[analyzer][WIP] Implement a primitive reaching definitions analysis

[Szelethus]

I plan to split this patch up eventually, but here's where I'm standing right now:

• Correct the algorithm that by accident did this: GEN[B] = GEN[B] union (IN[B] - KILL[B]) instead of this: OUT[B] = GEN[B] union (IN[B] - KILL[B])
• Realize that llvm::SmallSet uses both operator== and operator<, and since for a reaching definition set I'd like to sort by VarDecl, but for the kill set that AND the CFGElementRef, give up on it and use std::set instead with two different comparators
• Collect all non-local variables and regard all function calls as definitions to them
• Collect parameter declarations as well, add them to GEN[entry block]
• Plenty more test cases

Still left to do:

• Document, cite the algorithm
• If a pointee is written, invalidate all variables with the same type:

int i;
int *ptr;
// ...
*ptr = 0; // might point to i, regard it as i's definition

• Tests for unreachable successors
• Evaluate on a large codebase
• Come up with something smart to handle FieldDecls (or just ignore them :^) )

[NoQ]

In D64991#1595853, @Szelethus wrote:

CFGElementRef

Wait, is it a thing already?? Did i miss anything???

This analysis isn't conservative enough yet, I really should include function calls with non-const references into the gen set, but hey, at this point I'm optimistic that it can be done.

"Conservative" is not a property of the algorithm; it depends on how is the algorithm used. For some purposes you'll want to add an extra definition when you're not sure if it'll be a definition, for other purposes you'll want to only have definitions in which you are 100% certain in the set.

clang/lib/Analysis/ReachingDefinitions.cpp

69

I don't think you really need this. Every assignment would anyway appear in the CFG as a separate element. And also forEachDescendant() may accidentally scan items in different CFG blocks (i.e., if the whole statement is a ?: or a logical op).

[Szelethus]

In D64991#1596292, @NoQ wrote:

In D64991#1595853, @Szelethus wrote:

CFGElementRef

Wait, is it a thing already?? Did i miss anything???

Oh, yea, I have it locally, still need to iron out a couple things on that before daring to upload it :) I figured it wouldn't cause much confusion so I shared this one kinda hanging in the air.

This analysis isn't conservative enough yet, I really should include function calls with non-const references into the gen set, but hey, at this point I'm optimistic that it can be done.

"Conservative" is not a property of the algorithm; it depends on how is the algorithm used. For some purposes you'll want to add an extra definition when you're not sure if it'll be a definition, for other purposes you'll want to only have definitions in which you are 100% certain in the set.

Aye I'll try to specify on that. Thanks!

[Szelethus]

@steakhal you some great experience with (strict) aliasing, could you chip in on this maybe? :)

[Szelethus]

Rebase on top of D65196.

[Szelethus]

Use the correct sorting for the GEN, KILL, IN and OUT sets.

[xazax.hun]

clang/include/clang/Analysis/Analyses/ReachingDefinitions.h

31

In the future we might also want to reason about FieldDecls.

51

Is it safe to omit the Kind from the comparisons?

clang/lib/Analysis/ReachingDefinitions.cpp

62

Will this work if the LHS is not directly a declrefexpr?

E.g.:

(a, b) = 5;

Or more fun cases:

(cond ? a : b) = 5;

103

What about the non-const arguments of calls, and indirect writes through pointers? Even if you plan not to handle some of these, I prefer to have a TODO for these the appropriate places as soon as possible.

105

There are non-assignment operators too, like operator++. You might want to consider them as definitions too.

[Szelethus]

Hmm, we could make a redundant assignments checker: if a variable has multiple reaching definitions, but those all assign the same value, emit a warning. We could even use fixits with that.

void t(int a) {
  if (coin())
    a = 2; // note: reaching def
  else
    a = 2; // note: reaching def
  use(a); // warn: a is always 2 here
}

[NoQ]

In D64991#1662185, @Szelethus wrote:

Hmm, we could make a redundant assignments checker: if a variable has multiple reaching definitions, but those all assign the same value, emit a warning. We could even use fixits with that.

void t(int a) {
  if (coin())
    a = 2; // note: reaching def
  else
    a = 2; // note: reaching def
  use(a); // warn: a is always 2 here
}

Sounds like a useful compiler warning to me.

Also what specific fixit do you have in mind and why do you think it'll be easily obtainable from the results of the reaching definition analysis?

[Szelethus]

The following words are echoing in my ears as I'm knowingly going completely against them:

In D45532#1083670, @NoQ wrote:

I'm asking for this because it's, like, actually difficult and painful to understand formal information in large chunks. One-solution-at-a-time would have been so much easier. It is really a bad idea to start by presenting a working solution; the great idea is to present a small non-working solution with a reasonable idea behind it, and then extend it "in place" as much as it seems necessary. It is very comfortable when parts of the patch with different "status" (main ideas, corner-case fixes, heuristics, refactoring) stay in separate patches.

Essentially every part of the solution that you implement, if you think it might deserve a separate discussion, also deserves a separate patch. It is reasonable to split the work into logical chunks before you start it. It's very unlikely that you have a single idea that takes 500 non-trivial lines of code to express. Splitting up ideas so that they were easy to grasp is an invaluable effort.

I'll keep this revision as more of a bag of ideas, and create a series of patches when I got the core of this figured out. This algorithm is very hard to implement, and its easier for me to not bother with splitting up my entire work when I'm still shooting at a moving target. Several of my ideas required me to make huge refactorings, and as the code grows, my overall desire for the finished algorithm changes as well.

With that said.

I made the following changes:

• Added support for record, but not much in terms of C++ classes.
  • Fields of a record are identified with a (variable, chain of fields) pair, e.g. Var.a.x.b would be represented with (Var, FieldDecls of [a, x, b]).
  • A Definition of a record object doesn't contain Definitions of its fields -- instead, whenever a Definition of a record object is added to a GEN set, a helper function creates adds Definitions for its fields. This is convenient, else we'd need to flatten Definitions later on. For the example mentioned earlier, we really need an entry separately for Var, Var.a, Var.a.x, Var.a.x.b in order for the analyzer to conveniently ask for reaching definitions later down the line.
• Added/corrected plenty of test cases.
• Haven't really touched variable invalidation.
• Decorated the code with a ton of TODOs, but not much documentation just yet.

There are a couple things I'm worrying about, especially those that @xazax.hun mentioned in the inlines. I'm still confident that actual writes to a variable may only be assignments and variable definitions, but they can be esoteric enough, e.g. (a, b) = 5, retrieveWhateverObject() = {9, 5, "remember the vasa"}. For now, performance doesn't really concern me, but eventually I'll need to move the matchers to a builder class. Invalidation propagation (as discussed on mailing list) hide in them a variety of tricky edge cases. All of these combined create a desire for a thought-out, easily extensible way to create GEN sets.

So, here are my ideas.

• Overall code structure
  • Create a builder object, stored in the calculator itself, which would store the expensive-to-create matchers.
  • Make assignment an event to which a variety of rules may be assigned to, so special cases like (a, b) = 5, retrieveWhateverObject() = {9, 5, "remember the vasa"}, assignment to this, and whatever pitfalls Objective-.* languages have may be more easily handled.
  • GEN sets store the outgoing, or in other words, last definition to each variable, but this information is not enough. The way I described how I plan to make this algorithm semi-intraprocedural with the use of visitors in a nutshell works by the analyzer trying to prove that an invalidation really does write a variable, or can be discarded. However, in the same block, for the same variable, multiple invalidations of the same variable may occur. So, instead of storing the last definition, we should store all invalidations up to the first write. Later, the analyzer could remove these definitions directly, and ask the calculator to regenerate the KILL sets and recalculate the reaching definitions sets.
• Invalidation
  • Research type based alias analysis, until then, ignore aliases, and just invalidate objects of the same type.
  • The example below highlights how the function call on line 2 is a definition of i, because ptr might point to it, but may not be a definition of j. Buuuuuuuuuuut, with the use of goto, it is possible. This implies that every variable in a non-nested scope has to be invalidated if a pointer with an aliasing type escapes. This may be super tricky to implement precisely, so I'll probably just take all variables, not only non-nested ones into account.

1 void f(int i, int *ptr) {
2   foo(ptr);
3   int j;
4 }

• Invalidation has to be very customizable. The static analyzer doesn't generate code, so some relaxation of the invalidation ruleset maybe desirable, such as assuming that offsetof isn't used to change the rest of the record if a field of it escapes.

[Szelethus]

I'm starting to be really happy with the current direction! I think I'll start splitting this up soon, I'm confident that the current interface (after some polishing) is general enough to develop incrementally.

• Introduce Variable, a base class of Definition, which is a (VarDecl, FieldChain) pair.
• Introduce GenSetBuilder, a class that owns all MatchFinders and associated callbacks used for finding potential writes and invalidations to Variables, use exclusively it to build GEN sets.
  • Use a very flexible interface for creating and registering matchers for either
    • Creating the set of Variables accessible to a function
    • Finding statements that may write any of those
    • Teasing an Expr apart to find Variables in it
  • In an init() pass, collect all variables used, or potentially invalidated in the function. This allows for invalidations and writes to be done in a single pass on a CFGStmt.
  • Added a very primitive solution to invalidate variables passed to functions as a non-const reference.

[Szelethus]

Upload final version. This revision stays here for archaeological purposes, as I'll split this up into manageable pieces.

