[analyzer][CrossTU] Extend CTU to VarDecls with initializer

[r.stahl]

Summary

The existing CTU mechanism imports FunctionDecls where the definition is available in another TU. This patch extends that to VarDecls, to bind more constants.

• Add VarDecl importing functionality to CrossTranslationUnitContext
• Import Decls while traversing them in AnalysisConsumer
• Add VarDecls to CTU external mappings generator
• Name changes from "external function map" to "external definition map"

[r.stahl]

Tests and doc fixes pending. First I'm interested in your thoughts to this change.

It allows to bind more symbolic values to constants if they have been defined and initialized in another TU:

use.c:

extern int * const p;
extern struct S * const s;

def.c:

int * const p = 0;
struct S * const s = { /* complex init */ };

[a.sidorin]

Hi Rafael! I like the change.

lib/CrossTU/CrossTranslationUnit.cpp

276

Are we always sure that Import() returns non-null value of appropriate type? If no, we have to check the result after applying dyn_cast_or_null.

[r.stahl]

• added tests
• updated doc and var naming
• addressed review comment

[xazax.hun]

The analyzer can only reason about const variables this way, right? Maybe we should only import the initializers for such variables to have better performance? What do you think?

Also, I wonder what happens with user-defined classes. Will the analyzer evaluate the constructor if the variable is imported?

include/clang/CrossTU/CrossTranslationUnit.h

114

I wonder if we need these overloads. Maybe having only the templated version and having a static assert for the supported types is better? Asking the other reviewers as well.

138

Same question as above.

lib/CrossTU/CrossTranslationUnit.cpp

114

Functions should start with lowercase letter. Maybe these could be static?

143

Fn in the name refers to a function, maybe that could be changed as well.

lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp

354

Will this work for zero initialized globals (i.e. not having an initializer expression) that are defined in the current translation unit? It would be great to have a test case for that.

[xazax.hun]

include/clang/CrossTU/CrossTranslationUnit.h

117

Adding briefs are unnecessary, see https://reviews.llvm.org/rL331834

[r.stahl]

I looked through the original patches and found quite a few more occurrences of "function map" and renamed them - including the tool "clang-func-mapping". There is one comment "by using the 'clang-extdef-mapping' packaged with Xcode (on OS X)". Is this implicit from the install targets that the tool name changed or do I have to inform someone?

[r.stahl]

include/clang/CrossTU/CrossTranslationUnit.h

114

They are not required, but I thought they make the interface more clear and help prevent implementation in headers.

lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp

354

If a variable has a definition in the current TU, it may not have another one else where, but you're correct that this case will continue here. It will however only result in a failed lookup.

Similar but backwards: If an extern var is defined in another TU with global zero init.

Overall I'd say that default initializing a constant to zero is pretty uncommon (and invalid in C++), so that in my opinion it's fine to not support it for now. It seems like there is no transparent way to get the initializer including that case or am I missing something?

[xazax.hun]

Sorry for the limited activity. Unfortunately, I have very little time reviewing patches lately.
I think we need to answer the following questions:

• Does this change affect the analysis of the constructors of global objects? If so, how?
• Do we want to import non-const object's initializer expressions? The analyzer might not end up using the value anyways.
• How big can the index get with this modification for large projects?

Overall the direction looks good to me, this will be a very useful addition, thanks for working on this.

[r.stahl]

In D46421#1119098, @xazax.hun wrote:

Sorry for the limited activity. Unfortunately, I have very little time reviewing patches lately.

Thanks for getting around to it!

I think we need to answer the following questions:

• Does this change affect the analysis of the constructors of global objects? If so, how?

The intention was to only allow the analyzer to resolve constants of arrays, structs and integral values. It seems to me that construction would have to be symbolically executed at the correct point in time and cannot be retroactively looked up - as is done with the constants here.

• Do we want to import non-const object's initializer expressions? The analyzer might not end up using the value anyways.

It seems like a good idea to not do that, since non-const values are not used. It might become useful if we ever do some kind of straight line execution from static initialization to main.
However for structs it is enough if one of their fields is declared const.

• How big can the index get with this modification for large projects?

That depends a lot on global usage of course. In LLVM for example there is little impact, but I don't have any numbers, it's taking too long. Taking care of the previous point helps here as well.

Overall the direction looks good to me, this will be a very useful addition, thanks for working on this.

I will prepare something to not store unnecessary entries in the index. I also noticed the AnalysisConsumer change has gone missing with my latest diff - will be fixed.

[r.stahl]

• add missing AnalysisConsumer diff
• only collect const qualified vardecls in the extdef index and adjust test

[r.stahl]

Please let me know if there is anything else that should be addressed.

Note that even though this diff is quite large, most is just renaming things to stay consistent.

[xazax.hun]

Sorry for the delay. The changes are looking good to me, although I think it might be worth to split this up into two patch, one NFC with the renaming, and one that actually introduces the changes.

@martong could you also take a look?

First, we would also like to test this internally. just to make sure it works as intended. Could you rebase the path to current top of tree?

Thanks!

lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp

350

Maybe we should also opt out for non-const VarDecls to avoid even attempting to import the initializer if we will not find it anyways.

