[analyzer] FixItHint: Apply and test hints with the Clang-Tidy's script

[Charusso]

Summary

This patch introduces a way to apply the fix-its by the Analyzer:
-analyzer-config apply-fixits=true.

The fix-its should be testable, therefore I have copied the well-tested
check_clang_tidy.py script. The idea is that the Analyzer's workflow
is different so it would be very difficult to use only one script for
both Tidy and the Analyzer, the script would diverge a lot.
Example test: // RUN: %check-analyzer-fixit %s %t -analyzer-checker=core

When the copy-paste happened the original authors were:
@alexfh, @zinovy.nis, @JonasToth, @hokein, @gribozavr, @lebedev.ri

[Charusso]

Hey! I would like to reuse your script without any reinvention. It serves every needs, but at some point we start to heavily diverge. When I started with the Tidy I really enjoyed that script, and most of the people I know both develop Tidy and the Analyzer, so I would keep the design of the script to make it consistent to use.

Could you please let me use it as it is?

[zinovy.nis]

clang/lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp

179

Isn't llvm_unreacheable too pessimistic? May be use diagnostics instead?

[Charusso]

• Remove llvm_unreacheable from error-handling.

clang/lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp

179

Good idea, thanks! I was too optimistic so llvm_unreacheable should never fire.

[lebedev.ri]

clang/test/Analysis/check_analyzer_fixit.py

1 ↗

(On Diff #227640)

This does work with python3?

[NoQ]

I like this!

@gribozavr: It looks like @Charusso has independently implemented what we've talked about before. Do you agree that the duplication is inevitable here, or should we try to re-use code?

clang/lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp

93

I'll be perfectly happy with removing FixitsAsRemarks entirely. Your new mechanism is superior.

clang/test/Analysis/check_analyzer_fixit.py

50–51 ↗

(On Diff #227640)

I think there must be an os.path function for this.

59 ↗

(On Diff #227640)

Mmm, what does this do?

[gribozavr2]

This patch introduces a way to apply the fix-its by the Analyzer:

I'm not sure this option is very useful... I don't know of anyone who uses the same option in Clang or ClangTidy. The only way I know people apply fixits is with the help of IDEs. I am also skeptical that people want to apply *all* fixits. Usually people want to pick a few specific ones, or all fixits of a certain kind; but not everything.

What workflow are you thinking of for this option?

[NoQ]

In D69746#1756448, @gribozavr2 wrote:

This patch introduces a way to apply the fix-its by the Analyzer:

I'm not sure this option is very useful... I don't know of anyone who uses the same option in Clang or ClangTidy. The only way I know people apply fixits is with the help of IDEs. I am also skeptical that people want to apply *all* fixits. Usually people want to pick a few specific ones, or all fixits of a certain kind; but not everything.

What workflow are you thinking of for this option?

For now this is definitely for testing purposes only. This patch doesn't expose the option in any of the interfaces that are intended for actual users to use (-analyzer-config is not one of them).

I don't have any immediate plans on exposing this option to users. That said, the user can always apply fixits of a specific checker by only running that checker (or by only enabling fixits of this checker).

[alexfh]

In D69746#1756448, @gribozavr2 wrote:

The only way I know people apply fixits is with the help of IDEs.

This depends on the infrastructure available. Talking specifically about clang-tidy in our environment, I know of at least three other modes that are being frequently used:

• in a code review tool (allows to apply manually selected fixes one-by-one);
• in a code browsing tool (allows to apply manually selected fixes or all fixes of a certain category - e.g. from performance-related checks - to a file or directory);
• a script that applies pre-generated fixes to a set of files or all repository.

I am also skeptical that people want to apply *all* fixits. Usually people want to pick a few specific ones, or all fixits of a certain kind; but not everything.

While "all fixits" may be not particularly useful, "apply all fixes enabled for my project" is a reasonable function when the project is generally kept in a clean shape.

[Charusso]

• Change to 4-column space standard.
• Simplify obtaining the Clang include directory.

clang/lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp

93

Okai, challenge accepted. Thanks!

clang/test/Analysis/check_analyzer_fixit.py

1 ↗

(On Diff #227640)

I think it should. It is only made for running by the lit which is left in Python 2.