clang/include/clang/Analysis/Analyses/ReachingDefinitions.h

+//===--- ReachingDefinitions.h ----------------------------------*- C++ -*-===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+//
+// Calculates reaching definitions for a CFG.
+//
+//===----------------------------------------------------------------------===//
+
+#ifndef LLVM_CLANG_ANALYSIS_ANALYSES_REACHABLE_DEFINITIONS_H
+#define LLVM_CLANG_ANALYSIS_ANALYSES_REACHABLE_DEFINITIONS_H
+
+#include "clang/AST/Decl.h"
+#include "clang/ASTMatchers/ASTMatchFinder.h"
+#include "clang/Analysis/AnalysisDeclContext.h"
+#include "clang/Analysis/CFG.h"
+#include "llvm/ADT/SmallVector.h"
+#include <set>
+
+namespace clang {
+
+//===----------------------------------------------------------------------===//
+// Since reaching definitions was implemented for instructions, it isn't well
+// thought out what a definition of a variable is in C/C++, nor what we really
+// mean under the term variable.
+//===----------------------------------------------------------------------===//
+
+namespace ReachingDefinitionsDetail {
+
+//===----------------------------------------------------------------------===//
+// What a 'variable' is:
+// We define a variable as a VarDecl, and optionally, a non-empty list of
+// FieldDecls to express parts of a struct. This implies that we regard the
+// fields of a VarDecl as 'variables'.
+// TODO: How do we describe the implicit this parameter for methods?
+//===----------------------------------------------------------------------===//
+
+using FieldChainTy = llvm::SmallVector<const FieldDecl *, 2>;
+bool operator<(const FieldChainTy &Lhs, const FieldChainTy &Rhs);
+
+struct Variable {
+  const VarDecl *Var;
+  FieldChainTy FieldChain;
+
+  Variable(const VarDecl *Var, FieldChainTy FieldChain)
+      : Var(Var), FieldChain(FieldChain) {}
+};
+
+struct VariableLess {
+  // TODO: const ref? but what if we change this to immutablelist?
+  bool operator()(Variable Lhs, Variable Rhs) {
+    return std::make_pair(Lhs.Var, Lhs.FieldChain) <
+           std::make_pair(Rhs.Var, Rhs.FieldChain);
+  }
+};
+
+//===----------------------------------------------------------------------===//
+// What a 'definition of a variable' is:
+// Whatever statement that writes a 'variable', or may write a 'variable'.
+// We note whether know that the definition is a write, or just could be a
+// write, as well as the CFGElement that contains the defining statement.
+//===----------------------------------------------------------------------===//
+
+class Definition : public Variable {
+public:
+  enum DefinitionKind { Write, Invalidation };
+
+  CFGBlock::ConstCFGElementRef E;
+  DefinitionKind Kind;
+
+public:
+  Definition(const VarDecl *Var, FieldChainTy FieldChain,
+             CFGBlock::ConstCFGElementRef E, DefinitionKind Kind)
+      : Variable(Var, std::move(FieldChain)), E(E), Kind(Kind) {}
+
+  Definition(const VarDecl *Var, CFGBlock::ConstCFGElementRef E,
+             DefinitionKind Kind)
+      : Definition(Var, /*FieldChain=*/{}, E, Kind) {}
+
+  const CFGBlock *getCFGBlock() const { return E.getParent(); }
+
+  // (varname [blockid, elementid]) (reason)
+  void dump() const;
+};
+
+struct VarAndCFGElementLess {
+  bool operator()(Definition Lhs, Definition Rhs) const {
+    return std::tie(Lhs.Var, Lhs.FieldChain, Lhs.E) <
+           std::tie(Rhs.Var, Rhs.FieldChain, Rhs.E);
+  }
+};
+
+/// A set of definitions sorted only by the variable, so that each basic block
+/// may only emit a single definition for any single variable.
+// TODO: We need to track more then a single definition to a variable for a
+// block's GEN set. Say, the static analyzer manages to prove that a potential
+// invalidation definition (like a function call) didn't write the variable, we
+// need to retrieve the definitions up to that point in the block.
+using GenSet = std::set<Definition, VariableLess>;
+
+/// A set of definitions sorted by the variable and the location of the
+/// definition. For KILL, IN and OUT sets this is correct, because a CFGBlock
+/// may kill several definitions of the same variables from different locations.
+using DefinitionSet = std::set<Definition, VarAndCFGElementLess>;
+
+//===----------------------------------------------------------------------===//
+// Determining whether a statement modifies a variable is a challanging, and
+// requires using expensive-to-create matchers, and an easily extensible
+// interface, hence the use of a builder class outside of the main calculator.
+//===----------------------------------------------------------------------===//
+
+class GenSetBuilder;
+
+class GenSetMatcherCallback : public ast_matchers::MatchFinder::MatchCallback {
+protected:
+  GenSetBuilder &GSBuilder;
+
+  GenSetMatcherCallback(GenSetBuilder &GSBuilder) : GSBuilder(GSBuilder) {}
+};
+
+/// Responsible for building the GEN sets for each basic block.
+///
+/// Since pointer escapes or function calls in general require us to generate
+/// definitions that are invalidations, we need to gather all variables relevant
+/// for this analysis, like parameters, locals and globals. We refer to this
+/// stage as 'variable finding':
+///   * Collect all non-local, visible variables
+///   * Collect all local variables within the function that is used
+///
+/// The actual building of GEN sets has two stages:
+///   1. For each CFGStmt in the CFGBlock, look for a statement that may be a
+///      definition of an expression. ('definition finding')
+///   2. Search expressions for variables recursively. ('expression finding')
+class GenSetBuilder {
+  using DefinitionKind = Definition::DefinitionKind;
+
+  // Fields that shouldn't change after the construction of the builder object.
+
+  llvm::SmallVector<std::unique_ptr<GenSetMatcherCallback>, 8> Callbacks;
+
+  ast_matchers::MatchFinder VariableFinder;
+  ast_matchers::MatchFinder DefinitionFinder;
+  ast_matchers::MatchFinder ExpressionFinder;
+
+  const Decl *D;
+  ASTContext *Context = nullptr;
+
+  std::set<Variable, VariableLess> AllVariables;
+  std::set<Variable, VariableLess> AllGlobalVariables;
+
+  // Fields that are changed at and during each GEN set construction.
+
+  GenSet *CurrentGenSet;
+  Optional<CFGBlock::ConstCFGElementRef> CurrentCFGElem;
+  DefinitionKind CurrentKind = Definition::Write;
+
+private:
+  // TODO: Make this public and allow custom matchers to be added?
+  template <ast_matchers::MatchFinder GenSetBuilder::*Finder,
+            class GenSetMatcherCallbackTy>
+  void addMatcher() {
+    Callbacks.emplace_back(std::make_unique<GenSetMatcherCallbackTy>(*this));
+    (this->*Finder)
+        .addMatcher(GenSetMatcherCallbackTy::getMatcher(),
+                    Callbacks.back().get());
+  }
+
+public:
+  GenSetBuilder(const Decl *D);
+
+  //===--------------------------------------------------------------------===//
+  // Methods for retrieving a GEN set.
+  //===--------------------------------------------------------------------===//
+  void getGenSetForCFGBlock(const CFGBlock *B, GenSet &Gen);
+
+  void getGenSetForParameters(const CFGBlock *Entry, GenSet &Gen);
+
+  //===--------------------------------------------------------------------===//
+  // Utility methods for building a GEN set. These are public because the
+  // callback objects will need to call them.
+  //===--------------------------------------------------------------------===//
+
+  /// When we find a definition to an *expression*, we need to see if that
+  /// expression is a variable, or some other expression that needs further
+  /// processing, like in this case:
+  ///   (a, b) = 10;
+  void handleExpr(const Expr *E, DefinitionKind Kind);
+
+  /// Insert a new defintion of a variable into the current GEN set.
+  void insertToGenSet(const VarDecl *Var, FieldChainTy FieldChain,
+                      DefinitionKind Kind);
+
+  void insertToGenSet(const VarDecl *Var, DefinitionKind Kind) {
+    insertToGenSet(Var, FieldChainTy{}, Kind);
+  }
+
+  void insertToGenSet(const VarDecl *Var, FieldChainTy FieldChain) {
+    insertToGenSet(Var, FieldChain, CurrentKind);
+  }
+
+  void insertToGenSet(const VarDecl *Var) {
+    insertToGenSet(Var, FieldChainTy{});
+  }
+
+  void invalidateGlobals() {
+    for (const Variable &Var : AllGlobalVariables)
+      insertToGenSet(Var.Var, Var.FieldChain, DefinitionKind::Invalidation);
+  }
+
+  /// Called during the initialization of the builder to collect all variables
+  /// in a function.
+  void addVariable(const VarDecl *Var, FieldChainTy FieldChain);
+};
+
+} // end of namespace ReachingDefinitionsDetail
+
+/// Calculates reaching definitions for each basic block. This calculation
+/// doesn't try to argue about aliasing, meaning that some definitions are
+/// definite write (we know that the variable it written), and some are a result
+/// of invalidation, like passing a variable as a non-const reference to a
+/// function.
+class ReachingDefinitionsCalculator : public ManagedAnalysis {
+  using GenSetBuilder = ReachingDefinitionsDetail::GenSetBuilder;
+
+public:
+  using GenSet = ReachingDefinitionsDetail::GenSet;
+  using DefinitionKind = ReachingDefinitionsDetail::Definition::DefinitionKind;
+  using DefinitionSet = ReachingDefinitionsDetail::DefinitionSet;
+
+  void calculate();
+
+  void dumpKillSet() const;
+  void dumpGenSet() const;
+  void dumpReachingDefinitions() const;
+
+  static ReachingDefinitionsCalculator *create(AnalysisDeclContext &Ctx) {
+    return new ReachingDefinitionsCalculator(Ctx.getDecl(), Ctx.getCFG());
+  }
+
+  static const void *getTag() {
+    static int x;
+    return &x;
+  }
+
+private:
+  ReachingDefinitionsCalculator(const Decl *D, const CFG *cfg);
+
+  void init();
+
+  const CFG *cfg;
+  GenSetBuilder GSBuilder;
+
+  // TODO: Make the GEN set public to allow clients to remove definitions, or
+  // possibly mark an invalidation as write.
+  std::map<const CFGBlock *, GenSet> Gen;
+  std::map<const CFGBlock *, DefinitionSet> Kill;
+
+public:
+  std::map<const CFGBlock *, DefinitionSet> In;
+  std::map<const CFGBlock *, DefinitionSet> Out;
+};
+
+} // end of namespace clang
+
+#endif // LLVM_CLANG_ANALYSIS_ANALYSES_REACHABLE_DEFINITIONS_H

clang/include/clang/StaticAnalyzer/Checkers/Checkers.td

def DebugContainerModeling : Checker<"DebugContainerModeling">,
   Dependencies<[ContainerModeling]>,
   Documentation<NotDocumented>;
 
 def DebugIteratorModeling : Checker<"DebugIteratorModeling">,
   HelpText<"Check the analyzer's understanding of C++ iterators">,
   Dependencies<[DebugContainerModeling, IteratorModeling]>,
   Documentation<NotDocumented>;
 
-} // end "debug"
+def GenSetDumper : Checker<"DumpGenSets">,
+  HelpText<"Dump the GEN sets for each block in a function">,
+  Documentation<NotDocumented>;
+
+def KillSetDumper : Checker<"DumpKillSets">,
+  HelpText<"Dump the KILL sets for each block in a function">,
+  Documentation<NotDocumented>;
 
+def ReachingDefinitionsDumper : Checker<"DumpReachingDefinitions">,
+  HelpText<"Dump the reaching definitions for each block in a function">,
+  Documentation<NotDocumented>;
+
+} // end "debug"
 
 //===----------------------------------------------------------------------===//
 // Clone Detection
 //===----------------------------------------------------------------------===//
 
 let ParentPackage = CloneDetectionAlpha in {
 
 def CloneChecker : Checker<"CloneChecker">,

clang/lib/Analysis/CMakeLists.txt

add_clang_library(clangAnalysis
   Dominators.cpp
   ExprMutationAnalyzer.cpp
   LiveVariables.cpp
   ObjCNoReturn.cpp
   PathDiagnostic.cpp
   PostOrderCFGView.cpp
   ProgramPoint.cpp
   ReachableCode.cpp
+  ReachingDefinitions.cpp
   RetainSummaryManager.cpp
   ThreadSafety.cpp
   ThreadSafetyCommon.cpp
   ThreadSafetyLogical.cpp
   ThreadSafetyTIL.cpp
   UninitializedValues.cpp
 
   LINK_LIBS
   clangAST
   clangASTMatchers
   clangBasic
   clangLex
   )
 
 add_subdirectory(plugins)

