[analyzer][RFC] Get info from the LLVM IR for precision

[martong]

Summary

This is a prototype to access the IR from the components of the Clang Static Analyzer.
This involves architectural changes and there is a related discussion here on cfe-dev: http://lists.llvm.org/pipermail/cfe-dev/2020-August/066426.html.

There are many important and useful analyses in the LLVM layer that we can use during the path
sensitive analysis. Most notably, the "readnone" and "readonly" function
attributes which can be used to identify "pure" functions (those without side
effects). Here, I am using the pureness info from the IR to avoid invalidation
of any variables during conservative evaluation (when we evaluate a pure
function).

[martong]

• Remove dummy test file

[whisperity]

What will happen with the ability to analyse a translation unit whose target was not part of LLVM_TARGETS_TO_BUILD of the current clang binary? Will it break, because the binary lacks the information on how to generate for the given target?

clang/include/clang/StaticAnalyzer/Core/IRContext.h

39–41

Aren't documentation comments in LLVM ///?

clang/lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp

127

Where's this CG defined?

clang/lib/StaticAnalyzer/Frontend/FrontendActions.cpp

53–57

Isn't there a lifetime issue here? LLVMCtx is given as a raw reference to the BuildCodeGen and the shared pointer leaves scope at the end of the branch.

clang/test/Analysis/ircontext.cpp

17–18

What are we testing here? Without the ability to read the pureness of foo from the IR, the knowledge about g's value would be scrapped at the call? foo is defined in the current TU.

[martong]

clang/include/clang/StaticAnalyzer/Core/IRContext.h

39–41

Yep, I forgot about that.

clang/lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp

127

In AnalysisConsumer.h. And set in FrontendActions.cpp AConsumer->setCodeGen(CGConsumer.get());

clang/lib/StaticAnalyzer/Frontend/FrontendActions.cpp

53–57

Nope, LLVMCtx is a member of AnalysisAction.

clang/test/Analysis/ircontext.cpp

17–18

We test here that with no-inlining (i.e. always doing conservative evaluation) we do not invalidate the state after a call to a pure function.

[martong]

In D85319#2196648, @whisperity wrote:

What will happen with the ability to analyse a translation unit whose target was not part of LLVM_TARGETS_TO_BUILD of the current clang binary? Will it break, because the binary lacks the information on how to generate for the given target?

We get the target info from the CompilerInstance that is used for the command line of the analysis. So if clang cannot handle that then we'll probably get a diagnostics anyway by the AnalysisASTConsumers diag engine.

[rjmccall]

This seems a huge architectural change that we need to talk about.

[NoQ]

clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp

720

Before i forget: you still need to conjure the return value.

[NoQ]

In D85319#2197104, @rjmccall wrote:

This seems a huge architectural change that we need to talk about.

Absolutely.

I believe the relevant discussion is at http://lists.llvm.org/pipermail/cfe-dev/2020-August/066426.html.

[rjmccall]

Thanks. It'd be a good idea to mention that this is contingent on that discussion in the patch summary.

[martong]

In D85319#2197104, @rjmccall wrote:

This seems a huge architectural change that we need to talk about.

Yes, sure. I am open to and welcome any discussions and suggestions. This patch is just a prototype to demonstrate the usability and feasibility. As @NoQ indicated there is a relevant discussion in cfe-dev, maybe it's better to discuss there because of the bigger visibility.

[martong]

clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp

720

Good catch, thanks!

[martong]

clang/lib/StaticAnalyzer/Frontend/FrontendActions.cpp

30

TODO overwrite ALL optimization related config.

Artem:

we should not be taking -O flags into account at all, but pick some default -O2 regardless of flags; and ideally all flags should be ignored by default, to ensure experience as consistent as possible.

[xazax.hun]

clang/lib/StaticAnalyzer/Frontend/FrontendActions.cpp

30

Additional bit of info from the mailing list: relying on the set of optimizations from O2 might not suffice as it might contain passes with bad side effects. One example is removing a static function that was inlined to all of the call sites which would make us unable to query the analysis results for that function. Overall, we might not want to make the analysis dependent on inlining heuristics. (Or we might not care. This is up for discussion.)

[martong]

• Use custom, CSA specific pipeline
• Rename runOptimizerPipeline to runPipeline
• Add unittest for IRContext
  • Add BuildCodeGen to CSA's FrontendAction.h

[martong]

clang/lib/StaticAnalyzer/Frontend/FrontendActions.cpp

30

CodeGenOptions CGO = CodeGenOptions(); will create an options object with all value set to the default.