50–51 ↗

(On Diff #227640)

I hope it is os.path.normpath().

59 ↗

(On Diff #227640)

I think an empty truncate() does not do anything, so removed.

[Charusso]

• Rename the script from check_analyzer_fixit.py to check-analyzer-fixit.py

[Charusso]

Thanks for the reviews! Sorry for the delay.

[alexfh]

A few nits.

clang/lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp

93

One variable per definition would result in a more readable code, IMO.

114

nit: I'd suggest naming the method closer to the name of the corresponding field, e.g. enableApplyFixIts. Why isn't this setApplyFixIts(bool) btw?

156–157

Cosmetics: I'd suggest to make the message less verbose. Specifically, to change

An error occured during fix-it replacement:
   <replacement>
The error message: <error message>

to

Error applying replacement <replacement>: <error message>

199

s/fix-it replacements/fix-it/

[Charusso]

• Fix.

[Charusso]

Thanks for the reviews! Are we good to go?

clang/lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp

114

We do not support the disable way of options, so let us make it enableApplyFixIts().

[alexfh]

LG

[NoQ]

clang/lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp

93

So, can we remove FixitsAsRemarks now or is anything still blocking it?

[Charusso]

clang/lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp

93

https://reviews.llvm.org/D73729

[NoQ]

clang/lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp

93

Oh crap, how did i miss this? Thanks!!

[Charusso]

Thanks everyone! I hope the Analyzer developers start to use the wonderful features from Clang-Tidy.

clang/include/clang/StaticAnalyzer/Core/AnalyzerOptions.def

 ANALYZER_OPTION(bool, ShouldTrackConditionsDebug, "track-conditions-debug",
                 "Whether to place an event at each tracked condition.",
                 false)
 
 ANALYZER_OPTION(bool, ShouldEmitFixItHintsAsRemarks, "fixits-as-remarks",
                 "Emit fix-it hints as remarks for testing purposes",
                 false)
 
+ANALYZER_OPTION(bool, ShouldApplyFixIts, "apply-fixits",
+                "Apply the fix-it hints to the files",
+                false)
+
 //===----------------------------------------------------------------------===//
 // Unsigned analyzer options.
 //===----------------------------------------------------------------------===//
 
 ANALYZER_OPTION(unsigned, CTUImportThreshold, "ctu-import-threshold",
                 "The maximal amount of translation units that is considered "
                 "for import when inlining functions during CTU analysis. "
                 "Lowering this threshold can alleviate the memory burder of "

clang/lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp

 //===--- AnalysisConsumer.cpp - ASTConsumer for running Analyses ----------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
 // "Meta" ASTConsumer for running different source analyses.
 //
 //===----------------------------------------------------------------------===//
 
 #include "clang/StaticAnalyzer/Frontend/AnalysisConsumer.h"
 #include "ModelInjector.h"
-#include "clang/Analysis/PathDiagnostic.h"
 #include "clang/AST/Decl.h"
 #include "clang/AST/DeclCXX.h"
 #include "clang/AST/DeclObjC.h"
 #include "clang/AST/RecursiveASTVisitor.h"
 #include "clang/Analysis/Analyses/LiveVariables.h"
 #include "clang/Analysis/CFG.h"
 #include "clang/Analysis/CallGraph.h"
 #include "clang/Analysis/CodeInjector.h"
+#include "clang/Analysis/PathDiagnostic.h"
 #include "clang/Basic/SourceManager.h"
 #include "clang/CrossTU/CrossTranslationUnit.h"
 #include "clang/Frontend/CompilerInstance.h"
 #include "clang/Lex/Preprocessor.h"
+#include "clang/Rewrite/Core/Rewriter.h"
 #include "clang/StaticAnalyzer/Checkers/LocalCheckers.h"
 #include "clang/StaticAnalyzer/Core/AnalyzerOptions.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
 #include "clang/StaticAnalyzer/Core/PathDiagnosticConsumers.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
 #include "clang/StaticAnalyzer/Frontend/CheckerRegistration.h"
+#include "clang/Tooling/Core/Replacement.h"
+#include "clang/Tooling/Tooling.h"
 #include "llvm/ADT/PostOrderIterator.h"
 #include "llvm/ADT/Statistic.h"
 #include "llvm/Support/FileSystem.h"
 #include "llvm/Support/Path.h"
 #include "llvm/Support/Program.h"
 #include "llvm/Support/Timer.h"
 #include "llvm/Support/raw_ostream.h"
 #include <memory>
 #include <queue>
 #include <utility>
 
 using namespace clang;
 using namespace ento;
+using namespace tooling;
 
