| blob | d0f8c2512d42cfa224043a2c36b8e57a008c1d65 |
1 2024-04-05 David Malcolm <dmalcolm@redhat.com>
3 PR analyzer/114588
4 * access-diagram.cc (access_diagram_impl::access_diagram_impl):
5 Replace hardcoded colors for valid_style and invalid_style with
6 calls to text_art::get_style_from_color_cap_name.
8 2024-04-02 David Malcolm <dmalcolm@redhat.com>
10 * region-model-manager.cc (maybe_undo_optimize_bit_field_compare):
11 Guard against null types.
12 * region-model.cc (apply_constraints_for_gswitch): Likewise.
14 2024-03-27 David Malcolm <dmalcolm@redhat.com>
16 PR analyzer/114473
17 * call-summary.cc
18 (call_summary_replay::convert_svalue_from_summary): Assert that
19 the types match.
20 (call_summary_replay::convert_region_from_summary): Likewise.
21 (call_summary_replay::convert_region_from_summary_1): Add missing
22 cast for the deref of RK_SYMBOLIC case.
24 2024-03-23 David Malcolm <dmalcolm@redhat.com>
26 PR analyzer/114408
27 * engine.cc (impl_run_checkers): Free up any dominance info that
28 we may have created.
29 * kf.cc (class kf_ubsan_handler): New.
30 (register_sanitizer_builtins): New.
31 (register_known_functions): Call register_sanitizer_builtins.
33 2024-03-22 David Malcolm <dmalcolm@redhat.com>
35 PR analyzer/112974
36 PR analyzer/112975
37 * sm-taint.cc (taint_state_machine::on_condition): Strip away
38 casts before considering LHS and RHS, to increase the chance of
39 detecting places where sanitization of a value may have happened.
41 2024-03-22 David Malcolm <dmalcolm@redhat.com>
43 * sm-taint.cc: Include "diagnostic-format-sarif.h".
44 (bounds_to_str): New.
45 (taint_diagnostic::maybe_add_sarif_properties): New.
46 (tainted_offset::tainted_offset): Add "offset" param.
47 (tainted_offset::maybe_add_sarif_properties): New.
48 (tainted_offset::m_offset): New.
49 (region_model::check_region_for_taint): Pass offset to
50 tainted_offset ctor.
52 2024-03-21 David Malcolm <dmalcolm@redhat.com>
54 PR analyzer/113619
55 * region-model.cc (region_model::eval_condition): Fix
56 cast-handling from r14-3632-ge7b267444045c5 so that if those give
57 an unknown result, we continue trying the constraint manager.
59 2024-03-20 David Malcolm <dmalcolm@redhat.com>
61 PR analyzer/109251
62 * sm-malloc.cc (deref_before_check::emit): Reject cases where the
63 check is in a loop header within a macro expansion.
64 (deref_before_check::loop_header_p): New.
66 2024-03-20 Jakub Jelinek <jakub@redhat.com>
68 * constraint-manager.cc (test_range, test_constraint_conditions,
69 test_constant_comparisons, test_constraint_impl, test_purging,
70 test_bits): Use integer_zero_node instead of
71 build_zero_cst (integer_type_node) or
72 build_int_cst (integer_type_node, 0) and integer_one_node instead of
73 build_int_cst (integer_type_node, 1).
74 * region-model.cc (region_model::get_store_value,
75 append_interesting_constants, test_array_1,
76 test_get_representative_tree, test_unique_constants, test_assignment,
77 test_stack_frames, test_constraint_merging, test_widening_constraints,
78 test_iteration_1, test_array_2): Likewise.
80 2024-03-19 Jakub Jelinek <jakub@redhat.com>
82 PR analyzer/113505
83 * region-model.cc (get_tree_for_byte_offset,
84 region_model::get_representative_path_var_1,
85 test_mem_ref, test_POINTER_PLUS_EXPR_then_MEM_REF): Use
86 char __attribute__((may_alias)) * as type of MEM_REF second argument.
88 2024-03-19 David Malcolm <dmalcolm@redhat.com>
90 PR analyzer/114286
91 * kf.cc (class kf_atomic_exchange): Reimplement based on signature
92 seen in gimple, rather than user-facing signature.
93 (class kf_atomic_load): Likewise.
94 (class kf_atomic_store): New.
95 (register_atomic_builtins): Register kf_atomic_store.
97 2024-03-18 David Malcolm <dmalcolm@redhat.com>
99 PR analyzer/110902
100 PR analyzer/110928
101 PR analyzer/111305
102 PR analyzer/111441
103 * access-diagram.cc: Include "analyzer/analyzer-selftests.h".
104 (get_access_size_str): Reimplement for conversion of
105 implmementation of bit_size_expr from tree to const svalue &. Use
106 svalue::maybe_print_for_user rather than tree printing routines.
107 (remove_ssa_names): Make non-static.
108 (bit_size_expr::get_formatted_str): Rename to...
109 (bit_size_expr::maybe_get_formatted_str): ...this, adding "model"
110 param and converting return type to a unique_ptr. Update for
111 conversion of implementation of bit_size_expr from tree to
112 const svalue &. Use svalue::maybe_print_for_user rather than tree
113 printing routines.
114 (bit_size_expr::print): Rename to...
115 (bit_size_expr::maybe_print_for_user): ...this, adding "model"
116 param and converting return type to bool. Update for
117 conversion of implementation of bit_size_expr from tree to
118 const svalue &. Use svalue::maybe_print_for_user rather than tree
119 printing routines.
120 (bit_size_expr::maybe_get_as_bytes): Add "mgr" param and convert
121 return type from tree to const svalue *; reimplement.
122 (access_range::access_range): Call strip_types when on region_offset
123 intializations.
124 (access_range::get_size): Update for conversion of implementation
125 of bit_size_expr from tree to const svalue &.
126 (access_operation::get_valid_bits): Pass manager to access_range
127 ctor.
128 (access_operation::maybe_get_invalid_before_bits): Likewise.
129 (access_operation::maybe_get_invalid_after_bits): Likewise.
130 (boundaries::add): Likewise.
131 (bit_to_table_map::populate): Add "mgr" param and pass it to
132 access_range ctor.
133 (access_diagram_impl::access_diagram_impl): Pass manager to
134 bit_to_table_map::populate.
135 (access_diagram_impl::maybe_add_gap): Use svalue rather than tree
136 for symbolic bit offsets. Port to new bit_size_expr
137 representation.
138 (access_diagram_impl::add_valid_vs_invalid_ruler): Port to new
139 bit_size_expr representation.
140 (selftest::assert_eq_typeless_integer): New.
141 (ASSERT_EQ_TYPELESS_INTEGER): New.
142 (selftest::test_bit_size_expr_to_bytes): New.
143 (selftest::analyzer_access_diagram_cc_tests): New.
144 * access-diagram.h (class bit_size_expr): Reimplement, converting
145 implementation from tree to const svalue &.
146 (access_range::access_range): Add "mgr" param. Call strip_types
147 on region_offset initializations.
148 (access_range::get_size): Update decl for reimplementation.
149 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
150 selftest::analyzer_access_diagram_cc_tests.
151 * analyzer-selftests.h
152 (selftest::analyzer_checker_script_cc_tests): Delete this stray
153 typo.
154 (selftest::analyzer_access_diagram_cc_tests): New decl.
155 * analyzer.h (print_expr_for_user): New decl.
156 (calc_symbolic_bit_offset): Update decl for reimplementation.
157 (strip_types): New decls.
158 (remove_ssa_names): New decl.
159 * bounds-checking.cc (strip_types): New.
160 (region_model::check_symbolic_bounds): Use typeless svalues.
161 * region-model-manager.cc
162 (region_model_manager::get_or_create_constant_svalue): Add "type"
163 param. Add overload with old signature.
164 (region_model_manager::get_or_create_int_cst): Support type being
165 NULL_TREE.
166 (region_model_manager::maybe_fold_unaryop): Gracefully reject folding
167 of casts to NULL_TREE type.
168 (get_code_for_cast): Use NOP_EXPR for "casting" svalues to
169 NULL_TREE type.
170 (region_model_manager::get_or_create_cast): Support "casting"
171 svalues to NULL_TREE type.
172 (region_model_manager::maybe_fold_binop): Don't crash on inputs
173 with NULL_TREE type. Handle folding of binops on constants with
174 NULL_TREE type. Add missing cast from PR analyzer/110902.
175 Support enough folding of other ops on NULL_TREE type to support
176 bounds checking.
177 (region_model_manager::get_or_create_const_fn_result_svalue):
178 Remove assertion that type is nonnull.
179 * region-model-manager.h
180 (region_model_manager::get_or_create_constant_svalue): Add
181 overloaded decl taking a type.
182 (region_model_manager::maybe_fold_binop): Make public.
183 (region_model_manager::constants_map_t): Use
184 constant_svalue::key_t for the key, rather than just tree.
185 * region-model.cc (print_expr_for_user): New.
186 (selftest::test_array_2): Handle casts.
187 * region.cc (region_offset::calc_symbolic_bit_offset): Return
188 const svalue & rather than tree, and reimplement accordingly.
189 (region::calc_offset): Use ptrdiff_type_node for types of byte
190 offsets.
191 (region::maybe_print_for_user): New.
192 (element_region::get_relative_symbolic_offset): Use NULL_TREE for
193 types of bit offsets.
194 (offset_region::get_bit_offset): Likewise.
195 (sized_region::get_bit_size_sval): Likewise for bit sizes.
196 * region.h (region::maybe_print_for_user): New decl.
197 * svalue.cc (class auto_add_parens): New.
198 (svalue::maybe_print_for_user): New.
199 (svalue::cmp_ptr): Support typeless constant svalues.
200 (tristate_from_boolean_tree_node): New, taken from...
201 (constant_svalue::eval_condition): ...here. Handle comparison of
202 typeless integer svalue constants.
203 * svalue.h (svalue::maybe_print_for_user): New decl.
204 (class constant_svalue): Support the type of the svalue being
205 NULL_TREE.
206 (struct default_hash_traits<constant_svalue::key_t>): New.
208 2024-03-18 David Malcolm <dmalcolm@redhat.com>
210 * access-diagram.cc (remove_ssa_names): Support operands being
211 NULL_TREE, such as e.g. for COMPONENT_REF's operand 2.
213 2024-03-07 Jakub Jelinek <jakub@redhat.com>
215 * access-diagram.cc: Include diagnostic-core.h before including
216 diagnostic.h or diagnostic-path.h.
217 * sm-malloc.cc: Likewise.
218 * diagnostic-manager.cc: Likewise.
219 * call-summary.cc: Likewise.
220 * record-layout.cc: Likewise.
222 2024-02-29 David Malcolm <dmalcolm@redhat.com>
224 PR analyzer/114159
225 * analyzer.cc: Include "tree-dfa.h".
226 (get_ssa_default_def): New decl.
227 * analyzer.h (get_ssa_default_def): New.
228 * call-info.cc (call_info::call_info): New ctor taking an explicit
229 called_fn.
230 * call-info.h (call_info::call_info): Likewise.
231 * call-summary.cc (call_summary_replay::call_summary_replay):
232 Convert param from function * to const function &.
233 * call-summary.h (call_summary_replay::call_summary_replay):
234 Likewise.
235 * checker-event.h (state_change_event::get_dest_function):
236 Constify return value.
237 * engine.cc (point_and_state::validate): Update for conversion to
238 const function &.
239 (exploded_node::on_stmt): Likewise.
240 (call_summary_edge_info::call_summary_edge_info): Likewise.
241 Pass in called_fn to call_info ctor.
242 (exploded_node::replay_call_summaries): Update for conversion to
243 const function &. Convert per_function_data from * to &.
244 (exploded_node::replay_call_summary): Update for conversion to
245 const function &.
246 (exploded_graph::add_function_entry): Likewise.
247 (toplevel_function_p): Likewise.
248 (add_tainted_args_callback): Likewise.
249 (exploded_graph::build_initial_worklist): Likewise.
250 (exploded_graph::maybe_create_dynamic_call): Likewise.
251 (maybe_update_for_edge): Likewise.
252 (exploded_graph::on_escaped_function): Likewise.
253 * exploded-graph.h (exploded_node::replay_call_summaries):
254 Likewise.
255 (exploded_node::replay_call_summary): Likewise.
256 (exploded_graph::add_function_entry): Likewise.
257 * program-point.cc (function_point::from_function_entry):
258 Likewise.
259 (program_point::from_function_entry): Likewise.
260 * program-point.h (function_point::from_function_entry): Likewise.
261 (program_point::from_function_entry): Likewise.
262 * program-state.cc (program_state::push_frame): Likewise.
263 (program_state::get_current_function): Constify return type.
264 * program-state.h (program_state::push_frame): Update for
265 conversion to const function &.
266 (program_state::get_current_function): Likewise.
267 * region-model-manager.cc
268 (region_model_manager::get_frame_region): Likewise.
269 * region-model-manager.h
270 (region_model_manager::get_frame_region): Likewise.
271 * region-model.cc (region_model::called_from_main_p): Likewise.
272 (region_model::update_for_gcall): Likewise.
273 (region_model::push_frame): Likewise.
274 (region_model::get_current_function): Constify return type.
275 (region_model::pop_frame): Update for conversion to
276 const function &.
277 (selftest::test_stack_frames): Likewise.
278 (selftest::test_get_representative_path_var): Likewise.
279 (selftest::test_state_merging): Likewise.
280 (selftest::test_alloca): Likewise.
281 * region-model.h (region_model::push_frame): Likewise.
282 (region_model::get_current_function): Likewise.
283 * region.cc (frame_region::dump_to_pp): Likewise.
284 (frame_region::get_region_for_local): Likewise.
285 * region.h (class frame_region): Likewise.
286 * sm-signal.cc (signal_unsafe_call::describe_state_change):
287 Likewise.
288 (update_model_for_signal_handler): Likewise.
289 (signal_delivery_edge_info_t::update_model): Likewise.
290 (register_signal_handler::impl_transition): Likewise.
291 * state-purge.cc (class gimple_op_visitor): Likewise.
292 (state_purge_map::state_purge_map): Likewise.
293 (state_purge_map::get_or_create_data_for_decl): Likewise.
294 (state_purge_per_ssa_name::state_purge_per_ssa_name): Likewise.
295 (state_purge_per_ssa_name::add_to_worklist): Likewise.
296 (state_purge_per_ssa_name::process_point): Likewise.
297 (state_purge_per_decl::add_to_worklist): Likewise.
298 (state_purge_annotator::print_needed): Likewise.
299 * state-purge.h
300 (state_purge_map::get_or_create_data_for_decl): Likewise.
301 (class state_purge_per_tree): Likewise.
302 (class state_purge_per_ssa_name): Likewise.
303 (class state_purge_per_decl): Likewise.
304 * supergraph.cc (supergraph::dump_dot_to_pp): Likewise.
305 * supergraph.h
306 (supergraph::get_node_for_function_entry): Likewise.
307 (supergraph::get_node_for_function_exit): Likewise.
309 2024-02-27 David Malcolm <dmalcolm@redhat.com>
311 PR analyzer/110483
312 PR analyzer/111802
313 * access-diagram.cc
314 (string_literal_spatial_item::add_column_for_byte): Use %wu for
315 printing unsigned HOST_WIDE_INT.
317 2024-02-27 David Malcolm <dmalcolm@redhat.com>
319 PR analyzer/111881
320 * constraint-manager.cc (bound::ensure_closed): Assert that
321 m_constant has integral type.
322 (range::add_bound): Bail out on floating point constants.
324 2024-02-21 David Malcolm <dmalcolm@redhat.com>
326 PR analyzer/113999
327 * analyzer.h (get_string_cst_size): New decl.
328 * region-model-manager.cc (get_string_cst_size): New.
329 (region_model_manager::maybe_get_char_from_string_cst): Treat
330 single-byte accesses within string_cst but beyond
331 TREE_STRING_LENGTH as being 0.
332 * region-model.cc (string_cst_has_null_terminator): Likewise.
334 2024-02-21 David Malcolm <dmalcolm@redhat.com>
336 PR analyzer/113998
337 * ranges.cc (symbolic_byte_range::intersection): Handle empty ranges.
338 (selftest::test_intersects): Add test coverage for empty ranges.
340 2024-02-19 David Malcolm <dmalcolm@redhat.com>
342 PR analyzer/111289
343 * varargs.cc (representable_in_integral_type_p): New.
344 (va_arg_compatible_types_p): Add "arg_sval" param. Handle integer
345 types.
346 (kf_va_arg::impl_call_pre): Pass arg_sval to
347 va_arg_compatible_types_p.
349 2024-02-19 Andrew Pinski <quic_apinski@quicinc.com>
351 PR analyzer/113983
352 * region-model-manager.cc (maybe_undo_optimize_bit_field_compare): Reject
353 non integral types.
355 2024-02-15 David Malcolm <dmalcolm@redhat.com>
357 PR analyzer/111266
358 * region.cc (offset_region::get_byte_size_sval): Delete.
359 (offset_region::get_bit_size_sval): Delete.
360 * region.h (region::get_byte_size): Add comment clarifying that
361 this relates to the size of the access, rather than the size
362 that's valid to access.
363 (region::get_bit_size): Likewise.
364 (region::get_byte_size_sval): Likewise.
365 (region::get_bit_size_sval): Likewise.
366 (offset_region::get_byte_size_sval): Delete.
367 (offset_region::get_bit_size_sval): Delete.
369 2024-02-13 David Malcolm <dmalcolm@redhat.com>
371 * pending-diagnostic.cc (diagnostic_emission_context::warn):
372 Update for renaming of emit_diagnostic_valist overload to
373 emit_diagnostic_valist_meta.
374 (diagnostic_emission_context::inform): Likewise.
376 2024-01-31 David Malcolm <dmalcolm@redhat.com>
378 PR analyzer/113253
379 * region-model.cc (region_model::on_stmt_pre): Add gcc_unreachable
380 for debug statements.
381 * state-purge.cc
382 (state_purge_per_ssa_name::state_purge_per_ssa_name): Skip any
383 debug stmts in the FOR_EACH_IMM_USE_FAST list.
384 * supergraph.cc (supergraph::supergraph): Don't add debug stmts
385 to the supernodes.
387 2024-01-31 David Malcolm <dmalcolm@redhat.com>
389 PR analyzer/113509
390 * checker-event.cc (state_change_event::get_desc): Don't assume
391 "var" is non-NULL.
393 2024-01-30 David Malcolm <dmalcolm@redhat.com>
395 PR analyzer/113654
396 * region-model.cc (is_round_up): New.
397 (is_multiple_p): New.
398 (is_dubious_capacity): New.
399 (region_model::check_region_size): Move usage of size_visitor into
400 is_dubious_capacity.
402 2024-01-30 David Malcolm <dmalcolm@redhat.com>
404 * region-model.cc
405 (dubious_allocation_size::dubious_allocation_size): Add
406 "capacity_sval" param. Drop unused ctor.
407 (dubious_allocation_size::maybe_add_sarif_properties): New.
408 (dubious_allocation_size::m_capacity_sval): New field.
409 (region_model::check_region_size): Pass capacity svalue to
410 dubious_allocation_size ctor.
412 2024-01-25 David Malcolm <dmalcolm@redhat.com>
414 PR analyzer/112969
415 * store.cc (binding_cluster::maybe_get_compound_binding): When
416 populating default_map, express the bit-range of the default key
417 for REG relative to REG, rather than to the base region.
419 2024-01-24 David Malcolm <dmalcolm@redhat.com>
421 PR analyzer/112977
422 * engine.cc (impl_region_model_context::on_liveness_change): Pass
423 m_ext_state to sm_state_map::on_liveness_change.
424 * program-state.cc (sm_state_map::on_svalue_leak): Guard removal
425 of map entry based on can_purge_p.
426 (sm_state_map::on_liveness_change): Add ext_state param. Add
427 workaround for bad interaction between state purging and
428 alt-inherited sm-state.
429 * program-state.h (sm_state_map::on_liveness_change): Add
430 ext_state param.
431 * sm-taint.cc
432 (taint_state_machine::has_alt_get_inherited_state_p): New.
433 (taint_state_machine::can_purge_p): Return false for "has_lb" and
434 "has_ub".
435 * sm.h (state_machine::has_alt_get_inherited_state_p): New vfunc.
437 2024-01-18 David Malcolm <dmalcolm@redhat.com>
439 PR analyzer/111361
440 * region-model.cc (svalue_byte_range_has_null_terminator_1): The
441 initial byte of an all-zeroes SVAL is a zero byte. Remove
442 gcc_unreachable from SK_CONSTANT for constants that aren't
443 STRING_CST or INTEGER_CST.
445 2024-01-18 David Malcolm <dmalcolm@redhat.com>
447 PR analyzer/112811
448 * region-model.cc (fragment::dump_to_pp): New.
449 (fragment::has_null_terminator): Convert to...
450 (svalue_byte_range_has_null_terminator_1): ...this new function,
451 updating to use a byte_range relative to the start of the svalue.
452 (svalue_byte_range_has_null_terminator): New.
453 (fragment::string_cst_has_null_terminator): Convert to...
454 (string_cst_has_null_terminator): ...this, updating to use a
455 byte_range relative to the start of the svalue.
456 (iterable_cluster::dump_to_pp): New.
457 (region_model::scan_for_null_terminator): Add logging, moving body
458 to...
459 (region_model::scan_for_null_terminator_1): ...this new function,
460 adding more logging, and updating to use
461 svalue_byte_range_has_null_terminator.
462 * region-model.h (region_model::scan_for_null_terminator_1): New
463 decl.
465 2024-01-16 David Malcolm <dmalcolm@redhat.com>
467 PR analyzer/106229
468 * analyzer.h (compare_constants): New decl.
469 * constraint-manager.cc (compare_constants): Make non-static.
470 * sm-taint.cc: Add include "fold-const.h".
471 (class concrete_range): New.
472 (get_possible_range): New.
473 (index_can_be_out_of_bounds_p): New.
474 (region_model::check_region_for_taint): Reject
475 -Wanalyzer-tainted-array-index if the type of the value makes it
476 impossible for it to be out-of-bounds of the array.
478 2024-01-16 David Malcolm <dmalcolm@redhat.com>
480 PR analyzer/113333
481 * region-model-manager.cc
482 (region_model_manager::maybe_fold_unaryop): Casting all zeroes
483 should give all zeroes.
485 2024-01-04 David Malcolm <dmalcolm@redhat.com>
487 * analyzer.opt.urls: New file, autogenerated by
488 regenerate-opt-urls.py.
490 2024-01-04 David Malcolm <dmalcolm@redhat.com>
492 * checker-event.cc: Include "diagnostic-format-sarif.h" and
493 "tree-logical-location.h".
494 (checker_event::maybe_add_sarif_properties): New.
495 (superedge_event::maybe_add_sarif_properties): New.
496 (superedge_event::superedge_event): Add comment.
497 * checker-event.h (checker_event::maybe_add_sarif_properties): New
498 decl.
499 (superedge_event::maybe_add_sarif_properties): New decl.
501 2024-01-04 David Malcolm <dmalcolm@redhat.com>
503 PR analyzer/112790
504 * checker-event.cc (class inlining_info): Move to...
505 * inlining-iterator.h (class inlining_info): ...here.
506 * sm-malloc.cc: Include "analyzer/inlining-iterator.h".
507 (maybe_complain_about_deref_before_check): Reject stmts that were
508 inlined from another function.
510 2024-01-04 David Malcolm <dmalcolm@redhat.com>
512 PR analyzer/113222
513 * access-diagram.cc (valid_region_spatial_item::add_boundaries):
514 Handle TYPE_DOMAIN being null.
515 (valid_region_spatial_item::add_array_elements_to_table):
516 Likewise.
518 2023-12-16 David Malcolm <dmalcolm@redhat.com>
520 * analyzer.cc: Include "tree-pretty-print.h" and
521 "diagnostic-event-id.h".
522 (tree_to_json): New.
523 (diagnostic_event_id_to_json): New.
524 (bit_offset_to_json): New.
525 (byte_offset_to_json): New.
526 * analyzer.h (tree_to_json): New decl.
527 (diagnostic_event_id_to_json): New decl.
528 (bit_offset_to_json): New decl.
529 (byte_offset_to_json): New decl.
530 * bounds-checking.cc: Include "diagnostic-format-sarif.h".
531 (out_of_bounds::maybe_add_sarif_properties): New.
532 (concrete_out_of_bounds::maybe_add_sarif_properties): New.
533 (concrete_past_the_end::maybe_add_sarif_properties): New.
534 (symbolic_past_the_end::maybe_add_sarif_properties): New.
535 * region-model.cc (region_to_value_map::to_json): New.
536 (region_model::to_json): New.
537 * region-model.h (region_to_value_map::to_json): New decl.
538 (region_model::to_json): New decl.
539 * store.cc (bit_range::to_json): New.
540 (byte_range::to_json): New.
541 * store.h (bit_range::to_json): New decl.
542 (byte_range::to_json): New decl.
544 2023-12-16 David Malcolm <dmalcolm@redhat.com>
546 PR analyzer/112792
547 * bounds-checking.cc
548 (out_of_bounds::oob_region_creation_event_capacity): Rename
549 "capacity" to "byte_capacity". Layout fix.
550 (out_of_bounds::::add_region_creation_events): Rename
551 "capacity" to "byte_capacity".
552 (class concrete_out_of_bounds): Rename m_out_of_bounds_range to
553 m_out_of_bounds_bits and convert from a byte_range to a bit_range.
554 (concrete_out_of_bounds::get_out_of_bounds_bytes): New.
555 (concrete_past_the_end::concrete_past_the_end): Rename param
556 "byte_bound" to "bit_bound". Initialize m_byte_bound.
557 (concrete_past_the_end::subclass_equal_p): Update for renaming
558 of m_byte_bound to m_bit_bound.
559 (concrete_past_the_end::m_bit_bound): New field.
560 (concrete_buffer_overflow::concrete_buffer_overflow): Convert
561 param "range" from byte_range to bit_range. Rename param
562 "byte_bound" to "bit_bound".
563 (concrete_buffer_overflow::emit): Update for bits vs bytes.
564 (concrete_buffer_overflow::describe_final_event): Split
565 into...
566 (concrete_buffer_overflow::describe_final_event_as_bytes): ...this
567 (concrete_buffer_overflow::describe_final_event_as_bits): ...and
568 this.
569 (concrete_buffer_over_read::concrete_buffer_over_read): Convert
570 param "range" from byte_range to bit_range. Rename param
571 "byte_bound" to "bit_bound".
572 (concrete_buffer_over_read::emit): Update for bits vs bytes.
573 (concrete_buffer_over_read::describe_final_event): Split into...
574 (concrete_buffer_over_read::describe_final_event_as_bytes):
575 ...this
576 (concrete_buffer_over_read::describe_final_event_as_bits): ...and
577 this.
578 (concrete_buffer_underwrite::concrete_buffer_underwrite): Convert
579 param "range" from byte_range to bit_range.
580 (concrete_buffer_underwrite::describe_final_event): Split into...
581 (concrete_buffer_underwrite::describe_final_event_as_bytes):
582 ...this
583 (concrete_buffer_underwrite::describe_final_event_as_bits): ...and
584 this.
585 (concrete_buffer_under_read::concrete_buffer_under_read): Convert
586 param "range" from byte_range to bit_range.
587 (concrete_buffer_under_read::describe_final_event): Split into...
588 (concrete_buffer_under_read::describe_final_event_as_bytes):
589 ...this
590 (concrete_buffer_under_read::describe_final_event_as_bits): ...and
591 this.
592 (region_model::check_region_bounds): Use bits for concrete values,
593 and rename locals to indicate whether we're dealing with bits or
594 bytes. Specifically, replace "num_bytes_sval" with
595 "num_bits_sval", and get it from reg's "get_bit_size_sval".
596 Replace "num_bytes_tree" with "num_bits_tree". Rename "capacity"
597 to "byte_capacity". Rename "cst_capacity_tree" to
598 "cst_byte_capacity_tree". Replace "offset" and
599 "num_bytes_unsigned" with "bit_offset" and "num_bits_unsigned"
600 respectively, converting from byte_offset_t to bit_offset_t.
601 Replace "out" and "read_bytes" with "bits_outside" and "read_bits"
602 respectively, converting from byte_range to bit_range. Convert
603 "buffer" from byte_range to bit_range. Replace "byte_bound" with
604 "bit_bound".
605 * region.cc (region::get_bit_size_sval): New.
606 (offset_region::get_bit_offset): New.
607 (offset_region::get_bit_size_sval): New.
608 (sized_region::get_bit_size_sval): New.
609 (bit_range_region::get_bit_size_sval): New.
610 * region.h (region::get_bit_size_sval): New vfunc.
611 (offset_region::get_bit_offset): New decl.
612 (offset_region::get_bit_size_sval): New decl.
613 (sized_region::get_bit_size_sval): New decl.
614 (bit_range_region::get_bit_size_sval): New decl.
615 * store.cc (bit_range::intersects_p): New, based on
616 byte_range::intersects_p.
617 (bit_range::exceeds_p): New, based on byte_range::exceeds_p.
618 (bit_range::falls_short_of_p): New, based on
619 byte_range::falls_short_of_p.
620 (byte_range::intersects_p): Delete.
621 (byte_range::exceeds_p): Delete.
622 (byte_range::falls_short_of_p): Delete.
623 * store.h (bit_range::intersects_p): New overload.
624 (bit_range::exceeds_p): New.
625 (bit_range::falls_short_of_p): New.
626 (byte_range::intersects_p): Delete.
627 (byte_range::exceeds_p): Delete.
628 (byte_range::falls_short_of_p): Delete.
630 2023-12-14 David Malcolm <dmalcolm@redhat.com>
632 PR analyzer/112655
633 * infinite-loop.cc (infinite_loop::infinite_loop): Pass eedges
634 via rvalue reference rather than by value.
635 (starts_infinite_loop_p): Move eedges when constructing an
636 infinite_loop instance.
637 * sm-file.cc (fileptr_state_machine::fileptr_state_machine): Use
638 initializer list for states.
639 * sm-sensitive.cc
640 (sensitive_state_machine::sensitive_state_machine): Likewise.
641 * sm-signal.cc (signal_state_machine::signal_state_machine):
642 Likewise.
643 * sm-taint.cc (taint_state_machine::taint_state_machine):
644 Likewise.
645 * varargs.cc (va_list_state_machine::va_list_state_machine): Likewise.
647 2023-12-11 David Malcolm <dmalcolm@redhat.com>
649 PR analyzer/112955
650 * engine.cc (feasibility_state::feasibility_state): Initialize
651 m_snodes_visited.
653 2023-12-11 Andrew Pinski <apinski@marvell.com>
655 * region-model-manager.cc (maybe_undo_optimize_bit_field_compare): Remove
656 the check for type being unsigned_char_type_node.
658 2023-12-08 David Malcolm <dmalcolm@redhat.com>
660 * sm-taint.cc (taint_state_machine::alt_get_inherited_state): Fix
661 handling of TRUNC_MOD_EXPR.
663 2023-12-08 David Malcolm <dmalcolm@redhat.com>
665 * region-model.cc (contains_uninit_p): Only check for
666 svalues that the infoleak warning can handle.
668 2023-12-08 David Malcolm <dmalcolm@redhat.com>
670 PR analyzer/112889
671 * store.h (concrete_binding::concrete_binding): Strengthen
672 assertion to require size to be be positive, rather than just
673 non-zero.
674 (concrete_binding::mark_deleted): Use size rather than start bit
675 offset.
676 (concrete_binding::mark_empty): Likewise.
677 (concrete_binding::is_deleted): Likewise.
678 (concrete_binding::is_empty): Likewise.
680 2023-12-07 Alexandre Oliva <oliva@adacore.com>
682 * region-model.cc (has_nondefault_case_for_value_p): Take
683 enumerate type as a parameter.
684 (region_model::apply_constraints_for_gswitch): Cope with
685 integral promotion type casts.
687 2023-12-07 David Malcolm <dmalcolm@redhat.com>
689 PR analyzer/103546
690 PR analyzer/112850
691 * analyzer.opt (-param=analyzer-max-svalue-depth=): Increase from
692 12 to 18.
693 (Wanalyzer-symbol-too-complex): New.
694 * diagnostic-manager.cc
695 (null_assignment_sm_context::clear_all_per_svalue_state): New.
696 * engine.cc (impl_sm_context::clear_all_per_svalue_state): New.
697 * program-state.cc (sm_state_map::clear_all_per_svalue_state):
698 New.
699 * program-state.h (sm_state_map::clear_all_per_svalue_state): New
700 decl.
701 * region-model-manager.cc
702 (region_model_manager::reject_if_too_complex): Add
703 -Wanalyzer-symbol-too-complex.
704 * sm-taint.cc (taint_state_machine::on_condition): Handle
705 comparisons against UNKNOWN.
706 * sm.h (sm_context::clear_all_per_svalue_state): New.
708 2023-12-06 David Malcolm <dmalcolm@redhat.com>
710 * engine.cc (dump_analyzer_json): Use
711 flag_diagnostics_json_formatting.
713 2023-12-01 David Malcolm <dmalcolm@redhat.com>
715 * analyzer.h (class saved_diagnostic): New forward decl.
716 * bounds-checking.cc: Update for changes to
717 pending_diagnostic::emit.
718 * call-details.cc: Likewise.
719 * diagnostic-manager.cc: Include "diagnostic-format-sarif.h".
720 (saved_diagnostic::maybe_add_sarif_properties): New.
721 (class pending_diagnostic_metadata): New.
722 (diagnostic_manager::emit_saved_diagnostic): Create a
723 pending_diagnostic_metadata and a diagnostic_emission_context.
724 Pass the latter to the pending_diagnostic::emit vfunc.
725 * diagnostic-manager.h
726 (saved_diagnostic::maybe_add_sarif_properties): New decl.
727 * engine.cc: Update for changes to pending_diagnostic::emit.
728 * infinite-loop.cc: Likewise.
729 * infinite-recursion.cc: Likewise.
730 * kf-analyzer.cc: Likewise.
731 * kf.cc: Likewise.
732 * pending-diagnostic.cc
733 (diagnostic_emission_context::get_pending_diagnostic): New.
734 (diagnostic_emission_context::warn): New.
735 (diagnostic_emission_context::inform): New.
736 * pending-diagnostic.h (class diagnostic_emission_context): New.
737 (pending_diagnostic::emit): Update params.
738 (pending_diagnostic::maybe_add_sarif_properties): New vfunc.
739 * region.cc: Don't include "diagnostic-metadata.h".
740 * region-model.cc: Include "diagnostic-format-sarif.h". Update
741 for changes to pending_diagnostic::emit.
742 (exposure_through_uninit_copy::maybe_add_sarif_properties): New.
743 * sm-fd.cc: Update for changes to pending_diagnostic::emit.
744 * sm-file.cc: Likewise.
745 * sm-malloc.cc: Likewise.
746 * sm-pattern-test.cc: Likewise.
747 * sm-sensitive.cc: Likewise.
748 * sm-signal.cc: Likewise.
749 * sm-taint.cc: Likewise.
750 * store.cc: Don't include "diagnostic-metadata.h".
751 * varargs.cc: Update for changes to pending_diagnostic::emit.
753 2023-11-19 David Malcolm <dmalcolm@redhat.com>
755 * analyzer.h: Include "rich-location.h".
757 2023-11-19 David Malcolm <dmalcolm@redhat.com>
759 PR analyzer/107573
760 * analyzer.h (register_known_functions): Add region_model_manager
761 param.
762 * analyzer.opt (Wanalyzer-undefined-behavior-strtok): New.
763 * call-summary.cc
764 (call_summary_replay::convert_region_from_summary_1): Handle
765 RK_PRIVATE.
766 * engine.cc (impl_run_checkers): Pass model manager to
767 register_known_functions.
768 * kf.cc (class undefined_function_behavior): New.
769 (class kf_strtok): New.
770 (register_known_functions): Add region_model_manager param.
771 Use it to register "strtok".
772 * region-model-manager.cc
773 (region_model_manager::get_or_create_conjured_svalue): Add "idx"
774 param.
775 * region-model-manager.h
776 (region_model_manager::get_or_create_conjured_svalue): Add "idx"
777 param.
778 (region_model_manager::get_root_region): New accessor.
779 * region-model.cc (region_model::scan_for_null_terminator): Handle
780 "expr" being null.
781 (region_model::get_representative_path_var_1): Handle RK_PRIVATE.
782 * region-model.h (region_model::called_from_main_p): Make public.
783 * region.cc (region::get_memory_space): Handle RK_PRIVATE.
784 (region::can_have_initial_svalue_p): Handle MEMSPACE_PRIVATE.
785 (private_region::dump_to_pp): New.
786 * region.h (MEMSPACE_PRIVATE): New.
787 (RK_PRIVATE): New.
788 (class private_region): New.
789 (is_a_helper <const private_region *>::test): New.
790 * store.cc (store::replay_call_summary_cluster): Handle
791 RK_PRIVATE.
792 * svalue.h (struct conjured_svalue::key_t): Add "idx" param to
793 ctor and "m_idx" field.
794 (class conjured_svalue::conjured_svalue): Likewise.
796 2023-11-18 David Malcolm <dmalcolm@redhat.com>
798 PR analyzer/106147
799 * analyzer.opt (Wanalyzer-infinite-loop): New option.
800 (fdump-analyzer-infinite-loop): New option.
801 * checker-event.h (start_cfg_edge_event::get_desc): Drop "final".
802 (start_cfg_edge_event::maybe_describe_condition): Convert from
803 private to protected.
804 * checker-path.h (checker_path::get_logger): New.
805 * diagnostic-manager.cc (process_worklist_item): Update for
806 new context param of maybe_update_for_edge.
807 * engine.cc
808 (impl_region_model_context::impl_region_model_context): Add
809 out_could_have_done_work param to both ctors and use it to
810 initialize mm_out_could_have_done_work.
811 (impl_region_model_context::maybe_did_work): New vfunc
812 implementation.
813 (exploded_node::on_stmt): Add out_could_have_done_work param and
814 pass to ctxt ctor.
815 (exploded_node::on_stmt_pre): Treat setjmp and longjmp as "doing
816 work".
817 (exploded_node::on_longjmp): Likewise.
818 (exploded_edge::exploded_edge): Add "could_do_work" param and use
819 it to initialize m_could_do_work_p.
820 (exploded_edge::dump_dot_label): Add result of could_do_work_p.
821 (exploded_graph::add_function_entry): Mark edge as doing no work.
822 (exploded_graph::add_edge): Add "could_do_work" param and pass to
823 exploded_edge ctor.
824 (add_tainted_args_callback): Treat as doing no work.
825 (exploded_graph::process_worklist): Likewise when merging nodes.
826 (maybe_process_run_of_before_supernode_enodes::item): Likewise.
827 (exploded_graph::maybe_create_dynamic_call): Likewise.
828 (exploded_graph::process_node): Likewise for phi nodes.
829 Pass in a "could_have_done_work" bool when handling stmts and use
830 when creating edges. Assume work is done at bifurcation.
831 (exploded_path::feasible_p): Update for new context param of
832 maybe_update_for_edge.
833 (feasibility_state::feasibility_state): New ctor.
834 (feasibility_state::operator=): New.
835 (feasibility_state::maybe_update_for_edge): Add ctxt param and use
836 it. Fix missing newline when logging state.
837 (impl_run_checkers): Call exploded_graph::detect_infinite_loops.
838 * exploded-graph.h
839 (impl_region_model_context::impl_region_model_context): Add
840 out_could_have_done_work param to both ctors.
841 (impl_region_model_context::maybe_did_work): New decl.
842 (impl_region_model_context::checking_for_infinite_loop_p): New.
843 (impl_region_model_context::on_unusable_in_infinite_loop): New.
844 (impl_region_model_context::m_out_could_have_done_work): New
845 field.
846 (exploded_node::on_stmt): Add "out_could_have_done_work" param.
847 (exploded_edge::exploded_edge): Add "could_do_work" param.
848 (exploded_edge::could_do_work_p): New accessor.
849 (exploded_edge::m_could_do_work_p): New field.
850 (exploded_graph::add_edge): Add "could_do_work" param.
851 (exploded_graph::detect_infinite_loops): New decl.
852 (feasibility_state::feasibility_state): New ctor.
853 (feasibility_state::operator=): New decl.
854 (feasibility_state::maybe_update_for_edge): Add ctxt param.
855 * infinite-loop.cc: New file.
856 * program-state.cc (program_state::on_edge): Log the rejected
857 constraint when region_model::maybe_update_for_edge fails.
858 * region-model.cc (region_model::on_assignment): Treat any writes
859 other than to the stack as "doing work".
860 (region_model::on_stmt_pre): Treat all asm stmts as "doing work".
861 (region_model::on_call_post): Likewise for all calls to functions
862 with unknown side effects.
863 (region_model::handle_phi): Add svals_changing_meaning param.
864 Mark widening svalue in phi nodes as changing meaning.
865 (unusable_in_infinite_loop_constraint_p): New.
866 (region_model::add_constraint): If we're checking for an infinite
867 loop, bail out on unusable svalues, or if we don't have a definite
868 true/false for the constraint.
869 (region_model::update_for_phis): Gather all svalues changing
870 meaning in phi nodes, and purge constraints involving them.
871 (region_model::replay_call_summary): Treat all call summaries as
872 doing work.
873 (region_model::can_merge_with_p): Purge constraints involving
874 svalues that change meaning.
875 (model_merger::on_widening_reuse): New.
876 (test_iteration_1): Likewise.
877 (selftest::test_iteration_1): Remove assertion that model6 "knows"
878 that i < 157.
879 * region-model.h (region_model::handle_phi): Add
880 svals_changing_meaning param
881 (region_model_context::maybe_did_work): New pure virtual func.
882 (region_model_context::checking_for_infinite_loop_p): Likewise.
883 (region_model_context::on_unusable_in_infinite_loop): Likewise.
884 (noop_region_model_context::maybe_did_work): Implement.
885 (noop_region_model_context::checking_for_infinite_loop_p):
886 Likewise.
887 (noop_region_model_context::on_unusable_in_infinite_loop):
888 Likewise.
889 (region_model_context_decorator::maybe_did_work): Implement.
890 (region_model_context_decorator::checking_for_infinite_loop_p):
891 Likewise.
892 (region_model_context_decorator::on_unusable_in_infinite_loop):
893 Likewise.
894 (model_merger::on_widening_reuse): New decl.
895 (model_merger::m_svals_changing_meaning): New field.
896 * sm-signal.cc (register_signal_handler::impl_transition): Assume
897 the edge "does work".
898 * supergraph.cc (supernode::get_start_location): Use CFG edge's
899 goto_locus if available.
900 (supernode::get_end_location): Likewise.
901 (cfg_superedge::dump_label_to_pp): Dump edges with a "goto_locus"
902 * supergraph.h (cfg_superedge::get_goto_locus): New.
903 * svalue.cc (svalue::can_merge_p): Call on_widening_reuse for
904 widening values.
905 (involvement_visitor::visit_widening_svalue): New.
906 (svalue::involves_p): Update assertion to allow widening svalues.
908 2023-11-14 David Malcolm <dmalcolm@redhat.com>
910 PR analyzer/103533
911 * sm-taint.cc: Remove "experimental" from comment.
912 * sm.cc (make_checkers): Always add taint state machine.
914 2023-11-04 David Malcolm <dmalcolm@redhat.com>
916 * bounds-checking.cc: Update for changes to diagnostic_context.
918 2023-11-02 David Malcolm <dmalcolm@redhat.com>
920 PR analyzer/112317
921 * access-diagram.cc (class x_aligned_x_ruler_widget): Eliminate
922 unused field "m_col_widths".
923 (access_diagram_impl::add_valid_vs_invalid_ruler): Update for
924 above change.
925 * region-model.cc
926 (check_one_function_attr_null_terminated_string_arg): Remove
927 unused variables "cd_unchecked", "strlen_sval", and
928 "limited_sval".
929 * region-model.h (region_model_context_decorator::warn): Add
930 missing "override".
932 2023-10-31 David Malcolm <dmalcolm@redhat.com>
934 * record-layout.cc: New file, based on material in region-model.cc.
935 * record-layout.h: Likewise.
936 * region-model.cc: Include "analyzer/record-layout.h".
937 (class record_layout): Move to record-layout.cc and .h
939 2023-10-26 David Malcolm <dmalcolm@redhat.com>
941 * region-model.cc
942 (region_model::check_external_function_for_access_attr): Split
943 out, replacing with...
944 (region_model::check_function_attr_access): ...this new function
945 and...
946 (region_model::check_function_attrs): ...this new function.
947 (region_model::check_one_function_attr_null_terminated_string_arg):
948 New.
949 (region_model::check_function_attr_null_terminated_string_arg):
950 New.
951 (region_model::handle_unrecognized_call): Update for renaming of
952 check_external_function_for_access_attr to check_function_attrs.
953 (region_model::check_for_null_terminated_string_arg): Add return
954 value to one overload. Make both overloads const.
955 * region-model.h: Include "stringpool.h" and "attribs.h".
956 (region_model::check_for_null_terminated_string_arg): Add return
957 value to one overload. Make both overloads const.
958 (region_model::check_external_function_for_access_attr): Delete
959 decl.
960 (region_model::check_function_attr_access): New decl.
961 (region_model::check_function_attr_null_terminated_string_arg):
962 New decl.
963 (region_model::check_one_function_attr_null_terminated_string_arg):
964 New decl.
965 (region_model::check_function_attrs): New decl.
967 2023-10-09 David Malcolm <dmalcolm@redhat.com>
969 * access-diagram.cc (boundaries::add): Explicitly state
970 "boundaries::" scope for "kind" enum.
972 2023-10-08 David Malcolm <dmalcolm@redhat.com>
974 PR analyzer/111155
975 * access-diagram.cc (boundaries::boundaries): Add logger param
976 (boundaries::add): Add logging.
977 (boundaries::get_hard_boundaries_in_range): New.
978 (boundaries::m_logger): New field.
979 (boundaries::get_table_x_for_offset): Make public.
980 (class svalue_spatial_item): New.
981 (class compound_svalue_spatial_item): New.
982 (add_ellipsis_to_gaps): New.
983 (valid_region_spatial_item::valid_region_spatial_item): Add theme
984 param. Initialize m_boundaries, m_existing_sval, and
985 m_existing_sval_spatial_item.
986 (valid_region_spatial_item::add_boundaries): Set m_boundaries.
987 Add boundaries for any m_existing_sval_spatial_item.
988 (valid_region_spatial_item::add_array_elements_to_table): Rewrite
989 creation of min/max index in terms of
990 maybe_add_array_index_to_table. Rewrite ellipsis code using
991 add_ellipsis_to_gaps. Add index values for any hard boundaries
992 within the valid region.
993 (valid_region_spatial_item::maybe_add_array_index_to_table): New,
994 based on code formerly in add_array_elements_to_table.
995 (valid_region_spatial_item::make_table): Make use of
996 m_existing_sval_spatial_item, if any.
997 (valid_region_spatial_item::m_boundaries): New field.
998 (valid_region_spatial_item::m_existing_sval): New field.
999 (valid_region_spatial_item::m_existing_sval_spatial_item): New
1000 field.
1001 (class svalue_spatial_item): Rename to...
1002 (class written_svalue_spatial_item): ...this.
1003 (class string_region_spatial_item): Rename to..
1004 (class string_literal_spatial_item): ...this. Add "kind".
1005 (string_literal_spatial_item::add_boundaries): Use m_kind to
1006 determine kind of boundary. Update for renaming of m_actual_bits
1007 to m_bits.
1008 (string_literal_spatial_item::make_table): Likewise. Support not
1009 displaying a row for byte indexes, and not displaying a row for
1010 the type.
1011 (string_literal_spatial_item::add_column_for_byte): Make byte index
1012 row optional.
1013 (svalue_spatial_item::make): Convert to...
1014 (make_written_svalue_spatial_item): ...this.
1015 (make_existing_svalue_spatial_item): New.
1016 (access_diagram_impl::access_diagram_impl): Pass theme to
1017 m_valid_region_spatial_item ctor. Update for renaming of
1018 m_svalue_spatial_item.
1019 (access_diagram_impl::find_boundaries): Pass logger to boundaries.
1020 Update for renaming of...
1021 (access_diagram_impl::m_svalue_spatial_item): Rename to...
1022 (access_diagram_impl::m_written_svalue_spatial_item): ...this.
1024 2023-10-03 David Malcolm <dmalcolm@redhat.com>
1026 * analyzer-logging.cc (logger::log_va_partial): Use text_info
1027 ctor.
1028 * analyzer.cc (make_label_text): Likewise.
1029 (make_label_text_n): Likewise.
1030 * pending-diagnostic.cc (evdesc::event_desc::formatted_print):
1031 Likewise.
1033 2023-10-02 David Malcolm <dmalcolm@redhat.com>
1035 * program-point.cc: Update for grouping of source printing fields
1036 within diagnostic_context.
1038 2023-09-15 David Malcolm <dmalcolm@redhat.com>
1040 * analyzer.cc (get_stmt_location): Handle null stmt.
1041 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic): Copy
1042 m_loc from ploc.
1043 (saved_diagnostic::operator==): Compare m_loc.
1044 (saved_diagnostic::calc_best_epath): Only use m_stmt_finder if
1045 m_loc is unknown.
1046 (dedupe_key::dedupe_key): Initialize m_loc.
1047 (dedupe_key::operator==): Compare m_loc.
1048 (dedupe_key::get_location): Use m_loc if it's known.
1049 (dedupe_key::m_loc): New field.
1050 (diagnostic_manager::emit_saved_diagnostic): Only call
1051 get_emission_location if m_loc is unknown, preferring to use m_loc
1052 if it's available.
1053 * diagnostic-manager.h (saved_diagnostic::m_loc): New field.
1054 (pending_location::pending_location): Initialize m_loc. Add
1055 overload taking a location_t rather than a stmt/stmt_finder.
1056 (pending_location::m_loc): New field.
1058 2023-09-15 David Malcolm <dmalcolm@redhat.com>
1060 * analyzer.h (struct pending_location): New forward decl.
1061 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic):
1062 Replace params "enode", "snode", "stmt", and "stmt_finder" with
1063 "ploc".
1064 (diagnostic_manager::add_diagnostic): Likewise for both overloads.
1065 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic):
1066 Likewise.
1067 (struct pending_location): New.
1068 (diagnostic_manager::add_diagnostic): Replace params "enode",
1069 "snode", "stmt", and "stmt_finder" with "ploc".
1070 * engine.cc (impl_region_model_context::warn): Update call to
1071 add_diagnostic for above change.
1072 (impl_sm_context::warn): Likewise.
1073 (impl_region_model_context::on_state_leak): Likewise.
1074 * infinite-recursion.cc
1075 (exploded_graph::detect_infinite_recursion): Likewise.
1077 2023-09-15 David Malcolm <dmalcolm@redhat.com>
1079 * region-model.cc (region_model::get_gassign_result): Handle
1080 volatile ops by using a conjured_svalue.
1082 2023-09-14 David Malcolm <dmalcolm@redhat.com>
1084 * checker-event.h (checker_event::get_thread_id): New.
1085 * checker-path.h (class checker_path): Implement thread-related
1086 vfuncs via a single simple_diagnostic_thread instance named
1087 "main".
1089 2023-09-14 David Malcolm <dmalcolm@redhat.com>
1091 * diagnostic-manager.cc (compatible_epath_p): Fix missing return.
1093 2023-09-14 David Malcolm <dmalcolm@redhat.com>
1095 * diagnostic-manager.cc (process_worklist_item): Use
1096 std::unique_ptr rather than plain rejected_constraint *.
1097 * engine.cc (exploded_path::feasible_p): Likewise.
1098 (feasibility_state::maybe_update_for_edge): Likewise.
1099 * exploded-graph.h (feasibility_problem::feasibility_problem):
1100 Likewise.
1101 (feasibility_problem::~feasibility_problem): Delete.
1102 (feasibility_problem::m_rc): Use std::unique_ptr.
1103 (feasibility_state::maybe_update_for_edge): Likewise.
1104 * feasible-graph.cc (feasible_graph::add_feasibility_problem):
1105 Likewise.
1106 * feasible-graph.h (class infeasible_node): Likewise.
1107 (feasible_graph::add_feasibility_problem): Likewise.
1108 * region-model.cc (region_model::add_constraint): Likewise.
1109 (region_model::maybe_update_for_edge): Likewise.
1110 (region_model::apply_constraints_for_gcond): Likewise.
1111 (region_model::apply_constraints_for_gswitch): Likewise.
1112 (region_model::apply_constraints_for_exception): Likewise.
1113 * region-model.h (class region_model): Likewise for decls.
1115 2023-09-09 benjamin priour <vultkayn@gcc.gnu.org>
1117 PR analyzer/96395
1118 * region-model.cc
1119 (region_model::add_constraints_from_binop): binop_svalues around
1120 LT_EXPR, LE_EXPR, GT_EXPR, GE_EXPR are now unwrapped.
1122 2023-09-07 David Malcolm <dmalcolm@redhat.com>
1124 PR analyzer/110529
1125 * program-point.cc (program_point::on_edge): Don't reject
1126 EDGE_ABNORMAL for computed gotos.
1127 * region-model.cc (region_model::maybe_update_for_edge): Handle
1128 computed goto statements.
1129 (region_model::apply_constraints_for_ggoto): New.
1130 * region-model.h (region_model::apply_constraints_for_ggoto): New decl.
1131 * supergraph.cc (supernode::get_label): New.
1132 * supergraph.h (supernode::get_label): New decl.
1134 2023-09-07 benjamin priour <vultkayn@gcc.gnu.org>
1135 David Malcolm <dmalcolm@redhat.com>
1137 PR analyzer/110830
1138 * diagnostic-manager.cc
1139 (compatible_epaths_p): New function.
1140 (saved_diagnostic::supercedes_p): Now calls the above
1141 to determine if the diagnostics do overlap and the superseding
1142 may proceed.
1144 2023-09-07 David Malcolm <dmalcolm@redhat.com>
1146 * region-model.h: fix -Wunused-parameter warnings
1148 2023-09-06 David Malcolm <dmalcolm@redhat.com>
1150 PR analyzer/105899
1151 * kf.cc (class kf_strstr): New.
1152 (kf_strstr::impl_call_post): New.
1153 (register_known_functions): Register it.
1155 2023-09-06 David Malcolm <dmalcolm@redhat.com>
1157 PR analyzer/105899
1158 * kf.cc (class kf_strncpy): New.
1159 (kf_strncpy::impl_call_post): New.
1160 (register_known_functions): Register it.
1161 * region-model.cc (region_model::read_bytes): Handle unknown
1162 number of bytes.
1164 2023-09-06 David Malcolm <dmalcolm@redhat.com>
1166 * kf.cc (kf_calloc::impl_call_pre): Pass ctxt to zero_fill_region.
1167 (kf_memset::impl_call_pre): Move responsibility for calling
1168 check_region_for_write to fill_region.
1169 * region-model.cc (region_model::on_assignment): Pass ctxt to
1170 zero_fill_region.
1171 (region_model::fill_region): Add "ctxt" param, using it to call
1172 check_region_for_write.
1173 (region_model::zero_fill_region): Likewise.
1174 * region-model.h (region_model::fill_region): Add "ctxt" param.
1175 (region_model::zero_fill_region): Likewise.
1177 2023-09-01 benjamin priour <priour.be@gmail.com>
1179 PR analyzer/105948
1180 PR analyzer/94355
1181 * analyzer.h (is_placement_new_p): New declaration.
1182 * call-details.cc
1183 (call_details::deref_ptr_arg): New function.
1184 Dereference the argument at given index if possible.
1185 * call-details.h: Declaration of the above function.
1186 * kf-lang-cp.cc (is_placement_new_p): Returns true if the gcall
1187 is recognized as a placement new.
1188 (kf_operator_delete::impl_call_post): Unbinding a region and its
1189 descendents now poisons with POISON_KIND_DELETED.
1190 (register_known_functions_lang_cp): Known function "operator
1191 delete" is now registered only once independently of its number of
1192 arguments.
1193 * region-model.cc (region_model::eval_condition): Now
1194 recursively calls itself if any of the operand is wrapped in a
1195 cast.
1196 * sm-malloc.cc (malloc_state_machine::on_stmt):
1197 Add placement new recognition.
1198 * svalue.cc (poison_kind_to_str): Wording for the new PK.
1199 * svalue.h (enum poison_kind): Add value POISON_KIND_DELETED.
1201 2023-08-31 Francois-Xavier Coudert <fxcoudert@gcc.gnu.org>
1203 * kf.cc: Change spelling to macOS.
1205 2023-08-30 Eric Feng <ef2648@columbia.edu>
1207 PR analyzer/107646
1208 * engine.cc (impl_region_model_context::warn): New optional
1209 parameter.
1210 * exploded-graph.h (class impl_region_model_context): Likewise.
1211 * region-model.cc (region_model::pop_frame): New callback
1212 feature for region_model::pop_frame.
1213 * region-model.h (struct append_regions_cb_data): Likewise.
1214 (class region_model): Likewise.
1215 (class region_model_context): New optional parameter.
1216 (class region_model_context_decorator): Likewise.
1218 2023-08-30 Francois-Xavier Coudert <fxcoudert@gcc.gnu.org>
1220 * region-model.cc: Define INCLUDE_ALGORITHM.
1222 2023-08-29 David Malcolm <dmalcolm@redhat.com>
1224 PR analyzer/99860
1225 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
1226 selftest::analyzer_ranges_cc_tests.
1227 * analyzer-selftests.h (selftest::run_analyzer_selftests): New
1228 decl.
1229 * analyzer.opt (Wanalyzer-overlapping-buffers): New option.
1230 * call-details.cc: Include "analyzer/ranges.h" and "make-unique.h".
1231 (class overlapping_buffers): New.
1232 (call_details::complain_about_overlap): New.
1233 * call-details.h (call_details::complain_about_overlap): New decl.
1234 * kf.cc (kf_memcpy_memmove::impl_call_pre): Call
1235 cd.complain_about_overlap for memcpy and memcpy_chk.
1236 (kf_strcat::impl_call_pre): Call cd.complain_about_overlap.
1237 (kf_strcpy::impl_call_pre): Likewise.
1238 * ranges.cc: New file.
1239 * ranges.h: New file.
1241 2023-08-29 David Malcolm <dmalcolm@redhat.com>
1243 PR analyzer/105899
1244 * kf.cc (kf_strdup::impl_call_pre): Set size of
1245 dynamically-allocated buffer. Simulate copying the string from
1246 the source region to the new buffer.
1248 2023-08-27 benjamin priour <vultkayn@gcc.gnu.org>
1250 PR analyzer/96395
1251 * analyzer.h (class known_function): Add virtual casts
1252 to builtin_known_function.
1253 (class builtin_known_function): New subclass of known_function
1254 for builtins.
1255 * kf.cc (class kf_alloca): Now derived from
1256 builtin_known_function.
1257 (class kf_calloc): Likewise.
1258 (class kf_free): Likewise.
1259 (class kf_malloc): Likewise.
1260 (class kf_memcpy_memmove): Likewise.
1261 (class kf_memset): Likewise.
1262 (class kf_realloc): Likewise.
1263 (class kf_strchr): Likewise.
1264 (class kf_sprintf): Likewise.
1265 (class kf_strcat): Likewise.
1266 (class kf_strcpy): Likewise.
1267 (class kf_strdup): Likewise.
1268 (class kf_strlen): Likewise.
1269 (class kf_strndup): Likewise.
1270 (register_known_functions): Builtins are now registered as
1271 known_functions by name rather than by their BUILTIN_CODE.
1272 * known-function-manager.cc (get_normal_builtin): New overload.
1273 * known-function-manager.h: New overload declaration.
1274 * region-model.cc (region_model::get_builtin_kf): New function.
1275 * region-model.h (class region_model): Add declaration of
1276 get_builtin_kf.
1277 * sm-fd.cc: For called recognized as builtins, use the
1278 attributes of that builtin as defined in gcc/builtins.def
1279 rather than the user's.
1280 * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise.
1282 2023-08-25 David Malcolm <dmalcolm@redhat.com>
1284 * access-diagram.cc (class string_region_spatial_item): Remove
1285 assumption that the string is written to the start of the cluster.
1287 2023-08-24 David Malcolm <dmalcolm@redhat.com>
1289 PR analyzer/105899
1290 * call-details.cc
1291 (call_details::check_for_null_terminated_string_arg): Split into
1292 overloads, one taking just an arg_idx, the other a new
1293 "include_terminator" param.
1294 * call-details.h: Likewise.
1295 * kf.cc (class kf_strcat): New.
1296 (kf_strcpy::impl_call_pre): Update for change to
1297 check_for_null_terminated_string_arg.
1298 (register_known_functions): Register kf_strcat.
1299 * region-model.cc
1300 (region_model::check_for_null_terminated_string_arg): Split into
1301 overloads, one taking just an arg_idx, the other a new
1302 "include_terminator" param. When returning an svalue, handle
1303 "include_terminator" being false by subtracting one.
1304 * region-model.h
1305 (region_model::check_for_null_terminated_string_arg): Split into
1306 overloads, one taking just an arg_idx, the other a new
1307 "include_terminator" param.
1309 2023-08-24 David Malcolm <dmalcolm@redhat.com>
1311 PR analyzer/105899
1312 * region-model.cc (fragment::has_null_terminator): Handle
1313 SK_BITS_WITHIN.
1315 2023-08-24 David Malcolm <dmalcolm@redhat.com>
1317 PR analyzer/105899
1318 * region-model-manager.cc
1319 (region_model_manager::get_or_create_initial_value): Simplify
1320 INIT_VAL(ELEMENT_REG(STRING_REG), CONSTANT_SVAL) to
1321 CONSTANT_SVAL(STRING[N]).
1323 2023-08-24 David Malcolm <dmalcolm@redhat.com>
1325 PR analyzer/105899
1326 * region-model.cc (fragment::has_null_terminator): Move STRING_CST
1327 handling to fragment::string_cst_has_null_terminator; also use it to
1328 handle INIT_VAL(STRING_REG).
1329 (fragment::string_cst_has_null_terminator): New, from above.
1331 2023-08-24 David Malcolm <dmalcolm@redhat.com>
1333 * kf.cc (kf_memcpy_memmove::impl_call_pre): Reimplement using
1334 region_model::copy_bytes.
1335 * region-model.cc (region_model::read_bytes): New.
1336 (region_model::copy_bytes): New.
1337 * region-model.h (region_model::read_bytes): New decl.
1338 (region_model::copy_bytes): New decl.
1340 2023-08-24 David Malcolm <dmalcolm@redhat.com>
1342 PR analyzer/105899
1343 * region-model.cc (region_model::get_string_size): Delete both.
1344 * region-model.h (region_model::get_string_size): Delete both
1345 decls.
1347 2023-08-24 David Malcolm <dmalcolm@redhat.com>
1349 PR analyzer/105899
1350 * kf.cc (kf_strcpy::impl_call_pre): Reimplement using
1351 check_for_null_terminated_string_arg.
1352 * region-model.cc (region_model::get_store_bytes): Shortcut
1353 reading all of a string_region.
1354 (region_model::scan_for_null_terminator): Use get_store_value for
1355 the bytes rather than "unknown" when returning an unknown length.
1356 (region_model::write_bytes): New.
1357 * region-model.h (region_model::write_bytes): New decl.
1359 2023-08-24 David Malcolm <dmalcolm@redhat.com>
1361 PR analyzer/105899
1362 * region-model.cc (iterable_cluster::iterable_cluster): Add
1363 symbolic binding keys to m_symbolic_bindings.
1364 (iterable_cluster::has_symbolic_bindings_p): New.
1365 (iterable_cluster::m_symbolic_bindings): New field.
1366 (region_model::scan_for_null_terminator): Treat clusters with
1367 symbolic bindings as having unknown strlen.
1369 2023-08-24 David Malcolm <dmalcolm@redhat.com>
1371 * engine.cc (impl_path_context::impl_path_context): Add logger
1372 param.
1373 (impl_path_context::bifurcate): Add log message.
1374 (impl_path_context::terminate_path): Likewise.
1375 (impl_path_context::m_logger): New field.
1376 (exploded_graph::process_node): Pass logger to path_ctxt ctor.
1378 2023-08-22 David Malcolm <dmalcolm@redhat.com>
1380 PR analyzer/105899
1381 * kf-analyzer.cc (class kf_analyzer_get_strlen): Move to kf.cc.
1382 (register_known_analyzer_functions): Use make_kf_strlen.
1383 * kf.cc (class kf_strlen::impl_call_pre): Replace with
1384 implementation of kf_analyzer_get_strlen from kf-analyzer.cc.
1385 Handle "UNKNOWN" return from check_for_null_terminated_string_arg
1386 by falling back to a conjured svalue.
1387 (make_kf_strlen): New.
1388 (register_known_functions): Use make_kf_strlen.
1389 * known-function-manager.h (make_kf_strlen): New decl.
1391 2023-08-22 David Malcolm <dmalcolm@redhat.com>
1393 PR analyzer/105899
1394 * call-details.cc (call_details::call_details): New ctor.
1395 * call-details.h (call_details::call_details): New ctor decl.
1396 (struct call_arg_details): Move here from region-model.cc.
1397 * region-model.cc (region_model::check_call_format_attr): New.
1398 (region_model::check_call_args): Call it.
1399 (struct call_arg_details): Move it to call-details.h.
1400 * region-model.h (region_model::check_call_format_attr): New decl.
1402 2023-08-22 David Malcolm <dmalcolm@redhat.com>
1404 * kf.cc (class kf_fopen): New.
1405 (register_known_functions): Register it.
1407 2023-08-22 David Malcolm <dmalcolm@redhat.com>
1409 PR analyzer/105899
1410 * analyzer.opt (Wanalyzer-unterminated-string): Delete.
1411 * call-details.cc
1412 (call_details::check_for_null_terminated_string_arg): Convert
1413 return type from void to const svalue *. Add param "out_sval".
1414 * call-details.h
1415 (call_details::check_for_null_terminated_string_arg): Likewise.
1416 * kf-analyzer.cc (kf_analyzer_get_strlen::impl_call_pre): Wire up
1417 to result of check_for_null_terminated_string_arg.
1418 * region-model.cc (get_strlen): Delete.
1419 (class unterminated_string_arg): Delete.
1420 (struct fragment): New.
1421 (class iterable_cluster): New.
1422 (region_model::get_store_bytes): New.
1423 (get_tree_for_byte_offset): New.
1424 (region_model::scan_for_null_terminator): New.
1425 (region_model::check_for_null_terminated_string_arg): Convert
1426 return type from void to const svalue *. Add param "out_sval".
1427 Reimplement in terms of scan_for_null_terminator, dropping the
1428 special-case for -Wanalyzer-unterminated-string.
1429 * region-model.h (region_model::get_store_bytes): New decl.
1430 (region_model::scan_for_null_terminator): New decl.
1431 (region_model::check_for_null_terminated_string_arg): Convert
1432 return type from void to const svalue *. Add param "out_sval".
1433 * store.cc (concrete_binding::get_byte_range): New.
1434 * store.h (concrete_binding::get_byte_range): New decl.
1435 (store_manager::get_concrete_binding): New overload.
1437 2023-08-22 David Malcolm <dmalcolm@redhat.com>
1439 * region-model.cc (region_model_context_decorator::add_event):
1440 Handle m_inner being NULL.
1441 * region-model.h (class region_model_context_decorator): Likewise.
1442 (annotating_context::warn): Likewise.
1444 2023-08-22 David Malcolm <dmalcolm@redhat.com>
1446 * diagnostic-manager.cc (saved_diagnostic::add_event): New.
1447 (saved_diagnostic::add_any_saved_events): New.
1448 (diagnostic_manager::add_event): New.
1449 (dedupe_winners::emit_best): New.
1450 (diagnostic_manager::emit_saved_diagnostic): Make "sd" param
1451 non-const. Call saved_diagnostic::add_any_saved_events.
1452 * diagnostic-manager.h (saved_diagnostic::add_event): New decl.
1453 (saved_diagnostic::add_any_saved_events): New decl.
1454 (saved_diagnostic::m_saved_events): New field.
1455 (diagnostic_manager::add_event): New decl.
1456 (diagnostic_manager::emit_saved_diagnostic): Make "sd" param
1457 non-const.
1458 * engine.cc (impl_region_model_context::add_event): New.
1459 * exploded-graph.h (impl_region_model_context::add_event): New decl.
1460 * region-model.cc
1461 (noop_region_model_context::add_event): New.
1462 (region_model_context_decorator::add_event): New.
1463 * region-model.h (region_model_context::add_event): New vfunc.
1464 (noop_region_model_context::add_event): New decl.
1465 (region_model_context_decorator::add_event): New decl.
1467 2023-08-22 David Malcolm <dmalcolm@redhat.com>
1469 * region-model.cc
1470 (class check_external_function_for_access_attr::annotating_ctxt):
1471 Convert to an annotating_context.
1472 * region-model.h (class note_adding_context): Rename to...
1473 (class annotating_context): ...this, updating the "warn" method.
1474 (note_adding_context::make_note): Replace with...
1475 (annotating_context::add_annotations): ...this.
1477 2023-08-14 benjamin priour <vultkayn@gcc.gnu.org>
1479 PR analyzer/110543
1480 * analyzer.opt: Add new option.
1481 * diagnostic-manager.cc
1482 (diagnostic_manager::prune_path): Call prune_system_headers.
1483 (prune_frame): New function that deletes all events in a frame.
1484 (diagnostic_manager::prune_system_headers): New function.
1485 * diagnostic-manager.h: Add prune_system_headers declaration.
1487 2023-08-11 David Malcolm <dmalcolm@redhat.com>
1489 PR analyzer/105899
1490 * analyzer.opt (Wanalyzer-unterminated-string): New.
1491 * call-details.cc
1492 (call_details::check_for_null_terminated_string_arg): New.
1493 * call-details.h
1494 (call_details::check_for_null_terminated_string_arg): New decl.
1495 * kf-analyzer.cc (class kf_analyzer_get_strlen): New.
1496 (register_known_analyzer_functions): Register it.
1497 * kf.cc (kf_error::impl_call_pre): Check that format arg is a
1498 valid null-terminated string.
1499 (kf_putenv::impl_call_pre): Likewise for the sole param.
1500 (kf_strchr::impl_call_pre): Likewise for the first param.
1501 (kf_strcpy::impl_call_pre): Likewise for the second param.
1502 (kf_strdup::impl_call_pre): Likewise for the sole param.
1503 * region-model.cc (get_strlen): New.
1504 (struct call_arg_details): New.
1505 (inform_about_expected_null_terminated_string_arg): New.
1506 (class unterminated_string_arg): New.
1507 (region_model::check_for_null_terminated_string_arg): New.
1508 * region-model.h
1509 (region_model::check_for_null_terminated_string_arg): New decl.
1511 2023-08-11 Eric Feng <ef2648@columbia.edu>
1513 PR analyzer/107646
1514 * call-details.h: New function.
1515 * region-model.cc (region_model::get_or_create_region_for_heap_alloc):
1516 New optional parameters.
1517 * region-model.h (class region_model): New optional parameters.
1518 * sm-malloc.cc (on_realloc_with_move): New function.
1519 (region_model::transition_ptr_sval_non_null): New function.
1521 2023-08-09 David Malcolm <dmalcolm@redhat.com>
1523 * analyzer.h (class pure_known_function_with_default_return): New
1524 subclass.
1525 * call-details.cc (const_fn_p): Move here from region-model.cc.
1526 (maybe_get_const_fn_result): Likewise.
1527 (get_result_size_in_bytes): Likewise.
1528 (call_details::set_any_lhs_with_defaults): New function, based on
1529 code in region_model::on_call_pre.
1530 * call-details.h (call_details::set_any_lhs_with_defaults): New
1531 decl.
1532 * diagnostic-manager.cc
1533 (diagnostic_manager::emit_saved_diagnostic): Log the index of the
1534 saved_diagnostic.
1535 * kf.cc (pure_known_function_with_default_return::impl_call_pre):
1536 New.
1537 (kf_memset::impl_call_pre): Set the LHS to the first param.
1538 (kf_putenv::impl_call_pre): Call cd.set_any_lhs_with_defaults.
1539 (kf_sprintf::impl_call_pre): Call cd.set_any_lhs_with_defaults.
1540 (class kf_stack_restore): Derive from
1541 pure_known_function_with_default_return.
1542 (class kf_stack_save): Likewise.
1543 (kf_strlen::impl_call_pre): Call cd.set_any_lhs_with_defaults.
1544 * region-model-reachability.cc (reachable_regions::handle_sval):
1545 Remove logic for symbolic regions for pointers.
1546 * region-model.cc (region_model::canonicalize): Remove purging of
1547 dynamic extents workaround for surplus values from
1548 region_model::on_call_pre's default LHS code.
1549 (const_fn_p): Move to call-details.cc.
1550 (maybe_get_const_fn_result): Likewise.
1551 (get_result_size_in_bytes): Likewise.
1552 (region_model::update_for_nonzero_return): Call
1553 cd.set_any_lhs_with_defaults.
1554 (region_model::on_call_pre): Remove the assignment to the LHS of a
1555 default return value, instead requiring all known_function
1556 implementations to write to any LHS of the call. Use
1557 cd.set_any_lhs_with_defaults on the non-kf paths.
1558 * sm-fd.cc (kf_socket::outcome_of_socket::update_model): Use
1559 cd.set_any_lhs_with_defaults when failing to get at fd state.
1560 (kf_bind::outcome_of_bind::update_model): Likewise.
1561 (kf_listen::outcome_of_listen::update_model): Likewise.
1562 (kf_accept::outcome_of_accept::update_model): Likewise.
1563 (kf_connect::outcome_of_connect::update_model): Likewise.
1564 (kf_read::impl_call_pre): Use cd.set_any_lhs_with_defaults.
1565 * sm-file.cc (class kf_stdio_output_fn): Derive from
1566 pure_known_function_with_default_return.
1567 (class kf_ferror): Likewise.
1568 (class kf_fileno): Likewise.
1569 (kf_fgets::impl_call_pre): Use cd.set_any_lhs_with_defaults.
1570 (kf_read::impl_call_pre): Likewise.
1571 (class kf_getc): Derive from
1572 pure_known_function_with_default_return.
1573 (class kf_getchar): Likewise.
