[analyzer] Fix function macro crash

[bruntib]

Summary

When there is a functor-like macro which is passed as parameter to another "function" macro then its parameters are not listed at the place of expansion:

#define foo(x) int bar() { return x; }
#define hello(fvar) fvar(0)
hello(foo)
int main() { 1 / bar(); }

Expansion of hello(foo) asserted Clang, because it expected an l_paren token in the 3rd line after "foo", since it is a function-like token.

[Szelethus]

Cheers! Let's wait a couple days for feedback, and I'll commit on your behalf after that.

[Szelethus]

Actually, reproducing this with a testcase would be much preferred here too.

[bruntib]

I've added a test case.

[Szelethus]

Awesome, thanks! Will commit around next Friday.

[bruntib]

There was another place where this crash could have happened.

[Szelethus]

This patch no longer applies cleanly to the latest version of clang -- could you rebase please?

[bruntib]

I rebased the patch on the current master.

[Szelethus]

Ugh. Reverted the patch.

FAIL: Clang :: Analysis/plist-macros-with-expansion.cpp (720 of 14281)
******************** TEST 'Clang :: Analysis/plist-macros-with-expansion.cpp' FAILED ********************
Script:
--
: 'RUN: at line 1';   /b/sanitizer-x86_64-linux-fast/build/llvm_build_msan/bin/clang -cc1 -internal-isystem /b/sanitizer-x86_64-linux-fast/build/llvm_build_msan/lib/clang/9.0.0/include -nostdsysteminc -analyze -analyzer-constraints=range -analyzer-checker=core -verify /b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp
: 'RUN: at line 3';   /b/sanitizer-x86_64-linux-fast/build/llvm_build_msan/bin/clang -cc1 -internal-isystem /b/sanitizer-x86_64-linux-fast/build/llvm_build_msan/lib/clang/9.0.0/include -nostdsysteminc -analyze -analyzer-constraints=range -analyzer-checker=core /b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp     -analyzer-output=plist -o /b/sanitizer-x86_64-linux-fast/build/llvm_build_msan/tools/clang/test/Analysis/Output/plist-macros-with-expansion.cpp.tmp.plist    -analyzer-config expand-macros=true
: 'RUN: at line 8';   cat /b/sanitizer-x86_64-linux-fast/build/llvm_build_msan/tools/clang/test/Analysis/Output/plist-macros-with-expansion.cpp.tmp.plist | diff -u -w -I "<string>/" -I "<string>.:" -I "version"    /b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/test/Analysis/Inputs/expected-plists/plist-macros-with-expansion.cpp.plist -
: 'RUN: at line 13';   /b/sanitizer-x86_64-linux-fast/build/llvm_build_msan/bin/FileCheck --input-file=/b/sanitizer-x86_64-linux-fast/build/llvm_build_msan/tools/clang/test/Analysis/Output/plist-macros-with-expansion.cpp.tmp.plist /b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp
--
Exit Code: 77

