[clang][dataflow] Only model struct fields that are used in the function being analyzed.

[ymandel]

Summary

Previously, the model for structs modeled all fields in a struct when
createValue was called for that type. This patch adds a prepass on the
function under analysis to discover the fields referenced in the scope and then
limits modeling to only those fields. This reduces wasted memory usage
(modeling unused fields) which can be important for programss that use large
structs.

Note: This patch obviates the need for https://reviews.llvm.org/D123032.

[gribozavr2]

clang/include/clang/Analysis/FlowSensitive/DataflowAnalysisContext.h

147–148

380

clang/include/clang/Analysis/FlowSensitive/DataflowEnvironment.h

455

clang/unittests/Analysis/FlowSensitive/DataflowEnvironmentTest.cpp

61

clang/unittests/Analysis/FlowSensitive/TestingSupport.h

167

It is not clear what "optional" means for a boolean.

[ymandel]

address comments; fix lifetime bug in new code.

[ymandel]

Gabor -- do you want to review before I land this patch (Dmitri already accepted it)? thx

[xazax.hun]

This is a big improvement, I skimmed through it and looks good to me. There might be some sneaky ways to change values of fields without mentioning them, e.g., casting a pointer to a struct to an array of chars. But I think reasoning about those scenarios is probably not something we want to model anytime soon.

Another pesky scenario when we are not doing context sensitive analysis:

int* pointsToField = getField(myObj);

But this can be handled correctly in a conservative way buy treating `myObj' as escaped. Overall, I dont anticipate any blockers at the moment.

[xazax.hun]

I realized I did not say this explicitly in my previous comment, but feel free to commit :)

clang/include/clang/Analysis/FlowSensitive/DataflowAnalysisContext.h

263

Is there any scenario where check authors might invoke this function? If no, I wonder if it would be better to make this private and make Environment a friend of this class. Keeping the number of public methods minimal could be a great service to future check authors.

[ymandel]

rebase onto HEAD

[ymandel]

address comments

[ymandel]

In D140694#4026244, @xazax.hun wrote:

This is a big improvement, I skimmed through it and looks good to me. There might be some sneaky ways to change values of fields without mentioning them, e.g., casting a pointer to a struct to an array of chars. But I think reasoning about those scenarios is probably not something we want to model anytime soon.

Thanks!

Another pesky scenario when we are not doing context sensitive analysis:

int* pointsToField = getField(myObj);

But this can be handled correctly in a conservative way buy treating `myObj' as escaped. Overall, I dont anticipate any blockers at the moment.

Agreed. I think any other field access either falls into 1) we don't handle it soundly anyhow or 2) a conservative analysis will rule it out.

clang/include/clang/Analysis/FlowSensitive/DataflowAnalysisContext.h

263

Good point. Done.

[ymandel]

fix typo

[ymandel]

fix broken test (from rebase)

[thakis]

This breaks tests on Mac: http://45.33.8.238/macm1/52112/step_7.txt

Please take a look and revert for now if it takes a while to fix.

[paulkirth]

We're seeing a similar breakage on Linux in Fuchsia's Clang CI: https://ci.chromium.org/ui/p/fuchsia/builders/toolchain.ci/clang-linux-x64/b8792772367021497153/overview

[ymandel]

I'll revert now and take a look in the morning...

[ymandel]

fix use-after-free bug in test. Possible cause of buildbot failures.

[xazax.hun]

I think in these cases you can recommit without waiting for a new round of reviews, but I hit accept just in case :)

[ymandel]

fix memory error that cause buildbot failures

Fixes a self-move assign. This operation should be safe, but is known to cause
problems in some implementations of the standard library. The patch drops the
assignment, which was unnecessary since the object is modified in place.

[ymandel]

Committed: https://reviews.llvm.org/rG01ccf7b3cee58dbe02fd97696cae1781746b6137

clang/include/clang/Analysis/FlowSensitive/DataflowAnalysisContext.h

 
 /// Returns the set of all fields in the type.
 llvm::DenseSet<const FieldDecl *> getObjectFields(QualType Type);
 
 /// Owns objects that encompass the state of a program and stores context that
 /// is used during dataflow analysis.
 class DataflowAnalysisContext {
 public:
+  // FIXME: merge with TransferOptions from Transfer.h.
+  struct Options {
+    bool EnableContextSensitiveAnalysis;
+  };
+
   /// Constructs a dataflow analysis context.
   ///
   /// Requirements:
   ///
   ///  `S` must not be null.
-  DataflowAnalysisContext(std::unique_ptr<Solver> S)
+  DataflowAnalysisContext(std::unique_ptr<Solver> S,
+                          Options Opts = {
+                              /*EnableContextSensitiveAnalysis=*/false})
       : S(std::move(S)), TrueVal(createAtomicBoolValue()),
-        FalseVal(createAtomicBoolValue()) {
+        FalseVal(createAtomicBoolValue()), Options(Opts) {
     assert(this->S != nullptr);
   }
 
   /// Takes ownership of `Loc` and returns a reference to it.
   ///
   /// Requirements:
   ///
   ///  `Loc` must not be null.
public:
 