[martong]

• Use /// comments in IRContext.h
• Conjure the return value even if the funciton is pure
• Set all CodeGen options to the default (except the opt level)

clang/include/clang/CodeGen/CodeGenMangling.h

+//==----- CodeGenMangling.h - Get mangled names from the CodeGenModule -----==//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+// CodeGenMangling provides name mangling that depends on the target set for
+// the given CodeGen.
+//===----------------------------------------------------------------------===//
+
+#ifndef LLVM_CLANG_CODEGEN_CODEGENMANGLING_H
+#define LLVM_CLANG_CODEGEN_CODEGENMANGLING_H
+
+#include "clang/AST/GlobalDecl.h"
+#include "llvm/ADT/StringRef.h"
+
+namespace clang {
+namespace CodeGen {
+class CodeGenModule;
+
+llvm::StringRef getMangledName(CodeGenModule &CGM, GlobalDecl GD);
+
+} // namespace CodeGen
+} // namespace clang
+
+#endif

clang/include/clang/StaticAnalyzer/Core/AnalyzerOptions.def

 ANALYZER_OPTION(bool, ShouldApplyFixIts, "apply-fixits",
                 "Apply the fix-it hints to the files",
                 false)
 
 ANALYZER_OPTION(bool, ShouldDisplayCheckerNameForText, "display-checker-name",
                 "Display the checker name for textual outputs",
                 true)
 
+ANALYZER_OPTION(bool, GenerateLLVMIR, "generate-llvm-ir",
+                "Whether to generate LLVM IR for the translation unit. "
+                "The analyzer can be more precise by using info from the IR.",
+                false)
+
 //===----------------------------------------------------------------------===//
 // Unsigned analyzer options.
 //===----------------------------------------------------------------------===//
 
 ANALYZER_OPTION(unsigned, CTUImportThreshold, "ctu-import-threshold",
                 "The maximal amount of translation units that is considered "
                 "for import when inlining functions during CTU analysis. "
                 "Lowering this threshold can alleviate the memory burden of "

clang/include/clang/StaticAnalyzer/Core/IRContext.h

+//== IRContext.h - Get info from the IR in CSA -*- C++ -*--------------------=//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+//
+// This file defines auxilary structures for getting data from the IR inside
+// the Clang Static Analyzer.
+//
+//===----------------------------------------------------------------------===//
+
+#ifndef LLVM_CLANG_STATICANALYZER_CORE_IRCONTEXT_H
+#define LLVM_CLANG_STATICANALYZER_CORE_IRCONTEXT_H
+
+#include "clang/AST/GlobalDecl.h"
+
+namespace llvm {
+class Function;
+} // namespace llvm
+
+namespace clang {
+class CodeGenerator;
+class FunctionDecl;
+
+namespace ento {
+
+// Static Analyzer components can get access to the LLVM IR of a translation
+// unit throught this class.
+class IRContext {
+  // Set by AnalysisAction if the AnalyzerOptions requires that.
+  clang::CodeGenerator *&CodeGen;
+
+public:
+  IRContext(clang::CodeGenerator *&CodeGen) : CodeGen(CodeGen) {}
+  void runOptimizerPipeline();
+  llvm::Function *getFunction(GlobalDecl GD);
+  // Get the LLVM code for a function. We use the complete versions of the
+  // constructors and desctructors in this overload. Use the other overload to
+  // get the base object ctor/dtor.
+  llvm::Function *getFunction(const FunctionDecl *FD);
+};
+
+} // namespace ento
+} // namespace clang
+
+#endif

clang/include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h

 class CallEvent;
 class CheckerManager;
 class ConstraintManager;
 class CXXTempObjectRegion;
 class EndOfFunctionNodeBuilder;
 class ExplodedNodeSet;
 class ExplodedNode;
 class IndirectGotoNodeBuilder;
+class IRContext;
 class MemRegion;
 struct NodeBuilderContext;
 class NodeBuilderWithSinks;
 class ProgramState;
 class ProgramStateManager;
 class RegionAndSymbolInvalidationTraits;
 class SymbolManager;
 class SwitchNodeBuilder;
enum InliningModes {
 
     /// Do minimal inlining of callees.
     Inline_Minimal = 0x1
   };
 
 private:
   cross_tu::CrossTranslationUnitContext &CTU;
 
+  IRContext &IRCtx;
+
   AnalysisManager &AMgr;
 
   AnalysisDeclContextManager &AnalysisDeclContexts;
 
   CoreEngine Engine;
 
   /// G - the simulation graph.
   ExplodedGraph &G;
private:
   /// The functions which have been analyzed through inlining. This is owned by
   /// AnalysisConsumer. It can be null.
   SetOfConstDecls *VisitedCallees;
 
   /// The flag, which specifies the mode of inlining for the engine.
   InliningModes HowToInline;
 
 public:
-  ExprEngine(cross_tu::CrossTranslationUnitContext &CTU, AnalysisManager &mgr,
-             SetOfConstDecls *VisitedCalleesIn,
+  ExprEngine(cross_tu::CrossTranslationUnitContext &CTU, IRContext &IRCtx,
+             AnalysisManager &mgr, SetOfConstDecls *VisitedCalleesIn,
              FunctionSummariesTy *FS, InliningModes HowToInlineIn);
 
   virtual ~ExprEngine() = default;
 
   /// Returns true if there is still simulation state on the worklist.
   bool ExecuteWorkList(const LocationContext *L, unsigned Steps = 150000) {
     return Engine.ExecuteWorkList(L, Steps, nullptr);
   }
public:
 
