[frontend] [analyzer] Provide an option to load a checker from a declarative file

[george.karpenkov]

Summary

Many non-compiler-engineers would like to write simple AST checkers.
The necessity to compile the compiler often becomes an impenetrable obstacle for them (further complicated by the fact that in a corporate setup often a *specific* version of the compiler is required to compile the given project).

This patch adds a an ability to load a checker from a YAML file with a very simple grammar, significantly lowering the entry bar for the authorship to AST-based checkers.

Short FAQ I anticipate:

Q: Why not just use clang-query?
A: This is a very similar approach, but meant to be friendly to the build system, so the new checker can be run on the entire codebase at once.

Q: Why not put it in clang-tidy?
A: Again, in order to be friendly to the build system. With this setup, it's sufficient to add an extra line to CFLAGS. Doing that with clang-tidy could be more difficult, as not all projects are based on a compilation database (and currently Apple does not even ship clang-tidy in the toolchain).

Q: How expensive is linking Clang with dynamic AST matchers?
A: We already link with static AST matchers, so this change should not matter much. Changes I've seen are below few percent.

Q: Why not give the ability to load multiple files which checker descriptions at once?
A: Currently it's not done due to a technical limitation in CheckerRegistry, to be addressed in subsequent patches.

[alexfh]

That's an awesome idea! Did you think about supporting automated fix-it suggestions?

clang/include/clang/StaticAnalyzer/Core/AnalyzerOptions.h

135

The name is quite verbose, but misses the important detail. DeclarativeCheckerFiles or DeclarativeCheckerFileNames, maybe?

clang/include/clang/StaticAnalyzer/Frontend/DeclarativeChecker.h

36

Why Matcher<Decl>? What if the user needs to match a Stmt?
Can we avoid using a class from the internal namespace of ast_matchers?

37

llvm::StringMap<std::string>?

clang/lib/StaticAnalyzer/Frontend/CheckerRegistration.cpp

130

const std::string &?

clang/lib/StaticAnalyzer/Frontend/DeclarativeChecker.cpp

33

nit: I'd remove the empty line at the top.

125–128

I'd put this branch first and remove the else.

126

Do you want to print the error code as well?

131

Maybe return llvm::ErrorOr<...> instead of llvm::Optional<...> and report the errors outside of this method?

153–154

Why can't we store a DynTypedMatcher without converting it to Matcher<Decl>? The former is a public interface and the latter is an internal one.

159–168

The returned function is executed (almost) right after this method returns. This pattern looks a bit strange. Can the method just call Registry.addChecker directly? Or can it return DeclarativeChecker (or llvm::ErrorOr<DeclarativeChecker>)?

clang/test/Analysis/declarative/failed_matcher.yaml

9–11

Is (((()))) actually a valid matcher for a variable declaration?

[george.karpenkov]

clang/include/clang/StaticAnalyzer/Core/AnalyzerOptions.h

135

Yep, should be fixed.

clang/include/clang/StaticAnalyzer/Frontend/DeclarativeChecker.h

36

Hm, so I've started with a DynTypedMatcher, but I think that makes code worse.
The current code force-wraps everything into a decl matcher, with forEachDescendant inside, as there's always a top-level TranslationUnitDecl.

37

Yep. Also I do think that performance nitpick in the driver code somewhat miss the point :P

clang/lib/StaticAnalyzer/Frontend/CheckerRegistration.cpp

130

yep

clang/lib/StaticAnalyzer/Frontend/DeclarativeChecker.cpp

33

ok

126

Do you know how to translate it to something useful? Where are those codes are even defined?

131

and then do what with an error code? Also outside this method we can't tell whether we've failed due to file not found / YAML parsing failed / AST matcher parsing failed.

159–168

Hm, I'm not sure. It could be changed to call Registry.addChecker, but that somewhat violates layering, as it's nice to see all calls to the registry in the registry handling .cpp file.

clang/test/Analysis/declarative/failed_matcher.yaml

9–11

The point of this test is to check that we get a reasonable error message from the parser.

[george.karpenkov]

That's an awesome idea!

Thanks!

Did you think about supporting automated fix-it suggestions?

