gcc/analyzer/ChangeLog

   1 2024-02-29  David Malcolm  <dmalcolm@redhat.com>
   2
   3         PR analyzer/114159
   4         * analyzer.cc: Include "tree-dfa.h".
   5         (get_ssa_default_def): New decl.
   6         * analyzer.h (get_ssa_default_def): New.
   7         * call-info.cc (call_info::call_info): New ctor taking an explicit
   8         called_fn.
   9         * call-info.h (call_info::call_info): Likewise.
  10         * call-summary.cc (call_summary_replay::call_summary_replay):
  11         Convert param from function * to const function &.
  12         * call-summary.h (call_summary_replay::call_summary_replay):
  13         Likewise.
  14         * checker-event.h (state_change_event::get_dest_function):
  15         Constify return value.
  16         * engine.cc (point_and_state::validate): Update for conversion to
  17         const function &.
  18         (exploded_node::on_stmt): Likewise.
  19         (call_summary_edge_info::call_summary_edge_info): Likewise.
  20         Pass in called_fn to call_info ctor.
  21         (exploded_node::replay_call_summaries): Update for conversion to
  22         const function &.  Convert per_function_data from * to &.
  23         (exploded_node::replay_call_summary): Update for conversion to
  24         const function &.
  25         (exploded_graph::add_function_entry): Likewise.
  26         (toplevel_function_p): Likewise.
  27         (add_tainted_args_callback): Likewise.
  28         (exploded_graph::build_initial_worklist): Likewise.
  29         (exploded_graph::maybe_create_dynamic_call): Likewise.
  30         (maybe_update_for_edge): Likewise.
  31         (exploded_graph::on_escaped_function): Likewise.
  32         * exploded-graph.h (exploded_node::replay_call_summaries):
  33         Likewise.
  34         (exploded_node::replay_call_summary): Likewise.
  35         (exploded_graph::add_function_entry): Likewise.
  36         * program-point.cc (function_point::from_function_entry):
  37         Likewise.
  38         (program_point::from_function_entry): Likewise.
  39         * program-point.h (function_point::from_function_entry): Likewise.
  40         (program_point::from_function_entry): Likewise.
  41         * program-state.cc (program_state::push_frame): Likewise.
  42         (program_state::get_current_function): Constify return type.
  43         * program-state.h (program_state::push_frame): Update for
  44         conversion to const function &.
  45         (program_state::get_current_function): Likewise.
  46         * region-model-manager.cc
  47         (region_model_manager::get_frame_region): Likewise.
  48         * region-model-manager.h
  49         (region_model_manager::get_frame_region): Likewise.
  50         * region-model.cc (region_model::called_from_main_p): Likewise.
  51         (region_model::update_for_gcall): Likewise.
  52         (region_model::push_frame): Likewise.
  53         (region_model::get_current_function): Constify return type.
  54         (region_model::pop_frame): Update for conversion to
  55         const function &.
  56         (selftest::test_stack_frames): Likewise.
  57         (selftest::test_get_representative_path_var): Likewise.
  58         (selftest::test_state_merging): Likewise.
  59         (selftest::test_alloca): Likewise.
  60         * region-model.h (region_model::push_frame): Likewise.
  61         (region_model::get_current_function): Likewise.
  62         * region.cc (frame_region::dump_to_pp): Likewise.
  63         (frame_region::get_region_for_local): Likewise.
  64         * region.h (class frame_region): Likewise.
  65         * sm-signal.cc (signal_unsafe_call::describe_state_change):
  66         Likewise.
  67         (update_model_for_signal_handler): Likewise.
  68         (signal_delivery_edge_info_t::update_model): Likewise.
  69         (register_signal_handler::impl_transition): Likewise.
  70         * state-purge.cc (class gimple_op_visitor): Likewise.
  71         (state_purge_map::state_purge_map): Likewise.
  72         (state_purge_map::get_or_create_data_for_decl): Likewise.
  73         (state_purge_per_ssa_name::state_purge_per_ssa_name): Likewise.
  74         (state_purge_per_ssa_name::add_to_worklist): Likewise.
  75         (state_purge_per_ssa_name::process_point): Likewise.
  76         (state_purge_per_decl::add_to_worklist): Likewise.
  77         (state_purge_annotator::print_needed): Likewise.
  78         * state-purge.h
  79         (state_purge_map::get_or_create_data_for_decl): Likewise.
  80         (class state_purge_per_tree): Likewise.
  81         (class state_purge_per_ssa_name): Likewise.
  82         (class state_purge_per_decl): Likewise.
  83         * supergraph.cc (supergraph::dump_dot_to_pp): Likewise.
  84         * supergraph.h
  85         (supergraph::get_node_for_function_entry): Likewise.
  86         (supergraph::get_node_for_function_exit): Likewise.
  87
  88 2024-02-27  David Malcolm  <dmalcolm@redhat.com>
  89
  90         PR analyzer/110483
  91         PR analyzer/111802
  92         * access-diagram.cc
  93         (string_literal_spatial_item::add_column_for_byte): Use %wu for
  94         printing unsigned HOST_WIDE_INT.
  95
  96 2024-02-27  David Malcolm  <dmalcolm@redhat.com>
  97
  98         PR analyzer/111881
  99         * constraint-manager.cc (bound::ensure_closed): Assert that
 100         m_constant has integral type.
 101         (range::add_bound): Bail out on floating point constants.
 102
 103 2024-02-21  David Malcolm  <dmalcolm@redhat.com>
 104
 105         PR analyzer/113999
 106         * analyzer.h (get_string_cst_size): New decl.
 107         * region-model-manager.cc (get_string_cst_size): New.
 108         (region_model_manager::maybe_get_char_from_string_cst): Treat
 109         single-byte accesses within string_cst but beyond
 110         TREE_STRING_LENGTH as being 0.
 111         * region-model.cc (string_cst_has_null_terminator): Likewise.
 112
 113 2024-02-21  David Malcolm  <dmalcolm@redhat.com>
 114
 115         PR analyzer/113998
 116         * ranges.cc (symbolic_byte_range::intersection): Handle empty ranges.
 117         (selftest::test_intersects): Add test coverage for empty ranges.
 118
 119 2024-02-19  David Malcolm  <dmalcolm@redhat.com>
 120
 121         PR analyzer/111289
 122         * varargs.cc (representable_in_integral_type_p): New.
 123         (va_arg_compatible_types_p): Add "arg_sval" param.  Handle integer
 124         types.
 125         (kf_va_arg::impl_call_pre): Pass arg_sval to
 126         va_arg_compatible_types_p.
 127
 128 2024-02-19  Andrew Pinski  <quic_apinski@quicinc.com>
 129
 130         PR analyzer/113983
 131         * region-model-manager.cc (maybe_undo_optimize_bit_field_compare): Reject
 132         non integral types.
 133
 134 2024-02-15  David Malcolm  <dmalcolm@redhat.com>
 135
 136         PR analyzer/111266
 137         * region.cc (offset_region::get_byte_size_sval): Delete.
 138         (offset_region::get_bit_size_sval): Delete.
 139         * region.h (region::get_byte_size): Add comment clarifying that
 140         this relates to the size of the access, rather than the size
 141         that's valid to access.
 142         (region::get_bit_size): Likewise.
 143         (region::get_byte_size_sval): Likewise.
 144         (region::get_bit_size_sval): Likewise.
 145         (offset_region::get_byte_size_sval): Delete.
 146         (offset_region::get_bit_size_sval): Delete.
 147
 148 2024-02-13  David Malcolm  <dmalcolm@redhat.com>
 149
 150         * pending-diagnostic.cc (diagnostic_emission_context::warn):
 151         Update for renaming of emit_diagnostic_valist overload to
 152         emit_diagnostic_valist_meta.
 153         (diagnostic_emission_context::inform): Likewise.
 154
 155 2024-01-31  David Malcolm  <dmalcolm@redhat.com>
 156
 157         PR analyzer/113253
 158         * region-model.cc (region_model::on_stmt_pre): Add gcc_unreachable
 159         for debug statements.
 160         * state-purge.cc
 161         (state_purge_per_ssa_name::state_purge_per_ssa_name): Skip any
 162         debug stmts in the FOR_EACH_IMM_USE_FAST list.
 163         * supergraph.cc (supergraph::supergraph): Don't add debug stmts
 164         to the supernodes.
 165
 166 2024-01-31  David Malcolm  <dmalcolm@redhat.com>
 167
 168         PR analyzer/113509
 169         * checker-event.cc (state_change_event::get_desc): Don't assume
 170         "var" is non-NULL.
 171
 172 2024-01-30  David Malcolm  <dmalcolm@redhat.com>
 173
 174         PR analyzer/113654
 175         * region-model.cc (is_round_up): New.
 176         (is_multiple_p): New.
 177         (is_dubious_capacity): New.
 178         (region_model::check_region_size): Move usage of size_visitor into
 179         is_dubious_capacity.
 180
 181 2024-01-30  David Malcolm  <dmalcolm@redhat.com>
 182
 183         * region-model.cc
 184         (dubious_allocation_size::dubious_allocation_size): Add
 185         "capacity_sval" param.  Drop unused ctor.
 186         (dubious_allocation_size::maybe_add_sarif_properties): New.
 187         (dubious_allocation_size::m_capacity_sval): New field.
 188         (region_model::check_region_size): Pass capacity svalue to
 189         dubious_allocation_size ctor.
 190
 191 2024-01-25  David Malcolm  <dmalcolm@redhat.com>
 192
 193         PR analyzer/112969
 194         * store.cc (binding_cluster::maybe_get_compound_binding): When
 195         populating default_map, express the bit-range of the default key
 196         for REG relative to REG, rather than to the base region.
 197
 198 2024-01-24  David Malcolm  <dmalcolm@redhat.com>
 199
 200         PR analyzer/112977
 201         * engine.cc (impl_region_model_context::on_liveness_change): Pass
 202         m_ext_state to sm_state_map::on_liveness_change.
 203         * program-state.cc (sm_state_map::on_svalue_leak): Guard removal
 204         of map entry based on can_purge_p.
 205         (sm_state_map::on_liveness_change): Add ext_state param.  Add
 206         workaround for bad interaction between state purging and
 207         alt-inherited sm-state.
 208         * program-state.h (sm_state_map::on_liveness_change): Add
 209         ext_state param.
 210         * sm-taint.cc
 211         (taint_state_machine::has_alt_get_inherited_state_p): New.
 212         (taint_state_machine::can_purge_p): Return false for "has_lb" and
 213         "has_ub".
 214         * sm.h (state_machine::has_alt_get_inherited_state_p): New vfunc.
 215
 216 2024-01-18  David Malcolm  <dmalcolm@redhat.com>
 217
 218         PR analyzer/111361
 219         * region-model.cc (svalue_byte_range_has_null_terminator_1): The
 220         initial byte of an all-zeroes SVAL is a zero byte.  Remove
 221         gcc_unreachable from SK_CONSTANT for constants that aren't
 222         STRING_CST or INTEGER_CST.
 223
 224 2024-01-18  David Malcolm  <dmalcolm@redhat.com>
 225
 226         PR analyzer/112811
 227         * region-model.cc (fragment::dump_to_pp): New.
 228         (fragment::has_null_terminator): Convert to...
 229         (svalue_byte_range_has_null_terminator_1): ...this new function,
 230         updating to use a byte_range relative to the start of the svalue.
 231         (svalue_byte_range_has_null_terminator): New.
 232         (fragment::string_cst_has_null_terminator): Convert to...
 233         (string_cst_has_null_terminator): ...this, updating to use a
 234         byte_range relative to the start of the svalue.
 235         (iterable_cluster::dump_to_pp): New.
 236         (region_model::scan_for_null_terminator): Add logging, moving body
 237         to...
 238         (region_model::scan_for_null_terminator_1): ...this new function,
 239         adding more logging, and updating to use
 240         svalue_byte_range_has_null_terminator.
 241         * region-model.h (region_model::scan_for_null_terminator_1): New
 242         decl.
 243
 244 2024-01-16  David Malcolm  <dmalcolm@redhat.com>
 245
 246         PR analyzer/106229
 247         * analyzer.h (compare_constants): New decl.
 248         * constraint-manager.cc (compare_constants): Make non-static.
 249         * sm-taint.cc: Add include "fold-const.h".
 250         (class concrete_range): New.
 251         (get_possible_range): New.
 252         (index_can_be_out_of_bounds_p): New.
 253         (region_model::check_region_for_taint): Reject
 254         -Wanalyzer-tainted-array-index if the type of the value makes it
 255         impossible for it to be out-of-bounds of the array.
 256
 257 2024-01-16  David Malcolm  <dmalcolm@redhat.com>
 258
 259         PR analyzer/113333
 260         * region-model-manager.cc
 261         (region_model_manager::maybe_fold_unaryop): Casting all zeroes
 262         should give all zeroes.
 263
 264 2024-01-04  David Malcolm  <dmalcolm@redhat.com>
 265
 266         * analyzer.opt.urls: New file, autogenerated by
 267         regenerate-opt-urls.py.
 268
 269 2024-01-04  David Malcolm  <dmalcolm@redhat.com>
 270
 271         * checker-event.cc: Include "diagnostic-format-sarif.h" and
 272         "tree-logical-location.h".
 273         (checker_event::maybe_add_sarif_properties): New.
 274         (superedge_event::maybe_add_sarif_properties): New.
 275         (superedge_event::superedge_event): Add comment.
 276         * checker-event.h (checker_event::maybe_add_sarif_properties): New
 277         decl.
 278         (superedge_event::maybe_add_sarif_properties): New decl.
 279
 280 2024-01-04  David Malcolm  <dmalcolm@redhat.com>
 281
 282         PR analyzer/112790
 283         * checker-event.cc (class inlining_info): Move to...
 284         * inlining-iterator.h (class inlining_info): ...here.
 285         * sm-malloc.cc: Include "analyzer/inlining-iterator.h".
 286         (maybe_complain_about_deref_before_check): Reject stmts that were
 287         inlined from another function.
 288
 289 2024-01-04  David Malcolm  <dmalcolm@redhat.com>
 290
 291         PR analyzer/113222
 292         * access-diagram.cc (valid_region_spatial_item::add_boundaries):
 293         Handle TYPE_DOMAIN being null.
 294         (valid_region_spatial_item::add_array_elements_to_table):
 295         Likewise.
 296
 297 2023-12-16  David Malcolm  <dmalcolm@redhat.com>
 298
 299         * analyzer.cc: Include "tree-pretty-print.h" and
 300         "diagnostic-event-id.h".
 301         (tree_to_json): New.
 302         (diagnostic_event_id_to_json): New.
 303         (bit_offset_to_json): New.
 304         (byte_offset_to_json): New.
 305         * analyzer.h (tree_to_json): New decl.
 306         (diagnostic_event_id_to_json): New decl.
 307         (bit_offset_to_json): New decl.
 308         (byte_offset_to_json): New decl.
 309         * bounds-checking.cc: Include "diagnostic-format-sarif.h".
 310         (out_of_bounds::maybe_add_sarif_properties): New.
 311         (concrete_out_of_bounds::maybe_add_sarif_properties): New.
 312         (concrete_past_the_end::maybe_add_sarif_properties): New.
 313         (symbolic_past_the_end::maybe_add_sarif_properties): New.
 314         * region-model.cc (region_to_value_map::to_json): New.
 315         (region_model::to_json): New.
 316         * region-model.h (region_to_value_map::to_json): New decl.
 317         (region_model::to_json): New decl.
 318         * store.cc (bit_range::to_json): New.
 319         (byte_range::to_json): New.
 320         * store.h (bit_range::to_json): New decl.
 321         (byte_range::to_json): New decl.
 322
 323 2023-12-16  David Malcolm  <dmalcolm@redhat.com>
 324
 325         PR analyzer/112792
 326         * bounds-checking.cc
 327         (out_of_bounds::oob_region_creation_event_capacity): Rename
 328         "capacity" to "byte_capacity".  Layout fix.
 329         (out_of_bounds::::add_region_creation_events): Rename
 330         "capacity" to "byte_capacity".
 331         (class concrete_out_of_bounds): Rename m_out_of_bounds_range to
 332         m_out_of_bounds_bits and convert from a byte_range to a bit_range.
 333         (concrete_out_of_bounds::get_out_of_bounds_bytes): New.
 334         (concrete_past_the_end::concrete_past_the_end): Rename param
 335         "byte_bound" to "bit_bound".  Initialize m_byte_bound.
 336         (concrete_past_the_end::subclass_equal_p): Update for renaming
 337         of m_byte_bound to m_bit_bound.
 338         (concrete_past_the_end::m_bit_bound): New field.
 339         (concrete_buffer_overflow::concrete_buffer_overflow): Convert
 340         param "range" from byte_range to bit_range.  Rename param
 341         "byte_bound" to "bit_bound".
 342         (concrete_buffer_overflow::emit): Update for bits vs bytes.
 343         (concrete_buffer_overflow::describe_final_event): Split
 344         into...
 345         (concrete_buffer_overflow::describe_final_event_as_bytes): ...this
 346         (concrete_buffer_overflow::describe_final_event_as_bits): ...and
 347         this.
 348         (concrete_buffer_over_read::concrete_buffer_over_read): Convert
 349         param "range" from byte_range to bit_range.  Rename param
 350         "byte_bound" to "bit_bound".
 351         (concrete_buffer_over_read::emit): Update for bits vs bytes.
 352         (concrete_buffer_over_read::describe_final_event): Split into...
 353         (concrete_buffer_over_read::describe_final_event_as_bytes):
 354         ...this
 355         (concrete_buffer_over_read::describe_final_event_as_bits): ...and
 356         this.
 357         (concrete_buffer_underwrite::concrete_buffer_underwrite): Convert
 358         param "range" from byte_range to bit_range.
 359         (concrete_buffer_underwrite::describe_final_event): Split into...
 360         (concrete_buffer_underwrite::describe_final_event_as_bytes):
 361         ...this
 362         (concrete_buffer_underwrite::describe_final_event_as_bits): ...and
 363         this.
 364         (concrete_buffer_under_read::concrete_buffer_under_read): Convert
 365         param "range" from byte_range to bit_range.
 366         (concrete_buffer_under_read::describe_final_event): Split into...
 367         (concrete_buffer_under_read::describe_final_event_as_bytes):
 368         ...this
 369         (concrete_buffer_under_read::describe_final_event_as_bits): ...and
 370         this.
 371         (region_model::check_region_bounds): Use bits for concrete values,
 372         and rename locals to indicate whether we're dealing with bits or
 373         bytes.  Specifically, replace "num_bytes_sval" with
 374         "num_bits_sval", and get it from reg's "get_bit_size_sval".
 375         Replace "num_bytes_tree" with "num_bits_tree".  Rename "capacity"
 376         to "byte_capacity".  Rename "cst_capacity_tree" to
 377         "cst_byte_capacity_tree".  Replace "offset" and
 378         "num_bytes_unsigned" with "bit_offset" and "num_bits_unsigned"
 379         respectively, converting from byte_offset_t to bit_offset_t.
 380         Replace "out" and "read_bytes" with "bits_outside" and "read_bits"
 381         respectively, converting from byte_range to bit_range.  Convert
 382         "buffer" from byte_range to bit_range.  Replace "byte_bound" with
 383         "bit_bound".
 384         * region.cc (region::get_bit_size_sval): New.
 385         (offset_region::get_bit_offset): New.
 386         (offset_region::get_bit_size_sval): New.
 387         (sized_region::get_bit_size_sval): New.
 388         (bit_range_region::get_bit_size_sval): New.
 389         * region.h (region::get_bit_size_sval): New vfunc.
 390         (offset_region::get_bit_offset): New decl.
 391         (offset_region::get_bit_size_sval): New decl.
 392         (sized_region::get_bit_size_sval): New decl.
 393         (bit_range_region::get_bit_size_sval): New decl.
 394         * store.cc (bit_range::intersects_p): New, based on
 395         byte_range::intersects_p.
 396         (bit_range::exceeds_p): New, based on byte_range::exceeds_p.
 397         (bit_range::falls_short_of_p): New, based on
 398         byte_range::falls_short_of_p.
 399         (byte_range::intersects_p): Delete.
 400         (byte_range::exceeds_p): Delete.
 401         (byte_range::falls_short_of_p): Delete.
 402         * store.h (bit_range::intersects_p): New overload.
 403         (bit_range::exceeds_p): New.
 404         (bit_range::falls_short_of_p): New.
 405         (byte_range::intersects_p): Delete.
 406         (byte_range::exceeds_p): Delete.
 407         (byte_range::falls_short_of_p): Delete.
 408
 409 2023-12-14  David Malcolm  <dmalcolm@redhat.com>
 410
 411         PR analyzer/112655
 412         * infinite-loop.cc (infinite_loop::infinite_loop): Pass eedges
 413         via rvalue reference rather than by value.
 414         (starts_infinite_loop_p): Move eedges when constructing an
 415         infinite_loop instance.
 416         * sm-file.cc (fileptr_state_machine::fileptr_state_machine): Use
 417         initializer list for states.
 418         * sm-sensitive.cc
 419         (sensitive_state_machine::sensitive_state_machine): Likewise.
 420         * sm-signal.cc (signal_state_machine::signal_state_machine):
 421         Likewise.
 422         * sm-taint.cc (taint_state_machine::taint_state_machine):
 423         Likewise.
 424         * varargs.cc (va_list_state_machine::va_list_state_machine): Likewise.
 425
 426 2023-12-11  David Malcolm  <dmalcolm@redhat.com>
 427
 428         PR analyzer/112955
 429         * engine.cc (feasibility_state::feasibility_state): Initialize
 430         m_snodes_visited.
 431
 432 2023-12-11  Andrew Pinski  <apinski@marvell.com>
 433
 434         * region-model-manager.cc (maybe_undo_optimize_bit_field_compare): Remove
 435         the check for type being unsigned_char_type_node.
 436
 437 2023-12-08  David Malcolm  <dmalcolm@redhat.com>
 438
 439         * sm-taint.cc (taint_state_machine::alt_get_inherited_state): Fix
 440         handling of TRUNC_MOD_EXPR.
 441
 442 2023-12-08  David Malcolm  <dmalcolm@redhat.com>
 443
 444         * region-model.cc (contains_uninit_p): Only check for
 445         svalues that the infoleak warning can handle.
 446
 447 2023-12-08  David Malcolm  <dmalcolm@redhat.com>
 448
 449         PR analyzer/112889
 450         * store.h (concrete_binding::concrete_binding): Strengthen
 451         assertion to require size to be be positive, rather than just
 452         non-zero.
 453         (concrete_binding::mark_deleted): Use size rather than start bit
 454         offset.
 455         (concrete_binding::mark_empty): Likewise.
 456         (concrete_binding::is_deleted): Likewise.
 457         (concrete_binding::is_empty): Likewise.
 458
 459 2023-12-07  Alexandre Oliva  <oliva@adacore.com>
 460
 461         * region-model.cc (has_nondefault_case_for_value_p): Take
 462         enumerate type as a parameter.
 463         (region_model::apply_constraints_for_gswitch): Cope with
 464         integral promotion type casts.
 465
 466 2023-12-07  David Malcolm  <dmalcolm@redhat.com>
 467
 468         PR analyzer/103546
 469         PR analyzer/112850
 470         * analyzer.opt (-param=analyzer-max-svalue-depth=): Increase from
 471         12 to 18.
 472         (Wanalyzer-symbol-too-complex): New.
 473         * diagnostic-manager.cc
 474         (null_assignment_sm_context::clear_all_per_svalue_state): New.
 475         * engine.cc (impl_sm_context::clear_all_per_svalue_state): New.
 476         * program-state.cc (sm_state_map::clear_all_per_svalue_state):
 477         New.
 478         * program-state.h (sm_state_map::clear_all_per_svalue_state): New
 479         decl.
 480         * region-model-manager.cc
 481         (region_model_manager::reject_if_too_complex): Add
 482         -Wanalyzer-symbol-too-complex.
 483         * sm-taint.cc (taint_state_machine::on_condition): Handle
 484         comparisons against UNKNOWN.
 485         * sm.h (sm_context::clear_all_per_svalue_state): New.
 486
 487 2023-12-06  David Malcolm  <dmalcolm@redhat.com>
 488
 489         * engine.cc (dump_analyzer_json): Use
 490         flag_diagnostics_json_formatting.
 491
 492 2023-12-01  David Malcolm  <dmalcolm@redhat.com>
 493
 494         * analyzer.h (class saved_diagnostic): New forward decl.
 495         * bounds-checking.cc: Update for changes to
 496         pending_diagnostic::emit.
 497         * call-details.cc: Likewise.
 498         * diagnostic-manager.cc: Include "diagnostic-format-sarif.h".
 499         (saved_diagnostic::maybe_add_sarif_properties): New.
 500         (class pending_diagnostic_metadata): New.
 501         (diagnostic_manager::emit_saved_diagnostic): Create a
 502         pending_diagnostic_metadata and a diagnostic_emission_context.
 503         Pass the latter to the pending_diagnostic::emit vfunc.
 504         * diagnostic-manager.h
 505         (saved_diagnostic::maybe_add_sarif_properties): New decl.
 506         * engine.cc: Update for changes to pending_diagnostic::emit.
 507         * infinite-loop.cc: Likewise.
 508         * infinite-recursion.cc: Likewise.
 509         * kf-analyzer.cc: Likewise.
 510         * kf.cc: Likewise.
 511         * pending-diagnostic.cc
 512         (diagnostic_emission_context::get_pending_diagnostic): New.
 513         (diagnostic_emission_context::warn): New.
 514         (diagnostic_emission_context::inform): New.
 515         * pending-diagnostic.h (class diagnostic_emission_context): New.
 516         (pending_diagnostic::emit): Update params.
 517         (pending_diagnostic::maybe_add_sarif_properties): New vfunc.
 518         * region.cc: Don't include "diagnostic-metadata.h".
 519         * region-model.cc: Include "diagnostic-format-sarif.h".  Update
 520         for changes to pending_diagnostic::emit.
 521         (exposure_through_uninit_copy::maybe_add_sarif_properties): New.
 522         * sm-fd.cc: Update for changes to pending_diagnostic::emit.
 523         * sm-file.cc: Likewise.
 524         * sm-malloc.cc: Likewise.
 525         * sm-pattern-test.cc: Likewise.
 526         * sm-sensitive.cc: Likewise.
 527         * sm-signal.cc: Likewise.
 528         * sm-taint.cc: Likewise.
 529         * store.cc: Don't include "diagnostic-metadata.h".
 530         * varargs.cc: Update for changes to pending_diagnostic::emit.
 531
 532 2023-11-19  David Malcolm  <dmalcolm@redhat.com>
 533
 534         * analyzer.h: Include "rich-location.h".
 535
 536 2023-11-19  David Malcolm  <dmalcolm@redhat.com>
 537
 538         PR analyzer/107573
 539         * analyzer.h (register_known_functions): Add region_model_manager
 540         param.
 541         * analyzer.opt (Wanalyzer-undefined-behavior-strtok): New.
 542         * call-summary.cc
 543         (call_summary_replay::convert_region_from_summary_1): Handle
 544         RK_PRIVATE.
 545         * engine.cc (impl_run_checkers): Pass model manager to
 546         register_known_functions.
 547         * kf.cc (class undefined_function_behavior): New.
 548         (class kf_strtok): New.
 549         (register_known_functions): Add region_model_manager param.
 550         Use it to register "strtok".
 551         * region-model-manager.cc
 552         (region_model_manager::get_or_create_conjured_svalue): Add "idx"
 553         param.
 554         * region-model-manager.h
 555         (region_model_manager::get_or_create_conjured_svalue): Add "idx"
 556         param.
 557         (region_model_manager::get_root_region): New accessor.
 558         * region-model.cc (region_model::scan_for_null_terminator): Handle
 559         "expr" being null.
 560         (region_model::get_representative_path_var_1): Handle RK_PRIVATE.
 561         * region-model.h (region_model::called_from_main_p): Make public.
 562         * region.cc (region::get_memory_space): Handle RK_PRIVATE.
 563         (region::can_have_initial_svalue_p): Handle MEMSPACE_PRIVATE.
 564         (private_region::dump_to_pp): New.
 565         * region.h (MEMSPACE_PRIVATE): New.
 566         (RK_PRIVATE): New.
 567         (class private_region): New.
 568         (is_a_helper <const private_region *>::test): New.
 569         * store.cc (store::replay_call_summary_cluster): Handle
 570         RK_PRIVATE.
 571         * svalue.h (struct conjured_svalue::key_t): Add "idx" param to
 572         ctor and "m_idx" field.
 573         (class conjured_svalue::conjured_svalue): Likewise.
 574
 575 2023-11-18  David Malcolm  <dmalcolm@redhat.com>
 576
 577         PR analyzer/106147
 578         * analyzer.opt (Wanalyzer-infinite-loop): New option.
 579         (fdump-analyzer-infinite-loop): New option.
 580         * checker-event.h (start_cfg_edge_event::get_desc): Drop "final".
 581         (start_cfg_edge_event::maybe_describe_condition): Convert from
 582         private to protected.
 583         * checker-path.h (checker_path::get_logger): New.
 584         * diagnostic-manager.cc (process_worklist_item): Update for
 585         new context param of maybe_update_for_edge.
 586         * engine.cc
 587         (impl_region_model_context::impl_region_model_context): Add
 588         out_could_have_done_work param to both ctors and use it to
 589         initialize mm_out_could_have_done_work.
 590         (impl_region_model_context::maybe_did_work): New vfunc
 591         implementation.
 592         (exploded_node::on_stmt): Add out_could_have_done_work param and
 593         pass to ctxt ctor.
 594         (exploded_node::on_stmt_pre): Treat setjmp and longjmp as "doing
 595         work".
 596         (exploded_node::on_longjmp): Likewise.
 597         (exploded_edge::exploded_edge): Add "could_do_work" param and use
 598         it to initialize m_could_do_work_p.
 599         (exploded_edge::dump_dot_label): Add result of could_do_work_p.
 600         (exploded_graph::add_function_entry): Mark edge as doing no work.
 601         (exploded_graph::add_edge): Add "could_do_work" param and pass to
 602         exploded_edge ctor.
 603         (add_tainted_args_callback): Treat as doing no work.
 604         (exploded_graph::process_worklist): Likewise when merging nodes.
 605         (maybe_process_run_of_before_supernode_enodes::item): Likewise.
 606         (exploded_graph::maybe_create_dynamic_call): Likewise.
 607         (exploded_graph::process_node): Likewise for phi nodes.
 608         Pass in a "could_have_done_work" bool when handling stmts and use
 609         when creating edges.  Assume work is done at bifurcation.
 610         (exploded_path::feasible_p): Update for new context param of
 611         maybe_update_for_edge.
 612         (feasibility_state::feasibility_state): New ctor.
 613         (feasibility_state::operator=): New.
 614         (feasibility_state::maybe_update_for_edge): Add ctxt param and use
 615         it.  Fix missing newline when logging state.
 616         (impl_run_checkers): Call exploded_graph::detect_infinite_loops.
 617         * exploded-graph.h
 618         (impl_region_model_context::impl_region_model_context): Add
 619         out_could_have_done_work param to both ctors.
 620         (impl_region_model_context::maybe_did_work): New decl.
 621         (impl_region_model_context::checking_for_infinite_loop_p): New.
 622         (impl_region_model_context::on_unusable_in_infinite_loop): New.
 623         (impl_region_model_context::m_out_could_have_done_work): New
 624         field.
 625         (exploded_node::on_stmt): Add "out_could_have_done_work" param.
 626         (exploded_edge::exploded_edge): Add "could_do_work" param.
 627         (exploded_edge::could_do_work_p): New accessor.
 628         (exploded_edge::m_could_do_work_p): New field.
 629         (exploded_graph::add_edge): Add "could_do_work" param.
 630         (exploded_graph::detect_infinite_loops): New decl.
 631         (feasibility_state::feasibility_state): New ctor.
 632         (feasibility_state::operator=): New decl.
 633         (feasibility_state::maybe_update_for_edge): Add ctxt param.
 634         * infinite-loop.cc: New file.
 635         * program-state.cc (program_state::on_edge): Log the rejected
 636         constraint when region_model::maybe_update_for_edge fails.
 637         * region-model.cc (region_model::on_assignment): Treat any writes
 638         other than to the stack as "doing work".
 639         (region_model::on_stmt_pre): Treat all asm stmts as "doing work".
 640         (region_model::on_call_post): Likewise for all calls to functions
 641         with unknown side effects.
 642         (region_model::handle_phi): Add svals_changing_meaning param.
 643         Mark widening svalue in phi nodes as changing meaning.
 644         (unusable_in_infinite_loop_constraint_p): New.
 645         (region_model::add_constraint): If we're checking for an infinite
 646         loop, bail out on unusable svalues, or if we don't have a definite
 647         true/false for the constraint.
 648         (region_model::update_for_phis): Gather all svalues changing
 649         meaning in phi nodes, and purge constraints involving them.
 650         (region_model::replay_call_summary): Treat all call summaries as
 651         doing work.
 652         (region_model::can_merge_with_p): Purge constraints involving
 653         svalues that change meaning.
 654         (model_merger::on_widening_reuse): New.
 655         (test_iteration_1): Likewise.
 656         (selftest::test_iteration_1): Remove assertion that model6 "knows"
 657         that i < 157.
 658         * region-model.h (region_model::handle_phi): Add
 659         svals_changing_meaning param
 660         (region_model_context::maybe_did_work): New pure virtual func.
 661         (region_model_context::checking_for_infinite_loop_p): Likewise.
 662         (region_model_context::on_unusable_in_infinite_loop): Likewise.
 663         (noop_region_model_context::maybe_did_work): Implement.
 664         (noop_region_model_context::checking_for_infinite_loop_p):
 665         Likewise.
 666         (noop_region_model_context::on_unusable_in_infinite_loop):
 667         Likewise.
 668         (region_model_context_decorator::maybe_did_work): Implement.
 669         (region_model_context_decorator::checking_for_infinite_loop_p):
 670         Likewise.
 671         (region_model_context_decorator::on_unusable_in_infinite_loop):
 672         Likewise.
 673         (model_merger::on_widening_reuse): New decl.
 674         (model_merger::m_svals_changing_meaning): New field.
 675         * sm-signal.cc (register_signal_handler::impl_transition): Assume
 676         the edge "does work".
 677         * supergraph.cc (supernode::get_start_location): Use CFG edge's
 678         goto_locus if available.
 679         (supernode::get_end_location): Likewise.
 680         (cfg_superedge::dump_label_to_pp): Dump edges with a "goto_locus"
 681         * supergraph.h (cfg_superedge::get_goto_locus): New.
 682         * svalue.cc (svalue::can_merge_p): Call on_widening_reuse for
 683         widening values.
 684         (involvement_visitor::visit_widening_svalue): New.
 685         (svalue::involves_p): Update assertion to allow widening svalues.
 686
 687 2023-11-14  David Malcolm  <dmalcolm@redhat.com>
 688
 689         PR analyzer/103533
 690         * sm-taint.cc: Remove "experimental" from comment.
 691         * sm.cc (make_checkers): Always add taint state machine.
 692
 693 2023-11-04  David Malcolm  <dmalcolm@redhat.com>
 694
 695         * bounds-checking.cc: Update for changes to diagnostic_context.
 696
 697 2023-11-02  David Malcolm  <dmalcolm@redhat.com>
 698
 699         PR analyzer/112317
 700         * access-diagram.cc (class x_aligned_x_ruler_widget): Eliminate
 701         unused field "m_col_widths".
 702         (access_diagram_impl::add_valid_vs_invalid_ruler): Update for
 703         above change.
 704         * region-model.cc
 705         (check_one_function_attr_null_terminated_string_arg): Remove
 706         unused variables "cd_unchecked", "strlen_sval", and
 707         "limited_sval".
 708         * region-model.h (region_model_context_decorator::warn): Add
 709         missing "override".
 710
 711 2023-10-31  David Malcolm  <dmalcolm@redhat.com>
 712
 713         * record-layout.cc: New file, based on material in region-model.cc.
 714         * record-layout.h: Likewise.
 715         * region-model.cc: Include "analyzer/record-layout.h".
 716         (class record_layout): Move to record-layout.cc and .h
 717
 718 2023-10-26  David Malcolm  <dmalcolm@redhat.com>
 719
 720         * region-model.cc
 721         (region_model::check_external_function_for_access_attr): Split
 722         out, replacing with...
 723         (region_model::check_function_attr_access): ...this new function
 724         and...
 725         (region_model::check_function_attrs): ...this new function.
 726         (region_model::check_one_function_attr_null_terminated_string_arg):
 727         New.
 728         (region_model::check_function_attr_null_terminated_string_arg):
 729         New.
 730         (region_model::handle_unrecognized_call): Update for renaming of
 731         check_external_function_for_access_attr to check_function_attrs.
 732         (region_model::check_for_null_terminated_string_arg): Add return
 733         value to one overload.  Make both overloads const.
 734         * region-model.h: Include "stringpool.h" and "attribs.h".
 735         (region_model::check_for_null_terminated_string_arg): Add return
 736         value to one overload.  Make both overloads const.
 737         (region_model::check_external_function_for_access_attr): Delete
 738         decl.
 739         (region_model::check_function_attr_access): New decl.
 740         (region_model::check_function_attr_null_terminated_string_arg):
 741         New decl.
 742         (region_model::check_one_function_attr_null_terminated_string_arg):
 743         New decl.
 744         (region_model::check_function_attrs): New decl.
 745
 746 2023-10-09  David Malcolm  <dmalcolm@redhat.com>
 747
 748         * access-diagram.cc (boundaries::add): Explicitly state
 749         "boundaries::" scope for "kind" enum.
 750
 751 2023-10-08  David Malcolm  <dmalcolm@redhat.com>
 752
 753         PR analyzer/111155
 754         * access-diagram.cc (boundaries::boundaries): Add logger param
 755         (boundaries::add): Add logging.
 756         (boundaries::get_hard_boundaries_in_range): New.
 757         (boundaries::m_logger): New field.
 758         (boundaries::get_table_x_for_offset): Make public.
 759         (class svalue_spatial_item): New.
 760         (class compound_svalue_spatial_item): New.
 761         (add_ellipsis_to_gaps): New.
 762         (valid_region_spatial_item::valid_region_spatial_item): Add theme
 763         param.  Initialize m_boundaries, m_existing_sval, and
 764         m_existing_sval_spatial_item.
 765         (valid_region_spatial_item::add_boundaries): Set m_boundaries.
 766         Add boundaries for any m_existing_sval_spatial_item.
 767         (valid_region_spatial_item::add_array_elements_to_table): Rewrite
 768         creation of min/max index in terms of
 769         maybe_add_array_index_to_table.  Rewrite ellipsis code using
 770         add_ellipsis_to_gaps. Add index values for any hard boundaries
 771         within the valid region.
 772         (valid_region_spatial_item::maybe_add_array_index_to_table): New,
 773         based on code formerly in add_array_elements_to_table.
 774         (valid_region_spatial_item::make_table): Make use of
 775         m_existing_sval_spatial_item, if any.
 776         (valid_region_spatial_item::m_boundaries): New field.
 777         (valid_region_spatial_item::m_existing_sval): New field.
 778         (valid_region_spatial_item::m_existing_sval_spatial_item): New
 779         field.
 780         (class svalue_spatial_item): Rename to...
 781         (class written_svalue_spatial_item): ...this.
 782         (class string_region_spatial_item): Rename to..
 783         (class string_literal_spatial_item): ...this.  Add "kind".
 784         (string_literal_spatial_item::add_boundaries): Use m_kind to
 785         determine kind of boundary.  Update for renaming of m_actual_bits
 786         to m_bits.
 787         (string_literal_spatial_item::make_table): Likewise.  Support not
 788         displaying a row for byte indexes, and not displaying a row for
 789         the type.
 790         (string_literal_spatial_item::add_column_for_byte): Make byte index
 791         row optional.
 792         (svalue_spatial_item::make): Convert to...
 793         (make_written_svalue_spatial_item): ...this.
 794         (make_existing_svalue_spatial_item): New.
 795         (access_diagram_impl::access_diagram_impl): Pass theme to
 796         m_valid_region_spatial_item ctor.  Update for renaming of
 797         m_svalue_spatial_item.
 798         (access_diagram_impl::find_boundaries): Pass logger to boundaries.
 799         Update for renaming of...
 800         (access_diagram_impl::m_svalue_spatial_item): Rename to...
 801         (access_diagram_impl::m_written_svalue_spatial_item): ...this.
 802
 803 2023-10-03  David Malcolm  <dmalcolm@redhat.com>
 804
 805         * analyzer-logging.cc (logger::log_va_partial): Use text_info
 806         ctor.
 807         * analyzer.cc (make_label_text): Likewise.
 808         (make_label_text_n): Likewise.
 809         * pending-diagnostic.cc (evdesc::event_desc::formatted_print):
 810         Likewise.
 811
 812 2023-10-02  David Malcolm  <dmalcolm@redhat.com>
 813
 814         * program-point.cc: Update for grouping of source printing fields
 815         within diagnostic_context.
 816
 817 2023-09-15  David Malcolm  <dmalcolm@redhat.com>
 818
 819         * analyzer.cc (get_stmt_location): Handle null stmt.
 820         * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic): Copy
 821         m_loc from ploc.
 822         (saved_diagnostic::operator==): Compare m_loc.
 823         (saved_diagnostic::calc_best_epath): Only use m_stmt_finder if
 824         m_loc is unknown.
 825         (dedupe_key::dedupe_key): Initialize m_loc.
 826         (dedupe_key::operator==): Compare m_loc.
 827         (dedupe_key::get_location): Use m_loc if it's known.
 828         (dedupe_key::m_loc): New field.
 829         (diagnostic_manager::emit_saved_diagnostic): Only call
 830         get_emission_location if m_loc is unknown, preferring to use m_loc
 831         if it's available.
 832         * diagnostic-manager.h (saved_diagnostic::m_loc): New field.
 833         (pending_location::pending_location): Initialize m_loc.  Add
 834         overload taking a location_t rather than a stmt/stmt_finder.
 835         (pending_location::m_loc): New field.
 836
 837 2023-09-15  David Malcolm  <dmalcolm@redhat.com>
 838
 839         * analyzer.h (struct pending_location): New forward decl.
 840         * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic):
 841         Replace params "enode", "snode", "stmt", and "stmt_finder" with
 842         "ploc".
