to simulate the call stack of nested assume calls.

clang/include/clang/StaticAnalyzer/Core/PathSensitive/SVals.h

public:
   /// If this SVal wraps a symbol return that SymbolRef.
   /// Otherwise, return 0.
   ///
   /// Casts are ignored during lookup.
   /// \param IncludeBaseRegions The boolean that controls whether the search
   /// should continue to the base regions if the region is not symbolic.
   SymbolRef getAsSymbol(bool IncludeBaseRegions = false) const;
 
+  /// If this SVal is loc::ConcreteInt or nonloc::ConcreteInt,
+  /// return a pointer to APSInt which is held in it.
+  /// Otherwise, return nullptr.
+  const llvm::APSInt *getAsInteger() const;
+
   const MemRegion *getAsRegion() const;
 
   /// printJson - Pretty-prints in JSON format.
   void printJson(raw_ostream &Out, bool AddQuotes) const;
 
   void dumpToStream(raw_ostream &OS) const;
   void dump() const;
 

clang/lib/StaticAnalyzer/Checkers/ExprInspectionChecker.cpp

class ExprInspectionChecker
   mutable llvm::DenseMap<const CallExpr *, ReachedStat> ReachedStats;
 
   void analyzerEval(const CallExpr *CE, CheckerContext &C) const;
   void analyzerCheckInlined(const CallExpr *CE, CheckerContext &C) const;
   void analyzerWarnIfReached(const CallExpr *CE, CheckerContext &C) const;
   void analyzerNumTimesReached(const CallExpr *CE, CheckerContext &C) const;
   void analyzerCrash(const CallExpr *CE, CheckerContext &C) const;
   void analyzerWarnOnDeadSymbol(const CallExpr *CE, CheckerContext &C) const;
+  void analyzerValue(const CallExpr *CE, CheckerContext &C) const;
   void analyzerDumpSValType(const CallExpr *CE, CheckerContext &C) const;
   void analyzerDump(const CallExpr *CE, CheckerContext &C) const;
   void analyzerExplain(const CallExpr *CE, CheckerContext &C) const;
   void analyzerPrintState(const CallExpr *CE, CheckerContext &C) const;
   void analyzerGetExtent(const CallExpr *CE, CheckerContext &C) const;
   void analyzerDumpExtent(const CallExpr *CE, CheckerContext &C) const;
   void analyzerDumpElementCount(const CallExpr *CE, CheckerContext &C) const;
   void analyzerHashDump(const CallExpr *CE, CheckerContext &C) const;
   void analyzerDenote(const CallExpr *CE, CheckerContext &C) const;
   void analyzerExpress(const CallExpr *CE, CheckerContext &C) const;
   void analyzerIsTainted(const CallExpr *CE, CheckerContext &C) const;
 
   typedef void (ExprInspectionChecker::*FnCheck)(const CallExpr *,
                                                  CheckerContext &C) const;
 
   // Optional parameter `ExprVal` for expression value to be marked interesting.
   ExplodedNode *reportBug(llvm::StringRef Msg, CheckerContext &C,
                           Optional<SVal> ExprVal = None) const;
   ExplodedNode *reportBug(llvm::StringRef Msg, BugReporter &BR, ExplodedNode *N,
                           Optional<SVal> ExprVal = None) const;
+  template <typename T> void printAndReport(CheckerContext &C, T What) const;
 
   const Expr *getArgExpr(const CallExpr *CE, CheckerContext &C) const;
   const MemRegion *getArgRegion(const CallExpr *CE, CheckerContext &C) const;
 
 public:
   bool evalCall(const CallEvent &Call, CheckerContext &C) const;
   void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const;
   void checkEndAnalysis(ExplodedGraph &G, BugReporter &BR,
FnCheck Handler =
           .Case("clang_analyzer_warnOnDeadSymbol",
                 &ExprInspectionChecker::analyzerWarnOnDeadSymbol)
           .StartsWith("clang_analyzer_explain",
                       &ExprInspectionChecker::analyzerExplain)
           .Case("clang_analyzer_dumpExtent",
                 &ExprInspectionChecker::analyzerDumpExtent)
           .Case("clang_analyzer_dumpElementCount",
                 &ExprInspectionChecker::analyzerDumpElementCount)
+          .Case("clang_analyzer_value", &ExprInspectionChecker::analyzerValue)
           .StartsWith("clang_analyzer_dumpSvalType",
                       &ExprInspectionChecker::analyzerDumpSValType)
           .StartsWith("clang_analyzer_dump",
                       &ExprInspectionChecker::analyzerDump)
           .Case("clang_analyzer_getExtent",
                 &ExprInspectionChecker::analyzerGetExtent)
           .Case("clang_analyzer_printState",
                 &ExprInspectionChecker::analyzerPrintState)
void ExprInspectionChecker::analyzerExplain(const CallExpr *CE,
   if (!Arg)
     return;
 
