[analyzer] Add a debug analyzer config to place an event for each tracked condition

[Szelethus]

Summary

Exactly what it says on the tin!

I expect this to be especially valuable on production code where control dependencies aren't obvious.

[NoQ]

Aha, yep, nice debug flag!

clang/test/Analysis/track-control-dependency-conditions.cpp

17

Pls consider -verify= here as well.

clang/include/clang/StaticAnalyzer/Core/AnalyzerOptions.def

ANALYZER_OPTION(bool, DisplayCTUProgress, "display-ctu-progress",
                 "the analyzer's progress related to ctu.",
                 false)
 
 ANALYZER_OPTION(bool, ShouldTrackConditions, "track-conditions",
                 "Whether to track conditions that are a control dependency of "
                 "an already tracked variable.",
                 false)
 
+ANALYZER_OPTION(bool, ShouldTrackConditionsDebug, "track-conditions-debug",
+                "Whether to place an event at each tracked condition.",
+                false)
+
 //===----------------------------------------------------------------------===//
 // Unsinged analyzer options.
 //===----------------------------------------------------------------------===//
 
 ANALYZER_OPTION(
     unsigned, AlwaysInlineSize, "ipa-always-inline-size",
     "The size of the functions (in basic blocks), which should be considered "
     "to be small enough to always inline.",

clang/lib/Frontend/CompilerInvocation.cpp

 #undef ANALYZER_OPTION
 #undef ANALYZER_OPTION_DEPENDS_ON_USER_MODE
 
   // At this point, AnalyzerOptions is configured. Let's validate some options.
 
   if (!Diags)
     return;
 
+  if (AnOpts.ShouldTrackConditionsDebug && !AnOpts.ShouldTrackConditions)
+    Diags->Report(diag::err_analyzer_config_invalid_input)
+        << "track-conditions-debug" << "'track-conditions' to also be enabled";
+
   if (!AnOpts.CTUDir.empty() && !llvm::sys::fs::is_directory(AnOpts.CTUDir))
     Diags->Report(diag::err_analyzer_config_invalid_input) << "ctu-dir"
                                                            << "a filename";
 
   if (!AnOpts.ModelPath.empty() &&
       !llvm::sys::fs::is_directory(AnOpts.ModelPath))
     Diags->Report(diag::err_analyzer_config_invalid_input) << "model-path"
                                                            << "a filename";

clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

if (auto SP = Node->getLocationAs<StmtPoint>()) {
 
     return const_cast<CFGBlock *>(Node->getLocationContext()
         ->getAnalysisDeclContext()->getCFGStmtMap()->getBlock(S));
   }
 
   return nullptr;
 }
 
+static std::shared_ptr<PathDiagnosticEventPiece>
+constructDebugPieceForTrackedCondition(const Expr *Cond,
+                                       const ExplodedNode *N,
+                                       BugReporterContext &BRC) {
+
+  if (BRC.getAnalyzerOptions().AnalysisDiagOpt == PD_NONE ||
+      !BRC.getAnalyzerOptions().ShouldTrackConditionsDebug)
+    return nullptr;
+
+  std::string ConditionText = Lexer::getSourceText(
+      CharSourceRange::getTokenRange(Cond->getSourceRange()),
+                                     BRC.getSourceManager(),
+                                     BRC.getASTContext().getLangOpts());
+
+  return std::make_shared<PathDiagnosticEventPiece>(
+      PathDiagnosticLocation::createBegin(
+          Cond, BRC.getSourceManager(), N->getLocationContext()),
+          (Twine() + "Tracking condition '" + ConditionText + "'").str());
+}
+
 std::shared_ptr<PathDiagnosticPiece>
 TrackControlDependencyCondBRVisitor::VisitNode(const ExplodedNode *N,
                                                BugReporterContext &BRC,
                                                BugReport &BR) {
   // We can only reason about control dependencies within the same stack frame.
   if (Origin->getStackFrame() != N->getStackFrame())
     return nullptr;
 
