[analyzer][Z3-refutation] Add statistics tracking invalidated bug report classes

[steakhal]

Summary

Counts how many bug report equivalence classes were created and
how many of them were completely invalidated.

In other words how many times avoided emitting diagnostic to the user due to
Z3 refutation.

[steakhal]

It might be useful in the future, but right now, I'm not interested in upstreaming this.

clang/include/clang/StaticAnalyzer/Core/BugReporter/BugReporter.h

public:
   /// responsible for invalidation, and \p Data represents the reason this
   /// visitor decided to invalidate the bug report.
   ///
   /// \sa removeInvalidation
   void markInvalid(const void *Tag, const void *Data) {
     Invalidations.insert(std::make_pair(Tag, Data));
   }
 
+  /// Returns whether or not this report was marked invalid by a given Tag.
+  bool isInvalidatedByTag(const void *Tag) const {
+    const auto EqByTag = [Tag](const auto &TagAndData) {
+      return TagAndData.first == Tag;
+    };
+    return llvm::any_of(Invalidations, EqByTag);
+  }
+
   /// Profile to identify equivalent bug reports for error report coalescing.
   /// Reports are uniqued to ensure that we do not emit multiple diagnostics
   /// for each bug.
   void Profile(llvm::FoldingSetNodeID &hash) const override;
 
   /// Add custom or predefined bug report visitors to this report.
   ///
   /// The visitors should be used when the default trace is not sufficient.

clang/include/clang/StaticAnalyzer/Core/BugReporter/BugReporterVisitors.h

 class FalsePositiveRefutationBRVisitor final : public BugReporterVisitor {
 private:
   /// Holds the constraints in a given path
   ConstraintRangeTy Constraints;
 
 public:
   FalsePositiveRefutationBRVisitor();
 
+  static constexpr char *Tag = "Infeasible constraints";
+
   void Profile(llvm::FoldingSetNodeID &ID) const override;
 
   PathDiagnosticPieceRef VisitNode(const ExplodedNode *N,
                                    BugReporterContext &BRC,
                                    PathSensitiveBugReport &BR) override;
 
   void finalizeVisitor(BugReporterContext &BRC, const ExplodedNode *EndPathNode,
                        PathSensitiveBugReport &BR) override;

clang/lib/StaticAnalyzer/Core/BugReporter.cpp

 
 #define DEBUG_TYPE "BugReporter"
 
 STATISTIC(MaxBugClassSize,
           "The maximum number of bug reports in the same equivalence class");
 STATISTIC(MaxValidBugClassSize,
           "The maximum number of bug reports in the same equivalence class "
           "where at least one report is valid (not suppressed)");
+STATISTIC(TotalBugReportEquivClasses,
+          "The # of bug report equivalence classes");
+STATISTIC(InvalidatedBugReportEquivClasses,
+          "The # of bug report equivalence classes invalidated due to "
+          "infeasible constraints");
 
 BugReporterVisitor::~BugReporterVisitor() = default;
 
 void BugReporterContext::anchor() {}
 
 //===----------------------------------------------------------------------===//
 // PathDiagnosticBuilder and its associated routines and helper objects.
 //===----------------------------------------------------------------------===//
assert(StrBugTypes.empty() &&
          "Destroying BugReporter before diagnostics are emitted!");
 
   // Free the bug reports we are tracking.
   for (const auto I : EQClassesVector)
     delete I;
 }
 
 void BugReporter::FlushReports() {
+  // Increment the total bug report equivalence classes processed statistic.
+  TotalBugReportEquivClasses += EQClassesVector.size();
+
   // We need to flush reports in deterministic order to ensure the order
   // of the reports is consistent between runs.
   for (const auto EQ : EQClassesVector)
     FlushReport(*EQ);
 
   // BugReporter owns and deletes only BugTypes created implicitly through
   // EmitBasicReport.
   // FIXME: There are leaks from checkers that assume that the BugTypes they
void BugReporter::FlushReport(BugReportEquivClass& EQ) {
   BugReport *report = findReportInEquivalenceClass(EQ, bugReports);
   if (!report)
     return;
 
   ArrayRef<PathDiagnosticConsumer*> Consumers = getPathDiagnosticConsumers();
   std::unique_ptr<DiagnosticForConsumerMapTy> Diagnostics =
       generateDiagnosticForConsumerMap(report, Consumers, bugReports);
 
+  // Increment the statistic if necessary.
+  const bool IsEQClassInvalidatedByCrosscheck = llvm::all_of(
+      EQ.getReports(), [](const std::unique_ptr<BugReport> &RawReport) {
+        const auto *Report = dyn_cast<PathSensitiveBugReport>(RawReport.get());
+        return Report && Report->isInvalidatedByTag(
+                             FalsePositiveRefutationBRVisitor::Tag);
+      });
+  if (IsEQClassInvalidatedByCrosscheck)
+    ++InvalidatedBugReportEquivClasses;
+
   for (auto &P : *Diagnostics) {
     PathDiagnosticConsumer *Consumer = P.first;
     std::unique_ptr<PathDiagnostic> &PD = P.second;
 
     // If the path is empty, generate a single step path with the location
     // of the issue.
     if (PD->path.empty()) {
       PathDiagnosticLocation L = report->getLocation();

clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

void FalsePositiveRefutationBRVisitor::finalizeVisitor(
   }
 
   // And check for satisfiability
   Optional<bool> IsSAT = RefutationSolver->check();
   if (!IsSAT.hasValue())
     return;
 
   if (!IsSAT.getValue())
-    BR.markInvalid("Infeasible constraints", EndPathNode->getLocationContext());
+    BR.markInvalid(Tag, EndPathNode->getLocationContext());
 }
 
 void FalsePositiveRefutationBRVisitor::addConstraints(
     const ExplodedNode *N, bool OverwriteConstraintsOnExistingSyms) {
   // Collect new constraints
   const ConstraintRangeTy &NewCs = N->getState()->get<ConstraintRange>();
   ConstraintRangeTy::Factory &CF =
       N->getState()->get_context<ConstraintRange>();