[martong]

Hi Rafael,

This is a great patch and good improvement, thank you! I had a few minor comments.
(Also, I was thinking about what else could we import in the future, maybe definitions of C++11 enum classes would be also worth to be handled by CTU.)

include/clang/CrossTU/CrossTranslationUnit.h

114

I consider the new overload just great. Later, if we want we still can extend the interface with a template which would call the overloaded functions.

lib/CrossTU/CrossTranslationUnit.cpp

117

The naming here is confusing for me, would be better to be hasInit, because there are cases when a VarDecl has an initializer but it is not a definition:

struct A {
  static const int a = 1 + 2; // VarDecl: has init, but not a definition
};
const int A::a; // VarDecl: definition

In the above case we probably want to import the initializer and we don't care about the definition.

120

hasDefinitionOrInit ?

test/Analysis/Inputs/ctu-other.cpp

79

Could we have another test case when S::a is static?

test/Analysis/func-mapping-test.cpp

18

Could we have one more test when we have a static member variable?

[NoQ]

In D46421#1121080, @r.stahl wrote:

It seems like a good idea to not do that, since non-const values are not used. It might become useful if we ever do some kind of straight line execution from static initialization to main.
However for structs it is enough if one of their fields is declared const.

Aaand in C++ there's also the mutable keyword that can cancel the effect of the surrounding const keyword, at least for the purposes of precise memory contents modeling in RegionStore.

The idea looks great to me. It was far from obvious to me that importing variables manually was necessary, nice catch.

I definitely wish for a more direct test for this, i.e. "CTU analysis avoids that specific false positive due to the new functionality".

[r.stahl]

Strip name changes (see D56441); addressed review comments

In my old version I seemed to get away with the tests, but they failed after rebasing. It seems like earlier there was only a single VarDecl for the imported ones with InitExpr. Now after importing there is one without init and a redecl with the init. This is why I changed getInit() in RegionStore to getAnyInititializer. I think these three should be enough, but I'm not sure where else in the analyzer this would have to be changed.

I also noticed that nested struct inits don't work, but this is unrelated to this patch, so I commented out the test for now and will send a separate patch.

lib/CrossTU/CrossTranslationUnit.cpp

120

I simply made it hasBodyOrInit now to be as clear as possible

[NoQ]

In D46421#1354188, @r.stahl wrote:

In my old version I seemed to get away with the tests, but they failed after rebasing. It seems like earlier there was only a single VarDecl for the imported ones with InitExpr. Now after importing there is one without init and a redecl with the init. This is why I changed getInit() in RegionStore to getAnyInititializer. I think these three should be enough, but I'm not sure where else in the analyzer this would have to be changed.

Hmm, that is actually pretty interesting and sounds pretty bad: it seems that we are constructing a VarRegion with a non-canonical VarDecl. In other words, it turns out that VarRegion that is constructed for a DeclRefExpr may depend on which of the re-declarations of the variable does DeclRefExpr refer to. Which means that we potentially construct two different VarRegions for the same variable during analysis. It should always refer to the canonical declaration (which should, as far as i understand, be the one that has an initializer on it, if any).

The problem can be easily demonstrated by adding assert(d->isCanonicalDecl() to DeclRegion's constructor and running tests (a few should fail, including ctu-main.c), though i'd rather prefer the constructor to automatically canonicalize the declaration - which statically ensures that this sort of stuff doesn't happen (for a tiny performance cost). I also wonder if DeclRefExpr in a fully constructed AST should always point to the canonical declaration - maybe that's the thing that's broken.

At the same time, i don't have any test cases for the actual change in behavior that such canonicalization causes. If the test case that you had in mind is indeed demonstrating this problem, i'd love to have it. If it turns out that your test case doesn't allow us to demonstrate the problem without CTU, then probably it has something to do with ASTImporter accidentally canonicalizing the the declaration in DeclRefExpr more rarely than the vanilla AST.

[r.stahl]

In D46421#1374807, @NoQ wrote:

At the same time, i don't have any test cases for the actual change in behavior that such canonicalization causes. If the test case that you had in mind is indeed demonstrating this problem, i'd love to have it. If it turns out that your test case doesn't allow us to demonstrate the problem without CTU, then probably it has something to do with ASTImporter accidentally canonicalizing the the declaration in DeclRefExpr more rarely than the vanilla AST.

This seems unrelated to CTU. The following subset of my test demonstrates this:

// RUN: %clang_analyze_cc1 -analyzer-checker=core,debug.ExprInspection -verify %s

void clang_analyzer_eval(int);

extern const int extInt;

int main()
{
    clang_analyzer_eval(extInt == 2); // expected-warning{{TRUE}}
}

extern const int extInt = 2;

Breakpoint 1, (anonymous namespace)::RegionStoreManager::getBindingForVar (this=0xa7b420, B=..., R=0xa7d348)
    at /data/work/commitllvm/llvm/tools/clang/lib/StaticAnalyzer/Core/RegionStore.cpp:1948
1948        if (const Expr *Init = VD->getAnyInitializer()) {
(gdb) p VD->getInit()
$1 = (const clang::Expr *) 0x0
(gdb) p VD->getAnyInitializer()
$2 = (const clang::Expr *) 0xa4b630

[xazax.hun]

In D46421#1375147, @r.stahl wrote:

In D46421#1374807, @NoQ wrote:

At the same time, i don't have any test cases for the actual change in behavior that such canonicalization causes. If the test case that you had in mind is indeed demonstrating this problem, i'd love to have it. If it turns out that your test case doesn't allow us to demonstrate the problem without CTU, then probably it has something to do with ASTImporter accidentally canonicalizing the the declaration in DeclRefExpr more rarely than the vanilla AST.