 #define DEBUG_TYPE "AnalysisConsumer"
 
 STATISTIC(NumFunctionTopLevel, "The # of functions at top level.");
 STATISTIC(NumFunctionsAnalyzed,
                       "The # of functions and blocks analyzed (as top level "
                       "with inlining turned on).");
 STATISTIC(NumBlocksInAnalyzedFunctions,
void ento::createTextPathDiagnosticConsumer(
     const std::string &Prefix, const clang::Preprocessor &PP,
     const cross_tu::CrossTranslationUnitContext &CTU) {
   llvm_unreachable("'text' consumer should be enabled on ClangDiags");
 }
 
 namespace {
 class ClangDiagPathDiagConsumer : public PathDiagnosticConsumer {
   DiagnosticsEngine &Diag;
-  bool IncludePath = false, ShouldEmitAsError = false, FixitsAsRemarks = false;
+  LangOptions LO;
+
+  bool IncludePath = false;
+  bool ShouldEmitAsError = false;
+  bool FixitsAsRemarks = false;
+  bool ApplyFixIts = false;
 
 public:
-  ClangDiagPathDiagConsumer(DiagnosticsEngine &Diag)
-      : Diag(Diag) {}
+  ClangDiagPathDiagConsumer(DiagnosticsEngine &Diag, LangOptions LO)
+      : Diag(Diag), LO(LO) {}
   ~ClangDiagPathDiagConsumer() override {}
   StringRef getName() const override { return "ClangDiags"; }
 
   bool supportsLogicalOpControlFlow() const override { return true; }
   bool supportsCrossFileDiagnostics() const override { return true; }
 
   PathGenerationScheme getGenerationScheme() const override {
     return IncludePath ? Minimal : None;
   }
 
   void enablePaths() { IncludePath = true; }
   void enableWerror() { ShouldEmitAsError = true; }
   void enableFixitsAsRemarks() { FixitsAsRemarks = true; }
+  void enableApplyFixIts() { ApplyFixIts = true; }
 
   void FlushDiagnosticsImpl(std::vector<const PathDiagnostic *> &Diags,
                             FilesMade *filesMade) override {
     unsigned WarnID =
         ShouldEmitAsError
             ? Diag.getCustomDiagID(DiagnosticsEngine::Error, "%0")
             : Diag.getCustomDiagID(DiagnosticsEngine::Warning, "%0");
     unsigned NoteID = Diag.getCustomDiagID(DiagnosticsEngine::Note, "%0");
     unsigned RemarkID = Diag.getCustomDiagID(DiagnosticsEngine::Remark, "%0");
+    SourceManager &SM = Diag.getSourceManager();
 
