Index: clang/include/clang/Driver/CC1Options.td =================================================================== --- clang/include/clang/Driver/CC1Options.td +++ clang/include/clang/Driver/CC1Options.td @@ -80,6 +80,9 @@ HelpText<"Only show error-related paths in the analysis graph">; def analyzer_viz_egraph_graphviz : Flag<["-"], "analyzer-viz-egraph-graphviz">, HelpText<"Display exploded graph using GraphViz">; +def analyzer_dump_egraph : Separate<["-"], "analyzer-dump-egraph">, + HelpText<"Dump exploded graph to the specified file">; +def analyzer_dump_egraph_EQ : Joined<["-"], "analyzer-dump-egraph=">, Alias; def analyzer_inline_max_stack_depth : Separate<["-"], "analyzer-inline-max-stack-depth">, HelpText<"Bound on stack depth while inlining (4 by default)">; Index: clang/include/clang/StaticAnalyzer/Core/AnalyzerOptions.h =================================================================== --- clang/include/clang/StaticAnalyzer/Core/AnalyzerOptions.h +++ clang/include/clang/StaticAnalyzer/Core/AnalyzerOptions.h @@ -140,6 +140,9 @@ std::string AnalyzeSpecificFunction; + /// File path to which the exploded graph should be dumped. + std::string DumpExplodedGraphTo; + /// Store full compiler invocation for reproducible instructions in the /// generated report. std::string FullCompilerInvocation; Index: clang/include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h =================================================================== --- clang/include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h +++ clang/include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h @@ -204,6 +204,18 @@ void enqueueEndOfPath(ExplodedNodeSet &S); void GenerateCallExitNode(ExplodedNode *N); + + /// Dump graph to the specified filename. + /// If filename is empty, generate a temporary one. + /// \return The filename the graph is written into. + std::string DumpGraph(bool trim = false, StringRef Filename=""); + + /// Dump the graph consisting of the given nodes to a specified filename. + /// Generate a temporary filename if it's not provided. + /// \return The filename the graph is written into. + std::string DumpGraph(ArrayRef Nodes, + StringRef Filename = ""); + /// Visualize the ExplodedGraph created by executing the simulation. void ViewGraph(bool trim = false); Index: clang/lib/Frontend/CompilerInvocation.cpp =================================================================== --- clang/lib/Frontend/CompilerInvocation.cpp +++ clang/lib/Frontend/CompilerInvocation.cpp @@ -284,6 +284,7 @@ Opts.visualizeExplodedGraphWithGraphViz = Args.hasArg(OPT_analyzer_viz_egraph_graphviz); + Opts.DumpExplodedGraphTo = Args.getLastArgValue(OPT_analyzer_dump_egraph); Opts.NoRetryExhausted = Args.hasArg(OPT_analyzer_disable_retry_exhausted); Opts.AnalyzeAll = Args.hasArg(OPT_analyzer_opt_analyze_headers); Opts.AnalyzerDisplayProgress = Args.hasArg(OPT_analyzer_display_progress); Index: clang/lib/StaticAnalyzer/Core/ExprEngine.cpp =================================================================== --- clang/lib/StaticAnalyzer/Core/ExprEngine.cpp +++ clang/lib/StaticAnalyzer/Core/ExprEngine.cpp @@ -3057,6 +3057,23 @@ #endif void ExprEngine::ViewGraph(bool trim) { +#ifndef NDEBUG + std::string Filename = DumpGraph(trim); + llvm::DisplayGraph(Filename, false, llvm::GraphProgram::DOT); +#endif + llvm::errs() << "Warning: viewing graph requires assertions" << "\n"; +} + + +void ExprEngine::ViewGraph(ArrayRef Nodes) { +#ifndef NDEBUG + std::string Filename = DumpGraph(Nodes); + llvm::DisplayGraph(Filename, false, llvm::GraphProgram::DOT); +#endif + llvm::errs() << "Warning: viewing graph requires assertions" << "\n"; +} + +std::string ExprEngine::DumpGraph(bool trim, StringRef Filename) { #ifndef NDEBUG if (trim) { std::vector Src; @@ -3067,22 +3084,30 @@ const auto *N = const_cast(EI->begin()->getErrorNode()); if (N) Src.push_back(N); } - - ViewGraph(Src); + return DumpGraph(Src, Filename); } else { - llvm::ViewGraph(&G, "ExprEngine"); + return llvm::WriteGraph(&G, "ExprEngine", /*ShortNames=*/false, + /*Title=*/"Exploded Graph", /*Filename=*/Filename); } #endif + llvm::errs() << "Warning: dumping graph requires assertions" << "\n"; + return ""; } -void ExprEngine::ViewGraph(ArrayRef Nodes) { +std::string ExprEngine::DumpGraph(ArrayRef Nodes, + StringRef Filename) { #ifndef NDEBUG std::unique_ptr TrimmedG(G.trim(Nodes)); if (!TrimmedG.get()) { llvm::errs() << "warning: Trimmed ExplodedGraph is empty.\n"; } else { - llvm::ViewGraph(TrimmedG.get(), "TrimmedExprEngine"); + return llvm::WriteGraph(TrimmedG.get(), "TrimmedExprEngine", + /*ShortNames=*/false, + /*Title=*/"Trimmed Exploded Graph", + /*Filename=*/Filename); } #endif + llvm::errs() << "Warning: dumping graph requires assertions" << "\n"; + return ""; } Index: clang/lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp =================================================================== --- clang/lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp +++ clang/lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp @@ -745,6 +745,9 @@ Eng.ExecuteWorkList(Mgr->getAnalysisDeclContextManager().getStackFrame(D), Mgr->options.getMaxNodesPerTopLevelFunction()); + if (!Mgr->options.DumpExplodedGraphTo.empty()) + Eng.DumpGraph(Mgr->options.TrimGraph, Mgr->options.DumpExplodedGraphTo); + // Visualize the exploded graph. if (Mgr->options.visualizeExplodedGraphWithGraphViz) Eng.ViewGraph(Mgr->options.TrimGraph); Index: clang/test/Analysis/dump_egraph.c =================================================================== --- /dev/null +++ clang/test/Analysis/dump_egraph.c @@ -0,0 +1,15 @@ +// RUN: %clang_analyze_cc1 -analyzer-checker=core -analyzer-dump-egraph=%t.dot %s +// RUN: cat %t.dot | FileCheck %s +// REQUIRES: asserts + +int getJ(); + +int foo() { + int *x = 0; + return *x; +} + +// CHECK: digraph "Exploded Graph" { +// CHECK: Edge: (B2, B1) +// CHECK: Block Entrance: B1 +// CHECK: Bug report attached