| blob | 961764c97c6db878dfb8810baead269a496ec8a7 |
1 2024-01-24 David Malcolm <dmalcolm@redhat.com>
3 PR analyzer/112977
4 * engine.cc (impl_region_model_context::on_liveness_change): Pass
5 m_ext_state to sm_state_map::on_liveness_change.
6 * program-state.cc (sm_state_map::on_svalue_leak): Guard removal
7 of map entry based on can_purge_p.
8 (sm_state_map::on_liveness_change): Add ext_state param. Add
9 workaround for bad interaction between state purging and
10 alt-inherited sm-state.
11 * program-state.h (sm_state_map::on_liveness_change): Add
12 ext_state param.
13 * sm-taint.cc
14 (taint_state_machine::has_alt_get_inherited_state_p): New.
15 (taint_state_machine::can_purge_p): Return false for "has_lb" and
16 "has_ub".
17 * sm.h (state_machine::has_alt_get_inherited_state_p): New vfunc.
19 2024-01-18 David Malcolm <dmalcolm@redhat.com>
21 PR analyzer/111361
22 * region-model.cc (svalue_byte_range_has_null_terminator_1): The
23 initial byte of an all-zeroes SVAL is a zero byte. Remove
24 gcc_unreachable from SK_CONSTANT for constants that aren't
25 STRING_CST or INTEGER_CST.
27 2024-01-18 David Malcolm <dmalcolm@redhat.com>
29 PR analyzer/112811
30 * region-model.cc (fragment::dump_to_pp): New.
31 (fragment::has_null_terminator): Convert to...
32 (svalue_byte_range_has_null_terminator_1): ...this new function,
33 updating to use a byte_range relative to the start of the svalue.
34 (svalue_byte_range_has_null_terminator): New.
35 (fragment::string_cst_has_null_terminator): Convert to...
36 (string_cst_has_null_terminator): ...this, updating to use a
37 byte_range relative to the start of the svalue.
38 (iterable_cluster::dump_to_pp): New.
39 (region_model::scan_for_null_terminator): Add logging, moving body
40 to...
41 (region_model::scan_for_null_terminator_1): ...this new function,
42 adding more logging, and updating to use
43 svalue_byte_range_has_null_terminator.
44 * region-model.h (region_model::scan_for_null_terminator_1): New
45 decl.
47 2024-01-16 David Malcolm <dmalcolm@redhat.com>
49 PR analyzer/106229
50 * analyzer.h (compare_constants): New decl.
51 * constraint-manager.cc (compare_constants): Make non-static.
52 * sm-taint.cc: Add include "fold-const.h".
53 (class concrete_range): New.
54 (get_possible_range): New.
55 (index_can_be_out_of_bounds_p): New.
56 (region_model::check_region_for_taint): Reject
57 -Wanalyzer-tainted-array-index if the type of the value makes it
58 impossible for it to be out-of-bounds of the array.
60 2024-01-16 David Malcolm <dmalcolm@redhat.com>
62 PR analyzer/113333
63 * region-model-manager.cc
64 (region_model_manager::maybe_fold_unaryop): Casting all zeroes
65 should give all zeroes.
67 2024-01-04 David Malcolm <dmalcolm@redhat.com>
69 * analyzer.opt.urls: New file, autogenerated by
70 regenerate-opt-urls.py.
72 2024-01-04 David Malcolm <dmalcolm@redhat.com>
74 * checker-event.cc: Include "diagnostic-format-sarif.h" and
75 "tree-logical-location.h".
76 (checker_event::maybe_add_sarif_properties): New.
77 (superedge_event::maybe_add_sarif_properties): New.
78 (superedge_event::superedge_event): Add comment.
79 * checker-event.h (checker_event::maybe_add_sarif_properties): New
80 decl.
81 (superedge_event::maybe_add_sarif_properties): New decl.
83 2024-01-04 David Malcolm <dmalcolm@redhat.com>
85 PR analyzer/112790
86 * checker-event.cc (class inlining_info): Move to...
87 * inlining-iterator.h (class inlining_info): ...here.
88 * sm-malloc.cc: Include "analyzer/inlining-iterator.h".
89 (maybe_complain_about_deref_before_check): Reject stmts that were
90 inlined from another function.
92 2024-01-04 David Malcolm <dmalcolm@redhat.com>
94 PR analyzer/113222
95 * access-diagram.cc (valid_region_spatial_item::add_boundaries):
96 Handle TYPE_DOMAIN being null.
97 (valid_region_spatial_item::add_array_elements_to_table):
98 Likewise.
100 2023-12-16 David Malcolm <dmalcolm@redhat.com>
102 * analyzer.cc: Include "tree-pretty-print.h" and
103 "diagnostic-event-id.h".
104 (tree_to_json): New.
105 (diagnostic_event_id_to_json): New.
106 (bit_offset_to_json): New.
107 (byte_offset_to_json): New.
108 * analyzer.h (tree_to_json): New decl.
109 (diagnostic_event_id_to_json): New decl.
110 (bit_offset_to_json): New decl.
111 (byte_offset_to_json): New decl.
112 * bounds-checking.cc: Include "diagnostic-format-sarif.h".
113 (out_of_bounds::maybe_add_sarif_properties): New.
114 (concrete_out_of_bounds::maybe_add_sarif_properties): New.
115 (concrete_past_the_end::maybe_add_sarif_properties): New.
116 (symbolic_past_the_end::maybe_add_sarif_properties): New.
117 * region-model.cc (region_to_value_map::to_json): New.
118 (region_model::to_json): New.
119 * region-model.h (region_to_value_map::to_json): New decl.
120 (region_model::to_json): New decl.
121 * store.cc (bit_range::to_json): New.
122 (byte_range::to_json): New.
123 * store.h (bit_range::to_json): New decl.
124 (byte_range::to_json): New decl.
126 2023-12-16 David Malcolm <dmalcolm@redhat.com>
128 PR analyzer/112792
129 * bounds-checking.cc
130 (out_of_bounds::oob_region_creation_event_capacity): Rename
131 "capacity" to "byte_capacity". Layout fix.
132 (out_of_bounds::::add_region_creation_events): Rename
133 "capacity" to "byte_capacity".
134 (class concrete_out_of_bounds): Rename m_out_of_bounds_range to
135 m_out_of_bounds_bits and convert from a byte_range to a bit_range.
136 (concrete_out_of_bounds::get_out_of_bounds_bytes): New.
137 (concrete_past_the_end::concrete_past_the_end): Rename param
138 "byte_bound" to "bit_bound". Initialize m_byte_bound.
139 (concrete_past_the_end::subclass_equal_p): Update for renaming
140 of m_byte_bound to m_bit_bound.
141 (concrete_past_the_end::m_bit_bound): New field.
142 (concrete_buffer_overflow::concrete_buffer_overflow): Convert
143 param "range" from byte_range to bit_range. Rename param
144 "byte_bound" to "bit_bound".
145 (concrete_buffer_overflow::emit): Update for bits vs bytes.
146 (concrete_buffer_overflow::describe_final_event): Split
147 into...
148 (concrete_buffer_overflow::describe_final_event_as_bytes): ...this
149 (concrete_buffer_overflow::describe_final_event_as_bits): ...and
150 this.
151 (concrete_buffer_over_read::concrete_buffer_over_read): Convert
152 param "range" from byte_range to bit_range. Rename param
153 "byte_bound" to "bit_bound".
154 (concrete_buffer_over_read::emit): Update for bits vs bytes.
155 (concrete_buffer_over_read::describe_final_event): Split into...
156 (concrete_buffer_over_read::describe_final_event_as_bytes):
157 ...this
158 (concrete_buffer_over_read::describe_final_event_as_bits): ...and
159 this.
160 (concrete_buffer_underwrite::concrete_buffer_underwrite): Convert
161 param "range" from byte_range to bit_range.
162 (concrete_buffer_underwrite::describe_final_event): Split into...
163 (concrete_buffer_underwrite::describe_final_event_as_bytes):
164 ...this
165 (concrete_buffer_underwrite::describe_final_event_as_bits): ...and
166 this.
167 (concrete_buffer_under_read::concrete_buffer_under_read): Convert
168 param "range" from byte_range to bit_range.
169 (concrete_buffer_under_read::describe_final_event): Split into...
170 (concrete_buffer_under_read::describe_final_event_as_bytes):
171 ...this
172 (concrete_buffer_under_read::describe_final_event_as_bits): ...and
173 this.
174 (region_model::check_region_bounds): Use bits for concrete values,
175 and rename locals to indicate whether we're dealing with bits or
176 bytes. Specifically, replace "num_bytes_sval" with
177 "num_bits_sval", and get it from reg's "get_bit_size_sval".
178 Replace "num_bytes_tree" with "num_bits_tree". Rename "capacity"
179 to "byte_capacity". Rename "cst_capacity_tree" to
180 "cst_byte_capacity_tree". Replace "offset" and
181 "num_bytes_unsigned" with "bit_offset" and "num_bits_unsigned"
182 respectively, converting from byte_offset_t to bit_offset_t.
183 Replace "out" and "read_bytes" with "bits_outside" and "read_bits"
184 respectively, converting from byte_range to bit_range. Convert
185 "buffer" from byte_range to bit_range. Replace "byte_bound" with
186 "bit_bound".
187 * region.cc (region::get_bit_size_sval): New.
188 (offset_region::get_bit_offset): New.
189 (offset_region::get_bit_size_sval): New.
190 (sized_region::get_bit_size_sval): New.
191 (bit_range_region::get_bit_size_sval): New.
192 * region.h (region::get_bit_size_sval): New vfunc.
193 (offset_region::get_bit_offset): New decl.
194 (offset_region::get_bit_size_sval): New decl.
195 (sized_region::get_bit_size_sval): New decl.
196 (bit_range_region::get_bit_size_sval): New decl.
197 * store.cc (bit_range::intersects_p): New, based on
198 byte_range::intersects_p.
199 (bit_range::exceeds_p): New, based on byte_range::exceeds_p.
200 (bit_range::falls_short_of_p): New, based on
201 byte_range::falls_short_of_p.
202 (byte_range::intersects_p): Delete.
203 (byte_range::exceeds_p): Delete.
204 (byte_range::falls_short_of_p): Delete.
205 * store.h (bit_range::intersects_p): New overload.
206 (bit_range::exceeds_p): New.
207 (bit_range::falls_short_of_p): New.
208 (byte_range::intersects_p): Delete.
209 (byte_range::exceeds_p): Delete.
210 (byte_range::falls_short_of_p): Delete.
212 2023-12-14 David Malcolm <dmalcolm@redhat.com>
214 PR analyzer/112655
215 * infinite-loop.cc (infinite_loop::infinite_loop): Pass eedges
216 via rvalue reference rather than by value.
217 (starts_infinite_loop_p): Move eedges when constructing an
218 infinite_loop instance.
219 * sm-file.cc (fileptr_state_machine::fileptr_state_machine): Use
220 initializer list for states.
221 * sm-sensitive.cc
222 (sensitive_state_machine::sensitive_state_machine): Likewise.
223 * sm-signal.cc (signal_state_machine::signal_state_machine):
224 Likewise.
225 * sm-taint.cc (taint_state_machine::taint_state_machine):
226 Likewise.
227 * varargs.cc (va_list_state_machine::va_list_state_machine): Likewise.
229 2023-12-11 David Malcolm <dmalcolm@redhat.com>
231 PR analyzer/112955
232 * engine.cc (feasibility_state::feasibility_state): Initialize
233 m_snodes_visited.
235 2023-12-11 Andrew Pinski <apinski@marvell.com>
237 * region-model-manager.cc (maybe_undo_optimize_bit_field_compare): Remove
238 the check for type being unsigned_char_type_node.
240 2023-12-08 David Malcolm <dmalcolm@redhat.com>
242 * sm-taint.cc (taint_state_machine::alt_get_inherited_state): Fix
243 handling of TRUNC_MOD_EXPR.
245 2023-12-08 David Malcolm <dmalcolm@redhat.com>
247 * region-model.cc (contains_uninit_p): Only check for
248 svalues that the infoleak warning can handle.
250 2023-12-08 David Malcolm <dmalcolm@redhat.com>
252 PR analyzer/112889
253 * store.h (concrete_binding::concrete_binding): Strengthen
254 assertion to require size to be be positive, rather than just
255 non-zero.
256 (concrete_binding::mark_deleted): Use size rather than start bit
257 offset.
258 (concrete_binding::mark_empty): Likewise.
259 (concrete_binding::is_deleted): Likewise.
260 (concrete_binding::is_empty): Likewise.
262 2023-12-07 Alexandre Oliva <oliva@adacore.com>
264 * region-model.cc (has_nondefault_case_for_value_p): Take
265 enumerate type as a parameter.
266 (region_model::apply_constraints_for_gswitch): Cope with
267 integral promotion type casts.
269 2023-12-07 David Malcolm <dmalcolm@redhat.com>
271 PR analyzer/103546
272 PR analyzer/112850
273 * analyzer.opt (-param=analyzer-max-svalue-depth=): Increase from
274 12 to 18.
275 (Wanalyzer-symbol-too-complex): New.
276 * diagnostic-manager.cc
277 (null_assignment_sm_context::clear_all_per_svalue_state): New.
278 * engine.cc (impl_sm_context::clear_all_per_svalue_state): New.
279 * program-state.cc (sm_state_map::clear_all_per_svalue_state):
280 New.
281 * program-state.h (sm_state_map::clear_all_per_svalue_state): New
282 decl.
283 * region-model-manager.cc
284 (region_model_manager::reject_if_too_complex): Add
285 -Wanalyzer-symbol-too-complex.
286 * sm-taint.cc (taint_state_machine::on_condition): Handle
287 comparisons against UNKNOWN.
288 * sm.h (sm_context::clear_all_per_svalue_state): New.
290 2023-12-06 David Malcolm <dmalcolm@redhat.com>
292 * engine.cc (dump_analyzer_json): Use
293 flag_diagnostics_json_formatting.
295 2023-12-01 David Malcolm <dmalcolm@redhat.com>
297 * analyzer.h (class saved_diagnostic): New forward decl.
298 * bounds-checking.cc: Update for changes to
299 pending_diagnostic::emit.
300 * call-details.cc: Likewise.
301 * diagnostic-manager.cc: Include "diagnostic-format-sarif.h".
302 (saved_diagnostic::maybe_add_sarif_properties): New.
303 (class pending_diagnostic_metadata): New.
304 (diagnostic_manager::emit_saved_diagnostic): Create a
305 pending_diagnostic_metadata and a diagnostic_emission_context.
306 Pass the latter to the pending_diagnostic::emit vfunc.
307 * diagnostic-manager.h
308 (saved_diagnostic::maybe_add_sarif_properties): New decl.
309 * engine.cc: Update for changes to pending_diagnostic::emit.
310 * infinite-loop.cc: Likewise.
311 * infinite-recursion.cc: Likewise.
312 * kf-analyzer.cc: Likewise.
313 * kf.cc: Likewise.
314 * pending-diagnostic.cc
315 (diagnostic_emission_context::get_pending_diagnostic): New.
316 (diagnostic_emission_context::warn): New.
317 (diagnostic_emission_context::inform): New.
318 * pending-diagnostic.h (class diagnostic_emission_context): New.
319 (pending_diagnostic::emit): Update params.
320 (pending_diagnostic::maybe_add_sarif_properties): New vfunc.
321 * region.cc: Don't include "diagnostic-metadata.h".
322 * region-model.cc: Include "diagnostic-format-sarif.h". Update
323 for changes to pending_diagnostic::emit.
324 (exposure_through_uninit_copy::maybe_add_sarif_properties): New.
325 * sm-fd.cc: Update for changes to pending_diagnostic::emit.
326 * sm-file.cc: Likewise.
327 * sm-malloc.cc: Likewise.
328 * sm-pattern-test.cc: Likewise.
329 * sm-sensitive.cc: Likewise.
330 * sm-signal.cc: Likewise.
331 * sm-taint.cc: Likewise.
332 * store.cc: Don't include "diagnostic-metadata.h".
333 * varargs.cc: Update for changes to pending_diagnostic::emit.
335 2023-11-19 David Malcolm <dmalcolm@redhat.com>
337 * analyzer.h: Include "rich-location.h".
339 2023-11-19 David Malcolm <dmalcolm@redhat.com>
341 PR analyzer/107573
342 * analyzer.h (register_known_functions): Add region_model_manager
343 param.
344 * analyzer.opt (Wanalyzer-undefined-behavior-strtok): New.
345 * call-summary.cc
346 (call_summary_replay::convert_region_from_summary_1): Handle
347 RK_PRIVATE.
348 * engine.cc (impl_run_checkers): Pass model manager to
349 register_known_functions.
350 * kf.cc (class undefined_function_behavior): New.
351 (class kf_strtok): New.
352 (register_known_functions): Add region_model_manager param.
353 Use it to register "strtok".
354 * region-model-manager.cc
355 (region_model_manager::get_or_create_conjured_svalue): Add "idx"
356 param.
357 * region-model-manager.h
358 (region_model_manager::get_or_create_conjured_svalue): Add "idx"
359 param.
360 (region_model_manager::get_root_region): New accessor.
361 * region-model.cc (region_model::scan_for_null_terminator): Handle
362 "expr" being null.
363 (region_model::get_representative_path_var_1): Handle RK_PRIVATE.
364 * region-model.h (region_model::called_from_main_p): Make public.
365 * region.cc (region::get_memory_space): Handle RK_PRIVATE.
366 (region::can_have_initial_svalue_p): Handle MEMSPACE_PRIVATE.
367 (private_region::dump_to_pp): New.
368 * region.h (MEMSPACE_PRIVATE): New.
369 (RK_PRIVATE): New.
370 (class private_region): New.
371 (is_a_helper <const private_region *>::test): New.
372 * store.cc (store::replay_call_summary_cluster): Handle
373 RK_PRIVATE.
374 * svalue.h (struct conjured_svalue::key_t): Add "idx" param to
375 ctor and "m_idx" field.
376 (class conjured_svalue::conjured_svalue): Likewise.
378 2023-11-18 David Malcolm <dmalcolm@redhat.com>
380 PR analyzer/106147
381 * analyzer.opt (Wanalyzer-infinite-loop): New option.
382 (fdump-analyzer-infinite-loop): New option.
383 * checker-event.h (start_cfg_edge_event::get_desc): Drop "final".
384 (start_cfg_edge_event::maybe_describe_condition): Convert from
385 private to protected.
386 * checker-path.h (checker_path::get_logger): New.
387 * diagnostic-manager.cc (process_worklist_item): Update for
388 new context param of maybe_update_for_edge.
389 * engine.cc
390 (impl_region_model_context::impl_region_model_context): Add
391 out_could_have_done_work param to both ctors and use it to
392 initialize mm_out_could_have_done_work.
393 (impl_region_model_context::maybe_did_work): New vfunc
394 implementation.
395 (exploded_node::on_stmt): Add out_could_have_done_work param and
396 pass to ctxt ctor.
397 (exploded_node::on_stmt_pre): Treat setjmp and longjmp as "doing
398 work".
399 (exploded_node::on_longjmp): Likewise.
400 (exploded_edge::exploded_edge): Add "could_do_work" param and use
401 it to initialize m_could_do_work_p.
402 (exploded_edge::dump_dot_label): Add result of could_do_work_p.
403 (exploded_graph::add_function_entry): Mark edge as doing no work.
404 (exploded_graph::add_edge): Add "could_do_work" param and pass to
405 exploded_edge ctor.
406 (add_tainted_args_callback): Treat as doing no work.
407 (exploded_graph::process_worklist): Likewise when merging nodes.
408 (maybe_process_run_of_before_supernode_enodes::item): Likewise.
409 (exploded_graph::maybe_create_dynamic_call): Likewise.
410 (exploded_graph::process_node): Likewise for phi nodes.
411 Pass in a "could_have_done_work" bool when handling stmts and use
412 when creating edges. Assume work is done at bifurcation.
413 (exploded_path::feasible_p): Update for new context param of
414 maybe_update_for_edge.
415 (feasibility_state::feasibility_state): New ctor.
416 (feasibility_state::operator=): New.
417 (feasibility_state::maybe_update_for_edge): Add ctxt param and use
418 it. Fix missing newline when logging state.
419 (impl_run_checkers): Call exploded_graph::detect_infinite_loops.
420 * exploded-graph.h
421 (impl_region_model_context::impl_region_model_context): Add
422 out_could_have_done_work param to both ctors.
423 (impl_region_model_context::maybe_did_work): New decl.
424 (impl_region_model_context::checking_for_infinite_loop_p): New.
425 (impl_region_model_context::on_unusable_in_infinite_loop): New.
426 (impl_region_model_context::m_out_could_have_done_work): New
427 field.
428 (exploded_node::on_stmt): Add "out_could_have_done_work" param.
429 (exploded_edge::exploded_edge): Add "could_do_work" param.
430 (exploded_edge::could_do_work_p): New accessor.
431 (exploded_edge::m_could_do_work_p): New field.
432 (exploded_graph::add_edge): Add "could_do_work" param.
433 (exploded_graph::detect_infinite_loops): New decl.
434 (feasibility_state::feasibility_state): New ctor.
435 (feasibility_state::operator=): New decl.
436 (feasibility_state::maybe_update_for_edge): Add ctxt param.
437 * infinite-loop.cc: New file.
438 * program-state.cc (program_state::on_edge): Log the rejected
439 constraint when region_model::maybe_update_for_edge fails.
440 * region-model.cc (region_model::on_assignment): Treat any writes
441 other than to the stack as "doing work".
442 (region_model::on_stmt_pre): Treat all asm stmts as "doing work".
443 (region_model::on_call_post): Likewise for all calls to functions
444 with unknown side effects.
445 (region_model::handle_phi): Add svals_changing_meaning param.
446 Mark widening svalue in phi nodes as changing meaning.
447 (unusable_in_infinite_loop_constraint_p): New.
448 (region_model::add_constraint): If we're checking for an infinite
449 loop, bail out on unusable svalues, or if we don't have a definite
450 true/false for the constraint.
451 (region_model::update_for_phis): Gather all svalues changing
452 meaning in phi nodes, and purge constraints involving them.
453 (region_model::replay_call_summary): Treat all call summaries as
454 doing work.
455 (region_model::can_merge_with_p): Purge constraints involving
456 svalues that change meaning.
457 (model_merger::on_widening_reuse): New.
458 (test_iteration_1): Likewise.
459 (selftest::test_iteration_1): Remove assertion that model6 "knows"
460 that i < 157.
461 * region-model.h (region_model::handle_phi): Add
462 svals_changing_meaning param
463 (region_model_context::maybe_did_work): New pure virtual func.
464 (region_model_context::checking_for_infinite_loop_p): Likewise.
465 (region_model_context::on_unusable_in_infinite_loop): Likewise.
466 (noop_region_model_context::maybe_did_work): Implement.
467 (noop_region_model_context::checking_for_infinite_loop_p):
468 Likewise.
469 (noop_region_model_context::on_unusable_in_infinite_loop):
470 Likewise.
471 (region_model_context_decorator::maybe_did_work): Implement.
472 (region_model_context_decorator::checking_for_infinite_loop_p):
473 Likewise.
474 (region_model_context_decorator::on_unusable_in_infinite_loop):
475 Likewise.
476 (model_merger::on_widening_reuse): New decl.
477 (model_merger::m_svals_changing_meaning): New field.
478 * sm-signal.cc (register_signal_handler::impl_transition): Assume
479 the edge "does work".
480 * supergraph.cc (supernode::get_start_location): Use CFG edge's
481 goto_locus if available.
482 (supernode::get_end_location): Likewise.
483 (cfg_superedge::dump_label_to_pp): Dump edges with a "goto_locus"
484 * supergraph.h (cfg_superedge::get_goto_locus): New.
485 * svalue.cc (svalue::can_merge_p): Call on_widening_reuse for
486 widening values.
487 (involvement_visitor::visit_widening_svalue): New.
488 (svalue::involves_p): Update assertion to allow widening svalues.
490 2023-11-14 David Malcolm <dmalcolm@redhat.com>
492 PR analyzer/103533
493 * sm-taint.cc: Remove "experimental" from comment.
494 * sm.cc (make_checkers): Always add taint state machine.
496 2023-11-04 David Malcolm <dmalcolm@redhat.com>
498 * bounds-checking.cc: Update for changes to diagnostic_context.
500 2023-11-02 David Malcolm <dmalcolm@redhat.com>
502 PR analyzer/112317
503 * access-diagram.cc (class x_aligned_x_ruler_widget): Eliminate
504 unused field "m_col_widths".
505 (access_diagram_impl::add_valid_vs_invalid_ruler): Update for
506 above change.
507 * region-model.cc
508 (check_one_function_attr_null_terminated_string_arg): Remove
509 unused variables "cd_unchecked", "strlen_sval", and
510 "limited_sval".
511 * region-model.h (region_model_context_decorator::warn): Add
512 missing "override".
514 2023-10-31 David Malcolm <dmalcolm@redhat.com>
516 * record-layout.cc: New file, based on material in region-model.cc.
517 * record-layout.h: Likewise.
518 * region-model.cc: Include "analyzer/record-layout.h".
519 (class record_layout): Move to record-layout.cc and .h
521 2023-10-26 David Malcolm <dmalcolm@redhat.com>
523 * region-model.cc
524 (region_model::check_external_function_for_access_attr): Split
525 out, replacing with...
526 (region_model::check_function_attr_access): ...this new function
527 and...
528 (region_model::check_function_attrs): ...this new function.
529 (region_model::check_one_function_attr_null_terminated_string_arg):
530 New.
531 (region_model::check_function_attr_null_terminated_string_arg):
532 New.
533 (region_model::handle_unrecognized_call): Update for renaming of
534 check_external_function_for_access_attr to check_function_attrs.
535 (region_model::check_for_null_terminated_string_arg): Add return
536 value to one overload. Make both overloads const.
537 * region-model.h: Include "stringpool.h" and "attribs.h".
538 (region_model::check_for_null_terminated_string_arg): Add return
539 value to one overload. Make both overloads const.
540 (region_model::check_external_function_for_access_attr): Delete
541 decl.
542 (region_model::check_function_attr_access): New decl.
543 (region_model::check_function_attr_null_terminated_string_arg):
544 New decl.
545 (region_model::check_one_function_attr_null_terminated_string_arg):
546 New decl.
547 (region_model::check_function_attrs): New decl.
549 2023-10-09 David Malcolm <dmalcolm@redhat.com>
551 * access-diagram.cc (boundaries::add): Explicitly state
552 "boundaries::" scope for "kind" enum.
554 2023-10-08 David Malcolm <dmalcolm@redhat.com>
556 PR analyzer/111155
557 * access-diagram.cc (boundaries::boundaries): Add logger param
558 (boundaries::add): Add logging.
559 (boundaries::get_hard_boundaries_in_range): New.
560 (boundaries::m_logger): New field.
561 (boundaries::get_table_x_for_offset): Make public.
562 (class svalue_spatial_item): New.
563 (class compound_svalue_spatial_item): New.
564 (add_ellipsis_to_gaps): New.
565 (valid_region_spatial_item::valid_region_spatial_item): Add theme
566 param. Initialize m_boundaries, m_existing_sval, and
567 m_existing_sval_spatial_item.
568 (valid_region_spatial_item::add_boundaries): Set m_boundaries.
569 Add boundaries for any m_existing_sval_spatial_item.
570 (valid_region_spatial_item::add_array_elements_to_table): Rewrite
571 creation of min/max index in terms of
572 maybe_add_array_index_to_table. Rewrite ellipsis code using
573 add_ellipsis_to_gaps. Add index values for any hard boundaries
574 within the valid region.
575 (valid_region_spatial_item::maybe_add_array_index_to_table): New,
576 based on code formerly in add_array_elements_to_table.
577 (valid_region_spatial_item::make_table): Make use of
578 m_existing_sval_spatial_item, if any.
579 (valid_region_spatial_item::m_boundaries): New field.
580 (valid_region_spatial_item::m_existing_sval): New field.
581 (valid_region_spatial_item::m_existing_sval_spatial_item): New
582 field.
583 (class svalue_spatial_item): Rename to...
584 (class written_svalue_spatial_item): ...this.
585 (class string_region_spatial_item): Rename to..
586 (class string_literal_spatial_item): ...this. Add "kind".
587 (string_literal_spatial_item::add_boundaries): Use m_kind to
588 determine kind of boundary. Update for renaming of m_actual_bits
589 to m_bits.
590 (string_literal_spatial_item::make_table): Likewise. Support not
591 displaying a row for byte indexes, and not displaying a row for
592 the type.
593 (string_literal_spatial_item::add_column_for_byte): Make byte index
594 row optional.
595 (svalue_spatial_item::make): Convert to...
596 (make_written_svalue_spatial_item): ...this.
597 (make_existing_svalue_spatial_item): New.
598 (access_diagram_impl::access_diagram_impl): Pass theme to
599 m_valid_region_spatial_item ctor. Update for renaming of
600 m_svalue_spatial_item.
601 (access_diagram_impl::find_boundaries): Pass logger to boundaries.
602 Update for renaming of...
603 (access_diagram_impl::m_svalue_spatial_item): Rename to...
604 (access_diagram_impl::m_written_svalue_spatial_item): ...this.
606 2023-10-03 David Malcolm <dmalcolm@redhat.com>
608 * analyzer-logging.cc (logger::log_va_partial): Use text_info
609 ctor.
610 * analyzer.cc (make_label_text): Likewise.
611 (make_label_text_n): Likewise.
612 * pending-diagnostic.cc (evdesc::event_desc::formatted_print):
613 Likewise.
615 2023-10-02 David Malcolm <dmalcolm@redhat.com>
617 * program-point.cc: Update for grouping of source printing fields
618 within diagnostic_context.
620 2023-09-15 David Malcolm <dmalcolm@redhat.com>
622 * analyzer.cc (get_stmt_location): Handle null stmt.
623 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic): Copy
624 m_loc from ploc.
625 (saved_diagnostic::operator==): Compare m_loc.
626 (saved_diagnostic::calc_best_epath): Only use m_stmt_finder if
627 m_loc is unknown.
628 (dedupe_key::dedupe_key): Initialize m_loc.
629 (dedupe_key::operator==): Compare m_loc.
630 (dedupe_key::get_location): Use m_loc if it's known.
631 (dedupe_key::m_loc): New field.
632 (diagnostic_manager::emit_saved_diagnostic): Only call
633 get_emission_location if m_loc is unknown, preferring to use m_loc
634 if it's available.
635 * diagnostic-manager.h (saved_diagnostic::m_loc): New field.
636 (pending_location::pending_location): Initialize m_loc. Add
637 overload taking a location_t rather than a stmt/stmt_finder.
638 (pending_location::m_loc): New field.
640 2023-09-15 David Malcolm <dmalcolm@redhat.com>
642 * analyzer.h (struct pending_location): New forward decl.
643 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic):
644 Replace params "enode", "snode", "stmt", and "stmt_finder" with
645 "ploc".
646 (diagnostic_manager::add_diagnostic): Likewise for both overloads.
647 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic):
648 Likewise.
649 (struct pending_location): New.
650 (diagnostic_manager::add_diagnostic): Replace params "enode",
651 "snode", "stmt", and "stmt_finder" with "ploc".
652 * engine.cc (impl_region_model_context::warn): Update call to
653 add_diagnostic for above change.
654 (impl_sm_context::warn): Likewise.
655 (impl_region_model_context::on_state_leak): Likewise.
656 * infinite-recursion.cc
657 (exploded_graph::detect_infinite_recursion): Likewise.
659 2023-09-15 David Malcolm <dmalcolm@redhat.com>
661 * region-model.cc (region_model::get_gassign_result): Handle
662 volatile ops by using a conjured_svalue.
664 2023-09-14 David Malcolm <dmalcolm@redhat.com>
666 * checker-event.h (checker_event::get_thread_id): New.
667 * checker-path.h (class checker_path): Implement thread-related
668 vfuncs via a single simple_diagnostic_thread instance named
669 "main".
671 2023-09-14 David Malcolm <dmalcolm@redhat.com>
673 * diagnostic-manager.cc (compatible_epath_p): Fix missing return.
675 2023-09-14 David Malcolm <dmalcolm@redhat.com>
677 * diagnostic-manager.cc (process_worklist_item): Use
678 std::unique_ptr rather than plain rejected_constraint *.
679 * engine.cc (exploded_path::feasible_p): Likewise.
680 (feasibility_state::maybe_update_for_edge): Likewise.
681 * exploded-graph.h (feasibility_problem::feasibility_problem):
682 Likewise.
683 (feasibility_problem::~feasibility_problem): Delete.
684 (feasibility_problem::m_rc): Use std::unique_ptr.
685 (feasibility_state::maybe_update_for_edge): Likewise.
686 * feasible-graph.cc (feasible_graph::add_feasibility_problem):
687 Likewise.
688 * feasible-graph.h (class infeasible_node): Likewise.
689 (feasible_graph::add_feasibility_problem): Likewise.
690 * region-model.cc (region_model::add_constraint): Likewise.
691 (region_model::maybe_update_for_edge): Likewise.
692 (region_model::apply_constraints_for_gcond): Likewise.
693 (region_model::apply_constraints_for_gswitch): Likewise.
694 (region_model::apply_constraints_for_exception): Likewise.
695 * region-model.h (class region_model): Likewise for decls.
697 2023-09-09 benjamin priour <vultkayn@gcc.gnu.org>
699 PR analyzer/96395
700 * region-model.cc
701 (region_model::add_constraints_from_binop): binop_svalues around
702 LT_EXPR, LE_EXPR, GT_EXPR, GE_EXPR are now unwrapped.
704 2023-09-07 David Malcolm <dmalcolm@redhat.com>
706 PR analyzer/110529
707 * program-point.cc (program_point::on_edge): Don't reject
708 EDGE_ABNORMAL for computed gotos.
709 * region-model.cc (region_model::maybe_update_for_edge): Handle
710 computed goto statements.
711 (region_model::apply_constraints_for_ggoto): New.
712 * region-model.h (region_model::apply_constraints_for_ggoto): New decl.
713 * supergraph.cc (supernode::get_label): New.
714 * supergraph.h (supernode::get_label): New decl.
716 2023-09-07 benjamin priour <vultkayn@gcc.gnu.org>
717 David Malcolm <dmalcolm@redhat.com>
719 PR analyzer/110830
720 * diagnostic-manager.cc
721 (compatible_epaths_p): New function.
722 (saved_diagnostic::supercedes_p): Now calls the above
723 to determine if the diagnostics do overlap and the superseding
724 may proceed.
726 2023-09-07 David Malcolm <dmalcolm@redhat.com>
728 * region-model.h: fix -Wunused-parameter warnings
730 2023-09-06 David Malcolm <dmalcolm@redhat.com>
732 PR analyzer/105899
733 * kf.cc (class kf_strstr): New.
734 (kf_strstr::impl_call_post): New.
735 (register_known_functions): Register it.
737 2023-09-06 David Malcolm <dmalcolm@redhat.com>
739 PR analyzer/105899
740 * kf.cc (class kf_strncpy): New.
741 (kf_strncpy::impl_call_post): New.
742 (register_known_functions): Register it.
743 * region-model.cc (region_model::read_bytes): Handle unknown
744 number of bytes.
746 2023-09-06 David Malcolm <dmalcolm@redhat.com>
748 * kf.cc (kf_calloc::impl_call_pre): Pass ctxt to zero_fill_region.
749 (kf_memset::impl_call_pre): Move responsibility for calling
750 check_region_for_write to fill_region.
751 * region-model.cc (region_model::on_assignment): Pass ctxt to
752 zero_fill_region.
753 (region_model::fill_region): Add "ctxt" param, using it to call
754 check_region_for_write.
755 (region_model::zero_fill_region): Likewise.
756 * region-model.h (region_model::fill_region): Add "ctxt" param.
757 (region_model::zero_fill_region): Likewise.
759 2023-09-01 benjamin priour <priour.be@gmail.com>
761 PR analyzer/105948
762 PR analyzer/94355
763 * analyzer.h (is_placement_new_p): New declaration.
764 * call-details.cc
765 (call_details::deref_ptr_arg): New function.
766 Dereference the argument at given index if possible.
767 * call-details.h: Declaration of the above function.
768 * kf-lang-cp.cc (is_placement_new_p): Returns true if the gcall
769 is recognized as a placement new.
770 (kf_operator_delete::impl_call_post): Unbinding a region and its
771 descendents now poisons with POISON_KIND_DELETED.
772 (register_known_functions_lang_cp): Known function "operator
773 delete" is now registered only once independently of its number of
774 arguments.
775 * region-model.cc (region_model::eval_condition): Now
776 recursively calls itself if any of the operand is wrapped in a
777 cast.
778 * sm-malloc.cc (malloc_state_machine::on_stmt):
779 Add placement new recognition.
780 * svalue.cc (poison_kind_to_str): Wording for the new PK.
781 * svalue.h (enum poison_kind): Add value POISON_KIND_DELETED.
783 2023-08-31 Francois-Xavier Coudert <fxcoudert@gcc.gnu.org>
785 * kf.cc: Change spelling to macOS.
787 2023-08-30 Eric Feng <ef2648@columbia.edu>
789 PR analyzer/107646
790 * engine.cc (impl_region_model_context::warn): New optional
791 parameter.
792 * exploded-graph.h (class impl_region_model_context): Likewise.
793 * region-model.cc (region_model::pop_frame): New callback
794 feature for region_model::pop_frame.
795 * region-model.h (struct append_regions_cb_data): Likewise.
796 (class region_model): Likewise.
797 (class region_model_context): New optional parameter.
798 (class region_model_context_decorator): Likewise.
800 2023-08-30 Francois-Xavier Coudert <fxcoudert@gcc.gnu.org>
802 * region-model.cc: Define INCLUDE_ALGORITHM.
804 2023-08-29 David Malcolm <dmalcolm@redhat.com>
806 PR analyzer/99860
807 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
808 selftest::analyzer_ranges_cc_tests.
809 * analyzer-selftests.h (selftest::run_analyzer_selftests): New
810 decl.
811 * analyzer.opt (Wanalyzer-overlapping-buffers): New option.
812 * call-details.cc: Include "analyzer/ranges.h" and "make-unique.h".
813 (class overlapping_buffers): New.
814 (call_details::complain_about_overlap): New.
815 * call-details.h (call_details::complain_about_overlap): New decl.
816 * kf.cc (kf_memcpy_memmove::impl_call_pre): Call
817 cd.complain_about_overlap for memcpy and memcpy_chk.
818 (kf_strcat::impl_call_pre): Call cd.complain_about_overlap.
819 (kf_strcpy::impl_call_pre): Likewise.
820 * ranges.cc: New file.
821 * ranges.h: New file.
823 2023-08-29 David Malcolm <dmalcolm@redhat.com>
825 PR analyzer/105899
826 * kf.cc (kf_strdup::impl_call_pre): Set size of
827 dynamically-allocated buffer. Simulate copying the string from
828 the source region to the new buffer.
830 2023-08-27 benjamin priour <vultkayn@gcc.gnu.org>
832 PR analyzer/96395
833 * analyzer.h (class known_function): Add virtual casts
834 to builtin_known_function.
835 (class builtin_known_function): New subclass of known_function
836 for builtins.
837 * kf.cc (class kf_alloca): Now derived from
838 builtin_known_function.
839 (class kf_calloc): Likewise.
840 (class kf_free): Likewise.
841 (class kf_malloc): Likewise.
842 (class kf_memcpy_memmove): Likewise.
843 (class kf_memset): Likewise.
844 (class kf_realloc): Likewise.
845 (class kf_strchr): Likewise.
846 (class kf_sprintf): Likewise.
847 (class kf_strcat): Likewise.
848 (class kf_strcpy): Likewise.
849 (class kf_strdup): Likewise.
850 (class kf_strlen): Likewise.
851 (class kf_strndup): Likewise.
852 (register_known_functions): Builtins are now registered as
853 known_functions by name rather than by their BUILTIN_CODE.
854 * known-function-manager.cc (get_normal_builtin): New overload.
855 * known-function-manager.h: New overload declaration.
856 * region-model.cc (region_model::get_builtin_kf): New function.
857 * region-model.h (class region_model): Add declaration of
858 get_builtin_kf.
859 * sm-fd.cc: For called recognized as builtins, use the
860 attributes of that builtin as defined in gcc/builtins.def
861 rather than the user's.
862 * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise.
864 2023-08-25 David Malcolm <dmalcolm@redhat.com>
866 * access-diagram.cc (class string_region_spatial_item): Remove
867 assumption that the string is written to the start of the cluster.
869 2023-08-24 David Malcolm <dmalcolm@redhat.com>
871 PR analyzer/105899
872 * call-details.cc
873 (call_details::check_for_null_terminated_string_arg): Split into
874 overloads, one taking just an arg_idx, the other a new
875 "include_terminator" param.
876 * call-details.h: Likewise.
877 * kf.cc (class kf_strcat): New.
878 (kf_strcpy::impl_call_pre): Update for change to
879 check_for_null_terminated_string_arg.
880 (register_known_functions): Register kf_strcat.
881 * region-model.cc
882 (region_model::check_for_null_terminated_string_arg): Split into
883 overloads, one taking just an arg_idx, the other a new
884 "include_terminator" param. When returning an svalue, handle
885 "include_terminator" being false by subtracting one.
886 * region-model.h
887 (region_model::check_for_null_terminated_string_arg): Split into
888 overloads, one taking just an arg_idx, the other a new
889 "include_terminator" param.
891 2023-08-24 David Malcolm <dmalcolm@redhat.com>
893 PR analyzer/105899
894 * region-model.cc (fragment::has_null_terminator): Handle
895 SK_BITS_WITHIN.
897 2023-08-24 David Malcolm <dmalcolm@redhat.com>
899 PR analyzer/105899
900 * region-model-manager.cc
901 (region_model_manager::get_or_create_initial_value): Simplify
902 INIT_VAL(ELEMENT_REG(STRING_REG), CONSTANT_SVAL) to
903 CONSTANT_SVAL(STRING[N]).
905 2023-08-24 David Malcolm <dmalcolm@redhat.com>
907 PR analyzer/105899
908 * region-model.cc (fragment::has_null_terminator): Move STRING_CST
909 handling to fragment::string_cst_has_null_terminator; also use it to
910 handle INIT_VAL(STRING_REG).
911 (fragment::string_cst_has_null_terminator): New, from above.
913 2023-08-24 David Malcolm <dmalcolm@redhat.com>
915 * kf.cc (kf_memcpy_memmove::impl_call_pre): Reimplement using
916 region_model::copy_bytes.
917 * region-model.cc (region_model::read_bytes): New.
918 (region_model::copy_bytes): New.
919 * region-model.h (region_model::read_bytes): New decl.
920 (region_model::copy_bytes): New decl.
922 2023-08-24 David Malcolm <dmalcolm@redhat.com>
924 PR analyzer/105899
925 * region-model.cc (region_model::get_string_size): Delete both.
926 * region-model.h (region_model::get_string_size): Delete both
927 decls.
929 2023-08-24 David Malcolm <dmalcolm@redhat.com>
931 PR analyzer/105899
932 * kf.cc (kf_strcpy::impl_call_pre): Reimplement using
933 check_for_null_terminated_string_arg.
934 * region-model.cc (region_model::get_store_bytes): Shortcut
935 reading all of a string_region.
936 (region_model::scan_for_null_terminator): Use get_store_value for
937 the bytes rather than "unknown" when returning an unknown length.
938 (region_model::write_bytes): New.
939 * region-model.h (region_model::write_bytes): New decl.
941 2023-08-24 David Malcolm <dmalcolm@redhat.com>
943 PR analyzer/105899
944 * region-model.cc (iterable_cluster::iterable_cluster): Add
945 symbolic binding keys to m_symbolic_bindings.
946 (iterable_cluster::has_symbolic_bindings_p): New.
947 (iterable_cluster::m_symbolic_bindings): New field.
948 (region_model::scan_for_null_terminator): Treat clusters with
949 symbolic bindings as having unknown strlen.
951 2023-08-24 David Malcolm <dmalcolm@redhat.com>
953 * engine.cc (impl_path_context::impl_path_context): Add logger
954 param.
955 (impl_path_context::bifurcate): Add log message.
956 (impl_path_context::terminate_path): Likewise.
957 (impl_path_context::m_logger): New field.
958 (exploded_graph::process_node): Pass logger to path_ctxt ctor.
960 2023-08-22 David Malcolm <dmalcolm@redhat.com>
962 PR analyzer/105899
963 * kf-analyzer.cc (class kf_analyzer_get_strlen): Move to kf.cc.
964 (register_known_analyzer_functions): Use make_kf_strlen.
965 * kf.cc (class kf_strlen::impl_call_pre): Replace with
966 implementation of kf_analyzer_get_strlen from kf-analyzer.cc.
967 Handle "UNKNOWN" return from check_for_null_terminated_string_arg
968 by falling back to a conjured svalue.
969 (make_kf_strlen): New.
970 (register_known_functions): Use make_kf_strlen.
971 * known-function-manager.h (make_kf_strlen): New decl.
973 2023-08-22 David Malcolm <dmalcolm@redhat.com>
975 PR analyzer/105899
976 * call-details.cc (call_details::call_details): New ctor.
977 * call-details.h (call_details::call_details): New ctor decl.
978 (struct call_arg_details): Move here from region-model.cc.
979 * region-model.cc (region_model::check_call_format_attr): New.
980 (region_model::check_call_args): Call it.
981 (struct call_arg_details): Move it to call-details.h.
982 * region-model.h (region_model::check_call_format_attr): New decl.
984 2023-08-22 David Malcolm <dmalcolm@redhat.com>
986 * kf.cc (class kf_fopen): New.
987 (register_known_functions): Register it.
989 2023-08-22 David Malcolm <dmalcolm@redhat.com>
991 PR analyzer/105899
992 * analyzer.opt (Wanalyzer-unterminated-string): Delete.
993 * call-details.cc
994 (call_details::check_for_null_terminated_string_arg): Convert
995 return type from void to const svalue *. Add param "out_sval".
996 * call-details.h
997 (call_details::check_for_null_terminated_string_arg): Likewise.
998 * kf-analyzer.cc (kf_analyzer_get_strlen::impl_call_pre): Wire up
999 to result of check_for_null_terminated_string_arg.
1000 * region-model.cc (get_strlen): Delete.
1001 (class unterminated_string_arg): Delete.
1002 (struct fragment): New.
1003 (class iterable_cluster): New.
1004 (region_model::get_store_bytes): New.
1005 (get_tree_for_byte_offset): New.
1006 (region_model::scan_for_null_terminator): New.
1007 (region_model::check_for_null_terminated_string_arg): Convert
1008 return type from void to const svalue *. Add param "out_sval".
1009 Reimplement in terms of scan_for_null_terminator, dropping the
1010 special-case for -Wanalyzer-unterminated-string.
1011 * region-model.h (region_model::get_store_bytes): New decl.
1012 (region_model::scan_for_null_terminator): New decl.
1013 (region_model::check_for_null_terminated_string_arg): Convert
1014 return type from void to const svalue *. Add param "out_sval".
1015 * store.cc (concrete_binding::get_byte_range): New.
1016 * store.h (concrete_binding::get_byte_range): New decl.
1017 (store_manager::get_concrete_binding): New overload.
1019 2023-08-22 David Malcolm <dmalcolm@redhat.com>
1021 * region-model.cc (region_model_context_decorator::add_event):
1022 Handle m_inner being NULL.
1023 * region-model.h (class region_model_context_decorator): Likewise.
1024 (annotating_context::warn): Likewise.
1026 2023-08-22 David Malcolm <dmalcolm@redhat.com>
1028 * diagnostic-manager.cc (saved_diagnostic::add_event): New.
1029 (saved_diagnostic::add_any_saved_events): New.
1030 (diagnostic_manager::add_event): New.
1031 (dedupe_winners::emit_best): New.
1032 (diagnostic_manager::emit_saved_diagnostic): Make "sd" param
1033 non-const. Call saved_diagnostic::add_any_saved_events.
1034 * diagnostic-manager.h (saved_diagnostic::add_event): New decl.
1035 (saved_diagnostic::add_any_saved_events): New decl.
1036 (saved_diagnostic::m_saved_events): New field.
1037 (diagnostic_manager::add_event): New decl.
1038 (diagnostic_manager::emit_saved_diagnostic): Make "sd" param
1039 non-const.
1040 * engine.cc (impl_region_model_context::add_event): New.
1041 * exploded-graph.h (impl_region_model_context::add_event): New decl.
1042 * region-model.cc
1043 (noop_region_model_context::add_event): New.
1044 (region_model_context_decorator::add_event): New.
1045 * region-model.h (region_model_context::add_event): New vfunc.
1046 (noop_region_model_context::add_event): New decl.
1047 (region_model_context_decorator::add_event): New decl.
1049 2023-08-22 David Malcolm <dmalcolm@redhat.com>
1051 * region-model.cc
1052 (class check_external_function_for_access_attr::annotating_ctxt):
1053 Convert to an annotating_context.
1054 * region-model.h (class note_adding_context): Rename to...
1055 (class annotating_context): ...this, updating the "warn" method.
1056 (note_adding_context::make_note): Replace with...
1057 (annotating_context::add_annotations): ...this.
1059 2023-08-14 benjamin priour <vultkayn@gcc.gnu.org>
1061 PR analyzer/110543
1062 * analyzer.opt: Add new option.
1063 * diagnostic-manager.cc
1064 (diagnostic_manager::prune_path): Call prune_system_headers.
1065 (prune_frame): New function that deletes all events in a frame.
1066 (diagnostic_manager::prune_system_headers): New function.
1067 * diagnostic-manager.h: Add prune_system_headers declaration.
1069 2023-08-11 David Malcolm <dmalcolm@redhat.com>
1071 PR analyzer/105899
1072 * analyzer.opt (Wanalyzer-unterminated-string): New.
1073 * call-details.cc
1074 (call_details::check_for_null_terminated_string_arg): New.
1075 * call-details.h
1076 (call_details::check_for_null_terminated_string_arg): New decl.
1077 * kf-analyzer.cc (class kf_analyzer_get_strlen): New.
1078 (register_known_analyzer_functions): Register it.
1079 * kf.cc (kf_error::impl_call_pre): Check that format arg is a
1080 valid null-terminated string.
1081 (kf_putenv::impl_call_pre): Likewise for the sole param.
1082 (kf_strchr::impl_call_pre): Likewise for the first param.
1083 (kf_strcpy::impl_call_pre): Likewise for the second param.
1084 (kf_strdup::impl_call_pre): Likewise for the sole param.
1085 * region-model.cc (get_strlen): New.
1086 (struct call_arg_details): New.
1087 (inform_about_expected_null_terminated_string_arg): New.
1088 (class unterminated_string_arg): New.
1089 (region_model::check_for_null_terminated_string_arg): New.
1090 * region-model.h
1091 (region_model::check_for_null_terminated_string_arg): New decl.
1093 2023-08-11 Eric Feng <ef2648@columbia.edu>
1095 PR analyzer/107646
1096 * call-details.h: New function.
1097 * region-model.cc (region_model::get_or_create_region_for_heap_alloc):
1098 New optional parameters.
1099 * region-model.h (class region_model): New optional parameters.
1100 * sm-malloc.cc (on_realloc_with_move): New function.
1101 (region_model::transition_ptr_sval_non_null): New function.
1103 2023-08-09 David Malcolm <dmalcolm@redhat.com>
1105 * analyzer.h (class pure_known_function_with_default_return): New
1106 subclass.
1107 * call-details.cc (const_fn_p): Move here from region-model.cc.
1108 (maybe_get_const_fn_result): Likewise.
1109 (get_result_size_in_bytes): Likewise.
1110 (call_details::set_any_lhs_with_defaults): New function, based on
1111 code in region_model::on_call_pre.
1112 * call-details.h (call_details::set_any_lhs_with_defaults): New
1113 decl.
1114 * diagnostic-manager.cc
1115 (diagnostic_manager::emit_saved_diagnostic): Log the index of the
1116 saved_diagnostic.
1117 * kf.cc (pure_known_function_with_default_return::impl_call_pre):
1118 New.
1119 (kf_memset::impl_call_pre): Set the LHS to the first param.
1120 (kf_putenv::impl_call_pre): Call cd.set_any_lhs_with_defaults.
1121 (kf_sprintf::impl_call_pre): Call cd.set_any_lhs_with_defaults.
1122 (class kf_stack_restore): Derive from
1123 pure_known_function_with_default_return.
1124 (class kf_stack_save): Likewise.
1125 (kf_strlen::impl_call_pre): Call cd.set_any_lhs_with_defaults.
1126 * region-model-reachability.cc (reachable_regions::handle_sval):
1127 Remove logic for symbolic regions for pointers.
1128 * region-model.cc (region_model::canonicalize): Remove purging of
1129 dynamic extents workaround for surplus values from
1130 region_model::on_call_pre's default LHS code.
1131 (const_fn_p): Move to call-details.cc.
1132 (maybe_get_const_fn_result): Likewise.
1133 (get_result_size_in_bytes): Likewise.
1134 (region_model::update_for_nonzero_return): Call
1135 cd.set_any_lhs_with_defaults.
1136 (region_model::on_call_pre): Remove the assignment to the LHS of a
1137 default return value, instead requiring all known_function
1138 implementations to write to any LHS of the call. Use
1139 cd.set_any_lhs_with_defaults on the non-kf paths.
1140 * sm-fd.cc (kf_socket::outcome_of_socket::update_model): Use
1141 cd.set_any_lhs_with_defaults when failing to get at fd state.
1142 (kf_bind::outcome_of_bind::update_model): Likewise.
1143 (kf_listen::outcome_of_listen::update_model): Likewise.
1144 (kf_accept::outcome_of_accept::update_model): Likewise.
1145 (kf_connect::outcome_of_connect::update_model): Likewise.
1146 (kf_read::impl_call_pre): Use cd.set_any_lhs_with_defaults.
1147 * sm-file.cc (class kf_stdio_output_fn): Derive from
1148 pure_known_function_with_default_return.
1149 (class kf_ferror): Likewise.
1150 (class kf_fileno): Likewise.
1151 (kf_fgets::impl_call_pre): Use cd.set_any_lhs_with_defaults.
1152 (kf_read::impl_call_pre): Likewise.
1153 (class kf_getc): Derive from
1154 pure_known_function_with_default_return.
1155 (class kf_getchar): Likewise.
1156 * varargs.cc (kf_va_arg::impl_call_pre): Use
1157 cd.set_any_lhs_with_defaults.
1159 2023-08-04 David Malcolm <dmalcolm@redhat.com>
1161 PR analyzer/110426
1162 * bounds-checking.cc (region_model::check_region_bounds): Handle
1163 symbolic base regions.
1164 * call-details.cc: Include "stringpool.h" and "attribs.h".
1165 (call_details::lookup_function_attribute): New function.
1166 * call-details.h (call_details::lookup_function_attribute): New
1167 function decl.
1168 * region-model-manager.cc
1169 (region_model_manager::maybe_fold_binop): Add reference to
1170 PR analyzer/110902.
1171 * region-model-reachability.cc (reachable_regions::handle_sval):
1172 Add symbolic regions for pointers that are conjured svalues for
1173 the LHS of a stmt.
1174 * region-model.cc (region_model::canonicalize): Purge dynamic
1175 extents for regions that aren't referenced.
1176 (get_result_size_in_bytes): New function.
1177 (region_model::on_call_pre): Use get_result_size_in_bytes and
1178 potentially set the dynamic extents of the region pointed to by
1179 the return value.
1180 (region_model::deref_rvalue): Add param "add_nonnull_constraint"
1181 and use it to conditionalize adding the constraint.
1182 (pending_diagnostic_subclass::dubious_allocation_size): Add "stmt"
1183 param to both ctors and use it to initialize new "m_stmt" field.
1184 (pending_diagnostic_subclass::operator==): Use m_stmt; don't use
1185 m_lhs or m_rhs.
1186 (pending_diagnostic_subclass::m_stmt): New field.
1187 (region_model::check_region_size): Generalize to any kind of
1188 pointer svalue by using deref_rvalue rather than checking for
1189 region_svalue. Pass stmt to dubious_allocation_size ctor.
1190 * region-model.h (region_model::deref_rvalue): Add param
1191 "add_nonnull_constraint".
1192 * svalue.cc (conjured_svalue::lhs_value_p): New function.
1193 * svalue.h (conjured_svalue::lhs_value_p): New decl.
1195 2023-08-04 David Malcolm <dmalcolm@redhat.com>
1197 * svalue.cc (region_svalue::dump_to_pp): Support NULL type.
1198 (constant_svalue::dump_to_pp): Likewise.
1199 (initial_svalue::dump_to_pp): Likewise.
1200 (conjured_svalue::dump_to_pp): Likewise. Fix missing print of the
1201 type.
1203 2023-08-03 David Malcolm <dmalcolm@redhat.com>
1205 PR analyzer/110882
1206 * region.cc (int_size_in_bits): Fail on zero-sized types.
1208 2023-08-02 Eric Feng <ef2648@columbia.edu>
1210 PR analyzer/107646
1211 * analyzer-language.cc (run_callbacks): New function.
1212 (on_finish_translation_unit): New function.
1213 * analyzer-language.h (GCC_ANALYZER_LANGUAGE_H): New include.
1214 (class translation_unit): New vfuncs.
1216 2023-07-26 David Malcolm <dmalcolm@redhat.com>
1218 PR analyzer/104940
1219 * region-model-manager.cc
1220 (region_model_manager::region_model_manager): Update for
1221 generalizing region ids to also cover svalues.
1222 (region_model_manager::get_or_create_constant_svalue): Likewise.
1223 (region_model_manager::get_or_create_unknown_svalue): Likewise.
1224 (region_model_manager::create_unique_svalue): Likewise.
1225 (region_model_manager::get_or_create_initial_value): Likewise.
1226 (region_model_manager::get_or_create_setjmp_svalue): Likewise.
1227 (region_model_manager::get_or_create_poisoned_svalue): Likewise.
1228 (region_model_manager::get_ptr_svalue): Likewise.
1229 (region_model_manager::get_or_create_unaryop): Likewise.
1230 (region_model_manager::get_or_create_binop): Likewise.
1231 (region_model_manager::get_or_create_sub_svalue): Likewise.
1232 (region_model_manager::get_or_create_repeated_svalue): Likewise.
1233 (region_model_manager::get_or_create_bits_within): Likewise.
1234 (region_model_manager::get_or_create_unmergeable): Likewise.
1235 (region_model_manager::get_or_create_widening_svalue): Likewise.
1236 (region_model_manager::get_or_create_compound_svalue): Likewise.
1237 (region_model_manager::get_or_create_conjured_svalue): Likewise.
1238 (region_model_manager::get_or_create_asm_output_svalue): Likewise.
1239 (region_model_manager::get_or_create_const_fn_result_svalue):
1240 Likewise.
1241 (region_model_manager::get_region_for_fndecl): Likewise.
1242 (region_model_manager::get_region_for_label): Likewise.
1243 (region_model_manager::get_region_for_global): Likewise.
1244 (region_model_manager::get_field_region): Likewise.
1245 (region_model_manager::get_element_region): Likewise.
1246 (region_model_manager::get_offset_region): Likewise.
1247 (region_model_manager::get_sized_region): Likewise.
1248 (region_model_manager::get_cast_region): Likewise.
1249 (region_model_manager::get_frame_region): Likewise.
1250 (region_model_manager::get_symbolic_region): Likewise.
1251 (region_model_manager::get_region_for_string): Likewise.
1252 (region_model_manager::get_bit_range): Likewise.
1253 (region_model_manager::get_var_arg_region): Likewise.
1254 (region_model_manager::get_region_for_unexpected_tree_code):
1255 Likewise.
1256 (region_model_manager::get_or_create_region_for_heap_alloc):
1257 Likewise.
1258 (region_model_manager::create_region_for_alloca): Likewise.
1259 (region_model_manager::log_stats): Likewise.
1260 * region-model-manager.h (region_model_manager::get_num_regions):
1261 Replace with...
1262 (region_model_manager::get_num_symbols): ...this.
1263 (region_model_manager::alloc_region_id): Replace with...
1264 (region_model_manager::alloc_symbol_id): ...this.
1265 (region_model_manager::m_next_region_id): Replace with...
1266 (region_model_manager::m_next_symbol_id): ...this.
1267 * region-model.cc (selftest::test_get_representative_tree): Update
1268 for generalizing region ids to also cover svalues.
1269 (selftest::test_binop_svalue_folding): Likewise.
1270 (selftest::test_state_merging): Likewise.
1271 * region.cc (region::cmp_ids): Delete, in favor of
1272 symbol::cmp_ids.
1273 (region::region): Update for introduction of symbol base class.
1274 (frame_region::get_region_for_local): Likewise.
1275 (root_region::root_region): Likewise.
1276 (symbolic_region::symbolic_region): Likewise.
1277 * region.h: Replace include of "analyzer/complexity.h" with
1278 "analyzer/symbol.h".
1279 (class region): Make a subclass of symbol.
1280 (region::get_id): Delete in favor of symbol::get_id.
1281 (region::cmp_ids): Delete in favor of symbol::cmp_ids.
1282 (region::get_complexity): Delete in favor of
1283 symbol::get_complexity.
1284 (region::region): Use symbol::id_t for "id" param.
1285 (region::m_complexity): Move field to symbol base class.
1286 (region::m_id): Likewise.
1287 (space_region::space_region): Use symbol::id_t for "id" param.
1288 (frame_region::frame_region): Likewise.
1289 (globals_region::globals_region): Likewise.
1290 (code_region::code_region): Likewise.
1291 (function_region::function_region): Likewise.
1292 (label_region::label_region): Likewise.
1293 (stack_region::stack_region): Likewise.
1294 (heap_region::heap_region): Likewise.
1295 (thread_local_region::thread_local_region): Likewise.
1296 (root_region::root_region): Likewise.
1297 (symbolic_region::symbolic_region): Likewise.
1298 (decl_region::decl_region): Likewise.
1299 (field_region::field_region): Likewise.
1300 (element_region::element_region): Likewise.
1301 (offset_region::offset_region): Likewise.
1302 (sized_region::sized_region): Likewise.
1303 (cast_region::cast_region): Likewise.
1304 (heap_allocated_region::heap_allocated_region): Likewise.
1305 (alloca_region::alloca_region): Likewise.
1306 (string_region::string_region): Likewise.
1307 (bit_range_region::bit_range_region): Likewise.
1308 (var_arg_region::var_arg_region): Likewise.
1309 (errno_region::errno_region): Likewise.
1310 (unknown_region::unknown_region): Likewise.
1311 * svalue.cc (sub_svalue::sub_svalue): Add symbol::id_t param.
1312 (repeated_svalue::repeated_svalue): Likewise.
1313 (bits_within_svalue::bits_within_svalue): Likewise.
1314 (compound_svalue::compound_svalue): Likewise.
1315 * svalue.h: Replace include of "analyzer/complexity.h" with
1316 "analyzer/symbol.h".
1317 (class svalue): Make a subclass of symbol.
1318 (svalue::get_complexity): Delete in favor of
1319 symbol::get_complexity.
1320 (svalue::svalue): Add symbol::id_t param. Update for new base
1321 class.
1322 (svalue::m_complexity): Delete in favor of
1323 symbol::m_complexity.
1324 (region_svalue::region_svalue): Add symbol::id_t param
1325 (constant_svalue::constant_svalue): Likewise.
1326 (unknown_svalue::unknown_svalue): Likewise.
1327 (poisoned_svalue::poisoned_svalue): Likewise.
1328 (setjmp_svalue::setjmp_svalue): Likewise.
1329 (initial_svalue::initial_svalue): Likewise.
1330 (unaryop_svalue::unaryop_svalue): Likewise.
1331 (binop_svalue::binop_svalue): Likewise.
1332 (sub_svalue::sub_svalue): Likewise.
1333 (repeated_svalue::repeated_svalue): Likewise.
1334 (bits_within_svalue::bits_within_svalue): Likewise.
1335 (unmergeable_svalue::unmergeable_svalue): Likewise.
1336 (placeholder_svalue::placeholder_svalue): Likewise.
1337 (widening_svalue::widening_svalue): Likewise.
1338 (compound_svalue::compound_svalue): Likewise.
1339 (conjured_svalue::conjured_svalue): Likewise.
1340 (asm_output_svalue::asm_output_svalue): Likewise.
1341 (const_fn_result_svalue::const_fn_result_svalue): Likewise.
1342 * symbol.cc: New file.
1343 * symbol.h: New file.
1345 2023-07-21 David Malcolm <dmalcolm@redhat.com>
1347 PR analyzer/110455
1348 * region-model.cc (region_model::get_gassign_result): Only check
1349 for bad shift counts when dealing with an integral type.
1351 2023-07-21 David Malcolm <dmalcolm@redhat.com>
1353 PR analyzer/110433
1354 PR middle-end/110612
1355 * access-diagram.cc (class spatial_item): Add virtual dtor.
1357 2023-07-21 David Malcolm <dmalcolm@redhat.com>
1359 PR analyzer/110387
1360 * region.h (struct cast_region::key_t): Support "m_type" being
1361 null by using "m_original_region" for empty/deleted slots.
1363 2023-07-19 David Malcolm <dmalcolm@redhat.com>
1365 PR analyzer/110700
1366 * region-model-manager.cc
1367 (region_model_manager::get_or_create_int_cst): Assert that we have
1368 an integral or pointer type.
1369 * sm-taint.cc (taint_state_machine::check_for_tainted_divisor):
1370 Don't check non-integral types.
1372 2023-06-29 benjamin priour <priour.be@gmail.com>
1374 PR analyzer/110198
1375 * region-model-manager.cc
1376 (region_model_manager::get_or_create_initial_value): Take an
1377 optional boolean value to bypass poisoning checks
1378 * region-model-manager.h: Update declaration of the above function.
1379 * region-model.cc (region_model::get_store_value): No longer returns
1380 on OOB, but rather gives a boolean to get_or_create_initial_value.
1381 (region_model::check_region_access): Update docstring.
1382 (region_model::check_region_for_write): Update docstring.
1384 2023-06-24 David Malcolm <dmalcolm@redhat.com>
1386 * access-diagram.cc: Add #define INCLUDE_VECTOR.
1387 * bounds-checking.cc: Likewise.
1389 2023-06-22 David Malcolm <dmalcolm@redhat.com>
1391 PR analyzer/106626
1392 * access-diagram.cc: New file.
1393 * access-diagram.h: New file.
1394 * analyzer.h (class region_offset): Add default ctor.
1395 (region_offset::make_byte_offset): New decl.
1396 (region_offset::concrete_p): New.
1397 (region_offset::get_concrete_byte_offset): New.
1398 (region_offset::calc_symbolic_bit_offset): New decl.
1399 (region_offset::calc_symbolic_byte_offset): New decl.
1400 (region_offset::dump_to_pp): New decl.
1401 (region_offset::dump): New decl.
1402 (operator<, operator<=, operator>, operator>=): New decls for
1403 region_offset.
1404 * analyzer.opt
1405 (-param=analyzer-text-art-string-ellipsis-threshold=): New.
1406 (-param=analyzer-text-art-string-ellipsis-head-len=): New.
1407 (-param=analyzer-text-art-string-ellipsis-tail-len=): New.
1408 (-param=analyzer-text-art-ideal-canvas-width=): New.
1409 (fanalyzer-debug-text-art): New.
1410 * bounds-checking.cc: Include "intl.h", "diagnostic-diagram.h",
1411 and "analyzer/access-diagram.h".
1412 (class out_of_bounds::oob_region_creation_event_capacity): New.
1413 (out_of_bounds::out_of_bounds): Add "model" and "sval_hint"
1414 params.
1415 (out_of_bounds::mark_interesting_stuff): Use the base region.
1416 (out_of_bounds::add_region_creation_events): Use
1417 oob_region_creation_event_capacity.
1418 (out_of_bounds::get_dir): New pure vfunc.
1419 (out_of_bounds::maybe_show_notes): New.
1420 (out_of_bounds::maybe_show_diagram): New.
1421 (out_of_bounds::make_access_diagram): New.
1422 (out_of_bounds::m_model): New field.
1423 (out_of_bounds::m_sval_hint): New field.
1424 (out_of_bounds::m_region_creation_event_id): New field.
1425 (concrete_out_of_bounds::concrete_out_of_bounds): Update for new
1426 fields.
1427 (concrete_past_the_end::concrete_past_the_end): Likewise.
1428 (concrete_past_the_end::add_region_creation_events): Use
1429 oob_region_creation_event_capacity.
1430 (concrete_buffer_overflow::concrete_buffer_overflow): Update for
1431 new fields.
1432 (concrete_buffer_overflow::emit): Replace call to
1433 maybe_describe_array_bounds with maybe_show_notes.
1434 (concrete_buffer_overflow::get_dir): New.
1435 (concrete_buffer_over_read::concrete_buffer_over_read): Update for
1436 new fields.
1437 (concrete_buffer_over_read::emit): Replace call to
1438 maybe_describe_array_bounds with maybe_show_notes.
1439 (concrete_buffer_overflow::get_dir): New.
1440 (concrete_buffer_underwrite::concrete_buffer_underwrite): Update
1441 for new fields.
1442 (concrete_buffer_underwrite::emit): Replace call to
1443 maybe_describe_array_bounds with maybe_show_notes.
1444 (concrete_buffer_underwrite::get_dir): New.
1445 (concrete_buffer_under_read::concrete_buffer_under_read): Update
1446 for new fields.
1447 (concrete_buffer_under_read::emit): Replace call to
1448 maybe_describe_array_bounds with maybe_show_notes.
1449 (concrete_buffer_under_read::get_dir): New.
1450 (symbolic_past_the_end::symbolic_past_the_end): Update for new
1451 fields.
1452 (symbolic_buffer_overflow::symbolic_buffer_overflow): Likewise.
1453 (symbolic_buffer_overflow::emit): Call maybe_show_notes.
1454 (symbolic_buffer_overflow::get_dir): New.
1455 (symbolic_buffer_over_read::symbolic_buffer_over_read): Update for
1456 new fields.
1457 (symbolic_buffer_over_read::emit): Call maybe_show_notes.
1458 (symbolic_buffer_over_read::get_dir): New.
1459 (region_model::check_symbolic_bounds): Add "sval_hint" param. Pass
1460 it and sized_offset_reg to diagnostics.
1461 (region_model::check_region_bounds): Add "sval_hint" param, passing
1462 it to diagnostics.
1463 * diagnostic-manager.cc
1464 (diagnostic_manager::emit_saved_diagnostic): Pass logger to
1465 pending_diagnostic::emit.
1466 * engine.cc: Add logger param to pending_diagnostic::emit
1467 implementations.
1468 * infinite-recursion.cc: Likewise.
1469 * kf-analyzer.cc: Likewise.
1470 * kf.cc: Likewise. Add nullptr for new param of
1471 check_region_for_write.
1472 * pending-diagnostic.h: Likewise in decl.
1473 * region-model-manager.cc
1474 (region_model_manager::get_or_create_int_cst): Convert param from
1475 poly_int64 to const poly_wide_int_ref &.
1476 (region_model_manager::maybe_fold_binop): Support type being NULL
1477 when checking for floating-point types.
1478 Check for (X + Y) - X => Y. Be less strict about types when folding
1479 associative ops. Check for (X + Y) * CST => (X * CST) + (Y * CST).
1480 * region-model-manager.h
1481 (region_model_manager::get_or_create_int_cst): Convert param from
1482 poly_int64 to const poly_wide_int_ref &.
1483 * region-model.cc: Add logger param to pending_diagnostic::emit
1484 implementations.
1485 (region_model::check_external_function_for_access_attr): Update
1486 for new param of check_region_for_write.
1487 (region_model::deref_rvalue): Use nullptr rather than NULL.
1488 (region_model::get_capacity): Handle RK_STRING.