clang/lib/Analysis/ReachingDefinitions.cpp

+//===--- ReachableDefinitions.cpp -------------------------------*- C++ -*-===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+//
+// Calculates reachable definitions for a variable.
+//
+//===----------------------------------------------------------------------===//
+
+#include "clang/Analysis/Analyses/ReachingDefinitions.h"
+#include "clang/AST/Decl.h"
+#include "clang/AST/DeclCXX.h"
+#include "clang/AST/DeclLookups.h"
+#include "clang/AST/Expr.h"
+#include "clang/ASTMatchers/ASTMatchFinder.h"
+#include "clang/ASTMatchers/ASTMatchers.h"
+#include "clang/ASTMatchers/ASTMatchersInternal.h"
+#include "clang/Analysis/CFG.h"
+#include "clang/Basic/LLVM.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"
+#include "llvm/ADT/STLExtras.h"
+#include "llvm/ADT/SetOperations.h"
+#include "llvm/Support/ErrorHandling.h"
+#include <memory>
+
+using namespace clang;
+using namespace ReachingDefinitionsDetail;
+using namespace ast_matchers;
+
+using DefinitionKind = Definition::DefinitionKind;
+
+//===----------------------------------------------------------------------===//
+// Utility functions.
+//===----------------------------------------------------------------------===//
+
+/// Print a field chain, e.g. 's.x.y'. Mind that even the indirection operator
+/// (->) will be written as a dot, but that shouldn't really be an issue since
+/// we don't argue about pointees.
+static void dumpFieldChain(const FieldChainTy &FieldChain) {
+  for (const FieldDecl *Field : FieldChain)
+    llvm::errs() << "." + Field->getNameAsString();
+}
+
+#if !defined(NDEBUG) || defined(LLVM_ENABLE_DUMP)
+LLVM_DUMP_METHOD static void dumpFieldChainNL(const FieldChainTy &FieldChain) {
+  dumpFieldChain(FieldChain);
+  llvm::errs() << '\n';
+}
+#endif
+
+/// The reaching definitions calculator implemented here uses the CFG and some
+/// AST analysis and does not employ points-to analysis, so we're ignoring
+/// any field that is indirectly contained.
+static bool hasIndirection(FieldChainTy FieldChain) {
+  if (FieldChain.empty())
+    return false;
+
+  FieldChainTy::iterator It = llvm::find_if(FieldChain, [](const FieldDecl *F) {
+    return ento::Loc::isLocType(F->getType());
+  });
+
+  // Yay, no indirection in the chain.
+  if (It == FieldChain.end())
+    return false;
+
+  // If the last element in the chain is a LocType, we're not arguing about
+  // aliasing, only the value of a pointer object. That is fine.
+  if (*It == FieldChain.back())
+    return false;
+
+  return true;
+}
+
+/// Visit each field of a 'variable', and its subfields recursively, and call
+/// the callback on each.
+///
+///   \param [in] CB A callback that expects a single FieldChain object.
+template <class CallBack>
+static void forAllFields(const VarDecl *Var, FieldChainTy FieldChain,
+                         CallBack CB) {
+  if (hasIndirection(FieldChain))
+    return;
+
+  const RecordDecl *R = nullptr;
+  if (FieldChain.empty())
+    R = Var->getType()->getAsRecordDecl();
+  else
+    R = FieldChain.back()->getType()->getAsRecordDecl();
+
+  CB(FieldChain);
+
+  if (R) {
+    for (const FieldDecl *Field : R->fields()) {
+      FieldChainTy Cpy = FieldChain;
+      Cpy.emplace_back(Field);
+      forAllFields(Var, Cpy, CB);
+    }
+  }
+}
+
+static bool killsVar(const Definition &Victim, const GenSet &Set) {
+  for (const Definition &Perpetrator : Set)
+    if (std::make_pair(Victim.Var, Victim.FieldChain) ==
+        std::make_pair(Perpetrator.Var, Perpetrator.FieldChain))
+      return true;
+  return false;
+}
+
+static StringRef describeDefinitionKind(DefinitionKind K) {
+  switch (K) {
+  case Definition::Write:
+    return "write";
+  case Definition::Invalidation:
+    return "invalidation";
+  }
+}
+
+//===----------------------------------------------------------------------===//
+// Methods of Definition.
+//===----------------------------------------------------------------------===//
+
+bool operator<(const FieldChainTy &Lhs, const FieldChainTy &Rhs) {
+  if (Lhs.size() != Rhs.size())
+    return Lhs.size() < Rhs.size();
+
+  for (size_t Index = 0; Index < Lhs.size(); ++Index) {
+    if (Lhs[Index] != Rhs[Index])
+      return Lhs[Index] < Rhs[Index];
+  }
+
+  return false;
+}
+
+void Definition::dump() const {
+  llvm::errs() << "(" << Var->getNameAsString();
+  dumpFieldChain(FieldChain);
+
+  llvm::errs() << ", [" << getCFGBlock()->getIndexInCFG() << ", "
+               << E.getIndexInBlock() << "])"
+               << " <" << (describeDefinitionKind(Kind)) << ">";
+}
+
+//===----------------------------------------------------------------------===//
+// Matcher callbacks for constructing GEN sets for the variable finding stage.
+//===----------------------------------------------------------------------===//
+
+class VariableCollectorCB : public GenSetMatcherCallback {
+public:
+  VariableCollectorCB(GenSetBuilder &GSBuilder)
+      : GenSetMatcherCallback(GSBuilder) {}
+
+  static internal::Matcher<Stmt> getMatcher() {
+    return stmt(forEachDescendant(declRefExpr().bind("var")));
+  }
+
+  virtual void run(const MatchFinder::MatchResult &Result) override {
+    const auto *E = Result.Nodes.getNodeAs<DeclRefExpr>("var");
+    assert(E);
+    if (const VarDecl *Var = dyn_cast<VarDecl>(E->getDecl()))
+      GSBuilder.addVariable(Var, {});
+  }
+};
+
+//===----------------------------------------------------------------------===//
+// Matcher callbacks for constructing GEN sets for the definition finding stage.
+//===----------------------------------------------------------------------===//
+
+class AssignmentOperatorCB : public GenSetMatcherCallback {
+public:
+  AssignmentOperatorCB(GenSetBuilder &GSBuilder)
+      : GenSetMatcherCallback(GSBuilder) {}
+
+  static internal::Matcher<Stmt> getMatcher() {
+    return binaryOperator(isAssignmentOperator()).bind("assign");
+  }
+
+  virtual void run(const MatchFinder::MatchResult &Result) override {
+    const auto *BO = Result.Nodes.getNodeAs<BinaryOperator>("assign");
+    assert(BO);
+    GSBuilder.handleExpr(BO->getLHS(), DefinitionKind::Write);
+  }
+};
+
+class DeclarationCB : public GenSetMatcherCallback {
+public:
+  DeclarationCB(GenSetBuilder &GSBuilder) : GenSetMatcherCallback(GSBuilder) {}
+
+  static internal::Matcher<Stmt> getMatcher() {
+    return declStmt().bind("decls");
+  }
+
+  virtual void run(const MatchFinder::MatchResult &Result) override {
+    const auto *DS = Result.Nodes.getNodeAs<DeclStmt>("decls");
+    assert(DS);
+
+    for (const Decl *D : DS->decls()) {
+      const auto *Var = dyn_cast<VarDecl>(D);
+      if (!Var)
+        continue;
+
+      GSBuilder.insertToGenSet(Var, DefinitionKind::Write);
+    }
+  }
+};
+
+class CallExprCB : public GenSetMatcherCallback {
+public:
+  CallExprCB(GenSetBuilder &GSBuilder) : GenSetMatcherCallback(GSBuilder) {}
+
+  static internal::Matcher<Stmt> getMatcher() {
+    return callExpr().bind("calls");
+  }
+
+  static QualType stripPointers(QualType T) {
+    while (!T->getPointeeType().isNull())
+      T = T->getPointeeType();
+
+    return T;
+  }
+
+  static bool isPointerToNonConstTy(QualType T) {
+    if (T->getPointeeType().isNull())
+      return false;
+    return !stripPointers(T).isConstQualified();
+  }
+
+  virtual void run(const MatchFinder::MatchResult &Result) override {
+    const auto *Call = Result.Nodes.getNodeAs<CallExpr>("calls");
+    assert(Call);
+
+    GSBuilder.invalidateGlobals();
+
+    const FunctionDecl *FD = Call->getDirectCallee();
+    if (!FD)
+      return;
+    bool HasImplicitThisParam = isa<CXXMethodDecl>(FD);
+
+    for (size_t Index = 0,
+                E = Call->getNumArgs() - (HasImplicitThisParam ? 1 : 0);
+         Index < E; ++Index) {
+      QualType ParamTy = FD->getParamDecl(Index)->getOriginalType();
+      if (!ParamTy->isRecordType() && !isPointerToNonConstTy(ParamTy))
+        continue;
+      GSBuilder.handleExpr(Call->getArg(Index + (HasImplicitThisParam ? 1 : 0)),
+                           Definition::Invalidation);
+    }
+  }
+};
+
+//===----------------------------------------------------------------------===//
+// Matcher callbacks for constructing GEN sets for the expression finding stage.
+//===----------------------------------------------------------------------===//
+
+class DeclRefExprCB : public GenSetMatcherCallback {
+public:
+  DeclRefExprCB(GenSetBuilder &GSBuilder) : GenSetMatcherCallback(GSBuilder) {}
+
+  static internal::Matcher<Stmt> getMatcher() {
+    return declRefExpr(to(varDecl().bind("var")));
+  }
+
+  virtual void run(const MatchFinder::MatchResult &Result) override {
+    const auto *Var = Result.Nodes.getNodeAs<VarDecl>("var");
+    assert(Var);
+    GSBuilder.insertToGenSet(Var);
+  }
+};
+
+class ParenExprCB : public GenSetMatcherCallback {
+public:
+  ParenExprCB(GenSetBuilder &GSBuilder) : GenSetMatcherCallback(GSBuilder) {}
+
+  static internal::Matcher<Stmt> getMatcher() {
+    return parenExpr().bind("paren");
+  }
+
+  virtual void run(const MatchFinder::MatchResult &Result) override {
+    const auto *Paren = Result.Nodes.getNodeAs<ParenExpr>("paren");
+    assert(Paren);
+    // TODO
+  }
+};
+
+class MemberExprCB : public GenSetMatcherCallback {
+public:
+  MemberExprCB(GenSetBuilder &GSBuilder) : GenSetMatcherCallback(GSBuilder) {}
+
+  static internal::Matcher<Stmt> getMatcher() {
+    return memberExpr(unless(hasAncestor(memberExpr()))).bind("member");
+  }
+
+  virtual void run(const MatchFinder::MatchResult &Result) override {
+    // If we found an assignemnt to S.x.y.z, the matcher will match for
+    // the last MemberExpr (z), let's build the fieldchain back up.
+    const auto *Member = Result.Nodes.getNodeAs<MemberExpr>("member");
+    assert(Member);
+    FieldChainTy FieldChain;
+    FieldChain.emplace_back(cast<FieldDecl>(Member->getMemberDecl()));
+
+    const Expr *NextBase = Member->getBase()->IgnoreParenCasts();
+    // Retrieve the next field in the fieldchain.
+    // FIXME: How about 'a.x.getCookie().x'?
+    while ((Member = dyn_cast<MemberExpr>(NextBase))) {
+      FieldChain.emplace_back(cast<FieldDecl>(Member->getMemberDecl()));
+      NextBase = Member->getBase()->IgnoreParenCasts();
+    }
+    std::reverse(FieldChain.begin(), FieldChain.end());
+
+    GSBuilder.insertToGenSet(
+        cast<VarDecl>(cast<DeclRefExpr>(NextBase)->getDecl()), FieldChain);
+  }
+};
+
+//===----------------------------------------------------------------------===//
+// Methods of GenSetBuilder.
+//===----------------------------------------------------------------------===//
+
+GenSetBuilder::GenSetBuilder(const Decl *D)
+    : D(D), Context(&D->getASTContext()) {
+
+  // TODO: Should we match the entire TU for nested static variables?
+  addMatcher<&GenSetBuilder::VariableFinder, VariableCollectorCB>();
+
+  // TODO: Elvis operator (?:).
+  addMatcher<&GenSetBuilder::ExpressionFinder, DeclRefExprCB>();
+  addMatcher<&GenSetBuilder::ExpressionFinder, MemberExprCB>();
+  addMatcher<&GenSetBuilder::ExpressionFinder, ParenExprCB>();
+
+  // TODO: Destructor calls? Should we be THAT conservative?
+  // TODO: Moving an object?
+  // TODO: Method calls?
+  // TODO: Analyzing a method?
+  // TODO: What do you do with Objective.*???
+  // TODO: Exceptions?
+  addMatcher<&GenSetBuilder::DefinitionFinder, AssignmentOperatorCB>();
+  addMatcher<&GenSetBuilder::DefinitionFinder, DeclarationCB>();
+  addMatcher<&GenSetBuilder::DefinitionFinder, CallExprCB>();
+
+  // Collect all used variables.
+  if (const auto *FD = dyn_cast<FunctionDecl>(D)) {
+    VariableFinder.match(*FD, FD->getASTContext());
+    for (const ParmVarDecl *Param : FD->parameters())
+      addVariable(Param, {});
+  }
+
+  // Collect all visible, non-local variables in a separate set.
+  // TODO: Does this actually collect all of them?
+  const DeclContext *DC = D->getDeclContext();
+  while (DC) {
+    DC = DC->getPrimaryContext();
+    for (const Decl *Res : DC->decls())
+      if (const auto *VD = dyn_cast<VarDecl>(Res))
+        forAllFields(VD, FieldChainTy{}, [this, VD](const FieldChainTy &FC) {
+          AllGlobalVariables.emplace(VD, FC);
+        });
+    DC = DC->getParent();
+  }
+}
+
+void GenSetBuilder::getGenSetForCFGBlock(const CFGBlock *B, GenSet &Gen) {
+  if (B->empty())
+    return;
+
+  VariableFinder.match(*D, D->getASTContext());
+
+  CurrentGenSet = &Gen;
+
+  for (CFGBlock::ConstCFGElementRef E : B->rrefs()) {
+    if (E->getKind() != CFGElement::Kind::Statement)
+      continue;
+    CurrentCFGElem = E;
+
+    const Stmt *S = E->castAs<CFGStmt>().getStmt();
+    assert(S);
+    DefinitionFinder.match(*S, D->getASTContext());
+  }
+
+  CurrentGenSet = nullptr;
+}
+
+void GenSetBuilder::getGenSetForParameters(const CFGBlock *Entry, GenSet &Gen) {
+  CurrentGenSet = &Gen;
+  CurrentCFGElem = {Entry, 0};
+  if (const auto *F = dyn_cast<FunctionDecl>(D)) {
+    for (const ParmVarDecl *Param : F->parameters()) {
+      insertToGenSet(Param, Definition::DefinitionKind::Write);
+    }
+  }
+  CurrentGenSet = nullptr;
+}
+
+void GenSetBuilder::handleExpr(const Expr *E, DefinitionKind Kind) {
+  CurrentKind = Kind;
+  ExpressionFinder.match(*E, *Context);
+}
+
+void GenSetBuilder::insertToGenSet(const VarDecl *Var, FieldChainTy FieldChain,
+                                   DefinitionKind Kind) {
+  forAllFields(Var, FieldChain, [this, Var, Kind](const FieldChainTy &FC) {
+    CurrentGenSet->emplace(Var, FC, *CurrentCFGElem, Kind);
+    // TODO: Invalidate all variables that can alias with this type.
+  });
+}
+
+void GenSetBuilder::addVariable(const VarDecl *Var, FieldChainTy FieldChain) {
+  forAllFields(Var, FieldChain, [this, Var](const FieldChainTy &FC) {
+    AllVariables.emplace(Var, FC);
+  });
+}
+
+//===----------------------------------------------------------------------===//
+// Methods of ReachingDefinitionsCalculator.
+//===----------------------------------------------------------------------===//
+
+ReachingDefinitionsCalculator::ReachingDefinitionsCalculator(const Decl *D,
+                                                             const CFG *cfg)
+    : cfg(cfg), GSBuilder(D) {
+
+  for (const CFGBlock *B : *cfg)
+    GSBuilder.getGenSetForCFGBlock(B, Gen[B]);
+  GSBuilder.getGenSetForParameters(&cfg->getEntry(), Gen[&cfg->getEntry()]);
+
+  calculate();
+}
+
+void ReachingDefinitionsCalculator::init() {
+  llvm::SmallVector<Definition, 16> AllDefinitions;
+  for (const std::pair<const CFGBlock *, GenSet> G : Gen)
+    for (const Definition &Def : G.second)
+      AllDefinitions.push_back(Def);
+
+  for (const std::pair<const CFGBlock *, GenSet> G : Gen)
+    for (const Definition &Def : AllDefinitions)
+      if (G.first != Def.getCFGBlock() && killsVar(Def, G.second))
+        Kill[G.first].insert(Def);
+}
+
+using WorklistTy = llvm::SmallVector<const CFGBlock *, 5>;
+
+void ReachingDefinitionsCalculator::calculate() {
+  init();
+
+  for (const std::pair<const CFGBlock *, GenSet> G : Gen)
+    Out[G.first] = {G.second.begin(), G.second.end()};
+
+  WorklistTy Worklist({cfg->begin(), cfg->end()});
+
+  while (!Worklist.empty()) {
+    const CFGBlock *N = Worklist.pop_back_val();
+
+    for (const CFGBlock *Pred : N->preds())
+      llvm::set_union(In[N], Out[Pred]);
+
+    bool HasChanged =
+        llvm::set_union(Out[N], llvm::set_difference(In[N], Kill[N]));
+
+    if (llvm::set_union(Out[N], Gen[N]))
+      HasChanged = true;
+
+    if (HasChanged) {
+      for (const CFGBlock *Succ : N->succs())
+        Worklist.push_back(Succ);
+    }
+  }
+}
+
+void ReachingDefinitionsCalculator::dumpGenSet() const {
+  llvm::errs() << "GEN sets: blockid (varname [blockid, elementid])\n";
+  for (const std::pair<const CFGBlock *, GenSet> D : Gen) {
+    size_t BlockID = llvm::find(*cfg, D.first) - cfg->begin();
+    for (const Definition &Def : D.second) {
+      llvm::errs() << BlockID << ' ';
+      Def.dump();
+      llvm::errs() << '\n';
+    }
+  }
+}
+
+void ReachingDefinitionsCalculator::dumpKillSet() const {
+  llvm::errs() << "KILL sets: blockid (varname [blockid, elementid])\n";
+  for (const std::pair<const CFGBlock *, DefinitionSet> D : Kill) {
+    size_t BlockID = llvm::find(*cfg, D.first) - cfg->begin();
+    for (const Definition &Def : D.second) {
+      llvm::errs() << BlockID << ' ';
+      Def.dump();
+      llvm::errs() << '\n';
+    }
+  }
+}
+
+void ReachingDefinitionsCalculator::dumpReachingDefinitions() const {
+  llvm::errs() << "Reaching definition sets: "
+                  "blockid IN/OUT (varname [blockid, elementid])\n";
+  for (const CFGBlock *B : *cfg) {
+    size_t BlockID = llvm::find(*cfg, B) - cfg->begin();
+    if (In.count(B)) {
+      for (const Definition &Def : In.find(B)->second) {
+        llvm::errs() << BlockID << " IN ";
+        Def.dump();
+        llvm::errs() << '\n';
+      }
+    }
+
+    if (Out.count(B)) {
+      for (const Definition &Def : Out.find(B)->second) {
+        llvm::errs() << BlockID << " OUT ";
+        Def.dump();
+        llvm::errs() << '\n';
+      }
+    }
+  }
+}