 843         (diagnostic_manager::add_diagnostic): Likewise for both overloads.
 844         * diagnostic-manager.h (saved_diagnostic::saved_diagnostic):
 845         Likewise.
 846         (struct pending_location): New.
 847         (diagnostic_manager::add_diagnostic): Replace params "enode",
 848         "snode", "stmt", and "stmt_finder" with "ploc".
 849         * engine.cc (impl_region_model_context::warn): Update call to
 850         add_diagnostic for above change.
 851         (impl_sm_context::warn): Likewise.
 852         (impl_region_model_context::on_state_leak): Likewise.
 853         * infinite-recursion.cc
 854         (exploded_graph::detect_infinite_recursion): Likewise.
 855
 856 2023-09-15  David Malcolm  <dmalcolm@redhat.com>
 857
 858         * region-model.cc (region_model::get_gassign_result): Handle
 859         volatile ops by using a conjured_svalue.
 860
 861 2023-09-14  David Malcolm  <dmalcolm@redhat.com>
 862
 863         * checker-event.h (checker_event::get_thread_id): New.
 864         * checker-path.h (class checker_path): Implement thread-related
 865         vfuncs via a single simple_diagnostic_thread instance named
 866         "main".
 867
 868 2023-09-14  David Malcolm  <dmalcolm@redhat.com>
 869
 870         * diagnostic-manager.cc (compatible_epath_p): Fix missing return.
 871
 872 2023-09-14  David Malcolm  <dmalcolm@redhat.com>
 873
 874         * diagnostic-manager.cc (process_worklist_item): Use
 875         std::unique_ptr rather than plain rejected_constraint *.
 876         * engine.cc (exploded_path::feasible_p): Likewise.
 877         (feasibility_state::maybe_update_for_edge): Likewise.
 878         * exploded-graph.h (feasibility_problem::feasibility_problem):
 879         Likewise.
 880         (feasibility_problem::~feasibility_problem): Delete.
 881         (feasibility_problem::m_rc): Use std::unique_ptr.
 882         (feasibility_state::maybe_update_for_edge): Likewise.
 883         * feasible-graph.cc (feasible_graph::add_feasibility_problem):
 884         Likewise.
 885         * feasible-graph.h (class infeasible_node): Likewise.
 886         (feasible_graph::add_feasibility_problem): Likewise.
 887         * region-model.cc (region_model::add_constraint): Likewise.
 888         (region_model::maybe_update_for_edge): Likewise.
 889         (region_model::apply_constraints_for_gcond): Likewise.
 890         (region_model::apply_constraints_for_gswitch): Likewise.
 891         (region_model::apply_constraints_for_exception): Likewise.
 892         * region-model.h (class region_model): Likewise for decls.
 893
 894 2023-09-09  benjamin priour  <vultkayn@gcc.gnu.org>
 895
 896         PR analyzer/96395
 897         * region-model.cc
 898         (region_model::add_constraints_from_binop): binop_svalues around
 899         LT_EXPR, LE_EXPR, GT_EXPR, GE_EXPR are now unwrapped.
 900
 901 2023-09-07  David Malcolm  <dmalcolm@redhat.com>
 902
 903         PR analyzer/110529
 904         * program-point.cc (program_point::on_edge): Don't reject
 905         EDGE_ABNORMAL for computed gotos.
 906         * region-model.cc (region_model::maybe_update_for_edge): Handle
 907         computed goto statements.
 908         (region_model::apply_constraints_for_ggoto): New.
 909         * region-model.h (region_model::apply_constraints_for_ggoto): New decl.
 910         * supergraph.cc (supernode::get_label): New.
 911         * supergraph.h (supernode::get_label): New decl.
 912
 913 2023-09-07  benjamin priour  <vultkayn@gcc.gnu.org>
 914             David Malcolm  <dmalcolm@redhat.com>
 915
 916         PR analyzer/110830
 917         * diagnostic-manager.cc
 918         (compatible_epaths_p): New function.
 919         (saved_diagnostic::supercedes_p): Now calls the above
 920         to determine if the diagnostics do overlap and the superseding
 921         may proceed.
 922
 923 2023-09-07  David Malcolm  <dmalcolm@redhat.com>
 924
 925         * region-model.h: fix -Wunused-parameter warnings
 926
 927 2023-09-06  David Malcolm  <dmalcolm@redhat.com>
 928
 929         PR analyzer/105899
 930         * kf.cc (class kf_strstr): New.
 931         (kf_strstr::impl_call_post): New.
 932         (register_known_functions): Register it.
 933
 934 2023-09-06  David Malcolm  <dmalcolm@redhat.com>
 935
 936         PR analyzer/105899
 937         * kf.cc (class kf_strncpy): New.
 938         (kf_strncpy::impl_call_post): New.
 939         (register_known_functions): Register it.
 940         * region-model.cc (region_model::read_bytes): Handle unknown
 941         number of bytes.
 942
 943 2023-09-06  David Malcolm  <dmalcolm@redhat.com>
 944
 945         * kf.cc (kf_calloc::impl_call_pre): Pass ctxt to zero_fill_region.
 946         (kf_memset::impl_call_pre): Move responsibility for calling
 947         check_region_for_write to fill_region.
 948         * region-model.cc (region_model::on_assignment): Pass ctxt to
 949         zero_fill_region.
 950         (region_model::fill_region): Add "ctxt" param, using it to call
 951         check_region_for_write.
 952         (region_model::zero_fill_region): Likewise.
 953         * region-model.h (region_model::fill_region): Add "ctxt" param.
 954         (region_model::zero_fill_region): Likewise.
 955
 956 2023-09-01  benjamin priour  <priour.be@gmail.com>
 957
 958         PR analyzer/105948
 959         PR analyzer/94355
 960         * analyzer.h (is_placement_new_p): New declaration.
 961         * call-details.cc
 962         (call_details::deref_ptr_arg): New function.
 963         Dereference the argument at given index if possible.
 964         * call-details.h: Declaration of the above function.
 965         * kf-lang-cp.cc (is_placement_new_p): Returns true if the gcall
 966         is recognized as a placement new.
 967         (kf_operator_delete::impl_call_post): Unbinding a region and its
 968         descendents now poisons with POISON_KIND_DELETED.
 969         (register_known_functions_lang_cp): Known function "operator
 970         delete" is now registered only once independently of its number of
 971         arguments.
 972         * region-model.cc (region_model::eval_condition): Now
 973         recursively calls itself if any of the operand is wrapped in a
 974         cast.
 975         * sm-malloc.cc (malloc_state_machine::on_stmt):
 976         Add placement new recognition.
 977         * svalue.cc (poison_kind_to_str): Wording for the new PK.
 978         * svalue.h (enum poison_kind): Add value POISON_KIND_DELETED.
 979
 980 2023-08-31  Francois-Xavier Coudert  <fxcoudert@gcc.gnu.org>
 981
 982         * kf.cc: Change spelling to macOS.
 983
 984 2023-08-30  Eric Feng  <ef2648@columbia.edu>
 985
 986         PR analyzer/107646
 987         * engine.cc (impl_region_model_context::warn): New optional
 988         parameter.
 989         * exploded-graph.h (class impl_region_model_context): Likewise.
 990         * region-model.cc (region_model::pop_frame): New callback
 991         feature for region_model::pop_frame.
 992         * region-model.h (struct append_regions_cb_data): Likewise.
 993         (class region_model): Likewise.
 994         (class region_model_context): New optional parameter.
 995         (class region_model_context_decorator): Likewise.
 996
 997 2023-08-30  Francois-Xavier Coudert  <fxcoudert@gcc.gnu.org>
 998
 999         * region-model.cc: Define INCLUDE_ALGORITHM.
1000
1001 2023-08-29  David Malcolm  <dmalcolm@redhat.com>
1002
1003         PR analyzer/99860
1004         * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
1005         selftest::analyzer_ranges_cc_tests.
1006         * analyzer-selftests.h (selftest::run_analyzer_selftests): New
1007         decl.
1008         * analyzer.opt (Wanalyzer-overlapping-buffers): New option.
1009         * call-details.cc: Include "analyzer/ranges.h" and "make-unique.h".
1010         (class overlapping_buffers): New.
1011         (call_details::complain_about_overlap): New.
1012         * call-details.h (call_details::complain_about_overlap): New decl.
1013         * kf.cc (kf_memcpy_memmove::impl_call_pre): Call
1014         cd.complain_about_overlap for memcpy and memcpy_chk.
1015         (kf_strcat::impl_call_pre): Call cd.complain_about_overlap.
1016         (kf_strcpy::impl_call_pre): Likewise.
1017         * ranges.cc: New file.
1018         * ranges.h: New file.
1019
1020 2023-08-29  David Malcolm  <dmalcolm@redhat.com>
1021
1022         PR analyzer/105899
1023         * kf.cc (kf_strdup::impl_call_pre): Set size of
1024         dynamically-allocated buffer.  Simulate copying the string from
1025         the source region to the new buffer.
1026
1027 2023-08-27  benjamin priour  <vultkayn@gcc.gnu.org>
1028
1029         PR analyzer/96395
1030         * analyzer.h (class known_function): Add virtual casts
1031         to builtin_known_function.
1032         (class builtin_known_function): New subclass of known_function
1033         for builtins.
1034         * kf.cc (class kf_alloca): Now derived from
1035         builtin_known_function.
1036         (class kf_calloc): Likewise.
1037         (class kf_free): Likewise.
1038         (class kf_malloc): Likewise.
1039         (class kf_memcpy_memmove): Likewise.
1040         (class kf_memset): Likewise.
1041         (class kf_realloc): Likewise.
1042         (class kf_strchr): Likewise.
1043         (class kf_sprintf): Likewise.
1044         (class kf_strcat): Likewise.
1045         (class kf_strcpy): Likewise.
1046         (class kf_strdup): Likewise.
1047         (class kf_strlen): Likewise.
1048         (class kf_strndup): Likewise.
1049         (register_known_functions): Builtins are now registered as
1050         known_functions by name rather than by their BUILTIN_CODE.
1051         * known-function-manager.cc (get_normal_builtin): New overload.
1052         * known-function-manager.h: New overload declaration.
1053         * region-model.cc (region_model::get_builtin_kf): New function.
1054         * region-model.h (class region_model): Add declaration of
1055         get_builtin_kf.
1056         * sm-fd.cc: For called recognized as builtins, use the
1057         attributes of that builtin as defined in gcc/builtins.def
1058         rather than the user's.
1059         * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise.
1060
1061 2023-08-25  David Malcolm  <dmalcolm@redhat.com>
1062
1063         * access-diagram.cc (class string_region_spatial_item): Remove
1064         assumption that the string is written to the start of the cluster.
1065
1066 2023-08-24  David Malcolm  <dmalcolm@redhat.com>
1067
1068         PR analyzer/105899
1069         * call-details.cc
1070         (call_details::check_for_null_terminated_string_arg): Split into
1071         overloads, one taking just an arg_idx, the other a new
1072         "include_terminator" param.
1073         * call-details.h: Likewise.
1074         * kf.cc (class kf_strcat): New.
1075         (kf_strcpy::impl_call_pre): Update for change to
1076         check_for_null_terminated_string_arg.
1077         (register_known_functions): Register kf_strcat.
1078         * region-model.cc
1079         (region_model::check_for_null_terminated_string_arg): Split into
1080         overloads, one taking just an arg_idx, the other a new
1081         "include_terminator" param.  When returning an svalue, handle
1082         "include_terminator" being false by subtracting one.
1083         * region-model.h
1084         (region_model::check_for_null_terminated_string_arg): Split into
1085         overloads, one taking just an arg_idx, the other a new
1086         "include_terminator" param.
1087
1088 2023-08-24  David Malcolm  <dmalcolm@redhat.com>
1089
1090         PR analyzer/105899
1091         * region-model.cc (fragment::has_null_terminator): Handle
1092         SK_BITS_WITHIN.
1093
1094 2023-08-24  David Malcolm  <dmalcolm@redhat.com>
1095
1096         PR analyzer/105899
1097         * region-model-manager.cc
1098         (region_model_manager::get_or_create_initial_value): Simplify
1099         INIT_VAL(ELEMENT_REG(STRING_REG), CONSTANT_SVAL) to
1100         CONSTANT_SVAL(STRING[N]).
1101
1102 2023-08-24  David Malcolm  <dmalcolm@redhat.com>
1103
1104         PR analyzer/105899
1105         * region-model.cc (fragment::has_null_terminator): Move STRING_CST
1106         handling to fragment::string_cst_has_null_terminator; also use it to
1107         handle INIT_VAL(STRING_REG).
1108         (fragment::string_cst_has_null_terminator): New, from above.
1109
1110 2023-08-24  David Malcolm  <dmalcolm@redhat.com>
1111
1112         * kf.cc (kf_memcpy_memmove::impl_call_pre): Reimplement using
1113         region_model::copy_bytes.
1114         * region-model.cc (region_model::read_bytes): New.
1115         (region_model::copy_bytes): New.
1116         * region-model.h (region_model::read_bytes): New decl.
1117         (region_model::copy_bytes): New decl.
1118
1119 2023-08-24  David Malcolm  <dmalcolm@redhat.com>
1120
1121         PR analyzer/105899
1122         * region-model.cc (region_model::get_string_size): Delete both.
1123         * region-model.h (region_model::get_string_size): Delete both
1124         decls.
1125
1126 2023-08-24  David Malcolm  <dmalcolm@redhat.com>
1127
1128         PR analyzer/105899
1129         * kf.cc (kf_strcpy::impl_call_pre): Reimplement using
1130         check_for_null_terminated_string_arg.
1131         * region-model.cc (region_model::get_store_bytes): Shortcut
1132         reading all of a string_region.
1133         (region_model::scan_for_null_terminator): Use get_store_value for
1134         the bytes rather than "unknown" when returning an unknown length.
1135         (region_model::write_bytes): New.
1136         * region-model.h (region_model::write_bytes): New decl.
1137
1138 2023-08-24  David Malcolm  <dmalcolm@redhat.com>
1139
1140         PR analyzer/105899
1141         * region-model.cc (iterable_cluster::iterable_cluster): Add
1142         symbolic binding keys to m_symbolic_bindings.
1143         (iterable_cluster::has_symbolic_bindings_p): New.
1144         (iterable_cluster::m_symbolic_bindings): New field.
1145         (region_model::scan_for_null_terminator): Treat clusters with
1146         symbolic bindings as having unknown strlen.
1147
1148 2023-08-24  David Malcolm  <dmalcolm@redhat.com>
1149
1150         * engine.cc (impl_path_context::impl_path_context): Add logger
1151         param.
1152         (impl_path_context::bifurcate): Add log message.
1153         (impl_path_context::terminate_path): Likewise.
1154         (impl_path_context::m_logger): New field.
1155         (exploded_graph::process_node): Pass logger to path_ctxt ctor.
1156
1157 2023-08-22  David Malcolm  <dmalcolm@redhat.com>
1158
1159         PR analyzer/105899
1160         * kf-analyzer.cc (class kf_analyzer_get_strlen): Move to kf.cc.
1161         (register_known_analyzer_functions): Use make_kf_strlen.
1162         * kf.cc (class kf_strlen::impl_call_pre): Replace with
1163         implementation of kf_analyzer_get_strlen from kf-analyzer.cc.
1164         Handle "UNKNOWN" return from check_for_null_terminated_string_arg
1165         by falling back to a conjured svalue.
1166         (make_kf_strlen): New.
1167         (register_known_functions): Use make_kf_strlen.
1168         * known-function-manager.h (make_kf_strlen): New decl.
1169
1170 2023-08-22  David Malcolm  <dmalcolm@redhat.com>
1171
1172         PR analyzer/105899
1173         * call-details.cc (call_details::call_details): New ctor.
1174         * call-details.h (call_details::call_details): New ctor decl.
1175         (struct call_arg_details): Move here from region-model.cc.
1176         * region-model.cc (region_model::check_call_format_attr): New.
1177         (region_model::check_call_args): Call it.
1178         (struct call_arg_details): Move it to call-details.h.
1179         * region-model.h (region_model::check_call_format_attr): New decl.
1180
1181 2023-08-22  David Malcolm  <dmalcolm@redhat.com>
1182
1183         * kf.cc (class kf_fopen): New.
1184         (register_known_functions): Register it.
1185
1186 2023-08-22  David Malcolm  <dmalcolm@redhat.com>
1187
1188         PR analyzer/105899
1189         * analyzer.opt (Wanalyzer-unterminated-string): Delete.
1190         * call-details.cc
1191         (call_details::check_for_null_terminated_string_arg): Convert
1192         return type from void to const svalue *.  Add param "out_sval".
1193         * call-details.h
1194         (call_details::check_for_null_terminated_string_arg): Likewise.
1195         * kf-analyzer.cc (kf_analyzer_get_strlen::impl_call_pre): Wire up
1196         to result of check_for_null_terminated_string_arg.
1197         * region-model.cc (get_strlen): Delete.
1198         (class unterminated_string_arg): Delete.
1199         (struct fragment): New.
1200         (class iterable_cluster): New.
1201         (region_model::get_store_bytes): New.
1202         (get_tree_for_byte_offset): New.
1203         (region_model::scan_for_null_terminator): New.
1204         (region_model::check_for_null_terminated_string_arg): Convert
1205         return type from void to const svalue *.  Add param "out_sval".
1206         Reimplement in terms of scan_for_null_terminator, dropping the
1207         special-case for -Wanalyzer-unterminated-string.
1208         * region-model.h (region_model::get_store_bytes): New decl.
1209         (region_model::scan_for_null_terminator): New decl.
1210         (region_model::check_for_null_terminated_string_arg): Convert
1211         return type from void to const svalue *.  Add param "out_sval".
1212         * store.cc (concrete_binding::get_byte_range): New.
1213         * store.h (concrete_binding::get_byte_range): New decl.
1214         (store_manager::get_concrete_binding): New overload.
1215
1216 2023-08-22  David Malcolm  <dmalcolm@redhat.com>
1217
1218         * region-model.cc (region_model_context_decorator::add_event):
1219         Handle m_inner being NULL.
1220         * region-model.h (class region_model_context_decorator): Likewise.
1221         (annotating_context::warn): Likewise.
1222
1223 2023-08-22  David Malcolm  <dmalcolm@redhat.com>
1224
1225         * diagnostic-manager.cc (saved_diagnostic::add_event): New.
1226         (saved_diagnostic::add_any_saved_events): New.
1227         (diagnostic_manager::add_event): New.
1228         (dedupe_winners::emit_best): New.
1229         (diagnostic_manager::emit_saved_diagnostic): Make "sd" param
1230         non-const.  Call saved_diagnostic::add_any_saved_events.
1231         * diagnostic-manager.h (saved_diagnostic::add_event): New decl.
1232         (saved_diagnostic::add_any_saved_events): New decl.
1233         (saved_diagnostic::m_saved_events): New field.
1234         (diagnostic_manager::add_event): New decl.
1235         (diagnostic_manager::emit_saved_diagnostic): Make "sd" param
1236         non-const.
1237         * engine.cc (impl_region_model_context::add_event): New.
1238         * exploded-graph.h (impl_region_model_context::add_event): New decl.
1239         * region-model.cc
1240         (noop_region_model_context::add_event): New.
1241         (region_model_context_decorator::add_event): New.
1242         * region-model.h (region_model_context::add_event): New vfunc.
1243         (noop_region_model_context::add_event): New decl.
1244         (region_model_context_decorator::add_event): New decl.
1245
1246 2023-08-22  David Malcolm  <dmalcolm@redhat.com>
1247
1248         * region-model.cc
1249         (class check_external_function_for_access_attr::annotating_ctxt):
1250         Convert to an annotating_context.
1251         * region-model.h (class note_adding_context): Rename to...
1252         (class annotating_context): ...this, updating the "warn" method.
1253         (note_adding_context::make_note): Replace with...
1254         (annotating_context::add_annotations): ...this.
1255
1256 2023-08-14  benjamin priour  <vultkayn@gcc.gnu.org>
1257
1258         PR analyzer/110543
1259         * analyzer.opt: Add new option.
1260         * diagnostic-manager.cc
1261         (diagnostic_manager::prune_path): Call prune_system_headers.
1262         (prune_frame): New function that deletes all events in a frame.
1263         (diagnostic_manager::prune_system_headers): New function.
1264         * diagnostic-manager.h: Add prune_system_headers declaration.
1265
1266 2023-08-11  David Malcolm  <dmalcolm@redhat.com>
1267
1268         PR analyzer/105899
1269         * analyzer.opt (Wanalyzer-unterminated-string): New.
1270         * call-details.cc
1271         (call_details::check_for_null_terminated_string_arg): New.
1272         * call-details.h
1273         (call_details::check_for_null_terminated_string_arg): New decl.
1274         * kf-analyzer.cc (class kf_analyzer_get_strlen): New.
1275         (register_known_analyzer_functions): Register it.
1276         * kf.cc (kf_error::impl_call_pre): Check that format arg is a
1277         valid null-terminated string.
1278         (kf_putenv::impl_call_pre): Likewise for the sole param.
1279         (kf_strchr::impl_call_pre): Likewise for the first param.
1280         (kf_strcpy::impl_call_pre): Likewise for the second param.
1281         (kf_strdup::impl_call_pre): Likewise for the sole param.
1282         * region-model.cc (get_strlen): New.
1283         (struct call_arg_details): New.
1284         (inform_about_expected_null_terminated_string_arg): New.
1285         (class unterminated_string_arg): New.
1286         (region_model::check_for_null_terminated_string_arg): New.
1287         * region-model.h
1288         (region_model::check_for_null_terminated_string_arg): New decl.
1289
1290 2023-08-11  Eric Feng  <ef2648@columbia.edu>
1291
1292         PR analyzer/107646
1293         * call-details.h: New function.
1294         * region-model.cc (region_model::get_or_create_region_for_heap_alloc):
1295         New optional parameters.
1296         * region-model.h (class region_model): New optional parameters.
1297         * sm-malloc.cc (on_realloc_with_move): New function.
1298         (region_model::transition_ptr_sval_non_null): New function.
1299
1300 2023-08-09  David Malcolm  <dmalcolm@redhat.com>
1301
1302         * analyzer.h (class pure_known_function_with_default_return): New
1303         subclass.
1304         * call-details.cc (const_fn_p): Move here from region-model.cc.
1305         (maybe_get_const_fn_result): Likewise.
1306         (get_result_size_in_bytes): Likewise.
1307         (call_details::set_any_lhs_with_defaults): New function, based on
1308         code in region_model::on_call_pre.
1309         * call-details.h (call_details::set_any_lhs_with_defaults): New
1310         decl.
1311         * diagnostic-manager.cc
1312         (diagnostic_manager::emit_saved_diagnostic): Log the index of the
1313         saved_diagnostic.
1314         * kf.cc (pure_known_function_with_default_return::impl_call_pre):
1315         New.
1316         (kf_memset::impl_call_pre): Set the LHS to the first param.
1317         (kf_putenv::impl_call_pre): Call cd.set_any_lhs_with_defaults.
1318         (kf_sprintf::impl_call_pre): Call cd.set_any_lhs_with_defaults.
1319         (class kf_stack_restore): Derive from
1320         pure_known_function_with_default_return.
1321         (class kf_stack_save): Likewise.
1322         (kf_strlen::impl_call_pre): Call cd.set_any_lhs_with_defaults.
1323         * region-model-reachability.cc (reachable_regions::handle_sval):
1324         Remove logic for symbolic regions for pointers.
1325         * region-model.cc (region_model::canonicalize): Remove purging of
1326         dynamic extents workaround for surplus values from
1327         region_model::on_call_pre's default LHS code.
1328         (const_fn_p): Move to call-details.cc.
1329         (maybe_get_const_fn_result): Likewise.
1330         (get_result_size_in_bytes): Likewise.
1331         (region_model::update_for_nonzero_return): Call
1332         cd.set_any_lhs_with_defaults.
1333         (region_model::on_call_pre): Remove the assignment to the LHS of a
1334         default return value, instead requiring all known_function
1335         implementations to write to any LHS of the call.  Use
1336         cd.set_any_lhs_with_defaults on the non-kf paths.
1337         * sm-fd.cc (kf_socket::outcome_of_socket::update_model): Use
1338         cd.set_any_lhs_with_defaults when failing to get at fd state.
1339         (kf_bind::outcome_of_bind::update_model): Likewise.
1340         (kf_listen::outcome_of_listen::update_model): Likewise.
1341         (kf_accept::outcome_of_accept::update_model): Likewise.
1342         (kf_connect::outcome_of_connect::update_model): Likewise.
1343         (kf_read::impl_call_pre): Use cd.set_any_lhs_with_defaults.
1344         * sm-file.cc (class kf_stdio_output_fn): Derive from
1345         pure_known_function_with_default_return.
1346         (class kf_ferror): Likewise.
1347         (class kf_fileno): Likewise.
1348         (kf_fgets::impl_call_pre): Use cd.set_any_lhs_with_defaults.
1349         (kf_read::impl_call_pre): Likewise.
1350         (class kf_getc): Derive from
1351         pure_known_function_with_default_return.
1352         (class kf_getchar): Likewise.
1353         * varargs.cc (kf_va_arg::impl_call_pre): Use
1354         cd.set_any_lhs_with_defaults.
1355
1356 2023-08-04  David Malcolm  <dmalcolm@redhat.com>
1357
1358         PR analyzer/110426
1359         * bounds-checking.cc (region_model::check_region_bounds): Handle
1360         symbolic base regions.
1361         * call-details.cc: Include "stringpool.h" and "attribs.h".
1362         (call_details::lookup_function_attribute): New function.
1363         * call-details.h (call_details::lookup_function_attribute): New
1364         function decl.
1365         * region-model-manager.cc
1366         (region_model_manager::maybe_fold_binop): Add reference to
1367         PR analyzer/110902.
1368         * region-model-reachability.cc (reachable_regions::handle_sval):
1369         Add symbolic regions for pointers that are conjured svalues for
1370         the LHS of a stmt.
1371         * region-model.cc (region_model::canonicalize): Purge dynamic
1372         extents for regions that aren't referenced.
1373         (get_result_size_in_bytes): New function.
1374         (region_model::on_call_pre): Use get_result_size_in_bytes and
1375         potentially set the dynamic extents of the region pointed to by
1376         the return value.
1377         (region_model::deref_rvalue): Add param "add_nonnull_constraint"
1378         and use it to conditionalize adding the constraint.
1379         (pending_diagnostic_subclass::dubious_allocation_size): Add "stmt"
1380         param to both ctors and use it to initialize new "m_stmt" field.
1381         (pending_diagnostic_subclass::operator==): Use m_stmt; don't use
1382         m_lhs or m_rhs.
1383         (pending_diagnostic_subclass::m_stmt): New field.
1384         (region_model::check_region_size): Generalize to any kind of
1385         pointer svalue by using deref_rvalue rather than checking for
1386         region_svalue.  Pass stmt to dubious_allocation_size ctor.
1387         * region-model.h (region_model::deref_rvalue): Add param
1388         "add_nonnull_constraint".
1389         * svalue.cc (conjured_svalue::lhs_value_p): New function.
1390         * svalue.h (conjured_svalue::lhs_value_p): New decl.
1391
1392 2023-08-04  David Malcolm  <dmalcolm@redhat.com>
1393
1394         * svalue.cc (region_svalue::dump_to_pp): Support NULL type.
1395         (constant_svalue::dump_to_pp): Likewise.
1396         (initial_svalue::dump_to_pp): Likewise.
1397         (conjured_svalue::dump_to_pp): Likewise.  Fix missing print of the
1398         type.
1399
1400 2023-08-03  David Malcolm  <dmalcolm@redhat.com>
1401
1402         PR analyzer/110882
1403         * region.cc (int_size_in_bits): Fail on zero-sized types.
1404
1405 2023-08-02  Eric Feng  <ef2648@columbia.edu>
1406
1407         PR analyzer/107646
1408         * analyzer-language.cc (run_callbacks): New function.
1409         (on_finish_translation_unit): New function.
1410         * analyzer-language.h (GCC_ANALYZER_LANGUAGE_H): New include.
1411         (class translation_unit): New vfuncs.
1412
1413 2023-07-26  David Malcolm  <dmalcolm@redhat.com>
1414
1415         PR analyzer/104940
1416         * region-model-manager.cc
1417         (region_model_manager::region_model_manager): Update for
1418         generalizing region ids to also cover svalues.
1419         (region_model_manager::get_or_create_constant_svalue): Likewise.
1420         (region_model_manager::get_or_create_unknown_svalue): Likewise.
1421         (region_model_manager::create_unique_svalue): Likewise.
1422         (region_model_manager::get_or_create_initial_value): Likewise.
1423         (region_model_manager::get_or_create_setjmp_svalue): Likewise.
1424         (region_model_manager::get_or_create_poisoned_svalue): Likewise.
1425         (region_model_manager::get_ptr_svalue): Likewise.
1426         (region_model_manager::get_or_create_unaryop): Likewise.
1427         (region_model_manager::get_or_create_binop): Likewise.
1428         (region_model_manager::get_or_create_sub_svalue): Likewise.
1429         (region_model_manager::get_or_create_repeated_svalue): Likewise.
1430         (region_model_manager::get_or_create_bits_within): Likewise.
1431         (region_model_manager::get_or_create_unmergeable): Likewise.
1432         (region_model_manager::get_or_create_widening_svalue): Likewise.
1433         (region_model_manager::get_or_create_compound_svalue): Likewise.
1434         (region_model_manager::get_or_create_conjured_svalue): Likewise.
1435         (region_model_manager::get_or_create_asm_output_svalue): Likewise.
1436         (region_model_manager::get_or_create_const_fn_result_svalue):
1437         Likewise.
1438         (region_model_manager::get_region_for_fndecl): Likewise.
1439         (region_model_manager::get_region_for_label): Likewise.
1440         (region_model_manager::get_region_for_global): Likewise.
1441         (region_model_manager::get_field_region): Likewise.
1442         (region_model_manager::get_element_region): Likewise.
1443         (region_model_manager::get_offset_region): Likewise.
1444         (region_model_manager::get_sized_region): Likewise.
1445         (region_model_manager::get_cast_region): Likewise.
1446         (region_model_manager::get_frame_region): Likewise.
1447         (region_model_manager::get_symbolic_region): Likewise.
1448         (region_model_manager::get_region_for_string): Likewise.
1449         (region_model_manager::get_bit_range): Likewise.
1450         (region_model_manager::get_var_arg_region): Likewise.
1451         (region_model_manager::get_region_for_unexpected_tree_code):
1452         Likewise.
1453         (region_model_manager::get_or_create_region_for_heap_alloc):
1454         Likewise.
1455         (region_model_manager::create_region_for_alloca): Likewise.
1456         (region_model_manager::log_stats): Likewise.
1457         * region-model-manager.h (region_model_manager::get_num_regions):
1458         Replace with...
1459         (region_model_manager::get_num_symbols): ...this.
1460         (region_model_manager::alloc_region_id): Replace with...
1461         (region_model_manager::alloc_symbol_id): ...this.
1462         (region_model_manager::m_next_region_id): Replace with...
1463         (region_model_manager::m_next_symbol_id): ...this.
1464         * region-model.cc (selftest::test_get_representative_tree): Update
1465         for generalizing region ids to also cover svalues.
1466         (selftest::test_binop_svalue_folding): Likewise.
1467         (selftest::test_state_merging): Likewise.
1468         * region.cc (region::cmp_ids): Delete, in favor of
1469         symbol::cmp_ids.
1470         (region::region): Update for introduction of symbol base class.
1471         (frame_region::get_region_for_local): Likewise.
1472         (root_region::root_region): Likewise.
1473         (symbolic_region::symbolic_region): Likewise.
1474         * region.h: Replace include of "analyzer/complexity.h" with
1475         "analyzer/symbol.h".
1476         (class region): Make a subclass of symbol.
1477         (region::get_id): Delete in favor of symbol::get_id.
1478         (region::cmp_ids): Delete in favor of symbol::cmp_ids.
1479         (region::get_complexity): Delete in favor of
1480         symbol::get_complexity.
1481         (region::region): Use symbol::id_t for "id" param.
1482         (region::m_complexity): Move field to symbol base class.
1483         (region::m_id): Likewise.
1484         (space_region::space_region): Use symbol::id_t for "id" param.
1485         (frame_region::frame_region): Likewise.
1486         (globals_region::globals_region): Likewise.
1487         (code_region::code_region): Likewise.
1488         (function_region::function_region): Likewise.
1489         (label_region::label_region): Likewise.
1490         (stack_region::stack_region): Likewise.
1491         (heap_region::heap_region): Likewise.
1492         (thread_local_region::thread_local_region): Likewise.
1493         (root_region::root_region): Likewise.
1494         (symbolic_region::symbolic_region): Likewise.
1495         (decl_region::decl_region): Likewise.
1496         (field_region::field_region): Likewise.
1497         (element_region::element_region): Likewise.
1498         (offset_region::offset_region): Likewise.
1499         (sized_region::sized_region): Likewise.
1500         (cast_region::cast_region): Likewise.
1501         (heap_allocated_region::heap_allocated_region): Likewise.
1502         (alloca_region::alloca_region): Likewise.
1503         (string_region::string_region): Likewise.
1504         (bit_range_region::bit_range_region): Likewise.
1505         (var_arg_region::var_arg_region): Likewise.
1506         (errno_region::errno_region): Likewise.
1507         (unknown_region::unknown_region): Likewise.
1508         * svalue.cc (sub_svalue::sub_svalue): Add symbol::id_t param.
1509         (repeated_svalue::repeated_svalue): Likewise.
1510         (bits_within_svalue::bits_within_svalue): Likewise.
1511         (compound_svalue::compound_svalue): Likewise.
1512         * svalue.h: Replace include of "analyzer/complexity.h" with
1513         "analyzer/symbol.h".
1514         (class svalue): Make a subclass of symbol.
1515         (svalue::get_complexity): Delete in favor of
1516         symbol::get_complexity.
1517         (svalue::svalue): Add symbol::id_t param.  Update for new base
1518         class.
1519         (svalue::m_complexity): Delete in favor of
1520         symbol::m_complexity.
1521         (region_svalue::region_svalue): Add symbol::id_t param
1522         (constant_svalue::constant_svalue): Likewise.
1523         (unknown_svalue::unknown_svalue): Likewise.
1524         (poisoned_svalue::poisoned_svalue): Likewise.
1525         (setjmp_svalue::setjmp_svalue): Likewise.
1526         (initial_svalue::initial_svalue): Likewise.
1527         (unaryop_svalue::unaryop_svalue): Likewise.
1528         (binop_svalue::binop_svalue): Likewise.
1529         (sub_svalue::sub_svalue): Likewise.
1530         (repeated_svalue::repeated_svalue): Likewise.
1531         (bits_within_svalue::bits_within_svalue): Likewise.
1532         (unmergeable_svalue::unmergeable_svalue): Likewise.
1533         (placeholder_svalue::placeholder_svalue): Likewise.
1534         (widening_svalue::widening_svalue): Likewise.
1535         (compound_svalue::compound_svalue): Likewise.
1536         (conjured_svalue::conjured_svalue): Likewise.
1537         (asm_output_svalue::asm_output_svalue): Likewise.
1538         (const_fn_result_svalue::const_fn_result_svalue): Likewise.
1539         * symbol.cc: New file.
1540         * symbol.h: New file.
1541
1542 2023-07-21  David Malcolm  <dmalcolm@redhat.com>
1543
1544         PR analyzer/110455
1545         * region-model.cc (region_model::get_gassign_result): Only check
1546         for bad shift counts when dealing with an integral type.
1547
1548 2023-07-21  David Malcolm  <dmalcolm@redhat.com>
1549
1550         PR analyzer/110433
1551         PR middle-end/110612
1552         * access-diagram.cc (class spatial_item): Add virtual dtor.
1553
1554 2023-07-21  David Malcolm  <dmalcolm@redhat.com>
1555
1556         PR analyzer/110387
1557         * region.h (struct cast_region::key_t): Support "m_type" being
1558         null by using "m_original_region" for empty/deleted slots.
1559
1560 2023-07-19  David Malcolm  <dmalcolm@redhat.com>
1561
1562         PR analyzer/110700
1563         * region-model-manager.cc
1564         (region_model_manager::get_or_create_int_cst): Assert that we have
1565         an integral or pointer type.
1566         * sm-taint.cc (taint_state_machine::check_for_tainted_divisor):
1567         Don't check non-integral types.
1568
1569 2023-06-29  benjamin priour  <priour.be@gmail.com>
1570
1571         PR analyzer/110198
1572         * region-model-manager.cc
1573         (region_model_manager::get_or_create_initial_value): Take an
1574         optional boolean value to bypass poisoning checks
1575         * region-model-manager.h: Update declaration of the above function.
1576         * region-model.cc (region_model::get_store_value): No longer returns
1577         on OOB, but rather gives a boolean to get_or_create_initial_value.
1578         (region_model::check_region_access): Update docstring.
1579         (region_model::check_region_for_write): Update docstring.
1580
1581 2023-06-24  David Malcolm  <dmalcolm@redhat.com>
1582
1583         * access-diagram.cc: Add #define INCLUDE_VECTOR.
1584         * bounds-checking.cc: Likewise.
1585
1586 2023-06-22  David Malcolm  <dmalcolm@redhat.com>
1587
1588         PR analyzer/106626
1589         * access-diagram.cc: New file.
1590         * access-diagram.h: New file.
1591         * analyzer.h (class region_offset): Add default ctor.
1592         (region_offset::make_byte_offset): New decl.
1593         (region_offset::concrete_p): New.
1594         (region_offset::get_concrete_byte_offset): New.
1595         (region_offset::calc_symbolic_bit_offset): New decl.
1596         (region_offset::calc_symbolic_byte_offset): New decl.
1597         (region_offset::dump_to_pp): New decl.
1598         (region_offset::dump): New decl.
1599         (operator<, operator<=, operator>, operator>=): New decls for
1600         region_offset.
1601         * analyzer.opt
1602         (-param=analyzer-text-art-string-ellipsis-threshold=): New.
1603         (-param=analyzer-text-art-string-ellipsis-head-len=): New.
1604         (-param=analyzer-text-art-string-ellipsis-tail-len=): New.
1605         (-param=analyzer-text-art-ideal-canvas-width=): New.
1606         (fanalyzer-debug-text-art): New.
1607         * bounds-checking.cc: Include "intl.h", "diagnostic-diagram.h",
1608         and "analyzer/access-diagram.h".
1609         (class out_of_bounds::oob_region_creation_event_capacity): New.
1610         (out_of_bounds::out_of_bounds): Add "model" and "sval_hint"
1611         params.
1612         (out_of_bounds::mark_interesting_stuff): Use the base region.
1613         (out_of_bounds::add_region_creation_events): Use
1614         oob_region_creation_event_capacity.
1615         (out_of_bounds::get_dir): New pure vfunc.
1616         (out_of_bounds::maybe_show_notes): New.
1617         (out_of_bounds::maybe_show_diagram): New.
1618         (out_of_bounds::make_access_diagram): New.
1619         (out_of_bounds::m_model): New field.
1620         (out_of_bounds::m_sval_hint): New field.
1621         (out_of_bounds::m_region_creation_event_id): New field.
1622         (concrete_out_of_bounds::concrete_out_of_bounds): Update for new
1623         fields.
1624         (concrete_past_the_end::concrete_past_the_end): Likewise.
1625         (concrete_past_the_end::add_region_creation_events): Use
1626         oob_region_creation_event_capacity.
1627         (concrete_buffer_overflow::concrete_buffer_overflow): Update for
1628         new fields.
1629         (concrete_buffer_overflow::emit): Replace call to
1630         maybe_describe_array_bounds with maybe_show_notes.
1631         (concrete_buffer_overflow::get_dir): New.
1632         (concrete_buffer_over_read::concrete_buffer_over_read): Update for
1633         new fields.
1634         (concrete_buffer_over_read::emit): Replace call to
1635         maybe_describe_array_bounds with maybe_show_notes.
1636         (concrete_buffer_overflow::get_dir): New.
1637         (concrete_buffer_underwrite::concrete_buffer_underwrite): Update
1638         for new fields.
1639         (concrete_buffer_underwrite::emit): Replace call to
1640         maybe_describe_array_bounds with maybe_show_notes.
1641         (concrete_buffer_underwrite::get_dir): New.
1642         (concrete_buffer_under_read::concrete_buffer_under_read): Update
1643         for new fields.
1644         (concrete_buffer_under_read::emit): Replace call to
1645         maybe_describe_array_bounds with maybe_show_notes.
1646         (concrete_buffer_under_read::get_dir): New.
1647         (symbolic_past_the_end::symbolic_past_the_end): Update for new
1648         fields.
1649         (symbolic_buffer_overflow::symbolic_buffer_overflow): Likewise.
1650         (symbolic_buffer_overflow::emit): Call maybe_show_notes.
1651         (symbolic_buffer_overflow::get_dir): New.
1652         (symbolic_buffer_over_read::symbolic_buffer_over_read): Update for
1653         new fields.
1654         (symbolic_buffer_over_read::emit): Call maybe_show_notes.
1655         (symbolic_buffer_over_read::get_dir): New.
1656         (region_model::check_symbolic_bounds): Add "sval_hint" param.  Pass
1657         it and sized_offset_reg to diagnostics.
1658         (region_model::check_region_bounds): Add "sval_hint" param, passing
1659         it to diagnostics.
1660         * diagnostic-manager.cc
1661         (diagnostic_manager::emit_saved_diagnostic): Pass logger to
1662         pending_diagnostic::emit.
1663         * engine.cc: Add logger param to pending_diagnostic::emit
1664         implementations.
1665         * infinite-recursion.cc: Likewise.
1666         * kf-analyzer.cc: Likewise.
1667         * kf.cc: Likewise.  Add nullptr for new param of
1668         check_region_for_write.
1669         * pending-diagnostic.h: Likewise in decl.
1670         * region-model-manager.cc
1671         (region_model_manager::get_or_create_int_cst): Convert param from
1672         poly_int64 to const poly_wide_int_ref &.
1673         (region_model_manager::maybe_fold_binop): Support type being NULL
1674         when checking for floating-point types.
1675         Check for (X + Y) - X => Y.  Be less strict about types when folding
1676         associative ops.  Check for (X + Y) * CST => (X * CST) + (Y * CST).
1677         * region-model-manager.h
1678         (region_model_manager::get_or_create_int_cst): Convert param from
1679         poly_int64 to const poly_wide_int_ref &.