TrackControlDependencyCondBRVisitor::VisitNode(const ExplodedNode *N,
   if (ControlDeps.isControlDependent(OriginB, NB)) {
     if (const Expr *Condition = NB->getLastCondition()) {
       // Keeping track of the already tracked conditions on a visitor level
       // isn't sufficient, because a new visitor is created for each tracked
       // expression, hence the BugReport level set.
       if (BR.addTrackedCondition(N)) {
         bugreporter::trackExpressionValue(
             N, Condition, BR, /*EnableNullFPSuppression=*/false);
+        return constructDebugPieceForTrackedCondition(Condition, N, BRC);
       }
     }
   }
 
   return nullptr;
 }
 
 //===----------------------------------------------------------------------===//

clang/test/Analysis/analyzer-config.c

 // CHECK-NEXT: region-store-small-struct-limit = 2
 // CHECK-NEXT: report-in-main-source-file = false
 // CHECK-NEXT: serialize-stats = false
 // CHECK-NEXT: stable-report-filename = false
 // CHECK-NEXT: suppress-c++-stdlib = true
 // CHECK-NEXT: suppress-inlined-defensive-checks = true
 // CHECK-NEXT: suppress-null-return-paths = true
 // CHECK-NEXT: track-conditions = false
+// CHECK-NEXT: track-conditions-debug = false
 // CHECK-NEXT: unix.DynamicMemoryModeling:Optimistic = false
 // CHECK-NEXT: unroll-loops = false
 // CHECK-NEXT: widen-loops = false
 // CHECK-NEXT: [stats]
-// CHECK-NEXT: num-entries = 86
+// CHECK-NEXT: num-entries = 87

clang/test/Analysis/track-control-dependency-conditions.cpp

 // RUN: %clang_analyze_cc1 %s \
 // RUN:   -verify=expected,tracking \
 // RUN:   -analyzer-config track-conditions=true \
 // RUN:   -analyzer-output=text \
 // RUN:   -analyzer-checker=core
+
+// RUN: not %clang_analyze_cc1 -verify %s \
+// RUN:   -analyzer-checker=core \
+// RUN:   -analyzer-config track-conditions-debug=true \
+// RUN:   2>&1 | FileCheck %s -check-prefix=CHECK-INVALID-DEBUG
+
+// CHECK-INVALID-DEBUG: (frontend): invalid input for analyzer-config option
+// CHECK-INVALID-DEBUG-SAME:        'track-conditions-debug', that expects
+// CHECK-INVALID-DEBUG-SAME:        'track-conditions' to also be enabled
 //
+// RUN: %clang_analyze_cc1 %s \
+// RUN:   -verify=expected,tracking,debug \
+// RUN:   -analyzer-config track-conditions=true \
+// RUN:   -analyzer-config track-conditions-debug=true \
+// RUN:   -analyzer-output=text \
+// RUN:   -analyzer-checker=core
+
 // RUN: %clang_analyze_cc1 %s -verify \
 // RUN:   -analyzer-output=text \
 // RUN:   -analyzer-checker=core
 
 namespace example_1 {
 int flag;
 bool coin();
 
if (flag) // expected-note   {{Assuming 'flag' is 0}}
             // expected-note@-1{{Taking false branch}}
     x = new int;
 
   foo(); // tracking-note{{Calling 'foo'}}
          // tracking-note@-1{{Returning from 'foo'}}
 
   if (flag) // expected-note   {{Assuming 'flag' is not equal to 0}}
             // expected-note@-1{{Taking true branch}}
+            // debug-note@-2{{Tracking condition 'flag'}}
+
     *x = 5; // expected-warning{{Dereference of null pointer}}
             // expected-note@-1{{Dereference of null pointer}}
 }
 } // end of namespace example_1
 
 namespace example_2 {
 int flag;
 bool coin();
void test() {
 
   x = 0; // expected-note{{Null pointer value stored to 'x'}}
 
   foo(); // tracking-note{{Calling 'foo'}}
          // tracking-note@-1{{Returning from 'foo'}}
 
   if (flag) // expected-note   {{Assuming 'flag' is not equal to 0}}
             // expected-note@-1{{Taking true branch}}
+            // debug-note@-2{{Tracking condition 'flag'}}
+
     *x = 5; // expected-warning{{Dereference of null pointer}}
             // expected-note@-1{{Dereference of null pointer}}
 }
 } // end of namespace example_2
 
 namespace global_variable_invalidation {
 int flag;
 bool coin();
void test() {
   int *x = 0; // expected-note{{'x' initialized to a null pointer value}}
   flag = 1;
 