   /// Returns the storage location assigned to `E` or null if `E` has no
   /// assigned storage location.
   StorageLocation *getStorageLocation(const Expr &E) const {
     auto It = ExprToLoc.find(&ignoreCFGOmittedNodes(E));
     return It == ExprToLoc.end() ? nullptr : It->second;
   }
 
   /// Returns a pointer value that represents a null pointer. Calls with
   /// `PointeeType` that are canonically equivalent will return the same result.
   /// A null `PointeeType` can be used for the pointee of `std::nullptr_t`.
   PointerValue &getOrCreateNullPointerValue(QualType PointeeType);
 
   /// Returns a symbolic boolean value that models a boolean literal equal to
   /// `Value`.
   AtomicBoolValue &getBoolLiteralValue(bool Value) const {
     return Value ? TrueVal : FalseVal;
   }
public:
   bool equivalentBoolValues(BoolValue &Val1, BoolValue &Val2);
 
   LLVM_DUMP_METHOD void dumpFlowCondition(AtomicBoolValue &Token);
 
   /// Returns the `ControlFlowContext` registered for `F`, if any. Otherwise,
   /// returns null.
   const ControlFlowContext *getControlFlowContext(const FunctionDecl *F);
 
+  void addFieldsReferencedInScope(llvm::DenseSet<const FieldDecl *> Fields);
+
 private:
+  friend class Environment;
+
   struct NullableQualTypeDenseMapInfo : private llvm::DenseMapInfo<QualType> {
     static QualType getEmptyKey() {
       // Allow a NULL `QualType` by using a different value as the empty key.
       return QualType::getFromOpaquePtr(reinterpret_cast<Type *>(1));
     }
 
     using DenseMapInfo::getHashValue;
     using DenseMapInfo::getTombstoneKey;
     using DenseMapInfo::isEqual;
   };
 
+  /// Returns the subset of fields of `Type` that are referenced in the scope of
+  /// the analysis.
+  llvm::DenseSet<const FieldDecl *> getReferencedFields(QualType Type);
+
   /// Adds all constraints of the flow condition identified by `Token` and all
   /// of its transitive dependencies to `Constraints`. `VisitedTokens` is used
   /// to track tokens of flow conditions that were already visited by recursive
   /// calls.
   void addTransitiveFlowConditionConstraints(
       AtomicBoolValue &Token, llvm::DenseSet<BoolValue *> &Constraints,
       llvm::DenseSet<AtomicBoolValue *> &VisitedTokens);
 
private:
   // creating a type-independent `NullPointerValue` without a `PointeeLoc`
   // field.
   llvm::DenseMap<QualType, PointerValue *, NullableQualTypeDenseMapInfo>
       NullPointerVals;
 
   AtomicBoolValue &TrueVal;
   AtomicBoolValue &FalseVal;
 
+  Options Options;
+
   // Indices that are used to avoid recreating the same composite boolean
   // values.
   llvm::DenseMap<std::pair<BoolValue *, BoolValue *>, ConjunctionValue *>
       ConjunctionVals;
   llvm::DenseMap<std::pair<BoolValue *, BoolValue *>, DisjunctionValue *>
       DisjunctionVals;
   llvm::DenseMap<BoolValue *, NegationValue *> NegationVals;
   llvm::DenseMap<std::pair<BoolValue *, BoolValue *>, ImplicationValue *>
private:
   // Flow conditions depend on other flow conditions if they are created using
   // `forkFlowCondition` or `joinFlowConditions`. The graph of flow condition
   // dependencies is stored in the `FlowConditionDeps` map.
   llvm::DenseMap<AtomicBoolValue *, llvm::DenseSet<AtomicBoolValue *>>
       FlowConditionDeps;
   llvm::DenseMap<AtomicBoolValue *, BoolValue *> FlowConditionConstraints;
 
   llvm::DenseMap<const FunctionDecl *, ControlFlowContext> FunctionContexts;
+
+  // All fields referenced (statically) in the scope of the analysis.
+  llvm::DenseSet<const FieldDecl *> FieldsReferencedInScope;
 };
 
 } // namespace dataflow
 } // namespace clang
 
 #endif // LLVM_CLANG_ANALYSIS_FLOWSENSITIVE_DATAFLOWANALYSISCONTEXT_H

clang/include/clang/Analysis/FlowSensitive/DataflowEnvironment.h

private:
   const StorageLocation &skip(const StorageLocation &Loc, SkipPast SP) const;
 
   /// Shared implementation of `pushCall` overloads. Note that unlike
   /// `pushCall`, this member is invoked on the environment of the callee, not
   /// of the caller.
   void pushCallInternal(const FunctionDecl *FuncDecl,
                         ArrayRef<const Expr *> Args);
 
+  /// Assigns storage locations and values to all variables in `Vars`.
+  void initVars(llvm::DenseSet<const VarDecl *> Vars);
+
   // `DACtx` is not null and not owned by this object.
   DataflowAnalysisContext *DACtx;
 
 
   // FIXME: move the fields `CallStack`, `ReturnLoc` and `ThisPointeeLoc` into a
   // separate call-context object, shared between environments in the same call.
   // https://github.com/llvm/llvm-project/issues/59005
 

clang/lib/Analysis/FlowSensitive/DataflowAnalysisContext.cpp

 //  dataflow analysis.
 //
 //===----------------------------------------------------------------------===//
 
