[analyzer] Add an option to re-analyze a dead-end path without inlining.

The analyzer gives up path exploration under certain conditions. For
example, when the same basic block has been visited more than 4 times.
With inlining turned on, this could lead to decrease in code coverage.
Specifically, if we give up inside the inlined function, the rest of
parent's basic blocks will not get analyzed.

This commit introduces an option to enable re-run along the failed path,
in which we do not inline the last inlined call site. This is done by
enqueueing the node before the processing of the inlined call site
with a special policy encoded in the state. The policy tells us not to
inline the call site along the path.

This lead to ~10% increase in the number of paths analyzed. Even though
we expected a much greater coverage improvement. 

The option is turned off by default for now.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153534 91177308-0d34-0410-b5e6-96231b3b80d8

1 files changed, 94 insertions, 0 deletions

diff --git a/test/Analysis/coverage.c b/test/Analysis/coverage.c
new file mode 100644
index 0000000000..2e85b7f61d
--- /dev/null
+++ b/test/Analysis/coverage.c
@@ -0,0 +1,94 @@
+// RUN: %clang_cc1 -analyze -analyzer-checker=core,unix.Malloc -analyzer-store=region -analyzer-max-loop 4 -analyzer-retry-exhausted -verify %s
+#include "system-header-simulator.h"
+
+typedef __typeof(sizeof(int)) size_t;
+void *malloc(size_t);
+
+static int another_function(int *y) {
+  if (*y > 0)
+    return *y;
+  return 0;
+}
+
+static void function_which_doesnt_give_up(int **x) {
+   *x = 0;
+}
+
+static void function_which_gives_up(int *x) {
+  for (int i = 0; i < 5; ++i)
+    (*x)++;
+}
+
+static void function_which_gives_up_nested(int *x) {
+  function_which_gives_up(x);
+  for (int i = 0; i < 5; ++i)
+    (*x)++;
+}
+
+static void function_which_doesnt_give_up_nested(int *x, int *y) {
+  *y = another_function(x);
+  function_which_gives_up(x);
+}
+
+void coverage1(int *x) {
+  function_which_gives_up(x);
+  char *m = (char*)malloc(12); // expected-warning {{potential leak}}
+}
+
+void coverage2(int *x) {
+  if (x) {
+    function_which_gives_up(x);
+    char *m = (char*)malloc(12);// expected-warning {{potential leak}}
+  }
+}
+
+void coverage3(int *x) {
+  x++;
+  function_which_gives_up(x);
+  char *m = (char*)malloc(12);// expected-warning {{potential leak}}
+}
+
+void coverage4(int *x) {
+  *x += another_function(x);
+  function_which_gives_up(x);
+  char *m = (char*)malloc(12);// expected-warning {{potential leak}}
+}
+
+void coverage5(int *x) {
+  for (int i = 0; i<7; ++i)
+    function_which_gives_up(x);
+  // The root function gives up here.
+  char *m = (char*)malloc(12); // no-warning
+}
+
+void coverage6(int *x) {
+  for (int i = 0; i<3; ++i) {
+    function_which_gives_up(x);
+  }
+  char *m = (char*)malloc(12); // expected-warning {{potential leak}}
+}
+
+int coverage7_inline(int *i) {
+  function_which_doesnt_give_up(&i);
+  return *i; // expected-warning {{Dereference}}
+}
+
+void coverage8(int *x) {
+  int y;
+  function_which_doesnt_give_up_nested(x, &y);
+  y = (*x)/y;  // expected-warning {{Division by zero}}
+  char *m = (char*)malloc(12); // expected-warning {{potential leak}}
+}
+
+void function_which_gives_up_settonull(int **x) {
+  *x = 0;
+  int y = 0;
+  for (int i = 0; i < 5; ++i)
+    y++;
+}
+
+void coverage9(int *x) {
+  int y = 5;
+  function_which_gives_up_settonull(&x);
+  y = (*x);  // no warning
+}