   BugReporter &getBugReporter() { return BR; }
 
   cross_tu::CrossTranslationUnitContext *
   getCrossTranslationUnitContext() {
     return &CTU;
   }
 
+  IRContext *getIRContext() { return &IRCtx; }
+
   const NodeBuilderContext &getBuilderContext() {
     assert(currBldrCtx);
     return *currBldrCtx;
   }
 
   const Stmt *getStmt() const;
 
   void GenerateAutoTransition(ExplodedNode *N);

clang/include/clang/StaticAnalyzer/Frontend/AnalysisConsumer.h

 #include <functional>
 #include <memory>
 
 namespace clang {
 
 class Preprocessor;
 class DiagnosticsEngine;
 class CodeInjector;
+class CodeGenerator;
 class CompilerInstance;
 
 namespace ento {
 class PathDiagnosticConsumer;
 class CheckerManager;
 class CheckerRegistry;
 
 class AnalysisASTConsumer : public ASTConsumer {
+protected:
+  CodeGenerator *CG = nullptr;
+
 public:
   virtual void AddDiagnosticConsumer(PathDiagnosticConsumer *Consumer) = 0;
 
   /// This method allows registering statically linked custom checkers that are
   /// not a part of the Clang tree. It employs the same mechanism that is used
   /// by plugins.
   ///
   /// Example:
   ///
   ///   Consumer->AddCheckerRegistrationFn([] (CheckerRegistry& Registry) {
   ///     Registry.addChecker<MyCustomChecker>("example.MyCustomChecker",
   ///                                          "Description");
   ///   });
   virtual void
   AddCheckerRegistrationFn(std::function<void(CheckerRegistry &)> Fn) = 0;
+
+  void setCodeGen(CodeGenerator *Cg) { CG = Cg; }
 };
 
 /// CreateAnalysisConsumer - Creates an ASTConsumer to run various code
 /// analysis passes.  (The set of analyses run is controlled by command-line
 /// options.)
 std::unique_ptr<AnalysisASTConsumer>
 CreateAnalysisConsumer(CompilerInstance &CI);
 
 } // namespace ento
 
-} // end clang namespace
+} // namespace clang
 
 #endif

clang/include/clang/StaticAnalyzer/Frontend/FrontendActions.h

 //===-- FrontendActions.h - Useful Frontend Actions -------------*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
 #ifndef LLVM_CLANG_STATICANALYZER_FRONTEND_FRONTENDACTIONS_H
 #define LLVM_CLANG_STATICANALYZER_FRONTEND_FRONTENDACTIONS_H
 
 #include "clang/Frontend/FrontendAction.h"
 #include "llvm/ADT/StringMap.h"
 #include "llvm/ADT/StringRef.h"
 
+#include <memory>
+
+namespace llvm {
+class LLVMContext;
+} // namespace llvm
+
 namespace clang {
 
 class Stmt;
 class AnalyzerOptions;
 
 namespace ento {
 
 class CheckerManager;
 
 //===----------------------------------------------------------------------===//
 // AST Consumer Actions
 //===----------------------------------------------------------------------===//
 
 class AnalysisAction : public ASTFrontendAction {
+  // Cannot be a unique_ptr because then ClangFrontendTool would
+  // depend on this lib.
+  std::shared_ptr<llvm::LLVMContext> LLVMCtx;
+  std::unique_ptr<DiagnosticsEngine> CodeGenDiags;
+
 protected:
   std::unique_ptr<ASTConsumer> CreateASTConsumer(CompilerInstance &CI,
                                                  StringRef InFile) override;
+
+public:
+  ~AnalysisAction();
 };
 
+std::unique_ptr<AnalysisAction> CreateAnalysisAction();
+
 /// Frontend action to parse model files.
 ///
 /// This frontend action is responsible for parsing model files. Model files can
 /// not be parsed on their own, they rely on type information that is available
 /// in another translation unit. The parsing of model files is done by a
 /// separate compiler instance that reuses the ASTContext and othen information
 /// from the main translation unit that is being compiled. After a model file is
 /// parsed, the function definitions will be collected into a StringMap.

clang/lib/CodeGen/CMakeLists.txt

add_clang_library(clangCodeGen
   CGRecordLayoutBuilder.cpp
   CGStmt.cpp
   CGStmtOpenMP.cpp
   CGVTT.cpp
   CGVTables.cpp
   CodeGenABITypes.cpp
   CodeGenAction.cpp
   CodeGenFunction.cpp
+  CodeGenMangling.cpp
   CodeGenModule.cpp
   CodeGenPGO.cpp
   CodeGenTBAA.cpp
   CodeGenTypes.cpp
   ConstantInitBuilder.cpp
   CoverageMappingGen.cpp
   ItaniumCXXABI.cpp
   MacroPPCallbacks.cpp