clang/lib/StaticAnalyzer/Checkers/DebugCheckers.cpp

 //==- DebugCheckers.cpp - Debugging Checkers ---------------------*- C++ -*-==//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
 //  This file defines checkers that display debugging information.
 //
 //===----------------------------------------------------------------------===//
 
-#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
 #include "clang/Analysis/Analyses/Dominators.h"
 #include "clang/Analysis/Analyses/LiveVariables.h"
+#include "clang/Analysis/Analyses/ReachingDefinitions.h"
 #include "clang/Analysis/CallGraph.h"
-#include "clang/StaticAnalyzer/Core/Checker.h"
+#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ExplodedGraph.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
 #include "llvm/Support/Process.h"
 
 using namespace clang;
 using namespace ento;
void ento::registerControlDependencyTreeDumper(CheckerManager &mgr) {
   mgr.registerChecker<ControlDependencyTreeDumper>();
 }
 
 bool ento::shouldRegisterControlDependencyTreeDumper(const LangOptions &LO) {
   return true;
 }
 
 //===----------------------------------------------------------------------===//
+// GenSetDumper
+//===----------------------------------------------------------------------===//
+
+namespace {
+class GenSetDumper : public Checker<check::ASTCodeBody> {
+public:
+  void checkASTCodeBody(const Decl *D, AnalysisManager &mgr,
+                        BugReporter &BR) const {
+    if (AnalysisDeclContext *AC = mgr.getAnalysisDeclContext(D))
+      AC->getAnalysis<ReachingDefinitionsCalculator>()->dumpGenSet();
+  }
+};
+} // namespace
+
+void ento::registerGenSetDumper(CheckerManager &mgr) {
+  mgr.registerChecker<GenSetDumper>();
+}
+
+bool ento::shouldRegisterGenSetDumper(const LangOptions &LO) { return true; }
+
+//===----------------------------------------------------------------------===//
+// KillSetDumper
+//===----------------------------------------------------------------------===//
+
+namespace {
+class KillSetDumper : public Checker<check::ASTCodeBody> {
+public:
+  void checkASTCodeBody(const Decl *D, AnalysisManager &mgr,
+                        BugReporter &BR) const {
+    if (AnalysisDeclContext *AC = mgr.getAnalysisDeclContext(D))
+      AC->getAnalysis<ReachingDefinitionsCalculator>()->dumpKillSet();
+  }
+};
+} // namespace
+
+void ento::registerKillSetDumper(CheckerManager &mgr) {
+  mgr.registerChecker<KillSetDumper>();
+}
+
+bool ento::shouldRegisterKillSetDumper(const LangOptions &LO) { return true; }
+
+//===----------------------------------------------------------------------===//
+// ReachingDefinitionsDumper
+//===----------------------------------------------------------------------===//
+
+namespace {
+class ReachingDefinitionsDumper : public Checker<check::ASTCodeBody> {
+public:
+  void checkASTCodeBody(const Decl *D, AnalysisManager &mgr,
+                        BugReporter &BR) const {
+    if (AnalysisDeclContext *AC = mgr.getAnalysisDeclContext(D))
+      AC->getAnalysis<ReachingDefinitionsCalculator>()
+          ->dumpReachingDefinitions();
+  }
+};
+} // namespace
+
+void ento::registerReachingDefinitionsDumper(CheckerManager &mgr) {
+  mgr.registerChecker<ReachingDefinitionsDumper>();
+}
+
+bool ento::shouldRegisterReachingDefinitionsDumper(const LangOptions &LO) {
+  return true;
+}
+
+//===----------------------------------------------------------------------===//
 // LiveVariablesDumper
 //===----------------------------------------------------------------------===//
 
 namespace {
 class LiveVariablesDumper : public Checker<check::ASTCodeBody> {
 public:
   void checkASTCodeBody(const Decl *D, AnalysisManager& mgr,
                         BugReporter &BR) const {

clang/test/Analysis/dump-definitions-local-invalidation.cpp

+// RUN: %clang_analyze_cc1 %s \
+// RUN:   -analyzer-checker=debug.DumpCFG \
+// RUN:   -analyzer-checker=debug.DumpGenSets \
+// RUN:   -analyzer-checker=debug.DumpKillSets \
+// RUN:   -analyzer-checker=debug.DumpReachingDefinitions \
+// RUN:   2>&1 | FileCheck %s
+
+int global_var;
+
+namespace simple_invalidation {
+
+bool coin();
+
+void invalidate(int &i, double d);
+
+void invalidateOnFnCall() {
+  int i;
+  double d = 0.0;
+
+  if (coin())
+    i = 5;
+
+  if (coin())
+    d = 2.3;
+
+  invalidate(i, d);
+}
+//                    -> [B4] ->    -> [B2] ->
+//                   /          \  /          \
+// [B6 (ENTRY)] -> [B5] ------> [B3] ------> [B1] -> [B0 (EXIT)]
+
+// CHECK:      GEN sets: blockid (varname [blockid, elementid])
+// CHECK-NEXT: 1 (global_var, [1, 5]) <invalidation>
+// CHECK-NEXT: 1 (i, [1, 5]) <invalidation>
+// CHECK-NEXT: 2 (d, [2, 2]) <write>
+// CHECK-NEXT: 3 (global_var, [3, 2]) <invalidation>
+// CHECK-NEXT: 4 (i, [4, 2]) <write>
+// CHECK-NEXT: 5 (global_var, [5, 5]) <invalidation>
+// CHECK-NEXT: 5 (i, [5, 0]) <write>
+// CHECK-NEXT: 5 (d, [5, 2]) <write>
+// CHECK-NEXT: KILL sets: blockid (varname [blockid, elementid])
+// CHECK-NEXT: 1 (global_var, [3, 2]) <invalidation>
+// CHECK-NEXT: 1 (global_var, [5, 5]) <invalidation>
+// CHECK-NEXT: 1 (i, [4, 2]) <write>
+// CHECK-NEXT: 1 (i, [5, 0]) <write>
+// CHECK-NEXT: 2 (d, [5, 2]) <write>
+// CHECK-NEXT: 3 (global_var, [1, 5]) <invalidation>
+// CHECK-NEXT: 3 (global_var, [5, 5]) <invalidation>
+// CHECK-NEXT: 4 (i, [1, 5]) <invalidation>
+// CHECK-NEXT: 4 (i, [5, 0]) <write>
+// CHECK-NEXT: 5 (global_var, [1, 5]) <invalidation>
+// CHECK-NEXT: 5 (global_var, [3, 2]) <invalidation>
+// CHECK-NEXT: 5 (i, [1, 5]) <invalidation>
+// CHECK-NEXT: 5 (i, [4, 2]) <write>
+// CHECK-NEXT: 5 (d, [2, 2]) <write>
+// CHECK-NEXT: Reaching definition sets: blockid IN/OUT (varname [blockid, elementid])
+// CHECK-NEXT: 0 IN (global_var, [1, 5]) <invalidation>
+// CHECK-NEXT: 0 IN (i, [1, 5]) <invalidation>
+// CHECK-NEXT: 0 IN (d, [2, 2]) <write>
+// CHECK-NEXT: 0 IN (d, [5, 2]) <write>
+// CHECK-NEXT: 0 OUT (global_var, [1, 5]) <invalidation>
+// CHECK-NEXT: 0 OUT (i, [1, 5]) <invalidation>
+// CHECK-NEXT: 0 OUT (d, [2, 2]) <write>
+// CHECK-NEXT: 0 OUT (d, [5, 2]) <write>
+// CHECK-NEXT: 1 IN (global_var, [3, 2]) <invalidation>
+// CHECK-NEXT: 1 IN (i, [4, 2]) <write>
+// CHECK-NEXT: 1 IN (i, [5, 0]) <write>
+// CHECK-NEXT: 1 IN (d, [2, 2]) <write>
+// CHECK-NEXT: 1 IN (d, [5, 2]) <write>
+// CHECK-NEXT: 1 OUT (global_var, [1, 5]) <invalidation>
+// CHECK-NEXT: 1 OUT (i, [1, 5]) <invalidation>
+// CHECK-NEXT: 1 OUT (d, [2, 2]) <write>
+// CHECK-NEXT: 1 OUT (d, [5, 2]) <write>
+// CHECK-NEXT: 2 IN (global_var, [3, 2]) <invalidation>
+// CHECK-NEXT: 2 IN (i, [4, 2]) <write>
+// CHECK-NEXT: 2 IN (i, [5, 0]) <write>
+// CHECK-NEXT: 2 IN (d, [5, 2]) <write>
+// CHECK-NEXT: 2 OUT (global_var, [3, 2]) <invalidation>
+// CHECK-NEXT: 2 OUT (i, [4, 2]) <write>
+// CHECK-NEXT: 2 OUT (i, [5, 0]) <write>
+// CHECK-NEXT: 2 OUT (d, [2, 2]) <write>
+// CHECK-NEXT: 3 IN (global_var, [5, 5]) <invalidation>
+// CHECK-NEXT: 3 IN (i, [4, 2]) <write>
+// CHECK-NEXT: 3 IN (i, [5, 0]) <write>
+// CHECK-NEXT: 3 IN (d, [5, 2]) <write>
+// CHECK-NEXT: 3 OUT (global_var, [3, 2]) <invalidation>
+// CHECK-NEXT: 3 OUT (i, [4, 2]) <write>
+// CHECK-NEXT: 3 OUT (i, [5, 0]) <write>
+// CHECK-NEXT: 3 OUT (d, [5, 2]) <write>
+// CHECK-NEXT: 4 IN (global_var, [5, 5]) <invalidation>
+// CHECK-NEXT: 4 IN (i, [5, 0]) <write>
+// CHECK-NEXT: 4 IN (d, [5, 2]) <write>
+// CHECK-NEXT: 4 OUT (global_var, [5, 5]) <invalidation>
+// CHECK-NEXT: 4 OUT (i, [4, 2]) <write>
+// CHECK-NEXT: 4 OUT (d, [5, 2]) <write>
+// CHECK-NEXT: 5 OUT (global_var, [5, 5]) <invalidation>
+// CHECK-NEXT: 5 OUT (i, [5, 0]) <write>
+// CHECK-NEXT: 5 OUT (d, [5, 2]) <write>
+
+} // namespace simple_invalidation