1680         * region-model.cc: Add logger param to pending_diagnostic::emit
1681         implementations.
1682         (region_model::check_external_function_for_access_attr): Update
1683         for new param of check_region_for_write.
1684         (region_model::deref_rvalue): Use nullptr rather than NULL.
1685         (region_model::get_capacity): Handle RK_STRING.
1686         (region_model::check_region_access): Add "sval_hint" param; pass it to
1687         check_region_bounds.
1688         (region_model::check_region_for_write): Add "sval_hint" param;
1689         pass it to check_region_access.
1690         (region_model::check_region_for_read): Add NULL for new param to
1691         check_region_access.
1692         (region_model::set_value): Pass rhs_sval to
1693         check_region_for_write.
1694         (region_model::get_representative_path_var_1): Handle SK_CONSTANT
1695         in the check for infinite recursion.
1696         * region-model.h (region_model::check_region_for_write): Add
1697         "sval_hint" param.
1698         (region_model::check_region_access): Likewise.
1699         (region_model::check_symbolic_bounds): Likewise.
1700         (region_model::check_region_bounds): Likewise.
1701         * region.cc (region_offset::make_byte_offset): New.
1702         (region_offset::calc_symbolic_bit_offset): New.
1703         (region_offset::calc_symbolic_byte_offset): New.
1704         (region_offset::dump_to_pp): New.
1705         (region_offset::dump): New.
1706         (struct linear_op): New.
1707         (operator<, operator<=, operator>, operator>=): New, for
1708         region_offset.
1709         (region::get_next_offset): New.
1710         (region::get_relative_symbolic_offset): Use ptrdiff_type_node.
1711         (field_region::get_relative_symbolic_offset): Likewise.
1712         (element_region::get_relative_symbolic_offset): Likewise.
1713         (bit_range_region::get_relative_symbolic_offset): Likewise.
1714         * region.h (region::get_next_offset): New decl.
1715         * sm-fd.cc: Add logger param to pending_diagnostic::emit
1716         implementations.
1717         * sm-file.cc: Likewise.
1718         * sm-malloc.cc: Likewise.
1719         * sm-pattern-test.cc: Likewise.
1720         * sm-sensitive.cc: Likewise.
1721         * sm-signal.cc: Likewise.
1722         * sm-taint.cc: Likewise.
1723         * store.cc (bit_range::contains_p): Allow "out" to be null.
1724         * store.h (byte_range::get_start_bit_offset): New.
1725         (byte_range::get_next_bit_offset): New.
1726         * varargs.cc: Add logger param to pending_diagnostic::emit
1727         implementations.
1728
1729 2023-06-10  Tim Lange  <mail@tim-lange.me>
1730
1731         PR analyzer/109577
1732         * constraint-manager.cc (class sval_finder): Visitor to find
1733         childs in svalue trees.
1734         (constraint_manager::sval_constrained_p): Add new function to
1735         check whether a sval might be part of an constraint.
1736         * constraint-manager.h: Add sval_constrained_p function.
1737         * region-model.cc (class size_visitor): Reverse behavior to not
1738         emit a warning on not explicitly considered cases.
1739         (region_model::check_region_size):
1740         Adapt to size_visitor changes.
1741
1742 2023-06-09  David Malcolm  <dmalcolm@redhat.com>
1743
1744         PR analyzer/110112
1745         * region-model.cc (region_model::get_initial_value_for_global):
1746         Move code to region::calc_initial_value_at_main.
1747         * region.cc (region::get_initial_value_at_main): New function.
1748         (region::calc_initial_value_at_main): New function, based on code
1749         in region_model::get_initial_value_for_global.
1750         (region::region): Initialize m_cached_init_sval_at_main.
1751         (decl_region::get_svalue_for_constructor): Add a cache, splitting
1752         out body to...
1753         (decl_region::calc_svalue_for_constructor): ...this new function.
1754         * region.h (region::get_initial_value_at_main): New decl.
1755         (region::calc_initial_value_at_main): New decl.
1756         (region::m_cached_init_sval_at_main): New field.
1757         (decl_region::decl_region): Initialize m_ctor_svalue.
1758         (decl_region::calc_svalue_for_constructor): New decl.
1759         (decl_region::m_ctor_svalue): New field.
1760
1761 2023-06-08  Benjamin Priour  <vultkayn@gcc.gnu.org>
1762
1763         * bounds-checking.cc (region_model::check_symbolic_bounds): Returns whether the BASE_REG
1764         region access was OOB.
1765         (region_model::check_region_bounds): Likewise.
1766         * region-model.cc (region_model::get_store_value): Creates an
1767         unknown svalue on OOB-read access to REG.
1768         (region_model::check_region_access): Returns whether an unknown svalue needs be created.
1769         (region_model::check_region_for_read): Passes check_region_access return value.
1770         * region-model.h: Update prior function definitions.
1771
1772 2023-06-02  David Malcolm  <dmalcolm@redhat.com>
1773
1774         PR analyzer/109015
1775         * kf.cc (class kf_atomic_exchange): New.
1776         (class kf_atomic_exchange_n): New.
1777         (class kf_atomic_fetch_op): New.
1778         (class kf_atomic_op_fetch): New.
1779         (class kf_atomic_load): New.
1780         (class kf_atomic_load_n): New.
1781         (class kf_atomic_store_n): New.
1782         (register_atomic_builtins): New function.
1783         (register_known_functions): Call register_atomic_builtins.
1784
1785 2023-06-02  David Malcolm  <dmalcolm@redhat.com>
1786
1787         * store.cc (store::eval_alias_1): Regions in different memory
1788         spaces can't alias.
1789
1790 2023-05-18  Bernhard Reutner-Fischer  <aldot@gcc.gnu.org>
1791
1792         * region-model-manager.cc (get_code_for_cast): Use _P defines from
1793         tree.h.
1794         (region_model_manager::get_or_create_cast): Ditto.
1795         (region_model_manager::get_region_for_global): Ditto.
1796         * region-model.cc (region_model::get_lvalue_1): Ditto.
1797         * region.cc (decl_region::maybe_get_constant_value): Ditto.
1798
1799 2023-03-22  David Malcolm  <dmalcolm@redhat.com>
1800
1801         PR analyzer/109239
1802         * program-point.cc: Include "analyzer/inlining-iterator.h".
1803         (program_point::effectively_intraprocedural_p): New function.
1804         * program-point.h (program_point::effectively_intraprocedural_p):
1805         New decl.
1806         * sm-malloc.cc (deref_before_check::emit): Use it when rejecting
1807         interprocedural cases, so that we reject interprocedural cases
1808         that have become intraprocedural due to inlining.
1809
1810 2023-03-18  David Malcolm  <dmalcolm@redhat.com>
1811
1812         PR analyzer/109094
1813         * region-model.cc (region_model::on_longjmp): Pass false for
1814         new "eval_return_svalue" param of pop_frame.
1815         (region_model::pop_frame): Add new "eval_return_svalue" param and
1816         use it to suppress the call to get_rvalue on the result when
1817         needed by on_longjmp.
1818         * region-model.h (region_model::pop_frame): Add new
1819         "eval_return_svalue" param.
1820
1821 2023-03-10  David Malcolm  <dmalcolm@redhat.com>
1822
1823         PR analyzer/109059
1824         * region-model.cc (region_model::mark_region_as_unknown): Gather a
1825         set of maybe-live svalues and call on_maybe_live_values with it.
1826         * store.cc (binding_map::remove_overlapping_bindings): Add new
1827         "maybe_live_values" param; add any removed svalues to it.
1828         (binding_cluster::clobber_region): Add NULL as new param of
1829         remove_overlapping_bindings.
1830         (binding_cluster::mark_region_as_unknown): Add "maybe_live_values"
1831         param and pass it to remove_overlapping_bindings.
1832         (binding_cluster::maybe_get_compound_binding): Add NULL for new
1833         param of binding_map::remove_overlapping_bindings.
1834         (binding_cluster::remove_overlapping_bindings): Add
1835         "maybe_live_values" param and pass to
1836         binding_map::remove_overlapping_bindings.
1837         (store::set_value): Capture a set of maybe-live svalues, and call
1838         on_maybe_live_values with it.
1839         (store::on_maybe_live_values): New.
1840         (store::mark_region_as_unknown): Add "maybe_live_values" param
1841         and pass it to binding_cluster::mark_region_as_unknown.
1842         (store::remove_overlapping_bindings): Pass NULL for new param of
1843         binding_cluster::remove_overlapping_bindings.
1844         * store.h (binding_map::remove_overlapping_bindings): Add
1845         "maybe_live_values" param.
1846         (binding_cluster::mark_region_as_unknown): Likewise.
1847         (binding_cluster::remove_overlapping_bindings): Likewise.
1848         (store::mark_region_as_unknown): Likewise.
1849         (store::on_maybe_live_values): New decl.
1850
1851 2023-03-10  David Malcolm  <dmalcolm@redhat.com>
1852
1853         PR analyzer/108475
1854         PR analyzer/109060
1855         * sm-malloc.cc (deref_before_check::deref_before_check):
1856         Initialize new field m_deref_expr.  Assert that arg is non-NULL.
1857         (deref_before_check::emit): Reject cases where the spelling of the
1858         thing that was dereferenced differs from that of what is checked,
1859         or if the dereference expression was not found.  Remove code to
1860         handle NULL m_arg.
1861         (deref_before_check::describe_state_change): Remove code to handle
1862         NULL m_arg.
1863         (deref_before_check::describe_final_event): Likewise.
1864         (deref_before_check::sufficiently_similar_p): New.
1865         (deref_before_check::m_deref_expr): New field.
1866         (malloc_state_machine::maybe_complain_about_deref_before_check):
1867         Don't warn if the diag_ptr is NULL.
1868
1869 2023-03-03  David Malcolm  <dmalcolm@redhat.com>
1870
1871         * kf.cc (class kf_sprintf): New.
1872         (register_known_functions): Register it.
1873
1874 2023-03-02  David Malcolm  <dmalcolm@redhat.com>
1875
1876         PR analyzer/108968
1877         * region-model.cc (region_model::get_rvalue_1): Handle VAR_DECLs
1878         with a DECL_HARD_REGISTER by returning UNKNOWN.
1879
1880 2023-03-02  Hans-Peter Nilsson  <hp@axis.com>
1881
1882         * kf.cc (register_known_functions): Add __errno function for newlib.
1883
1884 2023-03-01  David Malcolm  <dmalcolm@redhat.com>
1885
1886         PR analyzer/107565
1887         * region-model.cc (region_model::on_call_pre): Flatten logic by
1888         returning early.  Consolidate logic for detecting const and pure
1889         functions.  When considering whether an unhandled built-in
1890         function has side-effects, consider all kinds of builtin, rather
1891         than just BUILT_IN_NORMAL, and don't require
1892         gimple_builtin_call_types_compatible_p.
1893
1894 2023-03-01  David Malcolm  <dmalcolm@redhat.com>
1895
1896         PR analyzer/108935
1897         * infinite-recursion.cc (contains_unknown_p): New.
1898         (sufficiently_different_region_binding_p): New function, splitting
1899         out inner loop from...
1900         (sufficiently_different_p): ...here.  Extend detection of unknown
1901         svalues to also include svalues that contain unknown.  Treat
1902         changes in frames below the entry to the recursion as being
1903         sufficiently different to reject being an infinite recursion.
1904
1905 2023-02-21  David Malcolm  <dmalcolm@redhat.com>
1906
1907         PR analyzer/108830
1908         * analyzer.opt (fanalyzer-suppress-followups): New option.
1909         * engine.cc (impl_region_model_context::warn): Terminate the path
1910         if the diagnostic's terminate_path_p vfunc returns true and
1911         -fanalyzer-suppress-followups is true (the default).
1912         (impl_sm_context::warn): Likewise, for both overloads.
1913         * pending-diagnostic.h (pending_diagnostic::terminate_path_p): New
1914         vfunc.
1915         * program-state.cc (program_state::on_edge): Terminate the path if
1916         the ctxt requests it during updating the edge.
1917         * region-model.cc (poisoned_value_diagnostic::terminate_path_p):
1918         New vfunc.
1919         * sm-malloc.cc (null_deref::terminate_path_p): New vfunc.
1920         (null_arg::terminate_path_p): New vfunc.
1921
1922 2023-02-16  David Malcolm  <dmalcolm@redhat.com>
1923
1924         PR analyzer/108806
1925         * constraint-manager.cc (bounded_range::dump_to_pp): Use
1926         bounded_range::singleton_p.
1927         (constraint_manager::add_bounded_ranges): Handle singleton ranges
1928         by adding an EQ_EXPR constraint.
1929         (constraint_manager::impossible_derived_conditions_p): New.
1930         (constraint_manager::eval_condition): Reject EQ_EXPR when it would
1931         imply impossible derived conditions.
1932         (selftest::test_bits): New.
1933         (selftest::run_constraint_manager_tests): Run it.
1934         * constraint-manager.h (bounded_range::singleton_p): New.
1935         (constraint_manager::impossible_derived_conditions_p): New decl.
1936         * region-model.cc (region_model::get_rvalue_1): Handle
1937         BIT_AND_EXPR, BIT_IOR_EXPR, and BIT_XOR_EXPR.
1938
1939 2023-02-15  David Malcolm  <dmalcolm@redhat.com>
1940
1941         PR analyzer/108664
1942         PR analyzer/108666
1943         PR analyzer/108725
1944         * diagnostic-manager.cc (epath_finder::get_best_epath): Add
1945         "target_stmt" param.
1946         (epath_finder::explore_feasible_paths): Likewise.
1947         (epath_finder::process_worklist_item): Likewise.
1948         (saved_diagnostic::calc_best_epath): Pass m_stmt to
1949         epath_finder::get_best_epath.
1950         * engine.cc (feasibility_state::maybe_update_for_edge): Move
1951         per-stmt logic to...
1952         (feasibility_state::update_for_stmt): ...this new function.
1953         * exploded-graph.h (feasibility_state::update_for_stmt): New decl.
1954         * feasible-graph.cc (feasible_node::get_state_at_stmt): New.
1955         * feasible-graph.h: Include "analyzer/exploded-graph.h".
1956         (feasible_node::get_state_at_stmt): New decl.
1957         * infinite-recursion.cc
1958         (infinite_recursion_diagnostic::check_valid_fpath_p): Update for
1959         vfunc signature change.
1960         * pending-diagnostic.h (pending_diagnostic::check_valid_fpath_p):
1961         Convert first param to a reference.  Add stmt param.
1962         * region-model.cc: Include "analyzer/feasible-graph.h".
1963         (poisoned_value_diagnostic::poisoned_value_diagnostic): Add
1964         "check_expr" param.
1965         (poisoned_value_diagnostic::check_valid_fpath_p): New.
1966         (poisoned_value_diagnostic::m_check_expr): New field.
1967         (region_model::check_for_poison): Attempt to supply a check_expr
1968         to the diagnostic
1969         (region_model::deref_rvalue): Add NULL for new check_expr param
1970         of poisoned_value_diagnostic.
1971         (region_model::get_or_create_region_for_heap_alloc): Don't reuse
1972         regions that are marked as TOUCHED.
1973
1974 2023-02-10  David Malcolm  <dmalcolm@redhat.com>
1975
1976         PR analyzer/108745
1977         * sm-malloc.cc (deref_before_check::emit): Reject the warning if
1978         the check occurs within a macro defintion.
1979
1980 2023-02-09  David Malcolm  <dmalcolm@redhat.com>
1981
1982         PR analyzer/108733
1983         * state-purge.cc (get_candidate_for_purging): Add ADDR_EXPR
1984         and MEM_REF.
1985
1986 2023-02-08  David Malcolm  <dmalcolm@redhat.com>
1987
1988         PR analyzer/108704
1989         * state-purge.cc (state_purge_per_decl::process_point_backwards):
1990         Don't stop processing the decl if it's fully overwritten by
1991         this stmt if it's also used by this stmt.
1992
1993 2023-02-07  David Malcolm  <dmalcolm@redhat.com>
1994
1995         PR analyzer/108661
1996         * sm-fd.cc (class kf_read): New.
1997         (register_known_fd_functions): Register "read".
1998         * sm-file.cc (class kf_fread): Update comment.
1999
2000 2023-02-02  David Malcolm  <dmalcolm@redhat.com>
2001
2002         PR analyzer/108633
2003         * sm-fd.cc (fd_state_machine::check_for_fd_attrs): Add missing
2004         "continue".
2005         (fd_state_machine::on_listen): Don't issue phase-mismatch or
2006         type-mismatch warnings for the "invalid" state.
2007
2008 2023-02-01  David Malcolm  <dmalcolm@redhat.com>
2009
2010         PR analyzer/108616
2011         * pending-diagnostic.cc (fixup_location_in_macro_p): Add "alloca"
2012         to macros that we shouldn't unwind inside.
2013
2014 2023-01-26  David Malcolm  <dmalcolm@redhat.com>
2015
2016         PR analyzer/108524
2017         * analyzer.h (class feasible_node): New forward decl.
2018         * diagnostic-manager.cc (epath_finder::get_best_epath): Add "pd"
2019         param.
2020         (epath_finder::explore_feasible_paths): Likewise.
2021         (epath_finder::process_worklist_item): Likewise.  Use it to call
2022         pending_diagnostic::check_valid_fpath_p on the final fpath to
2023         give pending_diagnostic a way to add additional restrictions on
2024         feasibility.
2025         (saved_diagnostic::calc_best_epath): Pass pending_diagnostic to
2026         epath_finder::get_best_epath.
2027         * infinite-recursion.cc: Include "analyzer/feasible-graph.h".
2028         (infinite_recursion_diagnostic::check_valid_fpath_p): New.
2029         (infinite_recursion_diagnostic::fedge_uses_conjured_svalue_p): New.
2030         (infinite_recursion_diagnostic::expr_uses_conjured_svalue_p): New.
2031         * pending-diagnostic.h (pending_diagnostic::check_valid_fpath_p):
2032         New vfunc.
2033
2034 2023-01-19  David Malcolm  <dmalcolm@redhat.com>
2035
2036         PR analyzer/108455
2037         * analyzer.h (class checker_event): New forward decl.
2038         (class state_change_event): Indent.
2039         (class warning_event): New forward decl.
2040         * checker-event.cc (state_change_event::state_change_event): Add
2041         "enode" param.
2042         (warning_event::get_desc): Update for new param of
2043         evdesc::final_event ctor.
2044         * checker-event.h (state_change_event::state_change_event): Add
2045         "enode" param.
2046         (state_change_event::get_exploded_node): New accessor.
2047         (state_change_event::m_enode): New field.
2048         (warning_event::warning_event): New "enode" param.
2049         (warning_event::get_exploded_node): New accessor.
2050         (warning_event::m_enode): New field.
2051         * diagnostic-manager.cc
2052         (state_change_event_creator::on_global_state_change): Pass
2053         src_node to state_change_event ctor.
2054         (state_change_event_creator::on_state_change): Likewise.
2055         (null_assignment_sm_context::set_next_state): Pass NULL for
2056         new param of state_change_event ctor.
2057         * infinite-recursion.cc
2058         (infinite_recursion_diagnostic::add_final_event): Update for new
2059         param of warning_event ctor.
2060         * pending-diagnostic.cc (pending_diagnostic::add_final_event):
2061         Pass enode to warning_event ctor.
2062         * pending-diagnostic.h (evdesc::final_event): Add reference to
2063         warning_event.
2064         * sm-malloc.cc: Include "analyzer/checker-event.h" and
2065         "analyzer/exploded-graph.h".
2066         (deref_before_check::deref_before_check): Initialize new fields.
2067         (deref_before_check::emit): Reject warnings in which we were
2068         unable to determine the enodes of the dereference and the check.
2069         Reject warnings interprocedural warnings. Reject warnings in which
2070         the dereference doesn't dominate the check.
2071         (deref_before_check::describe_state_change): Set m_deref_enode.
2072         (deref_before_check::describe_final_event): Set m_check_enode.
2073         (deref_before_check::m_deref_enode): New field.
2074         (deref_before_check::m_check_enode): New field.
2075
2076 2023-01-13  David Malcolm  <dmalcolm@redhat.com>
2077
2078         PR analyzer/105273
2079         * region-model.cc (has_nondefault_case_for_value_p): New.
2080         (has_nondefault_cases_for_all_enum_values_p): New.
2081         (region_model::apply_constraints_for_gswitch): Skip
2082         implicitly-created "default" when switching on an enum
2083         and all enum values have non-default cases.
2084         (rejected_default_case::dump_to_pp): New.
2085         * region-model.h (region_model_context::possibly_tainted_p): New
2086         decl.
2087         (class rejected_default_case): New.
2088         * sm-taint.cc (region_model_context::possibly_tainted_p): New.
2089         * supergraph.cc (switch_cfg_superedge::dump_label_to_pp): Dump
2090         when implicitly_created_default_p.
2091         (switch_cfg_superedge::implicitly_created_default_p): New.
2092         * supergraph.h
2093         (switch_cfg_superedge::implicitly_created_default_p): New decl.
2094
2095 2023-01-11  David Malcolm  <dmalcolm@redhat.com>
2096
2097         PR analyzer/108252
2098         * kf.cc (class kf_strdup): New.
2099         (class kf_strndup): New.
2100         (register_known_functions): Register them.
2101         * region-model.cc (region_model::on_call_pre): Use
2102         &HEAP_ALLOCATED_REGION for the default result of an external
2103         function with the "malloc" attribute, rather than CONJURED_SVALUE.
2104         (region_model::get_or_create_region_for_heap_alloc): Allow
2105         "size_in_bytes" to be NULL.
2106         * store.cc (store::set_value): When handling *UNKNOWN = VAL,
2107         mark VAL as "maybe bound".
2108
2109 2022-12-16  David Malcolm  <dmalcolm@redhat.com>
2110
2111         PR analyzer/106479
2112         * kf.cc (kf_memcpy_memmove::impl_call_pre): Pass in source region
2113         to region_model::check_for_poison.
2114         * region-model-asm.cc (region_model::on_asm_stmt): Pass NULL
2115         region to region_model::check_for_poison.
2116         * region-model.cc (region_model::check_for_poison): Add
2117         "src_region" param, and pass it to poisoned_value_diagnostic.
2118         (region_model::on_assignment): Pass NULL region to
2119         region_model::check_for_poison.
2120         (region_model::get_rvalue): Likewise.
2121         * region-model.h (region_model::check_for_poison): Add
2122         "src_region" param.
2123         * sm-fd.cc (fd_state_machine::on_accept): Pass in source region
2124         to region_model::check_for_poison.
2125         * varargs.cc (kf_va_copy::impl_call_pre): Pass NULL region to
2126         region_model::check_for_poison.
2127         (kf_va_arg::impl_call_pre): Pass in source region to
2128         region_model::check_for_poison.
2129
2130 2022-12-14  David Malcolm  <dmalcolm@redhat.com>
2131
2132         PR analyzer/108065
2133         * region.cc (decl_region::get_svalue_for_initializer): Bail out to
2134         avoid calling binding_key::make with an empty region.
2135         * store.cc (binding_map::apply_ctor_val_to_range): Likewise.
2136         (binding_map::apply_ctor_pair_to_child_region): Likewise.
2137         (binding_cluster::bind): Likewise.
2138         (binding_cluster::purge_region): Likewise.
2139         (binding_cluster::maybe_get_compound_binding): Likewise.
2140         (binding_cluster::maybe_get_simple_value): Likewise.
2141
2142 2022-12-09  David Malcolm  <dmalcolm@redhat.com>
2143
2144         * analyzer.h (class known_function): Expand comment.
2145         * region-model-impl-calls.cc: Rename to...
2146         * kf.cc: ...this.
2147         * known-function-manager.h (class known_function_manager): Add
2148         leading comment.
2149
2150 2022-12-09  David Malcolm  <dmalcolm@redhat.com>
2151
2152         PR analyzer/108003
2153         * call-summary.cc
2154         (call_summary_replay::convert_region_from_summary_1): Convert
2155         heap_regs_in_use from auto_sbitmap to auto_bitmap.
2156         * region-model-manager.cc
2157         (region_model_manager::get_or_create_region_for_heap_alloc):
2158         Convert from sbitmap to bitmap.
2159         * region-model-manager.h: Likewise.
2160         * region-model.cc
2161         (region_model::get_or_create_region_for_heap_alloc): Convert from
2162         auto_sbitmap to auto_bitmap.
2163         (region_model::get_referenced_base_regions): Likewise.
2164         * region-model.h: Include "bitmap.h" rather than "sbitmap.h".
2165         (region_model::get_referenced_base_regions): Convert from
2166         auto_sbitmap to auto_bitmap.
2167
2168 2022-12-09  David Malcolm  <dmalcolm@redhat.com>
2169
2170         * region-model-impl-calls.cc (class kf_memcpy): Rename to...
2171         (class kf_memcpy_memmove): ...this.
2172         (kf_memcpy::impl_call_pre): Rename to...
2173         (kf_memcpy_memmove::impl_call_pre): ...this, and check the src for
2174         poison.
2175         (register_known_functions): Update for above renaming, and
2176         register BUILT_IN_MEMMOVE and BUILT_IN_MEMMOVE_CHK.
2177
2178 2022-12-06  David Malcolm  <dmalcolm@redhat.com>
2179
2180         PR analyzer/107882
2181         * region-model.cc (region_model::get_store_value): Return an
2182         unknown value for empty regions.
2183         (region_model::set_value): Bail on empty regions.
2184         * region.cc (region::empty_p): New.
2185         * region.h (region::empty_p): New decl.
2186         * state-purge.cc (same_binding_p): Bail if either region is empty.
2187         * store.cc (binding_key::make): Assert that a concrete binding's
2188         bit_size must be > 0.
2189         (binding_cluster::mark_region_as_unknown): Bail on empty regions.
2190         (binding_cluster::get_binding): Likewise.
2191         (binding_cluster::remove_overlapping_bindings): Likewise.
2192         (binding_cluster::on_unknown_fncall): Don't conjure values for
2193         empty regions.
2194         (store::fill_region): Bail on empty regions.
2195         * store.h (class concrete_binding): Update comment to reflect that
2196         the range of bits must be non-empty.
2197         (concrete_binding::concrete_binding): Assert that bit range is
2198         non-empty.
2199
2200 2022-12-06  David Malcolm  <dmalcolm@redhat.com>
2201
2202         PR analyzer/106325
2203         * region-model-manager.cc
2204         (region_model_manager::get_or_create_null_ptr): New.
2205         * region-model-manager.h
2206         (region_model_manager::get_or_create_null_ptr): New decl.
2207         * region-model.cc (region_model::on_top_level_param): Add
2208         "nonnull" param and make use of it.
2209         (region_model::push_frame): When handling a top-level entrypoint
2210         to the analysis, determine which params __attribute__((nonnull))
2211         applies to, and pass to on_top_level_param.
2212         * region-model.h (region_model::on_top_level_param): Add "nonnull"
2213         param.
2214
2215 2022-12-06  David Malcolm  <dmalcolm@redhat.com>
2216
2217         * analyzer.h (register_known_analyzer_functions): New decl.
2218         (register_known_functions_lang_cp): New decl.
2219         * call-details.cc: New file, split out from
2220         region-model-impl-calls.cc.
2221         * call-details.h: New file, split out from region-model.h.
2222         * call-info.cc: Include "analyzer/call-details.h".
2223         * call-summary.h: Likewise.
2224         * kf-analyzer.cc: New file, split out from
2225         region-model-impl-calls.cc.
2226         * kf-lang-cp.cc: Likewise.
2227         * known-function-manager.cc: Include "analyzer/call-details.h".
2228         * region-model-impl-calls.cc: Move definitions of call_details's
2229         member functions to call-details.cc.  Move class kf_analyzer_* to
2230         kf-analyzer.cc.  Move kf_operator_new and kf_operator_delete to
2231         kf-lang-cp.cc.  Refresh #includes accordingly.
2232         (register_known_functions): Replace registration of __analyzer_*
2233         functions with a call to register_known_analyzer_functions.
2234         Replace registration of C++ support functions with a call to
2235         register_known_functions_lang_cp.
2236         * region-model.h (class call_details): Move to new call-details.h.
2237         * sm-fd.cc: Include "analyzer/call-details.h".
2238         * sm-file.cc: Likewise.
2239         * sm-malloc.cc: Likewise.
2240         * varargs.cc: Likewise.
2241
2242 2022-12-02  David Malcolm  <dmalcolm@redhat.com>
2243
2244         * analyzer.h (struct event_loc_info): New forward decl.
2245         * bounds-checking.cc: Use event_loc_info throughout to bundle the
2246         loc, fndecl, depth triples.
2247         * call-info.cc: Likewise.
2248         * checker-event.cc: Likewise.
2249         * checker-event.h (struct event_loc_info): New decl.  Use it
2250         throughout to bundle the loc, fndecl, depth triples.
2251         * checker-path.cc: Likewise.
2252         * checker-path.h: Likewise.
2253         * diagnostic-manager.cc: Likewise.
2254         * engine.cc: Likewise.
2255         * infinite-recursion.cc: Likewise.
2256         * pending-diagnostic.cc: Likewise.
2257         * pending-diagnostic.h: Likewise.
2258         * region-model.cc: Likewise.
2259         * sm-signal.cc: Likewise.
2260         * varargs.cc: Likewise.
2261
2262 2022-12-02  David Malcolm  <dmalcolm@redhat.com>
2263
2264         PR analyzer/107851
2265         * analyzer.cc (make_label_text_n): Convert param "n" from int to
2266         unsigned HOST_WIDE_INT.
2267         * analyzer.h (make_label_text_n): Likewise for decl.
2268         * bounds-checking.cc: Include "analyzer/checker-event.h" and
2269         "analyzer/checker-path.h".
2270         (out_of_bounds::add_region_creation_events): New.
2271         (concrete_past_the_end::describe_region_creation_event): Replace
2272         with...
2273         (concrete_past_the_end::add_region_creation_events): ...this.
2274         (symbolic_past_the_end::describe_region_creation_event): Delete.
2275         * checker-event.cc (region_creation_event::region_creation_event):
2276         Update for dropping all member data.
2277         (region_creation_event::get_desc): Delete, splitting out into
2278         region_creation_event_memory_space::get_desc,
2279         region_creation_event_capacity::get_desc, and
2280         region_creation_event_debug::get_desc.
2281         (region_creation_event_memory_space::get_desc): New.
2282         (region_creation_event_capacity::get_desc): New.
2283         (region_creation_event_allocation_size::get_desc): New.
2284         (region_creation_event_debug::get_desc): New.
2285         * checker-event.h: Include "analyzer/program-state.h".
2286         (enum rce_kind): Delete.
2287         (class region_creation_event): Drop all member data.
2288         (region_creation_event::region_creation_event): Make protected.
2289         (region_creation_event::get_desc): Delete.
2290         (class region_creation_event_memory_space): New.
2291         (class region_creation_event_capacity): New.
2292         (class region_creation_event_allocation_size): New.
2293         (class region_creation_event_debug): New.
2294         * checker-path.cc (checker_path::add_region_creation_events): Add
2295         "pd" param.  Call pending_diangnostic::add_region_creation_events.
2296         Update for conversion of RCE_DEBUG to region_creation_event_debug.
2297         * checker-path.h (checker_path::add_region_creation_events): Add
2298         "pd" param.
2299         * diagnostic-manager.cc (diagnostic_manager::build_emission_path):
2300         Pass pending_diagnostic to
2301         emission_path::add_region_creation_events.
2302         (diagnostic_manager::build_emission_path): Pass path_builder to
2303         add_event_on_final_node.
2304         (diagnostic_manager::add_event_on_final_node): Add "pb" param.
2305         Pass pending_diagnostic to
2306         emission_path::add_region_creation_events.
2307         (diagnostic_manager::add_events_for_eedge): Pass
2308         pending_diagnostic to emission_path::add_region_creation_events.
2309         * diagnostic-manager.h
2310         (diagnostic_manager::add_event_on_final_node): Add "pb" param.
2311         * pending-diagnostic.cc
2312         (pending_diagnostic::add_region_creation_events): New.
2313         * pending-diagnostic.h (struct region_creation): Delete.
2314         (pending_diagnostic::describe_region_creation_event): Delete.
2315         (pending_diagnostic::add_region_creation_events): New vfunc.
2316         * region-model.cc: Include "analyzer/checker-event.h" and
2317         "analyzer/checker-path.h".
2318         (dubious_allocation_size::dubious_allocation_size): Initialize
2319         m_has_allocation_event.
2320         (dubious_allocation_size::describe_region_creation_event): Delete.
2321         (dubious_allocation_size::describe_final_event): Update for
2322         replacement of m_allocation_event with m_has_allocation_event.
2323         (dubious_allocation_size::add_region_creation_events): New.
2324         (dubious_allocation_size::m_allocation_event): Replace with...
2325         (dubious_allocation_size::m_has_allocation_event): ...this.
2326
2327 2022-12-02  David Malcolm  <dmalcolm@redhat.com>
2328
2329         PR analyzer/107948
2330         * region-model-manager.cc
2331         (region_model_manager::maybe_fold_binop): Fold (0 - VAL) to -VAL.
2332         * region-model.cc (region_model::eval_condition): Handle e.g.
2333         "-X <= 0" as equivalent to X >= 0".
2334
2335 2022-12-01  David Malcolm  <dmalcolm@redhat.com>
2336
2337         PR analyzer/106626
2338         * bounds-checking.cc
2339         (symbolic_past_the_end::describe_final_event): Delete, moving to
2340         symbolic_buffer_overflow::describe_final_event and
2341         symbolic_buffer_over_read::describe_final_event, eliminating
2342         composition of text strings via "byte_str" and "m_dir_str".
2343         (symbolic_past_the_end::m_dir_str): Delete field.
2344         (symbolic_buffer_overflow::symbolic_buffer_overflow): Drop
2345         m_dir_str.
2346         (symbolic_buffer_overflow::describe_final_event): New, as noted
2347         above.
2348         (symbolic_buffer_over_read::symbolic_buffer_overflow): Drop
2349         m_dir_str.
2350         (symbolic_buffer_over_read::describe_final_event): New, as noted
2351         above.
2352
2353 2022-12-01  David Malcolm  <dmalcolm@redhat.com>
2354
2355         * bounds-checking.cc (class out_of_bounds): Split out from...
2356         (class concrete_out_of_bounds): New abstract subclass.
2357         (class past_the_end): Rename to...
2358         (class concrete_past_the_end): ...this, and make a subclass of
2359         concrete_out_of_bounds.
2360         (class buffer_overflow): Rename to...
2361         (class concrete_buffer_overflow): ...this, and make a subclass of
2362         concrete_past_the_end.
2363         (class buffer_over_read): Rename to...
2364         (class concrete_buffer_over_read): ...this, and make a subclass of
2365         concrete_past_the_end.
2366         (class buffer_underwrite): Rename to...
2367         (class concrete_buffer_underwrite): ...this, and make a subclass
2368         of concrete_out_of_bounds.
2369         (class buffer_under_read): Rename to...
2370         (class concrete_buffer_under_read): ...this, and make a subclass
2371         of concrete_out_of_bounds.
2372         (class symbolic_past_the_end): Convert to a subclass of
2373         out_of_bounds.
2374         (symbolic_buffer_overflow::get_kind): New.
2375         (symbolic_buffer_over_read::get_kind): New.
2376         (region_model::check_region_bounds): Update for renamings.
2377         * engine.cc (impl_sm_context::set_next_state): Eliminate
2378         "new_ctxt", passing NULL to get_rvalue instead.
2379         (impl_sm_context::warn): Likewise.
2380
2381 2022-12-01  David Malcolm  <dmalcolm@redhat.com>
2382
2383         PR analyzer/106626
2384         * bounds-checking.cc (out_of_bounds::get_memory_space): New.
2385         (buffer_overflow::emit): Use it.
2386         (class buffer_overread): Rename to...
2387         (class buffer_over_read): ...this.
2388         (buffer_over_read::emit): Specify which memory space the read is
2389         from, where known.  Change "overread" to "over-read".
2390         (class buffer_underflow): Rename to...
2391         (class buffer_underwrite): ...this.
2392         (buffer_underwrite::emit): Specify which memory space the write is
2393         to, where known.  Change "underflow" to "underwrite".
2394         (class buffer_underread): Rename to...
2395         (class buffer_under_read): Rename to...
2396         (buffer_under_read::emit): Specify which memory space the read is
2397         from, where known.  Change "underread" to "under-read".
2398         (symbolic_past_the_end::get_memory_space): New.
2399         (symbolic_buffer_overflow::emit): Use it.
2400         (class symbolic_buffer_overread): Rename to...
2401         (class symbolic_buffer_over_read): ...this.
2402         (symbolic_buffer_over_read::emit): Specify which memory space the
2403         read is from, where known.  Change "overread" to "over-read".
2404         (region_model::check_symbolic_bounds): Update for class renaming.
2405         (region_model::check_region_bounds): Likewise.
2406
2407 2022-12-01  David Malcolm  <dmalcolm@redhat.com>
2408
2409         PR analyzer/106626
2410         * bounds-checking.cc (out_of_bounds::maybe_describe_array_bounds):
2411         New.
2412         (buffer_overflow::emit): Call maybe_describe_array_bounds.
2413         (buffer_overread::emit): Likewise.
2414         (buffer_underflow::emit): Likewise.
2415         (buffer_underread::emit): Likewise.
2416
2417 2022-12-01  David Malcolm  <dmalcolm@redhat.com>
2418
2419         PR analyzer/106626
2420         * bounds-checking.cc (buffer_overflow::emit): Use inform_n.
2421         Update wording to clarify that we're talking about the size of
2422         the bad access, rather than its position.
2423         (buffer_overread::emit): Likewise.
2424
2425 2022-12-01  David Malcolm  <dmalcolm@redhat.com>
2426
2427         * bounds-checking.cc: New file, taken from region-model.cc.
2428         * region-model.cc (class out_of_bounds): Move to
2429         bounds-checking.cc.
2430         (class past_the_end): Likewise.
2431         (class buffer_overflow): Likewise.
2432         (class buffer_overread): Likewise.
2433         (class buffer_underflow): Likewise.
2434         (class buffer_underread): Likewise.
2435         (class symbolic_past_the_end): Likewise.
2436         (class symbolic_buffer_overflow): Likewise.
2437         (class symbolic_buffer_overread): Likewise.
2438         (region_model::check_symbolic_bounds): Likewise.
2439         (maybe_get_integer_cst_tree): Likewise.
2440         (region_model::check_region_bounds): Likewise.
2441         * region-model.h: Add comment.
2442
2443 2022-12-01  David Malcolm  <dmalcolm@redhat.com>
2444
2445         PR analyzer/107928
2446         * sm-fd.cc (fd_state_machine::on_bind): Handle m_constant_fd in
2447         the "success" outcome.
2448         (fd_state_machine::on_connect): Likewise.
2449         * sm-fd.dot: Add "constant_fd" state and its transitions.
2450
2451 2022-11-30  David Malcolm  <dmalcolm@redhat.com>
2452
2453         * region-model-impl-calls.cc (class kf_fgets): Move to sm-file.cc.
2454         (kf_fgets::impl_call_pre): Likewise.
2455         (class kf_fread): Likewise.
2456         (kf_fread::impl_call_pre): Likewise.
2457         (class kf_getchar): Likewise.
2458         (class kf_stdio_output_fn): Likewise.
2459         (register_known_functions): Move registration of
2460         BUILT_IN_FPRINTF, BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_FPUTC,
2461         BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
2462         BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
2463         BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTCHAR,
2464         BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_PUTS,
2465         BUILT_IN_PUTS_UNLOCKED, BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF,
2466         "getchar", "fgets", "fgets_unlocked", and "fread" to
2467         register_known_file_functions.
2468         * sm-file.cc (class kf_stdio_output_fn): Move here from
2469         region-model-impl-calls.cc.
2470         (class kf_fgets): Likewise.
2471         (class kf_fread): Likewise.
2472         (class kf_getchar): Likewise.
2473         (register_known_file_functions): Move registration of
2474         BUILT_IN_FPRINTF, BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_FPUTC,
2475         BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
2476         BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
2477         BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTCHAR,
2478         BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_PUTS,
2479         BUILT_IN_PUTS_UNLOCKED, BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF,
2480         "fgets", "fgets_unlocked", "fread", and "getchar" to here from
2481         register_known_functions.
2482
2483 2022-11-30  David Malcolm  <dmalcolm@redhat.com>
2484
2485         PR analyzer/103546
2486         * analyzer.h (register_known_file_functions): New decl.
2487         * program-state.cc (sm_state_map::replay_call_summary): Rejct
2488         attempts to store sm-state for caller_sval that can't have
2489         associated state.
2490         * region-model-impl-calls.cc (register_known_functions): Call
2491         register_known_file_functions.
2492         * sm-fd.cc (class kf_isatty): New.
2493         (register_known_fd_functions): Register it.
2494         * sm-file.cc (class kf_ferror): New.
2495         (class kf_fileno): New.
2496         (class kf_getc): New.
2497         (register_known_file_functions): New.
2498
2499 2022-11-30  David Malcolm  <dmalcolm@redhat.com>
2500
2501         PR analyzer/105784
2502         * region-model-manager.cc
2503         (region_model_manager::maybe_fold_binop): For POINTER_PLUS_EXPR,
2504         PLUS_EXPR and MINUS_EXPR, eliminate requirement that the final
2505         type matches that of arg0 in favor of a cast.
2506
2507 2022-11-24  Martin Liska  <mliska@suse.cz>
2508
2509         * varargs.cc: Fix Clang warnings.
2510
2511 2022-11-24  David Malcolm  <dmalcolm@redhat.com>
2512
2513         PR analyzer/106473
2514         * call-summary.cc
2515         (call_summary_replay::convert_region_from_summary_1): Update for
2516         change to creation of heap-allocated regions.
2517         * program-state.cc (test_program_state_1): Likewise.
2518         (test_program_state_merging): Likewise.
2519         * region-model-impl-calls.cc (kf_calloc::impl_call_pre): Likewise.
2520         (kf_malloc::impl_call_pre): Likewise.
2521         (kf_operator_new::impl_call_pre): Likewise.
2522         (kf_realloc::impl_call_postsuccess_with_move::update_model): Likewise.
2523         * region-model-manager.cc
2524         (region_model_manager::create_region_for_heap_alloc): Convert
2525         to...