1489 (region_model::check_region_access): Add "sval_hint" param; pass it to
1490 check_region_bounds.
1491 (region_model::check_region_for_write): Add "sval_hint" param;
1492 pass it to check_region_access.
1493 (region_model::check_region_for_read): Add NULL for new param to
1494 check_region_access.
1495 (region_model::set_value): Pass rhs_sval to
1496 check_region_for_write.
1497 (region_model::get_representative_path_var_1): Handle SK_CONSTANT
1498 in the check for infinite recursion.
1499 * region-model.h (region_model::check_region_for_write): Add
1500 "sval_hint" param.
1501 (region_model::check_region_access): Likewise.
1502 (region_model::check_symbolic_bounds): Likewise.
1503 (region_model::check_region_bounds): Likewise.
1504 * region.cc (region_offset::make_byte_offset): New.
1505 (region_offset::calc_symbolic_bit_offset): New.
1506 (region_offset::calc_symbolic_byte_offset): New.
1507 (region_offset::dump_to_pp): New.
1508 (region_offset::dump): New.
1509 (struct linear_op): New.
1510 (operator<, operator<=, operator>, operator>=): New, for
1511 region_offset.
1512 (region::get_next_offset): New.
1513 (region::get_relative_symbolic_offset): Use ptrdiff_type_node.
1514 (field_region::get_relative_symbolic_offset): Likewise.
1515 (element_region::get_relative_symbolic_offset): Likewise.
1516 (bit_range_region::get_relative_symbolic_offset): Likewise.
1517 * region.h (region::get_next_offset): New decl.
1518 * sm-fd.cc: Add logger param to pending_diagnostic::emit
1519 implementations.
1520 * sm-file.cc: Likewise.
1521 * sm-malloc.cc: Likewise.
1522 * sm-pattern-test.cc: Likewise.
1523 * sm-sensitive.cc: Likewise.
1524 * sm-signal.cc: Likewise.
1525 * sm-taint.cc: Likewise.
1526 * store.cc (bit_range::contains_p): Allow "out" to be null.
1527 * store.h (byte_range::get_start_bit_offset): New.
1528 (byte_range::get_next_bit_offset): New.
1529 * varargs.cc: Add logger param to pending_diagnostic::emit
1530 implementations.
1532 2023-06-10 Tim Lange <mail@tim-lange.me>
1534 PR analyzer/109577
1535 * constraint-manager.cc (class sval_finder): Visitor to find
1536 childs in svalue trees.
1537 (constraint_manager::sval_constrained_p): Add new function to
1538 check whether a sval might be part of an constraint.
1539 * constraint-manager.h: Add sval_constrained_p function.
1540 * region-model.cc (class size_visitor): Reverse behavior to not
1541 emit a warning on not explicitly considered cases.
1542 (region_model::check_region_size):
1543 Adapt to size_visitor changes.
1545 2023-06-09 David Malcolm <dmalcolm@redhat.com>
1547 PR analyzer/110112
1548 * region-model.cc (region_model::get_initial_value_for_global):
1549 Move code to region::calc_initial_value_at_main.
1550 * region.cc (region::get_initial_value_at_main): New function.
1551 (region::calc_initial_value_at_main): New function, based on code
1552 in region_model::get_initial_value_for_global.
1553 (region::region): Initialize m_cached_init_sval_at_main.
1554 (decl_region::get_svalue_for_constructor): Add a cache, splitting
1555 out body to...
1556 (decl_region::calc_svalue_for_constructor): ...this new function.
1557 * region.h (region::get_initial_value_at_main): New decl.
1558 (region::calc_initial_value_at_main): New decl.
1559 (region::m_cached_init_sval_at_main): New field.
1560 (decl_region::decl_region): Initialize m_ctor_svalue.
1561 (decl_region::calc_svalue_for_constructor): New decl.
1562 (decl_region::m_ctor_svalue): New field.
1564 2023-06-08 Benjamin Priour <vultkayn@gcc.gnu.org>
1566 * bounds-checking.cc (region_model::check_symbolic_bounds): Returns whether the BASE_REG
1567 region access was OOB.
1568 (region_model::check_region_bounds): Likewise.
1569 * region-model.cc (region_model::get_store_value): Creates an
1570 unknown svalue on OOB-read access to REG.
1571 (region_model::check_region_access): Returns whether an unknown svalue needs be created.
1572 (region_model::check_region_for_read): Passes check_region_access return value.
1573 * region-model.h: Update prior function definitions.
1575 2023-06-02 David Malcolm <dmalcolm@redhat.com>
1577 PR analyzer/109015
1578 * kf.cc (class kf_atomic_exchange): New.
1579 (class kf_atomic_exchange_n): New.
1580 (class kf_atomic_fetch_op): New.
1581 (class kf_atomic_op_fetch): New.
1582 (class kf_atomic_load): New.
1583 (class kf_atomic_load_n): New.
1584 (class kf_atomic_store_n): New.
1585 (register_atomic_builtins): New function.
1586 (register_known_functions): Call register_atomic_builtins.
1588 2023-06-02 David Malcolm <dmalcolm@redhat.com>
1590 * store.cc (store::eval_alias_1): Regions in different memory
1591 spaces can't alias.
1593 2023-05-18 Bernhard Reutner-Fischer <aldot@gcc.gnu.org>
1595 * region-model-manager.cc (get_code_for_cast): Use _P defines from
1596 tree.h.
1597 (region_model_manager::get_or_create_cast): Ditto.
1598 (region_model_manager::get_region_for_global): Ditto.
1599 * region-model.cc (region_model::get_lvalue_1): Ditto.
1600 * region.cc (decl_region::maybe_get_constant_value): Ditto.
1602 2023-03-22 David Malcolm <dmalcolm@redhat.com>
1604 PR analyzer/109239
1605 * program-point.cc: Include "analyzer/inlining-iterator.h".
1606 (program_point::effectively_intraprocedural_p): New function.
1607 * program-point.h (program_point::effectively_intraprocedural_p):
1608 New decl.
1609 * sm-malloc.cc (deref_before_check::emit): Use it when rejecting
1610 interprocedural cases, so that we reject interprocedural cases
1611 that have become intraprocedural due to inlining.
1613 2023-03-18 David Malcolm <dmalcolm@redhat.com>
1615 PR analyzer/109094
1616 * region-model.cc (region_model::on_longjmp): Pass false for
1617 new "eval_return_svalue" param of pop_frame.
1618 (region_model::pop_frame): Add new "eval_return_svalue" param and
1619 use it to suppress the call to get_rvalue on the result when
1620 needed by on_longjmp.
1621 * region-model.h (region_model::pop_frame): Add new
1622 "eval_return_svalue" param.
1624 2023-03-10 David Malcolm <dmalcolm@redhat.com>
1626 PR analyzer/109059
1627 * region-model.cc (region_model::mark_region_as_unknown): Gather a
1628 set of maybe-live svalues and call on_maybe_live_values with it.
1629 * store.cc (binding_map::remove_overlapping_bindings): Add new
1630 "maybe_live_values" param; add any removed svalues to it.
1631 (binding_cluster::clobber_region): Add NULL as new param of
1632 remove_overlapping_bindings.
1633 (binding_cluster::mark_region_as_unknown): Add "maybe_live_values"
1634 param and pass it to remove_overlapping_bindings.
1635 (binding_cluster::maybe_get_compound_binding): Add NULL for new
1636 param of binding_map::remove_overlapping_bindings.
1637 (binding_cluster::remove_overlapping_bindings): Add
1638 "maybe_live_values" param and pass to
1639 binding_map::remove_overlapping_bindings.
1640 (store::set_value): Capture a set of maybe-live svalues, and call
1641 on_maybe_live_values with it.
1642 (store::on_maybe_live_values): New.
1643 (store::mark_region_as_unknown): Add "maybe_live_values" param
1644 and pass it to binding_cluster::mark_region_as_unknown.
1645 (store::remove_overlapping_bindings): Pass NULL for new param of
1646 binding_cluster::remove_overlapping_bindings.
1647 * store.h (binding_map::remove_overlapping_bindings): Add
1648 "maybe_live_values" param.
1649 (binding_cluster::mark_region_as_unknown): Likewise.
1650 (binding_cluster::remove_overlapping_bindings): Likewise.
1651 (store::mark_region_as_unknown): Likewise.
1652 (store::on_maybe_live_values): New decl.
1654 2023-03-10 David Malcolm <dmalcolm@redhat.com>
1656 PR analyzer/108475
1657 PR analyzer/109060
1658 * sm-malloc.cc (deref_before_check::deref_before_check):
1659 Initialize new field m_deref_expr. Assert that arg is non-NULL.
1660 (deref_before_check::emit): Reject cases where the spelling of the
1661 thing that was dereferenced differs from that of what is checked,
1662 or if the dereference expression was not found. Remove code to
1663 handle NULL m_arg.
1664 (deref_before_check::describe_state_change): Remove code to handle
1665 NULL m_arg.
1666 (deref_before_check::describe_final_event): Likewise.
1667 (deref_before_check::sufficiently_similar_p): New.
1668 (deref_before_check::m_deref_expr): New field.
1669 (malloc_state_machine::maybe_complain_about_deref_before_check):
1670 Don't warn if the diag_ptr is NULL.
1672 2023-03-03 David Malcolm <dmalcolm@redhat.com>
1674 * kf.cc (class kf_sprintf): New.
1675 (register_known_functions): Register it.
1677 2023-03-02 David Malcolm <dmalcolm@redhat.com>
1679 PR analyzer/108968
1680 * region-model.cc (region_model::get_rvalue_1): Handle VAR_DECLs
1681 with a DECL_HARD_REGISTER by returning UNKNOWN.
1683 2023-03-02 Hans-Peter Nilsson <hp@axis.com>
1685 * kf.cc (register_known_functions): Add __errno function for newlib.
1687 2023-03-01 David Malcolm <dmalcolm@redhat.com>
1689 PR analyzer/107565
1690 * region-model.cc (region_model::on_call_pre): Flatten logic by
1691 returning early. Consolidate logic for detecting const and pure
1692 functions. When considering whether an unhandled built-in
1693 function has side-effects, consider all kinds of builtin, rather
1694 than just BUILT_IN_NORMAL, and don't require
1695 gimple_builtin_call_types_compatible_p.
1697 2023-03-01 David Malcolm <dmalcolm@redhat.com>
1699 PR analyzer/108935
1700 * infinite-recursion.cc (contains_unknown_p): New.
1701 (sufficiently_different_region_binding_p): New function, splitting
1702 out inner loop from...
1703 (sufficiently_different_p): ...here. Extend detection of unknown
1704 svalues to also include svalues that contain unknown. Treat
1705 changes in frames below the entry to the recursion as being
1706 sufficiently different to reject being an infinite recursion.
1708 2023-02-21 David Malcolm <dmalcolm@redhat.com>
1710 PR analyzer/108830
1711 * analyzer.opt (fanalyzer-suppress-followups): New option.
1712 * engine.cc (impl_region_model_context::warn): Terminate the path
1713 if the diagnostic's terminate_path_p vfunc returns true and
1714 -fanalyzer-suppress-followups is true (the default).
1715 (impl_sm_context::warn): Likewise, for both overloads.
1716 * pending-diagnostic.h (pending_diagnostic::terminate_path_p): New
1717 vfunc.
1718 * program-state.cc (program_state::on_edge): Terminate the path if
1719 the ctxt requests it during updating the edge.
1720 * region-model.cc (poisoned_value_diagnostic::terminate_path_p):
1721 New vfunc.
1722 * sm-malloc.cc (null_deref::terminate_path_p): New vfunc.
1723 (null_arg::terminate_path_p): New vfunc.
1725 2023-02-16 David Malcolm <dmalcolm@redhat.com>
1727 PR analyzer/108806
1728 * constraint-manager.cc (bounded_range::dump_to_pp): Use
1729 bounded_range::singleton_p.
1730 (constraint_manager::add_bounded_ranges): Handle singleton ranges
1731 by adding an EQ_EXPR constraint.
1732 (constraint_manager::impossible_derived_conditions_p): New.
1733 (constraint_manager::eval_condition): Reject EQ_EXPR when it would
1734 imply impossible derived conditions.
1735 (selftest::test_bits): New.
1736 (selftest::run_constraint_manager_tests): Run it.
1737 * constraint-manager.h (bounded_range::singleton_p): New.
1738 (constraint_manager::impossible_derived_conditions_p): New decl.
1739 * region-model.cc (region_model::get_rvalue_1): Handle
1740 BIT_AND_EXPR, BIT_IOR_EXPR, and BIT_XOR_EXPR.
1742 2023-02-15 David Malcolm <dmalcolm@redhat.com>
1744 PR analyzer/108664
1745 PR analyzer/108666
1746 PR analyzer/108725
1747 * diagnostic-manager.cc (epath_finder::get_best_epath): Add
1748 "target_stmt" param.
1749 (epath_finder::explore_feasible_paths): Likewise.
1750 (epath_finder::process_worklist_item): Likewise.
1751 (saved_diagnostic::calc_best_epath): Pass m_stmt to
1752 epath_finder::get_best_epath.
1753 * engine.cc (feasibility_state::maybe_update_for_edge): Move
1754 per-stmt logic to...
1755 (feasibility_state::update_for_stmt): ...this new function.
1756 * exploded-graph.h (feasibility_state::update_for_stmt): New decl.
1757 * feasible-graph.cc (feasible_node::get_state_at_stmt): New.
1758 * feasible-graph.h: Include "analyzer/exploded-graph.h".
1759 (feasible_node::get_state_at_stmt): New decl.
1760 * infinite-recursion.cc
1761 (infinite_recursion_diagnostic::check_valid_fpath_p): Update for
1762 vfunc signature change.
1763 * pending-diagnostic.h (pending_diagnostic::check_valid_fpath_p):
1764 Convert first param to a reference. Add stmt param.
1765 * region-model.cc: Include "analyzer/feasible-graph.h".
1766 (poisoned_value_diagnostic::poisoned_value_diagnostic): Add
1767 "check_expr" param.
1768 (poisoned_value_diagnostic::check_valid_fpath_p): New.
1769 (poisoned_value_diagnostic::m_check_expr): New field.
1770 (region_model::check_for_poison): Attempt to supply a check_expr
1771 to the diagnostic
1772 (region_model::deref_rvalue): Add NULL for new check_expr param
1773 of poisoned_value_diagnostic.
1774 (region_model::get_or_create_region_for_heap_alloc): Don't reuse
1775 regions that are marked as TOUCHED.
1777 2023-02-10 David Malcolm <dmalcolm@redhat.com>
1779 PR analyzer/108745
1780 * sm-malloc.cc (deref_before_check::emit): Reject the warning if
1781 the check occurs within a macro defintion.
1783 2023-02-09 David Malcolm <dmalcolm@redhat.com>
1785 PR analyzer/108733
1786 * state-purge.cc (get_candidate_for_purging): Add ADDR_EXPR
1787 and MEM_REF.
1789 2023-02-08 David Malcolm <dmalcolm@redhat.com>
1791 PR analyzer/108704
1792 * state-purge.cc (state_purge_per_decl::process_point_backwards):
1793 Don't stop processing the decl if it's fully overwritten by
1794 this stmt if it's also used by this stmt.
1796 2023-02-07 David Malcolm <dmalcolm@redhat.com>
1798 PR analyzer/108661
1799 * sm-fd.cc (class kf_read): New.
1800 (register_known_fd_functions): Register "read".
1801 * sm-file.cc (class kf_fread): Update comment.
1803 2023-02-02 David Malcolm <dmalcolm@redhat.com>
1805 PR analyzer/108633
1806 * sm-fd.cc (fd_state_machine::check_for_fd_attrs): Add missing
1807 "continue".
1808 (fd_state_machine::on_listen): Don't issue phase-mismatch or
1809 type-mismatch warnings for the "invalid" state.
1811 2023-02-01 David Malcolm <dmalcolm@redhat.com>
1813 PR analyzer/108616
1814 * pending-diagnostic.cc (fixup_location_in_macro_p): Add "alloca"
1815 to macros that we shouldn't unwind inside.
1817 2023-01-26 David Malcolm <dmalcolm@redhat.com>
1819 PR analyzer/108524
1820 * analyzer.h (class feasible_node): New forward decl.
1821 * diagnostic-manager.cc (epath_finder::get_best_epath): Add "pd"
1822 param.
1823 (epath_finder::explore_feasible_paths): Likewise.
1824 (epath_finder::process_worklist_item): Likewise. Use it to call
1825 pending_diagnostic::check_valid_fpath_p on the final fpath to
1826 give pending_diagnostic a way to add additional restrictions on
1827 feasibility.
1828 (saved_diagnostic::calc_best_epath): Pass pending_diagnostic to
1829 epath_finder::get_best_epath.
1830 * infinite-recursion.cc: Include "analyzer/feasible-graph.h".
1831 (infinite_recursion_diagnostic::check_valid_fpath_p): New.
1832 (infinite_recursion_diagnostic::fedge_uses_conjured_svalue_p): New.
1833 (infinite_recursion_diagnostic::expr_uses_conjured_svalue_p): New.
1834 * pending-diagnostic.h (pending_diagnostic::check_valid_fpath_p):
1835 New vfunc.
1837 2023-01-19 David Malcolm <dmalcolm@redhat.com>
1839 PR analyzer/108455
1840 * analyzer.h (class checker_event): New forward decl.
1841 (class state_change_event): Indent.
1842 (class warning_event): New forward decl.
1843 * checker-event.cc (state_change_event::state_change_event): Add
1844 "enode" param.
1845 (warning_event::get_desc): Update for new param of
1846 evdesc::final_event ctor.
1847 * checker-event.h (state_change_event::state_change_event): Add
1848 "enode" param.
1849 (state_change_event::get_exploded_node): New accessor.
1850 (state_change_event::m_enode): New field.
1851 (warning_event::warning_event): New "enode" param.
1852 (warning_event::get_exploded_node): New accessor.
1853 (warning_event::m_enode): New field.
1854 * diagnostic-manager.cc
1855 (state_change_event_creator::on_global_state_change): Pass
1856 src_node to state_change_event ctor.
1857 (state_change_event_creator::on_state_change): Likewise.
1858 (null_assignment_sm_context::set_next_state): Pass NULL for
1859 new param of state_change_event ctor.
1860 * infinite-recursion.cc
1861 (infinite_recursion_diagnostic::add_final_event): Update for new
1862 param of warning_event ctor.
1863 * pending-diagnostic.cc (pending_diagnostic::add_final_event):
1864 Pass enode to warning_event ctor.
1865 * pending-diagnostic.h (evdesc::final_event): Add reference to
1866 warning_event.
1867 * sm-malloc.cc: Include "analyzer/checker-event.h" and
1868 "analyzer/exploded-graph.h".
1869 (deref_before_check::deref_before_check): Initialize new fields.
1870 (deref_before_check::emit): Reject warnings in which we were
1871 unable to determine the enodes of the dereference and the check.
1872 Reject warnings interprocedural warnings. Reject warnings in which
1873 the dereference doesn't dominate the check.
1874 (deref_before_check::describe_state_change): Set m_deref_enode.
1875 (deref_before_check::describe_final_event): Set m_check_enode.
1876 (deref_before_check::m_deref_enode): New field.
1877 (deref_before_check::m_check_enode): New field.
1879 2023-01-13 David Malcolm <dmalcolm@redhat.com>
1881 PR analyzer/105273
1882 * region-model.cc (has_nondefault_case_for_value_p): New.
1883 (has_nondefault_cases_for_all_enum_values_p): New.
1884 (region_model::apply_constraints_for_gswitch): Skip
1885 implicitly-created "default" when switching on an enum
1886 and all enum values have non-default cases.
1887 (rejected_default_case::dump_to_pp): New.
1888 * region-model.h (region_model_context::possibly_tainted_p): New
1889 decl.
1890 (class rejected_default_case): New.
1891 * sm-taint.cc (region_model_context::possibly_tainted_p): New.
1892 * supergraph.cc (switch_cfg_superedge::dump_label_to_pp): Dump
1893 when implicitly_created_default_p.
1894 (switch_cfg_superedge::implicitly_created_default_p): New.
1895 * supergraph.h
1896 (switch_cfg_superedge::implicitly_created_default_p): New decl.
1898 2023-01-11 David Malcolm <dmalcolm@redhat.com>
1900 PR analyzer/108252
1901 * kf.cc (class kf_strdup): New.
1902 (class kf_strndup): New.
1903 (register_known_functions): Register them.
1904 * region-model.cc (region_model::on_call_pre): Use
1905 &HEAP_ALLOCATED_REGION for the default result of an external
1906 function with the "malloc" attribute, rather than CONJURED_SVALUE.
1907 (region_model::get_or_create_region_for_heap_alloc): Allow
1908 "size_in_bytes" to be NULL.
1909 * store.cc (store::set_value): When handling *UNKNOWN = VAL,
1910 mark VAL as "maybe bound".
1912 2022-12-16 David Malcolm <dmalcolm@redhat.com>
1914 PR analyzer/106479
1915 * kf.cc (kf_memcpy_memmove::impl_call_pre): Pass in source region
1916 to region_model::check_for_poison.
1917 * region-model-asm.cc (region_model::on_asm_stmt): Pass NULL
1918 region to region_model::check_for_poison.
1919 * region-model.cc (region_model::check_for_poison): Add
1920 "src_region" param, and pass it to poisoned_value_diagnostic.
1921 (region_model::on_assignment): Pass NULL region to
1922 region_model::check_for_poison.
1923 (region_model::get_rvalue): Likewise.
1924 * region-model.h (region_model::check_for_poison): Add
1925 "src_region" param.
1926 * sm-fd.cc (fd_state_machine::on_accept): Pass in source region
1927 to region_model::check_for_poison.
1928 * varargs.cc (kf_va_copy::impl_call_pre): Pass NULL region to
1929 region_model::check_for_poison.
1930 (kf_va_arg::impl_call_pre): Pass in source region to
1931 region_model::check_for_poison.
1933 2022-12-14 David Malcolm <dmalcolm@redhat.com>
1935 PR analyzer/108065
1936 * region.cc (decl_region::get_svalue_for_initializer): Bail out to
1937 avoid calling binding_key::make with an empty region.
1938 * store.cc (binding_map::apply_ctor_val_to_range): Likewise.
1939 (binding_map::apply_ctor_pair_to_child_region): Likewise.
1940 (binding_cluster::bind): Likewise.
1941 (binding_cluster::purge_region): Likewise.
1942 (binding_cluster::maybe_get_compound_binding): Likewise.
1943 (binding_cluster::maybe_get_simple_value): Likewise.
1945 2022-12-09 David Malcolm <dmalcolm@redhat.com>
1947 * analyzer.h (class known_function): Expand comment.
1948 * region-model-impl-calls.cc: Rename to...
1949 * kf.cc: ...this.
1950 * known-function-manager.h (class known_function_manager): Add
1951 leading comment.
1953 2022-12-09 David Malcolm <dmalcolm@redhat.com>
1955 PR analyzer/108003
1956 * call-summary.cc
1957 (call_summary_replay::convert_region_from_summary_1): Convert
1958 heap_regs_in_use from auto_sbitmap to auto_bitmap.
1959 * region-model-manager.cc
1960 (region_model_manager::get_or_create_region_for_heap_alloc):
1961 Convert from sbitmap to bitmap.
1962 * region-model-manager.h: Likewise.
1963 * region-model.cc
1964 (region_model::get_or_create_region_for_heap_alloc): Convert from
1965 auto_sbitmap to auto_bitmap.
1966 (region_model::get_referenced_base_regions): Likewise.
1967 * region-model.h: Include "bitmap.h" rather than "sbitmap.h".
1968 (region_model::get_referenced_base_regions): Convert from
1969 auto_sbitmap to auto_bitmap.
1971 2022-12-09 David Malcolm <dmalcolm@redhat.com>
1973 * region-model-impl-calls.cc (class kf_memcpy): Rename to...
1974 (class kf_memcpy_memmove): ...this.
1975 (kf_memcpy::impl_call_pre): Rename to...
1976 (kf_memcpy_memmove::impl_call_pre): ...this, and check the src for
1977 poison.
1978 (register_known_functions): Update for above renaming, and
1979 register BUILT_IN_MEMMOVE and BUILT_IN_MEMMOVE_CHK.
1981 2022-12-06 David Malcolm <dmalcolm@redhat.com>
1983 PR analyzer/107882
1984 * region-model.cc (region_model::get_store_value): Return an
1985 unknown value for empty regions.
1986 (region_model::set_value): Bail on empty regions.
1987 * region.cc (region::empty_p): New.
1988 * region.h (region::empty_p): New decl.
1989 * state-purge.cc (same_binding_p): Bail if either region is empty.
1990 * store.cc (binding_key::make): Assert that a concrete binding's
1991 bit_size must be > 0.
1992 (binding_cluster::mark_region_as_unknown): Bail on empty regions.
1993 (binding_cluster::get_binding): Likewise.
1994 (binding_cluster::remove_overlapping_bindings): Likewise.
1995 (binding_cluster::on_unknown_fncall): Don't conjure values for
1996 empty regions.
1997 (store::fill_region): Bail on empty regions.
1998 * store.h (class concrete_binding): Update comment to reflect that
1999 the range of bits must be non-empty.
2000 (concrete_binding::concrete_binding): Assert that bit range is
2001 non-empty.
2003 2022-12-06 David Malcolm <dmalcolm@redhat.com>
2005 PR analyzer/106325
2006 * region-model-manager.cc
2007 (region_model_manager::get_or_create_null_ptr): New.
2008 * region-model-manager.h
2009 (region_model_manager::get_or_create_null_ptr): New decl.
2010 * region-model.cc (region_model::on_top_level_param): Add
2011 "nonnull" param and make use of it.
2012 (region_model::push_frame): When handling a top-level entrypoint
2013 to the analysis, determine which params __attribute__((nonnull))
2014 applies to, and pass to on_top_level_param.
2015 * region-model.h (region_model::on_top_level_param): Add "nonnull"
2016 param.
2018 2022-12-06 David Malcolm <dmalcolm@redhat.com>
2020 * analyzer.h (register_known_analyzer_functions): New decl.
2021 (register_known_functions_lang_cp): New decl.
2022 * call-details.cc: New file, split out from
2023 region-model-impl-calls.cc.
2024 * call-details.h: New file, split out from region-model.h.
2025 * call-info.cc: Include "analyzer/call-details.h".
2026 * call-summary.h: Likewise.
2027 * kf-analyzer.cc: New file, split out from
2028 region-model-impl-calls.cc.
2029 * kf-lang-cp.cc: Likewise.
2030 * known-function-manager.cc: Include "analyzer/call-details.h".
2031 * region-model-impl-calls.cc: Move definitions of call_details's
2032 member functions to call-details.cc. Move class kf_analyzer_* to
2033 kf-analyzer.cc. Move kf_operator_new and kf_operator_delete to
2034 kf-lang-cp.cc. Refresh #includes accordingly.
2035 (register_known_functions): Replace registration of __analyzer_*
2036 functions with a call to register_known_analyzer_functions.
2037 Replace registration of C++ support functions with a call to
2038 register_known_functions_lang_cp.
2039 * region-model.h (class call_details): Move to new call-details.h.
2040 * sm-fd.cc: Include "analyzer/call-details.h".
2041 * sm-file.cc: Likewise.
2042 * sm-malloc.cc: Likewise.
2043 * varargs.cc: Likewise.
2045 2022-12-02 David Malcolm <dmalcolm@redhat.com>
2047 * analyzer.h (struct event_loc_info): New forward decl.
2048 * bounds-checking.cc: Use event_loc_info throughout to bundle the
2049 loc, fndecl, depth triples.
2050 * call-info.cc: Likewise.
2051 * checker-event.cc: Likewise.
2052 * checker-event.h (struct event_loc_info): New decl. Use it
2053 throughout to bundle the loc, fndecl, depth triples.
2054 * checker-path.cc: Likewise.
2055 * checker-path.h: Likewise.
2056 * diagnostic-manager.cc: Likewise.
2057 * engine.cc: Likewise.
2058 * infinite-recursion.cc: Likewise.
2059 * pending-diagnostic.cc: Likewise.
2060 * pending-diagnostic.h: Likewise.
2061 * region-model.cc: Likewise.
2062 * sm-signal.cc: Likewise.
2063 * varargs.cc: Likewise.
2065 2022-12-02 David Malcolm <dmalcolm@redhat.com>
2067 PR analyzer/107851
2068 * analyzer.cc (make_label_text_n): Convert param "n" from int to
2069 unsigned HOST_WIDE_INT.
2070 * analyzer.h (make_label_text_n): Likewise for decl.
2071 * bounds-checking.cc: Include "analyzer/checker-event.h" and
2072 "analyzer/checker-path.h".
2073 (out_of_bounds::add_region_creation_events): New.
2074 (concrete_past_the_end::describe_region_creation_event): Replace
2075 with...
2076 (concrete_past_the_end::add_region_creation_events): ...this.
2077 (symbolic_past_the_end::describe_region_creation_event): Delete.
2078 * checker-event.cc (region_creation_event::region_creation_event):
2079 Update for dropping all member data.
2080 (region_creation_event::get_desc): Delete, splitting out into
2081 region_creation_event_memory_space::get_desc,
2082 region_creation_event_capacity::get_desc, and
2083 region_creation_event_debug::get_desc.
2084 (region_creation_event_memory_space::get_desc): New.
2085 (region_creation_event_capacity::get_desc): New.
2086 (region_creation_event_allocation_size::get_desc): New.
2087 (region_creation_event_debug::get_desc): New.
2088 * checker-event.h: Include "analyzer/program-state.h".
2089 (enum rce_kind): Delete.
2090 (class region_creation_event): Drop all member data.
2091 (region_creation_event::region_creation_event): Make protected.
2092 (region_creation_event::get_desc): Delete.
2093 (class region_creation_event_memory_space): New.
2094 (class region_creation_event_capacity): New.
2095 (class region_creation_event_allocation_size): New.
2096 (class region_creation_event_debug): New.
2097 * checker-path.cc (checker_path::add_region_creation_events): Add
2098 "pd" param. Call pending_diangnostic::add_region_creation_events.
2099 Update for conversion of RCE_DEBUG to region_creation_event_debug.
2100 * checker-path.h (checker_path::add_region_creation_events): Add
2101 "pd" param.
2102 * diagnostic-manager.cc (diagnostic_manager::build_emission_path):
2103 Pass pending_diagnostic to
2104 emission_path::add_region_creation_events.
2105 (diagnostic_manager::build_emission_path): Pass path_builder to
2106 add_event_on_final_node.
2107 (diagnostic_manager::add_event_on_final_node): Add "pb" param.
2108 Pass pending_diagnostic to
2109 emission_path::add_region_creation_events.
2110 (diagnostic_manager::add_events_for_eedge): Pass
2111 pending_diagnostic to emission_path::add_region_creation_events.
2112 * diagnostic-manager.h
2113 (diagnostic_manager::add_event_on_final_node): Add "pb" param.
2114 * pending-diagnostic.cc
2115 (pending_diagnostic::add_region_creation_events): New.
2116 * pending-diagnostic.h (struct region_creation): Delete.
2117 (pending_diagnostic::describe_region_creation_event): Delete.
2118 (pending_diagnostic::add_region_creation_events): New vfunc.
2119 * region-model.cc: Include "analyzer/checker-event.h" and
2120 "analyzer/checker-path.h".
2121 (dubious_allocation_size::dubious_allocation_size): Initialize
2122 m_has_allocation_event.
2123 (dubious_allocation_size::describe_region_creation_event): Delete.
2124 (dubious_allocation_size::describe_final_event): Update for
2125 replacement of m_allocation_event with m_has_allocation_event.
2126 (dubious_allocation_size::add_region_creation_events): New.
2127 (dubious_allocation_size::m_allocation_event): Replace with...
2128 (dubious_allocation_size::m_has_allocation_event): ...this.
2130 2022-12-02 David Malcolm <dmalcolm@redhat.com>
2132 PR analyzer/107948
2133 * region-model-manager.cc
2134 (region_model_manager::maybe_fold_binop): Fold (0 - VAL) to -VAL.
2135 * region-model.cc (region_model::eval_condition): Handle e.g.
2136 "-X <= 0" as equivalent to X >= 0".
2138 2022-12-01 David Malcolm <dmalcolm@redhat.com>
2140 PR analyzer/106626
2141 * bounds-checking.cc
2142 (symbolic_past_the_end::describe_final_event): Delete, moving to
2143 symbolic_buffer_overflow::describe_final_event and
2144 symbolic_buffer_over_read::describe_final_event, eliminating
2145 composition of text strings via "byte_str" and "m_dir_str".
2146 (symbolic_past_the_end::m_dir_str): Delete field.
2147 (symbolic_buffer_overflow::symbolic_buffer_overflow): Drop
2148 m_dir_str.
2149 (symbolic_buffer_overflow::describe_final_event): New, as noted
2150 above.
2151 (symbolic_buffer_over_read::symbolic_buffer_overflow): Drop
2152 m_dir_str.
2153 (symbolic_buffer_over_read::describe_final_event): New, as noted
2154 above.
2156 2022-12-01 David Malcolm <dmalcolm@redhat.com>
2158 * bounds-checking.cc (class out_of_bounds): Split out from...
2159 (class concrete_out_of_bounds): New abstract subclass.
2160 (class past_the_end): Rename to...
2161 (class concrete_past_the_end): ...this, and make a subclass of
2162 concrete_out_of_bounds.
2163 (class buffer_overflow): Rename to...
2164 (class concrete_buffer_overflow): ...this, and make a subclass of
2165 concrete_past_the_end.
2166 (class buffer_over_read): Rename to...
2167 (class concrete_buffer_over_read): ...this, and make a subclass of
2168 concrete_past_the_end.
2169 (class buffer_underwrite): Rename to...
2170 (class concrete_buffer_underwrite): ...this, and make a subclass
2171 of concrete_out_of_bounds.
2172 (class buffer_under_read): Rename to...
2173 (class concrete_buffer_under_read): ...this, and make a subclass
2174 of concrete_out_of_bounds.
2175 (class symbolic_past_the_end): Convert to a subclass of
2176 out_of_bounds.
2177 (symbolic_buffer_overflow::get_kind): New.
2178 (symbolic_buffer_over_read::get_kind): New.
2179 (region_model::check_region_bounds): Update for renamings.
2180 * engine.cc (impl_sm_context::set_next_state): Eliminate
2181 "new_ctxt", passing NULL to get_rvalue instead.
2182 (impl_sm_context::warn): Likewise.
2184 2022-12-01 David Malcolm <dmalcolm@redhat.com>
2186 PR analyzer/106626
2187 * bounds-checking.cc (out_of_bounds::get_memory_space): New.
2188 (buffer_overflow::emit): Use it.
2189 (class buffer_overread): Rename to...
2190 (class buffer_over_read): ...this.
2191 (buffer_over_read::emit): Specify which memory space the read is
2192 from, where known. Change "overread" to "over-read".
2193 (class buffer_underflow): Rename to...
2194 (class buffer_underwrite): ...this.
2195 (buffer_underwrite::emit): Specify which memory space the write is
2196 to, where known. Change "underflow" to "underwrite".
2197 (class buffer_underread): Rename to...
2198 (class buffer_under_read): Rename to...
2199 (buffer_under_read::emit): Specify which memory space the read is
2200 from, where known. Change "underread" to "under-read".
2201 (symbolic_past_the_end::get_memory_space): New.
2202 (symbolic_buffer_overflow::emit): Use it.
2203 (class symbolic_buffer_overread): Rename to...
2204 (class symbolic_buffer_over_read): ...this.
2205 (symbolic_buffer_over_read::emit): Specify which memory space the
2206 read is from, where known. Change "overread" to "over-read".
2207 (region_model::check_symbolic_bounds): Update for class renaming.
2208 (region_model::check_region_bounds): Likewise.
2210 2022-12-01 David Malcolm <dmalcolm@redhat.com>
2212 PR analyzer/106626
2213 * bounds-checking.cc (out_of_bounds::maybe_describe_array_bounds):
2214 New.
2215 (buffer_overflow::emit): Call maybe_describe_array_bounds.
2216 (buffer_overread::emit): Likewise.
2217 (buffer_underflow::emit): Likewise.
2218 (buffer_underread::emit): Likewise.
2220 2022-12-01 David Malcolm <dmalcolm@redhat.com>
2222 PR analyzer/106626
2223 * bounds-checking.cc (buffer_overflow::emit): Use inform_n.
2224 Update wording to clarify that we're talking about the size of
2225 the bad access, rather than its position.
2226 (buffer_overread::emit): Likewise.
2228 2022-12-01 David Malcolm <dmalcolm@redhat.com>
2230 * bounds-checking.cc: New file, taken from region-model.cc.
2231 * region-model.cc (class out_of_bounds): Move to
2232 bounds-checking.cc.
2233 (class past_the_end): Likewise.
2234 (class buffer_overflow): Likewise.
2235 (class buffer_overread): Likewise.
2236 (class buffer_underflow): Likewise.
2237 (class buffer_underread): Likewise.
2238 (class symbolic_past_the_end): Likewise.
2239 (class symbolic_buffer_overflow): Likewise.
2240 (class symbolic_buffer_overread): Likewise.
2241 (region_model::check_symbolic_bounds): Likewise.
2242 (maybe_get_integer_cst_tree): Likewise.
2243 (region_model::check_region_bounds): Likewise.
2244 * region-model.h: Add comment.
2246 2022-12-01 David Malcolm <dmalcolm@redhat.com>
2248 PR analyzer/107928
2249 * sm-fd.cc (fd_state_machine::on_bind): Handle m_constant_fd in
2250 the "success" outcome.
2251 (fd_state_machine::on_connect): Likewise.
2252 * sm-fd.dot: Add "constant_fd" state and its transitions.
2254 2022-11-30 David Malcolm <dmalcolm@redhat.com>
2256 * region-model-impl-calls.cc (class kf_fgets): Move to sm-file.cc.
2257 (kf_fgets::impl_call_pre): Likewise.
2258 (class kf_fread): Likewise.
2259 (kf_fread::impl_call_pre): Likewise.
2260 (class kf_getchar): Likewise.
2261 (class kf_stdio_output_fn): Likewise.
2262 (register_known_functions): Move registration of
2263 BUILT_IN_FPRINTF, BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_FPUTC,
2264 BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
2265 BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
2266 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTCHAR,
2267 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_PUTS,
2268 BUILT_IN_PUTS_UNLOCKED, BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF,
2269 "getchar", "fgets", "fgets_unlocked", and "fread" to
2270 register_known_file_functions.
2271 * sm-file.cc (class kf_stdio_output_fn): Move here from
2272 region-model-impl-calls.cc.
2273 (class kf_fgets): Likewise.
2274 (class kf_fread): Likewise.
2275 (class kf_getchar): Likewise.
2276 (register_known_file_functions): Move registration of
2277 BUILT_IN_FPRINTF, BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_FPUTC,
2278 BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
2279 BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
2280 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTCHAR,
2281 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_PUTS,
2282 BUILT_IN_PUTS_UNLOCKED, BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF,
2283 "fgets", "fgets_unlocked", "fread", and "getchar" to here from
2284 register_known_functions.
2286 2022-11-30 David Malcolm <dmalcolm@redhat.com>
2288 PR analyzer/103546
2289 * analyzer.h (register_known_file_functions): New decl.
2290 * program-state.cc (sm_state_map::replay_call_summary): Rejct
2291 attempts to store sm-state for caller_sval that can't have
2292 associated state.
2293 * region-model-impl-calls.cc (register_known_functions): Call
2294 register_known_file_functions.
2295 * sm-fd.cc (class kf_isatty): New.
2296 (register_known_fd_functions): Register it.
2297 * sm-file.cc (class kf_ferror): New.
2298 (class kf_fileno): New.
2299 (class kf_getc): New.
2300 (register_known_file_functions): New.
2302 2022-11-30 David Malcolm <dmalcolm@redhat.com>
2304 PR analyzer/105784
2305 * region-model-manager.cc
2306 (region_model_manager::maybe_fold_binop): For POINTER_PLUS_EXPR,
2307 PLUS_EXPR and MINUS_EXPR, eliminate requirement that the final
2308 type matches that of arg0 in favor of a cast.
2310 2022-11-24 Martin Liska <mliska@suse.cz>
2312 * varargs.cc: Fix Clang warnings.
2314 2022-11-24 David Malcolm <dmalcolm@redhat.com>
2316 PR analyzer/106473
2317 * call-summary.cc
2318 (call_summary_replay::convert_region_from_summary_1): Update for
2319 change to creation of heap-allocated regions.
2320 * program-state.cc (test_program_state_1): Likewise.
2321 (test_program_state_merging): Likewise.
2322 * region-model-impl-calls.cc (kf_calloc::impl_call_pre): Likewise.
2323 (kf_malloc::impl_call_pre): Likewise.
2324 (kf_operator_new::impl_call_pre): Likewise.
2325 (kf_realloc::impl_call_postsuccess_with_move::update_model): Likewise.
2326 * region-model-manager.cc
2327 (region_model_manager::create_region_for_heap_alloc): Convert
2328 to...
2329 (region_model_manager::get_or_create_region_for_heap_alloc):
2330 ...this, reusing an existing region if it's unreferenced in the
2331 client state.
2332 * region-model-manager.h (region_model_manager::get_num_regions): New.
2333 (region_model_manager::create_region_for_heap_alloc): Convert to...
2334 (region_model_manager::get_or_create_region_for_heap_alloc): ...this.
2335 * region-model.cc (region_to_value_map::can_merge_with_p): Reject
2336 merger when the values are different.
2337 (region_model::create_region_for_heap_alloc): Convert to...
2338 (region_model::get_or_create_region_for_heap_alloc): ...this.
2339 (region_model::get_referenced_base_regions): New.
2340 (selftest::test_state_merging): Update for change to creation of
2341 heap-allocated regions.
2342 (selftest::test_malloc_constraints): Likewise.
2343 (selftest::test_malloc): Likewise.
2344 * region-model.h: Include "sbitmap.h".
2345 (region_model::create_region_for_heap_alloc): Convert to...
2346 (region_model::get_or_create_region_for_heap_alloc): ...this.
2347 (region_model::get_referenced_base_regions): New decl.
2348 * store.cc (store::canonicalize): Don't purge a heap-allocated region
2349 that's been marked as escaping.
2351 2022-11-24 David Malcolm <dmalcolm@redhat.com>
2353 * checker-path.cc (checker_path::inject_any_inlined_call_events):
2354 Don't dump the address of the block when -fdump-noaddr.
2356 2022-11-24 David Malcolm <dmalcolm@redhat.com>
2358 * region-model.h (region_model::on_socket): Delete decl.
2359 (region_model::on_bind): Likewise.
2360 (region_model::on_listen): Likewise.
2361 (region_model::on_accept): Likewise.
2362 (region_model::on_connect): Likewise.
2363 * sm-fd.cc (kf_socket::outcome_of_socket::update_model): Move body
2364 of region_model::on_socket into here, ...
2365 (region_model::on_socket): ...eliminating this function.
2366 (kf_bind::outcome_of_bind::update_model): Likewise for on_bind...
2367 (region_model::on_bind): ...eliminating this function.
2368 (kf_listen::outcome_of_listen::update_model): Likewise fo
2369 on_listen...
2370 (region_model::on_listen): ...eliminating this function.
2371 (kf_accept::outcome_of_accept::update_model): Likewise fo
2372 on_accept...
2373 (region_model::on_accept): ...eliminating this function.
2374 (kf_connect::outcome_of_connect::update_model): Likewise fo
2375 on_connect...
2376 (region_model::on_connect): ...eliminating this function.
2378 2022-11-24 David Malcolm <dmalcolm@redhat.com>
2380 * analyzer.h (register_known_fd_functions): New decl.
2381 * region-model-impl-calls.cc (class kf_accept): Move to sm-fd.cc.
2382 (class kf_bind): Likewise.
2383 (class kf_connect): Likewise.
2384 (class kf_listen): Likewise.
2385 (class kf_pipe): Likewise.
2386 (class kf_socket): Likewise.
2387 (register_known_functions): Remove registration of the above
2388 functions, instead calling register_known_fd_functions.
2389 * sm-fd.cc: Include "analyzer/call-info.h".
2390 (class kf_socket): Move here from region-model-impl-calls.cc.
2391 (class kf_bind): Likewise.
2392 (class kf_listen): Likewise.
2393 (class kf_accept): Likewise.
2394 (class kf_connect): Likewise.
2395 (class kf_pipe): Likewise.
2396 (register_known_fd_functions): New.
2398 2022-11-22 David Malcolm <dmalcolm@redhat.com>
2400 PR analyzer/107788
2401 * known-function-manager.cc (known_function_manager::get_match):
2402 Don't look up fndecls by name when they're not in the root
2403 namespace.
2405 2022-11-22 David Malcolm <dmalcolm@redhat.com>
2407 PR analyzer/107783
2408 * sm-fd.cc (fd_state_machine::check_for_new_socket_fd): Don't
2409 complain when old state is "fd-constant".
2410 (fd_state_machine::on_listen): Likewise.
2411 (fd_state_machine::on_accept): Likewise.
2413 2022-11-22 David Malcolm <dmalcolm@redhat.com>
2415 PR analyzer/107807
2416 * region-model-impl-calls.cc (register_known_functions): Register
2417 "___errno" and "__error" as synonyms for "__errno_location".
2419 2022-11-22 David Malcolm <dmalcolm@redhat.com>
2421 * analyzer.h (class internal_known_function): New.
2422 (register_varargs_builtins): New decl.
2423 * engine.cc (exploded_node::on_stmt_pre): Remove
2424 "out_terminate_path" param from call to region_model::on_stmt_pre.
2425 (feasibility_state::maybe_update_for_edge): Likewise.
2426 * known-function-manager.cc: Include "basic-block.h", "gimple.h",
2427 and "analyzer/region-model.h".
2428 (known_function_manager::known_function_manager): Initialize
2429 m_combined_fns_arr.
2430 (known_function_manager::~known_function_manager): Clean up
2431 m_combined_fns_arr.
2432 (known_function_manager::get_by_identifier): Make const.
2433 (known_function_manager::add): New overloaded definitions for
2434 enum built_in_function and enum internal_fn.
2435 (known_function_manager::get_by_fndecl): Delete.
2436 (known_function_manager::get_match): New.
2437 (known_function_manager::get_internal_fn): New.
2438 (known_function_manager::get_normal_builtin): New.
2439 * known-function-manager.h
2440 (known_function_manager::get_by_identifier): Make private and
2441 add const qualifier.
2442 (known_function_manager::get_by_fndecl): Delete.
2443 (known_function_manager::add): Add overloaded decls for
2444 enum built_in_function name and enum internal_fn.
2445 (known_function_manager::get_match): New decl.
2446 (known_function_manager::get_internal_fn): New decl.
2447 (known_function_manager::get_normal_builtin): New decl.
2448 (known_function_manager::m_combined_fns_arr): New field.
2449 * region-model-impl-calls.cc (call_details::arg_is_size_p): New.
2450 (class kf_alloca): New.
2451 (region_model::impl_call_alloca): Convert to...
2452 (kf_alloca::impl_call_pre): ...this.
2453 (kf_analyzer_dump_capacity::matches_call_types_p): Rewrite check
2454 to use call_details::arg_is_pointer_p.
2455 (region_model::impl_call_builtin_expect): Convert to...
2456 (class kf_expect): ...this.
2457 (class kf_calloc): New, adding check that both arguments are
2458 size_t.
2459 (region_model::impl_call_calloc): Convert to...
2460 (kf_calloc::impl_call_pre): ...this.
2461 (kf_connect::matches_call_types_p): Rewrite check to use
2462 call_details::arg_is_pointer_p.
2463 (region_model::impl_call_error): Convert to...
2464 (class kf_error): ...this, and...
2465 (kf_error::impl_call_pre): ...this.
2466 (class kf_fgets): New, adding checks that args 0 and 2 are
2467 pointers.
2468 (region_model::impl_call_fgets): Convert to...
2469 (kf_fgets::impl_call_pre): ...this.
2470 (class kf_fread): New, adding checks on the argument types.
2471 (region_model::impl_call_fread): Convert to...
2472 (kf_fread::impl_call_pre): ...this.
2473 (class kf_free): New, adding check that the argument is a pointer.
2474 (region_model::impl_call_free): Convert to...
2475 (kf_free::impl_call_post): ...this.
2476 (class kf_getchar): New.
2477 (class kf_malloc): New, adding check that the argument is a
2478 size_t.
2479 (region_model::impl_call_malloc): Convert to...
2480 (kf_malloc::impl_call_pre): ...this.
2481 (class kf_memcpy): New, adding checks on arguments.
2482 (region_model::impl_call_memcpy): Convert to...
2483 (kf_memcpy::impl_call_pre): ...this.
2484 (class kf_memset): New.
2485 (region_model::impl_call_memset): Convert to...
2486 (kf_memset::impl_call_pre): ...this.
2487 (kf_pipe::matches_call_types_p): Rewrite check to use
2488 call_details::arg_is_pointer_p.
2489 (kf_putenv::matches_call_types_p): Likewise.
2490 (class kf_realloc): New, adding checks on the argument types.
2491 (region_model::impl_call_realloc): Convert to...
2492 (kf_realloc::impl_call_post): ...this.
2493 (class kf_strchr): New.
2494 (region_model::impl_call_strchr): Convert to...
2495 (kf_strchr::impl_call_post): ...this.
2496 (class kf_stack_restore): New.
2497 (class kf_stack_save): New.
2498 (class kf_stdio_output_fn): New.
2499 (class kf_strcpy): New,
2500 (region_model::impl_call_strcpy): Convert to...
2501 (kf_strcpy::impl_call_pre): ...this.
2502 (class kf_strlen): New.
2503 (region_model::impl_call_strlen): Convert to...
2504 (kf_strlen::impl_call_pre): ...this.
2505 (class kf_ubsan_bounds): New.
2506 (region_model::impl_deallocation_call): Reimplement to avoid call
2507 to impl_call_free.
2508 (register_known_functions): Add handlers for IFN_BUILTIN_EXPECT
2509 and IFN_UBSAN_BOUNDS. Add handlers for BUILT_IN_ALLOCA,
2510 BUILT_IN_ALLOCA_WITH_ALIGN, BUILT_IN_CALLOC, BUILT_IN_EXPECT,
2511 BUILT_IN_EXPECT_WITH_PROBABILITY, BUILT_IN_FPRINTF,
2512 BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_FPUTC,
2513 BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
2514 BUILT_IN_FREE, BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED,
2515 BUILT_IN_MALLOC, BUILT_IN_MEMCPY, BUILT_IN_MEMCPY_CHK,
2516 BUILT_IN_MEMSET, BUILT_IN_MEMSET_CHK, BUILT_IN_PRINTF,
2517 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTCHAR,
2518 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_PUTS,
2519 BUILT_IN_PUTS_UNLOCKED, BUILT_IN_REALLOC, BUILT_IN_STACK_RESTORE,
2520 BUILT_IN_STACK_SAVE, BUILT_IN_STRCHR, BUILT_IN_STRCPY,
2521 BUILT_IN_STRCPY_CHK, BUILT_IN_STRLEN, BUILT_IN_VFPRINTF, and
2522 BUILT_IN_VPRINTF. Call register_varargs_builtins. Add handlers
2523 for "getchar", "memset", "fgets", "fgets_unlocked", "fread",
2524 "error", and "error_at_line".
2525 * region-model.cc (region_model::on_stmt_pre): Drop
2526 "out_terminate_path" param.
2527 (region_model::get_known_function): Reimplement by calling
2528 known_function_manager::get_match, passing new "cd" param.
2529 Add overload taking enum internal_fn.
2530 (region_model::on_call_pre): Drop "out_terminate_path" param.
2531 Remove special-case handling of internal fns IFN_BUILTIN_EXPECT,
2532 IFN_UBSAN_BOUNDS, and IFN_VA_ARG, of built-in fns BUILT_IN_ALLOCA,
2533 BUILT_IN_ALLOCA_WITH_ALIGN, BUILT_IN_CALLOC, BUILT_IN_EXPECT,
2534 BUILT_IN_EXPECT_WITH_PROBABILITY, BUILT_IN_FREE, BUILT_IN_MALLOC,
2535 BUILT_IN_MEMCPY, BUILT_IN_MEMCPY_CHK, BUILT_IN_MEMSET,
2536 BUILT_IN_MEMSET_CHK, BUILT_IN_REALLOC, BUILT_IN_STRCHR,
2537 BUILT_IN_STRCPY, BUILT_IN_STRCPY_CHK, BUILT_IN_STRLEN,
2538 BUILT_IN_STACK_SAVE, BUILT_IN_STACK_RESTORE, BUILT_IN_FPRINTF,
2539 BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTC_UNLOCKED,
2540 BUILT_IN_FPUTC, BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS,
2541 BUILT_IN_FPUTS_UNLOCKED, BUILT_IN_FWRITE,
2542 BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
2543 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTCHAR,
2544 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTS, BUILT_IN_PUTS_UNLOCKED,
2545 BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF, BUILT_IN_VA_START, and
2546 BUILT_IN_VA_COPY, and of named functions "malloc", "calloc",
2547 "alloca", "realloc", "error", "error_at_line", "fgets",
2548 "fgets_unlocked", "fread", "getchar", "memset", "strchr", and
2549 "strlen". Replace all this special-casing with calls to
2550 get_known_function for internal fns and for fn decls.
2551 (region_model::on_call_post): Remove special-casing handling for
2552 "free" and "strchr", and for BUILT_IN_REALLOC, BUILT_IN_STRCHR,
2553 and BUILT_IN_VA_END. Replace by consolidating on usage of
2554 get_known_function.
2555 * region-model.h (call_details::arg_is_size_p): New.
2556 (region_model::on_stmt_pre): Drop "out_terminate_path" param.
2557 (region_model::on_call_pre): Likewise.
2558 (region_model::impl_call_alloca): Delete.
2559 (region_model::impl_call_builtin_expect): Delete.
2560 (region_model::impl_call_calloc): Delete.
2561 (region_model::impl_call_error): Delete.
2562 (region_model::impl_call_fgets): Delete.
2563 (region_model::impl_call_fread): Delete.
2564 (region_model::impl_call_free): Delete.
2565 (region_model::impl_call_malloc): Delete.
2566 (region_model::impl_call_memcpy): Delete.
2567 (region_model::impl_call_memset): Delete.
2568 (region_model::impl_call_realloc): Delete.
2569 (region_model::impl_call_strchr): Delete.
2570 (region_model::impl_call_strcpy): Delete.
2571 (region_model::impl_call_strlen): Delete.
2572 (region_model::impl_call_va_start): Delete.
2573 (region_model::impl_call_va_copy): Delete.
2574 (region_model::impl_call_va_arg): Delete.
2575 (region_model::impl_call_va_end): Delete.
2576 (region_model::check_region_for_write): Public.
2577 (region_model::get_known_function): Add "cd" param. Add
2578 overloaded decl taking enum internal_fn.
2579 * sm-malloc.cc: Update comments.
2580 * varargs.cc (class kf_va_start): New.
2581 (region_model::impl_call_va_start): Convert to...
2582 (kf_va_start::impl_call_pre): ...this.
2583 (class kf_va_copy): New.
2584 (region_model::impl_call_va_copy): Convert to...
2585 (kf_va_copy::impl_call_pre): ...this.
2586 (class kf_va_arg): New.
2587 (region_model::impl_call_va_arg): Convert to...
2588 (kf_va_arg::impl_call_pre): ...this.
2589 (class kf_va_end): New.
2590 (region_model::impl_call_va_end): Delete.
2591 (register_varargs_builtins): New.
2593 2022-11-22 David Malcolm <dmalcolm@redhat.com>
2595 PR analyzer/107788
2596 * region-model.cc (region_model::update_for_int_cst_return):
2597 Require that the return type be an integer type.
2598 (region_model::update_for_nonzero_return): Likewise.
2600 2022-11-22 David Malcolm <dmalcolm@redhat.com>
2602 PR analyzer/107783
2603 * region-model-impl-calls.cc (kf_accept::matches_call_types_p):
2604 Require that args 1 and 2 be pointers.
2605 (kf_bind::matches_call_types_p): Require that arg 1 be a pointer.
2606 * region-model.h (call_details::arg_is_pointer_p): New
2608 2022-11-22 David Malcolm <dmalcolm@redhat.com>
2610 PR analyzer/107777
2611 * call-summary.cc
2612 (call_summary_replay::convert_region_from_summary_1): Handle
2613 RK_THREAD_LOCAL and RK_ERRNO in switch.
2614 * region-model.cc (region_model::get_representative_path_var_1):
2615 Likewise.
2617 2022-11-19 David Malcolm <dmalcolm@redhat.com>
2619 PR analyzer/107582
2620 * engine.cc (dynamic_call_info_t::update_model): Update the model
2621 by pushing or pop a frame, rather than by clobbering it with the
2622 model from the exploded_node's state.
2624 2022-11-18 David Malcolm <dmalcolm@redhat.com>
2626 * analyzer.cc (is_pipe_call_p): Delete.
2627 * analyzer.h (is_pipe_call_p): Delete.
2628 * region-model-impl-calls.cc (call_details::get_location): New.
2629 (class kf_analyzer_break): New, adapted from
2630 region_model::on_stmt_pre.
2631 (region_model::impl_call_analyzer_describe): Convert to...
2632 (class kf_analyzer_describe): ...this.
2633 (region_model::impl_call_analyzer_dump_capacity): Convert to...
2634 (class kf_analyzer_dump_capacity): ...this.
2635 (region_model::impl_call_analyzer_dump_escaped): Convert to...
2636 (class kf_analyzer_dump_escaped): ...this.
2637 (class kf_analyzer_dump_exploded_nodes): New.
2638 (region_model::impl_call_analyzer_dump_named_constant): Convert
2639 to...
2640 (class kf_analyzer_dump_named_constant): ...this.
2641 (class dump_path_diagnostic): Move here from region-model.cc.
2642 (class kf_analyzer_dump_path) New, adapted from
2643 region_model::on_stmt_pre.
2644 (class kf_analyzer_dump_region_model): Likewise.
2645 (region_model::impl_call_analyzer_eval): Convert to...
2646 (class kf_analyzer_eval): ...this.
2647 (region_model::impl_call_analyzer_get_unknown_ptr): Convert to...
2648 (class kf_analyzer_get_unknown_ptr): ...this.
2649 (class known_function_accept): Rename to...
2650 (class kf_accept): ...this.
2651 (class known_function_bind): Rename to...
2652 (class kf_bind): ...this.
2653 (class known_function_connect): Rename to...
2654 (class kf_connect): ...this.
2655 (region_model::impl_call_errno_location): Convert to...
2656 (class kf_errno_location): ...this.
2657 (class known_function_listen): Rename to...
2658 (class kf_listen): ...this.
2659 (region_model::impl_call_pipe): Convert to...
2660 (class kf_pipe): ...this.
2661 (region_model::impl_call_putenv): Convert to...
2662 (class kf_putenv): ...this.
2663 (region_model::impl_call_operator_new): Convert to...
2664 (class kf_operator_new): ...this.
2665 (region_model::impl_call_operator_delete): Convert to...
2666 (class kf_operator_delete): ...this.
2667 (class known_function_socket): Rename to...
2668 (class kf_socket): ...this.
2669 (register_known_functions): Rename param to KFM. Break out
2670 existing known functions into a "POSIX" section, and add "pipe",
2671 "pipe2", and "putenv". Add debugging functions
2672 "__analyzer_break", "__analyzer_describe",
2673 "__analyzer_dump_capacity", "__analyzer_dump_escaped",
2674 "__analyzer_dump_exploded_nodes",
2675 "__analyzer_dump_named_constant", "__analyzer_dump_path",
2676 "__analyzer_dump_region_model", "__analyzer_eval",
2677 "__analyzer_get_unknown_ptr". Add C++ support functions
2678 "operator new", "operator new []", "operator delete", and
2679 "operator delete []".
2680 * region-model.cc (class dump_path_diagnostic): Move to
2681 region-model-impl-calls.cc.
2682 (region_model::on_stmt_pre): Eliminate special-casing of
2683 "__analyzer_describe", "__analyzer_dump_capacity",
2684 "__analyzer_dump_escaped", "__analyzer_dump_named_constant",
2685 "__analyzer_dump_path", "__analyzer_dump_region_model",
2686 "__analyzer_eval", "__analyzer_break",
2687 "__analyzer_dump_exploded_nodes", "__analyzer_get_unknown_ptr",
2688 "__errno_location", "pipe", "pipe2", "putenv", "operator new",
2689 "operator new []", "operator delete", "operator delete []"
2690 "pipe" and "pipe2", handling them instead via the known_functions
2691 mechanism.
2692 * region-model.h (call_details::get_location): New decl.
2693 (region_model::impl_call_analyzer_describe): Delete decl.
2694 (region_model::impl_call_analyzer_dump_capacity): Delete decl.
2695 (region_model::impl_call_analyzer_dump_escaped): Delete decl.
2696 (region_model::impl_call_analyzer_dump_named_constant): Delete decl.
2697 (region_model::impl_call_analyzer_eval): Delete decl.
2698 (region_model::impl_call_analyzer_get_unknown_ptr): Delete decl.
2699 (region_model::impl_call_errno_location): Delete decl.
2700 (region_model::impl_call_pipe): Delete decl.
2701 (region_model::impl_call_putenv): Delete decl.
2702 (region_model::impl_call_operator_new): Delete decl.
2703 (region_model::impl_call_operator_delete): Delete decl.
2704 * sm-fd.cc: Update comments.
2706 2022-11-16 David Malcolm <dmalcolm@redhat.com>
2708 PR analyzer/107711
2709 * analyzer-language.cc: Include "diagnostic.h".
2710 (maybe_stash_named_constant): Add logger param and use it to log
2711 the name being looked up, and the result.
2712 (stash_named_constants): New, splitting out from...
2713 (on_finish_translation_unit): ...this function. Call
2714 get_or_create_logfile and use the result to create a logger
2715 instance, passing it to stash_named_constants.
2716 * analyzer.h (get_or_create_any_logfile): New decl.
2717 * engine.cc (dump_fout, owns_dump_fout): New globals, split out
2718 from run_checkers.
2719 (get_or_create_any_logfile): New function, split out from...
2720 (run_checkers): ...here, so that the logfile can be opened by
2721 on_finish_translation_unit. Clear the globals when closing the
2722 dump file.
2724 2022-11-16 David Malcolm <dmalcolm@redhat.com>
2726 * analyzer.h (known_function::matches_call_types_p): New vfunc.
2727 (known_function::impl_call_pre): Provide base implementation.
2728 (known_function::impl_call_post): New vfunc.
2729 (register_known_functions): New.
2730 * engine.cc (impl_run_checkers): Call register_known_functions.
2731 * region-model-impl-calls.cc (region_model::impl_call_accept):
2732 Convert to...
2733 (class known_function_accept): ...this.
2734 (region_model::impl_call_bind): Convert to...
2735 (class known_function_bind): ...this.
2736 (region_model::impl_call_connect): Convert to...
2737 (class known_function_connect): ...this.
2738 (region_model::impl_call_listen): Convert to...
2739 (class known_function_listen): ...this.
2740 (region_model::impl_call_socket): Convert to...
2741 (class known_function_socket): ...this.
2742 (register_known_functions): New.
2743 * region-model.cc (region_model::on_call_pre): Remove special
2744 case for "bind" in favor of the known_function-handling dispatch.
2745 Add call to known_function::matches_call_types_p to latter.
2746 (region_model::on_call_post): Remove special cases for "accept",
2747 "bind", "connect", "listen", and "socket" in favor of dispatch
2748 to known_function::impl_call_post.
2749 * region-model.h (region_model::impl_call_accept): Delete decl.
2750 (region_model::impl_call_bind): Delete decl.
2751 (region_model::impl_call_connect): Delete decl.
2752 (region_model::impl_call_listen): Delete decl.
2753 (region_model::impl_call_socket): Delete decl.
2754 * sm-fd.cc: Update comments.
2756 2022-11-16 David Malcolm <dmalcolm@redhat.com>
2758 * checker-event.cc: New file, split out from...
2759 * checker-path.cc: ...this file.
2761 2022-11-15 David Malcolm <dmalcolm@redhat.com>
2763 PR analyzer/106140
2764 * analyzer-language.cc (on_finish_translation_unit): Stash named
2765 constants "SOCK_STREAM" and "SOCK_DGRAM".
2766 * analyzer.opt (Wanalyzer-fd-phase-mismatch): New.
2767 (Wanalyzer-fd-type-mismatch): New.
2768 * engine.cc (impl_region_model_context::get_state_map_by_name):
2769 Add "out_sm_context" param. Allow out_sm_idx to be NULL.
2770 * exploded-graph.h
2771 (impl_region_model_context::get_state_map_by_name):
2772 Add "out_sm_context" param.
2773 * region-model-impl-calls.cc (region_model::impl_call_accept): New.
2774 (region_model::impl_call_bind): New.
2775 (region_model::impl_call_connect): New.
2776 (region_model::impl_call_listen): New.
2777 (region_model::impl_call_socket): New.
2778 * region-model.cc (region_model::on_call_pre): Special-case
2779 "bind".
2780 (region_model::on_call_post): Special-case "accept", "bind",
2781 "connect", "listen", and "socket".
2782 * region-model.h (region_model::impl_call_accept): New decl.
2783 (region_model::impl_call_bind): New decl.
2784 (region_model::impl_call_connect): New decl.
2785 (region_model::impl_call_listen): New decl.
2786 (region_model::impl_call_socket): New decl.
2787 (region_model::on_socket): New decl.
2788 (region_model::on_bind): New decl.
2789 (region_model::on_listen): New decl.
2790 (region_model::on_accept): New decl.
2791 (region_model::on_connect): New decl.
2792 (region_model::add_constraint): Make public.
2793 (region_model::check_for_poison): Make public.
2794 (region_model_context::get_state_map_by_name): Add out_sm_context param.
2795 (region_model_context::get_fd_map): Likewise.
2796 (region_model_context::get_malloc_map): Likewise.
2797 (region_model_context::get_taint_map): Likewise.
2798 (noop_region_model_context::get_state_map_by_name): Likewise.
2799 (region_model_context_decorator::get_state_map_by_name): Likewise.
2800 * sm-fd.cc: Include "analyzer/supergraph.h" and
2801 "analyzer/analyzer-language.h".
2802 (enum expected_phase): New enum.
2803 (fd_state_machine::m_new_datagram_socket): New.
2804 (fd_state_machine::m_new_stream_socket): New.
2805 (fd_state_machine::m_new_unknown_socket): New.
2806 (fd_state_machine::m_bound_datagram_socket): New.
2807 (fd_state_machine::m_bound_stream_socket): New.
2808 (fd_state_machine::m_bound_unknown_socket): New.
2809 (fd_state_machine::m_listening_stream_socket): New.
2810 (fd_state_machine::m_m_connected_stream_socket): New.
2811 (fd_state_machine::m_SOCK_STREAM): New.
2812 (fd_state_machine::m_SOCK_DGRAM): New.
2813 (fd_diagnostic::describe_state_change): Handle socket states.
2814 (fd_diagnostic::get_meaning_for_state_change): Likewise.
2815 (class fd_phase_mismatch): New.
2816 (enum expected_type): New enum.
2817 (class fd_type_mismatch): New.
2818 (fd_state_machine::fd_state_machine): Initialize new states and
2819 stashed named constants.
2820 (fd_state_machine::is_socket_fd_p): New.
2821 (fd_state_machine::is_datagram_socket_fd_p): New.
2822 (fd_state_machine::is_stream_socket_fd_p): New.
2823 (fd_state_machine::on_close): Handle the socket states.
2824 (fd_state_machine::check_for_open_fd): Complain about fncalls on
2825 sockets in the wrong phase. Support socket FDs.
2826 (add_constraint_ge_zero): New.
2827 (fd_state_machine::get_state_for_socket_type): New.
2828 (fd_state_machine::on_socket): New.
2829 (fd_state_machine::check_for_socket_fd): New.
2830 (fd_state_machine::check_for_new_socket_fd): New.
2831 (fd_state_machine::on_bind): New.
2832 (fd_state_machine::on_listen): New.
2833 (fd_state_machine::on_accept): New.
2834 (fd_state_machine::on_connect): New.
2835 (fd_state_machine::can_purge_p): Don't purge socket values.
2836 (get_fd_state): New.
2837 (region_model::mark_as_valid_fd): Use get_fd_state.
2838 (region_model::on_socket): New.
2839 (region_model::on_bind): New.
2840 (region_model::on_listen): New.
2841 (region_model::on_accept): New.
2842 (region_model::on_connect): New.
2843 * sm-fd.dot: Update to reflect sm-fd.cc changes.
2845 2022-11-15 David Malcolm <dmalcolm@redhat.com>
2847 PR analyzer/106302
2848 * analyzer-language.cc: New file.
2849 * analyzer-language.h: New file.
2850 * analyzer.h (get_stashed_constant_by_name): New decl.
2851 (log_stashed_constants): New decl.
2852 * engine.cc (impl_run_checkers): Call log_stashed_constants.
2853 * region-model-impl-calls.cc
2854 (region_model::impl_call_analyzer_dump_named_constant): New.
2855 * region-model.cc (region_model::on_stmt_pre): Handle
2856 __analyzer_dump_named_constant.
2857 * region-model.h
2858 (region_model::impl_call_analyzer_dump_named_constant): New decl.
2859 * sm-fd.cc (fd_state_machine::m_O_ACCMODE): New.
2860 (fd_state_machine::m_O_RDONLY): New.
2861 (fd_state_machine::m_O_WRONLY): New.
2862 (fd_state_machine::fd_state_machine): Initialize the new fields.
2863 (fd_state_machine::get_access_mode_from_flag): Use the new fields,
2864 rather than using the host values.
2866 2022-11-13 David Malcolm <dmalcolm@redhat.com>
2868 PR analyzer/106235
2869 * analyzer.opt (Wanalyzer-tainted-assertion): New.
2870 * checker-path.cc (checker_path::fixup_locations): Pass false to
2871 pending_diagnostic::fixup_location.
2872 * diagnostic-manager.cc (get_emission_location): Pass true to
2873 pending_diagnostic::fixup_location.
2874 * pending-diagnostic.cc (pending_diagnostic::fixup_location): Add
2875 bool param.
2876 * pending-diagnostic.h (pending_diagnostic::fixup_location): Add
2877 bool param to decl.
2878 * sm-taint.cc (taint_state_machine::m_tainted_control_flow): New.
2879 (taint_diagnostic::describe_state_change): Drop "final".
2880 (class tainted_assertion): New.
2881 (taint_state_machine::taint_state_machine): Initialize
2882 m_tainted_control_flow.
2883 (taint_state_machine::alt_get_inherited_state): Support
2884 comparisons being tainted, based on their arguments.
2885 (is_assertion_failure_handler_p): New.
2886 (taint_state_machine::on_stmt): Complain about calls to assertion
2887 failure handlers guarded by an attacker-controller conditional.
2888 Detect attacker-controlled gcond conditionals and gswitch index
2889 values.
2890 (taint_state_machine::check_control_flow_arg_for_taint): New.
2892 2022-11-11 David Malcolm <dmalcolm@redhat.com>
2894 * sm-fd.dot: Fix typo in comment.
2895 * sm-file.dot: New file.
2896 * varargs.cc: Fix typo in comment.
2897 * varargs.dot: New file.
2899 2022-11-11 David Malcolm <dmalcolm@redhat.com>
2901 * checker-path.h: Split out checker_event and its subclasses to...
2902 * checker-event.h: ...this new header.
2904 2022-11-11 David Malcolm <dmalcolm@redhat.com>
2906 PR analyzer/106147
2907 * analyzer.opt (Wanalyzer-infinite-recursion): New.
2908 * call-string.cc (call_string::count_occurrences_of_function):
2909 New.
2910 * call-string.h (call_string::count_occurrences_of_function): New
2911 decl.
