aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--include/clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h3
-rw-r--r--lib/StaticAnalyzer/Checkers/DereferenceChecker.cpp8
-rw-r--r--lib/StaticAnalyzer/Core/BugReporterVisitors.cpp57
-rw-r--r--lib/StaticAnalyzer/Core/ExplodedGraph.cpp24
-rw-r--r--lib/StaticAnalyzer/Core/MemRegion.cpp8
-rw-r--r--test/Analysis/diagnostics/deref-track-symbolic-region.c714
-rw-r--r--test/Analysis/diagnostics/undef-value-param.c302
-rw-r--r--test/Analysis/plist-output-alternate.m63
-rw-r--r--test/Analysis/plist-output.m182
9 files changed, 895 insertions, 466 deletions
diff --git a/include/clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h b/include/clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h
index eb5947867f..d7acb4842a 100644
--- a/include/clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h
+++ b/include/clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h
@@ -950,6 +950,9 @@ public:
const ObjCIvarDecl *getDecl() const;
QualType getValueType() const;
+ bool canPrintPretty() const;
+ void printPretty(raw_ostream &os) const;
+
void dumpToStream(raw_ostream &os) const;
static bool classof(const MemRegion* R) {
diff --git a/lib/StaticAnalyzer/Checkers/DereferenceChecker.cpp b/lib/StaticAnalyzer/Checkers/DereferenceChecker.cpp
index 3aa8aaac0d..72d46c50e1 100644
--- a/lib/StaticAnalyzer/Checkers/DereferenceChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/DereferenceChecker.cpp
@@ -76,6 +76,14 @@ DereferenceChecker::AddDerefSource(raw_ostream &os,
Ranges.push_back(SourceRange(L, L));
break;
}
+ case Stmt::ObjCIvarRefExprClass: {
+ const ObjCIvarRefExpr *IV = cast<ObjCIvarRefExpr>(Ex);
+ os << " (" << (loadedFrom ? "loaded from" : "via")
+ << " ivar '" << IV->getDecl()->getName() << "')";
+ SourceLocation L = IV->getLocation();
+ Ranges.push_back(SourceRange(L, L));
+ break;
+ }
}
}
diff --git a/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp b/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp
index f59458ca6e..cb716a3154 100644
--- a/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp
+++ b/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp
@@ -662,14 +662,47 @@ bool bugreporter::trackNullOrUndefValue(const ExplodedNode *N, const Stmt *S,
// C++ user-defined implicit conversions, because those have a constructor
// or function call inside.
Ex = Ex->IgnoreParenCasts();
- if (const DeclRefExpr *DR = dyn_cast<DeclRefExpr>(Ex)) {
- // FIXME: Right now we only track VarDecls because it's non-trivial to
- // get a MemRegion for any other DeclRefExprs. <rdar://problem/12114812>
- if (const VarDecl *VD = dyn_cast<VarDecl>(DR->getDecl())) {
- ProgramStateManager &StateMgr = state->getStateManager();
- MemRegionManager &MRMgr = StateMgr.getRegionManager();
- const VarRegion *R = MRMgr.getVarRegion(VD, N->getLocationContext());
+ if (Ex->isLValue()) {
+ const MemRegion *R = 0;
+
+ // First check if this is a DeclRefExpr for a C++ reference type.
+ // For those, we want the location of the reference.
+ if (const DeclRefExpr *DR = dyn_cast<DeclRefExpr>(Ex)) {
+ if (const VarDecl *VD = dyn_cast<VarDecl>(DR->getDecl())) {
+ if (VD->getType()->isReferenceType()) {
+ ProgramStateManager &StateMgr = state->getStateManager();
+ MemRegionManager &MRMgr = StateMgr.getRegionManager();
+ R = MRMgr.getVarRegion(VD, N->getLocationContext());
+ }
+ }
+ }
+
+ // For all other cases, find the location by scouring the ExplodedGraph.
+ if (!R) {
+ // Find the ExplodedNode where the lvalue (the value of 'Ex')
+ // was computed. We need this for getting the location value.
+ const ExplodedNode *LVNode = N;
+ const Expr *SearchEx = Ex;
+ if (const OpaqueValueExpr *OPE = dyn_cast<OpaqueValueExpr>(Ex)) {
+ SearchEx = OPE->getSourceExpr();
+ }
+ while (LVNode) {
+ if (Optional<PostStmt> P = LVNode->getLocation().getAs<PostStmt>()) {
+ if (P->getStmt() == SearchEx)
+ break;
+ }
+ LVNode = LVNode->getFirstPred();
+ }
+ assert(LVNode && "Unable to find the lvalue node.");
+ ProgramStateRef LVState = LVNode->getState();
+ if (Optional<Loc> L =
+ LVState->getSVal(Ex, LVNode->getLocationContext()).getAs<Loc>()) {
+ R = L->getAsRegion();
+ }
+ }
+
+ if (R) {
// Mark both the variable region and its contents as interesting.