 #include "clang/Analysis/FlowSensitive/DataflowAnalysisContext.h"
 #include "clang/AST/ExprCXX.h"
 #include "clang/Analysis/FlowSensitive/DebugSupport.h"
 #include "clang/Analysis/FlowSensitive/Value.h"
+#include "llvm/ADT/SetOperations.h"
 #include "llvm/Support/Debug.h"
 #include <cassert>
 #include <memory>
 #include <utility>
 
 namespace clang {
 namespace dataflow {
 
+void DataflowAnalysisContext::addFieldsReferencedInScope(
+    llvm::DenseSet<const FieldDecl *> Fields) {
+  llvm::set_union(FieldsReferencedInScope, Fields);
+}
+
+llvm::DenseSet<const FieldDecl *>
+DataflowAnalysisContext::getReferencedFields(QualType Type) {
+  llvm::DenseSet<const FieldDecl *> Fields = getObjectFields(Type);
+  llvm::set_intersect(Fields, FieldsReferencedInScope);
+  return Fields;
+}
+
 StorageLocation &DataflowAnalysisContext::createStorageLocation(QualType Type) {
   if (!Type.isNull() &&
       (Type->isStructureOrClassType() || Type->isUnionType())) {
-    // FIXME: Explore options to avoid eager initialization of fields as some of
-    // them might not be needed for a particular analysis.
     llvm::DenseMap<const ValueDecl *, StorageLocation *> FieldLocs;
-    for (const FieldDecl *Field : getObjectFields(Type))
+    // During context-sensitive analysis, a struct may be allocated in one
+    // function, but its field accessed in a function lower in the stack than
+    // the allocation. Since we only collect fields used in the function where
+    // the allocation occurs, we can't apply that filter when performing
+    // context-sensitive analysis. But, this only applies to storage locations,
+    // since fields access it not allowed to fail. In contrast, field *values*
+    // don't need this allowance, since the API allows for uninitialized fields.
+    auto Fields = Options.EnableContextSensitiveAnalysis
+                      ? getObjectFields(Type)
+                      : getReferencedFields(Type);
+    for (const FieldDecl *Field : Fields)
       FieldLocs.insert({Field, &createStorageLocation(Field->getType())});
     return takeOwnership(
         std::make_unique<AggregateStorageLocation>(Type, std::move(FieldLocs)));
   }
   return takeOwnership(std::make_unique<ScalarStorageLocation>(Type));
 }
 
 StorageLocation &

clang/lib/Analysis/FlowSensitive/DataflowEnvironment.cpp

static Value &widenDistinctValues(QualType Type, Value &Prev,
   if (auto *W = Model.widen(Type, Prev, PrevEnv, Current, CurrentEnv))
     return *W;
 
   // Default of widening is a no-op: leave the current value unchanged.
   return Current;
 }
 
 /// Initializes a global storage value.
-static void initGlobalVar(const VarDecl &D, Environment &Env) {
-  if (!D.hasGlobalStorage() ||
-      Env.getStorageLocation(D, SkipPast::None) != nullptr)
-    return;
-
-  auto &Loc = Env.createStorageLocation(D);
-  Env.setStorageLocation(D, Loc);
-  if (auto *Val = Env.createValue(D.getType()))
-    Env.setValue(Loc, *Val);
-}
-
-/// Initializes a global storage value.
-static void initGlobalVar(const Decl &D, Environment &Env) {
+static void insertIfGlobal(const Decl &D,
+                           llvm::DenseSet<const FieldDecl *> &Fields,
+                           llvm::DenseSet<const VarDecl *> &Vars) {
   if (auto *V = dyn_cast<VarDecl>(&D))
-    initGlobalVar(*V, Env);
+    if (V->hasGlobalStorage())
+      Vars.insert(V);
 }
 
-/// Initializes global storage values that are declared or referenced from
-/// sub-statements of `S`.
-// FIXME: Add support for resetting globals after function calls to enable
-// the implementation of sound analyses.
-static void initGlobalVars(const Stmt &S, Environment &Env) {
-  for (auto *Child : S.children()) {
+static void getFieldsAndGlobalVars(const Decl &D,
+                                   llvm::DenseSet<const FieldDecl *> &Fields,
+                                   llvm::DenseSet<const VarDecl *> &Vars) {
+  insertIfGlobal(D, Fields, Vars);
+  if (const auto *Decomp = dyn_cast<DecompositionDecl>(&D))
+    for (const auto *B : Decomp->bindings())
+      if (auto *ME = dyn_cast_or_null<MemberExpr>(B->getBinding()))
+        // FIXME: should we be using `E->getFoundDecl()`?
+        if (const auto *FD = dyn_cast<FieldDecl>(ME->getMemberDecl()))
+          Fields.insert(FD);
+}
+
+/// Traverses `S` and inserts into `Vars` any global storage values that are
+/// declared in or referenced from sub-statements.
+static void getFieldsAndGlobalVars(const Stmt &S,
+                                   llvm::DenseSet<const FieldDecl *> &Fields,
+                                   llvm::DenseSet<const VarDecl *> &Vars) {
+  for (auto *Child : S.children())
     if (Child != nullptr)
-      initGlobalVars(*Child, Env);
-  }
+      getFieldsAndGlobalVars(*Child, Fields, Vars);
 
