[analyzer][CFG] Don't track the condition of asserts

[Szelethus]

Summary

Well, what is says on the tin I guess!

Some more changes:

• Move isInevitablySinking() from BugReporter.cpp to CFGBlock's interface
• Rename and move findBlockForNode() from BugReporter.cpp to ExplodedNode::getCFGBlock()
• Add some testcases, but are these assert implementations esoteric enough?

[NoQ]

I'm sure i've seen something with a do-while(0) loop. Let's also add the following:

#define assert(x) do {                                    \
  if (!x)                                                 \
    __assert_fail (#expr, __FILE__, __LINE__, __func__)   \
} while (0)

clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

1753–1755 ↗

(On Diff #211771)

Clever trick, but why not match for logical operators directly? Something like this:

if (auto B = dyn_cast<BinaryOperator>(OuterCond))
  if (B->isLogicalOp())
    return isAssertlikeBlock(Else, Context);

clang/test/Analysis/track-control-dependency-conditions.cpp

469–471 ↗

(On Diff #211771)

I'm pretty sure you can define this function only once.

[xazax.hun]

clang/include/clang/Analysis/CFG.h

860 ↗

(On Diff #211771)

Is it obvious what sink means in CFG's context? Maybe we should mention what our definition of sink is? Think about non-csa devs too :)

clang/lib/Analysis/CFG.cpp

5628 ↗

(On Diff #211771)

Are there other nodes that are treated as sinks? If so I wonder if there is a way to keep the list updated. Oh, I just saw that this code is just moved around.

clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

1743 ↗

(On Diff #211771)

Do we consider a block assert like if both branches are inevitable sinking?

1750 ↗

(On Diff #211771)

I wonder if the CFG is correct for your example. If A evaluates to false, we still check C before the sink. If A evaluates to true we still check B before going on. But maybe it is just late for me :)

[baloghadamsoftware]

clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

1743 ↗

(On Diff #211771)

No, I think (Then->isInevitablySinking() != Else->isInevitablySinking()) would serve better here.

1750 ↗

(On Diff #211771)

I think an arrow from [B1] to [B3] is missing for the A == false case.

1760 ↗

(On Diff #211771)

I would avoid using matchers in the core infrastructure. My experience says they are quite expensive to create and destroy.

[Szelethus]

Fixes according to reviewer comments!

[Szelethus]

clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

1753–1755 ↗

(On Diff #211771)

What about assert(a + b && "Shouldn't be zero!");?

clang/test/Analysis/track-control-dependency-conditions.cpp

469–471 ↗

(On Diff #211771)

Note that it is in a namespace!

[NoQ]

clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

1753–1755 ↗

(On Diff #211771)

Mmm, could you elaborate? >.<

clang/test/Analysis/track-control-dependency-conditions.cpp

469–471 ↗

(On Diff #211771)

I mean, why is it in a namespace? Why not just define it once for the whole file? It's not like you're gonna be trying out different variants of __assert_fail.

[Szelethus]

After testing this patch out, I'm confident it works pretty well. Take a look at the following two runs: 138 notes -> 20 notes.

clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

1753–1755 ↗

(On Diff #211771)

if (auto B = dyn_cast<BinaryOperator>(OuterCond))
  if (B->isLogicalOp())
    return isAssertlikeBlock(Else, Context);

We don't need isLogicalOp() here.

Also, I should probably have a testcase for the elvis operator (?:).

clang/test/Analysis/track-control-dependency-conditions.cpp

469–471 ↗

(On Diff #211771)

Yea, good point.

[Szelethus]

clang/test/Analysis/track-control-dependency-conditions.cpp

469–471 ↗

(On Diff #211771)

Actually, I kinda like how a single namespace is a single test case, an all-in-one package. Do you insist?