This seems unrelated to CTU. The following subset of my test demonstrates this:

// RUN: %clang_analyze_cc1 -analyzer-checker=core,debug.ExprInspection -verify %s

void clang_analyzer_eval(int);

extern const int extInt;

int main()
{
    clang_analyzer_eval(extInt == 2); // expected-warning{{TRUE}}
}

extern const int extInt = 2;

Breakpoint 1, (anonymous namespace)::RegionStoreManager::getBindingForVar (this=0xa7b420, B=..., R=0xa7d348)
    at /data/work/commitllvm/llvm/tools/clang/lib/StaticAnalyzer/Core/RegionStore.cpp:1948
1948        if (const Expr *Init = VD->getAnyInitializer()) {
(gdb) p VD->getInit()
$1 = (const clang::Expr *) 0x0
(gdb) p VD->getAnyInitializer()
$2 = (const clang::Expr *) 0xa4b630

I know you probably tired of me making you split all the patches but I think if it is independent of CTU we should submit this fix as a separate commit. This way we could be more focused having one commit doing one thing.

[xazax.hun]

Thank you for working on this!

I have two concerns:

• The logic when should we import the initializer of a VarDecl is duplicated. I think to have better maintainability it would be better to have only one implementation of the decision in a function and call it multiple times.
• While the static analyzer is currently the only user of CTU lib it might change in the future. Only importing initializers of const variables is an analyzer specific decision which might not be good for other potential users of the CTU library. Maybe it would be better to be able to configure the ClangExtDefMapGen somehow, so it is able to both export only vardecls that are required by the analyzer or anything?

lib/CrossTU/CrossTranslationUnit.cpp

118

The != nullptr part is usually not written in LLVM codebase.

lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp

360

I wonder what would happen with types that has const fields and user written constructors. In case we will not simulate the effect of the constructor and will not be able to set the const fields maybe we should exclude those as well?

365

Maybe this check could be hoisted so we do not need to repeat in both branches?

372

Redundant != nullptr.

tools/clang-extdef-mapping/ClangExtDefMapGen.cpp

68 ↗

(On Diff #181263)

Variables should start with a capital letter.

[r.stahl]

Thanks for the comments! All good points. Nice idea with the constructor, but that can probably happen in a follow up patch.

In D46421#1380619, @xazax.hun wrote:

I know you probably tired of me making you split all the patches but I think if it is independent of CTU we should submit this fix as a separate commit. This way we could be more focused having one commit doing one thing.

No problem if I should do that. However I'm concerned whether this change is correct. Previously this was not required since all VarDecls were canonical. Not sure if this change was intended. I did some digging, but am not familiar enough with the code base to figure out what changed. Does anyone have an idea about this?

But I agree that if it wasn't a deliberate change, we could canonicalize in the DeclRegion constructor - or VarRegion since only those are redeclarable.

[martong]

Previously this was not required since all VarDecls were canonical. Not sure if this change was intended. I did some digging, but am not familiar enough with the code base to figure out what changed. Does anyone have an idea about this?

We changed the ASTImporter a few months ago to import the redecl chains properly. That means we do not squash ever decl into one decl. Also we link a newly imported decl to an already existing (found by the lookup). We allow only one definition of course. In case of variables we allow only one initializer. This way we can preserve the original structure of the AST in the most precise way.
I don't think this could be a problem, since we may have redecl chains of variables (and other kind of decls) in a single TU too.

[NoQ]

Fxd the global variable problem in D57619, thanks! I think you should change back to getInit() once D57619 lands.

[martong]

I think you should change back to getInit()

I am not entirely sure about this because the initalizer may not be attached to the canonical decl. getInit() gives the initializer of one given specific Decl, however, getAnyInitializer() searches through the whole redecl chain.

[NoQ]

In D46421#1382017, @martong wrote:

I think you should change back to getInit()

I am not entirely sure about this because the initalizer may not be attached to the canonical decl. getInit() gives the initializer of one given specific Decl, however, getAnyInitializer() searches through the whole redecl chain.

Ugh, indeed. getDefinition() is also not the thing we're looking for. What a mess :) Tests are welcome!~

P.S. I don't intend to block this patch; you guys know your stuff, i'm just displaying a bit of curiosity and observing how it unfolds.

[r.stahl]

Okay so I would suggest to go ahead and commit this. Rebased it succeeds without modification.

Still leaves the open problems with the redecls. Should I add the failing test from https://reviews.llvm.org/D46421#1375147 in the same commit marked as expected to fail? Or what is the procedure here?

[xazax.hun]

In D46421#1456155, @r.stahl wrote:

Okay so I would suggest to go ahead and commit this. Rebased it succeeds without modification.

Still leaves the open problems with the redecls. Should I add the failing test from https://reviews.llvm.org/D46421#1375147 in the same commit marked as expected to fail? Or what is the procedure here?