2526         (region_model_manager::get_or_create_region_for_heap_alloc):
2527         ...this, reusing an existing region if it's unreferenced in the
2528         client state.
2529         * region-model-manager.h (region_model_manager::get_num_regions): New.
2530          (region_model_manager::create_region_for_heap_alloc): Convert to...
2531          (region_model_manager::get_or_create_region_for_heap_alloc): ...this.
2532         * region-model.cc (region_to_value_map::can_merge_with_p): Reject
2533         merger when the values are different.
2534         (region_model::create_region_for_heap_alloc): Convert to...
2535         (region_model::get_or_create_region_for_heap_alloc): ...this.
2536         (region_model::get_referenced_base_regions): New.
2537         (selftest::test_state_merging):  Update for change to creation of
2538         heap-allocated regions.
2539         (selftest::test_malloc_constraints): Likewise.
2540         (selftest::test_malloc): Likewise.
2541         * region-model.h: Include "sbitmap.h".
2542         (region_model::create_region_for_heap_alloc): Convert to...
2543         (region_model::get_or_create_region_for_heap_alloc): ...this.
2544         (region_model::get_referenced_base_regions): New decl.
2545         * store.cc (store::canonicalize): Don't purge a heap-allocated region
2546         that's been marked as escaping.
2547
2548 2022-11-24  David Malcolm  <dmalcolm@redhat.com>
2549
2550         * checker-path.cc (checker_path::inject_any_inlined_call_events):
2551         Don't dump the address of the block when -fdump-noaddr.
2552
2553 2022-11-24  David Malcolm  <dmalcolm@redhat.com>
2554
2555         * region-model.h (region_model::on_socket): Delete decl.
2556         (region_model::on_bind): Likewise.
2557         (region_model::on_listen): Likewise.
2558         (region_model::on_accept): Likewise.
2559         (region_model::on_connect): Likewise.
2560         * sm-fd.cc (kf_socket::outcome_of_socket::update_model): Move body
2561         of region_model::on_socket into here, ...
2562         (region_model::on_socket): ...eliminating this function.
2563         (kf_bind::outcome_of_bind::update_model): Likewise for on_bind...
2564         (region_model::on_bind): ...eliminating this function.
2565         (kf_listen::outcome_of_listen::update_model): Likewise fo
2566         on_listen...
2567         (region_model::on_listen): ...eliminating this function.
2568         (kf_accept::outcome_of_accept::update_model): Likewise fo
2569         on_accept...
2570         (region_model::on_accept): ...eliminating this function.
2571         (kf_connect::outcome_of_connect::update_model): Likewise fo
2572         on_connect...
2573         (region_model::on_connect): ...eliminating this function.
2574
2575 2022-11-24  David Malcolm  <dmalcolm@redhat.com>
2576
2577         * analyzer.h (register_known_fd_functions): New decl.
2578         * region-model-impl-calls.cc (class kf_accept): Move to sm-fd.cc.
2579         (class kf_bind): Likewise.
2580         (class kf_connect): Likewise.
2581         (class kf_listen): Likewise.
2582         (class kf_pipe): Likewise.
2583         (class kf_socket): Likewise.
2584         (register_known_functions): Remove registration of the above
2585         functions, instead calling register_known_fd_functions.
2586         * sm-fd.cc: Include "analyzer/call-info.h".
2587         (class kf_socket): Move here from region-model-impl-calls.cc.
2588         (class kf_bind): Likewise.
2589         (class kf_listen): Likewise.
2590         (class kf_accept): Likewise.
2591         (class kf_connect): Likewise.
2592         (class kf_pipe): Likewise.
2593         (register_known_fd_functions): New.
2594
2595 2022-11-22  David Malcolm  <dmalcolm@redhat.com>
2596
2597         PR analyzer/107788
2598         * known-function-manager.cc (known_function_manager::get_match):
2599         Don't look up fndecls by name when they're not in the root
2600         namespace.
2601
2602 2022-11-22  David Malcolm  <dmalcolm@redhat.com>
2603
2604         PR analyzer/107783
2605         * sm-fd.cc (fd_state_machine::check_for_new_socket_fd): Don't
2606         complain when old state is "fd-constant".
2607         (fd_state_machine::on_listen): Likewise.
2608         (fd_state_machine::on_accept): Likewise.
2609
2610 2022-11-22  David Malcolm  <dmalcolm@redhat.com>
2611
2612         PR analyzer/107807
2613         * region-model-impl-calls.cc (register_known_functions): Register
2614         "___errno" and "__error" as synonyms  for "__errno_location".
2615
2616 2022-11-22  David Malcolm  <dmalcolm@redhat.com>
2617
2618         * analyzer.h (class internal_known_function): New.
2619         (register_varargs_builtins): New decl.
2620         * engine.cc (exploded_node::on_stmt_pre): Remove
2621         "out_terminate_path" param from call to region_model::on_stmt_pre.
2622         (feasibility_state::maybe_update_for_edge): Likewise.
2623         * known-function-manager.cc: Include "basic-block.h", "gimple.h",
2624         and "analyzer/region-model.h".
2625         (known_function_manager::known_function_manager): Initialize
2626         m_combined_fns_arr.
2627         (known_function_manager::~known_function_manager): Clean up
2628         m_combined_fns_arr.
2629         (known_function_manager::get_by_identifier): Make const.
2630         (known_function_manager::add): New overloaded definitions for
2631         enum built_in_function and enum internal_fn.
2632         (known_function_manager::get_by_fndecl): Delete.
2633         (known_function_manager::get_match): New.
2634         (known_function_manager::get_internal_fn): New.
2635         (known_function_manager::get_normal_builtin): New.
2636         * known-function-manager.h
2637         (known_function_manager::get_by_identifier): Make private and
2638         add const qualifier.
2639         (known_function_manager::get_by_fndecl): Delete.
2640         (known_function_manager::add): Add overloaded decls for
2641         enum built_in_function name and enum internal_fn.
2642         (known_function_manager::get_match): New decl.
2643         (known_function_manager::get_internal_fn): New decl.
2644         (known_function_manager::get_normal_builtin): New decl.
2645         (known_function_manager::m_combined_fns_arr): New field.
2646         * region-model-impl-calls.cc (call_details::arg_is_size_p): New.
2647         (class kf_alloca): New.
2648         (region_model::impl_call_alloca): Convert to...
2649         (kf_alloca::impl_call_pre): ...this.
2650         (kf_analyzer_dump_capacity::matches_call_types_p): Rewrite check
2651         to use call_details::arg_is_pointer_p.
2652         (region_model::impl_call_builtin_expect): Convert to...
2653         (class kf_expect): ...this.
2654         (class kf_calloc): New, adding check that both arguments are
2655         size_t.
2656         (region_model::impl_call_calloc): Convert to...
2657         (kf_calloc::impl_call_pre): ...this.
2658         (kf_connect::matches_call_types_p): Rewrite check to use
2659         call_details::arg_is_pointer_p.
2660         (region_model::impl_call_error): Convert to...
2661         (class kf_error): ...this, and...
2662         (kf_error::impl_call_pre): ...this.
2663         (class kf_fgets): New, adding checks that args 0 and 2 are
2664         pointers.
2665         (region_model::impl_call_fgets): Convert to...
2666         (kf_fgets::impl_call_pre): ...this.
2667         (class kf_fread): New, adding checks on the argument types.
2668         (region_model::impl_call_fread): Convert to...
2669         (kf_fread::impl_call_pre): ...this.
2670         (class kf_free): New, adding check that the argument is a pointer.
2671         (region_model::impl_call_free): Convert to...
2672         (kf_free::impl_call_post): ...this.
2673         (class kf_getchar): New.
2674         (class kf_malloc): New, adding check that the argument is a
2675         size_t.
2676         (region_model::impl_call_malloc): Convert to...
2677         (kf_malloc::impl_call_pre): ...this.
2678         (class kf_memcpy): New, adding checks on arguments.
2679         (region_model::impl_call_memcpy): Convert to...
2680         (kf_memcpy::impl_call_pre): ...this.
2681         (class kf_memset): New.
2682         (region_model::impl_call_memset): Convert to...
2683         (kf_memset::impl_call_pre): ...this.
2684         (kf_pipe::matches_call_types_p): Rewrite check to use
2685         call_details::arg_is_pointer_p.
2686         (kf_putenv::matches_call_types_p): Likewise.
2687         (class kf_realloc): New, adding checks on the argument types.
2688         (region_model::impl_call_realloc): Convert to...
2689         (kf_realloc::impl_call_post): ...this.
2690         (class kf_strchr): New.
2691         (region_model::impl_call_strchr): Convert to...
2692         (kf_strchr::impl_call_post): ...this.
2693         (class kf_stack_restore): New.
2694         (class kf_stack_save): New.
2695         (class kf_stdio_output_fn): New.
2696         (class kf_strcpy): New,
2697         (region_model::impl_call_strcpy): Convert to...
2698         (kf_strcpy::impl_call_pre): ...this.
2699         (class kf_strlen): New.
2700         (region_model::impl_call_strlen): Convert to...
2701         (kf_strlen::impl_call_pre): ...this.
2702         (class kf_ubsan_bounds): New.
2703         (region_model::impl_deallocation_call): Reimplement to avoid call
2704         to impl_call_free.
2705         (register_known_functions): Add handlers for IFN_BUILTIN_EXPECT
2706         and IFN_UBSAN_BOUNDS.  Add handlers for BUILT_IN_ALLOCA,
2707         BUILT_IN_ALLOCA_WITH_ALIGN, BUILT_IN_CALLOC, BUILT_IN_EXPECT,
2708         BUILT_IN_EXPECT_WITH_PROBABILITY, BUILT_IN_FPRINTF,
2709         BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_FPUTC,
2710         BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
2711         BUILT_IN_FREE, BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED,
2712         BUILT_IN_MALLOC, BUILT_IN_MEMCPY, BUILT_IN_MEMCPY_CHK,
2713         BUILT_IN_MEMSET, BUILT_IN_MEMSET_CHK, BUILT_IN_PRINTF,
2714         BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTCHAR,
2715         BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_PUTS,
2716         BUILT_IN_PUTS_UNLOCKED, BUILT_IN_REALLOC, BUILT_IN_STACK_RESTORE,
2717         BUILT_IN_STACK_SAVE, BUILT_IN_STRCHR, BUILT_IN_STRCPY,
2718         BUILT_IN_STRCPY_CHK, BUILT_IN_STRLEN, BUILT_IN_VFPRINTF, and
2719         BUILT_IN_VPRINTF. Call register_varargs_builtins.  Add handlers
2720         for "getchar", "memset", "fgets", "fgets_unlocked", "fread",
2721         "error", and "error_at_line".
2722         * region-model.cc (region_model::on_stmt_pre): Drop
2723         "out_terminate_path" param.
2724         (region_model::get_known_function): Reimplement by calling
2725         known_function_manager::get_match, passing new "cd" param.
2726         Add overload taking enum internal_fn.
2727         (region_model::on_call_pre): Drop "out_terminate_path" param.
2728         Remove special-case handling of internal fns IFN_BUILTIN_EXPECT,
2729         IFN_UBSAN_BOUNDS, and IFN_VA_ARG, of built-in fns BUILT_IN_ALLOCA,
2730         BUILT_IN_ALLOCA_WITH_ALIGN, BUILT_IN_CALLOC, BUILT_IN_EXPECT,
2731         BUILT_IN_EXPECT_WITH_PROBABILITY, BUILT_IN_FREE, BUILT_IN_MALLOC,
2732         BUILT_IN_MEMCPY, BUILT_IN_MEMCPY_CHK, BUILT_IN_MEMSET,
2733         BUILT_IN_MEMSET_CHK, BUILT_IN_REALLOC, BUILT_IN_STRCHR,
2734         BUILT_IN_STRCPY, BUILT_IN_STRCPY_CHK, BUILT_IN_STRLEN,
2735         BUILT_IN_STACK_SAVE, BUILT_IN_STACK_RESTORE, BUILT_IN_FPRINTF,
2736         BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTC_UNLOCKED,
2737         BUILT_IN_FPUTC, BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS,
2738         BUILT_IN_FPUTS_UNLOCKED, BUILT_IN_FWRITE,
2739         BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
2740         BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTCHAR,
2741         BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTS, BUILT_IN_PUTS_UNLOCKED,
2742         BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF, BUILT_IN_VA_START, and
2743         BUILT_IN_VA_COPY, and of named functions "malloc", "calloc",
2744         "alloca", "realloc", "error", "error_at_line", "fgets",
2745         "fgets_unlocked", "fread", "getchar", "memset", "strchr", and
2746         "strlen".  Replace all this special-casing with calls to
2747         get_known_function for internal fns and for fn decls.
2748         (region_model::on_call_post): Remove special-casing handling for
2749         "free" and "strchr", and for BUILT_IN_REALLOC, BUILT_IN_STRCHR,
2750         and BUILT_IN_VA_END.  Replace by consolidating on usage of
2751         get_known_function.
2752         * region-model.h (call_details::arg_is_size_p): New.
2753         (region_model::on_stmt_pre): Drop "out_terminate_path" param.
2754         (region_model::on_call_pre): Likewise.
2755         (region_model::impl_call_alloca): Delete.
2756         (region_model::impl_call_builtin_expect): Delete.
2757         (region_model::impl_call_calloc): Delete.
2758         (region_model::impl_call_error): Delete.
2759         (region_model::impl_call_fgets): Delete.
2760         (region_model::impl_call_fread): Delete.
2761         (region_model::impl_call_free): Delete.
2762         (region_model::impl_call_malloc): Delete.
2763         (region_model::impl_call_memcpy): Delete.
2764         (region_model::impl_call_memset): Delete.
2765         (region_model::impl_call_realloc): Delete.
2766         (region_model::impl_call_strchr): Delete.
2767         (region_model::impl_call_strcpy): Delete.
2768         (region_model::impl_call_strlen): Delete.
2769         (region_model::impl_call_va_start): Delete.
2770         (region_model::impl_call_va_copy): Delete.
2771         (region_model::impl_call_va_arg): Delete.
2772         (region_model::impl_call_va_end): Delete.
2773         (region_model::check_region_for_write): Public.
2774         (region_model::get_known_function): Add "cd" param.  Add
2775         overloaded decl taking enum internal_fn.
2776         * sm-malloc.cc: Update comments.
2777         * varargs.cc (class kf_va_start): New.
2778         (region_model::impl_call_va_start): Convert to...
2779         (kf_va_start::impl_call_pre): ...this.
2780         (class kf_va_copy): New.
2781         (region_model::impl_call_va_copy): Convert to...
2782         (kf_va_copy::impl_call_pre): ...this.
2783         (class kf_va_arg): New.
2784         (region_model::impl_call_va_arg): Convert to...
2785         (kf_va_arg::impl_call_pre): ...this.
2786         (class kf_va_end): New.
2787         (region_model::impl_call_va_end): Delete.
2788         (register_varargs_builtins): New.
2789
2790 2022-11-22  David Malcolm  <dmalcolm@redhat.com>
2791
2792         PR analyzer/107788
2793         * region-model.cc (region_model::update_for_int_cst_return):
2794         Require that the return type be an integer type.
2795         (region_model::update_for_nonzero_return): Likewise.
2796
2797 2022-11-22  David Malcolm  <dmalcolm@redhat.com>
2798
2799         PR analyzer/107783
2800         * region-model-impl-calls.cc (kf_accept::matches_call_types_p):
2801         Require that args 1 and 2 be pointers.
2802         (kf_bind::matches_call_types_p): Require that arg 1 be a pointer.
2803         * region-model.h (call_details::arg_is_pointer_p): New
2804
2805 2022-11-22  David Malcolm  <dmalcolm@redhat.com>
2806
2807         PR analyzer/107777
2808         * call-summary.cc
2809         (call_summary_replay::convert_region_from_summary_1): Handle
2810         RK_THREAD_LOCAL and RK_ERRNO in switch.
2811         * region-model.cc (region_model::get_representative_path_var_1):
2812         Likewise.
2813
2814 2022-11-19  David Malcolm  <dmalcolm@redhat.com>
2815
2816         PR analyzer/107582
2817         * engine.cc (dynamic_call_info_t::update_model): Update the model
2818         by pushing or pop a frame, rather than by clobbering it with the
2819         model from the exploded_node's state.
2820
2821 2022-11-18  David Malcolm  <dmalcolm@redhat.com>
2822
2823         * analyzer.cc (is_pipe_call_p): Delete.
2824         * analyzer.h (is_pipe_call_p): Delete.
2825         * region-model-impl-calls.cc (call_details::get_location): New.
2826         (class kf_analyzer_break): New, adapted from
2827         region_model::on_stmt_pre.
2828         (region_model::impl_call_analyzer_describe): Convert to...
2829         (class kf_analyzer_describe): ...this.
2830         (region_model::impl_call_analyzer_dump_capacity): Convert to...
2831         (class kf_analyzer_dump_capacity): ...this.
2832         (region_model::impl_call_analyzer_dump_escaped): Convert to...
2833         (class kf_analyzer_dump_escaped): ...this.
2834         (class kf_analyzer_dump_exploded_nodes): New.
2835         (region_model::impl_call_analyzer_dump_named_constant): Convert
2836         to...
2837         (class kf_analyzer_dump_named_constant): ...this.
2838         (class dump_path_diagnostic): Move here from region-model.cc.
2839         (class kf_analyzer_dump_path) New, adapted from
2840         region_model::on_stmt_pre.
2841         (class kf_analyzer_dump_region_model): Likewise.
2842         (region_model::impl_call_analyzer_eval): Convert to...
2843         (class kf_analyzer_eval): ...this.
2844         (region_model::impl_call_analyzer_get_unknown_ptr): Convert to...
2845         (class kf_analyzer_get_unknown_ptr): ...this.
2846         (class known_function_accept): Rename to...
2847         (class kf_accept): ...this.
2848         (class known_function_bind): Rename to...
2849         (class kf_bind): ...this.
2850         (class known_function_connect): Rename to...
2851         (class kf_connect): ...this.
2852         (region_model::impl_call_errno_location): Convert to...
2853         (class kf_errno_location): ...this.
2854         (class known_function_listen): Rename to...
2855         (class kf_listen): ...this.
2856         (region_model::impl_call_pipe): Convert to...
2857         (class kf_pipe): ...this.
2858         (region_model::impl_call_putenv): Convert to...
2859         (class kf_putenv): ...this.
2860         (region_model::impl_call_operator_new): Convert to...
2861         (class kf_operator_new): ...this.
2862         (region_model::impl_call_operator_delete): Convert to...
2863         (class kf_operator_delete): ...this.
2864         (class known_function_socket): Rename to...
2865         (class kf_socket): ...this.
2866         (register_known_functions): Rename param to KFM.  Break out
2867         existing known functions into a "POSIX" section, and add "pipe",
2868         "pipe2", and "putenv".  Add debugging functions
2869         "__analyzer_break", "__analyzer_describe",
2870         "__analyzer_dump_capacity", "__analyzer_dump_escaped",
2871         "__analyzer_dump_exploded_nodes",
2872         "__analyzer_dump_named_constant", "__analyzer_dump_path",
2873         "__analyzer_dump_region_model", "__analyzer_eval",
2874         "__analyzer_get_unknown_ptr".  Add C++ support functions
2875         "operator new", "operator new []", "operator delete", and
2876         "operator delete []".
2877         * region-model.cc (class dump_path_diagnostic): Move to
2878         region-model-impl-calls.cc.
2879         (region_model::on_stmt_pre): Eliminate special-casing of
2880         "__analyzer_describe", "__analyzer_dump_capacity",
2881         "__analyzer_dump_escaped", "__analyzer_dump_named_constant",
2882         "__analyzer_dump_path", "__analyzer_dump_region_model",
2883         "__analyzer_eval", "__analyzer_break",
2884         "__analyzer_dump_exploded_nodes", "__analyzer_get_unknown_ptr",
2885         "__errno_location", "pipe", "pipe2", "putenv", "operator new",
2886         "operator new []", "operator delete", "operator delete []"
2887         "pipe" and "pipe2", handling them instead via the known_functions
2888         mechanism.
2889         * region-model.h (call_details::get_location): New decl.
2890         (region_model::impl_call_analyzer_describe): Delete decl.
2891         (region_model::impl_call_analyzer_dump_capacity): Delete decl.
2892         (region_model::impl_call_analyzer_dump_escaped): Delete decl.
2893         (region_model::impl_call_analyzer_dump_named_constant): Delete decl.
2894         (region_model::impl_call_analyzer_eval): Delete decl.
2895         (region_model::impl_call_analyzer_get_unknown_ptr): Delete decl.
2896         (region_model::impl_call_errno_location): Delete decl.
2897         (region_model::impl_call_pipe): Delete decl.
2898         (region_model::impl_call_putenv): Delete decl.
2899         (region_model::impl_call_operator_new): Delete decl.
2900         (region_model::impl_call_operator_delete): Delete decl.
2901         * sm-fd.cc: Update comments.
2902
2903 2022-11-16  David Malcolm  <dmalcolm@redhat.com>
2904
2905         PR analyzer/107711
2906         * analyzer-language.cc: Include "diagnostic.h".
2907         (maybe_stash_named_constant): Add logger param and use it to log
2908         the name being looked up, and the result.
2909         (stash_named_constants): New, splitting out from...
2910         (on_finish_translation_unit): ...this function.  Call
2911         get_or_create_logfile and use the result to create a logger
2912         instance, passing it to stash_named_constants.
2913         * analyzer.h (get_or_create_any_logfile): New decl.
2914         * engine.cc (dump_fout, owns_dump_fout): New globals, split out
2915         from run_checkers.
2916         (get_or_create_any_logfile): New function, split out from...
2917         (run_checkers): ...here, so that the logfile can be opened by
2918         on_finish_translation_unit.  Clear the globals when closing the
2919         dump file.
2920
2921 2022-11-16  David Malcolm  <dmalcolm@redhat.com>
2922
2923         * analyzer.h (known_function::matches_call_types_p): New vfunc.
2924         (known_function::impl_call_pre): Provide base implementation.
2925         (known_function::impl_call_post): New vfunc.
2926         (register_known_functions): New.
2927         * engine.cc (impl_run_checkers): Call register_known_functions.
2928         * region-model-impl-calls.cc (region_model::impl_call_accept):
2929         Convert to...
2930         (class known_function_accept): ...this.
2931         (region_model::impl_call_bind): Convert to...
2932         (class known_function_bind): ...this.
2933         (region_model::impl_call_connect): Convert to...
2934         (class known_function_connect): ...this.
2935         (region_model::impl_call_listen): Convert to...
2936         (class known_function_listen): ...this.
2937         (region_model::impl_call_socket): Convert to...
2938         (class known_function_socket): ...this.
2939         (register_known_functions): New.
2940         * region-model.cc (region_model::on_call_pre): Remove special
2941         case for "bind" in favor of the known_function-handling dispatch.
2942         Add call to known_function::matches_call_types_p to latter.
2943         (region_model::on_call_post): Remove special cases for "accept",
2944         "bind", "connect", "listen", and "socket" in favor of dispatch
2945         to known_function::impl_call_post.
2946         * region-model.h (region_model::impl_call_accept): Delete decl.
2947         (region_model::impl_call_bind): Delete decl.
2948         (region_model::impl_call_connect): Delete decl.
2949         (region_model::impl_call_listen): Delete decl.
2950         (region_model::impl_call_socket): Delete decl.
2951         * sm-fd.cc: Update comments.
2952
2953 2022-11-16  David Malcolm  <dmalcolm@redhat.com>
2954
2955         * checker-event.cc: New file, split out from...
2956         * checker-path.cc: ...this file.
2957
2958 2022-11-15  David Malcolm  <dmalcolm@redhat.com>
2959
2960         PR analyzer/106140
2961         * analyzer-language.cc (on_finish_translation_unit): Stash named
2962         constants "SOCK_STREAM" and "SOCK_DGRAM".
2963         * analyzer.opt (Wanalyzer-fd-phase-mismatch): New.
2964         (Wanalyzer-fd-type-mismatch): New.
2965         * engine.cc (impl_region_model_context::get_state_map_by_name):
2966         Add "out_sm_context" param.  Allow out_sm_idx to be NULL.
2967         * exploded-graph.h
2968         (impl_region_model_context::get_state_map_by_name):
2969         Add "out_sm_context" param.
2970         * region-model-impl-calls.cc (region_model::impl_call_accept): New.
2971         (region_model::impl_call_bind): New.
2972         (region_model::impl_call_connect): New.
2973         (region_model::impl_call_listen): New.
2974         (region_model::impl_call_socket): New.
2975         * region-model.cc (region_model::on_call_pre): Special-case
2976         "bind".
2977         (region_model::on_call_post): Special-case "accept", "bind",
2978         "connect", "listen", and "socket".
2979         * region-model.h (region_model::impl_call_accept): New decl.
2980         (region_model::impl_call_bind): New decl.
2981         (region_model::impl_call_connect): New decl.
2982         (region_model::impl_call_listen): New decl.
2983         (region_model::impl_call_socket): New decl.
2984         (region_model::on_socket): New decl.
2985         (region_model::on_bind): New decl.
2986         (region_model::on_listen): New decl.
2987         (region_model::on_accept): New decl.
2988         (region_model::on_connect): New decl.
2989         (region_model::add_constraint): Make public.
2990         (region_model::check_for_poison): Make public.
2991         (region_model_context::get_state_map_by_name): Add out_sm_context param.
2992         (region_model_context::get_fd_map): Likewise.
2993         (region_model_context::get_malloc_map): Likewise.
2994         (region_model_context::get_taint_map): Likewise.
2995         (noop_region_model_context::get_state_map_by_name): Likewise.
2996         (region_model_context_decorator::get_state_map_by_name): Likewise.
2997         * sm-fd.cc: Include "analyzer/supergraph.h" and
2998         "analyzer/analyzer-language.h".
2999         (enum expected_phase): New enum.
3000         (fd_state_machine::m_new_datagram_socket): New.
3001         (fd_state_machine::m_new_stream_socket): New.
3002         (fd_state_machine::m_new_unknown_socket): New.
3003         (fd_state_machine::m_bound_datagram_socket): New.
3004         (fd_state_machine::m_bound_stream_socket): New.
3005         (fd_state_machine::m_bound_unknown_socket): New.
3006         (fd_state_machine::m_listening_stream_socket): New.
3007         (fd_state_machine::m_m_connected_stream_socket): New.
3008         (fd_state_machine::m_SOCK_STREAM): New.
3009         (fd_state_machine::m_SOCK_DGRAM): New.
3010         (fd_diagnostic::describe_state_change): Handle socket states.
3011         (fd_diagnostic::get_meaning_for_state_change): Likewise.
3012         (class fd_phase_mismatch): New.
3013         (enum expected_type): New enum.
3014         (class fd_type_mismatch): New.
3015         (fd_state_machine::fd_state_machine): Initialize new states and
3016         stashed named constants.
3017         (fd_state_machine::is_socket_fd_p): New.
3018         (fd_state_machine::is_datagram_socket_fd_p): New.
3019         (fd_state_machine::is_stream_socket_fd_p): New.
3020         (fd_state_machine::on_close): Handle the socket states.
3021         (fd_state_machine::check_for_open_fd): Complain about fncalls on
3022         sockets in the wrong phase.  Support socket FDs.
3023         (add_constraint_ge_zero): New.
3024         (fd_state_machine::get_state_for_socket_type): New.
3025         (fd_state_machine::on_socket): New.
3026         (fd_state_machine::check_for_socket_fd): New.
3027         (fd_state_machine::check_for_new_socket_fd): New.
3028         (fd_state_machine::on_bind): New.
3029         (fd_state_machine::on_listen): New.
3030         (fd_state_machine::on_accept): New.
3031         (fd_state_machine::on_connect): New.
3032         (fd_state_machine::can_purge_p): Don't purge socket values.
3033         (get_fd_state): New.
3034         (region_model::mark_as_valid_fd): Use get_fd_state.
3035         (region_model::on_socket): New.
3036         (region_model::on_bind): New.
3037         (region_model::on_listen): New.
3038         (region_model::on_accept): New.
3039         (region_model::on_connect): New.
3040         * sm-fd.dot: Update to reflect sm-fd.cc changes.
3041
3042 2022-11-15  David Malcolm  <dmalcolm@redhat.com>
3043
3044         PR analyzer/106302
3045         * analyzer-language.cc: New file.
3046         * analyzer-language.h: New file.
3047         * analyzer.h (get_stashed_constant_by_name): New decl.
3048         (log_stashed_constants): New decl.
3049         * engine.cc (impl_run_checkers): Call log_stashed_constants.
3050         * region-model-impl-calls.cc
3051         (region_model::impl_call_analyzer_dump_named_constant): New.
3052         * region-model.cc (region_model::on_stmt_pre): Handle
3053         __analyzer_dump_named_constant.
3054         * region-model.h
3055         (region_model::impl_call_analyzer_dump_named_constant): New decl.
3056         * sm-fd.cc (fd_state_machine::m_O_ACCMODE): New.
3057         (fd_state_machine::m_O_RDONLY): New.
3058         (fd_state_machine::m_O_WRONLY): New.
3059         (fd_state_machine::fd_state_machine): Initialize the new fields.
3060         (fd_state_machine::get_access_mode_from_flag): Use the new fields,
3061         rather than using the host values.
3062
3063 2022-11-13  David Malcolm  <dmalcolm@redhat.com>
3064
3065         PR analyzer/106235
3066         * analyzer.opt (Wanalyzer-tainted-assertion): New.
3067         * checker-path.cc (checker_path::fixup_locations): Pass false to
3068         pending_diagnostic::fixup_location.
3069         * diagnostic-manager.cc (get_emission_location): Pass true to
3070         pending_diagnostic::fixup_location.
3071         * pending-diagnostic.cc (pending_diagnostic::fixup_location): Add
3072         bool param.
3073         * pending-diagnostic.h (pending_diagnostic::fixup_location): Add
3074         bool param to decl.
3075         * sm-taint.cc (taint_state_machine::m_tainted_control_flow): New.
3076         (taint_diagnostic::describe_state_change): Drop "final".
3077         (class tainted_assertion): New.
3078         (taint_state_machine::taint_state_machine): Initialize
3079         m_tainted_control_flow.
3080         (taint_state_machine::alt_get_inherited_state): Support
3081         comparisons being tainted, based on their arguments.
3082         (is_assertion_failure_handler_p): New.
3083         (taint_state_machine::on_stmt): Complain about calls to assertion
3084         failure handlers guarded by an attacker-controller conditional.
3085         Detect attacker-controlled gcond conditionals and gswitch index
3086         values.
3087         (taint_state_machine::check_control_flow_arg_for_taint): New.
3088
3089 2022-11-11  David Malcolm  <dmalcolm@redhat.com>
3090
3091         * sm-fd.dot: Fix typo in comment.
3092         * sm-file.dot: New file.
3093         * varargs.cc: Fix typo in comment.
3094         * varargs.dot: New file.
3095
3096 2022-11-11  David Malcolm  <dmalcolm@redhat.com>
3097
3098         * checker-path.h: Split out checker_event and its subclasses to...
3099         * checker-event.h: ...this new header.
3100
3101 2022-11-11  David Malcolm  <dmalcolm@redhat.com>
3102
3103         PR analyzer/106147
3104         * analyzer.opt (Wanalyzer-infinite-recursion): New.
3105         * call-string.cc (call_string::count_occurrences_of_function):
3106         New.
3107         * call-string.h (call_string::count_occurrences_of_function): New
3108         decl.
3109         * checker-path.cc (function_entry_event::function_entry_event):
3110         New ctor.
3111         (checker_path::add_final_event): Delete.
3112         * checker-path.h (function_entry_event::function_entry_event): New
3113         ctor.
3114         (function_entry_event::get_desc): Drop "final".
3115         (checker_path::add_final_event): Delete.
3116         * diagnostic-manager.cc
3117         (diagnostic_manager::emit_saved_diagnostic): Create the final
3118         event via a new pending_diagnostic::add_final_event vfunc, rather
3119         than checker_path::add_final_event.
3120         (diagnostic_manager::add_events_for_eedge): Create function entry
3121         events via a new pending_diagnostic::add_function_entry_event
3122         vfunc.
3123         * engine.cc (exploded_graph::process_node): When creating a new
3124         PK_BEFORE_SUPERNODE node, call
3125         exploded_graph::detect_infinite_recursion on it after adding the
3126         in-edge.
3127         * exploded-graph.h (exploded_graph::detect_infinite_recursion):
3128         New decl.
3129         (exploded_graph::find_previous_entry_to): New decl.
3130         * infinite-recursion.cc: New file.
3131         * pending-diagnostic.cc
3132         (pending_diagnostic::add_function_entry_event): New.
3133         (pending_diagnostic::add_final_event): New.
3134         * pending-diagnostic.h
3135         (pending_diagnostic::add_function_entry_event): New vfunc.
3136         (pending_diagnostic::add_final_event): New vfunc.
3137
3138 2022-11-10  David Malcolm  <dmalcolm@redhat.com>
3139
3140         PR analyzer/99671
3141         * analyzer.opt (Wanalyzer-deref-before-check): New warning.
3142         * diagnostic-manager.cc
3143         (null_assignment_sm_context::set_next_state): Only add state
3144         change events for transition to "null" state.
3145         (null_assignment_sm_context::is_transition_to_null): New.
3146         * engine.cc (impl_region_model_context::on_pop_frame): New.
3147         * exploded-graph.h (impl_region_model_context::on_pop_frame): New
3148         decl.
3149         * program-state.cc (sm_state_map::clear_any_state): New.
3150         (sm_state_map::can_merge_with_p): New.
3151         (program_state::can_merge_with_p): Replace requirement that
3152         sm-states be equal in favor of an attempt to merge them.
3153         * program-state.h (sm_state_map::clear_any_state): New decl.
3154         (sm_state_map::can_merge_with_p): New decl.
3155         * region-model.cc (region_model::eval_condition): Make const.
3156         (region_model::pop_frame): Call ctxt->on_pop_frame.
3157         * region-model.h (region_model::eval_condition): Make const.
3158         (region_model_context::on_pop_frame): New vfunc.
3159         (noop_region_model_context::on_pop_frame): New.
3160         (region_model_context_decorator::on_pop_frame): New.
3161         * sm-malloc.cc (enum resource_state): Add RS_ASSUMED_NON_NULL.
3162         (allocation_state::dump_to_pp): Drop "final".
3163         (struct assumed_non_null_state): New subclass.
3164         (malloc_state_machine::m_assumed_non_null): New.
3165         (assumed_non_null_p): New.
3166         (class deref_before_check): New.
3167         (assumed_non_null_state::dump_to_pp): New.
3168         (malloc_state_machine::get_or_create_assumed_non_null_state_for_frame):
3169         New.
3170         (malloc_state_machine::maybe_assume_non_null): New.
3171         (malloc_state_machine::on_stmt): Transition from start state to
3172         "assumed-non-null" state for pointers passed to
3173         __attribute__((nonnull)) arguments, and for pointers explicitly
3174         dereferenced.  Call maybe_complain_about_deref_before_check for
3175         pointers explicitly compared against NULL.
3176         (malloc_state_machine::maybe_complain_about_deref_before_check):
3177         New.
3178         (malloc_state_machine::on_deallocator_call): Also transition
3179         "assumed-non-null" states to "freed".
3180         (malloc_state_machine::on_pop_frame): New.
3181         (malloc_state_machine::maybe_get_merged_states_nonequal): New.
3182         * sm-malloc.dot: Update for changes to sm-malloc.cc.
3183         * sm.h (state_machine::on_pop_frame): New.
3184         (state_machine::maybe_get_merged_state): New.
3185         (state_machine::maybe_get_merged_states_nonequal): New.
3186
3187 2022-11-09  David Malcolm  <dmalcolm@redhat.com>
3188
3189         * checker-path.cc (checker_event::debug): New.
3190         (checker_path::add_event): Move here from checker-path.h.  Add
3191         logging.
3192         * checker-path.h (checker_event::debug): New decl.
3193         (checker_path::checker_path): Add logger param.
3194         (checker_path::add_event): Move definition from here to
3195         checker-path.cc.
3196         (checker_path::m_logger): New field.
3197         * diagnostic-manager.cc
3198         (diagnostic_manager::emit_saved_diagnostic): Pass logger to
3199         checker_path ctor.
3200         (diagnostic_manager::add_events_for_eedge): Log scope when
3201         processing a run of stmts.
3202
3203 2022-11-08  David Malcolm  <dmalcolm@redhat.com>
3204
3205         PR analyzer/101962
3206         * region-model-impl-calls.cc: Update comment.
3207         * region-model.cc (region_model::check_symbolic_bounds): Fix
3208         layout of "void" return.  Replace usage of
3209         eval_condition_without_cm with eval_condition.
3210         (region_model::eval_condition): Take over body of...
3211         (region_model::eval_condition_without_cm): ...this subroutine,
3212         dropping the latter.  Eliminating this distinction avoids issues
3213         where constraints were not considered when recursing.
3214         (region_model::compare_initial_and_pointer): Update comment.
3215         (region_model::symbolic_greater_than): Replace usage of
3216         eval_condition_without_cm with eval_condition.
3217         * region-model.h
3218         (region_model::eval_condition_without_cm): Delete decl.
3219
3220 2022-11-08  David Malcolm  <dmalcolm@redhat.com>
3221
3222         * region-model-impl-calls.cc
3223         (region_model::impl_call_errno_location): New.
3224         * region-model-manager.cc
3225         (region_model_manager::region_model_manager): Initialize
3226         m_thread_local_region and m_errno_region.
3227         * region-model-manager.h (region_model_manager::get_errno_region):
3228         New accessor.
3229         (region_model_manager::m_thread_local_region): New.
3230         (region_model_manager::m_errno_region): New.
3231         * region-model.cc (region_model::on_call_pre): Special-case
3232         "__errno_location".
3233         (region_model::set_errno): New.
3234         * region-model.h (impl_call_errno_location): New decl.
3235         (region_model::set_errno): New decl.
3236         * region.cc (thread_local_region::dump_to_pp): New.
3237         (errno_region::dump_to_pp): New.
3238         * region.h (enum memory_space): Add MEMSPACE_THREAD_LOCAL.
3239         (enum region_kind): Add RK_THREAD_LOCAL and RK_ERRNO.
3240         (class thread_local_region): New.
3241         (is_a_helper <const thread_local_region *>::test): New.
3242         (class errno_region): New.
3243         (is_a_helper <const errno_region *>::test): New.
3244         * store.cc (binding_cluster::escaped_p): New.
3245         (store::escaped_p): Treat errno as always having escaped.
3246         (store::replay_call_summary_cluster): Handle RK_THREAD_LOCAL and
3247         RK_ERRNO.
3248         * store.h (binding_cluster::escaped_p): Remove definition.
3249
3250 2022-11-08  David Malcolm  <dmalcolm@redhat.com>
3251
3252         * call-info.cc (success_call_info::get_desc): Delete.
3253         (failed_call_info::get_desc): Likewise.
3254         (succeed_or_fail_call_info::get_desc): New.
3255         * call-info.h (class succeed_or_fail_call_info): New.
3256         (class success_call_info): Convert to a subclass of
3257         succeed_or_fail_call_info.
3258         (class failed_call_info): Likewise.
3259
3260 2022-11-08  David Malcolm  <dmalcolm@redhat.com>
3261
3262         * region-model-impl-calls.cc (region_model::impl_call_strchr):
3263         Move to on_call_post.  Handle both outcomes using bifurcation,
3264         rather than just the "not found" case.
3265         * region-model.cc (region_model::on_call_pre): Move
3266         BUILT_IN_STRCHR and "strchr" to...
3267         (region_model::on_call_post): ...here.
3268
3269 2022-11-03  David Malcolm  <dmalcolm@redhat.com>
3270
3271         * analyzer.h: Use std::unique_ptr for state machines from plugins.
3272         * engine.cc: Likewise.
3273
3274 2022-11-03  David Malcolm  <dmalcolm@redhat.com>
3275
3276         * analyzer.h: Use std::unique_ptr for known functions.
3277         * engine.cc: Likewise.
3278         * known-function-manager.cc: Likewise.
3279         * known-function-manager.h: Likewise.
3280
3281 2022-11-03  David Malcolm  <dmalcolm@redhat.com>
3282
3283         * analysis-plan.cc: Define INCLUDE_MEMORY before including
3284         system.h.
3285         * analyzer-pass.cc: Likewise.
3286         * analyzer-selftests.cc: Likewise.
3287         * analyzer.cc: Likewise.
3288         * analyzer.h: Use std::unique_ptr in bifurcation code.
3289         * call-string.cc: Define INCLUDE_MEMORY before including system.h.
3290         * complexity.cc: Likewise.
3291         * engine.cc: Use std::unique_ptr in bifurcation code.
3292         * exploded-graph.h: Likewise.
3293         * known-function-manager.cc: Define INCLUDE_MEMORY before
3294         including system.h.
3295         * region-model-impl-calls.cc: Use std::unique_ptr in bifurcation
3296         code.
3297         * region-model.cc: Likewise.
3298         * region-model.h: Likewise.
3299         * supergraph.cc: Define INCLUDE_MEMORY before including system.h.
3300
3301 2022-11-03  David Malcolm  <dmalcolm@redhat.com>
3302
3303         * call-info.cc: Use std::unique_ptr for checker_event.
3304         * checker-path.cc: Likewise.
3305         * checker-path.h: Likewise.
3306         * diagnostic-manager.cc: Likewise.
3307         * engine.cc: Likewise.
3308         * pending-diagnostic.cc: Likewise.
3309         * sm-signal.cc: Likewise.
3310         * varargs.cc: Likewise.
3311
3312 2022-11-03  David Malcolm  <dmalcolm@redhat.com>
3313
3314         * diagnostic-manager.cc: Include "make-unique.h".
3315         Use std::unique_ptr for feasibility_problems and exploded_path.
3316         Delete explicit saved_diagnostic dtor.
3317         * diagnostic-manager.h: Likewise.
3318         * engine.cc: Likewise.
3319         * exploded-graph.h: Likewise.
3320         * feasible-graph.cc: Likewise.
3321         * feasible-graph.h: Likewise.
3322
3323 2022-11-03  David Malcolm  <dmalcolm@redhat.com>
3324
3325         * checker-path.cc (rewind_event::rewind_event): Update for usage of
3326         std::unique_ptr on custom_edge_info.
3327         * engine.cc (exploded_node::on_longjmp): Likewise.
3328         (exploded_edge::exploded_edge): Likewise.