2912 * checker-path.cc (function_entry_event::function_entry_event):
2913 New ctor.
2914 (checker_path::add_final_event): Delete.
2915 * checker-path.h (function_entry_event::function_entry_event): New
2916 ctor.
2917 (function_entry_event::get_desc): Drop "final".
2918 (checker_path::add_final_event): Delete.
2919 * diagnostic-manager.cc
2920 (diagnostic_manager::emit_saved_diagnostic): Create the final
2921 event via a new pending_diagnostic::add_final_event vfunc, rather
2922 than checker_path::add_final_event.
2923 (diagnostic_manager::add_events_for_eedge): Create function entry
2924 events via a new pending_diagnostic::add_function_entry_event
2925 vfunc.
2926 * engine.cc (exploded_graph::process_node): When creating a new
2927 PK_BEFORE_SUPERNODE node, call
2928 exploded_graph::detect_infinite_recursion on it after adding the
2929 in-edge.
2930 * exploded-graph.h (exploded_graph::detect_infinite_recursion):
2931 New decl.
2932 (exploded_graph::find_previous_entry_to): New decl.
2933 * infinite-recursion.cc: New file.
2934 * pending-diagnostic.cc
2935 (pending_diagnostic::add_function_entry_event): New.
2936 (pending_diagnostic::add_final_event): New.
2937 * pending-diagnostic.h
2938 (pending_diagnostic::add_function_entry_event): New vfunc.
2939 (pending_diagnostic::add_final_event): New vfunc.
2941 2022-11-10 David Malcolm <dmalcolm@redhat.com>
2943 PR analyzer/99671
2944 * analyzer.opt (Wanalyzer-deref-before-check): New warning.
2945 * diagnostic-manager.cc
2946 (null_assignment_sm_context::set_next_state): Only add state
2947 change events for transition to "null" state.
2948 (null_assignment_sm_context::is_transition_to_null): New.
2949 * engine.cc (impl_region_model_context::on_pop_frame): New.
2950 * exploded-graph.h (impl_region_model_context::on_pop_frame): New
2951 decl.
2952 * program-state.cc (sm_state_map::clear_any_state): New.
2953 (sm_state_map::can_merge_with_p): New.
2954 (program_state::can_merge_with_p): Replace requirement that
2955 sm-states be equal in favor of an attempt to merge them.
2956 * program-state.h (sm_state_map::clear_any_state): New decl.
2957 (sm_state_map::can_merge_with_p): New decl.
2958 * region-model.cc (region_model::eval_condition): Make const.
2959 (region_model::pop_frame): Call ctxt->on_pop_frame.
2960 * region-model.h (region_model::eval_condition): Make const.
2961 (region_model_context::on_pop_frame): New vfunc.
2962 (noop_region_model_context::on_pop_frame): New.
2963 (region_model_context_decorator::on_pop_frame): New.
2964 * sm-malloc.cc (enum resource_state): Add RS_ASSUMED_NON_NULL.
2965 (allocation_state::dump_to_pp): Drop "final".
2966 (struct assumed_non_null_state): New subclass.
2967 (malloc_state_machine::m_assumed_non_null): New.
2968 (assumed_non_null_p): New.
2969 (class deref_before_check): New.
2970 (assumed_non_null_state::dump_to_pp): New.
2971 (malloc_state_machine::get_or_create_assumed_non_null_state_for_frame):
2972 New.
2973 (malloc_state_machine::maybe_assume_non_null): New.
2974 (malloc_state_machine::on_stmt): Transition from start state to
2975 "assumed-non-null" state for pointers passed to
2976 __attribute__((nonnull)) arguments, and for pointers explicitly
2977 dereferenced. Call maybe_complain_about_deref_before_check for
2978 pointers explicitly compared against NULL.
2979 (malloc_state_machine::maybe_complain_about_deref_before_check):
2980 New.
2981 (malloc_state_machine::on_deallocator_call): Also transition
2982 "assumed-non-null" states to "freed".
2983 (malloc_state_machine::on_pop_frame): New.
2984 (malloc_state_machine::maybe_get_merged_states_nonequal): New.
2985 * sm-malloc.dot: Update for changes to sm-malloc.cc.
2986 * sm.h (state_machine::on_pop_frame): New.
2987 (state_machine::maybe_get_merged_state): New.
2988 (state_machine::maybe_get_merged_states_nonequal): New.
2990 2022-11-09 David Malcolm <dmalcolm@redhat.com>
2992 * checker-path.cc (checker_event::debug): New.
2993 (checker_path::add_event): Move here from checker-path.h. Add
2994 logging.
2995 * checker-path.h (checker_event::debug): New decl.
2996 (checker_path::checker_path): Add logger param.
2997 (checker_path::add_event): Move definition from here to
2998 checker-path.cc.
2999 (checker_path::m_logger): New field.
3000 * diagnostic-manager.cc
3001 (diagnostic_manager::emit_saved_diagnostic): Pass logger to
3002 checker_path ctor.
3003 (diagnostic_manager::add_events_for_eedge): Log scope when
3004 processing a run of stmts.
3006 2022-11-08 David Malcolm <dmalcolm@redhat.com>
3008 PR analyzer/101962
3009 * region-model-impl-calls.cc: Update comment.
3010 * region-model.cc (region_model::check_symbolic_bounds): Fix
3011 layout of "void" return. Replace usage of
3012 eval_condition_without_cm with eval_condition.
3013 (region_model::eval_condition): Take over body of...
3014 (region_model::eval_condition_without_cm): ...this subroutine,
3015 dropping the latter. Eliminating this distinction avoids issues
3016 where constraints were not considered when recursing.
3017 (region_model::compare_initial_and_pointer): Update comment.
3018 (region_model::symbolic_greater_than): Replace usage of
3019 eval_condition_without_cm with eval_condition.
3020 * region-model.h
3021 (region_model::eval_condition_without_cm): Delete decl.
3023 2022-11-08 David Malcolm <dmalcolm@redhat.com>
3025 * region-model-impl-calls.cc
3026 (region_model::impl_call_errno_location): New.
3027 * region-model-manager.cc
3028 (region_model_manager::region_model_manager): Initialize
3029 m_thread_local_region and m_errno_region.
3030 * region-model-manager.h (region_model_manager::get_errno_region):
3031 New accessor.
3032 (region_model_manager::m_thread_local_region): New.
3033 (region_model_manager::m_errno_region): New.
3034 * region-model.cc (region_model::on_call_pre): Special-case
3035 "__errno_location".
3036 (region_model::set_errno): New.
3037 * region-model.h (impl_call_errno_location): New decl.
3038 (region_model::set_errno): New decl.
3039 * region.cc (thread_local_region::dump_to_pp): New.
3040 (errno_region::dump_to_pp): New.
3041 * region.h (enum memory_space): Add MEMSPACE_THREAD_LOCAL.
3042 (enum region_kind): Add RK_THREAD_LOCAL and RK_ERRNO.
3043 (class thread_local_region): New.
3044 (is_a_helper <const thread_local_region *>::test): New.
3045 (class errno_region): New.
3046 (is_a_helper <const errno_region *>::test): New.
3047 * store.cc (binding_cluster::escaped_p): New.
3048 (store::escaped_p): Treat errno as always having escaped.
3049 (store::replay_call_summary_cluster): Handle RK_THREAD_LOCAL and
3050 RK_ERRNO.
3051 * store.h (binding_cluster::escaped_p): Remove definition.
3053 2022-11-08 David Malcolm <dmalcolm@redhat.com>
3055 * call-info.cc (success_call_info::get_desc): Delete.
3056 (failed_call_info::get_desc): Likewise.
3057 (succeed_or_fail_call_info::get_desc): New.
3058 * call-info.h (class succeed_or_fail_call_info): New.
3059 (class success_call_info): Convert to a subclass of
3060 succeed_or_fail_call_info.
3061 (class failed_call_info): Likewise.
3063 2022-11-08 David Malcolm <dmalcolm@redhat.com>
3065 * region-model-impl-calls.cc (region_model::impl_call_strchr):
3066 Move to on_call_post. Handle both outcomes using bifurcation,
3067 rather than just the "not found" case.
3068 * region-model.cc (region_model::on_call_pre): Move
3069 BUILT_IN_STRCHR and "strchr" to...
3070 (region_model::on_call_post): ...here.
3072 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3074 * analyzer.h: Use std::unique_ptr for state machines from plugins.
3075 * engine.cc: Likewise.
3077 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3079 * analyzer.h: Use std::unique_ptr for known functions.
3080 * engine.cc: Likewise.
3081 * known-function-manager.cc: Likewise.
3082 * known-function-manager.h: Likewise.
3084 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3086 * analysis-plan.cc: Define INCLUDE_MEMORY before including
3087 system.h.
3088 * analyzer-pass.cc: Likewise.
3089 * analyzer-selftests.cc: Likewise.
3090 * analyzer.cc: Likewise.
3091 * analyzer.h: Use std::unique_ptr in bifurcation code.
3092 * call-string.cc: Define INCLUDE_MEMORY before including system.h.
3093 * complexity.cc: Likewise.
3094 * engine.cc: Use std::unique_ptr in bifurcation code.
3095 * exploded-graph.h: Likewise.
3096 * known-function-manager.cc: Define INCLUDE_MEMORY before
3097 including system.h.
3098 * region-model-impl-calls.cc: Use std::unique_ptr in bifurcation
3099 code.
3100 * region-model.cc: Likewise.
3101 * region-model.h: Likewise.
3102 * supergraph.cc: Define INCLUDE_MEMORY before including system.h.
3104 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3106 * call-info.cc: Use std::unique_ptr for checker_event.
3107 * checker-path.cc: Likewise.
3108 * checker-path.h: Likewise.
3109 * diagnostic-manager.cc: Likewise.
3110 * engine.cc: Likewise.
3111 * pending-diagnostic.cc: Likewise.
3112 * sm-signal.cc: Likewise.
3113 * varargs.cc: Likewise.
3115 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3117 * diagnostic-manager.cc: Include "make-unique.h".
3118 Use std::unique_ptr for feasibility_problems and exploded_path.
3119 Delete explicit saved_diagnostic dtor.
3120 * diagnostic-manager.h: Likewise.
3121 * engine.cc: Likewise.
3122 * exploded-graph.h: Likewise.
3123 * feasible-graph.cc: Likewise.
3124 * feasible-graph.h: Likewise.
3126 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3128 * checker-path.cc (rewind_event::rewind_event): Update for usage of
3129 std::unique_ptr on custom_edge_info.
3130 * engine.cc (exploded_node::on_longjmp): Likewise.
3131 (exploded_edge::exploded_edge): Likewise.
3132 (exploded_edge::~exploded_edge): Delete.
3133 (exploded_graph::add_function_entry): Update for usage of
3134 std::unique_ptr on custom_edge_info.
3135 (exploded_graph::add_edge): Likewise.
3136 (add_tainted_args_callback): Likewise.
3137 (exploded_graph::maybe_create_dynamic_call): Likewise.
3138 (exploded_graph::process_node): Likewise.
3139 * exploded-graph.h (exploded_edge::~exploded_edge): Delete.
3140 (exploded_edge::m_custom_info): Use std::unique_ptr.
3141 (exploded_edge::add_edge): Likewise.
3142 * sm-signal.cc (register_signal_handler::impl_transition): Use
3143 make_unique.
3145 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3147 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic): Make
3148 stmt_finder const.
3149 (saved_diagnostic::~saved_diagnostic): Remove explicit delete of
3150 m_stmt_finder.
3151 (diagnostic_manager::add_diagnostic): Make stmt_finder const.
3152 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic):
3153 Likewise.
3154 (saved_diagnostic::m_stmt_finder): Convert to std::unique_ptr.
3155 (diagnostic_manager::add_diagnostic): Make stmt_finder const.
3156 * engine.cc (impl_sm_context::impl_sm_context): Likewise.
3157 (impl_sm_context::m_stmt_finder): Likewise.
3158 (leak_stmt_finder::clone): Convert return type to std::unique_ptr.
3159 * exploded-graph.h (stmt_finder::clone): Likewise.
3161 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3163 * call-info.cc: Add define of INCLUDE_MEMORY.
3164 * call-summary.cc: Likewise.
3165 * checker-path.cc: Likewise.
3166 * constraint-manager.cc: Likewise.
3167 * diagnostic-manager.cc: Likewise.
3168 (saved_diagnostic::saved_diagnostic): Use std::unique_ptr for
3169 param d and field m_d.
3170 (saved_diagnostic::~saved_diagnostic): Remove explicit delete of m_d.
3171 (saved_diagnostic::add_note): Use std::unique_ptr for
3172 param pn.
3173 (saved_diagnostic::get_pending_diagnostic): Update for conversion
3174 of m_sd.m_d to unique_ptr.
3175 (diagnostic_manager::add_diagnostic): Use std::unique_ptr for
3176 param d. Remove explicit deletion.
3177 (diagnostic_manager::add_note): Use std::unique_ptr for param pn.
3178 (diagnostic_manager::emit_saved_diagnostic): Update for conversion
3179 of m_sd.m_d to unique_ptr.
3180 (null_assignment_sm_context::warn): Use std::unique_ptr for
3181 param d. Remove explicit deletion.
3182 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Use
3183 std::unique_ptr for param d.
3184 (saved_diagnostic::add_note): Likewise for param pn.
3185 (saved_diagnostic::m_d): Likewise.
3186 (diagnostic_manager::add_diagnostic): Use std::unique_ptr for
3187 param d.
3188 (diagnostic_manager::add_note): Use std::unique_ptr for param pn.
3189 * engine.cc: Include "make-unique.h".
3190 (impl_region_model_context::warn): Update to use std::unique_ptr
3191 for param, removing explicit deletion.
3192 (impl_region_model_context::add_note): Likewise.
3193 (impl_sm_context::warn): Update to use std::unique_ptr
3194 for param.
3195 (impl_region_model_context::on_state_leak): Likewise for result of
3196 on_leak.
3197 (exploded_node::on_longjmp): Use make_unique when creating
3198 pending_diagnostic.
3199 (exploded_graph::process_node): Likewise.
3200 * exploded-graph.h (impl_region_model_context::warn): Update to
3201 use std::unique_ptr for param.
3202 (impl_region_model_context::add_note): Likewise.
3203 * feasible-graph.cc: Add define of INCLUDE_MEMORY.
3204 * pending-diagnostic.cc: Likewise.
3205 * pending-diagnostic.h: Include analyzer.sm.h"
3206 * program-point.cc: Add define of INCLUDE_MEMORY.
3207 * program-state.cc: Likewise.
3208 * region-model-asm.cc: Likewise.
3209 * region-model-impl-calls.cc: Likewise. Include "make-unique.h".
3210 (region_model::impl_call_putenv): Use make_unique when creating
3211 pending_diagnostic.
3212 * region-model-manager.cc: Add define of INCLUDE_MEMORY.
3213 * region-model-reachability.cc: Likewise.
3214 * region-model.cc: Likewise. Include "make-unique.h".
3215 (region_model::get_gassign_result): Use make_unique when creating
3216 pending_diagnostic.
3217 (region_model::check_for_poison): Likewise.
3218 (region_model::on_stmt_pre): Likewise.
3219 (region_model::check_symbolic_bounds): Likewise.
3220 (region_model::check_region_bounds): Likewise.
3221 (annotating_ctxt: make_note): Use std::unique_ptr for result.
3222 (region_model::deref_rvalue): Use make_unique when creating
3223 pending_diagnostic.
3224 (region_model::check_for_writable_region): Likewise.
3225 (region_model::check_region_size): Likewise.
3226 (region_model::check_dynamic_size_for_floats): Likewise.
3227 (region_model::maybe_complain_about_infoleak): Likewise.
3228 (noop_region_model_context::add_note): Use std::unique_ptr for
3229 param. Remove explicit deletion.
3230 * region-model.h: Include "analyzer/pending-diagnostic.h".
3231 (region_model_context::warn): Convert param to std::unique_ptr.
3232 (region_model_context::add_note): Likewise.
3233 (noop_region_model_context::warn): Likewise.
3234 (noop_region_model_context::add_note): Likewise.
3235 (region_model_context_decorator::warn): Likewise.
3236 (region_model_context_decorator::add_note): Likewise.
3237 (note_adding_context::warn): Likewise.
3238 (note_adding_context::make_note): Likewise for return type.
3239 (test_region_model_context::warn): Convert param to
3240 std::unique_ptr.
3241 * region.cc: Add define of INCLUDE_MEMORY.
3242 * sm-fd.cc: Likewise. Include "make-unique.h".
3243 (fd_state_machine::check_for_fd_attrs): Use make_unique when
3244 creating pending_diagnostics.
3245 (fd_state_machine::on_open): Likewise.
3246 (fd_state_machine::on_creat): Likewise.
3247 (fd_state_machine::check_for_dup): Likewise.
3248 (fd_state_machine::on_close): Likewise.
3249 (fd_state_machine::check_for_open_fd): Likewise.
3250 (fd_state_machine::on_leak): Likewise, converting return type to
3251 std::unique_ptr.
3252 * sm-file.cc: Add define of INCLUDE_MEMORY. Include
3253 "make-unique.h".
3254 (fileptr_state_machine::on_stmt): Use make_unique when creating
3255 pending_diagnostic.
3256 (fileptr_state_machine::on_leak): Likewise, converting return type
3257 to std::unique_ptr.
3258 * sm-malloc.cc: Add define of INCLUDE_MEMORY. Include
3259 "make-unique.h".
3260 (malloc_state_machine::on_stmt): Use make_unique when creating
3261 pending_diagnostic.
3262 (malloc_state_machine::handle_free_of_non_heap): Likewise.
3263 (malloc_state_machine::on_deallocator_call): Likewise.
3264 (malloc_state_machine::on_realloc_call): Likewise.
3265 (malloc_state_machine::on_leak): Likewise, converting return type
3266 to std::unique_ptr.
3267 * sm-pattern-test.cc: Add define of INCLUDE_MEMORY. Include
3268 "make-unique.h".
3269 (pattern_test_state_machine::on_condition): Use make_unique when
3270 creating pending_diagnostic.
3271 * sm-sensitive.cc: Add define of INCLUDE_MEMORY. Include
3272 "make-unique.h".
3273 (sensitive_state_machine::warn_for_any_exposure): Use make_unique
3274 when creating pending_diagnostic.
3275 * sm-signal.cc: Add define of INCLUDE_MEMORY. Include
3276 "make-unique.h".
3277 (signal_state_machine::on_stmt): Use make_unique when creating
3278 pending_diagnostic.
3279 * sm-taint.cc: Add define of INCLUDE_MEMORY. Include
3280 "make-unique.h".
3281 (taint_state_machine::check_for_tainted_size_arg): Use make_unique
3282 when creating pending_diagnostic.
3283 (taint_state_machine::check_for_tainted_divisor): Likewise.
3284 (region_model::check_region_for_taint): Likewise.
3285 (region_model::check_dynamic_size_for_taint): Likewise.
3286 * sm.cc: Add define of INCLUDE_MEMORY. Include
3287 "analyzer/pending-diagnostic.h".
3288 (state_machine::on_leak): Move here from sm.h, changing return
3289 type to std::unique_ptr.
3290 * sm.h (state_machine::on_leak): Change return type to
3291 std::unique_ptr. Move defn of base impl to sm.cc
3292 (sm_context::warn): Convert param d to std_unique_ptr.
3293 * state-purge.cc: Add define of INCLUDE_MEMORY.
3294 * store.cc: Likewise.
3295 * svalue.cc: Likewise.
3296 * trimmed-graph.cc: Likewise.
3297 * varargs.cc: Likewise. Include "make-unique.h".
3298 (va_list_state_machine::check_for_ended_va_list): Use make_unique
3299 when creating pending_diagnostic.
3300 (va_list_state_machine::on_leak): Likewise, converting return type
3301 to std::unique_ptr.
3302 (region_model::impl_call_va_arg): Use make_unique when creating
3303 pending_diagnostic.
3305 2022-11-03 David Malcolm <dmalcolm@redhat.com>
3307 PR analyzer/107486
3308 * analyzer.cc (is_pipe_call_p): New.
3309 * analyzer.h (is_pipe_call_p): New decl.
3310 * region-model.cc (region_model::on_call_pre): Use it.
3311 (region_model::on_call_post): Likewise.
3313 2022-10-26 David Malcolm <dmalcolm@redhat.com>
3315 * sm-fd.cc (fd_state_machine::on_open): Transition to "unchecked"
3316 when the mode is symbolic, rather than just on integer constants.
3317 (fd_state_machine::check_for_open_fd): Don't complain about
3318 unchecked values in the start state.
3320 2022-10-26 David Malcolm <dmalcolm@redhat.com>
3322 * sm-fd.dot: New file.
3324 2022-10-24 David Malcolm <dmalcolm@redhat.com>
3326 PR analyzer/107349
3327 * varargs.cc (get_va_copy_arg): Fix the non-pointer case.
3329 2022-10-24 David Malcolm <dmalcolm@redhat.com>
3331 PR analyzer/107345
3332 * region-model.cc (region_model::eval_condition_without_cm):
3333 Ensure that constants are on the right-hand side before checking
3334 for them.
3336 2022-10-24 David Malcolm <dmalcolm@redhat.com>
3338 * engine.cc (impl_region_model_context::get_malloc_map): Replace
3339 with...
3340 (impl_region_model_context::get_state_map_by_name): ...this.
3341 (impl_region_model_context::get_fd_map): Delete.
3342 (impl_region_model_context::get_taint_map): Delete.
3343 * exploded-graph.h (impl_region_model_context::get_fd_map):
3344 Delete.
3345 (impl_region_model_context::get_malloc_map): Delete.
3346 (impl_region_model_context::get_taint_map): Delete.
3347 (impl_region_model_context::get_state_map_by_name): New.
3348 * region-model.h (region_model_context::get_state_map_by_name):
3349 New vfunc.
3350 (region_model_context::get_fd_map): Convert from vfunc to
3351 function.
3352 (region_model_context::get_malloc_map): Likewise.
3353 (region_model_context::get_taint_map): Likewise.
3354 (noop_region_model_context::get_state_map_by_name): New.
3355 (noop_region_model_context::get_fd_map): Delete.
3356 (noop_region_model_context::get_malloc_map): Delete.
3357 (noop_region_model_context::get_taint_map): Delete.
3358 (region_model_context_decorator::get_state_map_by_name): New.
3359 (region_model_context_decorator::get_fd_map): Delete.
3360 (region_model_context_decorator::get_malloc_map): Delete.
3361 (region_model_context_decorator::get_taint_map): Delete.
3363 2022-10-24 David Malcolm <dmalcolm@redhat.com>
3365 PR analyzer/106300
3366 * engine.cc (impl_region_model_context::get_fd_map): New.
3367 * exploded-graph.h (impl_region_model_context::get_fd_map): New
3368 decl.
3369 * region-model-impl-calls.cc (region_model::impl_call_pipe): New.
3370 * region-model.cc (region_model::update_for_int_cst_return): New,
3371 based on...
3372 (region_model::update_for_zero_return): ...this. Reimplement in
3373 terms of the former.
3374 (region_model::on_call_pre): Handle "pipe" and "pipe2".
3375 (region_model::on_call_post): Likewise.
3376 * region-model.h (region_model::impl_call_pipe): New decl.
3377 (region_model::update_for_int_cst_return): New decl.
3378 (region_model::mark_as_valid_fd): New decl.
3379 (region_model_context::get_fd_map): New pure virtual fn.
3380 (noop_region_model_context::get_fd_map): New.
3381 (region_model_context_decorator::get_fd_map): New.
3382 * sm-fd.cc: Include "analyzer/program-state.h".
3383 (fd_state_machine::describe_state_change): Handle transitions from
3384 start state to valid states.
3385 (fd_state_machine::mark_as_valid_fd): New.
3386 (fd_state_machine::on_stmt): Add missing return for "creat".
3387 (region_model::mark_as_valid_fd): New.
3389 2022-10-19 David Malcolm <dmalcolm@redhat.com>
3391 PR analyzer/105765
3392 * varargs.cc (get_BT_VALIST_ARG): Rename to...
3393 (get_va_copy_arg): ...this, and update logic for determining level
3394 of indirection of va_copy's argument to use type of argument,
3395 rather than looking at va_list_type_node, to correctly handle
3396 __builtin_ms_va_copy.
3397 (get_stateful_BT_VALIST_ARG): Rename to...
3398 (get_stateful_va_copy_arg): ...this.
3399 (va_list_state_machine::on_va_copy): Update for renaming.
3400 (region_model::impl_call_va_copy): Likewise.
3402 2022-10-13 David Malcolm <dmalcolm@redhat.com>
3404 PR analyzer/107210
3405 * svalue.cc (constant_svalue::maybe_fold_bits_within): Only
3406 attempt to extract individual bits when tree_fits_uhwi_p.
3408 2022-10-07 David Malcolm <dmalcolm@redhat.com>
3410 PR analyzer/105783
3411 * region-model.cc (selftest::get_bit): New function.
3412 (selftest::test_bits_within_svalue_folding): New.
3413 (selfftest::analyzer_region_model_cc_tests): Call it.
3414 * svalue.cc (constant_svalue::maybe_fold_bits_within): Handle the
3415 case of extracting a single bit.
3417 2022-10-06 David Malcolm <dmalcolm@redhat.com>
3419 PR analyzer/107158
3420 * store.cc (store::replay_call_summary_cluster): Eliminate
3421 special-casing of RK_HEAP_ALLOCATED in favor of sharing code with
3422 RK_DECL, avoiding an ICE due to attempting to bind a
3423 compound_svalue into a binding_cluster when an svalue in the
3424 summary cluster converts to a compound_svalue in the caller.
3426 2022-10-06 David Malcolm <dmalcolm@redhat.com>
3428 * call-summary.cc (call_summary_replay::dump_to_pp): Bulletproof
3429 against NULL caller regions/svalues.
3431 2022-10-05 David Malcolm <dmalcolm@redhat.com>
3433 * analysis-plan.cc: Simplify includes.
3434 * analyzer-pass.cc: Likewise.
3435 * analyzer-selftests.cc: Likewise.
3436 * analyzer.cc: Likewise.
3437 * analyzer.h: Add includes of "json.h" and "tristate.h".
3438 * call-info.cc: Simplify includes.
3439 * call-string.cc: Likewise.
3440 * call-summary.cc: Likewise.
3441 * checker-path.cc: Likewise.
3442 * complexity.cc: Likewise.
3443 * constraint-manager.cc: Likewise.
3444 * diagnostic-manager.cc: Likewise.
3445 * engine.cc: Likewise.
3446 * feasible-graph.cc: Likewise.
3447 * known-function-manager.cc: Likewise.
3448 * pending-diagnostic.cc: Likewise.
3449 * program-point.cc: Likewise.
3450 * program-state.cc: Likewise.
3451 * region-model-asm.cc: Likewise.
3452 * region-model-impl-calls.cc: Likewise.
3453 * region-model-manager.cc: Likewise.
3454 * region-model-reachability.cc: Likewise.
3455 * region-model.cc: Likewise.
3456 * region-model.h: Include "selftest.h".
3457 * region.cc: Simplify includes.
3458 * sm-fd.cc: Likewise.
3459 * sm-file.cc: Likewise.
3460 * sm-malloc.cc: Likewise.
3461 * sm-pattern-test.cc: Likewise.
3462 * sm-sensitive.cc: Likewise.
3463 * sm-signal.cc: Likewise.
3464 * sm-taint.cc: Likewise.
3465 * sm.cc: Likewise.
3466 * state-purge.cc: Likewise.
3467 * store.cc: Likewise.
3468 * store.h: Likewise.
3469 * supergraph.cc: Likewise.
3470 * svalue.cc: Likewise.
3471 * svalue.h: Likewise.
3472 * trimmed-graph.cc: Likewise.
3473 * varargs.cc: Likewise.
3475 2022-10-05 David Malcolm <dmalcolm@redhat.com>
3477 PR analyzer/107060
3478 * call-summary.cc
3479 (call_summary_replay::convert_svalue_from_summary_1): Handle NULL
3480 results from convert_svalue_from_summary in SK_UNARY_OP and
3481 SK_BIN_OP.
3482 * engine.cc (impl_region_model_context::on_unknown_change): Bail
3483 out on svalues that can't have associated state.
3484 * region-model-impl-calls.cc
3485 (region_model::impl_call_analyzer_get_unknown_ptr): New.
3486 * region-model.cc (region_model::on_stmt_pre): Handle
3487 "__analyzer_get_unknown_ptr".
3488 * region-model.h
3489 (region_model::impl_call_analyzer_get_unknown_ptr): New decl.
3490 * store.cc (store::replay_call_summary_cluster): Avoid trying to
3491 create binding clusters for base regions that shouldn't have them.
3493 2022-10-05 Martin Liska <mliska@suse.cz>
3495 * call-summary.cc (call_summary_replay::call_summary_replay):
3496 Remove unused variable and arguments.
3497 * call-summary.h: Likewise.
3498 * engine.cc (exploded_node::on_stmt): Likewise.
3499 (exploded_node::replay_call_summaries): Likewise.
3500 (exploded_node::replay_call_summary): Likewise.
3501 * exploded-graph.h (class exploded_node): Likewise.
3503 2022-10-05 David Malcolm <dmalcolm@redhat.com>
3505 PR analyzer/107072
3506 * analyzer-logging.h: Include "diagnostic-core.h".
3507 * analyzer.h: Include "function.h".
3508 (class call_summary): New forward decl.
3509 (class call_summary_replay): New forward decl.
3510 (struct per_function_data): New forward decl.
3511 (struct interesting_t): New forward decl.
3512 (custom_edge_info::update_state): New vfunc.
3513 * call-info.cc (custom_edge_info::update_state): New.
3514 * call-summary.cc: New file.
3515 * call-summary.h: New file.
3516 * constraint-manager.cc: Include "analyzer/call-summary.h".
3517 (class replay_fact_visitor): New.
3518 (constraint_manager::replay_call_summary): New.
3519 * constraint-manager.h (constraint_manager::replay_call_summary):
3520 New.
3521 * engine.cc: Include "analyzer/call-summary.h".
3522 (exploded_node::on_stmt): Handle call summaries.
3523 (class call_summary_edge_info): New.
3524 (exploded_node::replay_call_summaries): New.
3525 (exploded_node::replay_call_summary): New.
3526 (per_function_data::~per_function_data): New.
3527 (per_function_data::add_call_summary): Move here from header and
3528 reimplement.
3529 (exploded_graph::process_node): Call update_state rather than
3530 update_model when handling bifurcation
3531 (viz_callgraph_node::dump_dot): Use a regular label rather
3532 than an HTML table; add summaries to dump.
3533 * exploded-graph.h: Include "alloc-pool.h", "fibonacci_heap.h",
3534 "supergraph.h", "sbitmap.h", "shortest-paths.h", "analyzer/sm.h",
3535 "analyzer/program-state.h", and "analyzer/diagnostic-manager.h".
3536 (exploded_node::replay_call_summaries): New decl.
3537 (exploded_node::replay_call_summary): New decl.
3538 (per_function_data::~per_function_data): New decl.
3539 (per_function_data::add_call_summary): Move implemention from
3540 header.
3541 (per_function_data::m_summaries): Update type of element.
3542 * known-function-manager.h: Include "analyzer/analyzer-logging.h".
3543 * program-point.h: Include "pretty-print.h" and
3544 "analyzer/call-string.h".
3545 * program-state.cc: Include "analyzer/call-summary.h".
3546 (sm_state_map::replay_call_summary): New.
3547 (program_state::replay_call_summary): New.
3548 * program-state.h (sm_state_map::replay_call_summary): New decl.
3549 (program_state::replay_call_summary): New decl.
3550 * region-model-manager.cc
3551 (region_model_manager::get_or_create_asm_output_svalue): New
3552 overload.
3553 * region-model-manager.h
3554 (region_model_manager::get_or_create_asm_output_svalue): New
3555 overload decl.
3556 * region-model.cc: Include "analyzer/call-summary.h".
3557 (region_model::maybe_update_for_edge): Remove call to
3558 region_model::update_for_call_summary on
3559 SUPEREDGE_INTRAPROCEDURAL_CALL.
3560 (region_model::update_for_call_summary): Delete.
3561 (region_model::replay_call_summary): New.
3562 * region-model.h (region_model::replay_call_summary): New decl.
3563 (region_model::update_for_call_summary): Delete decl.
3564 * store.cc: Include "analyzer/call-summary.h".
3565 (store::replay_call_summary): New.
3566 (store::replay_call_summary_cluster): New.
3567 * store.h: Include "tristate.h".
3568 (is_a_helper <const ana::concrete_binding *>::test): New.
3569 (store::replay_call_summary): New decl.
3570 (store::replay_call_summary_cluster): New decl.
3571 * supergraph.cc (get_ultimate_function_for_cgraph_edge): Remove
3572 "static" from decl.
3573 (supergraph_call_edge): Make stmt param const.
3574 * supergraph.h: Include "ordered-hash-map.h", "cfg.h",
3575 "basic-block.h", "gimple.h", "gimple-iterator.h", and "digraph.h".
3576 (supergraph_call_edge): Make stmt param const.
3577 (get_ultimate_function_for_cgraph_edge): New decl.
3578 * svalue.cc (compound_svalue::compound_svalue): Assert that we're
3579 not nesting compound_svalues.
3580 * svalue.h: Include "json.h", "analyzer/store.h", and
3581 "analyzer/program-point.h".
3582 (asm_output_svalue::get_num_outputs): New accessor.
3584 2022-10-05 David Malcolm <dmalcolm@redhat.com>
3586 * region-model.h: Include "analyzer/region-model-manager.h"
3587 (class region_model_manager): Move decl to...
3588 * region-model-manager.h: ...this new file.
3590 2022-10-05 David Malcolm <dmalcolm@redhat.com>
3592 * region-model-manager.cc
3593 (region_model_manager::maybe_fold_unaryop): Fold -(-(VAL)) to VAL.
3595 2022-10-05 David Malcolm <dmalcolm@redhat.com>
3597 * region-model-manager.cc
3598 (region_model_manager::get_or_create_widening_svalue): Use a
3599 function_point rather than a program_point.
3600 * region-model.cc (selftest::test_widening_constraints): Likewise.
3601 * region-model.h
3602 (region_model_manager::get_or_create_widening_svalue): Likewise.
3603 (model_merger::get_function_point): New.
3604 * svalue.cc (svalue::can_merge_p): Use a function_point rather
3605 than a program_point.
3606 (svalue::can_merge_p): Likewise.
3607 * svalue.h (widening_svalue::key_t): Likewise.
3608 (widening_svalue::widening_svalue): Likewise.
3610 2022-09-12 Martin Liska <mliska@suse.cz>
3612 * region-model.cc (region_model::maybe_complain_about_infoleak):
3613 Remove unused fields.
3615 2022-09-11 Tim Lange <mail@tim-lange.me>
3617 PR analyzer/106845
3618 * region-model.cc (region_model::check_region_bounds):
3619 Bail out if 0 bytes were accessed.
3620 * store.cc (byte_range::dump_to_pp):
3621 Add special case for empty ranges.
3622 (byte_range::exceeds_p): Restrict to non-empty ranges.
3623 (byte_range::falls_short_of_p): Restrict to non-empty ranges.
3624 * store.h (bit_range::empty_p): New function.
3625 (bit_range::get_last_byte_offset): Restrict to non-empty ranges.
3626 (byte_range::empty_p): New function.
3627 (byte_range::get_last_byte_offset): Restrict to non-empty ranges.
3629 2022-09-09 David Malcolm <dmalcolm@redhat.com>
3631 * analyzer.opt (Wanalyzer-exposure-through-uninit-copy): New.
3632 * checker-path.cc (region_creation_event::region_creation_event):
3633 Add "capacity" and "kind" params.
3634 (region_creation_event::get_desc): Generalize to different kinds
3635 of event.
3636 (checker_path::add_region_creation_event): Convert to...
3637 (checker_path::add_region_creation_events): ...this.
3638 * checker-path.h (enum rce_kind): New.
3639 (region_creation_event::region_creation_event): Add "capacity" and
3640 "kind" params.
3641 (region_creation_event::m_capacity): New field.
3642 (region_creation_event::m_rce_kind): New field.
3643 (checker_path::add_region_creation_event): Convert to...
3644 (checker_path::add_region_creation_events): ...this.
3645 * diagnostic-manager.cc (diagnostic_manager::build_emission_path):
3646 Update for multiple region creation events.
3647 (diagnostic_manager::add_event_on_final_node): Likewise.
3648 (diagnostic_manager::add_events_for_eedge): Likewise.
3649 * region-model-impl-calls.cc (call_details::get_logger): New.
3650 * region-model.cc: Define INCLUDE_MEMORY before including
3651 "system.h". Include "gcc-rich-location.h".
3652 (class record_layout): New.
3653 (class exposure_through_uninit_copy): New.
3654 (contains_uninit_p): New.
3655 (region_model::maybe_complain_about_infoleak): New.
3656 * region-model.h (call_details::get_logger): New decl.
3657 (region_model::maybe_complain_about_infoleak): New decl.
3658 (region_model::mark_as_tainted): New decl.
3659 * sm-taint.cc (region_model::mark_as_tainted): New.
3661 2022-09-09 David Malcolm <dmalcolm@redhat.com>
3663 * analyzer.h (class known_function_manager): New forward decl.
3664 (class known_function): New.
3665 (plugin_analyzer_init_iface::register_known_function): New.
3666 * engine.cc: Include "analyzer/known-function-manager.h".
3667 (plugin_analyzer_init_impl::plugin_analyzer_init_impl): Add
3668 known_fn_mgr param.
3669 (plugin_analyzer_init_impl::register_state_machine): Add
3670 LOC_SCOPE.
3671 (plugin_analyzer_init_impl::register_known_function): New.
3672 (plugin_analyzer_init_impl::m_known_fn_mgr): New.
3673 (impl_run_checkers): Update plugin callback invocation to use
3674 eng's known_function_manager.
3675 * known-function-manager.cc: New file.
3676 * known-function-manager.h: New file.
3677 * region-model-manager.cc
3678 (region_model_manager::region_model_manager): Pass logger to
3679 m_known_fn_mgr's ctor.
3680 * region-model.cc (region_model::update_for_zero_return): New.
3681 (region_model::update_for_nonzero_return): New.
3682 (maybe_simplify_upper_bound): New.
3683 (region_model::maybe_get_copy_bounds): New.
3684 (region_model::get_known_function): New.
3685 (region_model::on_call_pre): Handle plugin-supplied known
3686 functions.
3687 * region-model.h: Include "analyzer/known-function-manager.h".
3688 (region_model_manager::get_known_function_manager): New.
3689 (region_model_manager::m_known_fn_mgr): New.
3690 (call_details::get_model): New accessor.
3691 (region_model::maybe_get_copy_bounds): New decl.
3692 (region_model::update_for_zero_return): New decl.
3693 (region_model::update_for_nonzero_return): New decl.
3694 (region_model::get_known_function): New decl.
3695 (region_model::get_known_function_manager): New.
3697 2022-09-08 Tim Lange <mail@tim-lange.me>
3699 PR analyzer/106625
3700 * analyzer.h (region_offset): Eliminate m_is_symbolic member.
3701 * region-model-impl-calls.cc (region_model::impl_call_realloc):
3702 Refine implementation to be more precise.
3703 * region-model.cc (class symbolic_past_the_end):
3704 Abstract diagnostic class to complain about accesses past the end
3705 with symbolic values.
3706 (class symbolic_buffer_overflow):
3707 Concrete diagnostic class to complain about buffer overflows with
3708 symbolic values.
3709 (class symbolic_buffer_overread):
3710 Concrete diagnostic class to complain about buffer overreads with
3711 symbolic values.
3712 (region_model::check_symbolic_bounds): New function.
3713 (maybe_get_integer_cst_tree): New helper function.
3714 (region_model::check_region_bounds):
3715 Add call to check_symbolic_bounds if offset is not concrete.
3716 (region_model::eval_condition_without_cm):
3717 Add support for EQ_EXPR and GT_EXPR with binaryop_svalues.
3718 (is_positive_svalue): New hleper function.
3719 (region_model::symbolic_greater_than):
3720 New function to handle GT_EXPR comparisons with symbolic values.
3721 (region_model::structural_equality): New function to compare
3722 whether two svalues are structured the same, i.e. evaluate to
3723 the same value.
3724 (test_struct): Reflect changes to region::calc_offset.
3725 (test_var): Likewise.
3726 (test_array_2): Likewise and add selftest with symbolic i.
3727 * region-model.h (class region_model): Add check_symbolic_bounds,
3728 symbolic_greater_than and structural_equality.
3729 * region.cc (region::get_offset):
3730 Reflect changes to region::calc_offset.
3731 (region::calc_offset):
3732 Compute the symbolic offset if the offset is not concrete.
3733 (region::get_relative_symbolic_offset): New function to return the
3734 symbolic offset in bytes relative to its parent.
3735 (field_region::get_relative_symbolic_offset): Likewise.
3736 (element_region::get_relative_symbolic_offset): Likewise.
3737 (offset_region::get_relative_symbolic_offset): Likewise.
3738 (bit_range_region::get_relative_symbolic_offset): Likewise.
3739 * region.h: Add get_relative_symbolic_offset.
3740 * store.cc (binding_key::make):
3741 Reflect changes to region::calc_offset.
3742 (binding_map::apply_ctor_val_to_range): Likewise.
3743 (binding_map::apply_ctor_pair_to_child_region): Likewise.
3744 (binding_cluster::bind_compound_sval): Likewise.
3745 (binding_cluster::get_any_binding): Likewise.
3746 (binding_cluster::maybe_get_compound_binding): Likewise.
3748 2022-09-05 Tim Lange <mail@tim-lange.me>
3750 * region-model-impl-calls.cc (region_model::impl_call_strcpy):
3751 Handle the constant string case.
3752 * region-model.cc (region_model::get_string_size):
3753 New function to get the string size from a region or svalue.
3754 * region-model.h (class region_model): Add get_string_size.
3756 2022-09-05 Tim Lange <mail@tim-lange.me>
3758 * region.cc (cast_region::get_relative_concrete_offset):
3759 New overloaded method.
3760 * region.h: Add cast_region::get_relative_concrete_offset.
3762 2022-08-22 Martin Liska <mliska@suse.cz>
3764 * region-model.cc: Add missing final keyword.
3766 2022-08-18 Tim Lange <mail@tim-lange.me>
3768 PR analyzer/106181
3769 * analyzer.opt: Add Wanalyzer-imprecise-floating-point-arithmetic.
3770 * region-model.cc (is_any_cast_p): Formatting.
3771 (region_model::check_region_size): Ensure precondition.
3772 (class imprecise_floating_point_arithmetic): New abstract
3773 diagnostic class for all floating-point related warnings.
3774 (class float_as_size_arg): Concrete diagnostic class to complain
3775 about floating-point operands inside the size argument.
3776 (class contains_floating_point_visitor):
3777 New visitor to find floating-point operands inside svalues.
3778 (region_model::check_dynamic_size_for_floats): New function.
3779 (region_model::set_dynamic_extents):
3780 Call to check_dynamic_size_for_floats.
3781 * region-model.h (class region_model):
3782 Add region_model::check_dynamic_size_for_floats.
3784 2022-08-16 Martin Liska <mliska@suse.cz>
3786 * region-model.cc: Fix -Winconsistent-missing-override clang
3787 warning.
3788 * region.h: Likewise.
3790 2022-08-15 David Malcolm <dmalcolm@redhat.com>
3792 PR analyzer/106626
3793 * region-model.cc (buffer_overread::emit): Fix copy&paste error in
3794 direction of the access in the note.
3796 2022-08-15 David Malcolm <dmalcolm@redhat.com>
3798 PR analyzer/106573
3799 * region-model.cc (region_model::on_call_pre): Use check_call_args
3800 when ensuring that we call get_arg_svalue on all args. Remove
3801 redundant call from handling for stdio builtins.
3803 2022-08-15 Immad Mir <mirimmad@outlook.com>
3805 PR analyzer/106551
3806 * sm-fd.cc (check_for_dup): exit early if first
3807 argument is invalid for all dup functions.
3809 2022-08-12 Tim Lange <mail@tim-lange.me>
3811 PR analyzer/106000
3812 * analyzer.opt: Add Wanalyzer-out-of-bounds.
3813 * region-model.cc (class out_of_bounds): Diagnostics base class
3814 for all out-of-bounds diagnostics.
3815 (class past_the_end): Base class derived from out_of_bounds for
3816 the buffer_overflow and buffer_overread diagnostics.
3817 (class buffer_overflow): Buffer overflow diagnostics.
3818 (class buffer_overread): Buffer overread diagnostics.
3819 (class buffer_underflow): Buffer underflow diagnostics.
3820 (class buffer_underread): Buffer overread diagnostics.
3821 (region_model::check_region_bounds): New function to check region
3822 bounds for out-of-bounds accesses.
3823 (region_model::check_region_access):
3824 Add call to check_region_bounds.
3825 (region_model::get_representative_tree): New function that accepts
3826 a region instead of an svalue.
3827 * region-model.h (class region_model):
3828 Add region_model::check_region_bounds.
3829 * region.cc (region::symbolic_p): New predicate.
3830 (offset_region::get_byte_size_sval): Only return the remaining
3831 byte size on offset_regions.
3832 * region.h: Add region::symbolic_p.
3833 * store.cc (byte_range::intersects_p):
3834 Add new function equivalent to bit_range::intersects_p.
3835 (byte_range::exceeds_p): New function.
3836 (byte_range::falls_short_of_p): New function.
3837 * store.h (struct byte_range): Add byte_range::intersects_p,
3838 byte_range::exceeds_p and byte_range::falls_short_of_p.
3840 2022-08-12 Tim Lange <mail@tim-lange.me>
3842 PR analyzer/106539
3843 * region-model-impl-calls.cc (region_model::impl_call_realloc):
3844 Use the result of get_copied_size as the size for the
3845 sized_regions in realloc.
3846 (success_with_move::get_copied_size): New function.
3848 2022-08-11 Immad Mir <mirimmad@outlook.com>
3850 PR analyzer/106551
3851 * sm-fd.cc (check_for_dup): handle the m_start
3852 state when transitioning the state of LHS
3853 of dup, dup2 and dup3 call.
3855 2022-08-09 David Malcolm <dmalcolm@redhat.com>
3857 PR analyzer/106573
3858 * region-model.cc (region_model::on_call_pre): Ensure that we call
3859 get_arg_svalue on all arguments.
3861 2022-08-05 David Malcolm <dmalcolm@redhat.com>
3863 PR analyzer/105947
3864 * analyzer.opt (Wanalyzer-jump-through-null): New option.
3865 * engine.cc (class jump_through_null): New.
3866 (exploded_graph::process_node): Complain about jumps through NULL
3867 function pointers.
3869 2022-08-02 Immad Mir <mirimmad@outlook.com>
3871 PR analyzer/106298
3872 * sm-fd.cc (fd_state_machine::on_open): Add
3873 creat, dup, dup2 and dup3 functions.
3874 (enum dup): New.
3875 (fd_state_machine::valid_to_unchecked_state): New.
3876 (fd_state_machine::on_creat): New.
3877 (fd_state_machine::on_dup): New.
3879 2022-07-28 David Malcolm <dmalcolm@redhat.com>
3881 PR analyzer/105893
3882 * analyzer.opt (Wanalyzer-putenv-of-auto-var): New.
3883 * region-model-impl-calls.cc (class putenv_of_auto_var): New.
3884 (region_model::impl_call_putenv): New.
3885 * region-model.cc (region_model::on_call_pre): Handle putenv.
3886 * region-model.h (region_model::impl_call_putenv): New decl.
3888 2022-07-28 David Malcolm <dmalcolm@redhat.com>
3890 * sm-malloc.cc (free_of_non_heap::emit): Add comment about CWE.
3891 * sm-taint.cc (tainted_size::emit): Likewise.
3893 2022-07-28 David Malcolm <dmalcolm@redhat.com>
3895 * region.h: Add notes to the comment describing the region
3896 class hierarchy.
3898 2022-07-27 Immad Mir <mirimmad@outlook.com>
3900 PR analyzer/106286
3901 * sm-fd.cc:
3902 (fd_diagnostic::get_meaning_for_state_change): New.
3904 2022-07-26 David Malcolm <dmalcolm@redhat.com>
3906 PR analyzer/106319
3907 * store.cc (store::set_value): Don't strip away casts if the
3908 region has NULL type.
3910 2022-07-26 David Malcolm <dmalcolm@redhat.com>
3912 * region.h (code_region::get_element): Remove stray decl.
3913 (function_region::get_element): Likewise.
3915 2022-07-25 Martin Liska <mliska@suse.cz>
3917 * sm-fd.cc: Run dos2unix and fix coding style issues.
3919 2022-07-23 Immad Mir <mirimmad@outlook.com>
3921 * sm-fd.cc (fd_param_diagnostic): New diagnostic class.
3922 (fd_access_mode_mismatch): Change inheritance from fd_diagnostic
3923 to fd_param_diagnostic. Add new overloaded constructor.
3924 (fd_use_after_close): Likewise.
3925 (unchecked_use_of_fd): Likewise and also change name to fd_use_without_check.
3926 (double_close): Change name to fd_double_close.
3927 (enum access_directions): New.
3928 (fd_state_machine::on_stmt): Handle calls to function with the
3929 new three function attributes.
3930 (fd_state_machine::check_for_fd_attrs): New.
3931 (fd_state_machine::on_open): Use the new overloaded constructors
3932 of diagnostic classes.
3934 2022-07-22 David Malcolm <dmalcolm@redhat.com>
3936 PR analyzer/106413
3937 * varargs.cc (region_model::impl_call_va_start): Avoid iterating
3938 through non-existant variadic arguments by initializing the
3939 impl_region to "UNKNOWN" if the va_start occurs in the top-level
3940 function to the analysis.
3942 2022-07-22 David Malcolm <dmalcolm@redhat.com>
3944 PR analyzer/106401
3945 * store.cc (binding_cluster::binding_cluster): Remove overzealous
3946 assertion; we're checking for tracked_p in
3947 store::get_or_create_cluster.
3949 2022-07-22 Tim Lange <mail@tim-lange.me>
3951 PR analyzer/106394
3952 * region-model.cc (capacity_compatible_with_type): Always return true
3953 if alloc_size is zero.
3955 2022-07-21 David Malcolm <dmalcolm@redhat.com>
3957 PR analyzer/106383
3958 * varargs.cc (region_model::impl_call_va_arg): When determining if
3959 we're doing interprocedural analysis, use the stack depth of the
3960 frame in which va_start was called, rather than the current stack
3961 depth.
3963 2022-07-21 David Malcolm <dmalcolm@redhat.com>
3965 * sm-taint.cc (tainted_array_index::emit): Bulletproof against
3966 NULL m_arg.
3967 (tainted_array_index::describe_final_event): Likewise.
3968 (tainted_size::emit): Likewise.
3969 (tainted_size::describe_final_event): Likewise.
3971 2022-07-21 David Malcolm <dmalcolm@redhat.com>
3973 PR analyzer/106374
3974 * region.cc (decl_region::get_svalue_for_initializer): Bail out on
3975 untracked regions.
3977 2022-07-20 David Malcolm <dmalcolm@redhat.com>
3979 PR analyzer/106373
3980 * sm-taint.cc (taint_state_machine::on_condition): Potentially
3981 update the state of the RHS as well as the LHS.
3983 2022-07-20 David Malcolm <dmalcolm@redhat.com>
3985 PR analyzer/106359
3986 * region.h (string_region::tracked_p): New.
3987 * store.cc (binding_cluster::binding_cluster): Move here from
3988 store.h. Add assertion that base_region is tracked_p.
3989 * store.h (binding_cluster::binding_cluster): Move to store.cc.
3991 2022-07-19 David Malcolm <dmalcolm@redhat.com>
3993 PR analyzer/106321
3994 * constraint-manager.h (bounded_ranges::get_count): New.
3995 (bounded_ranges::get_range): New.
3996 * engine.cc (impl_region_model_context::on_bounded_ranges): New.
3997 * exploded-graph.h (impl_region_model_context::on_bounded_ranges):
3998 New decl.
3999 * region-model.cc (region_model::apply_constraints_for_gswitch):
4000 Potentially call ctxt->on_bounded_ranges.
4001 * region-model.h (region_model_context::on_bounded_ranges): New
4002 vfunc.
4003 (noop_region_model_context::on_bounded_ranges): New.
4004 (region_model_context_decorator::on_bounded_ranges): New.
4005 * sm-taint.cc: Include "analyzer/constraint-manager.h".
4006 (taint_state_machine::on_bounded_ranges): New.
4007 * sm.h (state_machine::on_bounded_ranges): New.
4009 2022-07-19 David Malcolm <dmalcolm@redhat.com>
4011 * engine.cc (exploded_graph::process_node): Show any description
4012 of the out-edge when logging it for consideration.
4014 2022-07-15 David Malcolm <dmalcolm@redhat.com>
4016 PR analyzer/106284
4017 * sm-taint.cc (taint_state_machine::on_condition): Handle range
4018 checks optimized by build_range_check.
4020 2022-07-15 Jonathan Wakely <jwakely@redhat.com>
4022 * call-info.cc (call_info::print): Adjust to new label_text API.
4023 * checker-path.cc (checker_event::dump): Likewise.
4024 (region_creation_event::get_desc): Likewise.
4025 (state_change_event::get_desc): Likewise.
4026 (superedge_event::should_filter_p): Likewise.
4027 (start_cfg_edge_event::get_desc): Likewise.
4028 (call_event::get_desc): Likewise.
4029 (return_event::get_desc): Likewise.
4030 (warning_event::get_desc): Likewise.
4031 (checker_path::dump): Likewise.
4032 (checker_path::debug): Likewise.
4033 * diagnostic-manager.cc (diagnostic_manager::prune_for_sm_diagnostic):
4034 Likewise.
4035 (diagnostic_manager::prune_interproc_events): Likewise.
4036 * engine.cc (feasibility_state::maybe_update_for_edge):
4037 Likewise.
4038 * program-state.cc (sm_state_map::to_json): Likewise.
4039 * region-model-impl-calls.cc (region_model::impl_call_analyzer_describe): Likewise.
4040 (region_model::impl_call_analyzer_dump_capacity): Likewise.
4041 * region.cc (region::to_json): Likewise.
4042 * sm-malloc.cc (inform_nonnull_attribute): Likewise.
4043 * store.cc (binding_map::to_json): Likewise.
4044 (store::to_json): Likewise.
4045 * supergraph.cc (superedge::dump): Likewise.
4046 * svalue.cc (svalue::to_json): Likewise.
4048 2022-07-07 David Malcolm <dmalcolm@redhat.com>
4050 * checker-path.cc (start_cfg_edge_event::get_desc): Update for
4051 superedge::get_description returning a label_text.
4052 * engine.cc (feasibility_state::maybe_update_for_edge): Likewise.
4053 * supergraph.cc (superedge::dump): Likewise.
4054 (superedge::get_description): Convert return type from char * to
4055 label_text.
4056 * supergraph.h (superedge::get_description): Likewise.
4058 2022-07-07 David Malcolm <dmalcolm@redhat.com>
4060 * call-info.cc (call_info::print): Update for removal of
4061 label_text::maybe_free in favor of automatic memory management.
4062 * checker-path.cc (checker_event::dump): Likewise.
4063 (checker_event::prepare_for_emission): Likewise.
4064 (state_change_event::get_desc): Likewise.
4065 (superedge_event::should_filter_p): Likewise.
4066 (start_cfg_edge_event::get_desc): Likewise.
4067 (warning_event::get_desc): Likewise.
4068 (checker_path::dump): Likewise.
4069 (checker_path::debug): Likewise.
4070 * diagnostic-manager.cc
4071 (diagnostic_manager::prune_for_sm_diagnostic): Likewise.
4072 (diagnostic_manager::prune_interproc_events): Likewise.
4073 * program-state.cc (sm_state_map::to_json): Likewise.
4074 * region.cc (region::to_json): Likewise.
4075 * sm-malloc.cc (inform_nonnull_attribute): Likewise.
4076 * store.cc (binding_map::to_json): Likewise.
4077 (store::to_json): Likewise.
4078 * svalue.cc (svalue::to_json): Likewise.
4080 2022-07-07 David Malcolm <dmalcolm@redhat.com>
4082 PR analyzer/106225
4083 * sm-taint.cc (taint_state_machine::on_stmt): Move handling of
4084 assignments from division to...
4085 (taint_state_machine::check_for_tainted_divisor): ...this new
4086 function. Reject warning when the divisor is known to be non-zero.
4087 * sm.cc: Include "analyzer/program-state.h".
4088 (sm_context::get_old_region_model): New.
4089 * sm.h (sm_context::get_old_region_model): New decl.
4091 2022-07-06 Immad Mir <mirimmad@outlook.com>
4093 PR analyzer/106184
4094 * sm-fd.cc (fd_state_machine): Change ordering of initialization
4095 of state m_invalid so that the order of initializers is same as
4096 the ordering of the fields in the class decl.
4098 2022-07-06 Immad Mir <mirimmad@outlook.com>
4100 * sm-fd.cc (use_after_close): save the "close" event and
4101 show it where possible.
4103 2022-07-06 David Malcolm <dmalcolm@redhat.com>
4105 PR analyzer/106204
4106 * region-model.cc (within_short_circuited_stmt_p): Move extraction
4107 of assign_stmt to caller.
4108 (due_to_ifn_deferred_init_p): New.
4109 (region_model::check_for_poison): Move extraction of assign_stmt
4110 from within_short_circuited_stmt_p to here. Share logic with
4111 call to due_to_ifn_deferred_init_p.
4113 2022-07-02 Tim Lange <mail@tim-lange.me>
4115 PR analyzer/105900
4116 * analyzer.opt: Added Wanalyzer-allocation-size.
4117 * checker-path.cc (region_creation_event::get_desc): Added call to new
4118 virtual function pending_diagnostic::describe_region_creation_event.
4119 * checker-path.h: Added region_creation_event::get_desc.
4120 * diagnostic-manager.cc (diagnostic_manager::add_event_on_final_node):
4121 New function.
4122 * diagnostic-manager.h:
4123 Added diagnostic_manager::add_event_on_final_node.
4124 * pending-diagnostic.h (struct region_creation): New event_desc struct.
4125 (pending_diagnostic::describe_region_creation_event): Added virtual
4126 function to overwrite description of a region creation.
4127 * region-model.cc (class dubious_allocation_size): New class.
4128 (capacity_compatible_with_type): New helper function.
4129 (class size_visitor): New class.
4130 (struct_or_union_with_inheritance_p): New helper function.
4131 (is_any_cast_p): New helper function.
4132 (region_model::check_region_size): New function.
4133 (region_model::set_value): Added call to
4134 region_model::check_region_size.
4135 * region-model.h (class region_model): New function check_region_size.
4136 * svalue.cc (region_svalue::accept): Changed to post-order traversal.
4137 (initial_svalue::accept): Likewise.
4138 (unaryop_svalue::accept): Likewise.
4139 (binop_svalue::accept): Likewise.
4140 (sub_svalue::accept): Likewise.
4141 (repeated_svalue::accept): Likewise.
4142 (bits_within_svalue::accept): Likewise.
4143 (widening_svalue::accept): Likewise.
4144 (unmergeable_svalue::accept): Likewise.
4145 (compound_svalue::accept): Likewise.
4146 (conjured_svalue::accept): Likewise.
4147 (asm_output_svalue::accept): Likewise.
4148 (const_fn_result_svalue::accept): Likewise.
4150 2022-07-02 Immad Mir <mirimmad17@gmail.com>
4152 PR analyzer/106003
4153 * analyzer.opt (Wanalyzer-fd-leak): New option.
4154 (Wanalyzer-fd-access-mode-mismatch): New option.
4155 (Wanalyzer-fd-use-without-check): New option.
4156 (Wanalyzer-fd-double-close): New option.
4157 (Wanalyzer-fd-use-after-close): New option.
4158 * sm.h (make_fd_state_machine): New decl.
4159 * sm.cc (make_checkers): Call make_fd_state_machine.
4160 * sm-fd.cc: New file.
4162 2022-06-24 David Malcolm <dmalcolm@redhat.com>
4164 * call-string.cc: Add includes of "analyzer/analyzer.h"
4165 and "analyzer/analyzer-logging.h".
4166 (call_string::call_string): Delete copy ctor.
4167 (call_string::operator=): Delete.
4168 (call_string::operator==): Delete.
4169 (call_string::hash): Delete.
4170 (call_string::push_call): Make const, returning the resulting
4171 call_string.
4172 (call_string::pop): Delete.
4173 (call_string::cmp_ptr_ptr): New.
4174 (call_string::validate): Assert that m_parent is non-NULL, or
4175 m_elements is empty.
4176 (call_string::call_string): Move default ctor here from
4177 call-string.h and reimplement. Add ctor taking a parent
4178 and an element.
4179 (call_string::~call_string): New.
4180 (call_string::recursive_log): New.
4181 * call-string.h (call_string::call_string): Move default ctor's
4182 defn to call-string.cc. Delete copy ctor. Add ctor taking a
4183 parent and an element.
4184 (call_string::operator=): Delete.
4185 (call_string::operator==): Delete.
4186 (call_string::hash): Delete.
4187 (call_string::push_call): Make const, returning the resulting
4188 call_string.
4189 (call_string::pop): Delete decl.
4190 (call_string::get_parent): New.
4191 (call_string::cmp_ptr_ptr): New decl.
4192 (call_string::get_top_of_stack): New.
4193 (struct call_string::hashmap_traits_t): New.
4194 (class call_string): Add friend class region_model_manager. Add
4195 DISABLE_COPY_AND_ASSIGN.
4196 (call_string::~call_string): New decl.
4197 (call_string::recursive_log): New decl.
4198 (call_string::m_parent): New field.
4199 (call_string::m_children): New field.
4200 * constraint-manager.cc (selftest::test_many_constants): Pass
4201 model manager to program_point::origin.
4202 * engine.cc (exploded_graph::exploded_graph): Likewise.
4203 (exploded_graph::add_function_entry): Likewise for
4204 program_point::from_function_entry.
4205 (add_tainted_args_callback): Likewise.
4206 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
4207 Update for change to program_point.get_call_string.
4208 (exploded_graph::process_node): Likewise.
4209 (class function_call_string_cluster): Convert m_cs from a
4210 call_string to a const call_string &.
4211 (struct function_call_string): Likewise.
4212 (pod_hash_traits<function_call_string>::hash): Use pointer_hash
4213 for m_cs.
4214 (pod_hash_traits<function_call_string>::equal): Update for change
4215 to m_cs.
4216 (root_cluster::add_node): Update for change to
4217 function_call_string.
4218 (viz_callgraph_node::dump_dot): Update for change to call_string.
4219 * exploded-graph.h (per_call_string_data::m_key): Convert to a
4220 reference.
4221 (struct eg_call_string_hash_map_traits): Delete.
4222 (exploded_graph::call_string_data_map_t): Remove traits class.
4223 * program-point.cc: Move include of "analyzer/call-string.h" to
4224 after "analyzer/analyzer-logging.h".
4225 (program_point::print): Update for conversion of m_call_string to
4226 a pointer.
4227 (program_point::to_json): Likewise.
4228 (program_point::push_to_call_stack): Update for immutability of
4229 call strings.
4230 (program_point::pop_from_call_stack): Likewise.
4231 (program_point::hash): Use pointer hashing for m_call_string.
4232 (program_point::get_function_at_depth): Update for change to
4233 m_call_string.
4234 (program_point::validate): Update for changes to call_string.
4235 (program_point::on_edge): Likewise.
4236 (program_point::origin): Move here from call-string.h. Add
4237 region_model_manager param and use it to get empty call string.
4238 (program_point::from_function_entry): Likewise.
4239 (selftest::test_function_point_ordering): Likewise.
4240 (selftest::test_function_point_ordering): Likewise.
4241 * program-point.h (program_point::program_point): Update for
4242 change to m_call_string.
4243 (program_point::get_call_string): Likewise.
4244 (program_point::get_stack_depth): Likewise.
4245 (program_point::origin): Add region_model_manager param, and move
4246 defn to call-string.cc.
4247 (program_point::from_function_entry): Likewise.
4248 (program_point::empty): Drop call_string.
4249 (program_point::deleted): Likewise.
4250 (program_point::program_point): New private ctor.
4251 (program_point::m_call_string): Convert from call_string to const
4252 call_string *.
4253 * program-state.cc (selftest::test_program_state_merging): Update
4254 for call_string changes.
4255 (selftest::test_program_state_merging_2): Likewise.
4256 * region-model-manager.cc
4257 (region_model_manager::region_model_manager): Construct
4258 m_empty_call_string.
4259 (region_model_manager::log_stats): Log the call strings.
4260 * region-model.cc (assert_region_models_merge): Pass the
4261 region_model_manager when creating program_point instances.
4262 (selftest::test_state_merging): Likewise.
4263 (selftest::test_constraint_merging): Likewise.
4264 (selftest::test_widening_constraints): Likewise.
4265 (selftest::test_iteration_1): Likewise.
4266 * region-model.h (region_model_manager::get_empty_call_string):
4267 New.
4268 (region_model_manager::m_empty_call_string): New.
4269 * sm-signal.cc (register_signal_handler::impl_transition): Update
4270 for changes to call_string.
4272 2022-06-24 David Malcolm <dmalcolm@redhat.com>
4274 * call-string.cc (call_string::calc_recursion_depth): Whitespace
4275 cleanups.
4276 (call_string::cmp): Likewise.
4277 (call_string::get_caller_node): Likewise.
4278 (call_string::validate): Likewise.
4279 * engine.cc (dynamic_call_info_t::add_events_to_path): Likewise.
4280 (exploded_graph::get_per_function_data): Likewise.
4281 (exploded_graph::maybe_create_dynamic_call): Likewise.
4282 (exploded_graph::maybe_create_dynamic_call): Likewise.
4283 (exploded_graph::process_node): Likewise.
4285 2022-06-16 David Malcolm <dmalcolm@redhat.com>
4287 * varargs.cc (va_arg_type_mismatch::emit): Associate the warning
4288 with CWE-686 ("Function Call With Incorrect Argument Type").
4290 2022-06-16 David Malcolm <dmalcolm@redhat.com>
4292 * varargs.cc: Include "diagnostic-metadata.h".
4293 (va_list_exhausted::emit): Associate the warning with
4294 CWE-685 ("Function Call With Incorrect Number of Arguments").
4296 2022-06-16 David Malcolm <dmalcolm@redhat.com>
4298 * sm-file.cc (double_fclose::emit): Associate the warning with
4299 CWE-1341 ("Multiple Releases of Same Resource or Handle").
4301 2022-06-15 David Malcolm <dmalcolm@redhat.com>
4303 PR analyzer/105962
4304 * analyzer.opt (fanalyzer-undo-inlining): New option.
4305 * checker-path.cc: Include "diagnostic-core.h" and
4306 "inlining-iterator.h".
4307 (event_kind_to_string): Handle EK_INLINED_CALL.
4308 (class inlining_info): New class.
4309 (checker_event::checker_event): Move here from checker-path.h.
4310 Store original fndecl and depth, and calculate effective fndecl
4311 and depth based on inlining information.
4312 (checker_event::dump): Emit original depth as well as effective
4313 depth when they differ; likewise for fndecl.
4314 (region_creation_event::get_desc): Use m_effective_fndecl.
4315 (inlined_call_event::get_desc): New.
4316 (inlined_call_event::get_meaning): New.
4317 (checker_path::inject_any_inlined_call_events): New.
4318 * checker-path.h (enum event_kind): Add EK_INLINED_CALL.
4319 (checker_event::checker_event): Make protected, and move
4320 definition to checker-path.cc.
4321 (checker_event::get_fndecl): Use effective fndecl.
4322 (checker_event::get_stack_depth): Use effective stack depth.
4323 (checker_event::get_logical_location): Use effective stack depth.
4324 (checker_event::get_original_stack_depth): New.
4325 (checker_event::m_fndecl): Rename to...
4326 (checker_event::m_original_fndecl): ...this.
4327 (checker_event::m_depth): Rename to...
4328 (checker_event::m_original_depth): ...this.
4329 (checker_event::m_effective_fndecl): New field.
4330 (checker_event::m_effective_depth): New field.
4331 (class inlined_call_event): New checker_event subclass.
4332 (checker_path::inject_any_inlined_call_events): New decl.
4333 * diagnostic-manager.cc: Include "inlining-iterator.h".
4334 (diagnostic_manager::emit_saved_diagnostic): Call
4335 checker_path::inject_any_inlined_call_events.
4336 (diagnostic_manager::prune_for_sm_diagnostic): Handle
4337 EK_INLINED_CALL.
4338 * engine.cc (tainted_args_function_custom_event::get_desc): Use
4339 effective fndecl.
4340 * inlining-iterator.h: New file.
4342 2022-06-15 David Malcolm <dmalcolm@redhat.com>
4344 * diagnostic-manager.cc (saved_diagnostic::dump_dot_id): New.
4345 (saved_diagnostic::dump_as_dot_node): New.
4346 * diagnostic-manager.h (saved_diagnostic::dump_dot_id): New decl.
4347 (saved_diagnostic::dump_as_dot_node): New decl.
4348 * engine.cc (exploded_node::dump_dot): Add nodes for saved
4349 diagnostics.
4351 2022-06-02 David Malcolm <dmalcolm@redhat.com>
4353 * checker-path.cc (checker_event::get_meaning): New.
4354 (function_entry_event::get_meaning): New.
4355 (state_change_event::get_desc): Add dump of meaning of the event
4356 to the -fanalyzer-verbose-state-changes output.
4357 (state_change_event::get_meaning): New.
4358 (cfg_edge_event::get_meaning): New.
4359 (call_event::get_meaning): New.
4360 (return_event::get_meaning): New.
4361 (start_consolidated_cfg_edges_event::get_meaning): New.
4362 (warning_event::get_meaning): New.
4363 * checker-path.h: Include "tree-logical-location.h".
4364 (checker_event::checker_event): Construct m_logical_loc.
4365 (checker_event::get_logical_location): New.
4366 (checker_event::get_meaning): New decl.
4367 (checker_event::m_logical_loc): New.
4368 (function_entry_event::get_meaning): New decl.
4369 (state_change_event::get_meaning): New decl.
4370 (cfg_edge_event::get_meaning): New decl.
4371 (call_event::get_meaning): New decl.
4372 (return_event::get_meaning): New decl.
4373 (start_consolidated_cfg_edges_event::get_meaning): New.
4374 (warning_event::get_meaning): New decl.
4375 * pending-diagnostic.h: Include "diagnostic-path.h".
4376 (pending_diagnostic::get_meaning_for_state_change): New vfunc.
4377 * sm-file.cc (file_diagnostic::get_meaning_for_state_change): New
4378 vfunc impl.
4379 * sm-malloc.cc (malloc_diagnostic::get_meaning_for_state_change):
4380 Likewise.
4381 * sm-sensitive.cc
4382 (exposure_through_output_file::get_meaning_for_state_change):
4383 Likewise.
4384 * sm-taint.cc (taint_diagnostic::get_meaning_for_state_change):
4385 Likewise.
4386 * varargs.cc
4387 (va_list_sm_diagnostic::get_meaning_for_state_change): Likewise.
4389 2022-05-23 David Malcolm <dmalcolm@redhat.com>
4391 * call-info.cc: Add "final" and "override" to all vfunc
4392 implementations that were missing them, as appropriate.
4393 * engine.cc: Likewise.
4394 * region-model.cc: Likewise.
4395 * sm-malloc.cc: Likewise.
4396 * supergraph.h: Likewise.
4397 * svalue.cc: Likewise.
4398 * varargs.cc: Likewise.