My last set of comments are also unresolved. Most of them are minor nits, but I would love to get rid of the code duplication between ClangExtDefMapGen and the Clang Static Analyzer regarding when do we consider a variable worth to import. Otherwise the patch looks good to me.

[r.stahl]

In D46421#1456171, @xazax.hun wrote:

My last set of comments are also unresolved. Most of them are minor nits, but I would love to get rid of the code duplication between ClangExtDefMapGen and the Clang Static Analyzer regarding when do we consider a variable worth to import. Otherwise the patch looks good to me.

Sorry, was too long ago, thought this was done!

What would be a good place for this? I'm thinking ExprClassification in the AST lib. There is a tail in IsModifiable that tests the CanQualType for const that could be moved out. And then make a new function bool ContainsConst(const VarDecl *VD) mabye? Shouldn't that be a new patch, because it touches the more critical AST lib?

[xazax.hun]

I cannot think of other users, so I would prefer to put it in the CTU lib for now.

[r.stahl]

• addressed review comments
• created cross_tu::containsConst
• fixed bug that unions were not exported
• added TODO test for constructor case

[r.stahl]

lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp

360

I added a test for that and it doesn't seem to work. It just ends up as unknown which is fine, right? Eventually it would be nice to do that of course.

[xazax.hun]

I have one question, once it is resolved I am fine with committing this.

lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp

356

Do we actually need this branch? I would expect cross_tu::containsConst(VD, *Ctx) to return true for all the cases where we would return true here.

[r.stahl]

@xazax.hun good point and that actually fixes a bug since that branch should also do the deep check. Added that to the tests.

[xazax.hun]

Looks good, thanks. Can you commit this or do you need someone to commit it on your behalf?

include/clang/CrossTU/CrossTranslationUnit.h

 
 namespace clang {
 class CompilerInstance;
 class ASTContext;
 class ASTImporter;
 class ASTUnit;
 class DeclContext;
 class FunctionDecl;
+class VarDecl;
 class NamedDecl;
 class TranslationUnitDecl;
 
 namespace cross_tu {
 
 enum class index_error_code {
   unspecified = 1,
   missing_index_file,
public:
   std::string getFileName() const { return FileName; }
 
 private:
   index_error_code Code;
   std::string FileName;
   int LineNo;
 };
 
-/// This function parses an index file that determines which
+/// \brief This function parses an index file that determines which
 ///        translation unit contains which definition.
 ///
 /// The index file format is the following:
 /// each line consists of an USR and a filepath separated by a space.
 ///
 /// \return Returns a map where the USR is the key and the filepath is the value
 ///         or an error.
 llvm::Expected<llvm::StringMap<std::string>>
 parseCrossTUIndex(StringRef IndexPath, StringRef CrossTUDir);
 
 std::string createCrossTUIndexString(const llvm::StringMap<std::string> &Index);
 
-/// This class is used for tools that requires cross translation
+/// \brief This class is used for tools that requires cross translation
 ///        unit capability.
 ///
-/// This class can load function definitions from external AST files.
+/// This class can load definitions from external AST files.
 /// The loaded definition will be merged back to the original AST using the
 /// AST Importer.
 /// In order to use this class, an index file is required that describes
-/// the locations of the AST files for each function definition.
+/// the locations of the AST files for each definition.
 ///
 /// Note that this class also implements caching.
 class CrossTranslationUnitContext {
 public:
   CrossTranslationUnitContext(CompilerInstance &CI);
   ~CrossTranslationUnitContext();
 
-  /// This function loads a function definition from an external AST
-  ///        file and merge it into the original AST.
+  /// \brief This function loads a function or variable definition from an
+  ///        external AST file and merges it into the original AST.
   ///
-  /// This method should only be used on functions that have no definitions in
-  /// the current translation unit. A function definition with the same
+  /// This method should only be used on functions that have no definitions or
+  //  variables that have no initializer in
+  /// the current translation unit. A definition with the same
   /// declaration will be looked up in the index file which should be in the
   /// \p CrossTUDir directory, called \p IndexName. In case the declaration is
   /// found in the index the corresponding AST file will be loaded and the
-  /// definition of the function will be merged into the original AST using
-  /// the AST Importer.
+  /// definition will be merged into the original AST using the AST Importer.
   ///
   /// \return The declaration with the definition will be returned.
   /// If no suitable definition is found in the index file or multiple
   /// definitions found error will be returned.
   ///
   /// Note that the AST files should also be in the \p CrossTUDir.
   llvm::Expected<const FunctionDecl *>
   getCrossTUDefinition(const FunctionDecl *FD, StringRef CrossTUDir,
                        StringRef IndexName);
+  llvm::Expected<const VarDecl *>
+  getCrossTUDefinition(const VarDecl *VD, StringRef CrossTUDir,
+                       StringRef IndexName);
 