-    auto reportPiece =
-        [&](unsigned ID, SourceLocation Loc, StringRef String,
-            ArrayRef<SourceRange> Ranges, ArrayRef<FixItHint> Fixits) {
-          if (!FixitsAsRemarks) {
-            Diag.Report(Loc, ID) << String << Ranges << Fixits;
-          } else {
-            Diag.Report(Loc, ID) << String << Ranges;
-            for (const FixItHint &Hint : Fixits) {
-              SourceManager &SM = Diag.getSourceManager();
-              llvm::SmallString<128> Str;
-              llvm::raw_svector_ostream OS(Str);
-              // FIXME: Add support for InsertFromRange and
-              // BeforePreviousInsertion.
-              assert(!Hint.InsertFromRange.isValid() && "Not implemented yet!");
-              assert(!Hint.BeforePreviousInsertions && "Not implemented yet!");
-              OS << SM.getSpellingColumnNumber(Hint.RemoveRange.getBegin())
-                 << "-" << SM.getSpellingColumnNumber(Hint.RemoveRange.getEnd())
-                 << ": '" << Hint.CodeToInsert << "'";
-              Diag.Report(Loc, RemarkID) << OS.str();
-            }
-          }
-        };
+    Replacements Repls;
+    auto reportPiece = [&](unsigned ID, FullSourceLoc Loc, StringRef String,
+                           ArrayRef<SourceRange> Ranges,
+                           ArrayRef<FixItHint> Fixits) {
+      if (!FixitsAsRemarks && !ApplyFixIts) {
+        return;
+      }
+
+      if (FixitsAsRemarks) {
+          OS << SM.getSpellingColumnNumber(Hint.RemoveRange.getBegin()) << "-"
+             << SM.getSpellingColumnNumber(Hint.RemoveRange.getEnd()) << ": '"
+             << Hint.CodeToInsert << "'";
+
+      if (ApplyFixIts) {
+        for (const FixItHint &Hint : Fixits) {
+          Replacement Repl(SM, Hint.RemoveRange, Hint.CodeToInsert);
+
+          if (llvm::Error Err = Repls.add(Repl)) {
+            llvm::errs() << "Error applying replacement " << Repl.toString()
+                         << ": " << Err << "\n";
+          }
+        }
+      }
 
     for (std::vector<const PathDiagnostic *>::iterator I = Diags.begin(),
          E = Diags.end();
          I != E; ++I) {
       const PathDiagnostic *PD = *I;
       reportPiece(WarnID, PD->getLocation().asLocation(),
                   PD->getShortDescription(), PD->path.back()->getRanges(),
                   PD->path.back()->getFixits());
 
       // First, add extra notes, even if paths should not be included.
       for (const auto &Piece : PD->path) {
         if (!isa<PathDiagnosticNotePiece>(Piece.get()))
           continue;
 
         reportPiece(NoteID, Piece->getLocation().asLocation(),
                     Piece->getString(), Piece->getRanges(), Piece->getFixits());
       }
 
       if (!IncludePath)
         continue;
 
       // Then, add the path notes if necessary.
       PathPieces FlatPath = PD->path.flatten(/*ShouldFlattenMacros=*/true);
       for (const auto &Piece : FlatPath) {
         if (isa<PathDiagnosticNotePiece>(Piece.get()))
           continue;
 
         reportPiece(NoteID, Piece->getLocation().asLocation(),
                     Piece->getString(), Piece->getRanges(), Piece->getFixits());
       }
     }
+
+    if (!ApplyFixIts || Repls.empty())
+      return;
+
+    Rewriter Rewrite(SM, LO);
+    if (!applyAllReplacements(Repls, Rewrite)) {
+      llvm::errs() << "An error occured during applying fix-it.\n";
+    }
+
+    Rewrite.overwriteChangedFiles();
   }
 };
 } // end anonymous namespace
 
 //===----------------------------------------------------------------------===//
 // AnalysisConsumer declaration.
 //===----------------------------------------------------------------------===//
 
if (Opts->PrintStats) {
       llvm::PrintStatistics();
     }
   }
 
   void DigestAnalyzerOptions() {
     if (Opts->AnalysisDiagOpt != PD_NONE) {
       // Create the PathDiagnosticConsumer.
       ClangDiagPathDiagConsumer *clangDiags =
-          new ClangDiagPathDiagConsumer(PP.getDiagnostics());
+          new ClangDiagPathDiagConsumer(PP.getDiagnostics(), PP.getLangOpts());
       PathConsumers.push_back(clangDiags);
 
       if (Opts->AnalyzerWerror)
         clangDiags->enableWerror();
 
       if (Opts->ShouldEmitFixItHintsAsRemarks)
         clangDiags->enableFixitsAsRemarks();
 
+      if (Opts->ShouldApplyFixIts)
+        clangDiags->enableApplyFixIts();
+
       if (Opts->AnalysisDiagOpt == PD_TEXT) {
         clangDiags->enablePaths();
 