SVal V = state->getRawSVal(loc::MemRegionVal(R));
@@ -692,6 +725,12 @@ bool bugreporter::trackNullOrUndefValue(const ExplodedNode *N, const Stmt *S,
report.markInteresting(V);
report.addVisitor(new UndefOrNullArgVisitor(R));
+ if (isa<SymbolicRegion>(R)) {
+ TrackConstraintBRVisitor *VI =
+ new TrackConstraintBRVisitor(loc::MemRegionVal(R), false);
+ report.addVisitor(VI);
+ }
+
// If the contents are symbolic, find out when they became null.
if (V.getAsLocSymbol()) {
BugReporterVisitor *ConstraintTracker =
@@ -706,8 +745,8 @@ bool bugreporter::trackNullOrUndefValue(const ExplodedNode *N, const Stmt *S,
}
}
- // If the expression does NOT refer to a variable, we can still track
- // constraints on its contents.
+ // If the expression is not an "lvalue expression", we can still
+ // track the constraints on its contents.
SVal V = state->getSValAsScalarOrLoc(S, N->getLocationContext());
// Uncomment this to find cases where we aren't properly getting the
diff --git a/lib/StaticAnalyzer/Core/ExplodedGraph.cpp b/lib/StaticAnalyzer/Core/ExplodedGraph.cpp
index a72f49d805..443d87076a 100644
--- a/lib/StaticAnalyzer/Core/ExplodedGraph.cpp
+++ b/lib/StaticAnalyzer/Core/ExplodedGraph.cpp
@@ -66,9 +66,10 @@ bool ExplodedGraph::shouldCollect(const ExplodedNode *node) {
// (5) The 'store' is the same as the predecessor.
// (6) The 'GDM' is the same as the predecessor.
// (7) The LocationContext is the same as the predecessor.
- // (8) The PostStmt isn't for a non-consumed Stmt or Expr.
- // (9) The successor is not a CallExpr StmtPoint (so that we would be able to
- // find it when retrying a call with no inlining).
+ // (8) Expressions that are *not* lvalue expressions.
+ // (9) The PostStmt isn't for a non-consumed Stmt or Expr.
+ // (10) The successor is not a CallExpr StmtPoint (so that we would
+ // be able to find it when retrying a call with no inlining).
// FIXME: It may be safe to reclaim PreCall and PostCall nodes as well.
// Conditions 1 and 2.
@@ -99,20 +100,23 @@ bool ExplodedGraph::shouldCollect(const ExplodedNode *node) {
if (state->store != pred_state->store || state->GDM != pred_state->GDM ||
progPoint.getLocationContext() != pred->getLocationContext())
return false;
-
+
// Condition 8.
- // Do not collect nodes for non-consumed Stmt or Expr to ensure precise
- // diagnostic generation; specifically, so that we could anchor arrows
- // pointing to the beginning of statements (as written in code).
+ // Do not collect nodes for lvalue expressions since they are
+ // used extensively for generating path diagnostics.
const Expr *Ex = dyn_cast<Expr>(ps.getStmt());
- if (!Ex)
+ if (!Ex || Ex->isLValue())
return false;
+ // Condition 9.
+ // Do not collect nodes for non-consumed Stmt or Expr to ensure precise
+ // diagnostic generation; specifically, so that we could anchor arrows
+ // pointing to the beginning of statements (as written in code).
ParentMap &PM = progPoint.getLocationContext()->getParentMap();
if (!PM.isConsumedExpr(Ex))
return false;
-
- // Condition 9.
+
+ // Condition 10.