clang/test/Analysis/dump-definitions-nontrivial-expressions.cpp

+// RUN: %clang_analyze_cc1 %s \
+// RUN:   -analyzer-checker=debug.DumpCFG \
+// RUN:   -analyzer-checker=debug.DumpGenSets \
+// RUN:   -analyzer-checker=debug.DumpKillSets \
+// RUN:   -analyzer-checker=debug.DumpReachingDefinitions \
+// RUN:   2>&1 | FileCheck %s
+
+void lhs_in_parantheses(int a, int b) {
+  (a, b) = 5;
+}
+// CHECK:      GEN sets: blockid (varname [blockid, elementid])
+// CHECK-NEXT: 2 (a, [2, 0]) <write>
+// CHECK-NEXT: 2 (b, [2, 0]) <write>
+// CHECK-NEXT: KILL sets: blockid (varname [blockid, elementid])
+// CHECK-NEXT: Reaching definition sets: blockid IN/OUT (varname [blockid, elementid])
+// CHECK-NEXT: 0 IN (a, [2, 0]) <write>
+// CHECK-NEXT: 0 IN (b, [2, 0]) <write>
+// CHECK-NEXT: 0 OUT (a, [2, 0]) <write>
+// CHECK-NEXT: 0 OUT (b, [2, 0]) <write>
+// CHECK-NEXT: 1 IN (a, [2, 0]) <write>
+// CHECK-NEXT: 1 IN (b, [2, 0]) <write>
+// CHECK-NEXT: 1 OUT (a, [2, 0]) <write>
+// CHECK-NEXT: 1 OUT (b, [2, 0]) <write>
+// CHECK-NEXT: 2 OUT (a, [2, 0]) <write>
+// CHECK-NEXT: 2 OUT (b, [2, 0]) <write>
+
+void lhs_buried_in_parantheses(int a, int b) {
+  ((((((((a, b)))))))) = 5;
+}
+// CHECK:      GEN sets: blockid (varname [blockid, elementid])
+// CHECK-NEXT: 2 (a, [2, 0]) <write>
+// CHECK-NEXT: 2 (b, [2, 0]) <write>
+// CHECK-NEXT: KILL sets: blockid (varname [blockid, elementid])
+// CHECK-NEXT: Reaching definition sets: blockid IN/OUT (varname [blockid, elementid])
+// CHECK-NEXT: 0 IN (a, [2, 0]) <write>
+// CHECK-NEXT: 0 IN (b, [2, 0]) <write>
+// CHECK-NEXT: 0 OUT (a, [2, 0]) <write>
+// CHECK-NEXT: 0 OUT (b, [2, 0]) <write>
+// CHECK-NEXT: 1 IN (a, [2, 0]) <write>
+// CHECK-NEXT: 1 IN (b, [2, 0]) <write>
+// CHECK-NEXT: 1 OUT (a, [2, 0]) <write>
+// CHECK-NEXT: 1 OUT (b, [2, 0]) <write>
+// CHECK-NEXT: 2 OUT (a, [2, 0]) <write>
+// CHECK-NEXT: 2 OUT (b, [2, 0]) <write>
+
+void lhs_buried_in_parantheses2(int a, int b) {
+  ((((((((a))))), b))) = 5;
+}
+// CHECK:      GEN sets: blockid (varname [blockid, elementid])
+// CHECK-NEXT: 2 (a, [2, 0]) <write>
+// CHECK-NEXT: 2 (b, [2, 0]) <write>
+// CHECK-NEXT: KILL sets: blockid (varname [blockid, elementid])
+// CHECK-NEXT: Reaching definition sets: blockid IN/OUT (varname [blockid, elementid])
+// CHECK-NEXT: 0 IN (a, [2, 0]) <write>
+// CHECK-NEXT: 0 IN (b, [2, 0]) <write>
+// CHECK-NEXT: 0 OUT (a, [2, 0]) <write>
+// CHECK-NEXT: 0 OUT (b, [2, 0]) <write>
+// CHECK-NEXT: 1 IN (a, [2, 0]) <write>
+// CHECK-NEXT: 1 IN (b, [2, 0]) <write>
+// CHECK-NEXT: 1 OUT (a, [2, 0]) <write>
+// CHECK-NEXT: 1 OUT (b, [2, 0]) <write>
+// CHECK-NEXT: 2 OUT (a, [2, 0]) <write>
+// CHECK-NEXT: 2 OUT (b, [2, 0]) <write>
+
+void lhs_is_conditional_operator(int a, int b) {
+  (a ? a : b) = 5;
+}
+// CHECK:      GEN sets: blockid (varname [blockid, elementid])
+// CHECK-NEXT: 5 (a, [5, 0]) <write>
+// CHECK-NEXT: 5 (b, [5, 0]) <write>
+// CHECK-NEXT: KILL sets: blockid (varname [blockid, elementid])
+// CHECK-NEXT: Reaching definition sets: blockid IN/OUT (varname [blockid, elementid])
+// CHECK-NEXT: 0 IN (a, [5, 0]) <write>
+// CHECK-NEXT: 0 IN (b, [5, 0]) <write>
+// CHECK-NEXT: 0 OUT (a, [5, 0]) <write>
+// CHECK-NEXT: 0 OUT (b, [5, 0]) <write>
+// CHECK-NEXT: 1 IN (a, [5, 0]) <write>
+// CHECK-NEXT: 1 IN (b, [5, 0]) <write>
+// CHECK-NEXT: 1 OUT (a, [5, 0]) <write>
+// CHECK-NEXT: 1 OUT (b, [5, 0]) <write>
+// CHECK-NEXT: 2 IN (a, [5, 0]) <write>
+// CHECK-NEXT: 2 IN (b, [5, 0]) <write>
+// CHECK-NEXT: 2 OUT (a, [5, 0]) <write>
+// CHECK-NEXT: 2 OUT (b, [5, 0]) <write>
+// CHECK-NEXT: 3 IN (a, [5, 0]) <write>
+// CHECK-NEXT: 3 IN (b, [5, 0]) <write>
+// CHECK-NEXT: 3 OUT (a, [5, 0]) <write>
+// CHECK-NEXT: 3 OUT (b, [5, 0]) <write>
+// CHECK-NEXT: 4 IN (a, [5, 0]) <write>
+// CHECK-NEXT: 4 IN (b, [5, 0]) <write>
+// CHECK-NEXT: 4 OUT (a, [5, 0]) <write>
+// CHECK-NEXT: 4 OUT (b, [5, 0]) <write>
+// CHECK-NEXT: 5 OUT (a, [5, 0]) <write>
+// CHECK-NEXT: 5 OUT (b, [5, 0]) <write>