-  /// This function loads a function definition from an external AST
-  ///        file.
+  /// \brief This function loads a definition from an external AST file.
   ///
-  /// A function definition with the same declaration will be looked up in the
+  /// A definition with the same declaration will be looked up in the
   /// index file which should be in the \p CrossTUDir directory, called
   /// \p IndexName. In case the declaration is found in the index the
   /// corresponding AST file will be loaded.
   ///
   /// \return Returns an ASTUnit that contains the definition of the looked up
-  /// function.
+  /// name.
   ///
   /// Note that the AST files should also be in the \p CrossTUDir.
   llvm::Expected<ASTUnit *> loadExternalAST(StringRef LookupName,
                                             StringRef CrossTUDir,
                                             StringRef IndexName);
 
-  /// This function merges a definition from a separate AST Unit into
+  /// \brief This function merges a definition from a separate AST Unit into
   ///        the current one which was created by the compiler instance that
   ///        was passed to the constructor.
   ///
   /// \return Returns the resulting definition or an error.
   llvm::Expected<const FunctionDecl *> importDefinition(const FunctionDecl *FD);
+  llvm::Expected<const VarDecl *> importDefinition(const VarDecl *VD);
 
-  /// Get a name to identify a function.
+  /// \brief Get a name to identify a named decl.
   static std::string getLookupName(const NamedDecl *ND);
 
-  /// Emit diagnostics for the user for potential configuration errors.
+  /// \brief Emit diagnostics for the user for potential configuration errors.
   void emitCrossTUDiagnostics(const IndexError &IE);
 
 private:
   ASTImporter &getOrCreateASTImporter(ASTContext &From);
-  const FunctionDecl *findFunctionInDeclContext(const DeclContext *DC,
-                                                StringRef LookupFnName);
+  template <typename T>
+  llvm::Expected<const T *> getCrossTUDefinitionImpl(const T *D,
+                                                     StringRef CrossTUDir,
+                                                     StringRef IndexName);
+  template <typename T>
+  const T *findDefInDeclContext(const DeclContext *DC,
+  template <typename T>
+  llvm::Expected<const T *> importDefinitionImpl(const T *D);
 
   llvm::StringMap<std::unique_ptr<clang::ASTUnit>> FileASTUnitMap;
-  llvm::StringMap<clang::ASTUnit *> FunctionASTUnitMap;
-  llvm::StringMap<std::string> FunctionFileMap;
+  llvm::StringMap<clang::ASTUnit *> NameASTUnitMap;
+  llvm::StringMap<std::string> NameFileMap;
   llvm::DenseMap<TranslationUnitDecl *, std::unique_ptr<ASTImporter>>
       ASTUnitImporterMap;
   CompilerInstance &CI;
   ASTContext &Context;
 };
 
 } // namespace cross_tu
 } // namespace clang
 
 #endif // LLVM_CLANG_CROSSTU_CROSSTRANSLATIONUNIT_H

lib/CrossTU/CrossTranslationUnit.cpp

parseCrossTUIndex(StringRef IndexPath, StringRef CrossTUDir) {
 
   llvm::StringMap<std::string> Result;
   std::string Line;
   unsigned LineNo = 1;
   while (std::getline(ExternalFnMapFile, Line)) {
     const size_t Pos = Line.find(" ");
     if (Pos > 0 && Pos != std::string::npos) {
       StringRef LineRef{Line};
-      StringRef FunctionLookupName = LineRef.substr(0, Pos);
-      if (Result.count(FunctionLookupName))
+      StringRef LookupName = LineRef.substr(0, Pos);
+      if (Result.count(LookupName))
         return llvm::make_error<IndexError>(
             index_error_code::multiple_definitions, IndexPath.str(), LineNo);
       StringRef FileName = LineRef.substr(Pos + 1);
       SmallString<256> FilePath = CrossTUDir;
       llvm::sys::path::append(FilePath, FileName);
-      Result[FunctionLookupName] = FilePath.str().str();
+      Result[LookupName] = FilePath.str().str();
     } else
       return llvm::make_error<IndexError>(
           index_error_code::invalid_index_format, IndexPath.str(), LineNo);
     LineNo++;
   }
   return Result;
 }
 
 std::string
 createCrossTUIndexString(const llvm::StringMap<std::string> &Index) {
   std::ostringstream Result;
   for (const auto &E : Index)
     Result << E.getKey().str() << " " << E.getValue() << '\n';
   return Result.str();
 }
 
+bool HasDefinition(const FunctionDecl *D, const FunctionDecl *&DefD) {
+  return D->hasBody(DefD);
+}
+bool HasDefinition(const VarDecl *D, const VarDecl *&DefD) {
+  return D->getAnyInitializer(DefD) != nullptr;
+}
+template <typename T> bool HasDefinition(const T *D) {
+  const T *Unused;
+  return HasDefinition(D, Unused);
+}
+
 CrossTranslationUnitContext::CrossTranslationUnitContext(CompilerInstance &CI)
     : CI(CI), Context(CI.getASTContext()) {}
 
 CrossTranslationUnitContext::~CrossTranslationUnitContext() {}
 
 std::string CrossTranslationUnitContext::getLookupName(const NamedDecl *ND) {
   SmallString<128> DeclUSR;
-  bool Ret = index::generateUSRForDecl(ND, DeclUSR); (void)Ret;
+  bool Ret = index::generateUSRForDecl(ND, DeclUSR);
+  (void)Ret;
   assert(!Ret && "Unable to generate USR");
   return DeclUSR.str();
 }
 
