[dataflow] Disallow implicit copy of Environment, use fork() instead

[sammccall]

Summary

Environments are heavyweight, and copies are observably different from the
original: they introduce new SAT variables, which degrade performance &
debugging. Copies should only be done deliberately, where justified.

Empirically there are several places in the framework where we perform dubious
copies, sometimes entirely accidentally. (see e.g. D153491). Making these
explicit makes this mistake harder.

This patch forces copies to go through fork(), the copy-constructor is private.
This requires changes to existing callsites: some are correct and call fork(),
some are incorrect and are fixed, others are difficult and I left a FIXME.

[sammccall]

clang/include/clang/Analysis/FlowSensitive/DataflowAnalysis.h

211

these copies shouldn't be happening (or if we're really going to do them, PostVisitCFG should get the env by value!)

However I think fixing it means changing the signature of PostVisitCFG...

228

with auto&& this fails to compile, complaining about the copy constructor being deleted.

Not sure exactly what's going on - maybe the wrong overload of transformOptional is called for some reason.

In any case, I'm fairly sure we were accidentally copying here.

clang/lib/Analysis/FlowSensitive/Transfer.cpp

868

this looks like it was an accidental copy

clang/unittests/Analysis/FlowSensitive/TestingSupport.h

366

this seems legitimate to me: the only way to preserve the Environment from halfway through a BB is to fork it

[xazax.hun]

Nice, looks like this change did catch some unintentional copies! Already paying dividends :)

[zixuan-wu]

Hi, there is a compiling error introduced recently as like following when files under clang/lib/Analysis/FlowSensitive/ are being compiled such as TypeErasedDataflowAnalysis.cpp and Transfer.cpp. Does anybody meet also?

from /usr/include/c++/7/functional:60,
from /iothome/wuzx/workspace/master-csky/clang/unittests/Analysis/FlowSensitive/TestingSupport.h:16,
from /iothome/wuzx/workspace/master-csky/clang/unittests/Analysis/FlowSensitive/TypeErasedDataflowAnalysisTest.cpp:9:

/usr/include/c++/7/optional:453:11: note: ‘std::optional<clang::dataflow::DataflowAnalysisState<clang::dataflow::NoopLattice> >::optional(const std::optional<clang::dataflow::DataflowAnalysisState<clang::dataflow::NoopLattice> >&)’ is implicitly deleted because the default definition would be ill-formed:

class optional
      ^~~~~~~~

/usr/include/c++/7/optional:453:11: error: use of deleted function ‘constexpr std::_Enable_copy_move<false, false, true, true, _Tag>::_Enable_copy_move(const std::_Enable_copy_move<false, false, true, true, _Tag>&) [with _Tag = std::optional<clang::dataflow::DataflowAnalysisState<clang::dataflow::NoopLattice> >]’
In file included from /usr/include/c++/7/optional:43:0,

from /usr/include/c++/7/bits/node_handle.h:39,
from /usr/include/c++/7/bits/hashtable.h:37,
from /usr/include/c++/7/unordered_map:47,
from /usr/include/c++/7/functional:60,
from /iothome/wuzx/workspace/master-csky/clang/unittests/Analysis/FlowSensitive/TestingSupport.h:16,
from /iothome/wuzx/workspace/master-csky/clang/unittests/Analysis/FlowSensitive/TypeErasedDataflowAnalysisTest.cpp:9:

/usr/include/c++/7/bits/enable_special_members.h:157:15: note: declared here

constexpr _Enable_copy_move(_Enable_copy_move const&) noexcept  = delete;
          ^~~~~~~~~~~~~~~~~

In file included from /usr/include/c++/7

The gcc version is gcc (Ubuntu 7.5.0-3ubuntu1~18.04) 7.5.0.

[sammccall]

Hi, sorry about that - are you able to provide a full log, or link to a
failing bot?
That error message doesn't show where in the LLVM code the error occurs.

[zixuan-wu]

In D153674#4455357, @sammccall wrote:

Hi, sorry about that - are you able to provide a full log, or link to a
failing bot?
That error message doesn't show where in the LLVM code the error occurs.