   if (auto *DS = dyn_cast<DeclStmt>(&S)) {
-    if (DS->isSingleDecl()) {
-      initGlobalVar(*DS->getSingleDecl(), Env);
-    } else {
+    if (DS->isSingleDecl())
+      getFieldsAndGlobalVars(*DS->getSingleDecl(), Fields, Vars);
+    else
       for (auto *D : DS->getDeclGroup())
-        initGlobalVar(*D, Env);
-    }
+          getFieldsAndGlobalVars(*D, Fields, Vars);
   } else if (auto *E = dyn_cast<DeclRefExpr>(&S)) {
-    initGlobalVar(*E->getDecl(), Env);
+    insertIfGlobal(*E->getDecl(), Fields, Vars);
   } else if (auto *E = dyn_cast<MemberExpr>(&S)) {
-    initGlobalVar(*E->getMemberDecl(), Env);
+    // FIXME: should we be using `E->getFoundDecl()`?
+    const ValueDecl *VD = E->getMemberDecl();
+    insertIfGlobal(*VD, Fields, Vars);
+    if (const auto *FD = dyn_cast<FieldDecl>(VD))
+      Fields.insert(FD);
+  }
+}
+
+// FIXME: Add support for resetting globals after function calls to enable
+// the implementation of sound analyses.
+void Environment::initVars(llvm::DenseSet<const VarDecl *> Vars) {
+  for (const VarDecl *D : Vars) {
+    if (getStorageLocation(*D, SkipPast::None) != nullptr)
+      continue;
+    auto &Loc = createStorageLocation(*D);
+    setStorageLocation(*D, Loc);
+    if (auto *Val = createValue(D->getType()))
+      setValue(Loc, *Val);
   }
 }
 
 Environment::Environment(DataflowAnalysisContext &DACtx)
     : DACtx(&DACtx), FlowConditionToken(&DACtx.makeFlowConditionToken()) {}
 
 Environment::Environment(const Environment &Other)
     : DACtx(Other.DACtx), CallStack(Other.CallStack),

 
 Environment::Environment(DataflowAnalysisContext &DACtx,
                          const DeclContext &DeclCtx)
     : Environment(DACtx) {
   CallStack.push_back(&DeclCtx);
 
   if (const auto *FuncDecl = dyn_cast<FunctionDecl>(&DeclCtx)) {
     assert(FuncDecl->getBody() != nullptr);
-    initGlobalVars(*FuncDecl->getBody(), *this);
+
+    llvm::DenseSet<const FieldDecl *> Fields;
+    llvm::DenseSet<const VarDecl *> Vars;
+
+    // Look for global variable references in the constructor-initializers.
+    if (const auto *CtorDecl = dyn_cast<CXXConstructorDecl>(&DeclCtx)) {
+      for (const auto *Init : CtorDecl->inits()) {
+        if (const auto *M = Init->getAnyMember())
+          Fields.insert(M);
+        const Expr *E = Init->getInit();
+        assert(E != nullptr);
+        getFieldsAndGlobalVars(*E, Fields, Vars);
+      }
+    }
+    getFieldsAndGlobalVars(*FuncDecl->getBody(), Fields, Vars);
+
+    initVars(Vars);
+    // These have to be set before the lines that follow to ensure that create*
+    // work correctly for structs.
+    DACtx.addFieldsReferencedInScope(std::move(Fields));
+
     for (const auto *ParamDecl : FuncDecl->parameters()) {
       assert(ParamDecl != nullptr);
       auto &ParamLoc = createStorageLocation(*ParamDecl);
       setStorageLocation(*ParamDecl, ParamLoc);
       if (Value *ParamVal = createValue(ParamDecl->getType()))
         setValue(ParamLoc, *ParamVal);
     }
 
if (const auto *MethodDecl = dyn_cast<CXXMethodDecl>(&DeclCtx)) {
     // FIXME: Initialize the ThisPointeeLoc of lambdas too.
     if (MethodDecl && !MethodDecl->isStatic()) {
       QualType ThisPointeeType = MethodDecl->getThisObjectType();
       ThisPointeeLoc = &createStorageLocation(ThisPointeeType);
       if (Value *ThisPointeeVal = createValue(ThisPointeeType))
         setValue(*ThisPointeeLoc, *ThisPointeeVal);
     }
   }
-
-  // Look for global variable references in the constructor-initializers.
-  if (const auto *CtorDecl = dyn_cast<CXXConstructorDecl>(&DeclCtx)) {
-    for (const auto *Init : CtorDecl->inits()) {
-      const Expr *E = Init->getInit();
-      assert(E != nullptr);
-      initGlobalVars(*E, *this);
-    }
-  }
 }
 
 bool Environment::canDescend(unsigned MaxDepth,
                              const DeclContext *Callee) const {
   return CallStack.size() <= MaxDepth && !llvm::is_contained(CallStack, Callee);
 }
 
 Environment Environment::pushCall(const CallExpr *Call) const {
Environment Environment::pushCall(const CXXConstructExpr *Call) const {
 
   return Env;
 }
 
 void Environment::pushCallInternal(const FunctionDecl *FuncDecl,
                                    ArrayRef<const Expr *> Args) {
   CallStack.push_back(FuncDecl);
 