[xazax.hun]

clang/include/clang/Analysis/CFG.h

859 ↗

(On Diff #212803)

I think the depth-first manner is an implementation detail and the result of this method should not depend on the traversal strategy. I would remove that part from the comment.

clang/lib/Analysis/CFG.cpp

5634 ↗

(On Diff #212803)

I am wondering, should we actually scan the whole CFGBlock for ThrowExprs? Shouldn't Throw be the terminator? (In case we can get that easily) In case we are afraid of seeing lifetime end or other blocks AFTER throw, maybe it is more efficient to start scanning from the last element ad early return on the first non-throw stmt?

5649 ↗

(On Diff #212803)

This should never be null, I think this should be dead code.

clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

1750 ↗

(On Diff #211771)

I am still not sure I like this picture. Looking at [B1] I had the impression it has 3 successors which is clearly not the case.

[NoQ]

clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

1750 ↗

(On Diff #211771)

*confirms that 3 successors is 1 successor too many*

1753–1755 ↗

(On Diff #211771)

Mmm, i'm still confused. The a + b in your example doesn't appear as an else-block terminator anywhere. And i don't see why would a + b behave differently compared to a simple a, while i do see why would, say, a && b behave differently.

clang/test/Analysis/track-control-dependency-conditions.cpp

469–471 ↗

(On Diff #211771)

Mmm, i guess it's more about __assert_fail never actually residing in a namespace in real life (being a C function at best).

[Szelethus]

Addressing reviewer feedback!

clang/lib/Analysis/CFG.cpp

5634 ↗

(On Diff #212803)

I just moved this code around, I'd be happy to tinker with this later maybe in a followup patch. To confidently make a change like this would require me to write a bunch more tests and study how the block is built, and I'm not even terribly familiar with how exceptions work -- would you mind if I delayed this?

clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

1750 ↗

(On Diff #211771)

Alright. I think I got it now (eventually).

1753–1755 ↗

(On Diff #211771)

Right. I take it all back. But I guess we might as well just assert that it's a logical operator, if it has 2 successors.

clang/test/Analysis/track-control-dependency-conditions.cpp

469–471 ↗

(On Diff #211771)

I could actually just use [[noreturn]] void halt();, but this looks cooler. :)

[NoQ]

clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

1750 ↗

(On Diff #211771)

There shouldn't be a direct edge from [B1] to the sink. If A is true, we proceed to evaluate B. If A is false, we proceed to evaluate C.

1753–1755 ↗

(On Diff #211771)

Aha, great!

[Szelethus]

If you have no major objections, could you please accept formally? :)

And I'll promise to draw CFG graphs all day tomorrow as an exercise after reading the order of operator evaluation rules >.<

[NoQ]

Wish granted!

[Szelethus]

cfe/trunk/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

1759

Okay, this is stupid. Commited rL369195 to turn this into a condition, accompanied with a test case that would cause an assertion failure.

cfe/trunk/include/clang/Analysis/CFG.h

public:
 
   // Manipulation of block contents
 
   void setTerminator(CFGTerminator Term) { Terminator = Term; }
   void setLabel(Stmt *Statement) { Label = Statement; }
   void setLoopTarget(const Stmt *loopTarget) { LoopTarget = loopTarget; }
   void setHasNoReturnElement() { HasNoReturnElement = true; }
 
+  /// Returns true if the block would eventually end with a sink (a noreturn
+  /// node).
+  bool isInevitablySinking() const;
+
   CFGTerminator getTerminator() const { return Terminator; }
 
   Stmt *getTerminatorStmt() { return Terminator.getStmt(); }
   const Stmt *getTerminatorStmt() const { return Terminator.getStmt(); }
 
   /// \returns the last (\c rbegin()) condition, e.g. observe the following code
   /// snippet:
   ///   if (A && B && C)

cfe/trunk/lib/Analysis/CFG.cpp

void CFGBlock::printTerminatorJson(raw_ostream &Out, const LangOptions &LO,
   std::string Buf;
   llvm::raw_string_ostream TempOut(Buf);
 
   printTerminator(TempOut, LO);
 