It can pass with gcc 8. And I can upload the .i file.

error.i5 MBDownload

g++ error.i -std=c++17
In file included from /usr/include/c++/7/memory:64:0,

from /iothome/wuzx/workspace/llvm-comm/llvm/include/llvm/Support/Casting.h:20,
from /iothome/wuzx/workspace/llvm-comm/clang/include/clang/Basic/LLVM.h:21,
from /iothome/wuzx/workspace/llvm-comm/clang/include/clang/Basic/DiagnosticIDs.h:17,
from /iothome/wuzx/workspace/llvm-comm/clang/include/clang/Basic/IdentifierTable.h:18,
from /iothome/wuzx/workspace/llvm-comm/clang/include/clang/AST/Stmt.h:20,
from /iothome/wuzx/workspace/llvm-comm/clang/include/clang/Analysis/FlowSensitive/Transfer.h:17,
from /iothome/wuzx/workspace/llvm-comm/clang/lib/Analysis/FlowSensitive/Transfer.cpp:14:

/usr/include/c++/7/bits/stl_construct.h: In instantiation of ‘void std::_Construct(_T1*, _Args&& ...) [with _T1 = std::optional<clang::dataflow::DataflowAnalysisState<clang::dataflow::NoopLattice> >; _Args = {const std::optional<clang::dataflow::DataflowAnalysisState<clang::dataflow::NoopLattice> >&}]’:
/usr/include/c++/7/bits/stl_uninitialized.h:83:18: required from ‘static _ForwardIterator std::uninitialized_copy<_TrivialValueTypes>::uninit_copy(_InputIterator, _InputIterator, _ForwardIterator) [with _InputIterator = gnu_cxx::normal_iterator<const std::optional<clang::dataflow::DataflowAnalysisState<clang::dataflow::NoopLattice> >*, std::vector<std::optional<clang::dataflow::DataflowAnalysisState<clang::dataflow::NoopLattice> >, std::allocator<std::optional<clang::dataflow::DataflowAnalysisState<clang::dataflow::NoopLattice> > > > >; _ForwardIterator = std::optional<clang::dataflow::DataflowAnalysisState<clang::dataflow::NoopLattice> >*; bool _TrivialValueTypes = false]’
/usr/include/c++/7/bits/stl_uninitialized.h:134:15: required from ‘_ForwardIterator std::uninitialized_copy(_InputIterator, _InputIterator, _ForwardIterator) [with _InputIterator = gnu_cxx::normal_iterator<const std::optional<clang::dataflow::DataflowAnalysisState<clang::dataflow::NoopLattice> >*, std::vector<std::optional<clang::dataflow::DataflowAnalysisState<clang::dataflow::NoopLattice> >, std::allocator<std::optional<clang::dataflow::DataflowAnalysisState<clang::dataflow::NoopLattice> > > > >; _ForwardIterator = std::optional<clang::dataflow::DataflowAnalysisState<clang::dataflow::NoopLattice> >*]’
/usr/include/c++/7/bits/stl_uninitialized.h:289:37: required from ‘_ForwardIterator std::uninitialized_copy_a(_InputIterator, _InputIterator, _ForwardIterator, std::allocator<_Tp>&) [with _InputIterator = gnu_cxx::__normal_iterator<const std::optional<clang::dataflow::DataflowAnalysisState<clang::dataflow::NoopLattice> >*, std::vector<std::optional<clang::dataflow::DataflowAnalysisState<clang::dataflow::NoopLattice> >, std::allocator<std::optional<clang::dataflow::DataflowAnalysisState<clang::dataflow::NoopLattice> > > > >; _ForwardIterator = std::optional<clang::dataflow::DataflowAnalysisState<clang::dataflow::NoopLattice> >*; _Tp = std::optional<clang::dataflow::DataflowAnalysisState<clang::dataflow::NoopLattice> >]’
/usr/include/c++/7/bits/stl_vector.h:331:31: required from ‘std::vector<_Tp, _Alloc>::vector(const std::vector<_Tp, _Alloc>&) [with _Tp = std::optional<clang::dataflow::DataflowAnalysisState<clang::dataflow::NoopLattice> >; _Alloc = std::allocator<std::optional<clang::dataflow::DataflowAnalysisState<clang::dataflow::NoopLattice> > >]’
/iothome/wuzx/workspace/llvm-comm/llvm/include/llvm/Support/Error.h:520:5: required from ‘llvm::Expected<T>::Expected(OtherT&&, std::enable_if_t<is_convertible_v<OtherT, T> >*) [with OtherT = std::vector<std::optional<clang::dataflow::DataflowAnalysisState<clang::dataflow::NoopLattice> >, std::allocator<std::optional<clang::dataflow::DataflowAnalysisState<clang::dataflow::NoopLattice> > > >&; T = std::vector<std::optional<clang::dataflow::DataflowAnalysisState<clang::dataflow::NoopLattice> >, std::allocator<std::optional<clang::dataflow::DataflowAnalysisState<clang::dataflow::NoopLattice> > > >; std::enable_if_t<is_convertible_v<OtherT, T> > = void]’
/iothome/wuzx/workspace/llvm-comm/clang/include/clang/Analysis/FlowSensitive/DataflowAnalysis.h:235:10: required from ‘llvm::Expected<std::vector<std::optional<clang::dataflow::DataflowAnalysisState<typename AnalysisT::Lattice> > > > clang::dataflow::runDataflowAnalysis(const clang::dataflow::ControlFlowContext&, AnalysisT&, const clang::dataflow::Environment&, std::function<void(const clang::CFGElement&, const clang::dataflow::DataflowAnalysisState<typename AnalysisT::Lattice>&)>) [with AnalysisT = clang::dataflow::NoopAnalysis; typename AnalysisT::Lattice = clang::dataflow::NoopLattice]’
/iothome/wuzx/workspace/llvm-comm/clang/lib/Analysis/FlowSensitive/Transfer.cpp:871:38: required from ‘void clang::dataflow::{anonymous}::TransferVisitor::transferInlineCall(const E*, const clang::FunctionDecl*) [with E = clang::CXXConstructExpr]’
/iothome/wuzx/workspace/llvm-comm/clang/lib/Analysis/FlowSensitive/Transfer.cpp:625:42: required from here
/usr/include/c++/7/bits/stl_construct.h:75:7: error: use of deleted function ‘std::optional<clang::dataflow::DataflowAnalysisState<clang::dataflow::NoopLattice> >::optional(const std::optional<clang::dataflow::DataflowAnalysisState<clang::dataflow::NoopLattice> >&)’