clang/test/Analysis/dump-definitions-records.cpp

+// RUN: %clang_analyze_cc1 %s \
+// RUN:   -analyzer-checker=debug.DumpCFG \
+// RUN:   -analyzer-checker=debug.DumpGenSets \
+// RUN:   -analyzer-checker=debug.DumpKillSets \
+// RUN:   -analyzer-checker=debug.DumpReachingDefinitions \
+// RUN:   2>&1 | FileCheck %s
+
+int global_var;
+
+namespace struct1 {
+
+struct S {
+  int a, b;
+};
+
+void structtest() {
+  S s;
+  s.a = 5;
+}
+
+// CHECK:      GEN sets: blockid (varname [blockid, elementid])
+// CHECK-NEXT: 1 (s, [1, 1]) <write>
+// CHECK-NEXT: 1 (s.a, [1, 5]) <write>
+// CHECK-NEXT: 1 (s.b, [1, 1]) <write>
+// CHECK-NEXT: KILL sets: blockid (varname [blockid, elementid])
+// CHECK-NEXT: Reaching definition sets: blockid IN/OUT (varname [blockid, elementid])
+// CHECK-NEXT: 0 IN (s, [1, 1]) <write>
+// CHECK-NEXT: 0 IN (s.a, [1, 5]) <write>
+// CHECK-NEXT: 0 IN (s.b, [1, 1]) <write>
+// CHECK-NEXT: 0 OUT (s, [1, 1]) <write>
+// CHECK-NEXT: 0 OUT (s.a, [1, 5]) <write>
+// CHECK-NEXT: 0 OUT (s.b, [1, 1]) <write>
+// CHECK-NEXT: 1 OUT (s, [1, 1]) <write>
+// CHECK-NEXT: 1 OUT (s.a, [1, 5]) <write>
+// CHECK-NEXT: 1 OUT (s.b, [1, 1]) <write>
+
+void struct_param(S s) {
+  s.a = 5;
+}
+
+// CHECK:      GEN sets: blockid (varname [blockid, elementid])
+// CHECK-NEXT: 1 (s.a, [1, 3]) <write>
+// CHECK-NEXT: 2 (s, [2, 0]) <write>
+// CHECK-NEXT: 2 (s.a, [2, 0]) <write>
+// CHECK-NEXT: 2 (s.b, [2, 0]) <write>
+// CHECK-NEXT: KILL sets: blockid (varname [blockid, elementid])
+// CHECK-NEXT: 1 (s.a, [2, 0]) <write>
+// CHECK-NEXT: 2 (s.a, [1, 3]) <write>
+// CHECK-NEXT: Reaching definition sets: blockid IN/OUT (varname [blockid, elementid])
+// CHECK-NEXT: 0 IN (s, [2, 0]) <write>
+// CHECK-NEXT: 0 IN (s.a, [1, 3]) <write>
+// CHECK-NEXT: 0 IN (s.b, [2, 0]) <write>
+// CHECK-NEXT: 0 OUT (s, [2, 0]) <write>
+// CHECK-NEXT: 0 OUT (s.a, [1, 3]) <write>
+// CHECK-NEXT: 0 OUT (s.b, [2, 0]) <write>
+// CHECK-NEXT: 1 IN (s, [2, 0]) <write>
+// CHECK-NEXT: 1 IN (s.a, [2, 0]) <write>
+// CHECK-NEXT: 1 IN (s.b, [2, 0]) <write>
+// CHECK-NEXT: 1 OUT (s, [2, 0]) <write>
+// CHECK-NEXT: 1 OUT (s.a, [1, 3]) <write>
+// CHECK-NEXT: 1 OUT (s.b, [2, 0]) <write>
+// CHECK-NEXT: 2 OUT (s, [2, 0]) <write>
+// CHECK-NEXT: 2 OUT (s.a, [2, 0]) <write>
+// CHECK-NEXT: 2 OUT (s.b, [2, 0]) <write>
+
+} // end of namespace struct1
+
+namespace struct2 {
+
+struct Inner {
+  int a, b;
+};
+
+struct S {
+  Inner x;
+  Inner y;
+};
+
+void struct_param(S s) {
+  s.x.b = 7;
+  s.y.b = 5;
+}
+
+// CHECK:      GEN sets: blockid (varname [blockid, elementid])
+// CHECK-NEXT: 1 (s.x.b, [1, 4]) <write>
+// CHECK-NEXT: 1 (s.y.b, [1, 9]) <write>
+// CHECK-NEXT: 2 (s, [2, 0]) <write>
+// CHECK-NEXT: 2 (s.x, [2, 0]) <write>
+// CHECK-NEXT: 2 (s.x.a, [2, 0]) <write>
+// CHECK-NEXT: 2 (s.x.b, [2, 0]) <write>
+// CHECK-NEXT: 2 (s.y, [2, 0]) <write>
+// CHECK-NEXT: 2 (s.y.a, [2, 0]) <write>
+// CHECK-NEXT: 2 (s.y.b, [2, 0]) <write>
+// CHECK-NEXT: KILL sets: blockid (varname [blockid, elementid])
+// CHECK-NEXT: 1 (s.x.b, [2, 0]) <write>
+// CHECK-NEXT: 1 (s.y.b, [2, 0]) <write>
+// CHECK-NEXT: 2 (s.x.b, [1, 4]) <write>
+// CHECK-NEXT: 2 (s.y.b, [1, 9]) <write>
+// CHECK-NEXT: Reaching definition sets: blockid IN/OUT (varname [blockid, elementid])
+// CHECK-NEXT: 0 IN (s, [2, 0]) <write>
+// CHECK-NEXT: 0 IN (s.x, [2, 0]) <write>
+// CHECK-NEXT: 0 IN (s.x.a, [2, 0]) <write>
+// CHECK-NEXT: 0 IN (s.x.b, [1, 4]) <write>
+// CHECK-NEXT: 0 IN (s.y, [2, 0]) <write>
+// CHECK-NEXT: 0 IN (s.y.a, [2, 0]) <write>
+// CHECK-NEXT: 0 IN (s.y.b, [1, 9]) <write>
+// CHECK-NEXT: 0 OUT (s, [2, 0]) <write>
+// CHECK-NEXT: 0 OUT (s.x, [2, 0]) <write>
+// CHECK-NEXT: 0 OUT (s.x.a, [2, 0]) <write>
+// CHECK-NEXT: 0 OUT (s.x.b, [1, 4]) <write>
+// CHECK-NEXT: 0 OUT (s.y, [2, 0]) <write>
+// CHECK-NEXT: 0 OUT (s.y.a, [2, 0]) <write>
+// CHECK-NEXT: 0 OUT (s.y.b, [1, 9]) <write>
+// CHECK-NEXT: 1 IN (s, [2, 0]) <write>
+// CHECK-NEXT: 1 IN (s.x, [2, 0]) <write>
+// CHECK-NEXT: 1 IN (s.x.a, [2, 0]) <write>
+// CHECK-NEXT: 1 IN (s.x.b, [2, 0]) <write>
+// CHECK-NEXT: 1 IN (s.y, [2, 0]) <write>
+// CHECK-NEXT: 1 IN (s.y.a, [2, 0]) <write>
+// CHECK-NEXT: 1 IN (s.y.b, [2, 0]) <write>
+// CHECK-NEXT: 1 OUT (s, [2, 0]) <write>
+// CHECK-NEXT: 1 OUT (s.x, [2, 0]) <write>
+// CHECK-NEXT: 1 OUT (s.x.a, [2, 0]) <write>
+// CHECK-NEXT: 1 OUT (s.x.b, [1, 4]) <write>
+// CHECK-NEXT: 1 OUT (s.y, [2, 0]) <write>
+// CHECK-NEXT: 1 OUT (s.y.a, [2, 0]) <write>
+// CHECK-NEXT: 1 OUT (s.y.b, [1, 9]) <write>
+// CHECK-NEXT: 2 OUT (s, [2, 0]) <write>
+// CHECK-NEXT: 2 OUT (s.x, [2, 0]) <write>
+// CHECK-NEXT: 2 OUT (s.x.a, [2, 0]) <write>
+// CHECK-NEXT: 2 OUT (s.x.b, [2, 0]) <write>
+// CHECK-NEXT: 2 OUT (s.y, [2, 0]) <write>
+// CHECK-NEXT: 2 OUT (s.y.a, [2, 0]) <write>
+// CHECK-NEXT: 2 OUT (s.y.b, [2, 0]) <write>
+
+} // namespace struct2
+
+namespace struct_ptr {
+
+struct Inner {
+  int a, b;
+};
+
+struct S {
+  Inner *x;
+  Inner &y;
+  Inner z;
+  S();
+};
+
+void struct_param(S s) {
+  s.x->b = 7;
+  s.y.b = 5;
+  s.z.a = 5;
+}
+
+// CHECK:      GEN sets: blockid (varname [blockid, elementid])
+// CHECK-NEXT: 1 (s.z.a, [1, 15]) <write>
+// CHECK-NEXT: 2 (s, [2, 0]) <write>
+// CHECK-NEXT: 2 (s.x, [2, 0]) <write>
+// CHECK-NEXT: 2 (s.y, [2, 0]) <write>
+// CHECK-NEXT: 2 (s.z, [2, 0]) <write>
+// CHECK-NEXT: 2 (s.z.a, [2, 0]) <write>
+// CHECK-NEXT: 2 (s.z.b, [2, 0]) <write>
+// CHECK-NEXT: KILL sets: blockid (varname [blockid, elementid])
+// CHECK-NEXT: 1 (s.z.a, [2, 0]) <write>
+// CHECK-NEXT: 2 (s.z.a, [1, 15]) <write>
+// CHECK-NEXT: Reaching definition sets: blockid IN/OUT (varname [blockid, elementid])
+// CHECK-NEXT: 0 IN (s, [2, 0]) <write>
+// CHECK-NEXT: 0 IN (s.x, [2, 0]) <write>
+// CHECK-NEXT: 0 IN (s.y, [2, 0]) <write>
+// CHECK-NEXT: 0 IN (s.z, [2, 0]) <write>
+// CHECK-NEXT: 0 IN (s.z.a, [1, 15]) <write>
+// CHECK-NEXT: 0 IN (s.z.b, [2, 0]) <write>
+// CHECK-NEXT: 0 OUT (s, [2, 0]) <write>
+// CHECK-NEXT: 0 OUT (s.x, [2, 0]) <write>
+// CHECK-NEXT: 0 OUT (s.y, [2, 0]) <write>
+// CHECK-NEXT: 0 OUT (s.z, [2, 0]) <write>
+// CHECK-NEXT: 0 OUT (s.z.a, [1, 15]) <write>
+// CHECK-NEXT: 0 OUT (s.z.b, [2, 0]) <write>
+// CHECK-NEXT: 1 IN (s, [2, 0]) <write>
+// CHECK-NEXT: 1 IN (s.x, [2, 0]) <write>
+// CHECK-NEXT: 1 IN (s.y, [2, 0]) <write>
+// CHECK-NEXT: 1 IN (s.z, [2, 0]) <write>
+// CHECK-NEXT: 1 IN (s.z.a, [2, 0]) <write>
+// CHECK-NEXT: 1 IN (s.z.b, [2, 0]) <write>
+// CHECK-NEXT: 1 OUT (s, [2, 0]) <write>
+// CHECK-NEXT: 1 OUT (s.x, [2, 0]) <write>
+// CHECK-NEXT: 1 OUT (s.y, [2, 0]) <write>
+// CHECK-NEXT: 1 OUT (s.z, [2, 0]) <write>
+// CHECK-NEXT: 1 OUT (s.z.a, [1, 15]) <write>
+// CHECK-NEXT: 1 OUT (s.z.b, [2, 0]) <write>
+// CHECK-NEXT: 2 OUT (s, [2, 0]) <write>
+// CHECK-NEXT: 2 OUT (s.x, [2, 0]) <write>
+// CHECK-NEXT: 2 OUT (s.y, [2, 0]) <write>
+// CHECK-NEXT: 2 OUT (s.z, [2, 0]) <write>
+// CHECK-NEXT: 2 OUT (s.z.a, [2, 0]) <write>
+// CHECK-NEXT: 2 OUT (s.z.b, [2, 0]) <write>
+
+void struct_switten(S s) {
+  s.x->b = 7;
+  s.y = {};
+  s.z.a = 5;
+}
+// CHECK:      GEN sets: blockid (varname [blockid, elementid])
+// CHECK-NEXT: 1 (global_var, [1, 12]) <invalidation>
+// CHECK-NEXT: 1 (s.z.a, [1, 17]) <write>
+// CHECK-NEXT: 2 (s, [2, 0]) <write>
+// CHECK-NEXT: 2 (s.x, [2, 0]) <write>
+// CHECK-NEXT: 2 (s.y, [2, 0]) <write>
+// CHECK-NEXT: 2 (s.z, [2, 0]) <write>
+// CHECK-NEXT: 2 (s.z.a, [2, 0]) <write>
+// CHECK-NEXT: 2 (s.z.b, [2, 0]) <write>
+// CHECK-NEXT: KILL sets: blockid (varname [blockid, elementid])
+// CHECK-NEXT: 1 (s.z.a, [2, 0]) <write>
+// CHECK-NEXT: 2 (s.z.a, [1, 17]) <write>
+// CHECK-NEXT: Reaching definition sets: blockid IN/OUT (varname [blockid, elementid])
+// CHECK-NEXT: 0 IN (global_var, [1, 12]) <invalidation>
+// CHECK-NEXT: 0 IN (s, [2, 0]) <write>
+// CHECK-NEXT: 0 IN (s.x, [2, 0]) <write>
+// CHECK-NEXT: 0 IN (s.y, [2, 0]) <write>
+// CHECK-NEXT: 0 IN (s.z, [2, 0]) <write>
+// CHECK-NEXT: 0 IN (s.z.a, [1, 17]) <write>
+// CHECK-NEXT: 0 IN (s.z.b, [2, 0]) <write>
+// CHECK-NEXT: 0 OUT (global_var, [1, 12]) <invalidation>
+// CHECK-NEXT: 0 OUT (s, [2, 0]) <write>
+// CHECK-NEXT: 0 OUT (s.x, [2, 0]) <write>
+// CHECK-NEXT: 0 OUT (s.y, [2, 0]) <write>
+// CHECK-NEXT: 0 OUT (s.z, [2, 0]) <write>
+// CHECK-NEXT: 0 OUT (s.z.a, [1, 17]) <write>
+// CHECK-NEXT: 0 OUT (s.z.b, [2, 0]) <write>
+// CHECK-NEXT: 1 IN (s, [2, 0]) <write>
+// CHECK-NEXT: 1 IN (s.x, [2, 0]) <write>
+// CHECK-NEXT: 1 IN (s.y, [2, 0]) <write>
+// CHECK-NEXT: 1 IN (s.z, [2, 0]) <write>
+// CHECK-NEXT: 1 IN (s.z.a, [2, 0]) <write>
+// CHECK-NEXT: 1 IN (s.z.b, [2, 0]) <write>
+// CHECK-NEXT: 1 OUT (global_var, [1, 12]) <invalidation>
+// CHECK-NEXT: 1 OUT (s, [2, 0]) <write>
+// CHECK-NEXT: 1 OUT (s.x, [2, 0]) <write>
+// CHECK-NEXT: 1 OUT (s.y, [2, 0]) <write>
+// CHECK-NEXT: 1 OUT (s.z, [2, 0]) <write>
+// CHECK-NEXT: 1 OUT (s.z.a, [1, 17]) <write>
+// CHECK-NEXT: 1 OUT (s.z.b, [2, 0]) <write>
+// CHECK-NEXT: 2 OUT (s, [2, 0]) <write>
+// CHECK-NEXT: 2 OUT (s.x, [2, 0]) <write>
+// CHECK-NEXT: 2 OUT (s.y, [2, 0]) <write>
+// CHECK-NEXT: 2 OUT (s.z, [2, 0]) <write>
+// CHECK-NEXT: 2 OUT (s.z.a, [2, 0]) <write>
+// CHECK-NEXT: 2 OUT (s.z.b, [2, 0]) <write>
+
+} // namespace struct_ptr