-  // FIXME: In order to allow the callee to reference globals, we probably need
-  // to call `initGlobalVars` here in some way.
+  // FIXME: Share this code with the constructor, rather than duplicating it.
+  llvm::DenseSet<const FieldDecl *> Fields;
+  llvm::DenseSet<const VarDecl *> Vars;
+  // Look for global variable references in the constructor-initializers.
+  if (const auto *CtorDecl = dyn_cast<CXXConstructorDecl>(FuncDecl)) {
+    for (const auto *Init : CtorDecl->inits()) {
+      if (const auto *M = Init->getAnyMember())
+        Fields.insert(M);
+      const Expr *E = Init->getInit();
+      assert(E != nullptr);
+      getFieldsAndGlobalVars(*E, Fields, Vars);
+    }
+  }
+  getFieldsAndGlobalVars(*FuncDecl->getBody(), Fields, Vars);
+  initVars(Vars);
+  DACtx->addFieldsReferencedInScope(std::move(Fields));
 
-  auto ParamIt = FuncDecl->param_begin();
+  const auto *ParamIt = FuncDecl->param_begin();
 
   // FIXME: Parameters don't always map to arguments 1:1; examples include
   // overloaded operators implemented as member functions, and parameter packs.
   for (unsigned ArgIndex = 0; ArgIndex < Args.size(); ++ParamIt, ++ArgIndex) {
     assert(ParamIt != FuncDecl->param_end());
 
     const Expr *Arg = Args[ArgIndex];
     auto *ArgLoc = getStorageLocation(*Arg, SkipPast::Reference);
void Environment::setValue(const StorageLocation &Loc, Value &Val) {
   LocToVal[&Loc] = &Val;
 
   if (auto *StructVal = dyn_cast<StructValue>(&Val)) {
     auto &AggregateLoc = *cast<AggregateStorageLocation>(&Loc);
 
     const QualType Type = AggregateLoc.getType();
     assert(Type->isStructureOrClassType() || Type->isUnionType());
 
-    for (const FieldDecl *Field : getObjectFields(Type)) {
+    for (const FieldDecl *Field : DACtx->getReferencedFields(Type)) {
       assert(Field != nullptr);
       StorageLocation &FieldLoc = AggregateLoc.getChild(*Field);
       MemberLocToStruct[&FieldLoc] = std::make_pair(StructVal, Field);
       if (auto *FieldVal = StructVal->getChild(*Field))
         setValue(FieldLoc, *FieldVal);
     }
   }
 
if (Visited.insert(PointeeType.getCanonicalType()).second) {
         setValue(PointeeLoc, *PointeeVal);
     }
 
     return &takeOwnership(std::make_unique<PointerValue>(PointeeLoc));
   }
 
   if (Type->isStructureOrClassType() || Type->isUnionType()) {
     CreatedValuesCount++;
-    // FIXME: Initialize only fields that are accessed in the context that is
-    // being analyzed.
     llvm::DenseMap<const ValueDecl *, Value *> FieldValues;
-    for (const FieldDecl *Field : getObjectFields(Type)) {
+    for (const FieldDecl *Field : DACtx->getReferencedFields(Type)) {
       assert(Field != nullptr);
 
       QualType FieldType = Field->getType();
       if (Visited.contains(FieldType.getCanonicalType()))
         continue;
 
       Visited.insert(FieldType.getCanonicalType());
       if (auto *FieldValue = createValueUnlessSelfReferential(

clang/lib/Analysis/FlowSensitive/Transfer.cpp

if (const auto *Decomp = dyn_cast<DecompositionDecl>(&D)) {
           VisitDeclRefExpr(DE);
           VisitMemberExpr(ME);
 
           if (auto *Loc = Env.getStorageLocation(*ME, SkipPast::Reference))
             Env.setStorageLocation(*B, *Loc);
         } else if (auto *VD = B->getHoldingVar()) {
           // Holding vars are used to back the BindingDecls of tuple-like
           // types. The holding var declarations appear *after* this statement,
-          // so we have to create a location or them here to share with `B`. We
+          // so we have to create a location for them here to share with `B`. We
           // don't visit the binding, because we know it will be a DeclRefExpr
           // to `VD`.
           auto &VDLoc = Env.createStorageLocation(*VD);
           Env.setStorageLocation(*VD, VDLoc);
           Env.setStorageLocation(*B, VDLoc);
         }
       }
     }

clang/unittests/Analysis/FlowSensitive/DataflowEnvironmentTest.cpp

 TEST_F(EnvironmentTest, CreateValueRecursiveType) {
   using namespace ast_matchers;
 
   std::string Code = R"cc(
     struct Recursive {
       bool X;
       Recursive *R;
     };
+    // Use both fields to force them to be created with `createValue`.
+    void Usage(Recursive R) { (void)R.X; (void)R.R; }
   )cc";
 
   auto Unit =
       tooling::buildASTFromCodeWithArgs(Code, {"-fsyntax-only", "-std=c++11"});
   auto &Context = Unit->getASTContext();
 