{ ::new(static_cast<void*>(__p)) _T1(std::forward<_Args>(__args)...); }
  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

In file included from /iothome/wuzx/workspace/llvm-comm/llvm/include/llvm/Support/Alignment.h:26:0,

from /iothome/wuzx/workspace/llvm-comm/llvm/include/llvm/Support/TrailingObjects.h:50,
from /iothome/wuzx/workspace/llvm-comm/clang/include/clang/AST/DeclGroup.h:16,
from /iothome/wuzx/workspace/llvm-comm/clang/include/clang/AST/Stmt.h:16,
from /iothome/wuzx/workspace/llvm-comm/clang/include/clang/Analysis/FlowSensitive/Transfer.h:17,
from /iothome/wuzx/workspace/llvm-comm/clang/lib/Analysis/FlowSensitive/Transfer.cpp:14:

/usr/include/c++/7/optional:453:11: note: ‘std::optional<clang::dataflow::DataflowAnalysisState<clang::dataflow::NoopLattice> >::optional(const std::optional<clang::dataflow::DataflowAnalysisState<clang::dataflow::NoopLattice> >&)’ is implicitly deleted because the default definition would be ill-formed:

class optional
      ^~~~~~~~

/usr/include/c++/7/optional:453:11: error: use of deleted function ‘constexpr std::_Enable_copy_move<false, false, true, true, _Tag>::_Enable_copy_move(const std::_Enable_copy_move<false, false, true, true, _Tag>&) [with _Tag = std::optional<clang::dataflow::DataflowAnalysisState<clang::dataflow::NoopLattice> >]’
In file included from /usr/include/c++/7/optional:43:0,

from /iothome/wuzx/workspace/llvm-comm/llvm/include/llvm/Support/Alignment.h:26,
from /iothome/wuzx/workspace/llvm-comm/llvm/include/llvm/Support/TrailingObjects.h:50,
from /iothome/wuzx/workspace/llvm-comm/clang/include/clang/AST/DeclGroup.h:16,
from /iothome/wuzx/workspace/llvm-comm/clang/include/clang/AST/Stmt.h:16,
from /iothome/wuzx/workspace/llvm-comm/clang/include/clang/Analysis/FlowSensitive/Transfer.h:17,
from /iothome/wuzx/workspace/llvm-comm/clang/lib/Analysis/FlowSensitive/Transfer.cpp:14:

/usr/include/c++/7/bits/enable_special_members.h:157:15: note: declared here

constexpr _Enable_copy_move(_Enable_copy_move const&) noexcept  = delete;
          ^~~~~~~~~~~~~~~~~

[donat.nagy]

I'm also using gcc (Ubuntu 7.5.0-3ubuntu1~18.04) 7.5.0 (which supported according to the LLVM "Getting Started" page) and I see the same std::optional compilation errors. Please revert this commit or fix the build.