clang/lib/CodeGen/CodeGenMangling.cpp

+//==--- CodeGenMangling.cpp - Get mangled names from the CodeGenModule -----==//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+// CodeGenMangling provides name mangling that depends on the target set for
+// the given CodeGen.
+//===----------------------------------------------------------------------===//
+
+#include "clang/CodeGen/CodeGenMangling.h"
+#include "CodeGenModule.h"
+
+using namespace llvm;
+
+namespace clang {
+namespace CodeGen {
+
+StringRef getMangledName(CodeGenModule &CGM, GlobalDecl GD) {
+  return CGM.getMangledName(GD);
+}
+
+} // namespace CodeGen
+} // namespace clang

clang/lib/StaticAnalyzer/Core/CMakeLists.txt

add_clang_library(clangStaticAnalyzerCore
   ExplodedGraph.cpp
   ExprEngine.cpp
   ExprEngineC.cpp
   ExprEngineCXX.cpp
   ExprEngineCallAndReturn.cpp
   ExprEngineObjC.cpp
   FunctionSummary.cpp
   HTMLDiagnostics.cpp
+  IRContext.cpp
   IssueHash.cpp
   LoopUnrolling.cpp
   LoopWidening.cpp
   MemRegion.cpp
   PlistDiagnostics.cpp
   ProgramState.cpp
   RangeConstraintManager.cpp
   RangedConstraintManager.cpp
   RegionStore.cpp
   SarifDiagnostics.cpp
   SimpleConstraintManager.cpp
   SimpleSValBuilder.cpp
   SMTConstraintManager.cpp
   Store.cpp
   SValBuilder.cpp
   SVals.cpp
   SymbolManager.cpp
   TextDiagnostics.cpp
   WorkList.cpp
 
   LINK_LIBS
+  LLVMAnalysis
+  LLVMCore
+  LLVMPasses
+  LLVMTransformUtils
   clangAST
   clangASTMatchers
   clangAnalysis
   clangBasic
+  clangCodeGen
   clangCrossTU
   clangFrontend
   clangLex
   clangRewrite
   clangToolingCore
 
   DEPENDS
   omp_gen
   )
 

clang/lib/StaticAnalyzer/Core/ExprEngine.cpp

 
 //===----------------------------------------------------------------------===//
 // Engine construction and deletion.
 //===----------------------------------------------------------------------===//
 
 static const char* TagProviderName = "ExprEngine";
 
 ExprEngine::ExprEngine(cross_tu::CrossTranslationUnitContext &CTU,
-                       AnalysisManager &mgr,
+                       IRContext &IRCtx, AnalysisManager &mgr,
                        SetOfConstDecls *VisitedCalleesIn,
-                       FunctionSummariesTy *FS,
-                       InliningModes HowToInlineIn)
-    : CTU(CTU), AMgr(mgr),
+                       FunctionSummariesTy *FS, InliningModes HowToInlineIn)
+    : CTU(CTU), IRCtx(IRCtx), AMgr(mgr),
       AnalysisDeclContexts(mgr.getAnalysisDeclContextManager()),
       Engine(*this, FS, mgr.getAnalyzerOptions()), G(Engine.getGraph()),
       StateMgr(getContext(), mgr.getStoreManagerCreator(),
-               mgr.getConstraintManagerCreator(), G.getAllocator(),
-               this),
-      SymMgr(StateMgr.getSymbolManager()),
-      MRMgr(StateMgr.getRegionManager()),
-      svalBuilder(StateMgr.getSValBuilder()),
-      ObjCNoRet(mgr.getASTContext()),
-      BR(mgr, *this),
-      VisitedCallees(VisitedCalleesIn),
-      HowToInline(HowToInlineIn)
-  {
+               mgr.getConstraintManagerCreator(), G.getAllocator(), this),
+      SymMgr(StateMgr.getSymbolManager()), MRMgr(StateMgr.getRegionManager()),
+      svalBuilder(StateMgr.getSValBuilder()), ObjCNoRet(mgr.getASTContext()),
+      BR(mgr, *this), VisitedCallees(VisitedCalleesIn),
+      HowToInline(HowToInlineIn) {
   unsigned TrimInterval = mgr.options.GraphTrimInterval;
   if (TrimInterval != 0) {
     // Enable eager node reclamation when constructing the ExplodedGraph.
     G.enableNodeReclamation(TrimInterval);
   }
 }
 
 //===----------------------------------------------------------------------===//

clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp

 
 #include "PrettyStackTraceLocationContext.h"
 #include "clang/AST/CXXInheritance.h"
 #include "clang/AST/Decl.h"
 #include "clang/AST/DeclCXX.h"
 #include "clang/Analysis/Analyses/LiveVariables.h"
 #include "clang/Analysis/ConstructionContext.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
+#include "clang/StaticAnalyzer/Core/IRContext.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
 #include "llvm/ADT/SmallSet.h"
 #include "llvm/ADT/Statistic.h"
+#include "llvm/IR/Function.h"
 #include "llvm/Support/Casting.h"
 #include "llvm/Support/Compiler.h"
 #include "llvm/Support/SaveAndRestore.h"
 
 using namespace clang;
 using namespace ento;
 