   ASSERT_EQ(Context.getDiagnostics().getClient()->getNumErrors(), 0U);
 
   auto Results =
       match(qualType(hasDeclaration(recordDecl(
                          hasName("Recursive"),
                          has(fieldDecl(hasName("R")).bind("field-r")))))
                 .bind("target"),
             Context);
-  const QualType *Ty = selectFirst<QualType>("target", Results);
+  const QualType *TyPtr = selectFirst<QualType>("target", Results);
+  ASSERT_THAT(TyPtr, NotNull());
+  QualType Ty = *TyPtr;
+  ASSERT_FALSE(Ty.isNull());
+
   const FieldDecl *R = selectFirst<FieldDecl>("field-r", Results);
-  ASSERT_TRUE(Ty != nullptr && !Ty->isNull());
-  ASSERT_TRUE(R != nullptr);
+  ASSERT_THAT(R, NotNull());
+
+  Results = match(functionDecl(hasName("Usage")).bind("fun"), Context);
+  const auto *Fun = selectFirst<FunctionDecl>("fun", Results);
+  ASSERT_THAT(Fun, NotNull());
 
   // Verify that the struct and the field (`R`) with first appearance of the
   // type is created successfully.
-  Environment Env(DAContext);
-  Value *Val = Env.createValue(*Ty);
+  Environment Env(DAContext, *Fun);
+  Value *Val = Env.createValue(Ty);
   ASSERT_NE(Val, nullptr);
   StructValue *SVal = clang::dyn_cast<StructValue>(Val);
   ASSERT_NE(SVal, nullptr);
   Val = SVal->getChild(*R);
   ASSERT_NE(Val, nullptr);
   PointerValue *PV = clang::dyn_cast<PointerValue>(Val);
   EXPECT_NE(PV, nullptr);
 }

clang/unittests/Analysis/FlowSensitive/TestingSupport.h

AnalysisInputs<AnalysisT> &&withASTBuildArgs(ArrayRef<std::string> Arg) && {
     ASTBuildArgs = std::move(Arg);
     return std::move(*this);
   }
   AnalysisInputs<AnalysisT> &&
   withASTBuildVirtualMappedFiles(tooling::FileContentMappings Arg) && {
     ASTBuildVirtualMappedFiles = std::move(Arg);
     return std::move(*this);
   }
+  AnalysisInputs<AnalysisT> &&
+  withContextSensitivity() && {
+    EnableContextSensitivity = true;
+    return std::move(*this);
+  }
 
   /// Required. Input code that is analyzed.
   llvm::StringRef Code;
   /// Required. The body of the function which matches this matcher is analyzed.
   ast_matchers::internal::Matcher<FunctionDecl> TargetFuncMatcher;
   /// Required. The analysis to be run is constructed with this function that
   /// takes as argument the AST generated from the code being analyzed and the
   /// initial state from which the analysis starts with.
std::function<void(
       ASTContext &, const CFGElement &,
       const TransferStateForDiagnostics<typename AnalysisT::Lattice> &)>
       PostVisitCFG = nullptr;
 
   /// Optional. Options for building the AST context.
   ArrayRef<std::string> ASTBuildArgs = {};
   /// Optional. Options for building the AST context.
   tooling::FileContentMappings ASTBuildVirtualMappedFiles = {};
+  /// Enables context-sensitive analysis when constructing the
+  /// `DataflowAnalysisContext`.
+  bool EnableContextSensitivity = false;
 };
 
 /// Returns assertions based on annotations that are present after statements in
 /// `AnnotatedCode`.
 llvm::Expected<llvm::DenseMap<const Stmt *, std::string>>
 buildStatementToAnnotationMapping(const FunctionDecl *Func,
                                   llvm::Annotations AnnotatedCode);
 
checkDataflow(AnalysisInputs<AnalysisT> AI,
   // Build control flow graph from body of target function.
   auto MaybeCFCtx =
       ControlFlowContext::build(Target, *Target->getBody(), Context);
   if (!MaybeCFCtx)
     return MaybeCFCtx.takeError();
   auto &CFCtx = *MaybeCFCtx;
 
   // Initialize states for running dataflow analysis.
-  DataflowAnalysisContext DACtx(std::make_unique<WatchedLiteralsSolver>());
+  DataflowAnalysisContext DACtx(
+      std::make_unique<WatchedLiteralsSolver>(),
+      {/*EnableContextSensitiveAnalysis=*/AI.EnableContextSensitivity});
   Environment InitEnv(DACtx, *Target);
   auto Analysis = AI.MakeAnalysis(Context, InitEnv);
   std::function<void(const CFGElement &,
                      const TypeErasedDataflowAnalysisState &)>
       PostVisitCFGClosure = nullptr;
   if (AI.PostVisitCFG) {
     PostVisitCFGClosure = [&AI, &Context](
                               const CFGElement &Element,

clang/unittests/Analysis/FlowSensitive/TransferTest.cpp

 #include "clang/AST/Decl.h"
 #include "clang/ASTMatchers/ASTMatchers.h"
 #include "clang/Analysis/FlowSensitive/DataflowEnvironment.h"
 #include "clang/Analysis/FlowSensitive/NoopAnalysis.h"
 #include "clang/Analysis/FlowSensitive/StorageLocation.h"
 #include "clang/Analysis/FlowSensitive/Value.h"
 #include "clang/Basic/LangStandard.h"
 #include "llvm/ADT/ArrayRef.h"
+#include "llvm/ADT/SmallVector.h"
 #include "llvm/ADT/StringRef.h"
 #include "llvm/Support/Casting.h"
 #include "llvm/Testing/Support/Error.h"
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
 #include <string>
 #include <utility>
 