1574 * varargs.cc (kf_va_arg::impl_call_pre): Use
1575 cd.set_any_lhs_with_defaults.
1577 2023-08-04 David Malcolm <dmalcolm@redhat.com>
1579 PR analyzer/110426
1580 * bounds-checking.cc (region_model::check_region_bounds): Handle
1581 symbolic base regions.
1582 * call-details.cc: Include "stringpool.h" and "attribs.h".
1583 (call_details::lookup_function_attribute): New function.
1584 * call-details.h (call_details::lookup_function_attribute): New
1585 function decl.
1586 * region-model-manager.cc
1587 (region_model_manager::maybe_fold_binop): Add reference to
1588 PR analyzer/110902.
1589 * region-model-reachability.cc (reachable_regions::handle_sval):
1590 Add symbolic regions for pointers that are conjured svalues for
1591 the LHS of a stmt.
1592 * region-model.cc (region_model::canonicalize): Purge dynamic
1593 extents for regions that aren't referenced.
1594 (get_result_size_in_bytes): New function.
1595 (region_model::on_call_pre): Use get_result_size_in_bytes and
1596 potentially set the dynamic extents of the region pointed to by
1597 the return value.
1598 (region_model::deref_rvalue): Add param "add_nonnull_constraint"
1599 and use it to conditionalize adding the constraint.
1600 (pending_diagnostic_subclass::dubious_allocation_size): Add "stmt"
1601 param to both ctors and use it to initialize new "m_stmt" field.
1602 (pending_diagnostic_subclass::operator==): Use m_stmt; don't use
1603 m_lhs or m_rhs.
1604 (pending_diagnostic_subclass::m_stmt): New field.
1605 (region_model::check_region_size): Generalize to any kind of
1606 pointer svalue by using deref_rvalue rather than checking for
1607 region_svalue. Pass stmt to dubious_allocation_size ctor.
1608 * region-model.h (region_model::deref_rvalue): Add param
1609 "add_nonnull_constraint".
1610 * svalue.cc (conjured_svalue::lhs_value_p): New function.
1611 * svalue.h (conjured_svalue::lhs_value_p): New decl.
1613 2023-08-04 David Malcolm <dmalcolm@redhat.com>
1615 * svalue.cc (region_svalue::dump_to_pp): Support NULL type.
1616 (constant_svalue::dump_to_pp): Likewise.
1617 (initial_svalue::dump_to_pp): Likewise.
1618 (conjured_svalue::dump_to_pp): Likewise. Fix missing print of the
1619 type.
1621 2023-08-03 David Malcolm <dmalcolm@redhat.com>
1623 PR analyzer/110882
1624 * region.cc (int_size_in_bits): Fail on zero-sized types.
1626 2023-08-02 Eric Feng <ef2648@columbia.edu>
1628 PR analyzer/107646
1629 * analyzer-language.cc (run_callbacks): New function.
1630 (on_finish_translation_unit): New function.
1631 * analyzer-language.h (GCC_ANALYZER_LANGUAGE_H): New include.
1632 (class translation_unit): New vfuncs.
1634 2023-07-26 David Malcolm <dmalcolm@redhat.com>
1636 PR analyzer/104940
1637 * region-model-manager.cc
1638 (region_model_manager::region_model_manager): Update for
1639 generalizing region ids to also cover svalues.
1640 (region_model_manager::get_or_create_constant_svalue): Likewise.
1641 (region_model_manager::get_or_create_unknown_svalue): Likewise.
1642 (region_model_manager::create_unique_svalue): Likewise.
1643 (region_model_manager::get_or_create_initial_value): Likewise.
1644 (region_model_manager::get_or_create_setjmp_svalue): Likewise.
1645 (region_model_manager::get_or_create_poisoned_svalue): Likewise.
1646 (region_model_manager::get_ptr_svalue): Likewise.
1647 (region_model_manager::get_or_create_unaryop): Likewise.
1648 (region_model_manager::get_or_create_binop): Likewise.
1649 (region_model_manager::get_or_create_sub_svalue): Likewise.
1650 (region_model_manager::get_or_create_repeated_svalue): Likewise.
1651 (region_model_manager::get_or_create_bits_within): Likewise.
1652 (region_model_manager::get_or_create_unmergeable): Likewise.
1653 (region_model_manager::get_or_create_widening_svalue): Likewise.
1654 (region_model_manager::get_or_create_compound_svalue): Likewise.
1655 (region_model_manager::get_or_create_conjured_svalue): Likewise.
1656 (region_model_manager::get_or_create_asm_output_svalue): Likewise.
1657 (region_model_manager::get_or_create_const_fn_result_svalue):
1658 Likewise.
1659 (region_model_manager::get_region_for_fndecl): Likewise.
1660 (region_model_manager::get_region_for_label): Likewise.
1661 (region_model_manager::get_region_for_global): Likewise.
1662 (region_model_manager::get_field_region): Likewise.
1663 (region_model_manager::get_element_region): Likewise.
1664 (region_model_manager::get_offset_region): Likewise.
1665 (region_model_manager::get_sized_region): Likewise.
1666 (region_model_manager::get_cast_region): Likewise.
1667 (region_model_manager::get_frame_region): Likewise.
1668 (region_model_manager::get_symbolic_region): Likewise.
1669 (region_model_manager::get_region_for_string): Likewise.
1670 (region_model_manager::get_bit_range): Likewise.
1671 (region_model_manager::get_var_arg_region): Likewise.
1672 (region_model_manager::get_region_for_unexpected_tree_code):
1673 Likewise.
1674 (region_model_manager::get_or_create_region_for_heap_alloc):
1675 Likewise.
1676 (region_model_manager::create_region_for_alloca): Likewise.
1677 (region_model_manager::log_stats): Likewise.
1678 * region-model-manager.h (region_model_manager::get_num_regions):
1679 Replace with...
1680 (region_model_manager::get_num_symbols): ...this.
1681 (region_model_manager::alloc_region_id): Replace with...
1682 (region_model_manager::alloc_symbol_id): ...this.
1683 (region_model_manager::m_next_region_id): Replace with...
1684 (region_model_manager::m_next_symbol_id): ...this.
1685 * region-model.cc (selftest::test_get_representative_tree): Update
1686 for generalizing region ids to also cover svalues.
1687 (selftest::test_binop_svalue_folding): Likewise.
1688 (selftest::test_state_merging): Likewise.
1689 * region.cc (region::cmp_ids): Delete, in favor of
1690 symbol::cmp_ids.
1691 (region::region): Update for introduction of symbol base class.
1692 (frame_region::get_region_for_local): Likewise.
1693 (root_region::root_region): Likewise.
1694 (symbolic_region::symbolic_region): Likewise.
1695 * region.h: Replace include of "analyzer/complexity.h" with
1696 "analyzer/symbol.h".
1697 (class region): Make a subclass of symbol.
1698 (region::get_id): Delete in favor of symbol::get_id.
1699 (region::cmp_ids): Delete in favor of symbol::cmp_ids.
1700 (region::get_complexity): Delete in favor of
1701 symbol::get_complexity.
1702 (region::region): Use symbol::id_t for "id" param.
1703 (region::m_complexity): Move field to symbol base class.
1704 (region::m_id): Likewise.
1705 (space_region::space_region): Use symbol::id_t for "id" param.
1706 (frame_region::frame_region): Likewise.
1707 (globals_region::globals_region): Likewise.
1708 (code_region::code_region): Likewise.
1709 (function_region::function_region): Likewise.
1710 (label_region::label_region): Likewise.
1711 (stack_region::stack_region): Likewise.
1712 (heap_region::heap_region): Likewise.
1713 (thread_local_region::thread_local_region): Likewise.
1714 (root_region::root_region): Likewise.
1715 (symbolic_region::symbolic_region): Likewise.
1716 (decl_region::decl_region): Likewise.
1717 (field_region::field_region): Likewise.
1718 (element_region::element_region): Likewise.
1719 (offset_region::offset_region): Likewise.
1720 (sized_region::sized_region): Likewise.
1721 (cast_region::cast_region): Likewise.
1722 (heap_allocated_region::heap_allocated_region): Likewise.
1723 (alloca_region::alloca_region): Likewise.
1724 (string_region::string_region): Likewise.
1725 (bit_range_region::bit_range_region): Likewise.
1726 (var_arg_region::var_arg_region): Likewise.
1727 (errno_region::errno_region): Likewise.
1728 (unknown_region::unknown_region): Likewise.
1729 * svalue.cc (sub_svalue::sub_svalue): Add symbol::id_t param.
1730 (repeated_svalue::repeated_svalue): Likewise.
1731 (bits_within_svalue::bits_within_svalue): Likewise.
1732 (compound_svalue::compound_svalue): Likewise.
1733 * svalue.h: Replace include of "analyzer/complexity.h" with
1734 "analyzer/symbol.h".
1735 (class svalue): Make a subclass of symbol.
1736 (svalue::get_complexity): Delete in favor of
1737 symbol::get_complexity.
1738 (svalue::svalue): Add symbol::id_t param. Update for new base
1739 class.
1740 (svalue::m_complexity): Delete in favor of
1741 symbol::m_complexity.
1742 (region_svalue::region_svalue): Add symbol::id_t param
1743 (constant_svalue::constant_svalue): Likewise.
1744 (unknown_svalue::unknown_svalue): Likewise.
1745 (poisoned_svalue::poisoned_svalue): Likewise.
1746 (setjmp_svalue::setjmp_svalue): Likewise.
1747 (initial_svalue::initial_svalue): Likewise.
1748 (unaryop_svalue::unaryop_svalue): Likewise.
1749 (binop_svalue::binop_svalue): Likewise.
1750 (sub_svalue::sub_svalue): Likewise.
1751 (repeated_svalue::repeated_svalue): Likewise.
1752 (bits_within_svalue::bits_within_svalue): Likewise.
1753 (unmergeable_svalue::unmergeable_svalue): Likewise.
1754 (placeholder_svalue::placeholder_svalue): Likewise.
1755 (widening_svalue::widening_svalue): Likewise.
1756 (compound_svalue::compound_svalue): Likewise.
1757 (conjured_svalue::conjured_svalue): Likewise.
1758 (asm_output_svalue::asm_output_svalue): Likewise.
1759 (const_fn_result_svalue::const_fn_result_svalue): Likewise.
1760 * symbol.cc: New file.
1761 * symbol.h: New file.
1763 2023-07-21 David Malcolm <dmalcolm@redhat.com>
1765 PR analyzer/110455
1766 * region-model.cc (region_model::get_gassign_result): Only check
1767 for bad shift counts when dealing with an integral type.
1769 2023-07-21 David Malcolm <dmalcolm@redhat.com>
1771 PR analyzer/110433
1772 PR middle-end/110612
1773 * access-diagram.cc (class spatial_item): Add virtual dtor.
1775 2023-07-21 David Malcolm <dmalcolm@redhat.com>
1777 PR analyzer/110387
1778 * region.h (struct cast_region::key_t): Support "m_type" being
1779 null by using "m_original_region" for empty/deleted slots.
1781 2023-07-19 David Malcolm <dmalcolm@redhat.com>
1783 PR analyzer/110700
1784 * region-model-manager.cc
1785 (region_model_manager::get_or_create_int_cst): Assert that we have
1786 an integral or pointer type.
1787 * sm-taint.cc (taint_state_machine::check_for_tainted_divisor):
1788 Don't check non-integral types.
1790 2023-06-29 benjamin priour <priour.be@gmail.com>
1792 PR analyzer/110198
1793 * region-model-manager.cc
1794 (region_model_manager::get_or_create_initial_value): Take an
1795 optional boolean value to bypass poisoning checks
1796 * region-model-manager.h: Update declaration of the above function.
1797 * region-model.cc (region_model::get_store_value): No longer returns
1798 on OOB, but rather gives a boolean to get_or_create_initial_value.
1799 (region_model::check_region_access): Update docstring.
1800 (region_model::check_region_for_write): Update docstring.
1802 2023-06-24 David Malcolm <dmalcolm@redhat.com>
1804 * access-diagram.cc: Add #define INCLUDE_VECTOR.
1805 * bounds-checking.cc: Likewise.
1807 2023-06-22 David Malcolm <dmalcolm@redhat.com>
1809 PR analyzer/106626
1810 * access-diagram.cc: New file.
1811 * access-diagram.h: New file.
1812 * analyzer.h (class region_offset): Add default ctor.
1813 (region_offset::make_byte_offset): New decl.
1814 (region_offset::concrete_p): New.
1815 (region_offset::get_concrete_byte_offset): New.
1816 (region_offset::calc_symbolic_bit_offset): New decl.
1817 (region_offset::calc_symbolic_byte_offset): New decl.
1818 (region_offset::dump_to_pp): New decl.
1819 (region_offset::dump): New decl.
1820 (operator<, operator<=, operator>, operator>=): New decls for
1821 region_offset.
1822 * analyzer.opt
1823 (-param=analyzer-text-art-string-ellipsis-threshold=): New.
1824 (-param=analyzer-text-art-string-ellipsis-head-len=): New.
1825 (-param=analyzer-text-art-string-ellipsis-tail-len=): New.
1826 (-param=analyzer-text-art-ideal-canvas-width=): New.
1827 (fanalyzer-debug-text-art): New.
1828 * bounds-checking.cc: Include "intl.h", "diagnostic-diagram.h",
1829 and "analyzer/access-diagram.h".
1830 (class out_of_bounds::oob_region_creation_event_capacity): New.
1831 (out_of_bounds::out_of_bounds): Add "model" and "sval_hint"
1832 params.
1833 (out_of_bounds::mark_interesting_stuff): Use the base region.
1834 (out_of_bounds::add_region_creation_events): Use
1835 oob_region_creation_event_capacity.
1836 (out_of_bounds::get_dir): New pure vfunc.
1837 (out_of_bounds::maybe_show_notes): New.
1838 (out_of_bounds::maybe_show_diagram): New.
1839 (out_of_bounds::make_access_diagram): New.
1840 (out_of_bounds::m_model): New field.
1841 (out_of_bounds::m_sval_hint): New field.
1842 (out_of_bounds::m_region_creation_event_id): New field.
1843 (concrete_out_of_bounds::concrete_out_of_bounds): Update for new
1844 fields.
1845 (concrete_past_the_end::concrete_past_the_end): Likewise.
1846 (concrete_past_the_end::add_region_creation_events): Use
1847 oob_region_creation_event_capacity.
1848 (concrete_buffer_overflow::concrete_buffer_overflow): Update for
1849 new fields.
1850 (concrete_buffer_overflow::emit): Replace call to
1851 maybe_describe_array_bounds with maybe_show_notes.
1852 (concrete_buffer_overflow::get_dir): New.
1853 (concrete_buffer_over_read::concrete_buffer_over_read): Update for
1854 new fields.
1855 (concrete_buffer_over_read::emit): Replace call to
1856 maybe_describe_array_bounds with maybe_show_notes.
1857 (concrete_buffer_overflow::get_dir): New.
1858 (concrete_buffer_underwrite::concrete_buffer_underwrite): Update
1859 for new fields.
1860 (concrete_buffer_underwrite::emit): Replace call to
1861 maybe_describe_array_bounds with maybe_show_notes.
1862 (concrete_buffer_underwrite::get_dir): New.
1863 (concrete_buffer_under_read::concrete_buffer_under_read): Update
1864 for new fields.
1865 (concrete_buffer_under_read::emit): Replace call to
1866 maybe_describe_array_bounds with maybe_show_notes.
1867 (concrete_buffer_under_read::get_dir): New.
1868 (symbolic_past_the_end::symbolic_past_the_end): Update for new
1869 fields.
1870 (symbolic_buffer_overflow::symbolic_buffer_overflow): Likewise.
1871 (symbolic_buffer_overflow::emit): Call maybe_show_notes.
1872 (symbolic_buffer_overflow::get_dir): New.
1873 (symbolic_buffer_over_read::symbolic_buffer_over_read): Update for
1874 new fields.
1875 (symbolic_buffer_over_read::emit): Call maybe_show_notes.
1876 (symbolic_buffer_over_read::get_dir): New.
1877 (region_model::check_symbolic_bounds): Add "sval_hint" param. Pass
1878 it and sized_offset_reg to diagnostics.
1879 (region_model::check_region_bounds): Add "sval_hint" param, passing
1880 it to diagnostics.
1881 * diagnostic-manager.cc
1882 (diagnostic_manager::emit_saved_diagnostic): Pass logger to
1883 pending_diagnostic::emit.
1884 * engine.cc: Add logger param to pending_diagnostic::emit
1885 implementations.
1886 * infinite-recursion.cc: Likewise.
1887 * kf-analyzer.cc: Likewise.
1888 * kf.cc: Likewise. Add nullptr for new param of
1889 check_region_for_write.
1890 * pending-diagnostic.h: Likewise in decl.
1891 * region-model-manager.cc
1892 (region_model_manager::get_or_create_int_cst): Convert param from
1893 poly_int64 to const poly_wide_int_ref &.
1894 (region_model_manager::maybe_fold_binop): Support type being NULL
1895 when checking for floating-point types.
1896 Check for (X + Y) - X => Y. Be less strict about types when folding
1897 associative ops. Check for (X + Y) * CST => (X * CST) + (Y * CST).
1898 * region-model-manager.h
1899 (region_model_manager::get_or_create_int_cst): Convert param from
1900 poly_int64 to const poly_wide_int_ref &.
1901 * region-model.cc: Add logger param to pending_diagnostic::emit
1902 implementations.
1903 (region_model::check_external_function_for_access_attr): Update
1904 for new param of check_region_for_write.
1905 (region_model::deref_rvalue): Use nullptr rather than NULL.
1906 (region_model::get_capacity): Handle RK_STRING.
1907 (region_model::check_region_access): Add "sval_hint" param; pass it to
1908 check_region_bounds.
1909 (region_model::check_region_for_write): Add "sval_hint" param;
1910 pass it to check_region_access.
1911 (region_model::check_region_for_read): Add NULL for new param to
1912 check_region_access.
1913 (region_model::set_value): Pass rhs_sval to
1914 check_region_for_write.
1915 (region_model::get_representative_path_var_1): Handle SK_CONSTANT
1916 in the check for infinite recursion.
1917 * region-model.h (region_model::check_region_for_write): Add
1918 "sval_hint" param.
1919 (region_model::check_region_access): Likewise.
1920 (region_model::check_symbolic_bounds): Likewise.
1921 (region_model::check_region_bounds): Likewise.
1922 * region.cc (region_offset::make_byte_offset): New.
1923 (region_offset::calc_symbolic_bit_offset): New.
1924 (region_offset::calc_symbolic_byte_offset): New.
1925 (region_offset::dump_to_pp): New.
1926 (region_offset::dump): New.
1927 (struct linear_op): New.
1928 (operator<, operator<=, operator>, operator>=): New, for
1929 region_offset.
1930 (region::get_next_offset): New.
1931 (region::get_relative_symbolic_offset): Use ptrdiff_type_node.
1932 (field_region::get_relative_symbolic_offset): Likewise.
1933 (element_region::get_relative_symbolic_offset): Likewise.
1934 (bit_range_region::get_relative_symbolic_offset): Likewise.
1935 * region.h (region::get_next_offset): New decl.
1936 * sm-fd.cc: Add logger param to pending_diagnostic::emit
1937 implementations.
1938 * sm-file.cc: Likewise.
1939 * sm-malloc.cc: Likewise.
1940 * sm-pattern-test.cc: Likewise.
1941 * sm-sensitive.cc: Likewise.
1942 * sm-signal.cc: Likewise.
1943 * sm-taint.cc: Likewise.
1944 * store.cc (bit_range::contains_p): Allow "out" to be null.
1945 * store.h (byte_range::get_start_bit_offset): New.
1946 (byte_range::get_next_bit_offset): New.
1947 * varargs.cc: Add logger param to pending_diagnostic::emit
1948 implementations.
1950 2023-06-10 Tim Lange <mail@tim-lange.me>
1952 PR analyzer/109577
1953 * constraint-manager.cc (class sval_finder): Visitor to find
1954 childs in svalue trees.
1955 (constraint_manager::sval_constrained_p): Add new function to
1956 check whether a sval might be part of an constraint.
1957 * constraint-manager.h: Add sval_constrained_p function.
1958 * region-model.cc (class size_visitor): Reverse behavior to not
1959 emit a warning on not explicitly considered cases.
1960 (region_model::check_region_size):
1961 Adapt to size_visitor changes.
1963 2023-06-09 David Malcolm <dmalcolm@redhat.com>
1965 PR analyzer/110112
1966 * region-model.cc (region_model::get_initial_value_for_global):
1967 Move code to region::calc_initial_value_at_main.
1968 * region.cc (region::get_initial_value_at_main): New function.
1969 (region::calc_initial_value_at_main): New function, based on code
1970 in region_model::get_initial_value_for_global.
1971 (region::region): Initialize m_cached_init_sval_at_main.
1972 (decl_region::get_svalue_for_constructor): Add a cache, splitting
1973 out body to...
1974 (decl_region::calc_svalue_for_constructor): ...this new function.
1975 * region.h (region::get_initial_value_at_main): New decl.
1976 (region::calc_initial_value_at_main): New decl.
1977 (region::m_cached_init_sval_at_main): New field.
1978 (decl_region::decl_region): Initialize m_ctor_svalue.
1979 (decl_region::calc_svalue_for_constructor): New decl.
1980 (decl_region::m_ctor_svalue): New field.
1982 2023-06-08 Benjamin Priour <vultkayn@gcc.gnu.org>
1984 * bounds-checking.cc (region_model::check_symbolic_bounds): Returns whether the BASE_REG
1985 region access was OOB.
1986 (region_model::check_region_bounds): Likewise.
1987 * region-model.cc (region_model::get_store_value): Creates an
1988 unknown svalue on OOB-read access to REG.
1989 (region_model::check_region_access): Returns whether an unknown svalue needs be created.
1990 (region_model::check_region_for_read): Passes check_region_access return value.
1991 * region-model.h: Update prior function definitions.
1993 2023-06-02 David Malcolm <dmalcolm@redhat.com>
1995 PR analyzer/109015
1996 * kf.cc (class kf_atomic_exchange): New.
1997 (class kf_atomic_exchange_n): New.
1998 (class kf_atomic_fetch_op): New.
1999 (class kf_atomic_op_fetch): New.
2000 (class kf_atomic_load): New.
2001 (class kf_atomic_load_n): New.
2002 (class kf_atomic_store_n): New.
2003 (register_atomic_builtins): New function.
2004 (register_known_functions): Call register_atomic_builtins.
2006 2023-06-02 David Malcolm <dmalcolm@redhat.com>
2008 * store.cc (store::eval_alias_1): Regions in different memory
2009 spaces can't alias.
2011 2023-05-18 Bernhard Reutner-Fischer <aldot@gcc.gnu.org>
2013 * region-model-manager.cc (get_code_for_cast): Use _P defines from
2014 tree.h.
2015 (region_model_manager::get_or_create_cast): Ditto.
2016 (region_model_manager::get_region_for_global): Ditto.
2017 * region-model.cc (region_model::get_lvalue_1): Ditto.
2018 * region.cc (decl_region::maybe_get_constant_value): Ditto.
2020 2023-03-22 David Malcolm <dmalcolm@redhat.com>
2022 PR analyzer/109239
2023 * program-point.cc: Include "analyzer/inlining-iterator.h".
2024 (program_point::effectively_intraprocedural_p): New function.
2025 * program-point.h (program_point::effectively_intraprocedural_p):
2026 New decl.
2027 * sm-malloc.cc (deref_before_check::emit): Use it when rejecting
2028 interprocedural cases, so that we reject interprocedural cases
2029 that have become intraprocedural due to inlining.
2031 2023-03-18 David Malcolm <dmalcolm@redhat.com>
2033 PR analyzer/109094
2034 * region-model.cc (region_model::on_longjmp): Pass false for
2035 new "eval_return_svalue" param of pop_frame.
2036 (region_model::pop_frame): Add new "eval_return_svalue" param and
2037 use it to suppress the call to get_rvalue on the result when
2038 needed by on_longjmp.
2039 * region-model.h (region_model::pop_frame): Add new
2040 "eval_return_svalue" param.
2042 2023-03-10 David Malcolm <dmalcolm@redhat.com>
2044 PR analyzer/109059
2045 * region-model.cc (region_model::mark_region_as_unknown): Gather a
2046 set of maybe-live svalues and call on_maybe_live_values with it.
2047 * store.cc (binding_map::remove_overlapping_bindings): Add new
2048 "maybe_live_values" param; add any removed svalues to it.
2049 (binding_cluster::clobber_region): Add NULL as new param of
2050 remove_overlapping_bindings.
2051 (binding_cluster::mark_region_as_unknown): Add "maybe_live_values"
2052 param and pass it to remove_overlapping_bindings.
2053 (binding_cluster::maybe_get_compound_binding): Add NULL for new
2054 param of binding_map::remove_overlapping_bindings.
2055 (binding_cluster::remove_overlapping_bindings): Add
2056 "maybe_live_values" param and pass to
2057 binding_map::remove_overlapping_bindings.
2058 (store::set_value): Capture a set of maybe-live svalues, and call
2059 on_maybe_live_values with it.
2060 (store::on_maybe_live_values): New.
2061 (store::mark_region_as_unknown): Add "maybe_live_values" param
2062 and pass it to binding_cluster::mark_region_as_unknown.
2063 (store::remove_overlapping_bindings): Pass NULL for new param of
2064 binding_cluster::remove_overlapping_bindings.
2065 * store.h (binding_map::remove_overlapping_bindings): Add
2066 "maybe_live_values" param.
2067 (binding_cluster::mark_region_as_unknown): Likewise.
2068 (binding_cluster::remove_overlapping_bindings): Likewise.
2069 (store::mark_region_as_unknown): Likewise.
2070 (store::on_maybe_live_values): New decl.
2072 2023-03-10 David Malcolm <dmalcolm@redhat.com>
2074 PR analyzer/108475
2075 PR analyzer/109060
2076 * sm-malloc.cc (deref_before_check::deref_before_check):
2077 Initialize new field m_deref_expr. Assert that arg is non-NULL.
2078 (deref_before_check::emit): Reject cases where the spelling of the
2079 thing that was dereferenced differs from that of what is checked,
2080 or if the dereference expression was not found. Remove code to
2081 handle NULL m_arg.
2082 (deref_before_check::describe_state_change): Remove code to handle
2083 NULL m_arg.
2084 (deref_before_check::describe_final_event): Likewise.
2085 (deref_before_check::sufficiently_similar_p): New.
2086 (deref_before_check::m_deref_expr): New field.
2087 (malloc_state_machine::maybe_complain_about_deref_before_check):
2088 Don't warn if the diag_ptr is NULL.
2090 2023-03-03 David Malcolm <dmalcolm@redhat.com>
2092 * kf.cc (class kf_sprintf): New.
2093 (register_known_functions): Register it.
2095 2023-03-02 David Malcolm <dmalcolm@redhat.com>
2097 PR analyzer/108968
2098 * region-model.cc (region_model::get_rvalue_1): Handle VAR_DECLs
2099 with a DECL_HARD_REGISTER by returning UNKNOWN.
2101 2023-03-02 Hans-Peter Nilsson <hp@axis.com>
2103 * kf.cc (register_known_functions): Add __errno function for newlib.
2105 2023-03-01 David Malcolm <dmalcolm@redhat.com>
2107 PR analyzer/107565
2108 * region-model.cc (region_model::on_call_pre): Flatten logic by
2109 returning early. Consolidate logic for detecting const and pure
2110 functions. When considering whether an unhandled built-in
2111 function has side-effects, consider all kinds of builtin, rather
2112 than just BUILT_IN_NORMAL, and don't require
2113 gimple_builtin_call_types_compatible_p.
2115 2023-03-01 David Malcolm <dmalcolm@redhat.com>
2117 PR analyzer/108935
2118 * infinite-recursion.cc (contains_unknown_p): New.
2119 (sufficiently_different_region_binding_p): New function, splitting
2120 out inner loop from...
2121 (sufficiently_different_p): ...here. Extend detection of unknown
2122 svalues to also include svalues that contain unknown. Treat
2123 changes in frames below the entry to the recursion as being
2124 sufficiently different to reject being an infinite recursion.
2126 2023-02-21 David Malcolm <dmalcolm@redhat.com>
2128 PR analyzer/108830
2129 * analyzer.opt (fanalyzer-suppress-followups): New option.
2130 * engine.cc (impl_region_model_context::warn): Terminate the path
2131 if the diagnostic's terminate_path_p vfunc returns true and
2132 -fanalyzer-suppress-followups is true (the default).
2133 (impl_sm_context::warn): Likewise, for both overloads.
2134 * pending-diagnostic.h (pending_diagnostic::terminate_path_p): New
2135 vfunc.
2136 * program-state.cc (program_state::on_edge): Terminate the path if
2137 the ctxt requests it during updating the edge.
2138 * region-model.cc (poisoned_value_diagnostic::terminate_path_p):
2139 New vfunc.
2140 * sm-malloc.cc (null_deref::terminate_path_p): New vfunc.
2141 (null_arg::terminate_path_p): New vfunc.
2143 2023-02-16 David Malcolm <dmalcolm@redhat.com>
2145 PR analyzer/108806
2146 * constraint-manager.cc (bounded_range::dump_to_pp): Use
2147 bounded_range::singleton_p.
2148 (constraint_manager::add_bounded_ranges): Handle singleton ranges
2149 by adding an EQ_EXPR constraint.
2150 (constraint_manager::impossible_derived_conditions_p): New.
2151 (constraint_manager::eval_condition): Reject EQ_EXPR when it would
2152 imply impossible derived conditions.
2153 (selftest::test_bits): New.
2154 (selftest::run_constraint_manager_tests): Run it.
2155 * constraint-manager.h (bounded_range::singleton_p): New.
2156 (constraint_manager::impossible_derived_conditions_p): New decl.
2157 * region-model.cc (region_model::get_rvalue_1): Handle
2158 BIT_AND_EXPR, BIT_IOR_EXPR, and BIT_XOR_EXPR.
2160 2023-02-15 David Malcolm <dmalcolm@redhat.com>
2162 PR analyzer/108664
2163 PR analyzer/108666
2164 PR analyzer/108725
2165 * diagnostic-manager.cc (epath_finder::get_best_epath): Add
2166 "target_stmt" param.
2167 (epath_finder::explore_feasible_paths): Likewise.
2168 (epath_finder::process_worklist_item): Likewise.
2169 (saved_diagnostic::calc_best_epath): Pass m_stmt to
2170 epath_finder::get_best_epath.
2171 * engine.cc (feasibility_state::maybe_update_for_edge): Move
2172 per-stmt logic to...
2173 (feasibility_state::update_for_stmt): ...this new function.
2174 * exploded-graph.h (feasibility_state::update_for_stmt): New decl.
2175 * feasible-graph.cc (feasible_node::get_state_at_stmt): New.
2176 * feasible-graph.h: Include "analyzer/exploded-graph.h".
2177 (feasible_node::get_state_at_stmt): New decl.
2178 * infinite-recursion.cc
2179 (infinite_recursion_diagnostic::check_valid_fpath_p): Update for
2180 vfunc signature change.
2181 * pending-diagnostic.h (pending_diagnostic::check_valid_fpath_p):
2182 Convert first param to a reference. Add stmt param.
2183 * region-model.cc: Include "analyzer/feasible-graph.h".
2184 (poisoned_value_diagnostic::poisoned_value_diagnostic): Add
2185 "check_expr" param.
2186 (poisoned_value_diagnostic::check_valid_fpath_p): New.
2187 (poisoned_value_diagnostic::m_check_expr): New field.
2188 (region_model::check_for_poison): Attempt to supply a check_expr
2189 to the diagnostic
2190 (region_model::deref_rvalue): Add NULL for new check_expr param
2191 of poisoned_value_diagnostic.
2192 (region_model::get_or_create_region_for_heap_alloc): Don't reuse
2193 regions that are marked as TOUCHED.
2195 2023-02-10 David Malcolm <dmalcolm@redhat.com>
2197 PR analyzer/108745
2198 * sm-malloc.cc (deref_before_check::emit): Reject the warning if
2199 the check occurs within a macro defintion.
2201 2023-02-09 David Malcolm <dmalcolm@redhat.com>
2203 PR analyzer/108733
2204 * state-purge.cc (get_candidate_for_purging): Add ADDR_EXPR
2205 and MEM_REF.
2207 2023-02-08 David Malcolm <dmalcolm@redhat.com>
2209 PR analyzer/108704
2210 * state-purge.cc (state_purge_per_decl::process_point_backwards):
2211 Don't stop processing the decl if it's fully overwritten by
2212 this stmt if it's also used by this stmt.
2214 2023-02-07 David Malcolm <dmalcolm@redhat.com>
2216 PR analyzer/108661
2217 * sm-fd.cc (class kf_read): New.
2218 (register_known_fd_functions): Register "read".
2219 * sm-file.cc (class kf_fread): Update comment.
2221 2023-02-02 David Malcolm <dmalcolm@redhat.com>
2223 PR analyzer/108633
2224 * sm-fd.cc (fd_state_machine::check_for_fd_attrs): Add missing
2225 "continue".
2226 (fd_state_machine::on_listen): Don't issue phase-mismatch or
2227 type-mismatch warnings for the "invalid" state.
2229 2023-02-01 David Malcolm <dmalcolm@redhat.com>
2231 PR analyzer/108616
2232 * pending-diagnostic.cc (fixup_location_in_macro_p): Add "alloca"
2233 to macros that we shouldn't unwind inside.
2235 2023-01-26 David Malcolm <dmalcolm@redhat.com>
2237 PR analyzer/108524
2238 * analyzer.h (class feasible_node): New forward decl.
2239 * diagnostic-manager.cc (epath_finder::get_best_epath): Add "pd"
2240 param.
2241 (epath_finder::explore_feasible_paths): Likewise.
2242 (epath_finder::process_worklist_item): Likewise. Use it to call
2243 pending_diagnostic::check_valid_fpath_p on the final fpath to
2244 give pending_diagnostic a way to add additional restrictions on
2245 feasibility.
2246 (saved_diagnostic::calc_best_epath): Pass pending_diagnostic to
2247 epath_finder::get_best_epath.
2248 * infinite-recursion.cc: Include "analyzer/feasible-graph.h".
2249 (infinite_recursion_diagnostic::check_valid_fpath_p): New.
2250 (infinite_recursion_diagnostic::fedge_uses_conjured_svalue_p): New.
2251 (infinite_recursion_diagnostic::expr_uses_conjured_svalue_p): New.
2252 * pending-diagnostic.h (pending_diagnostic::check_valid_fpath_p):
2253 New vfunc.
2255 2023-01-19 David Malcolm <dmalcolm@redhat.com>
2257 PR analyzer/108455
2258 * analyzer.h (class checker_event): New forward decl.
2259 (class state_change_event): Indent.
2260 (class warning_event): New forward decl.
2261 * checker-event.cc (state_change_event::state_change_event): Add
2262 "enode" param.
2263 (warning_event::get_desc): Update for new param of
2264 evdesc::final_event ctor.
2265 * checker-event.h (state_change_event::state_change_event): Add
2266 "enode" param.
2267 (state_change_event::get_exploded_node): New accessor.
2268 (state_change_event::m_enode): New field.
2269 (warning_event::warning_event): New "enode" param.
2270 (warning_event::get_exploded_node): New accessor.
2271 (warning_event::m_enode): New field.
2272 * diagnostic-manager.cc
2273 (state_change_event_creator::on_global_state_change): Pass
2274 src_node to state_change_event ctor.
2275 (state_change_event_creator::on_state_change): Likewise.
2276 (null_assignment_sm_context::set_next_state): Pass NULL for
2277 new param of state_change_event ctor.
2278 * infinite-recursion.cc
2279 (infinite_recursion_diagnostic::add_final_event): Update for new
2280 param of warning_event ctor.
2281 * pending-diagnostic.cc (pending_diagnostic::add_final_event):
2282 Pass enode to warning_event ctor.
2283 * pending-diagnostic.h (evdesc::final_event): Add reference to
2284 warning_event.
2285 * sm-malloc.cc: Include "analyzer/checker-event.h" and
2286 "analyzer/exploded-graph.h".
2287 (deref_before_check::deref_before_check): Initialize new fields.
2288 (deref_before_check::emit): Reject warnings in which we were
2289 unable to determine the enodes of the dereference and the check.
2290 Reject warnings interprocedural warnings. Reject warnings in which
2291 the dereference doesn't dominate the check.
2292 (deref_before_check::describe_state_change): Set m_deref_enode.
2293 (deref_before_check::describe_final_event): Set m_check_enode.
2294 (deref_before_check::m_deref_enode): New field.
2295 (deref_before_check::m_check_enode): New field.
2297 2023-01-13 David Malcolm <dmalcolm@redhat.com>
2299 PR analyzer/105273
2300 * region-model.cc (has_nondefault_case_for_value_p): New.
2301 (has_nondefault_cases_for_all_enum_values_p): New.
2302 (region_model::apply_constraints_for_gswitch): Skip
2303 implicitly-created "default" when switching on an enum
2304 and all enum values have non-default cases.
2305 (rejected_default_case::dump_to_pp): New.
2306 * region-model.h (region_model_context::possibly_tainted_p): New
2307 decl.
2308 (class rejected_default_case): New.
2309 * sm-taint.cc (region_model_context::possibly_tainted_p): New.
2310 * supergraph.cc (switch_cfg_superedge::dump_label_to_pp): Dump
2311 when implicitly_created_default_p.
2312 (switch_cfg_superedge::implicitly_created_default_p): New.
2313 * supergraph.h
2314 (switch_cfg_superedge::implicitly_created_default_p): New decl.
2316 2023-01-11 David Malcolm <dmalcolm@redhat.com>
2318 PR analyzer/108252
2319 * kf.cc (class kf_strdup): New.
2320 (class kf_strndup): New.
2321 (register_known_functions): Register them.
2322 * region-model.cc (region_model::on_call_pre): Use
2323 &HEAP_ALLOCATED_REGION for the default result of an external
2324 function with the "malloc" attribute, rather than CONJURED_SVALUE.
2325 (region_model::get_or_create_region_for_heap_alloc): Allow
2326 "size_in_bytes" to be NULL.
2327 * store.cc (store::set_value): When handling *UNKNOWN = VAL,
2328 mark VAL as "maybe bound".
2330 2022-12-16 David Malcolm <dmalcolm@redhat.com>
2332 PR analyzer/106479
2333 * kf.cc (kf_memcpy_memmove::impl_call_pre): Pass in source region
2334 to region_model::check_for_poison.
2335 * region-model-asm.cc (region_model::on_asm_stmt): Pass NULL
2336 region to region_model::check_for_poison.
2337 * region-model.cc (region_model::check_for_poison): Add
2338 "src_region" param, and pass it to poisoned_value_diagnostic.
2339 (region_model::on_assignment): Pass NULL region to
2340 region_model::check_for_poison.
2341 (region_model::get_rvalue): Likewise.
2342 * region-model.h (region_model::check_for_poison): Add
2343 "src_region" param.
2344 * sm-fd.cc (fd_state_machine::on_accept): Pass in source region
2345 to region_model::check_for_poison.
2346 * varargs.cc (kf_va_copy::impl_call_pre): Pass NULL region to
2347 region_model::check_for_poison.
2348 (kf_va_arg::impl_call_pre): Pass in source region to
2349 region_model::check_for_poison.
2351 2022-12-14 David Malcolm <dmalcolm@redhat.com>
2353 PR analyzer/108065
2354 * region.cc (decl_region::get_svalue_for_initializer): Bail out to
2355 avoid calling binding_key::make with an empty region.
2356 * store.cc (binding_map::apply_ctor_val_to_range): Likewise.
2357 (binding_map::apply_ctor_pair_to_child_region): Likewise.
2358 (binding_cluster::bind): Likewise.
2359 (binding_cluster::purge_region): Likewise.
2360 (binding_cluster::maybe_get_compound_binding): Likewise.
2361 (binding_cluster::maybe_get_simple_value): Likewise.
2363 2022-12-09 David Malcolm <dmalcolm@redhat.com>
2365 * analyzer.h (class known_function): Expand comment.
2366 * region-model-impl-calls.cc: Rename to...
2367 * kf.cc: ...this.
2368 * known-function-manager.h (class known_function_manager): Add
2369 leading comment.
2371 2022-12-09 David Malcolm <dmalcolm@redhat.com>
2373 PR analyzer/108003
2374 * call-summary.cc
2375 (call_summary_replay::convert_region_from_summary_1): Convert
2376 heap_regs_in_use from auto_sbitmap to auto_bitmap.
2377 * region-model-manager.cc
2378 (region_model_manager::get_or_create_region_for_heap_alloc):
2379 Convert from sbitmap to bitmap.
2380 * region-model-manager.h: Likewise.
2381 * region-model.cc
2382 (region_model::get_or_create_region_for_heap_alloc): Convert from
2383 auto_sbitmap to auto_bitmap.
2384 (region_model::get_referenced_base_regions): Likewise.
2385 * region-model.h: Include "bitmap.h" rather than "sbitmap.h".
2386 (region_model::get_referenced_base_regions): Convert from
2387 auto_sbitmap to auto_bitmap.
2389 2022-12-09 David Malcolm <dmalcolm@redhat.com>
2391 * region-model-impl-calls.cc (class kf_memcpy): Rename to...
2392 (class kf_memcpy_memmove): ...this.
2393 (kf_memcpy::impl_call_pre): Rename to...
2394 (kf_memcpy_memmove::impl_call_pre): ...this, and check the src for
2395 poison.
2396 (register_known_functions): Update for above renaming, and
2397 register BUILT_IN_MEMMOVE and BUILT_IN_MEMMOVE_CHK.
2399 2022-12-06 David Malcolm <dmalcolm@redhat.com>
2401 PR analyzer/107882
2402 * region-model.cc (region_model::get_store_value): Return an
2403 unknown value for empty regions.
2404 (region_model::set_value): Bail on empty regions.
2405 * region.cc (region::empty_p): New.
2406 * region.h (region::empty_p): New decl.
2407 * state-purge.cc (same_binding_p): Bail if either region is empty.
2408 * store.cc (binding_key::make): Assert that a concrete binding's
2409 bit_size must be > 0.
2410 (binding_cluster::mark_region_as_unknown): Bail on empty regions.
2411 (binding_cluster::get_binding): Likewise.
2412 (binding_cluster::remove_overlapping_bindings): Likewise.
2413 (binding_cluster::on_unknown_fncall): Don't conjure values for
2414 empty regions.
2415 (store::fill_region): Bail on empty regions.
2416 * store.h (class concrete_binding): Update comment to reflect that
2417 the range of bits must be non-empty.
2418 (concrete_binding::concrete_binding): Assert that bit range is
2419 non-empty.
2421 2022-12-06 David Malcolm <dmalcolm@redhat.com>
2423 PR analyzer/106325
2424 * region-model-manager.cc
2425 (region_model_manager::get_or_create_null_ptr): New.
2426 * region-model-manager.h
2427 (region_model_manager::get_or_create_null_ptr): New decl.
2428 * region-model.cc (region_model::on_top_level_param): Add
2429 "nonnull" param and make use of it.
2430 (region_model::push_frame): When handling a top-level entrypoint
2431 to the analysis, determine which params __attribute__((nonnull))
2432 applies to, and pass to on_top_level_param.
2433 * region-model.h (region_model::on_top_level_param): Add "nonnull"
2434 param.
2436 2022-12-06 David Malcolm <dmalcolm@redhat.com>
2438 * analyzer.h (register_known_analyzer_functions): New decl.
2439 (register_known_functions_lang_cp): New decl.
2440 * call-details.cc: New file, split out from
2441 region-model-impl-calls.cc.
2442 * call-details.h: New file, split out from region-model.h.
2443 * call-info.cc: Include "analyzer/call-details.h".
2444 * call-summary.h: Likewise.
2445 * kf-analyzer.cc: New file, split out from
2446 region-model-impl-calls.cc.
2447 * kf-lang-cp.cc: Likewise.
2448 * known-function-manager.cc: Include "analyzer/call-details.h".
2449 * region-model-impl-calls.cc: Move definitions of call_details's
2450 member functions to call-details.cc. Move class kf_analyzer_* to
2451 kf-analyzer.cc. Move kf_operator_new and kf_operator_delete to
2452 kf-lang-cp.cc. Refresh #includes accordingly.
2453 (register_known_functions): Replace registration of __analyzer_*
2454 functions with a call to register_known_analyzer_functions.
2455 Replace registration of C++ support functions with a call to
2456 register_known_functions_lang_cp.
2457 * region-model.h (class call_details): Move to new call-details.h.
2458 * sm-fd.cc: Include "analyzer/call-details.h".
2459 * sm-file.cc: Likewise.
2460 * sm-malloc.cc: Likewise.
2461 * varargs.cc: Likewise.
2463 2022-12-02 David Malcolm <dmalcolm@redhat.com>
2465 * analyzer.h (struct event_loc_info): New forward decl.
2466 * bounds-checking.cc: Use event_loc_info throughout to bundle the
2467 loc, fndecl, depth triples.
2468 * call-info.cc: Likewise.
2469 * checker-event.cc: Likewise.
2470 * checker-event.h (struct event_loc_info): New decl. Use it
2471 throughout to bundle the loc, fndecl, depth triples.
2472 * checker-path.cc: Likewise.
2473 * checker-path.h: Likewise.
2474 * diagnostic-manager.cc: Likewise.
2475 * engine.cc: Likewise.
2476 * infinite-recursion.cc: Likewise.
2477 * pending-diagnostic.cc: Likewise.
2478 * pending-diagnostic.h: Likewise.
2479 * region-model.cc: Likewise.
2480 * sm-signal.cc: Likewise.
2481 * varargs.cc: Likewise.
2483 2022-12-02 David Malcolm <dmalcolm@redhat.com>
2485 PR analyzer/107851
2486 * analyzer.cc (make_label_text_n): Convert param "n" from int to
2487 unsigned HOST_WIDE_INT.
2488 * analyzer.h (make_label_text_n): Likewise for decl.
2489 * bounds-checking.cc: Include "analyzer/checker-event.h" and
2490 "analyzer/checker-path.h".
2491 (out_of_bounds::add_region_creation_events): New.
2492 (concrete_past_the_end::describe_region_creation_event): Replace
2493 with...
2494 (concrete_past_the_end::add_region_creation_events): ...this.
2495 (symbolic_past_the_end::describe_region_creation_event): Delete.
2496 * checker-event.cc (region_creation_event::region_creation_event):
2497 Update for dropping all member data.
2498 (region_creation_event::get_desc): Delete, splitting out into
2499 region_creation_event_memory_space::get_desc,
2500 region_creation_event_capacity::get_desc, and
2501 region_creation_event_debug::get_desc.
2502 (region_creation_event_memory_space::get_desc): New.
2503 (region_creation_event_capacity::get_desc): New.
2504 (region_creation_event_allocation_size::get_desc): New.
2505 (region_creation_event_debug::get_desc): New.
2506 * checker-event.h: Include "analyzer/program-state.h".
2507 (enum rce_kind): Delete.
2508 (class region_creation_event): Drop all member data.
2509 (region_creation_event::region_creation_event): Make protected.
2510 (region_creation_event::get_desc): Delete.
2511 (class region_creation_event_memory_space): New.
2512 (class region_creation_event_capacity): New.
2513 (class region_creation_event_allocation_size): New.
2514 (class region_creation_event_debug): New.
2515 * checker-path.cc (checker_path::add_region_creation_events): Add
2516 "pd" param. Call pending_diangnostic::add_region_creation_events.
2517 Update for conversion of RCE_DEBUG to region_creation_event_debug.
2518 * checker-path.h (checker_path::add_region_creation_events): Add
2519 "pd" param.
2520 * diagnostic-manager.cc (diagnostic_manager::build_emission_path):
2521 Pass pending_diagnostic to
2522 emission_path::add_region_creation_events.
2523 (diagnostic_manager::build_emission_path): Pass path_builder to
2524 add_event_on_final_node.
2525 (diagnostic_manager::add_event_on_final_node): Add "pb" param.
2526 Pass pending_diagnostic to
2527 emission_path::add_region_creation_events.
2528 (diagnostic_manager::add_events_for_eedge): Pass
2529 pending_diagnostic to emission_path::add_region_creation_events.
2530 * diagnostic-manager.h
2531 (diagnostic_manager::add_event_on_final_node): Add "pb" param.
2532 * pending-diagnostic.cc
2533 (pending_diagnostic::add_region_creation_events): New.
2534 * pending-diagnostic.h (struct region_creation): Delete.
2535 (pending_diagnostic::describe_region_creation_event): Delete.
2536 (pending_diagnostic::add_region_creation_events): New vfunc.
2537 * region-model.cc: Include "analyzer/checker-event.h" and
2538 "analyzer/checker-path.h".
2539 (dubious_allocation_size::dubious_allocation_size): Initialize
2540 m_has_allocation_event.
2541 (dubious_allocation_size::describe_region_creation_event): Delete.
2542 (dubious_allocation_size::describe_final_event): Update for
2543 replacement of m_allocation_event with m_has_allocation_event.
2544 (dubious_allocation_size::add_region_creation_events): New.
2545 (dubious_allocation_size::m_allocation_event): Replace with...
2546 (dubious_allocation_size::m_has_allocation_event): ...this.
2548 2022-12-02 David Malcolm <dmalcolm@redhat.com>
2550 PR analyzer/107948
2551 * region-model-manager.cc
2552 (region_model_manager::maybe_fold_binop): Fold (0 - VAL) to -VAL.
2553 * region-model.cc (region_model::eval_condition): Handle e.g.
2554 "-X <= 0" as equivalent to X >= 0".
2556 2022-12-01 David Malcolm <dmalcolm@redhat.com>
2558 PR analyzer/106626
2559 * bounds-checking.cc
2560 (symbolic_past_the_end::describe_final_event): Delete, moving to
2561 symbolic_buffer_overflow::describe_final_event and
2562 symbolic_buffer_over_read::describe_final_event, eliminating
2563 composition of text strings via "byte_str" and "m_dir_str".
2564 (symbolic_past_the_end::m_dir_str): Delete field.
2565 (symbolic_buffer_overflow::symbolic_buffer_overflow): Drop
2566 m_dir_str.
2567 (symbolic_buffer_overflow::describe_final_event): New, as noted
2568 above.
2569 (symbolic_buffer_over_read::symbolic_buffer_overflow): Drop
2570 m_dir_str.
2571 (symbolic_buffer_over_read::describe_final_event): New, as noted
2572 above.
2574 2022-12-01 David Malcolm <dmalcolm@redhat.com>
2576 * bounds-checking.cc (class out_of_bounds): Split out from...
2577 (class concrete_out_of_bounds): New abstract subclass.
2578 (class past_the_end): Rename to...
2579 (class concrete_past_the_end): ...this, and make a subclass of
2580 concrete_out_of_bounds.
2581 (class buffer_overflow): Rename to...
2582 (class concrete_buffer_overflow): ...this, and make a subclass of
2583 concrete_past_the_end.
2584 (class buffer_over_read): Rename to...
2585 (class concrete_buffer_over_read): ...this, and make a subclass of
2586 concrete_past_the_end.
2587 (class buffer_underwrite): Rename to...
2588 (class concrete_buffer_underwrite): ...this, and make a subclass
2589 of concrete_out_of_bounds.
2590 (class buffer_under_read): Rename to...
2591 (class concrete_buffer_under_read): ...this, and make a subclass
2592 of concrete_out_of_bounds.
2593 (class symbolic_past_the_end): Convert to a subclass of
2594 out_of_bounds.
2595 (symbolic_buffer_overflow::get_kind): New.
2596 (symbolic_buffer_over_read::get_kind): New.
2597 (region_model::check_region_bounds): Update for renamings.
2598 * engine.cc (impl_sm_context::set_next_state): Eliminate
2599 "new_ctxt", passing NULL to get_rvalue instead.
2600 (impl_sm_context::warn): Likewise.
2602 2022-12-01 David Malcolm <dmalcolm@redhat.com>
2604 PR analyzer/106626
2605 * bounds-checking.cc (out_of_bounds::get_memory_space): New.
2606 (buffer_overflow::emit): Use it.
2607 (class buffer_overread): Rename to...
2608 (class buffer_over_read): ...this.
2609 (buffer_over_read::emit): Specify which memory space the read is
2610 from, where known. Change "overread" to "over-read".
2611 (class buffer_underflow): Rename to...
2612 (class buffer_underwrite): ...this.
2613 (buffer_underwrite::emit): Specify which memory space the write is
2614 to, where known. Change "underflow" to "underwrite".
2615 (class buffer_underread): Rename to...
2616 (class buffer_under_read): Rename to...
2617 (buffer_under_read::emit): Specify which memory space the read is
2618 from, where known. Change "underread" to "under-read".
2619 (symbolic_past_the_end::get_memory_space): New.
2620 (symbolic_buffer_overflow::emit): Use it.
2621 (class symbolic_buffer_overread): Rename to...
2622 (class symbolic_buffer_over_read): ...this.
2623 (symbolic_buffer_over_read::emit): Specify which memory space the
2624 read is from, where known. Change "overread" to "over-read".
2625 (region_model::check_symbolic_bounds): Update for class renaming.
2626 (region_model::check_region_bounds): Likewise.
2628 2022-12-01 David Malcolm <dmalcolm@redhat.com>
2630 PR analyzer/106626
2631 * bounds-checking.cc (out_of_bounds::maybe_describe_array_bounds):
2632 New.
2633 (buffer_overflow::emit): Call maybe_describe_array_bounds.
2634 (buffer_overread::emit): Likewise.
2635 (buffer_underflow::emit): Likewise.
2636 (buffer_underread::emit): Likewise.
2638 2022-12-01 David Malcolm <dmalcolm@redhat.com>
2640 PR analyzer/106626
2641 * bounds-checking.cc (buffer_overflow::emit): Use inform_n.
2642 Update wording to clarify that we're talking about the size of
2643 the bad access, rather than its position.
2644 (buffer_overread::emit): Likewise.
2646 2022-12-01 David Malcolm <dmalcolm@redhat.com>
2648 * bounds-checking.cc: New file, taken from region-model.cc.
2649 * region-model.cc (class out_of_bounds): Move to
2650 bounds-checking.cc.
2651 (class past_the_end): Likewise.
2652 (class buffer_overflow): Likewise.
2653 (class buffer_overread): Likewise.
2654 (class buffer_underflow): Likewise.
2655 (class buffer_underread): Likewise.
2656 (class symbolic_past_the_end): Likewise.
2657 (class symbolic_buffer_overflow): Likewise.
2658 (class symbolic_buffer_overread): Likewise.
2659 (region_model::check_symbolic_bounds): Likewise.
2660 (maybe_get_integer_cst_tree): Likewise.
2661 (region_model::check_region_bounds): Likewise.
2662 * region-model.h: Add comment.
2664 2022-12-01 David Malcolm <dmalcolm@redhat.com>
2666 PR analyzer/107928
2667 * sm-fd.cc (fd_state_machine::on_bind): Handle m_constant_fd in
2668 the "success" outcome.
2669 (fd_state_machine::on_connect): Likewise.
2670 * sm-fd.dot: Add "constant_fd" state and its transitions.
2672 2022-11-30 David Malcolm <dmalcolm@redhat.com>
2674 * region-model-impl-calls.cc (class kf_fgets): Move to sm-file.cc.
2675 (kf_fgets::impl_call_pre): Likewise.
2676 (class kf_fread): Likewise.
2677 (kf_fread::impl_call_pre): Likewise.
2678 (class kf_getchar): Likewise.
2679 (class kf_stdio_output_fn): Likewise.
2680 (register_known_functions): Move registration of
2681 BUILT_IN_FPRINTF, BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_FPUTC,
2682 BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
2683 BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
2684 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTCHAR,
2685 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_PUTS,
2686 BUILT_IN_PUTS_UNLOCKED, BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF,
2687 "getchar", "fgets", "fgets_unlocked", and "fread" to
2688 register_known_file_functions.
2689 * sm-file.cc (class kf_stdio_output_fn): Move here from
2690 region-model-impl-calls.cc.
2691 (class kf_fgets): Likewise.
2692 (class kf_fread): Likewise.
2693 (class kf_getchar): Likewise.
2694 (register_known_file_functions): Move registration of
2695 BUILT_IN_FPRINTF, BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_FPUTC,
2696 BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
2697 BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
2698 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTCHAR,
2699 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_PUTS,
2700 BUILT_IN_PUTS_UNLOCKED, BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF,
2701 "fgets", "fgets_unlocked", "fread", and "getchar" to here from
2702 register_known_functions.
2704 2022-11-30 David Malcolm <dmalcolm@redhat.com>
2706 PR analyzer/103546
2707 * analyzer.h (register_known_file_functions): New decl.
2708 * program-state.cc (sm_state_map::replay_call_summary): Rejct
2709 attempts to store sm-state for caller_sval that can't have
2710 associated state.
2711 * region-model-impl-calls.cc (register_known_functions): Call
2712 register_known_file_functions.
2713 * sm-fd.cc (class kf_isatty): New.
2714 (register_known_fd_functions): Register it.
2715 * sm-file.cc (class kf_ferror): New.
2716 (class kf_fileno): New.
2717 (class kf_getc): New.
2718 (register_known_file_functions): New.
2720 2022-11-30 David Malcolm <dmalcolm@redhat.com>
2722 PR analyzer/105784
2723 * region-model-manager.cc
2724 (region_model_manager::maybe_fold_binop): For POINTER_PLUS_EXPR,
2725 PLUS_EXPR and MINUS_EXPR, eliminate requirement that the final
2726 type matches that of arg0 in favor of a cast.
2728 2022-11-24 Martin Liska <mliska@suse.cz>
2730 * varargs.cc: Fix Clang warnings.
2732 2022-11-24 David Malcolm <dmalcolm@redhat.com>
2734 PR analyzer/106473
2735 * call-summary.cc
2736 (call_summary_replay::convert_region_from_summary_1): Update for
2737 change to creation of heap-allocated regions.
2738 * program-state.cc (test_program_state_1): Likewise.
2739 (test_program_state_merging): Likewise.
2740 * region-model-impl-calls.cc (kf_calloc::impl_call_pre): Likewise.
2741 (kf_malloc::impl_call_pre): Likewise.
2742 (kf_operator_new::impl_call_pre): Likewise.
2743 (kf_realloc::impl_call_postsuccess_with_move::update_model): Likewise.
2744 * region-model-manager.cc
2745 (region_model_manager::create_region_for_heap_alloc): Convert
2746 to...
2747 (region_model_manager::get_or_create_region_for_heap_alloc):
2748 ...this, reusing an existing region if it's unreferenced in the
2749 client state.
2750 * region-model-manager.h (region_model_manager::get_num_regions): New.
2751 (region_model_manager::create_region_for_heap_alloc): Convert to...
2752 (region_model_manager::get_or_create_region_for_heap_alloc): ...this.
2753 * region-model.cc (region_to_value_map::can_merge_with_p): Reject
2754 merger when the values are different.
2755 (region_model::create_region_for_heap_alloc): Convert to...
2756 (region_model::get_or_create_region_for_heap_alloc): ...this.
2757 (region_model::get_referenced_base_regions): New.
2758 (selftest::test_state_merging): Update for change to creation of
2759 heap-allocated regions.
2760 (selftest::test_malloc_constraints): Likewise.
2761 (selftest::test_malloc): Likewise.
2762 * region-model.h: Include "sbitmap.h".
2763 (region_model::create_region_for_heap_alloc): Convert to...
2764 (region_model::get_or_create_region_for_heap_alloc): ...this.
2765 (region_model::get_referenced_base_regions): New decl.
2766 * store.cc (store::canonicalize): Don't purge a heap-allocated region
2767 that's been marked as escaping.
2769 2022-11-24 David Malcolm <dmalcolm@redhat.com>
2771 * checker-path.cc (checker_path::inject_any_inlined_call_events):
2772 Don't dump the address of the block when -fdump-noaddr.
2774 2022-11-24 David Malcolm <dmalcolm@redhat.com>
2776 * region-model.h (region_model::on_socket): Delete decl.
2777 (region_model::on_bind): Likewise.
2778 (region_model::on_listen): Likewise.
2779 (region_model::on_accept): Likewise.
2780 (region_model::on_connect): Likewise.
2781 * sm-fd.cc (kf_socket::outcome_of_socket::update_model): Move body
2782 of region_model::on_socket into here, ...
2783 (region_model::on_socket): ...eliminating this function.
2784 (kf_bind::outcome_of_bind::update_model): Likewise for on_bind...
2785 (region_model::on_bind): ...eliminating this function.
2786 (kf_listen::outcome_of_listen::update_model): Likewise fo
2787 on_listen...
2788 (region_model::on_listen): ...eliminating this function.
2789 (kf_accept::outcome_of_accept::update_model): Likewise fo
2790 on_accept...
2791 (region_model::on_accept): ...eliminating this function.
2792 (kf_connect::outcome_of_connect::update_model): Likewise fo
2793 on_connect...
2794 (region_model::on_connect): ...eliminating this function.
2796 2022-11-24 David Malcolm <dmalcolm@redhat.com>
2798 * analyzer.h (register_known_fd_functions): New decl.
2799 * region-model-impl-calls.cc (class kf_accept): Move to sm-fd.cc.
2800 (class kf_bind): Likewise.
2801 (class kf_connect): Likewise.
2802 (class kf_listen): Likewise.
2803 (class kf_pipe): Likewise.
2804 (class kf_socket): Likewise.
2805 (register_known_functions): Remove registration of the above
2806 functions, instead calling register_known_fd_functions.
2807 * sm-fd.cc: Include "analyzer/call-info.h".
2808 (class kf_socket): Move here from region-model-impl-calls.cc.
2809 (class kf_bind): Likewise.
2810 (class kf_listen): Likewise.
2811 (class kf_accept): Likewise.
2812 (class kf_connect): Likewise.
2813 (class kf_pipe): Likewise.
2814 (register_known_fd_functions): New.
2816 2022-11-22 David Malcolm <dmalcolm@redhat.com>
2818 PR analyzer/107788
2819 * known-function-manager.cc (known_function_manager::get_match):
2820 Don't look up fndecls by name when they're not in the root
2821 namespace.
2823 2022-11-22 David Malcolm <dmalcolm@redhat.com>
2825 PR analyzer/107783
2826 * sm-fd.cc (fd_state_machine::check_for_new_socket_fd): Don't
2827 complain when old state is "fd-constant".
2828 (fd_state_machine::on_listen): Likewise.
2829 (fd_state_machine::on_accept): Likewise.
2831 2022-11-22 David Malcolm <dmalcolm@redhat.com>
2833 PR analyzer/107807
2834 * region-model-impl-calls.cc (register_known_functions): Register
2835 "___errno" and "__error" as synonyms for "__errno_location".
2837 2022-11-22 David Malcolm <dmalcolm@redhat.com>
2839 * analyzer.h (class internal_known_function): New.
2840 (register_varargs_builtins): New decl.
2841 * engine.cc (exploded_node::on_stmt_pre): Remove
2842 "out_terminate_path" param from call to region_model::on_stmt_pre.
2843 (feasibility_state::maybe_update_for_edge): Likewise.
2844 * known-function-manager.cc: Include "basic-block.h", "gimple.h",
2845 and "analyzer/region-model.h".
2846 (known_function_manager::known_function_manager): Initialize
2847 m_combined_fns_arr.
2848 (known_function_manager::~known_function_manager): Clean up
2849 m_combined_fns_arr.
2850 (known_function_manager::get_by_identifier): Make const.
2851 (known_function_manager::add): New overloaded definitions for
2852 enum built_in_function and enum internal_fn.
2853 (known_function_manager::get_by_fndecl): Delete.
2854 (known_function_manager::get_match): New.
2855 (known_function_manager::get_internal_fn): New.
2856 (known_function_manager::get_normal_builtin): New.
2857 * known-function-manager.h
2858 (known_function_manager::get_by_identifier): Make private and
2859 add const qualifier.
2860 (known_function_manager::get_by_fndecl): Delete.
2861 (known_function_manager::add): Add overloaded decls for
2862 enum built_in_function name and enum internal_fn.
2863 (known_function_manager::get_match): New decl.
2864 (known_function_manager::get_internal_fn): New decl.
2865 (known_function_manager::get_normal_builtin): New decl.
2866 (known_function_manager::m_combined_fns_arr): New field.
2867 * region-model-impl-calls.cc (call_details::arg_is_size_p): New.
2868 (class kf_alloca): New.
2869 (region_model::impl_call_alloca): Convert to...
2870 (kf_alloca::impl_call_pre): ...this.
2871 (kf_analyzer_dump_capacity::matches_call_types_p): Rewrite check
2872 to use call_details::arg_is_pointer_p.
2873 (region_model::impl_call_builtin_expect): Convert to...
2874 (class kf_expect): ...this.
2875 (class kf_calloc): New, adding check that both arguments are
2876 size_t.
2877 (region_model::impl_call_calloc): Convert to...
2878 (kf_calloc::impl_call_pre): ...this.
2879 (kf_connect::matches_call_types_p): Rewrite check to use
2880 call_details::arg_is_pointer_p.
2881 (region_model::impl_call_error): Convert to...
2882 (class kf_error): ...this, and...
2883 (kf_error::impl_call_pre): ...this.
2884 (class kf_fgets): New, adding checks that args 0 and 2 are
2885 pointers.
2886 (region_model::impl_call_fgets): Convert to...
2887 (kf_fgets::impl_call_pre): ...this.
2888 (class kf_fread): New, adding checks on the argument types.
2889 (region_model::impl_call_fread): Convert to...
2890 (kf_fread::impl_call_pre): ...this.
2891 (class kf_free): New, adding check that the argument is a pointer.
2892 (region_model::impl_call_free): Convert to...
2893 (kf_free::impl_call_post): ...this.
2894 (class kf_getchar): New.
2895 (class kf_malloc): New, adding check that the argument is a
2896 size_t.
2897 (region_model::impl_call_malloc): Convert to...
2898 (kf_malloc::impl_call_pre): ...this.
2899 (class kf_memcpy): New, adding checks on arguments.
2900 (region_model::impl_call_memcpy): Convert to...
2901 (kf_memcpy::impl_call_pre): ...this.
2902 (class kf_memset): New.
2903 (region_model::impl_call_memset): Convert to...
2904 (kf_memset::impl_call_pre): ...this.
2905 (kf_pipe::matches_call_types_p): Rewrite check to use
2906 call_details::arg_is_pointer_p.
2907 (kf_putenv::matches_call_types_p): Likewise.
2908 (class kf_realloc): New, adding checks on the argument types.
2909 (region_model::impl_call_realloc): Convert to...
2910 (kf_realloc::impl_call_post): ...this.
2911 (class kf_strchr): New.
2912 (region_model::impl_call_strchr): Convert to...
2913 (kf_strchr::impl_call_post): ...this.
2914 (class kf_stack_restore): New.
2915 (class kf_stack_save): New.
2916 (class kf_stdio_output_fn): New.
2917 (class kf_strcpy): New,
2918 (region_model::impl_call_strcpy): Convert to...
2919 (kf_strcpy::impl_call_pre): ...this.
2920 (class kf_strlen): New.
2921 (region_model::impl_call_strlen): Convert to...
2922 (kf_strlen::impl_call_pre): ...this.
2923 (class kf_ubsan_bounds): New.
2924 (region_model::impl_deallocation_call): Reimplement to avoid call
2925 to impl_call_free.
2926 (register_known_functions): Add handlers for IFN_BUILTIN_EXPECT
2927 and IFN_UBSAN_BOUNDS. Add handlers for BUILT_IN_ALLOCA,
2928 BUILT_IN_ALLOCA_WITH_ALIGN, BUILT_IN_CALLOC, BUILT_IN_EXPECT,
2929 BUILT_IN_EXPECT_WITH_PROBABILITY, BUILT_IN_FPRINTF,
2930 BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_FPUTC,
2931 BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
2932 BUILT_IN_FREE, BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED,
2933 BUILT_IN_MALLOC, BUILT_IN_MEMCPY, BUILT_IN_MEMCPY_CHK,
2934 BUILT_IN_MEMSET, BUILT_IN_MEMSET_CHK, BUILT_IN_PRINTF,
2935 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTCHAR,
2936 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_PUTS,
2937 BUILT_IN_PUTS_UNLOCKED, BUILT_IN_REALLOC, BUILT_IN_STACK_RESTORE,
2938 BUILT_IN_STACK_SAVE, BUILT_IN_STRCHR, BUILT_IN_STRCPY,
2939 BUILT_IN_STRCPY_CHK, BUILT_IN_STRLEN, BUILT_IN_VFPRINTF, and
2940 BUILT_IN_VPRINTF. Call register_varargs_builtins. Add handlers
2941 for "getchar", "memset", "fgets", "fgets_unlocked", "fread",
2942 "error", and "error_at_line".
2943 * region-model.cc (region_model::on_stmt_pre): Drop
2944 "out_terminate_path" param.
2945 (region_model::get_known_function): Reimplement by calling
2946 known_function_manager::get_match, passing new "cd" param.
2947 Add overload taking enum internal_fn.
2948 (region_model::on_call_pre): Drop "out_terminate_path" param.
2949 Remove special-case handling of internal fns IFN_BUILTIN_EXPECT,
2950 IFN_UBSAN_BOUNDS, and IFN_VA_ARG, of built-in fns BUILT_IN_ALLOCA,
2951 BUILT_IN_ALLOCA_WITH_ALIGN, BUILT_IN_CALLOC, BUILT_IN_EXPECT,
2952 BUILT_IN_EXPECT_WITH_PROBABILITY, BUILT_IN_FREE, BUILT_IN_MALLOC,
2953 BUILT_IN_MEMCPY, BUILT_IN_MEMCPY_CHK, BUILT_IN_MEMSET,
2954 BUILT_IN_MEMSET_CHK, BUILT_IN_REALLOC, BUILT_IN_STRCHR,
2955 BUILT_IN_STRCPY, BUILT_IN_STRCPY_CHK, BUILT_IN_STRLEN,
2956 BUILT_IN_STACK_SAVE, BUILT_IN_STACK_RESTORE, BUILT_IN_FPRINTF,
2957 BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTC_UNLOCKED,
2958 BUILT_IN_FPUTC, BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS,
2959 BUILT_IN_FPUTS_UNLOCKED, BUILT_IN_FWRITE,
2960 BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
2961 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTCHAR,
2962 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTS, BUILT_IN_PUTS_UNLOCKED,
2963 BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF, BUILT_IN_VA_START, and
2964 BUILT_IN_VA_COPY, and of named functions "malloc", "calloc",
2965 "alloca", "realloc", "error", "error_at_line", "fgets",
2966 "fgets_unlocked", "fread", "getchar", "memset", "strchr", and
2967 "strlen". Replace all this special-casing with calls to
2968 get_known_function for internal fns and for fn decls.
2969 (region_model::on_call_post): Remove special-casing handling for
2970 "free" and "strchr", and for BUILT_IN_REALLOC, BUILT_IN_STRCHR,
2971 and BUILT_IN_VA_END. Replace by consolidating on usage of
2972 get_known_function.
2973 * region-model.h (call_details::arg_is_size_p): New.
2974 (region_model::on_stmt_pre): Drop "out_terminate_path" param.
2975 (region_model::on_call_pre): Likewise.
2976 (region_model::impl_call_alloca): Delete.
2977 (region_model::impl_call_builtin_expect): Delete.
2978 (region_model::impl_call_calloc): Delete.
2979 (region_model::impl_call_error): Delete.
2980 (region_model::impl_call_fgets): Delete.
2981 (region_model::impl_call_fread): Delete.
2982 (region_model::impl_call_free): Delete.
2983 (region_model::impl_call_malloc): Delete.
2984 (region_model::impl_call_memcpy): Delete.
2985 (region_model::impl_call_memset): Delete.
2986 (region_model::impl_call_realloc): Delete.
2987 (region_model::impl_call_strchr): Delete.
2988 (region_model::impl_call_strcpy): Delete.
2989 (region_model::impl_call_strlen): Delete.
2990 (region_model::impl_call_va_start): Delete.
2991 (region_model::impl_call_va_copy): Delete.
2992 (region_model::impl_call_va_arg): Delete.
2993 (region_model::impl_call_va_end): Delete.
2994 (region_model::check_region_for_write): Public.
2995 (region_model::get_known_function): Add "cd" param. Add
2996 overloaded decl taking enum internal_fn.
2997 * sm-malloc.cc: Update comments.
2998 * varargs.cc (class kf_va_start): New.
2999 (region_model::impl_call_va_start): Convert to...
3000 (kf_va_start::impl_call_pre): ...this.
3001 (class kf_va_copy): New.
3002 (region_model::impl_call_va_copy): Convert to...
3003 (kf_va_copy::impl_call_pre): ...this.
3004 (class kf_va_arg): New.
3005 (region_model::impl_call_va_arg): Convert to...
3006 (kf_va_arg::impl_call_pre): ...this.
3007 (class kf_va_end): New.
3008 (region_model::impl_call_va_end): Delete.
3009 (register_varargs_builtins): New.
3011 2022-11-22 David Malcolm <dmalcolm@redhat.com>
3013 PR analyzer/107788
3014 * region-model.cc (region_model::update_for_int_cst_return):
3015 Require that the return type be an integer type.
3016 (region_model::update_for_nonzero_return): Likewise.
3018 2022-11-22 David Malcolm <dmalcolm@redhat.com>
3020 PR analyzer/107783
3021 * region-model-impl-calls.cc (kf_accept::matches_call_types_p):
3022 Require that args 1 and 2 be pointers.
3023 (kf_bind::matches_call_types_p): Require that arg 1 be a pointer.
3024 * region-model.h (call_details::arg_is_pointer_p): New
3026 2022-11-22 David Malcolm <dmalcolm@redhat.com>
3028 PR analyzer/107777
3029 * call-summary.cc
3030 (call_summary_replay::convert_region_from_summary_1): Handle
3031 RK_THREAD_LOCAL and RK_ERRNO in switch.
3032 * region-model.cc (region_model::get_representative_path_var_1):
3033 Likewise.
3035 2022-11-19 David Malcolm <dmalcolm@redhat.com>
3037 PR analyzer/107582
3038 * engine.cc (dynamic_call_info_t::update_model): Update the model
3039 by pushing or pop a frame, rather than by clobbering it with the
3040 model from the exploded_node's state.