   SVal V = C.getSVal(Arg);
   SValExplainer Ex(C.getASTContext());
   reportBug(Ex.Visit(V), C);
 }
 
+static void printHelper(llvm::raw_svector_ostream &Out, CheckerContext &C,
+                        const llvm::APSInt &I) {
+  Out << I.getBitWidth() << (I.isUnsigned() ? "u:" : "s:");
+  Out << I;
+}
+
+static void printHelper(llvm::raw_svector_ostream &Out, CheckerContext &C,
+                        SymbolRef Sym) {
+  C.getConstraintManager().printRange(Out, C.getState(), Sym);
+}
+
+static void printHelper(llvm::raw_svector_ostream &Out, CheckerContext &C,
+                        SVal V) {
+  Out << V;
+}
+
+template <typename T>
+void ExprInspectionChecker::printAndReport(CheckerContext &C, T What) const {
+  llvm::SmallString<64> Str;
+  llvm::raw_svector_ostream OS(Str);
+  printHelper(OS, C, What);
+  reportBug(OS.str(), C);
+}
+
+void ExprInspectionChecker::analyzerValue(const CallExpr *CE,
+                                          CheckerContext &C) const {
+  const Expr *Arg = getArgExpr(CE, C);
+  if (!Arg)
+    return;
+
+  SVal V = C.getSVal(Arg);
+  if (const SymbolRef Sym = V.getAsSymbol())
+    printAndReport(C, Sym);
+  else if (const llvm::APSInt *I = V.getAsInteger())
+    printAndReport(C, *I);
+  else
+    reportBug("n/a", C);
+}
+
 void ExprInspectionChecker::analyzerDumpSValType(const CallExpr *CE,
                                                  CheckerContext &C) const {
   const Expr *Arg = getArgExpr(CE, C);
   if (!Arg)
     return;
 
   QualType Ty = C.getSVal(Arg).getType(C.getASTContext());
   reportBug(Ty.getAsString(), C);
 }
 
 void ExprInspectionChecker::analyzerDump(const CallExpr *CE,
                                          CheckerContext &C) const {
   const Expr *Arg = getArgExpr(CE, C);
   if (!Arg)
     return;
 
   SVal V = C.getSVal(Arg);
-
-  llvm::SmallString<32> Str;
-  llvm::raw_svector_ostream OS(Str);
-  V.dumpToStream(OS);
-  reportBug(OS.str(), C);
+  printAndReport(C, V);
 }
 
 void ExprInspectionChecker::analyzerGetExtent(const CallExpr *CE,
                                               CheckerContext &C) const {
   const MemRegion *MR = getArgRegion(CE, C);
   if (!MR)
     return;
 
   ProgramStateRef State = C.getState();
   DefinedOrUnknownSVal Size = getDynamicExtent(State, MR, C.getSValBuilder());
 
   State = State->BindExpr(CE, C.getLocationContext(), Size);
   C.addTransition(State);
 }
 
 void ExprInspectionChecker::analyzerDumpExtent(const CallExpr *CE,
                                                CheckerContext &C) const {
   const MemRegion *MR = getArgRegion(CE, C);
   if (!MR)
     return;
 
   DefinedOrUnknownSVal Size =
       getDynamicExtent(C.getState(), MR, C.getSValBuilder());
-
-  SmallString<64> Msg;
-  llvm::raw_svector_ostream Out(Msg);
-  Out << Size;
-  reportBug(Out.str(), C);
+  printAndReport(C, Size);
 }
 
 void ExprInspectionChecker::analyzerDumpElementCount(const CallExpr *CE,
                                                      CheckerContext &C) const {
   const MemRegion *MR = getArgRegion(CE, C);
   if (!MR)
     return;
 
   QualType ElementTy;
   if (const auto *TVR = MR->getAs<TypedValueRegion>()) {
     ElementTy = TVR->getValueType();
   } else {
     ElementTy =
         MR->castAs<SymbolicRegion>()->getSymbol()->getType()->getPointeeType();
   }
 
   assert(!ElementTy->isPointerType());
 
   DefinedOrUnknownSVal ElementCount =
       getDynamicElementCount(C.getState(), MR, C.getSValBuilder(), ElementTy);
-
-  SmallString<128> Msg;
-  llvm::raw_svector_ostream Out(Msg);
-  Out << ElementCount;
-  reportBug(Out.str(), C);
+  printAndReport(C, ElementCount);
 }
 
 void ExprInspectionChecker::analyzerPrintState(const CallExpr *CE,
                                                CheckerContext &C) const {
   C.getState()->dump();
 }
 
 void ExprInspectionChecker::analyzerWarnOnDeadSymbol(const CallExpr *CE,

clang/lib/StaticAnalyzer/Core/RangeConstraintManager.cpp

public:
   const llvm::APSInt *getSymVal(ProgramStateRef State,
                                 SymbolRef Sym) const override;
 