 namespace {
 
 using namespace clang;
 using namespace dataflow;
 using namespace test;
 using ::testing::IsNull;
 using ::testing::NotNull;
 using ::testing::UnorderedElementsAre;
 
 template <typename Matcher>
 void runDataflow(llvm::StringRef Code, Matcher Match,
                  DataflowAnalysisOptions Options,
                  LangStandard::Kind Std = LangStandard::lang_cxx17,
                  llvm::StringRef TargetFun = "target") {
   using ast_matchers::hasName;
-  ASSERT_THAT_ERROR(
-      checkDataflow<NoopAnalysis>(
-          AnalysisInputs<NoopAnalysis>(Code, hasName(TargetFun),
-                                       [Options](ASTContext &C, Environment &) {
-                                         return NoopAnalysis(C, Options);
-                                       })
-              .withASTBuildArgs(
-                  {"-fsyntax-only", "-fno-delayed-template-parsing",
-                   "-std=" +
-                       std::string(LangStandard::getLangStandardForKind(Std)
-                                       .getName())}),
+  llvm::SmallVector<std::string, 3> ASTBuildArgs = {
+      "-fsyntax-only", "-fno-delayed-template-parsing",
+      "-std=" +
+          std::string(LangStandard::getLangStandardForKind(Std).getName())};
+  auto AI =
+                                   [&Options](ASTContext &C, Environment &) {
+          .withASTBuildArgs(ASTBuildArgs);
+  if (Options.BuiltinTransferOpts &&
+      Options.BuiltinTransferOpts->ContextSensitiveOpts)
+    AI = std::move(AI).withContextSensitivity();
+  ASSERT_THAT_ERROR(
+      checkDataflow<NoopAnalysis>(
+          std::move(AI),
           /*VerifyResults=*/
           [&Match](const llvm::StringMap<DataflowAnalysisState<NoopLattice>>
                        &Results,
                    const AnalysisOutputs &AO) { Match(Results, AO.ASTCtx); }),
       llvm::Succeeded());
 }
 
 template <typename Matcher>

 TEST(TransferTest, StructVarDecl) {
   std::string Code = R"(
     struct A {
       int Bar;
     };
 
     void target() {
       A Foo;
+      (void)Foo.Bar;
       // [[p]]
     }
   )";
   runDataflow(
       Code,
       [](const llvm::StringMap<DataflowAnalysisState<NoopLattice>> &Results,
          ASTContext &ASTCtx) {
         ASSERT_THAT(Results.keys(), UnorderedElementsAre("p"));
std::string Code = R"(
     struct A {
       int Bar;
     };
 
     A Gen();
 
     void target() {
       A Foo = Gen();
+      (void)Foo.Bar;
       // [[p]]
     }
   )";
   runDataflow(
       Code,
       [](const llvm::StringMap<DataflowAnalysisState<NoopLattice>> &Results,
          ASTContext &ASTCtx) {
         ASSERT_THAT(Results.keys(), UnorderedElementsAre("p"));
runDataflow(
         const auto *BarVal = cast<IntegerValue>(FooVal->getChild(*BarDecl));
         EXPECT_EQ(Env.getValue(*BarLoc), BarVal);
       });
 }
 
 TEST(TransferTest, ClassVarDecl) {
   std::string Code = R"(
     class A {
+     public:
       int Bar;
     };
 
     void target() {
       A Foo;
+      (void)Foo.Bar;
       // [[p]]
     }
   )";
   runDataflow(
       Code,
       [](const llvm::StringMap<DataflowAnalysisState<NoopLattice>> &Results,
          ASTContext &ASTCtx) {
         ASSERT_THAT(Results.keys(), UnorderedElementsAre("p"));
std::string Code = R"(
     struct A {
       C &Bar;
     };
 
     A &getA();
 
     void target() {
       A &Foo = getA();
+      (void)Foo.Bar.FooRef;
+      (void)Foo.Bar.FooPtr;
+      (void)Foo.Bar.BazRef;
+      (void)Foo.Bar.BazPtr;
       // [[p]]
     }
   )";
   runDataflow(Code, [](const llvm::StringMap<DataflowAnalysisState<NoopLattice>>
                            &Results,
                        ASTContext &ASTCtx) {
     ASSERT_THAT(Results.keys(), UnorderedElementsAre("p"));
     const Environment &Env = getEnvironmentAtAnnotation(Results, "p");
std::string Code = R"(
     struct A {
       C *Bar;
     };
 
     A *getA();
 
     void target() {
       A *Foo = getA();
+      (void)Foo->Bar->FooRef;
+      (void)Foo->Bar->FooPtr;
+      (void)Foo->Bar->BazRef;
+      (void)Foo->Bar->BazPtr;
       // [[p]]
     }
   )";
   runDataflow(
       Code,
       [](const llvm::StringMap<DataflowAnalysisState<NoopLattice>> &Results,
          ASTContext &ASTCtx) {
         ASSERT_THAT(Results.keys(), UnorderedElementsAre("p"));