3042 2022-11-18 David Malcolm <dmalcolm@redhat.com>
3044 * analyzer.cc (is_pipe_call_p): Delete.
3045 * analyzer.h (is_pipe_call_p): Delete.
3046 * region-model-impl-calls.cc (call_details::get_location): New.
3047 (class kf_analyzer_break): New, adapted from
3048 region_model::on_stmt_pre.
3049 (region_model::impl_call_analyzer_describe): Convert to...
3050 (class kf_analyzer_describe): ...this.
3051 (region_model::impl_call_analyzer_dump_capacity): Convert to...
3052 (class kf_analyzer_dump_capacity): ...this.
3053 (region_model::impl_call_analyzer_dump_escaped): Convert to...
3054 (class kf_analyzer_dump_escaped): ...this.
3055 (class kf_analyzer_dump_exploded_nodes): New.
3056 (region_model::impl_call_analyzer_dump_named_constant): Convert
3057 to...
3058 (class kf_analyzer_dump_named_constant): ...this.
3059 (class dump_path_diagnostic): Move here from region-model.cc.
3060 (class kf_analyzer_dump_path) New, adapted from
3061 region_model::on_stmt_pre.
3062 (class kf_analyzer_dump_region_model): Likewise.
3063 (region_model::impl_call_analyzer_eval): Convert to...
3064 (class kf_analyzer_eval): ...this.
3065 (region_model::impl_call_analyzer_get_unknown_ptr): Convert to...
3066 (class kf_analyzer_get_unknown_ptr): ...this.
3067 (class known_function_accept): Rename to...
3068 (class kf_accept): ...this.
3069 (class known_function_bind): Rename to...
3070 (class kf_bind): ...this.
3071 (class known_function_connect): Rename to...
3072 (class kf_connect): ...this.
3073 (region_model::impl_call_errno_location): Convert to...
3074 (class kf_errno_location): ...this.
3075 (class known_function_listen): Rename to...
3076 (class kf_listen): ...this.
3077 (region_model::impl_call_pipe): Convert to...
3078 (class kf_pipe): ...this.
3079 (region_model::impl_call_putenv): Convert to...
3080 (class kf_putenv): ...this.
3081 (region_model::impl_call_operator_new): Convert to...
3082 (class kf_operator_new): ...this.
3083 (region_model::impl_call_operator_delete): Convert to...
3084 (class kf_operator_delete): ...this.
3085 (class known_function_socket): Rename to...
3086 (class kf_socket): ...this.
3087 (register_known_functions): Rename param to KFM. Break out
3088 existing known functions into a "POSIX" section, and add "pipe",
3089 "pipe2", and "putenv". Add debugging functions
3090 "__analyzer_break", "__analyzer_describe",
3091 "__analyzer_dump_capacity", "__analyzer_dump_escaped",
3092 "__analyzer_dump_exploded_nodes",
3093 "__analyzer_dump_named_constant", "__analyzer_dump_path",
3094 "__analyzer_dump_region_model", "__analyzer_eval",
3095 "__analyzer_get_unknown_ptr". Add C++ support functions
3096 "operator new", "operator new []", "operator delete", and
3097 "operator delete []".
3098 * region-model.cc (class dump_path_diagnostic): Move to
3099 region-model-impl-calls.cc.
3100 (region_model::on_stmt_pre): Eliminate special-casing of
3101 "__analyzer_describe", "__analyzer_dump_capacity",
3102 "__analyzer_dump_escaped", "__analyzer_dump_named_constant",
3103 "__analyzer_dump_path", "__analyzer_dump_region_model",
3104 "__analyzer_eval", "__analyzer_break",
3105 "__analyzer_dump_exploded_nodes", "__analyzer_get_unknown_ptr",
3106 "__errno_location", "pipe", "pipe2", "putenv", "operator new",
3107 "operator new []", "operator delete", "operator delete []"
3108 "pipe" and "pipe2", handling them instead via the known_functions
3109 mechanism.
3110 * region-model.h (call_details::get_location): New decl.
3111 (region_model::impl_call_analyzer_describe): Delete decl.
3112 (region_model::impl_call_analyzer_dump_capacity): Delete decl.
3113 (region_model::impl_call_analyzer_dump_escaped): Delete decl.
3114 (region_model::impl_call_analyzer_dump_named_constant): Delete decl.
3115 (region_model::impl_call_analyzer_eval): Delete decl.
3116 (region_model::impl_call_analyzer_get_unknown_ptr): Delete decl.
3117 (region_model::impl_call_errno_location): Delete decl.
3118 (region_model::impl_call_pipe): Delete decl.
3119 (region_model::impl_call_putenv): Delete decl.
3120 (region_model::impl_call_operator_new): Delete decl.
3121 (region_model::impl_call_operator_delete): Delete decl.
3122 * sm-fd.cc: Update comments.
3124 2022-11-16 David Malcolm <dmalcolm@redhat.com>
3126 PR analyzer/107711
3127 * analyzer-language.cc: Include "diagnostic.h".
3128 (maybe_stash_named_constant): Add logger param and use it to log
3129 the name being looked up, and the result.
3130 (stash_named_constants): New, splitting out from...
3131 (on_finish_translation_unit): ...this function. Call
3132 get_or_create_logfile and use the result to create a logger
3133 instance, passing it to stash_named_constants.
3134 * analyzer.h (get_or_create_any_logfile): New decl.
3135 * engine.cc (dump_fout, owns_dump_fout): New globals, split out
3136 from run_checkers.
3137 (get_or_create_any_logfile): New function, split out from...
3138 (run_checkers): ...here, so that the logfile can be opened by
3139 on_finish_translation_unit. Clear the globals when closing the
3140 dump file.
3142 2022-11-16 David Malcolm <dmalcolm@redhat.com>
3144 * analyzer.h (known_function::matches_call_types_p): New vfunc.
3145 (known_function::impl_call_pre): Provide base implementation.
3146 (known_function::impl_call_post): New vfunc.
3147 (register_known_functions): New.
3148 * engine.cc (impl_run_checkers): Call register_known_functions.
3149 * region-model-impl-calls.cc (region_model::impl_call_accept):
3150 Convert to...
3151 (class known_function_accept): ...this.
3152 (region_model::impl_call_bind): Convert to...
3153 (class known_function_bind): ...this.
3154 (region_model::impl_call_connect): Convert to...
3155 (class known_function_connect): ...this.
3156 (region_model::impl_call_listen): Convert to...
3157 (class known_function_listen): ...this.
3158 (region_model::impl_call_socket): Convert to...
3159 (class known_function_socket): ...this.
3160 (register_known_functions): New.
3161 * region-model.cc (region_model::on_call_pre): Remove special
3162 case for "bind" in favor of the known_function-handling dispatch.
3163 Add call to known_function::matches_call_types_p to latter.
3164 (region_model::on_call_post): Remove special cases for "accept",
3165 "bind", "connect", "listen", and "socket" in favor of dispatch
3166 to known_function::impl_call_post.
3167 * region-model.h (region_model::impl_call_accept): Delete decl.
3168 (region_model::impl_call_bind): Delete decl.
3169 (region_model::impl_call_connect): Delete decl.
3170 (region_model::impl_call_listen): Delete decl.
3171 (region_model::impl_call_socket): Delete decl.
3172 * sm-fd.cc: Update comments.
3174 2022-11-16 David Malcolm <dmalcolm@redhat.com>
3176 * checker-event.cc: New file, split out from...
3177 * checker-path.cc: ...this file.
3179 2022-11-15 David Malcolm <dmalcolm@redhat.com>
3181 PR analyzer/106140
3182 * analyzer-language.cc (on_finish_translation_unit): Stash named
3183 constants "SOCK_STREAM" and "SOCK_DGRAM".
3184 * analyzer.opt (Wanalyzer-fd-phase-mismatch): New.
3185 (Wanalyzer-fd-type-mismatch): New.
3186 * engine.cc (impl_region_model_context::get_state_map_by_name):
3187 Add "out_sm_context" param. Allow out_sm_idx to be NULL.
3188 * exploded-graph.h
3189 (impl_region_model_context::get_state_map_by_name):
3190 Add "out_sm_context" param.
3191 * region-model-impl-calls.cc (region_model::impl_call_accept): New.
3192 (region_model::impl_call_bind): New.
3193 (region_model::impl_call_connect): New.
3194 (region_model::impl_call_listen): New.
3195 (region_model::impl_call_socket): New.
3196 * region-model.cc (region_model::on_call_pre): Special-case
3197 "bind".
3198 (region_model::on_call_post): Special-case "accept", "bind",
3199 "connect", "listen", and "socket".
3200 * region-model.h (region_model::impl_call_accept): New decl.
3201 (region_model::impl_call_bind): New decl.
3202 (region_model::impl_call_connect): New decl.
3203 (region_model::impl_call_listen): New decl.
3204 (region_model::impl_call_socket): New decl.
3205 (region_model::on_socket): New decl.
3206 (region_model::on_bind): New decl.
3207 (region_model::on_listen): New decl.
3208 (region_model::on_accept): New decl.
3209 (region_model::on_connect): New decl.
3210 (region_model::add_constraint): Make public.
3211 (region_model::check_for_poison): Make public.
3212 (region_model_context::get_state_map_by_name): Add out_sm_context param.
3213 (region_model_context::get_fd_map): Likewise.
3214 (region_model_context::get_malloc_map): Likewise.
3215 (region_model_context::get_taint_map): Likewise.
3216 (noop_region_model_context::get_state_map_by_name): Likewise.
3217 (region_model_context_decorator::get_state_map_by_name): Likewise.
3218 * sm-fd.cc: Include "analyzer/supergraph.h" and
3219 "analyzer/analyzer-language.h".
3220 (enum expected_phase): New enum.
3221 (fd_state_machine::m_new_datagram_socket): New.
3222 (fd_state_machine::m_new_stream_socket): New.
3223 (fd_state_machine::m_new_unknown_socket): New.
3224 (fd_state_machine::m_bound_datagram_socket): New.
3225 (fd_state_machine::m_bound_stream_socket): New.
3226 (fd_state_machine::m_bound_unknown_socket): New.
3227 (fd_state_machine::m_listening_stream_socket): New.
3228 (fd_state_machine::m_m_connected_stream_socket): New.
3229 (fd_state_machine::m_SOCK_STREAM): New.
3230 (fd_state_machine::m_SOCK_DGRAM): New.
3231 (fd_diagnostic::describe_state_change): Handle socket states.
3232 (fd_diagnostic::get_meaning_for_state_change): Likewise.
3233 (class fd_phase_mismatch): New.
3234 (enum expected_type): New enum.
3235 (class fd_type_mismatch): New.
3236 (fd_state_machine::fd_state_machine): Initialize new states and
3237 stashed named constants.
3238 (fd_state_machine::is_socket_fd_p): New.
3239 (fd_state_machine::is_datagram_socket_fd_p): New.
3240 (fd_state_machine::is_stream_socket_fd_p): New.
3241 (fd_state_machine::on_close): Handle the socket states.
3242 (fd_state_machine::check_for_open_fd): Complain about fncalls on
3243 sockets in the wrong phase. Support socket FDs.
3244 (add_constraint_ge_zero): New.
3245 (fd_state_machine::get_state_for_socket_type): New.
3246 (fd_state_machine::on_socket): New.
3247 (fd_state_machine::check_for_socket_fd): New.
3248 (fd_state_machine::check_for_new_socket_fd): New.
3249 (fd_state_machine::on_bind): New.
3250 (fd_state_machine::on_listen): New.
3251 (fd_state_machine::on_accept): New.
3252 (fd_state_machine::on_connect): New.
3253 (fd_state_machine::can_purge_p): Don't purge socket values.
3254 (get_fd_state): New.
3255 (region_model::mark_as_valid_fd): Use get_fd_state.
3256 (region_model::on_socket): New.
3257 (region_model::on_bind): New.
3258 (region_model::on_listen): New.
3259 (region_model::on_accept): New.
3260 (region_model::on_connect): New.
3261 * sm-fd.dot: Update to reflect sm-fd.cc changes.
3263 2022-11-15 David Malcolm <dmalcolm@redhat.com>
3265 PR analyzer/106302
3266 * analyzer-language.cc: New file.
3267 * analyzer-language.h: New file.
3268 * analyzer.h (get_stashed_constant_by_name): New decl.
3269 (log_stashed_constants): New decl.
3270 * engine.cc (impl_run_checkers): Call log_stashed_constants.
3271 * region-model-impl-calls.cc
3272 (region_model::impl_call_analyzer_dump_named_constant): New.
3273 * region-model.cc (region_model::on_stmt_pre): Handle
3274 __analyzer_dump_named_constant.
3275 * region-model.h
3276 (region_model::impl_call_analyzer_dump_named_constant): New decl.
3277 * sm-fd.cc (fd_state_machine::m_O_ACCMODE): New.
3278 (fd_state_machine::m_O_RDONLY): New.
3279 (fd_state_machine::m_O_WRONLY): New.
3280 (fd_state_machine::fd_state_machine): Initialize the new fields.
3281 (fd_state_machine::get_access_mode_from_flag): Use the new fields,
3282 rather than using the host values.
3284 2022-11-13 David Malcolm <dmalcolm@redhat.com>
3286 PR analyzer/106235
3287 * analyzer.opt (Wanalyzer-tainted-assertion): New.
3288 * checker-path.cc (checker_path::fixup_locations): Pass false to
3289 pending_diagnostic::fixup_location.
3290 * diagnostic-manager.cc (get_emission_location): Pass true to
3291 pending_diagnostic::fixup_location.
3292 * pending-diagnostic.cc (pending_diagnostic::fixup_location): Add
3293 bool param.
3294 * pending-diagnostic.h (pending_diagnostic::fixup_location): Add
3295 bool param to decl.
3296 * sm-taint.cc (taint_state_machine::m_tainted_control_flow): New.
3297 (taint_diagnostic::describe_state_change): Drop "final".
3298 (class tainted_assertion): New.
3299 (taint_state_machine::taint_state_machine): Initialize
3300 m_tainted_control_flow.
3301 (taint_state_machine::alt_get_inherited_state): Support
3302 comparisons being tainted, based on their arguments.
3303 (is_assertion_failure_handler_p): New.
3304 (taint_state_machine::on_stmt): Complain about calls to assertion
3305 failure handlers guarded by an attacker-controller conditional.
3306 Detect attacker-controlled gcond conditionals and gswitch index
3307 values.
3308 (taint_state_machine::check_control_flow_arg_for_taint): New.
3310 2022-11-11 David Malcolm <dmalcolm@redhat.com>
3312 * sm-fd.dot: Fix typo in comment.
3313 * sm-file.dot: New file.
3314 * varargs.cc: Fix typo in comment.
3315 * varargs.dot: New file.
3317 2022-11-11 David Malcolm <dmalcolm@redhat.com>
3319 * checker-path.h: Split out checker_event and its subclasses to...
3320 * checker-event.h: ...this new header.
3322 2022-11-11 David Malcolm <dmalcolm@redhat.com>
3324 PR analyzer/106147
3325 * analyzer.opt (Wanalyzer-infinite-recursion): New.
3326 * call-string.cc (call_string::count_occurrences_of_function):
3327 New.
3328 * call-string.h (call_string::count_occurrences_of_function): New
3329 decl.
3330 * checker-path.cc (function_entry_event::function_entry_event):
3331 New ctor.
3332 (checker_path::add_final_event): Delete.
3333 * checker-path.h (function_entry_event::function_entry_event): New
3334 ctor.
3335 (function_entry_event::get_desc): Drop "final".
3336 (checker_path::add_final_event): Delete.
3337 * diagnostic-manager.cc
3338 (diagnostic_manager::emit_saved_diagnostic): Create the final
3339 event via a new pending_diagnostic::add_final_event vfunc, rather
3340 than checker_path::add_final_event.
3341 (diagnostic_manager::add_events_for_eedge): Create function entry
3342 events via a new pending_diagnostic::add_function_entry_event
3343 vfunc.
3344 * engine.cc (exploded_graph::process_node): When creating a new
3345 PK_BEFORE_SUPERNODE node, call
3346 exploded_graph::detect_infinite_recursion on it after adding the
3347 in-edge.
3348 * exploded-graph.h (exploded_graph::detect_infinite_recursion):
3349 New decl.
3350 (exploded_graph::find_previous_entry_to): New decl.
3351 * infinite-recursion.cc: New file.
3352 * pending-diagnostic.cc
3353 (pending_diagnostic::add_function_entry_event): New.
3354 (pending_diagnostic::add_final_event): New.
3355 * pending-diagnostic.h
3356 (pending_diagnostic::add_function_entry_event): New vfunc.
3357 (pending_diagnostic::add_final_event): New vfunc.
3359 2022-11-10 David Malcolm <dmalcolm@redhat.com>
3361 PR analyzer/99671
3362 * analyzer.opt (Wanalyzer-deref-before-check): New warning.
3363 * diagnostic-manager.cc
3364 (null_assignment_sm_context::set_next_state): Only add state
3365 change events for transition to "null" state.
3366 (null_assignment_sm_context::is_transition_to_null): New.
3367 * engine.cc (impl_region_model_context::on_pop_frame): New.
3368 * exploded-graph.h (impl_region_model_context::on_pop_frame): New
3369 decl.
3370 * program-state.cc (sm_state_map::clear_any_state): New.
3371 (sm_state_map::can_merge_with_p): New.
3372 (program_state::can_merge_with_p): Replace requirement that
3373 sm-states be equal in favor of an attempt to merge them.
3374 * program-state.h (sm_state_map::clear_any_state): New decl.
3375 (sm_state_map::can_merge_with_p): New decl.
3376 * region-model.cc (region_model::eval_condition): Make const.
3377 (region_model::pop_frame): Call ctxt->on_pop_frame.
3378 * region-model.h (region_model::eval_condition): Make const.
3379 (region_model_context::on_pop_frame): New vfunc.
3380 (noop_region_model_context::on_pop_frame): New.
3381 (region_model_context_decorator::on_pop_frame): New.
3382 * sm-malloc.cc (enum resource_state): Add RS_ASSUMED_NON_NULL.
3383 (allocation_state::dump_to_pp): Drop "final".
3384 (struct assumed_non_null_state): New subclass.
3385 (malloc_state_machine::m_assumed_non_null): New.
3386 (assumed_non_null_p): New.
3387 (class deref_before_check): New.
3388 (assumed_non_null_state::dump_to_pp): New.
3389 (malloc_state_machine::get_or_create_assumed_non_null_state_for_frame):
3390 New.
3391 (malloc_state_machine::maybe_assume_non_null): New.
3392 (malloc_state_machine::on_stmt): Transition from start state to
3393 "assumed-non-null" state for pointers passed to
3394 __attribute__((nonnull)) arguments, and for pointers explicitly
3395 dereferenced. Call maybe_complain_about_deref_before_check for
3396 pointers explicitly compared against NULL.
3397 (malloc_state_machine::maybe_complain_about_deref_before_check):
3398 New.
3399 (malloc_state_machine::on_deallocator_call): Also transition
3400 "assumed-non-null" states to "freed".
3401 (malloc_state_machine::on_pop_frame): New.
3402 (malloc_state_machine::maybe_get_merged_states_nonequal): New.
3403 * sm-malloc.dot: Update for changes to sm-malloc.cc.
3404 * sm.h (state_machine::on_pop_frame): New.
3405 (state_machine::maybe_get_merged_state): New.
3406 (state_machine::maybe_get_merged_states_nonequal): New.
3408 2022-11-09 David Malcolm <dmalcolm@redhat.com>
3410 * checker-path.cc (checker_event::debug): New.
3411 (checker_path::add_event): Move here from checker-path.h. Add
3412 logging.
3413 * checker-path.h (checker_event::debug): New decl.
3414 (checker_path::checker_path): Add logger param.
3415 (checker_path::add_event): Move definition from here to
3416 checker-path.cc.
3417 (checker_path::m_logger): New field.
3418 * diagnostic-manager.cc
3419 (diagnostic_manager::emit_saved_diagnostic): Pass logger to
3420 checker_path ctor.
3421 (diagnostic_manager::add_events_for_eedge): Log scope when
3422 processing a run of stmts.
3424 2022-11-08 David Malcolm <dmalcolm@redhat.com>
3426 PR analyzer/101962
3427 * region-model-impl-calls.cc: Update comment.
3428 * region-model.cc (region_model::check_symbolic_bounds): Fix
3429 layout of "void" return. Replace usage of
3430 eval_condition_without_cm with eval_condition.
3431 (region_model::eval_condition): Take over body of...
3432 (region_model::eval_condition_without_cm): ...this subroutine,
3433 dropping the latter. Eliminating this distinction avoids issues
3434 where constraints were not considered when recursing.
3435 (region_model::compare_initial_and_pointer): Update comment.
3436 (region_model::symbolic_greater_than): Replace usage of
3437 eval_condition_without_cm with eval_condition.
3438 * region-model.h
3439 (region_model::eval_condition_without_cm): Delete decl.
3441 2022-11-08 David Malcolm <dmalcolm@redhat.com>
3443 * region-model-impl-calls.cc
3444 (region_model::impl_call_errno_location): New.
3445 * region-model-manager.cc
3446 (region_model_manager::region_model_manager): Initialize
3447 m_thread_local_region and m_errno_region.
3448 * region-model-manager.h (region_model_manager::get_errno_region):
3449 New accessor.
3450 (region_model_manager::m_thread_local_region): New.
3451 (region_model_manager::m_errno_region): New.
3452 * region-model.cc (region_model::on_call_pre): Special-case
3453 "__errno_location".
3454 (region_model::set_errno): New.
3455 * region-model.h (impl_call_errno_location): New decl.
3456 (region_model::set_errno): New decl.
3457 * region.cc (thread_local_region::dump_to_pp): New.
3458 (errno_region::dump_to_pp): New.
3459 * region.h (enum memory_space): Add MEMSPACE_THREAD_LOCAL.
3460 (enum region_kind): Add RK_THREAD_LOCAL and RK_ERRNO.
3461 (class thread_local_region): New.
3462 (is_a_helper <const thread_local_region *>::test): New.
3463 (class errno_region): New.
3464 (is_a_helper <const errno_region *>::test): New.
3465 * store.cc (binding_cluster::escaped_p): New.
3466 (store::escaped_p): Treat errno as always having escaped.
3467 (store::replay_call_summary_cluster): Handle RK_THREAD_LOCAL and
3468 RK_ERRNO.
3469 * store.h (binding_cluster::escaped_p): Remove definition.
3471 2022-11-08 David Malcolm <dmalcolm@redhat.com>
3473 * call-info.cc (success_call_info::get_desc): Delete.
3474 (failed_call_info::get_desc): Likewise.
3475 (succeed_or_fail_call_info::get_desc): New.
3476 * call-info.h (class succeed_or_fail_call_info): New.
3477 (class success_call_info): Convert to a subclass of
3478 succeed_or_fail_call_info.
3479 (class failed_call_info): Likewise.
3481 2022-11-08 David Malcolm <dmalcolm@redhat.com>
3483 * region-model-impl-calls.cc (region_model::impl_call_strchr):
3484 Move to on_call_post. Handle both outcomes using bifurcation,
3485 rather than just the "not found" case.
3486 * region-model.cc (region_model::on_call_pre): Move
3487 BUILT_IN_STRCHR and "strchr" to...
3488 (region_model::on_call_post): ...here.
3490 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3492 * analyzer.h: Use std::unique_ptr for state machines from plugins.
3493 * engine.cc: Likewise.
3495 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3497 * analyzer.h: Use std::unique_ptr for known functions.
3498 * engine.cc: Likewise.
3499 * known-function-manager.cc: Likewise.
3500 * known-function-manager.h: Likewise.
3502 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3504 * analysis-plan.cc: Define INCLUDE_MEMORY before including
3505 system.h.
3506 * analyzer-pass.cc: Likewise.
3507 * analyzer-selftests.cc: Likewise.
3508 * analyzer.cc: Likewise.
3509 * analyzer.h: Use std::unique_ptr in bifurcation code.
3510 * call-string.cc: Define INCLUDE_MEMORY before including system.h.
3511 * complexity.cc: Likewise.
3512 * engine.cc: Use std::unique_ptr in bifurcation code.
3513 * exploded-graph.h: Likewise.
3514 * known-function-manager.cc: Define INCLUDE_MEMORY before
3515 including system.h.
3516 * region-model-impl-calls.cc: Use std::unique_ptr in bifurcation
3517 code.
3518 * region-model.cc: Likewise.
3519 * region-model.h: Likewise.
3520 * supergraph.cc: Define INCLUDE_MEMORY before including system.h.
3522 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3524 * call-info.cc: Use std::unique_ptr for checker_event.
3525 * checker-path.cc: Likewise.
3526 * checker-path.h: Likewise.
3527 * diagnostic-manager.cc: Likewise.
3528 * engine.cc: Likewise.
3529 * pending-diagnostic.cc: Likewise.
3530 * sm-signal.cc: Likewise.
3531 * varargs.cc: Likewise.
3533 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3535 * diagnostic-manager.cc: Include "make-unique.h".
3536 Use std::unique_ptr for feasibility_problems and exploded_path.
3537 Delete explicit saved_diagnostic dtor.
3538 * diagnostic-manager.h: Likewise.
3539 * engine.cc: Likewise.
3540 * exploded-graph.h: Likewise.
3541 * feasible-graph.cc: Likewise.
3542 * feasible-graph.h: Likewise.
3544 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3546 * checker-path.cc (rewind_event::rewind_event): Update for usage of
3547 std::unique_ptr on custom_edge_info.
3548 * engine.cc (exploded_node::on_longjmp): Likewise.
3549 (exploded_edge::exploded_edge): Likewise.
3550 (exploded_edge::~exploded_edge): Delete.
3551 (exploded_graph::add_function_entry): Update for usage of
3552 std::unique_ptr on custom_edge_info.
3553 (exploded_graph::add_edge): Likewise.
3554 (add_tainted_args_callback): Likewise.
3555 (exploded_graph::maybe_create_dynamic_call): Likewise.
3556 (exploded_graph::process_node): Likewise.
3557 * exploded-graph.h (exploded_edge::~exploded_edge): Delete.
3558 (exploded_edge::m_custom_info): Use std::unique_ptr.
3559 (exploded_edge::add_edge): Likewise.
3560 * sm-signal.cc (register_signal_handler::impl_transition): Use
3561 make_unique.
3563 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3565 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic): Make
3566 stmt_finder const.
3567 (saved_diagnostic::~saved_diagnostic): Remove explicit delete of
3568 m_stmt_finder.
3569 (diagnostic_manager::add_diagnostic): Make stmt_finder const.
3570 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic):
3571 Likewise.
3572 (saved_diagnostic::m_stmt_finder): Convert to std::unique_ptr.
3573 (diagnostic_manager::add_diagnostic): Make stmt_finder const.
3574 * engine.cc (impl_sm_context::impl_sm_context): Likewise.
3575 (impl_sm_context::m_stmt_finder): Likewise.
3576 (leak_stmt_finder::clone): Convert return type to std::unique_ptr.
3577 * exploded-graph.h (stmt_finder::clone): Likewise.
3579 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3581 * call-info.cc: Add define of INCLUDE_MEMORY.
3582 * call-summary.cc: Likewise.
3583 * checker-path.cc: Likewise.
3584 * constraint-manager.cc: Likewise.
3585 * diagnostic-manager.cc: Likewise.
3586 (saved_diagnostic::saved_diagnostic): Use std::unique_ptr for
3587 param d and field m_d.
3588 (saved_diagnostic::~saved_diagnostic): Remove explicit delete of m_d.
3589 (saved_diagnostic::add_note): Use std::unique_ptr for
3590 param pn.
3591 (saved_diagnostic::get_pending_diagnostic): Update for conversion
3592 of m_sd.m_d to unique_ptr.
3593 (diagnostic_manager::add_diagnostic): Use std::unique_ptr for
3594 param d. Remove explicit deletion.
3595 (diagnostic_manager::add_note): Use std::unique_ptr for param pn.
3596 (diagnostic_manager::emit_saved_diagnostic): Update for conversion
3597 of m_sd.m_d to unique_ptr.
3598 (null_assignment_sm_context::warn): Use std::unique_ptr for
3599 param d. Remove explicit deletion.
3600 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Use
3601 std::unique_ptr for param d.
3602 (saved_diagnostic::add_note): Likewise for param pn.
3603 (saved_diagnostic::m_d): Likewise.
3604 (diagnostic_manager::add_diagnostic): Use std::unique_ptr for
3605 param d.
3606 (diagnostic_manager::add_note): Use std::unique_ptr for param pn.
3607 * engine.cc: Include "make-unique.h".
3608 (impl_region_model_context::warn): Update to use std::unique_ptr
3609 for param, removing explicit deletion.
3610 (impl_region_model_context::add_note): Likewise.
3611 (impl_sm_context::warn): Update to use std::unique_ptr
3612 for param.
3613 (impl_region_model_context::on_state_leak): Likewise for result of
3614 on_leak.
3615 (exploded_node::on_longjmp): Use make_unique when creating
3616 pending_diagnostic.
3617 (exploded_graph::process_node): Likewise.
3618 * exploded-graph.h (impl_region_model_context::warn): Update to
3619 use std::unique_ptr for param.
3620 (impl_region_model_context::add_note): Likewise.
3621 * feasible-graph.cc: Add define of INCLUDE_MEMORY.
3622 * pending-diagnostic.cc: Likewise.
3623 * pending-diagnostic.h: Include analyzer.sm.h"
3624 * program-point.cc: Add define of INCLUDE_MEMORY.
3625 * program-state.cc: Likewise.
3626 * region-model-asm.cc: Likewise.
3627 * region-model-impl-calls.cc: Likewise. Include "make-unique.h".
3628 (region_model::impl_call_putenv): Use make_unique when creating
3629 pending_diagnostic.
3630 * region-model-manager.cc: Add define of INCLUDE_MEMORY.
3631 * region-model-reachability.cc: Likewise.
3632 * region-model.cc: Likewise. Include "make-unique.h".
3633 (region_model::get_gassign_result): Use make_unique when creating
3634 pending_diagnostic.
3635 (region_model::check_for_poison): Likewise.
3636 (region_model::on_stmt_pre): Likewise.
3637 (region_model::check_symbolic_bounds): Likewise.
3638 (region_model::check_region_bounds): Likewise.
3639 (annotating_ctxt: make_note): Use std::unique_ptr for result.
3640 (region_model::deref_rvalue): Use make_unique when creating
3641 pending_diagnostic.
3642 (region_model::check_for_writable_region): Likewise.
3643 (region_model::check_region_size): Likewise.
3644 (region_model::check_dynamic_size_for_floats): Likewise.
3645 (region_model::maybe_complain_about_infoleak): Likewise.
3646 (noop_region_model_context::add_note): Use std::unique_ptr for
3647 param. Remove explicit deletion.
3648 * region-model.h: Include "analyzer/pending-diagnostic.h".
3649 (region_model_context::warn): Convert param to std::unique_ptr.
3650 (region_model_context::add_note): Likewise.
3651 (noop_region_model_context::warn): Likewise.
3652 (noop_region_model_context::add_note): Likewise.
3653 (region_model_context_decorator::warn): Likewise.
3654 (region_model_context_decorator::add_note): Likewise.
3655 (note_adding_context::warn): Likewise.
3656 (note_adding_context::make_note): Likewise for return type.
3657 (test_region_model_context::warn): Convert param to
3658 std::unique_ptr.
3659 * region.cc: Add define of INCLUDE_MEMORY.
3660 * sm-fd.cc: Likewise. Include "make-unique.h".
3661 (fd_state_machine::check_for_fd_attrs): Use make_unique when
3662 creating pending_diagnostics.
3663 (fd_state_machine::on_open): Likewise.
3664 (fd_state_machine::on_creat): Likewise.
3665 (fd_state_machine::check_for_dup): Likewise.
3666 (fd_state_machine::on_close): Likewise.
3667 (fd_state_machine::check_for_open_fd): Likewise.
3668 (fd_state_machine::on_leak): Likewise, converting return type to
3669 std::unique_ptr.
3670 * sm-file.cc: Add define of INCLUDE_MEMORY. Include
3671 "make-unique.h".
3672 (fileptr_state_machine::on_stmt): Use make_unique when creating
3673 pending_diagnostic.
3674 (fileptr_state_machine::on_leak): Likewise, converting return type
3675 to std::unique_ptr.
3676 * sm-malloc.cc: Add define of INCLUDE_MEMORY. Include
3677 "make-unique.h".
3678 (malloc_state_machine::on_stmt): Use make_unique when creating
3679 pending_diagnostic.
3680 (malloc_state_machine::handle_free_of_non_heap): Likewise.
3681 (malloc_state_machine::on_deallocator_call): Likewise.
3682 (malloc_state_machine::on_realloc_call): Likewise.
3683 (malloc_state_machine::on_leak): Likewise, converting return type
3684 to std::unique_ptr.
3685 * sm-pattern-test.cc: Add define of INCLUDE_MEMORY. Include
3686 "make-unique.h".
3687 (pattern_test_state_machine::on_condition): Use make_unique when
3688 creating pending_diagnostic.
3689 * sm-sensitive.cc: Add define of INCLUDE_MEMORY. Include
3690 "make-unique.h".
3691 (sensitive_state_machine::warn_for_any_exposure): Use make_unique
3692 when creating pending_diagnostic.
3693 * sm-signal.cc: Add define of INCLUDE_MEMORY. Include
3694 "make-unique.h".
3695 (signal_state_machine::on_stmt): Use make_unique when creating
3696 pending_diagnostic.
3697 * sm-taint.cc: Add define of INCLUDE_MEMORY. Include
3698 "make-unique.h".
3699 (taint_state_machine::check_for_tainted_size_arg): Use make_unique
3700 when creating pending_diagnostic.
3701 (taint_state_machine::check_for_tainted_divisor): Likewise.
3702 (region_model::check_region_for_taint): Likewise.
3703 (region_model::check_dynamic_size_for_taint): Likewise.
3704 * sm.cc: Add define of INCLUDE_MEMORY. Include
3705 "analyzer/pending-diagnostic.h".
3706 (state_machine::on_leak): Move here from sm.h, changing return
3707 type to std::unique_ptr.
3708 * sm.h (state_machine::on_leak): Change return type to
3709 std::unique_ptr. Move defn of base impl to sm.cc
3710 (sm_context::warn): Convert param d to std_unique_ptr.
3711 * state-purge.cc: Add define of INCLUDE_MEMORY.
3712 * store.cc: Likewise.
3713 * svalue.cc: Likewise.
3714 * trimmed-graph.cc: Likewise.
3715 * varargs.cc: Likewise. Include "make-unique.h".
3716 (va_list_state_machine::check_for_ended_va_list): Use make_unique
3717 when creating pending_diagnostic.
3718 (va_list_state_machine::on_leak): Likewise, converting return type
3719 to std::unique_ptr.
3720 (region_model::impl_call_va_arg): Use make_unique when creating
3721 pending_diagnostic.
3723 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3725 PR analyzer/107486
3726 * analyzer.cc (is_pipe_call_p): New.
3727 * analyzer.h (is_pipe_call_p): New decl.
3728 * region-model.cc (region_model::on_call_pre): Use it.
3729 (region_model::on_call_post): Likewise.
3731 2022-10-26 David Malcolm <dmalcolm@redhat.com>
3733 * sm-fd.cc (fd_state_machine::on_open): Transition to "unchecked"
3734 when the mode is symbolic, rather than just on integer constants.
3735 (fd_state_machine::check_for_open_fd): Don't complain about
3736 unchecked values in the start state.
3738 2022-10-26 David Malcolm <dmalcolm@redhat.com>
3740 * sm-fd.dot: New file.
3742 2022-10-24 David Malcolm <dmalcolm@redhat.com>
3744 PR analyzer/107349
3745 * varargs.cc (get_va_copy_arg): Fix the non-pointer case.
3747 2022-10-24 David Malcolm <dmalcolm@redhat.com>
3749 PR analyzer/107345
3750 * region-model.cc (region_model::eval_condition_without_cm):
3751 Ensure that constants are on the right-hand side before checking
3752 for them.
3754 2022-10-24 David Malcolm <dmalcolm@redhat.com>
3756 * engine.cc (impl_region_model_context::get_malloc_map): Replace
3757 with...
3758 (impl_region_model_context::get_state_map_by_name): ...this.
3759 (impl_region_model_context::get_fd_map): Delete.
3760 (impl_region_model_context::get_taint_map): Delete.
3761 * exploded-graph.h (impl_region_model_context::get_fd_map):
3762 Delete.
3763 (impl_region_model_context::get_malloc_map): Delete.
3764 (impl_region_model_context::get_taint_map): Delete.
3765 (impl_region_model_context::get_state_map_by_name): New.
3766 * region-model.h (region_model_context::get_state_map_by_name):
3767 New vfunc.
3768 (region_model_context::get_fd_map): Convert from vfunc to
3769 function.
3770 (region_model_context::get_malloc_map): Likewise.
3771 (region_model_context::get_taint_map): Likewise.
3772 (noop_region_model_context::get_state_map_by_name): New.
3773 (noop_region_model_context::get_fd_map): Delete.
3774 (noop_region_model_context::get_malloc_map): Delete.
3775 (noop_region_model_context::get_taint_map): Delete.
3776 (region_model_context_decorator::get_state_map_by_name): New.
3777 (region_model_context_decorator::get_fd_map): Delete.
3778 (region_model_context_decorator::get_malloc_map): Delete.
3779 (region_model_context_decorator::get_taint_map): Delete.
3781 2022-10-24 David Malcolm <dmalcolm@redhat.com>
3783 PR analyzer/106300
3784 * engine.cc (impl_region_model_context::get_fd_map): New.
3785 * exploded-graph.h (impl_region_model_context::get_fd_map): New
3786 decl.
3787 * region-model-impl-calls.cc (region_model::impl_call_pipe): New.
3788 * region-model.cc (region_model::update_for_int_cst_return): New,
3789 based on...
3790 (region_model::update_for_zero_return): ...this. Reimplement in
3791 terms of the former.
3792 (region_model::on_call_pre): Handle "pipe" and "pipe2".
3793 (region_model::on_call_post): Likewise.
3794 * region-model.h (region_model::impl_call_pipe): New decl.
3795 (region_model::update_for_int_cst_return): New decl.
3796 (region_model::mark_as_valid_fd): New decl.
3797 (region_model_context::get_fd_map): New pure virtual fn.
3798 (noop_region_model_context::get_fd_map): New.
3799 (region_model_context_decorator::get_fd_map): New.
3800 * sm-fd.cc: Include "analyzer/program-state.h".
3801 (fd_state_machine::describe_state_change): Handle transitions from
3802 start state to valid states.
3803 (fd_state_machine::mark_as_valid_fd): New.
3804 (fd_state_machine::on_stmt): Add missing return for "creat".
3805 (region_model::mark_as_valid_fd): New.
3807 2022-10-19 David Malcolm <dmalcolm@redhat.com>
3809 PR analyzer/105765
3810 * varargs.cc (get_BT_VALIST_ARG): Rename to...
3811 (get_va_copy_arg): ...this, and update logic for determining level
3812 of indirection of va_copy's argument to use type of argument,
3813 rather than looking at va_list_type_node, to correctly handle
3814 __builtin_ms_va_copy.
3815 (get_stateful_BT_VALIST_ARG): Rename to...
3816 (get_stateful_va_copy_arg): ...this.
3817 (va_list_state_machine::on_va_copy): Update for renaming.
3818 (region_model::impl_call_va_copy): Likewise.
3820 2022-10-13 David Malcolm <dmalcolm@redhat.com>
3822 PR analyzer/107210
3823 * svalue.cc (constant_svalue::maybe_fold_bits_within): Only
3824 attempt to extract individual bits when tree_fits_uhwi_p.
3826 2022-10-07 David Malcolm <dmalcolm@redhat.com>
3828 PR analyzer/105783
3829 * region-model.cc (selftest::get_bit): New function.
3830 (selftest::test_bits_within_svalue_folding): New.
3831 (selfftest::analyzer_region_model_cc_tests): Call it.
3832 * svalue.cc (constant_svalue::maybe_fold_bits_within): Handle the
3833 case of extracting a single bit.
3835 2022-10-06 David Malcolm <dmalcolm@redhat.com>
3837 PR analyzer/107158
3838 * store.cc (store::replay_call_summary_cluster): Eliminate
3839 special-casing of RK_HEAP_ALLOCATED in favor of sharing code with
3840 RK_DECL, avoiding an ICE due to attempting to bind a
3841 compound_svalue into a binding_cluster when an svalue in the
3842 summary cluster converts to a compound_svalue in the caller.
3844 2022-10-06 David Malcolm <dmalcolm@redhat.com>
3846 * call-summary.cc (call_summary_replay::dump_to_pp): Bulletproof
3847 against NULL caller regions/svalues.
3849 2022-10-05 David Malcolm <dmalcolm@redhat.com>
3851 * analysis-plan.cc: Simplify includes.
3852 * analyzer-pass.cc: Likewise.
3853 * analyzer-selftests.cc: Likewise.
3854 * analyzer.cc: Likewise.
3855 * analyzer.h: Add includes of "json.h" and "tristate.h".
3856 * call-info.cc: Simplify includes.
3857 * call-string.cc: Likewise.
3858 * call-summary.cc: Likewise.
3859 * checker-path.cc: Likewise.
3860 * complexity.cc: Likewise.
3861 * constraint-manager.cc: Likewise.
3862 * diagnostic-manager.cc: Likewise.
3863 * engine.cc: Likewise.
3864 * feasible-graph.cc: Likewise.
3865 * known-function-manager.cc: Likewise.
3866 * pending-diagnostic.cc: Likewise.
3867 * program-point.cc: Likewise.
3868 * program-state.cc: Likewise.
3869 * region-model-asm.cc: Likewise.
3870 * region-model-impl-calls.cc: Likewise.
3871 * region-model-manager.cc: Likewise.
3872 * region-model-reachability.cc: Likewise.
3873 * region-model.cc: Likewise.
3874 * region-model.h: Include "selftest.h".
3875 * region.cc: Simplify includes.
3876 * sm-fd.cc: Likewise.
3877 * sm-file.cc: Likewise.
3878 * sm-malloc.cc: Likewise.
3879 * sm-pattern-test.cc: Likewise.
3880 * sm-sensitive.cc: Likewise.
3881 * sm-signal.cc: Likewise.
3882 * sm-taint.cc: Likewise.
3883 * sm.cc: Likewise.
3884 * state-purge.cc: Likewise.
3885 * store.cc: Likewise.
3886 * store.h: Likewise.
3887 * supergraph.cc: Likewise.
3888 * svalue.cc: Likewise.
3889 * svalue.h: Likewise.
3890 * trimmed-graph.cc: Likewise.
3891 * varargs.cc: Likewise.
3893 2022-10-05 David Malcolm <dmalcolm@redhat.com>
3895 PR analyzer/107060
3896 * call-summary.cc
3897 (call_summary_replay::convert_svalue_from_summary_1): Handle NULL
3898 results from convert_svalue_from_summary in SK_UNARY_OP and
3899 SK_BIN_OP.
3900 * engine.cc (impl_region_model_context::on_unknown_change): Bail
3901 out on svalues that can't have associated state.
3902 * region-model-impl-calls.cc
3903 (region_model::impl_call_analyzer_get_unknown_ptr): New.
3904 * region-model.cc (region_model::on_stmt_pre): Handle
3905 "__analyzer_get_unknown_ptr".
3906 * region-model.h
3907 (region_model::impl_call_analyzer_get_unknown_ptr): New decl.
3908 * store.cc (store::replay_call_summary_cluster): Avoid trying to
3909 create binding clusters for base regions that shouldn't have them.
3911 2022-10-05 Martin Liska <mliska@suse.cz>
3913 * call-summary.cc (call_summary_replay::call_summary_replay):
3914 Remove unused variable and arguments.
3915 * call-summary.h: Likewise.
3916 * engine.cc (exploded_node::on_stmt): Likewise.
3917 (exploded_node::replay_call_summaries): Likewise.
3918 (exploded_node::replay_call_summary): Likewise.
3919 * exploded-graph.h (class exploded_node): Likewise.
3921 2022-10-05 David Malcolm <dmalcolm@redhat.com>
3923 PR analyzer/107072
3924 * analyzer-logging.h: Include "diagnostic-core.h".
3925 * analyzer.h: Include "function.h".
3926 (class call_summary): New forward decl.
3927 (class call_summary_replay): New forward decl.
3928 (struct per_function_data): New forward decl.
3929 (struct interesting_t): New forward decl.
3930 (custom_edge_info::update_state): New vfunc.
3931 * call-info.cc (custom_edge_info::update_state): New.
3932 * call-summary.cc: New file.
3933 * call-summary.h: New file.
3934 * constraint-manager.cc: Include "analyzer/call-summary.h".
3935 (class replay_fact_visitor): New.
3936 (constraint_manager::replay_call_summary): New.
3937 * constraint-manager.h (constraint_manager::replay_call_summary):
3938 New.
3939 * engine.cc: Include "analyzer/call-summary.h".
3940 (exploded_node::on_stmt): Handle call summaries.
3941 (class call_summary_edge_info): New.
3942 (exploded_node::replay_call_summaries): New.
3943 (exploded_node::replay_call_summary): New.
3944 (per_function_data::~per_function_data): New.
3945 (per_function_data::add_call_summary): Move here from header and
3946 reimplement.
3947 (exploded_graph::process_node): Call update_state rather than
3948 update_model when handling bifurcation
3949 (viz_callgraph_node::dump_dot): Use a regular label rather
3950 than an HTML table; add summaries to dump.
3951 * exploded-graph.h: Include "alloc-pool.h", "fibonacci_heap.h",
3952 "supergraph.h", "sbitmap.h", "shortest-paths.h", "analyzer/sm.h",
3953 "analyzer/program-state.h", and "analyzer/diagnostic-manager.h".
3954 (exploded_node::replay_call_summaries): New decl.
3955 (exploded_node::replay_call_summary): New decl.
3956 (per_function_data::~per_function_data): New decl.
3957 (per_function_data::add_call_summary): Move implemention from
3958 header.
3959 (per_function_data::m_summaries): Update type of element.
3960 * known-function-manager.h: Include "analyzer/analyzer-logging.h".
3961 * program-point.h: Include "pretty-print.h" and
3962 "analyzer/call-string.h".
3963 * program-state.cc: Include "analyzer/call-summary.h".
3964 (sm_state_map::replay_call_summary): New.
3965 (program_state::replay_call_summary): New.
3966 * program-state.h (sm_state_map::replay_call_summary): New decl.
3967 (program_state::replay_call_summary): New decl.
3968 * region-model-manager.cc
3969 (region_model_manager::get_or_create_asm_output_svalue): New
3970 overload.
3971 * region-model-manager.h
3972 (region_model_manager::get_or_create_asm_output_svalue): New
3973 overload decl.
3974 * region-model.cc: Include "analyzer/call-summary.h".
3975 (region_model::maybe_update_for_edge): Remove call to
3976 region_model::update_for_call_summary on
3977 SUPEREDGE_INTRAPROCEDURAL_CALL.
3978 (region_model::update_for_call_summary): Delete.
3979 (region_model::replay_call_summary): New.
3980 * region-model.h (region_model::replay_call_summary): New decl.
3981 (region_model::update_for_call_summary): Delete decl.
3982 * store.cc: Include "analyzer/call-summary.h".
3983 (store::replay_call_summary): New.
3984 (store::replay_call_summary_cluster): New.
3985 * store.h: Include "tristate.h".
3986 (is_a_helper <const ana::concrete_binding *>::test): New.
3987 (store::replay_call_summary): New decl.
3988 (store::replay_call_summary_cluster): New decl.
3989 * supergraph.cc (get_ultimate_function_for_cgraph_edge): Remove
3990 "static" from decl.
3991 (supergraph_call_edge): Make stmt param const.
3992 * supergraph.h: Include "ordered-hash-map.h", "cfg.h",
3993 "basic-block.h", "gimple.h", "gimple-iterator.h", and "digraph.h".
3994 (supergraph_call_edge): Make stmt param const.
3995 (get_ultimate_function_for_cgraph_edge): New decl.
3996 * svalue.cc (compound_svalue::compound_svalue): Assert that we're
3997 not nesting compound_svalues.
3998 * svalue.h: Include "json.h", "analyzer/store.h", and
3999 "analyzer/program-point.h".
4000 (asm_output_svalue::get_num_outputs): New accessor.
4002 2022-10-05 David Malcolm <dmalcolm@redhat.com>
4004 * region-model.h: Include "analyzer/region-model-manager.h"
4005 (class region_model_manager): Move decl to...
4006 * region-model-manager.h: ...this new file.
4008 2022-10-05 David Malcolm <dmalcolm@redhat.com>
4010 * region-model-manager.cc
4011 (region_model_manager::maybe_fold_unaryop): Fold -(-(VAL)) to VAL.
4013 2022-10-05 David Malcolm <dmalcolm@redhat.com>
4015 * region-model-manager.cc
4016 (region_model_manager::get_or_create_widening_svalue): Use a
4017 function_point rather than a program_point.
4018 * region-model.cc (selftest::test_widening_constraints): Likewise.
4019 * region-model.h
4020 (region_model_manager::get_or_create_widening_svalue): Likewise.
4021 (model_merger::get_function_point): New.
4022 * svalue.cc (svalue::can_merge_p): Use a function_point rather
4023 than a program_point.
4024 (svalue::can_merge_p): Likewise.
4025 * svalue.h (widening_svalue::key_t): Likewise.
4026 (widening_svalue::widening_svalue): Likewise.
4028 2022-09-12 Martin Liska <mliska@suse.cz>
4030 * region-model.cc (region_model::maybe_complain_about_infoleak):
4031 Remove unused fields.
4033 2022-09-11 Tim Lange <mail@tim-lange.me>
4035 PR analyzer/106845
4036 * region-model.cc (region_model::check_region_bounds):
4037 Bail out if 0 bytes were accessed.
4038 * store.cc (byte_range::dump_to_pp):
4039 Add special case for empty ranges.
4040 (byte_range::exceeds_p): Restrict to non-empty ranges.
4041 (byte_range::falls_short_of_p): Restrict to non-empty ranges.
4042 * store.h (bit_range::empty_p): New function.
4043 (bit_range::get_last_byte_offset): Restrict to non-empty ranges.
4044 (byte_range::empty_p): New function.
4045 (byte_range::get_last_byte_offset): Restrict to non-empty ranges.
4047 2022-09-09 David Malcolm <dmalcolm@redhat.com>
4049 * analyzer.opt (Wanalyzer-exposure-through-uninit-copy): New.
4050 * checker-path.cc (region_creation_event::region_creation_event):
4051 Add "capacity" and "kind" params.
4052 (region_creation_event::get_desc): Generalize to different kinds
4053 of event.
4054 (checker_path::add_region_creation_event): Convert to...
4055 (checker_path::add_region_creation_events): ...this.
4056 * checker-path.h (enum rce_kind): New.
4057 (region_creation_event::region_creation_event): Add "capacity" and
4058 "kind" params.
4059 (region_creation_event::m_capacity): New field.
4060 (region_creation_event::m_rce_kind): New field.
4061 (checker_path::add_region_creation_event): Convert to...
4062 (checker_path::add_region_creation_events): ...this.
4063 * diagnostic-manager.cc (diagnostic_manager::build_emission_path):
4064 Update for multiple region creation events.
4065 (diagnostic_manager::add_event_on_final_node): Likewise.
4066 (diagnostic_manager::add_events_for_eedge): Likewise.
4067 * region-model-impl-calls.cc (call_details::get_logger): New.
4068 * region-model.cc: Define INCLUDE_MEMORY before including
4069 "system.h". Include "gcc-rich-location.h".
4070 (class record_layout): New.
4071 (class exposure_through_uninit_copy): New.
4072 (contains_uninit_p): New.
4073 (region_model::maybe_complain_about_infoleak): New.
4074 * region-model.h (call_details::get_logger): New decl.
4075 (region_model::maybe_complain_about_infoleak): New decl.
4076 (region_model::mark_as_tainted): New decl.
4077 * sm-taint.cc (region_model::mark_as_tainted): New.
4079 2022-09-09 David Malcolm <dmalcolm@redhat.com>
4081 * analyzer.h (class known_function_manager): New forward decl.
4082 (class known_function): New.
4083 (plugin_analyzer_init_iface::register_known_function): New.
4084 * engine.cc: Include "analyzer/known-function-manager.h".
4085 (plugin_analyzer_init_impl::plugin_analyzer_init_impl): Add
4086 known_fn_mgr param.
4087 (plugin_analyzer_init_impl::register_state_machine): Add
4088 LOC_SCOPE.
4089 (plugin_analyzer_init_impl::register_known_function): New.
4090 (plugin_analyzer_init_impl::m_known_fn_mgr): New.
4091 (impl_run_checkers): Update plugin callback invocation to use
4092 eng's known_function_manager.
4093 * known-function-manager.cc: New file.
4094 * known-function-manager.h: New file.
4095 * region-model-manager.cc
4096 (region_model_manager::region_model_manager): Pass logger to
4097 m_known_fn_mgr's ctor.
4098 * region-model.cc (region_model::update_for_zero_return): New.
4099 (region_model::update_for_nonzero_return): New.
4100 (maybe_simplify_upper_bound): New.
4101 (region_model::maybe_get_copy_bounds): New.
4102 (region_model::get_known_function): New.
4103 (region_model::on_call_pre): Handle plugin-supplied known
4104 functions.
4105 * region-model.h: Include "analyzer/known-function-manager.h".
4106 (region_model_manager::get_known_function_manager): New.
4107 (region_model_manager::m_known_fn_mgr): New.
4108 (call_details::get_model): New accessor.
4109 (region_model::maybe_get_copy_bounds): New decl.
4110 (region_model::update_for_zero_return): New decl.
4111 (region_model::update_for_nonzero_return): New decl.
4112 (region_model::get_known_function): New decl.
4113 (region_model::get_known_function_manager): New.
4115 2022-09-08 Tim Lange <mail@tim-lange.me>
4117 PR analyzer/106625
4118 * analyzer.h (region_offset): Eliminate m_is_symbolic member.
4119 * region-model-impl-calls.cc (region_model::impl_call_realloc):
4120 Refine implementation to be more precise.
4121 * region-model.cc (class symbolic_past_the_end):
4122 Abstract diagnostic class to complain about accesses past the end
4123 with symbolic values.
4124 (class symbolic_buffer_overflow):
4125 Concrete diagnostic class to complain about buffer overflows with
4126 symbolic values.
4127 (class symbolic_buffer_overread):
4128 Concrete diagnostic class to complain about buffer overreads with
4129 symbolic values.
4130 (region_model::check_symbolic_bounds): New function.
4131 (maybe_get_integer_cst_tree): New helper function.
4132 (region_model::check_region_bounds):
4133 Add call to check_symbolic_bounds if offset is not concrete.
4134 (region_model::eval_condition_without_cm):
4135 Add support for EQ_EXPR and GT_EXPR with binaryop_svalues.
4136 (is_positive_svalue): New hleper function.
4137 (region_model::symbolic_greater_than):
4138 New function to handle GT_EXPR comparisons with symbolic values.
4139 (region_model::structural_equality): New function to compare
4140 whether two svalues are structured the same, i.e. evaluate to
4141 the same value.
4142 (test_struct): Reflect changes to region::calc_offset.
4143 (test_var): Likewise.
4144 (test_array_2): Likewise and add selftest with symbolic i.
4145 * region-model.h (class region_model): Add check_symbolic_bounds,
4146 symbolic_greater_than and structural_equality.
4147 * region.cc (region::get_offset):
4148 Reflect changes to region::calc_offset.
4149 (region::calc_offset):
4150 Compute the symbolic offset if the offset is not concrete.
4151 (region::get_relative_symbolic_offset): New function to return the
4152 symbolic offset in bytes relative to its parent.
4153 (field_region::get_relative_symbolic_offset): Likewise.
4154 (element_region::get_relative_symbolic_offset): Likewise.
4155 (offset_region::get_relative_symbolic_offset): Likewise.
4156 (bit_range_region::get_relative_symbolic_offset): Likewise.
4157 * region.h: Add get_relative_symbolic_offset.
4158 * store.cc (binding_key::make):
4159 Reflect changes to region::calc_offset.
4160 (binding_map::apply_ctor_val_to_range): Likewise.
4161 (binding_map::apply_ctor_pair_to_child_region): Likewise.
4162 (binding_cluster::bind_compound_sval): Likewise.
4163 (binding_cluster::get_any_binding): Likewise.
4164 (binding_cluster::maybe_get_compound_binding): Likewise.
4166 2022-09-05 Tim Lange <mail@tim-lange.me>
4168 * region-model-impl-calls.cc (region_model::impl_call_strcpy):
4169 Handle the constant string case.
4170 * region-model.cc (region_model::get_string_size):
4171 New function to get the string size from a region or svalue.
4172 * region-model.h (class region_model): Add get_string_size.
4174 2022-09-05 Tim Lange <mail@tim-lange.me>
4176 * region.cc (cast_region::get_relative_concrete_offset):
4177 New overloaded method.
4178 * region.h: Add cast_region::get_relative_concrete_offset.
4180 2022-08-22 Martin Liska <mliska@suse.cz>
4182 * region-model.cc: Add missing final keyword.
4184 2022-08-18 Tim Lange <mail@tim-lange.me>
4186 PR analyzer/106181
4187 * analyzer.opt: Add Wanalyzer-imprecise-floating-point-arithmetic.
4188 * region-model.cc (is_any_cast_p): Formatting.
4189 (region_model::check_region_size): Ensure precondition.
4190 (class imprecise_floating_point_arithmetic): New abstract
4191 diagnostic class for all floating-point related warnings.
4192 (class float_as_size_arg): Concrete diagnostic class to complain
4193 about floating-point operands inside the size argument.
4194 (class contains_floating_point_visitor):
4195 New visitor to find floating-point operands inside svalues.
4196 (region_model::check_dynamic_size_for_floats): New function.
4197 (region_model::set_dynamic_extents):
4198 Call to check_dynamic_size_for_floats.
4199 * region-model.h (class region_model):
4200 Add region_model::check_dynamic_size_for_floats.
4202 2022-08-16 Martin Liska <mliska@suse.cz>
4204 * region-model.cc: Fix -Winconsistent-missing-override clang
4205 warning.
4206 * region.h: Likewise.
4208 2022-08-15 David Malcolm <dmalcolm@redhat.com>
4210 PR analyzer/106626
4211 * region-model.cc (buffer_overread::emit): Fix copy&paste error in
4212 direction of the access in the note.
4214 2022-08-15 David Malcolm <dmalcolm@redhat.com>
4216 PR analyzer/106573
4217 * region-model.cc (region_model::on_call_pre): Use check_call_args
4218 when ensuring that we call get_arg_svalue on all args. Remove
4219 redundant call from handling for stdio builtins.
4221 2022-08-15 Immad Mir <mirimmad@outlook.com>
4223 PR analyzer/106551
4224 * sm-fd.cc (check_for_dup): exit early if first
4225 argument is invalid for all dup functions.
4227 2022-08-12 Tim Lange <mail@tim-lange.me>
4229 PR analyzer/106000
4230 * analyzer.opt: Add Wanalyzer-out-of-bounds.
4231 * region-model.cc (class out_of_bounds): Diagnostics base class
4232 for all out-of-bounds diagnostics.
4233 (class past_the_end): Base class derived from out_of_bounds for
4234 the buffer_overflow and buffer_overread diagnostics.
4235 (class buffer_overflow): Buffer overflow diagnostics.
4236 (class buffer_overread): Buffer overread diagnostics.
4237 (class buffer_underflow): Buffer underflow diagnostics.
4238 (class buffer_underread): Buffer overread diagnostics.
4239 (region_model::check_region_bounds): New function to check region
4240 bounds for out-of-bounds accesses.
4241 (region_model::check_region_access):
4242 Add call to check_region_bounds.
4243 (region_model::get_representative_tree): New function that accepts
4244 a region instead of an svalue.
4245 * region-model.h (class region_model):
4246 Add region_model::check_region_bounds.
4247 * region.cc (region::symbolic_p): New predicate.
4248 (offset_region::get_byte_size_sval): Only return the remaining
4249 byte size on offset_regions.
4250 * region.h: Add region::symbolic_p.
4251 * store.cc (byte_range::intersects_p):
4252 Add new function equivalent to bit_range::intersects_p.
4253 (byte_range::exceeds_p): New function.
4254 (byte_range::falls_short_of_p): New function.
4255 * store.h (struct byte_range): Add byte_range::intersects_p,
4256 byte_range::exceeds_p and byte_range::falls_short_of_p.
4258 2022-08-12 Tim Lange <mail@tim-lange.me>
4260 PR analyzer/106539
4261 * region-model-impl-calls.cc (region_model::impl_call_realloc):
4262 Use the result of get_copied_size as the size for the
4263 sized_regions in realloc.
4264 (success_with_move::get_copied_size): New function.
4266 2022-08-11 Immad Mir <mirimmad@outlook.com>
4268 PR analyzer/106551
4269 * sm-fd.cc (check_for_dup): handle the m_start
4270 state when transitioning the state of LHS
4271 of dup, dup2 and dup3 call.
4273 2022-08-09 David Malcolm <dmalcolm@redhat.com>
4275 PR analyzer/106573
4276 * region-model.cc (region_model::on_call_pre): Ensure that we call
4277 get_arg_svalue on all arguments.
4279 2022-08-05 David Malcolm <dmalcolm@redhat.com>
4281 PR analyzer/105947
4282 * analyzer.opt (Wanalyzer-jump-through-null): New option.
4283 * engine.cc (class jump_through_null): New.
4284 (exploded_graph::process_node): Complain about jumps through NULL
4285 function pointers.
4287 2022-08-02 Immad Mir <mirimmad@outlook.com>
4289 PR analyzer/106298
4290 * sm-fd.cc (fd_state_machine::on_open): Add
4291 creat, dup, dup2 and dup3 functions.
4292 (enum dup): New.
4293 (fd_state_machine::valid_to_unchecked_state): New.
4294 (fd_state_machine::on_creat): New.
4295 (fd_state_machine::on_dup): New.
4297 2022-07-28 David Malcolm <dmalcolm@redhat.com>
4299 PR analyzer/105893
4300 * analyzer.opt (Wanalyzer-putenv-of-auto-var): New.
4301 * region-model-impl-calls.cc (class putenv_of_auto_var): New.
4302 (region_model::impl_call_putenv): New.
4303 * region-model.cc (region_model::on_call_pre): Handle putenv.
4304 * region-model.h (region_model::impl_call_putenv): New decl.
4306 2022-07-28 David Malcolm <dmalcolm@redhat.com>
4308 * sm-malloc.cc (free_of_non_heap::emit): Add comment about CWE.
4309 * sm-taint.cc (tainted_size::emit): Likewise.
4311 2022-07-28 David Malcolm <dmalcolm@redhat.com>
4313 * region.h: Add notes to the comment describing the region
4314 class hierarchy.
4316 2022-07-27 Immad Mir <mirimmad@outlook.com>
4318 PR analyzer/106286
4319 * sm-fd.cc:
4320 (fd_diagnostic::get_meaning_for_state_change): New.
4322 2022-07-26 David Malcolm <dmalcolm@redhat.com>
4324 PR analyzer/106319
4325 * store.cc (store::set_value): Don't strip away casts if the
4326 region has NULL type.
4328 2022-07-26 David Malcolm <dmalcolm@redhat.com>
4330 * region.h (code_region::get_element): Remove stray decl.
4331 (function_region::get_element): Likewise.
4333 2022-07-25 Martin Liska <mliska@suse.cz>
4335 * sm-fd.cc: Run dos2unix and fix coding style issues.
4337 2022-07-23 Immad Mir <mirimmad@outlook.com>
4339 * sm-fd.cc (fd_param_diagnostic): New diagnostic class.
4340 (fd_access_mode_mismatch): Change inheritance from fd_diagnostic
4341 to fd_param_diagnostic. Add new overloaded constructor.
4342 (fd_use_after_close): Likewise.
4343 (unchecked_use_of_fd): Likewise and also change name to fd_use_without_check.
4344 (double_close): Change name to fd_double_close.
4345 (enum access_directions): New.
4346 (fd_state_machine::on_stmt): Handle calls to function with the
4347 new three function attributes.
4348 (fd_state_machine::check_for_fd_attrs): New.
4349 (fd_state_machine::on_open): Use the new overloaded constructors
4350 of diagnostic classes.
4352 2022-07-22 David Malcolm <dmalcolm@redhat.com>
4354 PR analyzer/106413
4355 * varargs.cc (region_model::impl_call_va_start): Avoid iterating
4356 through non-existant variadic arguments by initializing the
4357 impl_region to "UNKNOWN" if the va_start occurs in the top-level
4358 function to the analysis.
4360 2022-07-22 David Malcolm <dmalcolm@redhat.com>
4362 PR analyzer/106401
4363 * store.cc (binding_cluster::binding_cluster): Remove overzealous
4364 assertion; we're checking for tracked_p in
4365 store::get_or_create_cluster.
4367 2022-07-22 Tim Lange <mail@tim-lange.me>
4369 PR analyzer/106394
4370 * region-model.cc (capacity_compatible_with_type): Always return true
4371 if alloc_size is zero.
4373 2022-07-21 David Malcolm <dmalcolm@redhat.com>
4375 PR analyzer/106383
4376 * varargs.cc (region_model::impl_call_va_arg): When determining if
4377 we're doing interprocedural analysis, use the stack depth of the
4378 frame in which va_start was called, rather than the current stack
4379 depth.
4381 2022-07-21 David Malcolm <dmalcolm@redhat.com>
4383 * sm-taint.cc (tainted_array_index::emit): Bulletproof against
4384 NULL m_arg.
4385 (tainted_array_index::describe_final_event): Likewise.
4386 (tainted_size::emit): Likewise.
4387 (tainted_size::describe_final_event): Likewise.
4389 2022-07-21 David Malcolm <dmalcolm@redhat.com>
4391 PR analyzer/106374
4392 * region.cc (decl_region::get_svalue_for_initializer): Bail out on
4393 untracked regions.
4395 2022-07-20 David Malcolm <dmalcolm@redhat.com>
4397 PR analyzer/106373
4398 * sm-taint.cc (taint_state_machine::on_condition): Potentially
4399 update the state of the RHS as well as the LHS.
4401 2022-07-20 David Malcolm <dmalcolm@redhat.com>
4403 PR analyzer/106359
4404 * region.h (string_region::tracked_p): New.
4405 * store.cc (binding_cluster::binding_cluster): Move here from
4406 store.h. Add assertion that base_region is tracked_p.
4407 * store.h (binding_cluster::binding_cluster): Move to store.cc.
4409 2022-07-19 David Malcolm <dmalcolm@redhat.com>
4411 PR analyzer/106321
4412 * constraint-manager.h (bounded_ranges::get_count): New.
4413 (bounded_ranges::get_range): New.
4414 * engine.cc (impl_region_model_context::on_bounded_ranges): New.
4415 * exploded-graph.h (impl_region_model_context::on_bounded_ranges):
4416 New decl.
4417 * region-model.cc (region_model::apply_constraints_for_gswitch):
4418 Potentially call ctxt->on_bounded_ranges.
4419 * region-model.h (region_model_context::on_bounded_ranges): New
4420 vfunc.
4421 (noop_region_model_context::on_bounded_ranges): New.
4422 (region_model_context_decorator::on_bounded_ranges): New.
4423 * sm-taint.cc: Include "analyzer/constraint-manager.h".
4424 (taint_state_machine::on_bounded_ranges): New.
4425 * sm.h (state_machine::on_bounded_ranges): New.
4427 2022-07-19 David Malcolm <dmalcolm@redhat.com>
4429 * engine.cc (exploded_graph::process_node): Show any description
4430 of the out-edge when logging it for consideration.
4432 2022-07-15 David Malcolm <dmalcolm@redhat.com>
4434 PR analyzer/106284
4435 * sm-taint.cc (taint_state_machine::on_condition): Handle range
4436 checks optimized by build_range_check.
4438 2022-07-15 Jonathan Wakely <jwakely@redhat.com>
4440 * call-info.cc (call_info::print): Adjust to new label_text API.
4441 * checker-path.cc (checker_event::dump): Likewise.
4442 (region_creation_event::get_desc): Likewise.
4443 (state_change_event::get_desc): Likewise.
4444 (superedge_event::should_filter_p): Likewise.
4445 (start_cfg_edge_event::get_desc): Likewise.
4446 (call_event::get_desc): Likewise.
4447 (return_event::get_desc): Likewise.
4448 (warning_event::get_desc): Likewise.
4449 (checker_path::dump): Likewise.
4450 (checker_path::debug): Likewise.
4451 * diagnostic-manager.cc (diagnostic_manager::prune_for_sm_diagnostic):
4452 Likewise.
4453 (diagnostic_manager::prune_interproc_events): Likewise.
4454 * engine.cc (feasibility_state::maybe_update_for_edge):
4455 Likewise.
4456 * program-state.cc (sm_state_map::to_json): Likewise.
4457 * region-model-impl-calls.cc (region_model::impl_call_analyzer_describe): Likewise.
4458 (region_model::impl_call_analyzer_dump_capacity): Likewise.
4459 * region.cc (region::to_json): Likewise.
4460 * sm-malloc.cc (inform_nonnull_attribute): Likewise.
4461 * store.cc (binding_map::to_json): Likewise.
4462 (store::to_json): Likewise.
4463 * supergraph.cc (superedge::dump): Likewise.
4464 * svalue.cc (svalue::to_json): Likewise.
4466 2022-07-07 David Malcolm <dmalcolm@redhat.com>
4468 * checker-path.cc (start_cfg_edge_event::get_desc): Update for
4469 superedge::get_description returning a label_text.
4470 * engine.cc (feasibility_state::maybe_update_for_edge): Likewise.
4471 * supergraph.cc (superedge::dump): Likewise.
4472 (superedge::get_description): Convert return type from char * to
4473 label_text.
4474 * supergraph.h (superedge::get_description): Likewise.
4476 2022-07-07 David Malcolm <dmalcolm@redhat.com>
4478 * call-info.cc (call_info::print): Update for removal of
4479 label_text::maybe_free in favor of automatic memory management.
4480 * checker-path.cc (checker_event::dump): Likewise.
4481 (checker_event::prepare_for_emission): Likewise.
4482 (state_change_event::get_desc): Likewise.
4483 (superedge_event::should_filter_p): Likewise.
4484 (start_cfg_edge_event::get_desc): Likewise.
4485 (warning_event::get_desc): Likewise.
4486 (checker_path::dump): Likewise.
4487 (checker_path::debug): Likewise.
4488 * diagnostic-manager.cc
4489 (diagnostic_manager::prune_for_sm_diagnostic): Likewise.
4490 (diagnostic_manager::prune_interproc_events): Likewise.
4491 * program-state.cc (sm_state_map::to_json): Likewise.
4492 * region.cc (region::to_json): Likewise.
4493 * sm-malloc.cc (inform_nonnull_attribute): Likewise.
4494 * store.cc (binding_map::to_json): Likewise.
4495 (store::to_json): Likewise.
4496 * svalue.cc (svalue::to_json): Likewise.
4498 2022-07-07 David Malcolm <dmalcolm@redhat.com>
4500 PR analyzer/106225
4501 * sm-taint.cc (taint_state_machine::on_stmt): Move handling of
4502 assignments from division to...
4503 (taint_state_machine::check_for_tainted_divisor): ...this new
4504 function. Reject warning when the divisor is known to be non-zero.
4505 * sm.cc: Include "analyzer/program-state.h".
4506 (sm_context::get_old_region_model): New.
4507 * sm.h (sm_context::get_old_region_model): New decl.
4509 2022-07-06 Immad Mir <mirimmad@outlook.com>
4511 PR analyzer/106184
4512 * sm-fd.cc (fd_state_machine): Change ordering of initialization
4513 of state m_invalid so that the order of initializers is same as
4514 the ordering of the fields in the class decl.
4516 2022-07-06 Immad Mir <mirimmad@outlook.com>
4518 * sm-fd.cc (use_after_close): save the "close" event and
4519 show it where possible.
4521 2022-07-06 David Malcolm <dmalcolm@redhat.com>
4523 PR analyzer/106204
4524 * region-model.cc (within_short_circuited_stmt_p): Move extraction
4525 of assign_stmt to caller.
4526 (due_to_ifn_deferred_init_p): New.
4527 (region_model::check_for_poison): Move extraction of assign_stmt
4528 from within_short_circuited_stmt_p to here. Share logic with
4529 call to due_to_ifn_deferred_init_p.
4531 2022-07-02 Tim Lange <mail@tim-lange.me>
4533 PR analyzer/105900
4534 * analyzer.opt: Added Wanalyzer-allocation-size.
4535 * checker-path.cc (region_creation_event::get_desc): Added call to new
4536 virtual function pending_diagnostic::describe_region_creation_event.
4537 * checker-path.h: Added region_creation_event::get_desc.
4538 * diagnostic-manager.cc (diagnostic_manager::add_event_on_final_node):
4539 New function.
4540 * diagnostic-manager.h:
4541 Added diagnostic_manager::add_event_on_final_node.
4542 * pending-diagnostic.h (struct region_creation): New event_desc struct.
4543 (pending_diagnostic::describe_region_creation_event): Added virtual
4544 function to overwrite description of a region creation.
4545 * region-model.cc (class dubious_allocation_size): New class.
4546 (capacity_compatible_with_type): New helper function.
4547 (class size_visitor): New class.
4548 (struct_or_union_with_inheritance_p): New helper function.
4549 (is_any_cast_p): New helper function.
4550 (region_model::check_region_size): New function.
4551 (region_model::set_value): Added call to
4552 region_model::check_region_size.
4553 * region-model.h (class region_model): New function check_region_size.
4554 * svalue.cc (region_svalue::accept): Changed to post-order traversal.
4555 (initial_svalue::accept): Likewise.
4556 (unaryop_svalue::accept): Likewise.
4557 (binop_svalue::accept): Likewise.
4558 (sub_svalue::accept): Likewise.
4559 (repeated_svalue::accept): Likewise.
4560 (bits_within_svalue::accept): Likewise.
4561 (widening_svalue::accept): Likewise.