3329         (exploded_edge::~exploded_edge): Delete.
3330         (exploded_graph::add_function_entry): Update for usage of
3331         std::unique_ptr on custom_edge_info.
3332         (exploded_graph::add_edge): Likewise.
3333         (add_tainted_args_callback): Likewise.
3334         (exploded_graph::maybe_create_dynamic_call): Likewise.
3335         (exploded_graph::process_node): Likewise.
3336         * exploded-graph.h (exploded_edge::~exploded_edge): Delete.
3337         (exploded_edge::m_custom_info): Use std::unique_ptr.
3338         (exploded_edge::add_edge): Likewise.
3339         * sm-signal.cc (register_signal_handler::impl_transition): Use
3340         make_unique.
3341
3342 2022-11-03  David Malcolm  <dmalcolm@redhat.com>
3343
3344         * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic): Make
3345         stmt_finder const.
3346         (saved_diagnostic::~saved_diagnostic): Remove explicit delete of
3347         m_stmt_finder.
3348         (diagnostic_manager::add_diagnostic): Make stmt_finder const.
3349         * diagnostic-manager.h (saved_diagnostic::saved_diagnostic):
3350         Likewise.
3351         (saved_diagnostic::m_stmt_finder): Convert to std::unique_ptr.
3352         (diagnostic_manager::add_diagnostic): Make stmt_finder const.
3353         * engine.cc (impl_sm_context::impl_sm_context): Likewise.
3354         (impl_sm_context::m_stmt_finder): Likewise.
3355         (leak_stmt_finder::clone): Convert return type to std::unique_ptr.
3356         * exploded-graph.h (stmt_finder::clone): Likewise.
3357
3358 2022-11-03  David Malcolm  <dmalcolm@redhat.com>
3359
3360         * call-info.cc: Add define of INCLUDE_MEMORY.
3361         * call-summary.cc: Likewise.
3362         * checker-path.cc: Likewise.
3363         * constraint-manager.cc: Likewise.
3364         * diagnostic-manager.cc: Likewise.
3365         (saved_diagnostic::saved_diagnostic): Use std::unique_ptr for
3366         param d and field m_d.
3367         (saved_diagnostic::~saved_diagnostic): Remove explicit delete of m_d.
3368         (saved_diagnostic::add_note): Use std::unique_ptr for
3369         param pn.
3370         (saved_diagnostic::get_pending_diagnostic): Update for conversion
3371         of m_sd.m_d to unique_ptr.
3372         (diagnostic_manager::add_diagnostic): Use std::unique_ptr for
3373         param d.  Remove explicit deletion.
3374         (diagnostic_manager::add_note): Use std::unique_ptr for param pn.
3375         (diagnostic_manager::emit_saved_diagnostic): Update for conversion
3376         of m_sd.m_d to unique_ptr.
3377         (null_assignment_sm_context::warn): Use std::unique_ptr for
3378         param d.  Remove explicit deletion.
3379         * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Use
3380         std::unique_ptr for param d.
3381         (saved_diagnostic::add_note): Likewise for param pn.
3382         (saved_diagnostic::m_d): Likewise.
3383         (diagnostic_manager::add_diagnostic): Use std::unique_ptr for
3384         param d.
3385         (diagnostic_manager::add_note): Use std::unique_ptr for param pn.
3386         * engine.cc: Include "make-unique.h".
3387         (impl_region_model_context::warn): Update to use std::unique_ptr
3388         for param, removing explicit deletion.
3389         (impl_region_model_context::add_note): Likewise.
3390         (impl_sm_context::warn): Update to use std::unique_ptr
3391         for param.
3392         (impl_region_model_context::on_state_leak): Likewise for result of
3393         on_leak.
3394         (exploded_node::on_longjmp): Use make_unique when creating
3395         pending_diagnostic.
3396         (exploded_graph::process_node): Likewise.
3397         * exploded-graph.h (impl_region_model_context::warn): Update to
3398         use std::unique_ptr for param.
3399         (impl_region_model_context::add_note): Likewise.
3400         * feasible-graph.cc: Add define of INCLUDE_MEMORY.
3401         * pending-diagnostic.cc: Likewise.
3402         * pending-diagnostic.h: Include analyzer.sm.h"
3403         * program-point.cc: Add define of INCLUDE_MEMORY.
3404         * program-state.cc: Likewise.
3405         * region-model-asm.cc: Likewise.
3406         * region-model-impl-calls.cc: Likewise.  Include "make-unique.h".
3407         (region_model::impl_call_putenv): Use make_unique when creating
3408         pending_diagnostic.
3409         * region-model-manager.cc: Add define of INCLUDE_MEMORY.
3410         * region-model-reachability.cc: Likewise.
3411         * region-model.cc: Likewise.  Include "make-unique.h".
3412         (region_model::get_gassign_result): Use make_unique when creating
3413         pending_diagnostic.
3414         (region_model::check_for_poison): Likewise.
3415         (region_model::on_stmt_pre): Likewise.
3416         (region_model::check_symbolic_bounds): Likewise.
3417         (region_model::check_region_bounds): Likewise.
3418         (annotating_ctxt: make_note): Use std::unique_ptr for result.
3419         (region_model::deref_rvalue): Use make_unique when creating
3420         pending_diagnostic.
3421         (region_model::check_for_writable_region): Likewise.
3422         (region_model::check_region_size): Likewise.
3423         (region_model::check_dynamic_size_for_floats): Likewise.
3424         (region_model::maybe_complain_about_infoleak): Likewise.
3425         (noop_region_model_context::add_note): Use std::unique_ptr for
3426         param.  Remove explicit deletion.
3427         * region-model.h: Include "analyzer/pending-diagnostic.h".
3428         (region_model_context::warn): Convert param to std::unique_ptr.
3429         (region_model_context::add_note): Likewise.
3430         (noop_region_model_context::warn): Likewise.
3431         (noop_region_model_context::add_note): Likewise.
3432         (region_model_context_decorator::warn): Likewise.
3433         (region_model_context_decorator::add_note): Likewise.
3434         (note_adding_context::warn): Likewise.
3435         (note_adding_context::make_note): Likewise for return type.
3436         (test_region_model_context::warn): Convert param to
3437         std::unique_ptr.
3438         * region.cc: Add define of INCLUDE_MEMORY.
3439         * sm-fd.cc: Likewise.  Include "make-unique.h".
3440         (fd_state_machine::check_for_fd_attrs): Use make_unique when
3441         creating pending_diagnostics.
3442         (fd_state_machine::on_open): Likewise.
3443         (fd_state_machine::on_creat): Likewise.
3444         (fd_state_machine::check_for_dup): Likewise.
3445         (fd_state_machine::on_close): Likewise.
3446         (fd_state_machine::check_for_open_fd): Likewise.
3447         (fd_state_machine::on_leak): Likewise, converting return type to
3448         std::unique_ptr.
3449         * sm-file.cc: Add define of INCLUDE_MEMORY.  Include
3450         "make-unique.h".
3451         (fileptr_state_machine::on_stmt): Use make_unique when creating
3452         pending_diagnostic.
3453         (fileptr_state_machine::on_leak): Likewise, converting return type
3454         to std::unique_ptr.
3455         * sm-malloc.cc: Add define of INCLUDE_MEMORY.  Include
3456         "make-unique.h".
3457         (malloc_state_machine::on_stmt): Use make_unique when creating
3458         pending_diagnostic.
3459         (malloc_state_machine::handle_free_of_non_heap): Likewise.
3460         (malloc_state_machine::on_deallocator_call): Likewise.
3461         (malloc_state_machine::on_realloc_call): Likewise.
3462         (malloc_state_machine::on_leak): Likewise, converting return type
3463         to std::unique_ptr.
3464         * sm-pattern-test.cc: Add define of INCLUDE_MEMORY.  Include
3465         "make-unique.h".
3466         (pattern_test_state_machine::on_condition): Use make_unique when
3467         creating pending_diagnostic.
3468         * sm-sensitive.cc: Add define of INCLUDE_MEMORY.  Include
3469         "make-unique.h".
3470         (sensitive_state_machine::warn_for_any_exposure): Use make_unique
3471         when creating pending_diagnostic.
3472         * sm-signal.cc: Add define of INCLUDE_MEMORY.  Include
3473         "make-unique.h".
3474         (signal_state_machine::on_stmt): Use make_unique when creating
3475         pending_diagnostic.
3476         * sm-taint.cc: Add define of INCLUDE_MEMORY.  Include
3477         "make-unique.h".
3478         (taint_state_machine::check_for_tainted_size_arg): Use make_unique
3479         when creating pending_diagnostic.
3480         (taint_state_machine::check_for_tainted_divisor): Likewise.
3481         (region_model::check_region_for_taint): Likewise.
3482         (region_model::check_dynamic_size_for_taint): Likewise.
3483         * sm.cc: Add define of INCLUDE_MEMORY.  Include
3484         "analyzer/pending-diagnostic.h".
3485         (state_machine::on_leak): Move here from sm.h, changing return
3486         type to std::unique_ptr.
3487         * sm.h (state_machine::on_leak): Change return type to
3488         std::unique_ptr.  Move defn of base impl to sm.cc
3489         (sm_context::warn): Convert param d to std_unique_ptr.
3490         * state-purge.cc: Add define of INCLUDE_MEMORY.
3491         * store.cc: Likewise.
3492         * svalue.cc: Likewise.
3493         * trimmed-graph.cc: Likewise.
3494         * varargs.cc: Likewise.  Include "make-unique.h".
3495         (va_list_state_machine::check_for_ended_va_list): Use make_unique
3496         when creating pending_diagnostic.
3497         (va_list_state_machine::on_leak): Likewise, converting return type
3498         to std::unique_ptr.
3499         (region_model::impl_call_va_arg): Use make_unique when creating
3500         pending_diagnostic.
3501
3502 2022-11-03  David Malcolm  <dmalcolm@redhat.com>
3503
3504         PR analyzer/107486
3505         * analyzer.cc (is_pipe_call_p): New.
3506         * analyzer.h (is_pipe_call_p): New decl.
3507         * region-model.cc (region_model::on_call_pre): Use it.
3508         (region_model::on_call_post): Likewise.
3509
3510 2022-10-26  David Malcolm  <dmalcolm@redhat.com>
3511
3512         * sm-fd.cc (fd_state_machine::on_open): Transition to "unchecked"
3513         when the mode is symbolic, rather than just on integer constants.
3514         (fd_state_machine::check_for_open_fd): Don't complain about
3515         unchecked values in the start state.
3516
3517 2022-10-26  David Malcolm  <dmalcolm@redhat.com>
3518
3519         * sm-fd.dot: New file.
3520
3521 2022-10-24  David Malcolm  <dmalcolm@redhat.com>
3522
3523         PR analyzer/107349
3524         * varargs.cc (get_va_copy_arg): Fix the non-pointer case.
3525
3526 2022-10-24  David Malcolm  <dmalcolm@redhat.com>
3527
3528         PR analyzer/107345
3529         * region-model.cc (region_model::eval_condition_without_cm):
3530         Ensure that constants are on the right-hand side before checking
3531         for them.
3532
3533 2022-10-24  David Malcolm  <dmalcolm@redhat.com>
3534
3535         * engine.cc (impl_region_model_context::get_malloc_map): Replace
3536         with...
3537         (impl_region_model_context::get_state_map_by_name): ...this.
3538         (impl_region_model_context::get_fd_map): Delete.
3539         (impl_region_model_context::get_taint_map): Delete.
3540         * exploded-graph.h (impl_region_model_context::get_fd_map):
3541         Delete.
3542         (impl_region_model_context::get_malloc_map): Delete.
3543         (impl_region_model_context::get_taint_map): Delete.
3544         (impl_region_model_context::get_state_map_by_name): New.
3545         * region-model.h (region_model_context::get_state_map_by_name):
3546         New vfunc.
3547         (region_model_context::get_fd_map): Convert from vfunc to
3548         function.
3549         (region_model_context::get_malloc_map): Likewise.
3550         (region_model_context::get_taint_map): Likewise.
3551         (noop_region_model_context::get_state_map_by_name): New.
3552         (noop_region_model_context::get_fd_map): Delete.
3553         (noop_region_model_context::get_malloc_map): Delete.
3554         (noop_region_model_context::get_taint_map): Delete.
3555         (region_model_context_decorator::get_state_map_by_name): New.
3556         (region_model_context_decorator::get_fd_map): Delete.
3557         (region_model_context_decorator::get_malloc_map): Delete.
3558         (region_model_context_decorator::get_taint_map): Delete.
3559
3560 2022-10-24  David Malcolm  <dmalcolm@redhat.com>
3561
3562         PR analyzer/106300
3563         * engine.cc (impl_region_model_context::get_fd_map): New.
3564         * exploded-graph.h (impl_region_model_context::get_fd_map): New
3565         decl.
3566         * region-model-impl-calls.cc (region_model::impl_call_pipe): New.
3567         * region-model.cc (region_model::update_for_int_cst_return): New,
3568         based on...
3569         (region_model::update_for_zero_return): ...this.  Reimplement in
3570         terms of the former.
3571         (region_model::on_call_pre): Handle "pipe" and "pipe2".
3572         (region_model::on_call_post): Likewise.
3573         * region-model.h (region_model::impl_call_pipe): New decl.
3574         (region_model::update_for_int_cst_return): New decl.
3575         (region_model::mark_as_valid_fd): New decl.
3576         (region_model_context::get_fd_map): New pure virtual fn.
3577         (noop_region_model_context::get_fd_map): New.
3578         (region_model_context_decorator::get_fd_map): New.
3579         * sm-fd.cc: Include "analyzer/program-state.h".
3580         (fd_state_machine::describe_state_change): Handle transitions from
3581         start state to valid states.
3582         (fd_state_machine::mark_as_valid_fd): New.
3583         (fd_state_machine::on_stmt): Add missing return for "creat".
3584         (region_model::mark_as_valid_fd): New.
3585
3586 2022-10-19  David Malcolm  <dmalcolm@redhat.com>
3587
3588         PR analyzer/105765
3589         * varargs.cc (get_BT_VALIST_ARG): Rename to...
3590         (get_va_copy_arg): ...this, and update logic for determining level
3591         of indirection of va_copy's argument to use type of argument,
3592         rather than looking at va_list_type_node, to correctly handle
3593         __builtin_ms_va_copy.
3594         (get_stateful_BT_VALIST_ARG): Rename to...
3595         (get_stateful_va_copy_arg): ...this.
3596         (va_list_state_machine::on_va_copy): Update for renaming.
3597         (region_model::impl_call_va_copy): Likewise.
3598
3599 2022-10-13  David Malcolm  <dmalcolm@redhat.com>
3600
3601         PR analyzer/107210
3602         * svalue.cc (constant_svalue::maybe_fold_bits_within): Only
3603         attempt to extract individual bits when tree_fits_uhwi_p.
3604
3605 2022-10-07  David Malcolm  <dmalcolm@redhat.com>
3606
3607         PR analyzer/105783
3608         * region-model.cc (selftest::get_bit): New function.
3609         (selftest::test_bits_within_svalue_folding): New.
3610         (selfftest::analyzer_region_model_cc_tests): Call it.
3611         * svalue.cc (constant_svalue::maybe_fold_bits_within): Handle the
3612         case of extracting a single bit.
3613
3614 2022-10-06  David Malcolm  <dmalcolm@redhat.com>
3615
3616         PR analyzer/107158
3617         * store.cc (store::replay_call_summary_cluster): Eliminate
3618         special-casing of RK_HEAP_ALLOCATED in favor of sharing code with
3619         RK_DECL, avoiding an ICE due to attempting to bind a
3620         compound_svalue into a binding_cluster when an svalue in the
3621         summary cluster converts to a compound_svalue in the caller.
3622
3623 2022-10-06  David Malcolm  <dmalcolm@redhat.com>
3624
3625         * call-summary.cc (call_summary_replay::dump_to_pp): Bulletproof
3626         against NULL caller regions/svalues.
3627
3628 2022-10-05  David Malcolm  <dmalcolm@redhat.com>
3629
3630         * analysis-plan.cc: Simplify includes.
3631         * analyzer-pass.cc: Likewise.
3632         * analyzer-selftests.cc: Likewise.
3633         * analyzer.cc: Likewise.
3634         * analyzer.h: Add includes of "json.h" and "tristate.h".
3635         * call-info.cc: Simplify includes.
3636         * call-string.cc: Likewise.
3637         * call-summary.cc: Likewise.
3638         * checker-path.cc: Likewise.
3639         * complexity.cc: Likewise.
3640         * constraint-manager.cc: Likewise.
3641         * diagnostic-manager.cc: Likewise.
3642         * engine.cc: Likewise.
3643         * feasible-graph.cc: Likewise.
3644         * known-function-manager.cc: Likewise.
3645         * pending-diagnostic.cc: Likewise.
3646         * program-point.cc: Likewise.
3647         * program-state.cc: Likewise.
3648         * region-model-asm.cc: Likewise.
3649         * region-model-impl-calls.cc: Likewise.
3650         * region-model-manager.cc: Likewise.
3651         * region-model-reachability.cc: Likewise.
3652         * region-model.cc: Likewise.
3653         * region-model.h: Include "selftest.h".
3654         * region.cc: Simplify includes.
3655         * sm-fd.cc: Likewise.
3656         * sm-file.cc: Likewise.
3657         * sm-malloc.cc: Likewise.
3658         * sm-pattern-test.cc: Likewise.
3659         * sm-sensitive.cc: Likewise.
3660         * sm-signal.cc: Likewise.
3661         * sm-taint.cc: Likewise.
3662         * sm.cc: Likewise.
3663         * state-purge.cc: Likewise.
3664         * store.cc: Likewise.
3665         * store.h: Likewise.
3666         * supergraph.cc: Likewise.
3667         * svalue.cc: Likewise.
3668         * svalue.h: Likewise.
3669         * trimmed-graph.cc: Likewise.
3670         * varargs.cc: Likewise.
3671
3672 2022-10-05  David Malcolm  <dmalcolm@redhat.com>
3673
3674         PR analyzer/107060
3675         * call-summary.cc
3676         (call_summary_replay::convert_svalue_from_summary_1): Handle NULL
3677         results from convert_svalue_from_summary in SK_UNARY_OP and
3678         SK_BIN_OP.
3679         * engine.cc (impl_region_model_context::on_unknown_change): Bail
3680         out on svalues that can't have associated state.
3681         * region-model-impl-calls.cc
3682         (region_model::impl_call_analyzer_get_unknown_ptr): New.
3683         * region-model.cc (region_model::on_stmt_pre): Handle
3684         "__analyzer_get_unknown_ptr".
3685         * region-model.h
3686         (region_model::impl_call_analyzer_get_unknown_ptr): New decl.
3687         * store.cc (store::replay_call_summary_cluster): Avoid trying to
3688         create binding clusters for base regions that shouldn't have them.
3689
3690 2022-10-05  Martin Liska  <mliska@suse.cz>
3691
3692         * call-summary.cc (call_summary_replay::call_summary_replay):
3693         Remove unused variable and arguments.
3694         * call-summary.h: Likewise.
3695         * engine.cc (exploded_node::on_stmt): Likewise.
3696         (exploded_node::replay_call_summaries): Likewise.
3697         (exploded_node::replay_call_summary): Likewise.
3698         * exploded-graph.h (class exploded_node): Likewise.
3699
3700 2022-10-05  David Malcolm  <dmalcolm@redhat.com>
3701
3702         PR analyzer/107072
3703         * analyzer-logging.h: Include "diagnostic-core.h".
3704         * analyzer.h: Include "function.h".
3705         (class call_summary): New forward decl.
3706         (class call_summary_replay): New forward decl.
3707         (struct per_function_data): New forward decl.
3708         (struct interesting_t): New forward decl.
3709         (custom_edge_info::update_state): New vfunc.
3710         * call-info.cc (custom_edge_info::update_state): New.
3711         * call-summary.cc: New file.
3712         * call-summary.h: New file.
3713         * constraint-manager.cc: Include "analyzer/call-summary.h".
3714         (class replay_fact_visitor): New.
3715         (constraint_manager::replay_call_summary): New.
3716         * constraint-manager.h (constraint_manager::replay_call_summary):
3717         New.
3718         * engine.cc: Include "analyzer/call-summary.h".
3719         (exploded_node::on_stmt): Handle call summaries.
3720         (class call_summary_edge_info): New.
3721         (exploded_node::replay_call_summaries): New.
3722         (exploded_node::replay_call_summary): New.
3723         (per_function_data::~per_function_data): New.
3724         (per_function_data::add_call_summary): Move here from header and
3725         reimplement.
3726         (exploded_graph::process_node): Call update_state rather than
3727         update_model when handling bifurcation
3728         (viz_callgraph_node::dump_dot): Use a regular label rather
3729         than an HTML table; add summaries to dump.
3730         * exploded-graph.h: Include "alloc-pool.h", "fibonacci_heap.h",
3731         "supergraph.h", "sbitmap.h", "shortest-paths.h", "analyzer/sm.h",
3732         "analyzer/program-state.h", and "analyzer/diagnostic-manager.h".
3733         (exploded_node::replay_call_summaries): New decl.
3734         (exploded_node::replay_call_summary): New decl.
3735         (per_function_data::~per_function_data): New decl.
3736         (per_function_data::add_call_summary): Move implemention from
3737         header.
3738         (per_function_data::m_summaries): Update type of element.
3739         * known-function-manager.h: Include "analyzer/analyzer-logging.h".
3740         * program-point.h: Include "pretty-print.h" and
3741         "analyzer/call-string.h".
3742         * program-state.cc: Include "analyzer/call-summary.h".
3743         (sm_state_map::replay_call_summary): New.
3744         (program_state::replay_call_summary): New.
3745         * program-state.h (sm_state_map::replay_call_summary): New decl.
3746         (program_state::replay_call_summary): New decl.
3747         * region-model-manager.cc
3748         (region_model_manager::get_or_create_asm_output_svalue): New
3749         overload.
3750         * region-model-manager.h
3751         (region_model_manager::get_or_create_asm_output_svalue): New
3752         overload decl.
3753         * region-model.cc: Include "analyzer/call-summary.h".
3754         (region_model::maybe_update_for_edge): Remove call to
3755         region_model::update_for_call_summary on
3756         SUPEREDGE_INTRAPROCEDURAL_CALL.
3757         (region_model::update_for_call_summary): Delete.
3758         (region_model::replay_call_summary): New.
3759         * region-model.h (region_model::replay_call_summary): New decl.
3760         (region_model::update_for_call_summary): Delete decl.
3761         * store.cc: Include "analyzer/call-summary.h".
3762         (store::replay_call_summary): New.
3763         (store::replay_call_summary_cluster): New.
3764         * store.h: Include "tristate.h".
3765         (is_a_helper <const ana::concrete_binding *>::test): New.
3766         (store::replay_call_summary): New decl.
3767         (store::replay_call_summary_cluster): New decl.
3768         * supergraph.cc (get_ultimate_function_for_cgraph_edge): Remove
3769         "static" from decl.
3770         (supergraph_call_edge): Make stmt param const.
3771         * supergraph.h: Include "ordered-hash-map.h", "cfg.h",
3772         "basic-block.h", "gimple.h", "gimple-iterator.h", and "digraph.h".
3773         (supergraph_call_edge): Make stmt param const.
3774         (get_ultimate_function_for_cgraph_edge): New decl.
3775         * svalue.cc (compound_svalue::compound_svalue): Assert that we're
3776         not nesting compound_svalues.
3777         * svalue.h: Include "json.h", "analyzer/store.h", and
3778         "analyzer/program-point.h".
3779         (asm_output_svalue::get_num_outputs): New accessor.
3780
3781 2022-10-05  David Malcolm  <dmalcolm@redhat.com>
3782
3783         * region-model.h: Include "analyzer/region-model-manager.h"
3784         (class region_model_manager): Move decl to...
3785         * region-model-manager.h: ...this new file.
3786
3787 2022-10-05  David Malcolm  <dmalcolm@redhat.com>
3788
3789         * region-model-manager.cc
3790         (region_model_manager::maybe_fold_unaryop): Fold -(-(VAL)) to VAL.
3791
3792 2022-10-05  David Malcolm  <dmalcolm@redhat.com>
3793
3794         * region-model-manager.cc
3795         (region_model_manager::get_or_create_widening_svalue): Use a
3796         function_point rather than a program_point.
3797         * region-model.cc (selftest::test_widening_constraints): Likewise.
3798         * region-model.h
3799         (region_model_manager::get_or_create_widening_svalue): Likewise.
3800         (model_merger::get_function_point): New.
3801         * svalue.cc (svalue::can_merge_p): Use a function_point rather
3802         than a program_point.
3803         (svalue::can_merge_p): Likewise.
3804         * svalue.h (widening_svalue::key_t): Likewise.
3805         (widening_svalue::widening_svalue): Likewise.
3806
3807 2022-09-12  Martin Liska  <mliska@suse.cz>
3808
3809         * region-model.cc (region_model::maybe_complain_about_infoleak):
3810         Remove unused fields.
3811
3812 2022-09-11  Tim Lange  <mail@tim-lange.me>
3813
3814         PR analyzer/106845
3815         * region-model.cc (region_model::check_region_bounds):
3816         Bail out if 0 bytes were accessed.
3817         * store.cc (byte_range::dump_to_pp):
3818         Add special case for empty ranges.
3819         (byte_range::exceeds_p): Restrict to non-empty ranges.
3820         (byte_range::falls_short_of_p): Restrict to non-empty ranges.
3821         * store.h (bit_range::empty_p): New function.
3822         (bit_range::get_last_byte_offset): Restrict to non-empty ranges.
3823         (byte_range::empty_p): New function.
3824         (byte_range::get_last_byte_offset): Restrict to non-empty ranges.
3825
3826 2022-09-09  David Malcolm  <dmalcolm@redhat.com>
3827
3828         * analyzer.opt (Wanalyzer-exposure-through-uninit-copy): New.
3829         * checker-path.cc (region_creation_event::region_creation_event):
3830         Add "capacity" and "kind" params.
3831         (region_creation_event::get_desc): Generalize to different kinds
3832         of event.
3833         (checker_path::add_region_creation_event): Convert to...
3834         (checker_path::add_region_creation_events): ...this.
3835         * checker-path.h (enum rce_kind): New.
3836         (region_creation_event::region_creation_event): Add "capacity" and
3837         "kind" params.
3838         (region_creation_event::m_capacity): New field.
3839         (region_creation_event::m_rce_kind): New field.
3840         (checker_path::add_region_creation_event): Convert to...
3841         (checker_path::add_region_creation_events): ...this.
3842         * diagnostic-manager.cc (diagnostic_manager::build_emission_path):
3843         Update for multiple region creation events.
3844         (diagnostic_manager::add_event_on_final_node): Likewise.
3845         (diagnostic_manager::add_events_for_eedge): Likewise.
3846         * region-model-impl-calls.cc (call_details::get_logger): New.
3847         * region-model.cc: Define INCLUDE_MEMORY before including
3848         "system.h".  Include "gcc-rich-location.h".
3849         (class record_layout): New.
3850         (class exposure_through_uninit_copy): New.
3851         (contains_uninit_p): New.
3852         (region_model::maybe_complain_about_infoleak): New.
3853         * region-model.h (call_details::get_logger): New decl.
3854         (region_model::maybe_complain_about_infoleak): New decl.
3855         (region_model::mark_as_tainted): New decl.
3856         * sm-taint.cc (region_model::mark_as_tainted): New.
3857
3858 2022-09-09  David Malcolm  <dmalcolm@redhat.com>
3859
3860         * analyzer.h (class known_function_manager): New forward decl.
3861         (class known_function): New.
3862         (plugin_analyzer_init_iface::register_known_function): New.
3863         * engine.cc: Include "analyzer/known-function-manager.h".
3864         (plugin_analyzer_init_impl::plugin_analyzer_init_impl): Add
3865         known_fn_mgr param.
3866         (plugin_analyzer_init_impl::register_state_machine): Add
3867         LOC_SCOPE.
3868         (plugin_analyzer_init_impl::register_known_function): New.
3869         (plugin_analyzer_init_impl::m_known_fn_mgr): New.
3870         (impl_run_checkers): Update plugin callback invocation to use
3871         eng's known_function_manager.
3872         * known-function-manager.cc: New file.
3873         * known-function-manager.h: New file.
3874         * region-model-manager.cc
3875         (region_model_manager::region_model_manager): Pass logger to
3876         m_known_fn_mgr's ctor.
3877         * region-model.cc (region_model::update_for_zero_return): New.
3878         (region_model::update_for_nonzero_return): New.
3879         (maybe_simplify_upper_bound): New.
3880         (region_model::maybe_get_copy_bounds): New.
3881         (region_model::get_known_function): New.
3882         (region_model::on_call_pre): Handle plugin-supplied known
3883         functions.
3884         * region-model.h: Include "analyzer/known-function-manager.h".
3885         (region_model_manager::get_known_function_manager): New.
3886         (region_model_manager::m_known_fn_mgr): New.
3887         (call_details::get_model): New accessor.
3888         (region_model::maybe_get_copy_bounds): New decl.
3889         (region_model::update_for_zero_return): New decl.
3890         (region_model::update_for_nonzero_return): New decl.
3891         (region_model::get_known_function): New decl.
3892         (region_model::get_known_function_manager): New.
3893
3894 2022-09-08  Tim Lange  <mail@tim-lange.me>
3895
3896         PR analyzer/106625
3897         * analyzer.h (region_offset): Eliminate m_is_symbolic member.
3898         * region-model-impl-calls.cc (region_model::impl_call_realloc):
3899         Refine implementation to be more precise.
3900         * region-model.cc (class symbolic_past_the_end):
3901         Abstract diagnostic class to complain about accesses past the end
3902         with symbolic values.
3903         (class symbolic_buffer_overflow):
3904         Concrete diagnostic class to complain about buffer overflows with
3905         symbolic values.
3906         (class symbolic_buffer_overread):
3907         Concrete diagnostic class to complain about buffer overreads with
3908         symbolic values.
3909         (region_model::check_symbolic_bounds): New function.
3910         (maybe_get_integer_cst_tree): New helper function.
3911         (region_model::check_region_bounds):
3912         Add call to check_symbolic_bounds if offset is not concrete.
3913         (region_model::eval_condition_without_cm):
3914         Add support for EQ_EXPR and GT_EXPR with binaryop_svalues.
3915         (is_positive_svalue): New hleper function.
3916         (region_model::symbolic_greater_than):
3917         New function to handle GT_EXPR comparisons with symbolic values.
3918         (region_model::structural_equality): New function to compare
3919         whether two svalues are structured the same, i.e. evaluate to
3920         the same value.
3921         (test_struct): Reflect changes to region::calc_offset.
3922         (test_var): Likewise.
3923         (test_array_2): Likewise and add selftest with symbolic i.
3924         * region-model.h (class region_model): Add check_symbolic_bounds,
3925         symbolic_greater_than and structural_equality.
3926         * region.cc (region::get_offset):
3927         Reflect changes to region::calc_offset.
3928         (region::calc_offset):
3929         Compute the symbolic offset if the offset is not concrete.
3930         (region::get_relative_symbolic_offset): New function to return the
3931         symbolic offset in bytes relative to its parent.
3932         (field_region::get_relative_symbolic_offset): Likewise.
3933         (element_region::get_relative_symbolic_offset): Likewise.
3934         (offset_region::get_relative_symbolic_offset): Likewise.
3935         (bit_range_region::get_relative_symbolic_offset): Likewise.
3936         * region.h: Add get_relative_symbolic_offset.
3937         * store.cc (binding_key::make):
3938         Reflect changes to region::calc_offset.
3939         (binding_map::apply_ctor_val_to_range): Likewise.
3940         (binding_map::apply_ctor_pair_to_child_region): Likewise.
3941         (binding_cluster::bind_compound_sval): Likewise.
3942         (binding_cluster::get_any_binding): Likewise.
3943         (binding_cluster::maybe_get_compound_binding): Likewise.
3944
3945 2022-09-05  Tim Lange  <mail@tim-lange.me>
3946
3947         * region-model-impl-calls.cc (region_model::impl_call_strcpy):
3948         Handle the constant string case.
3949         * region-model.cc (region_model::get_string_size):
3950         New function to get the string size from a region or svalue.
3951         * region-model.h (class region_model): Add get_string_size.
3952
3953 2022-09-05  Tim Lange  <mail@tim-lange.me>
3954
3955         * region.cc (cast_region::get_relative_concrete_offset):
3956         New overloaded method.
3957         * region.h: Add cast_region::get_relative_concrete_offset.
3958
3959 2022-08-22  Martin Liska  <mliska@suse.cz>
3960
3961         * region-model.cc: Add missing final keyword.
3962
3963 2022-08-18  Tim Lange  <mail@tim-lange.me>
3964
3965         PR analyzer/106181
3966         * analyzer.opt: Add Wanalyzer-imprecise-floating-point-arithmetic.
3967         * region-model.cc (is_any_cast_p): Formatting.
3968         (region_model::check_region_size): Ensure precondition.
3969         (class imprecise_floating_point_arithmetic): New abstract
3970         diagnostic class for all floating-point related warnings.
3971         (class float_as_size_arg): Concrete diagnostic class to complain
3972         about floating-point operands inside the size argument.
3973         (class contains_floating_point_visitor):
3974         New visitor to find floating-point operands inside svalues.
3975         (region_model::check_dynamic_size_for_floats): New function.
3976         (region_model::set_dynamic_extents):
3977         Call to check_dynamic_size_for_floats.
3978         * region-model.h (class region_model):
3979         Add region_model::check_dynamic_size_for_floats.
3980
3981 2022-08-16  Martin Liska  <mliska@suse.cz>
3982
3983         * region-model.cc: Fix -Winconsistent-missing-override clang
3984         warning.
3985         * region.h: Likewise.
3986
3987 2022-08-15  David Malcolm  <dmalcolm@redhat.com>
3988
3989         PR analyzer/106626
3990         * region-model.cc (buffer_overread::emit): Fix copy&paste error in
3991         direction of the access in the note.
3992
3993 2022-08-15  David Malcolm  <dmalcolm@redhat.com>
3994
3995         PR analyzer/106573
3996         * region-model.cc (region_model::on_call_pre): Use check_call_args
3997         when ensuring that we call get_arg_svalue on all args.  Remove
3998         redundant call from handling for stdio builtins.
3999
4000 2022-08-15  Immad Mir  <mirimmad@outlook.com>
4001
4002         PR analyzer/106551
4003         * sm-fd.cc (check_for_dup): exit early if first
4004         argument is invalid for all dup functions.
4005
4006 2022-08-12  Tim Lange  <mail@tim-lange.me>
4007
4008         PR analyzer/106000
4009         * analyzer.opt: Add Wanalyzer-out-of-bounds.
4010         * region-model.cc (class out_of_bounds): Diagnostics base class
4011         for all out-of-bounds diagnostics.
4012         (class past_the_end): Base class derived from out_of_bounds for
4013         the buffer_overflow and buffer_overread diagnostics.
4014         (class buffer_overflow): Buffer overflow diagnostics.
4015         (class buffer_overread): Buffer overread diagnostics.
4016         (class buffer_underflow): Buffer underflow diagnostics.
4017         (class buffer_underread): Buffer overread diagnostics.
4018         (region_model::check_region_bounds): New function to check region
4019         bounds for out-of-bounds accesses.
4020         (region_model::check_region_access):
4021         Add call to check_region_bounds.
4022         (region_model::get_representative_tree): New function that accepts
4023         a region instead of an svalue.
4024         * region-model.h (class region_model):
4025         Add region_model::check_region_bounds.
4026         * region.cc (region::symbolic_p): New predicate.
4027         (offset_region::get_byte_size_sval): Only return the remaining
4028         byte size on offset_regions.
4029         * region.h: Add region::symbolic_p.
4030         * store.cc (byte_range::intersects_p):
4031         Add new function equivalent to bit_range::intersects_p.
4032         (byte_range::exceeds_p): New function.
4033         (byte_range::falls_short_of_p): New function.
4034         * store.h (struct byte_range): Add byte_range::intersects_p,
4035         byte_range::exceeds_p and byte_range::falls_short_of_p.
4036
4037 2022-08-12  Tim Lange  <mail@tim-lange.me>
4038
4039         PR analyzer/106539
4040         * region-model-impl-calls.cc (region_model::impl_call_realloc):
4041         Use the result of get_copied_size as the size for the
4042         sized_regions in realloc.
4043         (success_with_move::get_copied_size): New function.
4044
4045 2022-08-11  Immad Mir  <mirimmad@outlook.com>
4046
4047         PR analyzer/106551
4048         * sm-fd.cc (check_for_dup): handle the m_start
4049         state when transitioning the state of LHS
4050         of dup, dup2 and dup3 call.
4051
4052 2022-08-09  David Malcolm  <dmalcolm@redhat.com>
4053
4054         PR analyzer/106573
4055         * region-model.cc (region_model::on_call_pre): Ensure that we call
4056         get_arg_svalue on all arguments.
4057
4058 2022-08-05  David Malcolm  <dmalcolm@redhat.com>
4059
4060         PR analyzer/105947
4061         * analyzer.opt (Wanalyzer-jump-through-null): New option.
4062         * engine.cc (class jump_through_null): New.
4063         (exploded_graph::process_node): Complain about jumps through NULL
4064         function pointers.
4065
4066 2022-08-02  Immad Mir  <mirimmad@outlook.com>
4067
4068         PR analyzer/106298
4069         * sm-fd.cc (fd_state_machine::on_open): Add
4070         creat, dup, dup2 and dup3 functions.
4071         (enum dup): New.
4072         (fd_state_machine::valid_to_unchecked_state): New.
4073         (fd_state_machine::on_creat): New.
4074         (fd_state_machine::on_dup): New.
4075
4076 2022-07-28  David Malcolm  <dmalcolm@redhat.com>
4077
4078         PR analyzer/105893
4079         * analyzer.opt (Wanalyzer-putenv-of-auto-var): New.
4080         * region-model-impl-calls.cc (class putenv_of_auto_var): New.
4081         (region_model::impl_call_putenv): New.
4082         * region-model.cc (region_model::on_call_pre): Handle putenv.
4083         * region-model.h (region_model::impl_call_putenv): New decl.
4084
4085 2022-07-28  David Malcolm  <dmalcolm@redhat.com>
4086
4087         * sm-malloc.cc (free_of_non_heap::emit): Add comment about CWE.
4088         * sm-taint.cc (tainted_size::emit): Likewise.
4089
4090 2022-07-28  David Malcolm  <dmalcolm@redhat.com>
4091
4092         * region.h: Add notes to the comment describing the region
4093         class hierarchy.
4094
4095 2022-07-27  Immad Mir  <mirimmad@outlook.com>
4096
4097         PR analyzer/106286
4098         * sm-fd.cc:
4099         (fd_diagnostic::get_meaning_for_state_change): New.
4100
4101 2022-07-26  David Malcolm  <dmalcolm@redhat.com>
4102
4103         PR analyzer/106319
4104         * store.cc (store::set_value): Don't strip away casts if the
4105         region has NULL type.
4106
4107 2022-07-26  David Malcolm  <dmalcolm@redhat.com>
4108
4109         * region.h (code_region::get_element): Remove stray decl.
4110         (function_region::get_element): Likewise.
4111
4112 2022-07-25  Martin Liska  <mliska@suse.cz>
4113
4114         * sm-fd.cc: Run dos2unix and fix coding style issues.
4115
4116 2022-07-23  Immad Mir  <mirimmad@outlook.com>
4117
4118         * sm-fd.cc (fd_param_diagnostic): New diagnostic class.
4119         (fd_access_mode_mismatch): Change inheritance from fd_diagnostic
4120         to fd_param_diagnostic. Add new overloaded constructor.
4121         (fd_use_after_close): Likewise.
4122         (unchecked_use_of_fd): Likewise and also change name to fd_use_without_check.
4123         (double_close): Change name to fd_double_close.
4124         (enum access_directions): New.
4125         (fd_state_machine::on_stmt): Handle calls to function with the
4126         new three function attributes.
4127         (fd_state_machine::check_for_fd_attrs): New.
4128         (fd_state_machine::on_open): Use the new overloaded constructors
4129         of diagnostic classes.
4130
4131 2022-07-22  David Malcolm  <dmalcolm@redhat.com>
4132
4133         PR analyzer/106413
4134         * varargs.cc (region_model::impl_call_va_start): Avoid iterating
4135         through non-existant variadic arguments by initializing the
4136         impl_region to "UNKNOWN" if the va_start occurs in the top-level
4137         function to the analysis.
4138
4139 2022-07-22  David Malcolm  <dmalcolm@redhat.com>
4140
4141         PR analyzer/106401
4142         * store.cc (binding_cluster::binding_cluster): Remove overzealous
4143         assertion; we're checking for tracked_p in
4144         store::get_or_create_cluster.
4145
4146 2022-07-22  Tim Lange  <mail@tim-lange.me>
4147
4148         PR analyzer/106394
4149         * region-model.cc (capacity_compatible_with_type): Always return true
4150         if alloc_size is zero.
4151
4152 2022-07-21  David Malcolm  <dmalcolm@redhat.com>
4153
4154         PR analyzer/106383
4155         * varargs.cc (region_model::impl_call_va_arg): When determining if
4156         we're doing interprocedural analysis, use the stack depth of the
4157         frame in which va_start was called, rather than the current stack
4158         depth.
4159
4160 2022-07-21  David Malcolm  <dmalcolm@redhat.com>
4161
4162         * sm-taint.cc (tainted_array_index::emit): Bulletproof against
4163         NULL m_arg.
4164         (tainted_array_index::describe_final_event): Likewise.
4165         (tainted_size::emit): Likewise.
4166         (tainted_size::describe_final_event): Likewise.
4167
4168 2022-07-21  David Malcolm  <dmalcolm@redhat.com>
4169
4170         PR analyzer/106374
4171         * region.cc (decl_region::get_svalue_for_initializer): Bail out on
4172         untracked regions.
4173
4174 2022-07-20  David Malcolm  <dmalcolm@redhat.com>
4175
4176         PR analyzer/106373
4177         * sm-taint.cc (taint_state_machine::on_condition): Potentially
4178         update the state of the RHS as well as the LHS.
4179
4180 2022-07-20  David Malcolm  <dmalcolm@redhat.com>
4181
4182         PR analyzer/106359
4183         * region.h (string_region::tracked_p): New.