 #define DEBUG_TYPE "ExprEngine"
ProgramStateRef ExprEngine::bindReturnValue(const CallEvent &Call,
   }
   return State->BindExpr(E, LCtx, R);
 }
 
 // Conservatively evaluate call by invalidating regions and binding
 // a conjured return value.
 void ExprEngine::conservativeEvalCall(const CallEvent &Call, NodeBuilder &Bldr,
                                       ExplodedNode *Pred, ProgramStateRef State) {
+  // Query the LLVM IR whether this function is pure.
+  if (const Decl *D = Call.getRuntimeDefinition().getDecl())
+    if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(D))
+      if (FD->getDefinition())
+        if (auto *F = getIRContext()->getFunction(FD))
+          // Pure function.
+          if (F->getAttributes().hasFnAttribute(llvm::Attribute::ReadNone) ||
+              F->getAttributes().hasFnAttribute(llvm::Attribute::ReadOnly))
+            return;
+
   State = Call.invalidateRegions(currBldrCtx->blockCount(), State);
   State = bindReturnValue(Call, Pred->getLocationContext(), State);
 
   // And make the result node.
   Bldr.generateNode(Call.getProgramPoint(), State, Pred);
 }
 
 ExprEngine::CallInlinePolicy

clang/lib/StaticAnalyzer/Core/IRContext.cpp

+//===-------------- IRContext.cpp -----------------------------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+#include "clang/StaticAnalyzer/Core/IRContext.h"
+#include "clang/CodeGen/CodeGenMangling.h"
+#include "clang/CodeGen/ModuleBuilder.h"
+
+#include "llvm/IR/Module.h"
+#include "llvm/IR/PassManager.h"
+#include "llvm/Passes/PassBuilder.h"
+#include "llvm/Transforms/Utils/EntryExitInstrumenter.h"
+
+using namespace llvm;
+using namespace clang;
+using namespace ento;
+
+void IRContext::runOptimizerPipeline() {
+  if (CodeGen == nullptr)
+    return;
+
+  // TargetMachine is not set, so we will not do optimizations based on
+  // target-aware cost modeling of IR contructs. Still, a default
+  // TargetIRAnalysis is registerd in registerFunctionAnalyses. That will use
+  // the module's datalayout to construct a baseline conservative result.
+  PassBuilder PB;
+
+  // FIXME make this an option.
+  constexpr const bool Debug = false;
+
+  LoopAnalysisManager LAM(Debug);
+  FunctionAnalysisManager FAM(Debug);
+  CGSCCAnalysisManager CGAM(Debug);
+  ModuleAnalysisManager MAM(Debug);
+
+  // Register the AA manager first so that our version is the one used.
+  FAM.registerPass([&] { return PB.buildDefaultAAPipeline(); });
+
+  auto *M = CodeGen->GetModule();
+
+  // Register the target library analysis directly and give it a customized
+  // preset TLI.
+  Triple TargetTriple(M->getTargetTriple());
+  std::unique_ptr<TargetLibraryInfoImpl> TLII(
+      new TargetLibraryInfoImpl(TargetTriple));
+  FAM.registerPass([&] { return TargetLibraryAnalysis(*TLII); });
+
+  // Register all the basic analyses with the managers.
+  PB.registerModuleAnalyses(MAM);
+  PB.registerCGSCCAnalyses(CGAM);
+  PB.registerFunctionAnalyses(FAM);
+  PB.registerLoopAnalyses(LAM);
+  PB.crossRegisterProxies(LAM, FAM, CGAM, MAM);
+
+  ModulePassManager MPM(Debug);
+
+  PB.registerPipelineStartEPCallback([](ModulePassManager &MPM) {
+    MPM.addPass(createModuleToFunctionPassAdaptor(
+        EntryExitInstrumenterPass(/*PostInlining=*/false)));
+  });
+
+  MPM = PB.buildPerModuleDefaultPipeline(PassBuilder::OptimizationLevel::O2,
+                                         Debug);
+  MPM.run(*M, MAM);
+}
+
+llvm::Function *IRContext::getFunction(GlobalDecl GD) {
+  if (CodeGen == nullptr)
+    return nullptr;
+
+  CodeGen::CodeGenModule &CGM = CodeGen->CGM();
+  StringRef Name = getMangledName(CGM, GD);
+
+  auto *M = CodeGen->GetModule();
+  // There are functions which are not generated. E.g. not used operator=, etc.
+  return M->getFunction(Name);
+}
+
+llvm::Function *IRContext::getFunction(const FunctionDecl *FD) {
+  if (CodeGen == nullptr)
+    return nullptr;
+
+  // We use the complete versions of the constructors and desctructors.
+  // Use the other overload of getFunction to get the base object ctor/dtor.
+  GlobalDecl GD;
+  if (const auto *CD = dyn_cast<CXXConstructorDecl>(FD))
+    GD = GlobalDecl(CD, Ctor_Complete);
+  else if (const auto *DD = dyn_cast<CXXDestructorDecl>(FD))
+    GD = GlobalDecl(DD, Dtor_Complete);
+  else if (FD->hasAttr<CUDAGlobalAttr>())
+    GD = GlobalDecl(FD, KernelReferenceKind::Kernel);
+  else
+    GD = GlobalDecl(FD);
+
+  return getFunction(GD);
+}