   Out << JsonFormat(TempOut.str(), AddQuotes);
 }
 
+// Returns true if by simply looking at the block, we can be sure that it
+// results in a sink during analysis. This is useful to know when the analysis
+// was interrupted, and we try to figure out if it would sink eventually.
+// There may be many more reasons why a sink would appear during analysis
+// (eg. checkers may generate sinks arbitrarily), but here we only consider
+// sinks that would be obvious by looking at the CFG.
+static bool isImmediateSinkBlock(const CFGBlock *Blk) {
+  if (Blk->hasNoReturnElement())
+    return true;
+
+  // FIXME: Throw-expressions are currently generating sinks during analysis:
+  // they're not supported yet, and also often used for actually terminating
+  // the program. So we should treat them as sinks in this analysis as well,
+  // at least for now, but once we have better support for exceptions,
+  // we'd need to carefully handle the case when the throw is being
+  // immediately caught.
+  if (std::any_of(Blk->begin(), Blk->end(), [](const CFGElement &Elm) {
+        if (Optional<CFGStmt> StmtElm = Elm.getAs<CFGStmt>())
+          if (isa<CXXThrowExpr>(StmtElm->getStmt()))
+            return true;
+        return false;
+      }))
+    return true;
+
+  return false;
+}
+
+bool CFGBlock::isInevitablySinking() const {
+  const CFG &Cfg = *getParent();
+
+  const CFGBlock *StartBlk = this;
+  if (isImmediateSinkBlock(StartBlk))
+    return true;
+
+  llvm::SmallVector<const CFGBlock *, 32> DFSWorkList;
+  llvm::SmallPtrSet<const CFGBlock *, 32> Visited;
+
+  DFSWorkList.push_back(StartBlk);
+  while (!DFSWorkList.empty()) {
+    const CFGBlock *Blk = DFSWorkList.back();
+    DFSWorkList.pop_back();
+    Visited.insert(Blk);
+
+    // If at least one path reaches the CFG exit, it means that control is
+    // returned to the caller. For now, say that we are not sure what
+    // happens next. If necessary, this can be improved to analyze
+    // the parent StackFrameContext's call site in a similar manner.
+    if (Blk == &Cfg.getExit())
+      return false;
+
+    for (const auto &Succ : Blk->succs()) {
+      if (const CFGBlock *SuccBlk = Succ.getReachableBlock()) {
+        if (!isImmediateSinkBlock(SuccBlk) && !Visited.count(SuccBlk)) {
+          // If the block has reachable child blocks that aren't no-return,
+          // add them to the worklist.
+          DFSWorkList.push_back(SuccBlk);
+        }
+      }
+    }
+  }
+
+  // Nothing reached the exit. It can only mean one thing: there's no return.
+  return true;
+}
+
 const Expr *CFGBlock::getLastCondition() const {
   // If the terminator is a temporary dtor or a virtual base, etc, we can't
   // retrieve a meaningful condition, bail out.
   if (Terminator.getKind() != CFGTerminator::StmtBranch)
     return nullptr;
 
   // Also, if this method was called on a block that doesn't have 2 successors,
   // this block doesn't have retrievable condition.

cfe/trunk/lib/StaticAnalyzer/Core/BugReporter.cpp

struct FRIEC_WLItem {
   ExplodedNode::const_succ_iterator I, E;
 
   FRIEC_WLItem(const ExplodedNode *n)
       : N(n), I(N->succ_begin()), E(N->succ_end()) {}
 };
 