4562 (unmergeable_svalue::accept): Likewise.
4563 (compound_svalue::accept): Likewise.
4564 (conjured_svalue::accept): Likewise.
4565 (asm_output_svalue::accept): Likewise.
4566 (const_fn_result_svalue::accept): Likewise.
4568 2022-07-02 Immad Mir <mirimmad17@gmail.com>
4570 PR analyzer/106003
4571 * analyzer.opt (Wanalyzer-fd-leak): New option.
4572 (Wanalyzer-fd-access-mode-mismatch): New option.
4573 (Wanalyzer-fd-use-without-check): New option.
4574 (Wanalyzer-fd-double-close): New option.
4575 (Wanalyzer-fd-use-after-close): New option.
4576 * sm.h (make_fd_state_machine): New decl.
4577 * sm.cc (make_checkers): Call make_fd_state_machine.
4578 * sm-fd.cc: New file.
4580 2022-06-24 David Malcolm <dmalcolm@redhat.com>
4582 * call-string.cc: Add includes of "analyzer/analyzer.h"
4583 and "analyzer/analyzer-logging.h".
4584 (call_string::call_string): Delete copy ctor.
4585 (call_string::operator=): Delete.
4586 (call_string::operator==): Delete.
4587 (call_string::hash): Delete.
4588 (call_string::push_call): Make const, returning the resulting
4589 call_string.
4590 (call_string::pop): Delete.
4591 (call_string::cmp_ptr_ptr): New.
4592 (call_string::validate): Assert that m_parent is non-NULL, or
4593 m_elements is empty.
4594 (call_string::call_string): Move default ctor here from
4595 call-string.h and reimplement. Add ctor taking a parent
4596 and an element.
4597 (call_string::~call_string): New.
4598 (call_string::recursive_log): New.
4599 * call-string.h (call_string::call_string): Move default ctor's
4600 defn to call-string.cc. Delete copy ctor. Add ctor taking a
4601 parent and an element.
4602 (call_string::operator=): Delete.
4603 (call_string::operator==): Delete.
4604 (call_string::hash): Delete.
4605 (call_string::push_call): Make const, returning the resulting
4606 call_string.
4607 (call_string::pop): Delete decl.
4608 (call_string::get_parent): New.
4609 (call_string::cmp_ptr_ptr): New decl.
4610 (call_string::get_top_of_stack): New.
4611 (struct call_string::hashmap_traits_t): New.
4612 (class call_string): Add friend class region_model_manager. Add
4613 DISABLE_COPY_AND_ASSIGN.
4614 (call_string::~call_string): New decl.
4615 (call_string::recursive_log): New decl.
4616 (call_string::m_parent): New field.
4617 (call_string::m_children): New field.
4618 * constraint-manager.cc (selftest::test_many_constants): Pass
4619 model manager to program_point::origin.
4620 * engine.cc (exploded_graph::exploded_graph): Likewise.
4621 (exploded_graph::add_function_entry): Likewise for
4622 program_point::from_function_entry.
4623 (add_tainted_args_callback): Likewise.
4624 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
4625 Update for change to program_point.get_call_string.
4626 (exploded_graph::process_node): Likewise.
4627 (class function_call_string_cluster): Convert m_cs from a
4628 call_string to a const call_string &.
4629 (struct function_call_string): Likewise.
4630 (pod_hash_traits<function_call_string>::hash): Use pointer_hash
4631 for m_cs.
4632 (pod_hash_traits<function_call_string>::equal): Update for change
4633 to m_cs.
4634 (root_cluster::add_node): Update for change to
4635 function_call_string.
4636 (viz_callgraph_node::dump_dot): Update for change to call_string.
4637 * exploded-graph.h (per_call_string_data::m_key): Convert to a
4638 reference.
4639 (struct eg_call_string_hash_map_traits): Delete.
4640 (exploded_graph::call_string_data_map_t): Remove traits class.
4641 * program-point.cc: Move include of "analyzer/call-string.h" to
4642 after "analyzer/analyzer-logging.h".
4643 (program_point::print): Update for conversion of m_call_string to
4644 a pointer.
4645 (program_point::to_json): Likewise.
4646 (program_point::push_to_call_stack): Update for immutability of
4647 call strings.
4648 (program_point::pop_from_call_stack): Likewise.
4649 (program_point::hash): Use pointer hashing for m_call_string.
4650 (program_point::get_function_at_depth): Update for change to
4651 m_call_string.
4652 (program_point::validate): Update for changes to call_string.
4653 (program_point::on_edge): Likewise.
4654 (program_point::origin): Move here from call-string.h. Add
4655 region_model_manager param and use it to get empty call string.
4656 (program_point::from_function_entry): Likewise.
4657 (selftest::test_function_point_ordering): Likewise.
4658 (selftest::test_function_point_ordering): Likewise.
4659 * program-point.h (program_point::program_point): Update for
4660 change to m_call_string.
4661 (program_point::get_call_string): Likewise.
4662 (program_point::get_stack_depth): Likewise.
4663 (program_point::origin): Add region_model_manager param, and move
4664 defn to call-string.cc.
4665 (program_point::from_function_entry): Likewise.
4666 (program_point::empty): Drop call_string.
4667 (program_point::deleted): Likewise.
4668 (program_point::program_point): New private ctor.
4669 (program_point::m_call_string): Convert from call_string to const
4670 call_string *.
4671 * program-state.cc (selftest::test_program_state_merging): Update
4672 for call_string changes.
4673 (selftest::test_program_state_merging_2): Likewise.
4674 * region-model-manager.cc
4675 (region_model_manager::region_model_manager): Construct
4676 m_empty_call_string.
4677 (region_model_manager::log_stats): Log the call strings.
4678 * region-model.cc (assert_region_models_merge): Pass the
4679 region_model_manager when creating program_point instances.
4680 (selftest::test_state_merging): Likewise.
4681 (selftest::test_constraint_merging): Likewise.
4682 (selftest::test_widening_constraints): Likewise.
4683 (selftest::test_iteration_1): Likewise.
4684 * region-model.h (region_model_manager::get_empty_call_string):
4685 New.
4686 (region_model_manager::m_empty_call_string): New.
4687 * sm-signal.cc (register_signal_handler::impl_transition): Update
4688 for changes to call_string.
4690 2022-06-24 David Malcolm <dmalcolm@redhat.com>
4692 * call-string.cc (call_string::calc_recursion_depth): Whitespace
4693 cleanups.
4694 (call_string::cmp): Likewise.
4695 (call_string::get_caller_node): Likewise.
4696 (call_string::validate): Likewise.
4697 * engine.cc (dynamic_call_info_t::add_events_to_path): Likewise.
4698 (exploded_graph::get_per_function_data): Likewise.
4699 (exploded_graph::maybe_create_dynamic_call): Likewise.
4700 (exploded_graph::maybe_create_dynamic_call): Likewise.
4701 (exploded_graph::process_node): Likewise.
4703 2022-06-16 David Malcolm <dmalcolm@redhat.com>
4705 * varargs.cc (va_arg_type_mismatch::emit): Associate the warning
4706 with CWE-686 ("Function Call With Incorrect Argument Type").
4708 2022-06-16 David Malcolm <dmalcolm@redhat.com>
4710 * varargs.cc: Include "diagnostic-metadata.h".
4711 (va_list_exhausted::emit): Associate the warning with
4712 CWE-685 ("Function Call With Incorrect Number of Arguments").
4714 2022-06-16 David Malcolm <dmalcolm@redhat.com>
4716 * sm-file.cc (double_fclose::emit): Associate the warning with
4717 CWE-1341 ("Multiple Releases of Same Resource or Handle").
4719 2022-06-15 David Malcolm <dmalcolm@redhat.com>
4721 PR analyzer/105962
4722 * analyzer.opt (fanalyzer-undo-inlining): New option.
4723 * checker-path.cc: Include "diagnostic-core.h" and
4724 "inlining-iterator.h".
4725 (event_kind_to_string): Handle EK_INLINED_CALL.
4726 (class inlining_info): New class.
4727 (checker_event::checker_event): Move here from checker-path.h.
4728 Store original fndecl and depth, and calculate effective fndecl
4729 and depth based on inlining information.
4730 (checker_event::dump): Emit original depth as well as effective
4731 depth when they differ; likewise for fndecl.
4732 (region_creation_event::get_desc): Use m_effective_fndecl.
4733 (inlined_call_event::get_desc): New.
4734 (inlined_call_event::get_meaning): New.
4735 (checker_path::inject_any_inlined_call_events): New.
4736 * checker-path.h (enum event_kind): Add EK_INLINED_CALL.
4737 (checker_event::checker_event): Make protected, and move
4738 definition to checker-path.cc.
4739 (checker_event::get_fndecl): Use effective fndecl.
4740 (checker_event::get_stack_depth): Use effective stack depth.
4741 (checker_event::get_logical_location): Use effective stack depth.
4742 (checker_event::get_original_stack_depth): New.
4743 (checker_event::m_fndecl): Rename to...
4744 (checker_event::m_original_fndecl): ...this.
4745 (checker_event::m_depth): Rename to...
4746 (checker_event::m_original_depth): ...this.
4747 (checker_event::m_effective_fndecl): New field.
4748 (checker_event::m_effective_depth): New field.
4749 (class inlined_call_event): New checker_event subclass.
4750 (checker_path::inject_any_inlined_call_events): New decl.
4751 * diagnostic-manager.cc: Include "inlining-iterator.h".
4752 (diagnostic_manager::emit_saved_diagnostic): Call
4753 checker_path::inject_any_inlined_call_events.
4754 (diagnostic_manager::prune_for_sm_diagnostic): Handle
4755 EK_INLINED_CALL.
4756 * engine.cc (tainted_args_function_custom_event::get_desc): Use
4757 effective fndecl.
4758 * inlining-iterator.h: New file.
4760 2022-06-15 David Malcolm <dmalcolm@redhat.com>
4762 * diagnostic-manager.cc (saved_diagnostic::dump_dot_id): New.
4763 (saved_diagnostic::dump_as_dot_node): New.
4764 * diagnostic-manager.h (saved_diagnostic::dump_dot_id): New decl.
4765 (saved_diagnostic::dump_as_dot_node): New decl.
4766 * engine.cc (exploded_node::dump_dot): Add nodes for saved
4767 diagnostics.
4769 2022-06-02 David Malcolm <dmalcolm@redhat.com>
4771 * checker-path.cc (checker_event::get_meaning): New.
4772 (function_entry_event::get_meaning): New.
4773 (state_change_event::get_desc): Add dump of meaning of the event
4774 to the -fanalyzer-verbose-state-changes output.
4775 (state_change_event::get_meaning): New.
4776 (cfg_edge_event::get_meaning): New.
4777 (call_event::get_meaning): New.
4778 (return_event::get_meaning): New.
4779 (start_consolidated_cfg_edges_event::get_meaning): New.
4780 (warning_event::get_meaning): New.
4781 * checker-path.h: Include "tree-logical-location.h".
4782 (checker_event::checker_event): Construct m_logical_loc.
4783 (checker_event::get_logical_location): New.
4784 (checker_event::get_meaning): New decl.
4785 (checker_event::m_logical_loc): New.
4786 (function_entry_event::get_meaning): New decl.
4787 (state_change_event::get_meaning): New decl.
4788 (cfg_edge_event::get_meaning): New decl.
4789 (call_event::get_meaning): New decl.
4790 (return_event::get_meaning): New decl.
4791 (start_consolidated_cfg_edges_event::get_meaning): New.
4792 (warning_event::get_meaning): New decl.
4793 * pending-diagnostic.h: Include "diagnostic-path.h".
4794 (pending_diagnostic::get_meaning_for_state_change): New vfunc.
4795 * sm-file.cc (file_diagnostic::get_meaning_for_state_change): New
4796 vfunc impl.
4797 * sm-malloc.cc (malloc_diagnostic::get_meaning_for_state_change):
4798 Likewise.
4799 * sm-sensitive.cc
4800 (exposure_through_output_file::get_meaning_for_state_change):
4801 Likewise.
4802 * sm-taint.cc (taint_diagnostic::get_meaning_for_state_change):
4803 Likewise.
4804 * varargs.cc
4805 (va_list_sm_diagnostic::get_meaning_for_state_change): Likewise.
4807 2022-05-23 David Malcolm <dmalcolm@redhat.com>
4809 * call-info.cc: Add "final" and "override" to all vfunc
4810 implementations that were missing them, as appropriate.
4811 * engine.cc: Likewise.
4812 * region-model.cc: Likewise.
4813 * sm-malloc.cc: Likewise.
4814 * supergraph.h: Likewise.
4815 * svalue.cc: Likewise.
4816 * varargs.cc: Likewise.
4818 2022-05-20 David Malcolm <dmalcolm@redhat.com>
4820 * analyzer-pass.cc: Replace uses of "FINAL" and "OVERRIDE" with
4821 "final" and "override".
4822 * call-info.h: Likewise.
4823 * checker-path.h: Likewise.
4824 * constraint-manager.cc: Likewise.
4825 * diagnostic-manager.cc: Likewise.
4826 * engine.cc: Likewise.
4827 * exploded-graph.h: Likewise.
4828 * feasible-graph.h: Likewise.
4829 * pending-diagnostic.h: Likewise.
4830 * region-model-impl-calls.cc: Likewise.
4831 * region-model.cc: Likewise.
4832 * region-model.h: Likewise.
4833 * region.h: Likewise.
4834 * sm-file.cc: Likewise.
4835 * sm-malloc.cc: Likewise.
4836 * sm-pattern-test.cc: Likewise.
4837 * sm-sensitive.cc: Likewise.
4838 * sm-signal.cc: Likewise.
4839 * sm-taint.cc: Likewise.
4840 * state-purge.h: Likewise.
4841 * store.cc: Likewise.
4842 * store.h: Likewise.
4843 * supergraph.h: Likewise.
4844 * svalue.h: Likewise.
4845 * trimmed-graph.h: Likewise.
4846 * varargs.cc: Likewise.
4848 2022-05-16 David Malcolm <dmalcolm@redhat.com>
4850 PR analyzer/105103
4851 * analyzer.cc (make_label_text_n): New.
4852 * analyzer.h (class var_arg_region): New forward decl.
4853 (make_label_text_n): New decl.
4854 * analyzer.opt (Wanalyzer-va-arg-type-mismatch): New option.
4855 (Wanalyzer-va-list-exhausted): New option.
4856 (Wanalyzer-va-list-leak): New option.
4857 (Wanalyzer-va-list-use-after-va-end): New option.
4858 * checker-path.cc (call_event::get_desc): Split out decl access
4859 into..
4860 (call_event::get_caller_fndecl): ...this new function and...
4861 (call_event::get_callee_fndecl): ...this new function.
4862 * checker-path.h (call_event::get_desc): Drop "FINAL".
4863 (call_event::get_caller_fndecl): New decl.
4864 (call_event::get_callee_fndecl): New decl.
4865 (class call_event): Make fields protected.
4866 * diagnostic-manager.cc (null_assignment_sm_context::warn): New
4867 overload.
4868 (null_assignment_sm_context::get_new_program_state): New.
4869 (diagnostic_manager::add_events_for_superedge): Move case
4870 SUPEREDGE_CALL to a new pending_diagnostic::add_call_event vfunc.
4871 * engine.cc (impl_sm_context::warn): Implement new override.
4872 (impl_sm_context::get_new_program_state): New.
4873 * pending-diagnostic.cc: Include "analyzer/diagnostic-manager.h",
4874 "cpplib.h", "digraph.h", "ordered-hash-map.h", "cfg.h",
4875 "basic-block.h", "gimple.h", "gimple-iterator.h", "cgraph.h"
4876 "analyzer/supergraph.h", "analyzer/program-state.h",
4877 "alloc-pool.h", "fibonacci_heap.h", "shortest-paths.h",
4878 "sbitmap.h", "analyzer/exploded-graph.h", "diagnostic-path.h",
4879 and "analyzer/checker-path.h".
4880 (ht_ident_eq): New.
4881 (fixup_location_in_macro_p): New.
4882 (pending_diagnostic::fixup_location): New.
4883 (pending_diagnostic::add_call_event): New.
4884 * pending-diagnostic.h (pending_diagnostic::fixup_location): Drop
4885 no-op inline implementation in favor of the more complex
4886 implementation above.
4887 (pending_diagnostic::add_call_event): New vfunc.
4888 * region-model-impl-calls.cc: Include "analyzer/sm.h",
4889 "diagnostic-path.h", and "analyzer/pending-diagnostic.h".
4890 * region-model-manager.cc
4891 (region_model_manager::get_var_arg_region): New.
4892 (region_model_manager::log_stats): Log m_var_arg_regions.
4893 * region-model.cc (region_model::on_call_pre): Handle IFN_VA_ARG,
4894 BUILT_IN_VA_START, and BUILT_IN_VA_COPY.
4895 (region_model::on_call_post): Handle BUILT_IN_VA_END.
4896 (region_model::get_representative_path_var_1): Handle RK_VAR_ARG.
4897 (region_model::push_frame): Push variadic arguments.
4898 * region-model.h (region_model_manager::get_var_arg_region): New
4899 decl.
4900 (region_model_manager::m_var_arg_regions): New field.
4901 (region_model::impl_call_va_start): New decl.
4902 (region_model::impl_call_va_copy): New decl.
4903 (region_model::impl_call_va_arg): New decl.
4904 (region_model::impl_call_va_end): New decl.
4905 * region.cc (alloca_region::dump_to_pp): Dump the id.
4906 (var_arg_region::dump_to_pp): New.
4907 (var_arg_region::get_frame_region): New.
4908 * region.h (enum region_kind): Add RK_VAR_ARG.
4909 (region::dyn_cast_var_arg_region): New.
4910 (class var_arg_region): New.
4911 (is_a_helper <const var_arg_region *>::test): New.
4912 (struct default_hash_traits<var_arg_region::key_t>): New.
4913 * sm.cc (make_checkers): Call make_va_list_state_machine.
4914 * sm.h (sm_context::warn): New vfunc.
4915 (sm_context::get_old_svalue): Drop unused decl.
4916 (sm_context::get_new_program_state): New vfunc.
4917 (make_va_list_state_machine): New decl.
4918 * varargs.cc: New file.
4920 2022-05-16 Martin Liska <mliska@suse.cz>
4922 * engine.cc (exploded_node::get_dot_fillcolor): Use ARRAY_SIZE.
4923 * function-set.cc (test_stdio_example): Likewise.
4924 * sm-file.cc (get_file_using_fns): Likewise.
4925 * sm-malloc.cc (malloc_state_machine::unaffected_by_call_p): Likewise.
4926 * sm-signal.cc (get_async_signal_unsafe_fns): Likewise.
4928 2022-05-13 Richard Biener <rguenther@suse.de>
4930 * supergraph.cc: Re-order gimple-fold.h include.
4932 2022-05-11 David Malcolm <dmalcolm@redhat.com>
4934 * checker-path.cc (state_change_event::get_desc): Call maybe_free
4935 on label_text temporaries.
4936 * diagnostic-manager.cc
4937 (diagnostic_manager::prune_for_sm_diagnostic): Likewise.
4938 * engine.cc (exploded_graph::~exploded_graph): Fix leak of
4939 m_per_point_data and m_per_call_string_data values. Simplify
4940 cleanup of m_per_function_stats and m_per_point_data values.
4941 (feasibility_state::maybe_update_for_edge): Fix leak of result of
4942 superedge::get_description.
4943 * region-model-manager.cc
4944 (region_model_manager::~region_model_manager): Move cleanup of
4945 m_setjmp_values to match the ordering of the fields within
4946 region_model_manager. Fix leak of values within
4947 m_repeated_values_map, m_bits_within_values_map,
4948 m_asm_output_values_map, and m_const_fn_result_values_map.
4950 2022-04-28 David Malcolm <dmalcolm@redhat.com>
4952 PR analyzer/105285
4953 * store.cc (binding_cluster::get_any_binding): Handle accessing
4954 sub_svalues of clusters where the base region has a symbolic
4955 binding.
4957 2022-04-28 David Malcolm <dmalcolm@redhat.com>
4959 * diagnostic-manager.cc (epath_finder::process_worklist_item):
4960 Call dump_feasible_path when a path that reaches the the target
4961 enode is found.
4962 (epath_finder::dump_feasible_path): New.
4963 * engine.cc (feasibility_state::dump_to_pp): New.
4964 * exploded-graph.h (feasibility_state::dump_to_pp): New decl.
4965 * feasible-graph.cc (feasible_graph::dump_feasible_path): New.
4966 * feasible-graph.h (feasible_graph::dump_feasible_path): New
4967 decls.
4968 * program-point.cc (function_point::print): Fix missing trailing
4969 newlines.
4970 * program-point.h (program_point::print_source_line): Remove
4971 unimplemented decl.
4973 2022-04-25 David Malcolm <dmalcolm@redhat.com>
4975 PR analyzer/105365
4976 PR analyzer/105366
4977 * svalue.cc
4978 (cmp_cst): Rename to...
4979 (cmp_csts_same_type): ...this. Convert all recursive calls to
4980 calls to...
4981 (cmp_csts_and_types): ....this new function.
4982 (svalue::cmp_ptr): Update for renaming of cmp_cst
4984 2022-04-14 David Malcolm <dmalcolm@redhat.com>
4986 PR analyzer/105264
4987 * region-model-reachability.cc (reachable_regions::handle_parm):
4988 Use maybe_get_deref_base_region rather than just region_svalue, to
4989 handle pointer arithmetic also.
4990 * svalue.cc (svalue::maybe_get_deref_base_region): New.
4991 * svalue.h (svalue::maybe_get_deref_base_region): New decl.
4993 2022-04-14 David Malcolm <dmalcolm@redhat.com>
4995 PR analyzer/105252
4996 * svalue.cc (cmp_cst): When comparing VECTOR_CSTs, compare the
4997 types of the encoded elements before calling cmp_cst on them.
4999 2022-04-09 David Malcolm <dmalcolm@redhat.com>
5001 PR analyzer/103892
5002 * region-model-manager.cc
5003 (region_model_manager::get_unknown_symbolic_region): New,
5004 extracted from...
5005 (region_model_manager::get_field_region): ...here.
5006 (region_model_manager::get_element_region): Use it here.
5007 (region_model_manager::get_offset_region): Likewise.
5008 (region_model_manager::get_sized_region): Likewise.
5009 (region_model_manager::get_cast_region): Likewise.
5010 (region_model_manager::get_bit_range): Likewise.
5011 * region-model.h
5012 (region_model_manager::get_unknown_symbolic_region): New decl.
5013 * region.cc (symbolic_region::symbolic_region): Handle sval_ptr
5014 having NULL type.
5015 (symbolic_region::dump_to_pp): Handle having NULL type.
5017 2022-04-07 David Malcolm <dmalcolm@redhat.com>
5019 PR analyzer/102208
5020 * store.cc (binding_map::remove_overlapping_bindings): Add
5021 "always_overlap" param, using it to generalize to the case where
5022 we want to remove all bindings. Update "uncertainty" logic to
5023 only record maybe-bound values for cases where there is a symbolic
5024 write involved.
5025 (binding_cluster::mark_region_as_unknown): Split param "reg" into
5026 "reg_to_bind" and "reg_for_overlap".
5027 (binding_cluster::maybe_get_compound_binding): Pass "false" to
5028 binding_map::remove_overlapping_bindings new "always_overlap" param.
5029 (binding_cluster::remove_overlapping_bindings): Determine
5030 "always_overlap" and pass it to
5031 binding_map::remove_overlapping_bindings.
5032 (store::set_value): Pass uncertainty to remove_overlapping_bindings
5033 call. Update for new param of
5034 binding_cluster::mark_region_as_unknown, passing both the base
5035 region of the iter_cluster, and the lhs_reg.
5036 (store::mark_region_as_unknown): Update for new param of
5037 binding_cluster::mark_region_as_unknown, passing "reg" for both.
5038 (store::remove_overlapping_bindings): Add param "uncertainty", and
5039 pass it on to call to
5040 binding_cluster::remove_overlapping_bindings.
5041 * store.h (binding_map::remove_overlapping_bindings): Add
5042 "always_overlap" param.
5043 (binding_cluster::mark_region_as_unknown): Split param "reg" into
5044 "reg_to_bind" and "reg_for_overlap".
5045 (store::remove_overlapping_bindings): Add param "uncertainty".
5047 2022-03-29 David Malcolm <dmalcolm@redhat.com>
5049 PR testsuite/105085
5050 * region-model-manager.cc (dump_untracked_region): Skip decls in
5051 the constant pool.
5053 2022-03-29 David Malcolm <dmalcolm@redhat.com>
5055 PR analyzer/105087
5056 * analyzer.h (class conjured_purge): New forward decl.
5057 * region-model-asm.cc (region_model::on_asm_stmt): Add
5058 conjured_purge param to calls binding_cluster::on_asm and
5059 region_model_manager::get_or_create_conjured_svalue.
5060 * region-model-impl-calls.cc
5061 (call_details::get_or_create_conjured_svalue): Likewise for call
5062 to region_model_manager::get_or_create_conjured_svalue.
5063 (region_model::impl_call_fgets): Remove call to
5064 region_model::purge_state_involving, as this is now done
5065 implicitly by call_details::get_or_create_conjured_svalue.
5066 (region_model::impl_call_fread): Likewise.
5067 (region_model::impl_call_strchr): Pass conjured_purge param to
5068 call to region_model_manager::get_or_create_conjured_svalue.
5069 * region-model-manager.cc (conjured_purge::purge): New.
5070 (region_model_manager::get_or_create_conjured_svalue): Add
5071 param "p". Use it to purge state when reusing an existing
5072 conjured_svalue.
5073 * region-model.cc (region_model::on_call_pre): Replace call to
5074 region_model::purge_state_involving with passing conjured_purge
5075 to region_model_manager::get_or_create_conjured_svalue.
5076 (region_model::handle_unrecognized_call): Pass conjured_purge to
5077 store::on_unknown_fncall.
5078 * region-model.h
5079 (region_model_manager::get_or_create_conjured_svalue): Add param
5080 "p".
5081 * store.cc (binding_cluster::on_unknown_fncall): Likewise. Pass
5082 it on to region_model_manager::get_or_create_conjured_svalue.
5083 (binding_cluster::on_asm): Likewise.
5084 (store::on_unknown_fncall): Add param "p" and pass it on to
5085 binding_cluster::on_unknown_fncall.
5086 * store.h (binding_cluster::on_unknown_fncall): Add param p.
5087 (binding_cluster::on_asm): Likewise.
5088 (store::on_unknown_fncall): Likewise.
5089 * svalue.h (class conjured_purge): New.
5091 2022-03-29 David Malcolm <dmalcolm@redhat.com>
5093 PR analyzer/105074
5094 * region.cc (ipa_ref_requires_tracking): Drop "context_fndecl",
5095 instead using the ref->referring to get the cgraph node of the
5096 caller.
5097 (symnode_requires_tracking_p): Likewise.
5099 2022-03-26 David Malcolm <dmalcolm@redhat.com>
5101 PR analyzer/105057
5102 * store.cc (binding_cluster::make_unknown_relative_to): Reject
5103 attempts to create a cluster for untracked base regions.
5104 (store::set_value): Likewise.
5105 (store::fill_region): Likewise.
5106 (store::mark_region_as_unknown): Likewise.
5108 2022-03-25 David Malcolm <dmalcolm@redhat.com>
5110 PR analyzer/104954
5111 * analyzer.opt (-fdump-analyzer-untracked): New option.
5112 * engine.cc (impl_run_checkers): Handle it.
5113 * region-model-asm.cc (region_model::on_asm_stmt): Don't attempt
5114 to clobber regions with !tracked_p ().
5115 * region-model-manager.cc (dump_untracked_region): New.
5116 (region_model_manager::dump_untracked_regions): New.
5117 (frame_region::dump_untracked_regions): New.
5118 * region-model.h (region_model_manager::dump_untracked_regions):
5119 New decl.
5120 * region.cc (ipa_ref_requires_tracking): New.
5121 (symnode_requires_tracking_p): New.
5122 (decl_region::calc_tracked_p): New.
5123 * region.h (region::tracked_p): New vfunc.
5124 (frame_region::dump_untracked_regions): New decl.
5125 (class decl_region): Note that this is also used fo SSA names.
5126 (decl_region::decl_region): Initialize m_tracked.
5127 (decl_region::tracked_p): New.
5128 (decl_region::calc_tracked_p): New decl.
5129 (decl_region::m_tracked): New.
5130 * store.cc (store::get_or_create_cluster): Assert that we
5131 don't try to create clusters for base regions that aren't
5132 trackable.
5133 (store::mark_as_escaped): Don't mark base regions that we're not
5134 tracking.
5136 2022-03-23 David Malcolm <dmalcolm@redhat.com>
5138 PR analyzer/104979
5139 * engine.cc (impl_run_checkers): Create the engine after the
5140 supergraph, and pass the supergraph to the engine.
5141 * region-model.cc (region_model::get_lvalue_1): Pass ctxt to
5142 frame_region::get_region_for_local.
5143 (region_model::update_for_return_gcall): Pass the lvalue for the
5144 result to pop_frame as a tree, rather than as a region.
5145 (region_model::pop_frame): Update for above change, determining
5146 the destination region after the frame is popped and thus with
5147 respect to the caller frame rather than the called frame.
5148 Likewise, set the value of the region to the return value after
5149 the frame is popped.
5150 (engine::engine): Add supergraph pointer.
5151 (selftest::test_stack_frames): Set the DECL_CONTECT of PARM_DECLs.
5152 (selftest::test_get_representative_path_var): Likewise.
5153 (selftest::test_state_merging): Likewise.
5154 * region-model.h (region_model::pop_frame): Convert first param
5155 from a const region * to a tree.
5156 (engine::engine): Add param "sg".
5157 (engine::m_sg): New field.
5158 * region.cc: Include "analyzer/sm.h" and
5159 "analyzer/program-state.h".
5160 (frame_region::get_region_for_local): Add "ctxt" param.
5161 Add assertions that VAR_DECLs are locals, and that expr is for the
5162 correct function.
5163 * region.h (frame_region::get_region_for_local): Add "ctxt" param.
5165 2022-03-23 David Malcolm <dmalcolm@redhat.com>
5167 PR analyzer/105017
5168 * sm-taint.cc (taint_diagnostic::subclass_equal_p): Check
5169 m_has_bounds as well as m_arg.
5170 (tainted_allocation_size::subclass_equal_p): Chain up to base
5171 class implementation. Also check m_mem_space.
5172 (tainted_allocation_size::emit): Add note showing stack-based vs
5173 heap-based allocations.
5175 2022-03-23 David Malcolm <dmalcolm@redhat.com>
5177 PR analyzer/104997
5178 * diagnostic-manager.cc (diagnostic_manager::add_diagnostic):
5179 Convert return type from "void" to "bool", reporting success vs
5180 failure to caller, for both overloads.
5181 * diagnostic-manager.h (diagnostic_manager::add_diagnostic):
5182 Likewise.
5183 * engine.cc (impl_region_model_context::warn): Propagate return
5184 value from diagnostic_manager::add_diagnostic.
5186 2022-03-18 David Malcolm <dmalcolm@redhat.com>
5188 PR analyzer/104943
5189 PR analyzer/104954
5190 PR analyzer/103533
5191 * analyzer.h (class state_purge_per_decl): New forward decl.
5192 * engine.cc (impl_run_checkers): Pass region_model_manager to
5193 state_purge_map ctor.
5194 * program-point.cc (function_point::final_stmt_p): New.
5195 (function_point::get_next): New.
5196 * program-point.h (function_point::final_stmt_p): New decl.
5197 (function_point::get_next): New decl.
5198 * program-state.cc (program_state::prune_for_point): Generalize to
5199 purge local decls as well as SSA names.
5200 (program_state::can_purge_base_region_p): New.
5201 * program-state.h (program_state::can_purge_base_region_p): New
5202 decl.
5203 * region-model.cc (struct append_ssa_names_cb_data): Rename to...
5204 (struct append_regions_cb_data): ...this.
5205 (region_model::get_ssa_name_regions_for_current_frame): Rename
5206 to...
5207 (region_model::get_regions_for_current_frame): ...this, updating
5208 for other renamings.
5209 (region_model::append_ssa_names_cb): Rename to...
5210 (region_model::append_regions_cb): ...this, and drop the requirement
5211 that the subregion be a SSA name.
5212 * region-model.h (struct append_ssa_names_cb_data): Rename decl
5213 to...
5214 (struct append_regions_cb_data): ...this.
5215 (region_model::get_ssa_name_regions_for_current_frame): Rename
5216 decl to...
5217 (region_model::get_regions_for_current_frame): ...this.
5218 (region_model::append_ssa_names_cb): Rename decl to...
5219 (region_model::append_regions_cb): ...this.
5220 * state-purge.cc: Include "tristate.h", "selftest.h",
5221 "analyzer/store.h", "analyzer/region-model.h", and
5222 "gimple-walk.h".
5223 (get_candidate_for_purging): New.
5224 (class gimple_op_visitor): New.
5225 (my_load_cb): New.
5226 (my_store_cb): New.
5227 (my_addr_cb): New.
5228 (state_purge_map::state_purge_map): Add "mgr" param. Update for
5229 renamings. Find uses of local variables.
5230 (state_purge_map::~state_purge_map): Update for renaming of m_map
5231 to m_ssa_map. Clean up m_decl_map.
5232 (state_purge_map::get_or_create_data_for_decl): New.
5233 (state_purge_per_ssa_name::state_purge_per_ssa_name): Update for
5234 inheriting from state_purge_per_tree.
5235 (state_purge_per_ssa_name::add_to_worklist): Likewise.
5236 (state_purge_per_decl::state_purge_per_decl): New.
5237 (state_purge_per_decl::add_needed_at): New.
5238 (state_purge_per_decl::add_pointed_to_at): New.
5239 (state_purge_per_decl::process_worklists): New.
5240 (state_purge_per_decl::add_to_worklist): New.
5241 (same_binding_p): New.
5242 (fully_overwrites_p): New.
5243 (state_purge_per_decl::process_point_backwards): New.
5244 (state_purge_per_decl::process_point_forwards): New.
5245 (state_purge_per_decl::needed_at_point_p): New.
5246 (state_purge_annotator::print_needed): Generalize to print local
5247 decls as well as SSA names.
5248 * state-purge.h (class state_purge_map): Update leading comment.
5249 (state_purge_map::map_t): Rename to...
5250 (state_purge_map::ssa_map_t): ...this.
5251 (state_purge_map::iterator): Rename to...
5252 (state_purge_map::ssa_iterator): ...this.
5253 (state_purge_map::decl_map_t): New typedef.
5254 (state_purge_map::decl_iterator): New typedef.
5255 (state_purge_map::state_purge_map): Add "mgr" param.
5256 (state_purge_map::get_data_for_ssa_name): Update for renaming.
5257 (state_purge_map::get_any_data_for_decl): New.
5258 (state_purge_map::get_or_create_data_for_decl): New decl.
5259 (state_purge_map::begin): Rename to...
5260 (state_purge_map::begin_ssas): ...this.
5261 (state_purge_map::end): Rename to...
5262 (state_purge_map::end_ssa): ...this.
5263 (state_purge_map::begin_decls): New.
5264 (state_purge_map::end_decls): New.
5265 (state_purge_map::m_map): Rename to...
5266 (state_purge_map::m_ssa_map): ...this.
5267 (state_purge_map::m_decl_map): New field.
5268 (class state_purge_per_tree): New class.
5269 (class state_purge_per_ssa_name): Inherit from state_purge_per_tree.
5270 (state_purge_per_ssa_name::get_function): Move to base class.
5271 (state_purge_per_ssa_name::point_set_t): Likewise.
5272 (state_purge_per_ssa_name::m_fun): Likewise.
5273 (class state_purge_per_decl): New.
5275 2022-03-17 David Malcolm <dmalcolm@redhat.com>
5277 * state-purge.cc (state_purge_annotator::add_node_annotations):
5278 Avoid duplicate before-supernode annotations when returning from
5279 an interprocedural call. Show after-supernode annotations.
5281 2022-03-17 David Malcolm <dmalcolm@redhat.com>
5283 * program-point.cc (program_point::get_next): Fix missing
5284 increment of index.
5286 2022-03-16 David Malcolm <dmalcolm@redhat.com>
5288 PR analyzer/104955
5289 * diagnostic-manager.cc (get_emission_location): New.
5290 (diagnostic_manager::diagnostic_manager): Initialize
5291 m_num_disabled_diagnostics.
5292 (diagnostic_manager::add_diagnostic): Reject diagnostics that
5293 will eventually be rejected due to being disabled.
5294 (diagnostic_manager::emit_saved_diagnostics): Log the number
5295 of disabled diagnostics.
5296 (diagnostic_manager::emit_saved_diagnostic): Split out logic for
5297 determining emission location to get_emission_location.
5298 * diagnostic-manager.h
5299 (diagnostic_manager::m_num_disabled_diagnostics): New field.
5300 * engine.cc (stale_jmp_buf::get_controlling_option): New.
5301 (stale_jmp_buf::emit): Use it.
5302 * pending-diagnostic.h
5303 (pending_diagnostic::get_controlling_option): New vfunc.
5304 * region-model.cc
5305 (poisoned_value_diagnostic::get_controlling_option): New.
5306 (poisoned_value_diagnostic::emit): Use it.
5307 (shift_count_negative_diagnostic::get_controlling_option): New.
5308 (shift_count_negative_diagnostic::emit): Use it.
5309 (shift_count_overflow_diagnostic::get_controlling_option): New.
5310 (shift_count_overflow_diagnostic::emit): Use it.
5311 (dump_path_diagnostic::get_controlling_option): New.
5312 (dump_path_diagnostic::emit): Use it.
5313 (write_to_const_diagnostic::get_controlling_option): New.
5314 (write_to_const_diagnostic::emit): Use it.
5315 (write_to_string_literal_diagnostic::get_controlling_option): New.
5316 (write_to_string_literal_diagnostic::emit): Use it.
5317 * sm-file.cc (double_fclose::get_controlling_option): New.
5318 (double_fclose::emit): Use it.
5319 (file_leak::get_controlling_option): New.
5320 (file_leak::emit): Use it.
5321 * sm-malloc.cc (mismatching_deallocation::get_controlling_option):
5322 New.
5323 (mismatching_deallocation::emit): Use it.
5324 (double_free::get_controlling_option): New.
5325 (double_free::emit): Use it.
5326 (possible_null_deref::get_controlling_option): New.
5327 (possible_null_deref::emit): Use it.
5328 (possible_null_arg::get_controlling_option): New.
5329 (possible_null_arg::emit): Use it.
5330 (null_deref::get_controlling_option): New.
5331 (null_deref::emit): Use it.
5332 (null_arg::get_controlling_option): New.
5333 (null_arg::emit): Use it.
5334 (use_after_free::get_controlling_option): New.
5335 (use_after_free::emit): Use it.
5336 (malloc_leak::get_controlling_option): New.
5337 (malloc_leak::emit): Use it.
5338 (free_of_non_heap::get_controlling_option): New.
5339 (free_of_non_heap::emit): Use it.
5340 * sm-pattern-test.cc (pattern_match::get_controlling_option): New.
5341 (pattern_match::emit): Use it.
5342 * sm-sensitive.cc
5343 (exposure_through_output_file::get_controlling_option): New.
5344 (exposure_through_output_file::emit): Use it.
5345 * sm-signal.cc (signal_unsafe_call::get_controlling_option): New.
5346 (signal_unsafe_call::emit): Use it.
5347 * sm-taint.cc (tainted_array_index::get_controlling_option): New.
5348 (tainted_array_index::emit): Use it.
5349 (tainted_offset::get_controlling_option): New.
5350 (tainted_offset::emit): Use it.
5351 (tainted_size::get_controlling_option): New.
5352 (tainted_size::emit): Use it.
5353 (tainted_divisor::get_controlling_option): New.
5354 (tainted_divisor::emit): Use it.
5355 (tainted_allocation_size::get_controlling_option): New.
5356 (tainted_allocation_size::emit): Use it.
5358 2022-03-15 David Malcolm <dmalcolm@redhat.com>
5360 * store.cc (store::store): Presize m_cluster_map.
5362 2022-03-10 David Malcolm <dmalcolm@redhat.com>
5364 PR analyzer/104863
5365 * constraint-manager.cc (constraint_manager::add_constraint):
5366 Refresh the EC IDs when adding constraints implied by offsets.
5368 2022-03-10 David Malcolm <dmalcolm@redhat.com>
5370 PR analyzer/104793
5371 * analyzer.h (class pending_note): New forward decl.
5372 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic):
5373 Initialize m_notes.
5374 (saved_diagnostic::operator==): Compare m_notes.
5375 (saved_diagnostic::add_note): New.
5376 (saved_diagnostic::emit_any_notes): New.
5377 (diagnostic_manager::add_note): New.
5378 (diagnostic_manager::emit_saved_diagnostic): Call emit_any_notes
5379 after emitting the warning.
5380 * diagnostic-manager.h (saved_diagnostic::add_note): New decl.
5381 (saved_diagnostic::emit_any_notes): New decl.
5382 (saved_diagnostic::m_notes): New field.
5383 (diagnostic_manager::add_note): New decl.
5384 * engine.cc (impl_region_model_context::add_note): New.
5385 * exploded-graph.h (impl_region_model_context::add_note): New
5386 decl.
5387 * pending-diagnostic.h (class pending_note): New.
5388 (class pending_note_subclass): New template.
5389 * region-model.cc (class reason_attr_access): New.
5390 (check_external_function_for_access_attr): Add class
5391 annotating_ctxt and use it when checking region.
5392 (noop_region_model_context::add_note): New.
5393 * region-model.h (region_model_context::add_note): New vfunc.
5394 (noop_region_model_context::add_note): New decl.
5395 (class region_model_context_decorator): New.
5396 (class note_adding_context): New.
5398 2022-03-10 David Malcolm <dmalcolm@redhat.com>
5400 PR analyzer/104793
5401 * region-model.cc
5402 (region_model::check_external_function_for_access_attr): New.
5403 (region_model::handle_unrecognized_call): Call it.
5404 * region-model.h
5405 (region_model::check_external_function_for_access_attr): New decl.
5406 (region_model::handle_unrecognized_call): New decl.
5408 2022-03-10 David Malcolm <dmalcolm@redhat.com>
5410 * sm-taint.cc (taint_state_machine::check_for_tainted_size_arg):
5411 Avoid generating duplicate saved_diagnostics by only handling the
5412 rdwr_map entry for the ptrarg, not the duplicate entry for the
5413 sizarg.
5415 2022-03-07 David Malcolm <dmalcolm@redhat.com>
5417 PR analyzer/101983
5418 * engine.cc (returning_from_function_p): New.
5419 (impl_region_model_context::on_state_leak): Use it when rejecting
5420 leaks at the return from "main".
5422 2022-03-07 Jakub Jelinek <jakub@redhat.com>
5424 * store.cc: Fix up duplicated word issue in a comment.
5425 * analyzer.cc: Likewise.
5426 * engine.cc: Likewise.
5427 * sm-taint.cc: Likewise.
5429 2022-03-04 David Malcolm <dmalcolm@redhat.com>
5431 PR analyzer/103521
5432 * analyzer.opt (-param=analyzer-max-svalue-depth=): Reduce from 13
5433 to 12.
5435 2022-02-23 David Malcolm <dmalcolm@redhat.com>
5437 PR analyzer/104434
5438 * analyzer.h (class const_fn_result_svalue): New decl.
5439 * region-model-impl-calls.cc (call_details::get_manager): New.
5440 * region-model-manager.cc
5441 (region_model_manager::get_or_create_const_fn_result_svalue): New.
5442 (region_model_manager::log_stats): Log
5443 m_const_fn_result_values_map.
5444 * region-model.cc (const_fn_p): New.
5445 (maybe_get_const_fn_result): New.
5446 (region_model::on_call_pre): Handle fndecls with
5447 __attribute__((const)) by calling the above rather than making
5448 a conjured_svalue.
5449 * region-model.h (visitor::visit_const_fn_result_svalue): New.
5450 (region_model_manager::get_or_create_const_fn_result_svalue): New
5451 decl.
5452 (region_model_manager::const_fn_result_values_map_t): New typedef.
5453 (region_model_manager::m_const_fn_result_values_map): New field.
5454 (call_details::get_manager): New decl.
5455 * svalue.cc (svalue::cmp_ptr): Handle SK_CONST_FN_RESULT.
5456 (const_fn_result_svalue::dump_to_pp): New.
5457 (const_fn_result_svalue::dump_input): New.
5458 (const_fn_result_svalue::accept): New.
5459 * svalue.h (enum svalue_kind): Add SK_CONST_FN_RESULT.
5460 (svalue::dyn_cast_const_fn_result_svalue): New.
5461 (class const_fn_result_svalue): New.
5462 (is_a_helper <const const_fn_result_svalue *>::test): New.
5463 (template <> struct default_hash_traits<const_fn_result_svalue::key_t>):
5464 New.
5466 2022-02-17 David Malcolm <dmalcolm@redhat.com>
5468 PR analyzer/104576
5469 * region-model.cc: Include "calls.h".
5470 (region_model::on_call_pre): Use flags_from_decl_or_type to
5471 generalize check for DECL_PURE_P to also check for ECF_CONST.
5473 2022-02-16 David Malcolm <dmalcolm@redhat.com>
5475 PR analyzer/104560
5476 * diagnostic-manager.cc (diagnostic_manager::build_emission_path):
5477 Add region creation events for globals of interest.
5478 (null_assignment_sm_context::get_old_program_state): New.
5479 (diagnostic_manager::add_events_for_eedge): Move check for
5480 changing dynamic extents from PK_BEFORE_STMT case to after the
5481 switch on the dst_point's kind so that we can emit them for the
5482 final stmt in a basic block.
5483 * engine.cc (impl_sm_context::get_old_program_state): New.
5484 * sm-malloc.cc (malloc_state_machine::get_default_state): Rewrite
5485 detection of m_non_heap to use get_memory_space.
5486 (free_of_non_heap::free_of_non_heap): Add freed_reg param.
5487 (free_of_non_heap::subclass_equal_p): Update for changes to
5488 fields.
5489 (free_of_non_heap::emit): Drop m_kind in favor of
5490 get_memory_space.
5491 (free_of_non_heap::describe_state_change): Remove logic for
5492 detecting alloca.
5493 (free_of_non_heap::mark_interesting_stuff): Add region-creation of
5494 m_freed_reg.
5495 (free_of_non_heap::get_memory_space): New.
5496 (free_of_non_heap::kind): Drop enum.
5497 (free_of_non_heap::m_freed_reg): New field.
5498 (free_of_non_heap::m_kind): Drop field.
5499 (malloc_state_machine::on_stmt): Drop transition to m_non_heap.
5500 (malloc_state_machine::handle_free_of_non_heap): New function,
5501 split out from on_deallocator_call and on_realloc_call, adding
5502 detection of the freed region.
5503 (malloc_state_machine::on_deallocator_call): Use it.
5504 (malloc_state_machine::on_realloc_call): Likewise.
5505 * sm.h (sm_context::get_old_program_state): New vfunc.
5507 2022-02-15 David Malcolm <dmalcolm@redhat.com>
5509 PR analyzer/104524
5510 * region-model-manager.cc
5511 (region_model_manager::maybe_fold_sub_svalue): Only call
5512 get_or_create_cast if type is non-NULL.
5514 2022-02-15 David Malcolm <dmalcolm@redhat.com>
5516 PR analyzer/102692
5517 * exploded-graph.h (impl_region_model_context::get_stmt): New.
5518 * region-model.cc: Include "gimple-ssa.h", "tree-phinodes.h",
5519 "tree-ssa-operands.h", and "ssa-iterators.h".
5520 (within_short_circuited_stmt_p): New.
5521 (region_model::check_for_poison): Don't warn about uninit values
5522 if within_short_circuited_stmt_p.
5523 * region-model.h (region_model_context::get_stmt): New vfunc.
5524 (noop_region_model_context::get_stmt): New.
5526 2022-02-11 David Malcolm <dmalcolm@redhat.com>
5528 PR analyzer/104274
5529 * region-model.cc (region_model::check_for_poison): Ignore
5530 uninitialized uses of empty types.
5532 2022-02-10 David Malcolm <dmalcolm@redhat.com>
5534 PR analyzer/98797
5535 * region-model-manager.cc
5536 (region_model_manager::maybe_fold_sub_svalue): Generalize getting
5537 individual chars of a STRING_CST from element_region to any
5538 subregion which is a concrete access of a single byte from its
5539 parent region.
5540 * region.cc (region::get_relative_concrete_byte_range): New.
5541 * region.h (region::get_relative_concrete_byte_range): New decl.
5543 2022-02-09 David Malcolm <dmalcolm@redhat.com>
5545 PR analyzer/104452
5546 * region-model.cc (selftest::test_bit_range_regions): New.
5547 (selftest::analyzer_region_model_cc_tests): Call it.
5548 * region.h (bit_range_region::key_t::hash): Fix hashing of m_bits
5549 to avoid using uninitialized data.
5551 2022-02-07 David Malcolm <dmalcolm@redhat.com>
5553 PR analyzer/104417
5554 * sm-taint.cc (tainted_allocation_size::tainted_allocation_size):
5555 Remove overzealous assertion.
5556 (tainted_allocation_size::emit): Likewise.
5557 (region_model::check_dynamic_size_for_taint): Likewise.
5559 2022-02-07 David Malcolm <dmalcolm@redhat.com>
5561 PR analyzer/103872
5562 * region-model-impl-calls.cc (region_model::impl_call_memcpy):
5563 Reimplement in terms of a get_store_value followed by a set_value.
5565 2022-02-03 David Malcolm <dmalcolm@redhat.com>
5567 PR analyzer/104369
5568 * engine.cc (exploded_graph::process_node): Use the node for any
5569 diagnostics, avoiding ICE if a bifurcation update adds a
5570 saved_diagnostic, such as for a tainted realloc size.
5571 * region-model-impl-calls.cc
5572 (region_model::impl_call_realloc::success_no_move::update_model):
5573 Require the old pointer to be non-NULL to be able successfully
5574 grow in place. Use model->deref_rvalue rather than maybe_get_region
5575 to support the old pointer being symbolic.
5576 (region_model::impl_call_realloc::success_with_move::update_model):
5577 Likewise. Add a constraint that the new pointer != the old pointer.
5578 Use a sized_region when setting the value of the new region.
5579 Handle the case where we don't know the dynamic size of the old
5580 region by marking the new region as unknown.
5581 * sm-taint.cc (tainted_allocation_size::tainted_allocation_size):
5582 Update assertion to also allow for MEMSPACE_UNKNOWN.
5583 (tainted_allocation_size::emit): Likewise.
5584 (region_model::check_dynamic_size_for_taint): Likewise.
5586 2022-02-03 David Malcolm <dmalcolm@redhat.com>
5588 * region-model-impl-calls.cc (region_model::impl_call_calloc): Use
5589 a sized_region when calling zero_fill_region.
5591 2022-02-02 David Malcolm <dmalcolm@redhat.com>
5593 * region-model.cc (region_model::on_return): Replace usage of
5594 copy_region with get_rvalue/set_value pair.
5595 (region_model::pop_frame): Likewise.
5596 (selftest::test_compound_assignment): Likewise.
5597 * region-model.h (region_model::copy_region): Delete decl.
5598 * region.cc (region_model::copy_region): Delete.
5600 2022-02-02 David Malcolm <dmalcolm@redhat.com>
5602 * region.cc (region::calc_offset): Consolidate effectively
5603 identical cases.
5605 2022-02-02 David Malcolm <dmalcolm@redhat.com>
5607 * analyzer.h (class bit_range_region): New forward decl.
5608 * region-model-manager.cc (region_model_manager::get_bit_range):
5609 New.
5610 (region_model_manager::log_stats): Handle m_bit_range_regions.
5611 * region-model.cc (region_model::get_lvalue_1): Handle
5612 BIT_FIELD_REF.
5613 * region-model.h (region_model_manager::get_bit_range): New decl.
5614 (region_model_manager::m_bit_range_regions): New field.
5615 * region.cc (region::get_base_region): Handle RK_BIT_RANGE.
5616 (region::base_region_p): Likewise.
5617 (region::calc_offset): Likewise.
5618 (bit_range_region::dump_to_pp): New.
5619 (bit_range_region::get_byte_size): New.
5620 (bit_range_region::get_bit_size): New.
5621 (bit_range_region::get_byte_size_sval): New.
5622 (bit_range_region::get_relative_concrete_offset): New.
5623 * region.h (enum region_kind): Add RK_BIT_RANGE.
5624 (region::dyn_cast_bit_range_region): New vfunc.
5625 (class bit_range_region): New.
5626 (is_a_helper <const bit_range_region *>::test): New.
5627 (default_hash_traits<bit_range_region::key_t>): New.
5629 2022-02-02 David Malcolm <dmalcolm@redhat.com>
5631 PR analyzer/104270
5632 * region-model.cc (region_model::on_call_pre): Handle
5633 IFN_DEFERRED_INIT.
5635 2022-01-27 David Malcolm <dmalcolm@redhat.com>
5637 * checker-path.cc (event_kind_to_string): Handle
5638 EK_REGION_CREATION.
5639 (region_creation_event::region_creation_event): New.
5640 (region_creation_event::get_desc): New.
5641 (checker_path::add_region_creation_event): New.
5642 * checker-path.h (enum event_kind): Add EK_REGION_CREATION.
5643 (class region_creation_event): New subclass.
5644 (checker_path::add_region_creation_event): New decl.
5645 * diagnostic-manager.cc
5646 (diagnostic_manager::emit_saved_diagnostic): Pass NULL for new
5647 param to add_events_for_eedge when handling trailing eedge.
5648 (diagnostic_manager::build_emission_path): Create an interesting_t
5649 instance, allow the pending diagnostic to populate it, and pass it
5650 to the calls to add_events_for_eedge.
5651 (diagnostic_manager::add_events_for_eedge): Add "interest" param.
5652 Use it to add region_creation_events for on-stack regions created
5653 within at function entry, and when pertinent dynamically-sized
5654 regions are created.
5655 (diagnostic_manager::prune_for_sm_diagnostic): Add case for
5656 EK_REGION_CREATION.
5657 * diagnostic-manager.h (diagnostic_manager::add_events_for_eedge):
5658 Add "interest" param.
5659 * pending-diagnostic.cc: Include "selftest.h", "tristate.h",
5660 "analyzer/call-string.h", "analyzer/program-point.h",
5661 "analyzer/store.h", and "analyzer/region-model.h".
5662 (interesting_t::add_region_creation): New.
5663 (interesting_t::dump_to_pp): New.
5664 * pending-diagnostic.h (struct interesting_t): New.
5665 (pending_diagnostic::mark_interesting_stuff): New vfunc.
5666 * region-model.cc
5667 (poisoned_value_diagnostic::poisoned_value_diagnostic): Add
5668 (poisoned_value_diagnostic::operator==): Compare m_pkind and
5669 m_src_region fields.
5670 (poisoned_value_diagnostic::mark_interesting_stuff): New.
5671 (poisoned_value_diagnostic::m_src_region): New.
5672 (region_model::check_for_poison): Call
5673 get_region_for_poisoned_expr for uninit values and pass the resul
5674 to the diagnostic.
5675 (region_model::get_region_for_poisoned_expr): New.
5676 (region_model::deref_rvalue): Pass NULL for
5677 poisoned_value_diagnostic's src_region.
5678 * region-model.h (region_model::get_region_for_poisoned_expr): New
5679 decl.
5680 * region.h (frame_region::get_fndecl): New.
5682 2022-01-27 Martin Liska <mliska@suse.cz>
5684 PR analyzer/104247
5685 * constraint-manager.cc (bounded_ranges_manager::log_stats):
5686 Cast to long for format purpose.
5687 * region-model-manager.cc (log_uniq_map): Likewise.
5689 2022-01-26 David Malcolm <dmalcolm@redhat.com>
5691 PR analyzer/104224
5692 * region-model.cc (region_model::check_call_args): New.
5693 (region_model::on_call_pre): Call it when ignoring stdio builtins.
5694 * region-model.h (region_model::check_call_args): New decl
5696 2022-01-26 David Malcolm <dmalcolm@redhat.com>
5698 PR analyzer/94362
5699 * constraint-manager.cc (range::add_bound): Fix tests for
5700 discarding redundant constraints. Perform test for rejecting
5701 unsatisfiable constraints earlier so that they don't update
5702 the object on failure.
5703 (selftest::test_range): New.
5704 (selftest::test_constant_comparisons): Add test coverage for
5705 existing constraints becoming narrower until they are
5706 unsatisfiable.
5707 (selftest::run_constraint_manager_tests): Call test_range.
5709 2022-01-22 David Malcolm <dmalcolm@redhat.com>
5711 PR analyzer/104159
5712 * region-model-manager.cc
5713 (region_model_manager::get_or_create_cast): Bail out if the types
5714 are the same. Don't attempt to handle casts involving vector
5715 types.
5717 2022-01-20 David Malcolm <dmalcolm@redhat.com>
5719 PR analyzer/94362
5720 * constraint-manager.cc (bound::ensure_closed): Convert param to
5721 enum bound_kind.
5722 (range::constrained_to_single_element): Likewise.
5723 (range::add_bound): New.
5724 (constraint_manager::add_constraint): Handle SVAL + OFFSET
5725 compared to a constant.
5726 (constraint_manager::get_ec_bounds): Rewrite in terms of
5727 range::add_bound.
5728 (constraint_manager::eval_condition): Reject if range::add_bound
5729 fails.
5730 (selftest::test_constant_comparisons): Add test coverage for
5731 various impossible combinations of integer comparisons.
5732 * constraint-manager.h (enum bound_kind): New.
5733 (struct bound): Likewise.
5734 (bound::ensure_closed): Convert to param to enum bound_kind.
5735 (struct range): Convert to...
5736 (class range): ...this, making fields private.
5737 (range::add_bound): New decls.
5738 * region-model.cc (region_model::add_constraint): Fail if
5739 constraint_manager::add_constraint fails.
5741 2022-01-18 David Malcolm <dmalcolm@redhat.com>
5743 PR analyzer/104089
5744 * region-model-manager.cc
5745 (region_model_manager::get_or_create_constant_svalue): Assert that
5746 we have a CONSTANT_CLASS_P.
5747 (region_model_manager::maybe_fold_unaryop): Only fold a constant
5748 when fold_unary's result is a constant or a cast of a constant.
5750 2022-01-18 David Malcolm <dmalcolm@redhat.com>
5752 PR analyzer/104062
5753 * region-model-manager.cc
5754 (region_model_manager::maybe_fold_sub_svalue): Avoid casting to
5755 NULL type when folding access to repeated svalue.
5757 2022-01-17 Martin Liska <mliska@suse.cz>
5759 * analyzer.cc (is_special_named_call_p): Rename .c names to .cc.
5760 (is_named_call_p): Likewise.
5761 * region-model-asm.cc (deterministic_p): Likewise.
5762 * region.cc (field_region::get_relative_concrete_offset): Likewise.
5763 * sm-malloc.cc (method_p): Likewise.
5764 * supergraph.cc (superedge::dump_dot): Likewise.
5766 2022-01-14 David Malcolm <dmalcolm@redhat.com>
5768 * sm-taint.cc (taint_state_machine::combine_states): Handle combination
5769 of has_ub and has_lb.
5771 2022-01-14 David Malcolm <dmalcolm@redhat.com>
5773 PR analyzer/104029
5774 * sm-taint.cc (taint_state_machine::alt_get_inherited_state):
5775 Remove gcc_unreachable from default case for unary ops.
5777 2022-01-14 David Malcolm <dmalcolm@redhat.com>
5779 * engine.cc: Include "stringpool.h", "attribs.h", and
5780 "tree-dfa.h".
5781 (mark_params_as_tainted): New.
5782 (class tainted_args_function_custom_event): New.
5783 (class tainted_args_function_info): New.
5784 (exploded_graph::add_function_entry): Handle functions with
5785 "tainted_args" attribute.
5786 (class tainted_args_field_custom_event): New.
5787 (class tainted_args_callback_custom_event): New.
5788 (class tainted_args_call_info): New.
5789 (add_tainted_args_callback): New.
5790 (add_any_callbacks): New.
5791 (exploded_graph::build_initial_worklist): Likewise.
5792 (exploded_graph::build_initial_worklist): Find callbacks that are
5793 reachable from global initializers, calling add_any_callbacks on
5794 them.
5796 2022-01-12 David Malcolm <dmalcolm@redhat.com>
5798 PR analyzer/103940
5799 * engine.cc (impl_sm_context::impl_sm_context): Add
5800 "unknown_side_effects" param and use it to initialize
5801 new m_unknown_side_effects field.
5802 (impl_sm_context::unknown_side_effects_p): New.
5803 (impl_sm_context::m_unknown_side_effects): New.
5804 (exploded_node::on_stmt): Pass unknown_side_effects to sm_ctxt
5805 ctor.
5806 * sm-taint.cc: Include "stringpool.h" and "attribs.h".
5807 (tainted_size::tainted_size): Drop "dir" param.
5808 (tainted_size::get_kind): Drop "FINAL".
5809 (tainted_size::emit): Likewise.
5810 (tainted_size::m_dir): Drop unused field.
5811 (class tainted_access_attrib_size): New subclass.
5812 (taint_state_machine::on_stmt): Call check_for_tainted_size_arg on
5813 external functions with unknown side effects.
5814 (taint_state_machine::check_for_tainted_size_arg): New.
5815 (region_model::check_region_for_taint): Drop "dir" param from
5816 tainted_size ctor.
5817 * sm.h (sm_context::unknown_side_effects_p): New.
5819 2022-01-11 David Malcolm <dmalcolm@redhat.com>
5821 PR analyzer/102692
5822 * diagnostic-manager.cc
5823 (class auto_disable_complexity_checks): Rename to...
5824 (class auto_checking_feasibility): ...this, updating
5825 the calls accordingly.
5826 (epath_finder::explore_feasible_paths): Update for renaming.
5827 * region-model-manager.cc
5828 (region_model_manager::region_model_manager): Update for change from
5829 m_check_complexity to m_checking_feasibility.
5830 (region_model_manager::reject_if_too_complex): Likewise.
5831 (region_model_manager::get_or_create_unknown_svalue): Handle
5832 m_checking_feasibility.
5833 (region_model_manager::create_unique_svalue): New.
5834 (region_model_manager::maybe_fold_binop): Handle BIT_AND_EXPR and
5835 BIT_IOR_EXPRs on booleans where we know the result.
5836 * region-model.cc (test_binop_svalue_folding): Add test coverage
5837 for the above.
5838 * region-model.h (region_model_manager::create_unique_svalue): New
5839 decl.
5840 (region_model_manager::enable_complexity_check): Replace with...
5841 (region_model_manager::begin_checking_feasibility): ...this.
5842 (region_model_manager::disable_complexity_check): Replace with...
5843 (region_model_manager::end_checking_feasibility): ...this.
5844 (region_model_manager::m_check_complexity): Replace with...
5845 (region_model_manager::m_checking_feasibility): ...this.
5846 (region_model_manager::m_managed_dynamic_svalues): New field.
5848 2022-01-08 David Malcolm <dmalcolm@redhat.com>
5850 * engine.cc (impl_run_checkers): Pass logger to engine ctor.
5851 * region-model-manager.cc
5852 (region_model_manager::region_model_manager): Add logger param and
5853 use it to initialize m_logger.
5854 * region-model.cc (engine::engine): New.
5855 * region-model.h (region_model_manager::region_model_manager):
5856 Add logger param.
5857 (region_model_manager::get_logger): New.
5858 (region_model_manager::m_logger): New field.
5859 (engine::engine): New.
5860 * store.cc (store_manager::get_logger): New.
5861 (store::set_value): Log scope. Log when marking a cluster as
5862 unknown due to possible aliasing.
5863 * store.h (store_manager::get_logger): New decl.
5865 2022-01-08 David Malcolm <dmalcolm@redhat.com>
5867 * region-model-impl-calls.cc (cmp_decls): New.
5868 (cmp_decls_ptr_ptr): New.
5869 (region_model::impl_call_analyzer_dump_escaped): New.
5870 * region-model.cc (region_model::on_stmt_pre): Handle
5871 __analyzer_dump_escaped.
5872 * region-model.h (region_model::impl_call_analyzer_dump_escaped):
5873 New decl.
5874 * store.h (binding_cluster::get_base_region): New accessor.
5876 2022-01-08 David Malcolm <dmalcolm@redhat.com>
5878 * region.cc (region::is_named_decl_p): New.
5879 * region.h (region::is_named_decl_p): New decl.
5881 2022-01-06 David Malcolm <dmalcolm@redhat.com>
5883 PR analyzer/103546
5884 * store.cc (store::eval_alias_1): Refactor handling of decl
5885 regions, adding a test for may_be_aliased, rejecting those for
5886 which it returns false.
5888 2021-12-12 Jonathan Wakely <jwakely@redhat.com>
5890 * engine.cc: Define INCLUDE_MEMORY instead of INCLUDE_UNIQUE_PTR.
5892 2021-12-06 David Malcolm <dmalcolm@redhat.com>
5894 PR analyzer/103533
5895 * constraint-manager.cc (equiv_class::contains_non_constant_p):
5896 New.
5897 (constraint_manager::canonicalize): Call it when determining
5898 redundant ECs.
5899 (selftest::test_purging): New selftest.
5900 (selftest::run_constraint_manager_tests): Likewise.
5901 * constraint-manager.h (equiv_class::contains_non_constant_p):
5902 New decl.
5904 2021-12-01 David Malcolm <dmalcolm@redhat.com>
5906 PR analyzer/102471
5907 * region-model-reachability.cc (reachable_regions::handle_parm):
5908 Treat all svalues within a compound parm has reachable, and those
5909 wrapped in a cast.
5911 2021-11-29 David Malcolm <dmalcolm@redhat.com>
5913 PR analyzer/103217
5914 * store.cc (binding_cluster::can_merge_p): For the "key is bound"
5915 vs "key is not bound" merger case, check that the bound svalue
5916 is mergeable before merging it to "unknown", rejecting the merger
5917 otherwise.
5919 2021-11-19 David Malcolm <dmalcolm@redhat.com>
5921 PR analyzer/103217
5922 * engine.cc (exploded_graph::get_or_create_node): Pass in
5923 m_ext_state to program_state::can_merge_with_p.
5924 (exploded_graph::process_worklist): Likewise.
5925 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
5926 Likewise.
5927 (exploded_graph::process_node): Add missing call to detect_leaks
5928 when handling phi nodes.
5929 * program-state.cc (program_state::can_merge_with_p): Add
5930 "ext_state" param. Pass it and state ptrs to
5931 region_model::can_merge_with_p.
5932 (selftest::test_program_state_merging): Update for new ext_state
5933 param of program_state::can_merge_with_p.
5934 (selftest::test_program_state_merging_2): Likewise.
5935 * program-state.h (program_state::can_purge_p): Make const.
5936 (program_state::can_merge_with_p): Add "ext_state" param.
5937 * region-model.cc: Include "analyzer/program-state.h".
5938 (region_model::can_merge_with_p): Add params "ext_state",
5939 "state_a", and "state_b", use them when creating model_merger
5940 object.
5941 (model_merger::mergeable_svalue_p): New.
5942 * region-model.h (region_model::can_merge_with_p): Add params
5943 "ext_state", "state_a", and "state_b".
5944 (model_merger::model_merger) Likewise, initializing new fields.
5945 (model_merger::mergeable_svalue_p): New decl.
5946 (model_merger::m_ext_state): New field.
5947 (model_merger::m_state_a): New field.
5948 (model_merger::m_state_b): New field.
5949 * svalue.cc (svalue::can_merge_p): Call
5950 model_merger::mergeable_svalue_p on both states and reject the
5951 merger accordingly.
5953 2021-11-17 David Malcolm <dmalcolm@redhat.com>
5955 PR analyzer/102695
5956 * region-model-impl-calls.cc (region_model::impl_call_strchr): New.
5957 * region-model-manager.cc
5958 (region_model_manager::maybe_fold_unaryop): Simplify cast to
5959 pointer type of an existing pointer to a region.
5960 * region-model.cc (region_model::on_call_pre): Handle
5961 BUILT_IN_STRCHR and "strchr".
5962 (write_to_const_diagnostic::emit): Add auto_diagnostic_group. Add
5963 alternate wordings for functions and labels.
5964 (write_to_const_diagnostic::describe_final_event): Add alternate
5965 wordings for functions and labels.
5966 (region_model::check_for_writable_region): Handle RK_FUNCTION and
5967 RK_LABEL.
5968 * region-model.h (region_model::impl_call_strchr): New decl.
5970 2021-11-16 David Malcolm <dmalcolm@redhat.com>
5972 PR analyzer/102662
5973 * constraint-manager.cc (bounded_range::operator==): Require the
5974 types to be the same for equality.
5976 2021-11-13 David Malcolm <dmalcolm@redhat.com>
5978 * analyzer.opt (Wanalyzer-tainted-allocation-size): New.
5979 (Wanalyzer-tainted-divisor): New.
5980 (Wanalyzer-tainted-offset): New.
5981 (Wanalyzer-tainted-size): New.
5982 * engine.cc (impl_region_model_context::get_taint_map): New.
5983 * exploded-graph.h (impl_region_model_context::get_taint_map):
5984 New decl.
5985 * program-state.cc (sm_state_map::get_state): Call
5986 alt_get_inherited_state.
5987 (sm_state_map::impl_set_state): Modify states within
5988 compound svalues.
5989 (program_state::impl_call_analyzer_dump_state): Undo casts.
5990 (selftest::test_program_state_1): Update for new context param of
5991 create_region_for_heap_alloc.
5992 (selftest::test_program_state_merging): Likewise.
5993 * region-model-impl-calls.cc (region_model::impl_call_alloca):
5994 Likewise.
5995 (region_model::impl_call_calloc): Likewise.
5996 (region_model::impl_call_malloc): Likewise.
5997 (region_model::impl_call_operator_new): Likewise.
5998 (region_model::impl_call_realloc): Likewise.
5999 * region-model.cc (region_model::check_region_access): Call
6000 check_region_for_taint.
6001 (region_model::get_representative_path_var_1): Handle binops.
6002 (region_model::create_region_for_heap_alloc): Add "ctxt" param and
6003 pass it to set_dynamic_extents.
6004 (region_model::create_region_for_alloca): Likewise.
6005 (region_model::set_dynamic_extents): Add "ctxt" param and use it
6006 to call check_dynamic_size_for_taint.
6007 (selftest::test_state_merging): Update for new context param of
6008 create_region_for_heap_alloc.
6009 (selftest::test_malloc_constraints): Likewise.
6010 (selftest::test_malloc): Likewise.
6011 (selftest::test_alloca): Likewise for create_region_for_alloca.
6012 * region-model.h (region_model::create_region_for_heap_alloc): Add
6013 "ctxt" param.
6014 (region_model::create_region_for_alloca): Likewise.
6015 (region_model::set_dynamic_extents): Likewise.
6016 (region_model::check_dynamic_size_for_taint): New decl.
6017 (region_model::check_region_for_taint): New decl.
6018 (region_model_context::get_taint_map): New vfunc.
6019 (noop_region_model_context::get_taint_map): New.
6020 * sm-taint.cc: Remove include of "diagnostic-event-id.h"; add
6021 includes of "gimple-iterator.h", "tristate.h", "selftest.h",
6022 "ordered-hash-map.h", "cgraph.h", "cfg.h", "digraph.h",
6023 "analyzer/supergraph.h", "analyzer/call-string.h",
6024 "analyzer/program-point.h", "analyzer/store.h",
6025 "analyzer/region-model.h", and "analyzer/program-state.h".
6026 (enum bounds): Move to top of file.
6027 (class taint_diagnostic): New.
6028 (class tainted_array_index): Convert to subclass of taint_diagnostic.
6029 (tainted_array_index::emit): Add CWE-129. Reword warning to use
6030 "attacker-controlled" rather than "tainted".
6031 (tainted_array_index::describe_state_change): Move to
6032 taint_diagnostic::describe_state_change.
6033 (tainted_array_index::describe_final_event): Reword to use
6034 "attacker-controlled" rather than "tainted".
6035 (class tainted_offset): New.
6036 (class tainted_size): New.
6037 (class tainted_divisor): New.
6038 (class tainted_allocation_size): New.
6039 (taint_state_machine::alt_get_inherited_state): New.
6040 (taint_state_machine::on_stmt): In assignment handling, remove
6041 ARRAY_REF handling in favor of check_region_for_taint. Add
6042 detection of tainted divisors.
6043 (taint_state_machine::get_taint): New.
6044 (taint_state_machine::combine_states): New.
6045 (region_model::check_region_for_taint): New.
6046 (region_model::check_dynamic_size_for_taint): New.
6047 * sm.h (state_machine::alt_get_inherited_state): New.
6049 2021-11-12 David Malcolm <dmalcolm@redhat.com>
6051 * engine.cc (exploded_node::on_stmt_pre): Return when handling
6052 "__analyzer_dump_state".
6054 2021-11-11 Richard Biener <rguenther@suse.de>
6056 * supergraph.cc: Include bitmap.h.
6058 2021-11-04 David Malcolm <dmalcolm@redhat.com>
6060 * program-state.cc (sm_state_map::dump): Use default_tree_printer
6061 as format decoder.
6063 2021-09-16 Maxim Blinov <maxim.blinov@embecosm.com>
6065 PR bootstrap/102242
6066 * engine.cc (INCLUDE_UNIQUE_PTR): Define.
6068 2021-09-08 David Malcolm <dmalcolm@redhat.com>
6070 PR analyzer/102225
6071 * analyzer.h (compat_types_p): New decl.
6072 * constraint-manager.cc
6073 (constraint_manager::get_or_add_equiv_class): Guard against NULL
6074 type when checking for pointer types.
6075 * region-model-impl-calls.cc (region_model::impl_call_realloc):
6076 Guard against NULL lhs type/region. Guard against the size value
6077 not being of a compatible type for dynamic extents.
6078 * region-model.cc (compat_types_p): Make non-static.
6080 2021-08-30 David Malcolm <dmalcolm@redhat.com>
6082 PR analyzer/99260
6083 * analyzer.h (class custom_edge_info): New class, adapted from
6084 exploded_edge::custom_info_t. Make member functions const.