const ProgramPoint SuccLoc = succ->getLocation();
if (Optional<StmtPoint> SP = SuccLoc.getAs<StmtPoint>())
if (CallEvent::isCallStmt(SP->getStmt()))
diff --git a/lib/StaticAnalyzer/Core/MemRegion.cpp b/lib/StaticAnalyzer/Core/MemRegion.cpp
index a3e42eaa46..e1b8b186c7 100644
--- a/lib/StaticAnalyzer/Core/MemRegion.cpp
+++ b/lib/StaticAnalyzer/Core/MemRegion.cpp
@@ -566,6 +566,14 @@ void VarRegion::printPretty(raw_ostream &os) const {
os << getDecl()->getName();
}
+bool ObjCIvarRegion::canPrintPretty() const {
+ return true;
+}
+
+void ObjCIvarRegion::printPretty(raw_ostream &os) const {
+ os << getDecl()->getName();
+}
+
bool FieldRegion::canPrintPretty() const {
return superRegion->canPrintPretty();
}
diff --git a/test/Analysis/diagnostics/deref-track-symbolic-region.c b/test/Analysis/diagnostics/deref-track-symbolic-region.c
index 2e624dfa89..e2ec8fc5f3 100644
--- a/test/Analysis/diagnostics/deref-track-symbolic-region.c
+++ b/test/Analysis/diagnostics/deref-track-symbolic-region.c
@@ -1,5 +1,6 @@
// RUN: %clang_cc1 -analyze -analyzer-checker=core -analyzer-output=text -verify %s
-// RUN: %clang_cc1 -analyze -analyzer-checker=core -analyzer-output=plist-multi-file %s -o - | FileCheck %s
+// RUN: %clang_cc1 -analyze -analyzer-checker=core -analyzer-output=plist-multi-file %s -o %t.plist
+// RUN: FileCheck --input-file=%t.plist %s
struct S {
int *x;
@@ -18,7 +19,7 @@ void inlined(struct S *s, int m) {
}
void test(struct S syz, int *pp) {
int m = 0;
- syz.x = foo();
+ syz.x = foo(); // expected-note{{Value assigned to 'syz.x'}}
inlined(&syz, m);
// expected-note@-1{{Calling 'inlined'}}
// expected-note@-2{{Returning from 'inlined'}}
@@ -26,329 +27,386 @@ void test(struct S syz, int *pp) {
// expected-note@-1{{Dereference of null pointer (loaded from field 'x')}}
}
-//CHECK: <dict>
-//CHECK: <key>files</key>
-//CHECK: <array>
-//CHECK: </array>
-//CHECK: <key>diagnostics</key>
-//CHECK: <array>
-//CHECK: <dict>
-//CHECK: <key>path</key>
-//CHECK: <array>
-//CHECK: <dict>
-//CHECK: <key>kind</key><string>control</string>
-//CHECK: <key>edges</key>
-//CHECK: <array>
-//CHECK: <dict>
-//CHECK: <key>start</key>
-//CHECK: <array>
-//CHECK: <dict>
-//CHECK: <key>line</key><integer>20</integer>
-//CHECK: <key>col</key><integer>3</integer>
-//CHECK: <key>file</key><integer>0</integer>
-//CHECK: </dict>
-//CHECK: <dict>
-//CHECK: <key>line</key><integer>20</integer>
-//CHECK: <key>col</key><integer>5</integer>
-//CHECK: <key>file</key><integer>0</integer>
-//CHECK: </dict>
-//CHECK: </array>
-//CHECK: <key>end</key>
-//CHECK: <array>
-//CHECK: <dict>
-//CHECK: <key>line</key><integer>22</integer>
-//CHECK: <key>col</key><integer>3</integer>
-//CHECK: <key>file</key><integer>0</integer>
-//CHECK: </dict>
-//CHECK: <dict>
-//CHECK: <key>line</key><integer>22</integer>
-//CHECK: <key>col</key><integer>9</integer>
-//CHECK: <key>file</key><integer>0</integer>
-//CHECK: </dict>
-//CHECK: </array>
-//CHECK: </dict>
-//CHECK: </array>
-//CHECK: </dict>
-//CHECK: <dict>
-//CHECK: <key>kind</key><string>event</string>
-//CHECK: <key>location</key>
-//CHECK: <dict>
-//CHECK: <key>line</key><integer>22</integer>
-//CHECK: <key>col</key><integer>3</integer>
-//CHECK: <key>file</key><integer>0</integer>
-//CHECK: </dict>
-//CHECK: <key>ranges</key>
-//CHECK: <array>
-//CHECK: <array>
-//CHECK: <dict>