 } // namespace
 
-static const CFGBlock *findBlockForNode(const ExplodedNode *N) {
-  ProgramPoint P = N->getLocation();
-  if (auto BEP = P.getAs<BlockEntrance>())
-    return BEP->getBlock();
-
-  // Find the node's current statement in the CFG.
-  if (const Stmt *S = PathDiagnosticLocation::getStmt(N))
-    return N->getLocationContext()->getAnalysisDeclContext()
-                                  ->getCFGStmtMap()->getBlock(S);
-
-  return nullptr;
-}
-
-// Returns true if by simply looking at the block, we can be sure that it
-// results in a sink during analysis. This is useful to know when the analysis
-// was interrupted, and we try to figure out if it would sink eventually.
-// There may be many more reasons why a sink would appear during analysis
-// (eg. checkers may generate sinks arbitrarily), but here we only consider
-// sinks that would be obvious by looking at the CFG.
-static bool isImmediateSinkBlock(const CFGBlock *Blk) {
-  if (Blk->hasNoReturnElement())
-    return true;
-
-  // FIXME: Throw-expressions are currently generating sinks during analysis:
-  // they're not supported yet, and also often used for actually terminating
-  // the program. So we should treat them as sinks in this analysis as well,
-  // at least for now, but once we have better support for exceptions,
-  // we'd need to carefully handle the case when the throw is being
-  // immediately caught.
-  if (std::any_of(Blk->begin(), Blk->end(), [](const CFGElement &Elm) {
-        if (Optional<CFGStmt> StmtElm = Elm.getAs<CFGStmt>())
-          if (isa<CXXThrowExpr>(StmtElm->getStmt()))
-            return true;
-        return false;
-      }))
-    return true;
-
-  return false;
-}
-
-// Returns true if by looking at the CFG surrounding the node's program
-// point, we can be sure that any analysis starting from this point would
-// eventually end with a sink. We scan the child CFG blocks in a depth-first
-// manner and see if all paths eventually end up in an immediate sink block.
-static bool isInevitablySinking(const ExplodedNode *N) {
-  const CFG &Cfg = N->getCFG();
-
-  const CFGBlock *StartBlk = findBlockForNode(N);
-  if (!StartBlk)
-    return false;
-  if (isImmediateSinkBlock(StartBlk))
-    return true;
-
-  llvm::SmallVector<const CFGBlock *, 32> DFSWorkList;
-  llvm::SmallPtrSet<const CFGBlock *, 32> Visited;
-
-  DFSWorkList.push_back(StartBlk);
-  while (!DFSWorkList.empty()) {
-    const CFGBlock *Blk = DFSWorkList.back();
-    DFSWorkList.pop_back();
-    Visited.insert(Blk);
-
-    // If at least one path reaches the CFG exit, it means that control is
-    // returned to the caller. For now, say that we are not sure what
-    // happens next. If necessary, this can be improved to analyze
-    // the parent StackFrameContext's call site in a similar manner.
-    if (Blk == &Cfg.getExit())
-      return false;
-
-    for (const auto &Succ : Blk->succs()) {
-      if (const CFGBlock *SuccBlk = Succ.getReachableBlock()) {
-        if (!isImmediateSinkBlock(SuccBlk) && !Visited.count(SuccBlk)) {
-          // If the block has reachable child blocks that aren't no-return,
-          // add them to the worklist.
-          DFSWorkList.push_back(SuccBlk);
-        }
-      }
-    }
-  }
-
-  // Nothing reached the exit. It can only mean one thing: there's no return.
-  return true;
-}
-
 static BugReport *
 FindReportInEquivalenceClass(BugReportEquivClass& EQ,
                              SmallVectorImpl<BugReport*> &bugReports) {
   BugReportEquivClass::iterator I = EQ.begin(), E = EQ.end();
   assert(I != E);
   const BugType& BT = I->getBugType();
 
   // If we don't need to suppress any of the nodes because they are
if (errorNode->succ_empty()) {
         exampleReport = &*I;
       continue;
     }
 