       } else if (!OutDir.empty()) {
         switch (Opts->AnalysisDiagOpt) {
         default:
 #define ANALYSIS_DIAGNOSTICS(NAME, CMDFLAG, DESC, CREATEFN)                    \
   case PD_##NAME:                                                              \

clang/lib/StaticAnalyzer/Frontend/CMakeLists.txt

add_clang_library(clangStaticAnalyzerFrontend
   clangAST
   clangAnalysis
   clangBasic
   clangCrossTU
   clangFrontend
   clangLex
   clangStaticAnalyzerCheckers
   clangStaticAnalyzerCore
+  clangRewrite
+  clangToolingCore
   )

clang/test/Analysis/analyzer-config.c

 // RUN: %clang_analyze_cc1 -analyzer-checker=debug.ConfigDumper > %t 2>&1
 // RUN: FileCheck --input-file=%t %s --match-full-lines
 
 // CHECK: [config]
 // CHECK-NEXT: add-pop-up-notes = true
 // CHECK-NEXT: aggressive-binary-operation-simplification = false
 // CHECK-NEXT: alpha.clone.CloneChecker:IgnoredFilesPattern = ""
 // CHECK-NEXT: alpha.clone.CloneChecker:MinimumCloneComplexity = 50
 // CHECK-NEXT: alpha.clone.CloneChecker:ReportNormalClones = true
 // CHECK-NEXT: alpha.cplusplus.STLAlgorithmModeling:AggressiveStdFindModeling = false
 // CHECK-NEXT: alpha.security.MmapWriteExec:MmapProtExec = 0x04
 // CHECK-NEXT: alpha.security.MmapWriteExec:MmapProtRead = 0x01
 // CHECK-NEXT: alpha.security.taint.TaintPropagation:Config = ""
+// CHECK-NEXT: apply-fixits = false
 // CHECK-NEXT: avoid-suppressing-null-argument-paths = false
 // CHECK-NEXT: c++-allocator-inlining = true
 // CHECK-NEXT: c++-container-inlining = false
 // CHECK-NEXT: c++-inlining = destructors
 // CHECK-NEXT: c++-shared_ptr-inlining = false
 // CHECK-NEXT: c++-stdlib-inlining = true
 // CHECK-NEXT: c++-temp-dtor-inlining = true
 // CHECK-NEXT: c++-template-inlining = true

 // CHECK-NEXT: suppress-inlined-defensive-checks = true
 // CHECK-NEXT: suppress-null-return-paths = true
 // CHECK-NEXT: track-conditions = true
 // CHECK-NEXT: track-conditions-debug = false
 // CHECK-NEXT: unix.DynamicMemoryModeling:Optimistic = false
 // CHECK-NEXT: unroll-loops = false
 // CHECK-NEXT: widen-loops = false
 // CHECK-NEXT: [stats]
-// CHECK-NEXT: num-entries = 97
+// CHECK-NEXT: num-entries = 98