-//CHECK: <key>line</key><integer>22</integer>
-//CHECK: <key>col</key><integer>3</integer>
-//CHECK: <key>file</key><integer>0</integer>
-//CHECK: </dict>
-//CHECK: <dict>
-//CHECK: <key>line</key><integer>22</integer>
-//CHECK: <key>col</key><integer>18</integer>
-//CHECK: <key>file</key><integer>0</integer>
-//CHECK: </dict>
-//CHECK: </array>
-//CHECK: </array>
-//CHECK: <key>depth</key><integer>0</integer>
-//CHECK: <key>extended_message</key>
-//CHECK: <string>Calling &apos;inlined&apos;</string>
-//CHECK: <key>message</key>
-//CHECK: <string>Calling &apos;inlined&apos;</string>
-//CHECK: </dict>
-//CHECK: <dict>
-//CHECK: <key>kind</key><string>event</string>
-//CHECK: <key>location</key>
-//CHECK: <dict>
-//CHECK: <key>line</key><integer>11</integer>
-//CHECK: <key>col</key><integer>1</integer>
-//CHECK: <key>file</key><integer>0</integer>
-//CHECK: </dict>
-//CHECK: <key>depth</key><integer>1</integer>
-//CHECK: <key>extended_message</key>
-//CHECK: <string>Entered call from &apos;test&apos;</string>
-//CHECK: <key>message</key>
-//CHECK: <string>Entered call from &apos;test&apos;</string>
-//CHECK: </dict>
-//CHECK: <dict>
-//CHECK: <key>kind</key><string>control</string>
-//CHECK: <key>edges</key>
-//CHECK: <array>
-//CHECK: <dict>
-//CHECK: <key>start</key>
-//CHECK: <array>
-//CHECK: <dict>
-//CHECK: <key>line</key><integer>11</integer>
-//CHECK: <key>col</key><integer>1</integer>
-//CHECK: <key>file</key><integer>0</integer>
-//CHECK: </dict>
-//CHECK: <dict>
-//CHECK: <key>line</key><integer>11</integer>
-//CHECK: <key>col</key><integer>4</integer>
-//CHECK: <key>file</key><integer>0</integer>
-//CHECK: </dict>
-//CHECK: </array>
-//CHECK: <key>end</key>
-//CHECK: <array>
-//CHECK: <dict>
-//CHECK: <key>line</key><integer>12</integer>
-//CHECK: <key>col</key><integer>3</integer>
-//CHECK: <key>file</key><integer>0</integer>
-//CHECK: </dict>
-//CHECK: <dict>
-//CHECK: <key>line</key><integer>12</integer>
-//CHECK: <key>col</key><integer>4</integer>
-//CHECK: <key>file</key><integer>0</integer>
-//CHECK: </dict>
-//CHECK: </array>
-//CHECK: </dict>
-//CHECK: </array>
-//CHECK: </dict>
-//CHECK: <dict>
-//CHECK: <key>kind</key><string>control</string>
-//CHECK: <key>edges</key>
-//CHECK: <array>
-//CHECK: <dict>
-//CHECK: <key>start</key>
-//CHECK: <array>
-//CHECK: <dict>
-//CHECK: <key>line</key><integer>12</integer>
-//CHECK: <key>col</key><integer>3</integer>
-//CHECK: <key>file</key><integer>0</integer>
-//CHECK: </dict>
-//CHECK: <dict>
-//CHECK: <key>line</key><integer>12</integer>
-//CHECK: <key>col</key><integer>4</integer>
-//CHECK: <key>file</key><integer>0</integer>
-//CHECK: </dict>
-//CHECK: </array>
-//CHECK: <key>end</key>
-//CHECK: <array>
-//CHECK: <dict>
-//CHECK: <key>line</key><integer>12</integer>
-//CHECK: <key>col</key><integer>7</integer>
-//CHECK: <key>file</key><integer>0</integer>
-//CHECK: </dict>
-//CHECK: <dict>
-//CHECK: <key>line</key><integer>12</integer>
-//CHECK: <key>col</key><integer>7</integer>
-//CHECK: <key>file</key><integer>0</integer>
-//CHECK: </dict>
-//CHECK: </array>
-//CHECK: </dict>
-//CHECK: </array>
-//CHECK: </dict>
-//CHECK: <dict>
-//CHECK: <key>kind</key><string>event</string>
-//CHECK: <key>location</key>
-//CHECK: <dict>
-//CHECK: <key>line</key><integer>12</integer>
-//CHECK: <key>col</key><integer>7</integer>
-//CHECK: <key>file</key><integer>0</integer>