     // See if we are in a no-return CFG block. If so, treat this similarly
     // to being post-dominated by a sink. This works better when the analysis
     // is incomplete and we have never reached the no-return function call(s)
     // that we'd inevitably bump into on this path.
-    if (isInevitablySinking(errorNode))
+    if (const CFGBlock *ErrorB = errorNode->getCFGBlock())
+      if (ErrorB->isInevitablySinking())
         continue;
 
     // At this point we know that 'N' is not a sink and it has at least one
     // successor.  Use a DFS worklist to find a non-sink end-of-path node.
     using WLItem = FRIEC_WLItem;
     using DFSWorkList = SmallVector<WLItem, 10>;
 
     llvm::DenseMap<const ExplodedNode *, unsigned> Visited;
 

cfe/trunk/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

public:
   }
 
   PathDiagnosticPieceRef VisitNode(const ExplodedNode *N,
                                    BugReporterContext &BRC,
                                    BugReport &BR) override;
 };
 } // end of anonymous namespace
 
-static CFGBlock *GetRelevantBlock(const ExplodedNode *Node) {
-  if (auto SP = Node->getLocationAs<StmtPoint>()) {
-    const Stmt *S = SP->getStmt();
-    assert(S);
-
-    return const_cast<CFGBlock *>(Node->getLocationContext()
-        ->getAnalysisDeclContext()->getCFGStmtMap()->getBlock(S));
-  }
-
-  return nullptr;
-}
-
 static std::shared_ptr<PathDiagnosticEventPiece>
 constructDebugPieceForTrackedCondition(const Expr *Cond,
                                        const ExplodedNode *N,
                                        BugReporterContext &BRC) {
 
   if (BRC.getAnalyzerOptions().AnalysisDiagOpt == PD_NONE ||
       !BRC.getAnalyzerOptions().ShouldTrackConditionsDebug)
     return nullptr;
 
   std::string ConditionText = Lexer::getSourceText(
       CharSourceRange::getTokenRange(Cond->getSourceRange()),
                                      BRC.getSourceManager(),
                                      BRC.getASTContext().getLangOpts());
 
   return std::make_shared<PathDiagnosticEventPiece>(
       PathDiagnosticLocation::createBegin(
           Cond, BRC.getSourceManager(), N->getLocationContext()),
           (Twine() + "Tracking condition '" + ConditionText + "'").str());
 }
 
+static bool isAssertlikeBlock(const CFGBlock *B, ASTContext &Context) {
+  if (B->succ_size() != 2)
+    return false;
+
+  const CFGBlock *Then = B->succ_begin()->getReachableBlock();
+  const CFGBlock *Else = (B->succ_begin() + 1)->getReachableBlock();
+
+  if (!Then || !Else)
+    return false;
+
+  if (Then->isInevitablySinking() != Else->isInevitablySinking())
+    return true;
+
+  // For the following condition the following CFG would be built:
+  //
+  //                          ------------->
+  //                         /              \
+  //                       [B1] -> [B2] -> [B3] -> [sink]
+  // assert(A && B || C);            \       \
+  //                                  -----------> [go on with the execution]
+  //
+  // It so happens that CFGBlock::getTerminatorCondition returns 'A' for block
+  // B1, 'A && B' for B2, and 'A && B || C' for B3. Let's check whether we
+  // reached the end of the condition!
+  if (const Stmt *ElseCond = Else->getTerminatorCondition())
+    if (isa<BinaryOperator>(ElseCond)) {
+      assert(cast<BinaryOperator>(ElseCond)->isLogicalOp());
+      return isAssertlikeBlock(Else, Context);
+    }
+
+  return false;
+}
+
 PathDiagnosticPieceRef TrackControlDependencyCondBRVisitor::VisitNode(
     const ExplodedNode *N, BugReporterContext &BRC, BugReport &BR) {
   // We can only reason about control dependencies within the same stack frame.
   if (Origin->getStackFrame() != N->getStackFrame())
     return nullptr;
 