4400 2022-05-20 David Malcolm <dmalcolm@redhat.com>
4402 * analyzer-pass.cc: Replace uses of "FINAL" and "OVERRIDE" with
4403 "final" and "override".
4404 * call-info.h: Likewise.
4405 * checker-path.h: Likewise.
4406 * constraint-manager.cc: Likewise.
4407 * diagnostic-manager.cc: Likewise.
4408 * engine.cc: Likewise.
4409 * exploded-graph.h: Likewise.
4410 * feasible-graph.h: Likewise.
4411 * pending-diagnostic.h: Likewise.
4412 * region-model-impl-calls.cc: Likewise.
4413 * region-model.cc: Likewise.
4414 * region-model.h: Likewise.
4415 * region.h: Likewise.
4416 * sm-file.cc: Likewise.
4417 * sm-malloc.cc: Likewise.
4418 * sm-pattern-test.cc: Likewise.
4419 * sm-sensitive.cc: Likewise.
4420 * sm-signal.cc: Likewise.
4421 * sm-taint.cc: Likewise.
4422 * state-purge.h: Likewise.
4423 * store.cc: Likewise.
4424 * store.h: Likewise.
4425 * supergraph.h: Likewise.
4426 * svalue.h: Likewise.
4427 * trimmed-graph.h: Likewise.
4428 * varargs.cc: Likewise.
4430 2022-05-16 David Malcolm <dmalcolm@redhat.com>
4432 PR analyzer/105103
4433 * analyzer.cc (make_label_text_n): New.
4434 * analyzer.h (class var_arg_region): New forward decl.
4435 (make_label_text_n): New decl.
4436 * analyzer.opt (Wanalyzer-va-arg-type-mismatch): New option.
4437 (Wanalyzer-va-list-exhausted): New option.
4438 (Wanalyzer-va-list-leak): New option.
4439 (Wanalyzer-va-list-use-after-va-end): New option.
4440 * checker-path.cc (call_event::get_desc): Split out decl access
4441 into..
4442 (call_event::get_caller_fndecl): ...this new function and...
4443 (call_event::get_callee_fndecl): ...this new function.
4444 * checker-path.h (call_event::get_desc): Drop "FINAL".
4445 (call_event::get_caller_fndecl): New decl.
4446 (call_event::get_callee_fndecl): New decl.
4447 (class call_event): Make fields protected.
4448 * diagnostic-manager.cc (null_assignment_sm_context::warn): New
4449 overload.
4450 (null_assignment_sm_context::get_new_program_state): New.
4451 (diagnostic_manager::add_events_for_superedge): Move case
4452 SUPEREDGE_CALL to a new pending_diagnostic::add_call_event vfunc.
4453 * engine.cc (impl_sm_context::warn): Implement new override.
4454 (impl_sm_context::get_new_program_state): New.
4455 * pending-diagnostic.cc: Include "analyzer/diagnostic-manager.h",
4456 "cpplib.h", "digraph.h", "ordered-hash-map.h", "cfg.h",
4457 "basic-block.h", "gimple.h", "gimple-iterator.h", "cgraph.h"
4458 "analyzer/supergraph.h", "analyzer/program-state.h",
4459 "alloc-pool.h", "fibonacci_heap.h", "shortest-paths.h",
4460 "sbitmap.h", "analyzer/exploded-graph.h", "diagnostic-path.h",
4461 and "analyzer/checker-path.h".
4462 (ht_ident_eq): New.
4463 (fixup_location_in_macro_p): New.
4464 (pending_diagnostic::fixup_location): New.
4465 (pending_diagnostic::add_call_event): New.
4466 * pending-diagnostic.h (pending_diagnostic::fixup_location): Drop
4467 no-op inline implementation in favor of the more complex
4468 implementation above.
4469 (pending_diagnostic::add_call_event): New vfunc.
4470 * region-model-impl-calls.cc: Include "analyzer/sm.h",
4471 "diagnostic-path.h", and "analyzer/pending-diagnostic.h".
4472 * region-model-manager.cc
4473 (region_model_manager::get_var_arg_region): New.
4474 (region_model_manager::log_stats): Log m_var_arg_regions.
4475 * region-model.cc (region_model::on_call_pre): Handle IFN_VA_ARG,
4476 BUILT_IN_VA_START, and BUILT_IN_VA_COPY.
4477 (region_model::on_call_post): Handle BUILT_IN_VA_END.
4478 (region_model::get_representative_path_var_1): Handle RK_VAR_ARG.
4479 (region_model::push_frame): Push variadic arguments.
4480 * region-model.h (region_model_manager::get_var_arg_region): New
4481 decl.
4482 (region_model_manager::m_var_arg_regions): New field.
4483 (region_model::impl_call_va_start): New decl.
4484 (region_model::impl_call_va_copy): New decl.
4485 (region_model::impl_call_va_arg): New decl.
4486 (region_model::impl_call_va_end): New decl.
4487 * region.cc (alloca_region::dump_to_pp): Dump the id.
4488 (var_arg_region::dump_to_pp): New.
4489 (var_arg_region::get_frame_region): New.
4490 * region.h (enum region_kind): Add RK_VAR_ARG.
4491 (region::dyn_cast_var_arg_region): New.
4492 (class var_arg_region): New.
4493 (is_a_helper <const var_arg_region *>::test): New.
4494 (struct default_hash_traits<var_arg_region::key_t>): New.
4495 * sm.cc (make_checkers): Call make_va_list_state_machine.
4496 * sm.h (sm_context::warn): New vfunc.
4497 (sm_context::get_old_svalue): Drop unused decl.
4498 (sm_context::get_new_program_state): New vfunc.
4499 (make_va_list_state_machine): New decl.
4500 * varargs.cc: New file.
4502 2022-05-16 Martin Liska <mliska@suse.cz>
4504 * engine.cc (exploded_node::get_dot_fillcolor): Use ARRAY_SIZE.
4505 * function-set.cc (test_stdio_example): Likewise.
4506 * sm-file.cc (get_file_using_fns): Likewise.
4507 * sm-malloc.cc (malloc_state_machine::unaffected_by_call_p): Likewise.
4508 * sm-signal.cc (get_async_signal_unsafe_fns): Likewise.
4510 2022-05-13 Richard Biener <rguenther@suse.de>
4512 * supergraph.cc: Re-order gimple-fold.h include.
4514 2022-05-11 David Malcolm <dmalcolm@redhat.com>
4516 * checker-path.cc (state_change_event::get_desc): Call maybe_free
4517 on label_text temporaries.
4518 * diagnostic-manager.cc
4519 (diagnostic_manager::prune_for_sm_diagnostic): Likewise.
4520 * engine.cc (exploded_graph::~exploded_graph): Fix leak of
4521 m_per_point_data and m_per_call_string_data values. Simplify
4522 cleanup of m_per_function_stats and m_per_point_data values.
4523 (feasibility_state::maybe_update_for_edge): Fix leak of result of
4524 superedge::get_description.
4525 * region-model-manager.cc
4526 (region_model_manager::~region_model_manager): Move cleanup of
4527 m_setjmp_values to match the ordering of the fields within
4528 region_model_manager. Fix leak of values within
4529 m_repeated_values_map, m_bits_within_values_map,
4530 m_asm_output_values_map, and m_const_fn_result_values_map.
4532 2022-04-28 David Malcolm <dmalcolm@redhat.com>
4534 PR analyzer/105285
4535 * store.cc (binding_cluster::get_any_binding): Handle accessing
4536 sub_svalues of clusters where the base region has a symbolic
4537 binding.
4539 2022-04-28 David Malcolm <dmalcolm@redhat.com>
4541 * diagnostic-manager.cc (epath_finder::process_worklist_item):
4542 Call dump_feasible_path when a path that reaches the the target
4543 enode is found.
4544 (epath_finder::dump_feasible_path): New.
4545 * engine.cc (feasibility_state::dump_to_pp): New.
4546 * exploded-graph.h (feasibility_state::dump_to_pp): New decl.
4547 * feasible-graph.cc (feasible_graph::dump_feasible_path): New.
4548 * feasible-graph.h (feasible_graph::dump_feasible_path): New
4549 decls.
4550 * program-point.cc (function_point::print): Fix missing trailing
4551 newlines.
4552 * program-point.h (program_point::print_source_line): Remove
4553 unimplemented decl.
4555 2022-04-25 David Malcolm <dmalcolm@redhat.com>
4557 PR analyzer/105365
4558 PR analyzer/105366
4559 * svalue.cc
4560 (cmp_cst): Rename to...
4561 (cmp_csts_same_type): ...this. Convert all recursive calls to
4562 calls to...
4563 (cmp_csts_and_types): ....this new function.
4564 (svalue::cmp_ptr): Update for renaming of cmp_cst
4566 2022-04-14 David Malcolm <dmalcolm@redhat.com>
4568 PR analyzer/105264
4569 * region-model-reachability.cc (reachable_regions::handle_parm):
4570 Use maybe_get_deref_base_region rather than just region_svalue, to
4571 handle pointer arithmetic also.
4572 * svalue.cc (svalue::maybe_get_deref_base_region): New.
4573 * svalue.h (svalue::maybe_get_deref_base_region): New decl.
4575 2022-04-14 David Malcolm <dmalcolm@redhat.com>
4577 PR analyzer/105252
4578 * svalue.cc (cmp_cst): When comparing VECTOR_CSTs, compare the
4579 types of the encoded elements before calling cmp_cst on them.
4581 2022-04-09 David Malcolm <dmalcolm@redhat.com>
4583 PR analyzer/103892
4584 * region-model-manager.cc
4585 (region_model_manager::get_unknown_symbolic_region): New,
4586 extracted from...
4587 (region_model_manager::get_field_region): ...here.
4588 (region_model_manager::get_element_region): Use it here.
4589 (region_model_manager::get_offset_region): Likewise.
4590 (region_model_manager::get_sized_region): Likewise.
4591 (region_model_manager::get_cast_region): Likewise.
4592 (region_model_manager::get_bit_range): Likewise.
4593 * region-model.h
4594 (region_model_manager::get_unknown_symbolic_region): New decl.
4595 * region.cc (symbolic_region::symbolic_region): Handle sval_ptr
4596 having NULL type.
4597 (symbolic_region::dump_to_pp): Handle having NULL type.
4599 2022-04-07 David Malcolm <dmalcolm@redhat.com>
4601 PR analyzer/102208
4602 * store.cc (binding_map::remove_overlapping_bindings): Add
4603 "always_overlap" param, using it to generalize to the case where
4604 we want to remove all bindings. Update "uncertainty" logic to
4605 only record maybe-bound values for cases where there is a symbolic
4606 write involved.
4607 (binding_cluster::mark_region_as_unknown): Split param "reg" into
4608 "reg_to_bind" and "reg_for_overlap".
4609 (binding_cluster::maybe_get_compound_binding): Pass "false" to
4610 binding_map::remove_overlapping_bindings new "always_overlap" param.
4611 (binding_cluster::remove_overlapping_bindings): Determine
4612 "always_overlap" and pass it to
4613 binding_map::remove_overlapping_bindings.
4614 (store::set_value): Pass uncertainty to remove_overlapping_bindings
4615 call. Update for new param of
4616 binding_cluster::mark_region_as_unknown, passing both the base
4617 region of the iter_cluster, and the lhs_reg.
4618 (store::mark_region_as_unknown): Update for new param of
4619 binding_cluster::mark_region_as_unknown, passing "reg" for both.
4620 (store::remove_overlapping_bindings): Add param "uncertainty", and
4621 pass it on to call to
4622 binding_cluster::remove_overlapping_bindings.
4623 * store.h (binding_map::remove_overlapping_bindings): Add
4624 "always_overlap" param.
4625 (binding_cluster::mark_region_as_unknown): Split param "reg" into
4626 "reg_to_bind" and "reg_for_overlap".
4627 (store::remove_overlapping_bindings): Add param "uncertainty".
4629 2022-03-29 David Malcolm <dmalcolm@redhat.com>
4631 PR testsuite/105085
4632 * region-model-manager.cc (dump_untracked_region): Skip decls in
4633 the constant pool.
4635 2022-03-29 David Malcolm <dmalcolm@redhat.com>
4637 PR analyzer/105087
4638 * analyzer.h (class conjured_purge): New forward decl.
4639 * region-model-asm.cc (region_model::on_asm_stmt): Add
4640 conjured_purge param to calls binding_cluster::on_asm and
4641 region_model_manager::get_or_create_conjured_svalue.
4642 * region-model-impl-calls.cc
4643 (call_details::get_or_create_conjured_svalue): Likewise for call
4644 to region_model_manager::get_or_create_conjured_svalue.
4645 (region_model::impl_call_fgets): Remove call to
4646 region_model::purge_state_involving, as this is now done
4647 implicitly by call_details::get_or_create_conjured_svalue.
4648 (region_model::impl_call_fread): Likewise.
4649 (region_model::impl_call_strchr): Pass conjured_purge param to
4650 call to region_model_manager::get_or_create_conjured_svalue.
4651 * region-model-manager.cc (conjured_purge::purge): New.
4652 (region_model_manager::get_or_create_conjured_svalue): Add
4653 param "p". Use it to purge state when reusing an existing
4654 conjured_svalue.
4655 * region-model.cc (region_model::on_call_pre): Replace call to
4656 region_model::purge_state_involving with passing conjured_purge
4657 to region_model_manager::get_or_create_conjured_svalue.
4658 (region_model::handle_unrecognized_call): Pass conjured_purge to
4659 store::on_unknown_fncall.
4660 * region-model.h
4661 (region_model_manager::get_or_create_conjured_svalue): Add param
4662 "p".
4663 * store.cc (binding_cluster::on_unknown_fncall): Likewise. Pass
4664 it on to region_model_manager::get_or_create_conjured_svalue.
4665 (binding_cluster::on_asm): Likewise.
4666 (store::on_unknown_fncall): Add param "p" and pass it on to
4667 binding_cluster::on_unknown_fncall.
4668 * store.h (binding_cluster::on_unknown_fncall): Add param p.
4669 (binding_cluster::on_asm): Likewise.
4670 (store::on_unknown_fncall): Likewise.
4671 * svalue.h (class conjured_purge): New.
4673 2022-03-29 David Malcolm <dmalcolm@redhat.com>
4675 PR analyzer/105074
4676 * region.cc (ipa_ref_requires_tracking): Drop "context_fndecl",
4677 instead using the ref->referring to get the cgraph node of the
4678 caller.
4679 (symnode_requires_tracking_p): Likewise.
4681 2022-03-26 David Malcolm <dmalcolm@redhat.com>
4683 PR analyzer/105057
4684 * store.cc (binding_cluster::make_unknown_relative_to): Reject
4685 attempts to create a cluster for untracked base regions.
4686 (store::set_value): Likewise.
4687 (store::fill_region): Likewise.
4688 (store::mark_region_as_unknown): Likewise.
4690 2022-03-25 David Malcolm <dmalcolm@redhat.com>
4692 PR analyzer/104954
4693 * analyzer.opt (-fdump-analyzer-untracked): New option.
4694 * engine.cc (impl_run_checkers): Handle it.
4695 * region-model-asm.cc (region_model::on_asm_stmt): Don't attempt
4696 to clobber regions with !tracked_p ().
4697 * region-model-manager.cc (dump_untracked_region): New.
4698 (region_model_manager::dump_untracked_regions): New.
4699 (frame_region::dump_untracked_regions): New.
4700 * region-model.h (region_model_manager::dump_untracked_regions):
4701 New decl.
4702 * region.cc (ipa_ref_requires_tracking): New.
4703 (symnode_requires_tracking_p): New.
4704 (decl_region::calc_tracked_p): New.
4705 * region.h (region::tracked_p): New vfunc.
4706 (frame_region::dump_untracked_regions): New decl.
4707 (class decl_region): Note that this is also used fo SSA names.
4708 (decl_region::decl_region): Initialize m_tracked.
4709 (decl_region::tracked_p): New.
4710 (decl_region::calc_tracked_p): New decl.
4711 (decl_region::m_tracked): New.
4712 * store.cc (store::get_or_create_cluster): Assert that we
4713 don't try to create clusters for base regions that aren't
4714 trackable.
4715 (store::mark_as_escaped): Don't mark base regions that we're not
4716 tracking.
4718 2022-03-23 David Malcolm <dmalcolm@redhat.com>
4720 PR analyzer/104979
4721 * engine.cc (impl_run_checkers): Create the engine after the
4722 supergraph, and pass the supergraph to the engine.
4723 * region-model.cc (region_model::get_lvalue_1): Pass ctxt to
4724 frame_region::get_region_for_local.
4725 (region_model::update_for_return_gcall): Pass the lvalue for the
4726 result to pop_frame as a tree, rather than as a region.
4727 (region_model::pop_frame): Update for above change, determining
4728 the destination region after the frame is popped and thus with
4729 respect to the caller frame rather than the called frame.
4730 Likewise, set the value of the region to the return value after
4731 the frame is popped.
4732 (engine::engine): Add supergraph pointer.
4733 (selftest::test_stack_frames): Set the DECL_CONTECT of PARM_DECLs.
4734 (selftest::test_get_representative_path_var): Likewise.
4735 (selftest::test_state_merging): Likewise.
4736 * region-model.h (region_model::pop_frame): Convert first param
4737 from a const region * to a tree.
4738 (engine::engine): Add param "sg".
4739 (engine::m_sg): New field.
4740 * region.cc: Include "analyzer/sm.h" and
4741 "analyzer/program-state.h".
4742 (frame_region::get_region_for_local): Add "ctxt" param.
4743 Add assertions that VAR_DECLs are locals, and that expr is for the
4744 correct function.
4745 * region.h (frame_region::get_region_for_local): Add "ctxt" param.
4747 2022-03-23 David Malcolm <dmalcolm@redhat.com>
4749 PR analyzer/105017
4750 * sm-taint.cc (taint_diagnostic::subclass_equal_p): Check
4751 m_has_bounds as well as m_arg.
4752 (tainted_allocation_size::subclass_equal_p): Chain up to base
4753 class implementation. Also check m_mem_space.
4754 (tainted_allocation_size::emit): Add note showing stack-based vs
4755 heap-based allocations.
4757 2022-03-23 David Malcolm <dmalcolm@redhat.com>
4759 PR analyzer/104997
4760 * diagnostic-manager.cc (diagnostic_manager::add_diagnostic):
4761 Convert return type from "void" to "bool", reporting success vs
4762 failure to caller, for both overloads.
4763 * diagnostic-manager.h (diagnostic_manager::add_diagnostic):
4764 Likewise.
4765 * engine.cc (impl_region_model_context::warn): Propagate return
4766 value from diagnostic_manager::add_diagnostic.
4768 2022-03-18 David Malcolm <dmalcolm@redhat.com>
4770 PR analyzer/104943
4771 PR analyzer/104954
4772 PR analyzer/103533
4773 * analyzer.h (class state_purge_per_decl): New forward decl.
4774 * engine.cc (impl_run_checkers): Pass region_model_manager to
4775 state_purge_map ctor.
4776 * program-point.cc (function_point::final_stmt_p): New.
4777 (function_point::get_next): New.
4778 * program-point.h (function_point::final_stmt_p): New decl.
4779 (function_point::get_next): New decl.
4780 * program-state.cc (program_state::prune_for_point): Generalize to
4781 purge local decls as well as SSA names.
4782 (program_state::can_purge_base_region_p): New.
4783 * program-state.h (program_state::can_purge_base_region_p): New
4784 decl.
4785 * region-model.cc (struct append_ssa_names_cb_data): Rename to...
4786 (struct append_regions_cb_data): ...this.
4787 (region_model::get_ssa_name_regions_for_current_frame): Rename
4788 to...
4789 (region_model::get_regions_for_current_frame): ...this, updating
4790 for other renamings.
4791 (region_model::append_ssa_names_cb): Rename to...
4792 (region_model::append_regions_cb): ...this, and drop the requirement
4793 that the subregion be a SSA name.
4794 * region-model.h (struct append_ssa_names_cb_data): Rename decl
4795 to...
4796 (struct append_regions_cb_data): ...this.
4797 (region_model::get_ssa_name_regions_for_current_frame): Rename
4798 decl to...
4799 (region_model::get_regions_for_current_frame): ...this.
4800 (region_model::append_ssa_names_cb): Rename decl to...
4801 (region_model::append_regions_cb): ...this.
4802 * state-purge.cc: Include "tristate.h", "selftest.h",
4803 "analyzer/store.h", "analyzer/region-model.h", and
4804 "gimple-walk.h".
4805 (get_candidate_for_purging): New.
4806 (class gimple_op_visitor): New.
4807 (my_load_cb): New.
4808 (my_store_cb): New.
4809 (my_addr_cb): New.
4810 (state_purge_map::state_purge_map): Add "mgr" param. Update for
4811 renamings. Find uses of local variables.
4812 (state_purge_map::~state_purge_map): Update for renaming of m_map
4813 to m_ssa_map. Clean up m_decl_map.
4814 (state_purge_map::get_or_create_data_for_decl): New.
4815 (state_purge_per_ssa_name::state_purge_per_ssa_name): Update for
4816 inheriting from state_purge_per_tree.
4817 (state_purge_per_ssa_name::add_to_worklist): Likewise.
4818 (state_purge_per_decl::state_purge_per_decl): New.
4819 (state_purge_per_decl::add_needed_at): New.
4820 (state_purge_per_decl::add_pointed_to_at): New.
4821 (state_purge_per_decl::process_worklists): New.
4822 (state_purge_per_decl::add_to_worklist): New.
4823 (same_binding_p): New.
4824 (fully_overwrites_p): New.
4825 (state_purge_per_decl::process_point_backwards): New.
4826 (state_purge_per_decl::process_point_forwards): New.
4827 (state_purge_per_decl::needed_at_point_p): New.
4828 (state_purge_annotator::print_needed): Generalize to print local
4829 decls as well as SSA names.
4830 * state-purge.h (class state_purge_map): Update leading comment.
4831 (state_purge_map::map_t): Rename to...
4832 (state_purge_map::ssa_map_t): ...this.
4833 (state_purge_map::iterator): Rename to...
4834 (state_purge_map::ssa_iterator): ...this.
4835 (state_purge_map::decl_map_t): New typedef.
4836 (state_purge_map::decl_iterator): New typedef.
4837 (state_purge_map::state_purge_map): Add "mgr" param.
4838 (state_purge_map::get_data_for_ssa_name): Update for renaming.
4839 (state_purge_map::get_any_data_for_decl): New.
4840 (state_purge_map::get_or_create_data_for_decl): New decl.
4841 (state_purge_map::begin): Rename to...
4842 (state_purge_map::begin_ssas): ...this.
4843 (state_purge_map::end): Rename to...
4844 (state_purge_map::end_ssa): ...this.
4845 (state_purge_map::begin_decls): New.
4846 (state_purge_map::end_decls): New.
4847 (state_purge_map::m_map): Rename to...
4848 (state_purge_map::m_ssa_map): ...this.
4849 (state_purge_map::m_decl_map): New field.
4850 (class state_purge_per_tree): New class.
4851 (class state_purge_per_ssa_name): Inherit from state_purge_per_tree.
4852 (state_purge_per_ssa_name::get_function): Move to base class.
4853 (state_purge_per_ssa_name::point_set_t): Likewise.
4854 (state_purge_per_ssa_name::m_fun): Likewise.
4855 (class state_purge_per_decl): New.
4857 2022-03-17 David Malcolm <dmalcolm@redhat.com>
4859 * state-purge.cc (state_purge_annotator::add_node_annotations):
4860 Avoid duplicate before-supernode annotations when returning from
4861 an interprocedural call. Show after-supernode annotations.
4863 2022-03-17 David Malcolm <dmalcolm@redhat.com>
4865 * program-point.cc (program_point::get_next): Fix missing
4866 increment of index.
4868 2022-03-16 David Malcolm <dmalcolm@redhat.com>
4870 PR analyzer/104955
4871 * diagnostic-manager.cc (get_emission_location): New.
4872 (diagnostic_manager::diagnostic_manager): Initialize
4873 m_num_disabled_diagnostics.
4874 (diagnostic_manager::add_diagnostic): Reject diagnostics that
4875 will eventually be rejected due to being disabled.
4876 (diagnostic_manager::emit_saved_diagnostics): Log the number
4877 of disabled diagnostics.
4878 (diagnostic_manager::emit_saved_diagnostic): Split out logic for
4879 determining emission location to get_emission_location.
4880 * diagnostic-manager.h
4881 (diagnostic_manager::m_num_disabled_diagnostics): New field.
4882 * engine.cc (stale_jmp_buf::get_controlling_option): New.
4883 (stale_jmp_buf::emit): Use it.
4884 * pending-diagnostic.h
4885 (pending_diagnostic::get_controlling_option): New vfunc.
4886 * region-model.cc
4887 (poisoned_value_diagnostic::get_controlling_option): New.
4888 (poisoned_value_diagnostic::emit): Use it.
4889 (shift_count_negative_diagnostic::get_controlling_option): New.
4890 (shift_count_negative_diagnostic::emit): Use it.
4891 (shift_count_overflow_diagnostic::get_controlling_option): New.
4892 (shift_count_overflow_diagnostic::emit): Use it.
4893 (dump_path_diagnostic::get_controlling_option): New.
4894 (dump_path_diagnostic::emit): Use it.
4895 (write_to_const_diagnostic::get_controlling_option): New.
4896 (write_to_const_diagnostic::emit): Use it.
4897 (write_to_string_literal_diagnostic::get_controlling_option): New.
4898 (write_to_string_literal_diagnostic::emit): Use it.
4899 * sm-file.cc (double_fclose::get_controlling_option): New.
4900 (double_fclose::emit): Use it.
4901 (file_leak::get_controlling_option): New.
4902 (file_leak::emit): Use it.
4903 * sm-malloc.cc (mismatching_deallocation::get_controlling_option):
4904 New.
4905 (mismatching_deallocation::emit): Use it.
4906 (double_free::get_controlling_option): New.
4907 (double_free::emit): Use it.
4908 (possible_null_deref::get_controlling_option): New.
4909 (possible_null_deref::emit): Use it.
4910 (possible_null_arg::get_controlling_option): New.
4911 (possible_null_arg::emit): Use it.
4912 (null_deref::get_controlling_option): New.
4913 (null_deref::emit): Use it.
4914 (null_arg::get_controlling_option): New.
4915 (null_arg::emit): Use it.
4916 (use_after_free::get_controlling_option): New.
4917 (use_after_free::emit): Use it.
4918 (malloc_leak::get_controlling_option): New.
4919 (malloc_leak::emit): Use it.
4920 (free_of_non_heap::get_controlling_option): New.
4921 (free_of_non_heap::emit): Use it.
4922 * sm-pattern-test.cc (pattern_match::get_controlling_option): New.
4923 (pattern_match::emit): Use it.
4924 * sm-sensitive.cc
4925 (exposure_through_output_file::get_controlling_option): New.
4926 (exposure_through_output_file::emit): Use it.
4927 * sm-signal.cc (signal_unsafe_call::get_controlling_option): New.
4928 (signal_unsafe_call::emit): Use it.
4929 * sm-taint.cc (tainted_array_index::get_controlling_option): New.
4930 (tainted_array_index::emit): Use it.
4931 (tainted_offset::get_controlling_option): New.
4932 (tainted_offset::emit): Use it.
4933 (tainted_size::get_controlling_option): New.
4934 (tainted_size::emit): Use it.
4935 (tainted_divisor::get_controlling_option): New.
4936 (tainted_divisor::emit): Use it.
4937 (tainted_allocation_size::get_controlling_option): New.
4938 (tainted_allocation_size::emit): Use it.
4940 2022-03-15 David Malcolm <dmalcolm@redhat.com>
4942 * store.cc (store::store): Presize m_cluster_map.
4944 2022-03-10 David Malcolm <dmalcolm@redhat.com>
4946 PR analyzer/104863
4947 * constraint-manager.cc (constraint_manager::add_constraint):
4948 Refresh the EC IDs when adding constraints implied by offsets.
4950 2022-03-10 David Malcolm <dmalcolm@redhat.com>
4952 PR analyzer/104793
4953 * analyzer.h (class pending_note): New forward decl.
4954 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic):
4955 Initialize m_notes.
4956 (saved_diagnostic::operator==): Compare m_notes.
4957 (saved_diagnostic::add_note): New.
4958 (saved_diagnostic::emit_any_notes): New.
4959 (diagnostic_manager::add_note): New.
4960 (diagnostic_manager::emit_saved_diagnostic): Call emit_any_notes
4961 after emitting the warning.
4962 * diagnostic-manager.h (saved_diagnostic::add_note): New decl.
4963 (saved_diagnostic::emit_any_notes): New decl.
4964 (saved_diagnostic::m_notes): New field.
4965 (diagnostic_manager::add_note): New decl.
4966 * engine.cc (impl_region_model_context::add_note): New.
4967 * exploded-graph.h (impl_region_model_context::add_note): New
4968 decl.
4969 * pending-diagnostic.h (class pending_note): New.
4970 (class pending_note_subclass): New template.
4971 * region-model.cc (class reason_attr_access): New.
4972 (check_external_function_for_access_attr): Add class
4973 annotating_ctxt and use it when checking region.
4974 (noop_region_model_context::add_note): New.
4975 * region-model.h (region_model_context::add_note): New vfunc.
4976 (noop_region_model_context::add_note): New decl.
4977 (class region_model_context_decorator): New.
4978 (class note_adding_context): New.
4980 2022-03-10 David Malcolm <dmalcolm@redhat.com>
4982 PR analyzer/104793
4983 * region-model.cc
4984 (region_model::check_external_function_for_access_attr): New.
4985 (region_model::handle_unrecognized_call): Call it.
4986 * region-model.h
4987 (region_model::check_external_function_for_access_attr): New decl.
4988 (region_model::handle_unrecognized_call): New decl.
4990 2022-03-10 David Malcolm <dmalcolm@redhat.com>
4992 * sm-taint.cc (taint_state_machine::check_for_tainted_size_arg):
4993 Avoid generating duplicate saved_diagnostics by only handling the
4994 rdwr_map entry for the ptrarg, not the duplicate entry for the
4995 sizarg.
4997 2022-03-07 David Malcolm <dmalcolm@redhat.com>
4999 PR analyzer/101983
5000 * engine.cc (returning_from_function_p): New.
5001 (impl_region_model_context::on_state_leak): Use it when rejecting
5002 leaks at the return from "main".
5004 2022-03-07 Jakub Jelinek <jakub@redhat.com>
5006 * store.cc: Fix up duplicated word issue in a comment.
5007 * analyzer.cc: Likewise.
5008 * engine.cc: Likewise.
5009 * sm-taint.cc: Likewise.
5011 2022-03-04 David Malcolm <dmalcolm@redhat.com>
5013 PR analyzer/103521
5014 * analyzer.opt (-param=analyzer-max-svalue-depth=): Reduce from 13
5015 to 12.
5017 2022-02-23 David Malcolm <dmalcolm@redhat.com>
5019 PR analyzer/104434
5020 * analyzer.h (class const_fn_result_svalue): New decl.
5021 * region-model-impl-calls.cc (call_details::get_manager): New.
5022 * region-model-manager.cc
5023 (region_model_manager::get_or_create_const_fn_result_svalue): New.
5024 (region_model_manager::log_stats): Log
5025 m_const_fn_result_values_map.
5026 * region-model.cc (const_fn_p): New.
5027 (maybe_get_const_fn_result): New.
5028 (region_model::on_call_pre): Handle fndecls with
5029 __attribute__((const)) by calling the above rather than making
5030 a conjured_svalue.
5031 * region-model.h (visitor::visit_const_fn_result_svalue): New.
5032 (region_model_manager::get_or_create_const_fn_result_svalue): New
5033 decl.
5034 (region_model_manager::const_fn_result_values_map_t): New typedef.
5035 (region_model_manager::m_const_fn_result_values_map): New field.
5036 (call_details::get_manager): New decl.
5037 * svalue.cc (svalue::cmp_ptr): Handle SK_CONST_FN_RESULT.
5038 (const_fn_result_svalue::dump_to_pp): New.
5039 (const_fn_result_svalue::dump_input): New.
5040 (const_fn_result_svalue::accept): New.
5041 * svalue.h (enum svalue_kind): Add SK_CONST_FN_RESULT.
5042 (svalue::dyn_cast_const_fn_result_svalue): New.
5043 (class const_fn_result_svalue): New.
5044 (is_a_helper <const const_fn_result_svalue *>::test): New.
5045 (template <> struct default_hash_traits<const_fn_result_svalue::key_t>):
5046 New.
5048 2022-02-17 David Malcolm <dmalcolm@redhat.com>
5050 PR analyzer/104576
5051 * region-model.cc: Include "calls.h".
5052 (region_model::on_call_pre): Use flags_from_decl_or_type to
5053 generalize check for DECL_PURE_P to also check for ECF_CONST.
5055 2022-02-16 David Malcolm <dmalcolm@redhat.com>
5057 PR analyzer/104560
5058 * diagnostic-manager.cc (diagnostic_manager::build_emission_path):
5059 Add region creation events for globals of interest.
5060 (null_assignment_sm_context::get_old_program_state): New.
5061 (diagnostic_manager::add_events_for_eedge): Move check for
5062 changing dynamic extents from PK_BEFORE_STMT case to after the
5063 switch on the dst_point's kind so that we can emit them for the
5064 final stmt in a basic block.
5065 * engine.cc (impl_sm_context::get_old_program_state): New.
5066 * sm-malloc.cc (malloc_state_machine::get_default_state): Rewrite
5067 detection of m_non_heap to use get_memory_space.
5068 (free_of_non_heap::free_of_non_heap): Add freed_reg param.
5069 (free_of_non_heap::subclass_equal_p): Update for changes to
5070 fields.
5071 (free_of_non_heap::emit): Drop m_kind in favor of
5072 get_memory_space.
5073 (free_of_non_heap::describe_state_change): Remove logic for
5074 detecting alloca.
5075 (free_of_non_heap::mark_interesting_stuff): Add region-creation of
5076 m_freed_reg.
5077 (free_of_non_heap::get_memory_space): New.
5078 (free_of_non_heap::kind): Drop enum.
5079 (free_of_non_heap::m_freed_reg): New field.
5080 (free_of_non_heap::m_kind): Drop field.
5081 (malloc_state_machine::on_stmt): Drop transition to m_non_heap.
5082 (malloc_state_machine::handle_free_of_non_heap): New function,
5083 split out from on_deallocator_call and on_realloc_call, adding
5084 detection of the freed region.
5085 (malloc_state_machine::on_deallocator_call): Use it.
5086 (malloc_state_machine::on_realloc_call): Likewise.
5087 * sm.h (sm_context::get_old_program_state): New vfunc.
5089 2022-02-15 David Malcolm <dmalcolm@redhat.com>
5091 PR analyzer/104524
5092 * region-model-manager.cc
5093 (region_model_manager::maybe_fold_sub_svalue): Only call
5094 get_or_create_cast if type is non-NULL.
5096 2022-02-15 David Malcolm <dmalcolm@redhat.com>
5098 PR analyzer/102692
5099 * exploded-graph.h (impl_region_model_context::get_stmt): New.
5100 * region-model.cc: Include "gimple-ssa.h", "tree-phinodes.h",
5101 "tree-ssa-operands.h", and "ssa-iterators.h".
5102 (within_short_circuited_stmt_p): New.
5103 (region_model::check_for_poison): Don't warn about uninit values
5104 if within_short_circuited_stmt_p.
5105 * region-model.h (region_model_context::get_stmt): New vfunc.
5106 (noop_region_model_context::get_stmt): New.
5108 2022-02-11 David Malcolm <dmalcolm@redhat.com>
5110 PR analyzer/104274
5111 * region-model.cc (region_model::check_for_poison): Ignore
5112 uninitialized uses of empty types.
5114 2022-02-10 David Malcolm <dmalcolm@redhat.com>
5116 PR analyzer/98797
5117 * region-model-manager.cc
5118 (region_model_manager::maybe_fold_sub_svalue): Generalize getting
5119 individual chars of a STRING_CST from element_region to any
5120 subregion which is a concrete access of a single byte from its
5121 parent region.
5122 * region.cc (region::get_relative_concrete_byte_range): New.
5123 * region.h (region::get_relative_concrete_byte_range): New decl.
5125 2022-02-09 David Malcolm <dmalcolm@redhat.com>
5127 PR analyzer/104452
5128 * region-model.cc (selftest::test_bit_range_regions): New.
5129 (selftest::analyzer_region_model_cc_tests): Call it.
5130 * region.h (bit_range_region::key_t::hash): Fix hashing of m_bits
5131 to avoid using uninitialized data.
5133 2022-02-07 David Malcolm <dmalcolm@redhat.com>
5135 PR analyzer/104417
5136 * sm-taint.cc (tainted_allocation_size::tainted_allocation_size):
5137 Remove overzealous assertion.
5138 (tainted_allocation_size::emit): Likewise.
5139 (region_model::check_dynamic_size_for_taint): Likewise.
5141 2022-02-07 David Malcolm <dmalcolm@redhat.com>
5143 PR analyzer/103872
5144 * region-model-impl-calls.cc (region_model::impl_call_memcpy):
5145 Reimplement in terms of a get_store_value followed by a set_value.
5147 2022-02-03 David Malcolm <dmalcolm@redhat.com>
5149 PR analyzer/104369
5150 * engine.cc (exploded_graph::process_node): Use the node for any
5151 diagnostics, avoiding ICE if a bifurcation update adds a
5152 saved_diagnostic, such as for a tainted realloc size.
5153 * region-model-impl-calls.cc
5154 (region_model::impl_call_realloc::success_no_move::update_model):
5155 Require the old pointer to be non-NULL to be able successfully
5156 grow in place. Use model->deref_rvalue rather than maybe_get_region
5157 to support the old pointer being symbolic.
5158 (region_model::impl_call_realloc::success_with_move::update_model):
5159 Likewise. Add a constraint that the new pointer != the old pointer.
5160 Use a sized_region when setting the value of the new region.
5161 Handle the case where we don't know the dynamic size of the old
5162 region by marking the new region as unknown.
5163 * sm-taint.cc (tainted_allocation_size::tainted_allocation_size):
5164 Update assertion to also allow for MEMSPACE_UNKNOWN.
5165 (tainted_allocation_size::emit): Likewise.
5166 (region_model::check_dynamic_size_for_taint): Likewise.
5168 2022-02-03 David Malcolm <dmalcolm@redhat.com>
5170 * region-model-impl-calls.cc (region_model::impl_call_calloc): Use
5171 a sized_region when calling zero_fill_region.
5173 2022-02-02 David Malcolm <dmalcolm@redhat.com>
5175 * region-model.cc (region_model::on_return): Replace usage of
5176 copy_region with get_rvalue/set_value pair.
5177 (region_model::pop_frame): Likewise.
5178 (selftest::test_compound_assignment): Likewise.
5179 * region-model.h (region_model::copy_region): Delete decl.
5180 * region.cc (region_model::copy_region): Delete.
5182 2022-02-02 David Malcolm <dmalcolm@redhat.com>
5184 * region.cc (region::calc_offset): Consolidate effectively
5185 identical cases.
5187 2022-02-02 David Malcolm <dmalcolm@redhat.com>
5189 * analyzer.h (class bit_range_region): New forward decl.
5190 * region-model-manager.cc (region_model_manager::get_bit_range):
5191 New.
5192 (region_model_manager::log_stats): Handle m_bit_range_regions.
5193 * region-model.cc (region_model::get_lvalue_1): Handle
5194 BIT_FIELD_REF.
5195 * region-model.h (region_model_manager::get_bit_range): New decl.
5196 (region_model_manager::m_bit_range_regions): New field.
5197 * region.cc (region::get_base_region): Handle RK_BIT_RANGE.
5198 (region::base_region_p): Likewise.
5199 (region::calc_offset): Likewise.
5200 (bit_range_region::dump_to_pp): New.
5201 (bit_range_region::get_byte_size): New.
5202 (bit_range_region::get_bit_size): New.
5203 (bit_range_region::get_byte_size_sval): New.
5204 (bit_range_region::get_relative_concrete_offset): New.
5205 * region.h (enum region_kind): Add RK_BIT_RANGE.
5206 (region::dyn_cast_bit_range_region): New vfunc.
5207 (class bit_range_region): New.
5208 (is_a_helper <const bit_range_region *>::test): New.
5209 (default_hash_traits<bit_range_region::key_t>): New.
5211 2022-02-02 David Malcolm <dmalcolm@redhat.com>
5213 PR analyzer/104270
5214 * region-model.cc (region_model::on_call_pre): Handle
5215 IFN_DEFERRED_INIT.
5217 2022-01-27 David Malcolm <dmalcolm@redhat.com>
5219 * checker-path.cc (event_kind_to_string): Handle
5220 EK_REGION_CREATION.
5221 (region_creation_event::region_creation_event): New.
5222 (region_creation_event::get_desc): New.
5223 (checker_path::add_region_creation_event): New.
5224 * checker-path.h (enum event_kind): Add EK_REGION_CREATION.
5225 (class region_creation_event): New subclass.
5226 (checker_path::add_region_creation_event): New decl.
5227 * diagnostic-manager.cc
5228 (diagnostic_manager::emit_saved_diagnostic): Pass NULL for new
5229 param to add_events_for_eedge when handling trailing eedge.
5230 (diagnostic_manager::build_emission_path): Create an interesting_t
5231 instance, allow the pending diagnostic to populate it, and pass it
5232 to the calls to add_events_for_eedge.
5233 (diagnostic_manager::add_events_for_eedge): Add "interest" param.
5234 Use it to add region_creation_events for on-stack regions created
5235 within at function entry, and when pertinent dynamically-sized
5236 regions are created.
5237 (diagnostic_manager::prune_for_sm_diagnostic): Add case for
5238 EK_REGION_CREATION.
5239 * diagnostic-manager.h (diagnostic_manager::add_events_for_eedge):
5240 Add "interest" param.
5241 * pending-diagnostic.cc: Include "selftest.h", "tristate.h",
5242 "analyzer/call-string.h", "analyzer/program-point.h",
5243 "analyzer/store.h", and "analyzer/region-model.h".
5244 (interesting_t::add_region_creation): New.
5245 (interesting_t::dump_to_pp): New.
5246 * pending-diagnostic.h (struct interesting_t): New.
5247 (pending_diagnostic::mark_interesting_stuff): New vfunc.
5248 * region-model.cc
5249 (poisoned_value_diagnostic::poisoned_value_diagnostic): Add
5250 (poisoned_value_diagnostic::operator==): Compare m_pkind and
5251 m_src_region fields.
5252 (poisoned_value_diagnostic::mark_interesting_stuff): New.
5253 (poisoned_value_diagnostic::m_src_region): New.
5254 (region_model::check_for_poison): Call
5255 get_region_for_poisoned_expr for uninit values and pass the resul
5256 to the diagnostic.
5257 (region_model::get_region_for_poisoned_expr): New.
5258 (region_model::deref_rvalue): Pass NULL for
5259 poisoned_value_diagnostic's src_region.
5260 * region-model.h (region_model::get_region_for_poisoned_expr): New
5261 decl.
5262 * region.h (frame_region::get_fndecl): New.
5264 2022-01-27 Martin Liska <mliska@suse.cz>
5266 PR analyzer/104247
5267 * constraint-manager.cc (bounded_ranges_manager::log_stats):
5268 Cast to long for format purpose.
5269 * region-model-manager.cc (log_uniq_map): Likewise.
5271 2022-01-26 David Malcolm <dmalcolm@redhat.com>
5273 PR analyzer/104224
5274 * region-model.cc (region_model::check_call_args): New.
5275 (region_model::on_call_pre): Call it when ignoring stdio builtins.
5276 * region-model.h (region_model::check_call_args): New decl
5278 2022-01-26 David Malcolm <dmalcolm@redhat.com>
5280 PR analyzer/94362
5281 * constraint-manager.cc (range::add_bound): Fix tests for
5282 discarding redundant constraints. Perform test for rejecting
5283 unsatisfiable constraints earlier so that they don't update
5284 the object on failure.
5285 (selftest::test_range): New.
5286 (selftest::test_constant_comparisons): Add test coverage for
5287 existing constraints becoming narrower until they are
5288 unsatisfiable.
5289 (selftest::run_constraint_manager_tests): Call test_range.
5291 2022-01-22 David Malcolm <dmalcolm@redhat.com>
5293 PR analyzer/104159
5294 * region-model-manager.cc
5295 (region_model_manager::get_or_create_cast): Bail out if the types
5296 are the same. Don't attempt to handle casts involving vector
5297 types.
5299 2022-01-20 David Malcolm <dmalcolm@redhat.com>
5301 PR analyzer/94362
5302 * constraint-manager.cc (bound::ensure_closed): Convert param to
5303 enum bound_kind.
5304 (range::constrained_to_single_element): Likewise.
5305 (range::add_bound): New.
5306 (constraint_manager::add_constraint): Handle SVAL + OFFSET
5307 compared to a constant.
5308 (constraint_manager::get_ec_bounds): Rewrite in terms of
5309 range::add_bound.
5310 (constraint_manager::eval_condition): Reject if range::add_bound
5311 fails.
5312 (selftest::test_constant_comparisons): Add test coverage for
5313 various impossible combinations of integer comparisons.
5314 * constraint-manager.h (enum bound_kind): New.
5315 (struct bound): Likewise.
5316 (bound::ensure_closed): Convert to param to enum bound_kind.
5317 (struct range): Convert to...
5318 (class range): ...this, making fields private.
5319 (range::add_bound): New decls.
5320 * region-model.cc (region_model::add_constraint): Fail if
5321 constraint_manager::add_constraint fails.
5323 2022-01-18 David Malcolm <dmalcolm@redhat.com>
5325 PR analyzer/104089
5326 * region-model-manager.cc
5327 (region_model_manager::get_or_create_constant_svalue): Assert that
5328 we have a CONSTANT_CLASS_P.
5329 (region_model_manager::maybe_fold_unaryop): Only fold a constant
5330 when fold_unary's result is a constant or a cast of a constant.
5332 2022-01-18 David Malcolm <dmalcolm@redhat.com>
5334 PR analyzer/104062
5335 * region-model-manager.cc
5336 (region_model_manager::maybe_fold_sub_svalue): Avoid casting to
5337 NULL type when folding access to repeated svalue.
5339 2022-01-17 Martin Liska <mliska@suse.cz>
5341 * analyzer.cc (is_special_named_call_p): Rename .c names to .cc.
5342 (is_named_call_p): Likewise.
5343 * region-model-asm.cc (deterministic_p): Likewise.
5344 * region.cc (field_region::get_relative_concrete_offset): Likewise.
5345 * sm-malloc.cc (method_p): Likewise.
5346 * supergraph.cc (superedge::dump_dot): Likewise.
5348 2022-01-14 David Malcolm <dmalcolm@redhat.com>
5350 * sm-taint.cc (taint_state_machine::combine_states): Handle combination
5351 of has_ub and has_lb.
5353 2022-01-14 David Malcolm <dmalcolm@redhat.com>
5355 PR analyzer/104029
5356 * sm-taint.cc (taint_state_machine::alt_get_inherited_state):
5357 Remove gcc_unreachable from default case for unary ops.
5359 2022-01-14 David Malcolm <dmalcolm@redhat.com>
5361 * engine.cc: Include "stringpool.h", "attribs.h", and
5362 "tree-dfa.h".
5363 (mark_params_as_tainted): New.
5364 (class tainted_args_function_custom_event): New.
5365 (class tainted_args_function_info): New.
5366 (exploded_graph::add_function_entry): Handle functions with
5367 "tainted_args" attribute.
5368 (class tainted_args_field_custom_event): New.
5369 (class tainted_args_callback_custom_event): New.
5370 (class tainted_args_call_info): New.
5371 (add_tainted_args_callback): New.
5372 (add_any_callbacks): New.
5373 (exploded_graph::build_initial_worklist): Likewise.
5374 (exploded_graph::build_initial_worklist): Find callbacks that are
5375 reachable from global initializers, calling add_any_callbacks on
5376 them.
5378 2022-01-12 David Malcolm <dmalcolm@redhat.com>
5380 PR analyzer/103940
5381 * engine.cc (impl_sm_context::impl_sm_context): Add
5382 "unknown_side_effects" param and use it to initialize
5383 new m_unknown_side_effects field.
5384 (impl_sm_context::unknown_side_effects_p): New.
5385 (impl_sm_context::m_unknown_side_effects): New.
5386 (exploded_node::on_stmt): Pass unknown_side_effects to sm_ctxt
5387 ctor.
5388 * sm-taint.cc: Include "stringpool.h" and "attribs.h".
5389 (tainted_size::tainted_size): Drop "dir" param.
5390 (tainted_size::get_kind): Drop "FINAL".
5391 (tainted_size::emit): Likewise.
5392 (tainted_size::m_dir): Drop unused field.
5393 (class tainted_access_attrib_size): New subclass.
5394 (taint_state_machine::on_stmt): Call check_for_tainted_size_arg on
5395 external functions with unknown side effects.
5396 (taint_state_machine::check_for_tainted_size_arg): New.
5397 (region_model::check_region_for_taint): Drop "dir" param from
5398 tainted_size ctor.
5399 * sm.h (sm_context::unknown_side_effects_p): New.
5401 2022-01-11 David Malcolm <dmalcolm@redhat.com>
5403 PR analyzer/102692
5404 * diagnostic-manager.cc
5405 (class auto_disable_complexity_checks): Rename to...
5406 (class auto_checking_feasibility): ...this, updating
5407 the calls accordingly.
5408 (epath_finder::explore_feasible_paths): Update for renaming.
5409 * region-model-manager.cc
5410 (region_model_manager::region_model_manager): Update for change from
5411 m_check_complexity to m_checking_feasibility.
5412 (region_model_manager::reject_if_too_complex): Likewise.
5413 (region_model_manager::get_or_create_unknown_svalue): Handle
5414 m_checking_feasibility.
5415 (region_model_manager::create_unique_svalue): New.
5416 (region_model_manager::maybe_fold_binop): Handle BIT_AND_EXPR and
5417 BIT_IOR_EXPRs on booleans where we know the result.
5418 * region-model.cc (test_binop_svalue_folding): Add test coverage
5419 for the above.
5420 * region-model.h (region_model_manager::create_unique_svalue): New
5421 decl.
5422 (region_model_manager::enable_complexity_check): Replace with...
5423 (region_model_manager::begin_checking_feasibility): ...this.
5424 (region_model_manager::disable_complexity_check): Replace with...
5425 (region_model_manager::end_checking_feasibility): ...this.
5426 (region_model_manager::m_check_complexity): Replace with...
5427 (region_model_manager::m_checking_feasibility): ...this.
5428 (region_model_manager::m_managed_dynamic_svalues): New field.
5430 2022-01-08 David Malcolm <dmalcolm@redhat.com>
5432 * engine.cc (impl_run_checkers): Pass logger to engine ctor.
5433 * region-model-manager.cc
5434 (region_model_manager::region_model_manager): Add logger param and
5435 use it to initialize m_logger.
5436 * region-model.cc (engine::engine): New.
5437 * region-model.h (region_model_manager::region_model_manager):
5438 Add logger param.
5439 (region_model_manager::get_logger): New.
5440 (region_model_manager::m_logger): New field.
5441 (engine::engine): New.
5442 * store.cc (store_manager::get_logger): New.
5443 (store::set_value): Log scope. Log when marking a cluster as
5444 unknown due to possible aliasing.
5445 * store.h (store_manager::get_logger): New decl.
5447 2022-01-08 David Malcolm <dmalcolm@redhat.com>
5449 * region-model-impl-calls.cc (cmp_decls): New.
5450 (cmp_decls_ptr_ptr): New.
5451 (region_model::impl_call_analyzer_dump_escaped): New.
5452 * region-model.cc (region_model::on_stmt_pre): Handle
5453 __analyzer_dump_escaped.
5454 * region-model.h (region_model::impl_call_analyzer_dump_escaped):
5455 New decl.
5456 * store.h (binding_cluster::get_base_region): New accessor.
5458 2022-01-08 David Malcolm <dmalcolm@redhat.com>
5460 * region.cc (region::is_named_decl_p): New.
5461 * region.h (region::is_named_decl_p): New decl.
5463 2022-01-06 David Malcolm <dmalcolm@redhat.com>
5465 PR analyzer/103546
5466 * store.cc (store::eval_alias_1): Refactor handling of decl
5467 regions, adding a test for may_be_aliased, rejecting those for
5468 which it returns false.
5470 2021-12-12 Jonathan Wakely <jwakely@redhat.com>
5472 * engine.cc: Define INCLUDE_MEMORY instead of INCLUDE_UNIQUE_PTR.
5474 2021-12-06 David Malcolm <dmalcolm@redhat.com>
5476 PR analyzer/103533
5477 * constraint-manager.cc (equiv_class::contains_non_constant_p):
5478 New.
5479 (constraint_manager::canonicalize): Call it when determining
5480 redundant ECs.
5481 (selftest::test_purging): New selftest.
5482 (selftest::run_constraint_manager_tests): Likewise.
5483 * constraint-manager.h (equiv_class::contains_non_constant_p):
5484 New decl.
5486 2021-12-01 David Malcolm <dmalcolm@redhat.com>
5488 PR analyzer/102471
5489 * region-model-reachability.cc (reachable_regions::handle_parm):
5490 Treat all svalues within a compound parm has reachable, and those
5491 wrapped in a cast.
5493 2021-11-29 David Malcolm <dmalcolm@redhat.com>
5495 PR analyzer/103217
5496 * store.cc (binding_cluster::can_merge_p): For the "key is bound"
5497 vs "key is not bound" merger case, check that the bound svalue
5498 is mergeable before merging it to "unknown", rejecting the merger
5499 otherwise.
5501 2021-11-19 David Malcolm <dmalcolm@redhat.com>
5503 PR analyzer/103217
5504 * engine.cc (exploded_graph::get_or_create_node): Pass in
5505 m_ext_state to program_state::can_merge_with_p.
5506 (exploded_graph::process_worklist): Likewise.
5507 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
5508 Likewise.
5509 (exploded_graph::process_node): Add missing call to detect_leaks
5510 when handling phi nodes.
5511 * program-state.cc (program_state::can_merge_with_p): Add
5512 "ext_state" param. Pass it and state ptrs to
5513 region_model::can_merge_with_p.
5514 (selftest::test_program_state_merging): Update for new ext_state
5515 param of program_state::can_merge_with_p.
5516 (selftest::test_program_state_merging_2): Likewise.
5517 * program-state.h (program_state::can_purge_p): Make const.
5518 (program_state::can_merge_with_p): Add "ext_state" param.
5519 * region-model.cc: Include "analyzer/program-state.h".
5520 (region_model::can_merge_with_p): Add params "ext_state",
5521 "state_a", and "state_b", use them when creating model_merger
5522 object.
5523 (model_merger::mergeable_svalue_p): New.
5524 * region-model.h (region_model::can_merge_with_p): Add params
5525 "ext_state", "state_a", and "state_b".
5526 (model_merger::model_merger) Likewise, initializing new fields.
5527 (model_merger::mergeable_svalue_p): New decl.
5528 (model_merger::m_ext_state): New field.
5529 (model_merger::m_state_a): New field.
5530 (model_merger::m_state_b): New field.
5531 * svalue.cc (svalue::can_merge_p): Call
5532 model_merger::mergeable_svalue_p on both states and reject the
5533 merger accordingly.
5535 2021-11-17 David Malcolm <dmalcolm@redhat.com>
5537 PR analyzer/102695
5538 * region-model-impl-calls.cc (region_model::impl_call_strchr): New.
5539 * region-model-manager.cc
5540 (region_model_manager::maybe_fold_unaryop): Simplify cast to
5541 pointer type of an existing pointer to a region.
5542 * region-model.cc (region_model::on_call_pre): Handle
5543 BUILT_IN_STRCHR and "strchr".
5544 (write_to_const_diagnostic::emit): Add auto_diagnostic_group. Add
5545 alternate wordings for functions and labels.
5546 (write_to_const_diagnostic::describe_final_event): Add alternate
5547 wordings for functions and labels.
5548 (region_model::check_for_writable_region): Handle RK_FUNCTION and
5549 RK_LABEL.
5550 * region-model.h (region_model::impl_call_strchr): New decl.
5552 2021-11-16 David Malcolm <dmalcolm@redhat.com>
5554 PR analyzer/102662
5555 * constraint-manager.cc (bounded_range::operator==): Require the
5556 types to be the same for equality.
5558 2021-11-13 David Malcolm <dmalcolm@redhat.com>
5560 * analyzer.opt (Wanalyzer-tainted-allocation-size): New.
5561 (Wanalyzer-tainted-divisor): New.
5562 (Wanalyzer-tainted-offset): New.
5563 (Wanalyzer-tainted-size): New.
5564 * engine.cc (impl_region_model_context::get_taint_map): New.
5565 * exploded-graph.h (impl_region_model_context::get_taint_map):
5566 New decl.
5567 * program-state.cc (sm_state_map::get_state): Call
5568 alt_get_inherited_state.
5569 (sm_state_map::impl_set_state): Modify states within
5570 compound svalues.
5571 (program_state::impl_call_analyzer_dump_state): Undo casts.
5572 (selftest::test_program_state_1): Update for new context param of
5573 create_region_for_heap_alloc.
5574 (selftest::test_program_state_merging): Likewise.
5575 * region-model-impl-calls.cc (region_model::impl_call_alloca):
5576 Likewise.
5577 (region_model::impl_call_calloc): Likewise.
5578 (region_model::impl_call_malloc): Likewise.
5579 (region_model::impl_call_operator_new): Likewise.
5580 (region_model::impl_call_realloc): Likewise.
5581 * region-model.cc (region_model::check_region_access): Call
5582 check_region_for_taint.
5583 (region_model::get_representative_path_var_1): Handle binops.
5584 (region_model::create_region_for_heap_alloc): Add "ctxt" param and
5585 pass it to set_dynamic_extents.
5586 (region_model::create_region_for_alloca): Likewise.
5587 (region_model::set_dynamic_extents): Add "ctxt" param and use it
5588 to call check_dynamic_size_for_taint.
5589 (selftest::test_state_merging): Update for new context param of
5590 create_region_for_heap_alloc.
5591 (selftest::test_malloc_constraints): Likewise.
5592 (selftest::test_malloc): Likewise.
5593 (selftest::test_alloca): Likewise for create_region_for_alloca.
5594 * region-model.h (region_model::create_region_for_heap_alloc): Add
5595 "ctxt" param.
5596 (region_model::create_region_for_alloca): Likewise.
5597 (region_model::set_dynamic_extents): Likewise.
5598 (region_model::check_dynamic_size_for_taint): New decl.
5599 (region_model::check_region_for_taint): New decl.
5600 (region_model_context::get_taint_map): New vfunc.
5601 (noop_region_model_context::get_taint_map): New.
5602 * sm-taint.cc: Remove include of "diagnostic-event-id.h"; add
5603 includes of "gimple-iterator.h", "tristate.h", "selftest.h",
5604 "ordered-hash-map.h", "cgraph.h", "cfg.h", "digraph.h",
5605 "analyzer/supergraph.h", "analyzer/call-string.h",
5606 "analyzer/program-point.h", "analyzer/store.h",
5607 "analyzer/region-model.h", and "analyzer/program-state.h".
5608 (enum bounds): Move to top of file.
5609 (class taint_diagnostic): New.
5610 (class tainted_array_index): Convert to subclass of taint_diagnostic.
5611 (tainted_array_index::emit): Add CWE-129. Reword warning to use
5612 "attacker-controlled" rather than "tainted".
5613 (tainted_array_index::describe_state_change): Move to
5614 taint_diagnostic::describe_state_change.
5615 (tainted_array_index::describe_final_event): Reword to use
5616 "attacker-controlled" rather than "tainted".
5617 (class tainted_offset): New.
5618 (class tainted_size): New.
5619 (class tainted_divisor): New.
5620 (class tainted_allocation_size): New.
5621 (taint_state_machine::alt_get_inherited_state): New.
5622 (taint_state_machine::on_stmt): In assignment handling, remove
5623 ARRAY_REF handling in favor of check_region_for_taint. Add
5624 detection of tainted divisors.
5625 (taint_state_machine::get_taint): New.
5626 (taint_state_machine::combine_states): New.
5627 (region_model::check_region_for_taint): New.
5628 (region_model::check_dynamic_size_for_taint): New.
5629 * sm.h (state_machine::alt_get_inherited_state): New.
5631 2021-11-12 David Malcolm <dmalcolm@redhat.com>
5633 * engine.cc (exploded_node::on_stmt_pre): Return when handling
5634 "__analyzer_dump_state".
5636 2021-11-11 Richard Biener <rguenther@suse.de>
5638 * supergraph.cc: Include bitmap.h.
5640 2021-11-04 David Malcolm <dmalcolm@redhat.com>
5642 * program-state.cc (sm_state_map::dump): Use default_tree_printer
5643 as format decoder.
5645 2021-09-16 Maxim Blinov <maxim.blinov@embecosm.com>
5647 PR bootstrap/102242
5648 * engine.cc (INCLUDE_UNIQUE_PTR): Define.
5650 2021-09-08 David Malcolm <dmalcolm@redhat.com>
5652 PR analyzer/102225
5653 * analyzer.h (compat_types_p): New decl.
5654 * constraint-manager.cc
5655 (constraint_manager::get_or_add_equiv_class): Guard against NULL
5656 type when checking for pointer types.
5657 * region-model-impl-calls.cc (region_model::impl_call_realloc):
5658 Guard against NULL lhs type/region. Guard against the size value
5659 not being of a compatible type for dynamic extents.
5660 * region-model.cc (compat_types_p): Make non-static.
5662 2021-08-30 David Malcolm <dmalcolm@redhat.com>
5664 PR analyzer/99260
5665 * analyzer.h (class custom_edge_info): New class, adapted from
5666 exploded_edge::custom_info_t. Make member functions const.
5667 Make update_model return bool, converting edge param from
5668 reference to a pointer, and adding a ctxt param.
5669 (class path_context): New class.
5670 * call-info.cc: New file.
5671 * call-info.h: New file.
5672 * engine.cc: Include "analyzer/call-info.h" and <memory>.
5673 (impl_region_model_context::impl_region_model_context): Update for
5674 new m_path_ctxt field.
5675 (impl_region_model_context::bifurcate): New.
5676 (impl_region_model_context::terminate_path): New.
5677 (impl_region_model_context::get_malloc_map): New.
5678 (impl_sm_context::impl_sm_context): Update for new m_path_ctxt
5679 field.
5680 (impl_sm_context::get_fndecl_for_call): Likewise.
5681 (impl_sm_context::set_next_state): Likewise.
5682 (impl_sm_context::warn): Likewise.
5683 (impl_sm_context::is_zero_assignment): Likewise.
5684 (impl_sm_context::get_path_context): New.
5685 (impl_sm_context::m_path_ctxt): New.
5686 (impl_region_model_context::on_condition): Update for new
5687 path_ctxt param. Handle m_enode_for_diag being NULL.
5688 (impl_region_model_context::on_phi): Update for new path_ctxt
5689 param.
5690 (exploded_node::on_stmt): Add path_ctxt param, updating ctor calls
5691 to use it as necessary. Use it to bail out after sm-handling,
5692 if needed.
5693 (exploded_node::detect_leaks): Update for new path_ctxt param.
5694 (dynamic_call_info_t::update_model): Update for conversion of
5695 exploded_edge::custom_info_t to custom_edge_info.
5696 (dynamic_call_info_t::add_events_to_path): Likewise.
5697 (rewind_info_t::update_model): Likewise.
5698 (rewind_info_t::add_events_to_path): Likewise.
5699 (exploded_edge::exploded_edge): Likewise.
5700 (exploded_graph::add_edge): Likewise.
5701 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
5702 Update for new path_ctxt param.
5703 (class impl_path_context): New.
5704 (exploded_graph::process_node): Update for new path_ctxt param.
5705 Create an impl_path_context and pass it to exploded_node::on_stmt.
5706 Use it to terminate iterating stmts if terminate_path is called
5707 on it. After processing a run of stmts, query path_ctxt to
5708 potentially terminate the analysis path, and/or to "bifurcate" the
5709 analysis into multiple additional paths.
5710 (feasibility_state::maybe_update_for_edge): Update for new
5711 update_model ctxt param.
5712 * exploded-graph.h
5713 (impl_region_model_context::impl_region_model_context): Add
5714 path_ctxt param.
5715 (impl_region_model_context::bifurcate): New.
5716 (impl_region_model_context::terminate_path): New
5717 (impl_region_model_context::get_ext_state): New.
5718 (impl_region_model_context::get_malloc_map): New.
5719 (impl_region_model_context::m_path_ctxt): New field.
5720 (exploded_node::on_stmt): Add path_ctxt param.
5721 (class exploded_edge::custom_info_t): Move to analyzer.h, renaming
5722 to custom_edge_info, and making the changes as noted in analyzer.h
5723 above.
5724 (exploded_edge::exploded_edge): Update for these changes to
5725 exploded_edge::custom_info_t.
5726 (exploded_edge::m_custom_info): Likewise.
5727 (class dynamic_call_info_t): Likewise.
5728 (class rewind_info_t): Likewise.
5729 (exploded_graph::add_edge): Likewise.
5730 * program-state.cc (program_state::on_edge): Update for new
5731 path_ctxt param.
5732 (program_state::push_call): Likewise.
5733 (program_state::returning_call): Likewise.
5734 (program_state::prune_for_point): Likewise.
5735 * region-model-impl-calls.cc: Include "analyzer/call-info.h".
5736 (call_details::get_fndecl_for_call): New.
5737 (region_model::impl_call_realloc): Reimplement.
5738 * region-model.cc (region_model::on_call_pre): Move call to
5739 impl_call_realloc to...
5740 (region_model::on_call_post): ...here. Consolidate creation
5741 of call_details instance.
5742 (noop_region_model_context::bifurcate): New.
5743 (noop_region_model_context::terminate_path): New.
5744 * region-model.h (call_details::get_call_stmt): New.
5745 (call_details::get_fndecl_for_call): New.
5746 (region_model::on_realloc_with_move): New.
5747 (region_model_context::bifurcate): New.
5748 (region_model_context::terminate_path): New.
5749 (region_model_context::get_ext_state): New.
5750 (region_model_context::get_malloc_map): New.
5751 (noop_region_model_context::bifurcate): New.
5752 (noop_region_model_context::terminate_path): New.
5753 (noop_region_model_context::get_ext_state): New.
5754 (noop_region_model_context::get_malloc_map): New.
5755 * sm-malloc.cc: Include "analyzer/program-state.h".
5756 (malloc_state_machine::on_realloc_call): Reimplement.
5757 (malloc_state_machine::on_realloc_with_move): New.
5758 (region_model::on_realloc_with_move): New.
5759 * sm-signal.cc (class signal_delivery_edge_info_t): Update for
5760 conversion from exploded_edge::custom_info_t to custom_edge_info.
5761 * sm.h (sm_context::get_path_context): New.
5762 * svalue.cc (svalue::maybe_get_constant): Call
5763 unwrap_any_unmergeable.
5765 2021-08-25 Ankur Saini <arsenic@sourceware.org>
5767 PR analyzer/101980
5768 * engine.cc (exploded_graph::maybe_create_dynamic_call): Don't create
5769 calls if max recursion limit is reached.
5771 2021-08-23 David Malcolm <dmalcolm@redhat.com>
5773 * analyzer.h (struct rejected_constraint): Convert to...
5774 (class rejected_constraint): ...this.
5775 (class bounded_ranges): New forward decl.
5776 (class bounded_ranges_manager): New forward decl.
5777 * constraint-manager.cc: Include "analyzer/analyzer-logging.h" and
5778 "tree-pretty-print.h".
5779 (can_plus_one_p): New.
5780 (plus_one): New.
5781 (can_minus_one_p): New.
5782 (minus_one): New.
5783 (bounded_range::bounded_range): New.
5784 (dump_cst): New.
5785 (bounded_range::dump_to_pp): New.
5786 (bounded_range::dump): New.
5787 (bounded_range::to_json): New.
5788 (bounded_range::set_json_attr): New.
5789 (bounded_range::contains_p): New.
5790 (bounded_range::intersects_p): New.
5791 (bounded_range::operator==): New.
5792 (bounded_range::cmp): New.
5793 (bounded_ranges::bounded_ranges): New.
5794 (bounded_ranges::bounded_ranges): New.
5795 (bounded_ranges::bounded_ranges): New.
5796 (bounded_ranges::canonicalize): New.
5797 (bounded_ranges::validate): New.
5798 (bounded_ranges::operator==): New.
5799 (bounded_ranges::dump_to_pp): New.
5800 (bounded_ranges::dump): New.
5801 (bounded_ranges::to_json): New.
5802 (bounded_ranges::eval_condition): New.
5803 (bounded_ranges::contain_p): New.
5804 (bounded_ranges::cmp): New.
5805 (bounded_ranges_manager::~bounded_ranges_manager): New.
5806 (bounded_ranges_manager::get_or_create_empty): New.
5807 (bounded_ranges_manager::get_or_create_point): New.
5808 (bounded_ranges_manager::get_or_create_range): New.
5809 (bounded_ranges_manager::get_or_create_union): New.
5810 (bounded_ranges_manager::get_or_create_intersection): New.
5811 (bounded_ranges_manager::get_or_create_inverse): New.
5812 (bounded_ranges_manager::consolidate): New.
5813 (bounded_ranges_manager::get_or_create_ranges_for_switch): New.
5814 (bounded_ranges_manager::create_ranges_for_switch): New.
5815 (bounded_ranges_manager::make_case_label_ranges): New.
5816 (bounded_ranges_manager::log_stats): New.
5817 (bounded_ranges_constraint::print): New.
5818 (bounded_ranges_constraint::to_json): New.
5819 (bounded_ranges_constraint::operator==): New.
5820 (bounded_ranges_constraint::add_to_hash): New.
5821 (constraint_manager::constraint_manager): Update for new field
5822 m_bounded_ranges_constraints.
5823 (constraint_manager::operator=): Likewise.
5824 (constraint_manager::hash): Likewise.
5825 (constraint_manager::operator==): Likewise.
5826 (constraint_manager::print): Likewise.
5827 (constraint_manager::dump_to_pp): Likewise.
5828 (constraint_manager::to_json): Likewise.
5829 (constraint_manager::add_unknown_constraint): Update the lhs_ec_id
5830 if necessary in existing constraints when combining equivalence
5831 classes. Add similar code for handling
5832 m_bounded_ranges_constraints.
5833 (constraint_manager::add_constraint_internal): Add comment.
5834 (constraint_manager::add_bounded_ranges): New.
5835 (constraint_manager::eval_condition): Use new field
5836 m_bounded_ranges_constraints.
5837 (constraint_manager::purge): Update bounded_ranges_constraint
5838 instances.
5839 (constraint_manager::canonicalize): Update for new field.
5840 (merger_fact_visitor::on_ranges): New.
5841 (constraint_manager::for_each_fact): Use new field
5842 m_bounded_ranges_constraints.
5843 (constraint_manager::validate): Fix off-by-one error needed due
5844 to bug fixed above in add_unknown_constraint. Validate the EC IDs
5845 in m_bounded_ranges_constraints.
5846 (constraint_manager::get_range_manager): New.
5847 (selftest::assert_dump_bounded_range_eq): New.
5848 (ASSERT_DUMP_BOUNDED_RANGE_EQ): New.
5849 (selftest::test_bounded_range): New.
5850 (selftest::assert_dump_bounded_ranges_eq): New.
5851 (ASSERT_DUMP_BOUNDED_RANGES_EQ): New.
5852 (selftest::test_bounded_ranges): New.
5853 (selftest::run_constraint_manager_tests): Call the new selftests.
5854 * constraint-manager.h (struct bounded_range): New.
5855 (struct bounded_ranges): New.
5856 (template <> struct default_hash_traits<bounded_ranges::key_t>): New.