6085 Make update_model return bool, converting edge param from
6086 reference to a pointer, and adding a ctxt param.
6087 (class path_context): New class.
6088 * call-info.cc: New file.
6089 * call-info.h: New file.
6090 * engine.cc: Include "analyzer/call-info.h" and <memory>.
6091 (impl_region_model_context::impl_region_model_context): Update for
6092 new m_path_ctxt field.
6093 (impl_region_model_context::bifurcate): New.
6094 (impl_region_model_context::terminate_path): New.
6095 (impl_region_model_context::get_malloc_map): New.
6096 (impl_sm_context::impl_sm_context): Update for new m_path_ctxt
6097 field.
6098 (impl_sm_context::get_fndecl_for_call): Likewise.
6099 (impl_sm_context::set_next_state): Likewise.
6100 (impl_sm_context::warn): Likewise.
6101 (impl_sm_context::is_zero_assignment): Likewise.
6102 (impl_sm_context::get_path_context): New.
6103 (impl_sm_context::m_path_ctxt): New.
6104 (impl_region_model_context::on_condition): Update for new
6105 path_ctxt param. Handle m_enode_for_diag being NULL.
6106 (impl_region_model_context::on_phi): Update for new path_ctxt
6107 param.
6108 (exploded_node::on_stmt): Add path_ctxt param, updating ctor calls
6109 to use it as necessary. Use it to bail out after sm-handling,
6110 if needed.
6111 (exploded_node::detect_leaks): Update for new path_ctxt param.
6112 (dynamic_call_info_t::update_model): Update for conversion of
6113 exploded_edge::custom_info_t to custom_edge_info.
6114 (dynamic_call_info_t::add_events_to_path): Likewise.
6115 (rewind_info_t::update_model): Likewise.
6116 (rewind_info_t::add_events_to_path): Likewise.
6117 (exploded_edge::exploded_edge): Likewise.
6118 (exploded_graph::add_edge): Likewise.
6119 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
6120 Update for new path_ctxt param.
6121 (class impl_path_context): New.
6122 (exploded_graph::process_node): Update for new path_ctxt param.
6123 Create an impl_path_context and pass it to exploded_node::on_stmt.
6124 Use it to terminate iterating stmts if terminate_path is called
6125 on it. After processing a run of stmts, query path_ctxt to
6126 potentially terminate the analysis path, and/or to "bifurcate" the
6127 analysis into multiple additional paths.
6128 (feasibility_state::maybe_update_for_edge): Update for new
6129 update_model ctxt param.
6130 * exploded-graph.h
6131 (impl_region_model_context::impl_region_model_context): Add
6132 path_ctxt param.
6133 (impl_region_model_context::bifurcate): New.
6134 (impl_region_model_context::terminate_path): New
6135 (impl_region_model_context::get_ext_state): New.
6136 (impl_region_model_context::get_malloc_map): New.
6137 (impl_region_model_context::m_path_ctxt): New field.
6138 (exploded_node::on_stmt): Add path_ctxt param.
6139 (class exploded_edge::custom_info_t): Move to analyzer.h, renaming
6140 to custom_edge_info, and making the changes as noted in analyzer.h
6141 above.
6142 (exploded_edge::exploded_edge): Update for these changes to
6143 exploded_edge::custom_info_t.
6144 (exploded_edge::m_custom_info): Likewise.
6145 (class dynamic_call_info_t): Likewise.
6146 (class rewind_info_t): Likewise.
6147 (exploded_graph::add_edge): Likewise.
6148 * program-state.cc (program_state::on_edge): Update for new
6149 path_ctxt param.
6150 (program_state::push_call): Likewise.
6151 (program_state::returning_call): Likewise.
6152 (program_state::prune_for_point): Likewise.
6153 * region-model-impl-calls.cc: Include "analyzer/call-info.h".
6154 (call_details::get_fndecl_for_call): New.
6155 (region_model::impl_call_realloc): Reimplement.
6156 * region-model.cc (region_model::on_call_pre): Move call to
6157 impl_call_realloc to...
6158 (region_model::on_call_post): ...here. Consolidate creation
6159 of call_details instance.
6160 (noop_region_model_context::bifurcate): New.
6161 (noop_region_model_context::terminate_path): New.
6162 * region-model.h (call_details::get_call_stmt): New.
6163 (call_details::get_fndecl_for_call): New.
6164 (region_model::on_realloc_with_move): New.
6165 (region_model_context::bifurcate): New.
6166 (region_model_context::terminate_path): New.
6167 (region_model_context::get_ext_state): New.
6168 (region_model_context::get_malloc_map): New.
6169 (noop_region_model_context::bifurcate): New.
6170 (noop_region_model_context::terminate_path): New.
6171 (noop_region_model_context::get_ext_state): New.
6172 (noop_region_model_context::get_malloc_map): New.
6173 * sm-malloc.cc: Include "analyzer/program-state.h".
6174 (malloc_state_machine::on_realloc_call): Reimplement.
6175 (malloc_state_machine::on_realloc_with_move): New.
6176 (region_model::on_realloc_with_move): New.
6177 * sm-signal.cc (class signal_delivery_edge_info_t): Update for
6178 conversion from exploded_edge::custom_info_t to custom_edge_info.
6179 * sm.h (sm_context::get_path_context): New.
6180 * svalue.cc (svalue::maybe_get_constant): Call
6181 unwrap_any_unmergeable.
6183 2021-08-25 Ankur Saini <arsenic@sourceware.org>
6185 PR analyzer/101980
6186 * engine.cc (exploded_graph::maybe_create_dynamic_call): Don't create
6187 calls if max recursion limit is reached.
6189 2021-08-23 David Malcolm <dmalcolm@redhat.com>
6191 * analyzer.h (struct rejected_constraint): Convert to...
6192 (class rejected_constraint): ...this.
6193 (class bounded_ranges): New forward decl.
6194 (class bounded_ranges_manager): New forward decl.
6195 * constraint-manager.cc: Include "analyzer/analyzer-logging.h" and
6196 "tree-pretty-print.h".
6197 (can_plus_one_p): New.
6198 (plus_one): New.
6199 (can_minus_one_p): New.
6200 (minus_one): New.
6201 (bounded_range::bounded_range): New.
6202 (dump_cst): New.
6203 (bounded_range::dump_to_pp): New.
6204 (bounded_range::dump): New.
6205 (bounded_range::to_json): New.
6206 (bounded_range::set_json_attr): New.
6207 (bounded_range::contains_p): New.
6208 (bounded_range::intersects_p): New.
6209 (bounded_range::operator==): New.
6210 (bounded_range::cmp): New.
6211 (bounded_ranges::bounded_ranges): New.
6212 (bounded_ranges::bounded_ranges): New.
6213 (bounded_ranges::bounded_ranges): New.
6214 (bounded_ranges::canonicalize): New.
6215 (bounded_ranges::validate): New.
6216 (bounded_ranges::operator==): New.
6217 (bounded_ranges::dump_to_pp): New.
6218 (bounded_ranges::dump): New.
6219 (bounded_ranges::to_json): New.
6220 (bounded_ranges::eval_condition): New.
6221 (bounded_ranges::contain_p): New.
6222 (bounded_ranges::cmp): New.
6223 (bounded_ranges_manager::~bounded_ranges_manager): New.
6224 (bounded_ranges_manager::get_or_create_empty): New.
6225 (bounded_ranges_manager::get_or_create_point): New.
6226 (bounded_ranges_manager::get_or_create_range): New.
6227 (bounded_ranges_manager::get_or_create_union): New.
6228 (bounded_ranges_manager::get_or_create_intersection): New.
6229 (bounded_ranges_manager::get_or_create_inverse): New.
6230 (bounded_ranges_manager::consolidate): New.
6231 (bounded_ranges_manager::get_or_create_ranges_for_switch): New.
6232 (bounded_ranges_manager::create_ranges_for_switch): New.
6233 (bounded_ranges_manager::make_case_label_ranges): New.
6234 (bounded_ranges_manager::log_stats): New.
6235 (bounded_ranges_constraint::print): New.
6236 (bounded_ranges_constraint::to_json): New.
6237 (bounded_ranges_constraint::operator==): New.
6238 (bounded_ranges_constraint::add_to_hash): New.
6239 (constraint_manager::constraint_manager): Update for new field
6240 m_bounded_ranges_constraints.
6241 (constraint_manager::operator=): Likewise.
6242 (constraint_manager::hash): Likewise.
6243 (constraint_manager::operator==): Likewise.
6244 (constraint_manager::print): Likewise.
6245 (constraint_manager::dump_to_pp): Likewise.
6246 (constraint_manager::to_json): Likewise.
6247 (constraint_manager::add_unknown_constraint): Update the lhs_ec_id
6248 if necessary in existing constraints when combining equivalence
6249 classes. Add similar code for handling
6250 m_bounded_ranges_constraints.
6251 (constraint_manager::add_constraint_internal): Add comment.
6252 (constraint_manager::add_bounded_ranges): New.
6253 (constraint_manager::eval_condition): Use new field
6254 m_bounded_ranges_constraints.
6255 (constraint_manager::purge): Update bounded_ranges_constraint
6256 instances.
6257 (constraint_manager::canonicalize): Update for new field.
6258 (merger_fact_visitor::on_ranges): New.
6259 (constraint_manager::for_each_fact): Use new field
6260 m_bounded_ranges_constraints.
6261 (constraint_manager::validate): Fix off-by-one error needed due
6262 to bug fixed above in add_unknown_constraint. Validate the EC IDs
6263 in m_bounded_ranges_constraints.
6264 (constraint_manager::get_range_manager): New.
6265 (selftest::assert_dump_bounded_range_eq): New.
6266 (ASSERT_DUMP_BOUNDED_RANGE_EQ): New.
6267 (selftest::test_bounded_range): New.
6268 (selftest::assert_dump_bounded_ranges_eq): New.
6269 (ASSERT_DUMP_BOUNDED_RANGES_EQ): New.
6270 (selftest::test_bounded_ranges): New.
6271 (selftest::run_constraint_manager_tests): Call the new selftests.
6272 * constraint-manager.h (struct bounded_range): New.
6273 (struct bounded_ranges): New.
6274 (template <> struct default_hash_traits<bounded_ranges::key_t>): New.
6275 (class bounded_ranges_manager): New.
6276 (fact_visitor::on_ranges): New pure virtual function.
6277 (class bounded_ranges_constraint): New.
6278 (constraint_manager::add_bounded_ranges): New decl.
6279 (constraint_manager::get_range_manager): New decl.
6280 (constraint_manager::m_bounded_ranges_constraints): New field.
6281 * diagnostic-manager.cc (epath_finder::process_worklist_item):
6282 Transfer ownership of rc to add_feasibility_problem.
6283 * engine.cc (feasibility_problem::dump_to_pp): Use get_model.
6284 * feasible-graph.cc (infeasible_node::dump_dot): Update for
6285 conversion of m_rc to a pointer.
6286 (feasible_graph::add_feasibility_problem): Pass RC by pointer and
6287 take ownership.
6288 * feasible-graph.h (infeasible_node::infeasible_node): Pass RC by
6289 pointer and take ownership.
6290 (infeasible_node::~infeasible_node): New.
6291 (infeasible_node::m_rc): Convert to a pointer.
6292 (feasible_graph::add_feasibility_problem): Pass RC by pointer and
6293 take ownership.
6294 * region-model-manager.cc: Include
6295 "analyzer/constraint-manager.h".
6296 (region_model_manager::region_model_manager): Initializer new
6297 field m_range_mgr.
6298 (region_model_manager::~region_model_manager): Delete it.
6299 (region_model_manager::log_stats): Call log_stats on it.
6300 * region-model.cc (region_model::add_constraint): Use new subclass
6301 rejected_op_constraint.
6302 (region_model::apply_constraints_for_gswitch): Reimplement using
6303 bounded_ranges_manager.
6304 (rejected_constraint::dump_to_pp): Convert to...
6305 (rejected_op_constraint::dump_to_pp): ...this.
6306 (rejected_ranges_constraint::dump_to_pp): New.
6307 * region-model.h (struct purge_stats): Add field
6308 m_num_bounded_ranges_constraints.
6309 (region_model_manager::get_range_manager): New.
6310 (region_model_manager::m_range_mgr): New.
6311 (region_model::get_range_manager): New.
6312 (struct rejected_constraint): Split into...
6313 (class rejected_constraint):...this new abstract base class,
6314 and...
6315 (class rejected_op_constraint): ...this new concrete subclass.
6316 (class rejected_ranges_constraint): New.
6317 * supergraph.cc: Include "tree-cfg.h".
6318 (supergraph::supergraph): Drop idx param from add_cfg_edge.
6319 (supergraph::add_cfg_edge): Drop idx param.
6320 (switch_cfg_superedge::switch_cfg_superedge): Move here from
6321 header. Populate m_case_labels with all cases which go to DST.
6322 (switch_cfg_superedge::dump_label_to_pp): Reimplement to use
6323 m_case_labels.
6324 (switch_cfg_superedge::get_case_label): Delete.
6325 * supergraph.h (supergraphadd_cfg_edge): Drop "idx" param.
6326 (switch_cfg_superedge::switch_cfg_superedge): Drop idx param and
6327 move implementation to supergraph.cc.
6328 (switch_cfg_superedge::get_case_label): Delete.
6329 (switch_cfg_superedge::get_case_labels): New.
6330 (switch_cfg_superedge::m_idx): Delete.
6331 (switch_cfg_superedge::m_case_labels): New field.
6333 2021-08-23 David Malcolm <dmalcolm@redhat.com>
6335 PR analyzer/101875
6336 * sm-file.cc (file_diagnostic::describe_state_change): Handle
6337 change.m_expr being NULL.
6339 2021-08-23 David Malcolm <dmalcolm@redhat.com>
6341 PR analyzer/101837
6342 * analyzer.cc (maybe_reconstruct_from_def_stmt): Bail if fn is
6343 NULL, and assert that it's non-NULL before passing it to
6344 build_call_array_loc.
6346 2021-08-23 David Malcolm <dmalcolm@redhat.com>
6348 PR analyzer/101962
6349 * region-model.cc (region_model::eval_condition_without_cm):
6350 Refactor comparison against zero, adding a check for
6351 POINTER_PLUS_EXPR of non-NULL.
6353 2021-08-23 David Malcolm <dmalcolm@redhat.com>
6355 * store.cc (bit_range::intersects_p): New overload.
6356 (bit_range::operator-): New.
6357 (binding_cluster::maybe_get_compound_binding): Handle the partial
6358 overlap case.
6359 (selftest::test_bit_range_intersects_p): Add test coverage for
6360 new overload of bit_range::intersects_p.
6361 * store.h (bit_range::intersects_p): New overload.
6362 (bit_range::operator-): New.
6364 2021-08-23 Ankur Saini <arsenic@sourceware.org>
6366 PR analyzer/102020
6367 * diagnostic-manager.cc
6368 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>: Fix typo.
6370 2021-08-21 Ankur Saini <arsenic@sourceware.org>
6372 PR analyzer/101980
6373 * diagnostic-manager.cc
6374 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>: Use
6375 caller_model only when the supergraph_edge doesn't exixt.
6376 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_RETURN_EDGE>:
6377 Likewise.
6378 * engine.cc (exploded_graph::create_dynamic_call): Rename to...
6379 (exploded_graph::maybe_create_dynamic_call): ...this, return call
6380 creation status.
6381 (exploded_graph::process_node): Handle calls which were not dynamically
6382 discovered.
6383 * exploded-graph.h (exploded_graph::create_dynamic_call): Rename to...
6384 (exploded_graph::maybe_create_dynamic_call): ...this.
6385 * region-model.cc (region_model::update_for_gcall): New param, use it
6386 to push call to frame.
6387 (region_model::update_for_call_superedge): Pass callee function to
6388 update_for_gcall.
6389 * region-model.h (region_model::update_for_gcall): New param.
6391 2021-08-18 Ankur Saini <arsenic@sourceware.org>
6393 PR analyzer/97114
6394 * region-model.cc (region_model::get_rvalue_1): Add case for
6395 OBJ_TYPE_REF.
6397 2021-08-18 Ankur Saini <arsenic@sourceware.org>
6399 PR analyzer/100546
6400 * analysis-plan.cc (analysis_plan::use_summary_p): Don't use call
6401 summaries if there is no callgraph edge
6402 * checker-path.cc (call_event::call_event): Handle calls events that
6403 are not represented by a supergraph call edge
6404 (return_event::return_event): Likewise.
6405 (call_event::get_desc): Work with new call_event structure.
6406 (return_event::get_desc): Likeise.
6407 * checker-path.h (call_event::m_src_snode): New field.
6408 (call_event::m_dest_snode): New field.
6409 (return_event::m_src_snode): New field.
6410 (return_event::m_dest_snode): New field.
6411 * diagnostic-manager.cc
6412 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>:
6413 Refactor to work with edges without callgraph edge.
6414 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_RETURN_EDGE>:
6415 Likewise.
6416 * engine.cc (dynamic_call_info_t::update_model): New function.
6417 (dynamic_call_info_t::add_events_to_path): New function.
6418 (exploded_graph::create_dynamic_call): New function.
6419 (exploded_graph::process_node): Work with dynamically discovered calls.
6420 * exploded-graph.h (class dynamic_call_info_t): New class.
6421 (exploded_graph::create_dynamic_call): New decl.
6422 * program-point.cc (program_point::push_to_call_stack): New function.
6423 (program_point::pop_from_call_stack): New function.
6424 * program-point.h (program_point::push_to_call_stack): New decl.
6425 (program_point::pop_from_call_stack): New decl.
6426 * program-state.cc (program_state::push_call): New function.
6427 (program_state::returning_call): New function.
6428 * program-state.h (program_state::push_call): New decl.
6429 (program_state::returning_call): New decl.
6430 * region-model.cc (region_model::update_for_gcall) New function.
6431 (region_model::update_for_return_gcall): New function.
6432 (egion_model::update_for_call_superedge): Get the underlying gcall and
6433 update for gcall.
6434 (region_model::update_for_return_superedge): Likewise.
6435 * region-model.h (region_model::update_for_gcall): New decl.
6436 (region_model::update_for_return_gcall): New decl.
6437 * state-purge.cc (state_purge_per_ssa_name::process_point): Update to
6438 work with calls without underlying cgraph edge.
6439 * supergraph.cc (supergraph::supergraph) Split snodes at every callsite.
6440 * supergraph.h (supernode::get_returning_call) New accessor.
6442 2021-08-04 David Malcolm <dmalcolm@redhat.com>
6444 PR analyzer/101570
6445 * analyzer.cc (maybe_reconstruct_from_def_stmt): Add GIMPLE_ASM
6446 case.
6447 * analyzer.h (class asm_output_svalue): New forward decl.
6448 (class reachable_regions): New forward decl.
6449 * complexity.cc (complexity::from_vec_svalue): New.
6450 * complexity.h (complexity::from_vec_svalue): New decl.
6451 * engine.cc (feasibility_state::maybe_update_for_edge): Handle
6452 asm stmts by calling on_asm_stmt.
6453 * region-model-asm.cc: New file.
6454 * region-model-manager.cc
6455 (region_model_manager::maybe_fold_asm_output_svalue): New.
6456 (region_model_manager::get_or_create_asm_output_svalue): New.
6457 (region_model_manager::log_stats): Log m_asm_output_values_map.
6458 * region-model.cc (region_model::on_stmt_pre): Handle GIMPLE_ASM.
6459 * region-model.h (visitor::visit_asm_output_svalue): New.
6460 (region_model_manager::get_or_create_asm_output_svalue): New decl.
6461 (region_model_manager::maybe_fold_asm_output_svalue): New decl.
6462 (region_model_manager::asm_output_values_map_t): New typedef.
6463 (region_model_manager::m_asm_output_values_map): New field.
6464 (region_model::on_asm_stmt): New.
6465 * store.cc (binding_cluster::on_asm): New.
6466 * store.h (binding_cluster::on_asm): New decl.
6467 * svalue.cc (svalue::cmp_ptr): Handle SK_ASM_OUTPUT.
6468 (asm_output_svalue::dump_to_pp): New.
6469 (asm_output_svalue::dump_input): New.
6470 (asm_output_svalue::input_idx_to_asm_idx): New.
6471 (asm_output_svalue::accept): New.
6472 * svalue.h (enum svalue_kind): Add SK_ASM_OUTPUT.
6473 (svalue::dyn_cast_asm_output_svalue): New.
6474 (class asm_output_svalue): New.
6475 (is_a_helper <const asm_output_svalue *>::test): New.
6476 (struct default_hash_traits<asm_output_svalue::key_t>): New.
6478 2021-08-03 Jakub Jelinek <jakub@redhat.com>
6480 PR analyzer/101721
6481 * sm-malloc.cc (known_allocator_p): Only check DECL_FUNCTION_CODE on
6482 BUILT_IN_NORMAL builtins.
6484 2021-07-29 Ankur Saini <arsenic@sourceware.org>
6486 * call-string.cc (call_string::element_t::operator==): New operator.
6487 (call_String::element_t::operator!=): New operator.
6488 (call_string::element_t::get_caller_function): New function.
6489 (call_string::element_t::get_callee_function): New function.
6490 (call_string::call_string): Refactor to Initialise m_elements.
6491 (call_string::operator=): Refactor to work with m_elements.
6492 (call_string::operator==): Likewise.
6493 (call_string::to_json): Likewise.
6494 (call_string::hash): Refactor to hash e.m_caller.
6495 (call_string::push_call): Refactor to work with m_elements.
6496 (call_string::push_call): New overload to push call via supernodes.
6497 (call_string::pop): Refactor to work with m_elements.
6498 (call_string::calc_recursion_depth): Likewise.
6499 (call_string::cmp): Likewise.
6500 (call_string::validate): Likewise.
6501 (call_string::operator[]): Likewise.
6502 * call-string.h (class supernode): New forward decl.
6503 (struct call_string::element_t): New struct.
6504 (call_string::call_string): Refactor to initialise m_elements.
6505 (call_string::bool empty_p): Refactor to work with m_elements.
6506 (call_string::get_callee_node): New decl.
6507 (call_string::get_caller_node): New decl.
6508 (m_elements): Replaces m_return_edges.
6509 * program-point.cc (program_point::get_function_at_depth): Refactor to
6510 work with new call-string format.
6511 (program_point::validate): Likewise.
6512 (program_point::on_edge): Likewise.
6514 2021-07-28 David Malcolm <dmalcolm@redhat.com>
6516 * region-model.cc (region_model::on_call_pre): Treat
6517 IFN_UBSAN_BOUNDS, BUILT_IN_STACK_SAVE, and BUILT_IN_STACK_RESTORE
6518 as no-ops, rather than handling them as unknown functions.
6520 2021-07-28 David Malcolm <dmalcolm@redhat.com>
6522 * region-model-impl-calls.cc (region_model::impl_call_alloca):
6523 Drop redundant return value.
6524 (region_model::impl_call_builtin_expect): Likewise.
6525 (region_model::impl_call_calloc): Likewise.
6526 (region_model::impl_call_malloc): Likewise.
6527 (region_model::impl_call_memset): Likewise.
6528 (region_model::impl_call_operator_new): Likewise.
6529 (region_model::impl_call_operator_delete): Likewise.
6530 (region_model::impl_call_strlen): Likewise.
6531 * region-model.cc (region_model::on_call_pre): Fix return value of
6532 known functions that don't have unknown side-effects.
6533 * region-model.h (region_model::impl_call_alloca): Drop redundant
6534 return value.
6535 (region_model::impl_call_builtin_expect): Likewise.
6536 (region_model::impl_call_calloc): Likewise.
6537 (region_model::impl_call_malloc): Likewise.
6538 (region_model::impl_call_memset): Likewise.
6539 (region_model::impl_call_strlen): Likewise.
6540 (region_model::impl_call_operator_new): Likewise.
6541 (region_model::impl_call_operator_delete): Likewise.
6543 2021-07-28 Siddhesh Poyarekar <siddhesh@gotplt.org>
6545 * analyzer.cc (is_named_call_p, is_std_named_call_p): Make
6546 first argument a const_tree.
6547 * analyzer.h (is_named_call_p, -s_std_named_call_p): Likewise.
6548 * sm-malloc.cc (known_allocator_p): New function.
6549 (malloc_state_machine::on_stmt): Use it.
6551 2021-07-28 Siddhesh Poyarekar <siddhesh@gotplt.org>
6553 * sm-malloc.cc
6554 (malloc_state_machine::get_or_create_deallocator): Recognize
6555 __builtin_free.
6557 2021-07-26 David Malcolm <dmalcolm@redhat.com>
6559 * region-model.cc (region_model::on_call_pre): Always set conjured
6560 LHS, not just for SSA names.
6562 2021-07-23 David Malcolm <dmalcolm@redhat.com>
6564 * diagnostic-manager.cc
6565 (class auto_disable_complexity_checks): New.
6566 (epath_finder::explore_feasible_paths): Use it to disable
6567 complexity checks whilst processing the worklist.
6568 * region-model-manager.cc
6569 (region_model_manager::region_model_manager): Initialize
6570 m_check_complexity.
6571 (region_model_manager::reject_if_too_complex): Bail if
6572 m_check_complexity is false.
6573 * region-model.h
6574 (region_model_manager::enable_complexity_check): New.
6575 (region_model_manager::disable_complexity_check): New.
6576 (region_model_manager::m_check_complexity): New.
6578 2021-07-21 David Malcolm <dmalcolm@redhat.com>
6580 PR analyzer/101547
6581 * sm-file.cc (file_leak::emit): Handle m_arg being NULL.
6582 (file_leak::describe_final_event): Handle ev.m_expr being NULL.
6584 2021-07-21 David Malcolm <dmalcolm@redhat.com>
6586 PR analyzer/101522
6587 * store.cc (binding_cluster::purge_state_involving): Don't change
6588 m_map whilst iterating through it.
6590 2021-07-21 David Malcolm <dmalcolm@redhat.com>
6592 * region-model.cc (region_model::handle_phi): Add "old_state"
6593 param and use it.
6594 (region_model::update_for_phis): Update so that all of the phi
6595 stmts are effectively handled simultaneously, rather than in
6596 order.
6597 * region-model.h (region_model::handle_phi): Add "old_state"
6598 param.
6599 * state-purge.cc (self_referential_phi_p): Replace with...
6600 (name_used_by_phis_p): ...this new function.
6601 (state_purge_per_ssa_name::process_point): Update to use the
6602 above, so that all phi stmts at a basic block are effectively
6603 considered simultaneously, and only consider the phi arguments for
6604 the pertinent in-edge.
6605 * supergraph.cc (cfg_superedge::get_phi_arg_idx): New.
6606 (cfg_superedge::get_phi_arg): Use the above.
6607 * supergraph.h (cfg_superedge::get_phi_arg_idx): New decl.
6609 2021-07-21 David Malcolm <dmalcolm@redhat.com>
6611 * state-purge.cc (state_purge_annotator::add_node_annotations):
6612 Rather than erroneously always using the NULL in-edge, determine
6613 each relevant in-edge, and print the appropriate data for each
6614 in-edge. Use print_needed to print the data as comma-separated
6615 lists of SSA names.
6616 (print_vec_of_names): Add "within_table" param and use it.
6617 (state_purge_annotator::add_stmt_annotations): Factor out
6618 collation and printing code into...
6619 (state_purge_annotator::print_needed): ...this new function.
6620 * state-purge.h (state_purge_annotator::print_needed): New decl.
6622 2021-07-21 David Malcolm <dmalcolm@redhat.com>
6624 * program-point.cc (function_point::print): Show src BB index at
6625 BEFORE_SUPERNODE.
6627 2021-07-21 David Malcolm <dmalcolm@redhat.com>
6629 * svalue.cc (infix_p): New.
6630 (binop_svalue::dump_to_pp): Use it to print MIN_EXPR and MAX_EXPR
6631 in prefix form, rather than infix.
6633 2021-07-19 David Malcolm <dmalcolm@redhat.com>
6635 PR analyzer/101503
6636 * constraint-manager.cc (constraint_manager::add_constraint): Use
6637 can_have_associated_state_p rather than testing for unknown.
6638 (constraint_manager::get_or_add_equiv_class): Likewise.
6639 * program-state.cc (sm_state_map::set_state): Likewise.
6640 (sm_state_map::impl_set_state): Add assertion.
6641 * region-model-manager.cc
6642 (region_model_manager::maybe_fold_unaryop): Handle poisoned
6643 values.
6644 (region_model_manager::maybe_fold_binop): Move handling of unknown
6645 values...
6646 (region_model_manager::get_or_create_binop): ...to here, and
6647 generalize to use can_have_associated_state_p.
6648 (region_model_manager::maybe_fold_sub_svalue): Use
6649 can_have_associated_state_p rather than testing for unknown.
6650 (region_model_manager::maybe_fold_repeated_svalue): Use unknown
6651 when the size or repeated value is "unknown"/"poisoned".
6652 * region-model.cc (region_model::purge_state_involving): Reject
6653 attempts to purge unknown/poisoned svalues, as these svalues
6654 should not have state associated with them.
6655 * svalue.cc (sub_svalue::sub_svalue): Assert that we're building
6656 on top of an svalue with can_have_associated_state_p.
6657 (repeated_svalue::repeated_svalue): Likewise.
6658 (bits_within_svalue::bits_within_svalue): Likewise.
6659 * svalue.h (svalue::can_have_associated_state_p): New.
6660 (unknown_svalue::can_have_associated_state_p): New.
6661 (poisoned_svalue::can_have_associated_state_p): New.
6662 (unaryop_svalue::unaryop_svalue): Assert that we're building on
6663 top of an svalue with can_have_associated_state_p.
6664 (binop_svalue::binop_svalue): Likewise.
6665 (widening_svalue::widening_svalue): Likewise.
6667 2021-07-16 David Malcolm <dmalcolm@redhat.com>
6669 * analyzer.h (enum access_direction): New.
6670 * engine.cc (exploded_node::on_longjmp): Update for new param of
6671 get_store_value.
6672 * program-state.cc (program_state::prune_for_point): Likewise.
6673 * region-model-impl-calls.cc (region_model::impl_call_memcpy):
6674 Replace call to check_for_writable_region with call to
6675 check_region_for_write.
6676 (region_model::impl_call_memset): Likewise.
6677 (region_model::impl_call_strcpy): Likewise.
6678 * region-model-reachability.cc (reachable_regions::add): Update
6679 for new param of get_store_value.
6680 * region-model.cc (region_model::get_rvalue_1): Likewise, also for
6681 get_rvalue_for_bits.
6682 (region_model::get_store_value): Add ctxt param and use it to call
6683 check_region_for_read.
6684 (region_model::get_rvalue_for_bits): Add ctxt param and use it to
6685 call get_store_value.
6686 (region_model::check_region_access): New.
6687 (region_model::check_region_for_write): New.
6688 (region_model::check_region_for_read): New.
6689 (region_model::set_value): Update comment. Replace call to
6690 check_for_writable_region with call to check_region_for_write.
6691 * region-model.h (region_model::get_rvalue_for_bits): Add ctxt
6692 param.
6693 (region_model::get_store_value): Add ctxt param.
6694 (region_model::check_region_access): New decl.
6695 (region_model::check_region_for_write): New decl.
6696 (region_model::check_region_for_read): New decl.
6697 * region.cc (region_model::copy_region): Update call to
6698 get_store_value.
6699 * svalue.cc (initial_svalue::implicitly_live_p): Likewise.
6701 2021-07-16 David Malcolm <dmalcolm@redhat.com>
6703 * engine.cc (exploded_node::on_stmt_pre): Handle
6704 __analyzer_dump_state.
6705 * program-state.cc (extrinsic_state::get_sm_idx_by_name): New.
6706 (program_state::impl_call_analyzer_dump_state): New.
6707 * program-state.h (extrinsic_state::get_sm_idx_by_name): New decl.
6708 (program_state::impl_call_analyzer_dump_state): New decl.
6709 * region-model-impl-calls.cc
6710 (call_details::get_arg_string_literal): New.
6711 * region-model.h (call_details::get_arg_string_literal): New decl.
6713 2021-07-16 David Malcolm <dmalcolm@redhat.com>
6715 * program-state.cc (program_state::detect_leaks): Simplify using
6716 svalue::maybe_get_region.
6717 * region-model-impl-calls.cc (region_model::impl_call_fgets): Likewise.
6718 (region_model::impl_call_fread): Likewise.
6719 (region_model::impl_call_free): Likewise.
6720 (region_model::impl_call_operator_delete): Likewise.
6721 * region-model.cc (selftest::test_stack_frames): Likewise.
6722 (selftest::test_state_merging): Likewise.
6723 * svalue.cc (svalue::maybe_get_region): New.
6724 * svalue.h (svalue::maybe_get_region): New decl.
6726 2021-07-15 David Malcolm <dmalcolm@redhat.com>
6728 * svalue.h (is_a_helper <placeholder_svalue *>::test): Make
6729 param and template param const.
6730 (is_a_helper <widening_svalue *>::test): Likewise.
6731 (is_a_helper <compound_svalue *>::test): Likewise.
6732 (is_a_helper <conjured_svalue *>::test): Likewise.
6734 2021-07-15 David Malcolm <dmalcolm@redhat.com>
6736 PR analyzer/95006
6737 PR analyzer/94713
6738 PR analyzer/94714
6739 * analyzer.cc (maybe_reconstruct_from_def_stmt): Split out
6740 GIMPLE_ASSIGN case into...
6741 (get_diagnostic_tree_for_gassign_1): New.
6742 (get_diagnostic_tree_for_gassign): New.
6743 * analyzer.h (get_diagnostic_tree_for_gassign): New decl.
6744 * analyzer.opt (Wanalyzer-write-to-string-literal): New.
6745 * constraint-manager.cc (class svalue_purger): New.
6746 (constraint_manager::purge_state_involving): New.
6747 * constraint-manager.h
6748 (constraint_manager::purge_state_involving): New.
6749 * diagnostic-manager.cc (saved_diagnostic::supercedes_p): New.
6750 (dedupe_winners::handle_interactions): New.
6751 (diagnostic_manager::emit_saved_diagnostics): Call it.
6752 * diagnostic-manager.h (saved_diagnostic::supercedes_p): New decl.
6753 * engine.cc (impl_region_model_context::warn): Convert return type
6754 to bool. Return false if the diagnostic isn't saved.
6755 (impl_region_model_context::purge_state_involving): New.
6756 (impl_sm_context::get_state): Use NULL ctxt when querying old
6757 rvalue.
6758 (impl_sm_context::set_next_state): Use new sval when querying old
6759 state.
6760 (class dump_path_diagnostic): Move to region-model.cc
6761 (exploded_node::on_stmt): Move to on_stmt_pre and on_stmt_post.
6762 Remove call to purge_state_involving.
6763 (exploded_node::on_stmt_pre): New, based on the above. Move most
6764 of it to region_model::on_stmt_pre.
6765 (exploded_node::on_stmt_post): Likewise, moving to
6766 region_model::on_stmt_post.
6767 (class stale_jmp_buf): Fix parent class to use curiously recurring
6768 template pattern.
6769 (feasibility_state::maybe_update_for_edge): Call on_call_pre and
6770 on_call_post on gcalls.
6771 * exploded-graph.h (impl_region_model_context::warn): Return bool.
6772 (impl_region_model_context::purge_state_involving): New decl.
6773 (exploded_node::on_stmt_pre): New decl.
6774 (exploded_node::on_stmt_post): New decl.
6775 * pending-diagnostic.h (pending_diagnostic::use_of_uninit_p): New.
6776 (pending_diagnostic::supercedes_p): New.
6777 * program-state.cc (sm_state_map::get_state): Inherit state for
6778 conjured_svalue as well as initial_svalue.
6779 (sm_state_map::purge_state_involving): Also support SK_CONJURED.
6780 * region-model-impl-calls.cc (call_details::get_uncertainty):
6781 Handle m_ctxt being NULL.
6782 (call_details::get_or_create_conjured_svalue): New.
6783 (region_model::impl_call_fgets): New.
6784 (region_model::impl_call_fread): New.
6785 * region-model-manager.cc
6786 (region_model_manager::get_or_create_initial_value): Return an
6787 uninitialized poisoned value for regions that can't have initial
6788 values.
6789 * region-model-reachability.cc
6790 (reachable_regions::mark_escaped_clusters): Handle ctxt being
6791 NULL.
6792 * region-model.cc (region_to_value_map::purge_state_involving): New.
6793 (poisoned_value_diagnostic::use_of_uninit_p): New.
6794 (poisoned_value_diagnostic::emit): Handle POISON_KIND_UNINIT.
6795 (poisoned_value_diagnostic::describe_final_event): Likewise.
6796 (region_model::check_for_poison): New.
6797 (region_model::on_assignment): Call it.
6798 (class dump_path_diagnostic): Move here from engine.cc.
6799 (region_model::on_stmt_pre): New, based on exploded_node::on_stmt.
6800 (region_model::on_call_pre): Move the setting of the LHS to a
6801 conjured svalue to before the checks for specific functions.
6802 Handle "fgets", "fgets_unlocked", and "fread".
6803 (region_model::purge_state_involving): New.
6804 (region_model::handle_unrecognized_call): Handle ctxt being NULL.
6805 (region_model::get_rvalue): Call check_for_poison.
6806 (selftest::test_stack_frames): Use NULL for context when getting
6807 uninitialized rvalue.
6808 (selftest::test_alloca): Likewise.
6809 * region-model.h (region_to_value_map::purge_state_involving): New
6810 decl.
6811 (call_details::get_or_create_conjured_svalue): New decl.
6812 (region_model::on_stmt_pre): New decl.
6813 (region_model::purge_state_involving): New decl.
6814 (region_model::impl_call_fgets): New decl.
6815 (region_model::impl_call_fread): New decl.
6816 (region_model::check_for_poison): New decl.
6817 (region_model_context::warn): Return bool.
6818 (region_model_context::purge_state_involving): New.
6819 (noop_region_model_context::warn): Return bool.
6820 (noop_region_model_context::purge_state_involving): New.
6821 (test_region_model_context:: warn): Return bool.
6822 * region.cc (region::get_memory_space): New.
6823 (region::can_have_initial_svalue_p): New.
6824 (region::involves_p): New.
6825 * region.h (enum memory_space): New.
6826 (region::get_memory_space): New decl.
6827 (region::can_have_initial_svalue_p): New decl.
6828 (region::involves_p): New decl.
6829 * sm-malloc.cc (use_after_free::supercedes_p): New.
6830 * store.cc (binding_cluster::purge_state_involving): New.
6831 (store::purge_state_involving): New.
6832 * store.h (class symbolic_binding): New forward decl.
6833 (binding_key::dyn_cast_symbolic_binding): New.
6834 (symbolic_binding::dyn_cast_symbolic_binding): New.
6835 (binding_cluster::purge_state_involving): New.
6836 (store::purge_state_involving): New.
6837 * svalue.cc (svalue::can_merge_p): Reject attempts to merge
6838 poisoned svalues with other svalues, so that we identify
6839 paths in which a variable is conditionally uninitialized.
6840 (involvement_visitor::visit_conjured_svalue): New.
6841 (svalue::involves_p): Also handle SK_CONJURED.
6842 (poison_kind_to_str): Handle POISON_KIND_UNINIT.
6843 (poisoned_svalue::maybe_fold_bits_within): New.
6844 * svalue.h (enum poison_kind): Add POISON_KIND_UNINIT.
6845 (poisoned_svalue::maybe_fold_bits_within): New decl.
6847 2021-07-15 David Malcolm <dmalcolm@redhat.com>
6849 * analyzer.opt (fdump-analyzer-exploded-paths): New.
6850 * diagnostic-manager.cc
6851 (diagnostic_manager::emit_saved_diagnostic): Implement it.
6852 * engine.cc (exploded_path::dump_to_pp): Add ext_state param and
6853 use it to dump states if non-NULL.
6854 (exploded_path::dump): Likewise.
6855 (exploded_path::dump_to_file): New.
6856 * exploded-graph.h (exploded_path::dump_to_pp): Add ext_state
6857 param.
6858 (exploded_path::dump): Likewise.
6859 (exploded_path::dump): Likewise.
6860 (exploded_path::dump_to_file): New.
6862 2021-07-15 David Malcolm <dmalcolm@redhat.com>
6864 * analyzer.cc (fixup_tree_for_diagnostic_1): Use DECL_DEBUG_EXPR
6865 if it's available.
6866 * engine.cc (readability): Likewise.
6868 2021-07-15 David Malcolm <dmalcolm@redhat.com>
6870 * state-purge.cc (self_referential_phi_p): New.
6871 (state_purge_per_ssa_name::process_point): Don't purge an SSA name
6872 at its def-stmt if the def-stmt is self-referential.
6874 2021-07-07 David Malcolm <dmalcolm@redhat.com>
6876 * diagnostic-manager.cc (null_assignment_sm_context::get_state):
6877 New overload.
6878 (null_assignment_sm_context::set_next_state): New overload.
6879 (null_assignment_sm_context::get_diagnostic_tree): New.
6880 * engine.cc (impl_sm_context::get_state): New overload.
6881 (impl_sm_context::set_next_state): New overload.
6882 (impl_sm_context::get_diagnostic_tree): New overload.
6883 (impl_region_model_context::on_condition): Convert params from
6884 tree to const svalue *.
6885 * exploded-graph.h (impl_region_model_context::on_condition):
6886 Likewise.
6887 * region-model.cc (region_model::on_call_pre): Move handling of
6888 internal calls to before checking for get_fndecl_for_call.
6889 (region_model::add_constraints_from_binop): New.
6890 (region_model::add_constraint): Split out into a new overload
6891 working on const svalue * rather than tree. Call
6892 add_constraints_from_binop. Drop call to
6893 add_any_constraints_from_ssa_def_stmt.
6894 (region_model::add_any_constraints_from_ssa_def_stmt): Delete.
6895 (region_model::add_any_constraints_from_gassign): Delete.
6896 (region_model::add_any_constraints_from_gcall): Delete.
6897 * region-model.h
6898 (region_model::add_any_constraints_from_ssa_def_stmt): Delete.
6899 (region_model::add_any_constraints_from_gassign): Delete.
6900 (region_model::add_any_constraints_from_gcall): Delete.
6901 (region_model::add_constraint): Add overload decl.
6902 (region_model::add_constraints_from_binop): New decl.
6903 (region_model_context::on_condition): Convert params from tree to
6904 const svalue *.
6905 (noop_region_model_context::on_condition): Likewise.
6906 * sm-file.cc (fileptr_state_machine::condition): Likewise.
6907 * sm-malloc.cc (malloc_state_machine::on_condition): Likewise.
6908 * sm-pattern-test.cc: Include tristate.h, selftest.h,
6909 analyzer/call-string.h, analyzer/program-point.h,
6910 analyzer/store.h, and analyzer/region-model.h.
6911 (pattern_test_state_machine::on_condition): Convert params from tree to
6912 const svalue *.
6913 * sm-sensitive.cc (sensitive_state_machine::on_condition): Delete.
6914 * sm-signal.cc (signal_state_machine::on_condition): Delete.
6915 * sm-taint.cc (taint_state_machine::on_condition): Convert params
6916 from tree to const svalue *.
6917 * sm.cc: Include tristate.h, selftest.h, analyzer/call-string.h,
6918 analyzer/program-point.h, analyzer/store.h, and
6919 analyzer/region-model.h.
6920 (any_pointer_p): Add overload taking const svalue *sval.
6921 * sm.h (any_pointer_p): Add overload taking const svalue *sval.
6922 (state_machine::on_condition): Convert params from tree to
6923 const svalue *. Provide no-op default implementation.
6924 (sm_context::get_state): Add overload taking const svalue *sval.
6925 (sm_context::set_next_state): Likewise.
6926 (sm_context::on_transition): Likewise.
6927 (sm_context::get_diagnostic_tree): Likewise.
6928 * svalue.cc (svalue::all_zeroes_p): New.
6929 (constant_svalue::all_zeroes_p): New.
6930 (repeated_svalue::all_zeroes_p): Convert to vfunc.
6931 * svalue.h (svalue::all_zeroes_p): New decl.
6932 (constant_svalue::all_zeroes_p): New decl.
6933 (repeated_svalue::all_zeroes_p): Convert decl to vfunc.
6935 2021-06-30 David Malcolm <dmalcolm@redhat.com>
6937 PR analyzer/95006
6938 * analyzer.h (class repeated_svalue): New forward decl.
6939 (class bits_within_svalue): New forward decl.
6940 (class sized_region): New forward decl.
6941 (get_field_at_bit_offset): New forward decl.
6942 * engine.cc (exploded_graph::get_or_create_node): Validate the
6943 merged state.
6944 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
6945 Validate the states at each stage.
6946 * program-state.cc (program_state::validate): Validate
6947 m_region_model.
6948 * region-model-impl-calls.cc (region_model::impl_call_memset):
6949 Replace special-case logic for handling constant sizes with
6950 a call to fill_region of a sized_region with the given fill value.
6951 * region-model-manager.cc (maybe_undo_optimize_bit_field_compare):
6952 Drop DK_direct.
6953 (region_model_manager::maybe_fold_sub_svalue): Fold element-based
6954 subregions of an initial value into initial values of an element.
6955 Fold subvalues of repeated svalues.
6956 (region_model_manager::maybe_fold_repeated_svalue): New.
6957 (region_model_manager::get_or_create_repeated_svalue): New.
6958 (get_bit_range_for_field): New.
6959 (get_byte_range_for_field): New.
6960 (get_field_at_byte_range): New.
6961 (region_model_manager::maybe_fold_bits_within_svalue): New.
6962 (region_model_manager::get_or_create_bits_within): New.
6963 (region_model_manager::get_sized_region): New.
6964 (region_model_manager::log_stats): Update for addition of
6965 m_repeated_values_map, m_bits_within_values_map, and
6966 m_sized_regions.
6967 * region-model.cc (region_model::validate): New.
6968 (region_model::on_assignment): Drop enum binding_kind.
6969 (region_model::get_initial_value_for_global): Likewise.
6970 (region_model::get_rvalue_for_bits): Replace body with call to
6971 get_or_create_bits_within.
6972 (region_model::get_capacity): Handle RK_SIZED.
6973 (region_model::set_value): Drop enum binding_kind.
6974 (region_model::fill_region): New.
6975 (region_model::get_representative_path_var_1): Handle RK_SIZED.
6976 * region-model.h (visitor::visit_repeated_svalue): New.
6977 (visitor::visit_bits_within_svalue): New.
6978 (region_model_manager::get_or_create_repeated_svalue): New decl.
6979 (region_model_manager::get_or_create_bits_within): New decl.
6980 (region_model_manager::get_sized_region): New decl.
6981 (region_model_manager::maybe_fold_repeated_svalue): New decl.
6982 (region_model_manager::maybe_fold_bits_within_svalue): New decl.
6983 (region_model_manager::repeated_values_map_t): New typedef.
6984 (region_model_manager::m_repeated_values_map): New field.
6985 (region_model_manager::bits_within_values_map_t): New typedef.
6986 (region_model_manager::m_bits_within_values_map): New field.
6987 (region_model_manager::m_sized_regions): New field.
6988 (region_model::fill_region): New decl.
6989 * region.cc (region::get_base_region): Handle RK_SIZED.
6990 (region::base_region_p): Likewise.
6991 (region::get_byte_size_sval): New.
6992 (get_field_at_bit_offset): Make non-static.
6993 (region::calc_offset): Move implementation of cases to
6994 get_relative_concrete_offset vfunc implementations. Handle
6995 RK_SIZED.
6996 (region::get_relative_concrete_offset): New.
6997 (decl_region::get_svalue_for_initializer): Drop enum binding_kind.
6998 (field_region::get_relative_concrete_offset): New, from
6999 region::calc_offset.
7000 (element_region::get_relative_concrete_offset): Likewise.
7001 (offset_region::get_relative_concrete_offset): Likewise.
7002 (sized_region::accept): New.
7003 (sized_region::dump_to_pp): New.
7004 (sized_region::get_byte_size): New.
7005 (sized_region::get_bit_size): New.
7006 * region.h (enum region_kind): Add RK_SIZED.
7007 (region::dyn_cast_sized_region): New.
7008 (region::get_byte_size): Make virtual.
7009 (region::get_bit_size): Likewise.
7010 (region::get_byte_size_sval): New decl.
7011 (region::get_relative_concrete_offset): New decl.
7012 (field_region::get_relative_concrete_offset): New decl.
7013 (element_region::get_relative_concrete_offset): Likewise.
7014 (offset_region::get_relative_concrete_offset): Likewise.
7015 (class sized_region): New.
7016 * store.cc (binding_kind_to_string): Delete.
7017 (binding_key::make): Drop enum binding_kind.
7018 (binding_key::dump_to_pp): Delete.
7019 (binding_key::cmp_ptrs): Drop enum binding_kind.
7020 (bit_range::contains_p): New.
7021 (byte_range::dump): New.
7022 (byte_range::contains_p): New.
7023 (byte_range::cmp): New.
7024 (concrete_binding::dump_to_pp): Drop enum binding_kind.
7025 (concrete_binding::cmp_ptr_ptr): Likewise.
7026 (symbolic_binding::dump_to_pp): Likewise.
7027 (symbolic_binding::cmp_ptr_ptr): Likewise.
7028 (binding_map::apply_ctor_val_to_range): Likewise.
7029 (binding_map::apply_ctor_pair_to_child_region): Likewise.
7030 (binding_map::get_overlapping_bindings): New.
7031 (binding_map::remove_overlapping_bindings): New.
7032 (binding_cluster::validate): New.
7033 (binding_cluster::bind): Drop enum binding_kind.
7034 (binding_cluster::bind_compound_sval): Likewise.
7035 (binding_cluster::purge_region): Likewise.
7036 (binding_cluster::zero_fill_region): Reimplement in terms of...
7037 (binding_cluster::fill_region): New.
7038 (binding_cluster::mark_region_as_unknown): Drop enum binding_kind.
7039 (binding_cluster::get_binding): Likewise.
7040 (binding_cluster::get_binding_recursive): Likewise.
7041 (binding_cluster::get_any_binding): Likewise.
7042 (binding_cluster::maybe_get_compound_binding): Reimplement.
7043 (binding_cluster::get_overlapping_bindings): Delete.
7044 (binding_cluster::remove_overlapping_bindings): Reimplement in
7045 terms of binding_map::remove_overlapping_bindings.
7046 (binding_cluster::can_merge_p): Update for removal of
7047 enum binding_kind.
7048 (binding_cluster::on_unknown_fncall): Drop enum binding_kind.
7049 (binding_cluster::maybe_get_simple_value): Likewise.
7050 (store_manager::get_concrete_binding): Likewise.
7051 (store_manager::get_symbolic_binding): Likewise.
7052 (store::validate): New.
7053 (store::set_value): Drop enum binding_kind.
7054 (store::zero_fill_region): Reimplement in terms of...
7055 (store::fill_region): New.
7056 (selftest::test_binding_key_overlap): Drop enum binding_kind.
7057 * store.h (enum binding_kind): Delete.
7058 (binding_kind_to_string): Delete decl.
7059 (binding_key::make): Drop enum binding_kind.
7060 (binding_key::dump_to_pp): Make pure virtual.
7061 (binding_key::get_kind): Delete.
7062 (binding_key::mark_deleted): Delete.
7063 (binding_key::mark_empty): Delete.
7064 (binding_key::is_deleted): Delete.
7065 (binding_key::is_empty): Delete.
7066 (binding_key::binding_key): Delete.
7067 (binding_key::impl_hash): Delete.
7068 (binding_key::impl_eq): Delete.
7069 (binding_key::m_kind): Delete.
7070 (bit_range::get_last_bit_offset): New.
7071 (bit_range::contains_p): New.
7072 (byte_range::contains_p): New.
7073 (byte_range::operator==): New.
7074 (byte_range::get_start_byte_offset): New.
7075 (byte_range::get_next_byte_offset): New.
7076 (byte_range::get_last_byte_offset): New.
7077 (byte_range::as_bit_range): New.
7078 (byte_range::cmp): New.
7079 (concrete_binding::concrete_binding): Drop enum binding_kind.
7080 (concrete_binding::hash): Likewise.
7081 (concrete_binding::operator==): Likewise.
7082 (concrete_binding::mark_deleted): New.
7083 (concrete_binding::mark_empty): New.
7084 (concrete_binding::is_deleted): New.
7085 (concrete_binding::is_empty): New.
7086 (default_hash_traits<ana::concrete_binding>::empty_zero_p): Make false.
7087 (symbolic_binding::symbolic_binding): Drop enum binding_kind.
7088 (symbolic_binding::hash): Likewise.
7089 (symbolic_binding::operator==): Likewise.
7090 (symbolic_binding::mark_deleted): New.
7091 (symbolic_binding::mark_empty): New.
7092 (symbolic_binding::is_deleted): New.
7093 (symbolic_binding::is_empty): New.
7094 (binding_map::remove_overlapping_bindings): New decl.
7095 (binding_map::get_overlapping_bindings): New decl.
7096 (binding_cluster::validate): New decl.
7097 (binding_cluster::bind): Drop enum binding_kind.
7098 (binding_cluster::fill_region): New decl.
7099 (binding_cluster::get_binding): Drop enum binding_kind.
7100 (binding_cluster::get_binding_recursive): Likewise.
7101 (binding_cluster::get_overlapping_bindings): Delete.
7102 (store::validate): New decl.
7103 (store::set_value): Drop enum binding_kind.
7104 (store::fill_region): New decl.
7105 (store_manager::get_concrete_binding): Drop enum binding_kind.
7106 (store_manager::get_symbolic_binding): Likewise.
7107 * svalue.cc (svalue::cmp_ptr): Handle SK_REPEATED and
7108 SK_BITS_WITHIN.
7109 (svalue::extract_bit_range): New.
7110 (svalue::maybe_fold_bits_within): New.
7111 (constant_svalue::maybe_fold_bits_within): New.
7112 (unknown_svalue::maybe_fold_bits_within): New.
7113 (unaryop_svalue::maybe_fold_bits_within): New.
7114 (repeated_svalue::repeated_svalue): New.
7115 (repeated_svalue::dump_to_pp): New.
7116 (repeated_svalue::accept): New.
7117 (repeated_svalue::all_zeroes_p): New.
7118 (repeated_svalue::maybe_fold_bits_within): New.
7119 (bits_within_svalue::bits_within_svalue): New.
7120 (bits_within_svalue::dump_to_pp): New.
7121 (bits_within_svalue::maybe_fold_bits_within): New.
7122 (bits_within_svalue::accept): New.
7123 (bits_within_svalue::implicitly_live_p): New.
7124 (compound_svalue::maybe_fold_bits_within): New.
7125 * svalue.h (enum svalue_kind): Add SK_REPEATED and SK_BITS_WITHIN.
7126 (svalue::dyn_cast_repeated_svalue): New.
7127 (svalue::dyn_cast_bits_within_svalue): New.
7128 (svalue::extract_bit_range): New decl.
7129 (svalue::maybe_fold_bits_within): New vfunc decl.
7130 (region_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
7131 (region_svalue::key_t::is_empty): Likewise.
7132 (default_hash_traits<region_svalue::key_t>::empty_zero_p): Make false.
7133 (constant_svalue::maybe_fold_bits_within): New.
7134 (unknown_svalue::maybe_fold_bits_within): New.
7135 (poisoned_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
7136 (poisoned_svalue::key_t::is_empty): Likewise.
7137 (default_hash_traits<poisoned_svalue::key_t>::empty_zero_p): Make
7138 false.
7139 (setjmp_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
7140 (setjmp_svalue::key_t::is_empty): Likewise.
7141 (default_hash_traits<setjmp_svalue::key_t>::empty_zero_p): Make
7142 false.
7143 (unaryop_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
7144 (unaryop_svalue::key_t::is_empty): Likewise.
7145 (unaryop_svalue::maybe_fold_bits_within): New.
7146 (default_hash_traits<unaryop_svalue::key_t>::empty_zero_p): Make
7147 false.
7148 (binop_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
7149 (binop_svalue::key_t::is_empty): Likewise.
7150 (default_hash_traits<binop_svalue::key_t>::empty_zero_p): Make
7151 false.
7152 (sub_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
7153 (sub_svalue::key_t::is_empty): Likewise.
7154 (default_hash_traits<sub_svalue::key_t>::empty_zero_p): Make
7155 false.
7156 (class repeated_svalue): New.
7157 (is_a_helper <const repeated_svalue *>::test): New.
7158 (struct default_hash_traits<repeated_svalue::key_t>): New.
7159 (class bits_within_svalue): New.
7160 (is_a_helper <const bits_within_svalue *>::test): New.
7161 (struct default_hash_traits<bits_within_svalue::key_t>): New.
7162 (widening_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
7163 (widening_svalue::key_t::is_empty): Likewise.
7164 (default_hash_traits<widening_svalue::key_t>::empty_zero_p): Make
7165 false.
7166 (compound_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
7167 (compound_svalue::key_t::is_empty): Likewise.
7168 (compound_svalue::maybe_fold_bits_within): New.
7169 (default_hash_traits<compound_svalue::key_t>::empty_zero_p): Make
7170 false.
7172 2021-06-28 David Malcolm <dmalcolm@redhat.com>
7174 * analyzer.h (byte_offset_t): New typedef.
7175 * store.cc (bit_range::dump_to_pp): Dump as a byte range if
7176 possible.
7177 (bit_range::as_byte_range): New.
7178 (byte_range::dump_to_pp): New.
7179 * store.h (class byte_range): New forward decl.
7180 (struct bit_range): Add comment.
7181 (bit_range::as_byte_range): New decl.
7182 (struct byte_range): New.
7184 2021-06-22 David Malcolm <dmalcolm@redhat.com>
7186 PR analyzer/101143
7187 * region-model.cc (compat_types_p): New function.
7188 (region_model::create_region_for_heap_alloc): Convert assertion to
7189 an error check.
7190 (region_model::create_region_for_alloca): Likewise.
7192 2021-06-18 David Malcolm <dmalcolm@redhat.com>
7194 * store.cc (binding_cluster::get_any_binding): Make symbolic reads
7195 from a cluster with concrete bindings return unknown.
7197 2021-06-18 David Malcolm <dmalcolm@redhat.com>
7199 * region-model-manager.cc
7200 (region_model_manager::get_or_create_int_cst): New.
7201 (region_model_manager::maybe_undo_optimize_bit_field_compare): Use
7202 it to simplify away a local tree.
7203 * region-model.cc (region_model::on_setjmp): Likewise.
7204 (region_model::on_longjmp): Likewise.
7205 * region-model.h (region_model_manager::get_or_create_int_cst):
7206 New decl.
7207 * store.cc (binding_cluster::zero_fill_region): Use it to simplify
7208 away a local tree.
7210 2021-06-18 David Malcolm <dmalcolm@redhat.com>
7212 * checker-path.cc (class custom_event): Make abstract to allow for
7213 custom vfuncs, splitting existing implementation into...
7214 (class precanned_custom_event): New subclass.
7215 (custom_event::get_desc): Move to...
7216 (precanned_custom_event::get_desc): ...subclass.
7217 * checker-path.h (class custom_event): Make abstract to allow for
7218 custom vfuncs, splitting existing implementation into...
7219 (class precanned_custom_event): New subclass.
7220 * diagnostic-manager.cc (diagnostic_manager::add_events_for_eedge):
7221 Use precanned_custom_event.
7222 * engine.cc
7223 (stale_jmp_buf::maybe_add_custom_events_for_superedge): Likewise.
7224 * sm-signal.cc (signal_delivery_edge_info_t::add_events_to_path):
7225 Likewise.
7227 2021-06-15 David Malcolm <dmalcolm@redhat.com>
7229 PR analyzer/99212
7230 PR analyzer/101082
7231 * engine.cc: Include "target.h".
7232 (impl_run_checkers): Log BITS_BIG_ENDIAN, BYTES_BIG_ENDIAN, and
7233 WORDS_BIG_ENDIAN.
7234 * region-model-manager.cc
7235 (region_model_manager::maybe_fold_binop): Move support for masking
7236 via ARG0 & CST into...
7237 (region_model_manager::maybe_undo_optimize_bit_field_compare):
7238 ...this new function. Flatten by converting from nested
7239 conditionals to a series of early return statements to reject
7240 failures. Reject if type is not unsigned_char_type_node.
7241 Handle BYTES_BIG_ENDIAN when determining which bits are bound
7242 in the binding_map.
7243 * region-model.h
7244 (region_model_manager::maybe_undo_optimize_bit_field_compare):
7245 New decl.
7246 * store.cc (bit_range::dump): New function.
7247 * store.h (bit_range::dump): New decl.
7249 2021-06-15 David Malcolm <dmalcolm@redhat.com>
7251 * engine.cc (exploded_node::on_stmt): Handle __analyzer_dump_capacity.
7252 (exploded_node::on_stmt): Drop m_sm_changes from on_stmt_flags.
7253 (state_change_requires_new_enode_p): New function...
7254 (exploded_graph::process_node): Call it, rather than querying
7255 flags.m_sm_changes, so that dynamic-extent differences can also
7256 trigger the splitting of nodes.
7257 * exploded-graph.h (struct on_stmt_flags): Drop field m_sm_changes.
7258 * program-state.cc (program_state::detect_leaks): Purge dead
7259 heap-allocated regions from dynamic extents.
7260 (selftest::test_program_state_1): Fix type of "size_in_bytes".
7261 (selftest::test_program_state_merging): Likewise.
7262 * region-model-impl-calls.cc
7263 (region_model::impl_call_analyzer_dump_capacity): New.
7264 (region_model::impl_call_free): Remove dynamic extents from the
7265 freed region.
7266 * region-model-reachability.h
7267 (reachable_regions::begin_mutable_base_regs): New.
7268 (reachable_regions::end_mutable_base_regs): New.
7269 * region-model.cc: Include "tree-object-size.h".
7270 (region_model::region_model): Support new field m_dynamic_extents.
7271 (region_model::operator=): Likewise.
7272 (region_model::operator==): Likewise.
7273 (region_model::dump_to_pp): Dump sizes of dynamic regions.
7274 (region_model::handle_unrecognized_call): Purge dynamic extents
7275 from any regions that have escaped mutably:.
7276 (region_model::get_capacity): New function.
7277 (region_model::add_constraint): Unset dynamic extents when a
7278 heap-allocated region's address is NULL.
7279 (region_model::unbind_region_and_descendents): Purge dynamic
7280 extents of unbound regions.
7281 (region_model::can_merge_with_p): Call
7282 m_dynamic_extents.can_merge_with_p.
7283 (region_model::create_region_for_heap_alloc): Assert that
7284 size_in_bytes's type is compatible with size_type_node. Update
7285 for renaming of record_dynamic_extents to set_dynamic_extents.
7286 (region_model::create_region_for_alloca): Likewise.
7287 (region_model::record_dynamic_extents): Rename to...
7288 (region_model::set_dynamic_extents): ...this. Assert that
7289 size_in_bytes's type is compatible with size_type_node. Add it
7290 to the m_dynamic_extents map.
7291 (region_model::get_dynamic_extents): New.
7292 (region_model::unset_dynamic_extents): New.
7293 (selftest::test_state_merging): Fix type of "size".
7294 (selftest::test_malloc_constraints): Likewise.
7295 (selftest::test_malloc): Verify dynamic extents.
7296 (selftest::test_alloca): Likewise.
7297 * region-model.h (region_to_value_map::is_empty): New.
7298 (region_model::dynamic_extents_t): New typedef.
7299 (region_model::impl_call_analyzer_dump_capacity): New decl.
7300 (region_model::get_dynamic_extents): New function.
7301 (region_model::get_dynamic_extents): New decl.
7302 (region_model::set_dynamic_extents): New decl.
7303 (region_model::unset_dynamic_extents): New decl.
7304 (region_model::get_capacity): New decl.
7305 (region_model::record_dynamic_extents): Rename to set_dynamic_extents.
7306 (region_model::m_dynamic_extents): New field.
7308 2021-06-15 David Malcolm <dmalcolm@redhat.com>
7310 * region-model.cc (region_to_value_map::operator=): New.
7311 (region_to_value_map::operator==): New.
7312 (region_to_value_map::dump_to_pp): New.
7313 (region_to_value_map::dump): New.
7314 (region_to_value_map::can_merge_with_p): New.
7315 * region-model.h (class region_to_value_map): New class.
7317 2021-06-13 Trevor Saunders <tbsaunde@tbsaunde.org>
7319 * call-string.cc (call_string::call_string): Use range based for
7320 to iterate over vec<>.
7321 (call_string::to_json): Likewise.
7322 (call_string::hash): Likewise.
7323 (call_string::calc_recursion_depth): Likewise.
7324 * checker-path.cc (checker_path::fixup_locations): Likewise.
7325 * constraint-manager.cc (equiv_class::equiv_class): Likewise.
7326 (equiv_class::to_json): Likewise.
7327 (equiv_class::hash): Likewise.
7328 (constraint_manager::to_json): Likewise.
7329 * engine.cc (impl_region_model_context::on_svalue_leak):
7330 Likewise.
7331 (on_liveness_change): Likewise.
7332 (impl_region_model_context::on_unknown_change): Likewise.
7333 * program-state.cc (sm_state_map::set_state): Likewise.
7334 * region-model.cc (test_canonicalization_4): Likewise.
7336 2021-06-11 David Malcolm <dmalcolm@redhat.com>
7338 * engine.cc (worklist::key_t::cmp): Move sort by call_string to
7339 before SCC.
7341 2021-06-09 David Malcolm <dmalcolm@redhat.com>
7343 * region-model.cc (region_model::get_lvalue_1): Make const.
7344 (region_model::get_lvalue): Likewise.
7345 (region_model::get_rvalue_1): Likewise.
7346 (region_model::get_rvalue): Likewise.
7347 (region_model::deref_rvalue): Likewise.
7348 (region_model::get_rvalue_for_bits): Likewise.
7349 * region-model.h (region_model::get_lvalue): Likewise.
7350 (region_model::get_rvalue): Likewise.
7351 (region_model::deref_rvalue): Likewise.
7352 (region_model::get_rvalue_for_bits): Likewise.
7353 (region_model::get_lvalue_1): Likewise.
7354 (region_model::get_rvalue_1): Likewise.
7356 2021-06-08 David Malcolm <dmalcolm@redhat.com>
7358 PR analyzer/99212
7359 * region-model-manager.cc
7360 (region_model_manager::maybe_fold_binop): Add support for folding
7361 BIT_AND_EXPR of compound_svalue and a mask constant.
7362 * region-model.cc (region_model::get_rvalue_1): Implement
7363 BIT_FIELD_REF in terms of...
7364 (region_model::get_rvalue_for_bits): New function.
7365 * region-model.h (region_model::get_rvalue_for_bits): New decl.
7366 * store.cc (bit_range::from_mask): New function.
7367 (selftest::test_bit_range_intersects_p): New selftest.
7368 (selftest::assert_bit_range_from_mask_eq): New.
7369 (ASSERT_BIT_RANGE_FROM_MASK_EQ): New macro.
7370 (selftest::assert_no_bit_range_from_mask_eq): New.
7371 (ASSERT_NO_BIT_RANGE_FROM_MASK): New macro.
7372 (selftest::test_bit_range_from_mask): New selftest.
7373 (selftest::analyzer_store_cc_tests): Call the new selftests.
7374 * store.h (bit_range::intersects_p): New.
7375 (bit_range::from_mask): New decl.
7376 (concrete_binding::get_bit_range): New accessor.
7377 (store_manager::get_concrete_binding): New overload taking
7378 const bit_range &.
7380 2021-06-08 David Malcolm <dmalcolm@redhat.com>
7382 * analyzer.h (int_size_in_bits): New decl.
7383 * region.cc (int_size_in_bits): New function.
7384 (region::get_bit_size): Reimplement in terms of the above.
7386 2021-06-08 David Malcolm <dmalcolm@redhat.com>
7388 * store.cc (concrete_binding::dump_to_pp): Move bulk of
7389 implementation to...
7390 (bit_range::dump_to_pp): ...this new function.
7391 (bit_range::cmp): New.
7392 (concrete_binding::overlaps_p): Update for use of bit_range.
7393 (concrete_binding::cmp_ptr_ptr): Likewise.
7394 * store.h (struct bit_range): New.
7395 (class concrete_binding): Replace fields m_start_bit_offset and
7396 m_size_in_bits with new field m_bit_range.
7398 2021-06-08 David Malcolm <dmalcolm@redhat.com>
7400 * svalue.h (conjured_svalue::iterator_t): Delete.
7402 2021-06-03 David Malcolm <dmalcolm@redhat.com>
7404 * store.h (store::get_direct_binding): Remove unused decl.
7405 (store::get_default_binding): Likewise.
7407 2021-06-03 David Malcolm <dmalcolm@redhat.com>
7409 * svalue.cc (poisoned_svalue::dump_to_pp): Dump type.
7410 (compound_svalue::dump_to_pp): Dump any type.
7412 2021-05-18 David Malcolm <dmalcolm@redhat.com>
7414 PR analyzer/100615
7415 * sm-malloc.cc: Include "analyzer/function-set.h".
7416 (malloc_state_machine::on_stmt): Call unaffected_by_call_p and
7417 bail on the functions it recognizes.
7418 (malloc_state_machine::unaffected_by_call_p): New.
7420 2021-05-10 Martin Liska <mliska@suse.cz>
7422 * sm-file.cc (is_file_using_fn_p): Use startswith
7423 function instead of strncmp.
7425 2021-05-10 Martin Liska <mliska@suse.cz>
7427 * program-state.cc (program_state::operator=): Remove
7428 __cplusplus >= 201103.
7429 (program_state::program_state): Likewise.
7430 * program-state.h: Likewise.
7431 * region-model.h (class region_model): Remove dead code.
7433 2021-04-24 David Malcolm <dmalcolm@redhat.com>
7435 PR analyzer/100244
7436 * sm-malloc.cc (free_of_non_heap::describe_state_change):
7437 Bulletproof against change.m_expr being NULL.
7439 2021-04-13 David Malcolm <dmalcolm@redhat.com>
7441 PR analyzer/98599
7442 * supergraph.cc (saved_uids::make_uid_unique): New.
7443 (saved_uids::restore_uids): New.
7444 (supergraph::supergraph): Replace assignments to stmt->uid with
7445 calls to m_stmt_uids.make_uid_unique.
7446 (supergraph::~supergraph): New.
7447 * supergraph.h (class saved_uids): New.
7448 (supergraph::~supergraph): New decl.
7449 (supergraph::m_stmt_uids): New field.
7451 2021-04-10 David Malcolm <dmalcolm@redhat.com>
7453 PR analyzer/100011
7454 * region-model.cc (region_model::on_assignment): Avoid NULL
7455 dereference if ctxt is NULL when assigning from a STRING_CST.
7457 2021-04-08 David Malcolm <dmalcolm@redhat.com>
7459 PR analyzer/99042
7460 PR analyzer/99774
7461 * engine.cc
7462 (impl_region_model_context::impl_region_model_context): Add
7463 uncertainty param and use it to initialize m_uncertainty.
7464 (impl_region_model_context::get_uncertainty): New.
7465 (impl_sm_context::get_fndecl_for_call): Add NULL for new
7466 uncertainty param when constructing impl_region_model_context.
7467 (impl_sm_context::get_state): Likewise.
7468 (impl_sm_context::set_next_state): Likewise.
7469 (impl_sm_context::warn): Likewise.
7470 (exploded_node::on_stmt): Add uncertainty param
7471 and use it when constructing impl_region_model_context.
7472 (exploded_node::on_edge): Add uncertainty param and pass
7473 to on_edge call.
7474 (exploded_node::detect_leaks): Create uncertainty_t and pass to
7475 impl_region_model_context.
7476 (exploded_graph::get_or_create_node): Create uncertainty_t and
7477 pass to prune_for_point.
7478 (maybe_process_run_of_before_supernode_enodes): Create
7479 uncertainty_t and pass to impl_region_model_context.
7480 (exploded_graph::process_node): Create uncertainty_t instances and
7481 pass around as needed.
7482 * exploded-graph.h
7483 (impl_region_model_context::impl_region_model_context): Add
7484 uncertainty param.
7485 (impl_region_model_context::get_uncertainty): New decl.
7486 (impl_region_model_context::m_uncertainty): New field.
7487 (exploded_node::on_stmt): Add uncertainty param.
7488 (exploded_node::on_edge): Likewise.
7489 * program-state.cc (sm_state_map::on_liveness_change): Get
7490 uncertainty from context and use it to unset sm-state from
7491 svalues as appropriate.
7492 (program_state::on_edge): Add uncertainty param and use it when
7493 constructing impl_region_model_context. Fix indentation.
7494 (program_state::prune_for_point): Add uncertainty param and use it
7495 when constructing impl_region_model_context.
7496 (program_state::detect_leaks): Get any uncertainty from ctxt and
7497 use it to get maybe-live svalues for dest_state, rather than
7498 definitely-live ones; use this when determining which svalues
7499 have leaked.
7500 (selftest::test_program_state_merging): Create uncertainty_t and
7501 pass to impl_region_model_context.
7502 * program-state.h (program_state::on_edge): Add uncertainty param.
7503 (program_state::prune_for_point): Likewise.
7504 * region-model-impl-calls.cc (call_details::get_uncertainty): New.
7505 (region_model::impl_call_memcpy): Pass uncertainty to
7506 mark_region_as_unknown call.
7507 (region_model::impl_call_memset): Likewise.
7508 (region_model::impl_call_strcpy): Likewise.
7509 * region-model-reachability.cc (reachable_regions::handle_sval):
7510 Also add sval to m_mutable_svals.
7511 * region-model.cc (region_model::on_assignment): Pass any
7512 uncertainty from ctxt to the store::set_value call.
7513 (region_model::handle_unrecognized_call): Get any uncertainty from
7514 ctxt and use it to record mutable svalues at the unknown call.
7515 (region_model::get_reachable_svalues): Add uncertainty param and
7516 use it to mark any maybe-bound svalues as being reachable.
7517 (region_model::set_value): Pass any uncertainty from ctxt to the
7518 store::set_value call.
7519 (region_model::mark_region_as_unknown): Add uncertainty param and
7520 pass it on to the store::mark_region_as_unknown call.
7521 (region_model::update_for_call_summary): Add uncertainty param and
7522 pass it on to the region_model::mark_region_as_unknown call.
