[analyzer] Prevent AnalyzerStatsChecker from crash

[szepet]

Summary

The checker marks the locations where the analyzer creates sinks. However, it can happen that the sink was created because of a loop which does not contain condition statement, only breaks in the body. The exhausted block is the block which should contain the condition but empty, in this case.
This change only emits this marking in order to avoid the undefined behavior.

[dcoughlin]

This seems reasonable.

Would it make sense to use the last element of the block edge's source for the diagnostic location when the destination block is empty?

[szepet]

Would it make sense to use the last element of the block edge's source for the diagnostic location when the destination block is empty?

I do not think so. In the testfile emptyConditionLoop function is a great counter example since the last element of the source block is the num = 1 which would not make sense (in my opinion). However, in this case the location of the terminator statement could be used (if there is any). If you are OK with that solution, I can update the patch.

[NoQ]

LGTM! @george.karpenkov has also tested that when he was gathering statistics about his traversal order improvements and it helped :)

lib/StaticAnalyzer/Checkers/AnalyzerStatsChecker.cpp

void AnalyzerStatsChecker::checkEndAnalysis(ExplodedGraph &G,
 
   // Emit warning for each block we bailed out on.
   typedef CoreEngine::BlocksExhausted::const_iterator ExhaustedIterator;
   const CoreEngine &CE = Eng.getCoreEngine();
   for (ExhaustedIterator I = CE.blocks_exhausted_begin(),
       E = CE.blocks_exhausted_end(); I != E; ++I) {
     const BlockEdge &BE =  I->first;
     const CFGBlock *Exit = BE.getDst();
+    if (Exit->empty())
+      continue;
     const CFGElement &CE = Exit->front();
     if (Optional<CFGStmt> CS = CE.getAs<CFGStmt>()) {
       SmallString<128> bufI;
       llvm::raw_svector_ostream outputI(bufI);
       outputI << "(" << NameOfRootFunction << ")" <<
                  ": The analyzer generated a sink at this point";
       B.EmitBasicReport(
           D, this, "Sink Point", "Internal Statistics", outputI.str(),
           PathDiagnosticLocation::createBegin(CS->getStmt(), SM, LC));
     }
   }
 }
 
 void ento::registerAnalyzerStatsChecker(CheckerManager &mgr) {
   mgr.registerChecker<AnalyzerStatsChecker>();
 }

test/Analysis/analyzer-stats.c

-// RUN: %clang_analyze_cc1 -analyzer-checker=core,deadcode.DeadStores,debug.Stats -verify -Wno-unreachable-code -analyzer-opt-analyze-nested-blocks %s
+// RUN: %clang_analyze_cc1 -analyzer-checker=core,deadcode.DeadStores,debug.Stats -verify -Wno-unreachable-code -analyzer-opt-analyze-nested-blocks -analyzer-max-loop 4 %s
 
 int foo();
 
 int test() { // expected-warning-re{{test -> Total CFGBlocks: {{[0-9]+}} | Unreachable CFGBlocks: 0 | Exhausted Block: no | Empty WorkList: yes}}
   int a = 1;
   a = 34 / 12;
 
   if (foo())
     return a;
 
   a /= 4;
   return a;
 }
+
+
+int sink() // expected-warning-re{{sink -> Total CFGBlocks: {{[0-9]+}} | Unreachable CFGBlocks: 1 | Exhausted Block: yes | Empty WorkList: yes}}
+{
+  for (int i = 0; i < 10; ++i) // expected-warning {{(sink): The analyzer generated a sink at this point}}
+    ++i;
+
+  return 0;
+}
+
+int emptyConditionLoop() // expected-warning-re{{emptyConditionLoop -> Total CFGBlocks: {{[0-9]+}} | Unreachable CFGBlocks: 0 | Exhausted Block: yes | Empty WorkList: yes}}
+{
+  int num = 1;
+  for (;;)
+    num++;
+}