5857 (class bounded_ranges_manager): New.
5858 (fact_visitor::on_ranges): New pure virtual function.
5859 (class bounded_ranges_constraint): New.
5860 (constraint_manager::add_bounded_ranges): New decl.
5861 (constraint_manager::get_range_manager): New decl.
5862 (constraint_manager::m_bounded_ranges_constraints): New field.
5863 * diagnostic-manager.cc (epath_finder::process_worklist_item):
5864 Transfer ownership of rc to add_feasibility_problem.
5865 * engine.cc (feasibility_problem::dump_to_pp): Use get_model.
5866 * feasible-graph.cc (infeasible_node::dump_dot): Update for
5867 conversion of m_rc to a pointer.
5868 (feasible_graph::add_feasibility_problem): Pass RC by pointer and
5869 take ownership.
5870 * feasible-graph.h (infeasible_node::infeasible_node): Pass RC by
5871 pointer and take ownership.
5872 (infeasible_node::~infeasible_node): New.
5873 (infeasible_node::m_rc): Convert to a pointer.
5874 (feasible_graph::add_feasibility_problem): Pass RC by pointer and
5875 take ownership.
5876 * region-model-manager.cc: Include
5877 "analyzer/constraint-manager.h".
5878 (region_model_manager::region_model_manager): Initializer new
5879 field m_range_mgr.
5880 (region_model_manager::~region_model_manager): Delete it.
5881 (region_model_manager::log_stats): Call log_stats on it.
5882 * region-model.cc (region_model::add_constraint): Use new subclass
5883 rejected_op_constraint.
5884 (region_model::apply_constraints_for_gswitch): Reimplement using
5885 bounded_ranges_manager.
5886 (rejected_constraint::dump_to_pp): Convert to...
5887 (rejected_op_constraint::dump_to_pp): ...this.
5888 (rejected_ranges_constraint::dump_to_pp): New.
5889 * region-model.h (struct purge_stats): Add field
5890 m_num_bounded_ranges_constraints.
5891 (region_model_manager::get_range_manager): New.
5892 (region_model_manager::m_range_mgr): New.
5893 (region_model::get_range_manager): New.
5894 (struct rejected_constraint): Split into...
5895 (class rejected_constraint):...this new abstract base class,
5896 and...
5897 (class rejected_op_constraint): ...this new concrete subclass.
5898 (class rejected_ranges_constraint): New.
5899 * supergraph.cc: Include "tree-cfg.h".
5900 (supergraph::supergraph): Drop idx param from add_cfg_edge.
5901 (supergraph::add_cfg_edge): Drop idx param.
5902 (switch_cfg_superedge::switch_cfg_superedge): Move here from
5903 header. Populate m_case_labels with all cases which go to DST.
5904 (switch_cfg_superedge::dump_label_to_pp): Reimplement to use
5905 m_case_labels.
5906 (switch_cfg_superedge::get_case_label): Delete.
5907 * supergraph.h (supergraphadd_cfg_edge): Drop "idx" param.
5908 (switch_cfg_superedge::switch_cfg_superedge): Drop idx param and
5909 move implementation to supergraph.cc.
5910 (switch_cfg_superedge::get_case_label): Delete.
5911 (switch_cfg_superedge::get_case_labels): New.
5912 (switch_cfg_superedge::m_idx): Delete.
5913 (switch_cfg_superedge::m_case_labels): New field.
5915 2021-08-23 David Malcolm <dmalcolm@redhat.com>
5917 PR analyzer/101875
5918 * sm-file.cc (file_diagnostic::describe_state_change): Handle
5919 change.m_expr being NULL.
5921 2021-08-23 David Malcolm <dmalcolm@redhat.com>
5923 PR analyzer/101837
5924 * analyzer.cc (maybe_reconstruct_from_def_stmt): Bail if fn is
5925 NULL, and assert that it's non-NULL before passing it to
5926 build_call_array_loc.
5928 2021-08-23 David Malcolm <dmalcolm@redhat.com>
5930 PR analyzer/101962
5931 * region-model.cc (region_model::eval_condition_without_cm):
5932 Refactor comparison against zero, adding a check for
5933 POINTER_PLUS_EXPR of non-NULL.
5935 2021-08-23 David Malcolm <dmalcolm@redhat.com>
5937 * store.cc (bit_range::intersects_p): New overload.
5938 (bit_range::operator-): New.
5939 (binding_cluster::maybe_get_compound_binding): Handle the partial
5940 overlap case.
5941 (selftest::test_bit_range_intersects_p): Add test coverage for
5942 new overload of bit_range::intersects_p.
5943 * store.h (bit_range::intersects_p): New overload.
5944 (bit_range::operator-): New.
5946 2021-08-23 Ankur Saini <arsenic@sourceware.org>
5948 PR analyzer/102020
5949 * diagnostic-manager.cc
5950 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>: Fix typo.
5952 2021-08-21 Ankur Saini <arsenic@sourceware.org>
5954 PR analyzer/101980
5955 * diagnostic-manager.cc
5956 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>: Use
5957 caller_model only when the supergraph_edge doesn't exixt.
5958 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_RETURN_EDGE>:
5959 Likewise.
5960 * engine.cc (exploded_graph::create_dynamic_call): Rename to...
5961 (exploded_graph::maybe_create_dynamic_call): ...this, return call
5962 creation status.
5963 (exploded_graph::process_node): Handle calls which were not dynamically
5964 discovered.
5965 * exploded-graph.h (exploded_graph::create_dynamic_call): Rename to...
5966 (exploded_graph::maybe_create_dynamic_call): ...this.
5967 * region-model.cc (region_model::update_for_gcall): New param, use it
5968 to push call to frame.
5969 (region_model::update_for_call_superedge): Pass callee function to
5970 update_for_gcall.
5971 * region-model.h (region_model::update_for_gcall): New param.
5973 2021-08-18 Ankur Saini <arsenic@sourceware.org>
5975 PR analyzer/97114
5976 * region-model.cc (region_model::get_rvalue_1): Add case for
5977 OBJ_TYPE_REF.
5979 2021-08-18 Ankur Saini <arsenic@sourceware.org>
5981 PR analyzer/100546
5982 * analysis-plan.cc (analysis_plan::use_summary_p): Don't use call
5983 summaries if there is no callgraph edge
5984 * checker-path.cc (call_event::call_event): Handle calls events that
5985 are not represented by a supergraph call edge
5986 (return_event::return_event): Likewise.
5987 (call_event::get_desc): Work with new call_event structure.
5988 (return_event::get_desc): Likeise.
5989 * checker-path.h (call_event::m_src_snode): New field.
5990 (call_event::m_dest_snode): New field.
5991 (return_event::m_src_snode): New field.
5992 (return_event::m_dest_snode): New field.
5993 * diagnostic-manager.cc
5994 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>:
5995 Refactor to work with edges without callgraph edge.
5996 (diagnostic_manager::prune_for_sm_diagnostic)<case EK_RETURN_EDGE>:
5997 Likewise.
5998 * engine.cc (dynamic_call_info_t::update_model): New function.
5999 (dynamic_call_info_t::add_events_to_path): New function.
6000 (exploded_graph::create_dynamic_call): New function.
6001 (exploded_graph::process_node): Work with dynamically discovered calls.
6002 * exploded-graph.h (class dynamic_call_info_t): New class.
6003 (exploded_graph::create_dynamic_call): New decl.
6004 * program-point.cc (program_point::push_to_call_stack): New function.
6005 (program_point::pop_from_call_stack): New function.
6006 * program-point.h (program_point::push_to_call_stack): New decl.
6007 (program_point::pop_from_call_stack): New decl.
6008 * program-state.cc (program_state::push_call): New function.
6009 (program_state::returning_call): New function.
6010 * program-state.h (program_state::push_call): New decl.
6011 (program_state::returning_call): New decl.
6012 * region-model.cc (region_model::update_for_gcall) New function.
6013 (region_model::update_for_return_gcall): New function.
6014 (egion_model::update_for_call_superedge): Get the underlying gcall and
6015 update for gcall.
6016 (region_model::update_for_return_superedge): Likewise.
6017 * region-model.h (region_model::update_for_gcall): New decl.
6018 (region_model::update_for_return_gcall): New decl.
6019 * state-purge.cc (state_purge_per_ssa_name::process_point): Update to
6020 work with calls without underlying cgraph edge.
6021 * supergraph.cc (supergraph::supergraph) Split snodes at every callsite.
6022 * supergraph.h (supernode::get_returning_call) New accessor.
6024 2021-08-04 David Malcolm <dmalcolm@redhat.com>
6026 PR analyzer/101570
6027 * analyzer.cc (maybe_reconstruct_from_def_stmt): Add GIMPLE_ASM
6028 case.
6029 * analyzer.h (class asm_output_svalue): New forward decl.
6030 (class reachable_regions): New forward decl.
6031 * complexity.cc (complexity::from_vec_svalue): New.
6032 * complexity.h (complexity::from_vec_svalue): New decl.
6033 * engine.cc (feasibility_state::maybe_update_for_edge): Handle
6034 asm stmts by calling on_asm_stmt.
6035 * region-model-asm.cc: New file.
6036 * region-model-manager.cc
6037 (region_model_manager::maybe_fold_asm_output_svalue): New.
6038 (region_model_manager::get_or_create_asm_output_svalue): New.
6039 (region_model_manager::log_stats): Log m_asm_output_values_map.
6040 * region-model.cc (region_model::on_stmt_pre): Handle GIMPLE_ASM.
6041 * region-model.h (visitor::visit_asm_output_svalue): New.
6042 (region_model_manager::get_or_create_asm_output_svalue): New decl.
6043 (region_model_manager::maybe_fold_asm_output_svalue): New decl.
6044 (region_model_manager::asm_output_values_map_t): New typedef.
6045 (region_model_manager::m_asm_output_values_map): New field.
6046 (region_model::on_asm_stmt): New.
6047 * store.cc (binding_cluster::on_asm): New.
6048 * store.h (binding_cluster::on_asm): New decl.
6049 * svalue.cc (svalue::cmp_ptr): Handle SK_ASM_OUTPUT.
6050 (asm_output_svalue::dump_to_pp): New.
6051 (asm_output_svalue::dump_input): New.
6052 (asm_output_svalue::input_idx_to_asm_idx): New.
6053 (asm_output_svalue::accept): New.
6054 * svalue.h (enum svalue_kind): Add SK_ASM_OUTPUT.
6055 (svalue::dyn_cast_asm_output_svalue): New.
6056 (class asm_output_svalue): New.
6057 (is_a_helper <const asm_output_svalue *>::test): New.
6058 (struct default_hash_traits<asm_output_svalue::key_t>): New.
6060 2021-08-03 Jakub Jelinek <jakub@redhat.com>
6062 PR analyzer/101721
6063 * sm-malloc.cc (known_allocator_p): Only check DECL_FUNCTION_CODE on
6064 BUILT_IN_NORMAL builtins.
6066 2021-07-29 Ankur Saini <arsenic@sourceware.org>
6068 * call-string.cc (call_string::element_t::operator==): New operator.
6069 (call_String::element_t::operator!=): New operator.
6070 (call_string::element_t::get_caller_function): New function.
6071 (call_string::element_t::get_callee_function): New function.
6072 (call_string::call_string): Refactor to Initialise m_elements.
6073 (call_string::operator=): Refactor to work with m_elements.
6074 (call_string::operator==): Likewise.
6075 (call_string::to_json): Likewise.
6076 (call_string::hash): Refactor to hash e.m_caller.
6077 (call_string::push_call): Refactor to work with m_elements.
6078 (call_string::push_call): New overload to push call via supernodes.
6079 (call_string::pop): Refactor to work with m_elements.
6080 (call_string::calc_recursion_depth): Likewise.
6081 (call_string::cmp): Likewise.
6082 (call_string::validate): Likewise.
6083 (call_string::operator[]): Likewise.
6084 * call-string.h (class supernode): New forward decl.
6085 (struct call_string::element_t): New struct.
6086 (call_string::call_string): Refactor to initialise m_elements.
6087 (call_string::bool empty_p): Refactor to work with m_elements.
6088 (call_string::get_callee_node): New decl.
6089 (call_string::get_caller_node): New decl.
6090 (m_elements): Replaces m_return_edges.
6091 * program-point.cc (program_point::get_function_at_depth): Refactor to
6092 work with new call-string format.
6093 (program_point::validate): Likewise.
6094 (program_point::on_edge): Likewise.
6096 2021-07-28 David Malcolm <dmalcolm@redhat.com>
6098 * region-model.cc (region_model::on_call_pre): Treat
6099 IFN_UBSAN_BOUNDS, BUILT_IN_STACK_SAVE, and BUILT_IN_STACK_RESTORE
6100 as no-ops, rather than handling them as unknown functions.
6102 2021-07-28 David Malcolm <dmalcolm@redhat.com>
6104 * region-model-impl-calls.cc (region_model::impl_call_alloca):
6105 Drop redundant return value.
6106 (region_model::impl_call_builtin_expect): Likewise.
6107 (region_model::impl_call_calloc): Likewise.
6108 (region_model::impl_call_malloc): Likewise.
6109 (region_model::impl_call_memset): Likewise.
6110 (region_model::impl_call_operator_new): Likewise.
6111 (region_model::impl_call_operator_delete): Likewise.
6112 (region_model::impl_call_strlen): Likewise.
6113 * region-model.cc (region_model::on_call_pre): Fix return value of
6114 known functions that don't have unknown side-effects.
6115 * region-model.h (region_model::impl_call_alloca): Drop redundant
6116 return value.
6117 (region_model::impl_call_builtin_expect): Likewise.
6118 (region_model::impl_call_calloc): Likewise.
6119 (region_model::impl_call_malloc): Likewise.
6120 (region_model::impl_call_memset): Likewise.
6121 (region_model::impl_call_strlen): Likewise.
6122 (region_model::impl_call_operator_new): Likewise.
6123 (region_model::impl_call_operator_delete): Likewise.
6125 2021-07-28 Siddhesh Poyarekar <siddhesh@gotplt.org>
6127 * analyzer.cc (is_named_call_p, is_std_named_call_p): Make
6128 first argument a const_tree.
6129 * analyzer.h (is_named_call_p, -s_std_named_call_p): Likewise.
6130 * sm-malloc.cc (known_allocator_p): New function.
6131 (malloc_state_machine::on_stmt): Use it.
6133 2021-07-28 Siddhesh Poyarekar <siddhesh@gotplt.org>
6135 * sm-malloc.cc
6136 (malloc_state_machine::get_or_create_deallocator): Recognize
6137 __builtin_free.
6139 2021-07-26 David Malcolm <dmalcolm@redhat.com>
6141 * region-model.cc (region_model::on_call_pre): Always set conjured
6142 LHS, not just for SSA names.
6144 2021-07-23 David Malcolm <dmalcolm@redhat.com>
6146 * diagnostic-manager.cc
6147 (class auto_disable_complexity_checks): New.
6148 (epath_finder::explore_feasible_paths): Use it to disable
6149 complexity checks whilst processing the worklist.
6150 * region-model-manager.cc
6151 (region_model_manager::region_model_manager): Initialize
6152 m_check_complexity.
6153 (region_model_manager::reject_if_too_complex): Bail if
6154 m_check_complexity is false.
6155 * region-model.h
6156 (region_model_manager::enable_complexity_check): New.
6157 (region_model_manager::disable_complexity_check): New.
6158 (region_model_manager::m_check_complexity): New.
6160 2021-07-21 David Malcolm <dmalcolm@redhat.com>
6162 PR analyzer/101547
6163 * sm-file.cc (file_leak::emit): Handle m_arg being NULL.
6164 (file_leak::describe_final_event): Handle ev.m_expr being NULL.
6166 2021-07-21 David Malcolm <dmalcolm@redhat.com>
6168 PR analyzer/101522
6169 * store.cc (binding_cluster::purge_state_involving): Don't change
6170 m_map whilst iterating through it.
6172 2021-07-21 David Malcolm <dmalcolm@redhat.com>
6174 * region-model.cc (region_model::handle_phi): Add "old_state"
6175 param and use it.
6176 (region_model::update_for_phis): Update so that all of the phi
6177 stmts are effectively handled simultaneously, rather than in
6178 order.
6179 * region-model.h (region_model::handle_phi): Add "old_state"
6180 param.
6181 * state-purge.cc (self_referential_phi_p): Replace with...
6182 (name_used_by_phis_p): ...this new function.
6183 (state_purge_per_ssa_name::process_point): Update to use the
6184 above, so that all phi stmts at a basic block are effectively
6185 considered simultaneously, and only consider the phi arguments for
6186 the pertinent in-edge.
6187 * supergraph.cc (cfg_superedge::get_phi_arg_idx): New.
6188 (cfg_superedge::get_phi_arg): Use the above.
6189 * supergraph.h (cfg_superedge::get_phi_arg_idx): New decl.
6191 2021-07-21 David Malcolm <dmalcolm@redhat.com>
6193 * state-purge.cc (state_purge_annotator::add_node_annotations):
6194 Rather than erroneously always using the NULL in-edge, determine
6195 each relevant in-edge, and print the appropriate data for each
6196 in-edge. Use print_needed to print the data as comma-separated
6197 lists of SSA names.
6198 (print_vec_of_names): Add "within_table" param and use it.
6199 (state_purge_annotator::add_stmt_annotations): Factor out
6200 collation and printing code into...
6201 (state_purge_annotator::print_needed): ...this new function.
6202 * state-purge.h (state_purge_annotator::print_needed): New decl.
6204 2021-07-21 David Malcolm <dmalcolm@redhat.com>
6206 * program-point.cc (function_point::print): Show src BB index at
6207 BEFORE_SUPERNODE.
6209 2021-07-21 David Malcolm <dmalcolm@redhat.com>
6211 * svalue.cc (infix_p): New.
6212 (binop_svalue::dump_to_pp): Use it to print MIN_EXPR and MAX_EXPR
6213 in prefix form, rather than infix.
6215 2021-07-19 David Malcolm <dmalcolm@redhat.com>
6217 PR analyzer/101503
6218 * constraint-manager.cc (constraint_manager::add_constraint): Use
6219 can_have_associated_state_p rather than testing for unknown.
6220 (constraint_manager::get_or_add_equiv_class): Likewise.
6221 * program-state.cc (sm_state_map::set_state): Likewise.
6222 (sm_state_map::impl_set_state): Add assertion.
6223 * region-model-manager.cc
6224 (region_model_manager::maybe_fold_unaryop): Handle poisoned
6225 values.
6226 (region_model_manager::maybe_fold_binop): Move handling of unknown
6227 values...
6228 (region_model_manager::get_or_create_binop): ...to here, and
6229 generalize to use can_have_associated_state_p.
6230 (region_model_manager::maybe_fold_sub_svalue): Use
6231 can_have_associated_state_p rather than testing for unknown.
6232 (region_model_manager::maybe_fold_repeated_svalue): Use unknown
6233 when the size or repeated value is "unknown"/"poisoned".
6234 * region-model.cc (region_model::purge_state_involving): Reject
6235 attempts to purge unknown/poisoned svalues, as these svalues
6236 should not have state associated with them.
6237 * svalue.cc (sub_svalue::sub_svalue): Assert that we're building
6238 on top of an svalue with can_have_associated_state_p.
6239 (repeated_svalue::repeated_svalue): Likewise.
6240 (bits_within_svalue::bits_within_svalue): Likewise.
6241 * svalue.h (svalue::can_have_associated_state_p): New.
6242 (unknown_svalue::can_have_associated_state_p): New.
6243 (poisoned_svalue::can_have_associated_state_p): New.
6244 (unaryop_svalue::unaryop_svalue): Assert that we're building on
6245 top of an svalue with can_have_associated_state_p.
6246 (binop_svalue::binop_svalue): Likewise.
6247 (widening_svalue::widening_svalue): Likewise.
6249 2021-07-16 David Malcolm <dmalcolm@redhat.com>
6251 * analyzer.h (enum access_direction): New.
6252 * engine.cc (exploded_node::on_longjmp): Update for new param of
6253 get_store_value.
6254 * program-state.cc (program_state::prune_for_point): Likewise.
6255 * region-model-impl-calls.cc (region_model::impl_call_memcpy):
6256 Replace call to check_for_writable_region with call to
6257 check_region_for_write.
6258 (region_model::impl_call_memset): Likewise.
6259 (region_model::impl_call_strcpy): Likewise.
6260 * region-model-reachability.cc (reachable_regions::add): Update
6261 for new param of get_store_value.
6262 * region-model.cc (region_model::get_rvalue_1): Likewise, also for
6263 get_rvalue_for_bits.
6264 (region_model::get_store_value): Add ctxt param and use it to call
6265 check_region_for_read.
6266 (region_model::get_rvalue_for_bits): Add ctxt param and use it to
6267 call get_store_value.
6268 (region_model::check_region_access): New.
6269 (region_model::check_region_for_write): New.
6270 (region_model::check_region_for_read): New.
6271 (region_model::set_value): Update comment. Replace call to
6272 check_for_writable_region with call to check_region_for_write.
6273 * region-model.h (region_model::get_rvalue_for_bits): Add ctxt
6274 param.
6275 (region_model::get_store_value): Add ctxt param.
6276 (region_model::check_region_access): New decl.
6277 (region_model::check_region_for_write): New decl.
6278 (region_model::check_region_for_read): New decl.
6279 * region.cc (region_model::copy_region): Update call to
6280 get_store_value.
6281 * svalue.cc (initial_svalue::implicitly_live_p): Likewise.
6283 2021-07-16 David Malcolm <dmalcolm@redhat.com>
6285 * engine.cc (exploded_node::on_stmt_pre): Handle
6286 __analyzer_dump_state.
6287 * program-state.cc (extrinsic_state::get_sm_idx_by_name): New.
6288 (program_state::impl_call_analyzer_dump_state): New.
6289 * program-state.h (extrinsic_state::get_sm_idx_by_name): New decl.
6290 (program_state::impl_call_analyzer_dump_state): New decl.
6291 * region-model-impl-calls.cc
6292 (call_details::get_arg_string_literal): New.
6293 * region-model.h (call_details::get_arg_string_literal): New decl.
6295 2021-07-16 David Malcolm <dmalcolm@redhat.com>
6297 * program-state.cc (program_state::detect_leaks): Simplify using
6298 svalue::maybe_get_region.
6299 * region-model-impl-calls.cc (region_model::impl_call_fgets): Likewise.
6300 (region_model::impl_call_fread): Likewise.
6301 (region_model::impl_call_free): Likewise.
6302 (region_model::impl_call_operator_delete): Likewise.
6303 * region-model.cc (selftest::test_stack_frames): Likewise.
6304 (selftest::test_state_merging): Likewise.
6305 * svalue.cc (svalue::maybe_get_region): New.
6306 * svalue.h (svalue::maybe_get_region): New decl.
6308 2021-07-15 David Malcolm <dmalcolm@redhat.com>
6310 * svalue.h (is_a_helper <placeholder_svalue *>::test): Make
6311 param and template param const.
6312 (is_a_helper <widening_svalue *>::test): Likewise.
6313 (is_a_helper <compound_svalue *>::test): Likewise.
6314 (is_a_helper <conjured_svalue *>::test): Likewise.
6316 2021-07-15 David Malcolm <dmalcolm@redhat.com>
6318 PR analyzer/95006
6319 PR analyzer/94713
6320 PR analyzer/94714
6321 * analyzer.cc (maybe_reconstruct_from_def_stmt): Split out
6322 GIMPLE_ASSIGN case into...
6323 (get_diagnostic_tree_for_gassign_1): New.
6324 (get_diagnostic_tree_for_gassign): New.
6325 * analyzer.h (get_diagnostic_tree_for_gassign): New decl.
6326 * analyzer.opt (Wanalyzer-write-to-string-literal): New.
6327 * constraint-manager.cc (class svalue_purger): New.
6328 (constraint_manager::purge_state_involving): New.
6329 * constraint-manager.h
6330 (constraint_manager::purge_state_involving): New.
6331 * diagnostic-manager.cc (saved_diagnostic::supercedes_p): New.
6332 (dedupe_winners::handle_interactions): New.
6333 (diagnostic_manager::emit_saved_diagnostics): Call it.
6334 * diagnostic-manager.h (saved_diagnostic::supercedes_p): New decl.
6335 * engine.cc (impl_region_model_context::warn): Convert return type
6336 to bool. Return false if the diagnostic isn't saved.
6337 (impl_region_model_context::purge_state_involving): New.
6338 (impl_sm_context::get_state): Use NULL ctxt when querying old
6339 rvalue.
6340 (impl_sm_context::set_next_state): Use new sval when querying old
6341 state.
6342 (class dump_path_diagnostic): Move to region-model.cc
6343 (exploded_node::on_stmt): Move to on_stmt_pre and on_stmt_post.
6344 Remove call to purge_state_involving.
6345 (exploded_node::on_stmt_pre): New, based on the above. Move most
6346 of it to region_model::on_stmt_pre.
6347 (exploded_node::on_stmt_post): Likewise, moving to
6348 region_model::on_stmt_post.
6349 (class stale_jmp_buf): Fix parent class to use curiously recurring
6350 template pattern.
6351 (feasibility_state::maybe_update_for_edge): Call on_call_pre and
6352 on_call_post on gcalls.
6353 * exploded-graph.h (impl_region_model_context::warn): Return bool.
6354 (impl_region_model_context::purge_state_involving): New decl.
6355 (exploded_node::on_stmt_pre): New decl.
6356 (exploded_node::on_stmt_post): New decl.
6357 * pending-diagnostic.h (pending_diagnostic::use_of_uninit_p): New.
6358 (pending_diagnostic::supercedes_p): New.
6359 * program-state.cc (sm_state_map::get_state): Inherit state for
6360 conjured_svalue as well as initial_svalue.
6361 (sm_state_map::purge_state_involving): Also support SK_CONJURED.
6362 * region-model-impl-calls.cc (call_details::get_uncertainty):
6363 Handle m_ctxt being NULL.
6364 (call_details::get_or_create_conjured_svalue): New.
6365 (region_model::impl_call_fgets): New.
6366 (region_model::impl_call_fread): New.
6367 * region-model-manager.cc
6368 (region_model_manager::get_or_create_initial_value): Return an
6369 uninitialized poisoned value for regions that can't have initial
6370 values.
6371 * region-model-reachability.cc
6372 (reachable_regions::mark_escaped_clusters): Handle ctxt being
6373 NULL.
6374 * region-model.cc (region_to_value_map::purge_state_involving): New.
6375 (poisoned_value_diagnostic::use_of_uninit_p): New.
6376 (poisoned_value_diagnostic::emit): Handle POISON_KIND_UNINIT.
6377 (poisoned_value_diagnostic::describe_final_event): Likewise.
6378 (region_model::check_for_poison): New.
6379 (region_model::on_assignment): Call it.
6380 (class dump_path_diagnostic): Move here from engine.cc.
6381 (region_model::on_stmt_pre): New, based on exploded_node::on_stmt.
6382 (region_model::on_call_pre): Move the setting of the LHS to a
6383 conjured svalue to before the checks for specific functions.
6384 Handle "fgets", "fgets_unlocked", and "fread".
6385 (region_model::purge_state_involving): New.
6386 (region_model::handle_unrecognized_call): Handle ctxt being NULL.
6387 (region_model::get_rvalue): Call check_for_poison.
6388 (selftest::test_stack_frames): Use NULL for context when getting
6389 uninitialized rvalue.
6390 (selftest::test_alloca): Likewise.
6391 * region-model.h (region_to_value_map::purge_state_involving): New
6392 decl.
6393 (call_details::get_or_create_conjured_svalue): New decl.
6394 (region_model::on_stmt_pre): New decl.
6395 (region_model::purge_state_involving): New decl.
6396 (region_model::impl_call_fgets): New decl.
6397 (region_model::impl_call_fread): New decl.
6398 (region_model::check_for_poison): New decl.
6399 (region_model_context::warn): Return bool.
6400 (region_model_context::purge_state_involving): New.
6401 (noop_region_model_context::warn): Return bool.
6402 (noop_region_model_context::purge_state_involving): New.
6403 (test_region_model_context:: warn): Return bool.
6404 * region.cc (region::get_memory_space): New.
6405 (region::can_have_initial_svalue_p): New.
6406 (region::involves_p): New.
6407 * region.h (enum memory_space): New.
6408 (region::get_memory_space): New decl.
6409 (region::can_have_initial_svalue_p): New decl.
6410 (region::involves_p): New decl.
6411 * sm-malloc.cc (use_after_free::supercedes_p): New.
6412 * store.cc (binding_cluster::purge_state_involving): New.
6413 (store::purge_state_involving): New.
6414 * store.h (class symbolic_binding): New forward decl.
6415 (binding_key::dyn_cast_symbolic_binding): New.
6416 (symbolic_binding::dyn_cast_symbolic_binding): New.
6417 (binding_cluster::purge_state_involving): New.
6418 (store::purge_state_involving): New.
6419 * svalue.cc (svalue::can_merge_p): Reject attempts to merge
6420 poisoned svalues with other svalues, so that we identify
6421 paths in which a variable is conditionally uninitialized.
6422 (involvement_visitor::visit_conjured_svalue): New.
6423 (svalue::involves_p): Also handle SK_CONJURED.
6424 (poison_kind_to_str): Handle POISON_KIND_UNINIT.
6425 (poisoned_svalue::maybe_fold_bits_within): New.
6426 * svalue.h (enum poison_kind): Add POISON_KIND_UNINIT.
6427 (poisoned_svalue::maybe_fold_bits_within): New decl.
6429 2021-07-15 David Malcolm <dmalcolm@redhat.com>
6431 * analyzer.opt (fdump-analyzer-exploded-paths): New.
6432 * diagnostic-manager.cc
6433 (diagnostic_manager::emit_saved_diagnostic): Implement it.
6434 * engine.cc (exploded_path::dump_to_pp): Add ext_state param and
6435 use it to dump states if non-NULL.
6436 (exploded_path::dump): Likewise.
6437 (exploded_path::dump_to_file): New.
6438 * exploded-graph.h (exploded_path::dump_to_pp): Add ext_state
6439 param.
6440 (exploded_path::dump): Likewise.
6441 (exploded_path::dump): Likewise.
6442 (exploded_path::dump_to_file): New.
6444 2021-07-15 David Malcolm <dmalcolm@redhat.com>
6446 * analyzer.cc (fixup_tree_for_diagnostic_1): Use DECL_DEBUG_EXPR
6447 if it's available.
6448 * engine.cc (readability): Likewise.
6450 2021-07-15 David Malcolm <dmalcolm@redhat.com>
6452 * state-purge.cc (self_referential_phi_p): New.
6453 (state_purge_per_ssa_name::process_point): Don't purge an SSA name
6454 at its def-stmt if the def-stmt is self-referential.
6456 2021-07-07 David Malcolm <dmalcolm@redhat.com>
6458 * diagnostic-manager.cc (null_assignment_sm_context::get_state):
6459 New overload.
6460 (null_assignment_sm_context::set_next_state): New overload.
6461 (null_assignment_sm_context::get_diagnostic_tree): New.
6462 * engine.cc (impl_sm_context::get_state): New overload.
6463 (impl_sm_context::set_next_state): New overload.
6464 (impl_sm_context::get_diagnostic_tree): New overload.
6465 (impl_region_model_context::on_condition): Convert params from
6466 tree to const svalue *.
6467 * exploded-graph.h (impl_region_model_context::on_condition):
6468 Likewise.
6469 * region-model.cc (region_model::on_call_pre): Move handling of
6470 internal calls to before checking for get_fndecl_for_call.
6471 (region_model::add_constraints_from_binop): New.
6472 (region_model::add_constraint): Split out into a new overload
6473 working on const svalue * rather than tree. Call
6474 add_constraints_from_binop. Drop call to
6475 add_any_constraints_from_ssa_def_stmt.
6476 (region_model::add_any_constraints_from_ssa_def_stmt): Delete.
6477 (region_model::add_any_constraints_from_gassign): Delete.
6478 (region_model::add_any_constraints_from_gcall): Delete.
6479 * region-model.h
6480 (region_model::add_any_constraints_from_ssa_def_stmt): Delete.
6481 (region_model::add_any_constraints_from_gassign): Delete.
6482 (region_model::add_any_constraints_from_gcall): Delete.
6483 (region_model::add_constraint): Add overload decl.
6484 (region_model::add_constraints_from_binop): New decl.
6485 (region_model_context::on_condition): Convert params from tree to
6486 const svalue *.
6487 (noop_region_model_context::on_condition): Likewise.
6488 * sm-file.cc (fileptr_state_machine::condition): Likewise.
6489 * sm-malloc.cc (malloc_state_machine::on_condition): Likewise.
6490 * sm-pattern-test.cc: Include tristate.h, selftest.h,
6491 analyzer/call-string.h, analyzer/program-point.h,
6492 analyzer/store.h, and analyzer/region-model.h.
6493 (pattern_test_state_machine::on_condition): Convert params from tree to
6494 const svalue *.
6495 * sm-sensitive.cc (sensitive_state_machine::on_condition): Delete.
6496 * sm-signal.cc (signal_state_machine::on_condition): Delete.
6497 * sm-taint.cc (taint_state_machine::on_condition): Convert params
6498 from tree to const svalue *.
6499 * sm.cc: Include tristate.h, selftest.h, analyzer/call-string.h,
6500 analyzer/program-point.h, analyzer/store.h, and
6501 analyzer/region-model.h.
6502 (any_pointer_p): Add overload taking const svalue *sval.
6503 * sm.h (any_pointer_p): Add overload taking const svalue *sval.
6504 (state_machine::on_condition): Convert params from tree to
6505 const svalue *. Provide no-op default implementation.
6506 (sm_context::get_state): Add overload taking const svalue *sval.
6507 (sm_context::set_next_state): Likewise.
6508 (sm_context::on_transition): Likewise.
6509 (sm_context::get_diagnostic_tree): Likewise.
6510 * svalue.cc (svalue::all_zeroes_p): New.
6511 (constant_svalue::all_zeroes_p): New.
6512 (repeated_svalue::all_zeroes_p): Convert to vfunc.
6513 * svalue.h (svalue::all_zeroes_p): New decl.
6514 (constant_svalue::all_zeroes_p): New decl.
6515 (repeated_svalue::all_zeroes_p): Convert decl to vfunc.
6517 2021-06-30 David Malcolm <dmalcolm@redhat.com>
6519 PR analyzer/95006
6520 * analyzer.h (class repeated_svalue): New forward decl.
6521 (class bits_within_svalue): New forward decl.
6522 (class sized_region): New forward decl.
6523 (get_field_at_bit_offset): New forward decl.
6524 * engine.cc (exploded_graph::get_or_create_node): Validate the
6525 merged state.
6526 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
6527 Validate the states at each stage.
6528 * program-state.cc (program_state::validate): Validate
6529 m_region_model.
6530 * region-model-impl-calls.cc (region_model::impl_call_memset):
6531 Replace special-case logic for handling constant sizes with
6532 a call to fill_region of a sized_region with the given fill value.
6533 * region-model-manager.cc (maybe_undo_optimize_bit_field_compare):
6534 Drop DK_direct.
6535 (region_model_manager::maybe_fold_sub_svalue): Fold element-based
6536 subregions of an initial value into initial values of an element.
6537 Fold subvalues of repeated svalues.
6538 (region_model_manager::maybe_fold_repeated_svalue): New.
6539 (region_model_manager::get_or_create_repeated_svalue): New.
6540 (get_bit_range_for_field): New.
6541 (get_byte_range_for_field): New.
6542 (get_field_at_byte_range): New.
6543 (region_model_manager::maybe_fold_bits_within_svalue): New.
6544 (region_model_manager::get_or_create_bits_within): New.
6545 (region_model_manager::get_sized_region): New.
6546 (region_model_manager::log_stats): Update for addition of
6547 m_repeated_values_map, m_bits_within_values_map, and
6548 m_sized_regions.
6549 * region-model.cc (region_model::validate): New.
6550 (region_model::on_assignment): Drop enum binding_kind.
6551 (region_model::get_initial_value_for_global): Likewise.
6552 (region_model::get_rvalue_for_bits): Replace body with call to
6553 get_or_create_bits_within.
6554 (region_model::get_capacity): Handle RK_SIZED.
6555 (region_model::set_value): Drop enum binding_kind.
6556 (region_model::fill_region): New.
6557 (region_model::get_representative_path_var_1): Handle RK_SIZED.
6558 * region-model.h (visitor::visit_repeated_svalue): New.
6559 (visitor::visit_bits_within_svalue): New.
6560 (region_model_manager::get_or_create_repeated_svalue): New decl.
6561 (region_model_manager::get_or_create_bits_within): New decl.
6562 (region_model_manager::get_sized_region): New decl.
6563 (region_model_manager::maybe_fold_repeated_svalue): New decl.
6564 (region_model_manager::maybe_fold_bits_within_svalue): New decl.
6565 (region_model_manager::repeated_values_map_t): New typedef.
6566 (region_model_manager::m_repeated_values_map): New field.
6567 (region_model_manager::bits_within_values_map_t): New typedef.
6568 (region_model_manager::m_bits_within_values_map): New field.
6569 (region_model_manager::m_sized_regions): New field.
6570 (region_model::fill_region): New decl.
6571 * region.cc (region::get_base_region): Handle RK_SIZED.
6572 (region::base_region_p): Likewise.
6573 (region::get_byte_size_sval): New.
6574 (get_field_at_bit_offset): Make non-static.
6575 (region::calc_offset): Move implementation of cases to
6576 get_relative_concrete_offset vfunc implementations. Handle
6577 RK_SIZED.
6578 (region::get_relative_concrete_offset): New.
6579 (decl_region::get_svalue_for_initializer): Drop enum binding_kind.
6580 (field_region::get_relative_concrete_offset): New, from
6581 region::calc_offset.
6582 (element_region::get_relative_concrete_offset): Likewise.
6583 (offset_region::get_relative_concrete_offset): Likewise.
6584 (sized_region::accept): New.
6585 (sized_region::dump_to_pp): New.
6586 (sized_region::get_byte_size): New.
6587 (sized_region::get_bit_size): New.
6588 * region.h (enum region_kind): Add RK_SIZED.
6589 (region::dyn_cast_sized_region): New.
6590 (region::get_byte_size): Make virtual.
6591 (region::get_bit_size): Likewise.
6592 (region::get_byte_size_sval): New decl.
6593 (region::get_relative_concrete_offset): New decl.
6594 (field_region::get_relative_concrete_offset): New decl.
6595 (element_region::get_relative_concrete_offset): Likewise.
6596 (offset_region::get_relative_concrete_offset): Likewise.
6597 (class sized_region): New.
6598 * store.cc (binding_kind_to_string): Delete.
6599 (binding_key::make): Drop enum binding_kind.
6600 (binding_key::dump_to_pp): Delete.
6601 (binding_key::cmp_ptrs): Drop enum binding_kind.
6602 (bit_range::contains_p): New.
6603 (byte_range::dump): New.
6604 (byte_range::contains_p): New.
6605 (byte_range::cmp): New.
6606 (concrete_binding::dump_to_pp): Drop enum binding_kind.
6607 (concrete_binding::cmp_ptr_ptr): Likewise.
6608 (symbolic_binding::dump_to_pp): Likewise.
6609 (symbolic_binding::cmp_ptr_ptr): Likewise.
6610 (binding_map::apply_ctor_val_to_range): Likewise.
6611 (binding_map::apply_ctor_pair_to_child_region): Likewise.
6612 (binding_map::get_overlapping_bindings): New.
6613 (binding_map::remove_overlapping_bindings): New.
6614 (binding_cluster::validate): New.
6615 (binding_cluster::bind): Drop enum binding_kind.
6616 (binding_cluster::bind_compound_sval): Likewise.
6617 (binding_cluster::purge_region): Likewise.
6618 (binding_cluster::zero_fill_region): Reimplement in terms of...
6619 (binding_cluster::fill_region): New.
6620 (binding_cluster::mark_region_as_unknown): Drop enum binding_kind.
6621 (binding_cluster::get_binding): Likewise.
6622 (binding_cluster::get_binding_recursive): Likewise.
6623 (binding_cluster::get_any_binding): Likewise.
6624 (binding_cluster::maybe_get_compound_binding): Reimplement.
6625 (binding_cluster::get_overlapping_bindings): Delete.
6626 (binding_cluster::remove_overlapping_bindings): Reimplement in
6627 terms of binding_map::remove_overlapping_bindings.
6628 (binding_cluster::can_merge_p): Update for removal of
6629 enum binding_kind.
6630 (binding_cluster::on_unknown_fncall): Drop enum binding_kind.
6631 (binding_cluster::maybe_get_simple_value): Likewise.
6632 (store_manager::get_concrete_binding): Likewise.
6633 (store_manager::get_symbolic_binding): Likewise.
6634 (store::validate): New.
6635 (store::set_value): Drop enum binding_kind.
6636 (store::zero_fill_region): Reimplement in terms of...
6637 (store::fill_region): New.
6638 (selftest::test_binding_key_overlap): Drop enum binding_kind.
6639 * store.h (enum binding_kind): Delete.
6640 (binding_kind_to_string): Delete decl.
6641 (binding_key::make): Drop enum binding_kind.
6642 (binding_key::dump_to_pp): Make pure virtual.
6643 (binding_key::get_kind): Delete.
6644 (binding_key::mark_deleted): Delete.
6645 (binding_key::mark_empty): Delete.
6646 (binding_key::is_deleted): Delete.
6647 (binding_key::is_empty): Delete.
6648 (binding_key::binding_key): Delete.
6649 (binding_key::impl_hash): Delete.
6650 (binding_key::impl_eq): Delete.
6651 (binding_key::m_kind): Delete.
6652 (bit_range::get_last_bit_offset): New.
6653 (bit_range::contains_p): New.
6654 (byte_range::contains_p): New.
6655 (byte_range::operator==): New.
6656 (byte_range::get_start_byte_offset): New.
6657 (byte_range::get_next_byte_offset): New.
6658 (byte_range::get_last_byte_offset): New.
6659 (byte_range::as_bit_range): New.
6660 (byte_range::cmp): New.
6661 (concrete_binding::concrete_binding): Drop enum binding_kind.
6662 (concrete_binding::hash): Likewise.
6663 (concrete_binding::operator==): Likewise.
6664 (concrete_binding::mark_deleted): New.
6665 (concrete_binding::mark_empty): New.
6666 (concrete_binding::is_deleted): New.
6667 (concrete_binding::is_empty): New.
6668 (default_hash_traits<ana::concrete_binding>::empty_zero_p): Make false.
6669 (symbolic_binding::symbolic_binding): Drop enum binding_kind.
6670 (symbolic_binding::hash): Likewise.
6671 (symbolic_binding::operator==): Likewise.
6672 (symbolic_binding::mark_deleted): New.
6673 (symbolic_binding::mark_empty): New.
6674 (symbolic_binding::is_deleted): New.
6675 (symbolic_binding::is_empty): New.
6676 (binding_map::remove_overlapping_bindings): New decl.
6677 (binding_map::get_overlapping_bindings): New decl.
6678 (binding_cluster::validate): New decl.
6679 (binding_cluster::bind): Drop enum binding_kind.
6680 (binding_cluster::fill_region): New decl.
6681 (binding_cluster::get_binding): Drop enum binding_kind.
6682 (binding_cluster::get_binding_recursive): Likewise.
6683 (binding_cluster::get_overlapping_bindings): Delete.
6684 (store::validate): New decl.
6685 (store::set_value): Drop enum binding_kind.
6686 (store::fill_region): New decl.
6687 (store_manager::get_concrete_binding): Drop enum binding_kind.
6688 (store_manager::get_symbolic_binding): Likewise.
6689 * svalue.cc (svalue::cmp_ptr): Handle SK_REPEATED and
6690 SK_BITS_WITHIN.
6691 (svalue::extract_bit_range): New.
6692 (svalue::maybe_fold_bits_within): New.
6693 (constant_svalue::maybe_fold_bits_within): New.
6694 (unknown_svalue::maybe_fold_bits_within): New.
6695 (unaryop_svalue::maybe_fold_bits_within): New.
6696 (repeated_svalue::repeated_svalue): New.
6697 (repeated_svalue::dump_to_pp): New.
6698 (repeated_svalue::accept): New.
6699 (repeated_svalue::all_zeroes_p): New.
6700 (repeated_svalue::maybe_fold_bits_within): New.
6701 (bits_within_svalue::bits_within_svalue): New.
6702 (bits_within_svalue::dump_to_pp): New.
6703 (bits_within_svalue::maybe_fold_bits_within): New.
6704 (bits_within_svalue::accept): New.
6705 (bits_within_svalue::implicitly_live_p): New.
6706 (compound_svalue::maybe_fold_bits_within): New.
6707 * svalue.h (enum svalue_kind): Add SK_REPEATED and SK_BITS_WITHIN.
6708 (svalue::dyn_cast_repeated_svalue): New.
6709 (svalue::dyn_cast_bits_within_svalue): New.
6710 (svalue::extract_bit_range): New decl.
6711 (svalue::maybe_fold_bits_within): New vfunc decl.
6712 (region_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
6713 (region_svalue::key_t::is_empty): Likewise.
6714 (default_hash_traits<region_svalue::key_t>::empty_zero_p): Make false.
6715 (constant_svalue::maybe_fold_bits_within): New.
6716 (unknown_svalue::maybe_fold_bits_within): New.
6717 (poisoned_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
6718 (poisoned_svalue::key_t::is_empty): Likewise.
6719 (default_hash_traits<poisoned_svalue::key_t>::empty_zero_p): Make
6720 false.
6721 (setjmp_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
6722 (setjmp_svalue::key_t::is_empty): Likewise.
6723 (default_hash_traits<setjmp_svalue::key_t>::empty_zero_p): Make
6724 false.
6725 (unaryop_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
6726 (unaryop_svalue::key_t::is_empty): Likewise.
6727 (unaryop_svalue::maybe_fold_bits_within): New.
6728 (default_hash_traits<unaryop_svalue::key_t>::empty_zero_p): Make
6729 false.
6730 (binop_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
6731 (binop_svalue::key_t::is_empty): Likewise.
6732 (default_hash_traits<binop_svalue::key_t>::empty_zero_p): Make
6733 false.
6734 (sub_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
6735 (sub_svalue::key_t::is_empty): Likewise.
6736 (default_hash_traits<sub_svalue::key_t>::empty_zero_p): Make
6737 false.
6738 (class repeated_svalue): New.
6739 (is_a_helper <const repeated_svalue *>::test): New.
6740 (struct default_hash_traits<repeated_svalue::key_t>): New.
6741 (class bits_within_svalue): New.
6742 (is_a_helper <const bits_within_svalue *>::test): New.
6743 (struct default_hash_traits<bits_within_svalue::key_t>): New.
6744 (widening_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
6745 (widening_svalue::key_t::is_empty): Likewise.
6746 (default_hash_traits<widening_svalue::key_t>::empty_zero_p): Make
6747 false.
6748 (compound_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
6749 (compound_svalue::key_t::is_empty): Likewise.
6750 (compound_svalue::maybe_fold_bits_within): New.
6751 (default_hash_traits<compound_svalue::key_t>::empty_zero_p): Make
6752 false.
6754 2021-06-28 David Malcolm <dmalcolm@redhat.com>
6756 * analyzer.h (byte_offset_t): New typedef.
6757 * store.cc (bit_range::dump_to_pp): Dump as a byte range if
6758 possible.
6759 (bit_range::as_byte_range): New.
6760 (byte_range::dump_to_pp): New.
6761 * store.h (class byte_range): New forward decl.
6762 (struct bit_range): Add comment.
6763 (bit_range::as_byte_range): New decl.
6764 (struct byte_range): New.
6766 2021-06-22 David Malcolm <dmalcolm@redhat.com>
6768 PR analyzer/101143
6769 * region-model.cc (compat_types_p): New function.
6770 (region_model::create_region_for_heap_alloc): Convert assertion to
6771 an error check.
6772 (region_model::create_region_for_alloca): Likewise.
6774 2021-06-18 David Malcolm <dmalcolm@redhat.com>
6776 * store.cc (binding_cluster::get_any_binding): Make symbolic reads
6777 from a cluster with concrete bindings return unknown.
6779 2021-06-18 David Malcolm <dmalcolm@redhat.com>
6781 * region-model-manager.cc
6782 (region_model_manager::get_or_create_int_cst): New.
6783 (region_model_manager::maybe_undo_optimize_bit_field_compare): Use
6784 it to simplify away a local tree.
6785 * region-model.cc (region_model::on_setjmp): Likewise.
6786 (region_model::on_longjmp): Likewise.
6787 * region-model.h (region_model_manager::get_or_create_int_cst):
6788 New decl.
6789 * store.cc (binding_cluster::zero_fill_region): Use it to simplify
6790 away a local tree.
6792 2021-06-18 David Malcolm <dmalcolm@redhat.com>
6794 * checker-path.cc (class custom_event): Make abstract to allow for
6795 custom vfuncs, splitting existing implementation into...
6796 (class precanned_custom_event): New subclass.
6797 (custom_event::get_desc): Move to...
6798 (precanned_custom_event::get_desc): ...subclass.
6799 * checker-path.h (class custom_event): Make abstract to allow for
6800 custom vfuncs, splitting existing implementation into...
6801 (class precanned_custom_event): New subclass.
6802 * diagnostic-manager.cc (diagnostic_manager::add_events_for_eedge):
6803 Use precanned_custom_event.
6804 * engine.cc
6805 (stale_jmp_buf::maybe_add_custom_events_for_superedge): Likewise.
6806 * sm-signal.cc (signal_delivery_edge_info_t::add_events_to_path):
6807 Likewise.
6809 2021-06-15 David Malcolm <dmalcolm@redhat.com>
6811 PR analyzer/99212
6812 PR analyzer/101082
6813 * engine.cc: Include "target.h".
6814 (impl_run_checkers): Log BITS_BIG_ENDIAN, BYTES_BIG_ENDIAN, and
6815 WORDS_BIG_ENDIAN.
6816 * region-model-manager.cc
6817 (region_model_manager::maybe_fold_binop): Move support for masking
6818 via ARG0 & CST into...
6819 (region_model_manager::maybe_undo_optimize_bit_field_compare):
6820 ...this new function. Flatten by converting from nested
6821 conditionals to a series of early return statements to reject
6822 failures. Reject if type is not unsigned_char_type_node.
6823 Handle BYTES_BIG_ENDIAN when determining which bits are bound
6824 in the binding_map.
6825 * region-model.h
6826 (region_model_manager::maybe_undo_optimize_bit_field_compare):
6827 New decl.
6828 * store.cc (bit_range::dump): New function.
6829 * store.h (bit_range::dump): New decl.
6831 2021-06-15 David Malcolm <dmalcolm@redhat.com>
6833 * engine.cc (exploded_node::on_stmt): Handle __analyzer_dump_capacity.
6834 (exploded_node::on_stmt): Drop m_sm_changes from on_stmt_flags.
6835 (state_change_requires_new_enode_p): New function...
6836 (exploded_graph::process_node): Call it, rather than querying
6837 flags.m_sm_changes, so that dynamic-extent differences can also
6838 trigger the splitting of nodes.
6839 * exploded-graph.h (struct on_stmt_flags): Drop field m_sm_changes.
6840 * program-state.cc (program_state::detect_leaks): Purge dead
6841 heap-allocated regions from dynamic extents.
6842 (selftest::test_program_state_1): Fix type of "size_in_bytes".
6843 (selftest::test_program_state_merging): Likewise.
6844 * region-model-impl-calls.cc
6845 (region_model::impl_call_analyzer_dump_capacity): New.
6846 (region_model::impl_call_free): Remove dynamic extents from the
6847 freed region.
6848 * region-model-reachability.h
6849 (reachable_regions::begin_mutable_base_regs): New.
6850 (reachable_regions::end_mutable_base_regs): New.
6851 * region-model.cc: Include "tree-object-size.h".
6852 (region_model::region_model): Support new field m_dynamic_extents.
6853 (region_model::operator=): Likewise.
6854 (region_model::operator==): Likewise.
6855 (region_model::dump_to_pp): Dump sizes of dynamic regions.
6856 (region_model::handle_unrecognized_call): Purge dynamic extents
6857 from any regions that have escaped mutably:.
6858 (region_model::get_capacity): New function.
6859 (region_model::add_constraint): Unset dynamic extents when a
6860 heap-allocated region's address is NULL.
6861 (region_model::unbind_region_and_descendents): Purge dynamic
6862 extents of unbound regions.
6863 (region_model::can_merge_with_p): Call
6864 m_dynamic_extents.can_merge_with_p.
6865 (region_model::create_region_for_heap_alloc): Assert that
6866 size_in_bytes's type is compatible with size_type_node. Update
6867 for renaming of record_dynamic_extents to set_dynamic_extents.
6868 (region_model::create_region_for_alloca): Likewise.
6869 (region_model::record_dynamic_extents): Rename to...
6870 (region_model::set_dynamic_extents): ...this. Assert that
6871 size_in_bytes's type is compatible with size_type_node. Add it
6872 to the m_dynamic_extents map.
6873 (region_model::get_dynamic_extents): New.
6874 (region_model::unset_dynamic_extents): New.
6875 (selftest::test_state_merging): Fix type of "size".
6876 (selftest::test_malloc_constraints): Likewise.
6877 (selftest::test_malloc): Verify dynamic extents.
6878 (selftest::test_alloca): Likewise.
6879 * region-model.h (region_to_value_map::is_empty): New.
6880 (region_model::dynamic_extents_t): New typedef.
6881 (region_model::impl_call_analyzer_dump_capacity): New decl.
6882 (region_model::get_dynamic_extents): New function.
6883 (region_model::get_dynamic_extents): New decl.
6884 (region_model::set_dynamic_extents): New decl.
6885 (region_model::unset_dynamic_extents): New decl.
6886 (region_model::get_capacity): New decl.
6887 (region_model::record_dynamic_extents): Rename to set_dynamic_extents.
6888 (region_model::m_dynamic_extents): New field.
6890 2021-06-15 David Malcolm <dmalcolm@redhat.com>
6892 * region-model.cc (region_to_value_map::operator=): New.
6893 (region_to_value_map::operator==): New.
6894 (region_to_value_map::dump_to_pp): New.
6895 (region_to_value_map::dump): New.
6896 (region_to_value_map::can_merge_with_p): New.
6897 * region-model.h (class region_to_value_map): New class.
6899 2021-06-13 Trevor Saunders <tbsaunde@tbsaunde.org>
6901 * call-string.cc (call_string::call_string): Use range based for
6902 to iterate over vec<>.
6903 (call_string::to_json): Likewise.
6904 (call_string::hash): Likewise.
6905 (call_string::calc_recursion_depth): Likewise.
6906 * checker-path.cc (checker_path::fixup_locations): Likewise.
6907 * constraint-manager.cc (equiv_class::equiv_class): Likewise.
6908 (equiv_class::to_json): Likewise.
6909 (equiv_class::hash): Likewise.
6910 (constraint_manager::to_json): Likewise.
6911 * engine.cc (impl_region_model_context::on_svalue_leak):
6912 Likewise.
6913 (on_liveness_change): Likewise.
6914 (impl_region_model_context::on_unknown_change): Likewise.
6915 * program-state.cc (sm_state_map::set_state): Likewise.
6916 * region-model.cc (test_canonicalization_4): Likewise.
6918 2021-06-11 David Malcolm <dmalcolm@redhat.com>
6920 * engine.cc (worklist::key_t::cmp): Move sort by call_string to
6921 before SCC.
6923 2021-06-09 David Malcolm <dmalcolm@redhat.com>
6925 * region-model.cc (region_model::get_lvalue_1): Make const.
6926 (region_model::get_lvalue): Likewise.
6927 (region_model::get_rvalue_1): Likewise.
6928 (region_model::get_rvalue): Likewise.
6929 (region_model::deref_rvalue): Likewise.
6930 (region_model::get_rvalue_for_bits): Likewise.
6931 * region-model.h (region_model::get_lvalue): Likewise.
6932 (region_model::get_rvalue): Likewise.
6933 (region_model::deref_rvalue): Likewise.
6934 (region_model::get_rvalue_for_bits): Likewise.
6935 (region_model::get_lvalue_1): Likewise.
6936 (region_model::get_rvalue_1): Likewise.
6938 2021-06-08 David Malcolm <dmalcolm@redhat.com>
6940 PR analyzer/99212
6941 * region-model-manager.cc
6942 (region_model_manager::maybe_fold_binop): Add support for folding
6943 BIT_AND_EXPR of compound_svalue and a mask constant.
6944 * region-model.cc (region_model::get_rvalue_1): Implement
6945 BIT_FIELD_REF in terms of...
6946 (region_model::get_rvalue_for_bits): New function.
6947 * region-model.h (region_model::get_rvalue_for_bits): New decl.
6948 * store.cc (bit_range::from_mask): New function.
6949 (selftest::test_bit_range_intersects_p): New selftest.
6950 (selftest::assert_bit_range_from_mask_eq): New.
6951 (ASSERT_BIT_RANGE_FROM_MASK_EQ): New macro.
6952 (selftest::assert_no_bit_range_from_mask_eq): New.
6953 (ASSERT_NO_BIT_RANGE_FROM_MASK): New macro.
6954 (selftest::test_bit_range_from_mask): New selftest.
6955 (selftest::analyzer_store_cc_tests): Call the new selftests.
6956 * store.h (bit_range::intersects_p): New.
6957 (bit_range::from_mask): New decl.
6958 (concrete_binding::get_bit_range): New accessor.
6959 (store_manager::get_concrete_binding): New overload taking
6960 const bit_range &.
6962 2021-06-08 David Malcolm <dmalcolm@redhat.com>
6964 * analyzer.h (int_size_in_bits): New decl.
6965 * region.cc (int_size_in_bits): New function.
6966 (region::get_bit_size): Reimplement in terms of the above.
6968 2021-06-08 David Malcolm <dmalcolm@redhat.com>
6970 * store.cc (concrete_binding::dump_to_pp): Move bulk of
6971 implementation to...
6972 (bit_range::dump_to_pp): ...this new function.
6973 (bit_range::cmp): New.
6974 (concrete_binding::overlaps_p): Update for use of bit_range.
6975 (concrete_binding::cmp_ptr_ptr): Likewise.
6976 * store.h (struct bit_range): New.
6977 (class concrete_binding): Replace fields m_start_bit_offset and
6978 m_size_in_bits with new field m_bit_range.
6980 2021-06-08 David Malcolm <dmalcolm@redhat.com>
6982 * svalue.h (conjured_svalue::iterator_t): Delete.
6984 2021-06-03 David Malcolm <dmalcolm@redhat.com>
6986 * store.h (store::get_direct_binding): Remove unused decl.
6987 (store::get_default_binding): Likewise.
6989 2021-06-03 David Malcolm <dmalcolm@redhat.com>
6991 * svalue.cc (poisoned_svalue::dump_to_pp): Dump type.
6992 (compound_svalue::dump_to_pp): Dump any type.
6994 2021-05-18 David Malcolm <dmalcolm@redhat.com>
6996 PR analyzer/100615
6997 * sm-malloc.cc: Include "analyzer/function-set.h".
6998 (malloc_state_machine::on_stmt): Call unaffected_by_call_p and
6999 bail on the functions it recognizes.
7000 (malloc_state_machine::unaffected_by_call_p): New.
7002 2021-05-10 Martin Liska <mliska@suse.cz>
7004 * sm-file.cc (is_file_using_fn_p): Use startswith
7005 function instead of strncmp.
7007 2021-05-10 Martin Liska <mliska@suse.cz>
7009 * program-state.cc (program_state::operator=): Remove
7010 __cplusplus >= 201103.
7011 (program_state::program_state): Likewise.
7012 * program-state.h: Likewise.
7013 * region-model.h (class region_model): Remove dead code.
7015 2021-04-24 David Malcolm <dmalcolm@redhat.com>
7017 PR analyzer/100244
7018 * sm-malloc.cc (free_of_non_heap::describe_state_change):
7019 Bulletproof against change.m_expr being NULL.
7021 2021-04-13 David Malcolm <dmalcolm@redhat.com>
7023 PR analyzer/98599
7024 * supergraph.cc (saved_uids::make_uid_unique): New.
7025 (saved_uids::restore_uids): New.
7026 (supergraph::supergraph): Replace assignments to stmt->uid with
7027 calls to m_stmt_uids.make_uid_unique.
7028 (supergraph::~supergraph): New.
7029 * supergraph.h (class saved_uids): New.
7030 (supergraph::~supergraph): New decl.
7031 (supergraph::m_stmt_uids): New field.
7033 2021-04-10 David Malcolm <dmalcolm@redhat.com>
7035 PR analyzer/100011
7036 * region-model.cc (region_model::on_assignment): Avoid NULL
7037 dereference if ctxt is NULL when assigning from a STRING_CST.
7039 2021-04-08 David Malcolm <dmalcolm@redhat.com>
7041 PR analyzer/99042
7042 PR analyzer/99774
7043 * engine.cc
7044 (impl_region_model_context::impl_region_model_context): Add
7045 uncertainty param and use it to initialize m_uncertainty.
7046 (impl_region_model_context::get_uncertainty): New.
7047 (impl_sm_context::get_fndecl_for_call): Add NULL for new
7048 uncertainty param when constructing impl_region_model_context.
7049 (impl_sm_context::get_state): Likewise.
7050 (impl_sm_context::set_next_state): Likewise.
7051 (impl_sm_context::warn): Likewise.
7052 (exploded_node::on_stmt): Add uncertainty param
7053 and use it when constructing impl_region_model_context.
7054 (exploded_node::on_edge): Add uncertainty param and pass
7055 to on_edge call.
7056 (exploded_node::detect_leaks): Create uncertainty_t and pass to
7057 impl_region_model_context.
7058 (exploded_graph::get_or_create_node): Create uncertainty_t and
7059 pass to prune_for_point.
7060 (maybe_process_run_of_before_supernode_enodes): Create
7061 uncertainty_t and pass to impl_region_model_context.
7062 (exploded_graph::process_node): Create uncertainty_t instances and
7063 pass around as needed.
7064 * exploded-graph.h
7065 (impl_region_model_context::impl_region_model_context): Add
7066 uncertainty param.
7067 (impl_region_model_context::get_uncertainty): New decl.
7068 (impl_region_model_context::m_uncertainty): New field.
7069 (exploded_node::on_stmt): Add uncertainty param.
7070 (exploded_node::on_edge): Likewise.
7071 * program-state.cc (sm_state_map::on_liveness_change): Get
7072 uncertainty from context and use it to unset sm-state from
7073 svalues as appropriate.
7074 (program_state::on_edge): Add uncertainty param and use it when
7075 constructing impl_region_model_context. Fix indentation.
7076 (program_state::prune_for_point): Add uncertainty param and use it
7077 when constructing impl_region_model_context.
7078 (program_state::detect_leaks): Get any uncertainty from ctxt and
7079 use it to get maybe-live svalues for dest_state, rather than
7080 definitely-live ones; use this when determining which svalues
7081 have leaked.
7082 (selftest::test_program_state_merging): Create uncertainty_t and
7083 pass to impl_region_model_context.
7084 * program-state.h (program_state::on_edge): Add uncertainty param.
7085 (program_state::prune_for_point): Likewise.
7086 * region-model-impl-calls.cc (call_details::get_uncertainty): New.
7087 (region_model::impl_call_memcpy): Pass uncertainty to
7088 mark_region_as_unknown call.
7089 (region_model::impl_call_memset): Likewise.
7090 (region_model::impl_call_strcpy): Likewise.
7091 * region-model-reachability.cc (reachable_regions::handle_sval):
7092 Also add sval to m_mutable_svals.
7093 * region-model.cc (region_model::on_assignment): Pass any
7094 uncertainty from ctxt to the store::set_value call.
7095 (region_model::handle_unrecognized_call): Get any uncertainty from
7096 ctxt and use it to record mutable svalues at the unknown call.
7097 (region_model::get_reachable_svalues): Add uncertainty param and
7098 use it to mark any maybe-bound svalues as being reachable.
7099 (region_model::set_value): Pass any uncertainty from ctxt to the
7100 store::set_value call.
7101 (region_model::mark_region_as_unknown): Add uncertainty param and
7102 pass it on to the store::mark_region_as_unknown call.
7103 (region_model::update_for_call_summary): Add uncertainty param and
7104 pass it on to the region_model::mark_region_as_unknown call.
7105 * region-model.h (call_details::get_uncertainty): New decl.
7106 (region_model::get_reachable_svalues): Add uncertainty param.
7107 (region_model::mark_region_as_unknown): Add uncertainty param.
7108 (region_model_context::get_uncertainty): New vfunc.
7109 (noop_region_model_context::get_uncertainty): New vfunc
7110 implementation.
7111 * store.cc (dump_svalue_set): New.
7112 (uncertainty_t::dump_to_pp): New.
7113 (uncertainty_t::dump): New.
7114 (binding_cluster::clobber_region): Pass NULL for uncertainty to
7115 remove_overlapping_bindings.
7116 (binding_cluster::mark_region_as_unknown): Add uncertainty param
7117 and pass it to remove_overlapping_bindings.
7118 (binding_cluster::remove_overlapping_bindings): Add uncertainty param.
7119 Use it to record any svalues that were in clobbered bindings.
7120 (store::set_value): Add uncertainty param. Pass it to
7121 binding_cluster::mark_region_as_unknown when handling symbolic
7122 regions.
7123 (store::mark_region_as_unknown): Add uncertainty param and pass it
7124 to binding_cluster::mark_region_as_unknown.
7125 (store::remove_overlapping_bindings): Add uncertainty param and
7126 pass it to binding_cluster::remove_overlapping_bindings.
7127 * store.h (binding_cluster::mark_region_as_unknown): Add
7128 uncertainty param.
7129 (binding_cluster::remove_overlapping_bindings): Likewise.
7130 (store::set_value): Likewise.
7131 (store::mark_region_as_unknown): Likewise.
7133 2021-04-05 David Malcolm <dmalcolm@redhat.com>
7135 PR analyzer/99906
7136 * analyzer.cc (maybe_reconstruct_from_def_stmt): Fix NULL
7137 dereference on calls with zero arguments.
7138 * sm-malloc.cc (malloc_state_machine::on_stmt): When handling
7139 __attribute__((nonnull)), only call get_diagnostic_tree if the
7140 result will be used.
7142 2021-04-05 David Malcolm <dmalcolm@redhat.com>
7144 PR analyzer/99886
7145 * diagnostic-manager.cc
7146 (diagnostic_manager::prune_interproc_events): Use signed integers
7147 when subtracting one from path->num_events ().
7148 (diagnostic_manager::consolidate_conditions): Likewise. Convert
7149 next_idx to a signed int.
7151 2021-04-01 David Malcolm <dmalcolm@redhat.com>
7153 * diagnostic-manager.cc (diagnostic_manager::add_diagnostic): Make
7154 enode param non-constant, and call add_diagnostic on it. Add
7155 enode index to log message.
7156 (diagnostic_manager::add_diagnostic): Make enode param
7157 non-constant.
7158 * diagnostic-manager.h (diagnostic_manager::add_diagnostic):
7159 Likewise for both decls.
7160 * engine.cc
7161 (impl_region_model_context::impl_region_model_context): Likewise
7162 for enode_for_diag.
7163 (impl_sm_context::impl_sm_context): Likewise.
7164 (impl_sm_context::m_enode_for_diag): Likewise.
7165 (exploded_node::dump_dot): Don't pass the diagnostic manager
7166 to dump_saved_diagnostics.
7167 (exploded_node::dump_saved_diagnostics): Drop param. Iterate
7168 directly through all saved diagnostics for the enode, rather
7169 than all saved diagnostics in the diagnostic_manager and
7170 filtering.
7171 (exploded_node::on_stmt): Make non-const.
7172 (exploded_node::on_edge): Likewise.
7173 (exploded_node::on_longjmp): Likewise.
7174 (exploded_node::detect_leaks): Likewise.
7175 (exploded_graph::get_or_create_node): Make enode_for_diag param
7176 non-const.
7177 (exploded_graph_annotator::print_enode): Iterate
7178 directly through all saved diagnostics for the enode, rather
7179 than all saved diagnostics in the diagnostic_manager and
7180 filtering.
7181 * exploded-graph.h
7182 (impl_region_model_context::impl_region_model_context): Make
7183 enode_for_diag param non-constant.
7184 (impl_region_model_context::m_enode_for_diag): Likewise.
7185 (exploded_node::dump_saved_diagnostics): Drop param.
7186 (exploded_node::on_stmt): Make non-const.
7187 (exploded_node::on_edge): Likewise.
7188 (exploded_node::on_longjmp): Likewise.
7189 (exploded_node::detect_leaks): Likewise.
7190 (exploded_node::add_diagnostic): New.
7191 (exploded_node::get_num_diagnostics): New.
7192 (exploded_node::get_saved_diagnostic): New.
7193 (exploded_node::m_saved_diagnostics): New.
7194 (exploded_graph::get_or_create_node): Make enode_for_diag param
7195 non-constant.
7196 * feasible-graph.cc (feasible_node::dump_dot): Drop
7197 diagnostic_manager from call to dump_saved_diagnostics.
7198 * program-state.cc (program_state::on_edge): Convert enode param
7199 to non-const pointer.
7200 (program_state::prune_for_point): Likewise for enode_for_diag
7201 param.
7202 * program-state.h (program_state::on_edge): Convert enode param
7203 to non-const pointer.
7204 (program_state::prune_for_point): Likewise for enode_for_diag
7205 param.
7207 2021-03-31 David Malcolm <dmalcolm@redhat.com>
7209 PR analyzer/99771
7210 * analyzer.cc (maybe_reconstruct_from_def_stmt): New.
7211 (fixup_tree_for_diagnostic_1): New.
7212 (fixup_tree_for_diagnostic): New.
7213 * analyzer.h (fixup_tree_for_diagnostic): New decl.
7214 * checker-path.cc (call_event::get_desc): Call
7215 fixup_tree_for_diagnostic and use it for the call_with_state call.
7216 (warning_event::get_desc): Likewise for the final_event and
7217 make_label_text calls.
7218 * engine.cc (impl_region_model_context::on_state_leak): Likewise
7219 for the on_leak and add_diagnostic calls.
7220 * region-model.cc (region_model::get_representative_tree):
7221 Likewise for the result.
7223 2021-03-30 David Malcolm <dmalcolm@redhat.com>
7225 * region.h (region::dump_to_pp): Remove old decl.
7227 2021-03-30 David Malcolm <dmalcolm@redhat.com>
7229 * sm-file.cc (fileptr_state_machine::on_stmt): Only call
7230 get_diagnostic_tree if the result will be used.
7231 * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise.
7232 (malloc_state_machine::on_deallocator_call): Likewise.
7233 (malloc_state_machine::on_realloc_call): Likewise.
7234 (malloc_state_machine::on_realloc_call): Likewise.
7235 * sm-sensitive.cc
7236 (sensitive_state_machine::warn_for_any_exposure): Likewise.
7237 * sm-taint.cc (taint_state_machine::on_stmt): Likewise.
7239 2021-03-25 David Malcolm <dmalcolm@redhat.com>
7241 PR analyzer/93695
7242 PR analyzer/99044
7243 PR analyzer/99716
7244 * engine.cc (exploded_node::on_stmt): Clear sm-state involving
7245 an SSA name at the def-stmt of that SSA name.
7246 * program-state.cc (sm_state_map::purge_state_involving): New.
7247 * program-state.h (sm_state_map::purge_state_involving): New decl.
7248 * region-model.cc (selftest::test_involves_p): New.
7249 (selftest::analyzer_region_model_cc_tests): Call it.
7250 * svalue.cc (class involvement_visitor): New class
7251 (svalue::involves_p): New.
7252 * svalue.h (svalue::involves_p): New decl.