Not really, I think of this as a "semantic-aware grep".

[george.karpenkov]

clang/lib/StaticAnalyzer/Frontend/DeclarativeChecker.cpp

33

actually, no: I think an empty line above a doxygen comment improves readability.

153–154

OK so I've started with a DynTypedMatcher.
It has a couple of problems:

• We have to use the annoying custom callback and can't just iterate over results
• We can't store it, as adding it to the finder can fail, and it's too late to bail out with a diagnostics by then
• We can store the finder, to which the matcher is already added. But then we have to also initialize it pointing to an existing container to put matches into, which is wrong at checker creation type.

[NoQ]

clang/lib/StaticAnalyzer/Frontend/DeclarativeChecker.cpp

114–116

Hmm, maybe first parse the string, and then add decl(forEachDescendant(...)) around the matcher object?

178–179

Maybe warn the developer so that they don't spend hours figuring out why their matcher isn't matching anything?

clang/include/clang/Basic/DiagnosticFrontendKinds.td

def warn_unknown_diag_option : Warning<
     "unknown %select{warning|remark}0 option '%1'%select{|; did you mean '%3'?}2">,
     InGroup<UnknownWarningOption>;
 def warn_unknown_warning_specifier : Warning<
     "unknown %0 warning specifier: '%1'">,
     InGroup<UnknownWarningOption>;
 
 def err_unknown_analyzer_checker : Error<
     "no analyzer checkers are associated with '%0'">;
+def err_declarative_checker_yaml_parsing : Error<
+    "failed parsing declarative checker from YAML (read from file '%0')">;
+def err_declarative_checker_file_not_found: Error<
+    "file '%0' with a checker description not found">;
+def err_declarative_checker_misformed_matcher: Error<
+    "failed parsing matcher from file '%0': '%1'">;
 def note_suggest_disabling_all_checkers : Note<
     "use -analyzer-disable-all-checks to disable all static analyzer checkers">;
 
 def warn_incompatible_analyzer_plugin_api : Warning<
     "checker plugin '%0' is not compatible with this version of the analyzer">,
     InGroup<DiagGroup<"analyzer-incompatible-plugin"> >;
 def note_incompatible_analyzer_plugin_api : Note<
     "current API version is '%0', but plugin was compiled with version '%1'">;

clang/include/clang/Basic/DiagnosticIDs.h

namespace clang {
   class SourceLocation;
 
   // Import the diagnostic enums themselves.
   namespace diag {
     // Size of each of the diagnostic categories.
     enum {
       DIAG_SIZE_COMMON        =  300,
       DIAG_SIZE_DRIVER        =  200,
-      DIAG_SIZE_FRONTEND      =  100,
+      DIAG_SIZE_FRONTEND      =  200,
       DIAG_SIZE_SERIALIZATION =  120,
       DIAG_SIZE_LEX           =  400,
       DIAG_SIZE_PARSE         =  500,
       DIAG_SIZE_AST           =  150,
       DIAG_SIZE_COMMENT       =  100,
       DIAG_SIZE_CROSSTU       =  100,
       DIAG_SIZE_SEMA          = 3500,
       DIAG_SIZE_ANALYSIS      =  100,

clang/include/clang/Driver/CC1Options.td

ValuesCode<[{
     #define PACKAGE(FULLNAME, G, D)  FULLNAME ","
     #include "clang/StaticAnalyzer/Checkers/Checkers.inc"
     #undef GET_PACKAGES
     ;
   }]>;
 def analyzer_checker_EQ : Joined<["-"], "analyzer-checker=">,
   Alias<analyzer_checker>;
 
+def analyzer_load_checker : Separate<["-"], "analyzer-load-checker">,
+  HelpText<"Load a checker declaratively">;
+
 def analyzer_disable_checker : Separate<["-"], "analyzer-disable-checker">,
   HelpText<"Choose analyzer checkers to disable">;
 def analyzer_disable_checker_EQ : Joined<["-"], "analyzer-disable-checker=">,
   Alias<analyzer_disable_checker>;
 
 def analyzer_disable_all_checks : Flag<["-"], "analyzer-disable-all-checks">,
   HelpText<"Disable all static analyzer checks">;
 

clang/include/clang/StaticAnalyzer/Core/AnalyzerOptions.h

 public:
   using ConfigTable = llvm::StringMap<std::string>;
 
   static std::vector<StringRef>
   getRegisteredCheckers(bool IncludeExperimental = false);
 