-//CHECK: </dict>
-//CHECK: <key>ranges</key>
-//CHECK: <array>
-//CHECK: <array>
-//CHECK: <dict>
-//CHECK: <key>line</key><integer>12</integer>
-//CHECK: <key>col</key><integer>7</integer>
-//CHECK: <key>file</key><integer>0</integer>
-//CHECK: </dict>
-//CHECK: <dict>
-//CHECK: <key>line</key><integer>12</integer>
-//CHECK: <key>col</key><integer>10</integer>
-//CHECK: <key>file</key><integer>0</integer>
-//CHECK: </dict>
-//CHECK: </array>
-//CHECK: </array>
-//CHECK: <key>depth</key><integer>1</integer>
-//CHECK: <key>extended_message</key>
-//CHECK: <string>Assuming pointer value is null</string>
-//CHECK: <key>message</key>
-//CHECK: <string>Assuming pointer value is null</string>
-//CHECK: </dict>
-//CHECK: <dict>
-//CHECK: <key>kind</key><string>event</string>
-//CHECK: <key>location</key>
-//CHECK: <dict>
-//CHECK: <key>line</key><integer>22</integer>
-//CHECK: <key>col</key><integer>3</integer>
-//CHECK: <key>file</key><integer>0</integer>
-//CHECK: </dict>
-//CHECK: <key>ranges</key>
-//CHECK: <array>
-//CHECK: <array>
-//CHECK: <dict>
-//CHECK: <key>line</key><integer>22</integer>
-//CHECK: <key>col</key><integer>3</integer>
-//CHECK: <key>file</key><integer>0</integer>
-//CHECK: </dict>
-//CHECK: <dict>
-//CHECK: <key>line</key><integer>22</integer>
-//CHECK: <key>col</key><integer>18</integer>
-//CHECK: <key>file</key><integer>0</integer>
-//CHECK: </dict>
-//CHECK: </array>
-//CHECK: </array>
-//CHECK: <key>depth</key><integer>1</integer>
-//CHECK: <key>extended_message</key>
-//CHECK: <string>Returning from &apos;inlined&apos;</string>
-//CHECK: <key>message</key>
-//CHECK: <string>Returning from &apos;inlined&apos;</string>
-//CHECK: </dict>
-//CHECK: <dict>
-//CHECK: <key>kind</key><string>control</string>
-//CHECK: <key>edges</key>
-//CHECK: <array>
-//CHECK: <dict>
-//CHECK: <key>start</key>
-//CHECK: <array>
-//CHECK: <dict>
-//CHECK: <key>line</key><integer>22</integer>
-//CHECK: <key>col</key><integer>3</integer>
-//CHECK: <key>file</key><integer>0</integer>
-//CHECK: </dict>
-//CHECK: <dict>
-//CHECK: <key>line</key><integer>22</integer>
-//CHECK: <key>col</key><integer>9</integer>
-//CHECK: <key>file</key><integer>0</integer>
-//CHECK: </dict>
-//CHECK: </array>
-//CHECK: <key>end</key>
-//CHECK: <array>
-//CHECK: <dict>
-//CHECK: <key>line</key><integer>25</integer>
-//CHECK: <key>col</key><integer>3</integer>
-//CHECK: <key>file</key><integer>0</integer>
-//CHECK: </dict>
-//CHECK: <dict>
-//CHECK: <key>line</key><integer>25</integer>
-//CHECK: <key>col</key><integer>3</integer>
-//CHECK: <key>file</key><integer>0</integer>
-//CHECK: </dict>
-//CHECK: </array>
-//CHECK: </dict>
-//CHECK: </array>
-//CHECK: </dict>
-//CHECK: <dict>
-//CHECK: <key>kind</key><string>control</string>
-//CHECK: <key>edges</key>
-//CHECK: <array>
-//CHECK: <dict>
-//CHECK: <key>start</key>
-//CHECK: <array>
-//CHECK: <dict>
-//CHECK: <key>line</key><integer>25</integer>
-//CHECK: <key>col</key><integer>3</integer>
-//CHECK: <key>file</key><integer>0</integer>
-//CHECK: </dict>
-//CHECK: <dict>
-//CHECK: <key>line</key><integer>25</integer>
-//CHECK: <key>col</key><integer>3</integer>
-//CHECK: <key>file</key><integer>0</integer>
-//CHECK: </dict>
-//CHECK: </array>
-//CHECK: <key>end</key>
-//CHECK: <array>
-//CHECK: <dict>
-//CHECK: <key>line</key><integer>25</integer>