7254 2021-03-19 David Malcolm <dmalcolm@redhat.com>
7256 PR analyzer/99614
7257 * diagnostic-manager.cc (class epath_finder): Add
7258 DISABLE_COPY_AND_ASSIGN.
7260 2021-03-15 Martin Liska <mliska@suse.cz>
7262 * sm-file.cc (get_file_using_fns): Add missing comma in initializer.
7264 2021-03-11 David Malcolm <dmalcolm@redhat.com>
7266 PR analyzer/96374
7267 * analyzer.opt (-param=analyzer-max-infeasible-edges=): New param.
7268 (fdump-analyzer-feasibility): New flag.
7269 * diagnostic-manager.cc: Include "analyzer/trimmed-graph.h" and
7270 "analyzer/feasible-graph.h".
7271 (epath_finder::epath_finder): Convert m_sep to a pointer and
7272 only create it if !flag_analyzer_feasibility.
7273 (epath_finder::~epath_finder): New.
7274 (epath_finder::m_sep): Convert to a pointer.
7275 (epath_finder::get_best_epath): Add param "diag_idx" and use it
7276 when logging. Rather than finding the shortest path and then
7277 checking feasibility, instead use explore_feasible_paths unless
7278 !flag_analyzer_feasibility, in which case simply use the shortest
7279 path, and note if it is infeasible. Update for m_sep becoming a
7280 pointer.
7281 (class feasible_worklist): New.
7282 (epath_finder::explore_feasible_paths): New.
7283 (epath_finder::process_worklist_item): New.
7284 (class dump_eg_with_shortest_path): New.
7285 (epath_finder::dump_trimmed_graph): New.
7286 (epath_finder::dump_feasible_graph): New.
7287 (saved_diagnostic::saved_diagnostic): Add "idx" param, using it
7288 on new field m_idx.
7289 (saved_diagnostic::to_json): Dump m_idx.
7290 (saved_diagnostic::calc_best_epath): Pass m_idx to get_best_epath.
7291 Remove assertion that m_problem was set when m_best_epath is NULL.
7292 (diagnostic_manager::add_diagnostic): Pass an index when created
7293 saved_diagnostic instances.
7294 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Add
7295 "idx" param.
7296 (saved_diagnostic::get_index): New accessor.
7297 (saved_diagnostic::m_idx): New field.
7298 * engine.cc (exploded_node::dump_dot): Call args.dump_extra_info.
7299 Move code to...
7300 (exploded_node::dump_processed_stmts): ...this new function and...
7301 (exploded_node::dump_saved_diagnostics): ...this new function.
7302 Add index of each diagnostic.
7303 (exploded_edge::dump_dot): Move bulk of code to...
7304 (exploded_edge::dump_dot_label): ...this new function.
7305 * exploded-graph.h (eg_traits::dump_args_t::dump_extra_info): New
7306 vfunc.
7307 (exploded_node::dump_processed_stmts): New decl.
7308 (exploded_node::dump_saved_diagnostics): New decl.
7309 (exploded_edge::dump_dot_label): New decl.
7310 * feasible-graph.cc: New file.
7311 * feasible-graph.h: New file.
7312 * trimmed-graph.cc: New file.
7313 * trimmed-graph.h: New file.
7315 2021-03-11 David Malcolm <dmalcolm@redhat.com>
7317 * diagnostic-manager.cc (epath_finder::epath_finder):
7318 Update shortest_paths init for new param.
7320 2021-03-10 David Malcolm <dmalcolm@redhat.com>
7322 PR analyzer/96374
7323 * engine.cc (exploded_path::feasible_p): Move "snodes_visited" and
7324 "model" locals into a new class feasibility_state. Move heart
7325 of per-edge processing into
7326 feasibility_state::maybe_update_for_edge.
7327 (feasibility_state::feasibility_state): New.
7328 (feasibility_state::maybe_update_for_edge): New, based on loop
7329 body in exploded_path::feasible_p.
7330 * exploded-graph.h (class feasibility_state): New.
7332 2021-03-10 David Malcolm <dmalcolm@redhat.com>
7334 * supergraph.h
7335 (callgraph_superedge::dyn_cast_callgraph_superedge): New.
7336 (call_superedge::dyn_cast_callgraph_superedge): Delete.
7337 (return_superedge::dyn_cast_callgraph_superedge): Delete.
7339 2021-03-02 Martin Liska <mliska@suse.cz>
7341 * diagnostic-manager.cc (diagnostic_manager::emit_saved_diagnostics):
7342 Do not pass engine.
7344 2021-02-26 David Malcolm <dmalcolm@redhat.com>
7346 * engine.cc (exploded_path::exploded_path): New copy-ctor.
7347 * exploded-graph.h (exploded_path::operator=): Drop decl.
7349 2021-02-26 David Malcolm <dmalcolm@redhat.com>
7351 PR analyzer/96374
7352 * diagnostic-manager.cc (class epath_finder): New.
7353 (epath_finder::get_best_epath): New.
7354 (saved_diagnostic::saved_diagnostic): Update for replacement of
7355 m_state and m_epath_length with m_best_epath.
7356 (saved_diagnostic::~saved_diagnostic): Delete m_best_epath.
7357 (saved_diagnostic::to_json): Update "path_length" to be optional.
7358 (saved_diagnostic::calc_best_epath): New, based on
7359 dedupe_winners::add and parts of dedupe_key::dedupe_key.
7360 (saved_diagnostic::get_epath_length): New.
7361 (saved_diagnostic::add_duplicate): New.
7362 (dedupe_key::dedupe_key): Drop epath param. Move invocation of
7363 stmt_finder to saved_diagnostic::calc_best_epath.
7364 (class dedupe_candidate): Delete.
7365 (class dedupe_hash_map_traits): Update to use saved_diagnotic *
7366 rather than dedupe_candidate * as the value_type/compare_type.
7367 (dedupe_winners::~dedupe_winners): Don't delete the values.
7368 (dedupe_winners::add): Convert param from shortest_exploded_paths to
7369 epath_finder. Drop "eg" param. Drop dedupe_candidate, moving
7370 path generation and feasiblity checking to
7371 epath_finder::get_best_epath. Update winner-selection for move
7372 of epaths from dedupe_candidate to saved_diagnostic.
7373 (dedupe_winners::emit_best): Update for removal of class
7374 dedupe_candidate.
7375 (dedupe_winners::map_t): Update to use saved_diagnotic * rather
7376 than dedupe_candidate * as the value_type/compare_type.
7377 (diagnostic_manager::emit_saved_diagnostics): Move
7378 shortest_exploded_paths instance into epath_finder and pass that
7379 around instead.
7380 (diagnostic_manager::emit_saved_diagnostic): Drop epath, stmt
7381 and num_dupes params, instead getting these from the
7382 saved_diagnostic. Use correct location in inform_n call.
7383 * diagnostic-manager.h (class epath_finder): New forward decl.
7384 (saved_diagnostic::status): Drop enum.
7385 (saved_diagnostic::set_feasible): Drop.
7386 (saved_diagnostic::set_infeasible): Drop.
7387 (saved_diagnostic::get_status): Drop.
7388 (saved_diagnostic::calc_best_epath): New decl.
7389 (saved_diagnostic::get_best_epath): New decl.
7390 (saved_diagnostic::get_epath_length): New decl.
7391 (saved_diagnostic::set_epath_length): Drop.
7392 (saved_diagnostic::get_epath_length): Drop inline implementation.
7393 (saved_diagnostic::add_duplicate): New.
7394 (saved_diagnostic::get_num_dupes): New.
7395 (saved_diagnostic::m_d): Document ownership.
7396 (saved_diagnostic::m_trailing_eedge): Make const.
7397 (saved_diagnostic::m_status): Drop field.
7398 (saved_diagnostic::m_epath_length): Drop field.
7399 (saved_diagnostic::m_best_epath): New field.
7400 (saved_diagnostic::m_problem): Document ownership.
7401 (saved_diagnostic::m_duplicates): New field.
7402 (diagnostic_manager::emit_saved_diagnostic): Drop params epath,
7403 stmt, and num_dupes.
7404 * engine.cc (exploded_graph_annotator::print_saved_diagnostic):
7405 Update for changes to saved_diagnostic class.
7406 * exploded-graph.h (exploded_path::feasible_p): Drop unused
7407 overloaded decl.
7409 2021-02-25 David Malcolm <dmalcolm@redhat.com>
7411 PR analyzer/99193
7412 * region-model-impl-calls.cc (region_model::impl_call_realloc): New.
7413 * region-model.cc (region_model::on_call_pre): Call it.
7414 * region-model.h (region_model::impl_call_realloc): New decl.
7415 * sm-malloc.cc (enum wording): Add WORDING_REALLOCATED.
7416 (malloc_state_machine::m_realloc): New field.
7417 (use_after_free::describe_state_change): Add case for
7418 WORDING_REALLOCATED.
7419 (use_after_free::describe_final_event): Likewise.
7420 (malloc_state_machine::malloc_state_machine): Initialize
7421 m_realloc.
7422 (malloc_state_machine::on_stmt): Handle realloc by calling...
7423 (malloc_state_machine::on_realloc_call): New.
7425 2021-02-22 David Malcolm <dmalcolm@redhat.com>
7427 PR analyzer/99196
7428 * engine.cc (exploded_node::on_stmt): Provide terminate_path
7429 flag as a way for on_call_pre to terminate the current analysis
7430 path.
7431 * region-model-impl-calls.cc (call_details::num_args): New.
7432 (region_model::impl_call_error): New.
7433 * region-model.cc (region_model::on_call_pre): Add param
7434 "out_terminate_path". Handle "error" and "error_at_line".
7435 * region-model.h (call_details::num_args): New decl.
7436 (region_model::on_call_pre): Add param "out_terminate_path".
7437 (region_model::impl_call_error): New decl.
7439 2021-02-17 David Malcolm <dmalcolm@redhat.com>
7441 PR analyzer/98969
7442 * constraint-manager.cc (dead_svalue_purger::should_purge_p):
7443 Update for change to svalue::live_p.
7444 * program-state.cc (sm_state_map::on_liveness_change): Likewise.
7445 (program_state::detect_leaks): Likewise.
7446 * region-model-reachability.cc (reachable_regions::init_cluster):
7447 When dealing with a symbolic region, if the underlying pointer is
7448 implicitly live, add the region to the reachable regions.
7449 * region-model.cc (region_model::compare_initial_and_pointer):
7450 Move logic for detecting initial values of params to
7451 initial_svalue::initial_value_of_param_p.
7452 * svalue.cc (svalue::live_p): Convert "live_svalues" from a
7453 reference to a pointer; support it being NULL.
7454 (svalue::implicitly_live_p): Convert first param from a
7455 refererence to a pointer.
7456 (region_svalue::implicitly_live_p): Likewise.
7457 (constant_svalue::implicitly_live_p): Likewise.
7458 (initial_svalue::implicitly_live_p): Likewise. Treat the initial
7459 values of params for the top level frame as still live.
7460 (initial_svalue::initial_value_of_param_p): New function, taken
7461 from a test in region_model::compare_initial_and_pointer.
7462 (unaryop_svalue::implicitly_live_p): Convert first param from a
7463 refererence to a pointer.
7464 (binop_svalue::implicitly_live_p): Likewise.
7465 (sub_svalue::implicitly_live_p): Likewise.
7466 (unmergeable_svalue::implicitly_live_p): Likewise.
7467 * svalue.h (svalue::live_p): Likewise.
7468 (svalue::implicitly_live_p): Likewise.
7469 (region_svalue::implicitly_live_p): Likewise.
7470 (constant_svalue::implicitly_live_p): Likewise.
7471 (initial_svalue::implicitly_live_p): Likewise.
7472 (initial_svalue::initial_value_of_param_p): New decl.
7473 (unaryop_svalue::implicitly_live_p): Convert first param from a
7474 refererence to a pointer.
7475 (binop_svalue::implicitly_live_p): Likewise.
7476 (sub_svalue::implicitly_live_p): Likewise.
7477 (unmergeable_svalue::implicitly_live_p): Likewise.
7479 2021-02-12 David Malcolm <dmalcolm@redhat.com>
7481 PR analyzer/98969
7482 * engine.cc (readability): Add names for the various arbitrary
7483 values. Handle NOP_EXPR and INTEGER_CST.
7484 (readability_comparator): Combine the readability tests for
7485 tree and stack depth, rather than performing them sequentially.
7486 (impl_region_model_context::on_state_leak): Strip off top-level
7487 casts.
7488 * region-model.cc (region_model::get_representative_path_var): Add
7489 type-checking, moving the bulk of the implementation to...
7490 (region_model::get_representative_path_var_1): ...here. Respect
7491 types in casts by recursing and re-adding the cast, rather than
7492 merely stripping them off. Use the correct type when handling
7493 region_svalue.
7494 (region_model::get_representative_tree): Strip off any top-level
7495 cast.
7496 (region_model::get_representative_path_var): Add type-checking,
7497 moving the bulk of the implementation to...
7498 (region_model::get_representative_path_var_1): ...here.
7499 * region-model.h (region_model::get_representative_path_var_1):
7500 New decl
7501 (region_model::get_representative_path_var_1): New decl.
7502 * store.cc (append_pathvar_with_type): New.
7503 (binding_cluster::get_representative_path_vars): Cast path_vars
7504 to the correct type when adding them to *OUT_PVS.
7506 2021-02-09 David Malcolm <dmalcolm@redhat.com>
7508 PR analyzer/98575
7509 * sm-file.cc (is_file_using_fn_p): Support "_IO_"-prefixed
7510 variants.
7512 2021-02-09 David Malcolm <dmalcolm@redhat.com>
7514 PR analyzer/98575
7515 * store.cc (store::set_value): Treat a pointer written to *UNKNOWN
7516 as having escaped.
7518 2021-02-02 David Malcolm <dmalcolm@redhat.com>
7520 PR analyzer/93355
7521 PR analyzer/96374
7522 * engine.cc (toplevel_function_p): Simplify so that
7523 we only reject functions with a "__analyzer_" prefix.
7524 (add_any_callbacks): Delete.
7525 (exploded_graph::build_initial_worklist): Update for
7526 dropped param of toplevel_function_p.
7527 (exploded_graph::build_initial_worklist): Don't bother
7528 looking for callbacks that are reachable from global
7529 initializers.
7531 2021-02-01 David Malcolm <dmalcolm@redhat.com>
7533 PR analyzer/98918
7534 * region-model-manager.cc
7535 (region_model_manager::get_or_create_initial_value):
7536 Fold the initial value of *UNKNOWN_PTR to an UNKNOWN value.
7537 (region_model_manager::get_field_region): Fold the value
7538 of UNKNOWN_PTR->FIELD to *UNKNOWN_PTR_OF_&FIELD_TYPE.
7540 2021-01-29 David Malcolm <dmalcolm@redhat.com>
7542 * checker-path.cc (event_kind_to_string): Handle
7543 EK_START_CONSOLIDATED_CFG_EDGES and
7544 EK_END_CONSOLIDATED_CFG_EDGES.
7545 (start_consolidated_cfg_edges_event::get_desc): New.
7546 (checker_path::cfg_edge_pair_at_p): New.
7547 * checker-path.h (enum event_kind): Add
7548 EK_START_CONSOLIDATED_CFG_EDGES and
7549 EK_END_CONSOLIDATED_CFG_EDGES.
7550 (class start_consolidated_cfg_edges_event): New class.
7551 (class end_consolidated_cfg_edges_event): New class.
7552 (checker_path::delete_events): New.
7553 (checker_path::replace_event): New.
7554 (checker_path::cfg_edge_pair_at_p): New decl.
7555 * diagnostic-manager.cc (diagnostic_manager::prune_path): Call
7556 consolidate_conditions.
7557 (same_line_as_p): New.
7558 (diagnostic_manager::consolidate_conditions): New.
7559 * diagnostic-manager.h
7560 (diagnostic_manager::consolidate_conditions): New decl.
7562 2021-01-18 David Malcolm <dmalcolm@redhat.com>
7564 * analyzer.h (is_std_named_call_p): New decl.
7565 * diagnostic-manager.cc (path_builder::get_sm): New.
7566 (state_change_event_creator::state_change_event_creator): Add "pb"
7567 param.
7568 (state_change_event_creator::on_global_state_change): Don't consider
7569 state changes affecting other state_machines.
7570 (state_change_event_creator::on_state_change): Likewise.
7571 (state_change_event_creator::m_pb): New field.
7572 (diagnostic_manager::add_events_for_eedge): Pass pb to visitor
7573 ctor.
7574 * region-model-impl-calls.cc
7575 (region_model::impl_deallocation_call): New.
7576 * region-model.cc: Include "attribs.h".
7577 (region_model::on_call_post): Handle fndecls referenced by
7578 __attribute__((deallocated_by(FOO))).
7579 * region-model.h (region_model::impl_deallocation_call): New decl.
7580 * sm-malloc.cc: Include "stringpool.h" and "attribs.h". Add
7581 leading comment.
7582 (class api): Delete.
7583 (enum resource_state): Update comment for change from api to
7584 deallocator and deallocator_set.
7585 (allocation_state::allocation_state): Drop api param. Add
7586 "deallocators" and "deallocator".
7587 (allocation_state::m_api): Drop field in favor of...
7588 (allocation_state::m_deallocators): New field.
7589 (allocation_state::m_deallocator): New field.
7590 (enum wording): Add WORDING_DEALLOCATED.
7591 (struct deallocator): New.
7592 (struct standard_deallocator): New.
7593 (struct custom_deallocator): New.
7594 (struct deallocator_set): New.
7595 (struct custom_deallocator_set): New.
7596 (struct standard_deallocator_set): New.
7597 (struct deallocator_set_map_traits): New.
7598 (malloc_state_machine::m_malloc): Drop field
7599 (malloc_state_machine::m_scalar_new): Likewise.
7600 (malloc_state_machine::m_vector_new): Likewise.
7601 (malloc_state_machine::m_free): New field
7602 (malloc_state_machine::m_scalar_delete): Likewise.
7603 (malloc_state_machine::m_vector_delete): Likewise.
7604 (malloc_state_machine::deallocator_map_t): New typedef.
7605 (malloc_state_machine::m_deallocator_map): New field.
7606 (malloc_state_machine::deallocator_set_cache_t): New typedef.
7607 (malloc_state_machine::m_custom_deallocator_set_cache): New field.
7608 (malloc_state_machine::custom_deallocator_set_map_t): New typedef.
7609 (malloc_state_machine::m_custom_deallocator_set_map): New field.
7610 (malloc_state_machine::m_dynamic_sets): New field.
7611 (malloc_state_machine::m_dynamic_deallocators): New field.
7612 (api::api): Delete.
7613 (deallocator::deallocator): New ctor.
7614 (deallocator::hash): New.
7615 (deallocator::dump_to_pp): New.
7616 (deallocator::cmp): New.
7617 (deallocator::cmp_ptr_ptr): New.
7618 (standard_deallocator::standard_deallocator): New ctor.
7619 (deallocator_set::deallocator_set): New ctor.
7620 (deallocator_set::dump): New.
7621 (custom_deallocator_set::custom_deallocator_set): New ctor.
7622 (custom_deallocator_set::contains_p): New.
7623 (custom_deallocator_set::maybe_get_single): New.
7624 (custom_deallocator_set::dump_to_pp): New.
7625 (standard_deallocator_set::standard_deallocator_set): New ctor.
7626 (standard_deallocator_set::contains_p): New.
7627 (standard_deallocator_set::maybe_get_single): New.
7628 (standard_deallocator_set::dump_to_pp): New.
7629 (start_p): New.
7630 (class mismatching_deallocation): Update for conversion from api
7631 to deallocator_set and deallocator.
7632 (double_free::emit): Use %qs.
7633 (class use_after_free): Update for conversion from api to
7634 deallocator_set and deallocator.
7635 (malloc_leak::describe_state_change): Only emit "allocated here" on
7636 a start->nonnull transition, rather than on other transitions to
7637 nonnull.
7638 (allocation_state::dump_to_pp): Update for conversion from api to
7639 deallocator_set.
7640 (allocation_state::get_nonnull): Likewise.
7641 (malloc_state_machine::malloc_state_machine): Likewise.
7642 (malloc_state_machine::~malloc_state_machine): New.
7643 (malloc_state_machine::add_state): Update for conversion from api
7644 to deallocator_set.
7645 (malloc_state_machine::get_or_create_custom_deallocator_set): New.
7646 (malloc_state_machine::maybe_create_custom_deallocator_set): New.
7647 (malloc_state_machine::get_or_create_deallocator): New.
7648 (malloc_state_machine::on_stmt): Update for conversion from api
7649 to deallocator_set. Handle "__attribute__((malloc(FOO)))", and
7650 the special attribute set on FOO.
7651 (malloc_state_machine::on_allocator_call): Update for conversion
7652 from api to deallocator_set. Add "returns_nonnull" param and use
7653 it to affect which state to transition to.
7654 (malloc_state_machine::on_deallocator_call): Update for conversion
7655 from api to deallocator_set.
7657 2021-01-14 David Malcolm <dmalcolm@redhat.com>
7659 * engine.cc (strongly_connected_components::to_json): New.
7660 (worklist::to_json): New.
7661 (exploded_graph::to_json): JSON-ify the worklist.
7662 * exploded-graph.h (strongly_connected_components::to_json): New
7663 decl.
7664 (worklist::to_json): New decl.
7665 * store.cc (store::to_json): Fix comment.
7666 * supergraph.cc (supernode::to_json): Fix reference to
7667 "returning_call" in comment. Add optional "fun" to JSON.
7668 (edge_kind_to_string): New.
7669 (superedge::to_json): Add "kind" to JSON.
7671 2021-01-14 David Malcolm <dmalcolm@redhat.com>
7673 PR analyzer/98679
7674 * analyzer.h (region_offset::operator==): Make const.
7675 * pending-diagnostic.h (pending_diagnostic::equal_p): Likewise.
7676 * store.h (binding_cluster::for_each_value): Likewise.
7677 (binding_cluster::for_each_binding): Likewise.
7679 2021-01-12 David Malcolm <dmalcolm@redhat.com>
7681 PR analyzer/98628
7682 * store.cc (binding_cluster::make_unknown_relative_to): Don't mark
7683 dereferenced unknown pointers as having escaped.
7685 2021-01-07 David Malcolm <dmalcolm@redhat.com>
7687 PR analyzer/98580
7688 * region.cc (decl_region::get_svalue_for_initializer): Gracefully
7689 handle when LTO writes out DECL_INITIAL as error_mark_node.
7691 2021-01-07 David Malcolm <dmalcolm@redhat.com>
7693 PR analyzer/97074
7694 * store.cc (binding_cluster::can_merge_p): Add "out_store" param
7695 and pass to calls to binding_cluster::make_unknown_relative_to.
7696 (binding_cluster::make_unknown_relative_to): Add "out_store"
7697 param. Use it to mark base regions that are pointed to by
7698 pointers that become unknown as having escaped.
7699 (store::can_merge_p): Pass out_store to
7700 binding_cluster::can_merge_p.
7701 * store.h (binding_cluster::can_merge_p): Add "out_store" param.
7702 (binding_cluster::make_unknown_relative_to): Likewise.
7703 * svalue.cc (region_svalue::implicitly_live_p): New vfunc.
7704 * svalue.h (region_svalue::implicitly_live_p): New vfunc decl.
7706 2021-01-07 David Malcolm <dmalcolm@redhat.com>
7708 PR analyzer/98564
7709 * engine.cc (exploded_path::feasible_p): Add missing call to
7710 bitmap_clear.
7712 2021-01-06 David Malcolm <dmalcolm@redhat.com>
7714 PR analyzer/97072
7715 * region-model-reachability.cc (reachable_regions::init_cluster):
7716 Convert symbolic region handling to a switch statement. Add cases
7717 to handle SK_UNKNOWN and SK_CONJURED.
7719 2021-01-05 David Malcolm <dmalcolm@redhat.com>
7721 PR analyzer/98293
7722 * store.cc (binding_map::apply_ctor_to_region): When "index" is
7723 NULL, iterate through the fields for RECORD_TYPEs, rather than
7724 creating an INTEGER_CST index.
7726 2020-11-30 David Malcolm <dmalcolm@redhat.com>
7728 * analyzer-pass.cc: Include "analyzer/analyzer.h" for the
7729 declaration of sorry_no_analyzer; include "tree.h" and
7730 "function.h" as these are needed by it.
7732 2020-11-30 David Malcolm <dmalcolm@redhat.com>
7734 * analyzer-pass.cc (pass_analyzer::execute): Move sorry call to...
7735 (sorry_no_analyzer): New.
7736 * analyzer.h (class state_machine): New forward decl.
7737 (class logger): New forward decl.
7738 (class plugin_analyzer_init_iface): New.
7739 (sorry_no_analyzer): New decl.
7740 * checker-path.cc (checker_path::fixup_locations): New.
7741 * checker-path.h (checker_event::set_location): New.
7742 (checker_path::fixup_locations): New decl.
7743 * diagnostic-manager.cc
7744 (diagnostic_manager::emit_saved_diagnostic): Call
7745 checker_path::fixup_locations, and call fixup_location
7746 on the primary location.
7747 * engine.cc: Include "plugin.h".
7748 (class plugin_analyzer_init_impl): New.
7749 (impl_run_checkers): Invoke PLUGIN_ANALYZER_INIT callbacks.
7750 * pending-diagnostic.h (pending_diagnostic::fixup_location): New
7751 vfunc.
7753 2020-11-18 David Malcolm <dmalcolm@redhat.com>
7755 PR analyzer/97893
7756 * sm-malloc.cc (null_deref::emit): Use CWE-476 rather than
7757 CWE-690, as this isn't due to an unchecked return value.
7758 (null_arg::emit): Likewise.
7760 2020-11-12 David Malcolm <dmalcolm@redhat.com>
7762 * checker-path.h (checker_event::get_id_ptr): New.
7763 * diagnostic-manager.cc (path_builder::path_builder): Add "sd"
7764 param and use it to initialize new field "m_sd".
7765 (path_builder::get_pending_diagnostic): New.
7766 (path_builder::m_sd): New field.
7767 (diagnostic_manager::emit_saved_diagnostic): Pass sd to
7768 path_builder ctor.
7769 (diagnostic_manager::add_events_for_superedge): Call new
7770 maybe_add_custom_events_for_superedge vfunc.
7771 * engine.cc (stale_jmp_buf::stale_jmp_buf): Add "setjmp_point"
7772 param and use it to initialize new field "m_setjmp_point".
7773 Initialize new field "m_stack_pop_event".
7774 (stale_jmp_buf::maybe_add_custom_events_for_superedge): New vfunc
7775 implementation.
7776 (stale_jmp_buf::describe_final_event): New vfunc implementation.
7777 (stale_jmp_buf::m_setjmp_point): New field.
7778 (stale_jmp_buf::m_stack_pop_event): New field.
7779 (exploded_node::on_longjmp): Pass setjmp_point to stale_jmp_buf
7780 ctor.
7781 * pending-diagnostic.h
7782 (pending_diagnostic::maybe_add_custom_events_for_superedge): New
7783 vfunc.
7785 2020-11-12 David Malcolm <dmalcolm@redhat.com>
7787 PR tree-optimization/97424
7788 * analyzer.opt (Wanalyzer-shift-count-negative): New.
7789 (Wanalyzer-shift-count-overflow): New.
7790 * region-model.cc (class shift_count_negative_diagnostic): New.
7791 (class shift_count_overflow_diagnostic): New.
7792 (region_model::get_gassign_result): Complain about shift counts that
7793 are negative or are >= the operand's type's width.
7795 2020-11-10 Martin Liska <mliska@suse.cz>
7797 * constraint-manager.cc (constraint_manager::merge): Remove
7798 unused code.
7799 * constraint-manager.h: Likewise.
7800 * program-state.cc (sm_state_map::sm_state_map): Likewise.
7801 (program_state::program_state): Likewise.
7802 (test_sm_state_map): Likewise.
7803 * program-state.h: Likewise.
7804 * region-model-reachability.cc (reachable_regions::reachable_regions): Likewise.
7805 * region-model-reachability.h: Likewise.
7806 * region-model.cc (region_model::handle_unrecognized_call): Likewise.
7807 (region_model::get_reachable_svalues): Likewise.
7808 (region_model::can_merge_with_p): Likewise.
7810 2020-11-05 David Malcolm <dmalcolm@redhat.com>
7812 PR analyzer/97668
7813 * svalue.cc (cmp_cst): Handle COMPLEX_CST.
7815 2020-10-29 David Malcolm <dmalcolm@redhat.com>
7817 * program-state.cc (sm_state_map::on_liveness_change): Sort the
7818 leaking svalues before calling on_state_leak.
7819 (program_state::detect_leaks): Likewise when calling
7820 on_svalue_leak.
7821 * region-model-reachability.cc
7822 (reachable_regions::mark_escaped_clusters): Likewise when
7823 calling on_escaped_function.
7825 2020-10-29 David Malcolm <dmalcolm@redhat.com>
7827 PR analyzer/97608
7828 * region-model-reachability.cc (reachable_regions::handle_sval):
7829 Operands of reachable reversible operations are reachable.
7831 2020-10-29 David Malcolm <dmalcolm@redhat.com>
7833 * analyzer.h (class state_machine): New forward decl.
7834 (class logger): Likewise.
7835 (class visitor): Likewise.
7836 * complexity.cc: New file, taken from svalue.cc.
7837 * complexity.h: New file, taken from region-model.h.
7838 * region-model.h: Include "analyzer/svalue.h" and
7839 "analyzer/region.h". Move struct complexity to complexity.h.
7840 Move svalue, its subclasses and supporting decls to svalue.h.
7841 Move region, its subclasses and supporting decls to region.h.
7842 * region.cc: Include "analyzer/region.h".
7843 (symbolic_region::symbolic_region): Move here from region-model.h.
7844 * region.h: New file, based on material from region-model.h.
7845 * svalue.cc: Include "analyzer/svalue.h".
7846 (complexity::complexity): Move to complexity.cc.
7847 (complexity::from_pair): Likewise.
7848 * svalue.h: New file, based on material from region-model.h.
7850 2020-10-29 David Malcolm <dmalcolm@redhat.com>
7852 * program-state.cc (sm_state_map::print): Guard the printing of
7853 the origin pointer with !flag_dump_noaddr.
7854 * region.cc (string_region::dump_to_pp): Likewise for
7855 m_string_cst.
7857 2020-10-27 David Malcolm <dmalcolm@redhat.com>
7859 PR analyzer/97568
7860 * region-model.cc (region_model::get_initial_value_for_global):
7861 Move check that !DECL_EXTERNAL from here to...
7862 * region.cc (decl_region::get_svalue_for_initializer): ...here,
7863 using it to reject zero initialization.
7865 2020-10-27 Markus Böck <markus.boeck02@gmail.com>
7867 PR analyzer/96608
7868 * store.h (hash): Cast to intptr_t instead of long
7870 2020-10-27 David Malcolm <dmalcolm@redhat.com>
7872 * constraint-manager.cc (svalue_cmp_by_ptr): Delete.
7873 (equiv_class::canonicalize): Use svalue::cmp_ptr_ptr instead.
7874 (equiv_class_cmp): Eliminate pointer comparison.
7875 * diagnostic-manager.cc (dedupe_key::comparator): If they are at
7876 the same location, also compare epath ength and pending_diagnostic
7877 kind.
7878 * engine.cc (readability_comparator): If two path_vars have the
7879 same readability, then impose an arbitrary ordering on them.
7880 (worklist::key_t::cmp): If two points have the same plan ordering,
7881 continue the comparison. Call sm_state_map::cmp rather than
7882 comparing hash values.
7883 * program-state.cc (sm_state_map::entry_t::cmp): New.
7884 (sm_state_map::cmp): New.
7885 * program-state.h (sm_state_map::entry_t::cmp): New decl.
7886 (sm_state_map::elements): New.
7887 (sm_state_map::cmp): New.
7889 2020-10-27 David Malcolm <dmalcolm@redhat.com>
7891 * engine.cc (setjmp_record::cmp): New.
7892 (supernode_cluster::dump_dot): Avoid embedding pointer in cluster
7893 name.
7894 (supernode_cluster::cmp_ptr_ptr): New.
7895 (function_call_string_cluster::dump_dot): Avoid embedding pointer
7896 in cluster name. Sort m_map when dumping child clusters.
7897 (function_call_string_cluster::cmp_ptr_ptr): New.
7898 (root_cluster::dump_dot): Sort m_map when dumping child clusters.
7899 * program-point.cc (function_point::cmp): New.
7900 (function_point::cmp_ptr): New.
7901 * program-point.h (function_point::cmp): New decl.
7902 (function_point::cmp_ptr): New decl.
7903 * program-state.cc (sm_state_map::print): Sort the values. Guard
7904 the printing of pointers with !flag_dump_noaddr.
7905 (program_state::prune_for_point): Sort the regions.
7906 (log_set_of_svalues): Sort the values. Guard the printing of
7907 pointers with !flag_dump_noaddr.
7908 * region-model-manager.cc (log_uniq_map): Sort the values.
7909 * region-model-reachability.cc (dump_set): New function template.
7910 (reachable_regions::dump_to_pp): Use it.
7911 * region-model.h (svalue::cmp_ptr): New decl.
7912 (svalue::cmp_ptr_ptr): New decl.
7913 (setjmp_record::cmp): New decl.
7914 (placeholder_svalue::get_name): New accessor.
7915 (widening_svalue::get_point): New accessor.
7916 (compound_svalue::get_map): New accessor.
7917 (conjured_svalue::get_stmt): New accessor.
7918 (conjured_svalue::get_id_region): New accessor.
7919 (region::cmp_ptrs): Rename to...
7920 (region::cmp_ptr_ptr): ...this.
7921 * region.cc (region::cmp_ptrs): Rename to...
7922 (region::cmp_ptr_ptr): ...this.
7923 * state-purge.cc
7924 (state_purge_per_ssa_name::state_purge_per_ssa_name): Sort
7925 m_points_needing_name when dumping.
7926 * store.cc (concrete_binding::cmp_ptr_ptr): New.
7927 (symbolic_binding::cmp_ptr_ptr): New.
7928 (binding_map::cmp): New.
7929 (get_sorted_parent_regions): Update for renaming of
7930 region::cmp_ptrs to region::cmp_ptr_ptr.
7931 (store::dump_to_pp): Likewise.
7932 (store::to_json): Likewise.
7933 (store::can_merge_p): Sort the base regions before considering
7934 them.
7935 * store.h (concrete_binding::cmp_ptr_ptr): New decl.
7936 (symbolic_binding::cmp_ptr_ptr): New decl.
7937 (binding_map::cmp): New decl.
7938 * supergraph.cc (supergraph::supergraph): Assign UIDs to the
7939 gimple stmts.
7940 * svalue.cc (cmp_cst): New.
7941 (svalue::cmp_ptr): New.
7942 (svalue::cmp_ptr_ptr): New.
7944 2020-10-27 David Malcolm <dmalcolm@redhat.com>
7946 * engine.cc (exploded_graph::get_or_create_node): Fix off-by-one
7947 when imposing param_analyzer_max_enodes_per_program_point limit.
7949 2020-10-27 David Malcolm <dmalcolm@redhat.com>
7951 * region-model.cc (region_model::get_representative_path_var):
7952 Implement case RK_LABEL.
7953 * region-model.h (label_region::get_label): New accessor.
7955 2020-10-22 David Malcolm <dmalcolm@redhat.com>
7957 PR analyzer/97514
7958 * engine.cc (exploded_graph::add_function_entry): Handle failure
7959 to create an enode, rather than asserting.
7961 2020-10-22 David Malcolm <dmalcolm@redhat.com>
7963 PR analyzer/97489
7964 * engine.cc (exploded_graph::add_function_entry): Assert that we
7965 have a function body.
7966 (exploded_graph::on_escaped_function): Reject fndecls that don't
7967 have a function body.
7969 2020-10-14 David Malcolm <dmalcolm@redhat.com>
7971 PR analyzer/93388
7972 * region-model.cc (region_model::get_initial_value_for_global):
7973 Fall back to returning an initial_svalue if
7974 decl_region::get_svalue_for_initializer fails.
7975 * region.cc (decl_region::get_svalue_for_initializer): Don't
7976 attempt to create a compound_svalue if the region has an unknown
7977 size.
7979 2020-10-14 David Malcolm <dmalcolm@redhat.com>
7981 PR analyzer/93723
7982 * store.cc (binding_map::apply_ctor_to_region): Remove redundant
7983 assertion.
7985 2020-10-12 David Malcolm <dmalcolm@redhat.com>
7987 PR analyzer/97258
7988 * engine.cc (impl_region_model_context::on_escaped_function): New
7989 vfunc.
7990 (exploded_graph::add_function_entry): Use m_functions_with_enodes
7991 to implement idempotency.
7992 (add_any_callbacks): New.
7993 (exploded_graph::build_initial_worklist): Use the above to find
7994 callbacks that are reachable from global initializers.
7995 (exploded_graph::on_escaped_function): New.
7996 * exploded-graph.h
7997 (impl_region_model_context::on_escaped_function): New decl.
7998 (exploded_graph::on_escaped_function): New decl.
7999 (exploded_graph::m_functions_with_enodes): New field.
8000 * region-model-reachability.cc
8001 (reachable_regions::reachable_regions): Replace "store" param with
8002 "model" param; use it to initialize m_model.
8003 (reachable_regions::add): When getting the svalue for the region,
8004 call get_store_value on the model rather than using an initial
8005 value.
8006 (reachable_regions::mark_escaped_clusters): Add ctxt param and
8007 use it to call on_escaped_function when a function_region escapes.
8008 * region-model-reachability.h
8009 (reachable_regions::reachable_regions): Replace "store" param with
8010 "model" param.
8011 (reachable_regions::mark_escaped_clusters): Add ctxt param.
8012 (reachable_regions::m_model): New field.
8013 * region-model.cc (region_model::handle_unrecognized_call): Update
8014 for change in reachable_regions ctor.
8015 (region_model::handle_unrecognized_call): Pass ctxt to
8016 mark_escaped_clusters.
8017 (region_model::get_reachable_svalues): Update for change in
8018 reachable_regions ctor.
8019 (region_model::get_initial_value_for_global): Read-only variables
8020 keep their initial values.
8021 * region-model.h (region_model_context::on_escaped_function): New
8022 vfunc.
8023 (noop_region_model_context::on_escaped_function): New.
8025 2020-10-12 David Malcolm <dmalcolm@redhat.com>
8027 * analyzer.opt (Wanalyzer-write-to-const): New.
8028 (Wanalyzer-write-to-string-literal): New.
8029 * region-model-impl-calls.cc (region_model::impl_call_memcpy):
8030 Call check_for_writable_region.
8031 (region_model::impl_call_memset): Likewise.
8032 (region_model::impl_call_strcpy): Likewise.
8033 * region-model.cc (class write_to_const_diagnostic): New.
8034 (class write_to_string_literal_diagnostic): New.
8035 (region_model::check_for_writable_region): New.
8036 (region_model::set_value): Call check_for_writable_region.
8037 * region-model.h (region_model::check_for_writable_region): New
8038 decl.
8040 2020-10-07 David Malcolm <dmalcolm@redhat.com>
8042 PR analyzer/97116
8043 * sm-malloc.cc (method_p): New.
8044 (describe_argument_index): New.
8045 (inform_nonnull_attribute): Use describe_argument_index.
8046 (possible_null_arg::describe_final_event): Likewise.
8047 (null_arg::describe_final_event): Likewise.
8049 2020-09-29 David Malcolm <dmalcolm@redhat.com>
8051 PR analyzer/95188
8052 * engine.cc (stmt_requires_new_enode_p): Split enodes before
8053 "signal" calls.
8055 2020-09-29 David Malcolm <dmalcolm@redhat.com>
8057 * constraint-manager.cc
8058 (constraint_manager::add_constraint_internal): Whitespace fixes.
8059 Silence -Wsign-compare warning.
8060 * engine.cc (maybe_process_run_of_before_supernode_enodes):
8061 Silence -Wsign-compare warning.
8063 2020-09-28 David Malcolm <dmalcolm@redhat.com>
8065 * region-model.h (binop_svalue::dyn_cast_binop_svalue): Remove
8066 redundant "virtual". Add FINAL OVERRIDE.
8067 (widening_svalue::dyn_cast_widening_svalue): Add FINAL OVERRIDE.
8068 (compound_svalue::dyn_cast_compound_svalue): Likewise.
8069 (conjured_svalue::dyn_cast_conjured_svalue): Likewise.
8071 2020-09-28 David Malcolm <dmalcolm@redhat.com>
8073 * diagnostic-manager.cc (null_assignment_sm_context::m_visitor):
8074 Remove unused field.
8076 2020-09-28 David Malcolm <dmalcolm@redhat.com>
8078 PR analyzer/97233
8079 * analyzer.cc (is_longjmp_call_p): Require the initial argument
8080 to be a pointer.
8081 * engine.cc (exploded_node::on_longjmp): Likewise.
8083 2020-09-28 David Malcolm <dmalcolm@redhat.com>
8085 * program-state.cc (sm_state_map::print): Update check
8086 for m_global_state being the start state.
8088 2020-09-26 David Malcolm <dmalcolm@redhat.com>
8090 PR analyzer/96646
8091 PR analyzer/96841
8092 * region-model.cc (region_model::get_representative_path_var):
8093 When handling offset_region, wrap the MEM_REF's first argument in
8094 an ADDR_EXPR of pointer type, rather than simply using the tree
8095 for the parent region. Require the MEM_REF's second argument to
8096 be an integer constant.
8098 2020-09-24 David Malcolm <dmalcolm@redhat.com>
8100 * analyzer.h (struct rejected_constraint): New decl.
8101 * analyzer.opt (fanalyzer-feasibility): New option.
8102 * diagnostic-manager.cc (path_builder::path_builder): Add
8103 "problem" param and use it to initialize new field.
8104 (path_builder::get_feasibility_problem): New accessor.
8105 (path_builder::m_feasibility_problem): New field.
8106 (dedupe_winners::add): Remove inversion of logic in "if" clause,
8107 swapping if/else suites. In the !feasible_p suite, inspect
8108 flag_analyzer_feasibility and add code to handle when this
8109 is off, accepting the infeasible path, but recording the
8110 feasibility_problem.
8111 (diagnostic_manager::emit_saved_diagnostic): Pass the
8112 feasibility_problem to the path_builder.
8113 (diagnostic_manager::add_events_for_eedge): If we have
8114 a feasibility_problem at this edge, use it to add a custom event.
8115 * engine.cc (exploded_path::feasible_p): Pass a
8116 rejected_constraint ** to model.maybe_update_for_edge and transfer
8117 ownership of any created instance to any feasibility_problem.
8118 (feasibility_problem::dump_to_pp): New.
8119 * exploded-graph.h (feasibility_problem::feasibility_problem):
8120 Drop "model" param; add rejected_constraint * param.
8121 (feasibility_problem::~feasibility_problem): New.
8122 (feasibility_problem::dump_to_pp): New decl.
8123 (feasibility_problem::m_model): Drop field.
8124 (feasibility_problem::m_rc): New field.
8125 * program-point.cc (function_point::get_location): Handle
8126 PK_BEFORE_SUPERNODE and PK_AFTER_SUPERNODE.
8127 * program-state.cc (program_state::on_edge): Pass NULL to new
8128 param of region_model::maybe_update_for_edge.
8129 * region-model.cc (region_model::add_constraint): New overload
8130 adding a rejected_constraint ** param.
8131 (region_model::maybe_update_for_edge): Add rejected_constraint **
8132 param and pass it to the various apply_constraints_for_ calls.
8133 (region_model::apply_constraints_for_gcond): Add
8134 rejected_constraint ** param and pass it to add_constraint calls.
8135 (region_model::apply_constraints_for_gswitch): Likewise.
8136 (region_model::apply_constraints_for_exception): Likewise.
8137 (rejected_constraint::dump_to_pp): New.
8138 * region-model.h (region_model::maybe_update_for_edge):
8139 Add rejected_constraint ** param.
8140 (region_model::add_constraint): New overload adding a
8141 rejected_constraint ** param.
8142 (region_model::apply_constraints_for_gcond): Add
8143 rejected_constraint ** param.
8144 (region_model::apply_constraints_for_gswitch): Likewise.
8145 (region_model::apply_constraints_for_exception): Likewise.
8146 (struct rejected_constraint): New.
8148 2020-09-23 David Malcolm <dmalcolm@redhat.com>
8150 PR analyzer/97178
8151 * engine.cc (impl_run_checkers): Update for change to ext_state
8152 ctor.
8153 * program-state.cc (selftest::test_sm_state_map): Pass an engine
8154 instance to ext_state ctor.
8155 (selftest::test_program_state_1): Likewise.
8156 (selftest::test_program_state_2): Likewise.
8157 (selftest::test_program_state_merging): Likewise.
8158 (selftest::test_program_state_merging_2): Likewise.
8159 * program-state.h (extrinsic_state::extrinsic_state): Remove NULL
8160 default value for "eng" param.
8162 2020-09-23 Tobias Burnus <tobias@codesourcery.com>
8164 * analyzer-logging.cc: Guard '#pragma ... ignored "-Wformat-diag"'
8165 by '#if __GNUC__ >= 10'
8166 * analyzer.h: Likewise.
8167 * call-string.cc: Likewise.
8169 2020-09-23 David Malcolm <dmalcolm@redhat.com>
8171 * engine.cc (exploded_node::on_stmt): Replace sequence of dyn_cast
8172 with switch.
8174 2020-09-22 David Malcolm <dmalcolm@redhat.com>
8176 * analysis-plan.cc: Include "json.h".
8177 * analyzer.opt (fdump-analyzer-json): New.
8178 * call-string.cc: Include "json.h".
8179 (call_string::to_json): New.
8180 * call-string.h (call_string::to_json): New decl.
8181 * checker-path.cc: Include "json.h".
8182 * constraint-manager.cc: Include "json.h".
8183 (equiv_class::to_json): New.
8184 (constraint::to_json): New.
8185 (constraint_manager::to_json): New.
8186 * constraint-manager.h (equiv_class::to_json): New decl.
8187 (constraint::to_json): New decl.
8188 (constraint_manager::to_json): New decl.
8189 * diagnostic-manager.cc: Include "json.h".
8190 (saved_diagnostic::to_json): New.
8191 (diagnostic_manager::to_json): New.
8192 * diagnostic-manager.h (saved_diagnostic::to_json): New decl.
8193 (diagnostic_manager::to_json): New decl.
8194 * engine.cc: Include "json.h", <zlib.h>.
8195 (exploded_node::status_to_str): New.
8196 (exploded_node::to_json): New.
8197 (exploded_edge::to_json): New.
8198 (exploded_graph::to_json): New.
8199 (dump_analyzer_json): New.
8200 (impl_run_checkers): Call it.
8201 * exploded-graph.h (exploded_node::status_to_str): New decl.
8202 (exploded_node::to_json): New.
8203 (exploded_edge::to_json): New.
8204 (exploded_graph::to_json): New.
8205 * pending-diagnostic.cc: Include "json.h".
8206 * program-point.cc: Include "json.h".
8207 (program_point::to_json): New.
8208 * program-point.h (program_point::to_json): New decl.
8209 * program-state.cc: Include "json.h".
8210 (extrinsic_state::to_json): New.
8211 (sm_state_map::to_json): New.
8212 (program_state::to_json): New.
8213 * program-state.h (extrinsic_state::to_json): New decl.
8214 (sm_state_map::to_json): New decl.
8215 (program_state::to_json): New decl.
8216 * region-model-impl-calls.cc: Include "json.h".
8217 * region-model-manager.cc: Include "json.h".
8218 * region-model-reachability.cc: Include "json.h".
8219 * region-model.cc: Include "json.h".
8220 * region-model.h (svalue::to_json): New decl.
8221 (region::to_json): New decl.
8222 * region.cc: Include "json.h".
8223 (region::to_json: New.
8224 * sm-file.cc: Include "json.h".
8225 * sm-malloc.cc: Include "json.h".
8226 * sm-pattern-test.cc: Include "json.h".
8227 * sm-sensitive.cc: Include "json.h".
8228 * sm-signal.cc: Include "json.h".
8229 (signal_delivery_edge_info_t::to_json): New.
8230 * sm-taint.cc: Include "json.h".
8231 * sm.cc: Include "diagnostic.h", "tree-diagnostic.h", and
8232 "json.h".
8233 (state_machine::state::to_json): New.
8234 (state_machine::to_json): New.
8235 * sm.h (state_machine::state::to_json): New.
8236 (state_machine::to_json): New.
8237 * state-purge.cc: Include "json.h".
8238 * store.cc: Include "json.h".
8239 (binding_key::get_desc): New.
8240 (binding_map::to_json): New.
8241 (binding_cluster::to_json): New.
8242 (store::to_json): New.
8243 * store.h (binding_key::get_desc): New decl.
8244 (binding_map::to_json): New decl.
8245 (binding_cluster::to_json): New decl.
8246 (store::to_json): New decl.
8247 * supergraph.cc: Include "json.h".
8248 (supergraph::to_json): New.
8249 (supernode::to_json): New.
8250 (superedge::to_json): New.
8251 * supergraph.h (supergraph::to_json): New decl.
8252 (supernode::to_json): New decl.
8253 (superedge::to_json): New decl.
8254 * svalue.cc: Include "json.h".
8255 (svalue::to_json): New.
8257 2020-09-21 David Malcolm <dmalcolm@redhat.com>
8259 PR analyzer/97130
8260 * region-model-impl-calls.cc (call_details::get_arg_type): New.
8261 * region-model.cc (region_model::on_call_pre): Check that the
8262 initial arg is a pointer before calling impl_call_memset and
8263 impl_call_strlen.
8264 * region-model.h (call_details::get_arg_type): New decl.
8266 2020-09-21 David Malcolm <dmalcolm@redhat.com>
8268 PR analyzer/93355
8269 * sm-malloc.cc (malloc_state_machine::get_default_state): Look at
8270 the base region when considering pointers. Treat pointers to
8271 decls as being non-heap.
8273 2020-09-18 David Malcolm <dmalcolm@redhat.com>
8275 * checker-path.cc (warning_event::get_desc): Handle global state
8276 changes.
8278 2020-09-18 David Malcolm <dmalcolm@redhat.com>
8280 * sm-malloc.cc (malloc_state_machine::on_stmt): Handle strdup and
8281 strndup as being malloc-like allocators.
8283 2020-09-16 David Malcolm <dmalcolm@redhat.com>
8285 * engine.cc (strongly_connected_components::strong_connect): Only
8286 consider intraprocedural edges when creating SCCs.
8287 (worklist::key_t::cmp): Add comment. Treat call_string
8288 differences as more important than differences of program_point
8289 within a supernode.
8291 2020-09-16 David Malcolm <dmalcolm@redhat.com>
8293 * engine.cc (supernode_cluster::dump_dot): Show the SCC id
8294 in the per-supernode clusters in FILENAME.eg.dot output.
8295 (exploded_graph_annotator::add_node_annotations):
8296 Show the SCC of the supernode in FILENAME.supernode.eg.dot output.
8297 * exploded-graph.h (worklist::scc_id): New.
8298 (exploded_graph::get_scc_id): New.
8300 2020-09-16 David Malcolm <dmalcolm@redhat.com>
8302 * engine.cc (exploded_node::dump_dot): Show STATUS_BULK_MERGED.
8303 (exploded_graph::process_worklist): Call
8304 maybe_process_run_of_before_supernode_enodes.
8305 (exploded_graph::maybe_process_run_of_before_supernode_enodes):
8306 New.
8307 (exploded_graph_annotator::print_enode): Show STATUS_BULK_MERGED.
8308 * exploded-graph.h (enum exploded_node::status): Add
8309 STATUS_BULK_MERGED.
8311 2020-09-16 David Malcolm <dmalcolm@redhat.com>
8313 * engine.cc
8314 (exploded_graph::process_node) <case PK_BEFORE_SUPERNODE>:
8315 Simplify by using program_point::get_next.
8316 * program-point.cc (program_point::get_next): New.
8317 * program-point.h (program_point::get_next): New decl.
8319 2020-09-16 David Malcolm <dmalcolm@redhat.com>
8321 * engine.cc (exploded_graph::get_or_create_node): Show the
8322 program point when issuing -Wanalyzer-too-complex due to hitting
8323 the per-program-point limit.
8325 2020-09-16 David Malcolm <dmalcolm@redhat.com>
8327 * region-model.cc (region_model::on_call_pre): Treat getchar as
8328 having no side-effects.
8330 2020-09-15 David Malcolm <dmalcolm@redhat.com>
8332 PR analyzer/96650
8333 * constraint-manager.cc (merger_fact_visitor::on_fact): Replace
8334 assertion that add_constraint succeeded with an assertion that
8335 if it fails, -fanalyzer-transitivity is off.
8337 2020-09-14 David Malcolm <dmalcolm@redhat.com>
8339 * analyzer.opt (-param=analyzer-max-constraints=): New param.
8340 * constraint-manager.cc
8341 (constraint_manager::add_constraint_internal): Silently reject
8342 attempts to add constraints when the above limit is reached.
8344 2020-09-14 David Malcolm <dmalcolm@redhat.com>
8346 PR analyzer/96653
8347 * constraint-manager.cc
8348 (constraint_manager::get_or_add_equiv_class): Don't accumulate
8349 transitive closure of all constraints on constants.
8351 2020-09-14 David Malcolm <dmalcolm@redhat.com>
8353 PR analyzer/97029
8354 * analyzer.cc (is_setjmp_call_p): Require the initial arg to be a
8355 pointer.
8356 * region-model.cc (region_model::deref_rvalue): Assert that the
8357 svalue is of pointer type.
8359 2020-09-11 David Malcolm <dmalcolm@redhat.com>
8361 PR analyzer/96798
8362 * region-model-impl-calls.cc (region_model::impl_call_memcpy):
8363 New.
8364 (region_model::impl_call_strcpy): New.
8365 * region-model.cc (region_model::on_call_pre): Flag unhandled
8366 builtins that are non-pure as having unknown side-effects.
8367 Implement BUILT_IN_MEMCPY, BUILT_IN_MEMCPY_CHK, BUILT_IN_STRCPY,
8368 BUILT_IN_STRCPY_CHK, BUILT_IN_FPRINTF, BUILT_IN_FPRINTF_UNLOCKED,
8369 BUILT_IN_PUTC, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_FPUTC,
8370 BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
8371 BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
8372 BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTCHAR,
8373 BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTS, BUILT_IN_PUTS_UNLOCKED,
8374 BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF.
8375 * region-model.h (region_model::impl_call_memcpy): New decl.
8376 (region_model::impl_call_strcpy): New decl.
8378 2020-09-09 David Malcolm <dmalcolm@redhat.com>
8380 PR analyzer/94355
8381 * analyzer.opt (Wanalyzer-mismatching-deallocation): New warning.
8382 * region-model-impl-calls.cc
8383 (region_model::impl_call_operator_new): New.
8384 (region_model::impl_call_operator_delete): New.
8385 * region-model.cc (region_model::on_call_pre): Detect operator new
8386 and operator delete.
8387 (region_model::on_call_post): Likewise.
8388 (region_model::maybe_update_for_edge): Detect EH edges and call...
8389 (region_model::apply_constraints_for_exception): New function.
8390 * region-model.h (region_model::impl_call_operator_new): New decl.
8391 (region_model::impl_call_operator_delete): New decl.
8392 (region_model::apply_constraints_for_exception): New decl.
8393 * sm-malloc.cc (enum resource_state): New.
8394 (struct allocation_state): New state subclass.
8395 (enum wording): New.
8396 (struct api): New.
8397 (malloc_state_machine::custom_data_t): New typedef.
8398 (malloc_state_machine::add_state): New decl.
8399 (malloc_state_machine::m_unchecked)
8400 (malloc_state_machine::m_nonnull)
8401 (malloc_state_machine::m_freed): Delete these states in favor
8402 of...
8403 (malloc_state_machine::m_malloc)
8404 (malloc_state_machine::m_scalar_new)
8405 (malloc_state_machine::m_vector_new): ...this new api instances,
8406 which own their own versions of these states.
8407 (malloc_state_machine::on_allocator_call): New decl.
8408 (malloc_state_machine::on_deallocator_call): New decl.
8409 (api::api): New ctor.
8410 (dyn_cast_allocation_state): New.
8411 (as_a_allocation_state): New.
8412 (get_rs): New.
8413 (unchecked_p): New.
8414 (nonnull_p): New.
8415 (freed_p): New.
8416 (malloc_diagnostic::describe_state_change): Use unchecked_p and
8417 nonnull_p.
8418 (class mismatching_deallocation): New.
8419 (double_free::double_free): Add funcname param for initializing
8420 m_funcname.
8421 (double_free::emit): Use m_funcname in warning message rather
8422 than hardcoding "free".
8423 (double_free::describe_state_change): Likewise. Use freed_p.
8424 (double_free::describe_call_with_state): Use freed_p.
8425 (double_free::describe_final_event): Use m_funcname in message
8426 rather than hardcoding "free".
8427 (double_free::m_funcname): New field.
8428 (possible_null::describe_state_change): Use unchecked_p.
8429 (possible_null::describe_return_of_state): Likewise.
8430 (use_after_free::use_after_free): Add param for initializing m_api.
8431 (use_after_free::emit): Use m_api->m_dealloc_funcname in message
8432 rather than hardcoding "free".
8433 (use_after_free::describe_state_change): Use freed_p. Change the
8434 wording of the message based on the API.
8435 (use_after_free::describe_final_event): Use
8436 m_api->m_dealloc_funcname in message rather than hardcoding
8437 "free". Change the wording of the message based on the API.
8438 (use_after_free::m_api): New field.
8439 (malloc_leak::describe_state_change): Use unchecked_p. Update
8440 for renaming of m_malloc_event to m_alloc_event.
8441 (malloc_leak::describe_final_event): Update for renaming of
8442 m_malloc_event to m_alloc_event.
8443 (malloc_leak::m_malloc_event): Rename...
8444 (malloc_leak::m_alloc_event): ...to this.
8445 (free_of_non_heap::free_of_non_heap): Add param for initializing
8446 m_funcname.
8447 (free_of_non_heap::emit): Use m_funcname in message rather than
8448 hardcoding "free".
8449 (free_of_non_heap::describe_final_event): Likewise.
8450 (free_of_non_heap::m_funcname): New field.
8451 (allocation_state::dump_to_pp): New.
8452 (allocation_state::get_nonnull): New.
8453 (malloc_state_machine::malloc_state_machine): Update for changes
8454 to state fields and new api fields.
8455 (malloc_state_machine::add_state): New.
8456 (malloc_state_machine::on_stmt): Move malloc/calloc handling to
8457 on_allocator_call and call it, passing in the API pointer.
8458 Likewise for free, moving it to on_deallocator_call. Handle calls
8459 to operator new and delete in an analogous way. Use unchecked_p
8460 when testing for possibly-null-arg and possibly-null-deref, and
8461 transition to the non-null for the correct API. Remove redundant
8462 node param from call to on_zero_assignment. Use freed_p for
8463 use-after-free check, and pass in API.
8464 (malloc_state_machine::on_allocator_call): New, based on code in
8465 on_stmt.
8466 (malloc_state_machine::on_deallocator_call): Likewise.
8467 (malloc_state_machine::on_phi): Mark node param with
8468 ATTRIBUTE_UNUSED; don't pass it to on_zero_assignment.
8469 (malloc_state_machine::on_condition): Mark node param with
8470 ATTRIBUTE_UNUSED. Replace on_transition calls with get_state and
8471 set_next_state pairs, transitioning to the non-null state for the
8472 appropriate API.
8473 (malloc_state_machine::can_purge_p): Port to new state approach.
8474 (malloc_state_machine::on_zero_assignment): Replace on_transition
8475 calls with get_state and set_next_state pairs. Drop redundant
8476 node param.
8477 * sm.h (state_machine::add_custom_state): New.
8479 2020-09-09 David Malcolm <dmalcolm@redhat.com>
8481 * diagnostic-manager.cc
8482 (null_assignment_sm_context::warn_for_state): Replace with...
8483 (null_assignment_sm_context::warn): ...this.
8484 * engine.cc (impl_sm_context::warn_for_state): Replace with...
8485 (impl_sm_context::warn): ...this.
8486 * sm-file.cc (fileptr_state_machine::on_stmt): Replace
8487 warn_for_state and on_transition calls with a get_state
8488 test guarding warn and set_next_state calls.
8489 * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise.
8490 * sm-pattern-test.cc (pattern_test_state_machine::on_condition):
8491 Replace warn_for_state call with warn call.
8492 * sm-sensitive.cc
8493 (sensitive_state_machine::warn_for_any_exposure): Replace
8494 warn_for_state call with a get_state test guarding a warn call.
8495 * sm-signal.cc (signal_state_machine::on_stmt): Likewise.
8496 * sm-taint.cc (taint_state_machine::on_stmt): Replace
8497 warn_for_state and on_transition calls with a get_state
8498 test guarding warn and set_next_state calls.
8499 * sm.h (sm_context::warn_for_state): Replace with...
8500 (sm_context::warn): ...this.
8502 2020-09-09 David Malcolm <dmalcolm@redhat.com>
8504 * diagnostic-manager.cc
8505 (null_assignment_sm_context::null_assignment_sm_context): Add old_state
8506 and ext_state params, initializing m_old_state and m_ext_state.
8507 (null_assignment_sm_context::on_transition): Split into...
8508 (null_assignment_sm_context::get_state): ...this new vfunc
8509 implementation and...
8510 (null_assignment_sm_context::set_next_state): ...this new vfunc
8511 implementation.
8512 (null_assignment_sm_context::m_old_state): New field.
8513 (null_assignment_sm_context::m_ext_state): New field.
8514 (diagnostic_manager::add_events_for_eedge): Pass in old state and
8515 ext_state when creating sm_ctxt.
8516 * engine.cc (impl_sm_context::on_transition): Split into...
8517 (impl_sm_context::get_state): ...this new vfunc
8518 implementation and...
8519 (impl_sm_context::set_next_state): ...this new vfunc
8520 implementation.
8521 * sm.h (sm_context::get_state): New pure virtual function.
8522 (sm_context::set_next_state): Likewise.
8523 (sm_context::on_transition): Convert from a pure virtual function
8524 to a regular function implemented in terms of get_state and
8525 set_next_state.
8527 2020-09-09 David Malcolm <dmalcolm@redhat.com>
8529 * checker-path.cc (state_change_event::get_desc): Update
8530 state_machine::get_state_name calls to state::get_name.
8531 (warning_event::get_desc): Likewise.
8532 * diagnostic-manager.cc
8533 (null_assignment_sm_context::on_transition): Update comparison
8534 against 0 with comparison with m_sm.get_start_state.
8535 (diagnostic_manager::prune_for_sm_diagnostic): Update
8536 state_machine::get_state_name calls to state::get_name.
8537 * engine.cc (impl_sm_context::on_transition): Likewise.
8538 (exploded_node::get_dot_fillcolor): Use get_id when summing
8539 the sm states.
8540 * program-state.cc (sm_state_map::sm_state_map): Don't hardcode
8541 0 as the start state when initializing m_global_state.
8542 (sm_state_map::print): Use dump_to_pp rather than get_state_name
8543 when dumping states.
8544 (sm_state_map::is_empty_p): Don't hardcode 0 as the start state
8545 when examining m_global_state.
8546 (sm_state_map::hash): Use get_id when hashing states.
8547 (selftest::test_sm_state_map): Use state objects rather than
8548 arbitrary hardcoded integers.
8549 (selftest::test_program_state_merging): Likewise.
8550 (selftest::test_program_state_merging_2): Likewise.
8551 * sm-file.cc (fileptr_state_machine::m_start): Move to base class.
8552 (file_diagnostic::describe_state_change): Use get_start_state.
8553 (fileptr_state_machine::fileptr_state_machine): Drop m_start
8554 initialization.
8555 * sm-malloc.cc (malloc_state_machine::m_start): Move to base
8556 class.
8557 (malloc_diagnostic::describe_state_change): Use get_start_state.
8558 (possible_null::describe_state_change): Likewise.
8559 (malloc_state_machine::malloc_state_machine): Drop m_start
8560 initialization.
8561 * sm-pattern-test.cc (pattern_test_state_machine::m_start): Move
8562 to base class.
8563 (pattern_test_state_machine::pattern_test_state_machine): Drop
8564 m_start initialization.
8565 * sm-sensitive.cc (sensitive_state_machine::m_start): Move to base
8566 class.
8567 (sensitive_state_machine::sensitive_state_machine): Drop m_start
8568 initialization.
8569 * sm-signal.cc (signal_state_machine::m_start): Move to base
8570 class.
8571 (signal_state_machine::signal_state_machine): Drop m_start
8572 initialization.
8573 * sm-taint.cc (taint_state_machine::m_start): Move to base class.
8574 (taint_state_machine::taint_state_machine): Drop m_start
8575 initialization.
8576 * sm.cc (state_machine::state::dump_to_pp): New.
8577 (state_machine::state_machine): Move here from sm.h. Initialize
8578 m_next_state_id and m_start.
8579 (state_machine::add_state): Reimplement in terms of state objects.
8580 (state_machine::get_state_name): Delete.
8581 (state_machine::get_state_by_name): Reimplement in terms of state
8582 objects. Make const.
8583 (state_machine::validate): Delete.
8584 (state_machine::dump_to_pp): Reimplement in terms of state
8585 objects.
8586 * sm.h (state_machine::state): New class.
8587 (state_machine::state_t): Convert typedef from "unsigned" to
8588 "const state_machine::state *".
8589 (state_machine::state_machine): Move to sm.cc.
8590 (state_machine::get_default_state): Use m_start rather than
8591 hardcoding 0.
8592 (state_machine::get_state_name): Delete.
8593 (state_machine::get_state_by_name): Make const.
8594 (state_machine::get_start_state): New accessor.
8595 (state_machine::alloc_state_id): New.
8596 (state_machine::m_state_names): Drop in favor of...
8597 (state_machine::m_states): New field
8598 (state_machine::m_start): New field
8599 (start_start_p): Delete.
8601 2020-09-08 David Malcolm <dmalcolm@redhat.com>
8603 PR analyzer/96949
8604 * store.cc (binding_map::apply_ctor_val_to_range): Add
8605 error-handling for the cases where we have symbolic offsets.
8607 2020-09-08 David Malcolm <dmalcolm@redhat.com>
8609 PR analyzer/96950
8610 * store.cc (binding_map::apply_ctor_to_region): Handle RANGE_EXPR
8611 where min_index == max_index.
8612 (binding_map::apply_ctor_val_to_range): Replace assertion that we
8613 don't have a CONSTRUCTOR value with error-handling.
8615 2020-09-08 David Malcolm <dmalcolm@redhat.com>
8617 PR analyzer/96962
8618 * region-model.cc (region_model::on_call_pre): Fix guard on switch
8619 on built-ins to only consider BUILT_IN_NORMAL, rather than other
8620 kinds of build-ins.
8622 2020-09-01 David Malcolm <dmalcolm@redhat.com>
8624 PR analyzer/96792
8625 * region-model.cc (region_model::deref_rvalue): Add the constraint
8626 that PTR_SVAL is non-NULL.
8628 2020-08-31 David Malcolm <dmalcolm@redhat.com>
8630 PR analyzer/96798
8631 * region-model.cc (region_model::on_call_pre): Handle
8632 BUILT_IN_MEMSET_CHK.
8634 2020-08-31 David Malcolm <dmalcolm@redhat.com>
8636 * region-model.cc (region_model::on_call_pre): Gather handling of
8637 builtins and of internal fns into switch statements. Handle
8638 "alloca" and BUILT_IN_ALLOCA_WITH_ALIGN.
8640 2020-08-31 David Malcolm <dmalcolm@redhat.com>
8642 PR analyzer/96860
8643 * region.cc (decl_region::get_svalue_for_constructor): Support
8644 apply_ctor_to_region failing.
8645 * store.cc (binding_map::apply_ctor_to_region): Add failure
8646 handling.
8647 (binding_map::apply_ctor_val_to_range): Likewise.
8648 (binding_map::apply_ctor_pair_to_child_region): Likewise. Replace
8649 assertion that child_base_offset is not symbolic with error
8650 handling.
8651 * store.h (binding_map::apply_ctor_to_region): Convert return type
8652 from void to bool.
8653 (binding_map::apply_ctor_val_to_range): Likewise.
8654 (binding_map::apply_ctor_pair_to_child_region): Likewise.
8656 2020-08-31 David Malcolm <dmalcolm@redhat.com>
8658 PR analyzer/96763
8659 * store.cc (binding_map::apply_ctor_to_region): Handle RANGE_EXPR
8660 by calling a new binding_map::apply_ctor_val_to_range subroutine.
8661 Split out the existing non-CONSTRUCTOR-handling code to a new
8662 apply_ctor_pair_to_child_region subroutine.
8663 (binding_map::apply_ctor_val_to_range): New.
8664 (binding_map::apply_ctor_pair_to_child_region): New, split out
8665 from binding_map::apply_ctor_to_region as noted above.
8666 * store.h (binding_map::apply_ctor_val_to_range): New decl.
8667 (binding_map::apply_ctor_pair_to_child_region): New decl.
8669 2020-08-31 David Malcolm <dmalcolm@redhat.com>
8671 PR analyzer/96764
8672 * region-model-manager.cc
8673 (region_model_manager::maybe_fold_unaryop): Handle VIEW_CONVERT_EXPR.
8674 (region_model_manager::get_or_create_cast): Move logic for
8675 real->integer casting to...
8676 (get_code_for_cast): ...this new function, and add logic for
8677 real->non-integer casts.
8678 (region_model_manager::maybe_fold_sub_svalue): Handle
8679 VIEW_CONVERT_EXPR.
8680 * region-model.cc
8681 (region_model::add_any_constraints_from_gassign): Likewise.
8682 * svalue.cc (svalue::maybe_undo_cast): Likewise.
8683 (unaryop_svalue::dump_to_pp): Likewise.
8685 2020-08-26 David Malcolm <dmalcolm@redhat.com>
8687 PR analyzer/94858
8688 * region-model-manager.cc
8689 (region_model_manager::get_or_create_widening_svalue): Assert that
8690 neither of the inputs are themselves widenings.
8691 * store.cc (store::eval_alias_1): The initial value of a pointer
8692 can't point to a region that was allocated on the heap after the
8693 beginning of the path. A widened pointer value can't alias anything
8694 that the initial pointer value can't alias.
8695 * svalue.cc (svalue::can_merge_p): Merge BINOP (X, OP, CST) with X
8696 to a widening svalue. Merge
8697 BINOP(WIDENING(BASE, BINOP(BASE, X)), X) and BINOP(BASE, X) to
8698 to the LHS of the first BINOP.
8700 2020-08-26 David Malcolm <dmalcolm@redhat.com>
8702 PR analyzer/96777
8703 * region-model.h (class compound_svalue): Document that all keys
8704 must be concrete.
8705 (compound_svalue::compound_svalue): Move definition to svalue.cc.
8706 * store.cc (binding_map::apply_ctor_to_region): Handle
8707 initializers for trailing arrays with incomplete size.
8708 * svalue.cc (compound_svalue::compound_svalue): Move definition
8709 here from region-model.h. Add assertion that all keys are
8710 concrete.
8712 2020-08-22 David Malcolm <dmalcolm@redhat.com>
8714 PR analyzer/94851
8715 * region-model-manager.cc
8716 (region_model_manager::maybe_fold_binop): Fold bitwise "& 0" to 0.
8718 2020-08-22 David Malcolm <dmalcolm@redhat.com>
8720 * store.cc (store::eval_alias): Make const. Split out 2nd half
8721 into store::eval_alias_1 and call it twice for symmetry, avoiding
8722 test duplication.
8723 (store::eval_alias_1): New function, split out from the above.
8724 * store.h (store::eval_alias): Make const.
8725 (store::eval_alias_1): New decl.