-/// Recursively visits the function decls of a DeclContext, and looks up a
-/// function based on USRs.
-const FunctionDecl *
-CrossTranslationUnitContext::findFunctionInDeclContext(const DeclContext *DC,
-                                                       StringRef LookupFnName) {
+/// Recursively visits the decls of a DeclContext, and returns one with the
+/// given USR.
+template <typename T>
+const T *
+CrossTranslationUnitContext::findDefInDeclContext(const DeclContext *DC,
   assert(DC && "Declaration Context must not be null");
   for (const Decl *D : DC->decls()) {
     const auto *SubDC = dyn_cast<DeclContext>(D);
     if (SubDC)
-      if (const auto *FD = findFunctionInDeclContext(SubDC, LookupFnName))
-        return FD;
+      if (const auto *ND = findDefInDeclContext<T>(SubDC, LookupFnName))
+        return ND;
 
-    const auto *ND = dyn_cast<FunctionDecl>(D);
-    const FunctionDecl *ResultDecl;
-    if (!ND || !ND->hasBody(ResultDecl))
+    const auto *ND = dyn_cast<T>(D);
+    const T *ResultDecl;
+    if (!ND || !HasDefinition(ND, ResultDecl))
       continue;
     if (getLookupName(ResultDecl) != LookupFnName)
       continue;
     return ResultDecl;
   }
   return nullptr;
 }
 
-llvm::Expected<const FunctionDecl *>
-CrossTranslationUnitContext::getCrossTUDefinition(const FunctionDecl *FD,
-                                                  StringRef CrossTUDir,
-                                                  StringRef IndexName) {
-  assert(!FD->hasBody() && "FD has a definition in current translation unit!");
-  const std::string LookupFnName = getLookupName(FD);
-  if (LookupFnName.empty())
+template <typename T>
+llvm::Expected<const T *> CrossTranslationUnitContext::getCrossTUDefinitionImpl(
+    const T *D, StringRef CrossTUDir, StringRef IndexName) {
+  assert(!HasDefinition(D) &&
+         "D has a definition in current translation unit!");
+  const std::string LookupName = getLookupName(D);
+  if (LookupName.empty())
     return llvm::make_error<IndexError>(
         index_error_code::failed_to_generate_usr);
   llvm::Expected<ASTUnit *> ASTUnitOrError =
-      loadExternalAST(LookupFnName, CrossTUDir, IndexName);
+      loadExternalAST(LookupName, CrossTUDir, IndexName);
   if (!ASTUnitOrError)
     return ASTUnitOrError.takeError();
   ASTUnit *Unit = *ASTUnitOrError;
   if (!Unit)
     return llvm::make_error<IndexError>(
         index_error_code::failed_to_get_external_ast);
   assert(&Unit->getFileManager() ==
          &Unit->getASTContext().getSourceManager().getFileManager());
 
   TranslationUnitDecl *TU = Unit->getASTContext().getTranslationUnitDecl();
-  if (const FunctionDecl *ResultDecl =
-          findFunctionInDeclContext(TU, LookupFnName))
+  if (const T *ResultDecl = findDefInDeclContext<T>(TU, LookupName))
     return importDefinition(ResultDecl);
   return llvm::make_error<IndexError>(index_error_code::failed_import);
 }
 
+llvm::Expected<const FunctionDecl *>
+CrossTranslationUnitContext::getCrossTUDefinition(const FunctionDecl *FD,
+                                                  StringRef CrossTUDir,
+                                                  StringRef IndexName) {
+  return getCrossTUDefinitionImpl(FD, CrossTUDir, IndexName);
+}
+
+llvm::Expected<const VarDecl *>
+CrossTranslationUnitContext::getCrossTUDefinition(const VarDecl *VD,
+                                                  StringRef CrossTUDir,
+                                                  StringRef IndexName) {
+  return getCrossTUDefinitionImpl(VD, CrossTUDir, IndexName);
+}
+
 void CrossTranslationUnitContext::emitCrossTUDiagnostics(const IndexError &IE) {
   switch (IE.getCode()) {
   case index_error_code::missing_index_file:
     Context.getDiagnostics().Report(diag::err_fe_error_opening)
         << IE.getFileName() << "required by the CrossTU functionality";
     break;
   case index_error_code::invalid_index_format:
     Context.getDiagnostics().Report(diag::err_fnmap_parsing)
         << IE.getFileName() << IE.getLineNum();
     break;
   case index_error_code::multiple_definitions:
     Context.getDiagnostics().Report(diag::err_multiple_def_index)
         << IE.getLineNum();
     break;
   default:
     break;
   }
 }
 