-  CFGBlock *NB = GetRelevantBlock(N);
+  CFGBlock *NB = const_cast<CFGBlock *>(N->getCFGBlock());
 
   // Skip if we already inspected this block.
   if (!VisitedBlocks.insert(NB).second)
     return nullptr;
 
-  CFGBlock *OriginB = GetRelevantBlock(Origin);
+  CFGBlock *OriginB = const_cast<CFGBlock *>(Origin->getCFGBlock());
 
   // TODO: Cache CFGBlocks for each ExplodedNode.
   if (!OriginB || !NB)
     return nullptr;
 
+  if (isAssertlikeBlock(NB, BRC.getASTContext()))
+    return nullptr;
+
   if (ControlDeps.isControlDependent(OriginB, NB)) {
     if (const Expr *Condition = NB->getLastCondition()) {
       // Keeping track of the already tracked conditions on a visitor level
       // isn't sufficient, because a new visitor is created for each tracked
       // expression, hence the BugReport level set.
       if (BR.addTrackedCondition(N)) {
         bugreporter::trackExpressionValue(
             N, Condition, BR, bugreporter::TrackingKind::Condition,

cfe/trunk/lib/StaticAnalyzer/Core/ExplodedGraph.cpp

 //
 //===----------------------------------------------------------------------===//
 
 #include "clang/StaticAnalyzer/Core/PathSensitive/ExplodedGraph.h"
 #include "clang/AST/Expr.h"
 #include "clang/AST/ExprObjC.h"
 #include "clang/AST/ParentMap.h"
 #include "clang/AST/Stmt.h"
+#include "clang/Analysis/CFGStmtMap.h"
 #include "clang/Analysis/ProgramPoint.h"
 #include "clang/Analysis/Support/BumpVector.h"
 #include "clang/Basic/LLVM.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState_Fwd.h"
 #include "llvm/ADT/DenseSet.h"
 #include "llvm/ADT/FoldingSet.h"

 }
 
 bool ExplodedNode::isTrivial() const {
   return pred_size() == 1 && succ_size() == 1 &&
          getFirstPred()->getState()->getID() == getState()->getID() &&
          getFirstPred()->succ_size() == 1;
 }
 
+const CFGBlock *ExplodedNode::getCFGBlock() const {
+  ProgramPoint P = getLocation();
+  if (auto BEP = P.getAs<BlockEntrance>())
+    return BEP->getBlock();
+
+  // Find the node's current statement in the CFG.
+  if (const Stmt *S = PathDiagnosticLocation::getStmt(this))
+    return getLocationContext()
+        ->getAnalysisDeclContext()
+        ->getCFGStmtMap()
+        ->getBlock(S);
+
+  return nullptr;
+}
+
 ExplodedNode *ExplodedGraph::getNode(const ProgramPoint &L,
                                      ProgramStateRef State,
                                      bool IsSink,
                                      bool* IsNew) {
   // Profile 'State' to determine if we already have an existing node.
   llvm::FoldingSetNodeID profile;
   void *InsertPos = nullptr;
 

cfe/trunk/test/Analysis/track-control-dependency-conditions.cpp

void f(int flag) {
   if (flag) // expected-note{{'flag' is not equal to 0}}
             // expected-note@-1{{Taking true branch}}
             // debug-note@-2{{Tracking condition 'flag'}}
     *x = 5; // expected-warning{{Dereference of null pointer}}
             // expected-note@-1{{Dereference of null pointer}}
 }
 