8727 2020-08-22 David Malcolm <dmalcolm@redhat.com>
8729 * region-model.cc (region_model::push_frame): Bind the default
8730 SSA name for each parm if it exists, falling back to the parm
8731 itself otherwise, rather than doing both.
8733 2020-08-20 David Malcolm <dmalcolm@redhat.com>
8735 PR analyzer/96723
8736 * region-model-manager.cc
8737 (region_model_manager::get_field_region): Assert that field is a
8738 FIELD_DECL.
8739 * region.cc (region::get_subregions_for_binding): In
8740 union-handling, filter the TYPE_FIELDS traversal to just FIELD_DECLs.
8742 2020-08-20 David Malcolm <dmalcolm@redhat.com>
8744 PR analyzer/96713
8745 * region-model.cc (region_model::get_gassign_result): For
8746 comparisons, only use eval_condition when the lhs has boolean
8747 type, and use get_or_create_constant_svalue on the boolean
8748 constants directly rather than via get_rvalue.
8750 2020-08-19 David Malcolm <dmalcolm@redhat.com>
8752 PR analyzer/96643
8753 * region-model.cc (region_model::deref_rvalue): Rather than
8754 attempting to handle all svalue kinds in the switch, only cover
8755 the special cases, and move symbolic-region handling to after
8756 the switch, thus implicitly handling the missing case SK_COMPOUND.
8758 2020-08-19 David Malcolm <dmalcolm@redhat.com>
8760 PR analyzer/96705
8761 * region-model-manager.cc
8762 (region_model_manager::maybe_fold_binop): Check that we have an
8763 integral type before calling build_int_cst.
8765 2020-08-19 David Malcolm <dmalcolm@redhat.com>
8767 PR analyzer/96699
8768 * region-model-manager.cc
8769 (region_model_manager::get_or_create_cast): Use FIX_TRUNC_EXPR for
8770 casting from REAL_TYPE to INTEGER_TYPE.
8772 2020-08-19 David Malcolm <dmalcolm@redhat.com>
8774 PR analyzer/96651
8775 * region-model.cc (region_model::called_from_main_p): New.
8776 (region_model::get_store_value): Move handling for globals into...
8777 (region_model::get_initial_value_for_global): ...this new
8778 function, and add logic for extracting values from decl
8779 initializers.
8780 * region-model.h (decl_region::get_svalue_for_constructor): New
8781 decl.
8782 (decl_region::get_svalue_for_initializer): New decl.
8783 (region_model::called_from_main_p): New decl.
8784 (region_model::get_initial_value_for_global): New.
8785 * region.cc (decl_region::maybe_get_constant_value): Move logic
8786 for getting an svalue from a CONSTRUCTOR node to...
8787 (decl_region::get_svalue_for_constructor): ...this new function.
8788 (decl_region::get_svalue_for_initializer): New.
8789 * store.cc (get_svalue_for_ctor_val): Rewrite in terms of
8790 region_model::get_rvalue.
8791 * store.h (binding_cluster::get_map): New accessor.
8793 2020-08-19 David Malcolm <dmalcolm@redhat.com>
8795 PR analyzer/96648
8796 * region.cc (get_field_at_bit_offset): Gracefully handle negative
8797 values for bit_offset.
8799 2020-08-18 David Malcolm <dmalcolm@redhat.com>
8801 * region-model.cc (region_model::get_rvalue_1): Fix name of local.
8803 2020-08-18 David Malcolm <dmalcolm@redhat.com>
8805 PR analyzer/96641
8806 * region-model.cc (region_model::get_rvalue_1): Handle
8807 unrecognized tree codes by returning "UNKNOWN.
8809 2020-08-18 David Malcolm <dmalcolm@redhat.com>
8811 PR analyzer/96640
8812 * region-model.cc (region_model::get_gassign_result): Handle various
8813 VEC_* tree codes by returning UNKNOWN.
8814 (region_model::on_assignment): Handle unrecognized tree codes by
8815 setting lhs to an unknown value, rather than issuing a "sorry" and
8816 asserting.
8818 2020-08-17 David Malcolm <dmalcolm@redhat.com>
8820 PR analyzer/96644
8821 * region-model-manager.cc (get_region_for_unexpected_tree_code):
8822 Handle ctxt being NULL.
8824 2020-08-17 David Malcolm <dmalcolm@redhat.com>
8826 PR analyzer/96639
8827 * region.cc (region::get_subregions_for_binding): Check for "type"
8828 being NULL.
8830 2020-08-17 David Malcolm <dmalcolm@redhat.com>
8832 PR analyzer/96642
8833 * store.cc (get_svalue_for_ctor_val): New.
8834 (binding_map::apply_ctor_to_region): Call it.
8836 2020-08-14 David Malcolm <dmalcolm@redhat.com>
8838 PR testsuite/96609
8839 PR analyzer/96616
8840 * region-model.cc (region_model::get_store_value): Call
8841 maybe_get_constant_value on decl_regions first.
8842 * region-model.h (decl_region::maybe_get_constant_value): New decl.
8843 * region.cc (decl_region::get_stack_depth): Likewise.
8844 (decl_region::maybe_get_constant_value): New.
8845 * store.cc (get_subregion_within_ctor): New.
8846 (binding_map::apply_ctor_to_region): New.
8847 * store.h (binding_map::apply_ctor_to_region): New decl.
8849 2020-08-14 David Malcolm <dmalcolm@redhat.com>
8851 PR analyzer/96611
8852 * store.cc (store::mark_as_escaped): Reject attempts to
8853 get a cluster for an unknown pointer.
8855 2020-08-13 David Malcolm <dmalcolm@redhat.com>
8857 PR analyzer/93032
8858 PR analyzer/93938
8859 PR analyzer/94011
8860 PR analyzer/94099
8861 PR analyzer/94399
8862 PR analyzer/94458
8863 PR analyzer/94503
8864 PR analyzer/94640
8865 PR analyzer/94688
8866 PR analyzer/94689
8867 PR analyzer/94839
8868 PR analyzer/95026
8869 PR analyzer/95042
8870 PR analyzer/95240
8871 * analyzer-logging.cc: Ignore "-Wformat-diag".
8872 (logger::enter_scope): Use inc_indent in both overloads.
8873 (logger::exit_scope): Use dec_indent.
8874 * analyzer-logging.h (logger::inc_indent): New.
8875 (logger::dec_indent): New.
8876 * analyzer-selftests.cc (run_analyzer_selftests): Call
8877 analyzer_store_cc_tests.
8878 * analyzer-selftests.h (analyzer_store_cc_tests): New decl.
8879 * analyzer.cc (get_stmt_location): New function.
8880 * analyzer.h (class initial_svalue): New forward decl.
8881 (class unaryop_svalue): New forward decl.
8882 (class binop_svalue): New forward decl.
8883 (class sub_svalue): New forward decl.
8884 (class unmergeable_svalue): New forward decl.
8885 (class placeholder_svalue): New forward decl.
8886 (class widening_svalue): New forward decl.
8887 (class compound_svalue): New forward decl.
8888 (class conjured_svalue): New forward decl.
8889 (svalue_set): New typedef.
8890 (class map_region): Delete.
8891 (class array_region): Delete.
8892 (class frame_region): New forward decl.
8893 (class function_region): New forward decl.
8894 (class label_region): New forward decl.
8895 (class decl_region): New forward decl.
8896 (class element_region): New forward decl.
8897 (class offset_region): New forward decl.
8898 (class cast_region): New forward decl.
8899 (class field_region): New forward decl.
8900 (class string_region): New forward decl.
8901 (class region_model_manager): New forward decl.
8902 (class store_manager): New forward decl.
8903 (class store): New forward decl.
8904 (class call_details): New forward decl.
8905 (struct svalue_id_merger_mapping): Delete.
8906 (struct canonicalization): Delete.
8907 (class function_point): New forward decl.
8908 (class engine): New forward decl.
8909 (dump_tree): New function decl.
8910 (print_quoted_type): New function decl.
8911 (readability_comparator): New function decl.
8912 (tree_cmp): New function decl.
8913 (class path_var): Move here from region-model.h
8914 (bit_offset_t, bit_size_t, byte_size_t): New typedefs.
8915 (class region_offset): New class.
8916 (get_stmt_location): New decl.
8917 (struct member_function_hash_traits): New struct.
8918 (class consolidation_map): New class.
8919 Ignore "-Wformat-diag".
8920 * analyzer.opt (-param=analyzer-max-svalue-depth=): New param.
8921 (-param=analyzer-max-enodes-for-full-dump=): New param.
8922 * call-string.cc: Ignore -Wformat-diag.
8923 * checker-path.cc: Move includes of "analyzer/call-string.h" and
8924 "analyzer/program-point.h" to before "analyzer/region-model.h",
8925 and also include "analyzer/store.h" before it.
8926 (state_change_event::state_change_event): Replace "tree var" param
8927 with "const svalue *sval". Convert "origin" param from tree to
8928 "const svalue *".
8929 (state_change_event::get_desc): Call get_representative_tree to
8930 convert the var and origin from const svalue * to tree. Use
8931 svalue::get_desc rather than %qE when describing state changes.
8932 (checker_path::add_final_event): Use get_stmt_location.
8933 * checker-path.h (state_change_event::state_change_event): Port
8934 from tree to const svalue *.
8935 (state_change_event::get_lvalue): Delete.
8936 (state_change_event::get_dest_function): New.
8937 (state_change_event::m_var): Replace with...
8938 (state_change_event::m_sval): ...this.
8939 (state_change_event::m_origin): Convert from tree to
8940 const svalue *.
8941 * constraint-manager.cc: Include "analyzer/call-string.h",
8942 "analyzer/program-point.h", and "analyzer/store.h" before
8943 "analyzer/region-model.h".
8944 (struct bound, struct range): Move to constraint-manager.h.
8945 (compare_constants): New function.
8946 (range::dump): Rename to...
8947 (range::dump_to_pp): ...this. Support NULL constants.
8948 (range::dump): Reintroduce for dumping to stderr.
8949 (range::constrained_to_single_element): Return result, rather than
8950 writing to *OUT.
8951 (range::eval_condition): New.
8952 (range::below_lower_bound): New.
8953 (range::above_upper_bound): New.
8954 (equiv_class::equiv_class): Port from svalue_id to const svalue *.
8955 (equiv_class::print): Likewise.
8956 (equiv_class::hash): Likewise.
8957 (equiv_class::operator==): Port from svalue_id to const svalue *.
8958 (equiv_class::add): Port from svalue_id to const svalue *. Drop
8959 "cm" param.
8960 (equiv_class::del): Port from svalue_id to const svalue *.
8961 (equiv_class::get_representative): Likewise.
8962 (equiv_class::remap_svalue_ids): Delete.
8963 (svalue_id_cmp_by_id): Rename to...
8964 (svalue_cmp_by_ptr): ...this, porting from svalue_id to
8965 const svalue *.
8966 (equiv_class::canonicalize): Update qsort comparator.
8967 (constraint::implied_by): New.
8968 (constraint_manager::constraint_manager): Copy m_mgr in copy ctor.
8969 (constraint_manager::dump_to_pp): Add "multiline" param
8970 (constraint_manager::dump): Pass "true" for "multiline".
8971 (constraint_manager::add_constraint): Port from svalue_id to
8972 const svalue *. Split out second part into...
8973 (constraint_manager::add_unknown_constraint): ...this new
8974 function. Remove self-constraints when merging equivalence
8975 classes.
8976 (constraint_manager::add_constraint_internal): Remove constraints
8977 that would be implied by the new constraint. Port from svalue_id
8978 to const svalue *.
8979 (constraint_manager::get_equiv_class_by_sid): Rename to...
8980 (constraint_manager::get_equiv_class_by_svalue): ...this, porting
8981 from svalue_id to const svalue *.
8982 (constraint_manager::get_or_add_equiv_class): Port from svalue_id
8983 to const svalue *.
8984 (constraint_manager::eval_condition): Make const. Call
8985 compare_constants and return early if it provides a known result.
8986 (constraint_manager::get_ec_bounds): New.
8987 (constraint_manager::eval_condition): New overloads. Make
8988 existing one const, and use compare_constants.
8989 (constraint_manager::purge): Convert "p" param to a template
8990 rather that an abstract base class. Port from svalue_id to
8991 const svalue *.
8992 (class dead_svalue_purger): New class.
8993 (constraint_manager::remap_svalue_ids): Delete.
8994 (constraint_manager::on_liveness_change): New.
8995 (equiv_class_cmp): Port from svalue_id to const svalue *.
8996 (constraint_manager::canonicalize): Likewise. Combine with
8997 purging of redundant equivalence classes and constraints.
8998 (class cleaned_constraint_manager): Delete.
8999 (class merger_fact_visitor): Make "m_cm_b" const. Add "m_merger"
9000 field.
9001 (merger_fact_visitor::fact): Port from svalue_id to const svalue *.
9002 Add special case for widening.
9003 (constraint_manager::merge): Port from svalue_id to const svalue *.
9004 (constraint_manager::clean_merger_input): Delete.
9005 (constraint_manager::for_each_fact): Port from svalue_id to
9006 const svalue *.
9007 (constraint_manager::validate): Likewise.
9008 (selftest::test_constraint_conditions): Provide a
9009 region_model_manager when creating region_model instances.
9010 Add test for self-equality not creating equivalence classes.
9011 (selftest::test_transitivity): Provide a region_model_manager when
9012 creating region_model instances. Verify that EC-merging happens
9013 when constraints are implied.
9014 (selftest::test_constant_comparisons): Provide a
9015 region_model_manager when creating region_model instances.
9016 (selftest::test_constraint_impl): Likewise. Remove over-specified
9017 assertions.
9018 (selftest::test_equality): Provide a region_model_manager when
9019 creating region_model instances.
9020 (selftest::test_many_constants): Likewise. Provide a
9021 program_point when testing merging.
9022 (selftest::run_constraint_manager_tests): Move call to
9023 test_constant_comparisons to outside the transitivity guard.
9024 * constraint-manager.h (struct bound): Move here from
9025 constraint-manager.cc.
9026 (struct range): Likewise.
9027 (struct::eval_condition): New decl.
9028 (struct::below_lower_bound): New decl.
9029 (struct::above_upper_bound): New decl.
9030 (equiv_class::add): Port from svalue_id to const svalue *.
9031 (equiv_class::del): Likewise.
9032 (equiv_class::get_representative): Likewise.
9033 (equiv_class::remap_svalue_ids): Drop.
9034 (equiv_class::m_cst_sid): Convert to..
9035 (equiv_class::m_cst_sval): ...this.
9036 (equiv_class::m_vars): Port from svalue_id to const svalue *.
9037 (constraint::bool implied_by): New decl.
9038 (fact_visitor::on_fact): Port from svalue_id to const svalue *.
9039 (constraint_manager::constraint_manager): Add mgr param.
9040 (constraint_manager::clone): Delete.
9041 (constraint_manager::maybe_get_constant): Delete.
9042 (constraint_manager::get_sid_for_constant): Delete.
9043 (constraint_manager::get_num_svalues): Delete.
9044 (constraint_manager::dump_to_pp): Add "multiline" param.
9045 (constraint_manager::get_equiv_class): Port from svalue_id to
9046 const svalue *.
9047 (constraint_manager::add_constraint): Likewise.
9048 (constraint_manager::get_equiv_class_by_sid): Rename to...
9049 (constraint_manager::get_equiv_class_by_svalue): ...this, porting
9050 from svalue_id to const svalue *.
9051 (constraint_manager::add_unknown_constraint): New decl.
9052 (constraint_manager::get_or_add_equiv_class): Port from svalue_id
9053 to const svalue *.
9054 (constraint_manager::eval_condition): Likewise. Add overloads.
9055 (constraint_manager::get_ec_bounds): New decl.
9056 (constraint_manager::purge): Convert to template.
9057 (constraint_manager::remap_svalue_ids): Delete.
9058 (constraint_manager::on_liveness_change): New decl.
9059 (constraint_manager::canonicalize): Drop param.
9060 (constraint_manager::clean_merger_input): Delete.
9061 (constraint_manager::m_mgr): New field.
9062 * diagnostic-manager.cc: Move includes of
9063 "analyzer/call-string.h" and "analyzer/program-point.h" to before
9064 "analyzer/region-model.h", and also include "analyzer/store.h"
9065 before it.
9066 (saved_diagnostic::saved_diagnostic): Add "sval" param.
9067 (diagnostic_manager::diagnostic_manager): Add engine param.
9068 (diagnostic_manager::add_diagnostic): Add "sval" param, passing it
9069 to saved_diagnostic ctor. Update overload to pass NULL for it.
9070 (dedupe_winners::dedupe_winners): Add engine param.
9071 (dedupe_winners::add): Add "eg" param. Pass m_engine to
9072 feasible_p.
9073 (dedupe_winner::m_engine): New field.
9074 (diagnostic_manager::emit_saved_diagnostics): Pass engine to
9075 dedupe_winners. Pass &eg when adding candidates. Pass svalue
9076 rather than tree to prune_path. Use get_stmt_location to get
9077 primary location of diagnostic.
9078 (diagnostic_manager::emit_saved_diagnostic): Likewise.
9079 (get_any_origin): Drop.
9080 (state_change_event_creator::on_global_state_change): Pass NULL
9081 const svalue * rather than NULL_TREE trees to state_change_event
9082 ctor.
9083 (state_change_event_creator::on_state_change): Port from tree and
9084 svalue_id to const svalue *.
9085 (for_each_state_change): Port from svalue_id to const svalue *.
9086 (struct null_assignment_sm_context): New.
9087 (diagnostic_manager::add_events_for_eedge): Add state change
9088 events for assignment to NULL.
9089 (diagnostic_manager::prune_path): Update param from tree to
9090 const svalue *.
9091 (diagnostic_manager::prune_for_sm_diagnostic): Port from tracking
9092 by tree to by const svalue *.
9093 * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Add sval
9094 param.
9095 (saved_diagnostic::m_sval): New field.
9096 (diagnostic_manager::diagnostic_manager): Add engine param.
9097 (diagnostic_manager::get_engine): New.
9098 (diagnostic_manager::add_diagnostic): Add "sval" param.
9099 (diagnostic_manager::prune_path): Likewise.
9100 (diagnostic_manager::prune_for_sm_diagnostic): New overload.
9101 (diagnostic_manager::m_eng): New field.
9102 * engine.cc: Move includes of "analyzer/call-string.h" and
9103 "analyzer/program-point.h" to before "analyzer/region-model.h",
9104 and also include "analyzer/store.h" before it.
9105 (impl_region_model_context::impl_region_model_context): Update for
9106 removal of m_change field.
9107 (impl_region_model_context::remap_svalue_ids): Delete.
9108 (impl_region_model_context::on_svalue_leak): New.
9109 (impl_region_model_context::on_svalue_purge): Delete.
9110 (impl_region_model_context::on_liveness_change): New.
9111 (impl_region_model_context::on_unknown_change): Update param
9112 from svalue_id to const svalue *. Add is_mutable param.
9113 (setjmp_svalue::compare_fields): Delete.
9114 (setjmp_svalue::accept): New.
9115 (setjmp_svalue::add_to_hash): Delete.
9116 (setjmp_svalue::dump_to_pp): New.
9117 (setjmp_svalue::print_details): Delete.
9118 (impl_sm_context::impl_sm_context): Drop "change" param.
9119 (impl_sm_context::get_fndecl_for_call): Drop "m_change".
9120 (impl_sm_context::on_transition): Drop ATTRIBUTE_UNUSED from
9121 "stmt" param. Drop m_change. Port from svalue_id to
9122 const svalue *.
9123 (impl_sm_context::warn_for_state): Drop m_change. Port from
9124 svalue_id to const svalue *.
9125 (impl_sm_context::get_readable_tree): Rename to...
9126 (impl_sm_context::get_diagnostic_tree): ...this. Port from
9127 svalue_id to const svalue *.
9128 (impl_sm_context::is_zero_assignment): New.
9129 (impl_sm_context::m_change): Delete field.
9130 (leak_stmt_finder::find_stmt): Handle m_var being NULL.
9131 (readability): Increase penalty for MEM_REF. For SSA_NAMEs,
9132 slightly favor the underlying var over the SSA name. Heavily
9133 penalize temporaries. Handle RESULT_DECL.
9134 (readability_comparator): Make non-static. Consider stack depths.
9135 (impl_region_model_context::on_state_leak): Convert from svalue_id
9136 to const svalue *, updating for region_model changes. Use
9137 id_equal.
9138 (impl_region_model_context::on_inherited_svalue): Delete.
9139 (impl_region_model_context::on_cast): Delete.
9140 (impl_region_model_context::on_condition): Drop m_change.
9141 (impl_region_model_context::on_phi): Likewise.
9142 (impl_region_model_context::on_unexpected_tree_code): Handle t
9143 being NULL.
9144 (point_and_state::validate): Update stack checking for
9145 region_model changes.
9146 (eg_traits::dump_args_t::show_enode_details_p): New.
9147 (exploded_node::exploded_node): Initialize m_num_processed_stmts.
9148 (exploded_node::get_processed_stmt): New function.
9149 (exploded_node::get_dot_fillcolor): Add more colors.
9150 (exploded_node::dump_dot): Guard the printing of the point and
9151 state with show_enode_details_p. Print the processed stmts for
9152 this enode after the initial state.
9153 (exploded_node::dump_to_pp): Pass true for new multiline param
9154 of program_state::dump_to_pp.
9155 (exploded_node::on_stmt): Drop "change" param. Log the stmt.
9156 Set input_location. Implement __analyzer_describe. Update
9157 implementation of __analyzer_dump and __analyzer_eval.
9158 Remove purging of sm-state for unknown fncalls from here.
9159 (exploded_node::on_edge): Drop "change" param.
9160 (exploded_node::on_longjmp): Port from region_id/svalue_id to
9161 const region */const svalue *. Call program_state::detect_leaks.
9162 Drop state_change.
9163 (exploded_node::detect_leaks): Update for changes to region_model.
9164 Call program_state::detect_leaks.
9165 (exploded_edge::exploded_edge): Drop ext_state and change params.
9166 (exploded_edge::dump_dot): "args" is no longer used. Drop dumping
9167 of m_change.
9168 (exploded_graph::exploded_graph): Pass engine to
9169 m_diagnostic_manager ctor. Use program_point::origin.
9170 (exploded_graph::add_function_entry): Drop ctxt. Use
9171 program_state::push_frame. Drop state_change.
9172 (exploded_graph::get_or_create_node): Drop "change" param. Add
9173 "enode_for_diag" param. Update dumping calls for API changes.
9174 Pass point to can_merge_with_p. Show enode indices
9175 within -Wanalyzer-too-complex diagnostic for hitting the per-point
9176 limit.
9177 (exploded_graph::add_edge): Drop "change" param. Log which nodes
9178 are being connected. Update for changes to exploded_edge ctor.
9179 (exploded_graph::get_per_program_point_data): New.
9180 (exploded_graph::process_worklist): Pass point to
9181 can_merge_with_p. Drop state_change. Update dumping call for API
9182 change.
9183 (exploded_graph::process_node): Drop state_change. Split the
9184 node in-place if an sm-state-change occurs. Update
9185 m_num_processed_stmts. Update dumping calls for API change.
9186 (exploded_graph::log_stats): Call engine::log_stats.
9187 (exploded_graph::dump_states_for_supernode): Update dumping
9188 call.
9189 (exploded_path::feasible_p): Add "eng" and "eg" params.
9190 Rename "i" to "end_idx". Pass the manager to the region_model
9191 ctor. Update for every processed stmt in the enode, not just the
9192 first. Keep track of which snodes have been visited, and call
9193 loop_replay_fixup when revisiting one.
9194 (enode_label::get_text): Update dump call for new param.
9195 (exploded_graph::dump_exploded_nodes): Likewise.
9196 (exploded_graph::get_node_by_index): New.
9197 (impl_run_checkers): Create engine instance and pass its address
9198 to extrinsic_state ctor.
9199 * exploded-graph.h
9200 (impl_region_model_context::impl_region_model_context): Drop
9201 "change" params.
9202 (impl_region_model_context::void remap_svalue_ids): Delete.
9203 (impl_region_model_context::on_svalue_purge): Delete.
9204 (impl_region_model_context::on_svalue_leak): New.
9205 (impl_region_model_context::on_liveness_change): New.
9206 (impl_region_model_context::on_state_leak): Update signature.
9207 (impl_region_model_context::on_inherited_svalue): Delete.
9208 (impl_region_model_context::on_cast): Delete.
9209 (impl_region_model_context::on_unknown_change): Update signature.
9210 (impl_region_model_context::m_change): Delete.
9211 (eg_traits::dump_args_t::show_enode_details_p): New.
9212 (exploded_node::on_stmt): Drop "change" param.
9213 (exploded_node::on_edge): Likewise.
9214 (exploded_node::get_processed_stmt): New decl.
9215 (exploded_node::m_num_processed_stmts): New field.
9216 (exploded_edge::exploded_edge): Drop ext_state and change params.
9217 (exploded_edge::m_change): Delete.
9218 (exploded_graph::get_engine): New accessor.
9219 (exploded_graph::get_or_create_node): Drop "change" param. Add
9220 "enode_for_diag" param.
9221 (exploded_graph::add_edge): Drop "change" param.
9222 (exploded_graph::get_per_program_point_data): New decl.
9223 (exploded_graph::get_node_by_index): New decl.
9224 (exploded_path::feasible_p): Add "eng" and "eg" params.
9225 * program-point.cc: Include "analyzer/store.h" before including
9226 "analyzer/region-model.h".
9227 (function_point::function_point): Move here from
9228 program-point.h.
9229 (function_point::get_function): Likewise.
9230 (function_point::from_function_entry): Likewise.
9231 (function_point::before_supernode): Likewise.
9232 (function_point::next_stmt): New function.
9233 * program-point.h (function_point::function_point): Move
9234 implementation from here to program-point.cc.
9235 (function_point::get_function): Likewise.
9236 (function_point::from_function_entry): Likewise.
9237 (function_point::before_supernode): Likewise.
9238 (function_point::next_stmt): New decl.
9239 (program_point::operator!=): New.
9240 (program_point::origin): New.
9241 (program_point::next_stmt): New.
9242 (program_point::m_function_point): Make non-const.
9243 * program-state.cc: Move includes of "analyzer/call-string.h" and
9244 "analyzer/program-point.h" to before "analyzer/region-model.h",
9245 and also include "analyzer/store.h" before it.
9246 (extrinsic_state::get_model_manager): New.
9247 (sm_state_map::sm_state_map): Pass in sm and sm_idx to ctor,
9248 rather than pass the around.
9249 (sm_state_map::clone_with_remapping): Delete.
9250 (sm_state_map::print): Remove "sm" param in favor of "m_sm". Add
9251 "simple" and "multiline" params and support multiline vs single
9252 line dumping.
9253 (sm_state_map::dump): Remove "sm" param in favor of "m_sm". Add
9254 "simple" param.
9255 (sm_state_map::hash): Port from svalue_id to const svalue *.
9256 (sm_state_map::operator==): Likewise.
9257 (sm_state_map::get_state): Likewise. Call canonicalize_svalue on
9258 input. Handle inheritance of sm-state. Call get_default_state.
9259 (sm_state_map::get_origin): Port from svalue_id to const svalue *.
9260 (sm_state_map::set_state): Likewise. Pass in ext_state. Reject
9261 attempts to set state on UNKNOWN.
9262 (sm_state_map::impl_set_state): Port from svalue_id to
9263 const svalue *. Pass in ext_state. Call canonicalize_svalue on
9264 input.
9265 (sm_state_map::purge_for_unknown_fncall): Delete.
9266 (sm_state_map::on_svalue_leak): New.
9267 (sm_state_map::remap_svalue_ids): Delete.
9268 (sm_state_map::on_liveness_change): New.
9269 (sm_state_map::on_unknown_change): Reimplement.
9270 (sm_state_map::on_svalue_purge): Delete.
9271 (sm_state_map::on_inherited_svalue): Delete.
9272 (sm_state_map::on_cast): Delete.
9273 (sm_state_map::validate): Delete.
9274 (sm_state_map::canonicalize_svalue): New.
9275 (program_state::program_state): Update to pass manager to
9276 region_model's ctor. Constify num_states and pass state machine
9277 and index to sm_state_map ctor.
9278 (program_state::print): Update for changes to dump API.
9279 (program_state::dump_to_pp): Ignore the summarize param. Add
9280 "multiline" param.
9281 (program_state::dump_to_file): Add "multiline" param.
9282 (program_state::dump): Pass "true" for new "multiline" param.
9283 (program_state::push_frame): New.
9284 (program_state::on_edge): Drop "change" param. Call
9285 program_state::detect_leaks.
9286 (program_state::prune_for_point): Add enode_for_diag param.
9287 Reimplement based on store class. Call detect_leaks
9288 (program_state::remap_svalue_ids): Delete.
9289 (program_state::get_representative_tree): Port from svalue_id to
9290 const svalue *.
9291 (program_state::can_merge_with_p): Add "point" param. Add early
9292 reject for sm-differences. Drop id remapping.
9293 (program_state::validate): Drop region model and sm_state_map
9294 validation.
9295 (state_change::sm_change::dump): Delete.
9296 (state_change::sm_change::remap_svalue_ids): Delete.
9297 (state_change::sm_change::on_svalue_purge): Delete.
9298 (log_set_of_svalues): New.
9299 (state_change::sm_change::validate): Delete.
9300 (state_change::state_change): Delete.
9301 (state_change::add_sm_change): Delete.
9302 (state_change::affects_p): Delete.
9303 (state_change::dump): Delete.
9304 (state_change::remap_svalue_ids): Delete.
9305 (state_change::on_svalue_purge): Delete.
9306 (state_change::validate): Delete.
9307 (selftest::assert_dump_eq): Delete.
9308 (ASSERT_DUMP_EQ): Delete.
9309 (selftest::test_sm_state_map): Update for changes to region_model
9310 and sm_state_map, porting from svalue_id to const svalue *.
9311 (selftest::test_program_state_dumping): Likewise. Drop test of
9312 dumping, renaming to...
9313 (selftest::test_program_state_1): ...this.
9314 (selftest::test_program_state_dumping_2): Likewise, renaming to...
9315 (selftest::test_program_state_2): ...this.
9316 (selftest::test_program_state_merging): Update for changes to
9317 region_model.
9318 (selftest::test_program_state_merging_2): Likewise.
9319 (selftest::analyzer_program_state_cc_tests): Update for renamed
9320 tests.
9321 * program-state.h (extrinsic_state::extrinsic_state): Add logger
9322 and engine params.
9323 (extrinsic_state::get_logger): New accessor.
9324 (extrinsic_state::get_engine): New accessor.
9325 (extrinsic_state::get_model_manager): New accessor.
9326 (extrinsic_state::m_logger): New field.
9327 (extrinsic_state::m_engine): New field.
9328 (struct default_hash_traits<svalue_id>): Delete.
9329 (pod_hash_traits<svalue_id>::hash): Delete.
9330 (pod_hash_traits<svalue_id>::equal): Delete.
9331 (pod_hash_traits<svalue_id>::mark_deleted): Delete.
9332 (pod_hash_traits<svalue_id>::mark_empty): Delete.
9333 (pod_hash_traits<svalue_id>::is_deleted): Delete.
9334 (pod_hash_traits<svalue_id>::is_empty): Delete.
9335 (sm_state_map::entry_t::entry_t): Port from svalue_id to
9336 const svalue *.
9337 (sm_state_map::entry_t::m_origin): Likewise.
9338 (sm_state_map::map_t): Likewise.
9339 (sm_state_map::sm_state_map): Add state_machine and index params.
9340 (sm_state_map::clone_with_remapping): Delete.
9341 (sm_state_map::print): Drop sm param; add simple and multiline
9342 params.
9343 (sm_state_map::dump): Drop sm param; add simple param.
9344 (sm_state_map::get_state): Port from svalue_id to const svalue *.
9345 Add ext_state param.
9346 (sm_state_map::get_origin): Likewise.
9347 (sm_state_map::set_state): Likewise.
9348 (sm_state_map::impl_set_state): Likewise.
9349 (sm_state_map::purge_for_unknown_fncall): Delete.
9350 (sm_state_map::remap_svalue_ids): Delete.
9351 (sm_state_map::on_svalue_purge): Delete.
9352 (sm_state_map::on_svalue_leak): New.
9353 (sm_state_map::on_liveness_change): New.
9354 (sm_state_map::on_inherited_svalue): Delete.
9355 (sm_state_map::on_cast): Delete.
9356 (sm_state_map::validate): Delete.
9357 (sm_state_map::on_unknown_change): Port from svalue_id to
9358 const svalue *. Add is_mutable and ext_state params.
9359 (sm_state_map::canonicalize_svalue): New.
9360 (sm_state_map::m_sm): New field.
9361 (sm_state_map::m_sm_idx): New field.
9362 (program_state::operator=): Delete.
9363 (program_state::dump_to_pp): Drop "summarize" param, adding
9364 "simple" and "multiline".
9365 (program_state::dump_to_file): Likewise.
9366 (program_state::dump): Rename "summarize" to "simple".
9367 (program_state::push_frame): New.
9368 (program_state::get_current_function): New.
9369 (program_state::on_edge): Drop "change" param.
9370 (program_state::prune_for_point): Likewise. Add enode_for_diag
9371 param.
9372 (program_state::remap_svalue_ids): Delete.
9373 (program_state::get_representative_tree): Port from svalue_id to
9374 const svalue *.
9375 (program_state::can_purge_p): Likewise. Pass ext_state to get_state.
9376 (program_state::can_merge_with_p): Add point param.
9377 (program_state::detect_leaks): New.
9378 (state_change_visitor::on_state_change): Port from tree and
9379 svalue_id to a pair of const svalue *.
9380 (class state_change): Delete.
9381 * region.cc: New file.
9382 * region-model-impl-calls.cc: New file.
9383 * region-model-manager.cc: New file.
9384 * region-model-reachability.cc: New file.
9385 * region-model-reachability.h: New file.
9386 * region-model.cc: Include "analyzer/call-string.h",
9387 "analyzer/program-point.h", and "analyzer/store.h" before
9388 "analyzer/region-model.h". Include
9389 "analyzer/region-model-reachability.h".
9390 (dump_tree): Make non-static.
9391 (dump_quoted_tree): Make non-static.
9392 (print_quoted_type): Make non-static.
9393 (path_var::dump): Delete.
9394 (dump_separator): Delete.
9395 (class impl_constraint_manager): Delete.
9396 (svalue_id::print): Delete.
9397 (svalue_id::dump_node_name_to_pp): Delete.
9398 (svalue_id::validate): Delete.
9399 (region_id::print): Delete.
9400 (region_id::dump_node_name_to_pp): Delete.
9401 (region_id::validate): Delete.
9402 (region_id_set::region_id_set): Delete.
9403 (svalue_id_set::svalue_id_set): Delete.
9404 (svalue::operator==): Delete.
9405 (svalue::hash): Delete.
9406 (svalue::print): Delete.
9407 (svalue::dump_dot_to_pp): Delete.
9408 (svalue::remap_region_ids): Delete.
9409 (svalue::walk_for_canonicalization): Delete.
9410 (svalue::get_child_sid): Delete.
9411 (svalue::maybe_get_constant): Delete.
9412 (region_svalue::compare_fields): Delete.
9413 (region_svalue::add_to_hash): Delete.
9414 (region_svalue::print_details): Delete.
9415 (region_svalue::dump_dot_to_pp): Delete.
9416 (region_svalue::remap_region_ids): Delete.
9417 (region_svalue::merge_values): Delete.
9418 (region_svalue::walk_for_canonicalization): Delete.
9419 (region_svalue::eval_condition): Delete.
9420 (constant_svalue::compare_fields): Delete.
9421 (constant_svalue::add_to_hash): Delete.
9422 (constant_svalue::merge_values): Delete.
9423 (constant_svalue::eval_condition): Move to svalue.cc.
9424 (constant_svalue::print_details): Delete.
9425 (constant_svalue::get_child_sid): Delete.
9426 (unknown_svalue::compare_fields): Delete.
9427 (unknown_svalue::add_to_hash): Delete.
9428 (unknown_svalue::print_details): Delete.
9429 (poison_kind_to_str): Move to svalue.cc.
9430 (poisoned_svalue::compare_fields): Delete.
9431 (poisoned_svalue::add_to_hash): Delete.
9432 (poisoned_svalue::print_details): Delete.
9433 (region_kind_to_str): Move to region.cc and reimplement.
9434 (region::operator==): Delete.
9435 (region::get_parent_region): Delete.
9436 (region::set_value): Delete.
9437 (region::become_active_view): Delete.
9438 (region::deactivate_any_active_view): Delete.
9439 (region::deactivate_view): Delete.
9440 (region::get_value): Delete.
9441 (region::get_inherited_child_sid): Delete.
9442 (region_model::copy_region): Delete.
9443 (region_model::copy_struct_region): Delete.
9444 (region_model::copy_union_region): Delete.
9445 (region_model::copy_array_region): Delete.
9446 (region::hash): Delete.
9447 (region::print): Delete.
9448 (region::dump_dot_to_pp): Delete.
9449 (region::dump_to_pp): Delete.
9450 (region::dump_child_label): Delete.
9451 (region::validate): Delete.
9452 (region::remap_svalue_ids): Delete.
9453 (region::remap_region_ids): Delete.
9454 (region::add_view): Delete.
9455 (region::get_view): Delete.
9456 (region::region): Move to region.cc.
9457 (region::add_to_hash): Delete.
9458 (region::print_fields): Delete.
9459 (region::non_null_p): Delete.
9460 (primitive_region::clone): Delete.
9461 (primitive_region::walk_for_canonicalization): Delete.
9462 (map_region::map_region): Delete.
9463 (map_region::compare_fields): Delete.
9464 (map_region::print_fields): Delete.
9465 (map_region::validate): Delete.
9466 (map_region::dump_dot_to_pp): Delete.
9467 (map_region::dump_child_label): Delete.
9468 (map_region::get_or_create): Delete.
9469 (map_region::get): Delete.
9470 (map_region::add_to_hash): Delete.
9471 (map_region::remap_region_ids): Delete.
9472 (map_region::unbind): Delete.
9473 (map_region::get_tree_for_child_region): Delete.
9474 (map_region::get_tree_for_child_region): Delete.
9475 (tree_cmp): Move to region.cc.
9476 (map_region::can_merge_p): Delete.
9477 (map_region::walk_for_canonicalization): Delete.
9478 (map_region::get_value_by_name): Delete.
9479 (struct_or_union_region::valid_key_p): Delete.
9480 (struct_or_union_region::compare_fields): Delete.
9481 (struct_region::clone): Delete.
9482 (struct_region::compare_fields): Delete.
9483 (union_region::clone): Delete.
9484 (union_region::compare_fields): Delete.
9485 (frame_region::compare_fields): Delete.
9486 (frame_region::clone): Delete.
9487 (frame_region::valid_key_p): Delete.
9488 (frame_region::print_fields): Delete.
9489 (frame_region::add_to_hash): Delete.
9490 (globals_region::compare_fields): Delete.
9491 (globals_region::clone): Delete.
9492 (globals_region::valid_key_p): Delete.
9493 (code_region::compare_fields): Delete.
9494 (code_region::clone): Delete.
9495 (code_region::valid_key_p): Delete.
9496 (array_region::array_region): Delete.
9497 (array_region::get_element): Delete.
9498 (array_region::clone): Delete.
9499 (array_region::compare_fields): Delete.
9500 (array_region::print_fields): Delete.
9501 (array_region::validate): Delete.
9502 (array_region::dump_dot_to_pp): Delete.
9503 (array_region::dump_child_label): Delete.
9504 (array_region::get_or_create): Delete.
9505 (array_region::get): Delete.
9506 (array_region::add_to_hash): Delete.
9507 (array_region::remap_region_ids): Delete.
9508 (array_region::get_key_for_child_region): Delete.
9509 (array_region::key_cmp): Delete.
9510 (array_region::walk_for_canonicalization): Delete.
9511 (array_region::key_from_constant): Delete.
9512 (array_region::constant_from_key): Delete.
9513 (function_region::compare_fields): Delete.
9514 (function_region::clone): Delete.
9515 (function_region::valid_key_p): Delete.
9516 (stack_region::stack_region): Delete.
9517 (stack_region::compare_fields): Delete.
9518 (stack_region::clone): Delete.
9519 (stack_region::print_fields): Delete.
9520 (stack_region::dump_child_label): Delete.
9521 (stack_region::validate): Delete.
9522 (stack_region::push_frame): Delete.
9523 (stack_region::get_current_frame_id): Delete.
9524 (stack_region::pop_frame): Delete.
9525 (stack_region::add_to_hash): Delete.
9526 (stack_region::remap_region_ids): Delete.
9527 (stack_region::can_merge_p): Delete.
9528 (stack_region::walk_for_canonicalization): Delete.
9529 (stack_region::get_value_by_name): Delete.
9530 (heap_region::heap_region): Delete.
9531 (heap_region::compare_fields): Delete.
9532 (heap_region::clone): Delete.
9533 (heap_region::walk_for_canonicalization): Delete.
9534 (root_region::root_region): Delete.
9535 (root_region::compare_fields): Delete.
9536 (root_region::clone): Delete.
9537 (root_region::print_fields): Delete.
9538 (root_region::validate): Delete.
9539 (root_region::dump_child_label): Delete.
9540 (root_region::push_frame): Delete.
9541 (root_region::get_current_frame_id): Delete.
9542 (root_region::pop_frame): Delete.
9543 (root_region::ensure_stack_region): Delete.
9544 (root_region::get_stack_region): Delete.
9545 (root_region::ensure_globals_region): Delete.
9546 (root_region::get_code_region): Delete.
9547 (root_region::ensure_code_region): Delete.
9548 (root_region::get_globals_region): Delete.
9549 (root_region::ensure_heap_region): Delete.
9550 (root_region::get_heap_region): Delete.
9551 (root_region::remap_region_ids): Delete.
9552 (root_region::can_merge_p): Delete.
9553 (root_region::add_to_hash): Delete.
9554 (root_region::walk_for_canonicalization): Delete.
9555 (root_region::get_value_by_name): Delete.
9556 (symbolic_region::symbolic_region): Delete.
9557 (symbolic_region::compare_fields): Delete.
9558 (symbolic_region::clone): Delete.
9559 (symbolic_region::walk_for_canonicalization): Delete.
9560 (symbolic_region::print_fields): Delete.
9561 (region_model::region_model): Add region_model_manager * param.
9562 Reimplement in terms of store, dropping impl_constraint_manager
9563 subclass.
9564 (region_model::operator=): Reimplement in terms of store
9565 (region_model::operator==): Likewise.
9566 (region_model::hash): Likewise.
9567 (region_model::print): Delete.
9568 (region_model::print_svalue): Delete.
9569 (region_model::dump_dot_to_pp): Delete.
9570 (region_model::dump_dot_to_file): Delete.
9571 (region_model::dump_dot): Delete.
9572 (region_model::dump_to_pp): Replace "summarize" param with
9573 "simple" and "multiline". Port to store-based implementation.
9574 (region_model::dump): Replace "summarize" param with "simple" and
9575 "multiline".
9576 (dump_vec_of_tree): Delete.
9577 (region_model::dump_summary_of_rep_path_vars): Delete.
9578 (region_model::validate): Delete.
9579 (svalue_id_cmp_by_constant_svalue_model): Delete.
9580 (svalue_id_cmp_by_constant_svalue): Delete.
9581 (region_model::canonicalize): Drop "ctxt" param. Reimplement in
9582 terms of store and constraints.
9583 (region_model::canonicalized_p): Remove NULL arg to canonicalize.
9584 (region_model::loop_replay_fixup): New.
9585 (poisoned_value_diagnostic::emit): Tweak wording of warnings.
9586 (region_model::check_for_poison): Delete.
9587 (region_model::get_gassign_result): New.
9588 (region_model::on_assignment): Port to store-based implementation.
9589 (region_model::on_call_pre): Delete calls to check_for_poison.
9590 Move implementations to region-model-impl-calls.c and port to
9591 store-based implementation.
9592 (region_model::on_call_post): Likewise.
9593 (class reachable_regions): Move to region-model-reachability.h/cc
9594 and port to store-based implementation.
9595 (region_model::handle_unrecognized_call): Port to store-based
9596 implementation.
9597 (region_model::get_reachable_svalues): New.
9598 (region_model::on_setjmp): Port to store-based implementation.
9599 (region_model::on_longjmp): Likewise.
9600 (region_model::handle_phi): Drop is_back_edge param and the logic
9601 using it.
9602 (region_model::get_lvalue_1): Port from region_id to const region *.
9603 (region_model::make_region_for_unexpected_tree_code): Delete.
9604 (assert_compat_types): If the check fails, use internal_error to
9605 show the types.
9606 (region_model::get_lvalue): Port from region_id to const region *.
9607 (region_model::get_rvalue_1): Port from svalue_id to const svalue *.
9608 (region_model::get_rvalue): Likewise.
9609 (region_model::get_or_create_ptr_svalue): Delete.
9610 (region_model::get_or_create_constant_svalue): Delete.
9611 (region_model::get_svalue_for_fndecl): Delete.
9612 (region_model::get_region_for_fndecl): Delete.
9613 (region_model::get_svalue_for_label): Delete.
9614 (region_model::get_region_for_label): Delete.
9615 (build_cast): Delete.
9616 (region_model::maybe_cast_1): Delete.
9617 (region_model::maybe_cast): Delete.
9618 (region_model::get_field_region): Delete.
9619 (region_model::get_store_value): New.
9620 (region_model::region_exists_p): New.
9621 (region_model::deref_rvalue): Port from svalue_id to const svalue *.
9622 (region_model::set_value): Likewise.
9623 (region_model::clobber_region): New.
9624 (region_model::purge_region): New.
9625 (region_model::zero_fill_region): New.
9626 (region_model::mark_region_as_unknown): New.
9627 (region_model::eval_condition): Port from svalue_id to
9628 const svalue *.
9629 (region_model::eval_condition_without_cm): Likewise.
9630 (region_model::compare_initial_and_pointer): New.
9631 (region_model::add_constraint): Port from svalue_id to
9632 const svalue *.
9633 (region_model::maybe_get_constant): Delete.
9634 (region_model::get_representative_path_var): New.
9635 (region_model::add_new_malloc_region): Delete.
9636 (region_model::get_representative_tree): Port to const svalue *.
9637 (region_model::get_representative_path_var): Port to
9638 const region *.
9639 (region_model::get_path_vars_for_svalue): Delete.
9640 (region_model::set_to_new_unknown_value): Delete.
9641 (region_model::update_for_phis): Don't pass is_back_edge to handle_phi.
9642 (region_model::update_for_call_superedge): Port from svalue_id to
9643 const svalue *.
9644 (region_model::update_for_return_superedge): Port to store-based
9645 implementation.
9646 (region_model::update_for_call_summary): Replace
9647 set_to_new_unknown_value with mark_region_as_unknown.
9648 (region_model::get_root_region): Delete.
9649 (region_model::get_stack_region_id): Delete.
9650 (region_model::push_frame): Delete.
9651 (region_model::get_current_frame_id): Delete.
9652 (region_model::get_current_function): Delete.
9653 (region_model::pop_frame): Delete.
9654 (region_model::on_top_level_param): New.
9655 (region_model::get_stack_depth): Delete.
9656 (region_model::get_function_at_depth): Delete.
9657 (region_model::get_globals_region_id): Delete.
9658 (region_model::add_svalue): Delete.
9659 (region_model::replace_svalue): Delete.
9660 (region_model::add_region): Delete.
9661 (region_model::get_svalue): Delete.
9662 (region_model::get_region): Delete.
9663 (make_region_for_type): Delete.
9664 (region_model::add_region_for_type): Delete.
9665 (region_model::on_top_level_param): New.
9666 (class restrict_to_used_svalues): Delete.
9667 (region_model::purge_unused_svalues): Delete.
9668 (region_model::push_frame): New.
9669 (region_model::remap_svalue_ids): Delete.
9670 (region_model::remap_region_ids): Delete.
9671 (region_model::purge_regions): Delete.
9672 (region_model::get_descendents): Delete.
9673 (region_model::delete_region_and_descendents): Delete.
9674 (region_model::poison_any_pointers_to_bad_regions): Delete.
9675 (region_model::can_merge_with_p): Delete.
9676 (region_model::get_current_function): New.
9677 (region_model::get_value_by_name): Delete.
9678 (region_model::convert_byte_offset_to_array_index): Delete.
9679 (region_model::pop_frame): New.
9680 (region_model::get_or_create_mem_ref): Delete.
9681 (region_model::get_stack_depth): New.
9682 (region_model::get_frame_at_index): New.
9683 (region_model::unbind_region_and_descendents): New.
9684 (struct bad_pointer_finder): New.
9685 (region_model::get_or_create_pointer_plus_expr): Delete.
9686 (region_model::poison_any_pointers_to_descendents): New.
9687 (region_model::get_or_create_view): Delete.
9688 (region_model::can_merge_with_p): New.
9689 (region_model::get_fndecl_for_call): Port from svalue_id to
9690 const svalue *.
9691 (struct append_ssa_names_cb_data): New.
9692 (get_ssa_name_regions_for_current_frame): New.
9693 (region_model::append_ssa_names_cb): New.
9694 (model_merger::dump_to_pp): Add "simple" param. Drop dumping of
9695 remappings.
9696 (model_merger::dump): Add "simple" param to both overloads.
9697 (model_merger::can_merge_values_p): Delete.
9698 (model_merger::record_regions): Delete.
9699 (model_merger::record_svalues): Delete.
9700 (svalue_id_merger_mapping::svalue_id_merger_mapping): Delete.
9701 (svalue_id_merger_mapping::dump_to_pp): Delete.
9702 (svalue_id_merger_mapping::dump): Delete.
9703 (region_model::create_region_for_heap_alloc): New.
9704 (region_model::create_region_for_alloca): New.
9705 (region_model::record_dynamic_extents): New.
9706 (canonicalization::canonicalization): Delete.
9707 (canonicalization::walk_rid): Delete.
9708 (canonicalization::walk_sid): Delete.
9709 (canonicalization::dump_to_pp): Delete.
9710 (canonicalization::dump): Delete.
9711 (inchash::add): Delete overloads for svalue_id and region_id.
9712 (engine::log_stats): New.
9713 (assert_condition): Add overload comparing svalues.
9714 (assert_dump_eq): Pass "true" for multiline.
9715 (selftest::test_dump): Update for rewrite of region_model.
9716 (selftest::test_dump_2): Rename to...
9717 (selftest::test_struct): ...this. Provide a region_model_manager
9718 when creating region_model instance. Remove dump test. Add
9719 checks for get_offset.
9720 (selftest::test_dump_3): Rename to...
9721 (selftest::test_array_1): ...this. Provide a region_model_manager
9722 when creating region_model instance. Remove dump test.
9723 (selftest::test_get_representative_tree): Port from svalue_id to
9724 new API. Add test coverage for various expressions.
9725 (selftest::test_unique_constants): Provide a region_model_manager
9726 for the region_model. Add test coverage for comparing const vs
9727 non-const.
9728 (selftest::test_svalue_equality): Delete.
9729 (selftest::test_region_equality): Delete.
9730 (selftest::test_unique_unknowns): New.
9731 (class purge_all_svalue_ids): Delete.
9732 (class purge_one_svalue_id): Delete.
9733 (selftest::test_purging_by_criteria): Delete.
9734 (selftest::test_initial_svalue_folding): New.
9735 (selftest::test_unaryop_svalue_folding): New.
9736 (selftest::test_binop_svalue_folding): New.
9737 (selftest::test_sub_svalue_folding): New.
9738 (selftest::test_purge_unused_svalues): Delete.
9739 (selftest::test_descendent_of_p): New.
9740 (selftest::test_assignment): Provide a region_model_manager for
9741 the region_model. Drop the dump test.
9742 (selftest::test_compound_assignment): Likewise.
9743 (selftest::test_stack_frames): Port to new implementation.
9744 (selftest::test_get_representative_path_var): Likewise.
9745 (selftest::test_canonicalization_1): Rename to...
9746 (selftest::test_equality_1): ...this. Port to new API, and add
9747 (selftest::test_canonicalization_2): Provide a
9748 region_model_manager when creating region_model instances.
9749 Remove redundant canicalization.
9750 (selftest::test_canonicalization_3): Provide a
9751 region_model_manager when creating region_model instances.
9752 Remove param from calls to region_model::canonicalize.
9753 (selftest::test_canonicalization_4): Likewise.
9754 (selftest::assert_region_models_merge): Constify
9755 out_merged_svalue. Port to new API.
9756 (selftest::test_state_merging): Provide a
9757 region_model_manager when creating region_model instances.
9758 Provide a program_point point when merging them. Replace
9759 set_to_new_unknown_value with usage of placeholder_svalues.
9760 Drop get_value_by_name. Port from svalue_id to const svalue *.
9761 Add test of heap allocation.
9762 (selftest::test_constraint_merging): Provide a
9763 region_model_manager when creating region_model instances.
9764 Provide a program_point point when merging them. Eliminate use
9765 of set_to_new_unknown_value.
9766 (selftest::test_widening_constraints): New.
9767 (selftest::test_iteration_1): New.
9768 (selftest::test_malloc_constraints): Port to store-based
9769 implementation.
9770 (selftest::test_var): New test.
9771 (selftest::test_array_2): New test.
9772 (selftest::test_mem_ref): New test.
9773 (selftest::test_POINTER_PLUS_EXPR_then_MEM_REF): New.
9774 (selftest::test_malloc): New.
9775 (selftest::test_alloca): New.
9776 (selftest::analyzer_region_model_cc_tests): Update for renamings.
9777 Call new functions.
9778 * region-model.h (class path_var): Move to analyzer.h.
9779 (class svalue_id): Delete.
9780 (class region_id): Delete.
9781 (class id_map): Delete.
9782 (svalue_id_map): Delete.
9783 (region_id_map): Delete.
9784 (id_map<T>::id_map): Delete.
9785 (id_map<T>::put): Delete.
9786 (id_map<T>::get_dst_for_src): Delete.
9787 (id_map<T>::get_src_for_dst): Delete.
9788 (id_map<T>::dump_to_pp): Delete.
9789 (id_map<T>::dump): Delete.
9790 (id_map<T>::update): Delete.
9791 (one_way_svalue_id_map): Delete.
9792 (one_way_region_id_map): Delete.
9793 (class region_id_set): Delete.
9794 (class svalue_id_set): Delete.
9795 (struct complexity): New.
9796 (class visitor): New.
9797 (enum svalue_kind): Add SK_SETJMP, SK_INITIAL, SK_UNARYOP,
9798 SK_BINOP, SK_SUB,SK_UNMERGEABLE, SK_PLACEHOLDER, SK_WIDENING,
9799 SK_COMPOUND, and SK_CONJURED.
9800 (svalue::operator==): Delete.
9801 (svalue::operator!=): Delete.
9802 (svalue::clone): Delete.
9803 (svalue::hash): Delete.
9804 (svalue::dump_dot_to_pp): Delete.
9805 (svalue::dump_to_pp): New.
9806 (svalue::dump): New.
9807 (svalue::get_desc): New.
9808 (svalue::dyn_cast_initial_svalue): New.
9809 (svalue::dyn_cast_unaryop_svalue): New.
9810 (svalue::dyn_cast_binop_svalue): New.
9811 (svalue::dyn_cast_sub_svalue): New.
9812 (svalue::dyn_cast_unmergeable_svalue): New.
9813 (svalue::dyn_cast_widening_svalue): New.
9814 (svalue::dyn_cast_compound_svalue): New.
9815 (svalue::dyn_cast_conjured_svalue): New.
9816 (svalue::maybe_undo_cast): New.
9817 (svalue::unwrap_any_unmergeable): New.
9818 (svalue::remap_region_ids): Delete
9819 (svalue::can_merge_p): New.
9820 (svalue::walk_for_canonicalization): Delete
9821 (svalue::get_complexity): New.
9822 (svalue::get_child_sid): Delete
9823 (svalue::accept): New.
9824 (svalue::live_p): New.
9825 (svalue::implicitly_live_p): New.
9826 (svalue::svalue): Add complexity param.
9827 (svalue::add_to_hash): Delete
9828 (svalue::print_details): Delete
9829 (svalue::m_complexity): New field.
9830 (region_svalue::key_t): New struct.
9831 (region_svalue::region_svalue): Port from region_id to
9832 const region_id *. Add complexity.
9833 (region_svalue::compare_fields): Delete.
9834 (region_svalue::clone): Delete.
9835 (region_svalue::dump_dot_to_pp): Delete.
9836 (region_svalue::get_pointee): Port from region_id to
9837 const region_id *.
9838 (region_svalue::remap_region_ids): Delete.
9839 (region_svalue::merge_values): Delete.
9840 (region_svalue::dump_to_pp): New.
9841 (region_svalue::accept): New.
9842 (region_svalue::walk_for_canonicalization): Delete.
9843 (region_svalue::eval_condition): Make params const.
9844 (region_svalue::add_to_hash): Delete.
9845 (region_svalue::print_details): Delete.
9846 (region_svalue::m_rid): Replace with...
9847 (region_svalue::m_reg): ...this.
9848 (is_a_helper <region_svalue *>::test): Convert to...
9849 (is_a_helper <const region_svalue *>::test): ...this.
9850 (template <> struct default_hash_traits<region_svalue::key_t>):
9851 New.
9852 (constant_svalue::constant_svalue): Add complexity.
9853 (constant_svalue::compare_fields): Delete.
9854 (constant_svalue::clone): Delete.
9855 (constant_svalue::add_to_hash): Delete.
9856 (constant_svalue::dump_to_pp): New.
9857 (constant_svalue::accept): New.
9858 (constant_svalue::implicitly_live_p): New.
9859 (constant_svalue::merge_values): Delete.
9860 (constant_svalue::eval_condition): Make params const.
9861 (constant_svalue::get_child_sid): Delete.
9862 (constant_svalue::print_details): Delete.
9863 (is_a_helper <constant_svalue *>::test): Convert to...
9864 (is_a_helper <const constant_svalue *>::test): ...this.
9865 (class unknown_svalue): Update leading comment.
9866 (unknown_svalue::unknown_svalue): Add complexity.
9867 (unknown_svalue::compare_fields): Delete.
9868 (unknown_svalue::add_to_hash): Delete.
9869 (unknown_svalue::dyn_cast_unknown_svalue): Delete.
9870 (unknown_svalue::print_details): Delete.
9871 (unknown_svalue::dump_to_pp): New.
9872 (unknown_svalue::accept): New.
9873 (poisoned_svalue::key_t): New struct.
9874 (poisoned_svalue::poisoned_svalue): Add complexity.
9875 (poisoned_svalue::compare_fields): Delete.
9876 (poisoned_svalue::clone): Delete.
9877 (poisoned_svalue::add_to_hash): Delete.
9878 (poisoned_svalue::dump_to_pp): New.
9879 (poisoned_svalue::accept): New.
9880 (poisoned_svalue::print_details): Delete.
9881 (is_a_helper <poisoned_svalue *>::test): Convert to...
9882 (is_a_helper <const poisoned_svalue *>::test): ...this.
9883 (template <> struct default_hash_traits<poisoned_svalue::key_t>):
9884 New.
9885 (setjmp_record::add_to_hash): New.
9886 (setjmp_svalue::key_t): New struct.
9887 (setjmp_svalue::compare_fields): Delete.
9888 (setjmp_svalue::clone): Delete.
9889 (setjmp_svalue::add_to_hash): Delete.
9890 (setjmp_svalue::setjmp_svalue): Add complexity.
9891 (setjmp_svalue::dump_to_pp): New.
9892 (setjmp_svalue::accept): New.
9893 (setjmp_svalue::void print_details): Delete.
9894 (is_a_helper <const setjmp_svalue *>::test): New.
9895 (template <> struct default_hash_traits<setjmp_svalue::key_t>): New.
9896 (class initial_svalue : public svalue): New.
9897 (is_a_helper <const initial_svalue *>::test): New.
9898 (class unaryop_svalue): New.
9899 (is_a_helper <const unaryop_svalue *>::test): New.
9900 (template <> struct default_hash_traits<unaryop_svalue::key_t>): New.
9901 (class binop_svalue): New.
9902 (is_a_helper <const binop_svalue *>::test): New.
9903 (template <> struct default_hash_traits<binop_svalue::key_t>): New.
9904 (class sub_svalue): New.
9905 (is_a_helper <const sub_svalue *>::test): New.
9906 (template <> struct default_hash_traits<sub_svalue::key_t>): New.
9907 (class unmergeable_svalue): New.
9908 (is_a_helper <const unmergeable_svalue *>::test): New.
9909 (class placeholder_svalue): New.
9910 (is_a_helper <placeholder_svalue *>::test): New.
9911 (class widening_svalue): New.
9912 (is_a_helper <widening_svalue *>::test): New.
9913 (template <> struct default_hash_traits<widening_svalue::key_t>): New.
9914 (class compound_svalue): New.
9915 (is_a_helper <compound_svalue *>::test): New.
9916 (template <> struct default_hash_traits<compound_svalue::key_t>): New.
9917 (class conjured_svalue): New.
9918 (is_a_helper <conjured_svalue *>::test): New.
9919 (template <> struct default_hash_traits<conjured_svalue::key_t>): New.
9920 (enum region_kind): Delete RK_PRIMITIVE, RK_STRUCT, RK_UNION, and
9921 RK_ARRAY. Add RK_LABEL, RK_DECL, RK_FIELD, RK_ELEMENT, RK_OFFSET,
9922 RK_CAST, RK_HEAP_ALLOCATED, RK_ALLOCA, RK_STRING, and RK_UNKNOWN.
9923 (region_kind_to_str): Delete.
9924 (region::~region): Move implementation to region.cc.
9925 (region::operator==): Delete.
9926 (region::operator!=): Delete.
9927 (region::clone): Delete.
9928 (region::get_id): New.
9929 (region::cmp_ids): New.
9930 (region::dyn_cast_map_region): Delete.
9931 (region::dyn_cast_array_region): Delete.
9932 (region::region_id get_parent): Delete.
9933 (region::get_parent_region): Convert to a simple accessor.
9934 (region::void set_value): Delete.
9935 (region::svalue_id get_value): Delete.
9936 (region::svalue_id get_value_direct): Delete.
9937 (region::svalue_id get_inherited_child_sid): Delete.
9938 (region::dyn_cast_frame_region): New.
9939 (region::dyn_cast_function_region): New.
9940 (region::dyn_cast_decl_region): New.
9941 (region::dyn_cast_field_region): New.
9942 (region::dyn_cast_element_region): New.
9943 (region::dyn_cast_offset_region): New.
9944 (region::dyn_cast_cast_region): New.
9945 (region::dyn_cast_string_region): New.
9946 (region::accept): New.
9947 (region::get_base_region): New.
9948 (region::base_region_p): New.
9949 (region::descendent_of_p): New.
9950 (region::maybe_get_frame_region): New.
9951 (region::maybe_get_decl): New.
9952 (region::hash): Delete.
9953 (region::rint): Delete.
9954 (region::dump_dot_to_pp): Delete.
9955 (region::get_desc): New.
9956 (region::dump_to_pp): Convert to vfunc, changing signature.
9957 (region::dump_child_label): Delete.
9958 (region::remap_svalue_ids): Delete.
9959 (region::remap_region_ids): Delete.
9960 (region::dump): New.
9961 (region::walk_for_canonicalization): Delete.
9962 (region::non_null_p): Drop region_model param.
9963 (region::add_view): Delete.
9964 (region::get_view): Delete.
9965 (region::get_active_view): Delete.
9966 (region::is_view_p): Delete.
9967 (region::cmp_ptrs): New.
9968 (region::validate): Delete.
9969 (region::get_offset): New.
9970 (region::get_byte_size): New.
9971 (region::get_bit_size): New.
9972 (region::get_subregions_for_binding): New.
9973 (region::region): Add complexity param. Convert parent from
9974 region_id to const region *. Drop svalue_id. Drop copy ctor.
9975 (region::symbolic_for_unknown_ptr_p): New.
9976 (region::add_to_hash): Delete.
9977 (region::print_fields): Delete.
9978 (region::get_complexity): New accessor.
9979 (region::become_active_view): Delete.
9980 (region::deactivate_any_active_view): Delete.
9981 (region::deactivate_view): Delete.
9982 (region::calc_offset): New.
9983 (region::m_parent_rid): Delete.
9984 (region::m_sval_id): Delete.
9985 (region::m_complexity): New.
9986 (region::m_id): New.
9987 (region::m_parent): New.
9988 (region::m_view_rids): Delete.
9989 (region::m_is_view): Delete.
9990 (region::m_active_view_rid): Delete.
9991 (region::m_cached_offset): New.
9992 (is_a_helper <region *>::test): Convert to...
9993 (is_a_helper <const region *>::test): ... this.
9994 (class primitive_region): Delete.
9995 (class space_region): New.
9996 (class map_region): Delete.
9997 (is_a_helper <map_region *>::test): Delete.
9998 (class frame_region): Reimplement.
9999 (template <> struct default_hash_traits<frame_region::key_t>):
10000 New.
10001 (class globals_region): Reimplement.
10002 (is_a_helper <globals_region *>::test): Convert to...
10003 (is_a_helper <const globals_region *>::test): ...this.
10004 (class struct_or_union_region): Delete.
10005 (is_a_helper <struct_or_union_region *>::test): Delete.
10006 (class code_region): Reimplement.
10007 (is_a_helper <const code_region *>::test): New.
10008 (class struct_region): Delete.
10009 (is_a_helper <struct_region *>::test): Delete.
10010 (class function_region): Reimplement.
10011 (is_a_helper <function_region *>::test): Convert to...
10012 (is_a_helper <const function_region *>::test): ...this.
10013 (class union_region): Delete.
10014 (is_a_helper <union_region *>::test): Delete.
10015 (class label_region): New.
10016 (is_a_helper <const label_region *>::test): New.
10017 (class scope_region): Delete.
10018 (class stack_region): Reimplement.
10019 (is_a_helper <stack_region *>::test): Convert to...
10020 (is_a_helper <const stack_region *>::test): ...this.
10021 (class heap_region): Reimplement.
10022 (is_a_helper <heap_region *>::test): Convert to...
10023 (is_a_helper <const heap_region *>::test): ...this.
10024 (class root_region): Reimplement.
10025 (is_a_helper <root_region *>::test): Convert to...
10026 (is_a_helper <const root_region *>::test): ...this.
10027 (class symbolic_region): Reimplement.
10028 (is_a_helper <const symbolic_region *>::test): New.
10029 (template <> struct default_hash_traits<symbolic_region::key_t>):
10030 New.
10031 (class decl_region): New.
10032 (is_a_helper <const decl_region *>::test): New.
10033 (class field_region): New.
10034 (template <> struct default_hash_traits<field_region::key_t>): New.
10035 (class array_region): Delete.
10036 (class element_region): New.
10037 (is_a_helper <array_region *>::test): Delete.
10038 (is_a_helper <const element_region *>::test): New.
10039 (template <> struct default_hash_traits<element_region::key_t>):
10040 New.
10041 (class offset_region): New.
10042 (is_a_helper <const offset_region *>::test): New.
10043 (template <> struct default_hash_traits<offset_region::key_t>):
10044 New.
10045 (class cast_region): New.
10046 (is_a_helper <const cast_region *>::test): New.
10047 (template <> struct default_hash_traits<cast_region::key_t>): New.
10048 (class heap_allocated_region): New.
10049 (class alloca_region): New.
10050 (class string_region): New.
10051 (is_a_helper <const string_region *>::test): New.
10052 (class unknown_region): New.
10053 (class region_model_manager): New.
10054 (struct append_ssa_names_cb_data): New.
10055 (class call_details): New.
10056 (region_model::region_model): Add region_model_manager param.
10057 (region_model::print_svalue): Delete.
10058 (region_model::dump_dot_to_pp): Delete.
10059 (region_model::dump_dot_to_file): Delete.
10060 (region_model::dump_dot): Delete.
10061 (region_model::dump_to_pp): Drop summarize param in favor of
10062 simple and multiline.
10063 (region_model::dump): Likewise.
10064 (region_model::summarize_to_pp): Delete.
10065 (region_model::summarize): Delete.
10066 (region_model::void canonicalize): Drop ctxt param.
10067 (region_model::void check_for_poison): Delete.
10068 (region_model::get_gassign_result): New.
10069 (region_model::impl_call_alloca): New.
10070 (region_model::impl_call_analyzer_describe): New.
10071 (region_model::impl_call_analyzer_eval): New.
10072 (region_model::impl_call_builtin_expect): New.
10073 (region_model::impl_call_calloc): New.
10074 (region_model::impl_call_free): New.
10075 (region_model::impl_call_malloc): New.
10076 (region_model::impl_call_memset): New.
10077 (region_model::impl_call_strlen): New.
10078 (region_model::get_reachable_svalues): New.
10079 (region_model::handle_phi): Drop is_back_edge param.
10080 (region_model::region_id get_root_rid): Delete.
10081 (region_model::root_region *get_root_region): Delete.
10082 (region_model::region_id get_stack_region_id): Delete.
10083 (region_model::push_frame): Convert from region_id and svalue_id
10084 to const region * and const svalue *.
10085 (region_model::get_current_frame_id): Replace with...
10086 (region_model::get_current_frame): ...this.
10087 (region_model::pop_frame): Convert from region_id to
10088 const region *. Drop purge and stats param. Add out_result.
10089 (region_model::function *get_function_at_depth): Delete.
10090 (region_model::get_globals_region_id): Delete.
10091 (region_model::add_svalue): Delete.
10092 (region_model::replace_svalue): Delete.
10093 (region_model::add_region): Delete.
10094 (region_model::add_region_for_type): Delete.
10095 (region_model::get_svalue): Delete.
10096 (region_model::get_region): Delete.
10097 (region_model::get_lvalue): Convert from region_id to
10098 const region *.
10099 (region_model::get_rvalue): Convert from svalue_id to
10100 const svalue *.
10101 (region_model::get_or_create_ptr_svalue): Delete.
10102 (region_model::get_or_create_constant_svalue): Delete.
10103 (region_model::get_svalue_for_fndecl): Delete.
10104 (region_model::get_svalue_for_label): Delete.
10105 (region_model::get_region_for_fndecl): Delete.
10106 (region_model::get_region_for_label): Delete.
10107 (region_model::get_frame_at_index (int index) const;): New.
10108 (region_model::maybe_cast): Delete.
10109 (region_model::maybe_cast_1): Delete.
10110 (region_model::get_field_region): Delete.
10111 (region_model::id deref_rvalue): Convert from region_id and
10112 svalue_id to const region * and const svalue *. Drop overload,
10113 passing in both a tree and an svalue.
10114 (region_model::set_value): Convert from region_id and svalue_id to
10115 const region * and const svalue *.
10116 (region_model::set_to_new_unknown_value): Delete.
10117 (region_model::clobber_region (const region *reg);): New.
10118 (region_model::purge_region (const region *reg);): New.
10119 (region_model::zero_fill_region (const region *reg);): New.
10120 (region_model::mark_region_as_unknown (const region *reg);): New.
10121 (region_model::copy_region): Convert from region_id to
10122 const region *.
10123 (region_model::eval_condition): Convert from svalue_id to
10124 const svalue *.
10125 (region_model::eval_condition_without_cm): Likewise.
10126 (region_model::compare_initial_and_pointer): New.
10127 (region_model:maybe_get_constant): Delete.
10128 (region_model::add_new_malloc_region): Delete.
10129 (region_model::get_representative_tree): Convert from svalue_id to
10130 const svalue *.
10131 (region_model::get_representative_path_var): Delete decl taking a
10132 region_id in favor of two decls, for svalue vs region, with an
10133 svalue_set to ensure termination.
10134 (region_model::get_path_vars_for_svalue): Delete.