 llvm::Expected<ASTUnit *> CrossTranslationUnitContext::loadExternalAST(
     StringRef LookupName, StringRef CrossTUDir, StringRef IndexName) {
-  // FIXME: The current implementation only supports loading functions with
+  // FIXME: The current implementation only supports loading decls with
   //        a lookup name from a single translation unit. If multiple
-  //        translation units contains functions with the same lookup name an
+  //        translation units contain decls with the same lookup name an
   //        error will be returned.
   ASTUnit *Unit = nullptr;
-  auto FnUnitCacheEntry = FunctionASTUnitMap.find(LookupName);
-  if (FnUnitCacheEntry == FunctionASTUnitMap.end()) {
-    if (FunctionFileMap.empty()) {
+  auto NameUnitCacheEntry = NameASTUnitMap.find(LookupName);
+  if (NameUnitCacheEntry == NameASTUnitMap.end()) {
+    if (NameFileMap.empty()) {
       SmallString<256> IndexFile = CrossTUDir;
       if (llvm::sys::path::is_absolute(IndexName))
         IndexFile = IndexName;
       else
         llvm::sys::path::append(IndexFile, IndexName);
       llvm::Expected<llvm::StringMap<std::string>> IndexOrErr =
           parseCrossTUIndex(IndexFile, CrossTUDir);
       if (IndexOrErr)
-        FunctionFileMap = *IndexOrErr;
+        NameFileMap = *IndexOrErr;
       else
         return IndexOrErr.takeError();
     }
 
-    auto It = FunctionFileMap.find(LookupName);
-    if (It == FunctionFileMap.end())
+    auto It = NameFileMap.find(LookupName);
+    if (It == NameFileMap.end())
       return llvm::make_error<IndexError>(index_error_code::missing_definition);
     StringRef ASTFileName = It->second;
     auto ASTCacheEntry = FileASTUnitMap.find(ASTFileName);
     if (ASTCacheEntry == FileASTUnitMap.end()) {
       IntrusiveRefCntPtr<DiagnosticOptions> DiagOpts = new DiagnosticOptions();
       TextDiagnosticPrinter *DiagClient =
           new TextDiagnosticPrinter(llvm::errs(), &*DiagOpts);
       IntrusiveRefCntPtr<DiagnosticIDs> DiagID(new DiagnosticIDs());
       IntrusiveRefCntPtr<DiagnosticsEngine> Diags(
           new DiagnosticsEngine(DiagID, &*DiagOpts, DiagClient));
 
       std::unique_ptr<ASTUnit> LoadedUnit(ASTUnit::LoadFromASTFile(
           ASTFileName, CI.getPCHContainerOperations()->getRawReader(),
           ASTUnit::LoadEverything, Diags, CI.getFileSystemOpts()));
       Unit = LoadedUnit.get();
       FileASTUnitMap[ASTFileName] = std::move(LoadedUnit);
     } else {
       Unit = ASTCacheEntry->second.get();
     }
-    FunctionASTUnitMap[LookupName] = Unit;
+    NameASTUnitMap[LookupName] = Unit;
   } else {
-    Unit = FnUnitCacheEntry->second;
+    Unit = NameUnitCacheEntry->second;
   }
   return Unit;
 }
 
+template <typename T>
+llvm::Expected<const T *>
+CrossTranslationUnitContext::importDefinitionImpl(const T *D) {
+  ASTImporter &Importer = getOrCreateASTImporter(D->getASTContext());
+  auto *ToDecl = dyn_cast_or_null<T>(Importer.Import(const_cast<T *>(D)));
+  if (!ToDecl)
+    return llvm::make_error<IndexError>(index_error_code::failed_import);
+  assert(HasDefinition(ToDecl));
+  assert(HasDefinition(D) &&
+         "Decls already imported should have a definition.");
+  return ToDecl;
+}
+
 llvm::Expected<const FunctionDecl *>
 CrossTranslationUnitContext::importDefinition(const FunctionDecl *FD) {
-  ASTImporter &Importer = getOrCreateASTImporter(FD->getASTContext());
-  auto *ToDecl =
-      cast<FunctionDecl>(Importer.Import(const_cast<FunctionDecl *>(FD)));
-  assert(ToDecl->hasBody());
-  assert(FD->hasBody() && "Functions already imported should have body.");
-  return ToDecl;
+  return importDefinitionImpl(FD);
+}
+
+llvm::Expected<const VarDecl *>
+CrossTranslationUnitContext::importDefinition(const VarDecl *VD) {
+  return importDefinitionImpl(VD);
 }
 
 ASTImporter &
 CrossTranslationUnitContext::getOrCreateASTImporter(ASTContext &From) {
   auto I = ASTUnitImporterMap.find(From.getTranslationUnitDecl());
   if (I != ASTUnitImporterMap.end())
     return *I->second;
   ASTImporter *NewImporter =
       new ASTImporter(Context, Context.getSourceManager().getFileManager(),
                       From, From.getSourceManager().getFileManager(), false);
   ASTUnitImporterMap[From.getTranslationUnitDecl()].reset(NewImporter);
   return *NewImporter;
 }
 
 } // namespace cross_tu
 } // namespace clang

lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp

#include "clang/StaticAnalyzer/Core/Analyses.def"
   /// Handle callbacks for arbitrary Decls.
   bool VisitDecl(Decl *D) {
     AnalysisMode Mode = getModeForDecl(D, RecVisitorMode);
     if (Mode & AM_Syntax)
       checkerMgr->runCheckersOnASTDecl(D, *Mgr, *RecVisitorBR);
     return true;
   }
 