clang/lib/StaticAnalyzer/Frontend/AnalysisConsumer.cpp

 #include "clang/CrossTU/CrossTranslationUnit.h"
 #include "clang/Frontend/CompilerInstance.h"
 #include "clang/Lex/Preprocessor.h"
 #include "clang/Rewrite/Core/Rewriter.h"
 #include "clang/StaticAnalyzer/Checkers/LocalCheckers.h"
 #include "clang/StaticAnalyzer/Core/AnalyzerOptions.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
+#include "clang/StaticAnalyzer/Core/IRContext.h"
 #include "clang/StaticAnalyzer/Core/PathDiagnosticConsumers.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
 #include "llvm/ADT/PostOrderIterator.h"
 #include "llvm/ADT/Statistic.h"
 #include "llvm/Support/FileSystem.h"
 #include "llvm/Support/Path.h"
 #include "llvm/Support/Program.h"

 public:
   ASTContext *Ctx;
   Preprocessor &PP;
   const std::string OutDir;
   AnalyzerOptionsRef Opts;
   ArrayRef<std::string> Plugins;
   CodeInjector *Injector;
   cross_tu::CrossTranslationUnitContext CTU;
+  IRContext IRCtx;
 
   /// Stores the declarations from the local translation unit.
   /// Note, we pre-compute the local declarations at parse time as an
   /// optimization to make sure we do not deserialize everything from disk.
   /// The local declaration to all declarations ratio might be very small when
   /// working with a PCH file.
   SetOfDecls LocalTUDecls;
 
public:
   /// translation unit.
   FunctionSummariesTy FunctionSummaries;
 
   AnalysisConsumer(CompilerInstance &CI, const std::string &outdir,
                    AnalyzerOptionsRef opts, ArrayRef<std::string> plugins,
                    CodeInjector *injector)
       : RecVisitorMode(0), RecVisitorBR(nullptr), Ctx(nullptr),
         PP(CI.getPreprocessor()), OutDir(outdir), Opts(std::move(opts)),
-        Plugins(plugins), Injector(injector), CTU(CI) {
+        Plugins(plugins), Injector(injector), CTU(CI), IRCtx(CG) {
     DigestAnalyzerOptions();
     if (Opts->PrintStats || Opts->ShouldSerializeStats) {
       AnalyzerTimers = std::make_unique<llvm::TimerGroup>(
           "analyzer", "Analyzer timers");
       SyntaxCheckTimer = std::make_unique<llvm::Timer>(
           "syntaxchecks", "Syntax-based analysis time", *AnalyzerTimers);
       ExprEngineTimer = std::make_unique<llvm::Timer>(
           "exprengine", "Path exploration time", *AnalyzerTimers);
if (isBisonFile(C)) {
     reportAnalyzerProgress("Skipping bison-generated file\n");
   } else if (Opts->DisableAllCheckers) {
 
     // Don't analyze if the user explicitly asked for no checks to be performed
     // on this file.
     reportAnalyzerProgress("All checks are disabled using a supplied option\n");
   } else {
     // Otherwise, just run the analysis.
+    IRCtx.runOptimizerPipeline();
     runAnalysisOnTranslationUnit(C);
   }
 
   // Count how many basic blocks we have not covered.
   NumBlocksInAnalyzedFunctions = FunctionSummaries.getTotalNumBasicBlocks();
   NumVisitedBlocksInAnalyzedFunctions =
       FunctionSummaries.getTotalNumVisitedBasicBlocks();
   if (NumBlocksInAnalyzedFunctions > 0)
void AnalysisConsumer::RunPathSensitiveChecks(Decl *D,
   // FIXME: Inter-procedural analysis will need to handle invalid CFGs.
   if (!Mgr->getCFG(D))
     return;
 
   // See if the LiveVariables analysis scales.
   if (!Mgr->getAnalysisDeclContext(D)->getAnalysis<RelaxedLiveVariables>())
     return;
 
-  ExprEngine Eng(CTU, *Mgr, VisitedCallees, &FunctionSummaries, IMode);
+  ExprEngine Eng(CTU, IRCtx, *Mgr, VisitedCallees, &FunctionSummaries, IMode);
 
   // Execute the worklist algorithm.
   if (ExprEngineTimer)
     ExprEngineTimer->startTimer();
   Eng.ExecuteWorkList(Mgr->getAnalysisDeclContextManager().getStackFrame(D),
                       Mgr->options.MaxNodesPerTopLevelFunction);
   if (ExprEngineTimer)
     ExprEngineTimer->stopTimer();

clang/lib/StaticAnalyzer/Frontend/CMakeLists.txt

 include_directories( ${CMAKE_CURRENT_BINARY_DIR}/../Checkers )
 
 set(LLVM_LINK_COMPONENTS
   Support
   )
 
 add_clang_library(clangStaticAnalyzerFrontend
   AnalysisConsumer.cpp
   AnalyzerHelpFlags.cpp
   CheckerRegistry.cpp
   CreateCheckerManager.cpp
   FrontendActions.cpp
   ModelConsumer.cpp
   ModelInjector.cpp
 