   /// Pair of checker name and enable/disable.
   std::vector<std::pair<std::string, bool>> CheckersControlList;
-  
+  /// A vector of declarative checker filenames which should be loaded.
+  std::vector<std::string> DeclarativeCheckerFileNames;
+  
   /// A key-value table of use-specified configuration values.
   ConfigTable Config;
   AnalysisStores AnalysisStoreOpt = RegionStoreModel;
   AnalysisConstraints AnalysisConstraintsOpt = RangeConstraintsModel;
   AnalysisDiagClients AnalysisDiagOpt = PD_HTML;
   AnalysisPurgeMode AnalysisPurgeOpt = PurgeStmt;
   
   std::string AnalyzeSpecificFunction;

clang/include/clang/StaticAnalyzer/Core/CheckerRegistry.h

 /// a package will recursively include all subpackages and checkers within it.
 /// For example, the checker "core.builtin.NoReturnFunctionChecker" will be
 /// included if initializeManager() is called with an option of "core",
 /// "core.builtin", or the full name "core.builtin.NoReturnFunctionChecker".
 class CheckerRegistry {
 public:
   /// Initialization functions perform any necessary setup for a checker.
   /// They should include a call to CheckerManager::registerChecker.
-  using InitializationFunction = void (*)(CheckerManager &);
+  using InitializationFunction = std::function<void(CheckerManager &)>;
 
   struct CheckerInfo {
     InitializationFunction Initialize;
-    StringRef FullName;
-    StringRef Desc;
+    std::string FullName;
+    std::string Desc;
 
     CheckerInfo(InitializationFunction fn, StringRef name, StringRef desc)
         : Initialize(fn), FullName(name), Desc(desc) {}
   };
 
   using CheckerInfoList = std::vector<CheckerInfo>;
 
 private:

clang/include/clang/StaticAnalyzer/Frontend/DeclarativeChecker.h

+//= DeclarativeChecker.h - Classes for representing declarations *- C++ -*-===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// This file defines a DeclarativeChecker, which is defined by an ASTChecker
+// string loaded from a user-provided file in YAML format.
+// The user-provided file additionally specifies which warnings should be
+// emitted on which bound nodes.
+//
+//
+//===----------------------------------------------------------------------===//
+
+#ifndef LLVM_CLANG_STATICANALYZER_DECLARATIVECHECKER_H
+#define LLVM_CLANG_STATICANALYZER_DECLARATIVECHECKER_H
+
+#include "clang/ASTMatchers/Dynamic/Parser.h"
+#include "clang/ASTMatchers/ASTMatchFinder.h"
+#include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
+#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
+#include "llvm/ADT/Twine.h"
+
+using namespace clang::ast_matchers::dynamic;
+
+namespace clang {
+namespace ento {
+
+class DeclarativeChecker : public Checker<check::ASTCodeBody> {
+  ast_matchers::internal::Matcher<Decl> Matcher;
+  llvm::StringMap<std::string> WarningsMap;
+  std::string CheckerCategory;
+  std::string CheckerName;
+
+public:
+  DeclarativeChecker(ast_matchers::internal::Matcher<Decl> Matcher,
+                     llvm::StringMap<std::string> WarningsMap,
+                     std::string CheckerCategory,
+                     std::string CheckerName) :
+    Matcher(Matcher),
+    WarningsMap(WarningsMap),
+    CheckerCategory(CheckerCategory),
+    CheckerName(CheckerName) {}
+
+  void checkASTCodeBody(const Decl *D,
+                        AnalysisManager &AM,
+                        BugReporter &BR) const;
+
+  static void registerCheckerFromFilename(llvm::StringRef Filename,
+                                          CheckerRegistry &Registry,
+                                          DiagnosticsEngine &Diags);
+};
+
+} // ento
+} // clang
+
+#endif // LLVM_CLANG_STATICANALYZER_DECLARATIVECHECKER_H

clang/lib/Frontend/CompilerInvocation.cpp

for (const Arg *A :
     // '-analyzer-checker=cocoa,unix'
     StringRef checkerList = A->getValue();
     SmallVector<StringRef, 4> checkers;
     checkerList.split(checkers, ",");
     for (auto checker : checkers)
       Opts.CheckersControlList.emplace_back(checker, enable);
   }
 