Command Output (stderr):
--
/b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:451:7: warning: expression result unused
    1 / value; // expected-warning{{Division by zero}}
    ~ ^ ~~~~~
/b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:27:8: warning: Dereference of null pointer (loaded from variable 'ptr')
  *ptr = 5; // expected-warning{{Dereference of null pointer}}
   ~~~ ^
/b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:40:8: warning: Dereference of null pointer (loaded from variable 'ptr')
  *ptr = 5; // expected-warning{{Dereference of null pointer}}
   ~~~ ^
/b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:60:8: warning: Dereference of null pointer (loaded from variable 'ptr')
  *ptr = 5; // expected-warning{{Dereference of null pointer}}
   ~~~ ^
/b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:80:12: warning: Dereference of null pointer (loaded from variable 'a')
  DEREF(a) = 5; // expected-warning{{Dereference of null pointer}}
        ~  ^
/b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:99:8: warning: Dereference of null pointer (loaded from variable 'ptr')
  *ptr = 5; // expected-warning{{Dereference of null pointer}}
   ~~~ ^
/b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:116:8: warning: Dereference of null pointer (loaded from variable 'ptr')
  *ptr = 5; // expected-warning{{Dereference of null pointer}}
   ~~~ ^
/b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:136:8: warning: Dereference of null pointer (loaded from variable 'ptr')
  *ptr = 5; // expected-warning{{Dereference of null pointer}}
   ~~~ ^
/b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:163:6: warning: Dereference of null pointer (loaded from variable 'a')
  *a = 5; // expected-warning{{Dereference of null pointer}}
   ~ ^
/b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:172:6: warning: Dereference of null pointer (loaded from variable 'a')
  *a = 5; // expected-warning{{Dereference of null pointer}}
   ~ ^
/b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:181:6: warning: Dereference of null pointer (loaded from variable 'a')
  *a = 5; // expected-warning{{Dereference of null pointer}}
   ~ ^
/b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:195:6: warning: Dereference of null pointer (loaded from variable 'a')
  *a = 5; // expected-warning{{Dereference of null pointer}}
   ~ ^
/b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:209:6: warning: Dereference of null pointer (loaded from variable 'a')
  *a = 5; // expected-warning{{Dereference of null pointer}}
   ~ ^
/b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:221:6: warning: Dereference of null pointer (loaded from variable 'a')
  *a = 5; // expected-warning{{Dereference of null pointer}}
   ~ ^
/b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:236:8: warning: Dereference of null pointer (loaded from variable 'ptr')
  *ptr = 5; // expected-warning{{Dereference of null pointer}}
   ~~~ ^
/b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:253:10: warning: Dereference of null pointer (loaded from variable 'ptr')
    *ptr = 5;
     ~~~ ^
/b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:243:3: note: expanded from macro 'PASTE_CODE'
  code
  ^~~~
/b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:271:8: warning: Dereference of null pointer (loaded from variable 'ptr')
  *ptr = 5; // expected-warning{{Dereference of null pointer}}
   ~~~ ^
/b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:285:8: warning: Dereference of null pointer (loaded from variable 'ptr')
  *ptr = 5; // expected-warning{{Dereference of null pointer}}
   ~~~ ^
/b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:297:8: warning: Dereference of null pointer (loaded from variable 'ptr')
  *ptr = 5; // expected-warning{{Dereference of null pointer}}
   ~~~ ^
/b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:317:8: warning: Dereference of null pointer (loaded from variable 'ptr')
  *ptr = 5; // expected-warning{{Dereference of null pointer}}
   ~~~ ^
/b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:328:8: warning: Dereference of null pointer (loaded from variable 'ptr')
  *ptr = 5; // expected-warning{{Dereference of null pointer}}
   ~~~ ^
/b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:345:8: warning: Dereference of null pointer (loaded from variable 'ptr')
  *ptr = 5; // expected-warning{{Dereference of null pointer}}
   ~~~ ^
/b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:354:6: warning: Dereference of null pointer (loaded from variable 'a')
  *a = 5; // expected-warning{{Dereference of null pointer}}
   ~ ^
/b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:367:8: warning: Dereference of null pointer (loaded from variable 'ptr')
  *ptr = 5; // expected-warning{{Dereference of null pointer}}
   ~~~ ^
/b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:376:6: warning: Dereference of null pointer (loaded from variable 'a')
  *a = 5; // expected-warning{{Dereference of null pointer}}
   ~ ^
/b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:418:3: warning: Division by zero
  EUCLIDEAN_ALGORITHM(A, B) // expected-warning{{Division by zero}}
  ^~~~~~~~~~~~~~~~~~~~~~~~~
/b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:415:12: note: expanded from macro 'EUCLIDEAN_ALGORITHM'
  RETURN B / (B - B) SEMICOLON
         ~~^~~~~~~~~
/b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:439:8: warning: Dereference of null pointer (loaded from variable 'ptr')
  *ptr = 5; // expected-warning{{Dereference of null pointer}}
   ~~~ ^
/b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:451:7: warning: Division by zero
    1 / value; // expected-warning{{Division by zero}}
    ~~^~~~~~~
/b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:459:35: warning: Division by zero
void useZeroApplier1() { (void)(1 / foo()); } // expected-warning{{Division by zero}}
                                ~~^~~~~~~
/b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:468:35: warning: Division by zero
void useZeroApplier2() { (void)(1 / bar()); } // expected-warning{{Division by zero}}
                                ~~^~~~~~~
==12509==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0xa3d16d8 in getMacroNameAndPrintExpansion((anonymous namespace)::TokenPrinter&, clang::SourceLocation, clang::Preprocessor const&, (anonymous namespace)::MacroArgMap const&, llvm::SmallPtrSet<clang::IdentifierInfo*, 8u>&) /b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/lib/StaticAnalyzer/Core/PlistDiagnostics.cpp:903:11
    #1 0xa3c1d1a in getExpandedMacro /b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/lib/StaticAnalyzer/Core/PlistDiagnostics.cpp:845:13
    #2 0xa3c1d1a in ReportMacroExpansions /b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/lib/StaticAnalyzer/Core/PlistDiagnostics.cpp:344
    #3 0xa3c1d1a in printBugPath /b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/lib/StaticAnalyzer/Core/PlistDiagnostics.cpp:479
    #4 0xa3c1d1a in (anonymous namespace)::PlistDiagnostics::FlushDiagnosticsImpl(std::__1::vector<clang::ento::PathDiagnostic const*, std::__1::allocator<clang::ento::PathDiagnostic const*> >&, clang::ento::PathDiagnosticConsumer::FilesMade*) /b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/lib/StaticAnalyzer/Core/PlistDiagnostics.cpp:583
    #5 0xa3ab1be in clang::ento::PathDiagnosticConsumer::FlushDiagnostics(clang::ento::PathDiagnosticConsumer::FilesMade*) /b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/lib/StaticAnalyzer/Core/PathDiagnostic.cpp:483:3
    #6 0xa18c704 in FlushDiagnostics /b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/lib/StaticAnalyzer/Core/AnalysisManager.cpp:59:11
    #7 0xa18c704 in clang::ento::AnalysisManager::~AnalysisManager() /b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/lib/StaticAnalyzer/Core/AnalysisManager.cpp:47
    #8 0xa18cd1c in clang::ento::AnalysisManager::~AnalysisManager() /b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/lib/StaticAnalyzer/Core/AnalysisManager.cpp:46:37
    #9 0x9a0e7ca in operator() /b/sanitizer-x86_64-linux-fast/build/libcxx_build_msan/include/c++/v1/memory:2338:5
    #10 0x9a0e7ca in reset /b/sanitizer-x86_64-linux-fast/build/libcxx_build_msan/include/c++/v1/memory:2651
    #11 0x9a0e7ca in (anonymous namespace)::AnalysisConsumer::HandleTranslationUnit(clang::ASTContext&) /b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp:602
    #12 0xa539235 in clang::ParseAST(clang::Sema&, bool, bool) /b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/lib/Parse/ParseAST.cpp:169:13
    #13 0x765a170 in clang::FrontendAction::Execute() /b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/lib/Frontend/FrontendAction.cpp:934:8
    #14 0x7574c5b in clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) /b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/lib/Frontend/CompilerInstance.cpp:952:11
    #15 0x78868e6 in clang::ExecuteCompilerInvocation(clang::CompilerInstance*) /b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/lib/FrontendTool/ExecuteCompilerInvocation.cpp:271:25
    #16 0xb27555 in cc1_main(llvm::ArrayRef<char const*>, char const*, void*) /b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/tools/driver/cc1_main.cpp:218:13
    #17 0xb206a0 in ExecuteCC1Tool /b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/tools/driver/driver.cpp:309:12
    #18 0xb206a0 in main /b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/tools/driver/driver.cpp:381
    #19 0x7f51944df2e0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202e0)
    #20 0xaa2ea9 in _start (/b/sanitizer-x86_64-linux-fast/build/llvm_build_msan/bin/clang-9+0xaa2ea9)

SUMMARY: MemorySanitizer: use-of-uninitialized-value /b/sanitizer-x86_64-linux-fast/build/llvm/tools/clang/lib/StaticAnalyzer/Core/PlistDiagnostics.cpp:903:11 in getMacroNameAndPrintExpansion((anonymous namespace)::TokenPrinter&, clang::SourceLocation, clang::Preprocessor const&, (anonymous namespace)::MacroArgMap const&, llvm::SmallPtrSet<clang::IdentifierInfo*, 8u>&)
Exiting

[Szelethus]

Let's investigate what's behind this.

[Szelethus]

Some bots also break but emit a different message:

******************** TEST 'Clang :: Analysis/plist-macros-with-expansion.cpp' FAILED ********************
Script:
--
: 'RUN: at line 1';   /b/sanitizer-x86_64-linux-bootstrap/build/llvm_build_asan/bin/clang -cc1 -internal-isystem /b/sanitizer-x86_64-linux-bootstrap/build/llvm_build_asan/lib/clang/9.0.0/include -nostdsysteminc -analyze -analyzer-constraints=range -analyzer-checker=core -verify /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp
: 'RUN: at line 3';   /b/sanitizer-x86_64-linux-bootstrap/build/llvm_build_asan/bin/clang -cc1 -internal-isystem /b/sanitizer-x86_64-linux-bootstrap/build/llvm_build_asan/lib/clang/9.0.0/include -nostdsysteminc -analyze -analyzer-constraints=range -analyzer-checker=core /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp     -analyzer-output=plist -o /b/sanitizer-x86_64-linux-bootstrap/build/llvm_build_asan/tools/clang/test/Analysis/Output/plist-macros-with-expansion.cpp.tmp.plist    -analyzer-config expand-macros=true
: 'RUN: at line 8';   cat /b/sanitizer-x86_64-linux-bootstrap/build/llvm_build_asan/tools/clang/test/Analysis/Output/plist-macros-with-expansion.cpp.tmp.plist | diff -u -w -I "<string>/" -I "<string>.:" -I "version"    /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/test/Analysis/Inputs/expected-plists/plist-macros-with-expansion.cpp.plist -
: 'RUN: at line 13';   /b/sanitizer-x86_64-linux-bootstrap/build/llvm_build_asan/bin/FileCheck --input-file=/b/sanitizer-x86_64-linux-bootstrap/build/llvm_build_asan/tools/clang/test/Analysis/Output/plist-macros-with-expansion.cpp.tmp.plist /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp
--
Exit Code: 1

Command Output (stderr):
--
/b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:451:7: warning: expression result unused
    1 / value; // expected-warning{{Division by zero}}
    ~ ^ ~~~~~
/b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:27:8: warning: Dereference of null pointer (loaded from variable 'ptr')
  *ptr = 5; // expected-warning{{Dereference of null pointer}}
   ~~~ ^
/b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:40:8: warning: Dereference of null pointer (loaded from variable 'ptr')
  *ptr = 5; // expected-warning{{Dereference of null pointer}}
   ~~~ ^
/b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:60:8: warning: Dereference of null pointer (loaded from variable 'ptr')
  *ptr = 5; // expected-warning{{Dereference of null pointer}}
   ~~~ ^
/b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:80:12: warning: Dereference of null pointer (loaded from variable 'a')
  DEREF(a) = 5; // expected-warning{{Dereference of null pointer}}
        ~  ^
/b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:99:8: warning: Dereference of null pointer (loaded from variable 'ptr')
  *ptr = 5; // expected-warning{{Dereference of null pointer}}
   ~~~ ^
/b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:116:8: warning: Dereference of null pointer (loaded from variable 'ptr')
  *ptr = 5; // expected-warning{{Dereference of null pointer}}
   ~~~ ^
/b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:136:8: warning: Dereference of null pointer (loaded from variable 'ptr')
  *ptr = 5; // expected-warning{{Dereference of null pointer}}
   ~~~ ^
/b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:163:6: warning: Dereference of null pointer (loaded from variable 'a')
  *a = 5; // expected-warning{{Dereference of null pointer}}
   ~ ^
/b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:172:6: warning: Dereference of null pointer (loaded from variable 'a')
  *a = 5; // expected-warning{{Dereference of null pointer}}
   ~ ^
/b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:181:6: warning: Dereference of null pointer (loaded from variable 'a')
  *a = 5; // expected-warning{{Dereference of null pointer}}
   ~ ^
/b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:195:6: warning: Dereference of null pointer (loaded from variable 'a')
  *a = 5; // expected-warning{{Dereference of null pointer}}
   ~ ^
/b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:209:6: warning: Dereference of null pointer (loaded from variable 'a')
  *a = 5; // expected-warning{{Dereference of null pointer}}
   ~ ^
/b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:221:6: warning: Dereference of null pointer (loaded from variable 'a')
  *a = 5; // expected-warning{{Dereference of null pointer}}
   ~ ^
/b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:236:8: warning: Dereference of null pointer (loaded from variable 'ptr')
  *ptr = 5; // expected-warning{{Dereference of null pointer}}
   ~~~ ^
/b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:253:10: warning: Dereference of null pointer (loaded from variable 'ptr')
    *ptr = 5;
     ~~~ ^
/b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:243:3: note: expanded from macro 'PASTE_CODE'
  code
  ^~~~
/b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:271:8: warning: Dereference of null pointer (loaded from variable 'ptr')
  *ptr = 5; // expected-warning{{Dereference of null pointer}}
   ~~~ ^
/b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:285:8: warning: Dereference of null pointer (loaded from variable 'ptr')
  *ptr = 5; // expected-warning{{Dereference of null pointer}}
   ~~~ ^
/b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:297:8: warning: Dereference of null pointer (loaded from variable 'ptr')
  *ptr = 5; // expected-warning{{Dereference of null pointer}}
   ~~~ ^
/b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:317:8: warning: Dereference of null pointer (loaded from variable 'ptr')
  *ptr = 5; // expected-warning{{Dereference of null pointer}}
   ~~~ ^
/b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:328:8: warning: Dereference of null pointer (loaded from variable 'ptr')
  *ptr = 5; // expected-warning{{Dereference of null pointer}}
   ~~~ ^
/b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:345:8: warning: Dereference of null pointer (loaded from variable 'ptr')
  *ptr = 5; // expected-warning{{Dereference of null pointer}}
   ~~~ ^
/b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:354:6: warning: Dereference of null pointer (loaded from variable 'a')
  *a = 5; // expected-warning{{Dereference of null pointer}}
   ~ ^
/b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:367:8: warning: Dereference of null pointer (loaded from variable 'ptr')
  *ptr = 5; // expected-warning{{Dereference of null pointer}}
   ~~~ ^
/b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:376:6: warning: Dereference of null pointer (loaded from variable 'a')
  *a = 5; // expected-warning{{Dereference of null pointer}}
   ~ ^
/b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:418:3: warning: Division by zero
  EUCLIDEAN_ALGORITHM(A, B) // expected-warning{{Division by zero}}
  ^~~~~~~~~~~~~~~~~~~~~~~~~
/b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:415:12: note: expanded from macro 'EUCLIDEAN_ALGORITHM'
  RETURN B / (B - B) SEMICOLON
         ~~^~~~~~~~~
/b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:439:8: warning: Dereference of null pointer (loaded from variable 'ptr')
  *ptr = 5; // expected-warning{{Dereference of null pointer}}
   ~~~ ^
/b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:451:7: warning: Division by zero
    1 / value; // expected-warning{{Division by zero}}
    ~~^~~~~~~
/b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:459:35: warning: Division by zero
void useZeroApplier1() { (void)(1 / foo()); } // expected-warning{{Division by zero}}
                                ~~^~~~~~~
/b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/test/Analysis/plist-macros-with-expansion.cpp:468:35: warning: Division by zero
void useZeroApplier2() { (void)(1 / bar()); } // expected-warning{{Division by zero}}
                                ~~^~~~~~~
=================================================================
==53065==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6180000037d8 at pc 0x000009ecdcf8 bp 0x7ffeb2611d50 sp 0x7ffeb2611d48
READ of size 2 at 0x6180000037d8 thread T0
    #0 0x9ecdcf7 in is /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/include/clang/Lex/Token.h:94:44
    #1 0x9ecdcf7 in getMacroNameAndPrintExpansion((anonymous namespace)::TokenPrinter&, clang::SourceLocation, clang::Preprocessor const&, (anonymous namespace)::MacroArgMap const&, llvm::SmallPtrSet<clang::IdentifierInfo*, 8u>&) /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/lib/StaticAnalyzer/Core/PlistDiagnostics.cpp:903
    #2 0x9ebaddc in getExpandedMacro /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/lib/StaticAnalyzer/Core/PlistDiagnostics.cpp:845:13
    #3 0x9ebaddc in ReportMacroExpansions /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/lib/StaticAnalyzer/Core/PlistDiagnostics.cpp:344
    #4 0x9ebaddc in printBugPath /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/lib/StaticAnalyzer/Core/PlistDiagnostics.cpp:479
    #5 0x9ebaddc in (anonymous namespace)::PlistDiagnostics::FlushDiagnosticsImpl(std::__1::vector<clang::ento::PathDiagnostic const*, std::__1::allocator<clang::ento::PathDiagnostic const*> >&, clang::ento::PathDiagnosticConsumer::FilesMade*) /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/lib/StaticAnalyzer/Core/PlistDiagnostics.cpp:583
    #6 0x9ea5aec in clang::ento::PathDiagnosticConsumer::FlushDiagnostics(clang::ento::PathDiagnosticConsumer::FilesMade*) /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/lib/StaticAnalyzer/Core/PathDiagnostic.cpp:483:3
    #7 0x9ca1a0f in FlushDiagnostics /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/lib/StaticAnalyzer/Core/AnalysisManager.cpp:59:11
    #8 0x9ca1a0f in clang::ento::AnalysisManager::~AnalysisManager() /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/lib/StaticAnalyzer/Core/AnalysisManager.cpp:47
    #9 0x9ca221d in clang::ento::AnalysisManager::~AnalysisManager() /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/lib/StaticAnalyzer/Core/AnalysisManager.cpp:46:37
    #10 0x9603b7b in operator() /b/sanitizer-x86_64-linux-bootstrap/build/libcxx_build_asan/include/c++/v1/memory:2338:5
    #11 0x9603b7b in reset /b/sanitizer-x86_64-linux-bootstrap/build/libcxx_build_asan/include/c++/v1/memory:2651
    #12 0x9603b7b in (anonymous namespace)::AnalysisConsumer::HandleTranslationUnit(clang::ASTContext&) /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp:602
    #13 0xa026ee2 in clang::ParseAST(clang::Sema&, bool, bool) /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/lib/Parse/ParseAST.cpp:169:13
    #14 0x73752ad in clang::FrontendAction::Execute() /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/lib/Frontend/FrontendAction.cpp:934:8
    #15 0x726050a in clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/lib/Frontend/CompilerInstance.cpp:952:11
    #16 0x75a61be in clang::ExecuteCompilerInvocation(clang::CompilerInstance*) /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/lib/FrontendTool/ExecuteCompilerInvocation.cpp:271:25
    #17 0xc658d1 in cc1_main(llvm::ArrayRef<char const*>, char const*, void*) /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/tools/driver/cc1_main.cpp:218:13
    #18 0xc5dd4f in ExecuteCC1Tool /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/tools/driver/driver.cpp:309:12
    #19 0xc5dd4f in main /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/tools/driver/driver.cpp:381
    #20 0x7fa292e942e0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202e0)
    #21 0xb8c569 in _start (/b/sanitizer-x86_64-linux-bootstrap/build/llvm_build_asan/bin/clang-9+0xb8c569)