-//CHECK: <key>col</key><integer>8</integer>
-//CHECK: <key>file</key><integer>0</integer>
-//CHECK: </dict>
-//CHECK: <dict>
-//CHECK: <key>line</key><integer>25</integer>
-//CHECK: <key>col</key><integer>8</integer>
-//CHECK: <key>file</key><integer>0</integer>
-//CHECK: </dict>
-//CHECK: </array>
-//CHECK: </dict>
-//CHECK: </array>
-//CHECK: </dict>
-//CHECK: <dict>
-//CHECK: <key>kind</key><string>event</string>
-//CHECK: <key>location</key>
-//CHECK: <dict>
-//CHECK: <key>line</key><integer>25</integer>
-//CHECK: <key>col</key><integer>8</integer>
-//CHECK: <key>file</key><integer>0</integer>
-//CHECK: </dict>
-//CHECK: <key>ranges</key>
-//CHECK: <array>
-//CHECK: <array>
-//CHECK: <dict>
-//CHECK: <key>line</key><integer>25</integer>
-//CHECK: <key>col</key><integer>13</integer>
-//CHECK: <key>file</key><integer>0</integer>
-//CHECK: </dict>
-//CHECK: <dict>
-//CHECK: <key>line</key><integer>25</integer>
-//CHECK: <key>col</key><integer>13</integer>
-//CHECK: <key>file</key><integer>0</integer>
-//CHECK: </dict>
-//CHECK: </array>
-//CHECK: </array>
-//CHECK: <key>depth</key><integer>0</integer>
-//CHECK: <key>extended_message</key>
-//CHECK: <string>Dereference of null pointer (loaded from field &apos;x&apos;)</string>
-//CHECK: <key>message</key>
-//CHECK: <string>Dereference of null pointer (loaded from field &apos;x&apos;)</string>
-//CHECK: </dict>
-//CHECK: </array>
-//CHECK: <key>description</key><string>Dereference of null pointer (loaded from field &apos;x&apos;)</string>
-//CHECK: <key>category</key><string>Logic error</string>
-//CHECK: <key>type</key><string>Dereference of null pointer</string>
-//CHECK: <key>issue_context_kind</key><string>function</string>
-//CHECK: <key>issue_context</key><string>test</string>
-//CHECK: <key>issue_hash</key><string>6</string>
-//CHECK: <key>location</key>
-//CHECK: <dict>
-//CHECK: <key>line</key><integer>25</integer>
-//CHECK: <key>col</key><integer>8</integer>
-//CHECK: <key>file</key><integer>0</integer>
-//CHECK: </dict>
-//CHECK: </dict>
-//CHECK: </array>
-//CHECK: </dict>
-//CHECK: </plist>
+// CHECK: <key>diagnostics</key>
+// CHECK-NEXT: <array>
+// CHECK-NEXT: <dict>
+// CHECK-NEXT: <key>path</key>
+// CHECK-NEXT: <array>
+// CHECK-NEXT: <dict>
+// CHECK-NEXT: <key>kind</key><string>control</string>
+// CHECK-NEXT: <key>edges</key>
+// CHECK-NEXT: <array>
+// CHECK-NEXT: <dict>
+// CHECK-NEXT: <key>start</key>
+// CHECK-NEXT: <array>
+// CHECK-NEXT: <dict>
+// CHECK-NEXT: <key>line</key><integer>21</integer>
+// CHECK-NEXT: <key>col</key><integer>3</integer>
+// CHECK-NEXT: <key>file</key><integer>0</integer>
+// CHECK-NEXT: </dict>
+// CHECK-NEXT: <dict>
+// CHECK-NEXT: <key>line</key><integer>21</integer>
+// CHECK-NEXT: <key>col</key><integer>5</integer>
+// CHECK-NEXT: <key>file</key><integer>0</integer>
+// CHECK-NEXT: </dict>
+// CHECK-NEXT: </array>
+// CHECK-NEXT: <key>end</key>
+// CHECK-NEXT: <array>
+// CHECK-NEXT: <dict>
+// CHECK-NEXT: <key>line</key><integer>22</integer>
+// CHECK-NEXT: <key>col</key><integer>3</integer>
+// CHECK-NEXT: <key>file</key><integer>0</integer>
+// CHECK-NEXT: </dict>
+// CHECK-NEXT: <dict>
+// CHECK-NEXT: <key>line</key><integer>22</integer>
+// CHECK-NEXT: <key>col</key><integer>5</integer>
+// CHECK-NEXT: <key>file</key><integer>0</integer>
+// CHECK-NEXT: </dict>
+// CHECK-NEXT: </array>