7523 * region-model.h (call_details::get_uncertainty): New decl.
7524 (region_model::get_reachable_svalues): Add uncertainty param.
7525 (region_model::mark_region_as_unknown): Add uncertainty param.
7526 (region_model_context::get_uncertainty): New vfunc.
7527 (noop_region_model_context::get_uncertainty): New vfunc
7528 implementation.
7529 * store.cc (dump_svalue_set): New.
7530 (uncertainty_t::dump_to_pp): New.
7531 (uncertainty_t::dump): New.
7532 (binding_cluster::clobber_region): Pass NULL for uncertainty to
7533 remove_overlapping_bindings.
7534 (binding_cluster::mark_region_as_unknown): Add uncertainty param
7535 and pass it to remove_overlapping_bindings.
7536 (binding_cluster::remove_overlapping_bindings): Add uncertainty param.
7537 Use it to record any svalues that were in clobbered bindings.
7538 (store::set_value): Add uncertainty param. Pass it to
7539 binding_cluster::mark_region_as_unknown when handling symbolic
7540 regions.
7541 (store::mark_region_as_unknown): Add uncertainty param and pass it
7542 to binding_cluster::mark_region_as_unknown.
7543 (store::remove_overlapping_bindings): Add uncertainty param and
7544 pass it to binding_cluster::remove_overlapping_bindings.
7545 * store.h (binding_cluster::mark_region_as_unknown): Add
7546 uncertainty param.
7547 (binding_cluster::remove_overlapping_bindings): Likewise.
7548 (store::set_value): Likewise.
7549 (store::mark_region_as_unknown): Likewise.
7551 2021-04-05 David Malcolm <dmalcolm@redhat.com>
7553 PR analyzer/99906
7554 * analyzer.cc (maybe_reconstruct_from_def_stmt): Fix NULL
7555 dereference on calls with zero arguments.
7556 * sm-malloc.cc (malloc_state_machine::on_stmt): When handling
7557 __attribute__((nonnull)), only call get_diagnostic_tree if the
7558 result will be used.
7560 2021-04-05 David Malcolm <dmalcolm@redhat.com>
7562 PR analyzer/99886
7563 * diagnostic-manager.cc
7564 (diagnostic_manager::prune_interproc_events): Use signed integers
7565 when subtracting one from path->num_events ().
7566 (diagnostic_manager::consolidate_conditions): Likewise. Convert
7567 next_idx to a signed int.
7569 2021-04-01 David Malcolm <dmalcolm@redhat.com>
7571 * diagnostic-manager.cc (diagnostic_manager::add_diagnostic): Make
7572 enode param non-constant, and call add_diagnostic on it. Add
7573 enode index to log message.
7574 (diagnostic_manager::add_diagnostic): Make enode param
7575 non-constant.
7576 * diagnostic-manager.h (diagnostic_manager::add_diagnostic):
7577 Likewise for both decls.
7578 * engine.cc
7579 (impl_region_model_context::impl_region_model_context): Likewise
7580 for enode_for_diag.
7581 (impl_sm_context::impl_sm_context): Likewise.
7582 (impl_sm_context::m_enode_for_diag): Likewise.
7583 (exploded_node::dump_dot): Don't pass the diagnostic manager
7584 to dump_saved_diagnostics.
7585 (exploded_node::dump_saved_diagnostics): Drop param. Iterate
7586 directly through all saved diagnostics for the enode, rather
7587 than all saved diagnostics in the diagnostic_manager and
7588 filtering.
7589 (exploded_node::on_stmt): Make non-const.
7590 (exploded_node::on_edge): Likewise.
7591 (exploded_node::on_longjmp): Likewise.
7592 (exploded_node::detect_leaks): Likewise.
7593 (exploded_graph::get_or_create_node): Make enode_for_diag param
7594 non-const.
7595 (exploded_graph_annotator::print_enode): Iterate
7596 directly through all saved diagnostics for the enode, rather
7597 than all saved diagnostics in the diagnostic_manager and
7598 filtering.
7599 * exploded-graph.h
7600 (impl_region_model_context::impl_region_model_context): Make
7601 enode_for_diag param non-constant.
7602 (impl_region_model_context::m_enode_for_diag): Likewise.
7603 (exploded_node::dump_saved_diagnostics): Drop param.
7604 (exploded_node::on_stmt): Make non-const.
7605 (exploded_node::on_edge): Likewise.
7606 (exploded_node::on_longjmp): Likewise.
7607 (exploded_node::detect_leaks): Likewise.
7608 (exploded_node::add_diagnostic): New.
7609 (exploded_node::get_num_diagnostics): New.
7610 (exploded_node::get_saved_diagnostic): New.
7611 (exploded_node::m_saved_diagnostics): New.
7612 (exploded_graph::get_or_create_node): Make enode_for_diag param
7613 non-constant.
7614 * feasible-graph.cc (feasible_node::dump_dot): Drop
7615 diagnostic_manager from call to dump_saved_diagnostics.
7616 * program-state.cc (program_state::on_edge): Convert enode param
7617 to non-const pointer.
7618 (program_state::prune_for_point): Likewise for enode_for_diag
7619 param.
7620 * program-state.h (program_state::on_edge): Convert enode param
7621 to non-const pointer.
7622 (program_state::prune_for_point): Likewise for enode_for_diag
7623 param.
7625 2021-03-31 David Malcolm <dmalcolm@redhat.com>
7627 PR analyzer/99771
7628 * analyzer.cc (maybe_reconstruct_from_def_stmt): New.
7629 (fixup_tree_for_diagnostic_1): New.
7630 (fixup_tree_for_diagnostic): New.
7631 * analyzer.h (fixup_tree_for_diagnostic): New decl.
7632 * checker-path.cc (call_event::get_desc): Call
7633 fixup_tree_for_diagnostic and use it for the call_with_state call.
7634 (warning_event::get_desc): Likewise for the final_event and
7635 make_label_text calls.
7636 * engine.cc (impl_region_model_context::on_state_leak): Likewise
7637 for the on_leak and add_diagnostic calls.
7638 * region-model.cc (region_model::get_representative_tree):
7639 Likewise for the result.
7641 2021-03-30 David Malcolm <dmalcolm@redhat.com>
7643 * region.h (region::dump_to_pp): Remove old decl.
7645 2021-03-30 David Malcolm <dmalcolm@redhat.com>
7647 * sm-file.cc (fileptr_state_machine::on_stmt): Only call
7648 get_diagnostic_tree if the result will be used.
7649 * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise.
7650 (malloc_state_machine::on_deallocator_call): Likewise.
7651 (malloc_state_machine::on_realloc_call): Likewise.
7652 (malloc_state_machine::on_realloc_call): Likewise.
7653 * sm-sensitive.cc
7654 (sensitive_state_machine::warn_for_any_exposure): Likewise.
7655 * sm-taint.cc (taint_state_machine::on_stmt): Likewise.
7657 2021-03-25 David Malcolm <dmalcolm@redhat.com>
7659 PR analyzer/93695
7660 PR analyzer/99044
7661 PR analyzer/99716
7662 * engine.cc (exploded_node::on_stmt): Clear sm-state involving
7663 an SSA name at the def-stmt of that SSA name.
7664 * program-state.cc (sm_state_map::purge_state_involving): New.
7665 * program-state.h (sm_state_map::purge_state_involving): New decl.
7666 * region-model.cc (selftest::test_involves_p): New.
7667 (selftest::analyzer_region_model_cc_tests): Call it.
7668 * svalue.cc (class involvement_visitor): New class
7669 (svalue::involves_p): New.
7670 * svalue.h (svalue::involves_p): New decl.
7672 2021-03-19 David Malcolm <dmalcolm@redhat.com>
7674 PR analyzer/99614
7675 * diagnostic-manager.cc (class epath_finder): Add
7676 DISABLE_COPY_AND_ASSIGN.
7678 2021-03-15 Martin Liska <mliska@suse.cz>
7680 * sm-file.cc (get_file_using_fns): Add missing comma in initializer.
7682 2021-03-11 David Malcolm <dmalcolm@redhat.com>
7684 PR analyzer/96374
7685 * analyzer.opt (-param=analyzer-max-infeasible-edges=): New param.
7686 (fdump-analyzer-feasibility): New flag.
7687 * diagnostic-manager.cc: Include "analyzer/trimmed-graph.h" and
7688 "analyzer/feasible-graph.h".
7689 (epath_finder::epath_finder): Convert m_sep to a pointer and
7690 only create it if !flag_analyzer_feasibility.
7691 (epath_finder::~epath_finder): New.
7692 (epath_finder::m_sep): Convert to a pointer.
7693 (epath_finder::get_best_epath): Add param "diag_idx" and use it
7694 when logging. Rather than finding the shortest path and then
7695 checking feasibility, instead use explore_feasible_paths unless
7696 !flag_analyzer_feasibility, in which case simply use the shortest
7697 path, and note if it is infeasible. Update for m_sep becoming a
7698 pointer.
7699 (class feasible_worklist): New.
7700 (epath_finder::explore_feasible_paths): New.
7701 (epath_finder::process_worklist_item): New.
7702 (class dump_eg_with_shortest_path): New.
7703 (epath_finder::dump_trimmed_graph): New.
7704 (epath_finder::dump_feasible_graph): New.
7705 (saved_diagnostic::saved_diagnostic): Add "idx" param, using it
7706 on new field m_idx.
7707 (saved_diagnostic::to_json): Dump m_idx.
7708 (saved_diagnostic::calc_best_epath): Pass m_idx to get_best_epath.
7709 Remove assertion that m_problem was set when m_best_epath is NULL.
7710 (diagnostic_manager::add_diagnostic): Pass an index when created
7711 saved_diagnostic instances.
7712 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Add
7713 "idx" param.
7714 (saved_diagnostic::get_index): New accessor.
7715 (saved_diagnostic::m_idx): New field.
7716 * engine.cc (exploded_node::dump_dot): Call args.dump_extra_info.
7717 Move code to...
7718 (exploded_node::dump_processed_stmts): ...this new function and...
7719 (exploded_node::dump_saved_diagnostics): ...this new function.
7720 Add index of each diagnostic.
7721 (exploded_edge::dump_dot): Move bulk of code to...
7722 (exploded_edge::dump_dot_label): ...this new function.
7723 * exploded-graph.h (eg_traits::dump_args_t::dump_extra_info): New
7724 vfunc.
7725 (exploded_node::dump_processed_stmts): New decl.
7726 (exploded_node::dump_saved_diagnostics): New decl.
7727 (exploded_edge::dump_dot_label): New decl.
7728 * feasible-graph.cc: New file.
7729 * feasible-graph.h: New file.
7730 * trimmed-graph.cc: New file.
7731 * trimmed-graph.h: New file.
7733 2021-03-11 David Malcolm <dmalcolm@redhat.com>
7735 * diagnostic-manager.cc (epath_finder::epath_finder):
7736 Update shortest_paths init for new param.
7738 2021-03-10 David Malcolm <dmalcolm@redhat.com>
7740 PR analyzer/96374
7741 * engine.cc (exploded_path::feasible_p): Move "snodes_visited" and
7742 "model" locals into a new class feasibility_state. Move heart
7743 of per-edge processing into
7744 feasibility_state::maybe_update_for_edge.
7745 (feasibility_state::feasibility_state): New.
7746 (feasibility_state::maybe_update_for_edge): New, based on loop
7747 body in exploded_path::feasible_p.
7748 * exploded-graph.h (class feasibility_state): New.
7750 2021-03-10 David Malcolm <dmalcolm@redhat.com>
7752 * supergraph.h
7753 (callgraph_superedge::dyn_cast_callgraph_superedge): New.
7754 (call_superedge::dyn_cast_callgraph_superedge): Delete.
7755 (return_superedge::dyn_cast_callgraph_superedge): Delete.
7757 2021-03-02 Martin Liska <mliska@suse.cz>
7759 * diagnostic-manager.cc (diagnostic_manager::emit_saved_diagnostics):
7760 Do not pass engine.
7762 2021-02-26 David Malcolm <dmalcolm@redhat.com>
7764 * engine.cc (exploded_path::exploded_path): New copy-ctor.
7765 * exploded-graph.h (exploded_path::operator=): Drop decl.
7767 2021-02-26 David Malcolm <dmalcolm@redhat.com>
7769 PR analyzer/96374
7770 * diagnostic-manager.cc (class epath_finder): New.
7771 (epath_finder::get_best_epath): New.
7772 (saved_diagnostic::saved_diagnostic): Update for replacement of
7773 m_state and m_epath_length with m_best_epath.
7774 (saved_diagnostic::~saved_diagnostic): Delete m_best_epath.
7775 (saved_diagnostic::to_json): Update "path_length" to be optional.
7776 (saved_diagnostic::calc_best_epath): New, based on
7777 dedupe_winners::add and parts of dedupe_key::dedupe_key.
7778 (saved_diagnostic::get_epath_length): New.
7779 (saved_diagnostic::add_duplicate): New.
7780 (dedupe_key::dedupe_key): Drop epath param. Move invocation of
7781 stmt_finder to saved_diagnostic::calc_best_epath.
7782 (class dedupe_candidate): Delete.
7783 (class dedupe_hash_map_traits): Update to use saved_diagnotic *
7784 rather than dedupe_candidate * as the value_type/compare_type.
7785 (dedupe_winners::~dedupe_winners): Don't delete the values.
7786 (dedupe_winners::add): Convert param from shortest_exploded_paths to
7787 epath_finder. Drop "eg" param. Drop dedupe_candidate, moving
7788 path generation and feasiblity checking to
7789 epath_finder::get_best_epath. Update winner-selection for move
7790 of epaths from dedupe_candidate to saved_diagnostic.
7791 (dedupe_winners::emit_best): Update for removal of class
7792 dedupe_candidate.
7793 (dedupe_winners::map_t): Update to use saved_diagnotic * rather
7794 than dedupe_candidate * as the value_type/compare_type.
7795 (diagnostic_manager::emit_saved_diagnostics): Move
7796 shortest_exploded_paths instance into epath_finder and pass that
7797 around instead.
7798 (diagnostic_manager::emit_saved_diagnostic): Drop epath, stmt
7799 and num_dupes params, instead getting these from the
7800 saved_diagnostic. Use correct location in inform_n call.
7801 * diagnostic-manager.h (class epath_finder): New forward decl.
7802 (saved_diagnostic::status): Drop enum.
7803 (saved_diagnostic::set_feasible): Drop.
7804 (saved_diagnostic::set_infeasible): Drop.
7805 (saved_diagnostic::get_status): Drop.
7806 (saved_diagnostic::calc_best_epath): New decl.
7807 (saved_diagnostic::get_best_epath): New decl.
7808 (saved_diagnostic::get_epath_length): New decl.
7809 (saved_diagnostic::set_epath_length): Drop.
7810 (saved_diagnostic::get_epath_length): Drop inline implementation.
7811 (saved_diagnostic::add_duplicate): New.
7812 (saved_diagnostic::get_num_dupes): New.
7813 (saved_diagnostic::m_d): Document ownership.
7814 (saved_diagnostic::m_trailing_eedge): Make const.
7815 (saved_diagnostic::m_status): Drop field.
7816 (saved_diagnostic::m_epath_length): Drop field.
7817 (saved_diagnostic::m_best_epath): New field.
7818 (saved_diagnostic::m_problem): Document ownership.
7819 (saved_diagnostic::m_duplicates): New field.
7820 (diagnostic_manager::emit_saved_diagnostic): Drop params epath,
7821 stmt, and num_dupes.
7822 * engine.cc (exploded_graph_annotator::print_saved_diagnostic):
7823 Update for changes to saved_diagnostic class.
7824 * exploded-graph.h (exploded_path::feasible_p): Drop unused
7825 overloaded decl.
7827 2021-02-25 David Malcolm <dmalcolm@redhat.com>
7829 PR analyzer/99193
7830 * region-model-impl-calls.cc (region_model::impl_call_realloc): New.
7831 * region-model.cc (region_model::on_call_pre): Call it.
7832 * region-model.h (region_model::impl_call_realloc): New decl.
7833 * sm-malloc.cc (enum wording): Add WORDING_REALLOCATED.
7834 (malloc_state_machine::m_realloc): New field.
7835 (use_after_free::describe_state_change): Add case for
7836 WORDING_REALLOCATED.
7837 (use_after_free::describe_final_event): Likewise.
7838 (malloc_state_machine::malloc_state_machine): Initialize
7839 m_realloc.
7840 (malloc_state_machine::on_stmt): Handle realloc by calling...
7841 (malloc_state_machine::on_realloc_call): New.
7843 2021-02-22 David Malcolm <dmalcolm@redhat.com>
7845 PR analyzer/99196
7846 * engine.cc (exploded_node::on_stmt): Provide terminate_path
7847 flag as a way for on_call_pre to terminate the current analysis
7848 path.
7849 * region-model-impl-calls.cc (call_details::num_args): New.
7850 (region_model::impl_call_error): New.
7851 * region-model.cc (region_model::on_call_pre): Add param
7852 "out_terminate_path". Handle "error" and "error_at_line".
7853 * region-model.h (call_details::num_args): New decl.
7854 (region_model::on_call_pre): Add param "out_terminate_path".
7855 (region_model::impl_call_error): New decl.
7857 2021-02-17 David Malcolm <dmalcolm@redhat.com>
7859 PR analyzer/98969
7860 * constraint-manager.cc (dead_svalue_purger::should_purge_p):
7861 Update for change to svalue::live_p.
7862 * program-state.cc (sm_state_map::on_liveness_change): Likewise.
7863 (program_state::detect_leaks): Likewise.
7864 * region-model-reachability.cc (reachable_regions::init_cluster):
7865 When dealing with a symbolic region, if the underlying pointer is
7866 implicitly live, add the region to the reachable regions.
7867 * region-model.cc (region_model::compare_initial_and_pointer):
7868 Move logic for detecting initial values of params to
7869 initial_svalue::initial_value_of_param_p.
7870 * svalue.cc (svalue::live_p): Convert "live_svalues" from a
7871 reference to a pointer; support it being NULL.
7872 (svalue::implicitly_live_p): Convert first param from a
7873 refererence to a pointer.
7874 (region_svalue::implicitly_live_p): Likewise.
7875 (constant_svalue::implicitly_live_p): Likewise.
7876 (initial_svalue::implicitly_live_p): Likewise. Treat the initial
7877 values of params for the top level frame as still live.
7878 (initial_svalue::initial_value_of_param_p): New function, taken
7879 from a test in region_model::compare_initial_and_pointer.
7880 (unaryop_svalue::implicitly_live_p): Convert first param from a
7881 refererence to a pointer.
7882 (binop_svalue::implicitly_live_p): Likewise.
7883 (sub_svalue::implicitly_live_p): Likewise.
7884 (unmergeable_svalue::implicitly_live_p): Likewise.
7885 * svalue.h (svalue::live_p): Likewise.
7886 (svalue::implicitly_live_p): Likewise.
7887 (region_svalue::implicitly_live_p): Likewise.
7888 (constant_svalue::implicitly_live_p): Likewise.
7889 (initial_svalue::implicitly_live_p): Likewise.
7890 (initial_svalue::initial_value_of_param_p): New decl.
7891 (unaryop_svalue::implicitly_live_p): Convert first param from a
7892 refererence to a pointer.
7893 (binop_svalue::implicitly_live_p): Likewise.
7894 (sub_svalue::implicitly_live_p): Likewise.
7895 (unmergeable_svalue::implicitly_live_p): Likewise.
7897 2021-02-12 David Malcolm <dmalcolm@redhat.com>
7899 PR analyzer/98969
7900 * engine.cc (readability): Add names for the various arbitrary
7901 values. Handle NOP_EXPR and INTEGER_CST.
7902 (readability_comparator): Combine the readability tests for
7903 tree and stack depth, rather than performing them sequentially.
7904 (impl_region_model_context::on_state_leak): Strip off top-level
7905 casts.
7906 * region-model.cc (region_model::get_representative_path_var): Add
7907 type-checking, moving the bulk of the implementation to...
7908 (region_model::get_representative_path_var_1): ...here. Respect
7909 types in casts by recursing and re-adding the cast, rather than
7910 merely stripping them off. Use the correct type when handling
7911 region_svalue.
7912 (region_model::get_representative_tree): Strip off any top-level
7913 cast.
7914 (region_model::get_representative_path_var): Add type-checking,
7915 moving the bulk of the implementation to...
7916 (region_model::get_representative_path_var_1): ...here.
7917 * region-model.h (region_model::get_representative_path_var_1):
7918 New decl
7919 (region_model::get_representative_path_var_1): New decl.
7920 * store.cc (append_pathvar_with_type): New.
7921 (binding_cluster::get_representative_path_vars): Cast path_vars
7922 to the correct type when adding them to *OUT_PVS.
7924 2021-02-09 David Malcolm <dmalcolm@redhat.com>
7926 PR analyzer/98575
7927 * sm-file.cc (is_file_using_fn_p): Support "_IO_"-prefixed
7928 variants.
7930 2021-02-09 David Malcolm <dmalcolm@redhat.com>
7932 PR analyzer/98575
7933 * store.cc (store::set_value): Treat a pointer written to *UNKNOWN
7934 as having escaped.
7936 2021-02-02 David Malcolm <dmalcolm@redhat.com>
7938 PR analyzer/93355
7939 PR analyzer/96374
7940 * engine.cc (toplevel_function_p): Simplify so that
7941 we only reject functions with a "__analyzer_" prefix.
7942 (add_any_callbacks): Delete.
7943 (exploded_graph::build_initial_worklist): Update for
7944 dropped param of toplevel_function_p.
7945 (exploded_graph::build_initial_worklist): Don't bother
7946 looking for callbacks that are reachable from global
7947 initializers.
7949 2021-02-01 David Malcolm <dmalcolm@redhat.com>
7951 PR analyzer/98918
7952 * region-model-manager.cc
7953 (region_model_manager::get_or_create_initial_value):
7954 Fold the initial value of *UNKNOWN_PTR to an UNKNOWN value.
7955 (region_model_manager::get_field_region): Fold the value
7956 of UNKNOWN_PTR->FIELD to *UNKNOWN_PTR_OF_&FIELD_TYPE.
7958 2021-01-29 David Malcolm <dmalcolm@redhat.com>
7960 * checker-path.cc (event_kind_to_string): Handle
7961 EK_START_CONSOLIDATED_CFG_EDGES and
7962 EK_END_CONSOLIDATED_CFG_EDGES.
7963 (start_consolidated_cfg_edges_event::get_desc): New.
7964 (checker_path::cfg_edge_pair_at_p): New.
7965 * checker-path.h (enum event_kind): Add
7966 EK_START_CONSOLIDATED_CFG_EDGES and
7967 EK_END_CONSOLIDATED_CFG_EDGES.
7968 (class start_consolidated_cfg_edges_event): New class.
7969 (class end_consolidated_cfg_edges_event): New class.
7970 (checker_path::delete_events): New.
7971 (checker_path::replace_event): New.
7972 (checker_path::cfg_edge_pair_at_p): New decl.
7973 * diagnostic-manager.cc (diagnostic_manager::prune_path): Call
7974 consolidate_conditions.
7975 (same_line_as_p): New.
7976 (diagnostic_manager::consolidate_conditions): New.
7977 * diagnostic-manager.h
7978 (diagnostic_manager::consolidate_conditions): New decl.
7980 2021-01-18 David Malcolm <dmalcolm@redhat.com>
7982 * analyzer.h (is_std_named_call_p): New decl.
7983 * diagnostic-manager.cc (path_builder::get_sm): New.
7984 (state_change_event_creator::state_change_event_creator): Add "pb"
7985 param.
7986 (state_change_event_creator::on_global_state_change): Don't consider
7987 state changes affecting other state_machines.
7988 (state_change_event_creator::on_state_change): Likewise.
7989 (state_change_event_creator::m_pb): New field.
7990 (diagnostic_manager::add_events_for_eedge): Pass pb to visitor
7991 ctor.
7992 * region-model-impl-calls.cc
7993 (region_model::impl_deallocation_call): New.
7994 * region-model.cc: Include "attribs.h".
7995 (region_model::on_call_post): Handle fndecls referenced by
7996 __attribute__((deallocated_by(FOO))).
7997 * region-model.h (region_model::impl_deallocation_call): New decl.
7998 * sm-malloc.cc: Include "stringpool.h" and "attribs.h". Add
7999 leading comment.
8000 (class api): Delete.
8001 (enum resource_state): Update comment for change from api to
8002 deallocator and deallocator_set.
8003 (allocation_state::allocation_state): Drop api param. Add
8004 "deallocators" and "deallocator".
8005 (allocation_state::m_api): Drop field in favor of...
8006 (allocation_state::m_deallocators): New field.
8007 (allocation_state::m_deallocator): New field.
8008 (enum wording): Add WORDING_DEALLOCATED.
8009 (struct deallocator): New.
8010 (struct standard_deallocator): New.
8011 (struct custom_deallocator): New.
8012 (struct deallocator_set): New.
8013 (struct custom_deallocator_set): New.
8014 (struct standard_deallocator_set): New.
8015 (struct deallocator_set_map_traits): New.
8016 (malloc_state_machine::m_malloc): Drop field
8017 (malloc_state_machine::m_scalar_new): Likewise.
8018 (malloc_state_machine::m_vector_new): Likewise.
8019 (malloc_state_machine::m_free): New field
8020 (malloc_state_machine::m_scalar_delete): Likewise.
8021 (malloc_state_machine::m_vector_delete): Likewise.
8022 (malloc_state_machine::deallocator_map_t): New typedef.
8023 (malloc_state_machine::m_deallocator_map): New field.
8024 (malloc_state_machine::deallocator_set_cache_t): New typedef.
8025 (malloc_state_machine::m_custom_deallocator_set_cache): New field.
8026 (malloc_state_machine::custom_deallocator_set_map_t): New typedef.
8027 (malloc_state_machine::m_custom_deallocator_set_map): New field.
8028 (malloc_state_machine::m_dynamic_sets): New field.
8029 (malloc_state_machine::m_dynamic_deallocators): New field.
8030 (api::api): Delete.
8031 (deallocator::deallocator): New ctor.
8032 (deallocator::hash): New.
8033 (deallocator::dump_to_pp): New.
8034 (deallocator::cmp): New.
8035 (deallocator::cmp_ptr_ptr): New.
8036 (standard_deallocator::standard_deallocator): New ctor.
8037 (deallocator_set::deallocator_set): New ctor.
8038 (deallocator_set::dump): New.
8039 (custom_deallocator_set::custom_deallocator_set): New ctor.
8040 (custom_deallocator_set::contains_p): New.
8041 (custom_deallocator_set::maybe_get_single): New.
8042 (custom_deallocator_set::dump_to_pp): New.
8043 (standard_deallocator_set::standard_deallocator_set): New ctor.
8044 (standard_deallocator_set::contains_p): New.
8045 (standard_deallocator_set::maybe_get_single): New.
8046 (standard_deallocator_set::dump_to_pp): New.
8047 (start_p): New.
8048 (class mismatching_deallocation): Update for conversion from api
8049 to deallocator_set and deallocator.
8050 (double_free::emit): Use %qs.
8051 (class use_after_free): Update for conversion from api to
8052 deallocator_set and deallocator.
8053 (malloc_leak::describe_state_change): Only emit "allocated here" on
8054 a start->nonnull transition, rather than on other transitions to
8055 nonnull.
8056 (allocation_state::dump_to_pp): Update for conversion from api to
8057 deallocator_set.
8058 (allocation_state::get_nonnull): Likewise.
8059 (malloc_state_machine::malloc_state_machine): Likewise.
8060 (malloc_state_machine::~malloc_state_machine): New.
8061 (malloc_state_machine::add_state): Update for conversion from api
8062 to deallocator_set.
8063 (malloc_state_machine::get_or_create_custom_deallocator_set): New.
8064 (malloc_state_machine::maybe_create_custom_deallocator_set): New.
8065 (malloc_state_machine::get_or_create_deallocator): New.
8066 (malloc_state_machine::on_stmt): Update for conversion from api
8067 to deallocator_set. Handle "__attribute__((malloc(FOO)))", and
8068 the special attribute set on FOO.
8069 (malloc_state_machine::on_allocator_call): Update for conversion
8070 from api to deallocator_set. Add "returns_nonnull" param and use
8071 it to affect which state to transition to.
8072 (malloc_state_machine::on_deallocator_call): Update for conversion
8073 from api to deallocator_set.
8075 2021-01-14 David Malcolm <dmalcolm@redhat.com>
8077 * engine.cc (strongly_connected_components::to_json): New.
8078 (worklist::to_json): New.
8079 (exploded_graph::to_json): JSON-ify the worklist.
8080 * exploded-graph.h (strongly_connected_components::to_json): New
8081 decl.
8082 (worklist::to_json): New decl.
8083 * store.cc (store::to_json): Fix comment.
8084 * supergraph.cc (supernode::to_json): Fix reference to
8085 "returning_call" in comment. Add optional "fun" to JSON.
8086 (edge_kind_to_string): New.
8087 (superedge::to_json): Add "kind" to JSON.
8089 2021-01-14 David Malcolm <dmalcolm@redhat.com>
8091 PR analyzer/98679
8092 * analyzer.h (region_offset::operator==): Make const.
8093 * pending-diagnostic.h (pending_diagnostic::equal_p): Likewise.
8094 * store.h (binding_cluster::for_each_value): Likewise.
8095 (binding_cluster::for_each_binding): Likewise.
8097 2021-01-12 David Malcolm <dmalcolm@redhat.com>
8099 PR analyzer/98628
8100 * store.cc (binding_cluster::make_unknown_relative_to): Don't mark
8101 dereferenced unknown pointers as having escaped.
8103 2021-01-07 David Malcolm <dmalcolm@redhat.com>
8105 PR analyzer/98580
8106 * region.cc (decl_region::get_svalue_for_initializer): Gracefully
8107 handle when LTO writes out DECL_INITIAL as error_mark_node.
8109 2021-01-07 David Malcolm <dmalcolm@redhat.com>
8111 PR analyzer/97074
8112 * store.cc (binding_cluster::can_merge_p): Add "out_store" param
8113 and pass to calls to binding_cluster::make_unknown_relative_to.
8114 (binding_cluster::make_unknown_relative_to): Add "out_store"
8115 param. Use it to mark base regions that are pointed to by
8116 pointers that become unknown as having escaped.
8117 (store::can_merge_p): Pass out_store to
8118 binding_cluster::can_merge_p.
8119 * store.h (binding_cluster::can_merge_p): Add "out_store" param.
8120 (binding_cluster::make_unknown_relative_to): Likewise.
8121 * svalue.cc (region_svalue::implicitly_live_p): New vfunc.
8122 * svalue.h (region_svalue::implicitly_live_p): New vfunc decl.
8124 2021-01-07 David Malcolm <dmalcolm@redhat.com>
8126 PR analyzer/98564
8127 * engine.cc (exploded_path::feasible_p): Add missing call to
8128 bitmap_clear.
8130 2021-01-06 David Malcolm <dmalcolm@redhat.com>
8132 PR analyzer/97072
8133 * region-model-reachability.cc (reachable_regions::init_cluster):
8134 Convert symbolic region handling to a switch statement. Add cases
8135 to handle SK_UNKNOWN and SK_CONJURED.
8137 2021-01-05 David Malcolm <dmalcolm@redhat.com>
8139 PR analyzer/98293
8140 * store.cc (binding_map::apply_ctor_to_region): When "index" is
8141 NULL, iterate through the fields for RECORD_TYPEs, rather than
8142 creating an INTEGER_CST index.
8144 2020-11-30 David Malcolm <dmalcolm@redhat.com>
8146 * analyzer-pass.cc: Include "analyzer/analyzer.h" for the
8147 declaration of sorry_no_analyzer; include "tree.h" and
8148 "function.h" as these are needed by it.
8150 2020-11-30 David Malcolm <dmalcolm@redhat.com>
8152 * analyzer-pass.cc (pass_analyzer::execute): Move sorry call to...
8153 (sorry_no_analyzer): New.
8154 * analyzer.h (class state_machine): New forward decl.
8155 (class logger): New forward decl.
8156 (class plugin_analyzer_init_iface): New.
8157 (sorry_no_analyzer): New decl.
8158 * checker-path.cc (checker_path::fixup_locations): New.
8159 * checker-path.h (checker_event::set_location): New.
8160 (checker_path::fixup_locations): New decl.
8161 * diagnostic-manager.cc
8162 (diagnostic_manager::emit_saved_diagnostic): Call
8163 checker_path::fixup_locations, and call fixup_location
8164 on the primary location.
8165 * engine.cc: Include "plugin.h".
8166 (class plugin_analyzer_init_impl): New.
8167 (impl_run_checkers): Invoke PLUGIN_ANALYZER_INIT callbacks.
8168 * pending-diagnostic.h (pending_diagnostic::fixup_location): New
8169 vfunc.
8171 2020-11-18 David Malcolm <dmalcolm@redhat.com>
8173 PR analyzer/97893
8174 * sm-malloc.cc (null_deref::emit): Use CWE-476 rather than
8175 CWE-690, as this isn't due to an unchecked return value.
8176 (null_arg::emit): Likewise.
8178 2020-11-12 David Malcolm <dmalcolm@redhat.com>
8180 * checker-path.h (checker_event::get_id_ptr): New.
8181 * diagnostic-manager.cc (path_builder::path_builder): Add "sd"
8182 param and use it to initialize new field "m_sd".
8183 (path_builder::get_pending_diagnostic): New.
8184 (path_builder::m_sd): New field.
8185 (diagnostic_manager::emit_saved_diagnostic): Pass sd to
8186 path_builder ctor.
8187 (diagnostic_manager::add_events_for_superedge): Call new
8188 maybe_add_custom_events_for_superedge vfunc.
8189 * engine.cc (stale_jmp_buf::stale_jmp_buf): Add "setjmp_point"
8190 param and use it to initialize new field "m_setjmp_point".
8191 Initialize new field "m_stack_pop_event".
8192 (stale_jmp_buf::maybe_add_custom_events_for_superedge): New vfunc
8193 implementation.
8194 (stale_jmp_buf::describe_final_event): New vfunc implementation.
8195 (stale_jmp_buf::m_setjmp_point): New field.
8196 (stale_jmp_buf::m_stack_pop_event): New field.
8197 (exploded_node::on_longjmp): Pass setjmp_point to stale_jmp_buf
8198 ctor.
8199 * pending-diagnostic.h
8200 (pending_diagnostic::maybe_add_custom_events_for_superedge): New
8201 vfunc.
8203 2020-11-12 David Malcolm <dmalcolm@redhat.com>
8205 PR tree-optimization/97424
8206 * analyzer.opt (Wanalyzer-shift-count-negative): New.
8207 (Wanalyzer-shift-count-overflow): New.
8208 * region-model.cc (class shift_count_negative_diagnostic): New.
8209 (class shift_count_overflow_diagnostic): New.
8210 (region_model::get_gassign_result): Complain about shift counts that
8211 are negative or are >= the operand's type's width.
8213 2020-11-10 Martin Liska <mliska@suse.cz>
8215 * constraint-manager.cc (constraint_manager::merge): Remove
8216 unused code.
8217 * constraint-manager.h: Likewise.
8218 * program-state.cc (sm_state_map::sm_state_map): Likewise.
8219 (program_state::program_state): Likewise.
8220 (test_sm_state_map): Likewise.
8221 * program-state.h: Likewise.
8222 * region-model-reachability.cc (reachable_regions::reachable_regions): Likewise.
8223 * region-model-reachability.h: Likewise.
8224 * region-model.cc (region_model::handle_unrecognized_call): Likewise.
8225 (region_model::get_reachable_svalues): Likewise.
8226 (region_model::can_merge_with_p): Likewise.
8228 2020-11-05 David Malcolm <dmalcolm@redhat.com>
8230 PR analyzer/97668
8231 * svalue.cc (cmp_cst): Handle COMPLEX_CST.
8233 2020-10-29 David Malcolm <dmalcolm@redhat.com>
8235 * program-state.cc (sm_state_map::on_liveness_change): Sort the
8236 leaking svalues before calling on_state_leak.
8237 (program_state::detect_leaks): Likewise when calling
8238 on_svalue_leak.
8239 * region-model-reachability.cc
8240 (reachable_regions::mark_escaped_clusters): Likewise when
8241 calling on_escaped_function.
8243 2020-10-29 David Malcolm <dmalcolm@redhat.com>
8245 PR analyzer/97608
8246 * region-model-reachability.cc (reachable_regions::handle_sval):
8247 Operands of reachable reversible operations are reachable.
8249 2020-10-29 David Malcolm <dmalcolm@redhat.com>
8251 * analyzer.h (class state_machine): New forward decl.
8252 (class logger): Likewise.
8253 (class visitor): Likewise.
8254 * complexity.cc: New file, taken from svalue.cc.
8255 * complexity.h: New file, taken from region-model.h.
8256 * region-model.h: Include "analyzer/svalue.h" and
8257 "analyzer/region.h". Move struct complexity to complexity.h.
8258 Move svalue, its subclasses and supporting decls to svalue.h.
8259 Move region, its subclasses and supporting decls to region.h.
8260 * region.cc: Include "analyzer/region.h".
8261 (symbolic_region::symbolic_region): Move here from region-model.h.
8262 * region.h: New file, based on material from region-model.h.
8263 * svalue.cc: Include "analyzer/svalue.h".
8264 (complexity::complexity): Move to complexity.cc.
8265 (complexity::from_pair): Likewise.
8266 * svalue.h: New file, based on material from region-model.h.
8268 2020-10-29 David Malcolm <dmalcolm@redhat.com>
8270 * program-state.cc (sm_state_map::print): Guard the printing of
8271 the origin pointer with !flag_dump_noaddr.
8272 * region.cc (string_region::dump_to_pp): Likewise for
8273 m_string_cst.
8275 2020-10-27 David Malcolm <dmalcolm@redhat.com>
8277 PR analyzer/97568
8278 * region-model.cc (region_model::get_initial_value_for_global):
8279 Move check that !DECL_EXTERNAL from here to...
8280 * region.cc (decl_region::get_svalue_for_initializer): ...here,
8281 using it to reject zero initialization.
8283 2020-10-27 Markus Böck <markus.boeck02@gmail.com>
8285 PR analyzer/96608
8286 * store.h (hash): Cast to intptr_t instead of long
8288 2020-10-27 David Malcolm <dmalcolm@redhat.com>
8290 * constraint-manager.cc (svalue_cmp_by_ptr): Delete.
8291 (equiv_class::canonicalize): Use svalue::cmp_ptr_ptr instead.
8292 (equiv_class_cmp): Eliminate pointer comparison.
8293 * diagnostic-manager.cc (dedupe_key::comparator): If they are at
8294 the same location, also compare epath ength and pending_diagnostic
8295 kind.
8296 * engine.cc (readability_comparator): If two path_vars have the
8297 same readability, then impose an arbitrary ordering on them.
8298 (worklist::key_t::cmp): If two points have the same plan ordering,
8299 continue the comparison. Call sm_state_map::cmp rather than
8300 comparing hash values.
8301 * program-state.cc (sm_state_map::entry_t::cmp): New.
8302 (sm_state_map::cmp): New.
8303 * program-state.h (sm_state_map::entry_t::cmp): New decl.
8304 (sm_state_map::elements): New.
8305 (sm_state_map::cmp): New.
8307 2020-10-27 David Malcolm <dmalcolm@redhat.com>
8309 * engine.cc (setjmp_record::cmp): New.
8310 (supernode_cluster::dump_dot): Avoid embedding pointer in cluster
8311 name.
8312 (supernode_cluster::cmp_ptr_ptr): New.
8313 (function_call_string_cluster::dump_dot): Avoid embedding pointer
8314 in cluster name. Sort m_map when dumping child clusters.
8315 (function_call_string_cluster::cmp_ptr_ptr): New.
8316 (root_cluster::dump_dot): Sort m_map when dumping child clusters.
8317 * program-point.cc (function_point::cmp): New.
8318 (function_point::cmp_ptr): New.
8319 * program-point.h (function_point::cmp): New decl.
8320 (function_point::cmp_ptr): New decl.
8321 * program-state.cc (sm_state_map::print): Sort the values. Guard
8322 the printing of pointers with !flag_dump_noaddr.
8323 (program_state::prune_for_point): Sort the regions.
8324 (log_set_of_svalues): Sort the values. Guard the printing of
8325 pointers with !flag_dump_noaddr.
8326 * region-model-manager.cc (log_uniq_map): Sort the values.
8327 * region-model-reachability.cc (dump_set): New function template.
8328 (reachable_regions::dump_to_pp): Use it.
8329 * region-model.h (svalue::cmp_ptr): New decl.
8330 (svalue::cmp_ptr_ptr): New decl.
8331 (setjmp_record::cmp): New decl.
8332 (placeholder_svalue::get_name): New accessor.
8333 (widening_svalue::get_point): New accessor.
8334 (compound_svalue::get_map): New accessor.
8335 (conjured_svalue::get_stmt): New accessor.
8336 (conjured_svalue::get_id_region): New accessor.
8337 (region::cmp_ptrs): Rename to...
8338 (region::cmp_ptr_ptr): ...this.
8339 * region.cc (region::cmp_ptrs): Rename to...
8340 (region::cmp_ptr_ptr): ...this.
8341 * state-purge.cc
8342 (state_purge_per_ssa_name::state_purge_per_ssa_name): Sort
8343 m_points_needing_name when dumping.
8344 * store.cc (concrete_binding::cmp_ptr_ptr): New.
8345 (symbolic_binding::cmp_ptr_ptr): New.
8346 (binding_map::cmp): New.
8347 (get_sorted_parent_regions): Update for renaming of
8348 region::cmp_ptrs to region::cmp_ptr_ptr.
8349 (store::dump_to_pp): Likewise.
8350 (store::to_json): Likewise.
8351 (store::can_merge_p): Sort the base regions before considering
8352 them.
8353 * store.h (concrete_binding::cmp_ptr_ptr): New decl.
8354 (symbolic_binding::cmp_ptr_ptr): New decl.
8355 (binding_map::cmp): New decl.
8356 * supergraph.cc (supergraph::supergraph): Assign UIDs to the
8357 gimple stmts.
8358 * svalue.cc (cmp_cst): New.
8359 (svalue::cmp_ptr): New.
8360 (svalue::cmp_ptr_ptr): New.
8362 2020-10-27 David Malcolm <dmalcolm@redhat.com>
8364 * engine.cc (exploded_graph::get_or_create_node): Fix off-by-one
8365 when imposing param_analyzer_max_enodes_per_program_point limit.
8367 2020-10-27 David Malcolm <dmalcolm@redhat.com>
8369 * region-model.cc (region_model::get_representative_path_var):
8370 Implement case RK_LABEL.
8371 * region-model.h (label_region::get_label): New accessor.
8373 2020-10-22 David Malcolm <dmalcolm@redhat.com>
8375 PR analyzer/97514
8376 * engine.cc (exploded_graph::add_function_entry): Handle failure
8377 to create an enode, rather than asserting.
8379 2020-10-22 David Malcolm <dmalcolm@redhat.com>
8381 PR analyzer/97489
8382 * engine.cc (exploded_graph::add_function_entry): Assert that we
8383 have a function body.
8384 (exploded_graph::on_escaped_function): Reject fndecls that don't
8385 have a function body.
8387 2020-10-14 David Malcolm <dmalcolm@redhat.com>
8389 PR analyzer/93388
8390 * region-model.cc (region_model::get_initial_value_for_global):
8391 Fall back to returning an initial_svalue if
8392 decl_region::get_svalue_for_initializer fails.
8393 * region.cc (decl_region::get_svalue_for_initializer): Don't
8394 attempt to create a compound_svalue if the region has an unknown
8395 size.
8397 2020-10-14 David Malcolm <dmalcolm@redhat.com>
8399 PR analyzer/93723
8400 * store.cc (binding_map::apply_ctor_to_region): Remove redundant
8401 assertion.
8403 2020-10-12 David Malcolm <dmalcolm@redhat.com>
8405 PR analyzer/97258
8406 * engine.cc (impl_region_model_context::on_escaped_function): New
8407 vfunc.
8408 (exploded_graph::add_function_entry): Use m_functions_with_enodes
8409 to implement idempotency.
8410 (add_any_callbacks): New.
8411 (exploded_graph::build_initial_worklist): Use the above to find
8412 callbacks that are reachable from global initializers.
8413 (exploded_graph::on_escaped_function): New.
8414 * exploded-graph.h
8415 (impl_region_model_context::on_escaped_function): New decl.
8416 (exploded_graph::on_escaped_function): New decl.
8417 (exploded_graph::m_functions_with_enodes): New field.
8418 * region-model-reachability.cc
8419 (reachable_regions::reachable_regions): Replace "store" param with
8420 "model" param; use it to initialize m_model.
8421 (reachable_regions::add): When getting the svalue for the region,
8422 call get_store_value on the model rather than using an initial
8423 value.
8424 (reachable_regions::mark_escaped_clusters): Add ctxt param and
8425 use it to call on_escaped_function when a function_region escapes.
8426 * region-model-reachability.h
8427 (reachable_regions::reachable_regions): Replace "store" param with
8428 "model" param.
8429 (reachable_regions::mark_escaped_clusters): Add ctxt param.
8430 (reachable_regions::m_model): New field.
8431 * region-model.cc (region_model::handle_unrecognized_call): Update
8432 for change in reachable_regions ctor.
8433 (region_model::handle_unrecognized_call): Pass ctxt to
8434 mark_escaped_clusters.
8435 (region_model::get_reachable_svalues): Update for change in
8436 reachable_regions ctor.
8437 (region_model::get_initial_value_for_global): Read-only variables
8438 keep their initial values.
8439 * region-model.h (region_model_context::on_escaped_function): New
8440 vfunc.
8441 (noop_region_model_context::on_escaped_function): New.
8443 2020-10-12 David Malcolm <dmalcolm@redhat.com>
8445 * analyzer.opt (Wanalyzer-write-to-const): New.
8446 (Wanalyzer-write-to-string-literal): New.
8447 * region-model-impl-calls.cc (region_model::impl_call_memcpy):
8448 Call check_for_writable_region.
8449 (region_model::impl_call_memset): Likewise.
8450 (region_model::impl_call_strcpy): Likewise.
8451 * region-model.cc (class write_to_const_diagnostic): New.
8452 (class write_to_string_literal_diagnostic): New.
8453 (region_model::check_for_writable_region): New.
8454 (region_model::set_value): Call check_for_writable_region.
8455 * region-model.h (region_model::check_for_writable_region): New
8456 decl.
8458 2020-10-07 David Malcolm <dmalcolm@redhat.com>
8460 PR analyzer/97116
8461 * sm-malloc.cc (method_p): New.
8462 (describe_argument_index): New.
8463 (inform_nonnull_attribute): Use describe_argument_index.
8464 (possible_null_arg::describe_final_event): Likewise.
8465 (null_arg::describe_final_event): Likewise.
8467 2020-09-29 David Malcolm <dmalcolm@redhat.com>
8469 PR analyzer/95188
8470 * engine.cc (stmt_requires_new_enode_p): Split enodes before
8471 "signal" calls.
8473 2020-09-29 David Malcolm <dmalcolm@redhat.com>
8475 * constraint-manager.cc
8476 (constraint_manager::add_constraint_internal): Whitespace fixes.
8477 Silence -Wsign-compare warning.
8478 * engine.cc (maybe_process_run_of_before_supernode_enodes):
8479 Silence -Wsign-compare warning.
8481 2020-09-28 David Malcolm <dmalcolm@redhat.com>
8483 * region-model.h (binop_svalue::dyn_cast_binop_svalue): Remove
8484 redundant "virtual". Add FINAL OVERRIDE.
8485 (widening_svalue::dyn_cast_widening_svalue): Add FINAL OVERRIDE.
8486 (compound_svalue::dyn_cast_compound_svalue): Likewise.
8487 (conjured_svalue::dyn_cast_conjured_svalue): Likewise.
8489 2020-09-28 David Malcolm <dmalcolm@redhat.com>
8491 * diagnostic-manager.cc (null_assignment_sm_context::m_visitor):
8492 Remove unused field.
8494 2020-09-28 David Malcolm <dmalcolm@redhat.com>
8496 PR analyzer/97233
8497 * analyzer.cc (is_longjmp_call_p): Require the initial argument
8498 to be a pointer.
8499 * engine.cc (exploded_node::on_longjmp): Likewise.
8501 2020-09-28 David Malcolm <dmalcolm@redhat.com>
8503 * program-state.cc (sm_state_map::print): Update check
8504 for m_global_state being the start state.
8506 2020-09-26 David Malcolm <dmalcolm@redhat.com>
8508 PR analyzer/96646
8509 PR analyzer/96841
8510 * region-model.cc (region_model::get_representative_path_var):
8511 When handling offset_region, wrap the MEM_REF's first argument in
8512 an ADDR_EXPR of pointer type, rather than simply using the tree
8513 for the parent region. Require the MEM_REF's second argument to
8514 be an integer constant.
8516 2020-09-24 David Malcolm <dmalcolm@redhat.com>
8518 * analyzer.h (struct rejected_constraint): New decl.
8519 * analyzer.opt (fanalyzer-feasibility): New option.
8520 * diagnostic-manager.cc (path_builder::path_builder): Add
8521 "problem" param and use it to initialize new field.
8522 (path_builder::get_feasibility_problem): New accessor.
8523 (path_builder::m_feasibility_problem): New field.
8524 (dedupe_winners::add): Remove inversion of logic in "if" clause,
8525 swapping if/else suites. In the !feasible_p suite, inspect
8526 flag_analyzer_feasibility and add code to handle when this
8527 is off, accepting the infeasible path, but recording the
8528 feasibility_problem.
8529 (diagnostic_manager::emit_saved_diagnostic): Pass the
8530 feasibility_problem to the path_builder.
8531 (diagnostic_manager::add_events_for_eedge): If we have
8532 a feasibility_problem at this edge, use it to add a custom event.
8533 * engine.cc (exploded_path::feasible_p): Pass a
8534 rejected_constraint ** to model.maybe_update_for_edge and transfer
8535 ownership of any created instance to any feasibility_problem.
8536 (feasibility_problem::dump_to_pp): New.
8537 * exploded-graph.h (feasibility_problem::feasibility_problem):
8538 Drop "model" param; add rejected_constraint * param.
8539 (feasibility_problem::~feasibility_problem): New.
8540 (feasibility_problem::dump_to_pp): New decl.
8541 (feasibility_problem::m_model): Drop field.
8542 (feasibility_problem::m_rc): New field.
8543 * program-point.cc (function_point::get_location): Handle
8544 PK_BEFORE_SUPERNODE and PK_AFTER_SUPERNODE.
8545 * program-state.cc (program_state::on_edge): Pass NULL to new
8546 param of region_model::maybe_update_for_edge.
8547 * region-model.cc (region_model::add_constraint): New overload
8548 adding a rejected_constraint ** param.
8549 (region_model::maybe_update_for_edge): Add rejected_constraint **
8550 param and pass it to the various apply_constraints_for_ calls.
8551 (region_model::apply_constraints_for_gcond): Add
8552 rejected_constraint ** param and pass it to add_constraint calls.
8553 (region_model::apply_constraints_for_gswitch): Likewise.
8554 (region_model::apply_constraints_for_exception): Likewise.
8555 (rejected_constraint::dump_to_pp): New.
8556 * region-model.h (region_model::maybe_update_for_edge):
8557 Add rejected_constraint ** param.
8558 (region_model::add_constraint): New overload adding a
8559 rejected_constraint ** param.
8560 (region_model::apply_constraints_for_gcond): Add
8561 rejected_constraint ** param.
8562 (region_model::apply_constraints_for_gswitch): Likewise.
8563 (region_model::apply_constraints_for_exception): Likewise.
8564 (struct rejected_constraint): New.
8566 2020-09-23 David Malcolm <dmalcolm@redhat.com>
8568 PR analyzer/97178
8569 * engine.cc (impl_run_checkers): Update for change to ext_state
8570 ctor.
8571 * program-state.cc (selftest::test_sm_state_map): Pass an engine
8572 instance to ext_state ctor.
8573 (selftest::test_program_state_1): Likewise.
8574 (selftest::test_program_state_2): Likewise.
8575 (selftest::test_program_state_merging): Likewise.
8576 (selftest::test_program_state_merging_2): Likewise.
8577 * program-state.h (extrinsic_state::extrinsic_state): Remove NULL
8578 default value for "eng" param.
8580 2020-09-23 Tobias Burnus <tobias@codesourcery.com>
8582 * analyzer-logging.cc: Guard '#pragma ... ignored "-Wformat-diag"'
8583 by '#if __GNUC__ >= 10'
8584 * analyzer.h: Likewise.
8585 * call-string.cc: Likewise.
8587 2020-09-23 David Malcolm <dmalcolm@redhat.com>
8589 * engine.cc (exploded_node::on_stmt): Replace sequence of dyn_cast
8590 with switch.
8592 2020-09-22 David Malcolm <dmalcolm@redhat.com>
8594 * analysis-plan.cc: Include "json.h".
8595 * analyzer.opt (fdump-analyzer-json): New.
8596 * call-string.cc: Include "json.h".
8597 (call_string::to_json): New.
8598 * call-string.h (call_string::to_json): New decl.
8599 * checker-path.cc: Include "json.h".
8600 * constraint-manager.cc: Include "json.h".
8601 (equiv_class::to_json): New.
8602 (constraint::to_json): New.
8603 (constraint_manager::to_json): New.
8604 * constraint-manager.h (equiv_class::to_json): New decl.
8605 (constraint::to_json): New decl.
8606 (constraint_manager::to_json): New decl.
8607 * diagnostic-manager.cc: Include "json.h".
8608 (saved_diagnostic::to_json): New.
8609 (diagnostic_manager::to_json): New.
8610 * diagnostic-manager.h (saved_diagnostic::to_json): New decl.
8611 (diagnostic_manager::to_json): New decl.
8612 * engine.cc: Include "json.h", <zlib.h>.
8613 (exploded_node::status_to_str): New.
8614 (exploded_node::to_json): New.
8615 (exploded_edge::to_json): New.
8616 (exploded_graph::to_json): New.
8617 (dump_analyzer_json): New.
8618 (impl_run_checkers): Call it.
8619 * exploded-graph.h (exploded_node::status_to_str): New decl.
8620 (exploded_node::to_json): New.
8621 (exploded_edge::to_json): New.
8622 (exploded_graph::to_json): New.
8623 * pending-diagnostic.cc: Include "json.h".
8624 * program-point.cc: Include "json.h".
8625 (program_point::to_json): New.
8626 * program-point.h (program_point::to_json): New decl.
8627 * program-state.cc: Include "json.h".
8628 (extrinsic_state::to_json): New.
8629 (sm_state_map::to_json): New.
8630 (program_state::to_json): New.
8631 * program-state.h (extrinsic_state::to_json): New decl.
8632 (sm_state_map::to_json): New decl.
8633 (program_state::to_json): New decl.
8634 * region-model-impl-calls.cc: Include "json.h".
8635 * region-model-manager.cc: Include "json.h".
8636 * region-model-reachability.cc: Include "json.h".
8637 * region-model.cc: Include "json.h".
8638 * region-model.h (svalue::to_json): New decl.
8639 (region::to_json): New decl.
8640 * region.cc: Include "json.h".
8641 (region::to_json: New.
8642 * sm-file.cc: Include "json.h".
8643 * sm-malloc.cc: Include "json.h".
8644 * sm-pattern-test.cc: Include "json.h".
8645 * sm-sensitive.cc: Include "json.h".
8646 * sm-signal.cc: Include "json.h".
8647 (signal_delivery_edge_info_t::to_json): New.
8648 * sm-taint.cc: Include "json.h".
8649 * sm.cc: Include "diagnostic.h", "tree-diagnostic.h", and
8650 "json.h".
8651 (state_machine::state::to_json): New.
8652 (state_machine::to_json): New.
8653 * sm.h (state_machine::state::to_json): New.
8654 (state_machine::to_json): New.
8655 * state-purge.cc: Include "json.h".
8656 * store.cc: Include "json.h".
8657 (binding_key::get_desc): New.
8658 (binding_map::to_json): New.
8659 (binding_cluster::to_json): New.
8660 (store::to_json): New.
8661 * store.h (binding_key::get_desc): New decl.
8662 (binding_map::to_json): New decl.
8663 (binding_cluster::to_json): New decl.
8664 (store::to_json): New decl.
8665 * supergraph.cc: Include "json.h".
8666 (supergraph::to_json): New.
8667 (supernode::to_json): New.
8668 (superedge::to_json): New.
8669 * supergraph.h (supergraph::to_json): New decl.
8670 (supernode::to_json): New decl.
8671 (superedge::to_json): New decl.
8672 * svalue.cc: Include "json.h".
8673 (svalue::to_json): New.
8675 2020-09-21 David Malcolm <dmalcolm@redhat.com>
8677 PR analyzer/97130
8678 * region-model-impl-calls.cc (call_details::get_arg_type): New.
8679 * region-model.cc (region_model::on_call_pre): Check that the
8680 initial arg is a pointer before calling impl_call_memset and
8681 impl_call_strlen.
8682 * region-model.h (call_details::get_arg_type): New decl.
8684 2020-09-21 David Malcolm <dmalcolm@redhat.com>
8686 PR analyzer/93355
8687 * sm-malloc.cc (malloc_state_machine::get_default_state): Look at
8688 the base region when considering pointers. Treat pointers to
8689 decls as being non-heap.
8691 2020-09-18 David Malcolm <dmalcolm@redhat.com>
8693 * checker-path.cc (warning_event::get_desc): Handle global state
8694 changes.
8696 2020-09-18 David Malcolm <dmalcolm@redhat.com>
8698 * sm-malloc.cc (malloc_state_machine::on_stmt): Handle strdup and
8699 strndup as being malloc-like allocators.
8701 2020-09-16 David Malcolm <dmalcolm@redhat.com>
8703 * engine.cc (strongly_connected_components::strong_connect): Only
8704 consider intraprocedural edges when creating SCCs.
8705 (worklist::key_t::cmp): Add comment. Treat call_string
8706 differences as more important than differences of program_point
8707 within a supernode.
8709 2020-09-16 David Malcolm <dmalcolm@redhat.com>
8711 * engine.cc (supernode_cluster::dump_dot): Show the SCC id
8712 in the per-supernode clusters in FILENAME.eg.dot output.
8713 (exploded_graph_annotator::add_node_annotations):
8714 Show the SCC of the supernode in FILENAME.supernode.eg.dot output.
8715 * exploded-graph.h (worklist::scc_id): New.
8716 (exploded_graph::get_scc_id): New.
8718 2020-09-16 David Malcolm <dmalcolm@redhat.com>
8720 * engine.cc (exploded_node::dump_dot): Show STATUS_BULK_MERGED.
8721 (exploded_graph::process_worklist): Call
8722 maybe_process_run_of_before_supernode_enodes.
8723 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
8724 New.
8725 (exploded_graph_annotator::print_enode): Show STATUS_BULK_MERGED.
8726 * exploded-graph.h (enum exploded_node::status): Add
8727 STATUS_BULK_MERGED.
8729 2020-09-16 David Malcolm <dmalcolm@redhat.com>
8731 * engine.cc
8732 (exploded_graph::process_node) <case PK_BEFORE_SUPERNODE>:
8733 Simplify by using program_point::get_next.
8734 * program-point.cc (program_point::get_next): New.
8735 * program-point.h (program_point::get_next): New decl.
8737 2020-09-16 David Malcolm <dmalcolm@redhat.com>
8739 * engine.cc (exploded_graph::get_or_create_node): Show the
8740 program point when issuing -Wanalyzer-too-complex due to hitting
8741 the per-program-point limit.
8743 2020-09-16 David Malcolm <dmalcolm@redhat.com>
8745 * region-model.cc (region_model::on_call_pre): Treat getchar as
8746 having no side-effects.
8748 2020-09-15 David Malcolm <dmalcolm@redhat.com>
8750 PR analyzer/96650
8751 * constraint-manager.cc (merger_fact_visitor::on_fact): Replace
8752 assertion that add_constraint succeeded with an assertion that
8753 if it fails, -fanalyzer-transitivity is off.
8755 2020-09-14 David Malcolm <dmalcolm@redhat.com>
8757 * analyzer.opt (-param=analyzer-max-constraints=): New param.
8758 * constraint-manager.cc
8759 (constraint_manager::add_constraint_internal): Silently reject
8760 attempts to add constraints when the above limit is reached.
8762 2020-09-14 David Malcolm <dmalcolm@redhat.com>
8764 PR analyzer/96653
8765 * constraint-manager.cc
8766 (constraint_manager::get_or_add_equiv_class): Don't accumulate
8767 transitive closure of all constraints on constants.
8769 2020-09-14 David Malcolm <dmalcolm@redhat.com>
8771 PR analyzer/97029
8772 * analyzer.cc (is_setjmp_call_p): Require the initial arg to be a
8773 pointer.
8774 * region-model.cc (region_model::deref_rvalue): Assert that the
8775 svalue is of pointer type.
8777 2020-09-11 David Malcolm <dmalcolm@redhat.com>
8779 PR analyzer/96798
8780 * region-model-impl-calls.cc (region_model::impl_call_memcpy):
8781 New.
8782 (region_model::impl_call_strcpy): New.
8783 * region-model.cc (region_model::on_call_pre): Flag unhandled
8784 builtins that are non-pure as having unknown side-effects.
8785 Implement BUILT_IN_MEMCPY, BUILT_IN_MEMCPY_CHK, BUILT_IN_STRCPY,
8786 BUILT_IN_STRCPY_CHK, BUILT_IN_FPRINTF, BUILT_IN_FPRINTF_UNLOCKED,
8787 BUILT_IN_PUTC, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_FPUTC,
8788 BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
8789 BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
8790 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTCHAR,
8791 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTS, BUILT_IN_PUTS_UNLOCKED,
8792 BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF.
8793 * region-model.h (region_model::impl_call_memcpy): New decl.
8794 (region_model::impl_call_strcpy): New decl.
8796 2020-09-09 David Malcolm <dmalcolm@redhat.com>
8798 PR analyzer/94355
8799 * analyzer.opt (Wanalyzer-mismatching-deallocation): New warning.
8800 * region-model-impl-calls.cc
8801 (region_model::impl_call_operator_new): New.
8802 (region_model::impl_call_operator_delete): New.
8803 * region-model.cc (region_model::on_call_pre): Detect operator new
8804 and operator delete.
8805 (region_model::on_call_post): Likewise.
8806 (region_model::maybe_update_for_edge): Detect EH edges and call...
8807 (region_model::apply_constraints_for_exception): New function.
8808 * region-model.h (region_model::impl_call_operator_new): New decl.
8809 (region_model::impl_call_operator_delete): New decl.
8810 (region_model::apply_constraints_for_exception): New decl.
8811 * sm-malloc.cc (enum resource_state): New.
8812 (struct allocation_state): New state subclass.
8813 (enum wording): New.
8814 (struct api): New.
8815 (malloc_state_machine::custom_data_t): New typedef.
8816 (malloc_state_machine::add_state): New decl.
8817 (malloc_state_machine::m_unchecked)
8818 (malloc_state_machine::m_nonnull)
8819 (malloc_state_machine::m_freed): Delete these states in favor
8820 of...
8821 (malloc_state_machine::m_malloc)
8822 (malloc_state_machine::m_scalar_new)
8823 (malloc_state_machine::m_vector_new): ...this new api instances,
8824 which own their own versions of these states.
8825 (malloc_state_machine::on_allocator_call): New decl.
8826 (malloc_state_machine::on_deallocator_call): New decl.
8827 (api::api): New ctor.
8828 (dyn_cast_allocation_state): New.
8829 (as_a_allocation_state): New.
8830 (get_rs): New.
8831 (unchecked_p): New.
8832 (nonnull_p): New.
8833 (freed_p): New.
8834 (malloc_diagnostic::describe_state_change): Use unchecked_p and
8835 nonnull_p.
8836 (class mismatching_deallocation): New.
8837 (double_free::double_free): Add funcname param for initializing
8838 m_funcname.
8839 (double_free::emit): Use m_funcname in warning message rather
8840 than hardcoding "free".
8841 (double_free::describe_state_change): Likewise. Use freed_p.
8842 (double_free::describe_call_with_state): Use freed_p.
8843 (double_free::describe_final_event): Use m_funcname in message
8844 rather than hardcoding "free".
8845 (double_free::m_funcname): New field.
8846 (possible_null::describe_state_change): Use unchecked_p.
8847 (possible_null::describe_return_of_state): Likewise.
8848 (use_after_free::use_after_free): Add param for initializing m_api.
8849 (use_after_free::emit): Use m_api->m_dealloc_funcname in message
8850 rather than hardcoding "free".
8851 (use_after_free::describe_state_change): Use freed_p. Change the
8852 wording of the message based on the API.
8853 (use_after_free::describe_final_event): Use
8854 m_api->m_dealloc_funcname in message rather than hardcoding
8855 "free". Change the wording of the message based on the API.
8856 (use_after_free::m_api): New field.
8857 (malloc_leak::describe_state_change): Use unchecked_p. Update
8858 for renaming of m_malloc_event to m_alloc_event.
8859 (malloc_leak::describe_final_event): Update for renaming of
8860 m_malloc_event to m_alloc_event.
8861 (malloc_leak::m_malloc_event): Rename...
8862 (malloc_leak::m_alloc_event): ...to this.
8863 (free_of_non_heap::free_of_non_heap): Add param for initializing
8864 m_funcname.
8865 (free_of_non_heap::emit): Use m_funcname in message rather than
8866 hardcoding "free".
8867 (free_of_non_heap::describe_final_event): Likewise.
8868 (free_of_non_heap::m_funcname): New field.
8869 (allocation_state::dump_to_pp): New.
8870 (allocation_state::get_nonnull): New.
8871 (malloc_state_machine::malloc_state_machine): Update for changes
8872 to state fields and new api fields.
8873 (malloc_state_machine::add_state): New.
8874 (malloc_state_machine::on_stmt): Move malloc/calloc handling to
8875 on_allocator_call and call it, passing in the API pointer.
8876 Likewise for free, moving it to on_deallocator_call. Handle calls
8877 to operator new and delete in an analogous way. Use unchecked_p
8878 when testing for possibly-null-arg and possibly-null-deref, and
8879 transition to the non-null for the correct API. Remove redundant
8880 node param from call to on_zero_assignment. Use freed_p for
8881 use-after-free check, and pass in API.
8882 (malloc_state_machine::on_allocator_call): New, based on code in
8883 on_stmt.
8884 (malloc_state_machine::on_deallocator_call): Likewise.
8885 (malloc_state_machine::on_phi): Mark node param with
8886 ATTRIBUTE_UNUSED; don't pass it to on_zero_assignment.
8887 (malloc_state_machine::on_condition): Mark node param with
8888 ATTRIBUTE_UNUSED. Replace on_transition calls with get_state and
8889 set_next_state pairs, transitioning to the non-null state for the
8890 appropriate API.
8891 (malloc_state_machine::can_purge_p): Port to new state approach.
8892 (malloc_state_machine::on_zero_assignment): Replace on_transition
8893 calls with get_state and set_next_state pairs. Drop redundant
8894 node param.
8895 * sm.h (state_machine::add_custom_state): New.
8897 2020-09-09 David Malcolm <dmalcolm@redhat.com>
8899 * diagnostic-manager.cc
8900 (null_assignment_sm_context::warn_for_state): Replace with...
8901 (null_assignment_sm_context::warn): ...this.
8902 * engine.cc (impl_sm_context::warn_for_state): Replace with...
8903 (impl_sm_context::warn): ...this.
8904 * sm-file.cc (fileptr_state_machine::on_stmt): Replace
8905 warn_for_state and on_transition calls with a get_state
8906 test guarding warn and set_next_state calls.
8907 * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise.
8908 * sm-pattern-test.cc (pattern_test_state_machine::on_condition):
8909 Replace warn_for_state call with warn call.
8910 * sm-sensitive.cc
8911 (sensitive_state_machine::warn_for_any_exposure): Replace
8912 warn_for_state call with a get_state test guarding a warn call.
8913 * sm-signal.cc (signal_state_machine::on_stmt): Likewise.
8914 * sm-taint.cc (taint_state_machine::on_stmt): Replace
8915 warn_for_state and on_transition calls with a get_state
8916 test guarding warn and set_next_state calls.
8917 * sm.h (sm_context::warn_for_state): Replace with...
8918 (sm_context::warn): ...this.
8920 2020-09-09 David Malcolm <dmalcolm@redhat.com>
8922 * diagnostic-manager.cc
8923 (null_assignment_sm_context::null_assignment_sm_context): Add old_state
8924 and ext_state params, initializing m_old_state and m_ext_state.
8925 (null_assignment_sm_context::on_transition): Split into...
8926 (null_assignment_sm_context::get_state): ...this new vfunc
8927 implementation and...
8928 (null_assignment_sm_context::set_next_state): ...this new vfunc
8929 implementation.
8930 (null_assignment_sm_context::m_old_state): New field.
8931 (null_assignment_sm_context::m_ext_state): New field.
8932 (diagnostic_manager::add_events_for_eedge): Pass in old state and
8933 ext_state when creating sm_ctxt.
8934 * engine.cc (impl_sm_context::on_transition): Split into...
8935 (impl_sm_context::get_state): ...this new vfunc
8936 implementation and...
8937 (impl_sm_context::set_next_state): ...this new vfunc
8938 implementation.
8939 * sm.h (sm_context::get_state): New pure virtual function.
8940 (sm_context::set_next_state): Likewise.
8941 (sm_context::on_transition): Convert from a pure virtual function
8942 to a regular function implemented in terms of get_state and
8943 set_next_state.
8945 2020-09-09 David Malcolm <dmalcolm@redhat.com>
8947 * checker-path.cc (state_change_event::get_desc): Update
8948 state_machine::get_state_name calls to state::get_name.
8949 (warning_event::get_desc): Likewise.
8950 * diagnostic-manager.cc
8951 (null_assignment_sm_context::on_transition): Update comparison
8952 against 0 with comparison with m_sm.get_start_state.
8953 (diagnostic_manager::prune_for_sm_diagnostic): Update
8954 state_machine::get_state_name calls to state::get_name.
8955 * engine.cc (impl_sm_context::on_transition): Likewise.
8956 (exploded_node::get_dot_fillcolor): Use get_id when summing
8957 the sm states.
8958 * program-state.cc (sm_state_map::sm_state_map): Don't hardcode
8959 0 as the start state when initializing m_global_state.
8960 (sm_state_map::print): Use dump_to_pp rather than get_state_name
8961 when dumping states.
8962 (sm_state_map::is_empty_p): Don't hardcode 0 as the start state
8963 when examining m_global_state.
8964 (sm_state_map::hash): Use get_id when hashing states.
8965 (selftest::test_sm_state_map): Use state objects rather than
8966 arbitrary hardcoded integers.
8967 (selftest::test_program_state_merging): Likewise.
8968 (selftest::test_program_state_merging_2): Likewise.
8969 * sm-file.cc (fileptr_state_machine::m_start): Move to base class.
8970 (file_diagnostic::describe_state_change): Use get_start_state.
8971 (fileptr_state_machine::fileptr_state_machine): Drop m_start
8972 initialization.
8973 * sm-malloc.cc (malloc_state_machine::m_start): Move to base
8974 class.
8975 (malloc_diagnostic::describe_state_change): Use get_start_state.
8976 (possible_null::describe_state_change): Likewise.
8977 (malloc_state_machine::malloc_state_machine): Drop m_start
8978 initialization.
8979 * sm-pattern-test.cc (pattern_test_state_machine::m_start): Move
8980 to base class.
8981 (pattern_test_state_machine::pattern_test_state_machine): Drop
8982 m_start initialization.
8983 * sm-sensitive.cc (sensitive_state_machine::m_start): Move to base
8984 class.
8985 (sensitive_state_machine::sensitive_state_machine): Drop m_start
8986 initialization.
8987 * sm-signal.cc (signal_state_machine::m_start): Move to base
8988 class.
8989 (signal_state_machine::signal_state_machine): Drop m_start
8990 initialization.
8991 * sm-taint.cc (taint_state_machine::m_start): Move to base class.
8992 (taint_state_machine::taint_state_machine): Drop m_start
8993 initialization.
8994 * sm.cc (state_machine::state::dump_to_pp): New.
8995 (state_machine::state_machine): Move here from sm.h. Initialize
8996 m_next_state_id and m_start.
8997 (state_machine::add_state): Reimplement in terms of state objects.
8998 (state_machine::get_state_name): Delete.
8999 (state_machine::get_state_by_name): Reimplement in terms of state
9000 objects. Make const.
9001 (state_machine::validate): Delete.
9002 (state_machine::dump_to_pp): Reimplement in terms of state
9003 objects.
9004 * sm.h (state_machine::state): New class.
9005 (state_machine::state_t): Convert typedef from "unsigned" to
9006 "const state_machine::state *".
9007 (state_machine::state_machine): Move to sm.cc.
9008 (state_machine::get_default_state): Use m_start rather than
9009 hardcoding 0.
9010 (state_machine::get_state_name): Delete.
9011 (state_machine::get_state_by_name): Make const.
9012 (state_machine::get_start_state): New accessor.
9013 (state_machine::alloc_state_id): New.
9014 (state_machine::m_state_names): Drop in favor of...
9015 (state_machine::m_states): New field
9016 (state_machine::m_start): New field
9017 (start_start_p): Delete.
9019 2020-09-08 David Malcolm <dmalcolm@redhat.com>
9021 PR analyzer/96949
9022 * store.cc (binding_map::apply_ctor_val_to_range): Add
9023 error-handling for the cases where we have symbolic offsets.
9025 2020-09-08 David Malcolm <dmalcolm@redhat.com>
9027 PR analyzer/96950
9028 * store.cc (binding_map::apply_ctor_to_region): Handle RANGE_EXPR
9029 where min_index == max_index.
9030 (binding_map::apply_ctor_val_to_range): Replace assertion that we
9031 don't have a CONSTRUCTOR value with error-handling.
9033 2020-09-08 David Malcolm <dmalcolm@redhat.com>
9035 PR analyzer/96962
9036 * region-model.cc (region_model::on_call_pre): Fix guard on switch
9037 on built-ins to only consider BUILT_IN_NORMAL, rather than other
9038 kinds of build-ins.