 
 TEST(TransferTest, StructParamDecl) {
   std::string Code = R"(
     struct A {
       int Bar;
     };
 
     void target(A Foo) {
-      (void)0;
+      (void)Foo.Bar;
       // [[p]]
     }
   )";
   runDataflow(
       Code,
       [](const llvm::StringMap<DataflowAnalysisState<NoopLattice>> &Results,
          ASTContext &ASTCtx) {
         ASSERT_THAT(Results.keys(), UnorderedElementsAre("p"));
std::string Code = R"(
     class A {
       int ADefault;
     protected:
       int AProtected;
     private:
       int APrivate;
     public:
       int APublic;
+
+    private:
+      friend void target();
     };
 
     class B : public A {
       int BDefault;
     protected:
       int BProtected;
     private:
       int BPrivate;
+
+    private:
+      friend void target();
     };
 
     void target() {
       B Foo;
+      (void)Foo.ADefault;
+      (void)Foo.AProtected;
+      (void)Foo.APrivate;
+      (void)Foo.APublic;
+      (void)Foo.BDefault;
+      (void)Foo.BProtected;
+      (void)Foo.BPrivate;
       // [[p]]
     }
   )";
   runDataflow(
       Code,
       [](const llvm::StringMap<DataflowAnalysisState<NoopLattice>> &Results,
          ASTContext &ASTCtx) {
         ASSERT_THAT(Results.keys(), UnorderedElementsAre("p"));
std::string Code = R"(
     struct A {
       int Bar;
     };
     struct B : public A {
     };
 
     void target() {
       B Foo;
+      (void)Foo.Bar;
       // [[p]]
     }
   )";
   runDataflow(Code, derivedBaseMemberExpectations);
 }
 
 TEST(TransferTest, DerivedBaseMemberPrivateFriend) {
   // Include an access to `Foo.Bar` to verify the analysis doesn't crash on that

 
 TEST(TransferTest, UnionThisMember) {
   std::string Code = R"(
     union A {
       int Foo;
       int Bar;
 
       void target() {
-        (void)0; // [[p]]
+        A a;
+        // Mention the fields to ensure they're included in the analysis.
+        (void)a.Foo;
+        (void)a.Bar;
+        // [[p]]
       }
     };
   )";
   runDataflow(
       Code,
       [](const llvm::StringMap<DataflowAnalysisState<NoopLattice>> &Results,
          ASTContext &ASTCtx) {
         ASSERT_THAT(Results.keys(), UnorderedElementsAre("p"));

 TEST(TransferTest, TemporaryObject) {
   std::string Code = R"(
     struct A {
       int Bar;
     };
 
     void target() {
       A Foo = A();
+      (void)Foo.Bar;
       // [[p]]
     }
   )";
   runDataflow(
       Code,
       [](const llvm::StringMap<DataflowAnalysisState<NoopLattice>> &Results,
          ASTContext &ASTCtx) {
         ASSERT_THAT(Results.keys(), UnorderedElementsAre("p"));
TEST(TransferTest, ElidableConstructor) {
   // the code is compiled as C++ 14.
   std::string Code = R"(
     struct A {
       int Bar;
     };
 
     void target() {
       A Foo = A();
+      (void)Foo.Bar;
       // [[p]]
     }
   )";
   runDataflow(
       Code,
       [](const llvm::StringMap<DataflowAnalysisState<NoopLattice>> &Results,
          ASTContext &ASTCtx) {
         ASSERT_THAT(Results.keys(), UnorderedElementsAre("p"));
TEST(TransferTest, AssignmentOperator) {
   std::string Code = R"(
     struct A {
       int Baz;
     };
 
     void target() {
       A Foo;
       A Bar;
+      (void)Foo.Baz;
       // [[p1]]
       Foo = Bar;
       // [[p2]]
     }
   )";
   runDataflow(
       Code,
       [](const llvm::StringMap<DataflowAnalysisState<NoopLattice>> &Results,

 TEST(TransferTest, CopyConstructor) {
   std::string Code = R"(
     struct A {
       int Baz;
     };
 
     void target() {
       A Foo;
+      (void)Foo.Baz;
       A Bar = Foo;
       // [[p]]
     }
   )";
   runDataflow(
       Code,
       [](const llvm::StringMap<DataflowAnalysisState<NoopLattice>> &Results,
          ASTContext &ASTCtx) {

 TEST(TransferTest, CopyConstructorWithParens) {
   std::string Code = R"(
     struct A {
       int Baz;
     };
 
     void target() {
       A Foo;
+      (void)Foo.Baz;
       A Bar((A(Foo)));
       // [[p]]
     }
   )";
   runDataflow(
       Code,
       [](const llvm::StringMap<DataflowAnalysisState<NoopLattice>> &Results,
          ASTContext &ASTCtx) {
std::string Code = R"(
 
     struct A {
       int Baz;
     };
 
     void target() {
       A Foo;
       A Bar;
+      (void)Foo.Baz;
       // [[p1]]
       Foo = std::move(Bar);
       // [[p2]]
     }
   )";
   runDataflow(
       Code,
       [](const llvm::StringMap<DataflowAnalysisState<NoopLattice>> &Results,