   LINK_LIBS
+  LLVMCore
   clangAST
   clangASTMatchers
   clangAnalysis
   clangBasic
+  clangCodeGen
   clangCrossTU
   clangFrontend
   clangLex
   clangStaticAnalyzerCheckers
   clangStaticAnalyzerCore
 
   DEPENDS
   omp_gen
   )

clang/lib/StaticAnalyzer/Frontend/FrontendActions.cpp

 //===--- FrontendActions.cpp ----------------------------------------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
 #include "clang/StaticAnalyzer/Frontend/FrontendActions.h"
+#include "clang/Frontend/MultiplexConsumer.h"
 #include "clang/StaticAnalyzer/Frontend/AnalysisConsumer.h"
 #include "clang/StaticAnalyzer/Frontend/ModelConsumer.h"
+
+#include "clang/CodeGen/ModuleBuilder.h"
+#include "clang/Frontend/CompilerInstance.h"
+
+#include "llvm/IR/LLVMContext.h"
+
 using namespace clang;
 using namespace ento;
 
+namespace {
+std::unique_ptr<CodeGenerator> BuildCodeGen(CompilerInstance &CI,
+                                            llvm::LLVMContext &LLVMCtx,
+                                            DiagnosticsEngine &CodeGenDiags) {
+  StringRef ModuleName("csa_module");
+  CodeGenOptions &CGO = CI.getCodeGenOpts();
+  // Set the optimization level, so CodeGenFunciton would emit lifetime
+  // markers which are used by some LLVM analysis (e.g. AliasAnalysis).
+  CGO.OptimizationLevel = 2; // -O2
+
+  return std::unique_ptr<CodeGenerator>(
+      CreateLLVMCodeGen(CodeGenDiags, ModuleName, CI.getHeaderSearchOpts(),
+                        CI.getPreprocessorOpts(), CGO, LLVMCtx));
+}
+} // namespace
+
+AnalysisAction::~AnalysisAction() {}
+
 std::unique_ptr<ASTConsumer>
 AnalysisAction::CreateASTConsumer(CompilerInstance &CI, StringRef InFile) {
-  return CreateAnalysisConsumer(CI);
+  std::vector<std::unique_ptr<ASTConsumer>> ASTConsumers;
+  auto AConsumer = CreateAnalysisConsumer(CI);
+
+  AnalyzerOptionsRef Opts = CI.getAnalyzerOpts();
+  if (Opts->GenerateLLVMIR) {
+    DiagnosticsEngine &SADiagEng = CI.getDiagnostics();
+    // Supress diagnostics during CodeGen.
+    CodeGenDiags = std::make_unique<DiagnosticsEngine>(
+        SADiagEng.getDiagnosticIDs(), &SADiagEng.getDiagnosticOptions(),
+        SADiagEng.getClient(), /*ShouldOwnClient=*/false);
+    CodeGenDiags->setSuppressAllDiagnostics(true);
+    LLVMCtx = std::make_shared<llvm::LLVMContext>();
+    auto CGConsumer = BuildCodeGen(CI, *LLVMCtx, *CodeGenDiags);
+    AConsumer->setCodeGen(CGConsumer.get());
+    ASTConsumers.push_back(std::move(CGConsumer));
+  }
+
+  ASTConsumers.push_back(std::move(AConsumer));
+  return std::make_unique<MultiplexConsumer>(std::move(ASTConsumers));
+}
+
+std::unique_ptr<AnalysisAction> CreateAnalysisAction() {
+  return std::make_unique<AnalysisAction>();
 }
 
 ParseModelFileAction::ParseModelFileAction(llvm::StringMap<Stmt *> &Bodies)
     : Bodies(Bodies) {}
 
 std::unique_ptr<ASTConsumer>
 ParseModelFileAction::CreateASTConsumer(CompilerInstance &CI,
                                         StringRef InFile) {
   return std::make_unique<ModelConsumer>(Bodies);
 }

clang/test/Analysis/analyzer-config.c

 // CHECK-NEXT: display-checker-name = true
 // CHECK-NEXT: display-ctu-progress = false
 // CHECK-NEXT: eagerly-assume = true
 // CHECK-NEXT: elide-constructors = true
 // CHECK-NEXT: expand-macros = false
 // CHECK-NEXT: experimental-enable-naive-ctu-analysis = false
 // CHECK-NEXT: exploration_strategy = unexplored_first_queue
 // CHECK-NEXT: faux-bodies = true
+// CHECK-NEXT: generate-llvm-ir = false
 // CHECK-NEXT: graph-trim-interval = 1000
 // CHECK-NEXT: inline-lambdas = true
 // CHECK-NEXT: ipa = dynamic-bifurcate
 // CHECK-NEXT: ipa-always-inline-size = 3
 // CHECK-NEXT: max-inlinable-size = 100
 // CHECK-NEXT: max-nodes = 225000
 // CHECK-NEXT: max-symbol-complexity = 35
 // CHECK-NEXT: max-times-inline-large = 32