[sammccall]

Sorry about the delay, and thanks for the .i.

It took me a while to work out what was going on, but it looks like it's just a bug where GCC forgets to automatic-move.
Fixed in 2f7d30dee8262746c3e8ee1f6f25be8c1ace9990

[zixuan-wu]

In D153674#4461195, @sammccall wrote:

Sorry about the delay, and thanks for the .i.

It took me a while to work out what was going on, but it looks like it's just a bug where GCC forgets to automatic-move.
Fixed in 2f7d30dee8262746c3e8ee1f6f25be8c1ace9990

Thanks a lot.

[donat.nagy]

Thank you for the fix :) !

[donat.nagy]

When I tried to compile with gcc 7.5 after your fix commit (2f7d30dee826), I got another very similar compilation error from a different location and I pushed commit cec30e2b190b to fix that. After this second correction I can successfully run ninja check-clang-analysis with gcc7.5.

clang/include/clang/Analysis/FlowSensitive/DataflowAnalysis.h

std::function<void(const CFGElement &,
                      const TypeErasedDataflowAnalysisState &)>
       PostVisitCFGClosure = nullptr;
   if (PostVisitCFG) {
     PostVisitCFGClosure = [&PostVisitCFG](
                               const CFGElement &Element,
                               const TypeErasedDataflowAnalysisState &State) {
       auto *Lattice =
           llvm::any_cast<typename AnalysisT::Lattice>(&State.Lattice.Value);
+      // FIXME: we should not be copying the environment here!
+      // Ultimately the PostVisitCFG only gets a const reference anyway.
       PostVisitCFG(Element, DataflowAnalysisState<typename AnalysisT::Lattice>{
-                                *Lattice, State.Env});
+                                *Lattice, State.Env.fork()});
     };
   }
 
   auto TypeErasedBlockStates = runTypeErasedDataflowAnalysis(
       CFCtx, Analysis, InitEnv, PostVisitCFGClosure);
   if (!TypeErasedBlockStates)
     return TypeErasedBlockStates.takeError();
 
   std::vector<std::optional<DataflowAnalysisState<typename AnalysisT::Lattice>>>
       BlockStates;
   BlockStates.reserve(TypeErasedBlockStates->size());
 
   llvm::transform(
       std::move(*TypeErasedBlockStates), std::back_inserter(BlockStates),
       [](auto &OptState) {
-        return llvm::transformOptional(std::move(OptState), [](auto &&State) {
+        return llvm::transformOptional(
+            std::move(OptState), [](TypeErasedDataflowAnalysisState &&State) {
               return DataflowAnalysisState<typename AnalysisT::Lattice>{
                   llvm::any_cast<typename AnalysisT::Lattice>(
                       std::move(State.Lattice.Value)),
                   std::move(State.Env)};
             });
       });
   return BlockStates;
 }
 
 /// Abstract base class for dataflow "models": reusable analysis components that
 /// model a particular aspect of program semantics in the `Environment`. For
 /// example, a model may capture a type and its related functions.
 class DataflowModel : public Environment::ValueModel {

clang/include/clang/Analysis/FlowSensitive/DataflowEnvironment.h

virtual Value *widen(QualType Type, Value &Prev, const Environment &PrevEnv,
       llvm_unreachable("all cases in switch covered");
     }
   };
 
   /// Creates an environment that uses `DACtx` to store objects that encompass
   /// the state of a program.
   explicit Environment(DataflowAnalysisContext &DACtx);
 
-  Environment(const Environment &Other);
-  Environment &operator=(const Environment &Other);
+  // Copy-constructor is private, Environments should not be copied. See fork().
+  Environment &operator=(const Environment &Other) = delete;
 
   Environment(Environment &&Other) = default;
   Environment &operator=(Environment &&Other) = default;
 
   /// Creates an environment that uses `DACtx` to store objects that encompass
   /// the state of a program.
   ///
   /// If `DeclCtx` is a function, initializes the environment with symbolic
   /// representations of the function parameters.
   ///
   /// If `DeclCtx` is a non-static member function, initializes the environment
   /// with a symbolic representation of the `this` pointee.
   Environment(DataflowAnalysisContext &DACtx, const DeclContext &DeclCtx);
 