0x6180000037d8 is located 16 bytes to the right of 840-byte region [0x618000003480,0x6180000037c8)
allocated by thread T0 here:
    #0 0xc1d580 in realloc /b/sanitizer-x86_64-linux-bootstrap/build/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:164
    #1 0x5d62737 in safe_realloc /b/sanitizer-x86_64-linux-bootstrap/build/llvm/include/llvm/Support/MemAlloc.h:41:18
    #2 0x5d62737 in llvm::SmallVectorBase::grow_pod(void*, unsigned long, unsigned long) /b/sanitizer-x86_64-linux-bootstrap/build/llvm/lib/Support/SmallVector.cpp:60
    #3 0xca71510 in grow_pod /b/sanitizer-x86_64-linux-bootstrap/build/llvm/include/llvm/ADT/SmallVector.h:98:22
    #4 0xca71510 in grow /b/sanitizer-x86_64-linux-bootstrap/build/llvm/include/llvm/ADT/SmallVector.h:299
    #5 0xca71510 in push_back /b/sanitizer-x86_64-linux-bootstrap/build/llvm/include/llvm/ADT/SmallVector.h:304
    #6 0xca71510 in AddTokenToBody /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/include/clang/Lex/MacroInfo.h:252
    #7 0xca71510 in clang::Preprocessor::ReadOptionalMacroParameterListAndBody(clang::Token const&, bool) /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/lib/Lex/PPDirectives.cpp:2456
    #8 0xca3f920 in clang::Preprocessor::HandleDefineDirective(clang::Token&, bool) /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/lib/Lex/PPDirectives.cpp:2600:25
    #9 0xca56434 in clang::Preprocessor::HandleDirective(clang::Token&) /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/lib/Lex/PPDirectives.cpp:953:14
    #10 0xc9b1109 in clang::Lexer::LexTokenInternal(clang::Token&, bool) /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/lib/Lex/Lexer.cpp:3931:7
    #11 0xc9a82be in clang::Lexer::Lex(clang::Token&) /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/lib/Lex/Lexer.cpp:3152:24
    #12 0xcb13b79 in clang::Preprocessor::Lex(clang::Token&) /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/lib/Lex/Preprocessor.cpp:870:33
    #13 0xa032d0d in clang::Parser::ConsumeBrace() /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/include/clang/Parse/Parser.h:585:8
    #14 0xa051458 in clang::BalancedDelimiterTracker::consumeClose() /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/include/clang/Parse/RAIIObjectsForParser.h:429:18
    #15 0xa2acd49 in clang::Parser::ParseCompoundStatementBody(bool) /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/lib/Parse/ParseStmt.cpp:1103:10
    #16 0xa2b01a4 in clang::Parser::ParseFunctionStatementBody(clang::Decl*, clang::Parser::ParseScope&) /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/lib/Parse/ParseStmt.cpp:2067:21
    #17 0xa048e50 in clang::Parser::ParseFunctionDefinition(clang::ParsingDeclarator&, clang::Parser::ParsedTemplateInfo const&, clang::Parser::LateParsedAttrList*) /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/lib/Parse/Parser.cpp:1246:10
    #18 0xa0ab30e in clang::Parser::ParseDeclGroup(clang::ParsingDeclSpec&, clang::DeclaratorContext, clang::SourceLocation*, clang::Parser::ForRangeInit*) /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/lib/Parse/ParseDecl.cpp:2001:11
    #19 0xa045c96 in clang::Parser::ParseDeclOrFunctionDefInternal(clang::Parser::ParsedAttributesWithRange&, clang::ParsingDeclSpec&, clang::AccessSpecifier) /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/lib/Parse/Parser.cpp:1015:10
    #20 0xa044a23 in clang::Parser::ParseDeclarationOrFunctionDefinition(clang::Parser::ParsedAttributesWithRange&, clang::ParsingDeclSpec*, clang::AccessSpecifier) /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/lib/Parse/Parser.cpp:1031:12
    #21 0xa03e7be in clang::Parser::ParseExternalDeclaration(clang::Parser::ParsedAttributesWithRange&, clang::ParsingDeclSpec*) /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/lib/Parse/Parser.cpp:855:12
    #22 0xa03ab0d in clang::Parser::ParseTopLevelDecl(clang::OpaquePtr<clang::DeclGroupRef>&) /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/lib/Parse/Parser.cpp:609:12
    #23 0xa026dd9 in clang::ParseAST(clang::Sema&, bool, bool) /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/lib/Parse/ParseAST.cpp:156:20
    #24 0x73752ad in clang::FrontendAction::Execute() /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/lib/Frontend/FrontendAction.cpp:934:8
    #25 0x726050a in clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/lib/Frontend/CompilerInstance.cpp:952:11
    #26 0x75a61be in clang::ExecuteCompilerInvocation(clang::CompilerInstance*) /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/lib/FrontendTool/ExecuteCompilerInvocation.cpp:271:25
    #27 0xc658d1 in cc1_main(llvm::ArrayRef<char const*>, char const*, void*) /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/tools/driver/cc1_main.cpp:218:13
    #28 0xc5dd4f in ExecuteCC1Tool /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/tools/driver/driver.cpp:309:12
    #29 0xc5dd4f in main /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/tools/driver/driver.cpp:381
    #30 0x7fa292e942e0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202e0)