   foo(); // tracking-note{{Calling 'foo'}}
          // tracking-note@-1{{Returning from 'foo'}}
 
   if (bar) // expected-note   {{Assuming 'bar' is not equal to 0}}
            // expected-note@-1{{Taking true branch}}
+           // debug-note@-2{{Tracking condition 'bar'}}
     if (flag) // expected-note   {{Assuming 'flag' is not equal to 0}}
               // expected-note@-1{{Taking true branch}}
+              // debug-note@-2{{Tracking condition 'flag'}}
+
       *x = 5; // expected-warning{{Dereference of null pointer}}
               // expected-note@-1{{Dereference of null pointer}}
 }
 } // end of namespace global_variable_invalidation
 
 namespace variable_declaration_in_condition {
 bool coin();
 
 bool foo() {
   return coin(); // tracking-note{{Returning value}}
 }
 
 int bar;
 
 void test() {
   int *x = 0; // expected-note{{'x' initialized to a null pointer value}}
 
   if (int flag = foo()) // tracking-note{{Calling 'foo'}}
                         // tracking-note@-1{{Returning from 'foo'}}
                         // tracking-note@-2{{'flag' initialized here}}
-
+                        // debug-note@-3{{Tracking condition 'flag'}}
                         // expected-note@-4{{Assuming 'flag' is not equal to 0}}
                         // expected-note@-5{{Taking true branch}}
 
     *x = 5; // expected-warning{{Dereference of null pointer}}
             // expected-note@-1{{Dereference of null pointer}}
 }
 } // end of namespace variable_declaration_in_condition
 
 namespace conversion_to_bool {
 bool coin();
 
 struct ConvertsToBool {
   operator bool() const { return coin(); } // tracking-note{{Returning value}}
 };
 
 void test() {
   int *x = 0; // expected-note{{'x' initialized to a null pointer value}}
 
   if (ConvertsToBool())
     // tracking-note@-1 {{Calling 'ConvertsToBool::operator bool'}}
     // tracking-note@-2{{Returning from 'ConvertsToBool::operator bool'}}
-
+    // debug-note@-3{{Tracking condition 'ConvertsToBool()'}}
     // expected-note@-4{{Assuming the condition is true}}
     // expected-note@-5{{Taking true branch}}
     *x = 5; // expected-warning{{Dereference of null pointer}}
             // expected-note@-1{{Dereference of null pointer}}
 }
 
 } // end of namespace variable_declaration_in_condition
 
 namespace unimportant_returning_value_note {
 bool coin();
 
 bool flipCoin() { return coin(); } // tracking-note{{Returning value}}
 
 void i(int *ptr) {
   if (ptr) // expected-note{{Assuming 'ptr' is null}}
            // expected-note@-1{{Taking false branch}}
     ;
   if (!flipCoin())
     // tracking-note@-1{{Calling 'flipCoin'}}
     // tracking-note@-2{{Returning from 'flipCoin'}}
-    // expected-note@-3{{Assuming the condition is true}}
-    // expected-note@-4{{Taking true branch}}
+    // debug-note@-3{{Tracking condition '!flipCoin()'}}
+    // expected-note@-4{{Assuming the condition is true}}
+    // expected-note@-5{{Taking true branch}}
     *ptr = 5; // expected-warning{{Dereference of null pointer}}
               // expected-note@-1{{Dereference of null pointer}}
 }
 } // end of namespace unimportant_returning_value_note
 
 namespace important_returning_value_note {
 bool coin();
 
 bool flipCoin() {
   if (coin()) // tracking-note{{Assuming the condition is false}}
               // tracking-note@-1{{Taking false branch}}
+              // debug-note@-2{{Tracking condition 'coin()'}}
     return true;
   return coin(); // tracking-note{{Returning value}}
 }
 
 void i(int *ptr) {
   if (ptr) // expected-note{{Assuming 'ptr' is null}}
            // expected-note@-1{{Taking false branch}}
     ;
   if (!flipCoin())
     // tracking-note@-1{{Calling 'flipCoin'}}
     // tracking-note@-2{{Returning from 'flipCoin'}}
-    // expected-note@-3{{Assuming the condition is true}}
-    // expected-note@-4{{Taking true branch}}
+    // debug-note@-3{{Tracking condition '!flipCoin()'}}
+    // expected-note@-4{{Assuming the condition is true}}
+    // expected-note@-5{{Taking true branch}}
     *ptr = 5; // expected-warning{{Dereference of null pointer}}
               // expected-note@-1{{Dereference of null pointer}}
 }
 } // end of namespace important_returning_value_note
 