clang/test/Analysis/dump-definitions.cpp

+// RUN: %clang_analyze_cc1 %s \
+// RUN:   -analyzer-checker=debug.DumpCFG \
+// RUN:   -analyzer-checker=debug.DumpGenSets \
+// RUN:   -analyzer-checker=debug.DumpKillSets \
+// RUN:   -analyzer-checker=debug.DumpReachingDefinitions \
+// RUN:   2>&1 | FileCheck %s
+
+int global_var;
+
+int getInt();
+int *getIntPtr();
+bool coin();
+
+void single_vardecl_in_declstmt() {
+  int *ptr = getIntPtr();
+}
+// [B2 (ENTRY)] -> [B1] -> [B0 (EXIT)]
+
+// CHECK:      GEN sets: blockid (varname [blockid, elementid])
+// CHECK-NEXT: 1 (global_var, [1, 2]) <invalidation>
+// CHECK-NEXT: 1 (ptr, [1, 3]) <write>
+// CHECK-NEXT: KILL sets: blockid (varname [blockid, elementid])
+// CHECK-NEXT: Reaching definition sets: blockid IN/OUT (varname [blockid, elementid])
+// CHECK-NEXT: 0 IN (global_var, [1, 2]) <invalidation>
+// CHECK-NEXT: 0 IN (ptr, [1, 3]) <write>
+// CHECK-NEXT: 0 OUT (global_var, [1, 2]) <invalidation>
+// CHECK-NEXT: 0 OUT (ptr, [1, 3]) <write>
+// CHECK-NEXT: 1 OUT (global_var, [1, 2]) <invalidation>
+// CHECK-NEXT: 1 OUT (ptr, [1, 3]) <write>
+
+void multiple_vardecl_in_declstmt() {
+  int *ptr = getIntPtr(), i;
+}
+// [B2 (ENTRY)] -> [B1] -> [B0 (EXIT)]
+
+// CHECK:      GEN sets: blockid (varname [blockid, elementid])
+// CHECK-NEXT: 1 (global_var, [1, 2]) <invalidation>
+// CHECK-NEXT: 1 (ptr, [1, 3]) <write>
+// CHECK-NEXT: 1 (i, [1, 4]) <write>
+// CHECK-NEXT: KILL sets: blockid (varname [blockid, elementid])
+// CHECK-NEXT: Reaching definition sets: blockid IN/OUT (varname [blockid, elementid])
+// CHECK-NEXT: 0 IN (global_var, [1, 2]) <invalidation>
+// CHECK-NEXT: 0 IN (ptr, [1, 3]) <write>
+// CHECK-NEXT: 0 IN (i, [1, 4]) <write>
+// CHECK-NEXT: 0 OUT (global_var, [1, 2]) <invalidation>
+// CHECK-NEXT: 0 OUT (ptr, [1, 3]) <write>
+// CHECK-NEXT: 0 OUT (i, [1, 4]) <write>
+// CHECK-NEXT: 1 OUT (global_var, [1, 2]) <invalidation>
+// CHECK-NEXT: 1 OUT (ptr, [1, 3]) <write>
+// CHECK-NEXT: 1 OUT (i, [1, 4]) <write>
+
+void function_and_vardecl_in_declstmt() {
+  int *ptr = getIntPtr(), a();
+}
+// [B2 (ENTRY)] -> [B1] -> [B0 (EXIT)]
+
+// CHECK:      GEN sets: blockid (varname [blockid, elementid])
+// CHECK-NEXT: 1 (global_var, [1, 2]) <invalidation>
+// CHECK-NEXT: 1 (ptr, [1, 3]) <write>
+// CHECK-NEXT: KILL sets: blockid (varname [blockid, elementid])
+// CHECK-NEXT: Reaching definition sets: blockid IN/OUT (varname [blockid, elementid])
+// CHECK-NEXT: 0 IN (global_var, [1, 2]) <invalidation>
+// CHECK-NEXT: 0 IN (ptr, [1, 3]) <write>
+// CHECK-NEXT: 0 OUT (global_var, [1, 2]) <invalidation>
+// CHECK-NEXT: 0 OUT (ptr, [1, 3]) <write>
+// CHECK-NEXT: 1 OUT (global_var, [1, 2]) <invalidation>
+// CHECK-NEXT: 1 OUT (ptr, [1, 3]) <write>
+
+void single_def_in_same_block() {
+  int *ptr = getIntPtr();
+
+  if (coin())
+    ptr = 0;
+
+  if (!ptr)
+    *ptr = 5;
+}
+//                    -> [B3] ->    -> [B1] ->
+//                   /          \  /          \
+// [B5 (ENTRY)] -> [B4] ------> [B2] ---> [B0 (EXIT)]
+
+// CHECK:      GEN sets: blockid (varname [blockid, elementid])
+// CHECK-NEXT: 3 (ptr, [3, 3]) <write>
+// CHECK-NEXT: 4 (global_var, [4, 6]) <invalidation>
+// CHECK-NEXT: 4 (ptr, [4, 3]) <write>
+// CHECK-NEXT: KILL sets: blockid (varname [blockid, elementid])
+// CHECK-NEXT: 3 (ptr, [4, 3]) <write>
+// CHECK-NEXT: 4 (ptr, [3, 3]) <write>
+// CHECK-NEXT: Reaching definition sets: blockid IN/OUT (varname [blockid, elementid])
+// CHECK-NEXT: 0 IN (global_var, [4, 6]) <invalidation>
+// CHECK-NEXT: 0 IN (ptr, [3, 3]) <write>
+// CHECK-NEXT: 0 IN (ptr, [4, 3]) <write>
+// CHECK-NEXT: 0 OUT (global_var, [4, 6]) <invalidation>
+// CHECK-NEXT: 0 OUT (ptr, [3, 3]) <write>
+// CHECK-NEXT: 0 OUT (ptr, [4, 3]) <write>
+// CHECK-NEXT: 1 IN (global_var, [4, 6]) <invalidation>
+// CHECK-NEXT: 1 IN (ptr, [3, 3]) <write>
+// CHECK-NEXT: 1 IN (ptr, [4, 3]) <write>
+// CHECK-NEXT: 1 OUT (global_var, [4, 6]) <invalidation>
+// CHECK-NEXT: 1 OUT (ptr, [3, 3]) <write>
+// CHECK-NEXT: 1 OUT (ptr, [4, 3]) <write>
+// CHECK-NEXT: 2 IN (global_var, [4, 6]) <invalidation>
+// CHECK-NEXT: 2 IN (ptr, [3, 3]) <write>
+// CHECK-NEXT: 2 IN (ptr, [4, 3]) <write>
+// CHECK-NEXT: 2 OUT (global_var, [4, 6]) <invalidation>
+// CHECK-NEXT: 2 OUT (ptr, [3, 3]) <write>
+// CHECK-NEXT: 2 OUT (ptr, [4, 3]) <write>
+// CHECK-NEXT: 3 IN (global_var, [4, 6]) <invalidation>
+// CHECK-NEXT: 3 IN (ptr, [4, 3]) <write>
+// CHECK-NEXT: 3 OUT (global_var, [4, 6]) <invalidation>
+// CHECK-NEXT: 3 OUT (ptr, [3, 3]) <write>
+// CHECK-NEXT: 4 OUT (global_var, [4, 6]) <invalidation>
+// CHECK-NEXT: 4 OUT (ptr, [4, 3]) <write>
+
+void different_assignments() {
+  int i = getInt();
+
+  if (coin())
+    i = 0;
+
+  i += 3;
+
+  if (!coin())
+    i -= 2;
+
+  i *= 9;
+
+  if (i = 0)
+    ;
+}
+//                    -> [B5] ->    -> [B3] ->    -> [B1] ->
+//                   /          \  /          \  /          \
+// [B7 (ENTRY)] -> [B6] ------> [B4] -------> [B2] ---> [B0 (EXIT)]
+
+// CHECK:      GEN sets: blockid (varname [blockid, elementid])
+// CHECK-NEXT: 2 (i, [2, 5]) <write>
+// CHECK-NEXT: 3 (i, [3, 2]) <write>
+// CHECK-NEXT: 4 (global_var, [4, 5]) <invalidation>
+// CHECK-NEXT: 4 (i, [4, 2]) <write>
+// CHECK-NEXT: 5 (i, [5, 2]) <write>
+// CHECK-NEXT: 6 (global_var, [6, 6]) <invalidation>
+// CHECK-NEXT: 6 (i, [6, 3]) <write>
+// CHECK-NEXT: KILL sets: blockid (varname [blockid, elementid])
+// CHECK-NEXT: 2 (i, [3, 2]) <write>
+// CHECK-NEXT: 2 (i, [4, 2]) <write>
+// CHECK-NEXT: 2 (i, [5, 2]) <write>
+// CHECK-NEXT: 2 (i, [6, 3]) <write>
+// CHECK-NEXT: 3 (i, [2, 5]) <write>
+// CHECK-NEXT: 3 (i, [4, 2]) <write>
+// CHECK-NEXT: 3 (i, [5, 2]) <write>
+// CHECK-NEXT: 3 (i, [6, 3]) <write>
+// CHECK-NEXT: 4 (global_var, [6, 6]) <invalidation>
+// CHECK-NEXT: 4 (i, [2, 5]) <write>
+// CHECK-NEXT: 4 (i, [3, 2]) <write>
+// CHECK-NEXT: 4 (i, [5, 2]) <write>
+// CHECK-NEXT: 4 (i, [6, 3]) <write>
+// CHECK-NEXT: 5 (i, [2, 5]) <write>
+// CHECK-NEXT: 5 (i, [3, 2]) <write>
+// CHECK-NEXT: 5 (i, [4, 2]) <write>
+// CHECK-NEXT: 5 (i, [6, 3]) <write>
+// CHECK-NEXT: 6 (global_var, [4, 5]) <invalidation>
+// CHECK-NEXT: 6 (i, [2, 5]) <write>
+// CHECK-NEXT: 6 (i, [3, 2]) <write>
+// CHECK-NEXT: 6 (i, [4, 2]) <write>
+// CHECK-NEXT: 6 (i, [5, 2]) <write>
+// CHECK-NEXT: Reaching definition sets: blockid IN/OUT (varname [blockid, elementid])
+// CHECK-NEXT: 0 IN (global_var, [4, 5]) <invalidation>
+// CHECK-NEXT: 0 IN (i, [2, 5]) <write>
+// CHECK-NEXT: 0 OUT (global_var, [4, 5]) <invalidation>
+// CHECK-NEXT: 0 OUT (i, [2, 5]) <write>
+// CHECK-NEXT: 1 IN (global_var, [4, 5]) <invalidation>
+// CHECK-NEXT: 1 IN (i, [2, 5]) <write>
+// CHECK-NEXT: 1 OUT (global_var, [4, 5]) <invalidation>
+// CHECK-NEXT: 1 OUT (i, [2, 5]) <write>
+// CHECK-NEXT: 2 IN (global_var, [4, 5]) <invalidation>
+// CHECK-NEXT: 2 IN (i, [3, 2]) <write>
+// CHECK-NEXT: 2 IN (i, [4, 2]) <write>
+// CHECK-NEXT: 2 OUT (global_var, [4, 5]) <invalidation>
+// CHECK-NEXT: 2 OUT (i, [2, 5]) <write>
+// CHECK-NEXT: 3 IN (global_var, [4, 5]) <invalidation>
+// CHECK-NEXT: 3 IN (i, [4, 2]) <write>
+// CHECK-NEXT: 3 OUT (global_var, [4, 5]) <invalidation>
+// CHECK-NEXT: 3 OUT (i, [3, 2]) <write>
+// CHECK-NEXT: 4 IN (global_var, [6, 6]) <invalidation>
+// CHECK-NEXT: 4 IN (i, [5, 2]) <write>
+// CHECK-NEXT: 4 IN (i, [6, 3]) <write>
+// CHECK-NEXT: 4 OUT (global_var, [4, 5]) <invalidation>
+// CHECK-NEXT: 4 OUT (i, [4, 2]) <write>
+// CHECK-NEXT: 5 IN (global_var, [6, 6]) <invalidation>
+// CHECK-NEXT: 5 IN (i, [6, 3]) <write>
+// CHECK-NEXT: 5 OUT (global_var, [6, 6]) <invalidation>
+// CHECK-NEXT: 5 OUT (i, [5, 2]) <write>
+// CHECK-NEXT: 6 OUT (global_var, [6, 6]) <invalidation>
+// CHECK-NEXT: 6 OUT (i, [6, 3]) <write>
+
+namespace example_1 {
+
+int flag;
+
+void foo() {
+  flag = coin();
+}
+// [B2 (ENTRY)] -> [B1] -> [B0 (EXIT)]
+
+// CHECK:      GEN sets: blockid (varname [blockid, elementid])
+// CHECK-NEXT: 1 (global_var, [1, 2]) <invalidation>
+// CHECK-NEXT: 1 (flag, [1, 5]) <write>
+// CHECK-NEXT: KILL sets: blockid (varname [blockid, elementid])