SUMMARY: AddressSanitizer: heap-buffer-overflow /b/sanitizer-x86_64-linux-bootstrap/build/llvm/tools/clang/include/clang/Lex/Token.h:94:44 in is
Shadow bytes around the buggy address:
  0x0c307fff86a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c307fff86b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c307fff86c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c307fff86d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c307fff86e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c307fff86f0: 00 00 00 00 00 00 00 00 00 fa fa[fa]fa fa fa fa
  0x0c307fff8700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c307fff8710: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c307fff8720: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c307fff8730: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c307fff8740: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==53065==ABORTING

[bruntib]

I added a condition before std::next() invocations to check if the next element is inside the valid interval. This fixes the crash of the build-bot. Sorry for the ugly bug.
I don't know if there is a more elegant solution.

[Szelethus]

Ah so it was a past-the-end iterator dereference error. Cheers!

[bruntib]

I've uploaded another version of the last fix. The previous one contained an UB, although it worked practically.

cfe/trunk/lib/StaticAnalyzer/Core/PlistDiagnostics.cpp

for (auto It = Info.MI->tokens_begin(), E = Info.MI->tokens_end(); It != E;
     if (const MacroInfo *MI =
                          getMacroInfoForLocation(PP, SM, II, T.getLocation())) {
       getMacroNameAndPrintExpansion(Printer, T.getLocation(), PP, Info.Args,
                                     AlreadyProcessedTokens);
 
       // If this is a function-like macro, skip its arguments, as
       // getExpandedMacro() already printed them. If this is the case, let's
       // first jump to the '(' token.
-      if (MI->getNumParams() != 0)
+      auto N = std::next(It);
+      if (N != E && N->is(tok::l_paren))
         It = getMatchingRParen(++It, E);
       continue;
     }
 