 namespace tracked_condition_is_only_initialized {
 int getInt();
 
 void f() {
   int flag = getInt(); // tracking-note{{'flag' initialized here}}
   int *x = 0; // expected-note{{'x' initialized to a null pointer value}}
   if (flag) // expected-note{{Assuming 'flag' is not equal to 0}}
             // expected-note@-1{{Taking true branch}}
+            // debug-note@-2{{Tracking condition 'flag'}}
     *x = 5; // expected-warning{{Dereference of null pointer}}
             // expected-note@-1{{Dereference of null pointer}}
 }
 } // end of namespace tracked_condition_is_only_initialized
 
 namespace tracked_condition_written_in_same_stackframe {
 int flag;
 int getInt();
 
 void f(int y) {
   y = 1; // tracking-note{{The value 1 is assigned to 'y'}}
   flag = y; // tracking-note{{The value 1 is assigned to 'flag'}}
 
   int *x = 0; // expected-note{{'x' initialized to a null pointer value}}
   if (flag) // expected-note{{'flag' is 1}}
             // expected-note@-1{{Taking true branch}}
+            // debug-note@-2{{Tracking condition 'flag'}}
     *x = 5; // expected-warning{{Dereference of null pointer}}
             // expected-note@-1{{Dereference of null pointer}}
 }
 } // end of namespace tracked_condition_written_in_same_stackframe
 
 namespace tracked_condition_written_in_nested_stackframe {
 int flag;
 int getInt();
 
 void foo() {
   int y;
   y = 1; // tracking-note{{The value 1 is assigned to 'y'}}
   flag = y; // tracking-note{{The value 1 is assigned to 'flag'}}
 
 }
 
 void f(int y) {
   int *x = 0; // expected-note{{'x' initialized to a null pointer value}}
 
   foo(); // tracking-note{{Calling 'foo'}}
          // tracking-note@-1{{Returning from 'foo'}}
 
   if (flag) // expected-note{{'flag' is 1}}
             // expected-note@-1{{Taking true branch}}
+            // debug-note@-2{{Tracking condition 'flag'}}
     *x = 5; // expected-warning{{Dereference of null pointer}}
             // expected-note@-1{{Dereference of null pointer}}
 }
 } // end of namespace tracked_condition_written_in_nested_stackframe
 
 namespace collapse_point_not_in_condition {
 
 [[noreturn]] void halt();
 
 void assert(int b) {
   if (!b) // tracking-note{{Assuming 'b' is not equal to 0}}
           // tracking-note@-1{{Taking false branch}}
     halt();
 }
 
 void f(int flag) {
   int *x = 0; // expected-note{{'x' initialized to a null pointer value}}
 
   assert(flag); // tracking-note{{Calling 'assert'}}
                 // tracking-note@-1{{Returning from 'assert'}}
 
   if (flag) // expected-note{{'flag' is not equal to 0}}
             // expected-note@-1{{Taking true branch}}
+            // debug-note@-2{{Tracking condition 'flag'}}
     *x = 5; // expected-warning{{Dereference of null pointer}}
             // expected-note@-1{{Dereference of null pointer}}
 }
 
 } // end of namespace collapse_point_not_in_condition
 
 namespace unimportant_write_before_collapse_point {
 
void f(int flag) {
   int *x = 0; // expected-note{{'x' initialized to a null pointer value}}
 
   flag = getInt(); // tracking-note{{Value assigned to 'flag'}}
   assert(flag); // tracking-note{{Calling 'assert'}}
                 // tracking-note@-1{{Returning from 'assert'}}
 
   if (flag) // expected-note{{'flag' is not equal to 0}}
             // expected-note@-1{{Taking true branch}}
+            // debug-note@-2{{Tracking condition 'flag'}}
     *x = 5; // expected-warning{{Dereference of null pointer}}
             // expected-note@-1{{Dereference of null pointer}}
 }
 
 } // end of namespace unimportant_write_before_collapse_point