4184         * store.cc (binding_cluster::binding_cluster): Move here from
4185         store.h.  Add assertion that base_region is tracked_p.
4186         * store.h (binding_cluster::binding_cluster): Move to store.cc.
4187
4188 2022-07-19  David Malcolm  <dmalcolm@redhat.com>
4189
4190         PR analyzer/106321
4191         * constraint-manager.h (bounded_ranges::get_count): New.
4192         (bounded_ranges::get_range): New.
4193         * engine.cc (impl_region_model_context::on_bounded_ranges): New.
4194         * exploded-graph.h (impl_region_model_context::on_bounded_ranges):
4195         New decl.
4196         * region-model.cc (region_model::apply_constraints_for_gswitch):
4197         Potentially call ctxt->on_bounded_ranges.
4198         * region-model.h (region_model_context::on_bounded_ranges): New
4199         vfunc.
4200         (noop_region_model_context::on_bounded_ranges): New.
4201         (region_model_context_decorator::on_bounded_ranges): New.
4202         * sm-taint.cc: Include "analyzer/constraint-manager.h".
4203         (taint_state_machine::on_bounded_ranges): New.
4204         * sm.h (state_machine::on_bounded_ranges): New.
4205
4206 2022-07-19  David Malcolm  <dmalcolm@redhat.com>
4207
4208         * engine.cc (exploded_graph::process_node): Show any description
4209         of the out-edge when logging it for consideration.
4210
4211 2022-07-15  David Malcolm  <dmalcolm@redhat.com>
4212
4213         PR analyzer/106284
4214         * sm-taint.cc (taint_state_machine::on_condition): Handle range
4215         checks optimized by build_range_check.
4216
4217 2022-07-15  Jonathan Wakely  <jwakely@redhat.com>
4218
4219         * call-info.cc (call_info::print): Adjust to new label_text API.
4220         * checker-path.cc (checker_event::dump): Likewise.
4221         (region_creation_event::get_desc): Likewise.
4222         (state_change_event::get_desc): Likewise.
4223         (superedge_event::should_filter_p): Likewise.
4224         (start_cfg_edge_event::get_desc): Likewise.
4225         (call_event::get_desc): Likewise.
4226         (return_event::get_desc): Likewise.
4227         (warning_event::get_desc): Likewise.
4228         (checker_path::dump): Likewise.
4229         (checker_path::debug): Likewise.
4230         * diagnostic-manager.cc (diagnostic_manager::prune_for_sm_diagnostic):
4231         Likewise.
4232         (diagnostic_manager::prune_interproc_events): Likewise.
4233         * engine.cc (feasibility_state::maybe_update_for_edge):
4234         Likewise.
4235         * program-state.cc (sm_state_map::to_json): Likewise.
4236         * region-model-impl-calls.cc (region_model::impl_call_analyzer_describe): Likewise.
4237         (region_model::impl_call_analyzer_dump_capacity): Likewise.
4238         * region.cc (region::to_json): Likewise.
4239         * sm-malloc.cc (inform_nonnull_attribute): Likewise.
4240         * store.cc (binding_map::to_json): Likewise.
4241         (store::to_json): Likewise.
4242         * supergraph.cc (superedge::dump): Likewise.
4243         * svalue.cc (svalue::to_json): Likewise.
4244
4245 2022-07-07  David Malcolm  <dmalcolm@redhat.com>
4246
4247         * checker-path.cc (start_cfg_edge_event::get_desc): Update for
4248         superedge::get_description returning a label_text.
4249         * engine.cc (feasibility_state::maybe_update_for_edge): Likewise.
4250         * supergraph.cc (superedge::dump): Likewise.
4251         (superedge::get_description): Convert return type from char * to
4252         label_text.
4253         * supergraph.h (superedge::get_description): Likewise.
4254
4255 2022-07-07  David Malcolm  <dmalcolm@redhat.com>
4256
4257         * call-info.cc (call_info::print): Update for removal of
4258         label_text::maybe_free in favor of automatic memory management.
4259         * checker-path.cc (checker_event::dump): Likewise.
4260         (checker_event::prepare_for_emission): Likewise.
4261         (state_change_event::get_desc): Likewise.
4262         (superedge_event::should_filter_p): Likewise.
4263         (start_cfg_edge_event::get_desc): Likewise.
4264         (warning_event::get_desc): Likewise.
4265         (checker_path::dump): Likewise.
4266         (checker_path::debug): Likewise.
4267         * diagnostic-manager.cc
4268         (diagnostic_manager::prune_for_sm_diagnostic): Likewise.
4269         (diagnostic_manager::prune_interproc_events): Likewise.
4270         * program-state.cc (sm_state_map::to_json): Likewise.
4271         * region.cc (region::to_json): Likewise.
4272         * sm-malloc.cc (inform_nonnull_attribute): Likewise.
4273         * store.cc (binding_map::to_json): Likewise.
4274         (store::to_json): Likewise.
4275         * svalue.cc (svalue::to_json): Likewise.
4276
4277 2022-07-07  David Malcolm  <dmalcolm@redhat.com>
4278
4279         PR analyzer/106225
4280         * sm-taint.cc (taint_state_machine::on_stmt): Move handling of
4281         assignments from division to...
4282         (taint_state_machine::check_for_tainted_divisor): ...this new
4283         function.  Reject warning when the divisor is known to be non-zero.
4284         * sm.cc: Include "analyzer/program-state.h".
4285         (sm_context::get_old_region_model): New.
4286         * sm.h (sm_context::get_old_region_model): New decl.
4287
4288 2022-07-06  Immad Mir  <mirimmad@outlook.com>
4289
4290         PR analyzer/106184
4291         * sm-fd.cc (fd_state_machine): Change ordering of initialization
4292         of state m_invalid so that the order of initializers is same as
4293         the ordering of the fields in the class decl.
4294
4295 2022-07-06  Immad Mir  <mirimmad@outlook.com>
4296
4297         * sm-fd.cc (use_after_close): save the "close" event and
4298         show it where possible.
4299
4300 2022-07-06  David Malcolm  <dmalcolm@redhat.com>
4301
4302         PR analyzer/106204
4303         * region-model.cc (within_short_circuited_stmt_p): Move extraction
4304         of assign_stmt to caller.
4305         (due_to_ifn_deferred_init_p): New.
4306         (region_model::check_for_poison): Move extraction of assign_stmt
4307         from within_short_circuited_stmt_p to here.  Share logic with
4308         call to due_to_ifn_deferred_init_p.
4309
4310 2022-07-02  Tim Lange  <mail@tim-lange.me>
4311
4312         PR analyzer/105900
4313         * analyzer.opt: Added Wanalyzer-allocation-size.
4314         * checker-path.cc (region_creation_event::get_desc): Added call to new
4315         virtual function pending_diagnostic::describe_region_creation_event.
4316         * checker-path.h: Added region_creation_event::get_desc.
4317         * diagnostic-manager.cc (diagnostic_manager::add_event_on_final_node):
4318         New function.
4319         * diagnostic-manager.h:
4320         Added diagnostic_manager::add_event_on_final_node.
4321         * pending-diagnostic.h (struct region_creation): New event_desc struct.
4322         (pending_diagnostic::describe_region_creation_event): Added virtual
4323         function to overwrite description of a region creation.
4324         * region-model.cc (class dubious_allocation_size): New class.
4325         (capacity_compatible_with_type): New helper function.
4326         (class size_visitor): New class.
4327         (struct_or_union_with_inheritance_p): New helper function.
4328         (is_any_cast_p): New helper function.
4329         (region_model::check_region_size): New function.
4330         (region_model::set_value): Added call to
4331         region_model::check_region_size.
4332         * region-model.h (class region_model): New function check_region_size.
4333         * svalue.cc (region_svalue::accept): Changed to post-order traversal.
4334         (initial_svalue::accept): Likewise.
4335         (unaryop_svalue::accept): Likewise.
4336         (binop_svalue::accept): Likewise.
4337         (sub_svalue::accept): Likewise.
4338         (repeated_svalue::accept): Likewise.
4339         (bits_within_svalue::accept): Likewise.
4340         (widening_svalue::accept): Likewise.
4341         (unmergeable_svalue::accept): Likewise.
4342         (compound_svalue::accept): Likewise.
4343         (conjured_svalue::accept): Likewise.
4344         (asm_output_svalue::accept): Likewise.
4345         (const_fn_result_svalue::accept): Likewise.
4346
4347 2022-07-02  Immad Mir  <mirimmad17@gmail.com>
4348
4349         PR analyzer/106003
4350         * analyzer.opt (Wanalyzer-fd-leak): New option.
4351         (Wanalyzer-fd-access-mode-mismatch): New option.
4352         (Wanalyzer-fd-use-without-check): New option.
4353         (Wanalyzer-fd-double-close): New option.
4354         (Wanalyzer-fd-use-after-close): New option.
4355         * sm.h (make_fd_state_machine): New decl.
4356         * sm.cc (make_checkers): Call make_fd_state_machine.
4357         * sm-fd.cc: New file.
4358
4359 2022-06-24  David Malcolm  <dmalcolm@redhat.com>
4360
4361         * call-string.cc: Add includes of "analyzer/analyzer.h"
4362         and "analyzer/analyzer-logging.h".
4363         (call_string::call_string): Delete copy ctor.
4364         (call_string::operator=): Delete.
4365         (call_string::operator==): Delete.
4366         (call_string::hash): Delete.
4367         (call_string::push_call): Make const, returning the resulting
4368         call_string.
4369         (call_string::pop): Delete.
4370         (call_string::cmp_ptr_ptr): New.
4371         (call_string::validate): Assert that m_parent is non-NULL, or
4372         m_elements is empty.
4373         (call_string::call_string): Move default ctor here from
4374         call-string.h and reimplement.  Add ctor taking a parent
4375         and an element.
4376         (call_string::~call_string): New.
4377         (call_string::recursive_log): New.
4378         * call-string.h (call_string::call_string): Move default ctor's
4379         defn to call-string.cc.  Delete copy ctor.  Add ctor taking a
4380         parent and an element.
4381         (call_string::operator=): Delete.
4382         (call_string::operator==): Delete.
4383         (call_string::hash): Delete.
4384         (call_string::push_call): Make const, returning the resulting
4385         call_string.
4386         (call_string::pop): Delete decl.
4387         (call_string::get_parent): New.
4388         (call_string::cmp_ptr_ptr): New decl.
4389         (call_string::get_top_of_stack): New.
4390         (struct call_string::hashmap_traits_t): New.
4391         (class call_string): Add friend class region_model_manager.  Add
4392         DISABLE_COPY_AND_ASSIGN.
4393         (call_string::~call_string): New decl.
4394         (call_string::recursive_log): New decl.
4395         (call_string::m_parent): New field.
4396         (call_string::m_children): New field.
4397         * constraint-manager.cc (selftest::test_many_constants): Pass
4398         model manager to program_point::origin.
4399         * engine.cc (exploded_graph::exploded_graph): Likewise.
4400         (exploded_graph::add_function_entry): Likewise for
4401         program_point::from_function_entry.
4402         (add_tainted_args_callback): Likewise.
4403         (exploded_graph::maybe_process_run_of_before_supernode_enodes):
4404         Update for change to program_point.get_call_string.
4405         (exploded_graph::process_node): Likewise.
4406         (class function_call_string_cluster): Convert m_cs from a
4407         call_string to a const call_string &.
4408         (struct function_call_string): Likewise.
4409         (pod_hash_traits<function_call_string>::hash): Use pointer_hash
4410         for m_cs.
4411         (pod_hash_traits<function_call_string>::equal): Update for change
4412         to m_cs.
4413         (root_cluster::add_node): Update for change to
4414         function_call_string.
4415         (viz_callgraph_node::dump_dot): Update for change to call_string.
4416         * exploded-graph.h (per_call_string_data::m_key): Convert to a
4417         reference.
4418         (struct eg_call_string_hash_map_traits): Delete.
4419         (exploded_graph::call_string_data_map_t): Remove traits class.
4420         * program-point.cc: Move include of "analyzer/call-string.h" to
4421         after "analyzer/analyzer-logging.h".
4422         (program_point::print): Update for conversion of m_call_string to
4423         a pointer.
4424         (program_point::to_json): Likewise.
4425         (program_point::push_to_call_stack): Update for immutability of
4426         call strings.
4427         (program_point::pop_from_call_stack): Likewise.
4428         (program_point::hash): Use pointer hashing for m_call_string.
4429         (program_point::get_function_at_depth): Update for change to
4430         m_call_string.
4431         (program_point::validate): Update for changes to call_string.
4432         (program_point::on_edge): Likewise.
4433         (program_point::origin): Move here from call-string.h.  Add
4434         region_model_manager param and use it to get empty call string.
4435         (program_point::from_function_entry): Likewise.
4436         (selftest::test_function_point_ordering): Likewise.
4437         (selftest::test_function_point_ordering): Likewise.
4438         * program-point.h (program_point::program_point): Update for
4439         change to m_call_string.
4440         (program_point::get_call_string): Likewise.
4441         (program_point::get_stack_depth): Likewise.
4442         (program_point::origin): Add region_model_manager param, and move
4443         defn to call-string.cc.
4444         (program_point::from_function_entry): Likewise.
4445         (program_point::empty): Drop call_string.
4446         (program_point::deleted): Likewise.
4447         (program_point::program_point): New private ctor.
4448         (program_point::m_call_string): Convert from call_string to const
4449         call_string *.
4450         * program-state.cc (selftest::test_program_state_merging): Update
4451         for call_string changes.
4452         (selftest::test_program_state_merging_2): Likewise.
4453         * region-model-manager.cc
4454         (region_model_manager::region_model_manager): Construct
4455         m_empty_call_string.
4456         (region_model_manager::log_stats): Log the call strings.
4457         * region-model.cc (assert_region_models_merge): Pass the
4458         region_model_manager when creating program_point instances.
4459         (selftest::test_state_merging): Likewise.
4460         (selftest::test_constraint_merging): Likewise.
4461         (selftest::test_widening_constraints): Likewise.
4462         (selftest::test_iteration_1): Likewise.
4463         * region-model.h (region_model_manager::get_empty_call_string):
4464         New.
4465         (region_model_manager::m_empty_call_string): New.
4466         * sm-signal.cc (register_signal_handler::impl_transition): Update
4467         for changes to call_string.
4468
4469 2022-06-24  David Malcolm  <dmalcolm@redhat.com>
4470
4471         * call-string.cc (call_string::calc_recursion_depth): Whitespace
4472         cleanups.
4473         (call_string::cmp): Likewise.
4474         (call_string::get_caller_node): Likewise.
4475         (call_string::validate): Likewise.
4476         * engine.cc (dynamic_call_info_t::add_events_to_path): Likewise.
4477         (exploded_graph::get_per_function_data): Likewise.
4478         (exploded_graph::maybe_create_dynamic_call): Likewise.
4479         (exploded_graph::maybe_create_dynamic_call): Likewise.
4480         (exploded_graph::process_node): Likewise.
4481
4482 2022-06-16  David Malcolm  <dmalcolm@redhat.com>
4483
4484         * varargs.cc (va_arg_type_mismatch::emit): Associate the warning
4485         with CWE-686 ("Function Call With Incorrect Argument Type").
4486
4487 2022-06-16  David Malcolm  <dmalcolm@redhat.com>
4488
4489         * varargs.cc: Include "diagnostic-metadata.h".
4490         (va_list_exhausted::emit): Associate the warning with
4491         CWE-685 ("Function Call With Incorrect Number of Arguments").
4492
4493 2022-06-16  David Malcolm  <dmalcolm@redhat.com>
4494
4495         * sm-file.cc (double_fclose::emit): Associate the warning with
4496         CWE-1341 ("Multiple Releases of Same Resource or Handle").
4497
4498 2022-06-15  David Malcolm  <dmalcolm@redhat.com>
4499
4500         PR analyzer/105962
4501         * analyzer.opt (fanalyzer-undo-inlining): New option.
4502         * checker-path.cc: Include "diagnostic-core.h" and
4503         "inlining-iterator.h".
4504         (event_kind_to_string): Handle EK_INLINED_CALL.
4505         (class inlining_info): New class.
4506         (checker_event::checker_event): Move here from checker-path.h.
4507         Store original fndecl and depth, and calculate effective fndecl
4508         and depth based on inlining information.
4509         (checker_event::dump): Emit original depth as well as effective
4510         depth when they differ; likewise for fndecl.
4511         (region_creation_event::get_desc): Use m_effective_fndecl.
4512         (inlined_call_event::get_desc): New.
4513         (inlined_call_event::get_meaning): New.
4514         (checker_path::inject_any_inlined_call_events): New.
4515         * checker-path.h (enum event_kind): Add EK_INLINED_CALL.
4516         (checker_event::checker_event): Make protected, and move
4517         definition to checker-path.cc.
4518         (checker_event::get_fndecl): Use effective fndecl.
4519         (checker_event::get_stack_depth): Use effective stack depth.
4520         (checker_event::get_logical_location): Use effective stack depth.
4521         (checker_event::get_original_stack_depth): New.
4522         (checker_event::m_fndecl): Rename to...
4523         (checker_event::m_original_fndecl): ...this.
4524         (checker_event::m_depth): Rename to...
4525         (checker_event::m_original_depth): ...this.
4526         (checker_event::m_effective_fndecl): New field.
4527         (checker_event::m_effective_depth): New field.
4528         (class inlined_call_event): New checker_event subclass.
4529         (checker_path::inject_any_inlined_call_events): New decl.
4530         * diagnostic-manager.cc: Include "inlining-iterator.h".
4531         (diagnostic_manager::emit_saved_diagnostic): Call
4532         checker_path::inject_any_inlined_call_events.
4533         (diagnostic_manager::prune_for_sm_diagnostic): Handle
4534         EK_INLINED_CALL.
4535         * engine.cc (tainted_args_function_custom_event::get_desc): Use
4536         effective fndecl.
4537         * inlining-iterator.h: New file.
4538
4539 2022-06-15  David Malcolm  <dmalcolm@redhat.com>
4540
4541         * diagnostic-manager.cc (saved_diagnostic::dump_dot_id): New.
4542         (saved_diagnostic::dump_as_dot_node): New.
4543         * diagnostic-manager.h (saved_diagnostic::dump_dot_id): New decl.
4544         (saved_diagnostic::dump_as_dot_node): New decl.
4545         * engine.cc (exploded_node::dump_dot): Add nodes for saved
4546         diagnostics.
4547
4548 2022-06-02  David Malcolm  <dmalcolm@redhat.com>
4549
4550         * checker-path.cc (checker_event::get_meaning): New.
4551         (function_entry_event::get_meaning): New.
4552         (state_change_event::get_desc): Add dump of meaning of the event
4553         to the -fanalyzer-verbose-state-changes output.
4554         (state_change_event::get_meaning): New.
4555         (cfg_edge_event::get_meaning): New.
4556         (call_event::get_meaning): New.
4557         (return_event::get_meaning): New.
4558         (start_consolidated_cfg_edges_event::get_meaning): New.
4559         (warning_event::get_meaning): New.
4560         * checker-path.h: Include "tree-logical-location.h".
4561         (checker_event::checker_event): Construct m_logical_loc.
4562         (checker_event::get_logical_location): New.
4563         (checker_event::get_meaning): New decl.
4564         (checker_event::m_logical_loc): New.
4565         (function_entry_event::get_meaning): New decl.
4566         (state_change_event::get_meaning): New decl.
4567         (cfg_edge_event::get_meaning): New decl.
4568         (call_event::get_meaning): New decl.
4569         (return_event::get_meaning): New decl.
4570         (start_consolidated_cfg_edges_event::get_meaning): New.
4571         (warning_event::get_meaning): New decl.
4572         * pending-diagnostic.h: Include "diagnostic-path.h".
4573         (pending_diagnostic::get_meaning_for_state_change): New vfunc.
4574         * sm-file.cc (file_diagnostic::get_meaning_for_state_change): New
4575         vfunc impl.
4576         * sm-malloc.cc (malloc_diagnostic::get_meaning_for_state_change):
4577         Likewise.
4578         * sm-sensitive.cc
4579         (exposure_through_output_file::get_meaning_for_state_change):
4580         Likewise.
4581         * sm-taint.cc (taint_diagnostic::get_meaning_for_state_change):
4582         Likewise.
4583         * varargs.cc
4584         (va_list_sm_diagnostic::get_meaning_for_state_change): Likewise.
4585
4586 2022-05-23  David Malcolm  <dmalcolm@redhat.com>
4587
4588         * call-info.cc: Add "final" and "override" to all vfunc
4589         implementations that were missing them, as appropriate.
4590         * engine.cc: Likewise.
4591         * region-model.cc: Likewise.
4592         * sm-malloc.cc: Likewise.
4593         * supergraph.h: Likewise.
4594         * svalue.cc: Likewise.
4595         * varargs.cc: Likewise.
4596
4597 2022-05-20  David Malcolm  <dmalcolm@redhat.com>
4598
4599         * analyzer-pass.cc: Replace uses of "FINAL" and "OVERRIDE" with
4600         "final" and "override".
4601         * call-info.h: Likewise.
4602         * checker-path.h: Likewise.
4603         * constraint-manager.cc: Likewise.
4604         * diagnostic-manager.cc: Likewise.
4605         * engine.cc: Likewise.
4606         * exploded-graph.h: Likewise.
4607         * feasible-graph.h: Likewise.
4608         * pending-diagnostic.h: Likewise.
4609         * region-model-impl-calls.cc: Likewise.
4610         * region-model.cc: Likewise.
4611         * region-model.h: Likewise.
4612         * region.h: Likewise.
4613         * sm-file.cc: Likewise.
4614         * sm-malloc.cc: Likewise.
4615         * sm-pattern-test.cc: Likewise.
4616         * sm-sensitive.cc: Likewise.
4617         * sm-signal.cc: Likewise.
4618         * sm-taint.cc: Likewise.
4619         * state-purge.h: Likewise.
4620         * store.cc: Likewise.
4621         * store.h: Likewise.
4622         * supergraph.h: Likewise.
4623         * svalue.h: Likewise.
4624         * trimmed-graph.h: Likewise.
4625         * varargs.cc: Likewise.
4626
4627 2022-05-16  David Malcolm  <dmalcolm@redhat.com>
4628
4629         PR analyzer/105103
4630         * analyzer.cc (make_label_text_n): New.
4631         * analyzer.h (class var_arg_region): New forward decl.
4632         (make_label_text_n): New decl.
4633         * analyzer.opt (Wanalyzer-va-arg-type-mismatch): New option.
4634         (Wanalyzer-va-list-exhausted): New option.
4635         (Wanalyzer-va-list-leak): New option.
4636         (Wanalyzer-va-list-use-after-va-end): New option.
4637         * checker-path.cc (call_event::get_desc): Split out decl access
4638         into..
4639         (call_event::get_caller_fndecl): ...this new function and...
4640         (call_event::get_callee_fndecl): ...this new function.
4641         * checker-path.h (call_event::get_desc): Drop "FINAL".
4642         (call_event::get_caller_fndecl): New decl.
4643         (call_event::get_callee_fndecl): New decl.
4644         (class call_event): Make fields protected.
4645         * diagnostic-manager.cc (null_assignment_sm_context::warn): New
4646         overload.
4647         (null_assignment_sm_context::get_new_program_state): New.
4648         (diagnostic_manager::add_events_for_superedge): Move case
4649         SUPEREDGE_CALL to a new pending_diagnostic::add_call_event vfunc.
4650         * engine.cc (impl_sm_context::warn): Implement new override.
4651         (impl_sm_context::get_new_program_state): New.
4652         * pending-diagnostic.cc: Include "analyzer/diagnostic-manager.h",
4653         "cpplib.h", "digraph.h", "ordered-hash-map.h", "cfg.h",
4654         "basic-block.h", "gimple.h", "gimple-iterator.h", "cgraph.h"
4655         "analyzer/supergraph.h", "analyzer/program-state.h",
4656         "alloc-pool.h", "fibonacci_heap.h", "shortest-paths.h",
4657         "sbitmap.h", "analyzer/exploded-graph.h", "diagnostic-path.h",
4658         and "analyzer/checker-path.h".
4659         (ht_ident_eq): New.
4660         (fixup_location_in_macro_p): New.
4661         (pending_diagnostic::fixup_location): New.
4662         (pending_diagnostic::add_call_event): New.
4663         * pending-diagnostic.h (pending_diagnostic::fixup_location): Drop
4664         no-op inline implementation in favor of the more complex
4665         implementation above.
4666         (pending_diagnostic::add_call_event): New vfunc.
4667         * region-model-impl-calls.cc: Include "analyzer/sm.h",
4668         "diagnostic-path.h", and "analyzer/pending-diagnostic.h".
4669         * region-model-manager.cc
4670         (region_model_manager::get_var_arg_region): New.
4671         (region_model_manager::log_stats): Log m_var_arg_regions.
4672         * region-model.cc (region_model::on_call_pre): Handle IFN_VA_ARG,
4673         BUILT_IN_VA_START, and BUILT_IN_VA_COPY.
4674         (region_model::on_call_post): Handle BUILT_IN_VA_END.
4675         (region_model::get_representative_path_var_1): Handle RK_VAR_ARG.
4676         (region_model::push_frame): Push variadic arguments.
4677         * region-model.h (region_model_manager::get_var_arg_region): New
4678         decl.
4679         (region_model_manager::m_var_arg_regions): New field.
4680         (region_model::impl_call_va_start): New decl.
4681         (region_model::impl_call_va_copy): New decl.
4682         (region_model::impl_call_va_arg): New decl.
4683         (region_model::impl_call_va_end): New decl.
4684         * region.cc (alloca_region::dump_to_pp): Dump the id.
4685         (var_arg_region::dump_to_pp): New.
4686         (var_arg_region::get_frame_region): New.
4687         * region.h (enum region_kind): Add RK_VAR_ARG.
4688         (region::dyn_cast_var_arg_region): New.
4689         (class var_arg_region): New.
4690         (is_a_helper <const var_arg_region *>::test): New.
4691         (struct default_hash_traits<var_arg_region::key_t>): New.
4692         * sm.cc (make_checkers): Call make_va_list_state_machine.
4693         * sm.h (sm_context::warn): New vfunc.
4694         (sm_context::get_old_svalue): Drop unused decl.
4695         (sm_context::get_new_program_state): New vfunc.
4696         (make_va_list_state_machine): New decl.
4697         * varargs.cc: New file.
4698
4699 2022-05-16  Martin Liska  <mliska@suse.cz>
4700
4701         * engine.cc (exploded_node::get_dot_fillcolor): Use ARRAY_SIZE.
4702         * function-set.cc (test_stdio_example): Likewise.
4703         * sm-file.cc (get_file_using_fns): Likewise.
4704         * sm-malloc.cc (malloc_state_machine::unaffected_by_call_p): Likewise.
4705         * sm-signal.cc (get_async_signal_unsafe_fns): Likewise.
4706
4707 2022-05-13  Richard Biener  <rguenther@suse.de>
4708
4709         * supergraph.cc: Re-order gimple-fold.h include.
4710
4711 2022-05-11  David Malcolm  <dmalcolm@redhat.com>
4712
4713         * checker-path.cc (state_change_event::get_desc): Call maybe_free
4714         on label_text temporaries.
4715         * diagnostic-manager.cc
4716         (diagnostic_manager::prune_for_sm_diagnostic): Likewise.
4717         * engine.cc (exploded_graph::~exploded_graph): Fix leak of
4718         m_per_point_data and m_per_call_string_data values.  Simplify
4719         cleanup of m_per_function_stats and m_per_point_data values.
4720         (feasibility_state::maybe_update_for_edge): Fix leak of result of
4721         superedge::get_description.
4722         * region-model-manager.cc
4723         (region_model_manager::~region_model_manager): Move cleanup of
4724         m_setjmp_values to match the ordering of the fields within
4725         region_model_manager.  Fix leak of values within
4726         m_repeated_values_map, m_bits_within_values_map,
4727         m_asm_output_values_map, and m_const_fn_result_values_map.
4728
4729 2022-04-28  David Malcolm  <dmalcolm@redhat.com>
4730
4731         PR analyzer/105285
4732         * store.cc (binding_cluster::get_any_binding): Handle accessing
4733         sub_svalues of clusters where the base region has a symbolic
4734         binding.
4735
4736 2022-04-28  David Malcolm  <dmalcolm@redhat.com>
4737
4738         * diagnostic-manager.cc (epath_finder::process_worklist_item):
4739         Call dump_feasible_path when a path that reaches the the target
4740         enode is found.
4741         (epath_finder::dump_feasible_path): New.
4742         * engine.cc (feasibility_state::dump_to_pp): New.
4743         * exploded-graph.h (feasibility_state::dump_to_pp): New decl.
4744         * feasible-graph.cc (feasible_graph::dump_feasible_path): New.
4745         * feasible-graph.h (feasible_graph::dump_feasible_path): New
4746         decls.
4747         * program-point.cc (function_point::print): Fix missing trailing
4748         newlines.
4749         * program-point.h (program_point::print_source_line): Remove
4750         unimplemented decl.
4751
4752 2022-04-25  David Malcolm  <dmalcolm@redhat.com>
4753
4754         PR analyzer/105365
4755         PR analyzer/105366
4756         * svalue.cc
4757         (cmp_cst): Rename to...
4758         (cmp_csts_same_type): ...this.  Convert all recursive calls to
4759         calls to...
4760         (cmp_csts_and_types): ....this new function.
4761         (svalue::cmp_ptr): Update for renaming of cmp_cst
4762
4763 2022-04-14  David Malcolm  <dmalcolm@redhat.com>
4764
4765         PR analyzer/105264
4766         * region-model-reachability.cc (reachable_regions::handle_parm):
4767         Use maybe_get_deref_base_region rather than just region_svalue, to
4768         handle pointer arithmetic also.
4769         * svalue.cc (svalue::maybe_get_deref_base_region): New.
4770         * svalue.h (svalue::maybe_get_deref_base_region): New decl.
4771
4772 2022-04-14  David Malcolm  <dmalcolm@redhat.com>
4773
4774         PR analyzer/105252
4775         * svalue.cc (cmp_cst): When comparing VECTOR_CSTs, compare the
4776         types of the encoded elements before calling cmp_cst on them.
4777
4778 2022-04-09  David Malcolm  <dmalcolm@redhat.com>
4779
4780         PR analyzer/103892
4781         * region-model-manager.cc
4782         (region_model_manager::get_unknown_symbolic_region): New,
4783         extracted from...
4784         (region_model_manager::get_field_region): ...here.
4785         (region_model_manager::get_element_region): Use it here.
4786         (region_model_manager::get_offset_region): Likewise.
4787         (region_model_manager::get_sized_region): Likewise.
4788         (region_model_manager::get_cast_region): Likewise.
4789         (region_model_manager::get_bit_range): Likewise.
4790         * region-model.h
4791         (region_model_manager::get_unknown_symbolic_region): New decl.
4792         * region.cc (symbolic_region::symbolic_region): Handle sval_ptr
4793         having NULL type.
4794         (symbolic_region::dump_to_pp): Handle having NULL type.
4795
4796 2022-04-07  David Malcolm  <dmalcolm@redhat.com>
4797
4798         PR analyzer/102208
4799         * store.cc (binding_map::remove_overlapping_bindings): Add
4800         "always_overlap" param, using it to generalize to the case where
4801         we want to remove all bindings.  Update "uncertainty" logic to
4802         only record maybe-bound values for cases where there is a symbolic
4803         write involved.
4804         (binding_cluster::mark_region_as_unknown): Split param "reg" into
4805         "reg_to_bind" and "reg_for_overlap".
4806         (binding_cluster::maybe_get_compound_binding): Pass "false" to
4807         binding_map::remove_overlapping_bindings new "always_overlap" param.
4808         (binding_cluster::remove_overlapping_bindings): Determine
4809         "always_overlap" and pass it to
4810         binding_map::remove_overlapping_bindings.
4811         (store::set_value): Pass uncertainty to remove_overlapping_bindings
4812         call.  Update for new param of
4813         binding_cluster::mark_region_as_unknown, passing both the base
4814         region of the iter_cluster, and the lhs_reg.
4815         (store::mark_region_as_unknown): Update for new param of
4816         binding_cluster::mark_region_as_unknown, passing "reg" for both.
4817         (store::remove_overlapping_bindings): Add param "uncertainty", and
4818         pass it on to call to
4819         binding_cluster::remove_overlapping_bindings.
4820         * store.h (binding_map::remove_overlapping_bindings): Add
4821         "always_overlap" param.
4822         (binding_cluster::mark_region_as_unknown): Split param "reg" into
4823         "reg_to_bind" and "reg_for_overlap".
4824         (store::remove_overlapping_bindings): Add param "uncertainty".
4825
4826 2022-03-29  David Malcolm  <dmalcolm@redhat.com>
4827
4828         PR testsuite/105085
4829         * region-model-manager.cc (dump_untracked_region): Skip decls in
4830         the constant pool.
4831
4832 2022-03-29  David Malcolm  <dmalcolm@redhat.com>
4833
4834         PR analyzer/105087
4835         * analyzer.h (class conjured_purge): New forward decl.
4836         * region-model-asm.cc (region_model::on_asm_stmt): Add
4837         conjured_purge param to calls binding_cluster::on_asm and
4838         region_model_manager::get_or_create_conjured_svalue.
4839         * region-model-impl-calls.cc
4840         (call_details::get_or_create_conjured_svalue): Likewise for call
4841         to region_model_manager::get_or_create_conjured_svalue.
4842         (region_model::impl_call_fgets): Remove call to
4843         region_model::purge_state_involving, as this is now done
4844         implicitly by call_details::get_or_create_conjured_svalue.
4845         (region_model::impl_call_fread): Likewise.
4846         (region_model::impl_call_strchr): Pass conjured_purge param to
4847         call to region_model_manager::get_or_create_conjured_svalue.
4848         * region-model-manager.cc (conjured_purge::purge): New.
4849         (region_model_manager::get_or_create_conjured_svalue): Add
4850         param "p".  Use it to purge state when reusing an existing
4851         conjured_svalue.
4852         * region-model.cc (region_model::on_call_pre): Replace call to
4853         region_model::purge_state_involving with passing conjured_purge
4854         to region_model_manager::get_or_create_conjured_svalue.
4855         (region_model::handle_unrecognized_call): Pass conjured_purge to
4856         store::on_unknown_fncall.
4857         * region-model.h
4858         (region_model_manager::get_or_create_conjured_svalue): Add param
4859         "p".
4860         * store.cc (binding_cluster::on_unknown_fncall): Likewise.  Pass
4861         it on to region_model_manager::get_or_create_conjured_svalue.
4862         (binding_cluster::on_asm): Likewise.
4863         (store::on_unknown_fncall): Add param "p" and pass it on to
4864         binding_cluster::on_unknown_fncall.
4865         * store.h (binding_cluster::on_unknown_fncall): Add param p.
4866         (binding_cluster::on_asm): Likewise.
4867         (store::on_unknown_fncall): Likewise.
4868         * svalue.h (class conjured_purge): New.
4869
4870 2022-03-29  David Malcolm  <dmalcolm@redhat.com>
4871
4872         PR analyzer/105074
4873         * region.cc (ipa_ref_requires_tracking): Drop "context_fndecl",
4874         instead using the ref->referring to get the cgraph node of the
4875         caller.
4876         (symnode_requires_tracking_p): Likewise.
4877
4878 2022-03-26  David Malcolm  <dmalcolm@redhat.com>
4879
4880         PR analyzer/105057
4881         * store.cc (binding_cluster::make_unknown_relative_to): Reject
4882         attempts to create a cluster for untracked base regions.
4883         (store::set_value): Likewise.
4884         (store::fill_region): Likewise.
4885         (store::mark_region_as_unknown): Likewise.
4886
4887 2022-03-25  David Malcolm  <dmalcolm@redhat.com>
4888
4889         PR analyzer/104954
4890         * analyzer.opt (-fdump-analyzer-untracked): New option.
4891         * engine.cc (impl_run_checkers): Handle it.
4892         * region-model-asm.cc (region_model::on_asm_stmt): Don't attempt
4893         to clobber regions with !tracked_p ().
4894         * region-model-manager.cc (dump_untracked_region): New.
4895         (region_model_manager::dump_untracked_regions): New.
4896         (frame_region::dump_untracked_regions): New.
4897         * region-model.h (region_model_manager::dump_untracked_regions):
4898         New decl.
4899         * region.cc (ipa_ref_requires_tracking): New.
4900         (symnode_requires_tracking_p): New.
4901         (decl_region::calc_tracked_p): New.
4902         * region.h (region::tracked_p): New vfunc.
4903         (frame_region::dump_untracked_regions): New decl.
4904         (class decl_region): Note that this is also used fo SSA names.
4905         (decl_region::decl_region): Initialize m_tracked.
4906         (decl_region::tracked_p): New.
4907         (decl_region::calc_tracked_p): New decl.
4908         (decl_region::m_tracked): New.
4909         * store.cc (store::get_or_create_cluster): Assert that we
4910         don't try to create clusters for base regions that aren't
4911         trackable.
4912         (store::mark_as_escaped): Don't mark base regions that we're not
4913         tracking.
4914
4915 2022-03-23  David Malcolm  <dmalcolm@redhat.com>
4916
4917         PR analyzer/104979
4918         * engine.cc (impl_run_checkers): Create the engine after the
4919         supergraph, and pass the supergraph to the engine.
4920         * region-model.cc (region_model::get_lvalue_1): Pass ctxt to
4921         frame_region::get_region_for_local.
4922         (region_model::update_for_return_gcall): Pass the lvalue for the
4923         result to pop_frame as a tree, rather than as a region.
4924         (region_model::pop_frame): Update for above change, determining
4925         the destination region after the frame is popped and thus with
4926         respect to the caller frame rather than the called frame.
4927         Likewise, set the value of the region to the return value after
4928         the frame is popped.
4929         (engine::engine): Add supergraph pointer.
4930         (selftest::test_stack_frames): Set the DECL_CONTECT of PARM_DECLs.
4931         (selftest::test_get_representative_path_var): Likewise.
4932         (selftest::test_state_merging): Likewise.
4933         * region-model.h (region_model::pop_frame): Convert first param
4934         from a const region * to a tree.
4935         (engine::engine): Add param "sg".
4936         (engine::m_sg): New field.
4937         * region.cc: Include "analyzer/sm.h" and
4938         "analyzer/program-state.h".
4939         (frame_region::get_region_for_local): Add "ctxt" param.
4940         Add assertions that VAR_DECLs are locals, and that expr is for the
4941         correct function.
4942         * region.h (frame_region::get_region_for_local): Add "ctxt" param.
4943
4944 2022-03-23  David Malcolm  <dmalcolm@redhat.com>
4945
4946         PR analyzer/105017
4947         * sm-taint.cc (taint_diagnostic::subclass_equal_p): Check
4948         m_has_bounds as well as m_arg.
4949         (tainted_allocation_size::subclass_equal_p): Chain up to base
4950         class implementation.  Also check m_mem_space.
4951         (tainted_allocation_size::emit): Add note showing stack-based vs
4952         heap-based allocations.
4953
4954 2022-03-23  David Malcolm  <dmalcolm@redhat.com>
4955
4956         PR analyzer/104997
4957         * diagnostic-manager.cc (diagnostic_manager::add_diagnostic):
4958         Convert return type from "void" to "bool", reporting success vs
4959         failure to caller, for both overloads.
4960         * diagnostic-manager.h (diagnostic_manager::add_diagnostic):
4961         Likewise.
4962         * engine.cc (impl_region_model_context::warn): Propagate return
4963         value from diagnostic_manager::add_diagnostic.
4964
4965 2022-03-18  David Malcolm  <dmalcolm@redhat.com>
4966
4967         PR analyzer/104943
4968         PR analyzer/104954
4969         PR analyzer/103533
4970         * analyzer.h (class state_purge_per_decl): New forward decl.
4971         * engine.cc (impl_run_checkers): Pass region_model_manager to
4972         state_purge_map ctor.
4973         * program-point.cc (function_point::final_stmt_p): New.
4974         (function_point::get_next): New.
4975         * program-point.h (function_point::final_stmt_p): New decl.
4976         (function_point::get_next): New decl.
4977         * program-state.cc (program_state::prune_for_point): Generalize to
4978         purge local decls as well as SSA names.
4979         (program_state::can_purge_base_region_p): New.
4980         * program-state.h (program_state::can_purge_base_region_p): New
4981         decl.
4982         * region-model.cc (struct append_ssa_names_cb_data): Rename to...
4983         (struct append_regions_cb_data): ...this.
4984         (region_model::get_ssa_name_regions_for_current_frame): Rename
4985         to...
4986         (region_model::get_regions_for_current_frame): ...this, updating
4987         for other renamings.
4988         (region_model::append_ssa_names_cb): Rename to...
4989         (region_model::append_regions_cb): ...this, and drop the requirement
4990         that the subregion be a SSA name.
4991         * region-model.h (struct append_ssa_names_cb_data): Rename decl
4992         to...
4993         (struct append_regions_cb_data): ...this.
4994         (region_model::get_ssa_name_regions_for_current_frame): Rename
4995         decl to...
4996         (region_model::get_regions_for_current_frame): ...this.
4997         (region_model::append_ssa_names_cb): Rename decl to...
4998         (region_model::append_regions_cb): ...this.
4999         * state-purge.cc: Include "tristate.h", "selftest.h",
5000         "analyzer/store.h", "analyzer/region-model.h", and
5001         "gimple-walk.h".
5002         (get_candidate_for_purging): New.
5003         (class gimple_op_visitor): New.
5004         (my_load_cb): New.
5005         (my_store_cb): New.
5006         (my_addr_cb): New.
5007         (state_purge_map::state_purge_map): Add "mgr" param.  Update for
5008         renamings.  Find uses of local variables.
5009         (state_purge_map::~state_purge_map): Update for renaming of m_map
5010         to m_ssa_map.  Clean up m_decl_map.
5011         (state_purge_map::get_or_create_data_for_decl): New.
5012         (state_purge_per_ssa_name::state_purge_per_ssa_name): Update for
5013         inheriting from state_purge_per_tree.
5014         (state_purge_per_ssa_name::add_to_worklist): Likewise.
5015         (state_purge_per_decl::state_purge_per_decl): New.
5016         (state_purge_per_decl::add_needed_at): New.
5017         (state_purge_per_decl::add_pointed_to_at): New.
5018         (state_purge_per_decl::process_worklists): New.