     // If this token is the current macro's argument, we should expand it.
     auto ArgMapIt = Info.Args.find(II);
     if (ArgMapIt != Info.Args.end()) {
       for (MacroInfo::tokens_iterator ArgIt = ArgMapIt->second.begin(),
if (ArgMapIt != Info.Args.end()) {
         const auto *MI = PP.getMacroInfo(ArgII);
         if (!MI) {
           Printer.printToken(*ArgIt);
           continue;
         }
 
         getMacroNameAndPrintExpansion(Printer, ArgIt->getLocation(), PP,
                                       Info.Args, AlreadyProcessedTokens);
-        if (MI->getNumParams() != 0)
+        // Peek the next token if it is a tok::l_paren. This way we can decide
+        // if this is the application or just a reference to a function maxro
+        // symbol:
+        //
+        // #define apply(f) ...
+        // #define func(x) ...
+        // apply(func)
+        // apply(func(42))
+        auto N = std::next(ArgIt);
+        if (N != ArgEnd && N->is(tok::l_paren))
           ArgIt = getMatchingRParen(++ArgIt, ArgEnd);
       }
       continue;
     }
 
     // If control reached here, then this token isn't a macro identifier, nor an
     // unexpanded macro argument that we need to handle, print it.
     Printer.printToken(T);
static MacroNameAndArgs getMacroNameAndArgs(SourceLocation ExpanLoc,
   // will be expanded to. An expanded macro argument may contain several tokens
   // (like '3 + 4'), so we'll lex until we find a tok::comma or tok::r_paren, at
   // which point we start lexing the next argument or finish.
   ArrayRef<const IdentifierInfo *> MacroArgs = MI->params();
   if (MacroArgs.empty())
     return { MacroName, MI, {} };
 
   RawLexer.LexFromRawLexer(TheTok);
-  assert(TheTok.is(tok::l_paren) &&
-         "The token after the macro's identifier token should be '('!");
+  // When this is a token which expands to another macro function then its
+  // parentheses are not at its expansion locaiton. For example:
+  //
+  // #define foo(x) int bar() { return x; }
+  // #define apply_zero(f) f(0)
+  // apply_zero(foo)
+  //               ^
+  //               This is not a tok::l_paren, but foo is a function.
+  if (TheTok.isNot(tok::l_paren))
+    return { MacroName, MI, {} };
 
   MacroArgMap Args;
 
   // When the macro's argument is a function call, like
   //   CALL_FN(someFunctionName(param1, param2))
   // we will find tok::l_paren, tok::r_paren, and tok::comma that do not divide
   // actual macro arguments, or do not represent the macro argument's closing
   // parentheses, so we'll count how many parentheses aren't closed yet.

cfe/trunk/test/Analysis/Inputs/expected-plists/plist-macros-with-expansion.cpp.plist