+  // Populate the list of filenames from which declarative checkers
+  // should be loaded.
+  for (const Arg *A : Args.filtered(OPT_analyzer_load_checker)) {
+    A->claim();
+    // FIXME: supporting multiple checkers
+    StringRef checkerToLoad = A->getValue();
+    Opts.DeclarativeCheckerFileNames.push_back(checkerToLoad);
+  }
+
   // Go through the analyzer configuration options.
   for (const auto *A : Args.filtered(OPT_analyzer_config)) {
     A->claim();
     // We can have a list of comma separated config names, e.g:
     // '-analyzer-config key1=val1,key2=val2'
     StringRef configList = A->getValue();
     SmallVector<StringRef, 4> configVals;
     configList.split(configVals, ",");

clang/lib/StaticAnalyzer/Core/CheckerRegistry.cpp

 static bool checkerNameLT(const CheckerRegistry::CheckerInfo &a,
                           const CheckerRegistry::CheckerInfo &b) {
   return a.FullName < b.FullName;
 }
 
 static bool isInPackage(const CheckerRegistry::CheckerInfo &checker,
                         StringRef packageName) {
   // Does the checker's full name have the package as a prefix?
-  if (!checker.FullName.startswith(packageName))
+  if (!StringRef(checker.FullName).startswith(packageName))
     return false;
 
   // Is the package actually just the name of a specific checker?
   if (checker.FullName.size() == packageName.size())
     return true;
 
   // Is the checker in the package (or a subpackage)?
   if (checker.FullName[packageName.size()] == PackageSeparator)
void CheckerRegistry::validateCheckerOptions(const AnalyzerOptions &opts,
   for (const auto &config : opts.Config) {
     size_t pos = config.getKey().find(':');
     if (pos == StringRef::npos)
       continue;
 
     bool hasChecker = false;
     StringRef checkerName = config.getKey().substr(0, pos);
     for (const auto &checker : Checkers) {
-      if (checker.FullName.startswith(checkerName) &&
+      if (StringRef(checker.FullName).startswith(checkerName) &&
           (checker.FullName.size() == pos || checker.FullName[pos] == '.')) {
         hasChecker = true;
         break;
       }
     }
     if (!hasChecker)
       diags.Report(diag::err_unknown_analyzer_checker) << checkerName;
   }

clang/lib/StaticAnalyzer/Frontend/CMakeLists.txt

 include_directories( ${CMAKE_CURRENT_BINARY_DIR}/../Checkers )
 
 set(LLVM_LINK_COMPONENTS
   Support
   )
 
 add_clang_library(clangStaticAnalyzerFrontend
   AnalysisConsumer.cpp
   CheckerRegistration.cpp
+  DeclarativeChecker.cpp
   FrontendActions.cpp
   ModelConsumer.cpp
   ModelInjector.cpp
 
   LINK_LIBS
   clangAST
+  clangDynamicASTMatchers
   clangAnalysis
   clangBasic
   clangCrossTU
   clangFrontend
   clangLex
   clangStaticAnalyzerCheckers
   clangStaticAnalyzerCore
   )

clang/lib/StaticAnalyzer/Frontend/CheckerRegistration.cpp

 #include "clang/Basic/Diagnostic.h"
 #include "clang/Frontend/FrontendDiagnostic.h"
 #include "clang/StaticAnalyzer/Checkers/ClangCheckers.h"
 #include "clang/StaticAnalyzer/Core/AnalyzerOptions.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/CheckerOptInfo.h"
 #include "clang/StaticAnalyzer/Core/CheckerRegistry.h"
 #include "clang/StaticAnalyzer/Frontend/FrontendActions.h"
+#include "clang/StaticAnalyzer/Frontend/DeclarativeChecker.h"
 #include "llvm/ADT/SmallVector.h"
 #include "llvm/Support/DynamicLibrary.h"
 #include "llvm/Support/Path.h"
 #include "llvm/Support/raw_ostream.h"
 #include <memory>
 
 using namespace clang;
 using namespace ento;
std::unique_ptr<CheckerManager> ento::createCheckerManager(
 
