[analyzer] exploded-graph-rewriter: Add support for objects under construction.

[NoQ]

Summary

This trait is Environment-like, so there was a chance to re-use a lot of code here as well.

[Charusso]

SSS! Thanks!

[NoQ]

No longer crashes on seeing CXXCtorInitializers. Test added.

[Charusso]

Thanks for testing it!

clang/utils/analyzer/exploded-graph-rewriter.py

76

Oh yeah, I forgot it as eventually we will bump into situations when Error() occurs. When I tested that script for myself I have seen two or three. Ofc it is ongoing to patch it, just I have not allocated time yet for creating an SVGParser to call DOTParser.

clang/test/Analysis/exploded-graph-rewriter/constraints.dot

"{
     { "node_id": 1,
       "pointer": "0x1",
       "state_id": 2,
       "program_points": [],
       "program_state": {
         "store": null,
         "environment": null,
         "dynamic_types": null,
+        "constructing_objects": null,
         "constraints": [
           { "symbol": "reg_$0<x>", "range": "{ [0, 0] }" }
         ]
       }
     }
 \l}"];

clang/test/Analysis/exploded-graph-rewriter/constraints_diff.dot

 // RUN: %exploded_graph_rewriter -d %s | FileCheck %s
 
 // FIXME: Substitution doesn't seem to work on Windows.
 // UNSUPPORTED: system-windows
 
 Node0x1 [shape=record,label=
  "{
     { "node_id": 1,
       "pointer": "0x1",
       "state_id": 2,
       "program_points": [],
       "program_state": {
         "store": null,
         "environment": null,
         "dynamic_types": null,
+        "constructing_objects": null,
         "constraints": [
           { "symbol": "reg_$0<x>", "range": "{ [0, 10] }" }
         ]
       }
     }
 \l}"];
 
 Node0x1 -> Node0x3;
"{
     { "node_id": 3,
       "pointer": "0x3",
       "state_id": 4,
       "program_points": [],
       "program_state": {
         "store": null,
         "environment": null,
         "dynamic_types": null,
+        "constructing_objects": null,
         "constraints": [
           { "symbol": "reg_$0<x>", "range": "{ [0, 5] }" }
         ]
       }
     }
 \l}"];
 
 Node0x3 -> Node0x5;
 
 Node0x5 [shape=record,label=
  "{
     { "node_id": 5,
       "pointer": "0x5",
       "state_id": 6,
       "program_points": [],
       "program_state": {
         "store": null,
         "environment": null,
         "constraints": null,
-        "dynamic_types": null
+        "dynamic_types": null,
+        "constructing_objects": null
       }
     }
 \l}"];

clang/test/Analysis/exploded-graph-rewriter/environment.dot

"{
     { "node_id": 1,
       "pointer": "0x1",
       "state_id": 2,
       "program_points": [],
       "program_state": {
         "store": null,
         "constraints": null,
         "dynamic_types": null,
+        "constructing_objects": null,
         "environment": {
           "pointer": "0x2",
           "items": [
             {
               "location_context": "#0 Call",
               "lctx_id": 3,
               "calling": "foo",
               "call_line": 4,

clang/test/Analysis/exploded-graph-rewriter/environment_diff.dot

 // RUN: %exploded_graph_rewriter -d %s | FileCheck %s
 
 // FIXME: Substitution doesn't seem to work on Windows.
 // UNSUPPORTED: system-windows
 
 // No diffs on the first node, nothing to check.
 Node0x1 [shape=record,label=
  "{
     { "node_id": 1,
       "pointer": "0x1",
       "state_id": 2,
       "program_points": [],
       "program_state": {
         "store": null,
         "constraints": null,
         "dynamic_types": null,
+        "constructing_objects": null,
         "environment": {
           "pointer": "0x2",
           "items": [
             {
               "location_context": "#0 Call",
               "lctx_id": 3,
               "calling": "foo",
               "call_line": 4,
"{
     { "node_id": 6,
       "pointer": "0x6",
       "state_id": 7,
       "program_points": [],
       "program_state": {
         "store": null,
         "constraints": null,
         "dynamic_types": null,
+        "constructing_objects": null,
         "environment": {
           "pointer": "0x2",
           "items": [
             {
               "location_context": "#0 Call",
               "lctx_id": 3,
               "calling": "foo",
               "call_line": 4,
"{
     { "node_id": 9,
       "pointer": "0x9",
       "state_id": 7,
       "program_points": [],
       "program_state": {
         "store": null,
         "constraints": null,
         "dynamic_types": null,
+        "constructing_objects": null,
         "environment": {
           "pointer": "0x2",
           "items": [
             {
               "location_context": "#0 Call",
               "lctx_id": 3,
               "calling": "foo",
               "call_line": 4,

