[analyzer] Remove crashing unneeded assert

[george.karpenkov]

Summary

The assertion failure gets exposed when experimenting with traversal options

[NoQ]

This one is really weird. Any node can cache out, regardless of program point types.

However, it documents how the code works: if the number of predecessors is not equal to 1, the ascension through predecessors is not necessarily working correctly.

I think we should keep it until we are ready to provide an actual broken example, and then see how can this code be fixed. There must be something in the program state that should keep these branches apart (and these nodes from caching out). And since there is something in the program state, we should extend it to contain whatever we need here, so that we didn't need to ascend.

[george.karpenkov]

@NoQ a short reproducer is:

typedef struct { char a; } b;
int c(b* input) {
    return (input->a ?: input) ? 1 : 0;
}

Tracked in rdar://37540480

[NoQ]

All right, so it sounds like it still needs to be investigated, but at least we've made one more step with a brand-new reproducer.

cfe/trunk/lib/StaticAnalyzer/Core/ExprEngineC.cpp

void ExprEngine::VisitGuardedExpr(const Expr *Ex,
   const LocationContext *LCtx = Pred->getLocationContext();
   const CFGBlock *SrcBlock = nullptr;
 
   // Find the predecessor block.
   ProgramStateRef SrcState = state;
   for (const ExplodedNode *N = Pred ; N ; N = *N->pred_begin()) {
     ProgramPoint PP = N->getLocation();
     if (PP.getAs<PreStmtPurgeDeadSymbols>() || PP.getAs<BlockEntrance>()) {
-      assert(N->pred_size() == 1);
+      // If the state N has multiple predecessors P, it means that successors
+      // of P are all equivalent.
+      // In turn, that means that all nodes at P are equivalent in terms
+      // of observable behavior at N, and we can follow any of them.
+      // FIXME: a more robust solution which does not walk up the tree.
       continue;
     }
     SrcBlock = PP.castAs<BlockEdge>().getSrc();
     SrcState = N->getState();
     break;
   }
 
   assert(SrcBlock && "missing function entry");

cfe/trunk/test/Analysis/exploration_order/noexprcrash.c

+// RUN: %clang_analyze_cc1 -analyzer-checker=core,debug.ExprInspection -verify -analyzer-config exploration_strategy=unexplored_first %s
+// RUN: %clang_analyze_cc1 -analyzer-checker=core,debug.ExprInspection -verify -analyzer-config exploration_strategy=dfs %s
+
+extern void clang_analyzer_eval(int);
+
+typedef struct { char a; } b;
+int c(b* input) {
+    int x = (input->a ?: input) ? 1 : 0; // expected-warning{{pointer/integer type mismatch}}
+    if (input->a) {
+      // FIXME: The value should actually be "TRUE",
+      // but is incorrect due to a bug.
+      clang_analyzer_eval(x); // expected-warning{{FALSE}}
+    } else {
+      clang_analyzer_eval(x); // expected-warning{{TRUE}}
+    }
+    return x;
+}