+  /// Returns a new environment that is a copy of this one.
+  ///
+  /// The state of the program is initially the same, but can be mutated without
+  /// affecting the original.
+  ///
+  /// However the original should not be further mutated, as this may interfere
+  /// with the fork. (In practice, values are stored independently, but the
+  /// forked flow condition references the original).
+  Environment fork() const;
+
   /// Creates and returns an environment to use for an inline analysis  of the
   /// callee. Uses the storage location from each argument in the `Call` as the
   /// storage location for the corresponding parameter in the callee.
   ///
   /// Requirements:
   ///
   ///  The callee of `Call` must be a `FunctionDecl`.
   ///
public:
 
   /// Returns the `DataflowAnalysisContext` used by the environment.
   DataflowAnalysisContext &getDataflowAnalysisContext() const { return *DACtx; }
 
   LLVM_DUMP_METHOD void dump() const;
   LLVM_DUMP_METHOD void dump(raw_ostream &OS) const;
 
 private:
+  // The copy-constructor is for use in fork() only.
+  Environment(const Environment &) = default;
+
   /// Creates a value appropriate for `Type`, if `Type` is supported, otherwise
   /// return null.
   ///
   /// Recursively initializes storage locations and values until it sees a
   /// self-referential pointer or reference type. `Visited` is used to track
   /// which types appeared in the reference/pointer chain in order to avoid
   /// creating a cyclic dependency with self-referential pointers/references.
   ///

clang/include/clang/Analysis/FlowSensitive/TypeErasedDataflowAnalysis.h

struct TypeErasedDataflowAnalysisState {
   /// Type-erased model of a program property.
   TypeErasedLattice Lattice;
 
   /// Model of the state of the program (store and heap).
   Environment Env;
 
   TypeErasedDataflowAnalysisState(TypeErasedLattice Lattice, Environment Env)
       : Lattice(std::move(Lattice)), Env(std::move(Env)) {}
+
+  TypeErasedDataflowAnalysisState fork() const {
+    return TypeErasedDataflowAnalysisState(Lattice, Env.fork());
+  }
 };
 
 /// Transfers the state of a basic block by evaluating each of its elements in
 /// the context of `Analysis` and the states of its predecessors that are
 /// available in `BlockStates`. `PostVisitCFG` (if provided) will be applied to
 /// each element in the block, after it is evaluated.
 ///
 /// Requirements:

clang/lib/Analysis/FlowSensitive/DataflowEnvironment.cpp

for (const FunctionDecl *FD : Funcs) {
     setStorageLocation(*FD, Loc);
   }
 }
 
 Environment::Environment(DataflowAnalysisContext &DACtx)
     : DACtx(&DACtx),
       FlowConditionToken(&DACtx.arena().makeFlowConditionToken()) {}
 
-Environment::Environment(const Environment &Other)
-    : DACtx(Other.DACtx), CallStack(Other.CallStack),
-      ReturnVal(Other.ReturnVal), ReturnLoc(Other.ReturnLoc),
-      ThisPointeeLoc(Other.ThisPointeeLoc), DeclToLoc(Other.DeclToLoc),
-      ExprToLoc(Other.ExprToLoc), LocToVal(Other.LocToVal),
-      MemberLocToStruct(Other.MemberLocToStruct),
-      FlowConditionToken(&DACtx->forkFlowCondition(*Other.FlowConditionToken)) {
-}
-
-Environment &Environment::operator=(const Environment &Other) {
-  Environment Copy(Other);
-  *this = std::move(Copy);
-  return *this;
+Environment Environment::fork() const {
+  Environment Copy(*this);
+  Copy.FlowConditionToken = &DACtx->forkFlowCondition(*FlowConditionToken);
+  return Copy;
 }
 
 Environment::Environment(DataflowAnalysisContext &DACtx,
                          const DeclContext &DeclCtx)
     : Environment(DACtx) {
   CallStack.push_back(&DeclCtx);
 
   if (const auto *FuncDecl = dyn_cast<FunctionDecl>(&DeclCtx)) {

clang/lib/Analysis/FlowSensitive/Transfer.cpp

void transferInlineCall(const E *S, const FunctionDecl *F) {
     auto Analysis = NoopAnalysis(CFCtx->getDecl()->getASTContext(),
                                  DataflowAnalysisOptions{Options});
 
     auto BlockToOutputState =
         dataflow::runDataflowAnalysis(*CFCtx, Analysis, CalleeEnv);
     assert(BlockToOutputState);
     assert(ExitBlock < BlockToOutputState->size());
 
