[analyzer] Dump stable identifiers for exploded nodes

[NoQ]

clang/include/clang/StaticAnalyzer/Core/PathSensitive/ExplodedGraph.h

243 ↗

(On Diff #163953)

Type needs to be updated.

[NoQ]

The interesting part here is that you immediately see in which order nodes were created, which is great for debugging exploration order.

clang/lib/StaticAnalyzer/Core/ExprEngine.cpp

3150 ↗

(On Diff #163953)

Formatting.

[mikhail.ramalho]

Hey guys, the assertion is being triggered for me (I'm using clang r342322):

$ cat ~/main.c
void foo(unsigned width)
{
  int base;
  int i = 0;

  if (i % width == 0)
    base = 1;

  assert(base == 1);
}

$ clang -cc1 -analyze -analyzer-checker=core ~/main.c -analyzer-viz-egraph-graphviz -trim-egraph
/home/mramalho/main.c:9:3: warning: implicit declaration of function 'assert' is invalid in C99
  assert(base == 1);
  ^
Writing '/tmp/TrimmedExprEngine-5b12da.dot'... clang: ../tools/clang/lib/StaticAnalyzer/Core/ExplodedGraph.cpp:288: int64_t clang::ento::ExplodedNode::getID(clang::ento::ExplodedGraph*) const: Assertion `Out && "Wrong allocator used"' failed.
Aborted (core dumped)

[NoQ]

So trimmed graphs are in a different allocator?

[george.karpenkov]

Hey, sorry, I’ll take a look

[llvm-commits]

Should be fixed by https://reviews.llvm.org/D52183 https://reviews.llvm.org/D52183

• msg-11351-579.txt162 BDownload

cfe/trunk/include/clang/StaticAnalyzer/Core/PathSensitive/ExplodedGraph.h

public:
 
   const_succ_iterator succ_begin() const {
     return const_cast<ExplodedNode*>(this)->succ_begin();
   }
   const_succ_iterator succ_end() const {
     return const_cast<ExplodedNode*>(this)->succ_end();
   }
 
+  int64_t getID(ExplodedGraph *G) const;
+
 private:
   void replaceSuccessor(ExplodedNode *node) { Succs.replaceNode(node); }
   void replacePredecessor(ExplodedNode *node) { Preds.replaceNode(node); }
 };
 
 using InterExplodedGraphMap =
     llvm::DenseMap<const ExplodedNode *, const ExplodedNode *>;
 

cfe/trunk/lib/StaticAnalyzer/Core/ExplodedGraph.cpp

ExplodedNode * const *ExplodedNode::NodeGroup::end() const {
   const GroupStorage &Storage = reinterpret_cast<const GroupStorage &>(P);
   if (Storage.isNull())
     return nullptr;
   if (ExplodedNodeVector *V = Storage.dyn_cast<ExplodedNodeVector *>())
     return V->end();
   return Storage.getAddrOfPtr1() + 1;
 }
 
+int64_t ExplodedNode::getID(ExplodedGraph *G) const {
+  Optional<int64_t> Out = G->getAllocator().identifyObject(this);
+  assert(Out && "Wrong allocator used");
+  assert(*Out % alignof(ExplodedNode) == 0 && "Wrong alignment information");
+  return *Out / alignof(ExplodedNode);
+}
+
 ExplodedNode *ExplodedGraph::getNode(const ProgramPoint &L,
                                      ProgramStateRef State,
                                      bool IsSink,
                                      bool* IsNew) {
   // Profile 'State' to determine if we already have an existing node.
   llvm::FoldingSetNodeID profile;
   void *InsertPos = nullptr;
 

cfe/trunk/lib/StaticAnalyzer/Core/ExprEngine.cpp

switch (Loc.getKind()) {
         else if (Loc.getAs<PostAllocatorCall>())
           Out << "\\lPostAllocatorCall\\l";
 
         break;
       }
     }
 
     ProgramStateRef state = N->getState();
-    Out << "\\|StateID: " << state->getID() << " ("
-        << (const void*) state.get() << ")"
-        << " NodeID: " << (const void*) N << "\\|";
+    ExplodedGraph &Graph =
+        static_cast<ExprEngine *>(state->getStateManager().getOwningEngine())
+            ->getGraph();
+
+    Out << "\\|StateID: " << state->getID() << " (" << (const void *)state.get()
+        << ")"
+        << " NodeID: " << N->getID(&Graph) << " (" << (const void *)N << ")\\|";
 
     state->printDOT(Out, N->getLocationContext());
 
     Out << "\\l";
 
     if (const ProgramPointTag *tag = Loc.getTag()) {
       Out << "\\|Tag: " << tag->getTagDescription();
       Out << "\\l";