9040 2020-09-01 David Malcolm <dmalcolm@redhat.com>
9042 PR analyzer/96792
9043 * region-model.cc (region_model::deref_rvalue): Add the constraint
9044 that PTR_SVAL is non-NULL.
9046 2020-08-31 David Malcolm <dmalcolm@redhat.com>
9048 PR analyzer/96798
9049 * region-model.cc (region_model::on_call_pre): Handle
9050 BUILT_IN_MEMSET_CHK.
9052 2020-08-31 David Malcolm <dmalcolm@redhat.com>
9054 * region-model.cc (region_model::on_call_pre): Gather handling of
9055 builtins and of internal fns into switch statements. Handle
9056 "alloca" and BUILT_IN_ALLOCA_WITH_ALIGN.
9058 2020-08-31 David Malcolm <dmalcolm@redhat.com>
9060 PR analyzer/96860
9061 * region.cc (decl_region::get_svalue_for_constructor): Support
9062 apply_ctor_to_region failing.
9063 * store.cc (binding_map::apply_ctor_to_region): Add failure
9064 handling.
9065 (binding_map::apply_ctor_val_to_range): Likewise.
9066 (binding_map::apply_ctor_pair_to_child_region): Likewise. Replace
9067 assertion that child_base_offset is not symbolic with error
9068 handling.
9069 * store.h (binding_map::apply_ctor_to_region): Convert return type
9070 from void to bool.
9071 (binding_map::apply_ctor_val_to_range): Likewise.
9072 (binding_map::apply_ctor_pair_to_child_region): Likewise.
9074 2020-08-31 David Malcolm <dmalcolm@redhat.com>
9076 PR analyzer/96763
9077 * store.cc (binding_map::apply_ctor_to_region): Handle RANGE_EXPR
9078 by calling a new binding_map::apply_ctor_val_to_range subroutine.
9079 Split out the existing non-CONSTRUCTOR-handling code to a new
9080 apply_ctor_pair_to_child_region subroutine.
9081 (binding_map::apply_ctor_val_to_range): New.
9082 (binding_map::apply_ctor_pair_to_child_region): New, split out
9083 from binding_map::apply_ctor_to_region as noted above.
9084 * store.h (binding_map::apply_ctor_val_to_range): New decl.
9085 (binding_map::apply_ctor_pair_to_child_region): New decl.
9087 2020-08-31 David Malcolm <dmalcolm@redhat.com>
9089 PR analyzer/96764
9090 * region-model-manager.cc
9091 (region_model_manager::maybe_fold_unaryop): Handle VIEW_CONVERT_EXPR.
9092 (region_model_manager::get_or_create_cast): Move logic for
9093 real->integer casting to...
9094 (get_code_for_cast): ...this new function, and add logic for
9095 real->non-integer casts.
9096 (region_model_manager::maybe_fold_sub_svalue): Handle
9097 VIEW_CONVERT_EXPR.
9098 * region-model.cc
9099 (region_model::add_any_constraints_from_gassign): Likewise.
9100 * svalue.cc (svalue::maybe_undo_cast): Likewise.
9101 (unaryop_svalue::dump_to_pp): Likewise.
9103 2020-08-26 David Malcolm <dmalcolm@redhat.com>
9105 PR analyzer/94858
9106 * region-model-manager.cc
9107 (region_model_manager::get_or_create_widening_svalue): Assert that
9108 neither of the inputs are themselves widenings.
9109 * store.cc (store::eval_alias_1): The initial value of a pointer
9110 can't point to a region that was allocated on the heap after the
9111 beginning of the path. A widened pointer value can't alias anything
9112 that the initial pointer value can't alias.
9113 * svalue.cc (svalue::can_merge_p): Merge BINOP (X, OP, CST) with X
9114 to a widening svalue. Merge
9115 BINOP(WIDENING(BASE, BINOP(BASE, X)), X) and BINOP(BASE, X) to
9116 to the LHS of the first BINOP.
9118 2020-08-26 David Malcolm <dmalcolm@redhat.com>
9120 PR analyzer/96777
9121 * region-model.h (class compound_svalue): Document that all keys
9122 must be concrete.
9123 (compound_svalue::compound_svalue): Move definition to svalue.cc.
9124 * store.cc (binding_map::apply_ctor_to_region): Handle
9125 initializers for trailing arrays with incomplete size.
9126 * svalue.cc (compound_svalue::compound_svalue): Move definition
9127 here from region-model.h. Add assertion that all keys are
9128 concrete.
9130 2020-08-22 David Malcolm <dmalcolm@redhat.com>
9132 PR analyzer/94851
9133 * region-model-manager.cc
9134 (region_model_manager::maybe_fold_binop): Fold bitwise "& 0" to 0.
9136 2020-08-22 David Malcolm <dmalcolm@redhat.com>
9138 * store.cc (store::eval_alias): Make const. Split out 2nd half
9139 into store::eval_alias_1 and call it twice for symmetry, avoiding
9140 test duplication.
9141 (store::eval_alias_1): New function, split out from the above.
9142 * store.h (store::eval_alias): Make const.
9143 (store::eval_alias_1): New decl.
9145 2020-08-22 David Malcolm <dmalcolm@redhat.com>
9147 * region-model.cc (region_model::push_frame): Bind the default
9148 SSA name for each parm if it exists, falling back to the parm
9149 itself otherwise, rather than doing both.
9151 2020-08-20 David Malcolm <dmalcolm@redhat.com>
9153 PR analyzer/96723
9154 * region-model-manager.cc
9155 (region_model_manager::get_field_region): Assert that field is a
9156 FIELD_DECL.
9157 * region.cc (region::get_subregions_for_binding): In
9158 union-handling, filter the TYPE_FIELDS traversal to just FIELD_DECLs.
9160 2020-08-20 David Malcolm <dmalcolm@redhat.com>
9162 PR analyzer/96713
9163 * region-model.cc (region_model::get_gassign_result): For
9164 comparisons, only use eval_condition when the lhs has boolean
9165 type, and use get_or_create_constant_svalue on the boolean
9166 constants directly rather than via get_rvalue.
9168 2020-08-19 David Malcolm <dmalcolm@redhat.com>
9170 PR analyzer/96643
9171 * region-model.cc (region_model::deref_rvalue): Rather than
9172 attempting to handle all svalue kinds in the switch, only cover
9173 the special cases, and move symbolic-region handling to after
9174 the switch, thus implicitly handling the missing case SK_COMPOUND.
9176 2020-08-19 David Malcolm <dmalcolm@redhat.com>
9178 PR analyzer/96705
9179 * region-model-manager.cc
9180 (region_model_manager::maybe_fold_binop): Check that we have an
9181 integral type before calling build_int_cst.
9183 2020-08-19 David Malcolm <dmalcolm@redhat.com>
9185 PR analyzer/96699
9186 * region-model-manager.cc
9187 (region_model_manager::get_or_create_cast): Use FIX_TRUNC_EXPR for
9188 casting from REAL_TYPE to INTEGER_TYPE.
9190 2020-08-19 David Malcolm <dmalcolm@redhat.com>
9192 PR analyzer/96651
9193 * region-model.cc (region_model::called_from_main_p): New.
9194 (region_model::get_store_value): Move handling for globals into...
9195 (region_model::get_initial_value_for_global): ...this new
9196 function, and add logic for extracting values from decl
9197 initializers.
9198 * region-model.h (decl_region::get_svalue_for_constructor): New
9199 decl.
9200 (decl_region::get_svalue_for_initializer): New decl.
9201 (region_model::called_from_main_p): New decl.
9202 (region_model::get_initial_value_for_global): New.
9203 * region.cc (decl_region::maybe_get_constant_value): Move logic
9204 for getting an svalue from a CONSTRUCTOR node to...
9205 (decl_region::get_svalue_for_constructor): ...this new function.
9206 (decl_region::get_svalue_for_initializer): New.
9207 * store.cc (get_svalue_for_ctor_val): Rewrite in terms of
9208 region_model::get_rvalue.
9209 * store.h (binding_cluster::get_map): New accessor.
9211 2020-08-19 David Malcolm <dmalcolm@redhat.com>
9213 PR analyzer/96648
9214 * region.cc (get_field_at_bit_offset): Gracefully handle negative
9215 values for bit_offset.
9217 2020-08-18 David Malcolm <dmalcolm@redhat.com>
9219 * region-model.cc (region_model::get_rvalue_1): Fix name of local.
9221 2020-08-18 David Malcolm <dmalcolm@redhat.com>
9223 PR analyzer/96641
9224 * region-model.cc (region_model::get_rvalue_1): Handle
9225 unrecognized tree codes by returning "UNKNOWN.
9227 2020-08-18 David Malcolm <dmalcolm@redhat.com>
9229 PR analyzer/96640
9230 * region-model.cc (region_model::get_gassign_result): Handle various
9231 VEC_* tree codes by returning UNKNOWN.
9232 (region_model::on_assignment): Handle unrecognized tree codes by
9233 setting lhs to an unknown value, rather than issuing a "sorry" and
9234 asserting.
9236 2020-08-17 David Malcolm <dmalcolm@redhat.com>
9238 PR analyzer/96644
9239 * region-model-manager.cc (get_region_for_unexpected_tree_code):
9240 Handle ctxt being NULL.
9242 2020-08-17 David Malcolm <dmalcolm@redhat.com>
9244 PR analyzer/96639
9245 * region.cc (region::get_subregions_for_binding): Check for "type"
9246 being NULL.
9248 2020-08-17 David Malcolm <dmalcolm@redhat.com>
9250 PR analyzer/96642
9251 * store.cc (get_svalue_for_ctor_val): New.
9252 (binding_map::apply_ctor_to_region): Call it.
9254 2020-08-14 David Malcolm <dmalcolm@redhat.com>
9256 PR testsuite/96609
9257 PR analyzer/96616
9258 * region-model.cc (region_model::get_store_value): Call
9259 maybe_get_constant_value on decl_regions first.
9260 * region-model.h (decl_region::maybe_get_constant_value): New decl.
9261 * region.cc (decl_region::get_stack_depth): Likewise.
9262 (decl_region::maybe_get_constant_value): New.
9263 * store.cc (get_subregion_within_ctor): New.
9264 (binding_map::apply_ctor_to_region): New.
9265 * store.h (binding_map::apply_ctor_to_region): New decl.
9267 2020-08-14 David Malcolm <dmalcolm@redhat.com>
9269 PR analyzer/96611
9270 * store.cc (store::mark_as_escaped): Reject attempts to
9271 get a cluster for an unknown pointer.
9273 2020-08-13 David Malcolm <dmalcolm@redhat.com>
9275 PR analyzer/93032
9276 PR analyzer/93938
9277 PR analyzer/94011
9278 PR analyzer/94099
9279 PR analyzer/94399
9280 PR analyzer/94458
9281 PR analyzer/94503
9282 PR analyzer/94640
9283 PR analyzer/94688
9284 PR analyzer/94689
9285 PR analyzer/94839
9286 PR analyzer/95026
9287 PR analyzer/95042
9288 PR analyzer/95240
9289 * analyzer-logging.cc: Ignore "-Wformat-diag".
9290 (logger::enter_scope): Use inc_indent in both overloads.
9291 (logger::exit_scope): Use dec_indent.
9292 * analyzer-logging.h (logger::inc_indent): New.
9293 (logger::dec_indent): New.
9294 * analyzer-selftests.cc (run_analyzer_selftests): Call
9295 analyzer_store_cc_tests.
9296 * analyzer-selftests.h (analyzer_store_cc_tests): New decl.
9297 * analyzer.cc (get_stmt_location): New function.
9298 * analyzer.h (class initial_svalue): New forward decl.
9299 (class unaryop_svalue): New forward decl.
9300 (class binop_svalue): New forward decl.
9301 (class sub_svalue): New forward decl.
9302 (class unmergeable_svalue): New forward decl.
9303 (class placeholder_svalue): New forward decl.
9304 (class widening_svalue): New forward decl.
9305 (class compound_svalue): New forward decl.
9306 (class conjured_svalue): New forward decl.
9307 (svalue_set): New typedef.
9308 (class map_region): Delete.
9309 (class array_region): Delete.
9310 (class frame_region): New forward decl.
9311 (class function_region): New forward decl.
9312 (class label_region): New forward decl.
9313 (class decl_region): New forward decl.
9314 (class element_region): New forward decl.
9315 (class offset_region): New forward decl.
9316 (class cast_region): New forward decl.
9317 (class field_region): New forward decl.
9318 (class string_region): New forward decl.
9319 (class region_model_manager): New forward decl.
9320 (class store_manager): New forward decl.
9321 (class store): New forward decl.
9322 (class call_details): New forward decl.
9323 (struct svalue_id_merger_mapping): Delete.
9324 (struct canonicalization): Delete.
9325 (class function_point): New forward decl.
9326 (class engine): New forward decl.
9327 (dump_tree): New function decl.
9328 (print_quoted_type): New function decl.
9329 (readability_comparator): New function decl.
9330 (tree_cmp): New function decl.
9331 (class path_var): Move here from region-model.h
9332 (bit_offset_t, bit_size_t, byte_size_t): New typedefs.
9333 (class region_offset): New class.
9334 (get_stmt_location): New decl.
9335 (struct member_function_hash_traits): New struct.
9336 (class consolidation_map): New class.
9337 Ignore "-Wformat-diag".
9338 * analyzer.opt (-param=analyzer-max-svalue-depth=): New param.
9339 (-param=analyzer-max-enodes-for-full-dump=): New param.
9340 * call-string.cc: Ignore -Wformat-diag.
9341 * checker-path.cc: Move includes of "analyzer/call-string.h" and
9342 "analyzer/program-point.h" to before "analyzer/region-model.h",
9343 and also include "analyzer/store.h" before it.
9344 (state_change_event::state_change_event): Replace "tree var" param
9345 with "const svalue *sval". Convert "origin" param from tree to
9346 "const svalue *".
9347 (state_change_event::get_desc): Call get_representative_tree to
9348 convert the var and origin from const svalue * to tree. Use
9349 svalue::get_desc rather than %qE when describing state changes.
9350 (checker_path::add_final_event): Use get_stmt_location.
9351 * checker-path.h (state_change_event::state_change_event): Port
9352 from tree to const svalue *.
9353 (state_change_event::get_lvalue): Delete.
9354 (state_change_event::get_dest_function): New.
9355 (state_change_event::m_var): Replace with...
9356 (state_change_event::m_sval): ...this.
9357 (state_change_event::m_origin): Convert from tree to
9358 const svalue *.
9359 * constraint-manager.cc: Include "analyzer/call-string.h",
9360 "analyzer/program-point.h", and "analyzer/store.h" before
9361 "analyzer/region-model.h".
9362 (struct bound, struct range): Move to constraint-manager.h.
9363 (compare_constants): New function.
9364 (range::dump): Rename to...
9365 (range::dump_to_pp): ...this. Support NULL constants.
9366 (range::dump): Reintroduce for dumping to stderr.
9367 (range::constrained_to_single_element): Return result, rather than
9368 writing to *OUT.
9369 (range::eval_condition): New.
9370 (range::below_lower_bound): New.
9371 (range::above_upper_bound): New.
9372 (equiv_class::equiv_class): Port from svalue_id to const svalue *.
9373 (equiv_class::print): Likewise.
9374 (equiv_class::hash): Likewise.
9375 (equiv_class::operator==): Port from svalue_id to const svalue *.
9376 (equiv_class::add): Port from svalue_id to const svalue *. Drop
9377 "cm" param.
9378 (equiv_class::del): Port from svalue_id to const svalue *.
9379 (equiv_class::get_representative): Likewise.
9380 (equiv_class::remap_svalue_ids): Delete.
9381 (svalue_id_cmp_by_id): Rename to...
9382 (svalue_cmp_by_ptr): ...this, porting from svalue_id to
9383 const svalue *.
9384 (equiv_class::canonicalize): Update qsort comparator.
9385 (constraint::implied_by): New.
9386 (constraint_manager::constraint_manager): Copy m_mgr in copy ctor.
9387 (constraint_manager::dump_to_pp): Add "multiline" param
9388 (constraint_manager::dump): Pass "true" for "multiline".
9389 (constraint_manager::add_constraint): Port from svalue_id to
9390 const svalue *. Split out second part into...
9391 (constraint_manager::add_unknown_constraint): ...this new
9392 function. Remove self-constraints when merging equivalence
9393 classes.
9394 (constraint_manager::add_constraint_internal): Remove constraints
9395 that would be implied by the new constraint. Port from svalue_id
9396 to const svalue *.
9397 (constraint_manager::get_equiv_class_by_sid): Rename to...
9398 (constraint_manager::get_equiv_class_by_svalue): ...this, porting
9399 from svalue_id to const svalue *.
9400 (constraint_manager::get_or_add_equiv_class): Port from svalue_id
9401 to const svalue *.
9402 (constraint_manager::eval_condition): Make const. Call
9403 compare_constants and return early if it provides a known result.
9404 (constraint_manager::get_ec_bounds): New.
9405 (constraint_manager::eval_condition): New overloads. Make
9406 existing one const, and use compare_constants.
9407 (constraint_manager::purge): Convert "p" param to a template
9408 rather that an abstract base class. Port from svalue_id to
9409 const svalue *.
9410 (class dead_svalue_purger): New class.
9411 (constraint_manager::remap_svalue_ids): Delete.
9412 (constraint_manager::on_liveness_change): New.
9413 (equiv_class_cmp): Port from svalue_id to const svalue *.
9414 (constraint_manager::canonicalize): Likewise. Combine with
9415 purging of redundant equivalence classes and constraints.
9416 (class cleaned_constraint_manager): Delete.
9417 (class merger_fact_visitor): Make "m_cm_b" const. Add "m_merger"
9418 field.
9419 (merger_fact_visitor::fact): Port from svalue_id to const svalue *.
9420 Add special case for widening.
9421 (constraint_manager::merge): Port from svalue_id to const svalue *.
9422 (constraint_manager::clean_merger_input): Delete.
9423 (constraint_manager::for_each_fact): Port from svalue_id to
9424 const svalue *.
9425 (constraint_manager::validate): Likewise.
9426 (selftest::test_constraint_conditions): Provide a
9427 region_model_manager when creating region_model instances.
9428 Add test for self-equality not creating equivalence classes.
9429 (selftest::test_transitivity): Provide a region_model_manager when
9430 creating region_model instances. Verify that EC-merging happens
9431 when constraints are implied.
9432 (selftest::test_constant_comparisons): Provide a
9433 region_model_manager when creating region_model instances.
9434 (selftest::test_constraint_impl): Likewise. Remove over-specified
9435 assertions.
9436 (selftest::test_equality): Provide a region_model_manager when
9437 creating region_model instances.
9438 (selftest::test_many_constants): Likewise. Provide a
9439 program_point when testing merging.
9440 (selftest::run_constraint_manager_tests): Move call to
9441 test_constant_comparisons to outside the transitivity guard.
9442 * constraint-manager.h (struct bound): Move here from
9443 constraint-manager.cc.
9444 (struct range): Likewise.
9445 (struct::eval_condition): New decl.
9446 (struct::below_lower_bound): New decl.
9447 (struct::above_upper_bound): New decl.
9448 (equiv_class::add): Port from svalue_id to const svalue *.
9449 (equiv_class::del): Likewise.
9450 (equiv_class::get_representative): Likewise.
9451 (equiv_class::remap_svalue_ids): Drop.
9452 (equiv_class::m_cst_sid): Convert to..
9453 (equiv_class::m_cst_sval): ...this.
9454 (equiv_class::m_vars): Port from svalue_id to const svalue *.
9455 (constraint::bool implied_by): New decl.
9456 (fact_visitor::on_fact): Port from svalue_id to const svalue *.
9457 (constraint_manager::constraint_manager): Add mgr param.
9458 (constraint_manager::clone): Delete.
9459 (constraint_manager::maybe_get_constant): Delete.
9460 (constraint_manager::get_sid_for_constant): Delete.
9461 (constraint_manager::get_num_svalues): Delete.
9462 (constraint_manager::dump_to_pp): Add "multiline" param.
9463 (constraint_manager::get_equiv_class): Port from svalue_id to
9464 const svalue *.
9465 (constraint_manager::add_constraint): Likewise.
9466 (constraint_manager::get_equiv_class_by_sid): Rename to...
9467 (constraint_manager::get_equiv_class_by_svalue): ...this, porting
9468 from svalue_id to const svalue *.
9469 (constraint_manager::add_unknown_constraint): New decl.
9470 (constraint_manager::get_or_add_equiv_class): Port from svalue_id
9471 to const svalue *.
9472 (constraint_manager::eval_condition): Likewise. Add overloads.
9473 (constraint_manager::get_ec_bounds): New decl.
9474 (constraint_manager::purge): Convert to template.
9475 (constraint_manager::remap_svalue_ids): Delete.
9476 (constraint_manager::on_liveness_change): New decl.
9477 (constraint_manager::canonicalize): Drop param.
9478 (constraint_manager::clean_merger_input): Delete.
9479 (constraint_manager::m_mgr): New field.
9480 * diagnostic-manager.cc: Move includes of
9481 "analyzer/call-string.h" and "analyzer/program-point.h" to before
9482 "analyzer/region-model.h", and also include "analyzer/store.h"
9483 before it.
9484 (saved_diagnostic::saved_diagnostic): Add "sval" param.
9485 (diagnostic_manager::diagnostic_manager): Add engine param.
9486 (diagnostic_manager::add_diagnostic): Add "sval" param, passing it
9487 to saved_diagnostic ctor. Update overload to pass NULL for it.
9488 (dedupe_winners::dedupe_winners): Add engine param.
9489 (dedupe_winners::add): Add "eg" param. Pass m_engine to
9490 feasible_p.
9491 (dedupe_winner::m_engine): New field.
9492 (diagnostic_manager::emit_saved_diagnostics): Pass engine to
9493 dedupe_winners. Pass &eg when adding candidates. Pass svalue
9494 rather than tree to prune_path. Use get_stmt_location to get
9495 primary location of diagnostic.
9496 (diagnostic_manager::emit_saved_diagnostic): Likewise.
9497 (get_any_origin): Drop.
9498 (state_change_event_creator::on_global_state_change): Pass NULL
9499 const svalue * rather than NULL_TREE trees to state_change_event
9500 ctor.
9501 (state_change_event_creator::on_state_change): Port from tree and
9502 svalue_id to const svalue *.
9503 (for_each_state_change): Port from svalue_id to const svalue *.
9504 (struct null_assignment_sm_context): New.
9505 (diagnostic_manager::add_events_for_eedge): Add state change
9506 events for assignment to NULL.
9507 (diagnostic_manager::prune_path): Update param from tree to
9508 const svalue *.
9509 (diagnostic_manager::prune_for_sm_diagnostic): Port from tracking
9510 by tree to by const svalue *.
9511 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Add sval
9512 param.
9513 (saved_diagnostic::m_sval): New field.
9514 (diagnostic_manager::diagnostic_manager): Add engine param.
9515 (diagnostic_manager::get_engine): New.
9516 (diagnostic_manager::add_diagnostic): Add "sval" param.
9517 (diagnostic_manager::prune_path): Likewise.
9518 (diagnostic_manager::prune_for_sm_diagnostic): New overload.
9519 (diagnostic_manager::m_eng): New field.
9520 * engine.cc: Move includes of "analyzer/call-string.h" and
9521 "analyzer/program-point.h" to before "analyzer/region-model.h",
9522 and also include "analyzer/store.h" before it.
9523 (impl_region_model_context::impl_region_model_context): Update for
9524 removal of m_change field.
9525 (impl_region_model_context::remap_svalue_ids): Delete.
9526 (impl_region_model_context::on_svalue_leak): New.
9527 (impl_region_model_context::on_svalue_purge): Delete.
9528 (impl_region_model_context::on_liveness_change): New.
9529 (impl_region_model_context::on_unknown_change): Update param
9530 from svalue_id to const svalue *. Add is_mutable param.
9531 (setjmp_svalue::compare_fields): Delete.
9532 (setjmp_svalue::accept): New.
9533 (setjmp_svalue::add_to_hash): Delete.
9534 (setjmp_svalue::dump_to_pp): New.
9535 (setjmp_svalue::print_details): Delete.
9536 (impl_sm_context::impl_sm_context): Drop "change" param.
9537 (impl_sm_context::get_fndecl_for_call): Drop "m_change".
9538 (impl_sm_context::on_transition): Drop ATTRIBUTE_UNUSED from
9539 "stmt" param. Drop m_change. Port from svalue_id to
9540 const svalue *.
9541 (impl_sm_context::warn_for_state): Drop m_change. Port from
9542 svalue_id to const svalue *.
9543 (impl_sm_context::get_readable_tree): Rename to...
9544 (impl_sm_context::get_diagnostic_tree): ...this. Port from
9545 svalue_id to const svalue *.
9546 (impl_sm_context::is_zero_assignment): New.
9547 (impl_sm_context::m_change): Delete field.
9548 (leak_stmt_finder::find_stmt): Handle m_var being NULL.
9549 (readability): Increase penalty for MEM_REF. For SSA_NAMEs,
9550 slightly favor the underlying var over the SSA name. Heavily
9551 penalize temporaries. Handle RESULT_DECL.
9552 (readability_comparator): Make non-static. Consider stack depths.
9553 (impl_region_model_context::on_state_leak): Convert from svalue_id
9554 to const svalue *, updating for region_model changes. Use
9555 id_equal.
9556 (impl_region_model_context::on_inherited_svalue): Delete.
9557 (impl_region_model_context::on_cast): Delete.
9558 (impl_region_model_context::on_condition): Drop m_change.
9559 (impl_region_model_context::on_phi): Likewise.
9560 (impl_region_model_context::on_unexpected_tree_code): Handle t
9561 being NULL.
9562 (point_and_state::validate): Update stack checking for
9563 region_model changes.
9564 (eg_traits::dump_args_t::show_enode_details_p): New.
9565 (exploded_node::exploded_node): Initialize m_num_processed_stmts.
9566 (exploded_node::get_processed_stmt): New function.
9567 (exploded_node::get_dot_fillcolor): Add more colors.
9568 (exploded_node::dump_dot): Guard the printing of the point and
9569 state with show_enode_details_p. Print the processed stmts for
9570 this enode after the initial state.
9571 (exploded_node::dump_to_pp): Pass true for new multiline param
9572 of program_state::dump_to_pp.
9573 (exploded_node::on_stmt): Drop "change" param. Log the stmt.
9574 Set input_location. Implement __analyzer_describe. Update
9575 implementation of __analyzer_dump and __analyzer_eval.
9576 Remove purging of sm-state for unknown fncalls from here.
9577 (exploded_node::on_edge): Drop "change" param.
9578 (exploded_node::on_longjmp): Port from region_id/svalue_id to
9579 const region */const svalue *. Call program_state::detect_leaks.
9580 Drop state_change.
9581 (exploded_node::detect_leaks): Update for changes to region_model.
9582 Call program_state::detect_leaks.
9583 (exploded_edge::exploded_edge): Drop ext_state and change params.
9584 (exploded_edge::dump_dot): "args" is no longer used. Drop dumping
9585 of m_change.
9586 (exploded_graph::exploded_graph): Pass engine to
9587 m_diagnostic_manager ctor. Use program_point::origin.
9588 (exploded_graph::add_function_entry): Drop ctxt. Use
9589 program_state::push_frame. Drop state_change.
9590 (exploded_graph::get_or_create_node): Drop "change" param. Add
9591 "enode_for_diag" param. Update dumping calls for API changes.
9592 Pass point to can_merge_with_p. Show enode indices
9593 within -Wanalyzer-too-complex diagnostic for hitting the per-point
9594 limit.
9595 (exploded_graph::add_edge): Drop "change" param. Log which nodes
9596 are being connected. Update for changes to exploded_edge ctor.
9597 (exploded_graph::get_per_program_point_data): New.
9598 (exploded_graph::process_worklist): Pass point to
9599 can_merge_with_p. Drop state_change. Update dumping call for API
9600 change.
9601 (exploded_graph::process_node): Drop state_change. Split the
9602 node in-place if an sm-state-change occurs. Update
9603 m_num_processed_stmts. Update dumping calls for API change.
9604 (exploded_graph::log_stats): Call engine::log_stats.
9605 (exploded_graph::dump_states_for_supernode): Update dumping
9606 call.
9607 (exploded_path::feasible_p): Add "eng" and "eg" params.
9608 Rename "i" to "end_idx". Pass the manager to the region_model
9609 ctor. Update for every processed stmt in the enode, not just the
9610 first. Keep track of which snodes have been visited, and call
9611 loop_replay_fixup when revisiting one.
9612 (enode_label::get_text): Update dump call for new param.
9613 (exploded_graph::dump_exploded_nodes): Likewise.
9614 (exploded_graph::get_node_by_index): New.
9615 (impl_run_checkers): Create engine instance and pass its address
9616 to extrinsic_state ctor.
9617 * exploded-graph.h
9618 (impl_region_model_context::impl_region_model_context): Drop
9619 "change" params.
9620 (impl_region_model_context::void remap_svalue_ids): Delete.
9621 (impl_region_model_context::on_svalue_purge): Delete.
9622 (impl_region_model_context::on_svalue_leak): New.
9623 (impl_region_model_context::on_liveness_change): New.
9624 (impl_region_model_context::on_state_leak): Update signature.
9625 (impl_region_model_context::on_inherited_svalue): Delete.
9626 (impl_region_model_context::on_cast): Delete.
9627 (impl_region_model_context::on_unknown_change): Update signature.
9628 (impl_region_model_context::m_change): Delete.
9629 (eg_traits::dump_args_t::show_enode_details_p): New.
9630 (exploded_node::on_stmt): Drop "change" param.
9631 (exploded_node::on_edge): Likewise.
9632 (exploded_node::get_processed_stmt): New decl.
9633 (exploded_node::m_num_processed_stmts): New field.
9634 (exploded_edge::exploded_edge): Drop ext_state and change params.
9635 (exploded_edge::m_change): Delete.
9636 (exploded_graph::get_engine): New accessor.
9637 (exploded_graph::get_or_create_node): Drop "change" param. Add
9638 "enode_for_diag" param.
9639 (exploded_graph::add_edge): Drop "change" param.
9640 (exploded_graph::get_per_program_point_data): New decl.
9641 (exploded_graph::get_node_by_index): New decl.
9642 (exploded_path::feasible_p): Add "eng" and "eg" params.
9643 * program-point.cc: Include "analyzer/store.h" before including
9644 "analyzer/region-model.h".
9645 (function_point::function_point): Move here from
9646 program-point.h.
9647 (function_point::get_function): Likewise.
9648 (function_point::from_function_entry): Likewise.
9649 (function_point::before_supernode): Likewise.
9650 (function_point::next_stmt): New function.
9651 * program-point.h (function_point::function_point): Move
9652 implementation from here to program-point.cc.
9653 (function_point::get_function): Likewise.
9654 (function_point::from_function_entry): Likewise.
9655 (function_point::before_supernode): Likewise.
9656 (function_point::next_stmt): New decl.
9657 (program_point::operator!=): New.
9658 (program_point::origin): New.
9659 (program_point::next_stmt): New.
9660 (program_point::m_function_point): Make non-const.
9661 * program-state.cc: Move includes of "analyzer/call-string.h" and
9662 "analyzer/program-point.h" to before "analyzer/region-model.h",
9663 and also include "analyzer/store.h" before it.
9664 (extrinsic_state::get_model_manager): New.
9665 (sm_state_map::sm_state_map): Pass in sm and sm_idx to ctor,
9666 rather than pass the around.
9667 (sm_state_map::clone_with_remapping): Delete.
9668 (sm_state_map::print): Remove "sm" param in favor of "m_sm". Add
9669 "simple" and "multiline" params and support multiline vs single
9670 line dumping.
9671 (sm_state_map::dump): Remove "sm" param in favor of "m_sm". Add
9672 "simple" param.
9673 (sm_state_map::hash): Port from svalue_id to const svalue *.
9674 (sm_state_map::operator==): Likewise.
9675 (sm_state_map::get_state): Likewise. Call canonicalize_svalue on
9676 input. Handle inheritance of sm-state. Call get_default_state.
9677 (sm_state_map::get_origin): Port from svalue_id to const svalue *.
9678 (sm_state_map::set_state): Likewise. Pass in ext_state. Reject
9679 attempts to set state on UNKNOWN.
9680 (sm_state_map::impl_set_state): Port from svalue_id to
9681 const svalue *. Pass in ext_state. Call canonicalize_svalue on
9682 input.
9683 (sm_state_map::purge_for_unknown_fncall): Delete.
9684 (sm_state_map::on_svalue_leak): New.
9685 (sm_state_map::remap_svalue_ids): Delete.
9686 (sm_state_map::on_liveness_change): New.
9687 (sm_state_map::on_unknown_change): Reimplement.
9688 (sm_state_map::on_svalue_purge): Delete.
9689 (sm_state_map::on_inherited_svalue): Delete.
9690 (sm_state_map::on_cast): Delete.
9691 (sm_state_map::validate): Delete.
9692 (sm_state_map::canonicalize_svalue): New.
9693 (program_state::program_state): Update to pass manager to
9694 region_model's ctor. Constify num_states and pass state machine
9695 and index to sm_state_map ctor.
9696 (program_state::print): Update for changes to dump API.
9697 (program_state::dump_to_pp): Ignore the summarize param. Add
9698 "multiline" param.
9699 (program_state::dump_to_file): Add "multiline" param.
9700 (program_state::dump): Pass "true" for new "multiline" param.
9701 (program_state::push_frame): New.
9702 (program_state::on_edge): Drop "change" param. Call
9703 program_state::detect_leaks.
9704 (program_state::prune_for_point): Add enode_for_diag param.
9705 Reimplement based on store class. Call detect_leaks
9706 (program_state::remap_svalue_ids): Delete.
9707 (program_state::get_representative_tree): Port from svalue_id to
9708 const svalue *.
9709 (program_state::can_merge_with_p): Add "point" param. Add early
9710 reject for sm-differences. Drop id remapping.
9711 (program_state::validate): Drop region model and sm_state_map
9712 validation.
9713 (state_change::sm_change::dump): Delete.
9714 (state_change::sm_change::remap_svalue_ids): Delete.
9715 (state_change::sm_change::on_svalue_purge): Delete.
9716 (log_set_of_svalues): New.
9717 (state_change::sm_change::validate): Delete.
9718 (state_change::state_change): Delete.
9719 (state_change::add_sm_change): Delete.
9720 (state_change::affects_p): Delete.
9721 (state_change::dump): Delete.
9722 (state_change::remap_svalue_ids): Delete.
9723 (state_change::on_svalue_purge): Delete.
9724 (state_change::validate): Delete.
9725 (selftest::assert_dump_eq): Delete.
9726 (ASSERT_DUMP_EQ): Delete.
9727 (selftest::test_sm_state_map): Update for changes to region_model
9728 and sm_state_map, porting from svalue_id to const svalue *.
9729 (selftest::test_program_state_dumping): Likewise. Drop test of
9730 dumping, renaming to...
9731 (selftest::test_program_state_1): ...this.
9732 (selftest::test_program_state_dumping_2): Likewise, renaming to...
9733 (selftest::test_program_state_2): ...this.
9734 (selftest::test_program_state_merging): Update for changes to
9735 region_model.
9736 (selftest::test_program_state_merging_2): Likewise.
9737 (selftest::analyzer_program_state_cc_tests): Update for renamed
9738 tests.
9739 * program-state.h (extrinsic_state::extrinsic_state): Add logger
9740 and engine params.
9741 (extrinsic_state::get_logger): New accessor.
9742 (extrinsic_state::get_engine): New accessor.
9743 (extrinsic_state::get_model_manager): New accessor.
9744 (extrinsic_state::m_logger): New field.
9745 (extrinsic_state::m_engine): New field.
9746 (struct default_hash_traits<svalue_id>): Delete.
9747 (pod_hash_traits<svalue_id>::hash): Delete.
9748 (pod_hash_traits<svalue_id>::equal): Delete.
9749 (pod_hash_traits<svalue_id>::mark_deleted): Delete.
9750 (pod_hash_traits<svalue_id>::mark_empty): Delete.
9751 (pod_hash_traits<svalue_id>::is_deleted): Delete.
9752 (pod_hash_traits<svalue_id>::is_empty): Delete.
9753 (sm_state_map::entry_t::entry_t): Port from svalue_id to
9754 const svalue *.
9755 (sm_state_map::entry_t::m_origin): Likewise.
9756 (sm_state_map::map_t): Likewise.
9757 (sm_state_map::sm_state_map): Add state_machine and index params.
9758 (sm_state_map::clone_with_remapping): Delete.
9759 (sm_state_map::print): Drop sm param; add simple and multiline
9760 params.
9761 (sm_state_map::dump): Drop sm param; add simple param.
9762 (sm_state_map::get_state): Port from svalue_id to const svalue *.
9763 Add ext_state param.
9764 (sm_state_map::get_origin): Likewise.
9765 (sm_state_map::set_state): Likewise.
9766 (sm_state_map::impl_set_state): Likewise.
9767 (sm_state_map::purge_for_unknown_fncall): Delete.
9768 (sm_state_map::remap_svalue_ids): Delete.
9769 (sm_state_map::on_svalue_purge): Delete.
9770 (sm_state_map::on_svalue_leak): New.
9771 (sm_state_map::on_liveness_change): New.
9772 (sm_state_map::on_inherited_svalue): Delete.
9773 (sm_state_map::on_cast): Delete.
9774 (sm_state_map::validate): Delete.
9775 (sm_state_map::on_unknown_change): Port from svalue_id to
9776 const svalue *. Add is_mutable and ext_state params.
9777 (sm_state_map::canonicalize_svalue): New.
9778 (sm_state_map::m_sm): New field.
9779 (sm_state_map::m_sm_idx): New field.
9780 (program_state::operator=): Delete.
9781 (program_state::dump_to_pp): Drop "summarize" param, adding
9782 "simple" and "multiline".
9783 (program_state::dump_to_file): Likewise.
9784 (program_state::dump): Rename "summarize" to "simple".
9785 (program_state::push_frame): New.
9786 (program_state::get_current_function): New.
9787 (program_state::on_edge): Drop "change" param.
9788 (program_state::prune_for_point): Likewise. Add enode_for_diag
9789 param.
9790 (program_state::remap_svalue_ids): Delete.
9791 (program_state::get_representative_tree): Port from svalue_id to
9792 const svalue *.
9793 (program_state::can_purge_p): Likewise. Pass ext_state to get_state.
9794 (program_state::can_merge_with_p): Add point param.
9795 (program_state::detect_leaks): New.
9796 (state_change_visitor::on_state_change): Port from tree and
9797 svalue_id to a pair of const svalue *.
9798 (class state_change): Delete.
9799 * region.cc: New file.
9800 * region-model-impl-calls.cc: New file.
9801 * region-model-manager.cc: New file.
9802 * region-model-reachability.cc: New file.
9803 * region-model-reachability.h: New file.
9804 * region-model.cc: Include "analyzer/call-string.h",
9805 "analyzer/program-point.h", and "analyzer/store.h" before
9806 "analyzer/region-model.h". Include
9807 "analyzer/region-model-reachability.h".
9808 (dump_tree): Make non-static.
9809 (dump_quoted_tree): Make non-static.
9810 (print_quoted_type): Make non-static.
9811 (path_var::dump): Delete.
9812 (dump_separator): Delete.
9813 (class impl_constraint_manager): Delete.
9814 (svalue_id::print): Delete.
9815 (svalue_id::dump_node_name_to_pp): Delete.
9816 (svalue_id::validate): Delete.
9817 (region_id::print): Delete.
9818 (region_id::dump_node_name_to_pp): Delete.
9819 (region_id::validate): Delete.
9820 (region_id_set::region_id_set): Delete.
9821 (svalue_id_set::svalue_id_set): Delete.
9822 (svalue::operator==): Delete.
9823 (svalue::hash): Delete.
9824 (svalue::print): Delete.
9825 (svalue::dump_dot_to_pp): Delete.
9826 (svalue::remap_region_ids): Delete.
9827 (svalue::walk_for_canonicalization): Delete.
9828 (svalue::get_child_sid): Delete.
9829 (svalue::maybe_get_constant): Delete.
9830 (region_svalue::compare_fields): Delete.
9831 (region_svalue::add_to_hash): Delete.
9832 (region_svalue::print_details): Delete.
9833 (region_svalue::dump_dot_to_pp): Delete.
9834 (region_svalue::remap_region_ids): Delete.
9835 (region_svalue::merge_values): Delete.
9836 (region_svalue::walk_for_canonicalization): Delete.
9837 (region_svalue::eval_condition): Delete.
9838 (constant_svalue::compare_fields): Delete.
9839 (constant_svalue::add_to_hash): Delete.
9840 (constant_svalue::merge_values): Delete.
9841 (constant_svalue::eval_condition): Move to svalue.cc.
9842 (constant_svalue::print_details): Delete.
9843 (constant_svalue::get_child_sid): Delete.
9844 (unknown_svalue::compare_fields): Delete.
9845 (unknown_svalue::add_to_hash): Delete.
9846 (unknown_svalue::print_details): Delete.
9847 (poison_kind_to_str): Move to svalue.cc.
9848 (poisoned_svalue::compare_fields): Delete.
9849 (poisoned_svalue::add_to_hash): Delete.
9850 (poisoned_svalue::print_details): Delete.
9851 (region_kind_to_str): Move to region.cc and reimplement.
9852 (region::operator==): Delete.
9853 (region::get_parent_region): Delete.
9854 (region::set_value): Delete.
9855 (region::become_active_view): Delete.
9856 (region::deactivate_any_active_view): Delete.
9857 (region::deactivate_view): Delete.
9858 (region::get_value): Delete.
9859 (region::get_inherited_child_sid): Delete.
9860 (region_model::copy_region): Delete.
9861 (region_model::copy_struct_region): Delete.
9862 (region_model::copy_union_region): Delete.
9863 (region_model::copy_array_region): Delete.
9864 (region::hash): Delete.
9865 (region::print): Delete.
9866 (region::dump_dot_to_pp): Delete.
9867 (region::dump_to_pp): Delete.
9868 (region::dump_child_label): Delete.
9869 (region::validate): Delete.
9870 (region::remap_svalue_ids): Delete.
9871 (region::remap_region_ids): Delete.
9872 (region::add_view): Delete.
9873 (region::get_view): Delete.
9874 (region::region): Move to region.cc.
9875 (region::add_to_hash): Delete.
9876 (region::print_fields): Delete.
9877 (region::non_null_p): Delete.
9878 (primitive_region::clone): Delete.
9879 (primitive_region::walk_for_canonicalization): Delete.
9880 (map_region::map_region): Delete.
9881 (map_region::compare_fields): Delete.
9882 (map_region::print_fields): Delete.
9883 (map_region::validate): Delete.
9884 (map_region::dump_dot_to_pp): Delete.
9885 (map_region::dump_child_label): Delete.
9886 (map_region::get_or_create): Delete.
9887 (map_region::get): Delete.
9888 (map_region::add_to_hash): Delete.
9889 (map_region::remap_region_ids): Delete.
9890 (map_region::unbind): Delete.
9891 (map_region::get_tree_for_child_region): Delete.
9892 (map_region::get_tree_for_child_region): Delete.
9893 (tree_cmp): Move to region.cc.
9894 (map_region::can_merge_p): Delete.
9895 (map_region::walk_for_canonicalization): Delete.
9896 (map_region::get_value_by_name): Delete.
9897 (struct_or_union_region::valid_key_p): Delete.
9898 (struct_or_union_region::compare_fields): Delete.
9899 (struct_region::clone): Delete.
9900 (struct_region::compare_fields): Delete.
9901 (union_region::clone): Delete.
9902 (union_region::compare_fields): Delete.
9903 (frame_region::compare_fields): Delete.
9904 (frame_region::clone): Delete.
9905 (frame_region::valid_key_p): Delete.
9906 (frame_region::print_fields): Delete.
9907 (frame_region::add_to_hash): Delete.
9908 (globals_region::compare_fields): Delete.
9909 (globals_region::clone): Delete.
9910 (globals_region::valid_key_p): Delete.
9911 (code_region::compare_fields): Delete.
9912 (code_region::clone): Delete.
9913 (code_region::valid_key_p): Delete.
9914 (array_region::array_region): Delete.
9915 (array_region::get_element): Delete.
9916 (array_region::clone): Delete.
9917 (array_region::compare_fields): Delete.
9918 (array_region::print_fields): Delete.
9919 (array_region::validate): Delete.
9920 (array_region::dump_dot_to_pp): Delete.
9921 (array_region::dump_child_label): Delete.
9922 (array_region::get_or_create): Delete.
9923 (array_region::get): Delete.
9924 (array_region::add_to_hash): Delete.
9925 (array_region::remap_region_ids): Delete.
9926 (array_region::get_key_for_child_region): Delete.
9927 (array_region::key_cmp): Delete.
9928 (array_region::walk_for_canonicalization): Delete.
9929 (array_region::key_from_constant): Delete.
9930 (array_region::constant_from_key): Delete.
9931 (function_region::compare_fields): Delete.
9932 (function_region::clone): Delete.
9933 (function_region::valid_key_p): Delete.
9934 (stack_region::stack_region): Delete.
9935 (stack_region::compare_fields): Delete.
9936 (stack_region::clone): Delete.
9937 (stack_region::print_fields): Delete.
9938 (stack_region::dump_child_label): Delete.
9939 (stack_region::validate): Delete.
9940 (stack_region::push_frame): Delete.
9941 (stack_region::get_current_frame_id): Delete.
9942 (stack_region::pop_frame): Delete.
9943 (stack_region::add_to_hash): Delete.
9944 (stack_region::remap_region_ids): Delete.
9945 (stack_region::can_merge_p): Delete.
9946 (stack_region::walk_for_canonicalization): Delete.
9947 (stack_region::get_value_by_name): Delete.
9948 (heap_region::heap_region): Delete.
9949 (heap_region::compare_fields): Delete.
9950 (heap_region::clone): Delete.
9951 (heap_region::walk_for_canonicalization): Delete.
9952 (root_region::root_region): Delete.
9953 (root_region::compare_fields): Delete.
9954 (root_region::clone): Delete.
9955 (root_region::print_fields): Delete.
9956 (root_region::validate): Delete.
9957 (root_region::dump_child_label): Delete.
9958 (root_region::push_frame): Delete.
9959 (root_region::get_current_frame_id): Delete.
9960 (root_region::pop_frame): Delete.
9961 (root_region::ensure_stack_region): Delete.
9962 (root_region::get_stack_region): Delete.
9963 (root_region::ensure_globals_region): Delete.
9964 (root_region::get_code_region): Delete.
9965 (root_region::ensure_code_region): Delete.
9966 (root_region::get_globals_region): Delete.
9967 (root_region::ensure_heap_region): Delete.
9968 (root_region::get_heap_region): Delete.
9969 (root_region::remap_region_ids): Delete.
9970 (root_region::can_merge_p): Delete.
9971 (root_region::add_to_hash): Delete.
9972 (root_region::walk_for_canonicalization): Delete.
9973 (root_region::get_value_by_name): Delete.
9974 (symbolic_region::symbolic_region): Delete.
9975 (symbolic_region::compare_fields): Delete.
9976 (symbolic_region::clone): Delete.
9977 (symbolic_region::walk_for_canonicalization): Delete.
9978 (symbolic_region::print_fields): Delete.
9979 (region_model::region_model): Add region_model_manager * param.
9980 Reimplement in terms of store, dropping impl_constraint_manager
9981 subclass.
9982 (region_model::operator=): Reimplement in terms of store
9983 (region_model::operator==): Likewise.
9984 (region_model::hash): Likewise.
9985 (region_model::print): Delete.
9986 (region_model::print_svalue): Delete.
9987 (region_model::dump_dot_to_pp): Delete.
9988 (region_model::dump_dot_to_file): Delete.
9989 (region_model::dump_dot): Delete.
9990 (region_model::dump_to_pp): Replace "summarize" param with
9991 "simple" and "multiline". Port to store-based implementation.
9992 (region_model::dump): Replace "summarize" param with "simple" and
9993 "multiline".
9994 (dump_vec_of_tree): Delete.
9995 (region_model::dump_summary_of_rep_path_vars): Delete.
9996 (region_model::validate): Delete.
9997 (svalue_id_cmp_by_constant_svalue_model): Delete.
9998 (svalue_id_cmp_by_constant_svalue): Delete.
9999 (region_model::canonicalize): Drop "ctxt" param. Reimplement in
10000 terms of store and constraints.
10001 (region_model::canonicalized_p): Remove NULL arg to canonicalize.
10002 (region_model::loop_replay_fixup): New.
10003 (poisoned_value_diagnostic::emit): Tweak wording of warnings.
10004 (region_model::check_for_poison): Delete.
10005 (region_model::get_gassign_result): New.
10006 (region_model::on_assignment): Port to store-based implementation.
10007 (region_model::on_call_pre): Delete calls to check_for_poison.
10008 Move implementations to region-model-impl-calls.c and port to
10009 store-based implementation.
10010 (region_model::on_call_post): Likewise.
10011 (class reachable_regions): Move to region-model-reachability.h/cc
10012 and port to store-based implementation.
10013 (region_model::handle_unrecognized_call): Port to store-based
10014 implementation.
10015 (region_model::get_reachable_svalues): New.
10016 (region_model::on_setjmp): Port to store-based implementation.
10017 (region_model::on_longjmp): Likewise.
10018 (region_model::handle_phi): Drop is_back_edge param and the logic
10019 using it.
10020 (region_model::get_lvalue_1): Port from region_id to const region *.
10021 (region_model::make_region_for_unexpected_tree_code): Delete.
10022 (assert_compat_types): If the check fails, use internal_error to
10023 show the types.
10024 (region_model::get_lvalue): Port from region_id to const region *.
10025 (region_model::get_rvalue_1): Port from svalue_id to const svalue *.
10026 (region_model::get_rvalue): Likewise.
10027 (region_model::get_or_create_ptr_svalue): Delete.
10028 (region_model::get_or_create_constant_svalue): Delete.
10029 (region_model::get_svalue_for_fndecl): Delete.
10030 (region_model::get_region_for_fndecl): Delete.
10031 (region_model::get_svalue_for_label): Delete.
10032 (region_model::get_region_for_label): Delete.
10033 (build_cast): Delete.
10034 (region_model::maybe_cast_1): Delete.
10035 (region_model::maybe_cast): Delete.
10036 (region_model::get_field_region): Delete.
10037 (region_model::get_store_value): New.
10038 (region_model::region_exists_p): New.
10039 (region_model::deref_rvalue): Port from svalue_id to const svalue *.
10040 (region_model::set_value): Likewise.
10041 (region_model::clobber_region): New.
10042 (region_model::purge_region): New.
10043 (region_model::zero_fill_region): New.
10044 (region_model::mark_region_as_unknown): New.
10045 (region_model::eval_condition): Port from svalue_id to
10046 const svalue *.
10047 (region_model::eval_condition_without_cm): Likewise.
10048 (region_model::compare_initial_and_pointer): New.
10049 (region_model::add_constraint): Port from svalue_id to
10050 const svalue *.
10051 (region_model::maybe_get_constant): Delete.
10052 (region_model::get_representative_path_var): New.
10053 (region_model::add_new_malloc_region): Delete.
10054 (region_model::get_representative_tree): Port to const svalue *.
10055 (region_model::get_representative_path_var): Port to
10056 const region *.
10057 (region_model::get_path_vars_for_svalue): Delete.
10058 (region_model::set_to_new_unknown_value): Delete.
10059 (region_model::update_for_phis): Don't pass is_back_edge to handle_phi.
10060 (region_model::update_for_call_superedge): Port from svalue_id to
10061 const svalue *.
10062 (region_model::update_for_return_superedge): Port to store-based
10063 implementation.
10064 (region_model::update_for_call_summary): Replace
10065 set_to_new_unknown_value with mark_region_as_unknown.
10066 (region_model::get_root_region): Delete.
10067 (region_model::get_stack_region_id): Delete.
10068 (region_model::push_frame): Delete.
10069 (region_model::get_current_frame_id): Delete.
10070 (region_model::get_current_function): Delete.
10071 (region_model::pop_frame): Delete.
10072 (region_model::on_top_level_param): New.
10073 (region_model::get_stack_depth): Delete.
10074 (region_model::get_function_at_depth): Delete.
10075 (region_model::get_globals_region_id): Delete.
10076 (region_model::add_svalue): Delete.
10077 (region_model::replace_svalue): Delete.
10078 (region_model::add_region): Delete.
10079 (region_model::get_svalue): Delete.
10080 (region_model::get_region): Delete.
10081 (make_region_for_type): Delete.
10082 (region_model::add_region_for_type): Delete.
10083 (region_model::on_top_level_param): New.
10084 (class restrict_to_used_svalues): Delete.
10085 (region_model::purge_unused_svalues): Delete.
10086 (region_model::push_frame): New.
10087 (region_model::remap_svalue_ids): Delete.
10088 (region_model::remap_region_ids): Delete.
10089 (region_model::purge_regions): Delete.
10090 (region_model::get_descendents): Delete.
10091 (region_model::delete_region_and_descendents): Delete.
10092 (region_model::poison_any_pointers_to_bad_regions): Delete.
10093 (region_model::can_merge_with_p): Delete.
10094 (region_model::get_current_function): New.
10095 (region_model::get_value_by_name): Delete.
10096 (region_model::convert_byte_offset_to_array_index): Delete.
10097 (region_model::pop_frame): New.
10098 (region_model::get_or_create_mem_ref): Delete.
10099 (region_model::get_stack_depth): New.
10100 (region_model::get_frame_at_index): New.
10101 (region_model::unbind_region_and_descendents): New.
10102 (struct bad_pointer_finder): New.
10103 (region_model::get_or_create_pointer_plus_expr): Delete.
10104 (region_model::poison_any_pointers_to_descendents): New.
10105 (region_model::get_or_create_view): Delete.
10106 (region_model::can_merge_with_p): New.
10107 (region_model::get_fndecl_for_call): Port from svalue_id to
10108 const svalue *.
10109 (struct append_ssa_names_cb_data): New.
10110 (get_ssa_name_regions_for_current_frame): New.
10111 (region_model::append_ssa_names_cb): New.
10112 (model_merger::dump_to_pp): Add "simple" param. Drop dumping of
10113 remappings.
10114 (model_merger::dump): Add "simple" param to both overloads.
10115 (model_merger::can_merge_values_p): Delete.
10116 (model_merger::record_regions): Delete.
10117 (model_merger::record_svalues): Delete.
10118 (svalue_id_merger_mapping::svalue_id_merger_mapping): Delete.
10119 (svalue_id_merger_mapping::dump_to_pp): Delete.
10120 (svalue_id_merger_mapping::dump): Delete.
10121 (region_model::create_region_for_heap_alloc): New.
10122 (region_model::create_region_for_alloca): New.
10123 (region_model::record_dynamic_extents): New.
10124 (canonicalization::canonicalization): Delete.
10125 (canonicalization::walk_rid): Delete.
10126 (canonicalization::walk_sid): Delete.
10127 (canonicalization::dump_to_pp): Delete.
10128 (canonicalization::dump): Delete.
10129 (inchash::add): Delete overloads for svalue_id and region_id.
10130 (engine::log_stats): New.
10131 (assert_condition): Add overload comparing svalues.
10132 (assert_dump_eq): Pass "true" for multiline.
10133 (selftest::test_dump): Update for rewrite of region_model.
10134 (selftest::test_dump_2): Rename to...
10135 (selftest::test_struct): ...this. Provide a region_model_manager
10136 when creating region_model instance. Remove dump test. Add
10137 checks for get_offset.
10138 (selftest::test_dump_3): Rename to...
10139 (selftest::test_array_1): ...this. Provide a region_model_manager
10140 when creating region_model instance. Remove dump test.
10141 (selftest::test_get_representative_tree): Port from svalue_id to
10142 new API. Add test coverage for various expressions.
10143 (selftest::test_unique_constants): Provide a region_model_manager
10144 for the region_model. Add test coverage for comparing const vs
10145 non-const.
10146 (selftest::test_svalue_equality): Delete.
10147 (selftest::test_region_equality): Delete.
10148 (selftest::test_unique_unknowns): New.
10149 (class purge_all_svalue_ids): Delete.
10150 (class purge_one_svalue_id): Delete.
10151 (selftest::test_purging_by_criteria): Delete.
10152 (selftest::test_initial_svalue_folding): New.
10153 (selftest::test_unaryop_svalue_folding): New.
10154 (selftest::test_binop_svalue_folding): New.
10155 (selftest::test_sub_svalue_folding): New.
10156 (selftest::test_purge_unused_svalues): Delete.
10157 (selftest::test_descendent_of_p): New.
10158 (selftest::test_assignment): Provide a region_model_manager for
10159 the region_model. Drop the dump test.
10160 (selftest::test_compound_assignment): Likewise.
10161 (selftest::test_stack_frames): Port to new implementation.
10162 (selftest::test_get_representative_path_var): Likewise.
10163 (selftest::test_canonicalization_1): Rename to...
10164 (selftest::test_equality_1): ...this. Port to new API, and add
10165 (selftest::test_canonicalization_2): Provide a
10166 region_model_manager when creating region_model instances.
10167 Remove redundant canicalization.
10168 (selftest::test_canonicalization_3): Provide a
10169 region_model_manager when creating region_model instances.
10170 Remove param from calls to region_model::canonicalize.
10171 (selftest::test_canonicalization_4): Likewise.
10172 (selftest::assert_region_models_merge): Constify
10173 out_merged_svalue. Port to new API.
10174 (selftest::test_state_merging): Provide a
10175 region_model_manager when creating region_model instances.
10176 Provide a program_point point when merging them. Replace
10177 set_to_new_unknown_value with usage of placeholder_svalues.
10178 Drop get_value_by_name. Port from svalue_id to const svalue *.
10179 Add test of heap allocation.
10180 (selftest::test_constraint_merging): Provide a
10181 region_model_manager when creating region_model instances.
10182 Provide a program_point point when merging them. Eliminate use
10183 of set_to_new_unknown_value.
10184 (selftest::test_widening_constraints): New.
10185 (selftest::test_iteration_1): New.
10186 (selftest::test_malloc_constraints): Port to store-based
10187 implementation.
10188 (selftest::test_var): New test.
10189 (selftest::test_array_2): New test.
10190 (selftest::test_mem_ref): New test.
10191 (selftest::test_POINTER_PLUS_EXPR_then_MEM_REF): New.
10192 (selftest::test_malloc): New.
10193 (selftest::test_alloca): New.
10194 (selftest::analyzer_region_model_cc_tests): Update for renamings.
10195 Call new functions.
10196 * region-model.h (class path_var): Move to analyzer.h.
10197 (class svalue_id): Delete.
10198 (class region_id): Delete.
10199 (class id_map): Delete.
10200 (svalue_id_map): Delete.
10201 (region_id_map): Delete.
10202 (id_map<T>::id_map): Delete.
10203 (id_map<T>::put): Delete.
10204 (id_map<T>::get_dst_for_src): Delete.
10205 (id_map<T>::get_src_for_dst): Delete.
10206 (id_map<T>::dump_to_pp): Delete.
10207 (id_map<T>::dump): Delete.
10208 (id_map<T>::update): Delete.
10209 (one_way_svalue_id_map): Delete.
10210 (one_way_region_id_map): Delete.
10211 (class region_id_set): Delete.
10212 (class svalue_id_set): Delete.
10213 (struct complexity): New.
10214 (class visitor): New.
10215 (enum svalue_kind): Add SK_SETJMP, SK_INITIAL, SK_UNARYOP,
10216 SK_BINOP, SK_SUB,SK_UNMERGEABLE, SK_PLACEHOLDER, SK_WIDENING,
10217 SK_COMPOUND, and SK_CONJURED.
10218 (svalue::operator==): Delete.
10219 (svalue::operator!=): Delete.
10220 (svalue::clone): Delete.
10221 (svalue::hash): Delete.
10222 (svalue::dump_dot_to_pp): Delete.
10223 (svalue::dump_to_pp): New.
10224 (svalue::dump): New.
10225 (svalue::get_desc): New.
10226 (svalue::dyn_cast_initial_svalue): New.
10227 (svalue::dyn_cast_unaryop_svalue): New.
10228 (svalue::dyn_cast_binop_svalue): New.
10229 (svalue::dyn_cast_sub_svalue): New.
10230 (svalue::dyn_cast_unmergeable_svalue): New.
10231 (svalue::dyn_cast_widening_svalue): New.
10232 (svalue::dyn_cast_compound_svalue): New.
10233 (svalue::dyn_cast_conjured_svalue): New.
10234 (svalue::maybe_undo_cast): New.
10235 (svalue::unwrap_any_unmergeable): New.
10236 (svalue::remap_region_ids): Delete
10237 (svalue::can_merge_p): New.
10238 (svalue::walk_for_canonicalization): Delete
10239 (svalue::get_complexity): New.
10240 (svalue::get_child_sid): Delete
10241 (svalue::accept): New.
10242 (svalue::live_p): New.
10243 (svalue::implicitly_live_p): New.
10244 (svalue::svalue): Add complexity param.
10245 (svalue::add_to_hash): Delete
10246 (svalue::print_details): Delete
10247 (svalue::m_complexity): New field.
10248 (region_svalue::key_t): New struct.
10249 (region_svalue::region_svalue): Port from region_id to
10250 const region_id *. Add complexity.
10251 (region_svalue::compare_fields): Delete.
10252 (region_svalue::clone): Delete.
10253 (region_svalue::dump_dot_to_pp): Delete.
10254 (region_svalue::get_pointee): Port from region_id to
10255 const region_id *.
10256 (region_svalue::remap_region_ids): Delete.
10257 (region_svalue::merge_values): Delete.
10258 (region_svalue::dump_to_pp): New.
10259 (region_svalue::accept): New.
10260 (region_svalue::walk_for_canonicalization): Delete.
10261 (region_svalue::eval_condition): Make params const.
10262 (region_svalue::add_to_hash): Delete.
10263 (region_svalue::print_details): Delete.
10264 (region_svalue::m_rid): Replace with...
10265 (region_svalue::m_reg): ...this.
10266 (is_a_helper <region_svalue *>::test): Convert to...
10267 (is_a_helper <const region_svalue *>::test): ...this.
10268 (template <> struct default_hash_traits<region_svalue::key_t>):
10269 New.
10270 (constant_svalue::constant_svalue): Add complexity.
10271 (constant_svalue::compare_fields): Delete.
10272 (constant_svalue::clone): Delete.
10273 (constant_svalue::add_to_hash): Delete.
10274 (constant_svalue::dump_to_pp): New.
10275 (constant_svalue::accept): New.
10276 (constant_svalue::implicitly_live_p): New.
10277 (constant_svalue::merge_values): Delete.
10278 (constant_svalue::eval_condition): Make params const.
10279 (constant_svalue::get_child_sid): Delete.
10280 (constant_svalue::print_details): Delete.
10281 (is_a_helper <constant_svalue *>::test): Convert to...
10282 (is_a_helper <const constant_svalue *>::test): ...this.
10283 (class unknown_svalue): Update leading comment.
10284 (unknown_svalue::unknown_svalue): Add complexity.
10285 (unknown_svalue::compare_fields): Delete.
10286 (unknown_svalue::add_to_hash): Delete.
10287 (unknown_svalue::dyn_cast_unknown_svalue): Delete.
10288 (unknown_svalue::print_details): Delete.
10289 (unknown_svalue::dump_to_pp): New.
10290 (unknown_svalue::accept): New.
10291 (poisoned_svalue::key_t): New struct.
10292 (poisoned_svalue::poisoned_svalue): Add complexity.
10293 (poisoned_svalue::compare_fields): Delete.
10294 (poisoned_svalue::clone): Delete.
10295 (poisoned_svalue::add_to_hash): Delete.
10296 (poisoned_svalue::dump_to_pp): New.
10297 (poisoned_svalue::accept): New.
10298 (poisoned_svalue::print_details): Delete.
10299 (is_a_helper <poisoned_svalue *>::test): Convert to...
10300 (is_a_helper <const poisoned_svalue *>::test): ...this.
10301 (template <> struct default_hash_traits<poisoned_svalue::key_t>):
10302 New.
10303 (setjmp_record::add_to_hash): New.
10304 (setjmp_svalue::key_t): New struct.
10305 (setjmp_svalue::compare_fields): Delete.
10306 (setjmp_svalue::clone): Delete.
10307 (setjmp_svalue::add_to_hash): Delete.
10308 (setjmp_svalue::setjmp_svalue): Add complexity.
10309 (setjmp_svalue::dump_to_pp): New.
10310 (setjmp_svalue::accept): New.
10311 (setjmp_svalue::void print_details): Delete.
10312 (is_a_helper <const setjmp_svalue *>::test): New.
10313 (template <> struct default_hash_traits<setjmp_svalue::key_t>): New.
10314 (class initial_svalue : public svalue): New.
10315 (is_a_helper <const initial_svalue *>::test): New.
10316 (class unaryop_svalue): New.
10317 (is_a_helper <const unaryop_svalue *>::test): New.
10318 (template <> struct default_hash_traits<unaryop_svalue::key_t>): New.
10319 (class binop_svalue): New.
10320 (is_a_helper <const binop_svalue *>::test): New.
10321 (template <> struct default_hash_traits<binop_svalue::key_t>): New.
10322 (class sub_svalue): New.
10323 (is_a_helper <const sub_svalue *>::test): New.
10324 (template <> struct default_hash_traits<sub_svalue::key_t>): New.
10325 (class unmergeable_svalue): New.
10326 (is_a_helper <const unmergeable_svalue *>::test): New.
10327 (class placeholder_svalue): New.
10328 (is_a_helper <placeholder_svalue *>::test): New.
10329 (class widening_svalue): New.
10330 (is_a_helper <widening_svalue *>::test): New.
10331 (template <> struct default_hash_traits<widening_svalue::key_t>): New.
10332 (class compound_svalue): New.
10333 (is_a_helper <compound_svalue *>::test): New.
10334 (template <> struct default_hash_traits<compound_svalue::key_t>): New.
10335 (class conjured_svalue): New.
10336 (is_a_helper <conjured_svalue *>::test): New.
10337 (template <> struct default_hash_traits<conjured_svalue::key_t>): New.
10338 (enum region_kind): Delete RK_PRIMITIVE, RK_STRUCT, RK_UNION, and
10339 RK_ARRAY. Add RK_LABEL, RK_DECL, RK_FIELD, RK_ELEMENT, RK_OFFSET,
10340 RK_CAST, RK_HEAP_ALLOCATED, RK_ALLOCA, RK_STRING, and RK_UNKNOWN.
10341 (region_kind_to_str): Delete.
10342 (region::~region): Move implementation to region.cc.
10343 (region::operator==): Delete.
10344 (region::operator!=): Delete.
10345 (region::clone): Delete.
10346 (region::get_id): New.
10347 (region::cmp_ids): New.
10348 (region::dyn_cast_map_region): Delete.
10349 (region::dyn_cast_array_region): Delete.
10350 (region::region_id get_parent): Delete.
10351 (region::get_parent_region): Convert to a simple accessor.
10352 (region::void set_value): Delete.
10353 (region::svalue_id get_value): Delete.
10354 (region::svalue_id get_value_direct): Delete.
10355 (region::svalue_id get_inherited_child_sid): Delete.
10356 (region::dyn_cast_frame_region): New.
10357 (region::dyn_cast_function_region): New.
10358 (region::dyn_cast_decl_region): New.
10359 (region::dyn_cast_field_region): New.
10360 (region::dyn_cast_element_region): New.
10361 (region::dyn_cast_offset_region): New.
10362 (region::dyn_cast_cast_region): New.
10363 (region::dyn_cast_string_region): New.
10364 (region::accept): New.
10365 (region::get_base_region): New.
10366 (region::base_region_p): New.
10367 (region::descendent_of_p): New.
10368 (region::maybe_get_frame_region): New.
10369 (region::maybe_get_decl): New.
10370 (region::hash): Delete.
10371 (region::rint): Delete.
10372 (region::dump_dot_to_pp): Delete.
10373 (region::get_desc): New.
10374 (region::dump_to_pp): Convert to vfunc, changing signature.
10375 (region::dump_child_label): Delete.
10376 (region::remap_svalue_ids): Delete.
10377 (region::remap_region_ids): Delete.
10378 (region::dump): New.
10379 (region::walk_for_canonicalization): Delete.
10380 (region::non_null_p): Drop region_model param.
10381 (region::add_view): Delete.
10382 (region::get_view): Delete.
10383 (region::get_active_view): Delete.
10384 (region::is_view_p): Delete.
10385 (region::cmp_ptrs): New.
10386 (region::validate): Delete.
10387 (region::get_offset): New.
10388 (region::get_byte_size): New.
10389 (region::get_bit_size): New.
10390 (region::get_subregions_for_binding): New.
10391 (region::region): Add complexity param. Convert parent from
10392 region_id to const region *. Drop svalue_id. Drop copy ctor.
10393 (region::symbolic_for_unknown_ptr_p): New.
10394 (region::add_to_hash): Delete.
10395 (region::print_fields): Delete.
10396 (region::get_complexity): New accessor.
10397 (region::become_active_view): Delete.
10398 (region::deactivate_any_active_view): Delete.
10399 (region::deactivate_view): Delete.
10400 (region::calc_offset): New.
10401 (region::m_parent_rid): Delete.
10402 (region::m_sval_id): Delete.
10403 (region::m_complexity): New.
10404 (region::m_id): New.
10405 (region::m_parent): New.
10406 (region::m_view_rids): Delete.
10407 (region::m_is_view): Delete.
10408 (region::m_active_view_rid): Delete.
10409 (region::m_cached_offset): New.
10410 (is_a_helper <region *>::test): Convert to...
10411 (is_a_helper <const region *>::test): ... this.
10412 (class primitive_region): Delete.
10413 (class space_region): New.
10414 (class map_region): Delete.
10415 (is_a_helper <map_region *>::test): Delete.
10416 (class frame_region): Reimplement.
10417 (template <> struct default_hash_traits<frame_region::key_t>):
10418 New.
10419 (class globals_region): Reimplement.
10420 (is_a_helper <globals_region *>::test): Convert to...
10421 (is_a_helper <const globals_region *>::test): ...this.
10422 (class struct_or_union_region): Delete.
10423 (is_a_helper <struct_or_union_region *>::test): Delete.
10424 (class code_region): Reimplement.
10425 (is_a_helper <const code_region *>::test): New.
10426 (class struct_region): Delete.
10427 (is_a_helper <struct_region *>::test): Delete.
10428 (class function_region): Reimplement.
10429 (is_a_helper <function_region *>::test): Convert to...
10430 (is_a_helper <const function_region *>::test): ...this.
10431 (class union_region): Delete.
10432 (is_a_helper <union_region *>::test): Delete.
10433 (class label_region): New.
10434 (is_a_helper <const label_region *>::test): New.
10435 (class scope_region): Delete.
10436 (class stack_region): Reimplement.
10437 (is_a_helper <stack_region *>::test): Convert to...
10438 (is_a_helper <const stack_region *>::test): ...this.
10439 (class heap_region): Reimplement.
10440 (is_a_helper <heap_region *>::test): Convert to...
10441 (is_a_helper <const heap_region *>::test): ...this.
10442 (class root_region): Reimplement.
10443 (is_a_helper <root_region *>::test): Convert to...
10444 (is_a_helper <const root_region *>::test): ...this.
10445 (class symbolic_region): Reimplement.
10446 (is_a_helper <const symbolic_region *>::test): New.
10447 (template <> struct default_hash_traits<symbolic_region::key_t>):
10448 New.
10449 (class decl_region): New.
10450 (is_a_helper <const decl_region *>::test): New.
10451 (class field_region): New.
10452 (template <> struct default_hash_traits<field_region::key_t>): New.
10453 (class array_region): Delete.
10454 (class element_region): New.
10455 (is_a_helper <array_region *>::test): Delete.
10456 (is_a_helper <const element_region *>::test): New.
10457 (template <> struct default_hash_traits<element_region::key_t>):
10458 New.
10459 (class offset_region): New.
10460 (is_a_helper <const offset_region *>::test): New.
10461 (template <> struct default_hash_traits<offset_region::key_t>):
10462 New.
10463 (class cast_region): New.
10464 (is_a_helper <const cast_region *>::test): New.
10465 (template <> struct default_hash_traits<cast_region::key_t>): New.
10466 (class heap_allocated_region): New.
10467 (class alloca_region): New.
10468 (class string_region): New.
10469 (is_a_helper <const string_region *>::test): New.
10470 (class unknown_region): New.
10471 (class region_model_manager): New.
10472 (struct append_ssa_names_cb_data): New.
10473 (class call_details): New.
10474 (region_model::region_model): Add region_model_manager param.
10475 (region_model::print_svalue): Delete.
10476 (region_model::dump_dot_to_pp): Delete.
10477 (region_model::dump_dot_to_file): Delete.
10478 (region_model::dump_dot): Delete.
10479 (region_model::dump_to_pp): Drop summarize param in favor of
10480 simple and multiline.
10481 (region_model::dump): Likewise.
10482 (region_model::summarize_to_pp): Delete.
10483 (region_model::summarize): Delete.
10484 (region_model::void canonicalize): Drop ctxt param.
10485 (region_model::void check_for_poison): Delete.
10486 (region_model::get_gassign_result): New.
10487 (region_model::impl_call_alloca): New.
10488 (region_model::impl_call_analyzer_describe): New.
10489 (region_model::impl_call_analyzer_eval): New.
10490 (region_model::impl_call_builtin_expect): New.
10491 (region_model::impl_call_calloc): New.
10492 (region_model::impl_call_free): New.
10493 (region_model::impl_call_malloc): New.
10494 (region_model::impl_call_memset): New.
10495 (region_model::impl_call_strlen): New.
10496 (region_model::get_reachable_svalues): New.
10497 (region_model::handle_phi): Drop is_back_edge param.
10498 (region_model::region_id get_root_rid): Delete.
10499 (region_model::root_region *get_root_region): Delete.
10500 (region_model::region_id get_stack_region_id): Delete.
10501 (region_model::push_frame): Convert from region_id and svalue_id
10502 to const region * and const svalue *.
10503 (region_model::get_current_frame_id): Replace with...
10504 (region_model::get_current_frame): ...this.