   SmallVector<CheckerOptInfo, 8> checkerOpts = getCheckerOptList(opts);
 
   ClangCheckerRegistry allCheckers(plugins, &diags);
 
   for (const auto &Fn : checkerRegistrationFns)
     Fn(allCheckers);
 
+  for (std::string &CheckerFile : opts.DeclarativeCheckerFileNames)
+    DeclarativeChecker::registerCheckerFromFilename(CheckerFile, allCheckers,
+                                                    diags);
+
   allCheckers.initializeManager(*checkerMgr, checkerOpts);
   allCheckers.validateCheckerOptions(opts, diags);
   checkerMgr->finishedCheckerRegistration();
 
   for (unsigned i = 0, e = checkerOpts.size(); i != e; ++i) {
     if (checkerOpts[i].isUnclaimed()) {
       diags.Report(diag::err_unknown_analyzer_checker)
           << checkerOpts[i].getName();

clang/lib/StaticAnalyzer/Frontend/DeclarativeChecker.cpp

+//===- DeclarativeChecker.cpp ------------------------------------*- C++ -*-==//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// Implementation for the DeclarativeChecker
+//
+//===----------------------------------------------------------------------===//
+
+#include "clang/AST/Decl.h"
+#include "clang/ASTMatchers/Dynamic/Parser.h"
+#include "clang/StaticAnalyzer/Core/CheckerManager.h"
+#include "clang/ASTMatchers/Dynamic/Diagnostics.h"
+#include "clang/StaticAnalyzer/Core/CheckerRegistry.h"
+#include "clang/Basic/Diagnostic.h"
+#include "clang/Frontend/FrontendDiagnostic.h"
+#include "clang/StaticAnalyzer/Frontend/DeclarativeChecker.h"
+#include "llvm/ObjectYAML/YAML.h"
+#include "llvm/Support/YAMLParser.h"
+#include "llvm/Support/YAMLTraits.h"
+
+using namespace clang;
+using namespace ento;
+using namespace ast_matchers;
+using namespace ast_matchers::dynamic;
+
+struct DeclarativeCheckerInfo {
+
+  /// Name of the checker.
+  std::string Name;
+
+  /// Description of the checker.
+  std::string Description;
+
+  /// Category for the warning.
+  std::string Category;
+
+  /// Declarative matcher used by the checker,
+  /// *including* the bindings.
+  std::string ASTMatcher;
+
+  /// Mapping from bindings to produced warnings.
+  llvm::StringMap<std::string> Warnings;
+};
+
+
+namespace llvm {
+namespace yaml {
+
+template <> struct MappingTraits<DeclarativeCheckerInfo> {
+  static void mapping(IO &Io, DeclarativeCheckerInfo &Obj) {
+    Io.mapRequired("name", Obj.Name);
+    Io.mapRequired("description", Obj.Description);
+    Io.mapRequired("category", Obj.Category);
+    Io.mapRequired("ast_matcher", Obj.ASTMatcher);
+    Io.mapRequired("warnings", Obj.Warnings);
+  }
+};
+
+template <>
+struct CustomMappingTraits<llvm::StringMap<std::string>> {
+  static void inputOne(IO &io, StringRef Key,
+                       llvm::StringMap<std::string> &V) {
+    io.mapRequired(Key.str().c_str(), V[Key]);
+  }
+
+  static void output(IO &io, llvm::StringMap<std::string> &V) {
+    for (auto &P : V)
+      io.mapRequired(P.first().data(), P.second);
+  }
+};
+
+} // yaml
+} // llvm
+
+static Optional<DeclarativeCheckerInfo>
+loadCheckerInfoFromFilename(llvm::StringRef Filename,
+                            DiagnosticsEngine &Diags) {
+  llvm::ErrorOr<std::unique_ptr<llvm::MemoryBuffer>> ExpectedMemoryBuffer =
+      llvm::MemoryBuffer::getFile(Filename);
+  // FIXME: should we show the error code?
+  std::error_code E = ExpectedMemoryBuffer.getError();