+// CHECK-NEXT: Reaching definition sets: blockid IN/OUT (varname [blockid, elementid])
+// CHECK-NEXT: 0 IN (global_var, [1, 2]) <invalidation>
+// CHECK-NEXT: 0 IN (flag, [1, 5]) <write>
+// CHECK-NEXT: 0 OUT (global_var, [1, 2]) <invalidation>
+// CHECK-NEXT: 0 OUT (flag, [1, 5]) <write>
+// CHECK-NEXT: 1 OUT (global_var, [1, 2]) <invalidation>
+// CHECK-NEXT: 1 OUT (flag, [1, 5]) <write>
+
+void f() {
+  int *x = nullptr;
+  flag = 1;
+
+  foo();
+  if (flag)
+    x = new int;
+
+  foo();
+  if (flag)
+    *x = 5;
+}
+//                    -> [B3] ->    -> [B1] ->
+//                   /          \  /          \
+// [B5 (ENTRY)] -> [B4] ------> [B2] ---> [B0 (EXIT)]
+
+// CHECK:      GEN sets: blockid (varname [blockid, elementid])
+// CHECK-NEXT: 2 (global_var, [2, 2]) <invalidation>
+// CHECK-NEXT: 2 (flag, [2, 2]) <invalidation>
+// CHECK-NEXT: 3 (x, [3, 3]) <write>
+// CHECK-NEXT: 4 (global_var, [4, 8]) <invalidation>
+// CHECK-NEXT: 4 (flag, [4, 8]) <invalidation>
+// CHECK-NEXT: 4 (x, [4, 2]) <write>
+// CHECK-NEXT: KILL sets: blockid (varname [blockid, elementid])
+// CHECK-NEXT: 2 (global_var, [4, 8]) <invalidation>
+// CHECK-NEXT: 2 (flag, [4, 8]) <invalidation>
+// CHECK-NEXT: 3 (x, [4, 2]) <write>
+// CHECK-NEXT: 4 (global_var, [2, 2]) <invalidation>
+// CHECK-NEXT: 4 (flag, [2, 2]) <invalidation>
+// CHECK-NEXT: 4 (x, [3, 3]) <write>
+// CHECK-NEXT: Reaching definition sets: blockid IN/OUT (varname [blockid, elementid])
+// CHECK-NEXT: 0 IN (global_var, [2, 2]) <invalidation>
+// CHECK-NEXT: 0 IN (flag, [2, 2]) <invalidation>
+// CHECK-NEXT: 0 IN (x, [3, 3]) <write>
+// CHECK-NEXT: 0 IN (x, [4, 2]) <write>
+// CHECK-NEXT: 0 OUT (global_var, [2, 2]) <invalidation>
+// CHECK-NEXT: 0 OUT (flag, [2, 2]) <invalidation>
+// CHECK-NEXT: 0 OUT (x, [3, 3]) <write>
+// CHECK-NEXT: 0 OUT (x, [4, 2]) <write>
+// CHECK-NEXT: 1 IN (global_var, [2, 2]) <invalidation>
+// CHECK-NEXT: 1 IN (flag, [2, 2]) <invalidation>
+// CHECK-NEXT: 1 IN (x, [3, 3]) <write>
+// CHECK-NEXT: 1 IN (x, [4, 2]) <write>
+// CHECK-NEXT: 1 OUT (global_var, [2, 2]) <invalidation>
+// CHECK-NEXT: 1 OUT (flag, [2, 2]) <invalidation>
+// CHECK-NEXT: 1 OUT (x, [3, 3]) <write>
+// CHECK-NEXT: 1 OUT (x, [4, 2]) <write>
+// CHECK-NEXT: 2 IN (global_var, [4, 8]) <invalidation>
+// CHECK-NEXT: 2 IN (flag, [4, 8]) <invalidation>
+// CHECK-NEXT: 2 IN (x, [3, 3]) <write>
+// CHECK-NEXT: 2 IN (x, [4, 2]) <write>
+// CHECK-NEXT: 2 OUT (global_var, [2, 2]) <invalidation>
+// CHECK-NEXT: 2 OUT (flag, [2, 2]) <invalidation>
+// CHECK-NEXT: 2 OUT (x, [3, 3]) <write>
+// CHECK-NEXT: 2 OUT (x, [4, 2]) <write>
+// CHECK-NEXT: 3 IN (global_var, [4, 8]) <invalidation>
+// CHECK-NEXT: 3 IN (flag, [4, 8]) <invalidation>
+// CHECK-NEXT: 3 IN (x, [4, 2]) <write>
+// CHECK-NEXT: 3 OUT (global_var, [4, 8]) <invalidation>
+// CHECK-NEXT: 3 OUT (flag, [4, 8]) <invalidation>
+// CHECK-NEXT: 3 OUT (x, [3, 3]) <write>
+// CHECK-NEXT: 4 OUT (global_var, [4, 8]) <invalidation>
+// CHECK-NEXT: 4 OUT (flag, [4, 8]) <invalidation>
+// CHECK-NEXT: 4 OUT (x, [4, 2]) <write>
+
+} // end of namespace example_1
+
+void assignment_buried_beneath_parentheses() {
+  int *ptr = getIntPtr();
+  if (coin())
+    (((((((((((((((ptr))))))) = getIntPtr()))))))));
+}
+//                    -> [B1] ->
+//                   /          \
+// [B3 (ENTRY)] -> [B2] ---> [B0 (EXIT)]
+
+// CHECK:      GEN sets: blockid (varname [blockid, elementid])
+// CHECK-NEXT: 1 (global_var, [1, 2]) <invalidation>
+// CHECK-NEXT: 2 (global_var, [2, 6]) <invalidation>
+// CHECK-NEXT: 2 (ptr, [2, 3]) <write>
+// CHECK-NEXT: KILL sets: blockid (varname [blockid, elementid])
+// CHECK-NEXT: 1 (global_var, [2, 6]) <invalidation>
+// CHECK-NEXT: 2 (global_var, [1, 2]) <invalidation>
+// CHECK-NEXT: Reaching definition sets: blockid IN/OUT (varname [blockid, elementid])
+// CHECK-NEXT: 0 IN (global_var, [1, 2]) <invalidation>
+// CHECK-NEXT: 0 IN (global_var, [2, 6]) <invalidation>
+// CHECK-NEXT: 0 IN (ptr, [2, 3]) <write>
+// CHECK-NEXT: 0 OUT (global_var, [1, 2]) <invalidation>
+// CHECK-NEXT: 0 OUT (global_var, [2, 6]) <invalidation>
+// CHECK-NEXT: 0 OUT (ptr, [2, 3]) <write>
+// CHECK-NEXT: 1 IN (global_var, [2, 6]) <invalidation>
+// CHECK-NEXT: 1 IN (ptr, [2, 3]) <write>
+// CHECK-NEXT: 1 OUT (global_var, [1, 2]) <invalidation>
+// CHECK-NEXT: 1 OUT (ptr, [2, 3]) <write>
+// CHECK-NEXT: 2 OUT (global_var, [2, 6]) <invalidation>
+// CHECK-NEXT: 2 OUT (ptr, [2, 3]) <write>
+
+void single_parameter(int i) {
+  int *ptr = getIntPtr();
+}
+// [B2 (ENTRY)] -> [B1] -> [B0 (EXIT)]
+
+// CHECK:      GEN sets: blockid (varname [blockid, elementid])
+// CHECK-NEXT: 1 (global_var, [1, 2]) <invalidation>
+// CHECK-NEXT: 1 (ptr, [1, 3]) <write>
+// CHECK-NEXT: 2 (i, [2, 0]) <write>
+// CHECK-NEXT: KILL sets: blockid (varname [blockid, elementid])
+// CHECK-NEXT: Reaching definition sets: blockid IN/OUT (varname [blockid, elementid])
+// CHECK-NEXT: 0 IN (global_var, [1, 2]) <invalidation>
+// CHECK-NEXT: 0 IN (i, [2, 0]) <write>
+// CHECK-NEXT: 0 IN (ptr, [1, 3]) <write>
+// CHECK-NEXT: 0 OUT (global_var, [1, 2]) <invalidation>
+// CHECK-NEXT: 0 OUT (i, [2, 0]) <write>
+// CHECK-NEXT: 0 OUT (ptr, [1, 3]) <write>
+// CHECK-NEXT: 1 IN (i, [2, 0]) <write>
+// CHECK-NEXT: 1 OUT (global_var, [1, 2]) <invalidation>
+// CHECK-NEXT: 1 OUT (i, [2, 0]) <write>
+// CHECK-NEXT: 1 OUT (ptr, [1, 3]) <write>
+// CHECK-NEXT: 2 OUT (i, [2, 0]) <write>
+
+void multiple_parameters(int i, int j, int k) {
+  int *ptr = getIntPtr();
+}
+// [B2 (ENTRY)] -> [B1] -> [B0 (EXIT)]
+
+// CHECK:      GEN sets: blockid (varname [blockid, elementid])
+// CHECK-NEXT: 1 (global_var, [1, 2]) <invalidation>
+// CHECK-NEXT: 1 (ptr, [1, 3]) <write>
+// CHECK-NEXT: 2 (i, [2, 0]) <write>
+// CHECK-NEXT: 2 (j, [2, 0]) <write>
+// CHECK-NEXT: 2 (k, [2, 0]) <write>
+// CHECK-NEXT: KILL sets: blockid (varname [blockid, elementid])
+// CHECK-NEXT: Reaching definition sets: blockid IN/OUT (varname [blockid, elementid])
+// CHECK-NEXT: 0 IN (global_var, [1, 2]) <invalidation>
+// CHECK-NEXT: 0 IN (i, [2, 0]) <write>
+// CHECK-NEXT: 0 IN (j, [2, 0]) <write>
+// CHECK-NEXT: 0 IN (k, [2, 0]) <write>
+// CHECK-NEXT: 0 IN (ptr, [1, 3]) <write>
+// CHECK-NEXT: 0 OUT (global_var, [1, 2]) <invalidation>
+// CHECK-NEXT: 0 OUT (i, [2, 0]) <write>
+// CHECK-NEXT: 0 OUT (j, [2, 0]) <write>
+// CHECK-NEXT: 0 OUT (k, [2, 0]) <write>
+// CHECK-NEXT: 0 OUT (ptr, [1, 3]) <write>
+// CHECK-NEXT: 1 IN (i, [2, 0]) <write>
+// CHECK-NEXT: 1 IN (j, [2, 0]) <write>
+// CHECK-NEXT: 1 IN (k, [2, 0]) <write>
+// CHECK-NEXT: 1 OUT (global_var, [1, 2]) <invalidation>
+// CHECK-NEXT: 1 OUT (i, [2, 0]) <write>
+// CHECK-NEXT: 1 OUT (j, [2, 0]) <write>
+// CHECK-NEXT: 1 OUT (k, [2, 0]) <write>
+// CHECK-NEXT: 1 OUT (ptr, [1, 3]) <write>
+// CHECK-NEXT: 2 OUT (i, [2, 0]) <write>
+// CHECK-NEXT: 2 OUT (j, [2, 0]) <write>
+// CHECK-NEXT: 2 OUT (k, [2, 0]) <write>
+
+void assignment_and_declaration_on_same_line(int i, int j) {
+  int k = i = j = 0;
+}
+// [B2 (ENTRY)] -> [B1] -> [B0 (EXIT)]
+
+// CHECK:      GEN sets: blockid (varname [blockid, elementid])
+// CHECK-NEXT: 1 (i, [1, 5]) <write>
+// CHECK-NEXT: 1 (j, [1, 2]) <write>
+// CHECK-NEXT: 1 (k, [1, 7]) <write>
+// CHECK-NEXT: 2 (i, [2, 0]) <write>
+// CHECK-NEXT: 2 (j, [2, 0]) <write>
+// CHECK-NEXT: KILL sets: blockid (varname [blockid, elementid])
+// CHECK-NEXT: 1 (i, [2, 0]) <write>
+// CHECK-NEXT: 1 (j, [2, 0]) <write>
+// CHECK-NEXT: 2 (i, [1, 5]) <write>
+// CHECK-NEXT: 2 (j, [1, 2]) <write>
+// CHECK-NEXT: Reaching definition sets: blockid IN/OUT (varname [blockid, elementid])
+// CHECK-NEXT: 0 IN (i, [1, 5]) <write>
+// CHECK-NEXT: 0 IN (j, [1, 2]) <write>
+// CHECK-NEXT: 0 IN (k, [1, 7]) <write>
+// CHECK-NEXT: 0 OUT (i, [1, 5]) <write>
+// CHECK-NEXT: 0 OUT (j, [1, 2]) <write>
+// CHECK-NEXT: 0 OUT (k, [1, 7]) <write>
+// CHECK-NEXT: 1 IN (i, [2, 0]) <write>
+// CHECK-NEXT: 1 IN (j, [2, 0]) <write>
+// CHECK-NEXT: 1 OUT (i, [1, 5]) <write>
+// CHECK-NEXT: 1 OUT (j, [1, 2]) <write>
+// CHECK-NEXT: 1 OUT (k, [1, 7]) <write>
+// CHECK-NEXT: 2 OUT (i, [2, 0]) <write>
+// CHECK-NEXT: 2 OUT (j, [2, 0]) <write>
+