clang/test/Analysis/ctu-different-triples.cpp

 // RUN: rm -rf %t && mkdir %t
 // RUN: mkdir -p %t/ctudir
 // RUN: %clang_cc1 -std=c++14 -triple x86_64-pc-linux-gnu \
 // RUN:   -emit-pch -o %t/ctudir/ctu-other.cpp.ast %S/Inputs/ctu-other.cpp
 // RUN: cp %S/Inputs/ctu-other.cpp.externalDefMap.ast-dump.txt %t/ctudir/externalDefMap.txt
 // RUN: %clang_analyze_cc1 -std=c++14 -triple powerpc64-montavista-linux-gnu \
 // RUN:   -analyzer-checker=core,debug.ExprInspection \
 // RUN:   -analyzer-config experimental-enable-naive-ctu-analysis=true \
 // RUN:   -analyzer-config ctu-dir=%t/ctudir \
 // RUN:   -Werror=ctu \
 // RUN:   -verify %s
 
 // We expect an error in this file, but without a location.
 // expected-error-re@./ctu-different-triples.cpp:*{{imported AST from {{.*}} had been generated for a different target, current: powerpc64-montavista-linux-gnu, imported: x86_64-pc-linux-gnu}}
+// FIXME Why do we get the error twice?
+// expected-error-re@./ctu-different-triples.cpp:*{{imported AST from {{.*}} had been generated for a different target, current: powerpc64-montavista-linux-gnu, imported: x86_64-pc-linux-gnu}}
 
 int f(int);
 
 int main() {
   return f(5);
 }

clang/test/Analysis/ircontext.cpp

+// RUN: %clang_analyze_cc1 %s \
+// RUN:   -analyzer-checker=core,debug.ExprInspection \
+// RUN:   -analyzer-config eagerly-assume=false \
+// RUN:   -analyzer-config ipa=none \
+// RUN:   -analyzer-config generate-llvm-ir=true \
+// RUN:   -triple i686-unknown-linux \
+// RUN:   -verify
+
+void clang_analyzer_eval(int);
+
+int g = 0;
+int foo(int *x) { return *x; }
+
+void test() {
+  g = 3;
+  int l = 0;
+  foo(&l);
+  clang_analyzer_eval(g == 3); // expected-warning{{TRUE}}
+}

clang/unittests/StaticAnalyzer/Reusables.h

 //===- unittests/StaticAnalyzer/Reusables.h -------------------------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
 #ifndef LLVM_CLANG_UNITTESTS_STATICANALYZER_REUSABLES_H
 #define LLVM_CLANG_UNITTESTS_STATICANALYZER_REUSABLES_H
 
 #include "clang/ASTMatchers/ASTMatchFinder.h"
-#include "clang/Frontend/CompilerInstance.h"
 #include "clang/CrossTU/CrossTranslationUnit.h"
+#include "clang/Frontend/CompilerInstance.h"
+#include "clang/StaticAnalyzer/Core/IRContext.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
 
 namespace clang {
 namespace ento {
 
 // Find a node in the current AST that matches a matcher.
 template <typename T, typename MatcherT>
 const T *findNode(const Decl *Where, MatcherT What) {
const T *findDeclByName(const Decl *Where, StringRef Name) {
   using namespace ast_matchers;
   return findNode<T>(Where, namedDecl(hasName(Name)));
 }
 
 // A re-usable consumer that constructs ExprEngine out of CompilerInvocation.
 class ExprEngineConsumer : public ASTConsumer {
 protected:
   CompilerInstance &C;
+  CodeGenerator *CG = nullptr;
 
 private:
   // We need to construct all of these in order to construct ExprEngine.
   CheckerManager ChkMgr;
   cross_tu::CrossTranslationUnitContext CTU;
+  IRContext IRCtx;
   PathDiagnosticConsumers Consumers;
   AnalysisManager AMgr;
   SetOfConstDecls VisitedCallees;
   FunctionSummariesTy FS;
 
 protected:
   ExprEngine Eng;
 
 public:
   ExprEngineConsumer(CompilerInstance &C)
       : C(C),
         ChkMgr(C.getASTContext(), *C.getAnalyzerOpts(), C.getPreprocessor()),
-        CTU(C), Consumers(),
+        CTU(C), IRCtx(CG), Consumers(),
         AMgr(C.getASTContext(), C.getPreprocessor(), Consumers,
              CreateRegionStoreManager, CreateRangeConstraintManager, &ChkMgr,
              *C.getAnalyzerOpts()),
-        VisitedCallees(), FS(),
-        Eng(CTU, AMgr, &VisitedCallees, &FS, ExprEngine::Inline_Regular) {}
+        VisitedCallees(), FS(), Eng(CTU, IRCtx, AMgr, &VisitedCallees, &FS,
+                                    ExprEngine::Inline_Regular) {}
 };
 
 } // namespace ento
 } // namespace clang
 
 #endif