5019         (state_purge_per_decl::add_to_worklist): New.
5020         (same_binding_p): New.
5021         (fully_overwrites_p): New.
5022         (state_purge_per_decl::process_point_backwards): New.
5023         (state_purge_per_decl::process_point_forwards): New.
5024         (state_purge_per_decl::needed_at_point_p): New.
5025         (state_purge_annotator::print_needed): Generalize to print local
5026         decls as well as SSA names.
5027         * state-purge.h (class state_purge_map): Update leading comment.
5028         (state_purge_map::map_t): Rename to...
5029         (state_purge_map::ssa_map_t): ...this.
5030         (state_purge_map::iterator): Rename to...
5031         (state_purge_map::ssa_iterator): ...this.
5032         (state_purge_map::decl_map_t): New typedef.
5033         (state_purge_map::decl_iterator): New typedef.
5034         (state_purge_map::state_purge_map): Add "mgr" param.
5035         (state_purge_map::get_data_for_ssa_name): Update for renaming.
5036         (state_purge_map::get_any_data_for_decl): New.
5037         (state_purge_map::get_or_create_data_for_decl): New decl.
5038         (state_purge_map::begin): Rename to...
5039         (state_purge_map::begin_ssas): ...this.
5040         (state_purge_map::end): Rename to...
5041         (state_purge_map::end_ssa): ...this.
5042         (state_purge_map::begin_decls): New.
5043         (state_purge_map::end_decls): New.
5044         (state_purge_map::m_map): Rename to...
5045         (state_purge_map::m_ssa_map): ...this.
5046         (state_purge_map::m_decl_map): New field.
5047         (class state_purge_per_tree): New class.
5048         (class state_purge_per_ssa_name): Inherit from state_purge_per_tree.
5049         (state_purge_per_ssa_name::get_function): Move to base class.
5050         (state_purge_per_ssa_name::point_set_t): Likewise.
5051         (state_purge_per_ssa_name::m_fun): Likewise.
5052         (class state_purge_per_decl): New.
5053
5054 2022-03-17  David Malcolm  <dmalcolm@redhat.com>
5055
5056         * state-purge.cc (state_purge_annotator::add_node_annotations):
5057         Avoid duplicate before-supernode annotations when returning from
5058         an interprocedural call.  Show after-supernode annotations.
5059
5060 2022-03-17  David Malcolm  <dmalcolm@redhat.com>
5061
5062         * program-point.cc (program_point::get_next): Fix missing
5063         increment of index.
5064
5065 2022-03-16  David Malcolm  <dmalcolm@redhat.com>
5066
5067         PR analyzer/104955
5068         * diagnostic-manager.cc (get_emission_location): New.
5069         (diagnostic_manager::diagnostic_manager): Initialize
5070         m_num_disabled_diagnostics.
5071         (diagnostic_manager::add_diagnostic): Reject diagnostics that
5072         will eventually be rejected due to being disabled.
5073         (diagnostic_manager::emit_saved_diagnostics): Log the number
5074         of disabled diagnostics.
5075         (diagnostic_manager::emit_saved_diagnostic): Split out logic for
5076         determining emission location to get_emission_location.
5077         * diagnostic-manager.h
5078         (diagnostic_manager::m_num_disabled_diagnostics): New field.
5079         * engine.cc (stale_jmp_buf::get_controlling_option): New.
5080         (stale_jmp_buf::emit): Use it.
5081         * pending-diagnostic.h
5082         (pending_diagnostic::get_controlling_option): New vfunc.
5083         * region-model.cc
5084         (poisoned_value_diagnostic::get_controlling_option): New.
5085         (poisoned_value_diagnostic::emit): Use it.
5086         (shift_count_negative_diagnostic::get_controlling_option): New.
5087         (shift_count_negative_diagnostic::emit): Use it.
5088         (shift_count_overflow_diagnostic::get_controlling_option): New.
5089         (shift_count_overflow_diagnostic::emit): Use it.
5090         (dump_path_diagnostic::get_controlling_option): New.
5091         (dump_path_diagnostic::emit): Use it.
5092         (write_to_const_diagnostic::get_controlling_option): New.
5093         (write_to_const_diagnostic::emit): Use it.
5094         (write_to_string_literal_diagnostic::get_controlling_option): New.
5095         (write_to_string_literal_diagnostic::emit): Use it.
5096         * sm-file.cc (double_fclose::get_controlling_option): New.
5097         (double_fclose::emit): Use it.
5098         (file_leak::get_controlling_option): New.
5099         (file_leak::emit): Use it.
5100         * sm-malloc.cc (mismatching_deallocation::get_controlling_option):
5101         New.
5102         (mismatching_deallocation::emit): Use it.
5103         (double_free::get_controlling_option): New.
5104         (double_free::emit): Use it.
5105         (possible_null_deref::get_controlling_option): New.
5106         (possible_null_deref::emit): Use it.
5107         (possible_null_arg::get_controlling_option): New.
5108         (possible_null_arg::emit): Use it.
5109         (null_deref::get_controlling_option): New.
5110         (null_deref::emit): Use it.
5111         (null_arg::get_controlling_option): New.
5112         (null_arg::emit): Use it.
5113         (use_after_free::get_controlling_option): New.
5114         (use_after_free::emit): Use it.
5115         (malloc_leak::get_controlling_option): New.
5116         (malloc_leak::emit): Use it.
5117         (free_of_non_heap::get_controlling_option): New.
5118         (free_of_non_heap::emit): Use it.
5119         * sm-pattern-test.cc (pattern_match::get_controlling_option): New.
5120         (pattern_match::emit): Use it.
5121         * sm-sensitive.cc
5122         (exposure_through_output_file::get_controlling_option): New.
5123         (exposure_through_output_file::emit): Use it.
5124         * sm-signal.cc (signal_unsafe_call::get_controlling_option): New.
5125         (signal_unsafe_call::emit): Use it.
5126         * sm-taint.cc (tainted_array_index::get_controlling_option): New.
5127         (tainted_array_index::emit): Use it.
5128         (tainted_offset::get_controlling_option): New.
5129         (tainted_offset::emit): Use it.
5130         (tainted_size::get_controlling_option): New.
5131         (tainted_size::emit): Use it.
5132         (tainted_divisor::get_controlling_option): New.
5133         (tainted_divisor::emit): Use it.
5134         (tainted_allocation_size::get_controlling_option): New.
5135         (tainted_allocation_size::emit): Use it.
5136
5137 2022-03-15  David Malcolm  <dmalcolm@redhat.com>
5138
5139         * store.cc (store::store): Presize m_cluster_map.
5140
5141 2022-03-10  David Malcolm  <dmalcolm@redhat.com>
5142
5143         PR analyzer/104863
5144         * constraint-manager.cc (constraint_manager::add_constraint):
5145         Refresh the EC IDs when adding constraints implied by offsets.
5146
5147 2022-03-10  David Malcolm  <dmalcolm@redhat.com>
5148
5149         PR analyzer/104793
5150         * analyzer.h (class pending_note): New forward decl.
5151         * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic):
5152         Initialize m_notes.
5153         (saved_diagnostic::operator==): Compare m_notes.
5154         (saved_diagnostic::add_note): New.
5155         (saved_diagnostic::emit_any_notes): New.
5156         (diagnostic_manager::add_note): New.
5157         (diagnostic_manager::emit_saved_diagnostic): Call emit_any_notes
5158         after emitting the warning.
5159         * diagnostic-manager.h (saved_diagnostic::add_note): New decl.
5160         (saved_diagnostic::emit_any_notes): New decl.
5161         (saved_diagnostic::m_notes): New field.
5162         (diagnostic_manager::add_note): New decl.
5163         * engine.cc (impl_region_model_context::add_note): New.
5164         * exploded-graph.h (impl_region_model_context::add_note): New
5165         decl.
5166         * pending-diagnostic.h (class pending_note): New.
5167         (class pending_note_subclass): New template.
5168         * region-model.cc (class reason_attr_access): New.
5169         (check_external_function_for_access_attr): Add class
5170         annotating_ctxt and use it when checking region.
5171         (noop_region_model_context::add_note): New.
5172         * region-model.h (region_model_context::add_note): New vfunc.
5173         (noop_region_model_context::add_note): New decl.
5174         (class region_model_context_decorator): New.
5175         (class note_adding_context): New.
5176
5177 2022-03-10  David Malcolm  <dmalcolm@redhat.com>
5178
5179         PR analyzer/104793
5180         * region-model.cc
5181         (region_model::check_external_function_for_access_attr): New.
5182         (region_model::handle_unrecognized_call): Call it.
5183         * region-model.h
5184         (region_model::check_external_function_for_access_attr): New decl.
5185         (region_model::handle_unrecognized_call): New decl.
5186
5187 2022-03-10  David Malcolm  <dmalcolm@redhat.com>
5188
5189         * sm-taint.cc (taint_state_machine::check_for_tainted_size_arg):
5190         Avoid generating duplicate saved_diagnostics by only handling the
5191         rdwr_map entry for the ptrarg, not the duplicate entry for the
5192         sizarg.
5193
5194 2022-03-07  David Malcolm  <dmalcolm@redhat.com>
5195
5196         PR analyzer/101983
5197         * engine.cc (returning_from_function_p): New.
5198         (impl_region_model_context::on_state_leak): Use it when rejecting
5199         leaks at the return from "main".
5200
5201 2022-03-07  Jakub Jelinek  <jakub@redhat.com>
5202
5203         * store.cc: Fix up duplicated word issue in a comment.
5204         * analyzer.cc: Likewise.
5205         * engine.cc: Likewise.
5206         * sm-taint.cc: Likewise.
5207
5208 2022-03-04  David Malcolm  <dmalcolm@redhat.com>
5209
5210         PR analyzer/103521
5211         * analyzer.opt (-param=analyzer-max-svalue-depth=): Reduce from 13
5212         to 12.
5213
5214 2022-02-23  David Malcolm  <dmalcolm@redhat.com>
5215
5216         PR analyzer/104434
5217         * analyzer.h (class const_fn_result_svalue): New decl.
5218         * region-model-impl-calls.cc (call_details::get_manager): New.
5219         * region-model-manager.cc
5220         (region_model_manager::get_or_create_const_fn_result_svalue): New.
5221         (region_model_manager::log_stats): Log
5222         m_const_fn_result_values_map.
5223         * region-model.cc (const_fn_p): New.
5224         (maybe_get_const_fn_result): New.
5225         (region_model::on_call_pre): Handle fndecls with
5226         __attribute__((const)) by calling the above rather than making
5227         a conjured_svalue.
5228         * region-model.h (visitor::visit_const_fn_result_svalue): New.
5229         (region_model_manager::get_or_create_const_fn_result_svalue): New
5230         decl.
5231         (region_model_manager::const_fn_result_values_map_t): New typedef.
5232         (region_model_manager::m_const_fn_result_values_map): New field.
5233         (call_details::get_manager): New decl.
5234         * svalue.cc (svalue::cmp_ptr): Handle SK_CONST_FN_RESULT.
5235         (const_fn_result_svalue::dump_to_pp): New.
5236         (const_fn_result_svalue::dump_input): New.
5237         (const_fn_result_svalue::accept): New.
5238         * svalue.h (enum svalue_kind): Add SK_CONST_FN_RESULT.
5239         (svalue::dyn_cast_const_fn_result_svalue): New.
5240         (class const_fn_result_svalue): New.
5241         (is_a_helper <const const_fn_result_svalue *>::test): New.
5242         (template <> struct default_hash_traits<const_fn_result_svalue::key_t>):
5243         New.
5244
5245 2022-02-17  David Malcolm  <dmalcolm@redhat.com>
5246
5247         PR analyzer/104576
5248         * region-model.cc: Include "calls.h".
5249         (region_model::on_call_pre): Use flags_from_decl_or_type to
5250         generalize check for DECL_PURE_P to also check for ECF_CONST.
5251
5252 2022-02-16  David Malcolm  <dmalcolm@redhat.com>
5253
5254         PR analyzer/104560
5255         * diagnostic-manager.cc (diagnostic_manager::build_emission_path):
5256         Add region creation events for globals of interest.
5257         (null_assignment_sm_context::get_old_program_state): New.
5258         (diagnostic_manager::add_events_for_eedge): Move check for
5259         changing dynamic extents from PK_BEFORE_STMT case to after the
5260         switch on the dst_point's kind so that we can emit them for the
5261         final stmt in a basic block.
5262         * engine.cc (impl_sm_context::get_old_program_state): New.
5263         * sm-malloc.cc (malloc_state_machine::get_default_state): Rewrite
5264         detection of m_non_heap to use get_memory_space.
5265         (free_of_non_heap::free_of_non_heap): Add freed_reg param.
5266         (free_of_non_heap::subclass_equal_p): Update for changes to
5267         fields.
5268         (free_of_non_heap::emit): Drop m_kind in favor of
5269         get_memory_space.
5270         (free_of_non_heap::describe_state_change): Remove logic for
5271         detecting alloca.
5272         (free_of_non_heap::mark_interesting_stuff): Add region-creation of
5273         m_freed_reg.
5274         (free_of_non_heap::get_memory_space): New.
5275         (free_of_non_heap::kind): Drop enum.
5276         (free_of_non_heap::m_freed_reg): New field.
5277         (free_of_non_heap::m_kind): Drop field.
5278         (malloc_state_machine::on_stmt): Drop transition to m_non_heap.
5279         (malloc_state_machine::handle_free_of_non_heap): New function,
5280         split out from on_deallocator_call and on_realloc_call, adding
5281         detection of the freed region.
5282         (malloc_state_machine::on_deallocator_call): Use it.
5283         (malloc_state_machine::on_realloc_call): Likewise.
5284         * sm.h (sm_context::get_old_program_state): New vfunc.
5285
5286 2022-02-15  David Malcolm  <dmalcolm@redhat.com>
5287
5288         PR analyzer/104524
5289         * region-model-manager.cc
5290         (region_model_manager::maybe_fold_sub_svalue): Only call
5291         get_or_create_cast if type is non-NULL.
5292
5293 2022-02-15  David Malcolm  <dmalcolm@redhat.com>
5294
5295         PR analyzer/102692
5296         * exploded-graph.h (impl_region_model_context::get_stmt): New.
5297         * region-model.cc: Include "gimple-ssa.h", "tree-phinodes.h",
5298         "tree-ssa-operands.h", and "ssa-iterators.h".
5299         (within_short_circuited_stmt_p): New.
5300         (region_model::check_for_poison): Don't warn about uninit values
5301         if within_short_circuited_stmt_p.
5302         * region-model.h (region_model_context::get_stmt): New vfunc.
5303         (noop_region_model_context::get_stmt): New.
5304
5305 2022-02-11  David Malcolm  <dmalcolm@redhat.com>
5306
5307         PR analyzer/104274
5308         * region-model.cc (region_model::check_for_poison): Ignore
5309         uninitialized uses of empty types.
5310
5311 2022-02-10  David Malcolm  <dmalcolm@redhat.com>
5312
5313         PR analyzer/98797
5314         * region-model-manager.cc
5315         (region_model_manager::maybe_fold_sub_svalue): Generalize getting
5316         individual chars of a STRING_CST from element_region to any
5317         subregion which is a concrete access of a single byte from its
5318         parent region.
5319         * region.cc (region::get_relative_concrete_byte_range): New.
5320         * region.h (region::get_relative_concrete_byte_range): New decl.
5321
5322 2022-02-09  David Malcolm  <dmalcolm@redhat.com>
5323
5324         PR analyzer/104452
5325         * region-model.cc (selftest::test_bit_range_regions): New.
5326         (selftest::analyzer_region_model_cc_tests): Call it.
5327         * region.h (bit_range_region::key_t::hash): Fix hashing of m_bits
5328         to avoid using uninitialized data.
5329
5330 2022-02-07  David Malcolm  <dmalcolm@redhat.com>
5331
5332         PR analyzer/104417
5333         * sm-taint.cc (tainted_allocation_size::tainted_allocation_size):
5334         Remove overzealous assertion.
5335         (tainted_allocation_size::emit): Likewise.
5336         (region_model::check_dynamic_size_for_taint): Likewise.
5337
5338 2022-02-07  David Malcolm  <dmalcolm@redhat.com>
5339
5340         PR analyzer/103872
5341         * region-model-impl-calls.cc (region_model::impl_call_memcpy):
5342         Reimplement in terms of a get_store_value followed by a set_value.
5343
5344 2022-02-03  David Malcolm  <dmalcolm@redhat.com>
5345
5346         PR analyzer/104369
5347         * engine.cc (exploded_graph::process_node): Use the node for any
5348         diagnostics, avoiding ICE if a bifurcation update adds a
5349         saved_diagnostic, such as for a tainted realloc size.
5350         * region-model-impl-calls.cc
5351         (region_model::impl_call_realloc::success_no_move::update_model):
5352         Require the old pointer to be non-NULL to be able successfully
5353         grow in place.  Use model->deref_rvalue rather than maybe_get_region
5354         to support the old pointer being symbolic.
5355         (region_model::impl_call_realloc::success_with_move::update_model):
5356         Likewise.  Add a constraint that the new pointer != the old pointer.
5357         Use a sized_region when setting the value of the new region.
5358         Handle the case where we don't know the dynamic size of the old
5359         region by marking the new region as unknown.
5360         * sm-taint.cc (tainted_allocation_size::tainted_allocation_size):
5361         Update assertion to also allow for MEMSPACE_UNKNOWN.
5362         (tainted_allocation_size::emit): Likewise.
5363         (region_model::check_dynamic_size_for_taint): Likewise.
5364
5365 2022-02-03  David Malcolm  <dmalcolm@redhat.com>
5366
5367         * region-model-impl-calls.cc (region_model::impl_call_calloc): Use
5368         a sized_region when calling zero_fill_region.
5369
5370 2022-02-02  David Malcolm  <dmalcolm@redhat.com>
5371
5372         * region-model.cc (region_model::on_return): Replace usage of
5373         copy_region with get_rvalue/set_value pair.
5374         (region_model::pop_frame): Likewise.
5375         (selftest::test_compound_assignment): Likewise.
5376         * region-model.h (region_model::copy_region): Delete decl.
5377         * region.cc (region_model::copy_region): Delete.
5378
5379 2022-02-02  David Malcolm  <dmalcolm@redhat.com>
5380
5381         * region.cc (region::calc_offset): Consolidate effectively
5382         identical cases.
5383
5384 2022-02-02  David Malcolm  <dmalcolm@redhat.com>
5385
5386         * analyzer.h (class bit_range_region): New forward decl.
5387         * region-model-manager.cc (region_model_manager::get_bit_range):
5388         New.
5389         (region_model_manager::log_stats): Handle m_bit_range_regions.
5390         * region-model.cc (region_model::get_lvalue_1): Handle
5391         BIT_FIELD_REF.
5392         * region-model.h (region_model_manager::get_bit_range): New decl.
5393         (region_model_manager::m_bit_range_regions): New field.
5394         * region.cc (region::get_base_region): Handle RK_BIT_RANGE.
5395         (region::base_region_p): Likewise.
5396         (region::calc_offset): Likewise.
5397         (bit_range_region::dump_to_pp): New.
5398         (bit_range_region::get_byte_size): New.
5399         (bit_range_region::get_bit_size): New.
5400         (bit_range_region::get_byte_size_sval): New.
5401         (bit_range_region::get_relative_concrete_offset): New.
5402         * region.h (enum region_kind): Add RK_BIT_RANGE.
5403         (region::dyn_cast_bit_range_region): New vfunc.
5404         (class bit_range_region): New.
5405         (is_a_helper <const bit_range_region *>::test): New.
5406         (default_hash_traits<bit_range_region::key_t>): New.
5407
5408 2022-02-02  David Malcolm  <dmalcolm@redhat.com>
5409
5410         PR analyzer/104270
5411         * region-model.cc (region_model::on_call_pre): Handle
5412         IFN_DEFERRED_INIT.
5413
5414 2022-01-27  David Malcolm  <dmalcolm@redhat.com>
5415
5416         * checker-path.cc (event_kind_to_string): Handle
5417         EK_REGION_CREATION.
5418         (region_creation_event::region_creation_event): New.
5419         (region_creation_event::get_desc): New.
5420         (checker_path::add_region_creation_event): New.
5421         * checker-path.h (enum event_kind): Add EK_REGION_CREATION.
5422         (class region_creation_event): New subclass.
5423         (checker_path::add_region_creation_event): New decl.
5424         * diagnostic-manager.cc
5425         (diagnostic_manager::emit_saved_diagnostic): Pass NULL for new
5426         param to add_events_for_eedge when handling trailing eedge.
5427         (diagnostic_manager::build_emission_path): Create an interesting_t
5428         instance, allow the pending diagnostic to populate it, and pass it
5429         to the calls to add_events_for_eedge.
5430         (diagnostic_manager::add_events_for_eedge): Add "interest" param.
5431         Use it to add region_creation_events for on-stack regions created
5432         within at function entry, and when pertinent dynamically-sized
5433         regions are created.
5434         (diagnostic_manager::prune_for_sm_diagnostic): Add case for
5435         EK_REGION_CREATION.
5436         * diagnostic-manager.h (diagnostic_manager::add_events_for_eedge):
5437         Add "interest" param.
5438         * pending-diagnostic.cc: Include "selftest.h", "tristate.h",
5439         "analyzer/call-string.h", "analyzer/program-point.h",
5440         "analyzer/store.h", and "analyzer/region-model.h".
5441         (interesting_t::add_region_creation): New.
5442         (interesting_t::dump_to_pp): New.
5443         * pending-diagnostic.h (struct interesting_t): New.
5444         (pending_diagnostic::mark_interesting_stuff): New vfunc.
5445         * region-model.cc
5446         (poisoned_value_diagnostic::poisoned_value_diagnostic): Add
5447         (poisoned_value_diagnostic::operator==): Compare m_pkind and
5448         m_src_region fields.
5449         (poisoned_value_diagnostic::mark_interesting_stuff): New.
5450         (poisoned_value_diagnostic::m_src_region): New.
5451         (region_model::check_for_poison): Call
5452         get_region_for_poisoned_expr for uninit values and pass the resul
5453         to the diagnostic.
5454         (region_model::get_region_for_poisoned_expr): New.
5455         (region_model::deref_rvalue): Pass NULL for
5456         poisoned_value_diagnostic's src_region.
5457         * region-model.h (region_model::get_region_for_poisoned_expr): New
5458         decl.
5459         * region.h (frame_region::get_fndecl): New.
5460
5461 2022-01-27  Martin Liska  <mliska@suse.cz>
5462
5463         PR analyzer/104247
5464         * constraint-manager.cc (bounded_ranges_manager::log_stats):
5465         Cast to long for format purpose.
5466         * region-model-manager.cc (log_uniq_map): Likewise.
5467
5468 2022-01-26  David Malcolm  <dmalcolm@redhat.com>
5469
5470         PR analyzer/104224
5471         * region-model.cc (region_model::check_call_args): New.
5472         (region_model::on_call_pre): Call it when ignoring stdio builtins.
5473         * region-model.h (region_model::check_call_args): New decl
5474
5475 2022-01-26  David Malcolm  <dmalcolm@redhat.com>
5476
5477         PR analyzer/94362
5478         * constraint-manager.cc (range::add_bound): Fix tests for
5479         discarding redundant constraints.  Perform test for rejecting
5480         unsatisfiable constraints earlier so that they don't update
5481         the object on failure.
5482         (selftest::test_range): New.
5483         (selftest::test_constant_comparisons): Add test coverage for
5484         existing constraints becoming narrower until they are
5485         unsatisfiable.
5486         (selftest::run_constraint_manager_tests): Call test_range.
5487
5488 2022-01-22  David Malcolm  <dmalcolm@redhat.com>
5489
5490         PR analyzer/104159
5491         * region-model-manager.cc
5492         (region_model_manager::get_or_create_cast): Bail out if the types
5493         are the same.  Don't attempt to handle casts involving vector
5494         types.
5495
5496 2022-01-20  David Malcolm  <dmalcolm@redhat.com>
5497
5498         PR analyzer/94362
5499         * constraint-manager.cc (bound::ensure_closed): Convert param to
5500         enum bound_kind.
5501         (range::constrained_to_single_element): Likewise.
5502         (range::add_bound): New.
5503         (constraint_manager::add_constraint): Handle SVAL + OFFSET
5504         compared to a constant.
5505         (constraint_manager::get_ec_bounds): Rewrite in terms of
5506         range::add_bound.
5507         (constraint_manager::eval_condition): Reject if range::add_bound
5508         fails.
5509         (selftest::test_constant_comparisons): Add test coverage for
5510         various impossible combinations of integer comparisons.
5511         * constraint-manager.h (enum bound_kind): New.
5512         (struct bound): Likewise.
5513         (bound::ensure_closed): Convert to param to enum bound_kind.
5514         (struct range): Convert to...
5515         (class range): ...this, making fields private.
5516         (range::add_bound): New decls.
5517         * region-model.cc (region_model::add_constraint): Fail if
5518         constraint_manager::add_constraint fails.
5519
5520 2022-01-18  David Malcolm  <dmalcolm@redhat.com>
5521
5522         PR analyzer/104089
5523         * region-model-manager.cc
5524         (region_model_manager::get_or_create_constant_svalue): Assert that
5525         we have a CONSTANT_CLASS_P.
5526         (region_model_manager::maybe_fold_unaryop): Only fold a constant
5527         when fold_unary's result is a constant or a cast of a constant.
5528
5529 2022-01-18  David Malcolm  <dmalcolm@redhat.com>
5530
5531         PR analyzer/104062
5532         * region-model-manager.cc
5533         (region_model_manager::maybe_fold_sub_svalue): Avoid casting to
5534         NULL type when folding access to repeated svalue.
5535
5536 2022-01-17  Martin Liska  <mliska@suse.cz>
5537
5538         * analyzer.cc (is_special_named_call_p): Rename .c names to .cc.
5539         (is_named_call_p): Likewise.
5540         * region-model-asm.cc (deterministic_p): Likewise.
5541         * region.cc (field_region::get_relative_concrete_offset): Likewise.
5542         * sm-malloc.cc (method_p): Likewise.
5543         * supergraph.cc (superedge::dump_dot): Likewise.
5544
5545 2022-01-14  David Malcolm  <dmalcolm@redhat.com>
5546
5547         * sm-taint.cc (taint_state_machine::combine_states): Handle combination
5548         of has_ub and has_lb.
5549
5550 2022-01-14  David Malcolm  <dmalcolm@redhat.com>
5551
5552         PR analyzer/104029
5553         * sm-taint.cc (taint_state_machine::alt_get_inherited_state):
5554         Remove gcc_unreachable from default case for unary ops.
5555
5556 2022-01-14  David Malcolm  <dmalcolm@redhat.com>
5557
5558         * engine.cc: Include "stringpool.h", "attribs.h", and
5559         "tree-dfa.h".
5560         (mark_params_as_tainted): New.
5561         (class tainted_args_function_custom_event): New.
5562         (class tainted_args_function_info): New.
5563         (exploded_graph::add_function_entry): Handle functions with
5564         "tainted_args" attribute.
5565         (class tainted_args_field_custom_event): New.
5566         (class tainted_args_callback_custom_event): New.
5567         (class tainted_args_call_info): New.
5568         (add_tainted_args_callback): New.
5569         (add_any_callbacks): New.
5570         (exploded_graph::build_initial_worklist): Likewise.
5571         (exploded_graph::build_initial_worklist): Find callbacks that are
5572         reachable from global initializers, calling add_any_callbacks on
5573         them.
5574
5575 2022-01-12  David Malcolm  <dmalcolm@redhat.com>
5576
5577         PR analyzer/103940
5578         * engine.cc (impl_sm_context::impl_sm_context): Add
5579         "unknown_side_effects" param and use it to initialize
5580         new m_unknown_side_effects field.
5581         (impl_sm_context::unknown_side_effects_p): New.
5582         (impl_sm_context::m_unknown_side_effects): New.
5583         (exploded_node::on_stmt): Pass unknown_side_effects to sm_ctxt
5584         ctor.
5585         * sm-taint.cc: Include "stringpool.h" and "attribs.h".
5586         (tainted_size::tainted_size): Drop "dir" param.
5587         (tainted_size::get_kind): Drop "FINAL".
5588         (tainted_size::emit): Likewise.
5589         (tainted_size::m_dir): Drop unused field.
5590         (class tainted_access_attrib_size): New subclass.
5591         (taint_state_machine::on_stmt): Call check_for_tainted_size_arg on
5592         external functions with unknown side effects.
5593         (taint_state_machine::check_for_tainted_size_arg): New.
5594         (region_model::check_region_for_taint): Drop "dir" param from
5595         tainted_size ctor.
5596         * sm.h (sm_context::unknown_side_effects_p): New.
5597
5598 2022-01-11  David Malcolm  <dmalcolm@redhat.com>
5599
5600         PR analyzer/102692
5601         * diagnostic-manager.cc
5602         (class auto_disable_complexity_checks): Rename to...
5603         (class auto_checking_feasibility): ...this, updating
5604         the calls accordingly.
5605         (epath_finder::explore_feasible_paths): Update for renaming.
5606         * region-model-manager.cc
5607         (region_model_manager::region_model_manager): Update for change from
5608         m_check_complexity to m_checking_feasibility.
5609         (region_model_manager::reject_if_too_complex): Likewise.
5610         (region_model_manager::get_or_create_unknown_svalue): Handle
5611         m_checking_feasibility.
5612         (region_model_manager::create_unique_svalue): New.
5613         (region_model_manager::maybe_fold_binop): Handle BIT_AND_EXPR and
5614         BIT_IOR_EXPRs on booleans where we know the result.
5615         * region-model.cc (test_binop_svalue_folding): Add test coverage
5616         for the above.
5617         * region-model.h (region_model_manager::create_unique_svalue): New
5618         decl.
5619         (region_model_manager::enable_complexity_check): Replace with...
5620         (region_model_manager::begin_checking_feasibility): ...this.
5621         (region_model_manager::disable_complexity_check): Replace with...
5622         (region_model_manager::end_checking_feasibility): ...this.
5623         (region_model_manager::m_check_complexity): Replace with...
5624         (region_model_manager::m_checking_feasibility): ...this.
5625         (region_model_manager::m_managed_dynamic_svalues): New field.
5626
5627 2022-01-08  David Malcolm  <dmalcolm@redhat.com>
5628
5629         * engine.cc (impl_run_checkers): Pass logger to engine ctor.
5630         * region-model-manager.cc
5631         (region_model_manager::region_model_manager): Add logger param and
5632         use it to initialize m_logger.
5633         * region-model.cc (engine::engine): New.
5634         * region-model.h (region_model_manager::region_model_manager):
5635         Add logger param.
5636         (region_model_manager::get_logger): New.
5637         (region_model_manager::m_logger): New field.
5638         (engine::engine): New.
5639         * store.cc (store_manager::get_logger): New.
5640         (store::set_value): Log scope.  Log when marking a cluster as
5641         unknown due to possible aliasing.
5642         * store.h (store_manager::get_logger): New decl.
5643
5644 2022-01-08  David Malcolm  <dmalcolm@redhat.com>
5645
5646         * region-model-impl-calls.cc (cmp_decls): New.
5647         (cmp_decls_ptr_ptr): New.
5648         (region_model::impl_call_analyzer_dump_escaped): New.
5649         * region-model.cc (region_model::on_stmt_pre): Handle
5650         __analyzer_dump_escaped.
5651         * region-model.h (region_model::impl_call_analyzer_dump_escaped):
5652         New decl.
5653         * store.h (binding_cluster::get_base_region): New accessor.
5654
5655 2022-01-08  David Malcolm  <dmalcolm@redhat.com>
5656
5657         * region.cc (region::is_named_decl_p): New.
5658         * region.h (region::is_named_decl_p): New decl.
5659
5660 2022-01-06  David Malcolm  <dmalcolm@redhat.com>
5661
5662         PR analyzer/103546
5663         * store.cc (store::eval_alias_1): Refactor handling of decl
5664         regions, adding a test for may_be_aliased, rejecting those for
5665         which it returns false.
5666
5667 2021-12-12  Jonathan Wakely  <jwakely@redhat.com>
5668
5669         * engine.cc: Define INCLUDE_MEMORY instead of INCLUDE_UNIQUE_PTR.
5670
5671 2021-12-06  David Malcolm  <dmalcolm@redhat.com>
5672
5673         PR analyzer/103533
5674         * constraint-manager.cc (equiv_class::contains_non_constant_p):
5675         New.
5676         (constraint_manager::canonicalize): Call it when determining
5677         redundant ECs.
5678         (selftest::test_purging): New selftest.
5679         (selftest::run_constraint_manager_tests): Likewise.
5680         * constraint-manager.h (equiv_class::contains_non_constant_p):
5681         New decl.
5682
5683 2021-12-01  David Malcolm  <dmalcolm@redhat.com>
5684
5685         PR analyzer/102471
5686         * region-model-reachability.cc (reachable_regions::handle_parm):
5687         Treat all svalues within a compound parm has reachable, and those
5688         wrapped in a cast.
5689
5690 2021-11-29  David Malcolm  <dmalcolm@redhat.com>
5691
5692         PR analyzer/103217
5693         * store.cc (binding_cluster::can_merge_p): For the "key is bound"
5694         vs "key is not bound" merger case, check that the bound svalue
5695         is mergeable before merging it to "unknown", rejecting the merger
5696         otherwise.
5697
5698 2021-11-19  David Malcolm  <dmalcolm@redhat.com>
5699
5700         PR analyzer/103217
5701         * engine.cc (exploded_graph::get_or_create_node): Pass in
5702         m_ext_state to program_state::can_merge_with_p.
5703         (exploded_graph::process_worklist): Likewise.
5704         (exploded_graph::maybe_process_run_of_before_supernode_enodes):
5705         Likewise.
5706         (exploded_graph::process_node): Add missing call to detect_leaks
5707         when handling phi nodes.
5708         * program-state.cc (program_state::can_merge_with_p): Add
5709         "ext_state" param.  Pass it and state ptrs to
5710         region_model::can_merge_with_p.
5711         (selftest::test_program_state_merging): Update for new ext_state
5712         param of program_state::can_merge_with_p.
5713         (selftest::test_program_state_merging_2): Likewise.
5714         * program-state.h (program_state::can_purge_p): Make const.
5715         (program_state::can_merge_with_p): Add "ext_state" param.
5716         * region-model.cc: Include "analyzer/program-state.h".
5717         (region_model::can_merge_with_p): Add params "ext_state",
5718         "state_a", and "state_b", use them when creating model_merger
5719         object.
5720         (model_merger::mergeable_svalue_p): New.
5721         * region-model.h (region_model::can_merge_with_p): Add params
5722         "ext_state", "state_a", and "state_b".
5723         (model_merger::model_merger) Likewise, initializing new fields.
5724         (model_merger::mergeable_svalue_p): New decl.
5725         (model_merger::m_ext_state): New field.
5726         (model_merger::m_state_a): New field.
5727         (model_merger::m_state_b): New field.
5728         * svalue.cc (svalue::can_merge_p): Call
5729         model_merger::mergeable_svalue_p on both states and reject the
5730         merger accordingly.
5731
5732 2021-11-17  David Malcolm  <dmalcolm@redhat.com>
5733
5734         PR analyzer/102695
5735         * region-model-impl-calls.cc (region_model::impl_call_strchr): New.
5736         * region-model-manager.cc
5737         (region_model_manager::maybe_fold_unaryop): Simplify cast to
5738         pointer type of an existing pointer to a region.
5739         * region-model.cc (region_model::on_call_pre): Handle
5740         BUILT_IN_STRCHR and "strchr".
5741         (write_to_const_diagnostic::emit): Add auto_diagnostic_group.  Add
5742         alternate wordings for functions and labels.
5743         (write_to_const_diagnostic::describe_final_event): Add alternate
5744         wordings for functions and labels.
5745         (region_model::check_for_writable_region): Handle RK_FUNCTION and
5746         RK_LABEL.
5747         * region-model.h (region_model::impl_call_strchr): New decl.
5748
5749 2021-11-16  David Malcolm  <dmalcolm@redhat.com>
5750
5751         PR analyzer/102662
5752         * constraint-manager.cc (bounded_range::operator==): Require the
5753         types to be the same for equality.
5754
5755 2021-11-13  David Malcolm  <dmalcolm@redhat.com>
5756
5757         * analyzer.opt (Wanalyzer-tainted-allocation-size): New.
5758         (Wanalyzer-tainted-divisor): New.
5759         (Wanalyzer-tainted-offset): New.
5760         (Wanalyzer-tainted-size): New.
5761         * engine.cc (impl_region_model_context::get_taint_map): New.
5762         * exploded-graph.h (impl_region_model_context::get_taint_map):
5763         New decl.
5764         * program-state.cc (sm_state_map::get_state): Call
5765         alt_get_inherited_state.
5766         (sm_state_map::impl_set_state): Modify states within
5767         compound svalues.
5768         (program_state::impl_call_analyzer_dump_state): Undo casts.
5769         (selftest::test_program_state_1): Update for new context param of
5770         create_region_for_heap_alloc.
5771         (selftest::test_program_state_merging): Likewise.
5772         * region-model-impl-calls.cc (region_model::impl_call_alloca):
5773         Likewise.
5774         (region_model::impl_call_calloc): Likewise.
5775         (region_model::impl_call_malloc): Likewise.
5776         (region_model::impl_call_operator_new): Likewise.
5777         (region_model::impl_call_realloc): Likewise.
5778         * region-model.cc (region_model::check_region_access): Call
5779         check_region_for_taint.
5780         (region_model::get_representative_path_var_1): Handle binops.
5781         (region_model::create_region_for_heap_alloc): Add "ctxt" param and
5782         pass it to set_dynamic_extents.
5783         (region_model::create_region_for_alloca): Likewise.
5784         (region_model::set_dynamic_extents): Add "ctxt" param and use it
5785         to call check_dynamic_size_for_taint.
5786         (selftest::test_state_merging): Update for new context param of
5787         create_region_for_heap_alloc.
5788         (selftest::test_malloc_constraints): Likewise.
5789         (selftest::test_malloc): Likewise.
5790         (selftest::test_alloca): Likewise for create_region_for_alloca.
5791         * region-model.h (region_model::create_region_for_heap_alloc): Add
5792         "ctxt" param.
5793         (region_model::create_region_for_alloca): Likewise.
5794         (region_model::set_dynamic_extents): Likewise.
5795         (region_model::check_dynamic_size_for_taint): New decl.
5796         (region_model::check_region_for_taint): New decl.
5797         (region_model_context::get_taint_map): New vfunc.
5798         (noop_region_model_context::get_taint_map): New.
5799         * sm-taint.cc: Remove include of "diagnostic-event-id.h"; add
5800         includes of "gimple-iterator.h", "tristate.h", "selftest.h",
5801         "ordered-hash-map.h", "cgraph.h", "cfg.h", "digraph.h",
5802         "analyzer/supergraph.h", "analyzer/call-string.h",
5803         "analyzer/program-point.h", "analyzer/store.h",
5804         "analyzer/region-model.h", and "analyzer/program-state.h".
5805         (enum bounds): Move to top of file.
5806         (class taint_diagnostic): New.
5807         (class tainted_array_index): Convert to subclass of taint_diagnostic.
5808         (tainted_array_index::emit): Add CWE-129.  Reword warning to use
5809         "attacker-controlled" rather than "tainted".
5810         (tainted_array_index::describe_state_change): Move to
5811         taint_diagnostic::describe_state_change.
5812         (tainted_array_index::describe_final_event): Reword to use
5813         "attacker-controlled" rather than "tainted".
5814         (class tainted_offset): New.
5815         (class tainted_size): New.
5816         (class tainted_divisor): New.
5817         (class tainted_allocation_size): New.
5818         (taint_state_machine::alt_get_inherited_state): New.
5819         (taint_state_machine::on_stmt): In assignment handling, remove
5820         ARRAY_REF handling in favor of check_region_for_taint.  Add
5821         detection of tainted divisors.
5822         (taint_state_machine::get_taint): New.
5823         (taint_state_machine::combine_states): New.
5824         (region_model::check_region_for_taint): New.
5825         (region_model::check_dynamic_size_for_taint): New.
5826         * sm.h (state_machine::alt_get_inherited_state): New.
5827
5828 2021-11-12  David Malcolm  <dmalcolm@redhat.com>
5829
5830         * engine.cc (exploded_node::on_stmt_pre): Return when handling
5831         "__analyzer_dump_state".
5832
5833 2021-11-11  Richard Biener  <rguenther@suse.de>
5834
5835         * supergraph.cc: Include bitmap.h.
5836
5837 2021-11-04  David Malcolm  <dmalcolm@redhat.com>
5838
5839         * program-state.cc (sm_state_map::dump): Use default_tree_printer
5840         as format decoder.
5841
5842 2021-09-16  Maxim Blinov  <maxim.blinov@embecosm.com>
5843
5844         PR bootstrap/102242
5845         * engine.cc (INCLUDE_UNIQUE_PTR): Define.
5846
5847 2021-09-08  David Malcolm  <dmalcolm@redhat.com>
5848
5849         PR analyzer/102225
5850         * analyzer.h (compat_types_p): New decl.
5851         * constraint-manager.cc
5852         (constraint_manager::get_or_add_equiv_class): Guard against NULL
5853         type when checking for pointer types.
5854         * region-model-impl-calls.cc (region_model::impl_call_realloc):
5855         Guard against NULL lhs type/region.  Guard against the size value
5856         not being of a compatible type for dynamic extents.
5857         * region-model.cc (compat_types_p): Make non-static.
5858
5859 2021-08-30  David Malcolm  <dmalcolm@redhat.com>
5860
5861         PR analyzer/99260
5862         * analyzer.h (class custom_edge_info): New class, adapted from
5863         exploded_edge::custom_info_t.  Make member functions const.
5864         Make update_model return bool, converting edge param from
5865         reference to a pointer, and adding a ctxt param.
5866         (class path_context): New class.
5867         * call-info.cc: New file.
5868         * call-info.h: New file.
5869         * engine.cc: Include "analyzer/call-info.h" and <memory>.
5870         (impl_region_model_context::impl_region_model_context): Update for
5871         new m_path_ctxt field.
5872         (impl_region_model_context::bifurcate): New.
5873         (impl_region_model_context::terminate_path): New.
5874         (impl_region_model_context::get_malloc_map): New.
5875         (impl_sm_context::impl_sm_context): Update for new m_path_ctxt
5876         field.