clang/test/Analysis/exploded-graph-rewriter/initializers_under_construction.cpp

+// FIXME: Figure out how to use %clang_analyze_cc1 with our lit.local.cfg.
+// RUN: %clang_cc1 -analyze -triple x86_64-unknown-linux-gnu \
+// RUN:                     -analyzer-checker=core \
+// RUN:                     -analyzer-dump-egraph=%t.dot %s
+// RUN: %exploded_graph_rewriter %t.dot | FileCheck %s
+// REQUIRES: asserts
+
+// FIXME: Substitution doesn't seem to work on Windows.
+// UNSUPPORTED: system-windows
+
+struct A {
+  A() {}
+};
+
+struct B {
+  A a;
+  B() : a() {}
+};
+
+void test() {
+  // CHECK: (construct into member variable)
+  // CHECK-SAME: <td align="left">a</td>
+  // CHECK-SAME: <td align="left">&amp;b-&gt;a</td>
+  B b;
+}

clang/test/Analysis/exploded-graph-rewriter/objects_under_construction.cpp

+// FIXME: Figure out how to use %clang_analyze_cc1 with our lit.local.cfg.
+// RUN: %clang_cc1 -analyze -triple x86_64-unknown-linux-gnu \
+// RUN:                     -analyzer-checker=core \
+// RUN:                     -analyzer-dump-egraph=%t.dot %s
+// RUN: %exploded_graph_rewriter %t.dot | FileCheck %s
+// REQUIRES: asserts
+
+// FIXME: Substitution doesn't seem to work on Windows.
+// UNSUPPORTED: system-windows
+
+struct S {
+  S() {}
+};
+
+void test() {
+  // CHECK: Objects Under Construction:
+  // CHECK-SAME: <tr>
+  // CHECK-SAME:   <td align="left"><b>#0 Call</b></td>
+  // CHECK-SAME:   <td align="left" colspan="2">
+  // CHECK-SAME:     <font color="grey60">test </font>
+  // CHECK-SAME:   </td>
+  // CHECK-SAME: </tr>
+  // CHECK-SAME: <tr>
+  // CHECK-SAME:   <td align="left"><i>S{{[0-9]*}}</i></td>
+  // CHECK-SAME:   <td align="left"><font color="darkgreen"><i>
+  // CHECK-SAME:     (materialize temporary)
+  // CHECK-SAME:   </i></font></td>
+  // CHECK-SAME:   <td align="left">S()</td>
+  // CHECK-SAME:   <td align="left">&amp;s</td>
+  // CHECK-SAME: </tr>
+  // CHECK-SAME: <tr>
+  // CHECK-SAME:   <td align="left"><i>S{{[0-9]*}}</i></td>
+  // CHECK-SAME:   <td align="left"><font color="darkgreen"><i>
+  // CHECK-SAME:     (elide constructor)
+  // CHECK-SAME:   </i></font></td>
+  // CHECK-SAME:   <td align="left">S()</td>
+  // CHECK-SAME:   <td align="left">&amp;s</td>
+  // CHECK-SAME: </tr>
+  // CHECK-SAME: <tr>
+  // CHECK-SAME:   <td align="left"><i>S{{[0-9]*}}</i></td>
+  // CHECK-SAME:   <td align="left"><font color="darkgreen"><i>
+  // CHECK-SAME:     (construct into local variable)
+  // CHECK-SAME:   </i></font></td>
+  // CHECK-SAME:   <td align="left">S s = S();</td>
+  // CHECK-SAME:   <td align="left">&amp;s</td>
+  // CHECK-SAME: </tr>
+  S s = S();
+}

clang/test/Analysis/exploded-graph-rewriter/store.dot

"{
     { "node_id": 1,
       "pointer": "0x1",
       "state_id": 2,
       "program_points": [],
       "program_state": {
         "environment": null,
         "constraints": null,
         "dynamic_types": null,
+        "constructing_objects": null,
         "store": {
           "pointer": "0x2",
           "items": [
             {
               "cluster": "x",
               "pointer": "0x3",
               "items": [
                 {

clang/test/Analysis/exploded-graph-rewriter/store_diff.dot

 // RUN: %exploded_graph_rewriter -d %s | FileCheck %s
 
 // FIXME: Substitution doesn't seem to work on Windows.
 // UNSUPPORTED: system-windows
 