10135 (region_model::create_region_for_heap_alloc): New.
10136 (region_model::create_region_for_alloca): New.
10137 (region_model::purge_unused_svalues): Delete.
10138 (region_model::remap_svalue_ids): Delete.
10139 (region_model::remap_region_ids): Delete.
10140 (region_model::purge_regions): Delete.
10141 (region_model::get_num_svalues): Delete.
10142 (region_model::get_num_regions): Delete.
10143 (region_model::get_descendents): Delete.
10144 (region_model::get_store): New.
10145 (region_model::delete_region_and_descendents): Delete.
10146 (region_model::get_manager): New.
10147 (region_model::unbind_region_and_descendents): New.
10148 (region_model::can_merge_with_p): Add point param. Drop
10149 svalue_id_merger_mapping.
10150 (region_model::get_value_by_name): Delete.
10151 (region_model::convert_byte_offset_to_array_index): Delete.
10152 (region_model::get_or_create_mem_ref): Delete.
10153 (region_model::get_or_create_pointer_plus_expr): Delete.
10154 (region_model::get_or_create_view): Delete.
10155 (region_model::get_lvalue_1): Convert from region_id to
10156 const region *.
10157 (region_model::get_rvalue_1): Convert from svalue_id to
10158 const svalue *.
10159 (region_model::get_ssa_name_regions_for_current_frame): New.
10160 (region_model::append_ssa_names_cb): New.
10161 (region_model::get_store_value): New.
10162 (region_model::copy_struct_region): Delete.
10163 (region_model::copy_union_region): Delete.
10164 (region_model::copy_array_region): Delete.
10165 (region_model::region_exists_p): New.
10166 (region_model::make_region_for_unexpected_tree_code): Delete.
10167 (region_model::loop_replay_fixup): New.
10168 (region_model::poison_any_pointers_to_bad_regions): Delete.
10169 (region_model::poison_any_pointers_to_descendents): New.
10170 (region_model::dump_summary_of_rep_path_vars): Delete.
10171 (region_model::on_top_level_param): New.
10172 (region_model::record_dynamic_extents): New.
10173 (region_model::m_mgr;): New.
10174 (region_model::m_store;): New.
10175 (region_model::m_svalues;): Delete.
10176 (region_model::m_regions;): Delete.
10177 (region_model::m_root_rid;): Delete.
10178 (region_model::m_current_frame;): New.
10179 (region_model_context::remap_svalue_ids): Delete.
10180 (region_model_context::can_purge_p): Delete.
10181 (region_model_context::on_svalue_leak): New.
10182 (region_model_context::on_svalue_purge): Delete.
10183 (region_model_context::on_liveness_change): New.
10184 (region_model_context::on_inherited_svalue): Delete.
10185 (region_model_context::on_cast): Delete.
10186 (region_model_context::on_unknown_change): Convert from svalue_id to
10187 const svalue * and add is_mutable.
10188 (class noop_region_model_context): Update for region_model_context
10189 changes.
10190 (model_merger::model_merger): Add program_point. Drop
10191 svalue_id_merger_mapping.
10192 (model_merger::dump_to_pp): Add "simple" param.
10193 (model_merger::dump): Likewise.
10194 (model_merger::get_region_a): Delete.
10195 (model_merger::get_region_b): Delete.
10196 (model_merger::can_merge_values_p): Delete.
10197 (model_merger::record_regions): Delete.
10198 (model_merger::record_svalues): Delete.
10199 (model_merger::m_point): New field.
10200 (model_merger::m_map_regions_from_a_to_m): Delete.
10201 (model_merger::m_map_regions_from_b_to_m): Delete.
10202 (model_merger::m_sid_mapping): Delete.
10203 (struct svalue_id_merger_mapping): Delete.
10204 (class engine): New.
10205 (struct canonicalization): Delete.
10206 (inchash::add): Delete decls for hashing svalue_id and region_id.
10207 (test_region_model_context::on_unexpected_tree_code): Require t to
10208 be non-NULL.
10209 (selftest::assert_condition): Add overload comparing a pair of
10210 const svalue *.
10211 * sm-file.cc: Include "tristate.h", "selftest.h",
10212 "analyzer/call-string.h", "analyzer/program-point.h",
10213 "analyzer/store.h", and "analyzer/region-model.h".
10214 (fileptr_state_machine::get_default_state): New.
10215 (fileptr_state_machine::on_stmt): Remove calls to
10216 get_readable_tree in favor of get_diagnostic_tree.
10217 * sm-malloc.cc: Include "tristate.h", "selftest.h",
10218 "analyzer/call-string.h", "analyzer/program-point.h",
10219 "analyzer/store.h", and "analyzer/region-model.h".
10220 (malloc_state_machine::get_default_state): New.
10221 (malloc_state_machine::reset_when_passed_to_unknown_fn_p): New.
10222 (malloc_diagnostic::describe_state_change): Handle change.m_expr
10223 being NULL.
10224 (null_arg::emit): Avoid printing "NULL '0'".
10225 (null_arg::describe_final_event): Avoid printing "(0) NULL".
10226 (malloc_leak::emit): Handle m_arg being NULL.
10227 (malloc_leak::describe_final_event): Handle ev.m_expr being NULL.
10228 (malloc_state_machine::on_stmt): Don't call get_readable_tree.
10229 Call get_diagnostic_tree when creating pending diagnostics.
10230 Update for is_zero_assignment becoming a member function of
10231 sm_ctxt.
10232 Don't transition to m_non_heap for ADDR_EXPR(MEM_REF()).
10233 (malloc_state_machine::reset_when_passed_to_unknown_fn_p): New
10234 vfunc implementation.
10235 * sm-sensitive.cc (sensitive_state_machine::warn_for_any_exposure): Call
10236 get_diagnostic_tree and pass the result to warn_for_state.
10237 * sm-signal.cc: Move includes of "analyzer/call-string.h" and
10238 "analyzer/program-point.h" to before "analyzer/region-model.h",
10239 and also include "analyzer/store.h" before it.
10240 (signal_unsafe_call::describe_state_change): Use
10241 get_dest_function to get handler.
10242 (update_model_for_signal_handler): Pass manager to region_model
10243 ctor.
10244 (register_signal_handler::impl_transition): Update for changes to
10245 get_or_create_node and add_edge.
10246 * sm-taint.cc (taint_state_machine::on_stmt): Remove calls to
10247 get_readable_tree, replacing them when calling warn_for_state with
10248 calls to get_diagnostic_tree.
10249 * sm.cc (is_zero_assignment): Delete.
10250 (any_pointer_p): Move to within namespace ana.
10251 * sm.h (is_zero_assignment): Remove decl.
10252 (any_pointer_p): Move decl to within namespace ana.
10253 (state_machine::get_default_state): New vfunc.
10254 (state_machine::reset_when_passed_to_unknown_fn_p): New vfunc.
10255 (sm_context::get_readable_tree): Rename to...
10256 (sm_context::get_diagnostic_tree): ...this.
10257 (sm_context::is_zero_assignment): New vfunc.
10258 * store.cc: New file.
10259 * store.h: New file.
10260 * svalue.cc: New file.
10262 2020-05-22 Mark Wielaard <mark@klomp.org>
10264 * sm-signal.cc(signal_unsafe_call::emit): Possibly add
10265 gcc_rich_location note for replacement.
10266 (signal_unsafe_call::get_replacement_fn): New private function.
10267 (get_async_signal_unsafe_fns): Add "exit".
10269 2020-04-28 David Malcolm <dmalcolm@redhat.com>
10271 PR analyzer/94816
10272 * engine.cc (impl_region_model_context::on_unexpected_tree_code):
10273 Handle NULL tree.
10274 * region-model.cc (region_model::add_region_for_type): Handle
10275 NULL type.
10276 * region-model.h
10277 (test_region_model_context::on_unexpected_tree_code): Handle NULL
10278 tree.
10280 2020-04-28 David Malcolm <dmalcolm@redhat.com>
10282 PR analyzer/94447
10283 PR analyzer/94639
10284 PR analyzer/94732
10285 PR analyzer/94754
10286 * analyzer.opt (Wanalyzer-use-of-uninitialized-value): Delete.
10287 * program-state.cc (selftest::test_program_state_dumping): Update
10288 expected dump result for removal of "uninit".
10289 * region-model.cc (poison_kind_to_str): Delete POISON_KIND_UNINIT
10290 case.
10291 (root_region::ensure_stack_region): Initialize stack with null
10292 svalue_id rather than with a typeless POISON_KIND_UNINIT value.
10293 (root_region::ensure_heap_region): Likewise for the heap.
10294 (region_model::dump_summary_of_rep_path_vars): Remove
10295 summarization of uninit values.
10296 (region_model::validate): Remove check that the stack has a
10297 POISON_KIND_UNINIT value.
10298 (poisoned_value_diagnostic::emit): Remove POISON_KIND_UNINIT
10299 case.
10300 (poisoned_value_diagnostic::describe_final_event): Likewise.
10301 (selftest::test_dump): Update expected dump result for removal of
10302 "uninit".
10303 (selftest::test_svalue_equality): Remove "uninit" and "freed".
10304 * region-model.h (enum poison_kind): Remove POISON_KIND_UNINIT.
10306 2020-04-01 David Malcolm <dmalcolm@redhat.com>
10308 PR analyzer/94378
10309 * checker-path.cc: Include "bitmap.h".
10310 * constraint-manager.cc: Likewise.
10311 * diagnostic-manager.cc: Likewise.
10312 * engine.cc: Likewise.
10313 (exploded_node::detect_leaks): Pass null region_id to pop_frame.
10314 * program-point.cc: Include "bitmap.h".
10315 * program-state.cc: Likewise.
10316 * region-model.cc (id_set<region_id>::id_set): Convert to...
10317 (region_id_set::region_id_set): ...this.
10318 (svalue_id_set::svalue_id_set): New ctor.
10319 (region_model::copy_region): New function.
10320 (region_model::copy_struct_region): New function.
10321 (region_model::copy_union_region): New function.
10322 (region_model::copy_array_region): New function.
10323 (stack_region::pop_frame): Drop return value. Add
10324 "result_dst_rid" param; if it is non-null, use copy_region to copy
10325 the result to it. Rather than capture and pass a single "known
10326 used" return value to be used by purge_unused_values, instead
10327 gather and pass a set of known used return values.
10328 (root_region::pop_frame): Drop return value. Add "result_dst_rid"
10329 param.
10330 (region_model::on_assignment): Use copy_region.
10331 (region_model::on_return): Likewise for the result.
10332 (region_model::on_longjmp): Pass null for pop_frame's
10333 result_dst_rid.
10334 (region_model::update_for_return_superedge): Pass the region for the
10335 return value of the call, if any, to pop_frame, rather than setting
10336 the lvalue for the lhs of the result.
10337 (region_model::pop_frame): Drop return value. Add
10338 "result_dst_rid" param.
10339 (region_model::purge_unused_svalues): Convert third param from an
10340 svalue_id * to an svalue_id_set *, updating the initial populating
10341 of the "used" bitmap accordingly. Don't remap it when done.
10342 (struct selftest::coord_test): New selftest fixture, extracted from...
10343 (selftest::test_dump_2): ...here.
10344 (selftest::test_compound_assignment): New selftest.
10345 (selftest::test_stack_frames): Pass null to new param of pop_frame.
10346 (selftest::analyzer_region_model_cc_tests): Call the new selftest.
10347 * region-model.h (class id_set): Delete template.
10348 (class region_id_set): Reimplement, using old id_set implementation.
10349 (class svalue_id_set): Likewise. Convert from auto_sbitmap to
10350 auto_bitmap.
10351 (region::get_active_view): New accessor.
10352 (stack_region::pop_frame): Drop return value. Add
10353 "result_dst_rid" param.
10354 (root_region::pop_frame): Likewise.
10355 (region_model::pop_frame): Likewise.
10356 (region_model::copy_region): New decl.
10357 (region_model::purge_unused_svalues): Convert third param from an
10358 svalue_id * to an svalue_id_set *.
10359 (region_model::copy_struct_region): New decl.
10360 (region_model::copy_union_region): New decl.
10361 (region_model::copy_array_region): New decl.
10363 2020-03-27 David Malcolm <dmalcolm@redhat.com>
10365 * program-state.cc (selftest::test_program_state_dumping): Update
10366 expected dump to include symbolic_region's possibly_null field.
10367 * region-model.cc (symbolic_region::print_fields): New vfunc
10368 implementation.
10369 (region_model::add_constraint): Clear m_possibly_null from
10370 symbolic_regions now known to be non-NULL.
10371 (selftest::test_malloc_constraints): New selftest.
10372 (selftest::analyzer_region_model_cc_tests): Call it.
10373 * region-model.h (region::dyn_cast_symbolic_region): Add non-const
10374 overload.
10375 (symbolic_region::dyn_cast_symbolic_region): Implement it.
10376 (symbolic_region::print_fields): New vfunc override decl.
10378 2020-03-27 David Malcolm <dmalcolm@redhat.com>
10380 * analyzer.h (class feasibility_problem): New forward decl.
10381 * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic):
10382 Initialize new fields m_status, m_epath_length, and m_problem.
10383 (saved_diagnostic::~saved_diagnostic): Delete m_problem.
10384 (dedupe_candidate::dedupe_candidate): Convert "sd" param from a
10385 const ref to a mutable ptr.
10386 (dedupe_winners::add): Convert "sd" param from a const ref to a
10387 mutable ptr. Record the length of the exploded_path. Record the
10388 feasibility/infeasibility of sd into sd, capturing a
10389 feasibility_problem when feasible_p fails, and storing it in sd.
10390 (diagnostic_manager::emit_saved_diagnostics): Update for pass by
10391 ptr rather than by const ref.
10392 * diagnostic-manager.h (class saved_diagnostic): Add new enum
10393 status. Add fields m_status, m_epath_length and m_problem.
10394 (saved_diagnostic::set_feasible): New member function.
10395 (saved_diagnostic::set_infeasible): New member function.
10396 (saved_diagnostic::get_feasibility_problem): New accessor.
10397 (saved_diagnostic::get_status): New accessor.
10398 (saved_diagnostic::set_epath_length): New member function.
10399 (saved_diagnostic::get_epath_length): New accessor.
10400 * engine.cc: Include "gimple-pretty-print.h".
10401 (exploded_path::feasible_p): Add OUT param and, if non-NULL, write
10402 a new feasibility_problem to it on failure.
10403 (viz_callgraph_node::dump_dot): Convert begin_tr calls to
10404 begin_trtd. Convert end_tr calls to end_tdtr.
10405 (class exploded_graph_annotator): New subclass of dot_annotator.
10406 (impl_run_checkers): Add a second -fdump-analyzer-supergraph dump
10407 after the analysis runs, using exploded_graph_annotator. dumping
10408 to DUMP_BASE_NAME.supergraph-eg.dot.
10409 * exploded-graph.h (exploded_node::get_dot_fillcolor): Make
10410 public.
10411 (exploded_path::feasible_p): Add OUT param.
10412 (class feasibility_problem): New class.
10413 * state-purge.cc (state_purge_annotator::add_node_annotations):
10414 Return a bool, add a "within_table" param.
10415 (print_vec_of_names): Convert begin_tr calls to begin_trtd.
10416 Convert end_tr calls to end_tdtr.
10417 (state_purge_annotator::add_stmt_annotations): Add "within_row"
10418 param.
10419 * state-purge.h ((state_purge_annotator::add_node_annotations):
10420 Return a bool, add a "within_table" param.
10421 (state_purge_annotator::add_stmt_annotations): Add "within_row"
10422 param.
10423 * supergraph.cc (supernode::dump_dot): Call add_node_annotations
10424 twice: as before, passing false for "within_table", then again
10425 with true when within the TABLE element. Convert some begin_tr
10426 calls to begin_trtd, and some end_tr calls to end_tdtr.
10427 Repeat each add_stmt_annotations call, distinguishing between
10428 calls that add TRs and those that add TDs to an existing TR.
10429 Add a call to add_after_node_annotations.
10430 * supergraph.h (dot_annotator::add_node_annotations): Add a
10431 "within_table" param.
10432 (dot_annotator::add_stmt_annotations): Add a "within_row" param.
10433 (dot_annotator::add_after_node_annotations): New vfunc.
10435 2020-03-27 David Malcolm <dmalcolm@redhat.com>
10437 * diagnostic-manager.cc (dedupe_winners::add): Show the
10438 exploded_node index in the log messages.
10439 (diagnostic_manager::emit_saved_diagnostics): Log a summary of
10440 m_saved_diagnostics at entry.
10442 2020-03-27 David Malcolm <dmalcolm@redhat.com>
10444 * supergraph.cc (superedge::dump): Add space before description;
10445 move newline to non-pretty_printer overload.
10447 2020-03-18 David Malcolm <dmalcolm@redhat.com>
10449 * region-model.cc: Include "stor-layout.h".
10450 (region_model::dump_to_pp): Rather than calling
10451 dump_summary_of_map on each of the current frame and the globals,
10452 instead get a vec of representative path_vars for all regions,
10453 and then dump a summary of all of them.
10454 (region_model::dump_summary_of_map): Delete, rewriting into...
10455 (region_model::dump_summary_of_rep_path_vars): ...this new
10456 function, working on a vec of path_vars.
10457 (region_model::set_value): New overload.
10458 (region_model::get_representative_path_var): Rename
10459 "parent_region" local to "parent_reg" and consolidate with other
10460 local. Guard test for grandparent being stack on parent_reg being
10461 non-NULL. Move handling for parent being an array_region to
10462 within guard for parent_reg being non-NULL.
10463 (selftest::make_test_compound_type): New function.
10464 (selftest::test_dump_2): New selftest.
10465 (selftest::test_dump_3): New selftest.
10466 (selftest::test_stack_frames): Update expected output from
10467 simplified dump to show "a" and "b" from parent frame and "y" in
10468 child frame.
10469 (selftest::analyzer_region_model_cc_tests): Call test_dump_2 and
10470 test_dump_3.
10471 * region-model.h (region_model::set_value): New overload decl.
10472 (region_model::dump_summary_of_map): Delete.
10473 (region_model::dump_summary_of_rep_path_vars): New.
10475 2020-03-18 David Malcolm <dmalcolm@redhat.com>
10477 * region-model.h (class noop_region_model_context): New subclass
10478 of region_model_context.
10479 (class tentative_region_model_context): Inherit from
10480 noop_region_model_context rather than from region_model_context;
10481 drop redundant vfunc implementations.
10482 (class test_region_model_context): Likewise.
10484 2020-03-18 David Malcolm <dmalcolm@redhat.com>
10486 * engine.cc (exploded_node::exploded_node): Move implementation
10487 here from header; accept point_and_state by const reference rather
10488 than by value.
10489 * exploded-graph.h (exploded_node::exploded_node): Pass
10490 point_and_state by const reference rather than by value. Move
10491 body to engine.cc.
10493 2020-03-18 Jakub Jelinek <jakub@redhat.com>
10495 * sm-malloc.cc (malloc_state_machine::on_stmt): Fix up duplicated word
10496 issue in a comment.
10497 * region-model.cc (region_model::make_region_for_unexpected_tree_code,
10498 region_model::delete_region_and_descendents): Likewise.
10499 * engine.cc (class exploded_cluster): Likewise.
10500 * diagnostic-manager.cc (class path_builder): Likewise.
10502 2020-03-13 David Malcolm <dmalcolm@redhat.com>
10504 PR analyzer/94099
10505 PR analyzer/94105
10506 * diagnostic-manager.cc (for_each_state_change): Bulletproof
10507 against errors in get_rvalue by passing a
10508 tentative_region_model_context and rejecting if there's an error.
10509 * region-model.cc (region_model::get_lvalue_1): When handling
10510 ARRAY_REF, handle results of error-handling. Handle NOP_EXPR.
10512 2020-03-06 David Malcolm <dmalcolm@redhat.com>
10514 * analyzer.h (class array_region): New forward decl.
10515 * program-state.cc (selftest::test_program_state_dumping_2): New.
10516 (selftest::analyzer_program_state_cc_tests): Call it.
10517 * region-model.cc (array_region::constant_from_key): New.
10518 (region_model::get_representative_tree): Handle region_svalue by
10519 generating an ADDR_EXPR.
10520 (region_model::get_representative_path_var): In view handling,
10521 remove erroneous TREE_TYPE when determining the type of the tree.
10522 Handle array regions and STRING_CST.
10523 (selftest::assert_dump_tree_eq): New.
10524 (ASSERT_DUMP_TREE_EQ): New macro.
10525 (selftest::test_get_representative_tree): New selftest.
10526 (selftest::analyzer_region_model_cc_tests): Call it.
10527 * region-model.h (region::dyn_cast_array_region): New vfunc.
10528 (array_region::dyn_cast_array_region): New vfunc implementation.
10529 (array_region::constant_from_key): New decl.
10531 2020-03-06 David Malcolm <dmalcolm@redhat.com>
10533 * analyzer.h (dump_quoted_tree): New decl.
10534 * engine.cc (exploded_node::dump_dot): Pass region model to
10535 sm_state_map::print.
10536 * program-state.cc: Include diagnostic-core.h.
10537 (sm_state_map::print): Add "model" param and use it to print
10538 representative trees. Only print origin information if non-null.
10539 (sm_state_map::dump): Pass NULL for model to print call.
10540 (program_state::print): Pass region model to sm_state_map::print.
10541 (program_state::dump_to_pp): Use spaces rather than newlines when
10542 summarizing. Pass region_model to sm_state_map::print.
10543 (ana::selftest::assert_dump_eq): New function.
10544 (ASSERT_DUMP_EQ): New macro.
10545 (ana::selftest::test_program_state_dumping): New function.
10546 (ana::selftest::analyzer_program_state_cc_tests): Call it.
10547 * program-state.h (program_state::print): Add model param.
10548 * region-model.cc (dump_quoted_tree): New function.
10549 (map_region::print_fields): Use dump_quoted_tree rather than
10550 %qE to avoid lang-dependent output.
10551 (map_region::dump_child_label): Likewise.
10552 (region_model::dump_summary_of_map): For SK_REGION, when
10553 get_representative_path_var fails, print the region id rather than
10554 erroneously printing NULL.
10555 * sm.cc (state_machine::get_state_by_name): New function.
10556 * sm.h (state_machine::get_state_by_name): New decl.
10558 2020-03-04 David Malcolm <dmalcolm@redhat.com>
10560 * region-model.cc (region::validate): Convert model param from ptr
10561 to reference. Update comment to reflect that it's now a vfunc.
10562 (map_region::validate): New vfunc implementation.
10563 (array_region::validate): New vfunc implementation.
10564 (stack_region::validate): New vfunc implementation.
10565 (root_region::validate): New vfunc implementation.
10566 (region_model::validate): Pass a reference rather than a pointer
10567 to the region::validate vfunc.
10568 * region-model.h (region::validate): Make virtual. Convert model
10569 param from ptr to reference.
10570 (map_region::validate): New vfunc decl.
10571 (array_region::validate): New vfunc decl.
10572 (stack_region::validate): New vfunc decl.
10573 (root_region::validate): New vfunc decl.
10575 2020-03-04 David Malcolm <dmalcolm@redhat.com>
10577 PR analyzer/93993
10578 * region-model.cc (region_model::on_call_pre): Handle
10579 BUILT_IN_EXPECT and its variants.
10580 (region_model::add_any_constraints_from_ssa_def_stmt): Split out
10581 gassign handling into add_any_constraints_from_gassign; add gcall
10582 handling.
10583 (region_model::add_any_constraints_from_gassign): New function,
10584 based on the above. Add handling for NOP_EXPR.
10585 (region_model::add_any_constraints_from_gcall): New function.
10586 (region_model::get_representative_path_var): Handle views.
10587 * region-model.h
10588 (region_model::add_any_constraints_from_ssa_def_stmt): New decl.
10589 (region_model::add_any_constraints_from_gassign): New decl.
10591 2020-03-04 David Malcolm <dmalcolm@redhat.com>
10593 PR analyzer/93993
10594 * checker-path.h (state_change_event::get_lvalue): Add ctxt param
10595 and pass it to region_model::get_value call.
10596 * diagnostic-manager.cc (get_any_origin): Pass a
10597 tentative_region_model_context to the calls to get_lvalue and reject
10598 the comparison if errors occur.
10599 (can_be_expr_of_interest_p): New function.
10600 (diagnostic_manager::prune_for_sm_diagnostic): Replace checks for
10601 CONSTANT_CLASS_P with calls to update_for_unsuitable_sm_exprs.
10602 Pass a tentative_region_model_context to the calls to
10603 state_change_event::get_lvalue and reject the comparison if errors
10604 occur.
10605 (diagnostic_manager::update_for_unsuitable_sm_exprs): New.
10606 * diagnostic-manager.h
10607 (diagnostic_manager::update_for_unsuitable_sm_exprs): New decl.
10608 * region-model.h (class tentative_region_model_context): New class.
10610 2020-03-04 David Malcolm <dmalcolm@redhat.com>
10612 * engine.cc (worklist::worklist): Remove unused field m_eg.
10613 (class viz_callgraph_edge): Remove unused field m_call_sedge.
10614 (class viz_callgraph): Remove unused field m_sg.
10615 * exploded-graph.h (worklist::::m_eg): Remove unused field.
10617 2020-03-02 David Malcolm <dmalcolm@redhat.com>
10619 * analyzer.opt (fanalyzer-show-duplicate-count): New option.
10620 * diagnostic-manager.cc
10621 (diagnostic_manager::emit_saved_diagnostic): Use the above to
10622 guard the printing of the duplicate count.
10624 2020-03-02 David Malcolm <dmalcolm@redhat.com>
10626 PR analyzer/93959
10627 * analyzer.cc (is_std_function_p): New function.
10628 (is_std_named_call_p): New functions.
10629 * analyzer.h (is_std_named_call_p): New decl.
10630 * sm-malloc.cc (malloc_state_machine::on_stmt): Check for "std::"
10631 variants when checking for malloc, calloc and free.
10633 2020-02-26 David Malcolm <dmalcolm@redhat.com>
10635 PR analyzer/93950
10636 * diagnostic-manager.cc
10637 (diagnostic_manager::prune_for_sm_diagnostic): Assert that var is
10638 either NULL or not a constant. When updating var, bulletproof
10639 against constant values.
10641 2020-02-26 David Malcolm <dmalcolm@redhat.com>
10643 PR analyzer/93947
10644 * region-model.cc (region_model::get_fndecl_for_call): Gracefully
10645 fail for fn_decls that don't have a cgraph_node.
10647 2020-02-26 David Malcolm <dmalcolm@redhat.com>
10649 * bar-chart.cc: New file.
10650 * bar-chart.h: New file.
10651 * engine.cc: Include "analyzer/bar-chart.h".
10652 (stats::log): Only log the m_num_nodes kinds that are non-zero.
10653 (stats::dump): Likewise when dumping.
10654 (stats::get_total_enodes): New.
10655 (exploded_graph::get_or_create_node): Increment the per-point-data
10656 m_excess_enodes when hitting the per-program-point limit on
10657 enodes.
10658 (exploded_graph::print_bar_charts): New.
10659 (exploded_graph::log_stats): Log the number of unprocessed enodes
10660 in the worklist. Call print_bar_charts.
10661 (exploded_graph::dump_stats): Print the number of unprocessed
10662 enodes in the worklist.
10663 * exploded-graph.h (stats::get_total_enodes): New decl.
10664 (struct per_program_point_data): Add field m_excess_enodes.
10665 (exploded_graph::print_bar_charts): New decl.
10666 * supergraph.cc (superedge::dump): New.
10667 (superedge::dump): New.
10668 * supergraph.h (supernode::get_function): New.
10669 (superedge::dump): New decl.
10670 (superedge::dump): New decl.
10672 2020-02-24 David Malcolm <dmalcolm@redhat.com>
10674 * engine.cc (exploded_graph::get_or_create_node): Dump the
10675 program_state to the pp, rather than to stderr.
10677 2020-02-24 David Malcolm <dmalcolm@redhat.com>
10679 PR analyzer/93032
10680 * sm.cc (make_checkers): Require the "taint" checker to be
10681 explicitly enabled.
10683 2020-02-24 David Malcolm <dmalcolm@redhat.com>
10685 PR analyzer/93899
10686 * engine.cc
10687 (impl_region_model_context::impl_region_model_context): Add logger
10688 param.
10689 * engine.cc (exploded_graph::add_function_entry): Create an
10690 impl_region_model_context and pass it to the push_frame call.
10691 Bail if the resulting state is invalid.
10692 (exploded_graph::build_initial_worklist): Likewise.
10693 (exploded_graph::build_initial_worklist): Handle the case where
10694 add_function_entry fails.
10695 * exploded-graph.h
10696 (impl_region_model_context::impl_region_model_context): Add logger
10697 param.
10698 * region-model.cc (map_region::get_or_create): Add ctxt param and
10699 pass it to add_region_for_type.
10700 (map_region::can_merge_p): Pass NULL as a ctxt to call to
10701 get_or_create.
10702 (array_region::get_element): Pass ctxt to call to get_or_create.
10703 (array_region::get_or_create): Add ctxt param and pass it to
10704 add_region_for_type.
10705 (root_region::push_frame): Pass ctxt to get_or_create calls.
10706 (region_model::get_lvalue_1): Likewise.
10707 (region_model::make_region_for_unexpected_tree_code): Assert that
10708 ctxt is non-NULL.
10709 (region_model::get_rvalue_1): Pass ctxt to get_svalue_for_fndecl
10710 and get_svalue_for_label calls.
10711 (region_model::get_svalue_for_fndecl): Add ctxt param and pass it
10712 to get_region_for_fndecl.
10713 (region_model::get_region_for_fndecl): Add ctxt param and pass it
10714 to get_or_create.
10715 (region_model::get_svalue_for_label): Add ctxt param and pass it
10716 to get_region_for_label.
10717 (region_model::get_region_for_label): Add ctxt param and pass it
10718 to get_region_for_fndecl and get_or_create.
10719 (region_model::get_field_region): Add ctxt param and pass it to
10720 get_or_create_view and get_or_create.
10721 (make_region_for_type): Replace gcc_unreachable with return NULL.
10722 (region_model::add_region_for_type): Add ctxt param. Handle a
10723 return of NULL from make_region_for_type by calling
10724 make_region_for_unexpected_tree_code.
10725 (region_model::get_or_create_mem_ref): Pass ctxt to calls to
10726 get_or_create_view.
10727 (region_model::get_or_create_view): Add ctxt param and pass it to
10728 add_region_for_type.
10729 (selftest::test_state_merging): Pass ctxt to get_or_create_view.
10730 * region-model.h (region_model::get_or_create): Add ctxt param.
10731 (region_model::add_region_for_type): Likewise.
10732 (region_model::get_svalue_for_fndecl): Likewise.
10733 (region_model::get_svalue_for_label): Likewise.
10734 (region_model::get_region_for_fndecl): Likewise.
10735 (region_model::get_region_for_label): Likewise.
10736 (region_model::get_field_region): Likewise.
10737 (region_model::get_or_create_view): Likewise.
10739 2020-02-24 David Malcolm <dmalcolm@redhat.com>
10741 * checker-path.cc (superedge_event::should_filter_p): Update
10742 filter for empty descriptions to cover verbosity level 3 as well
10743 as 2.
10744 * diagnostic-manager.cc: Include "analyzer/reachability.h".
10745 (class path_builder): New class.
10746 (diagnostic_manager::emit_saved_diagnostic): Create a path_builder
10747 and pass it to build_emission_path, rather passing eg; similarly
10748 for add_events_for_eedge and ext_state.
10749 (diagnostic_manager::build_emission_path): Replace "eg" param
10750 with a path_builder, pass it to add_events_for_eedge.
10751 (diagnostic_manager::add_events_for_eedge): Replace ext_state
10752 param with path_builder; pass it to add_events_for_superedge.
10753 (diagnostic_manager::significant_edge_p): New.
10754 (diagnostic_manager::add_events_for_superedge): Add path_builder
10755 param. Reject insignificant edges at verbosity levels below 3.
10756 (diagnostic_manager::prune_for_sm_diagnostic): Update highest
10757 verbosity level to 4.
10758 * diagnostic-manager.h (class path_builder): New forward decl.
10759 (diagnostic_manager::build_emission_path): Replace "eg" param
10760 with a path_builder.
10761 (diagnostic_manager::add_events_for_eedge): Replace ext_state
10762 param with path_builder.
10763 (diagnostic_manager::significant_edge_p): New.
10764 (diagnostic_manager::add_events_for_superedge): Add path_builder
10765 param.
10766 * reachability.h: New file.
10768 2020-02-18 David Malcolm <dmalcolm@redhat.com>
10770 PR analyzer/93692
10771 * analyzer.opt (fdump-analyzer-callgraph): Rewrite description.
10773 2020-02-18 David Malcolm <dmalcolm@redhat.com>
10775 PR analyzer/93777
10776 * region-model.cc (region_model::maybe_cast_1): Replace assertion
10777 that build_cast returns non-NULL with a conditional, falling
10778 through to the logic which returns a new unknown value of the
10779 desired type if it fails.
10781 2020-02-18 David Malcolm <dmalcolm@redhat.com>
10783 PR analyzer/93778
10784 * engine.cc (impl_region_model_context::on_unknown_tree_code):
10785 Rename to...
10786 (impl_region_model_context::on_unexpected_tree_code): ...this and
10787 convert first argument from path_var to tree.
10788 (exploded_node::on_stmt): Pass ctxt to purge_for_unknown_fncall.
10789 * exploded-graph.h (region_model_context::on_unknown_tree_code):
10790 Rename to...
10791 (region_model_context::on_unexpected_tree_code): ...this and
10792 convert first argument from path_var to tree.
10793 * program-state.cc (sm_state_map::purge_for_unknown_fncall): Add
10794 ctxt param and pass on to calls to get_rvalue.
10795 * program-state.h (sm_state_map::purge_for_unknown_fncall): Add
10796 ctxt param.
10797 * region-model.cc (region_model::handle_unrecognized_call): Pass
10798 ctxt on to call to get_rvalue.
10799 (region_model::get_lvalue_1): Move body of default case to
10800 region_model::make_region_for_unexpected_tree_code and call it.
10801 Within COMPONENT_REF case, reject attempts to handle types other
10802 than RECORD_TYPE and UNION_TYPE.
10803 (region_model::make_region_for_unexpected_tree_code): New
10804 function, based on default case of region_model::get_lvalue_1.
10805 * region-model.h
10806 (region_model::make_region_for_unexpected_tree_code): New decl.
10807 (region_model::on_unknown_tree_code): Rename to...
10808 (region_model::on_unexpected_tree_code): ...this and convert first
10809 argument from path_var to tree.
10810 (class test_region_model_context): Update vfunc implementation for
10811 above change.
10813 2020-02-18 David Malcolm <dmalcolm@redhat.com>
10815 PR analyzer/93774
10816 * region-model.cc
10817 (region_model::convert_byte_offset_to_array_index): Use
10818 int_size_in_bytes before calling size_in_bytes, to gracefully fail
10819 on incomplete types.
10821 2020-02-17 David Malcolm <dmalcolm@redhat.com>
10823 PR analyzer/93775
10824 * region-model.cc (region_model::get_fndecl_for_call): Handle the
10825 case where the code_region's get_tree_for_child_region returns
10826 NULL.
10828 2020-02-17 David Malcolm <dmalcolm@redhat.com>
10830 PR analyzer/93388
10831 * engine.cc (impl_region_model_context::on_unknown_tree_code):
10832 New.
10833 (exploded_graph::get_or_create_node): Reject invalid states.
10834 * exploded-graph.h
10835 (impl_region_model_context::on_unknown_tree_code): New decl.
10836 (point_and_state::point_and_state): Assert that the state is
10837 valid.
10838 * program-state.cc (program_state::program_state): Initialize
10839 m_valid to true.
10840 (program_state::operator=): Copy m_valid.
10841 (program_state::program_state): Likewise for move constructor.
10842 (program_state::print): Print m_valid.
10843 (program_state::dump_to_pp): Likewise.
10844 * program-state.h (program_state::m_valid): New field.
10845 * region-model.cc (region_model::get_lvalue_1): Implement the
10846 default case by returning a new symbolic region and calling
10847 the context's on_unknown_tree_code, rather than issuing an
10848 internal_error. Implement VIEW_CONVERT_EXPR.
10849 * region-model.h (region_model_context::on_unknown_tree_code): New
10850 vfunc.
10851 (test_region_model_context::on_unknown_tree_code): New.
10853 2020-02-17 David Malcolm <dmalcolm@redhat.com>
10855 * sm-malloc.cc (malloc_diagnostic::describe_state_change): For
10856 transition to the "null" state, only say "assuming" when
10857 transitioning from the "unchecked" state.
10859 2020-02-17 David Malcolm <dmalcolm@redhat.com>
10861 * diagnostic-manager.h (diagnostic_manager::get_saved_diagnostic):
10862 Add const overload.
10863 * engine.cc (exploded_node::dump_dot): Dump saved_diagnostics.
10864 * exploded-graph.h (exploded_graph::get_diagnostic_manager): Add
10865 const overload.
10867 2020-02-11 David Malcolm <dmalcolm@redhat.com>
10869 PR analyzer/93288
10870 * analysis-plan.cc (analysis_plan::use_summary_p): Look through
10871 the ultimate_alias_target when getting the called function.
10872 * engine.cc (exploded_node::on_stmt): Rename second "ctxt" to
10873 "sm_ctxt". Use the region_model's get_fndecl_for_call rather than
10874 gimple_call_fndecl.
10875 * region-model.cc (region_model::get_fndecl_for_call): Use
10876 ultimate_alias_target on fndecl.
10877 * supergraph.cc (get_ultimate_function_for_cgraph_edge): New
10878 function.
10879 (supergraph_call_edge): Use it when rejecting edges without
10880 functions.
10881 (supergraph::supergraph): Use it to get the function for the
10882 cgraph_edge when building interprocedural superedges.
10883 (callgraph_superedge::get_callee_function): Use it.
10884 * supergraph.h (supergraph::get_num_snodes): Make param const.
10885 (supergraph::function_to_num_snodes_t): Make first type param
10886 const.
10888 2020-02-11 David Malcolm <dmalcolm@redhat.com>
10890 PR analyzer/93374
10891 * engine.cc (exploded_edge::exploded_edge): Add ext_state param
10892 and pass it to change.validate.
10893 (exploded_graph::get_or_create_node): Move purging of change
10894 svalues to also cover the case of reusing an existing enode.
10895 (exploded_graph::add_edge): Pass m_ext_state to exploded_edge's
10896 ctor.
10897 * exploded-graph.h (exploded_edge::exploded_edge): Add ext_state
10898 param.
10899 * program-state.cc (state_change::sm_change::validate): Likewise.
10900 Assert that m_sm_idx is sane. Use ext_state to validate
10901 m_old_state and m_new_state.
10902 (state_change::validate): Add ext_state param and pass it to
10903 the sm_change validate calls.
10904 * program-state.h (state_change::sm_change::validate): Add
10905 ext_state param.
10906 (state_change::validate): Likewise.
10908 2020-02-11 David Malcolm <dmalcolm@redhat.com>
10910 PR analyzer/93669
10911 * engine.cc (exploded_graph::dump_exploded_nodes): Handle missing
10912 case of STATUS_WORKLIST in implementation of
10913 "__analyzer_dump_exploded_nodes".
10915 2020-02-11 David Malcolm <dmalcolm@redhat.com>
10917 PR analyzer/93649
10918 * constraint-manager.cc (constraint_manager::add_constraint): When
10919 merging equivalence classes and updating m_constant, also update
10920 m_cst_sid.
10921 (constraint_manager::validate): If m_constant is non-NULL assert
10922 that m_cst_sid is non-null and is valid.
10924 2020-02-11 David Malcolm <dmalcolm@redhat.com>
10926 PR analyzer/93657
10927 * analyzer.opt (fdump-analyzer): Reword description.
10928 (fdump-analyzer-stderr): Likewise.
10930 2020-02-11 David Malcolm <dmalcolm@redhat.com>
10932 * region-model.cc (print_quoted_type): New function.
10933 (svalue::print): Use it to replace %qT.
10934 (region::dump_to_pp): Likewise.
10935 (region::dump_child_label): Likewise.
10936 (region::print_fields): Likewise.
10938 2020-02-10 David Malcolm <dmalcolm@redhat.com>
10940 PR analyzer/93659
10941 * analyzer.opt (-param=analyzer-max-recursion-depth=): Fix "tha"
10942 -> "that" typo.
10943 (Wanalyzer-use-of-uninitialized-value): Fix "initialized" ->
10944 "uninitialized" typo.
10946 2020-02-10 David Malcolm <dmalcolm@redhat.com>
10948 PR analyzer/93350
10949 * region-model.cc (region_model::get_lvalue_1):
10950 Handle BIT_FIELD_REF.
10951 (make_region_for_type): Handle VECTOR_TYPE.
10953 2020-02-10 David Malcolm <dmalcolm@redhat.com>
10955 PR analyzer/93647
10956 * diagnostic-manager.cc
10957 (diagnostic_manager::prune_for_sm_diagnostic): Bulletproof against
10958 VAR being constant.
10959 * region-model.cc (region_model::get_lvalue_1): Provide a better
10960 error message when encountering an unhandled tree code.
10962 2020-02-10 David Malcolm <dmalcolm@redhat.com>
10964 PR analyzer/93405
10965 * region-model.cc (region_model::get_lvalue_1): Implement
10966 CONST_DECL.
10968 2020-02-06 David Malcolm <dmalcolm@redhat.com>
10970 * region-model.cc (region_model::maybe_cast_1): Attempt to provide
10971 a region_svalue if either type is a pointer, rather than if both
10972 types are pointers.
10974 2020-02-05 David Malcolm <dmalcolm@redhat.com>
10976 * engine.cc (exploded_node::dump_dot): Show merger enodes.
10977 (worklist::add_node): Assert that the node's m_status is
10978 STATUS_WORKLIST.
10979 (exploded_graph::process_worklist): Likewise for nodes from the
10980 worklist. Set status of merged nodes to STATUS_MERGER.
10981 (exploded_graph::process_node): Set status of node to
10982 STATUS_PROCESSED.
10983 (exploded_graph::dump_exploded_nodes): Rework handling of
10984 "__analyzer_dump_exploded_nodes", splitting enodes by status into
10985 "processed" and "merger", showing the count of just the processed
10986 enodes at the call, rather than the count of all enodes.
10987 * exploded-graph.h (exploded_node::status): New enum.
10988 (exploded_node::exploded_node): Initialize m_status to
10989 STATUS_WORKLIST.
10990 (exploded_node::get_status): New getter.
10991 (exploded_node::set_status): New setter.
10993 2020-02-04 David Malcolm <dmalcolm@redhat.com>
10995 PR analyzer/93543
10996 * engine.cc (pod_hash_traits<function_call_string>::mark_empty):
10997 Eliminate reinterpret_cast.
10998 (pod_hash_traits<function_call_string>::is_empty): Likewise.
11000 2020-02-03 David Malcolm <dmalcolm@redhat.com>
11002 * constraint-manager.cc (range::constrained_to_single_element):
11003 Replace fold_build2 with fold_binary. Remove unnecessary newline.
11004 (constraint_manager::get_or_add_equiv_class): Replace fold_build2
11005 with fold_binary in two places, and remove out-of-date comment.
11006 (constraint_manager::eval_condition): Replace fold_build2 with
11007 fold_binary.
11008 * region-model.cc (constant_svalue::eval_condition): Likewise.
11009 (region_model::on_assignment): Likewise.
11011 2020-02-03 David Malcolm <dmalcolm@redhat.com>
11013 PR analyzer/93544
11014 * diagnostic-manager.cc
11015 (diagnostic_manager::prune_for_sm_diagnostic): Bulletproof
11016 against bad choices due to bad paths.
11017 * engine.cc (impl_region_model_context::on_phi): New.
11018 * exploded-graph.h (impl_region_model_context::on_phi): New decl.
11019 * region-model.cc (region_model::on_longjmp): Likewise.
11020 (region_model::handle_phi): Add phi param. Call the ctxt's on_phi
11021 vfunc.
11022 (region_model::update_for_phis): Pass phi to handle_phi.
11023 * region-model.h (region_model::handle_phi): Add phi param.
11024 (region_model_context::on_phi): New vfunc.
11025 (test_region_model_context::on_phi): New.
11026 * sm-malloc.cc (malloc_state_machine::on_phi): New.
11027 (malloc_state_machine::on_zero_assignment): New.
11028 * sm.h (state_machine::on_phi): New vfunc.
11030 2020-02-03 David Malcolm <dmalcolm@redhat.com>
11032 * engine.cc (supernode_cluster::dump_dot): Show BB index as
11033 well as SN index.
11034 * supergraph.cc (supernode::dump_dot): Likewise.
11036 2020-02-03 David Malcolm <dmalcolm@redhat.com>
11038 PR analyzer/93546
11039 * region-model.cc (region_model::on_call_pre): Update for new
11040 param of symbolic_region ctor.
11041 (region_model::deref_rvalue): Likewise.
11042 (region_model::add_new_malloc_region): Likewise.
11043 (make_region_for_type): Likewise, preserving type.
11044 * region-model.h (symbolic_region::symbolic_region): Add "type"
11045 param and pass it to base class ctor.
11047 2020-02-03 David Malcolm <dmalcolm@redhat.com>
11049 PR analyzer/93547
11050 * constraint-manager.cc
11051 (constraint_manager::get_or_add_equiv_class): Ensure types are
11052 compatible before comparing constants.
11054 2020-01-31 David Malcolm <dmalcolm@redhat.com>
11056 PR analyzer/93457
11057 * region-model.cc (make_region_for_type): Use VOID_TYPE_P rather
11058 than checking against void_type_node.
11060 2020-01-31 David Malcolm <dmalcolm@redhat.com>
11062 PR analyzer/93373
11063 * region-model.cc (ASSERT_COMPAT_TYPES): Convert to...
11064 (assert_compat_types): ...this, and bail when either type is NULL,
11065 or when VOID_TYPE_P (dst_type).
11066 (region_model::get_lvalue): Update for above conversion.
11067 (region_model::get_rvalue): Likewise.
11069 2020-01-31 David Malcolm <dmalcolm@redhat.com>
11071 PR analyzer/93379
11072 * region-model.cc (region_model::update_for_return_superedge):
11073 Move check for null result so that it also guards setting the
11074 lhs.
11076 2020-01-31 David Malcolm <dmalcolm@redhat.com>
11078 PR analyzer/93438
11079 * region-model.cc (stack_region::can_merge_p): Split into a two
11080 pass approach, creating all stack regions first, then populating
11081 them.
11082 (selftest::test_state_merging): Add test coverage for (a) the case
11083 of self-merging a model in which a local in an older stack frame
11084 points to a local in a more recent stack frame (which previously
11085 would ICE), and (b) the case of self-merging a model in which a
11086 local points to a global (which previously worked OK).
11088 2020-01-31 David Malcolm <dmalcolm@redhat.com>
11090 * analyzer.cc (is_named_call_p): Replace tests for fndecl being
11091 extern at file scope and having a non-NULL DECL_NAME with a call
11092 to maybe_special_function_p.
11093 * function-set.cc (function_set::contains_decl_p): Add call to
11094 maybe_special_function_p.
11096 2020-01-31 David Malcolm <dmalcolm@redhat.com>
11098 PR analyzer/93450
11099 * constraint-manager.cc
11100 (constraint_manager::get_or_add_equiv_class): Only compare constants
11101 if their types are compatible.
11102 * region-model.cc (constant_svalue::eval_condition): Replace check
11103 for identical types with call to types_compatible_p.
11105 2020-01-30 David Malcolm <dmalcolm@redhat.com>
11107 * program-state.cc (extrinsic_state::dump_to_pp): New.
11108 (extrinsic_state::dump_to_file): New.
11109 (extrinsic_state::dump): New.
11110 * program-state.h (extrinsic_state::dump_to_pp): New decl.
11111 (extrinsic_state::dump_to_file): New decl.
11112 (extrinsic_state::dump): New decl.
11113 * sm.cc: Include "pretty-print.h".
11114 (state_machine::dump_to_pp): New.
11115 * sm.h (state_machine::dump_to_pp): New decl.
11117 2020-01-30 David Malcolm <dmalcolm@redhat.com>
11119 * diagnostic-manager.cc (for_each_state_change): Use
11120 extrinsic_state::get_num_checkers rather than accessing m_checkers
11121 directly.
11122 * program-state.cc (program_state::program_state): Likewise.
11123 * program-state.h (extrinsic_state::m_checkers): Make private.
11125 2020-01-30 David Malcolm <dmalcolm@redhat.com>
11127 PR analyzer/93356
11128 * region-model.cc (region_model::eval_condition): In both
11129 overloads, bail out immediately on floating-point types.
11130 (region_model::eval_condition_without_cm): Likewise.
11131 (region_model::add_constraint): Likewise.
11133 2020-01-30 David Malcolm <dmalcolm@redhat.com>
11135 PR analyzer/93450
11136 * program-state.cc (sm_state_map::set_state): For the overload
11137 taking an svalue_id, bail out if the set_state on the ec does
11138 nothing. Convert the latter's return type from void to bool,
11139 returning true if anything changed.
11140 (sm_state_map::impl_set_state): Convert the return type from void
11141 to bool, returning true if the state changed.
11142 * program-state.h (sm_state_map::set_state): Convert return type
11143 from void to bool.
11144 (sm_state_map::impl_set_state): Likewise.
11145 * region-model.cc (constant_svalue::eval_condition): Only call
11146 fold_build2 if the types are the same.
11148 2020-01-29 Jakub Jelinek <jakub@redhat.com>
11150 * analyzer.h (PUSH_IGNORE_WFORMAT, POP_IGNORE_WFORMAT): Remove.
11151 * constraint-manager.cc: Include diagnostic-core.h before graphviz.h.
11152 (range::dump, equiv_class::print): Don't use PUSH_IGNORE_WFORMAT or
11153 POP_IGNORE_WFORMAT.
11154 * state-purge.cc: Include diagnostic-core.h before
11155 gimple-pretty-print.h.
11156 (state_purge_annotator::add_node_annotations, print_vec_of_names):
11157 Don't use PUSH_IGNORE_WFORMAT or POP_IGNORE_WFORMAT.
11158 * region-model.cc: Move diagnostic-core.h include before graphviz.h.
11159 (path_var::dump, svalue::print, constant_svalue::print_details,
11160 region::dump_to_pp, region::dump_child_label, region::print_fields,
11161 map_region::print_fields, map_region::dump_dot_to_pp,
11162 map_region::dump_child_label, array_region::print_fields,
11163 array_region::dump_dot_to_pp): Don't use PUSH_IGNORE_WFORMAT or
11164 POP_IGNORE_WFORMAT.
11166 2020-01-28 David Malcolm <dmalcolm@redhat.com>
11168 PR analyzer/93316
11169 * engine.cc (rewind_info_t::update_model): Get the longjmp call
11170 stmt via get_longjmp_call () rather than assuming it is the last
11171 stmt in the longjmp's supernode.
11172 (rewind_info_t::add_events_to_path): Get the location_t for the
11173 rewind_from_longjmp_event via get_longjmp_call () rather than from
11174 the supernode's get_end_location ().
11176 2020-01-28 David Malcolm <dmalcolm@redhat.com>
11178 * region-model.cc (poisoned_value_diagnostic::emit): Update for
11179 renaming of warning_at overload to warning_meta.
11180 * sm-file.cc (file_leak::emit): Likewise.
11181 * sm-malloc.cc (double_free::emit): Likewise.
11182 (possible_null_deref::emit): Likewise.
11183 (possible_null_arg::emit): Likewise.
11184 (null_deref::emit): Likewise.
11185 (null_arg::emit): Likewise.
11186 (use_after_free::emit): Likewise.
11187 (malloc_leak::emit): Likewise.
11188 (free_of_non_heap::emit): Likewise.
11189 * sm-sensitive.cc (exposure_through_output_file::emit): Likewise.
11190 * sm-signal.cc (signal_unsafe_call::emit): Likewise.
11191 * sm-taint.cc (tainted_array_index::emit): Likewise.
11193 2020-01-27 David Malcolm <dmalcolm@redhat.com>
11195 PR analyzer/93451
11196 * region-model.cc (tree_cmp): For the REAL_CST case, impose an
11197 arbitrary order on NaNs relative to other NaNs and to non-NaNs;
11198 const-correctness tweak.
11199 (ana::selftests::build_real_cst_from_string): New function.
11200 (ana::selftests::append_interesting_constants): New function.
11201 (ana::selftests::test_tree_cmp_on_constants): New test.
11202 (ana::selftests::test_canonicalization_4): New test.
11203 (ana::selftests::analyzer_region_model_cc_tests): Call the new
11204 tests.
11206 2020-01-27 David Malcolm <dmalcolm@redhat.com>
11208 PR analyzer/93349
11209 * engine.cc (run_checkers): Save and restore input_location.
11211 2020-01-27 David Malcolm <dmalcolm@redhat.com>
11213 * call-string.cc (call_string::cmp_1): Delete, moving body to...
11214 (call_string::cmp): ...here.
11215 * call-string.h (call_string::cmp_1): Delete decl.
11216 * engine.cc (worklist::key_t::cmp_1): Delete, moving body to...
11217 (worklist::key_t::cmp): ...here. Implement hash comparisons
11218 via comparison rather than subtraction to avoid overflow issues.
11219 * exploded-graph.h (worklist::key_t::cmp_1): Delete decl.
11220 * region-model.cc (tree_cmp): Eliminate buggy checking for
11221 symmetry.
11223 2020-01-27 David Malcolm <dmalcolm@redhat.com>
11225 * analyzer.cc (is_named_call_p): Check that fndecl is "extern"
11226 and at file scope. Potentially disregard prefix _ or __ in
11227 fndecl's name. Bail if the identifier is NULL.
11228 (is_setjmp_call_p): Expect a gcall rather than plain gimple.
11229 Remove special-case check for leading prefix, and also check for
11230 sigsetjmp.
11231 (is_longjmp_call_p): Also check for siglongjmp.
11232 (get_user_facing_name): New function.
11233 * analyzer.h (is_setjmp_call_p): Expect a gcall rather than plain
11234 gimple.
11235 (get_user_facing_name): New decl.
11236 * checker-path.cc (setjmp_event::get_desc): Use
11237 get_user_facing_name to avoid hardcoding the function name.
11238 (rewind_event::rewind_event): Add rewind_info param, using it to
11239 initialize new m_rewind_info field, and strengthen the assertion.
11240 (rewind_from_longjmp_event::get_desc): Use get_user_facing_name to
11241 avoid hardcoding the function name.
11242 (rewind_to_setjmp_event::get_desc): Likewise.
11243 * checker-path.h (setjmp_event::setjmp_event): Add setjmp_call
11244 param and use it to initialize...
11245 (setjmp_event::m_setjmp_call): New field.
11246 (rewind_event::rewind_event): Add rewind_info param.
11247 (rewind_event::m_rewind_info): New protected field.
11248 (rewind_from_longjmp_event::rewind_from_longjmp_event): Add
11249 rewind_info param.
11250 (class rewind_to_setjmp_event): Move rewind_info field to parent
11251 class.
11252 * diagnostic-manager.cc (diagnostic_manager::add_events_for_eedge):
11253 Update setjmp-handling for is_setjmp_call_p requiring a gcall;
11254 pass the call to the new setjmp_event.
11255 * engine.cc (exploded_node::on_stmt): Update for is_setjmp_call_p
11256 requiring a gcall.
11257 (stale_jmp_buf::emit): Use get_user_facing_name to avoid
11258 hardcoding the function names.
11259 (exploded_node::on_longjmp): Pass the longjmp_call when
11260 constructing rewind_info.
11261 (rewind_info_t::add_events_to_path): Pass the rewind_info_t to the
11262 rewind_from_longjmp_event's ctor.
11263 * exploded-graph.h (rewind_info_t::rewind_info_t): Add
11264 longjmp_call param.
11265 (rewind_info_t::get_longjmp_call): New.
11266 (rewind_info_t::m_longjmp_call): New.
11267 * region-model.cc (region_model::on_setjmp): Update comment to
11268 indicate this is also for sigsetjmp.
11269 * region-model.h (struct setjmp_record): Likewise.
11270 (class setjmp_svalue): Likewise.
11272 2020-01-27 David Malcolm <dmalcolm@redhat.com>
11274 PR analyzer/93276
11275 * analyzer.h (PUSH_IGNORE_WFORMAT, POP_IGNORE_WFORMAT): Guard these
11276 macros with GCC_VERSION >= 4006, making them no-op otherwise.
11277 * engine.cc (exploded_edge::exploded_edge): Specify template for
11278 base class initializer.
11279 (exploded_graph::add_edge): Specify template when chaining up to
11280 base class add_edge implementation.
11281 (viz_callgraph_node::dump_dot): Drop redundant "typename".
11282 (viz_callgraph_edge::viz_callgraph_edge): Specify template for
11283 base class initializer.
11284 * program-state.cc (sm_state_map::clone_with_remapping): Drop
11285 redundant "typename".
11286 (sm_state_map::print): Likewise.
11287 (sm_state_map::hash): Likewise.
11288 (sm_state_map::operator==): Likewise.
11289 (sm_state_map::remap_svalue_ids): Likewise.
11290 (sm_state_map::on_svalue_purge): Likewise.
11291 (sm_state_map::validate): Likewise.
11292 * program-state.h (sm_state_map::iterator_t): Likewise.
11293 * supergraph.h (superedge::superedge): Specify template for base
11294 class initializer.
11296 2020-01-23 David Malcolm <dmalcolm@redhat.com>
11298 PR analyzer/93375
11299 * supergraph.cc (callgraph_superedge::get_arg_for_parm): Fail
11300 gracefully is the number of parameters at the callee exceeds the
11301 number of arguments at the call stmt.
11302 (callgraph_superedge::get_parm_for_arg): Likewise.
11304 2020-01-22 David Malcolm <dmalcolm@redhat.com>
11306 PR analyzer/93382
11307 * program-state.cc (sm_state_map::on_svalue_purge): If the
11308 entry survives, but the origin is being purged, then reset the
11309 origin to null.
11311 2020-01-22 David Malcolm <dmalcolm@redhat.com>
11313 * sm-signal.cc: Fix nesting of CHECKING_P and namespace ana.
11315 2020-01-22 David Malcolm <dmalcolm@redhat.com>
11317 PR analyzer/93378
11318 * engine.cc (setjmp_svalue::compare_fields): Update for
11319 replacement of m_enode with m_setjmp_record.
11320 (setjmp_svalue::add_to_hash): Likewise.
11321 (setjmp_svalue::get_index): Rename...
11322 (setjmp_svalue::get_enode_index): ...to this.
11323 (setjmp_svalue::print_details): Update for replacement of m_enode
11324 with m_setjmp_record.
11325 (exploded_node::on_longjmp): Likewise.
11326 * exploded-graph.h (rewind_info_t::m_enode_origin): Replace...
11327 (rewind_info_t::m_setjmp_record): ...with this.
11328 (rewind_info_t::rewind_info_t): Update for replacement of m_enode
11329 with m_setjmp_record.
11330 (rewind_info_t::get_setjmp_point): Likewise.
11331 (rewind_info_t::get_setjmp_call): Likewise.
11332 * region-model.cc (region_model::dump_summary_of_map): Likewise.
11333 (region_model::on_setjmp): Likewise.
11334 * region-model.h (struct setjmp_record): New struct.
11335 (setjmp_svalue::m_enode): Replace...
11336 (setjmp_svalue::m_setjmp_record): ...with this.
11337 (setjmp_svalue::setjmp_svalue): Update for replacement of m_enode
11338 with m_setjmp_record.
11339 (setjmp_svalue::clone): Likewise.
11340 (setjmp_svalue::get_index): Rename...
11341 (setjmp_svalue::get_enode_index): ...to this.
11342 (setjmp_svalue::get_exploded_node): Replace...
11343 (setjmp_svalue::get_setjmp_record): ...with this.
11345 2020-01-22 David Malcolm <dmalcolm@redhat.com>
11347 PR analyzer/93316
11348 * analyzer.cc (is_setjmp_call_p): Check for "setjmp" as well as
11349 "_setjmp".
11351 2020-01-22 David Malcolm <dmalcolm@redhat.com>
11353 PR analyzer/93307
11354 * analysis-plan.h: Wrap everything namespace "ana".
11355 * analyzer-logging.cc: Likewise.
11356 * analyzer-logging.h: Likewise.
11357 * analyzer-pass.cc (pass_analyzer::execute): Update for "ana"
11358 namespace.
11359 * analyzer-selftests.cc: Wrap everything namespace "ana".
11360 * analyzer-selftests.h: Likewise.
11361 * analyzer.h: Likewise for forward decls of types.
11362 * call-string.h: Likewise.
11363 * checker-path.cc: Likewise.
11364 * checker-path.h: Likewise.
11365 * constraint-manager.cc: Likewise.
11366 * constraint-manager.h: Likewise.
11367 * diagnostic-manager.cc: Likewise.
11368 * diagnostic-manager.h: Likewise.
11369 * engine.cc: Likewise.
11370 * engine.h: Likewise.
11371 * exploded-graph.h: Likewise.
11372 * function-set.cc: Likewise.
11373 * function-set.h: Likewise.
11374 * pending-diagnostic.cc: Likewise.
11375 * pending-diagnostic.h: Likewise.
11376 * program-point.cc: Likewise.
11377 * program-point.h: Likewise.
11378 * program-state.cc: Likewise.
11379 * program-state.h: Likewise.
11380 * region-model.cc: Likewise.
11381 * region-model.h: Likewise.
11382 * sm-file.cc: Likewise.
11383 * sm-malloc.cc: Likewise.
11384 * sm-pattern-test.cc: Likewise.
11385 * sm-sensitive.cc: Likewise.
11386 * sm-signal.cc: Likewise.
11387 * sm-taint.cc: Likewise.
11388 * sm.cc: Likewise.
11389 * sm.h: Likewise.
11390 * state-purge.h: Likewise.
11391 * supergraph.cc: Likewise.
11392 * supergraph.h: Likewise.
11394 2020-01-21 David Malcolm <dmalcolm@redhat.com>
11396 PR analyzer/93352
11397 * region-model.cc (int_cmp): Rename to...
11398 (array_region::key_cmp): ...this, using key_t rather than int.
11399 Rewrite in terms of comparisons rather than subtraction to
11400 ensure qsort is anti-symmetric when handling extreme values.
11401 (array_region::walk_for_canonicalization): Update for above
11402 renaming.
11403 * region-model.h (array_region::key_cmp): New decl.
11405 2020-01-17 David Malcolm <dmalcolm@redhat.com>
11407 PR analyzer/93290
11408 * region-model.cc (region_model::eval_condition_without_cm): Avoid
11409 gcc_unreachable for unexpected operations for the case where
11410 we're comparing an svalue against itself.
11412 2020-01-17 David Malcolm <dmalcolm@redhat.com>
11414 PR analyzer/93281
11415 * region-model.cc
11416 (region_model::convert_byte_offset_to_array_index): Convert to
11417 ssizetype before dividing by byte_size. Use fold_binary rather
11418 than fold_build2 to avoid needlessly constructing a tree for the
11419 non-const case.
11421 2020-01-15 David Malcolm <dmalcolm@redhat.com>
11423 * engine.cc (class impl_region_model_context): Fix comment.
11425 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11427 PR analyzer/93212
11428 * region-model.cc (make_region_for_type): Use
11429 FUNC_OR_METHOD_TYPE_P rather than comparing against FUNCTION_TYPE.
11430 * region-model.h (function_region::function_region): Likewise.
11432 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11434 * program-state.cc (sm_state_map::clone_with_remapping): Copy
11435 m_global_state.
11436 (selftest::test_program_state_merging_2): New selftest.
11437 (selftest::analyzer_program_state_cc_tests): Call it.
11439 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11441 * checker-path.h (checker_path::get_checker_event): New function.
11442 (checker_path): Add DISABLE_COPY_AND_ASSIGN; make fields private.
11443 * diagnostic-manager.cc
11444 (diagnostic_manager::prune_for_sm_diagnostic): Replace direct
11445 access to checker_path::m_events with accessor functions. Fix
11446 overlong line.
11447 (diagnostic_manager::prune_interproc_events): Replace direct
11448 access to checker_path::m_events with accessor functions.
11449 (diagnostic_manager::finish_pruning): Likewise.
11451 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11453 * checker-path.h (checker_event::clone): Delete vfunc decl.
11454 (debug_event::clone): Delete vfunc impl.
11455 (custom_event::clone): Delete vfunc impl.
11456 (statement_event::clone): Delete vfunc impl.
11457 (function_entry_event::clone): Delete vfunc impl.
11458 (state_change_event::clone): Delete vfunc impl.
11459 (start_cfg_edge_event::clone): Delete vfunc impl.
11460 (end_cfg_edge_event::clone): Delete vfunc impl.
11461 (call_event::clone): Delete vfunc impl.
11462 (return_event::clone): Delete vfunc impl.
11463 (setjmp_event::clone): Delete vfunc impl.
11464 (rewind_from_longjmp_event::clone): Delete vfunc impl.
11465 (rewind_to_setjmp_event::clone): Delete vfunc impl.
11466 (warning_event::clone): Delete vfunc impl.
11468 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11470 * supergraph.cc (supernode::dump_dot): Ensure that the TABLE
11471 element has at least one TR.
11473 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11475 PR analyzer/58237
11476 * engine.cc (leak_stmt_finder::find_stmt): Use get_pure_location
11477 when comparing against UNKNOWN_LOCATION.
11478 (stmt_requires_new_enode_p): Likewise.
11479 (exploded_graph::dump_exploded_nodes): Likewise.
11480 * supergraph.cc (supernode::get_start_location): Likewise.
11481 (supernode::get_end_location): Likewise.
11483 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11485 PR analyzer/58237
11486 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
11487 selftest::analyzer_sm_file_cc_tests.
11488 * analyzer-selftests.h (selftest::analyzer_sm_file_cc_tests): New
11489 decl.
11490 * sm-file.cc: Include "analyzer/function-set.h" and
11491 "analyzer/analyzer-selftests.h".
11492 (get_file_using_fns): New function.
11493 (is_file_using_fn_p): New function.
11494 (fileptr_state_machine::on_stmt): Return true for known functions.
11495 (selftest::analyzer_sm_file_cc_tests): New function.
11497 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11499 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
11500 selftest::analyzer_sm_signal_cc_tests.
11501 * analyzer-selftests.h (selftest::analyzer_sm_signal_cc_tests):
11502 New decl.
11503 * sm-signal.cc: Include "analyzer/function-set.h" and
11504 "analyzer/analyzer-selftests.h".
11505 (get_async_signal_unsafe_fns): New function.
11506 (signal_unsafe_p): Reimplement in terms of the above.
11507 (selftest::analyzer_sm_signal_cc_tests): New function.
11509 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11511 * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
11512 selftest::analyzer_function_set_cc_tests.
11513 * analyzer-selftests.h (selftest::analyzer_function_set_cc_tests):
11514 New decl.
11515 * function-set.cc: New file.
11516 * function-set.h: New file.
11518 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11520 * analyzer.h (fndecl_has_gimple_body_p): New decl.
11521 * engine.cc (impl_region_model_context::on_unknown_change): New
11522 function.
11523 (fndecl_has_gimple_body_p): Make non-static.
11524 (exploded_node::on_stmt): Treat __analyzer_dump_exploded_nodes as
11525 known. Track whether we have a call with unknown side-effects and
11526 pass it to on_call_post.
11527 * exploded-graph.h (impl_region_model_context::on_unknown_change):
11528 New decl.
11529 * program-state.cc (sm_state_map::on_unknown_change): New function.
11530 * program-state.h (sm_state_map::on_unknown_change): New decl.
11531 * region-model.cc: Include "bitmap.h".
11532 (region_model::on_call_pre): Return a bool, capturing whether the
11533 call has unknown side effects.
11534 (region_model::on_call_post): Add arg "bool unknown_side_effects"
11535 and if true, call handle_unrecognized_call.
11536 (class reachable_regions): New class.
11537 (region_model::handle_unrecognized_call): New function.
11538 * region-model.h (region_model::on_call_pre): Return a bool.
11539 (region_model::on_call_post): Add arg "bool unknown_side_effects".
11540 (region_model::handle_unrecognized_call): New decl.
11541 (region_model_context::on_unknown_change): New vfunc.
11542 (test_region_model_context::on_unknown_change): New function.
11544 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11546 * diagnostic-manager.cc (saved_diagnostic::operator==): Move here
11547 from header. Replace pointer equality test on m_var with call to
11548 pending_diagnostic::same_tree_p.
11549 * diagnostic-manager.h (saved_diagnostic::operator==): Move to
11550 diagnostic-manager.cc.
11551 * pending-diagnostic.cc (pending_diagnostic::same_tree_p): New.
11552 * pending-diagnostic.h (pending_diagnostic::same_tree_p): New.
11553 * sm-file.cc (file_diagnostic::subclass_equal_p): Replace pointer
11554 equality on m_arg with call to pending_diagnostic::same_tree_p.
11555 * sm-malloc.cc (malloc_diagnostic::subclass_equal_p): Likewise.
11556 (possible_null_arg::subclass_equal_p): Likewise.
11557 (null_arg::subclass_equal_p): Likewise.
11558 (free_of_non_heap::subclass_equal_p): Likewise.
11559 * sm-pattern-test.cc (pattern_match::operator==): Likewise.
11560 * sm-sensitive.cc (exposure_through_output_file::operator==):
11561 Likewise.
11562 * sm-taint.cc (tainted_array_index::operator==): Likewise.
11564 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11566 * diagnostic-manager.cc (dedupe_winners::add): Add logging
11567 of deduplication decisions made.
11569 2020-01-14 David Malcolm <dmalcolm@redhat.com>
11571 * ChangeLog: New file.
11572 * analyzer-selftests.cc: New file.
11573 * analyzer-selftests.h: New file.
11574 * analyzer.opt: New file.
11575 * analysis-plan.cc: New file.
11576 * analysis-plan.h: New file.
11577 * analyzer-logging.cc: New file.
11578 * analyzer-logging.h: New file.
11579 * analyzer-pass.cc: New file.
11580 * analyzer.cc: New file.
11581 * analyzer.h: New file.
11582 * call-string.cc: New file.
11583 * call-string.h: New file.
11584 * checker-path.cc: New file.
11585 * checker-path.h: New file.
11586 * constraint-manager.cc: New file.
11587 * constraint-manager.h: New file.
11588 * diagnostic-manager.cc: New file.
11589 * diagnostic-manager.h: New file.
11590 * engine.cc: New file.
11591 * engine.h: New file.
11592 * exploded-graph.h: New file.
11593 * pending-diagnostic.cc: New file.
11594 * pending-diagnostic.h: New file.
11595 * program-point.cc: New file.
11596 * program-point.h: New file.
11597 * program-state.cc: New file.
11598 * program-state.h: New file.
11599 * region-model.cc: New file.
11600 * region-model.h: New file.
11601 * sm-file.cc: New file.
11602 * sm-malloc.cc: New file.
11603 * sm-malloc.dot: New file.
11604 * sm-pattern-test.cc: New file.
11605 * sm-sensitive.cc: New file.
11606 * sm-signal.cc: New file.
11607 * sm-taint.cc: New file.
11608 * sm.cc: New file.
11609 * sm.h: New file.
11610 * state-purge.cc: New file.
11611 * state-purge.h: New file.
11612 * supergraph.cc: New file.
11613 * supergraph.h: New file.
11615 2019-12-13 David Malcolm <dmalcolm@redhat.com>
11617 * Initial creation
11619 \f
11620 Copyright (C) 2019-2024 Free Software Foundation, Inc.
11622 Copying and distribution of this file, with or without modification,
11623 are permitted in any medium without royalty provided the copyright
11624 notice and this notice are preserved.