+  bool VisitVarDecl(VarDecl *VD) {
+    if (!Opts->naiveCTUEnabled())
+      return true;
+
+    if (!VD->hasExternalStorage() ||
+        VD->getAnyInitializer() != nullptr)
+      return true;
+
+    llvm::Expected<const VarDecl *> CTUDeclOrError =
+      CTU.getCrossTUDefinition(VD, Opts->getCTUDir(), Opts->getCTUIndexName());
+
+    if (!CTUDeclOrError) {
+      handleAllErrors(CTUDeclOrError.takeError(),
+                      [&](const cross_tu::IndexError &IE) {
+                        CTU.emitCrossTUDiagnostics(IE);
+                      });
+    }
+
+    return true;
+  }
+
   bool VisitFunctionDecl(FunctionDecl *FD) {
     IdentifierInfo *II = FD->getIdentifier();
     if (II && II->getName().startswith("__inline"))
       return true;
 
     // We skip function template definitions, as their semantics is
     // only determined when they are instantiated.
     if (FD->isThisDeclarationADefinition() &&
         !FD->isDependentContext()) {
       assert(RecVisitorMode == AM_Syntax || Mgr->shouldInlineCall() == false);
       HandleCode(FD, RecVisitorMode);

test/Analysis/Inputs/ctu-other.cpp

 
 int chf1(int x) {
   return chf2(x);
 }
 }
 
 typedef struct { int n; } Anonymous;
 int fun_using_anon_struct(int n) { Anonymous anon; anon.n = n; return anon.n; }
+
+extern const int extInt = 2;
+namespace intns {
+extern const int extInt = 3;
+}
+struct S {
+  int a;
+};
+extern const S extS = {.a = 4};

test/Analysis/Inputs/externalFnMap.txt

 c:@N@chns@F@chf1#I# ctu-other.cpp.ast
 c:@N@myns@N@embed_ns@F@fens#I# ctu-other.cpp.ast
 c:@F@g#I# ctu-other.cpp.ast
 c:@S@mycls@F@fscl#I#S ctu-other.cpp.ast
 c:@S@mycls@F@fcl#I# ctu-other.cpp.ast
 c:@N@myns@S@embed_cls@F@fecl#I# ctu-other.cpp.ast
 c:@S@mycls@S@embed_cls2@F@fecl2#I# ctu-other.cpp.ast
 c:@F@f#I# ctu-other.cpp.ast
 c:@N@myns@F@fns#I# ctu-other.cpp.ast
 c:@F@h#I# ctu-other.cpp.ast
 c:@F@h_chain#I# ctu-chain.cpp.ast
 c:@N@chns@S@chcls@F@chf4#I# ctu-chain.cpp.ast
 c:@N@chns@F@chf2#I# ctu-chain.cpp.ast
 c:@F@fun_using_anon_struct#I# ctu-other.cpp.ast
+c:@extInt ctu-other.cpp.ast
+c:@N@intns@extInt ctu-other.cpp.ast
+c:@extS ctu-other.cpp.ast

test/Analysis/ctu-main.cpp

 };
 
 namespace chns {
 int chf1(int x);
 }
 
 int fun_using_anon_struct(int);
 
+extern const int extInt;
+namespace intns {
+extern const int extInt;
+}
+struct S {
+  int a;
+};
+extern const S extS;
+
 int main() {
   clang_analyzer_eval(f(3) == 2); // expected-warning{{TRUE}}
   clang_analyzer_eval(f(4) == 3); // expected-warning{{TRUE}}
   clang_analyzer_eval(f(5) == 3); // expected-warning{{FALSE}}
   clang_analyzer_eval(g(4) == 6); // expected-warning{{TRUE}}
   clang_analyzer_eval(h(2) == 8); // expected-warning{{TRUE}}
 
   clang_analyzer_eval(myns::fns(2) == 9);                   // expected-warning{{TRUE}}
   clang_analyzer_eval(myns::embed_ns::fens(2) == -1);       // expected-warning{{TRUE}}
   clang_analyzer_eval(mycls().fcl(1) == 6);                 // expected-warning{{TRUE}}
   clang_analyzer_eval(mycls::fscl(1) == 7);                 // expected-warning{{TRUE}}
   clang_analyzer_eval(myns::embed_cls().fecl(1) == -6);     // expected-warning{{TRUE}}
   clang_analyzer_eval(mycls::embed_cls2().fecl2(0) == -11); // expected-warning{{TRUE}}
 
   clang_analyzer_eval(chns::chf1(4) == 12); // expected-warning{{TRUE}}
   clang_analyzer_eval(fun_using_anon_struct(8) == 8); // expected-warning{{TRUE}}
+
+  clang_analyzer_eval(extInt == 2); // expected-warning{{TRUE}}
+  clang_analyzer_eval(intns::extInt == 3); // expected-warning{{TRUE}}
+  clang_analyzer_eval(extS.a == 4); // expected-warning{{TRUE}}
 }

test/Analysis/func-mapping-test.cpp

 // RUN: %clang_func_map %s -- | FileCheck %s
 
 int f(int) {
   return 0;
 }
+// CHECK-DAG: c:@F@f#I#
 
-// CHECK: c:@F@f#I#
+int x = 5;
+// CHECK-DAG: c:@x
+
+struct S {
+  int a;
+};
+S s = {.a = 2};
+// CHECK-DAG: c:@s
+
+int arr[5] = { 0, 1 };
+// CHECK-DAG: c:@arr