+  if (!E) {
+    std::unique_ptr<llvm::MemoryBuffer> MemoryBuffer =
+        std::move(ExpectedMemoryBuffer.get());
+    llvm::yaml::Input Yin(*MemoryBuffer);
+    DeclarativeCheckerInfo Benchmark;
+    Yin >> Benchmark;
+    if (Yin.error()) {
+      Diags.Report(diag::err_declarative_checker_yaml_parsing)
+          << Filename;
+      return None;
+    }
+    return Benchmark;
+  } else {
+    Diags.Report(diag::err_declarative_checker_file_not_found) << Filename;
+    return None;
+  }
+}
+
+void DeclarativeChecker::registerCheckerFromFilename(
+    llvm::StringRef Filename, CheckerRegistry &Registry,
+    DiagnosticsEngine &Diags) {
+  llvm::Optional<DeclarativeCheckerInfo> Info =
+      loadCheckerInfoFromFilename(Filename, Diags);
+
+  if (!Info)
+    return;
+
+  // Force the matcher to be be a decl matcher.
+  // This works, as everything is wrapped in a top-level decl.
+  std::string ASTMatcher = "decl(forEachDescendant(" + Info->ASTMatcher + "))";
+
+  Diagnostics ParserDiag;
+  Optional<DynTypedMatcher> DynMatcher = Parser::parseMatcherExpression(
+      ASTMatcher, /*Sema=*/nullptr, /*NamedValueMap=*/nullptr, &ParserDiag);
+
+  if (!DynMatcher) {
+    Diags.Report(diag::err_declarative_checker_misformed_matcher)
+      << Filename << ParserDiag.toStringFull();
+    return;
+  }
+
+  ast_matchers::internal::Matcher<Decl> DeclMatcher =
+      DynMatcher->convertTo<Decl>();
+
+  // Capture by value is required, as ownership is transferred to the callback.
+  DeclarativeCheckerInfo CInfo = *Info;
+  Registry.addChecker(
+      [DeclMatcher, CInfo](CheckerManager &Mgr) {
+        return Mgr.registerChecker<DeclarativeChecker>(
+            DeclMatcher, CInfo.Warnings, CInfo.Category, CInfo.Name);
+      },
+      CInfo.Name, CInfo.Description);
+}
+
+template <typename T>
+static void emitReport(AnalysisDeclContext *ADC, BugReporter &BR,
+                       const DeclarativeChecker *Checker,
+                       const StringRef WarningTxt,
+                       const StringRef CheckerCategory,
+                       T Node) {
+
+  PathDiagnosticLocation Location =
+      PathDiagnosticLocation::createBegin(Node, BR.getSourceManager(), ADC);
+
+  clang::SourceRange Range = Node->getSourceRange();
+
+  BR.EmitBasicReport(ADC->getDecl(), Checker, WarningTxt, CheckerCategory,
+                     WarningTxt, Location, Range);
+}
+
+void DeclarativeChecker::checkASTCodeBody(const Decl *D,
+                                          AnalysisManager &AM,
+                                          BugReporter &BR) const {
+  AnalysisDeclContext *ADC = AM.getAnalysisDeclContext(D);
+  auto Matches = match(Matcher, *D, AM.getASTContext());
+
+  for (BoundNodes Match : Matches) {
+    for (auto &P : WarningsMap) {
+      StringRef BoundName = P.first();
+      StringRef WarningTxt = P.second;
+
+      if (const Stmt *StmtNode = Match.getNodeAs<Stmt>(BoundName)) {
+        emitReport(ADC, BR, this, WarningTxt, CheckerCategory,
+                                 StmtNode);
+
+      } else if (const Decl *DeclNode = Match.getNodeAs<Decl>(BoundName)) {
+        emitReport(ADC, BR, this, WarningTxt, CheckerCategory,
+                                 DeclNode);
+
+      } else {
+
+        // TODO: supporting matching types/etc.
+        continue;
+      }
+
+    }
+  }
+}