+// CHECK-NEXT: </dict>
+// CHECK-NEXT: </array>
+// CHECK-NEXT: </dict>
+// CHECK-NEXT: <dict>
+// CHECK-NEXT: <key>kind</key><string>event</string>
+// CHECK-NEXT: <key>location</key>
+// CHECK-NEXT: <dict>
+// CHECK-NEXT: <key>line</key><integer>22</integer>
+// CHECK-NEXT: <key>col</key><integer>3</integer>
+// CHECK-NEXT: <key>file</key><integer>0</integer>
+// CHECK-NEXT: </dict>
+// CHECK-NEXT: <key>ranges</key>
+// CHECK-NEXT: <array>
+// CHECK-NEXT: <array>
+// CHECK-NEXT: <dict>
+// CHECK-NEXT: <key>line</key><integer>22</integer>
+// CHECK-NEXT: <key>col</key><integer>3</integer>
+// CHECK-NEXT: <key>file</key><integer>0</integer>
+// CHECK-NEXT: </dict>
+// CHECK-NEXT: <dict>
+// CHECK-NEXT: <key>line</key><integer>22</integer>
+// CHECK-NEXT: <key>col</key><integer>15</integer>
+// CHECK-NEXT: <key>file</key><integer>0</integer>
+// CHECK-NEXT: </dict>
+// CHECK-NEXT: </array>
+// CHECK-NEXT: </array>
+// CHECK-NEXT: <key>depth</key><integer>0</integer>
+// CHECK-NEXT: <key>extended_message</key>
+// CHECK-NEXT: <string>Value assigned to &apos;syz.x&apos;</string>
+// CHECK-NEXT: <key>message</key>
+// CHECK-NEXT: <string>Value assigned to &apos;syz.x&apos;</string>
+// CHECK-NEXT: </dict>
+// CHECK-NEXT: <dict>
+// CHECK-NEXT: <key>kind</key><string>control</string>
+// CHECK-NEXT: <key>edges</key>
+// CHECK-NEXT: <array>
+// CHECK-NEXT: <dict>
+// CHECK-NEXT: <key>start</key>
+// CHECK-NEXT: <array>
+// CHECK-NEXT: <dict>
+// CHECK-NEXT: <key>line</key><integer>22</integer>
+// CHECK-NEXT: <key>col</key><integer>3</integer>
+// CHECK-NEXT: <key>file</key><integer>0</integer>
+// CHECK-NEXT: </dict>
+// CHECK-NEXT: <dict>
+// CHECK-NEXT: <key>line</key><integer>22</integer>
+// CHECK-NEXT: <key>col</key><integer>5</integer>
+// CHECK-NEXT: <key>file</key><integer>0</integer>
+// CHECK-NEXT: </dict>
+// CHECK-NEXT: </array>
+// CHECK-NEXT: <key>end</key>
+// CHECK-NEXT: <array>
+// CHECK-NEXT: <dict>
+// CHECK-NEXT: <key>line</key><integer>23</integer>
+// CHECK-NEXT: <key>col</key><integer>3</integer>
+// CHECK-NEXT: <key>file</key><integer>0</integer>
+// CHECK-NEXT: </dict>
+// CHECK-NEXT: <dict>
+// CHECK-NEXT: <key>line</key><integer>23</integer>
+// CHECK-NEXT: <key>col</key><integer>9</integer>
+// CHECK-NEXT: <key>file</key><integer>0</integer>
+// CHECK-NEXT: </dict>
+// CHECK-NEXT: </array>
+// CHECK-NEXT: </dict>
+// CHECK-NEXT: </array>
+// CHECK-NEXT: </dict>
+// CHECK-NEXT: <dict>
+// CHECK-NEXT: <key>kind</key><string>event</string>
+// CHECK-NEXT: <key>location</key>
+// CHECK-NEXT: <dict>
+// CHECK-NEXT: <key>line</key><integer>23</integer>
+// CHECK-NEXT: <key>col</key><integer>3</integer>
+// CHECK-NEXT: <key>file</key><integer>0</integer>
+// CHECK-NEXT: </dict>
+// CHECK-NEXT: <key>ranges</key>
+// CHECK-NEXT: <array>
+// CHECK-NEXT: <array>
+// CHECK-NEXT: <dict>
+// CHECK-NEXT: <key>line</key><integer>23</integer>
+// CHECK-NEXT: <key>col</key><integer>3</integer>
+// CHECK-NEXT: <key>file</key><integer>0</integer>
+// CHECK-NEXT: </dict>
+// CHECK-NEXT: <dict>
+// CHECK-NEXT: <key>line</key><integer>23</integer>
+// CHECK-NEXT: <key>col</key><integer>18</integer>
+// CHECK-NEXT: <key>file</key><integer>0</integer>
+// CHECK-NEXT: </dict>
+// CHECK-NEXT: </array>
+// CHECK-NEXT: </array>
+// CHECK-NEXT: <key>depth</key><integer>0</integer>