 } // end of namespace unimportant_write_before_collapse_point
+
+namespace dont_track_assertlike_conditions {
+
+extern void __assert_fail(__const char *__assertion, __const char *__file,
+                          unsigned int __line, __const char *__function)
+    __attribute__((__noreturn__));
+#define assert(expr) \
+  ((expr) ? (void)(0) : __assert_fail(#expr, __FILE__, __LINE__, __func__))
+
+int getInt();
+
+int cond1;
+
+void bar() {
+  cond1 = getInt();
+}
+
+void f(int flag) {
+  int *x = 0; // expected-note{{'x' initialized to a null pointer value}}
+
+  flag = getInt();
+
+  bar();
+  assert(cond1); // expected-note{{Assuming 'cond1' is not equal to 0}}
+                 // expected-note@-1{{'?' condition is true}}
+
+  if (flag) // expected-note{{'flag' is not equal to 0}}
+            // expected-note@-1{{Taking true branch}}
+            // debug-note@-2{{Tracking condition 'flag'}}
+    *x = 5; // expected-warning{{Dereference of null pointer}}
+            // expected-note@-1{{Dereference of null pointer}}
+}
+
+#undef assert
+} // end of namespace dont_track_assertlike_conditions
+
+namespace dont_track_assertlike_and_conditions {
+
+extern void __assert_fail(__const char *__assertion, __const char *__file,
+                          unsigned int __line, __const char *__function)
+    __attribute__((__noreturn__));
+#define assert(expr) \
+  ((expr) ? (void)(0) : __assert_fail(#expr, __FILE__, __LINE__, __func__))
+
+int getInt();
+
+int cond1;
+int cond2;
+
+void bar() {
+  cond1 = getInt();
+  cond2 = getInt();
+}
+
+void f(int flag) {
+  int *x = 0; // expected-note{{'x' initialized to a null pointer value}}
+
+  flag = getInt();
+
+  bar();
+  assert(cond1 && cond2);
+  // expected-note@-1{{Assuming 'cond1' is not equal to 0}}
+  // expected-note@-2{{Assuming 'cond2' is not equal to 0}}
+  // expected-note@-3{{'?' condition is true}}
+  // expected-note@-4{{Left side of '&&' is true}}
+
+  if (flag) // expected-note{{'flag' is not equal to 0}}
+            // expected-note@-1{{Taking true branch}}
+            // debug-note@-2{{Tracking condition 'flag'}}
+    *x = 5; // expected-warning{{Dereference of null pointer}}
+            // expected-note@-1{{Dereference of null pointer}}
+}
+
+#undef assert
+} // end of namespace dont_track_assertlike_and_conditions
+
+namespace dont_track_assertlike_or_conditions {
+
+extern void __assert_fail(__const char *__assertion, __const char *__file,
+                          unsigned int __line, __const char *__function)
+    __attribute__((__noreturn__));
+#define assert(expr) \
+  ((expr) ? (void)(0) : __assert_fail(#expr, __FILE__, __LINE__, __func__))
+
+int getInt();
+
+int cond1;
+int cond2;
+
+void bar() {
+  cond1 = getInt();
+  cond2 = getInt();
+}
+
+void f(int flag) {
+  int *x = 0; // expected-note{{'x' initialized to a null pointer value}}
+
+  flag = getInt();
+
+  bar();
+  assert(cond1 || cond2);
+  // expected-note@-1{{Assuming 'cond1' is not equal to 0}}
+  // expected-note@-2{{Left side of '||' is true}}
+
+  if (flag) // expected-note{{'flag' is not equal to 0}}
+            // expected-note@-1{{Taking true branch}}
+            // debug-note@-2{{Tracking condition 'flag'}}
+    *x = 5; // expected-warning{{Dereference of null pointer}}
+            // expected-note@-1{{Dereference of null pointer}}
+}
+
+#undef assert
+} // end of namespace dont_track_assertlike_or_conditions
+
+namespace dont_track_assert2like_conditions {
+
+extern void __assert_fail(__const char *__assertion, __const char *__file,
+                          unsigned int __line, __const char *__function)
+    __attribute__((__noreturn__));
+#define assert(expr)                                      \
+  do {                                                    \