clang/test/Analysis/check-analyzer-fixit.py

+#!/usr/bin/env python
+#
+#===- check-analyzer-fixit.py - Static Analyzer test helper ---*- python -*-===#
+#
+# Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+# See https://llvm.org/LICENSE.txt for license information.
+# SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+#
+#===------------------------------------------------------------------------===#
+#
+# This file copy-pasted mostly from the Clang-Tidy's 'check_clang_tidy.py'.
+#
+#===------------------------------------------------------------------------===#
+
+r"""
+Clang Static Analyzer test helper
+=================================
+
+This script runs the Analyzer in fix-it mode and verify fixes, warnings, notes.
+
+Usage:
+  check-analyzer-fixit.py <source-file> <temp-file> [analyzer arguments]
+
+Example:
+  // RUN: %check-analyzer-fixit %s %t -analyzer-checker=core
+"""
+
+import argparse
+import os
+import re
+import subprocess
+import sys
+
+
+def write_file(file_name, text):
+    with open(file_name, 'w') as f:
+        f.write(text)
+
+
+def run_test_once(args, extra_args):
+    input_file_name = args.input_file_name
+    temp_file_name = args.temp_file_name
+    clang_analyzer_extra_args = extra_args
+
+    file_name_with_extension = input_file_name
+    _, extension = os.path.splitext(file_name_with_extension)
+    if extension not in ['.c', '.hpp', '.m', '.mm']:
+        extension = '.cpp'
+    temp_file_name = temp_file_name + extension
+
+    with open(input_file_name, 'r') as input_file:
+        input_text = input_file.read()
+
+    # Remove the contents of the CHECK lines to avoid CHECKs matching on
+    # themselves.  We need to keep the comments to preserve line numbers while
+    # avoiding empty lines which could potentially trigger formatting-related
+    # checks.
+    cleaned_test = re.sub('// *CHECK-[A-Z0-9\-]*:[^\r\n]*', '//', input_text)
+    write_file(temp_file_name, cleaned_test)
+
+    original_file_name = temp_file_name + ".orig"
+    write_file(original_file_name, cleaned_test)
+
+    try:
+        builtin_include_dir = subprocess.check_output(
+            ['clang', '-print-file-name=include'], stderr=subprocess.STDOUT)
+    except subprocess.CalledProcessError as e:
+        print('Cannot print Clang include directory: ' + e.output.decode())
+
+    builtin_include_dir = os.path.normpath(builtin_include_dir)
+
+    args = (['clang', '-cc1', '-internal-isystem', builtin_include_dir,
+             '-nostdsysteminc', '-analyze', '-analyzer-constraints=range',
+             '-analyzer-config', 'apply-fixits=true']
+            + clang_analyzer_extra_args + ['-verify', temp_file_name])
+
+    print('Running ' + str(args) + '...')
+
+    try:
+        clang_analyzer_output = \
+            subprocess.check_output(args, stderr=subprocess.STDOUT).decode()
+    except subprocess.CalledProcessError as e:
+        print('Clang Static Analyzer test failed:\n' + e.output.decode())
+        raise
+
+    print('----------------- Clang Static Analyzer output -----------------\n' +
+          clang_analyzer_output +
+          '\n--------------------------------------------------------------')
+
+    try:
+        diff_output = subprocess.check_output(
+            ['diff', '-u', original_file_name, temp_file_name],
+            stderr=subprocess.STDOUT)
+    except subprocess.CalledProcessError as e:
+        diff_output = e.output
+
+    print('----------------------------- Fixes ----------------------------\n' +
+          diff_output.decode() +
+          '\n--------------------------------------------------------------')
+
+    try:
+        subprocess.check_output(
+            ['FileCheck', '-input-file=' + temp_file_name, input_file_name,
+             '-check-prefixes=CHECK-FIXES', '-strict-whitespace'],
+            stderr=subprocess.STDOUT)
+    except subprocess.CalledProcessError as e:
+        print('FileCheck failed:\n' + e.output.decode())
+        raise
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument('input_file_name')
+    parser.add_argument('temp_file_name')
+
+    args, extra_args = parser.parse_known_args()
+    run_test_once(args, extra_args)
+
+
+if __name__ == '__main__':
+    main()

clang/test/Analysis/virtualcall-fixit.cpp

+// RUN: %check_analyzer_fixit %s %t \
+// RUN:   -analyzer-checker=core,optin.cplusplus.VirtualCall \
+// RUN:   -analyzer-config optin.cplusplus.VirtualCall:ShowFixIts=true
+
+struct S {
+  virtual void foo();
+  S() {
+    foo();
+    // expected-warning@-1 {{Call to virtual method 'S::foo' during construction bypasses virtual dispatch}}
+    // CHECK-FIXES: S::foo();
+  }
+  ~S();
+};

clang/test/lit.cfg.py

 
 if config.clang_staticanalyzer:
     config.available_features.add('staticanalyzer')
     tools.append('clang-check')
 
     if config.clang_staticanalyzer_z3 == '1':
         config.available_features.add('z3')
 
+    check_analyzer_fixit_path = os.path.join(
+        config.test_source_root, "Analysis", "check-analyzer-fixit.py")
+    config.substitutions.append(
+        ('%check_analyzer_fixit',
+         '%s %s' % (config.python_executable, check_analyzer_fixit_path)))
 
 llvm_config.add_tool_substitutions(tools, tool_dirs)
 
 config.substitutions.append(
     ('%hmaptool', "'%s' %s" % (config.python_executable,
                              os.path.join(config.clang_tools_dir, 'hmaptool'))))
 
 # Plugins (loadable modules)