    <key>0</key>
    <array>
     <integer>449</integer>
     <integer>450</integer>
     <integer>451</integer>
    </array>
   </dict>
   </dict>
+  <dict>
+   <key>path</key>
+   <array>
+    <dict>
+     <key>kind</key><string>control</string>
+     <key>edges</key>
+      <array>
+       <dict>
+        <key>start</key>
+         <array>
+          <dict>
+           <key>line</key><integer>459</integer>
+           <key>col</key><integer>33</integer>
+           <key>file</key><integer>0</integer>
+          </dict>
+          <dict>
+           <key>line</key><integer>459</integer>
+           <key>col</key><integer>33</integer>
+           <key>file</key><integer>0</integer>
+          </dict>
+         </array>
+        <key>end</key>
+         <array>
+          <dict>
+           <key>line</key><integer>459</integer>
+           <key>col</key><integer>37</integer>
+           <key>file</key><integer>0</integer>
+          </dict>
+          <dict>
+           <key>line</key><integer>459</integer>
+           <key>col</key><integer>39</integer>
+           <key>file</key><integer>0</integer>
+          </dict>
+         </array>
+       </dict>
+      </array>
+    </dict>
+    <dict>
+     <key>kind</key><string>event</string>
+     <key>location</key>
+     <dict>
+      <key>line</key><integer>459</integer>
+      <key>col</key><integer>37</integer>
+      <key>file</key><integer>0</integer>
+     </dict>
+     <key>ranges</key>
+     <array>
+       <array>
+        <dict>
+         <key>line</key><integer>459</integer>
+         <key>col</key><integer>37</integer>
+         <key>file</key><integer>0</integer>
+        </dict>
+        <dict>
+         <key>line</key><integer>459</integer>
+         <key>col</key><integer>41</integer>
+         <key>file</key><integer>0</integer>
+        </dict>
+       </array>
+     </array>
+     <key>depth</key><integer>0</integer>
+     <key>extended_message</key>
+     <string>Calling &apos;foo&apos;</string>
+     <key>message</key>
+     <string>Calling &apos;foo&apos;</string>
+    </dict>
+    <dict>
+     <key>kind</key><string>event</string>
+     <key>location</key>
+     <dict>
+      <key>line</key><integer>458</integer>
+      <key>col</key><integer>1</integer>
+      <key>file</key><integer>0</integer>
+     </dict>
+     <key>depth</key><integer>1</integer>
+     <key>extended_message</key>
+     <string>Entered call from &apos;useZeroApplier1&apos;</string>
+     <key>message</key>
+     <string>Entered call from &apos;useZeroApplier1&apos;</string>
+    </dict>
+    <dict>
+     <key>kind</key><string>event</string>
+     <key>location</key>
+     <dict>
+      <key>line</key><integer>458</integer>
+      <key>col</key><integer>1</integer>
+      <key>file</key><integer>0</integer>
+     </dict>
+     <key>ranges</key>
+     <array>
+       <array>
+        <dict>
+         <key>line</key><integer>458</integer>
+         <key>col</key><integer>1</integer>
+         <key>file</key><integer>0</integer>
+        </dict>
+        <dict>
+         <key>line</key><integer>458</integer>
+         <key>col</key><integer>16</integer>
+         <key>file</key><integer>0</integer>
+        </dict>
+       </array>
+     </array>
+     <key>depth</key><integer>1</integer>
+     <key>extended_message</key>
+     <string>Returning zero</string>
+     <key>message</key>
+     <string>Returning zero</string>
+    </dict>
+    <dict>
+     <key>kind</key><string>event</string>
+     <key>location</key>
+     <dict>
+      <key>line</key><integer>459</integer>
+      <key>col</key><integer>37</integer>
+      <key>file</key><integer>0</integer>
+     </dict>
+     <key>ranges</key>
+     <array>
+       <array>
+        <dict>
+         <key>line</key><integer>459</integer>
+         <key>col</key><integer>37</integer>
+         <key>file</key><integer>0</integer>
+        </dict>
+        <dict>
+         <key>line</key><integer>459</integer>
+         <key>col</key><integer>41</integer>
+         <key>file</key><integer>0</integer>
+        </dict>
+       </array>
+     </array>
+     <key>depth</key><integer>0</integer>
+     <key>extended_message</key>
+     <string>Returning from &apos;foo&apos;</string>
+     <key>message</key>
+     <string>Returning from &apos;foo&apos;</string>
+    </dict>
+    <dict>
+     <key>kind</key><string>control</string>
+     <key>edges</key>
+      <array>
+       <dict>
+        <key>start</key>
+         <array>
+          <dict>
+           <key>line</key><integer>459</integer>
+           <key>col</key><integer>37</integer>
+           <key>file</key><integer>0</integer>
+          </dict>
+          <dict>
+           <key>line</key><integer>459</integer>
+           <key>col</key><integer>39</integer>
+           <key>file</key><integer>0</integer>
+          </dict>
+         </array>
+        <key>end</key>
+         <array>
+          <dict>
+           <key>line</key><integer>459</integer>
+           <key>col</key><integer>35</integer>
+           <key>file</key><integer>0</integer>
+          </dict>
+          <dict>
+           <key>line</key><integer>459</integer>
+           <key>col</key><integer>35</integer>
+           <key>file</key><integer>0</integer>
+          </dict>
+         </array>
+       </dict>
+      </array>
+    </dict>
+    <dict>
+     <key>kind</key><string>event</string>
+     <key>location</key>
+     <dict>
+      <key>line</key><integer>459</integer>
+      <key>col</key><integer>35</integer>
+      <key>file</key><integer>0</integer>
+     </dict>
+     <key>ranges</key>
+     <array>
+       <array>
+        <dict>
+         <key>line</key><integer>459</integer>
+         <key>col</key><integer>33</integer>
+         <key>file</key><integer>0</integer>
+        </dict>
+        <dict>
+         <key>line</key><integer>459</integer>
+         <key>col</key><integer>41</integer>
+         <key>file</key><integer>0</integer>
+        </dict>
+       </array>
+     </array>
+     <key>depth</key><integer>0</integer>
+     <key>extended_message</key>
+     <string>Division by zero</string>
+     <key>message</key>
+     <string>Division by zero</string>
+    </dict>
+   </array>
+   <key>macro_expansions</key>
+   <array>
+    <dict>
+     <key>location</key>
+     <dict>
+      <key>line</key><integer>458</integer>
+      <key>col</key><integer>1</integer>
+      <key>file</key><integer>0</integer>
+     </dict>
+     <key>name</key><string>APPLY_ZERO1</string>
+     <key>expansion</key><string>int foo() { return x; }(0)</string>
+    </dict>
+   </array>
+   <key>description</key><string>Division by zero</string>
+   <key>category</key><string>Logic error</string>
+   <key>type</key><string>Division by zero</string>
+   <key>check_name</key><string>core.DivideZero</string>
+   <!-- This hash is experimental and going to change! -->
+   <key>issue_hash_content_of_line_in_context</key><string>7ff82561a6c752746649d05220deeb40</string>
+  <key>issue_context_kind</key><string>function</string>
+  <key>issue_context</key><string>useZeroApplier1</string>
+  <key>issue_hash_function_offset</key><string>0</string>
+  <key>location</key>
+  <dict>
+   <key>line</key><integer>459</integer>
+   <key>col</key><integer>35</integer>
+   <key>file</key><integer>0</integer>
+  </dict>
+  <key>ExecutedLines</key>
+  <dict>
+   <key>0</key>
+   <array>
+    <integer>458</integer>
+    <integer>459</integer>
+   </array>
+  </dict>
+  </dict>
+  <dict>
+   <key>path</key>
+   <array>
+    <dict>
+     <key>kind</key><string>control</string>
+     <key>edges</key>
+      <array>
+       <dict>
+        <key>start</key>
+         <array>
+          <dict>
+           <key>line</key><integer>468</integer>
+           <key>col</key><integer>33</integer>
+           <key>file</key><integer>0</integer>
+          </dict>
+          <dict>
+           <key>line</key><integer>468</integer>
+           <key>col</key><integer>33</integer>