+// CHECK-NEXT: <key>extended_message</key>
+// CHECK-NEXT: <string>Calling &apos;inlined&apos;</string>
+// CHECK-NEXT: <key>message</key>
+// CHECK-NEXT: <string>Calling &apos;inlined&apos;</string>
+// CHECK-NEXT: </dict>
+// CHECK-NEXT: <dict>
+// CHECK-NEXT: <key>kind</key><string>event</string>
+// CHECK-NEXT: <key>location</key>
+// CHECK-NEXT: <dict>
+// CHECK-NEXT: <key>line</key><integer>12</integer>
+// CHECK-NEXT: <key>col</key><integer>1</integer>
+// CHECK-NEXT: <key>file</key><integer>0</integer>
+// CHECK-NEXT: </dict>
+// CHECK-NEXT: <key>depth</key><integer>1</integer>
+// CHECK-NEXT: <key>extended_message</key>
+// CHECK-NEXT: <string>Entered call from &apos;test&apos;</string>
+// CHECK-NEXT: <key>message</key>
+// CHECK-NEXT: <string>Entered call from &apos;test&apos;</string>
+// CHECK-NEXT: </dict>
+// CHECK-NEXT: <dict>
+// CHECK-NEXT: <key>kind</key><string>control</string>
+// CHECK-NEXT: <key>edges</key>
+// CHECK-NEXT: <array>
+// CHECK-NEXT: <dict>
+// CHECK-NEXT: <key>start</key>
+// CHECK-NEXT: <array>
+// CHECK-NEXT: <dict>
+// CHECK-NEXT: <key>line</key><integer>12</integer>
+// CHECK-NEXT: <key>col</key><integer>1</integer>
+// CHECK-NEXT: <key>file</key><integer>0</integer>
+// CHECK-NEXT: </dict>
+// CHECK-NEXT: <dict>
+// CHECK-NEXT: <key>line</key><integer>12</integer>
+// CHECK-NEXT: <key>col</key><integer>4</integer>
+// CHECK-NEXT: <key>file</key><integer>0</integer>
+// CHECK-NEXT: </dict>
+// CHECK-NEXT: </array>
+// CHECK-NEXT: <key>end</key>
+// CHECK-NEXT: <array>
+// CHECK-NEXT: <dict>
+// CHECK-NEXT: <key>line</key><integer>13</integer>
+// CHECK-NEXT: <key>col</key><integer>3</integer>
+// CHECK-NEXT: <key>file</key><integer>0</integer>
+// CHECK-NEXT: </dict>
+// CHECK-NEXT: <dict>
+// CHECK-NEXT: <key>line</key><integer>13</integer>
+// CHECK-NEXT: <key>col</key><integer>4</integer>
+// CHECK-NEXT: <key>file</key><integer>0</integer>
+// CHECK-NEXT: </dict>
+// CHECK-NEXT: </array>
+// CHECK-NEXT: </dict>
+// CHECK-NEXT: </array>
+// CHECK-NEXT: </dict>
+// CHECK-NEXT: <dict>
+// CHECK-NEXT: <key>kind</key><string>control</string>
+// CHECK-NEXT: <key>edges</key>
+// CHECK-NEXT: <array>
+// CHECK-NEXT: <dict>
+// CHECK-NEXT: <key>start</key>
+// CHECK-NEXT: <array>
+// CHECK-NEXT: <dict>
+// CHECK-NEXT: <key>line</key><integer>13</integer>
+// CHECK-NEXT: <key>col</key><integer>3</integer>
+// CHECK-NEXT: <key>file</key><integer>0</integer>
+// CHECK-NEXT: </dict>
+// CHECK-NEXT: <dict>
+// CHECK-NEXT: <key>line</key><integer>13</integer>
+// CHECK-NEXT: <key>col</key><integer>4</integer>
+// CHECK-NEXT: <key>file</key><integer>0</integer>
+// CHECK-NEXT: </dict>
+// CHECK-NEXT: </array>
+// CHECK-NEXT: <key>end</key>
+// CHECK-NEXT: <array>
+// CHECK-NEXT: <dict>
+// CHECK-NEXT: <key>line</key><integer>13</integer>
+// CHECK-NEXT: <key>col</key><integer>7</integer>
+// CHECK-NEXT: <key>file</key><integer>0</integer>
+// CHECK-NEXT: </dict>
+// CHECK-NEXT: <dict>
+// CHECK-NEXT: <key>line</key><integer>13</integer>
+// CHECK-NEXT: <key>col</key><integer>7</integer>
+// CHECK-NEXT: <key>file</key><integer>0</integer>
+// CHECK-NEXT: </dict>
+// CHECK-NEXT: </array>
+// CHECK-NEXT: </dict>
+// CHECK-NEXT: </array>
+// CHECK-NEXT: </dict>
+// CHECK-NEXT: <dict>
+// CHECK-NEXT: <key>kind</key><string>event</string>
+// CHECK-NEXT: <key>location</key>