 Node0x1 [shape=record,label=
  "{
     { "node_id": 1,
       "pointer": "0x1",
       "state_id": 2,
       "program_points": [],
       "program_state": {
         "environment": null,
         "constraints": null,
         "dynamic_types": null,
+        "constructing_objects": null,
         "store": {
           "pointer": "0x2",
           "items": [
             {
               "cluster": "x",
               "pointer": "0x3",
               "items": [
                 {
"{
     { "node_id": 4,
       "pointer": "0x4",
       "state_id": 5,
       "program_points": [],
       "program_state": {
         "environment": null,
         "constraints": null,
         "dynamic_types": null,
+        "constructing_objects": null,
         "store": {
           "pointer": "0x5",
           "items": [
             {
               "cluster": "x",
               "pointer": "0x3",
               "items": [
                 {

clang/utils/analyzer/exploded-graph-rewriter.py

def __init__(self, json_pp):
         elif self.kind == 'BlockEntrance':
             self.block_id = json_pp['block_id']
 
 
 # A single expression acting as a key in a deserialized Environment.
 class EnvironmentBindingKey(object):
     def __init__(self, json_ek):
         super(EnvironmentBindingKey, self).__init__()
-        self.stmt_id = json_ek['stmt_id']
+        # CXXCtorInitializer is not a Stmt!
+        self.stmt_id = json_ek['stmt_id'] if 'stmt_id' in json_ek \
+            else json_ek['init_id']
         self.pretty = json_ek['pretty']
+        self.kind = json_ek['kind'] if 'kind' in json_ek else None
 
     def _key(self):
         return self.stmt_id
 
     def __eq__(self, other):
         return self._key() == other._key()
 
     def __hash__(self):
class EnvironmentFrame(object):
     def diff_bindings(self, prev):
         return diff_dicts(self.bindings, prev.bindings)
 
     def is_different(self, prev):
         removed, added = self.diff_bindings(prev)
         return len(removed) != 0 or len(added) != 0
 
 
-# A deserialized Environment.
-class Environment(object):
+# A deserialized Environment. This class can also hold other entities that
+# are similar to Environment, such as Objects Under Construction.
+class GenericEnvironment(object):
     def __init__(self, json_e):
-        super(Environment, self).__init__()
-        self.ptr = json_e['pointer']
-        self.frames = [EnvironmentFrame(f) for f in json_e['items']]
+        super(GenericEnvironment, self).__init__()
+        self.frames = [EnvironmentFrame(f) for f in json_e]
 
     def diff_frames(self, prev):
         # TODO: It's difficult to display a good diff when frame numbers shift.
         if len(self.frames) != len(prev.frames):
             return None
 
         updated = []
         for i in range(len(self.frames)):

 
 # A deserialized program state.
 class ProgramState(object):
     def __init__(self, state_id, json_ps):
         super(ProgramState, self).__init__()
         logging.debug('Adding ProgramState ' + str(state_id))
 
         self.state_id = state_id
+
         self.store = Store(json_ps['store']) \
             if json_ps['store'] is not None else None
-        self.environment = Environment(json_ps['environment']) \
+
+        self.environment = \
+            GenericEnvironment(json_ps['environment']['items']) \
             if json_ps['environment'] is not None else None
+
         self.constraints = GenericMap([
             (c['symbol'], c['range']) for c in json_ps['constraints']
         ]) if json_ps['constraints'] is not None else None
+
         self.dynamic_types = GenericMap([
                 (t['region'], '%s%s' % (t['dyn_type'],
                                         ' (or a sub-class)'
                                         if t['sub_classable'] else ''))
                 for t in json_ps['dynamic_types']]) \
             if json_ps['dynamic_types'] is not None else None
 
-        # TODO: Objects under construction.
+        self.constructing_objects = \
+            GenericEnvironment(json_ps['constructing_objects']) \
+            if json_ps['constructing_objects'] is not None else None
+
         # TODO: Checker messages.
 
 
 # A deserialized exploded graph node. Has a default constructor because it
 # may be referenced as part of an edge before its contents are deserialized,
 # and in this moment we already need a room for predecessors and successors.
 class ExplodedNode(object):
     def __init__(self):
def visit_environment(self, e, prev_e=None):
                        % (self._diff_plus_minus(is_added),
                           lc.caption, lc.decl,
                           ('(line %s)' % lc.line) if lc.line is not None
                           else ''))
 
         def dump_binding(f, b, is_added=None):
             self._dump('<tr><td>%s</td>'
                        '<td align="left"><i>S%s</i></td>'
+                       '%s'
                        '<td align="left">%s</td>'
                        '<td align="left">%s</td></tr>'
                        % (self._diff_plus_minus(is_added),
-                          b.stmt_id, b.pretty, f.bindings[b]))
+                          b.stmt_id,
+                          '<td align="left"><font color="darkgreen"><i>'
+                          '(%s)</i></font></td>' % b.kind
+                          if b.kind is not None else '',
+                          b.pretty, f.bindings[b]))
 