+    if (!(expr))                                          \
+      __assert_fail(#expr, __FILE__, __LINE__, __func__); \
+  } while (0)
+
+int getInt();
+
+int cond1;
+
+void bar() {
+  cond1 = getInt();
+}
+
+void f(int flag) {
+  int *x = 0; // expected-note{{'x' initialized to a null pointer value}}
+
+  flag = getInt();
+
+  bar();
+  assert(cond1); // expected-note{{Assuming 'cond1' is not equal to 0}}
+                 // expected-note@-1{{Taking false branch}}
+                 // expected-note@-2{{Loop condition is false.  Exiting loop}}
+
+  if (flag) // expected-note{{'flag' is not equal to 0}}
+            // expected-note@-1{{Taking true branch}}
+            // debug-note@-2{{Tracking condition 'flag'}}
+    *x = 5; // expected-warning{{Dereference of null pointer}}
+            // expected-note@-1{{Dereference of null pointer}}
+}
+
+#undef assert
+} // end of namespace dont_track_assert2like_conditions
+
+namespace dont_track_assert2like_and_conditions {
+
+extern void __assert_fail(__const char *__assertion, __const char *__file,
+                          unsigned int __line, __const char *__function)
+    __attribute__((__noreturn__));
+#define assert(expr)                                      \
+  do {                                                    \
+    if (!(expr))                                          \
+      __assert_fail(#expr, __FILE__, __LINE__, __func__); \
+  } while (0)
+
+int getInt();
+
+int cond1;
+int cond2;
+
+void bar() {
+  cond1 = getInt();
+  cond2 = getInt();
+}
+
+void f(int flag) {
+  int *x = 0; // expected-note{{'x' initialized to a null pointer value}}
+
+  flag = getInt();
+
+  bar();
+  assert(cond1 && cond2);
+  // expected-note@-1{{Assuming 'cond1' is not equal to 0}}
+  // expected-note@-2{{Left side of '&&' is true}}
+  // expected-note@-3{{Assuming the condition is false}}
+  // expected-note@-4{{Taking false branch}}
+  // expected-note@-5{{Loop condition is false.  Exiting loop}}
+
+  if (flag) // expected-note{{'flag' is not equal to 0}}
+            // expected-note@-1{{Taking true branch}}
+            // debug-note@-2{{Tracking condition 'flag'}}
+    *x = 5; // expected-warning{{Dereference of null pointer}}
+            // expected-note@-1{{Dereference of null pointer}}
+}
+
+#undef assert
+} // end of namespace dont_track_assert2like_and_conditions
+
+namespace dont_track_assert2like_or_conditions {
+
+extern void __assert_fail(__const char *__assertion, __const char *__file,
+                          unsigned int __line, __const char *__function)
+    __attribute__((__noreturn__));
+#define assert(expr)                                      \
+  do {                                                    \
+    if (!(expr))                                          \
+      __assert_fail(#expr, __FILE__, __LINE__, __func__); \
+  } while (0)
+
+int getInt();
+
+int cond1;
+int cond2;
+
+void bar() {
+  cond1 = getInt();
+  cond2 = getInt();
+}
+
+void f(int flag) {
+  int *x = 0; // expected-note{{'x' initialized to a null pointer value}}
+
+  flag = getInt();
+
+  bar();
+  assert(cond1 || cond2);
+  // expected-note@-1{{Assuming 'cond1' is not equal to 0}}
+  // expected-note@-2{{Left side of '||' is true}}
+  // expected-note@-3{{Taking false branch}}
+  // expected-note@-4{{Loop condition is false.  Exiting loop}}
+
+  if (flag) // expected-note{{'flag' is not equal to 0}}
+            // expected-note@-1{{Taking true branch}}
+            // debug-note@-2{{Tracking condition 'flag'}}
+    *x = 5; // expected-warning{{Dereference of null pointer}}
+            // expected-note@-1{{Dereference of null pointer}}
+}
+
+#undef assert
+} // end of namespace dont_track_assert2like_or_conditions