[analyzer] Remove crashing unneeded assert

[george.karpenkov]

Summary

The assertion failure gets exposed when experimenting with traversal options

[NoQ]

This one is really weird. Any node can cache out, regardless of program point types.

However, it documents how the code works: if the number of predecessors is not equal to 1, the ascension through predecessors is not necessarily working correctly.

I think we should keep it until we are ready to provide an actual broken example, and then see how can this code be fixed. There must be something in the program state that should keep these branches apart (and these nodes from caching out). And since there is something in the program state, we should extend it to contain whatever we need here, so that we didn't need to ascend.

[george.karpenkov]

@NoQ a short reproducer is:

typedef struct { char a; } b;
int c(b* input) {
    return (input->a ?: input) ? 1 : 0;
}

Tracked in rdar://37540480

[NoQ]

All right, so it sounds like it still needs to be investigated, but at least we've made one more step with a brand-new reproducer.

lib/StaticAnalyzer/Core/ExprEngineC.cpp

void ExprEngine::VisitGuardedExpr(const Expr *Ex,
   const LocationContext *LCtx = Pred->getLocationContext();
   const CFGBlock *SrcBlock = nullptr;
 
   // Find the predecessor block.
   ProgramStateRef SrcState = state;
   for (const ExplodedNode *N = Pred ; N ; N = *N->pred_begin()) {
     ProgramPoint PP = N->getLocation();
     if (PP.getAs<PreStmtPurgeDeadSymbols>() || PP.getAs<BlockEntrance>()) {
-      assert(N->pred_size() == 1);
+      // FIXME: we are assuming one parent here, which
+      // is not necessarily the case. Cf. D42773.
       continue;
     }
     SrcBlock = PP.castAs<BlockEdge>().getSrc();
     SrcState = N->getState();
     break;
   }
 
   assert(SrcBlock && "missing function entry");

test/Analysis/exploration_order/noexprcrash.c

+// RUN: %clang_analyze_cc1 -analyzer-checker=core -analyzer-config exploration_strategy=unexplored_first %s
+
+typedef struct { char a; } b;
+int c(b* input) {
+    return (input->a ?: input) ? 1 : 0; // no-crash
+}