10505 (region_model::pop_frame): Convert from region_id to
10506 const region *. Drop purge and stats param. Add out_result.
10507 (region_model::function *get_function_at_depth): Delete.
10508 (region_model::get_globals_region_id): Delete.
10509 (region_model::add_svalue): Delete.
10510 (region_model::replace_svalue): Delete.
10511 (region_model::add_region): Delete.
10512 (region_model::add_region_for_type): Delete.
10513 (region_model::get_svalue): Delete.
10514 (region_model::get_region): Delete.
10515 (region_model::get_lvalue): Convert from region_id to
10516 const region *.
10517 (region_model::get_rvalue): Convert from svalue_id to
10518 const svalue *.
10519 (region_model::get_or_create_ptr_svalue): Delete.
10520 (region_model::get_or_create_constant_svalue): Delete.
10521 (region_model::get_svalue_for_fndecl): Delete.
10522 (region_model::get_svalue_for_label): Delete.
10523 (region_model::get_region_for_fndecl): Delete.
10524 (region_model::get_region_for_label): Delete.
10525 (region_model::get_frame_at_index (int index) const;): New.
10526 (region_model::maybe_cast): Delete.
10527 (region_model::maybe_cast_1): Delete.
10528 (region_model::get_field_region): Delete.
10529 (region_model::id deref_rvalue): Convert from region_id and
10530 svalue_id to const region * and const svalue *. Drop overload,
10531 passing in both a tree and an svalue.
10532 (region_model::set_value): Convert from region_id and svalue_id to
10533 const region * and const svalue *.
10534 (region_model::set_to_new_unknown_value): Delete.
10535 (region_model::clobber_region (const region *reg);): New.
10536 (region_model::purge_region (const region *reg);): New.
10537 (region_model::zero_fill_region (const region *reg);): New.
10538 (region_model::mark_region_as_unknown (const region *reg);): New.
10539 (region_model::copy_region): Convert from region_id to
10540 const region *.
10541 (region_model::eval_condition): Convert from svalue_id to
10542 const svalue *.
10543 (region_model::eval_condition_without_cm): Likewise.
10544 (region_model::compare_initial_and_pointer): New.
10545 (region_model:maybe_get_constant): Delete.
10546 (region_model::add_new_malloc_region): Delete.
10547 (region_model::get_representative_tree): Convert from svalue_id to
10548 const svalue *.
10549 (region_model::get_representative_path_var): Delete decl taking a
10550 region_id in favor of two decls, for svalue vs region, with an
10551 svalue_set to ensure termination.
10552 (region_model::get_path_vars_for_svalue): Delete.
10553 (region_model::create_region_for_heap_alloc): New.
10554 (region_model::create_region_for_alloca): New.
10555 (region_model::purge_unused_svalues): Delete.
10556 (region_model::remap_svalue_ids): Delete.
10557 (region_model::remap_region_ids): Delete.
10558 (region_model::purge_regions): Delete.
10559 (region_model::get_num_svalues): Delete.
10560 (region_model::get_num_regions): Delete.
10561 (region_model::get_descendents): Delete.
10562 (region_model::get_store): New.
10563 (region_model::delete_region_and_descendents): Delete.
10564 (region_model::get_manager): New.
10565 (region_model::unbind_region_and_descendents): New.
10566 (region_model::can_merge_with_p): Add point param. Drop
10567 svalue_id_merger_mapping.
10568 (region_model::get_value_by_name): Delete.
10569 (region_model::convert_byte_offset_to_array_index): Delete.
10570 (region_model::get_or_create_mem_ref): Delete.
10571 (region_model::get_or_create_pointer_plus_expr): Delete.
10572 (region_model::get_or_create_view): Delete.
10573 (region_model::get_lvalue_1): Convert from region_id to
10574 const region *.
10575 (region_model::get_rvalue_1): Convert from svalue_id to
10576 const svalue *.
10577 (region_model::get_ssa_name_regions_for_current_frame): New.
10578 (region_model::append_ssa_names_cb): New.
10579 (region_model::get_store_value): New.
10580 (region_model::copy_struct_region): Delete.
10581 (region_model::copy_union_region): Delete.
10582 (region_model::copy_array_region): Delete.
10583 (region_model::region_exists_p): New.
10584 (region_model::make_region_for_unexpected_tree_code): Delete.
10585 (region_model::loop_replay_fixup): New.
10586 (region_model::poison_any_pointers_to_bad_regions): Delete.
10587 (region_model::poison_any_pointers_to_descendents): New.
10588 (region_model::dump_summary_of_rep_path_vars): Delete.
10589 (region_model::on_top_level_param): New.
10590 (region_model::record_dynamic_extents): New.
10591 (region_model::m_mgr;): New.
10592 (region_model::m_store;): New.
10593 (region_model::m_svalues;): Delete.
10594 (region_model::m_regions;): Delete.
10595 (region_model::m_root_rid;): Delete.
10596 (region_model::m_current_frame;): New.
10597 (region_model_context::remap_svalue_ids): Delete.
10598 (region_model_context::can_purge_p): Delete.
10599 (region_model_context::on_svalue_leak): New.
10600 (region_model_context::on_svalue_purge): Delete.
10601 (region_model_context::on_liveness_change): New.
10602 (region_model_context::on_inherited_svalue): Delete.
10603 (region_model_context::on_cast): Delete.
10604 (region_model_context::on_unknown_change): Convert from svalue_id to
10605 const svalue * and add is_mutable.
10606 (class noop_region_model_context): Update for region_model_context
10607 changes.
10608 (model_merger::model_merger): Add program_point. Drop
10609 svalue_id_merger_mapping.
10610 (model_merger::dump_to_pp): Add "simple" param.
10611 (model_merger::dump): Likewise.
10612 (model_merger::get_region_a): Delete.
10613 (model_merger::get_region_b): Delete.
10614 (model_merger::can_merge_values_p): Delete.
10615 (model_merger::record_regions): Delete.
10616 (model_merger::record_svalues): Delete.
10617 (model_merger::m_point): New field.
10618 (model_merger::m_map_regions_from_a_to_m): Delete.
10619 (model_merger::m_map_regions_from_b_to_m): Delete.
10620 (model_merger::m_sid_mapping): Delete.
10621 (struct svalue_id_merger_mapping): Delete.
10622 (class engine): New.
10623 (struct canonicalization): Delete.
10624 (inchash::add): Delete decls for hashing svalue_id and region_id.
10625 (test_region_model_context::on_unexpected_tree_code): Require t to
10626 be non-NULL.
10627 (selftest::assert_condition): Add overload comparing a pair of
10628 const svalue *.
10629 * sm-file.cc: Include "tristate.h", "selftest.h",
10630 "analyzer/call-string.h", "analyzer/program-point.h",
10631 "analyzer/store.h", and "analyzer/region-model.h".
10632 (fileptr_state_machine::get_default_state): New.
10633 (fileptr_state_machine::on_stmt): Remove calls to
10634 get_readable_tree in favor of get_diagnostic_tree.
10635 * sm-malloc.cc: Include "tristate.h", "selftest.h",
10636 "analyzer/call-string.h", "analyzer/program-point.h",
10637 "analyzer/store.h", and "analyzer/region-model.h".
10638 (malloc_state_machine::get_default_state): New.
10639 (malloc_state_machine::reset_when_passed_to_unknown_fn_p): New.
10640 (malloc_diagnostic::describe_state_change): Handle change.m_expr
10641 being NULL.
10642 (null_arg::emit): Avoid printing "NULL '0'".
10643 (null_arg::describe_final_event): Avoid printing "(0) NULL".
10644 (malloc_leak::emit): Handle m_arg being NULL.
10645 (malloc_leak::describe_final_event): Handle ev.m_expr being NULL.
10646 (malloc_state_machine::on_stmt): Don't call get_readable_tree.
10647 Call get_diagnostic_tree when creating pending diagnostics.
10648 Update for is_zero_assignment becoming a member function of
10649 sm_ctxt.
10650 Don't transition to m_non_heap for ADDR_EXPR(MEM_REF()).
10651 (malloc_state_machine::reset_when_passed_to_unknown_fn_p): New
10652 vfunc implementation.
10653 * sm-sensitive.cc (sensitive_state_machine::warn_for_any_exposure): Call
10654 get_diagnostic_tree and pass the result to warn_for_state.
10655 * sm-signal.cc: Move includes of "analyzer/call-string.h" and
10656 "analyzer/program-point.h" to before "analyzer/region-model.h",
10657 and also include "analyzer/store.h" before it.
10658 (signal_unsafe_call::describe_state_change): Use
10659 get_dest_function to get handler.
10660 (update_model_for_signal_handler): Pass manager to region_model
10661 ctor.
10662 (register_signal_handler::impl_transition): Update for changes to
10663 get_or_create_node and add_edge.
10664 * sm-taint.cc (taint_state_machine::on_stmt): Remove calls to
10665 get_readable_tree, replacing them when calling warn_for_state with
10666 calls to get_diagnostic_tree.
10667 * sm.cc (is_zero_assignment): Delete.
10668 (any_pointer_p): Move to within namespace ana.
10669 * sm.h (is_zero_assignment): Remove decl.
10670 (any_pointer_p): Move decl to within namespace ana.
10671 (state_machine::get_default_state): New vfunc.
10672 (state_machine::reset_when_passed_to_unknown_fn_p): New vfunc.
10673 (sm_context::get_readable_tree): Rename to...
10674 (sm_context::get_diagnostic_tree): ...this.
10675 (sm_context::is_zero_assignment): New vfunc.
10676 * store.cc: New file.
10677 * store.h: New file.
10678 * svalue.cc: New file.
10680 2020-05-22 Mark Wielaard <mark@klomp.org>
10682 * sm-signal.cc(signal_unsafe_call::emit): Possibly add
10683 gcc_rich_location note for replacement.
10684 (signal_unsafe_call::get_replacement_fn): New private function.
10685 (get_async_signal_unsafe_fns): Add "exit".
10687 2020-04-28 David Malcolm <dmalcolm@redhat.com>
10689 PR analyzer/94816
10690 * engine.cc (impl_region_model_context::on_unexpected_tree_code):
10691 Handle NULL tree.
10692 * region-model.cc (region_model::add_region_for_type): Handle
10693 NULL type.
10694 * region-model.h
10695 (test_region_model_context::on_unexpected_tree_code): Handle NULL
10696 tree.
10698 2020-04-28 David Malcolm <dmalcolm@redhat.com>
10700 PR analyzer/94447
10701 PR analyzer/94639
10702 PR analyzer/94732
10703 PR analyzer/94754
10704 * analyzer.opt (Wanalyzer-use-of-uninitialized-value): Delete.
10705 * program-state.cc (selftest::test_program_state_dumping): Update
10706 expected dump result for removal of "uninit".
10707 * region-model.cc (poison_kind_to_str): Delete POISON_KIND_UNINIT
10708 case.
10709 (root_region::ensure_stack_region): Initialize stack with null
10710 svalue_id rather than with a typeless POISON_KIND_UNINIT value.
10711 (root_region::ensure_heap_region): Likewise for the heap.
10712 (region_model::dump_summary_of_rep_path_vars): Remove
10713 summarization of uninit values.
10714 (region_model::validate): Remove check that the stack has a
10715 POISON_KIND_UNINIT value.
10716 (poisoned_value_diagnostic::emit): Remove POISON_KIND_UNINIT
10717 case.
10718 (poisoned_value_diagnostic::describe_final_event): Likewise.
10719 (selftest::test_dump): Update expected dump result for removal of
10720 "uninit".
10721 (selftest::test_svalue_equality): Remove "uninit" and "freed".
10722 * region-model.h (enum poison_kind): Remove POISON_KIND_UNINIT.
10724 2020-04-01 David Malcolm <dmalcolm@redhat.com>
10726 PR analyzer/94378
10727 * checker-path.cc: Include "bitmap.h".
10728 * constraint-manager.cc: Likewise.
10729 * diagnostic-manager.cc: Likewise.
10730 * engine.cc: Likewise.
10731 (exploded_node::detect_leaks): Pass null region_id to pop_frame.
10732 * program-point.cc: Include "bitmap.h".
10733 * program-state.cc: Likewise.
10734 * region-model.cc (id_set<region_id>::id_set): Convert to...
10735 (region_id_set::region_id_set): ...this.
10736 (svalue_id_set::svalue_id_set): New ctor.
10737 (region_model::copy_region): New function.
10738 (region_model::copy_struct_region): New function.
10739 (region_model::copy_union_region): New function.
10740 (region_model::copy_array_region): New function.
10741 (stack_region::pop_frame): Drop return value. Add
10742 "result_dst_rid" param; if it is non-null, use copy_region to copy
10743 the result to it. Rather than capture and pass a single "known
10744 used" return value to be used by purge_unused_values, instead
10745 gather and pass a set of known used return values.
10746 (root_region::pop_frame): Drop return value. Add "result_dst_rid"
10747 param.
10748 (region_model::on_assignment): Use copy_region.
10749 (region_model::on_return): Likewise for the result.
10750 (region_model::on_longjmp): Pass null for pop_frame's
10751 result_dst_rid.
10752 (region_model::update_for_return_superedge): Pass the region for the
10753 return value of the call, if any, to pop_frame, rather than setting
10754 the lvalue for the lhs of the result.
10755 (region_model::pop_frame): Drop return value. Add
10756 "result_dst_rid" param.
10757 (region_model::purge_unused_svalues): Convert third param from an
10758 svalue_id * to an svalue_id_set *, updating the initial populating
10759 of the "used" bitmap accordingly. Don't remap it when done.
10760 (struct selftest::coord_test): New selftest fixture, extracted from...
10761 (selftest::test_dump_2): ...here.
10762 (selftest::test_compound_assignment): New selftest.
10763 (selftest::test_stack_frames): Pass null to new param of pop_frame.
10764 (selftest::analyzer_region_model_cc_tests): Call the new selftest.
10765 * region-model.h (class id_set): Delete template.
10766 (class region_id_set): Reimplement, using old id_set implementation.
10767 (class svalue_id_set): Likewise. Convert from auto_sbitmap to
10768 auto_bitmap.
10769 (region::get_active_view): New accessor.
10770 (stack_region::pop_frame): Drop return value. Add
10771 "result_dst_rid" param.
10772 (root_region::pop_frame): Likewise.
10773 (region_model::pop_frame): Likewise.
10774 (region_model::copy_region): New decl.
10775 (region_model::purge_unused_svalues): Convert third param from an
10776 svalue_id * to an svalue_id_set *.
10777 (region_model::copy_struct_region): New decl.
10778 (region_model::copy_union_region): New decl.
10779 (region_model::copy_array_region): New decl.
10781 2020-03-27 David Malcolm <dmalcolm@redhat.com>
10783 * program-state.cc (selftest::test_program_state_dumping): Update
10784 expected dump to include symbolic_region's possibly_null field.
10785 * region-model.cc (symbolic_region::print_fields): New vfunc
10786 implementation.
10787 (region_model::add_constraint): Clear m_possibly_null from
10788 symbolic_regions now known to be non-NULL.
10789 (selftest::test_malloc_constraints): New selftest.
10790 (selftest::analyzer_region_model_cc_tests): Call it.
10791 * region-model.h (region::dyn_cast_symbolic_region): Add non-const
10792 overload.
10793 (symbolic_region::dyn_cast_symbolic_region): Implement it.
10794 (symbolic_region::print_fields): New vfunc override decl.
10796 2020-03-27 David Malcolm <dmalcolm@redhat.com>
10798 * analyzer.h (class feasibility_problem): New forward decl.
10799 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic):
10800 Initialize new fields m_status, m_epath_length, and m_problem.
10801 (saved_diagnostic::~saved_diagnostic): Delete m_problem.
10802 (dedupe_candidate::dedupe_candidate): Convert "sd" param from a
10803 const ref to a mutable ptr.
10804 (dedupe_winners::add): Convert "sd" param from a const ref to a
10805 mutable ptr. Record the length of the exploded_path. Record the
10806 feasibility/infeasibility of sd into sd, capturing a
10807 feasibility_problem when feasible_p fails, and storing it in sd.
10808 (diagnostic_manager::emit_saved_diagnostics): Update for pass by
10809 ptr rather than by const ref.
10810 * diagnostic-manager.h (class saved_diagnostic): Add new enum
10811 status. Add fields m_status, m_epath_length and m_problem.
10812 (saved_diagnostic::set_feasible): New member function.
10813 (saved_diagnostic::set_infeasible): New member function.
10814 (saved_diagnostic::get_feasibility_problem): New accessor.
10815 (saved_diagnostic::get_status): New accessor.
10816 (saved_diagnostic::set_epath_length): New member function.
10817 (saved_diagnostic::get_epath_length): New accessor.
10818 * engine.cc: Include "gimple-pretty-print.h".
10819 (exploded_path::feasible_p): Add OUT param and, if non-NULL, write
10820 a new feasibility_problem to it on failure.
10821 (viz_callgraph_node::dump_dot): Convert begin_tr calls to
10822 begin_trtd. Convert end_tr calls to end_tdtr.
10823 (class exploded_graph_annotator): New subclass of dot_annotator.
10824 (impl_run_checkers): Add a second -fdump-analyzer-supergraph dump
10825 after the analysis runs, using exploded_graph_annotator. dumping
10826 to DUMP_BASE_NAME.supergraph-eg.dot.
10827 * exploded-graph.h (exploded_node::get_dot_fillcolor): Make
10828 public.
10829 (exploded_path::feasible_p): Add OUT param.
10830 (class feasibility_problem): New class.
10831 * state-purge.cc (state_purge_annotator::add_node_annotations):
10832 Return a bool, add a "within_table" param.
10833 (print_vec_of_names): Convert begin_tr calls to begin_trtd.
10834 Convert end_tr calls to end_tdtr.
10835 (state_purge_annotator::add_stmt_annotations): Add "within_row"
10836 param.
10837 * state-purge.h ((state_purge_annotator::add_node_annotations):
10838 Return a bool, add a "within_table" param.
10839 (state_purge_annotator::add_stmt_annotations): Add "within_row"
10840 param.
10841 * supergraph.cc (supernode::dump_dot): Call add_node_annotations
10842 twice: as before, passing false for "within_table", then again
10843 with true when within the TABLE element. Convert some begin_tr
10844 calls to begin_trtd, and some end_tr calls to end_tdtr.
10845 Repeat each add_stmt_annotations call, distinguishing between
10846 calls that add TRs and those that add TDs to an existing TR.
10847 Add a call to add_after_node_annotations.
10848 * supergraph.h (dot_annotator::add_node_annotations): Add a
10849 "within_table" param.
10850 (dot_annotator::add_stmt_annotations): Add a "within_row" param.
10851 (dot_annotator::add_after_node_annotations): New vfunc.
10853 2020-03-27 David Malcolm <dmalcolm@redhat.com>
10855 * diagnostic-manager.cc (dedupe_winners::add): Show the
10856 exploded_node index in the log messages.
10857 (diagnostic_manager::emit_saved_diagnostics): Log a summary of
10858 m_saved_diagnostics at entry.
10860 2020-03-27 David Malcolm <dmalcolm@redhat.com>
10862 * supergraph.cc (superedge::dump): Add space before description;
10863 move newline to non-pretty_printer overload.
10865 2020-03-18 David Malcolm <dmalcolm@redhat.com>
10867 * region-model.cc: Include "stor-layout.h".
10868 (region_model::dump_to_pp): Rather than calling
10869 dump_summary_of_map on each of the current frame and the globals,
10870 instead get a vec of representative path_vars for all regions,
10871 and then dump a summary of all of them.
10872 (region_model::dump_summary_of_map): Delete, rewriting into...
10873 (region_model::dump_summary_of_rep_path_vars): ...this new
10874 function, working on a vec of path_vars.
10875 (region_model::set_value): New overload.
10876 (region_model::get_representative_path_var): Rename
10877 "parent_region" local to "parent_reg" and consolidate with other
10878 local. Guard test for grandparent being stack on parent_reg being
10879 non-NULL. Move handling for parent being an array_region to
10880 within guard for parent_reg being non-NULL.
10881 (selftest::make_test_compound_type): New function.
10882 (selftest::test_dump_2): New selftest.
10883 (selftest::test_dump_3): New selftest.
10884 (selftest::test_stack_frames): Update expected output from
10885 simplified dump to show "a" and "b" from parent frame and "y" in
10886 child frame.
10887 (selftest::analyzer_region_model_cc_tests): Call test_dump_2 and
10888 test_dump_3.
10889 * region-model.h (region_model::set_value): New overload decl.
10890 (region_model::dump_summary_of_map): Delete.
10891 (region_model::dump_summary_of_rep_path_vars): New.
10893 2020-03-18 David Malcolm <dmalcolm@redhat.com>
10895 * region-model.h (class noop_region_model_context): New subclass
10896 of region_model_context.
10897 (class tentative_region_model_context): Inherit from
10898 noop_region_model_context rather than from region_model_context;
10899 drop redundant vfunc implementations.
10900 (class test_region_model_context): Likewise.
10902 2020-03-18 David Malcolm <dmalcolm@redhat.com>
10904 * engine.cc (exploded_node::exploded_node): Move implementation
10905 here from header; accept point_and_state by const reference rather
10906 than by value.
10907 * exploded-graph.h (exploded_node::exploded_node): Pass
10908 point_and_state by const reference rather than by value. Move
10909 body to engine.cc.
10911 2020-03-18 Jakub Jelinek <jakub@redhat.com>
10913 * sm-malloc.cc (malloc_state_machine::on_stmt): Fix up duplicated word
10914 issue in a comment.
10915 * region-model.cc (region_model::make_region_for_unexpected_tree_code,
10916 region_model::delete_region_and_descendents): Likewise.
10917 * engine.cc (class exploded_cluster): Likewise.
10918 * diagnostic-manager.cc (class path_builder): Likewise.
10920 2020-03-13 David Malcolm <dmalcolm@redhat.com>
10922 PR analyzer/94099
10923 PR analyzer/94105
10924 * diagnostic-manager.cc (for_each_state_change): Bulletproof
10925 against errors in get_rvalue by passing a
10926 tentative_region_model_context and rejecting if there's an error.
10927 * region-model.cc (region_model::get_lvalue_1): When handling
10928 ARRAY_REF, handle results of error-handling. Handle NOP_EXPR.
10930 2020-03-06 David Malcolm <dmalcolm@redhat.com>
10932 * analyzer.h (class array_region): New forward decl.
10933 * program-state.cc (selftest::test_program_state_dumping_2): New.
10934 (selftest::analyzer_program_state_cc_tests): Call it.
10935 * region-model.cc (array_region::constant_from_key): New.
10936 (region_model::get_representative_tree): Handle region_svalue by
10937 generating an ADDR_EXPR.
10938 (region_model::get_representative_path_var): In view handling,
10939 remove erroneous TREE_TYPE when determining the type of the tree.
10940 Handle array regions and STRING_CST.
10941 (selftest::assert_dump_tree_eq): New.
10942 (ASSERT_DUMP_TREE_EQ): New macro.
10943 (selftest::test_get_representative_tree): New selftest.
10944 (selftest::analyzer_region_model_cc_tests): Call it.
10945 * region-model.h (region::dyn_cast_array_region): New vfunc.
10946 (array_region::dyn_cast_array_region): New vfunc implementation.
10947 (array_region::constant_from_key): New decl.
10949 2020-03-06 David Malcolm <dmalcolm@redhat.com>
10951 * analyzer.h (dump_quoted_tree): New decl.
10952 * engine.cc (exploded_node::dump_dot): Pass region model to
10953 sm_state_map::print.
10954 * program-state.cc: Include diagnostic-core.h.
10955 (sm_state_map::print): Add "model" param and use it to print
10956 representative trees. Only print origin information if non-null.
10957 (sm_state_map::dump): Pass NULL for model to print call.
10958 (program_state::print): Pass region model to sm_state_map::print.
10959 (program_state::dump_to_pp): Use spaces rather than newlines when
10960 summarizing. Pass region_model to sm_state_map::print.
10961 (ana::selftest::assert_dump_eq): New function.
10962 (ASSERT_DUMP_EQ): New macro.
10963 (ana::selftest::test_program_state_dumping): New function.
10964 (ana::selftest::analyzer_program_state_cc_tests): Call it.
10965 * program-state.h (program_state::print): Add model param.
10966 * region-model.cc (dump_quoted_tree): New function.
10967 (map_region::print_fields): Use dump_quoted_tree rather than
10968 %qE to avoid lang-dependent output.
10969 (map_region::dump_child_label): Likewise.
10970 (region_model::dump_summary_of_map): For SK_REGION, when
10971 get_representative_path_var fails, print the region id rather than
10972 erroneously printing NULL.
10973 * sm.cc (state_machine::get_state_by_name): New function.
10974 * sm.h (state_machine::get_state_by_name): New decl.
10976 2020-03-04 David Malcolm <dmalcolm@redhat.com>
10978 * region-model.cc (region::validate): Convert model param from ptr
10979 to reference. Update comment to reflect that it's now a vfunc.
10980 (map_region::validate): New vfunc implementation.
10981 (array_region::validate): New vfunc implementation.
10982 (stack_region::validate): New vfunc implementation.
10983 (root_region::validate): New vfunc implementation.
10984 (region_model::validate): Pass a reference rather than a pointer
10985 to the region::validate vfunc.
10986 * region-model.h (region::validate): Make virtual. Convert model
10987 param from ptr to reference.
10988 (map_region::validate): New vfunc decl.
10989 (array_region::validate): New vfunc decl.
10990 (stack_region::validate): New vfunc decl.
10991 (root_region::validate): New vfunc decl.
10993 2020-03-04 David Malcolm <dmalcolm@redhat.com>
10995 PR analyzer/93993
10996 * region-model.cc (region_model::on_call_pre): Handle
10997 BUILT_IN_EXPECT and its variants.
10998 (region_model::add_any_constraints_from_ssa_def_stmt): Split out
10999 gassign handling into add_any_constraints_from_gassign; add gcall
11000 handling.
11001 (region_model::add_any_constraints_from_gassign): New function,
11002 based on the above. Add handling for NOP_EXPR.
11003 (region_model::add_any_constraints_from_gcall): New function.
11004 (region_model::get_representative_path_var): Handle views.
11005 * region-model.h
11006 (region_model::add_any_constraints_from_ssa_def_stmt): New decl.
11007 (region_model::add_any_constraints_from_gassign): New decl.
11009 2020-03-04 David Malcolm <dmalcolm@redhat.com>
11011 PR analyzer/93993
11012 * checker-path.h (state_change_event::get_lvalue): Add ctxt param
11013 and pass it to region_model::get_value call.
11014 * diagnostic-manager.cc (get_any_origin): Pass a
11015 tentative_region_model_context to the calls to get_lvalue and reject
11016 the comparison if errors occur.
11017 (can_be_expr_of_interest_p): New function.
11018 (diagnostic_manager::prune_for_sm_diagnostic): Replace checks for
11019 CONSTANT_CLASS_P with calls to update_for_unsuitable_sm_exprs.
11020 Pass a tentative_region_model_context to the calls to
11021 state_change_event::get_lvalue and reject the comparison if errors
11022 occur.
11023 (diagnostic_manager::update_for_unsuitable_sm_exprs): New.
11024 * diagnostic-manager.h
11025 (diagnostic_manager::update_for_unsuitable_sm_exprs): New decl.
11026 * region-model.h (class tentative_region_model_context): New class.
11028 2020-03-04 David Malcolm <dmalcolm@redhat.com>
11030 * engine.cc (worklist::worklist): Remove unused field m_eg.
11031 (class viz_callgraph_edge): Remove unused field m_call_sedge.
11032 (class viz_callgraph): Remove unused field m_sg.
11033 * exploded-graph.h (worklist::::m_eg): Remove unused field.
11035 2020-03-02 David Malcolm <dmalcolm@redhat.com>
11037 * analyzer.opt (fanalyzer-show-duplicate-count): New option.
11038 * diagnostic-manager.cc
11039 (diagnostic_manager::emit_saved_diagnostic): Use the above to
11040 guard the printing of the duplicate count.
11042 2020-03-02 David Malcolm <dmalcolm@redhat.com>
11044 PR analyzer/93959
11045 * analyzer.cc (is_std_function_p): New function.
11046 (is_std_named_call_p): New functions.
11047 * analyzer.h (is_std_named_call_p): New decl.
11048 * sm-malloc.cc (malloc_state_machine::on_stmt): Check for "std::"
11049 variants when checking for malloc, calloc and free.
11051 2020-02-26 David Malcolm <dmalcolm@redhat.com>
11053 PR analyzer/93950
11054 * diagnostic-manager.cc
11055 (diagnostic_manager::prune_for_sm_diagnostic): Assert that var is
11056 either NULL or not a constant. When updating var, bulletproof
11057 against constant values.
11059 2020-02-26 David Malcolm <dmalcolm@redhat.com>
11061 PR analyzer/93947
11062 * region-model.cc (region_model::get_fndecl_for_call): Gracefully
11063 fail for fn_decls that don't have a cgraph_node.
11065 2020-02-26 David Malcolm <dmalcolm@redhat.com>
11067 * bar-chart.cc: New file.
11068 * bar-chart.h: New file.
11069 * engine.cc: Include "analyzer/bar-chart.h".
11070 (stats::log): Only log the m_num_nodes kinds that are non-zero.
11071 (stats::dump): Likewise when dumping.
11072 (stats::get_total_enodes): New.
11073 (exploded_graph::get_or_create_node): Increment the per-point-data
11074 m_excess_enodes when hitting the per-program-point limit on
11075 enodes.
11076 (exploded_graph::print_bar_charts): New.
11077 (exploded_graph::log_stats): Log the number of unprocessed enodes
11078 in the worklist. Call print_bar_charts.
11079 (exploded_graph::dump_stats): Print the number of unprocessed
11080 enodes in the worklist.
11081 * exploded-graph.h (stats::get_total_enodes): New decl.
11082 (struct per_program_point_data): Add field m_excess_enodes.
11083 (exploded_graph::print_bar_charts): New decl.
11084 * supergraph.cc (superedge::dump): New.
11085 (superedge::dump): New.
11086 * supergraph.h (supernode::get_function): New.
11087 (superedge::dump): New decl.
11088 (superedge::dump): New decl.
11090 2020-02-24 David Malcolm <dmalcolm@redhat.com>
11092 * engine.cc (exploded_graph::get_or_create_node): Dump the
11093 program_state to the pp, rather than to stderr.
11095 2020-02-24 David Malcolm <dmalcolm@redhat.com>
11097 PR analyzer/93032
11098 * sm.cc (make_checkers): Require the "taint" checker to be
11099 explicitly enabled.
11101 2020-02-24 David Malcolm <dmalcolm@redhat.com>
11103 PR analyzer/93899
11104 * engine.cc
11105 (impl_region_model_context::impl_region_model_context): Add logger
11106 param.
11107 * engine.cc (exploded_graph::add_function_entry): Create an
11108 impl_region_model_context and pass it to the push_frame call.
11109 Bail if the resulting state is invalid.
11110 (exploded_graph::build_initial_worklist): Likewise.
11111 (exploded_graph::build_initial_worklist): Handle the case where
11112 add_function_entry fails.
11113 * exploded-graph.h
11114 (impl_region_model_context::impl_region_model_context): Add logger
11115 param.
11116 * region-model.cc (map_region::get_or_create): Add ctxt param and
11117 pass it to add_region_for_type.
11118 (map_region::can_merge_p): Pass NULL as a ctxt to call to
11119 get_or_create.
11120 (array_region::get_element): Pass ctxt to call to get_or_create.
11121 (array_region::get_or_create): Add ctxt param and pass it to
11122 add_region_for_type.
11123 (root_region::push_frame): Pass ctxt to get_or_create calls.
11124 (region_model::get_lvalue_1): Likewise.
11125 (region_model::make_region_for_unexpected_tree_code): Assert that
11126 ctxt is non-NULL.
11127 (region_model::get_rvalue_1): Pass ctxt to get_svalue_for_fndecl
11128 and get_svalue_for_label calls.
11129 (region_model::get_svalue_for_fndecl): Add ctxt param and pass it
11130 to get_region_for_fndecl.
11131 (region_model::get_region_for_fndecl): Add ctxt param and pass it
11132 to get_or_create.
11133 (region_model::get_svalue_for_label): Add ctxt param and pass it
11134 to get_region_for_label.
11135 (region_model::get_region_for_label): Add ctxt param and pass it
11136 to get_region_for_fndecl and get_or_create.
11137 (region_model::get_field_region): Add ctxt param and pass it to
11138 get_or_create_view and get_or_create.
11139 (make_region_for_type): Replace gcc_unreachable with return NULL.
11140 (region_model::add_region_for_type): Add ctxt param. Handle a
11141 return of NULL from make_region_for_type by calling
11142 make_region_for_unexpected_tree_code.
11143 (region_model::get_or_create_mem_ref): Pass ctxt to calls to
11144 get_or_create_view.
11145 (region_model::get_or_create_view): Add ctxt param and pass it to
11146 add_region_for_type.
11147 (selftest::test_state_merging): Pass ctxt to get_or_create_view.
11148 * region-model.h (region_model::get_or_create): Add ctxt param.
11149 (region_model::add_region_for_type): Likewise.
11150 (region_model::get_svalue_for_fndecl): Likewise.
11151 (region_model::get_svalue_for_label): Likewise.
11152 (region_model::get_region_for_fndecl): Likewise.
11153 (region_model::get_region_for_label): Likewise.
11154 (region_model::get_field_region): Likewise.
11155 (region_model::get_or_create_view): Likewise.
11157 2020-02-24 David Malcolm <dmalcolm@redhat.com>
11159 * checker-path.cc (superedge_event::should_filter_p): Update
11160 filter for empty descriptions to cover verbosity level 3 as well
11161 as 2.
11162 * diagnostic-manager.cc: Include "analyzer/reachability.h".
11163 (class path_builder): New class.
11164 (diagnostic_manager::emit_saved_diagnostic): Create a path_builder
11165 and pass it to build_emission_path, rather passing eg; similarly
11166 for add_events_for_eedge and ext_state.
11167 (diagnostic_manager::build_emission_path): Replace "eg" param
11168 with a path_builder, pass it to add_events_for_eedge.
11169 (diagnostic_manager::add_events_for_eedge): Replace ext_state
11170 param with path_builder; pass it to add_events_for_superedge.
11171 (diagnostic_manager::significant_edge_p): New.
11172 (diagnostic_manager::add_events_for_superedge): Add path_builder
11173 param. Reject insignificant edges at verbosity levels below 3.
11174 (diagnostic_manager::prune_for_sm_diagnostic): Update highest
11175 verbosity level to 4.
11176 * diagnostic-manager.h (class path_builder): New forward decl.
11177 (diagnostic_manager::build_emission_path): Replace "eg" param
11178 with a path_builder.
11179 (diagnostic_manager::add_events_for_eedge): Replace ext_state
11180 param with path_builder.
11181 (diagnostic_manager::significant_edge_p): New.
11182 (diagnostic_manager::add_events_for_superedge): Add path_builder
11183 param.
11184 * reachability.h: New file.
11186 2020-02-18 David Malcolm <dmalcolm@redhat.com>
11188 PR analyzer/93692
11189 * analyzer.opt (fdump-analyzer-callgraph): Rewrite description.
11191 2020-02-18 David Malcolm <dmalcolm@redhat.com>
11193 PR analyzer/93777
11194 * region-model.cc (region_model::maybe_cast_1): Replace assertion
11195 that build_cast returns non-NULL with a conditional, falling
11196 through to the logic which returns a new unknown value of the
11197 desired type if it fails.
11199 2020-02-18 David Malcolm <dmalcolm@redhat.com>
11201 PR analyzer/93778
11202 * engine.cc (impl_region_model_context::on_unknown_tree_code):
11203 Rename to...
11204 (impl_region_model_context::on_unexpected_tree_code): ...this and
11205 convert first argument from path_var to tree.
11206 (exploded_node::on_stmt): Pass ctxt to purge_for_unknown_fncall.
11207 * exploded-graph.h (region_model_context::on_unknown_tree_code):
11208 Rename to...
11209 (region_model_context::on_unexpected_tree_code): ...this and
11210 convert first argument from path_var to tree.
11211 * program-state.cc (sm_state_map::purge_for_unknown_fncall): Add
11212 ctxt param and pass on to calls to get_rvalue.
11213 * program-state.h (sm_state_map::purge_for_unknown_fncall): Add
11214 ctxt param.
11215 * region-model.cc (region_model::handle_unrecognized_call): Pass
11216 ctxt on to call to get_rvalue.
11217 (region_model::get_lvalue_1): Move body of default case to
11218 region_model::make_region_for_unexpected_tree_code and call it.
11219 Within COMPONENT_REF case, reject attempts to handle types other
11220 than RECORD_TYPE and UNION_TYPE.
11221 (region_model::make_region_for_unexpected_tree_code): New
11222 function, based on default case of region_model::get_lvalue_1.
11223 * region-model.h
11224 (region_model::make_region_for_unexpected_tree_code): New decl.
11225 (region_model::on_unknown_tree_code): Rename to...
11226 (region_model::on_unexpected_tree_code): ...this and convert first
11227 argument from path_var to tree.
11228 (class test_region_model_context): Update vfunc implementation for
11229 above change.
11231 2020-02-18 David Malcolm <dmalcolm@redhat.com>
11233 PR analyzer/93774
11234 * region-model.cc
11235 (region_model::convert_byte_offset_to_array_index): Use
11236 int_size_in_bytes before calling size_in_bytes, to gracefully fail
11237 on incomplete types.
11239 2020-02-17 David Malcolm <dmalcolm@redhat.com>
11241 PR analyzer/93775
11242 * region-model.cc (region_model::get_fndecl_for_call): Handle the
11243 case where the code_region's get_tree_for_child_region returns
11244 NULL.
11246 2020-02-17 David Malcolm <dmalcolm@redhat.com>
11248 PR analyzer/93388
11249 * engine.cc (impl_region_model_context::on_unknown_tree_code):
11250 New.
11251 (exploded_graph::get_or_create_node): Reject invalid states.
11252 * exploded-graph.h
11253 (impl_region_model_context::on_unknown_tree_code): New decl.
11254 (point_and_state::point_and_state): Assert that the state is
11255 valid.
11256 * program-state.cc (program_state::program_state): Initialize
11257 m_valid to true.
11258 (program_state::operator=): Copy m_valid.
11259 (program_state::program_state): Likewise for move constructor.
11260 (program_state::print): Print m_valid.
11261 (program_state::dump_to_pp): Likewise.
11262 * program-state.h (program_state::m_valid): New field.
11263 * region-model.cc (region_model::get_lvalue_1): Implement the
11264 default case by returning a new symbolic region and calling
11265 the context's on_unknown_tree_code, rather than issuing an
11266 internal_error. Implement VIEW_CONVERT_EXPR.
11267 * region-model.h (region_model_context::on_unknown_tree_code): New
11268 vfunc.
11269 (test_region_model_context::on_unknown_tree_code): New.
11271 2020-02-17 David Malcolm <dmalcolm@redhat.com>
11273 * sm-malloc.cc (malloc_diagnostic::describe_state_change): For
11274 transition to the "null" state, only say "assuming" when
11275 transitioning from the "unchecked" state.
11277 2020-02-17 David Malcolm <dmalcolm@redhat.com>
11279 * diagnostic-manager.h (diagnostic_manager::get_saved_diagnostic):
11280 Add const overload.
11281 * engine.cc (exploded_node::dump_dot): Dump saved_diagnostics.
11282 * exploded-graph.h (exploded_graph::get_diagnostic_manager): Add
11283 const overload.
11285 2020-02-11 David Malcolm <dmalcolm@redhat.com>
11287 PR analyzer/93288
11288 * analysis-plan.cc (analysis_plan::use_summary_p): Look through
11289 the ultimate_alias_target when getting the called function.
11290 * engine.cc (exploded_node::on_stmt): Rename second "ctxt" to
11291 "sm_ctxt". Use the region_model's get_fndecl_for_call rather than
11292 gimple_call_fndecl.
11293 * region-model.cc (region_model::get_fndecl_for_call): Use
11294 ultimate_alias_target on fndecl.
11295 * supergraph.cc (get_ultimate_function_for_cgraph_edge): New
11296 function.
11297 (supergraph_call_edge): Use it when rejecting edges without
11298 functions.
11299 (supergraph::supergraph): Use it to get the function for the
11300 cgraph_edge when building interprocedural superedges.
11301 (callgraph_superedge::get_callee_function): Use it.
11302 * supergraph.h (supergraph::get_num_snodes): Make param const.
11303 (supergraph::function_to_num_snodes_t): Make first type param
11304 const.
11306 2020-02-11 David Malcolm <dmalcolm@redhat.com>
11308 PR analyzer/93374
11309 * engine.cc (exploded_edge::exploded_edge): Add ext_state param
11310 and pass it to change.validate.
11311 (exploded_graph::get_or_create_node): Move purging of change
11312 svalues to also cover the case of reusing an existing enode.
11313 (exploded_graph::add_edge): Pass m_ext_state to exploded_edge's
11314 ctor.
11315 * exploded-graph.h (exploded_edge::exploded_edge): Add ext_state
11316 param.
11317 * program-state.cc (state_change::sm_change::validate): Likewise.
11318 Assert that m_sm_idx is sane. Use ext_state to validate
11319 m_old_state and m_new_state.
11320 (state_change::validate): Add ext_state param and pass it to
11321 the sm_change validate calls.
11322 * program-state.h (state_change::sm_change::validate): Add
11323 ext_state param.
11324 (state_change::validate): Likewise.
11326 2020-02-11 David Malcolm <dmalcolm@redhat.com>
11328 PR analyzer/93669
11329 * engine.cc (exploded_graph::dump_exploded_nodes): Handle missing
11330 case of STATUS_WORKLIST in implementation of
11331 "__analyzer_dump_exploded_nodes".
11333 2020-02-11 David Malcolm <dmalcolm@redhat.com>
11335 PR analyzer/93649
11336 * constraint-manager.cc (constraint_manager::add_constraint): When
11337 merging equivalence classes and updating m_constant, also update
11338 m_cst_sid.
11339 (constraint_manager::validate): If m_constant is non-NULL assert
11340 that m_cst_sid is non-null and is valid.
11342 2020-02-11 David Malcolm <dmalcolm@redhat.com>
11344 PR analyzer/93657
11345 * analyzer.opt (fdump-analyzer): Reword description.
11346 (fdump-analyzer-stderr): Likewise.
11348 2020-02-11 David Malcolm <dmalcolm@redhat.com>
11350 * region-model.cc (print_quoted_type): New function.
11351 (svalue::print): Use it to replace %qT.
11352 (region::dump_to_pp): Likewise.
11353 (region::dump_child_label): Likewise.
11354 (region::print_fields): Likewise.
11356 2020-02-10 David Malcolm <dmalcolm@redhat.com>
11358 PR analyzer/93659
11359 * analyzer.opt (-param=analyzer-max-recursion-depth=): Fix "tha"
11360 -> "that" typo.
11361 (Wanalyzer-use-of-uninitialized-value): Fix "initialized" ->
11362 "uninitialized" typo.
11364 2020-02-10 David Malcolm <dmalcolm@redhat.com>
11366 PR analyzer/93350
11367 * region-model.cc (region_model::get_lvalue_1):
11368 Handle BIT_FIELD_REF.
11369 (make_region_for_type): Handle VECTOR_TYPE.
11371 2020-02-10 David Malcolm <dmalcolm@redhat.com>
11373 PR analyzer/93647
11374 * diagnostic-manager.cc
11375 (diagnostic_manager::prune_for_sm_diagnostic): Bulletproof against
11376 VAR being constant.
11377 * region-model.cc (region_model::get_lvalue_1): Provide a better
11378 error message when encountering an unhandled tree code.
11380 2020-02-10 David Malcolm <dmalcolm@redhat.com>
11382 PR analyzer/93405
11383 * region-model.cc (region_model::get_lvalue_1): Implement
11384 CONST_DECL.
11386 2020-02-06 David Malcolm <dmalcolm@redhat.com>
11388 * region-model.cc (region_model::maybe_cast_1): Attempt to provide
11389 a region_svalue if either type is a pointer, rather than if both
11390 types are pointers.
11392 2020-02-05 David Malcolm <dmalcolm@redhat.com>
11394 * engine.cc (exploded_node::dump_dot): Show merger enodes.
11395 (worklist::add_node): Assert that the node's m_status is
11396 STATUS_WORKLIST.
11397 (exploded_graph::process_worklist): Likewise for nodes from the
11398 worklist. Set status of merged nodes to STATUS_MERGER.
11399 (exploded_graph::process_node): Set status of node to
11400 STATUS_PROCESSED.
11401 (exploded_graph::dump_exploded_nodes): Rework handling of
11402 "__analyzer_dump_exploded_nodes", splitting enodes by status into
11403 "processed" and "merger", showing the count of just the processed
11404 enodes at the call, rather than the count of all enodes.
11405 * exploded-graph.h (exploded_node::status): New enum.
11406 (exploded_node::exploded_node): Initialize m_status to
11407 STATUS_WORKLIST.
11408 (exploded_node::get_status): New getter.
11409 (exploded_node::set_status): New setter.
11411 2020-02-04 David Malcolm <dmalcolm@redhat.com>
11413 PR analyzer/93543
11414 * engine.cc (pod_hash_traits<function_call_string>::mark_empty):
11415 Eliminate reinterpret_cast.
11416 (pod_hash_traits<function_call_string>::is_empty): Likewise.
11418 2020-02-03 David Malcolm <dmalcolm@redhat.com>
11420 * constraint-manager.cc (range::constrained_to_single_element):
11421 Replace fold_build2 with fold_binary. Remove unnecessary newline.
11422 (constraint_manager::get_or_add_equiv_class): Replace fold_build2
11423 with fold_binary in two places, and remove out-of-date comment.
11424 (constraint_manager::eval_condition): Replace fold_build2 with
11425 fold_binary.
11426 * region-model.cc (constant_svalue::eval_condition): Likewise.
11427 (region_model::on_assignment): Likewise.
11429 2020-02-03 David Malcolm <dmalcolm@redhat.com>
11431 PR analyzer/93544
11432 * diagnostic-manager.cc
11433 (diagnostic_manager::prune_for_sm_diagnostic): Bulletproof
11434 against bad choices due to bad paths.
11435 * engine.cc (impl_region_model_context::on_phi): New.
11436 * exploded-graph.h (impl_region_model_context::on_phi): New decl.
11437 * region-model.cc (region_model::on_longjmp): Likewise.
11438 (region_model::handle_phi): Add phi param. Call the ctxt's on_phi
11439 vfunc.
11440 (region_model::update_for_phis): Pass phi to handle_phi.
11441 * region-model.h (region_model::handle_phi): Add phi param.
11442 (region_model_context::on_phi): New vfunc.
11443 (test_region_model_context::on_phi): New.
11444 * sm-malloc.cc (malloc_state_machine::on_phi): New.
11445 (malloc_state_machine::on_zero_assignment): New.
11446 * sm.h (state_machine::on_phi): New vfunc.
11448 2020-02-03 David Malcolm <dmalcolm@redhat.com>
11450 * engine.cc (supernode_cluster::dump_dot): Show BB index as
11451 well as SN index.
11452 * supergraph.cc (supernode::dump_dot): Likewise.
11454 2020-02-03 David Malcolm <dmalcolm@redhat.com>
11456 PR analyzer/93546
11457 * region-model.cc (region_model::on_call_pre): Update for new
11458 param of symbolic_region ctor.
11459 (region_model::deref_rvalue): Likewise.
11460 (region_model::add_new_malloc_region): Likewise.
11461 (make_region_for_type): Likewise, preserving type.
11462 * region-model.h (symbolic_region::symbolic_region): Add "type"
11463 param and pass it to base class ctor.
11465 2020-02-03 David Malcolm <dmalcolm@redhat.com>
11467 PR analyzer/93547
11468 * constraint-manager.cc
11469 (constraint_manager::get_or_add_equiv_class): Ensure types are
11470 compatible before comparing constants.
11472 2020-01-31 David Malcolm <dmalcolm@redhat.com>
11474 PR analyzer/93457
11475 * region-model.cc (make_region_for_type): Use VOID_TYPE_P rather
11476 than checking against void_type_node.
11478 2020-01-31 David Malcolm <dmalcolm@redhat.com>
11480 PR analyzer/93373
11481 * region-model.cc (ASSERT_COMPAT_TYPES): Convert to...
11482 (assert_compat_types): ...this, and bail when either type is NULL,
11483 or when VOID_TYPE_P (dst_type).
11484 (region_model::get_lvalue): Update for above conversion.
11485 (region_model::get_rvalue): Likewise.
11487 2020-01-31 David Malcolm <dmalcolm@redhat.com>
11489 PR analyzer/93379
11490 * region-model.cc (region_model::update_for_return_superedge):
11491 Move check for null result so that it also guards setting the
11492 lhs.
11494 2020-01-31 David Malcolm <dmalcolm@redhat.com>
11496 PR analyzer/93438
11497 * region-model.cc (stack_region::can_merge_p): Split into a two
11498 pass approach, creating all stack regions first, then populating
11499 them.
11500 (selftest::test_state_merging): Add test coverage for (a) the case
11501 of self-merging a model in which a local in an older stack frame
11502 points to a local in a more recent stack frame (which previously
11503 would ICE), and (b) the case of self-merging a model in which a
11504 local points to a global (which previously worked OK).
11506 2020-01-31 David Malcolm <dmalcolm@redhat.com>
11508 * analyzer.cc (is_named_call_p): Replace tests for fndecl being
11509 extern at file scope and having a non-NULL DECL_NAME with a call
11510 to maybe_special_function_p.
11511 * function-set.cc (function_set::contains_decl_p): Add call to
11512 maybe_special_function_p.
11514 2020-01-31 David Malcolm <dmalcolm@redhat.com>
11516 PR analyzer/93450
11517 * constraint-manager.cc
11518 (constraint_manager::get_or_add_equiv_class): Only compare constants
11519 if their types are compatible.
11520 * region-model.cc (constant_svalue::eval_condition): Replace check
11521 for identical types with call to types_compatible_p.
11523 2020-01-30 David Malcolm <dmalcolm@redhat.com>
11525 * program-state.cc (extrinsic_state::dump_to_pp): New.
11526 (extrinsic_state::dump_to_file): New.
11527 (extrinsic_state::dump): New.
11528 * program-state.h (extrinsic_state::dump_to_pp): New decl.
11529 (extrinsic_state::dump_to_file): New decl.
11530 (extrinsic_state::dump): New decl.
11531 * sm.cc: Include "pretty-print.h".
11532 (state_machine::dump_to_pp): New.
11533 * sm.h (state_machine::dump_to_pp): New decl.
11535 2020-01-30 David Malcolm <dmalcolm@redhat.com>
11537 * diagnostic-manager.cc (for_each_state_change): Use
11538 extrinsic_state::get_num_checkers rather than accessing m_checkers
11539 directly.
11540 * program-state.cc (program_state::program_state): Likewise.
11541 * program-state.h (extrinsic_state::m_checkers): Make private.
11543 2020-01-30 David Malcolm <dmalcolm@redhat.com>
11545 PR analyzer/93356
11546 * region-model.cc (region_model::eval_condition): In both
11547 overloads, bail out immediately on floating-point types.
11548 (region_model::eval_condition_without_cm): Likewise.
11549 (region_model::add_constraint): Likewise.
11551 2020-01-30 David Malcolm <dmalcolm@redhat.com>
11553 PR analyzer/93450
11554 * program-state.cc (sm_state_map::set_state): For the overload
11555 taking an svalue_id, bail out if the set_state on the ec does
11556 nothing. Convert the latter's return type from void to bool,
11557 returning true if anything changed.
11558 (sm_state_map::impl_set_state): Convert the return type from void
11559 to bool, returning true if the state changed.
11560 * program-state.h (sm_state_map::set_state): Convert return type
11561 from void to bool.
11562 (sm_state_map::impl_set_state): Likewise.
11563 * region-model.cc (constant_svalue::eval_condition): Only call
11564 fold_build2 if the types are the same.
11566 2020-01-29 Jakub Jelinek <jakub@redhat.com>
11568 * analyzer.h (PUSH_IGNORE_WFORMAT, POP_IGNORE_WFORMAT): Remove.
11569 * constraint-manager.cc: Include diagnostic-core.h before graphviz.h.
11570 (range::dump, equiv_class::print): Don't use PUSH_IGNORE_WFORMAT or
11571 POP_IGNORE_WFORMAT.
11572 * state-purge.cc: Include diagnostic-core.h before
11573 gimple-pretty-print.h.
11574 (state_purge_annotator::add_node_annotations, print_vec_of_names):
11575 Don't use PUSH_IGNORE_WFORMAT or POP_IGNORE_WFORMAT.
11576 * region-model.cc: Move diagnostic-core.h include before graphviz.h.
11577 (path_var::dump, svalue::print, constant_svalue::print_details,
11578 region::dump_to_pp, region::dump_child_label, region::print_fields,
11579 map_region::print_fields, map_region::dump_dot_to_pp,
11580 map_region::dump_child_label, array_region::print_fields,
11581 array_region::dump_dot_to_pp): Don't use PUSH_IGNORE_WFORMAT or
11582 POP_IGNORE_WFORMAT.
11584 2020-01-28 David Malcolm <dmalcolm@redhat.com>
11586 PR analyzer/93316
11587 * engine.cc (rewind_info_t::update_model): Get the longjmp call
11588 stmt via get_longjmp_call () rather than assuming it is the last
11589 stmt in the longjmp's supernode.
11590 (rewind_info_t::add_events_to_path): Get the location_t for the
11591 rewind_from_longjmp_event via get_longjmp_call () rather than from
11592 the supernode's get_end_location ().
11594 2020-01-28 David Malcolm <dmalcolm@redhat.com>
11596 * region-model.cc (poisoned_value_diagnostic::emit): Update for
11597 renaming of warning_at overload to warning_meta.
11598 * sm-file.cc (file_leak::emit): Likewise.
11599 * sm-malloc.cc (double_free::emit): Likewise.
11600 (possible_null_deref::emit): Likewise.
11601 (possible_null_arg::emit): Likewise.
11602 (null_deref::emit): Likewise.
11603 (null_arg::emit): Likewise.
11604 (use_after_free::emit): Likewise.
11605 (malloc_leak::emit): Likewise.
11606 (free_of_non_heap::emit): Likewise.
11607 * sm-sensitive.cc (exposure_through_output_file::emit): Likewise.
11608 * sm-signal.cc (signal_unsafe_call::emit): Likewise.
11609 * sm-taint.cc (tainted_array_index::emit): Likewise.
11611 2020-01-27 David Malcolm <dmalcolm@redhat.com>
11613 PR analyzer/93451
11614 * region-model.cc (tree_cmp): For the REAL_CST case, impose an
11615 arbitrary order on NaNs relative to other NaNs and to non-NaNs;
11616 const-correctness tweak.
11617 (ana::selftests::build_real_cst_from_string): New function.
11618 (ana::selftests::append_interesting_constants): New function.
11619 (ana::selftests::test_tree_cmp_on_constants): New test.
11620 (ana::selftests::test_canonicalization_4): New test.
11621 (ana::selftests::analyzer_region_model_cc_tests): Call the new
11622 tests.
11624 2020-01-27 David Malcolm <dmalcolm@redhat.com>
11626 PR analyzer/93349
11627 * engine.cc (run_checkers): Save and restore input_location.
11629 2020-01-27 David Malcolm <dmalcolm@redhat.com>
11631 * call-string.cc (call_string::cmp_1): Delete, moving body to...
11632 (call_string::cmp): ...here.
11633 * call-string.h (call_string::cmp_1): Delete decl.
11634 * engine.cc (worklist::key_t::cmp_1): Delete, moving body to...
11635 (worklist::key_t::cmp): ...here. Implement hash comparisons
11636 via comparison rather than subtraction to avoid overflow issues.
11637 * exploded-graph.h (worklist::key_t::cmp_1): Delete decl.
11638 * region-model.cc (tree_cmp): Eliminate buggy checking for
11639 symmetry.
11641 2020-01-27 David Malcolm <dmalcolm@redhat.com>
11643 * analyzer.cc (is_named_call_p): Check that fndecl is "extern"
11644 and at file scope. Potentially disregard prefix _ or __ in
11645 fndecl's name. Bail if the identifier is NULL.
11646 (is_setjmp_call_p): Expect a gcall rather than plain gimple.
11647 Remove special-case check for leading prefix, and also check for
11648 sigsetjmp.
11649 (is_longjmp_call_p): Also check for siglongjmp.
11650 (get_user_facing_name): New function.
11651 * analyzer.h (is_setjmp_call_p): Expect a gcall rather than plain
11652 gimple.
11653 (get_user_facing_name): New decl.
11654 * checker-path.cc (setjmp_event::get_desc): Use
11655 get_user_facing_name to avoid hardcoding the function name.
11656 (rewind_event::rewind_event): Add rewind_info param, using it to
11657 initialize new m_rewind_info field, and strengthen the assertion.
11658 (rewind_from_longjmp_event::get_desc): Use get_user_facing_name to
11659 avoid hardcoding the function name.
11660 (rewind_to_setjmp_event::get_desc): Likewise.
11661 * checker-path.h (setjmp_event::setjmp_event): Add setjmp_call
11662 param and use it to initialize...
11663 (setjmp_event::m_setjmp_call): New field.
11664 (rewind_event::rewind_event): Add rewind_info param.
11665 (rewind_event::m_rewind_info): New protected field.
11666 (rewind_from_longjmp_event::rewind_from_longjmp_event): Add
11667 rewind_info param.
11668 (class rewind_to_setjmp_event): Move rewind_info field to parent
11669 class.
11670 * diagnostic-manager.cc (diagnostic_manager::add_events_for_eedge):
11671 Update setjmp-handling for is_setjmp_call_p requiring a gcall;
11672 pass the call to the new setjmp_event.
11673 * engine.cc (exploded_node::on_stmt): Update for is_setjmp_call_p
11674 requiring a gcall.
11675 (stale_jmp_buf::emit): Use get_user_facing_name to avoid
11676 hardcoding the function names.
11677 (exploded_node::on_longjmp): Pass the longjmp_call when
11678 constructing rewind_info.
11679 (rewind_info_t::add_events_to_path): Pass the rewind_info_t to the
11680 rewind_from_longjmp_event's ctor.
11681 * exploded-graph.h (rewind_info_t::rewind_info_t): Add
11682 longjmp_call param.
11683 (rewind_info_t::get_longjmp_call): New.
11684 (rewind_info_t::m_longjmp_call): New.
11685 * region-model.cc (region_model::on_setjmp): Update comment to
11686 indicate this is also for sigsetjmp.
11687 * region-model.h (struct setjmp_record): Likewise.
11688 (class setjmp_svalue): Likewise.
11690 2020-01-27 David Malcolm <dmalcolm@redhat.com>
11692 PR analyzer/93276
11693 * analyzer.h (PUSH_IGNORE_WFORMAT, POP_IGNORE_WFORMAT): Guard these
11694 macros with GCC_VERSION >= 4006, making them no-op otherwise.
11695 * engine.cc (exploded_edge::exploded_edge): Specify template for
11696 base class initializer.
11697 (exploded_graph::add_edge): Specify template when chaining up to
11698 base class add_edge implementation.
11699 (viz_callgraph_node::dump_dot): Drop redundant "typename".
11700 (viz_callgraph_edge::viz_callgraph_edge): Specify template for
11701 base class initializer.
11702 * program-state.cc (sm_state_map::clone_with_remapping): Drop
11703 redundant "typename".
11704 (sm_state_map::print): Likewise.
11705 (sm_state_map::hash): Likewise.
11706 (sm_state_map::operator==): Likewise.
11707 (sm_state_map::remap_svalue_ids): Likewise.
11708 (sm_state_map::on_svalue_purge): Likewise.
11709 (sm_state_map::validate): Likewise.
11710 * program-state.h (sm_state_map::iterator_t): Likewise.
11711 * supergraph.h (superedge::superedge): Specify template for base
11712 class initializer.
11714 2020-01-23 David Malcolm <dmalcolm@redhat.com>
11716 PR analyzer/93375
11717 * supergraph.cc (callgraph_superedge::get_arg_for_parm): Fail
11718 gracefully is the number of parameters at the callee exceeds the
11719 number of arguments at the call stmt.
11720 (callgraph_superedge::get_parm_for_arg): Likewise.
11722 2020-01-22 David Malcolm <dmalcolm@redhat.com>
11724 PR analyzer/93382
11725 * program-state.cc (sm_state_map::on_svalue_purge): If the
11726 entry survives, but the origin is being purged, then reset the
11727 origin to null.
11729 2020-01-22 David Malcolm <dmalcolm@redhat.com>
11731 * sm-signal.cc: Fix nesting of CHECKING_P and namespace ana.
11733 2020-01-22 David Malcolm <dmalcolm@redhat.com>
11735 PR analyzer/93378
11736 * engine.cc (setjmp_svalue::compare_fields): Update for
11737 replacement of m_enode with m_setjmp_record.
11738 (setjmp_svalue::add_to_hash): Likewise.
11739 (setjmp_svalue::get_index): Rename...
11740 (setjmp_svalue::get_enode_index): ...to this.
11741 (setjmp_svalue::print_details): Update for replacement of m_enode
11742 with m_setjmp_record.
11743 (exploded_node::on_longjmp): Likewise.
11744 * exploded-graph.h (rewind_info_t::m_enode_origin): Replace...
11745 (rewind_info_t::m_setjmp_record): ...with this.
11746 (rewind_info_t::rewind_info_t): Update for replacement of m_enode
11747 with m_setjmp_record.
11748 (rewind_info_t::get_setjmp_point): Likewise.
11749 (rewind_info_t::get_setjmp_call): Likewise.
11750 * region-model.cc (region_model::dump_summary_of_map): Likewise.
11751 (region_model::on_setjmp): Likewise.
11752 * region-model.h (struct setjmp_record): New struct.
11753 (setjmp_svalue::m_enode): Replace...
11754 (setjmp_svalue::m_setjmp_record): ...with this.
11755 (setjmp_svalue::setjmp_svalue): Update for replacement of m_enode
11756 with m_setjmp_record.
11757 (setjmp_svalue::clone): Likewise.
11758 (setjmp_svalue::get_index): Rename...
11759 (setjmp_svalue::get_enode_index): ...to this.
11760 (setjmp_svalue::get_exploded_node): Replace...
11761 (setjmp_svalue::get_setjmp_record): ...with this.
11763 2020-01-22 David Malcolm <dmalcolm@redhat.com>
11765 PR analyzer/93316
11766 * analyzer.cc (is_setjmp_call_p): Check for "setjmp" as well as
11767 "_setjmp".
11769 2020-01-22 David Malcolm <dmalcolm@redhat.com>
11771 PR analyzer/93307
11772 * analysis-plan.h: Wrap everything namespace "ana".
11773 * analyzer-logging.cc: Likewise.
11774 * analyzer-logging.h: Likewise.
11775 * analyzer-pass.cc (pass_analyzer::execute): Update for "ana"
11776 namespace.
11777 * analyzer-selftests.cc: Wrap everything namespace "ana".
11778 * analyzer-selftests.h: Likewise.
11779 * analyzer.h: Likewise for forward decls of types.
11780 * call-string.h: Likewise.
11781 * checker-path.cc: Likewise.
11782 * checker-path.h: Likewise.
11783 * constraint-manager.cc: Likewise.
11784 * constraint-manager.h: Likewise.
11785 * diagnostic-manager.cc: Likewise.
11786 * diagnostic-manager.h: Likewise.
11787 * engine.cc: Likewise.
11788 * engine.h: Likewise.
11789 * exploded-graph.h: Likewise.
11790 * function-set.cc: Likewise.
11791 * function-set.h: Likewise.
11792 * pending-diagnostic.cc: Likewise.
11793 * pending-diagnostic.h: Likewise.
11794 * program-point.cc: Likewise.
11795 * program-point.h: Likewise.
11796 * program-state.cc: Likewise.
11797 * program-state.h: Likewise.
11798 * region-model.cc: Likewise.
11799 * region-model.h: Likewise.
11800 * sm-file.cc: Likewise.
11801 * sm-malloc.cc: Likewise.
11802 * sm-pattern-test.cc: Likewise.
11803 * sm-sensitive.cc: Likewise.
11804 * sm-signal.cc: Likewise.
11805 * sm-taint.cc: Likewise.
11806 * sm.cc: Likewise.
11807 * sm.h: Likewise.
11808 * state-purge.h: Likewise.
11809 * supergraph.cc: Likewise.
11810 * supergraph.h: Likewise.
11812 2020-01-21 David Malcolm <dmalcolm@redhat.com>
11814 PR analyzer/93352
11815 * region-model.cc (int_cmp): Rename to...
11816 (array_region::key_cmp): ...this, using key_t rather than int.
11817 Rewrite in terms of comparisons rather than subtraction to
11818 ensure qsort is anti-symmetric when handling extreme values.
11819 (array_region::walk_for_canonicalization): Update for above
11820 renaming.
11821 * region-model.h (array_region::key_cmp): New decl.
11823 2020-01-17 David Malcolm <dmalcolm@redhat.com>
11825 PR analyzer/93290
11826 * region-model.cc (region_model::eval_condition_without_cm): Avoid
11827 gcc_unreachable for unexpected operations for the case where
11828 we're comparing an svalue against itself.
11830 2020-01-17 David Malcolm <dmalcolm@redhat.com>
11832 PR analyzer/93281
11833 * region-model.cc
11834 (region_model::convert_byte_offset_to_array_index): Convert to
11835 ssizetype before dividing by byte_size. Use fold_binary rather
11836 than fold_build2 to avoid needlessly constructing a tree for the
11837 non-const case.
11839 2020-01-15 David Malcolm <dmalcolm@redhat.com>
11841 * engine.cc (class impl_region_model_context): Fix comment.
11843 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11845 PR analyzer/93212
11846 * region-model.cc (make_region_for_type): Use
11847 FUNC_OR_METHOD_TYPE_P rather than comparing against FUNCTION_TYPE.
11848 * region-model.h (function_region::function_region): Likewise.
11850 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11852 * program-state.cc (sm_state_map::clone_with_remapping): Copy
11853 m_global_state.
11854 (selftest::test_program_state_merging_2): New selftest.
11855 (selftest::analyzer_program_state_cc_tests): Call it.
11857 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11859 * checker-path.h (checker_path::get_checker_event): New function.
11860 (checker_path): Add DISABLE_COPY_AND_ASSIGN; make fields private.
11861 * diagnostic-manager.cc
11862 (diagnostic_manager::prune_for_sm_diagnostic): Replace direct
11863 access to checker_path::m_events with accessor functions. Fix
11864 overlong line.
11865 (diagnostic_manager::prune_interproc_events): Replace direct
11866 access to checker_path::m_events with accessor functions.
11867 (diagnostic_manager::finish_pruning): Likewise.
11869 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11871 * checker-path.h (checker_event::clone): Delete vfunc decl.
11872 (debug_event::clone): Delete vfunc impl.
11873 (custom_event::clone): Delete vfunc impl.
11874 (statement_event::clone): Delete vfunc impl.
11875 (function_entry_event::clone): Delete vfunc impl.
11876 (state_change_event::clone): Delete vfunc impl.
11877 (start_cfg_edge_event::clone): Delete vfunc impl.
11878 (end_cfg_edge_event::clone): Delete vfunc impl.
11879 (call_event::clone): Delete vfunc impl.
11880 (return_event::clone): Delete vfunc impl.
11881 (setjmp_event::clone): Delete vfunc impl.
11882 (rewind_from_longjmp_event::clone): Delete vfunc impl.
11883 (rewind_to_setjmp_event::clone): Delete vfunc impl.
11884 (warning_event::clone): Delete vfunc impl.
11886 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11888 * supergraph.cc (supernode::dump_dot): Ensure that the TABLE
11889 element has at least one TR.
11891 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11893 PR analyzer/58237
11894 * engine.cc (leak_stmt_finder::find_stmt): Use get_pure_location
11895 when comparing against UNKNOWN_LOCATION.
11896 (stmt_requires_new_enode_p): Likewise.
11897 (exploded_graph::dump_exploded_nodes): Likewise.
11898 * supergraph.cc (supernode::get_start_location): Likewise.
11899 (supernode::get_end_location): Likewise.
11901 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11903 PR analyzer/58237
11904 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
11905 selftest::analyzer_sm_file_cc_tests.
11906 * analyzer-selftests.h (selftest::analyzer_sm_file_cc_tests): New
11907 decl.
11908 * sm-file.cc: Include "analyzer/function-set.h" and
11909 "analyzer/analyzer-selftests.h".
11910 (get_file_using_fns): New function.
11911 (is_file_using_fn_p): New function.
11912 (fileptr_state_machine::on_stmt): Return true for known functions.
11913 (selftest::analyzer_sm_file_cc_tests): New function.
11915 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11917 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
11918 selftest::analyzer_sm_signal_cc_tests.
11919 * analyzer-selftests.h (selftest::analyzer_sm_signal_cc_tests):
11920 New decl.
11921 * sm-signal.cc: Include "analyzer/function-set.h" and
11922 "analyzer/analyzer-selftests.h".
11923 (get_async_signal_unsafe_fns): New function.
11924 (signal_unsafe_p): Reimplement in terms of the above.
11925 (selftest::analyzer_sm_signal_cc_tests): New function.
11927 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11929 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
11930 selftest::analyzer_function_set_cc_tests.
11931 * analyzer-selftests.h (selftest::analyzer_function_set_cc_tests):
11932 New decl.
11933 * function-set.cc: New file.
11934 * function-set.h: New file.
11936 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11938 * analyzer.h (fndecl_has_gimple_body_p): New decl.
11939 * engine.cc (impl_region_model_context::on_unknown_change): New
11940 function.
11941 (fndecl_has_gimple_body_p): Make non-static.
11942 (exploded_node::on_stmt): Treat __analyzer_dump_exploded_nodes as
11943 known. Track whether we have a call with unknown side-effects and
11944 pass it to on_call_post.
11945 * exploded-graph.h (impl_region_model_context::on_unknown_change):
11946 New decl.
11947 * program-state.cc (sm_state_map::on_unknown_change): New function.
11948 * program-state.h (sm_state_map::on_unknown_change): New decl.
11949 * region-model.cc: Include "bitmap.h".
11950 (region_model::on_call_pre): Return a bool, capturing whether the
11951 call has unknown side effects.
11952 (region_model::on_call_post): Add arg "bool unknown_side_effects"
11953 and if true, call handle_unrecognized_call.
11954 (class reachable_regions): New class.
11955 (region_model::handle_unrecognized_call): New function.
11956 * region-model.h (region_model::on_call_pre): Return a bool.
11957 (region_model::on_call_post): Add arg "bool unknown_side_effects".
11958 (region_model::handle_unrecognized_call): New decl.
11959 (region_model_context::on_unknown_change): New vfunc.
11960 (test_region_model_context::on_unknown_change): New function.
11962 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11964 * diagnostic-manager.cc (saved_diagnostic::operator==): Move here
11965 from header. Replace pointer equality test on m_var with call to
11966 pending_diagnostic::same_tree_p.
11967 * diagnostic-manager.h (saved_diagnostic::operator==): Move to
11968 diagnostic-manager.cc.
11969 * pending-diagnostic.cc (pending_diagnostic::same_tree_p): New.
11970 * pending-diagnostic.h (pending_diagnostic::same_tree_p): New.
11971 * sm-file.cc (file_diagnostic::subclass_equal_p): Replace pointer
11972 equality on m_arg with call to pending_diagnostic::same_tree_p.
11973 * sm-malloc.cc (malloc_diagnostic::subclass_equal_p): Likewise.
11974 (possible_null_arg::subclass_equal_p): Likewise.
11975 (null_arg::subclass_equal_p): Likewise.
11976 (free_of_non_heap::subclass_equal_p): Likewise.
11977 * sm-pattern-test.cc (pattern_match::operator==): Likewise.
11978 * sm-sensitive.cc (exposure_through_output_file::operator==):
11979 Likewise.
11980 * sm-taint.cc (tainted_array_index::operator==): Likewise.
11982 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11984 * diagnostic-manager.cc (dedupe_winners::add): Add logging
11985 of deduplication decisions made.
11987 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11989 * ChangeLog: New file.
11990 * analyzer-selftests.cc: New file.
11991 * analyzer-selftests.h: New file.
11992 * analyzer.opt: New file.
11993 * analysis-plan.cc: New file.
11994 * analysis-plan.h: New file.
11995 * analyzer-logging.cc: New file.
11996 * analyzer-logging.h: New file.
11997 * analyzer-pass.cc: New file.
11998 * analyzer.cc: New file.
11999 * analyzer.h: New file.
12000 * call-string.cc: New file.
12001 * call-string.h: New file.
12002 * checker-path.cc: New file.
12003 * checker-path.h: New file.
12004 * constraint-manager.cc: New file.
12005 * constraint-manager.h: New file.
12006 * diagnostic-manager.cc: New file.
12007 * diagnostic-manager.h: New file.
12008 * engine.cc: New file.
12009 * engine.h: New file.
12010 * exploded-graph.h: New file.
12011 * pending-diagnostic.cc: New file.
12012 * pending-diagnostic.h: New file.
12013 * program-point.cc: New file.
12014 * program-point.h: New file.
12015 * program-state.cc: New file.
12016 * program-state.h: New file.
12017 * region-model.cc: New file.
12018 * region-model.h: New file.
12019 * sm-file.cc: New file.
12020 * sm-malloc.cc: New file.
12021 * sm-malloc.dot: New file.
12022 * sm-pattern-test.cc: New file.
12023 * sm-sensitive.cc: New file.
12024 * sm-signal.cc: New file.
12025 * sm-taint.cc: New file.
12026 * sm.cc: New file.
12027 * sm.h: New file.
12028 * state-purge.cc: New file.
12029 * state-purge.h: New file.
12030 * supergraph.cc: New file.
12031 * supergraph.h: New file.
12033 2019-12-13 David Malcolm <dmalcolm@redhat.com>
12035 * Initial creation
12037 \f
12038 Copyright (C) 2019-2024 Free Software Foundation, Inc.
12040 Copying and distribution of this file, with or without modification,
12041 are permitted in any medium without royalty provided the copyright
12042 notice and this notice are preserved.