         frames_updated = e.diff_frames(prev_e) if prev_e is not None else None
         if frames_updated:
             for i in frames_updated:
                 f = e.frames[i]
                 prev_f = prev_e.frames[i]
                 dump_location_context(f.location_context)
                 bindings_removed, bindings_added = f.diff_bindings(prev_f)
                 for b in bindings_removed:
                     dump_binding(prev_f, b, False)
                 for b in bindings_added:
                     dump_binding(f, b, True)
         else:
             for f in e.frames:
                 dump_location_context(f.location_context)
                 for b in f.bindings:
                     dump_binding(f, b)
 
         self._dump('</table>')
 
-    def visit_environment_in_state(self, s, prev_s=None):
-        self._dump('<hr /><tr><td align="left"><b>Environment: </b>')
-        if s.environment is None:
+    def visit_environment_in_state(self, selector, title, s, prev_s=None):
+        e = getattr(s, selector)
+        prev_e = getattr(prev_s, selector) if prev_s is not None else None
+        if e is None and prev_e is None:
+            return
+
+        self._dump('<hr /><tr><td align="left"><b>%s: </b>' % title)
+        if e is None:
             self._dump('<i> Nothing!</i>')
         else:
-            if prev_s is not None and prev_s.environment is not None:
-                if s.environment.is_different(prev_s.environment):
+            if prev_e is not None:
+                if e.is_different(prev_e):
                     self._dump('</td></tr><tr><td align="left">')
-                    self.visit_environment(s.environment, prev_s.environment)
+                    self.visit_environment(e, prev_e)
                 else:
                     self._dump('<i> No changes!</i>')
             else:
                 self._dump('</td></tr><tr><td align="left">')
-                self.visit_environment(s.environment)
+                self.visit_environment(e)
 
         self._dump('</td></tr>')
 
     def visit_store(self, s, prev_s=None):
         self._dump('<table border="0">')
 
         def dump_binding(s, c, b, is_added=None):
             self._dump('<tr><td>%s</td>'
def visit_store(self, s, prev_s=None):
         else:
             for c in s.clusters:
                 for b in s.clusters[c].bindings:
                     dump_binding(s, c, b)
 
         self._dump('</table>')
 
     def visit_store_in_state(self, s, prev_s=None):
+        st = s.store
+        prev_st = prev_s.store if prev_s is not None else None
+        if st is None and prev_st is None:
+            return
+
         self._dump('<hr /><tr><td align="left"><b>Store: </b>')
-        if s.store is None:
+        if st is None:
             self._dump('<i> Nothing!</i>')
         else:
-            if prev_s is not None and prev_s.store is not None:
-                if s.store.is_different(prev_s.store):
+            if prev_st is not None:
+                if s.store.is_different(prev_st):
                     self._dump('</td></tr><tr><td align="left">')
-                    self.visit_store(s.store, prev_s.store)
+                    self.visit_store(st, prev_st)
                 else:
                     self._dump('<i> No changes!</i>')
             else:
                 self._dump('</td></tr><tr><td align="left">')
-                self.visit_store(s.store)
+                self.visit_store(st)
         self._dump('</td></tr>')
 
     def visit_generic_map(self, m, prev_m=None):
         self._dump('<table border="0">')
 
         def dump_pair(m, k, is_added=None):
             self._dump('<tr><td>%s</td>'
                        '<td align="left">%s</td>'
def visit_generic_map_in_state(self, selector, title, s, prev_s=None):
                         self._dump('<i> No changes!</i>')
             if prev_m is None:
                 self._dump('</td></tr><tr><td align="left">')
                 self.visit_generic_map(m)
         self._dump('</td></tr>')
 
     def visit_state(self, s, prev_s):
         self.visit_store_in_state(s, prev_s)
-        self.visit_environment_in_state(s, prev_s)
+        self.visit_environment_in_state('environment', 'Environment',
+                                        s, prev_s)
         self.visit_generic_map_in_state('constraints', 'Ranges',
                                         s, prev_s)
         self.visit_generic_map_in_state('dynamic_types', 'Dynamic Types',
                                         s, prev_s)
+        self.visit_environment_in_state('constructing_objects',
+                                        'Objects Under Construction',
+                                        s, prev_s)
 
     def visit_node(self, node):
         self._dump('%s [shape=record,label=<<table border="0">'
                    % (node.node_name()))
 
         self._dump('<tr><td bgcolor="grey"><b>Node %d (%s) - '
                    'State %s</b></td></tr>'
                    % (node.node_id, node.ptr, node.state.state_id