-    auto ExitState = (*BlockToOutputState)[ExitBlock];
+    auto &ExitState = (*BlockToOutputState)[ExitBlock];
     assert(ExitState);
 
     Env.popCall(S, ExitState->Env);
   }
 
   const StmtToEnvMap &StmtToEnv;
   Environment &Env;
 };

clang/lib/Analysis/FlowSensitive/TypeErasedDataflowAnalysis.cpp

for (const CFGBlock *Pred : Preds) {
 
     // Skip if `Pred` was not evaluated yet. This could happen if `Pred` has a
     // loop back edge to `Block`.
     const std::optional<TypeErasedDataflowAnalysisState> &MaybePredState =
         AC.BlockStates[Pred->getBlockID()];
     if (!MaybePredState)
       continue;
 
-    TypeErasedDataflowAnalysisState PredState = *MaybePredState;
+    TypeErasedDataflowAnalysisState PredState = MaybePredState->fork();
     if (Analysis.builtinOptions()) {
       if (const Stmt *PredTerminatorStmt = Pred->getTerminatorStmt()) {
         const StmtToEnvMap StmtToEnv(AC.CFCtx, AC.BlockStates);
         auto [Cond, CondValue] =
             TerminatorVisitor(StmtToEnv, PredState.Env,
                               blockIndexInPredecessor(*Pred, Block))
                 .Visit(PredTerminatorStmt);
         if (Cond != nullptr)
for (const CFGBlock *Pred : Preds) {
     } else {
       MaybeState = std::move(PredState);
     }
   }
   if (!MaybeState) {
     // FIXME: Consider passing `Block` to `Analysis.typeErasedInitialElement()`
     // to enable building analyses like computation of dominators that
     // initialize the state of each basic block differently.
-    MaybeState.emplace(Analysis.typeErasedInitialElement(), AC.InitEnv);
+    MaybeState.emplace(Analysis.typeErasedInitialElement(), AC.InitEnv.fork());
   }
   return std::move(*MaybeState);
 }
 
 /// Built-in transfer function for `CFGStmt`.
 static void
 builtinTransferStatement(const CFGStmt &Elt,
                          TypeErasedDataflowAnalysisState &InputState,
std::function<void(const CFGElement &,
                        const TypeErasedDataflowAnalysisState &)>
         PostVisitCFG) {
   PrettyStackTraceAnalysis CrashInfo(CFCtx, "runTypeErasedDataflowAnalysis");
 
   PostOrderCFGView POV(&CFCtx.getCFG());
   ForwardDataflowWorklist Worklist(CFCtx.getCFG(), &POV);
 
   std::vector<std::optional<TypeErasedDataflowAnalysisState>> BlockStates(
-      CFCtx.getCFG().size(), std::nullopt);
+      CFCtx.getCFG().size());
 
   // The entry basic block doesn't contain statements so it can be skipped.
   const CFGBlock &Entry = CFCtx.getCFG().getEntry();
   BlockStates[Entry.getBlockID()] = {Analysis.typeErasedInitialElement(),
-                                     InitEnv};
+                                     InitEnv.fork()};
   Worklist.enqueueSuccessors(&Entry);
 
   AnalysisContext AC(CFCtx, Analysis, InitEnv, BlockStates);
 
   // Bugs in lattices and transfer functions can prevent the analysis from
   // converging. To limit the damage (infinite loops) that these bugs can cause,
   // limit the number of iterations.
   // FIXME: Consider making the maximum number of iterations configurable.

clang/unittests/Analysis/FlowSensitive/TestingSupport.h

auto PostVisitCFG =
         // FIXME: Extend retrieval of state for non statement constructs.
         auto Stmt = Elt.getAs<CFGStmt>();
         if (!Stmt)
           return;
         auto It = StmtToAnnotations.find(Stmt->getStmt());
         if (It == StmtToAnnotations.end())
           return;
         auto [_, InsertSuccess] = AnnotationStates.insert(
-            {It->second, StateT{State.Lattice, State.Env}});
+            {It->second, StateT{State.Lattice, State.Env.fork()}});
         (void)_;
         (void)InsertSuccess;
         assert(InsertSuccess);
       };
   return checkDataflow<AnalysisT>(
       std::move(AI)
           .withSetupTest(std::move(SetupTest))
           .withPostVisitCFG(std::move(PostVisitCFG)),