+           <key>file</key><integer>0</integer>
+          </dict>
+         </array>
+        <key>end</key>
+         <array>
+          <dict>
+           <key>line</key><integer>468</integer>
+           <key>col</key><integer>37</integer>
+           <key>file</key><integer>0</integer>
+          </dict>
+          <dict>
+           <key>line</key><integer>468</integer>
+           <key>col</key><integer>39</integer>
+           <key>file</key><integer>0</integer>
+          </dict>
+         </array>
+       </dict>
+      </array>
+    </dict>
+    <dict>
+     <key>kind</key><string>event</string>
+     <key>location</key>
+     <dict>
+      <key>line</key><integer>468</integer>
+      <key>col</key><integer>37</integer>
+      <key>file</key><integer>0</integer>
+     </dict>
+     <key>ranges</key>
+     <array>
+       <array>
+        <dict>
+         <key>line</key><integer>468</integer>
+         <key>col</key><integer>37</integer>
+         <key>file</key><integer>0</integer>
+        </dict>
+        <dict>
+         <key>line</key><integer>468</integer>
+         <key>col</key><integer>41</integer>
+         <key>file</key><integer>0</integer>
+        </dict>
+       </array>
+     </array>
+     <key>depth</key><integer>0</integer>
+     <key>extended_message</key>
+     <string>Calling &apos;bar&apos;</string>
+     <key>message</key>
+     <string>Calling &apos;bar&apos;</string>
+    </dict>
+    <dict>
+     <key>kind</key><string>event</string>
+     <key>location</key>
+     <dict>
+      <key>line</key><integer>467</integer>
+      <key>col</key><integer>1</integer>
+      <key>file</key><integer>0</integer>
+     </dict>
+     <key>depth</key><integer>1</integer>
+     <key>extended_message</key>
+     <string>Entered call from &apos;useZeroApplier2&apos;</string>
+     <key>message</key>
+     <string>Entered call from &apos;useZeroApplier2&apos;</string>
+    </dict>
+    <dict>
+     <key>kind</key><string>event</string>
+     <key>location</key>
+     <dict>
+      <key>line</key><integer>467</integer>
+      <key>col</key><integer>1</integer>
+      <key>file</key><integer>0</integer>
+     </dict>
+     <key>ranges</key>
+     <array>
+       <array>
+        <dict>
+         <key>line</key><integer>467</integer>
+         <key>col</key><integer>1</integer>
+         <key>file</key><integer>0</integer>
+        </dict>
+        <dict>
+         <key>line</key><integer>467</integer>
+         <key>col</key><integer>11</integer>
+         <key>file</key><integer>0</integer>
+        </dict>
+       </array>
+     </array>
+     <key>depth</key><integer>1</integer>
+     <key>extended_message</key>
+     <string>Returning zero</string>
+     <key>message</key>
+     <string>Returning zero</string>
+    </dict>
+    <dict>
+     <key>kind</key><string>event</string>
+     <key>location</key>
+     <dict>
+      <key>line</key><integer>468</integer>
+      <key>col</key><integer>37</integer>
+      <key>file</key><integer>0</integer>
+     </dict>
+     <key>ranges</key>
+     <array>
+       <array>
+        <dict>
+         <key>line</key><integer>468</integer>
+         <key>col</key><integer>37</integer>
+         <key>file</key><integer>0</integer>
+        </dict>
+        <dict>
+         <key>line</key><integer>468</integer>
+         <key>col</key><integer>41</integer>
+         <key>file</key><integer>0</integer>
+        </dict>
+       </array>
+     </array>
+     <key>depth</key><integer>0</integer>
+     <key>extended_message</key>
+     <string>Returning from &apos;bar&apos;</string>
+     <key>message</key>
+     <string>Returning from &apos;bar&apos;</string>
+    </dict>
+    <dict>
+     <key>kind</key><string>control</string>
+     <key>edges</key>
+      <array>
+       <dict>
+        <key>start</key>
+         <array>
+          <dict>
+           <key>line</key><integer>468</integer>
+           <key>col</key><integer>37</integer>
+           <key>file</key><integer>0</integer>
+          </dict>
+          <dict>
+           <key>line</key><integer>468</integer>
+           <key>col</key><integer>39</integer>
+           <key>file</key><integer>0</integer>
+          </dict>
+         </array>
+        <key>end</key>
+         <array>
+          <dict>
+           <key>line</key><integer>468</integer>
+           <key>col</key><integer>35</integer>
+           <key>file</key><integer>0</integer>
+          </dict>
+          <dict>
+           <key>line</key><integer>468</integer>
+           <key>col</key><integer>35</integer>
+           <key>file</key><integer>0</integer>
+          </dict>
+         </array>
+       </dict>
+      </array>
+    </dict>
+    <dict>
+     <key>kind</key><string>event</string>
+     <key>location</key>
+     <dict>
+      <key>line</key><integer>468</integer>
+      <key>col</key><integer>35</integer>
+      <key>file</key><integer>0</integer>
+     </dict>
+     <key>ranges</key>
+     <array>
+       <array>
+        <dict>
+         <key>line</key><integer>468</integer>
+         <key>col</key><integer>33</integer>
+         <key>file</key><integer>0</integer>
+        </dict>
+        <dict>
+         <key>line</key><integer>468</integer>
+         <key>col</key><integer>41</integer>
+         <key>file</key><integer>0</integer>
+        </dict>
+       </array>
+     </array>
+     <key>depth</key><integer>0</integer>
+     <key>extended_message</key>
+     <string>Division by zero</string>
+     <key>message</key>
+     <string>Division by zero</string>
+    </dict>
+   </array>
+   <key>macro_expansions</key>
+   <array>
+    <dict>
+     <key>location</key>
+     <dict>
+      <key>line</key><integer>467</integer>
+      <key>col</key><integer>1</integer>
+      <key>file</key><integer>0</integer>
+     </dict>
+     <key>name</key><string>APPLY_ZERO2</string>
+     <key>expansion</key><string>int bar() { return 0; }</string>
+    </dict>
+   </array>
+   <key>description</key><string>Division by zero</string>
+   <key>category</key><string>Logic error</string>
+   <key>type</key><string>Division by zero</string>
+   <key>check_name</key><string>core.DivideZero</string>
+   <!-- This hash is experimental and going to change! -->
+   <key>issue_hash_content_of_line_in_context</key><string>dd82c11b436b00009e37f54b1620a728</string>
+  <key>issue_context_kind</key><string>function</string>
+  <key>issue_context</key><string>useZeroApplier2</string>
+  <key>issue_hash_function_offset</key><string>0</string>
+  <key>location</key>
+  <dict>
+   <key>line</key><integer>468</integer>
+   <key>col</key><integer>35</integer>
+   <key>file</key><integer>0</integer>
+  </dict>
+  <key>ExecutedLines</key>
+  <dict>
+   <key>0</key>
+   <array>
+    <integer>467</integer>
+    <integer>468</integer>
+   </array>
+  </dict>
+  </dict>
  </array>
  <key>files</key>
  <array>
   <string>/home/szelethus/Documents/macro_expansion/clang/test/Analysis/plist-macros-with-expansion.cpp</string>
  </array>
 </dict>
 </plist>

cfe/trunk/test/Analysis/plist-macros-with-expansion.cpp

 #define REC_MACRO_FUNC(REC_MACRO_PARAM) garbage_##REC_MACRO_PARAM
 #define value REC_MACRO_FUNC(value)
 
 void recursiveMacroUser() {
   if (value == 0)
     1 / value; // expected-warning{{Division by zero}}
                // expected-warning@-1{{expression result unused}}
 }
+
+#define FOO(x) int foo() { return x; }
+#define APPLY_ZERO1(function) function(0)
+
+APPLY_ZERO1(FOO)
+void useZeroApplier1() { (void)(1 / foo()); } // expected-warning{{Division by zero}}
+
+// CHECK: <key>name</key><string>APPLY_ZERO1</string>
+// CHECK-NEXT: <key>expansion</key><string>int foo() { return x; }(0)</string>
+
+#define BAR(x) int bar() { return x; }
+#define APPLY_ZERO2 BAR(0)
+
+APPLY_ZERO2
+void useZeroApplier2() { (void)(1 / bar()); } // expected-warning{{Division by zero}}
+
+// CHECK: <key>name</key><string>APPLY_ZERO2</string>
+// CHECK-NEXT: <key>expansion</key><string>int bar() { return 0; }</string>