clang/test/Analysis/declarative/failed_matcher.c

+// RUN: not %clang_analyze_cc1 -analyze -analyzer-load-checker %S/failed_matcher.yaml -analyzer-checker=mypackage.mychecker %s 2>&1 | FileCheck %s
+
+void foo() {}
+
+// CHECK: failed parsing matcher

clang/test/Analysis/declarative/failed_matcher.yaml

+name:
+  mypackage.mychecker
+category:
+  core
+description:
+  descr
+ast_matcher:
+  (((())))
+warnings:
+  binding: "Variable declaration found"
+

clang/test/Analysis/declarative/failed_yaml_parsing.cpp

+// RUN: not %clang_analyze_cc1 -analyze -analyzer-load-checker %S/misformed.yaml -analyzer-checker=mypackage.mychecker %s 2>&1 | FileCheck %s
+
+void foo(){}
+
+// CHECK: error: missing required key 'name'
+// CHECK: failed parsing declarative checker from YAML

clang/test/Analysis/declarative/load_simple_matcher.c

+// RUN: %clang_analyze_cc1 -analyze -analyzer-load-checker %S/matcher.yaml -analyzer-checker=mypackage.mychecker %s
+
+int bar() {
+  int z = 120; // expected-warning{{Variable declaration found}}
+  return z;
+}
+
+int foo() {
+  int a = 0; // expected-warning{{Variable declaration found}}
+  int b = 1; // expected-warning{{Variable declaration found}}
+  int c = 2; // expected-warning{{Variable declaration found}}
+  return a + b + c;
+}
+

clang/test/Analysis/declarative/matcher.yaml

+name:
+  mypackage.mychecker
+category:
+  core
+description:
+  descr
+ast_matcher:
+  varDecl().bind("binding")
+warnings:
+  binding: "Variable declaration found"
+

clang/test/Analysis/declarative/matcher_multiple_bindings.yaml

+name:
+  mypackage.mychecker
+category:
+  core
+description:
+  descr
+ast_matcher:
+  anyOf(varDecl(hasInitializer(integerLiteral(0)).bind("zero_init"), varDecl(hasInitializer(integerLiteral(1)).bind("one_init")))
+warnings:
+  zero_init: "Variable initialized to zero"
+  one_init: "Variable initialized to one"
+

clang/test/Analysis/declarative/misformed.yaml

+fail: fail

clang/test/Analysis/declarative/nonexistent_file.c

+// RUN: not %clang_analyze_cc1 -analyze -analyzer-load-checker %S/nonexistentfile.yaml -analyzer-checker=mypackage.mychecker %s 2>&1 | FileCheck %s
+
+void foo() {}
+
+// CHECK: file '{{.*}}nonexistentfile.yaml' with a checker description not found

clang/test/Analysis/declarative/stmt_matcher.yaml

+name:
+  mypackage.stmt_matcher
+category:
+  core
+description:
+  descr
+ast_matcher:
+  returnStmt().bind("binding")
+warnings:
+  binding: "Return statement"
+

clang/test/Analysis/declarative/use_matcher_multiple_bindings.c

+// RUN: %clang_analyze_cc1 -analyze -analyzer-load-checker %S/matcher.yaml -analyzer-checker=mypackage.mychecker %s
+
+int bar() {
+  int z = 0; // expected-warning{{Variable initialized to zero}}
+  return z;
+}
+
+int foo() {
+  int a = 0; // expected-warning{{Variable initialized to zero}}
+  int b = 1; // expected-warning{{Variable initialized to one}}
+  return a + b;
+}
+

clang/test/Analysis/declarative/use_stmt_matcher.c

+// RUN: %clang_analyze_cc1 -analyze -analyzer-load-checker %S/stmt_matcher.yaml -analyzer-checker=mypackage.stmt_matcher %s
+
+int foo() {
+  int a = 0;
+  int b = 0;
+  int c = 0;
+  return a + b + c; // expected-warning{{Return statement}}
+}
+