   ProgramStateRef removeDeadBindings(ProgramStateRef State,
                                      SymbolReaper &SymReaper) override;
 
   void printJson(raw_ostream &Out, ProgramStateRef State, const char *NL = "\n",
                  unsigned int Space = 0, bool IsDot = false) const override;
+  void printRange(raw_ostream &Out, ProgramStateRef State,
+                  SymbolRef Sym) override;
   void printConstraints(raw_ostream &Out, ProgramStateRef State,
                         const char *NL = "\n", unsigned int Space = 0,
                         bool IsDot = false) const;
   void printEquivalenceClasses(raw_ostream &Out, ProgramStateRef State,
                                const char *NL = "\n", unsigned int Space = 0,
                                bool IsDot = false) const;
   void printDisequalities(raw_ostream &Out, ProgramStateRef State,
                           const char *NL = "\n", unsigned int Space = 0,

 void RangeConstraintManager::printJson(raw_ostream &Out, ProgramStateRef State,
                                        const char *NL, unsigned int Space,
                                        bool IsDot) const {
   printConstraints(Out, State, NL, Space, IsDot);
   printEquivalenceClasses(Out, State, NL, Space, IsDot);
   printDisequalities(Out, State, NL, Space, IsDot);
 }
 
+void RangeConstraintManager::printRange(raw_ostream &Out, ProgramStateRef State,
+                                        SymbolRef Sym) {
+  const RangeSet RS = getRange(State, Sym);
+  Out << RS.getBitWidth() << (RS.isUnsigned() ? "u:" : "s:");
+  RS.dump(Out);
+}
+
 static std::string toString(const SymbolRef &Sym) {
   std::string S;
   llvm::raw_string_ostream O(S);
   Sym->dumpToStream(O);
   return O.str();
 }
 
 void RangeConstraintManager::printConstraints(raw_ostream &Out,

clang/lib/StaticAnalyzer/Core/SVals.cpp

 SymbolRef SVal::getAsSymbol(bool IncludeBaseRegions) const {
   // FIXME: should we consider SymbolRef wrapped in CodeTextRegion?
   if (Optional<nonloc::SymbolVal> X = getAs<nonloc::SymbolVal>())
     return X->getSymbol();
 
   return getAsLocSymbol(IncludeBaseRegions);
 }
 
+const llvm::APSInt *SVal::getAsInteger() const {
+  if (auto CI = getAs<nonloc::ConcreteInt>())
+    return &CI->getValue();
+  if (auto CI = getAs<loc::ConcreteInt>())
+    return &CI->getValue();
+  return nullptr;
+}
+
 const MemRegion *SVal::getAsRegion() const {
   if (Optional<loc::MemRegionVal> X = getAs<loc::MemRegionVal>())
     return X->getRegion();
 
   if (Optional<nonloc::LocAsInteger> X = getAs<nonloc::LocAsInteger>())
     return X->getLoc().getAsRegion();
 
   return nullptr;

clang/test/Analysis/print-ranges.cpp

+// RUN: %clang_analyze_cc1 -analyzer-checker=core,debug.ExprInspection -analyzer-config eagerly-assume=false -verify %s
+// REQUIRES: no-z3
+
+template <typename T>
+void clang_analyzer_value(T x);
+void clang_analyzer_value();
+template <typename T1, typename T2>
+void clang_analyzer_value(T1 x, T2 y);
+
+void test1(char x) {
+  clang_analyzer_value(x); // expected-warning{{8s:{ [-128, 127] }}}
+  if (x > 42)
+    clang_analyzer_value(x); // expected-warning{{8s:{ [43, 127] }}}
+  if (x == 42)
+    clang_analyzer_value(x); // expected-warning{{8s:42}}
+}
+
+void test2(short x) {
+  clang_analyzer_value(x); // expected-warning{{16s:{ [-32768, 32767] }}}
+  if (x < 4200)
+    clang_analyzer_value(x); // expected-warning{{16s:{ [-32768, 4199] }}}
+  if (x == 4200)
+    clang_analyzer_value(x); // expected-warning{{16s:4200}}
+}
+
+void test3(unsigned long long x) {
+  clang_analyzer_value(x); // expected-warning{{64u:{ [0, 18446744073709551615] }}}
+  if (x != 42000000)
+    clang_analyzer_value(x); // expected-warning{{64u:{ [0, 41999999], [42000001, 18446744073709551615] }}}
+  if (x == 18446744073709551615ull)
+    clang_analyzer_value(x); // expected-warning{{64u:18446744073709551615}}
+}
+
+struct S {};
+void test4(S s) {
+  clang_analyzer_value(s); // expected-warning{{n/a}}
+}
+
+void test5() {
+  clang_analyzer_value(); // expected-warning{{Missing argument}}
+}
+
+void test6(int x, int y) {
+  if (x == 42 && y == 24)
+    // Ignore 'y'.
+    clang_analyzer_value(x, y); // expected-warning{{32s:42}}
+}