5877         (impl_sm_context::get_fndecl_for_call): Likewise.
5878         (impl_sm_context::set_next_state): Likewise.
5879         (impl_sm_context::warn): Likewise.
5880         (impl_sm_context::is_zero_assignment): Likewise.
5881         (impl_sm_context::get_path_context): New.
5882         (impl_sm_context::m_path_ctxt): New.
5883         (impl_region_model_context::on_condition): Update for new
5884         path_ctxt param.  Handle m_enode_for_diag being NULL.
5885         (impl_region_model_context::on_phi): Update for new path_ctxt
5886         param.
5887         (exploded_node::on_stmt): Add path_ctxt param, updating ctor calls
5888         to use it as necessary.  Use it to bail out after sm-handling,
5889         if needed.
5890         (exploded_node::detect_leaks): Update for new path_ctxt param.
5891         (dynamic_call_info_t::update_model): Update for conversion of
5892         exploded_edge::custom_info_t to custom_edge_info.
5893         (dynamic_call_info_t::add_events_to_path): Likewise.
5894         (rewind_info_t::update_model): Likewise.
5895         (rewind_info_t::add_events_to_path): Likewise.
5896         (exploded_edge::exploded_edge): Likewise.
5897         (exploded_graph::add_edge): Likewise.
5898         (exploded_graph::maybe_process_run_of_before_supernode_enodes):
5899         Update for new path_ctxt param.
5900         (class impl_path_context): New.
5901         (exploded_graph::process_node): Update for new path_ctxt param.
5902         Create an impl_path_context and pass it to exploded_node::on_stmt.
5903         Use it to terminate iterating stmts if terminate_path is called
5904         on it.  After processing a run of stmts, query path_ctxt to
5905         potentially terminate the analysis path, and/or to "bifurcate" the
5906         analysis into multiple additional paths.
5907         (feasibility_state::maybe_update_for_edge): Update for new
5908         update_model ctxt param.
5909         * exploded-graph.h
5910         (impl_region_model_context::impl_region_model_context): Add
5911         path_ctxt param.
5912         (impl_region_model_context::bifurcate): New.
5913         (impl_region_model_context::terminate_path): New
5914         (impl_region_model_context::get_ext_state): New.
5915         (impl_region_model_context::get_malloc_map): New.
5916         (impl_region_model_context::m_path_ctxt): New field.
5917         (exploded_node::on_stmt): Add path_ctxt param.
5918         (class exploded_edge::custom_info_t): Move to analyzer.h, renaming
5919         to custom_edge_info, and making the changes as noted in analyzer.h
5920         above.
5921         (exploded_edge::exploded_edge): Update for these changes to
5922         exploded_edge::custom_info_t.
5923         (exploded_edge::m_custom_info): Likewise.
5924         (class dynamic_call_info_t): Likewise.
5925         (class rewind_info_t): Likewise.
5926         (exploded_graph::add_edge): Likewise.
5927         * program-state.cc (program_state::on_edge): Update for new
5928         path_ctxt param.
5929         (program_state::push_call): Likewise.
5930         (program_state::returning_call): Likewise.
5931         (program_state::prune_for_point): Likewise.
5932         * region-model-impl-calls.cc: Include "analyzer/call-info.h".
5933         (call_details::get_fndecl_for_call): New.
5934         (region_model::impl_call_realloc): Reimplement.
5935         * region-model.cc (region_model::on_call_pre): Move call to
5936         impl_call_realloc to...
5937         (region_model::on_call_post): ...here.  Consolidate creation
5938         of call_details instance.
5939         (noop_region_model_context::bifurcate): New.
5940         (noop_region_model_context::terminate_path): New.
5941         * region-model.h (call_details::get_call_stmt): New.
5942         (call_details::get_fndecl_for_call): New.
5943         (region_model::on_realloc_with_move): New.
5944         (region_model_context::bifurcate): New.
5945         (region_model_context::terminate_path): New.
5946         (region_model_context::get_ext_state): New.
5947         (region_model_context::get_malloc_map): New.
5948         (noop_region_model_context::bifurcate): New.
5949         (noop_region_model_context::terminate_path): New.
5950         (noop_region_model_context::get_ext_state): New.
5951         (noop_region_model_context::get_malloc_map): New.
5952         * sm-malloc.cc: Include "analyzer/program-state.h".
5953         (malloc_state_machine::on_realloc_call): Reimplement.
5954         (malloc_state_machine::on_realloc_with_move): New.
5955         (region_model::on_realloc_with_move): New.
5956         * sm-signal.cc (class signal_delivery_edge_info_t): Update for
5957         conversion from exploded_edge::custom_info_t to custom_edge_info.
5958         * sm.h (sm_context::get_path_context): New.
5959         * svalue.cc (svalue::maybe_get_constant): Call
5960         unwrap_any_unmergeable.
5961
5962 2021-08-25  Ankur Saini  <arsenic@sourceware.org>
5963
5964         PR analyzer/101980
5965         * engine.cc (exploded_graph::maybe_create_dynamic_call): Don't create
5966         calls if max recursion limit is reached.
5967
5968 2021-08-23  David Malcolm  <dmalcolm@redhat.com>
5969
5970         * analyzer.h (struct rejected_constraint): Convert to...
5971         (class rejected_constraint): ...this.
5972         (class bounded_ranges): New forward decl.
5973         (class bounded_ranges_manager): New forward decl.
5974         * constraint-manager.cc: Include "analyzer/analyzer-logging.h" and
5975         "tree-pretty-print.h".
5976         (can_plus_one_p): New.
5977         (plus_one): New.
5978         (can_minus_one_p): New.
5979         (minus_one): New.
5980         (bounded_range::bounded_range): New.
5981         (dump_cst): New.
5982         (bounded_range::dump_to_pp): New.
5983         (bounded_range::dump): New.
5984         (bounded_range::to_json): New.
5985         (bounded_range::set_json_attr): New.
5986         (bounded_range::contains_p): New.
5987         (bounded_range::intersects_p): New.
5988         (bounded_range::operator==): New.
5989         (bounded_range::cmp): New.
5990         (bounded_ranges::bounded_ranges): New.
5991         (bounded_ranges::bounded_ranges): New.
5992         (bounded_ranges::bounded_ranges): New.
5993         (bounded_ranges::canonicalize): New.
5994         (bounded_ranges::validate): New.
5995         (bounded_ranges::operator==): New.
5996         (bounded_ranges::dump_to_pp): New.
5997         (bounded_ranges::dump): New.
5998         (bounded_ranges::to_json): New.
5999         (bounded_ranges::eval_condition): New.
6000         (bounded_ranges::contain_p): New.
6001         (bounded_ranges::cmp): New.
6002         (bounded_ranges_manager::~bounded_ranges_manager): New.
6003         (bounded_ranges_manager::get_or_create_empty): New.
6004         (bounded_ranges_manager::get_or_create_point): New.
6005         (bounded_ranges_manager::get_or_create_range): New.
6006         (bounded_ranges_manager::get_or_create_union): New.
6007         (bounded_ranges_manager::get_or_create_intersection): New.
6008         (bounded_ranges_manager::get_or_create_inverse): New.
6009         (bounded_ranges_manager::consolidate): New.
6010         (bounded_ranges_manager::get_or_create_ranges_for_switch): New.
6011         (bounded_ranges_manager::create_ranges_for_switch): New.
6012         (bounded_ranges_manager::make_case_label_ranges): New.
6013         (bounded_ranges_manager::log_stats): New.
6014         (bounded_ranges_constraint::print): New.
6015         (bounded_ranges_constraint::to_json): New.
6016         (bounded_ranges_constraint::operator==): New.
6017         (bounded_ranges_constraint::add_to_hash): New.
6018         (constraint_manager::constraint_manager): Update for new field
6019         m_bounded_ranges_constraints.
6020         (constraint_manager::operator=): Likewise.
6021         (constraint_manager::hash): Likewise.
6022         (constraint_manager::operator==): Likewise.
6023         (constraint_manager::print): Likewise.
6024         (constraint_manager::dump_to_pp): Likewise.
6025         (constraint_manager::to_json): Likewise.
6026         (constraint_manager::add_unknown_constraint): Update the lhs_ec_id
6027         if necessary in existing constraints when combining equivalence
6028         classes.  Add similar code for handling
6029         m_bounded_ranges_constraints.
6030         (constraint_manager::add_constraint_internal): Add comment.
6031         (constraint_manager::add_bounded_ranges): New.
6032         (constraint_manager::eval_condition): Use new field
6033         m_bounded_ranges_constraints.
6034         (constraint_manager::purge): Update bounded_ranges_constraint
6035         instances.
6036         (constraint_manager::canonicalize): Update for new field.
6037         (merger_fact_visitor::on_ranges): New.
6038         (constraint_manager::for_each_fact): Use new field
6039         m_bounded_ranges_constraints.
6040         (constraint_manager::validate):  Fix off-by-one error needed due
6041         to bug fixed above in add_unknown_constraint.  Validate the EC IDs
6042         in m_bounded_ranges_constraints.
6043         (constraint_manager::get_range_manager): New.
6044         (selftest::assert_dump_bounded_range_eq): New.
6045         (ASSERT_DUMP_BOUNDED_RANGE_EQ): New.
6046         (selftest::test_bounded_range): New.
6047         (selftest::assert_dump_bounded_ranges_eq): New.
6048         (ASSERT_DUMP_BOUNDED_RANGES_EQ): New.
6049         (selftest::test_bounded_ranges): New.
6050         (selftest::run_constraint_manager_tests): Call the new selftests.
6051         * constraint-manager.h (struct bounded_range): New.
6052         (struct bounded_ranges): New.
6053         (template <> struct default_hash_traits<bounded_ranges::key_t>): New.
6054         (class bounded_ranges_manager): New.
6055         (fact_visitor::on_ranges): New pure virtual function.
6056         (class bounded_ranges_constraint): New.
6057         (constraint_manager::add_bounded_ranges): New decl.
6058         (constraint_manager::get_range_manager): New decl.
6059         (constraint_manager::m_bounded_ranges_constraints): New field.
6060         * diagnostic-manager.cc (epath_finder::process_worklist_item):
6061         Transfer ownership of rc to add_feasibility_problem.
6062         * engine.cc (feasibility_problem::dump_to_pp): Use get_model.
6063         * feasible-graph.cc (infeasible_node::dump_dot): Update for
6064         conversion of m_rc to a pointer.
6065         (feasible_graph::add_feasibility_problem): Pass RC by pointer and
6066         take ownership.
6067         * feasible-graph.h (infeasible_node::infeasible_node): Pass RC by
6068         pointer and take ownership.
6069         (infeasible_node::~infeasible_node): New.
6070         (infeasible_node::m_rc): Convert to a pointer.
6071         (feasible_graph::add_feasibility_problem): Pass RC by pointer and
6072         take ownership.
6073         * region-model-manager.cc: Include
6074         "analyzer/constraint-manager.h".
6075         (region_model_manager::region_model_manager): Initializer new
6076         field m_range_mgr.
6077         (region_model_manager::~region_model_manager): Delete it.
6078         (region_model_manager::log_stats): Call log_stats on it.
6079         * region-model.cc (region_model::add_constraint): Use new subclass
6080         rejected_op_constraint.
6081         (region_model::apply_constraints_for_gswitch): Reimplement using
6082         bounded_ranges_manager.
6083         (rejected_constraint::dump_to_pp): Convert to...
6084         (rejected_op_constraint::dump_to_pp): ...this.
6085         (rejected_ranges_constraint::dump_to_pp): New.
6086         * region-model.h (struct purge_stats): Add field
6087         m_num_bounded_ranges_constraints.
6088         (region_model_manager::get_range_manager): New.
6089         (region_model_manager::m_range_mgr): New.
6090         (region_model::get_range_manager): New.
6091         (struct rejected_constraint): Split into...
6092         (class rejected_constraint):...this new abstract base class,
6093         and...
6094         (class rejected_op_constraint): ...this new concrete subclass.
6095         (class rejected_ranges_constraint): New.
6096         * supergraph.cc: Include "tree-cfg.h".
6097         (supergraph::supergraph): Drop idx param from add_cfg_edge.
6098         (supergraph::add_cfg_edge): Drop idx param.
6099         (switch_cfg_superedge::switch_cfg_superedge): Move here from
6100         header.  Populate m_case_labels with all cases which go to DST.
6101         (switch_cfg_superedge::dump_label_to_pp): Reimplement to use
6102         m_case_labels.
6103         (switch_cfg_superedge::get_case_label): Delete.
6104         * supergraph.h (supergraphadd_cfg_edge): Drop "idx" param.
6105         (switch_cfg_superedge::switch_cfg_superedge): Drop idx param and
6106         move implementation to supergraph.cc.
6107         (switch_cfg_superedge::get_case_label): Delete.
6108         (switch_cfg_superedge::get_case_labels): New.
6109         (switch_cfg_superedge::m_idx): Delete.
6110         (switch_cfg_superedge::m_case_labels): New field.
6111
6112 2021-08-23  David Malcolm  <dmalcolm@redhat.com>
6113
6114         PR analyzer/101875
6115         * sm-file.cc (file_diagnostic::describe_state_change): Handle
6116         change.m_expr being NULL.
6117
6118 2021-08-23  David Malcolm  <dmalcolm@redhat.com>
6119
6120         PR analyzer/101837
6121         * analyzer.cc (maybe_reconstruct_from_def_stmt): Bail if fn is
6122         NULL, and assert that it's non-NULL before passing it to
6123         build_call_array_loc.
6124
6125 2021-08-23  David Malcolm  <dmalcolm@redhat.com>
6126
6127         PR analyzer/101962
6128         * region-model.cc (region_model::eval_condition_without_cm):
6129         Refactor comparison against zero, adding a check for
6130         POINTER_PLUS_EXPR of non-NULL.
6131
6132 2021-08-23  David Malcolm  <dmalcolm@redhat.com>
6133
6134         * store.cc (bit_range::intersects_p): New overload.
6135         (bit_range::operator-): New.
6136         (binding_cluster::maybe_get_compound_binding): Handle the partial
6137         overlap case.
6138         (selftest::test_bit_range_intersects_p): Add test coverage for
6139         new overload of bit_range::intersects_p.
6140         * store.h (bit_range::intersects_p): New overload.
6141         (bit_range::operator-): New.
6142
6143 2021-08-23  Ankur Saini  <arsenic@sourceware.org>
6144
6145         PR analyzer/102020
6146         * diagnostic-manager.cc
6147         (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>: Fix typo.
6148
6149 2021-08-21  Ankur Saini  <arsenic@sourceware.org>
6150
6151         PR analyzer/101980
6152         * diagnostic-manager.cc
6153         (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>: Use
6154         caller_model only when the supergraph_edge doesn't exixt.
6155         (diagnostic_manager::prune_for_sm_diagnostic)<case EK_RETURN_EDGE>:
6156         Likewise.
6157         * engine.cc (exploded_graph::create_dynamic_call): Rename to...
6158         (exploded_graph::maybe_create_dynamic_call): ...this, return call
6159         creation status.
6160         (exploded_graph::process_node): Handle calls which were not dynamically
6161         discovered.
6162         * exploded-graph.h (exploded_graph::create_dynamic_call): Rename to...
6163         (exploded_graph::maybe_create_dynamic_call): ...this.
6164         * region-model.cc (region_model::update_for_gcall): New param, use it
6165         to push call to frame.
6166         (region_model::update_for_call_superedge): Pass callee function to
6167         update_for_gcall.
6168         * region-model.h (region_model::update_for_gcall): New param.
6169
6170 2021-08-18  Ankur Saini  <arsenic@sourceware.org>
6171
6172         PR analyzer/97114
6173         * region-model.cc (region_model::get_rvalue_1): Add case for
6174         OBJ_TYPE_REF.
6175
6176 2021-08-18  Ankur Saini  <arsenic@sourceware.org>
6177
6178         PR analyzer/100546
6179         * analysis-plan.cc (analysis_plan::use_summary_p): Don't use call
6180         summaries if there is no callgraph edge
6181         * checker-path.cc (call_event::call_event): Handle calls events that
6182         are not represented by a supergraph call edge
6183         (return_event::return_event): Likewise.
6184         (call_event::get_desc): Work with new call_event structure.
6185         (return_event::get_desc): Likeise.
6186         * checker-path.h (call_event::m_src_snode): New field.
6187         (call_event::m_dest_snode): New field.
6188         (return_event::m_src_snode): New field.
6189         (return_event::m_dest_snode): New field.
6190         * diagnostic-manager.cc
6191         (diagnostic_manager::prune_for_sm_diagnostic)<case EK_CALL_EDGE>:
6192         Refactor to work with edges without callgraph edge.
6193         (diagnostic_manager::prune_for_sm_diagnostic)<case EK_RETURN_EDGE>:
6194         Likewise.
6195         * engine.cc (dynamic_call_info_t::update_model): New function.
6196         (dynamic_call_info_t::add_events_to_path): New function.
6197         (exploded_graph::create_dynamic_call): New function.
6198         (exploded_graph::process_node): Work with dynamically discovered calls.
6199         * exploded-graph.h (class dynamic_call_info_t): New class.
6200         (exploded_graph::create_dynamic_call): New decl.
6201         * program-point.cc (program_point::push_to_call_stack): New function.
6202         (program_point::pop_from_call_stack): New function.
6203         * program-point.h (program_point::push_to_call_stack): New decl.
6204         (program_point::pop_from_call_stack): New decl.
6205         * program-state.cc (program_state::push_call): New function.
6206         (program_state::returning_call): New function.
6207         * program-state.h (program_state::push_call): New decl.
6208         (program_state::returning_call): New decl.
6209         * region-model.cc (region_model::update_for_gcall) New function.
6210         (region_model::update_for_return_gcall): New function.
6211         (egion_model::update_for_call_superedge): Get the underlying gcall and
6212         update for gcall.
6213         (region_model::update_for_return_superedge): Likewise.
6214         * region-model.h (region_model::update_for_gcall): New decl.
6215         (region_model::update_for_return_gcall): New decl.
6216         * state-purge.cc (state_purge_per_ssa_name::process_point): Update to
6217         work with calls without underlying cgraph edge.
6218         * supergraph.cc (supergraph::supergraph) Split snodes at every callsite.
6219         * supergraph.h (supernode::get_returning_call) New accessor.
6220
6221 2021-08-04  David Malcolm  <dmalcolm@redhat.com>
6222
6223         PR analyzer/101570
6224         * analyzer.cc (maybe_reconstruct_from_def_stmt): Add GIMPLE_ASM
6225         case.
6226         * analyzer.h (class asm_output_svalue): New forward decl.
6227         (class reachable_regions): New forward decl.
6228         * complexity.cc (complexity::from_vec_svalue): New.
6229         * complexity.h (complexity::from_vec_svalue): New decl.
6230         * engine.cc (feasibility_state::maybe_update_for_edge): Handle
6231         asm stmts by calling on_asm_stmt.
6232         * region-model-asm.cc: New file.
6233         * region-model-manager.cc
6234         (region_model_manager::maybe_fold_asm_output_svalue): New.
6235         (region_model_manager::get_or_create_asm_output_svalue): New.
6236         (region_model_manager::log_stats): Log m_asm_output_values_map.
6237         * region-model.cc (region_model::on_stmt_pre): Handle GIMPLE_ASM.
6238         * region-model.h (visitor::visit_asm_output_svalue): New.
6239         (region_model_manager::get_or_create_asm_output_svalue): New decl.
6240         (region_model_manager::maybe_fold_asm_output_svalue): New decl.
6241         (region_model_manager::asm_output_values_map_t): New typedef.
6242         (region_model_manager::m_asm_output_values_map): New field.
6243         (region_model::on_asm_stmt): New.
6244         * store.cc (binding_cluster::on_asm): New.
6245         * store.h (binding_cluster::on_asm): New decl.
6246         * svalue.cc (svalue::cmp_ptr): Handle SK_ASM_OUTPUT.
6247         (asm_output_svalue::dump_to_pp): New.
6248         (asm_output_svalue::dump_input): New.
6249         (asm_output_svalue::input_idx_to_asm_idx): New.
6250         (asm_output_svalue::accept): New.
6251         * svalue.h (enum svalue_kind): Add SK_ASM_OUTPUT.
6252         (svalue::dyn_cast_asm_output_svalue): New.
6253         (class asm_output_svalue): New.
6254         (is_a_helper <const asm_output_svalue *>::test): New.
6255         (struct default_hash_traits<asm_output_svalue::key_t>): New.
6256
6257 2021-08-03  Jakub Jelinek  <jakub@redhat.com>
6258
6259         PR analyzer/101721
6260         * sm-malloc.cc (known_allocator_p): Only check DECL_FUNCTION_CODE on
6261         BUILT_IN_NORMAL builtins.
6262
6263 2021-07-29  Ankur Saini  <arsenic@sourceware.org>
6264
6265         * call-string.cc (call_string::element_t::operator==): New operator.
6266         (call_String::element_t::operator!=): New operator.
6267         (call_string::element_t::get_caller_function): New function.
6268         (call_string::element_t::get_callee_function): New function.
6269         (call_string::call_string): Refactor to Initialise m_elements.
6270         (call_string::operator=): Refactor to work with m_elements.
6271         (call_string::operator==): Likewise.
6272         (call_string::to_json): Likewise.
6273         (call_string::hash): Refactor to hash e.m_caller.
6274         (call_string::push_call): Refactor to work with m_elements.
6275         (call_string::push_call): New overload to push call via supernodes.
6276         (call_string::pop): Refactor to work with m_elements.
6277         (call_string::calc_recursion_depth): Likewise.
6278         (call_string::cmp): Likewise.
6279         (call_string::validate): Likewise.
6280         (call_string::operator[]): Likewise.
6281         * call-string.h (class supernode): New forward decl.
6282         (struct call_string::element_t): New struct.
6283         (call_string::call_string): Refactor to initialise m_elements.
6284         (call_string::bool empty_p): Refactor to work with m_elements.
6285         (call_string::get_callee_node): New decl.
6286         (call_string::get_caller_node): New decl.
6287         (m_elements): Replaces m_return_edges.
6288         * program-point.cc (program_point::get_function_at_depth): Refactor to
6289         work with new call-string format.
6290         (program_point::validate): Likewise.
6291         (program_point::on_edge): Likewise.
6292
6293 2021-07-28  David Malcolm  <dmalcolm@redhat.com>
6294
6295         * region-model.cc (region_model::on_call_pre): Treat
6296         IFN_UBSAN_BOUNDS, BUILT_IN_STACK_SAVE, and BUILT_IN_STACK_RESTORE
6297         as no-ops, rather than handling them as unknown functions.
6298
6299 2021-07-28  David Malcolm  <dmalcolm@redhat.com>
6300
6301         * region-model-impl-calls.cc (region_model::impl_call_alloca):
6302         Drop redundant return value.
6303         (region_model::impl_call_builtin_expect): Likewise.
6304         (region_model::impl_call_calloc): Likewise.
6305         (region_model::impl_call_malloc): Likewise.
6306         (region_model::impl_call_memset): Likewise.
6307         (region_model::impl_call_operator_new): Likewise.
6308         (region_model::impl_call_operator_delete): Likewise.
6309         (region_model::impl_call_strlen): Likewise.
6310         * region-model.cc (region_model::on_call_pre): Fix return value of
6311         known functions that don't have unknown side-effects.
6312         * region-model.h (region_model::impl_call_alloca): Drop redundant
6313         return value.
6314         (region_model::impl_call_builtin_expect): Likewise.
6315         (region_model::impl_call_calloc): Likewise.
6316         (region_model::impl_call_malloc): Likewise.
6317         (region_model::impl_call_memset): Likewise.
6318         (region_model::impl_call_strlen): Likewise.
6319         (region_model::impl_call_operator_new): Likewise.
6320         (region_model::impl_call_operator_delete): Likewise.
6321
6322 2021-07-28  Siddhesh Poyarekar  <siddhesh@gotplt.org>
6323
6324         * analyzer.cc (is_named_call_p, is_std_named_call_p): Make
6325         first argument a const_tree.
6326         * analyzer.h (is_named_call_p, -s_std_named_call_p): Likewise.
6327         * sm-malloc.cc (known_allocator_p): New function.
6328         (malloc_state_machine::on_stmt): Use it.
6329
6330 2021-07-28  Siddhesh Poyarekar  <siddhesh@gotplt.org>
6331
6332         * sm-malloc.cc
6333         (malloc_state_machine::get_or_create_deallocator): Recognize
6334         __builtin_free.
6335
6336 2021-07-26  David Malcolm  <dmalcolm@redhat.com>
6337
6338         * region-model.cc (region_model::on_call_pre): Always set conjured
6339         LHS, not just for SSA names.
6340
6341 2021-07-23  David Malcolm  <dmalcolm@redhat.com>
6342
6343         * diagnostic-manager.cc
6344         (class auto_disable_complexity_checks): New.
6345         (epath_finder::explore_feasible_paths): Use it to disable
6346         complexity checks whilst processing the worklist.
6347         * region-model-manager.cc
6348         (region_model_manager::region_model_manager): Initialize
6349         m_check_complexity.
6350         (region_model_manager::reject_if_too_complex): Bail if
6351         m_check_complexity is false.
6352         * region-model.h
6353         (region_model_manager::enable_complexity_check): New.
6354         (region_model_manager::disable_complexity_check): New.
6355         (region_model_manager::m_check_complexity): New.
6356
6357 2021-07-21  David Malcolm  <dmalcolm@redhat.com>
6358
6359         PR analyzer/101547
6360         * sm-file.cc (file_leak::emit): Handle m_arg being NULL.
6361         (file_leak::describe_final_event): Handle ev.m_expr being NULL.
6362
6363 2021-07-21  David Malcolm  <dmalcolm@redhat.com>
6364
6365         PR analyzer/101522
6366         * store.cc (binding_cluster::purge_state_involving): Don't change
6367         m_map whilst iterating through it.
6368
6369 2021-07-21  David Malcolm  <dmalcolm@redhat.com>
6370
6371         * region-model.cc (region_model::handle_phi): Add "old_state"
6372         param and use it.
6373         (region_model::update_for_phis): Update so that all of the phi
6374         stmts are effectively handled simultaneously, rather than in
6375         order.
6376         * region-model.h (region_model::handle_phi): Add "old_state"
6377         param.
6378         * state-purge.cc (self_referential_phi_p): Replace with...
6379         (name_used_by_phis_p): ...this new function.
6380         (state_purge_per_ssa_name::process_point): Update to use the
6381         above, so that all phi stmts at a basic block are effectively
6382         considered simultaneously, and only consider the phi arguments for
6383         the pertinent in-edge.
6384         * supergraph.cc (cfg_superedge::get_phi_arg_idx): New.
6385         (cfg_superedge::get_phi_arg): Use the above.
6386         * supergraph.h (cfg_superedge::get_phi_arg_idx): New decl.
6387
6388 2021-07-21  David Malcolm  <dmalcolm@redhat.com>
6389
6390         * state-purge.cc (state_purge_annotator::add_node_annotations):
6391         Rather than erroneously always using the NULL in-edge, determine
6392         each relevant in-edge, and print the appropriate data for each
6393         in-edge.  Use print_needed to print the data as comma-separated
6394         lists of SSA names.
6395         (print_vec_of_names): Add "within_table" param and use it.
6396         (state_purge_annotator::add_stmt_annotations): Factor out
6397         collation and printing code into...
6398         (state_purge_annotator::print_needed): ...this new function.
6399         * state-purge.h (state_purge_annotator::print_needed): New decl.
6400
6401 2021-07-21  David Malcolm  <dmalcolm@redhat.com>
6402
6403         * program-point.cc (function_point::print): Show src BB index at
6404         BEFORE_SUPERNODE.
6405
6406 2021-07-21  David Malcolm  <dmalcolm@redhat.com>
6407
6408         * svalue.cc (infix_p): New.
6409         (binop_svalue::dump_to_pp): Use it to print MIN_EXPR and MAX_EXPR
6410         in prefix form, rather than infix.
6411
6412 2021-07-19  David Malcolm  <dmalcolm@redhat.com>
6413
6414         PR analyzer/101503
6415         * constraint-manager.cc (constraint_manager::add_constraint): Use
6416         can_have_associated_state_p rather than testing for unknown.
6417         (constraint_manager::get_or_add_equiv_class): Likewise.
6418         * program-state.cc (sm_state_map::set_state): Likewise.
6419         (sm_state_map::impl_set_state): Add assertion.
6420         * region-model-manager.cc
6421         (region_model_manager::maybe_fold_unaryop): Handle poisoned
6422         values.
6423         (region_model_manager::maybe_fold_binop): Move handling of unknown
6424         values...
6425         (region_model_manager::get_or_create_binop): ...to here, and
6426         generalize to use can_have_associated_state_p.
6427         (region_model_manager::maybe_fold_sub_svalue): Use
6428         can_have_associated_state_p rather than testing for unknown.
6429         (region_model_manager::maybe_fold_repeated_svalue): Use unknown
6430         when the size or repeated value is "unknown"/"poisoned".
6431         * region-model.cc (region_model::purge_state_involving): Reject
6432         attempts to purge unknown/poisoned svalues, as these svalues
6433         should not have state associated with them.
6434         * svalue.cc (sub_svalue::sub_svalue): Assert that we're building
6435         on top of an svalue with can_have_associated_state_p.
6436         (repeated_svalue::repeated_svalue): Likewise.
6437         (bits_within_svalue::bits_within_svalue): Likewise.
6438         * svalue.h (svalue::can_have_associated_state_p): New.
6439         (unknown_svalue::can_have_associated_state_p): New.
6440         (poisoned_svalue::can_have_associated_state_p): New.
6441         (unaryop_svalue::unaryop_svalue): Assert that we're building on
6442         top of an svalue with can_have_associated_state_p.
6443         (binop_svalue::binop_svalue): Likewise.
6444         (widening_svalue::widening_svalue): Likewise.
6445
6446 2021-07-16  David Malcolm  <dmalcolm@redhat.com>
6447
6448         * analyzer.h (enum access_direction): New.
6449         * engine.cc (exploded_node::on_longjmp): Update for new param of
6450         get_store_value.
6451         * program-state.cc (program_state::prune_for_point): Likewise.
6452         * region-model-impl-calls.cc (region_model::impl_call_memcpy):
6453         Replace call to check_for_writable_region with call to
6454         check_region_for_write.
6455         (region_model::impl_call_memset): Likewise.
6456         (region_model::impl_call_strcpy): Likewise.
6457         * region-model-reachability.cc (reachable_regions::add): Update
6458         for new param of get_store_value.
6459         * region-model.cc (region_model::get_rvalue_1): Likewise, also for
6460         get_rvalue_for_bits.
6461         (region_model::get_store_value): Add ctxt param and use it to call
6462         check_region_for_read.
6463         (region_model::get_rvalue_for_bits): Add ctxt param and use it to
6464         call get_store_value.
6465         (region_model::check_region_access): New.
6466         (region_model::check_region_for_write): New.
6467         (region_model::check_region_for_read): New.
6468         (region_model::set_value): Update comment.  Replace call to
6469         check_for_writable_region with call to check_region_for_write.
6470         * region-model.h (region_model::get_rvalue_for_bits): Add ctxt
6471         param.
6472         (region_model::get_store_value): Add ctxt param.
6473         (region_model::check_region_access): New decl.
6474         (region_model::check_region_for_write): New decl.
6475         (region_model::check_region_for_read): New decl.
6476         * region.cc (region_model::copy_region): Update call to
6477         get_store_value.
6478         * svalue.cc (initial_svalue::implicitly_live_p): Likewise.
6479
6480 2021-07-16  David Malcolm  <dmalcolm@redhat.com>
6481
6482         * engine.cc (exploded_node::on_stmt_pre): Handle
6483         __analyzer_dump_state.
6484         * program-state.cc (extrinsic_state::get_sm_idx_by_name): New.
6485         (program_state::impl_call_analyzer_dump_state): New.
6486         * program-state.h (extrinsic_state::get_sm_idx_by_name): New decl.
6487         (program_state::impl_call_analyzer_dump_state): New decl.
6488         * region-model-impl-calls.cc
6489         (call_details::get_arg_string_literal): New.
6490         * region-model.h (call_details::get_arg_string_literal): New decl.
6491
6492 2021-07-16  David Malcolm  <dmalcolm@redhat.com>
6493
6494         * program-state.cc (program_state::detect_leaks): Simplify using
6495         svalue::maybe_get_region.
6496         * region-model-impl-calls.cc (region_model::impl_call_fgets): Likewise.
6497         (region_model::impl_call_fread): Likewise.
6498         (region_model::impl_call_free): Likewise.
6499         (region_model::impl_call_operator_delete): Likewise.
6500         * region-model.cc (selftest::test_stack_frames): Likewise.
6501         (selftest::test_state_merging): Likewise.
6502         * svalue.cc (svalue::maybe_get_region): New.
6503         * svalue.h (svalue::maybe_get_region): New decl.
6504
6505 2021-07-15  David Malcolm  <dmalcolm@redhat.com>
6506
6507         * svalue.h (is_a_helper <placeholder_svalue *>::test): Make
6508         param and template param const.
6509         (is_a_helper <widening_svalue *>::test): Likewise.
6510         (is_a_helper <compound_svalue *>::test): Likewise.
6511         (is_a_helper <conjured_svalue *>::test): Likewise.
6512
6513 2021-07-15  David Malcolm  <dmalcolm@redhat.com>
6514
6515         PR analyzer/95006
6516         PR analyzer/94713
6517         PR analyzer/94714
6518         * analyzer.cc (maybe_reconstruct_from_def_stmt): Split out
6519         GIMPLE_ASSIGN case into...
6520         (get_diagnostic_tree_for_gassign_1): New.
6521         (get_diagnostic_tree_for_gassign): New.
6522         * analyzer.h (get_diagnostic_tree_for_gassign): New decl.
6523         * analyzer.opt (Wanalyzer-write-to-string-literal): New.
6524         * constraint-manager.cc (class svalue_purger): New.
6525         (constraint_manager::purge_state_involving): New.
6526         * constraint-manager.h
6527         (constraint_manager::purge_state_involving): New.
6528         * diagnostic-manager.cc (saved_diagnostic::supercedes_p): New.
6529         (dedupe_winners::handle_interactions): New.
6530         (diagnostic_manager::emit_saved_diagnostics): Call it.
6531         * diagnostic-manager.h (saved_diagnostic::supercedes_p): New decl.
6532         * engine.cc (impl_region_model_context::warn): Convert return type
6533         to bool.  Return false if the diagnostic isn't saved.
6534         (impl_region_model_context::purge_state_involving): New.
6535         (impl_sm_context::get_state): Use NULL ctxt when querying old
6536         rvalue.
6537         (impl_sm_context::set_next_state): Use new sval when querying old
6538         state.
6539         (class dump_path_diagnostic): Move to region-model.cc
6540         (exploded_node::on_stmt): Move to on_stmt_pre and on_stmt_post.
6541         Remove call to purge_state_involving.
6542         (exploded_node::on_stmt_pre): New, based on the above.  Move most
6543         of it to region_model::on_stmt_pre.
6544         (exploded_node::on_stmt_post): Likewise, moving to
6545         region_model::on_stmt_post.
6546         (class stale_jmp_buf): Fix parent class to use curiously recurring
6547         template pattern.
6548         (feasibility_state::maybe_update_for_edge): Call on_call_pre and
6549         on_call_post on gcalls.
6550         * exploded-graph.h (impl_region_model_context::warn): Return bool.
6551         (impl_region_model_context::purge_state_involving): New decl.
6552         (exploded_node::on_stmt_pre): New decl.
6553         (exploded_node::on_stmt_post): New decl.
6554         * pending-diagnostic.h (pending_diagnostic::use_of_uninit_p): New.
6555         (pending_diagnostic::supercedes_p): New.
6556         * program-state.cc (sm_state_map::get_state): Inherit state for
6557         conjured_svalue as well as initial_svalue.
6558         (sm_state_map::purge_state_involving): Also support SK_CONJURED.
6559         * region-model-impl-calls.cc (call_details::get_uncertainty):
6560         Handle m_ctxt being NULL.
6561         (call_details::get_or_create_conjured_svalue): New.
6562         (region_model::impl_call_fgets): New.
6563         (region_model::impl_call_fread): New.
6564         * region-model-manager.cc
6565         (region_model_manager::get_or_create_initial_value): Return an
6566         uninitialized poisoned value for regions that can't have initial
6567         values.
6568         * region-model-reachability.cc
6569         (reachable_regions::mark_escaped_clusters): Handle ctxt being
6570         NULL.
6571         * region-model.cc (region_to_value_map::purge_state_involving): New.
6572         (poisoned_value_diagnostic::use_of_uninit_p): New.
6573         (poisoned_value_diagnostic::emit): Handle POISON_KIND_UNINIT.
6574         (poisoned_value_diagnostic::describe_final_event): Likewise.
6575         (region_model::check_for_poison): New.
6576         (region_model::on_assignment): Call it.
6577         (class dump_path_diagnostic): Move here from engine.cc.
6578         (region_model::on_stmt_pre): New, based on exploded_node::on_stmt.
6579         (region_model::on_call_pre): Move the setting of the LHS to a
6580         conjured svalue to before the checks for specific functions.
6581         Handle "fgets", "fgets_unlocked", and "fread".
6582         (region_model::purge_state_involving): New.
6583         (region_model::handle_unrecognized_call): Handle ctxt being NULL.
6584         (region_model::get_rvalue): Call check_for_poison.
6585         (selftest::test_stack_frames): Use NULL for context when getting
6586         uninitialized rvalue.
6587         (selftest::test_alloca): Likewise.
6588         * region-model.h (region_to_value_map::purge_state_involving): New
6589         decl.
6590         (call_details::get_or_create_conjured_svalue): New decl.
6591         (region_model::on_stmt_pre): New decl.
6592         (region_model::purge_state_involving): New decl.
6593         (region_model::impl_call_fgets): New decl.
6594         (region_model::impl_call_fread): New decl.
6595         (region_model::check_for_poison): New decl.
6596         (region_model_context::warn): Return bool.
6597         (region_model_context::purge_state_involving): New.
6598         (noop_region_model_context::warn): Return bool.
6599         (noop_region_model_context::purge_state_involving): New.
6600         (test_region_model_context:: warn): Return bool.
6601         * region.cc (region::get_memory_space): New.
6602         (region::can_have_initial_svalue_p): New.
6603         (region::involves_p): New.
6604         * region.h (enum memory_space): New.
6605         (region::get_memory_space): New decl.
6606         (region::can_have_initial_svalue_p): New decl.
6607         (region::involves_p): New decl.
6608         * sm-malloc.cc (use_after_free::supercedes_p): New.
6609         * store.cc (binding_cluster::purge_state_involving): New.
6610         (store::purge_state_involving): New.
6611         * store.h (class symbolic_binding): New forward decl.
6612         (binding_key::dyn_cast_symbolic_binding): New.
6613         (symbolic_binding::dyn_cast_symbolic_binding): New.
6614         (binding_cluster::purge_state_involving): New.
6615         (store::purge_state_involving): New.
6616         * svalue.cc (svalue::can_merge_p): Reject attempts to merge
6617         poisoned svalues with other svalues, so that we identify
6618         paths in which a variable is conditionally uninitialized.
6619         (involvement_visitor::visit_conjured_svalue): New.
6620         (svalue::involves_p): Also handle SK_CONJURED.
6621         (poison_kind_to_str): Handle POISON_KIND_UNINIT.
6622         (poisoned_svalue::maybe_fold_bits_within): New.
6623         * svalue.h (enum poison_kind): Add POISON_KIND_UNINIT.
6624         (poisoned_svalue::maybe_fold_bits_within): New decl.
6625
6626 2021-07-15  David Malcolm  <dmalcolm@redhat.com>
6627
6628         * analyzer.opt (fdump-analyzer-exploded-paths): New.
6629         * diagnostic-manager.cc
6630         (diagnostic_manager::emit_saved_diagnostic): Implement it.
6631         * engine.cc (exploded_path::dump_to_pp): Add ext_state param and
6632         use it to dump states if non-NULL.
6633         (exploded_path::dump): Likewise.
6634         (exploded_path::dump_to_file): New.
6635         * exploded-graph.h (exploded_path::dump_to_pp): Add ext_state
6636         param.
6637         (exploded_path::dump): Likewise.
6638         (exploded_path::dump): Likewise.
6639         (exploded_path::dump_to_file): New.
6640
6641 2021-07-15  David Malcolm  <dmalcolm@redhat.com>
6642
6643         * analyzer.cc (fixup_tree_for_diagnostic_1): Use DECL_DEBUG_EXPR
6644         if it's available.
6645         * engine.cc (readability): Likewise.
6646
6647 2021-07-15  David Malcolm  <dmalcolm@redhat.com>
6648
6649         * state-purge.cc (self_referential_phi_p): New.
6650         (state_purge_per_ssa_name::process_point): Don't purge an SSA name
6651         at its def-stmt if the def-stmt is self-referential.
6652
6653 2021-07-07  David Malcolm  <dmalcolm@redhat.com>
6654
6655         * diagnostic-manager.cc (null_assignment_sm_context::get_state):
6656         New overload.
6657         (null_assignment_sm_context::set_next_state): New overload.
6658         (null_assignment_sm_context::get_diagnostic_tree): New.
6659         * engine.cc (impl_sm_context::get_state): New overload.
6660         (impl_sm_context::set_next_state): New overload.
6661         (impl_sm_context::get_diagnostic_tree): New overload.
6662         (impl_region_model_context::on_condition): Convert params from
6663         tree to const svalue *.
6664         * exploded-graph.h (impl_region_model_context::on_condition):
6665         Likewise.
6666         * region-model.cc (region_model::on_call_pre): Move handling of
6667         internal calls to before checking for get_fndecl_for_call.
6668         (region_model::add_constraints_from_binop): New.
6669         (region_model::add_constraint): Split out into a new overload
6670         working on const svalue * rather than tree.  Call
6671         add_constraints_from_binop.  Drop call to
6672         add_any_constraints_from_ssa_def_stmt.
6673         (region_model::add_any_constraints_from_ssa_def_stmt): Delete.
6674         (region_model::add_any_constraints_from_gassign): Delete.
6675         (region_model::add_any_constraints_from_gcall): Delete.
6676         * region-model.h
6677         (region_model::add_any_constraints_from_ssa_def_stmt): Delete.
6678         (region_model::add_any_constraints_from_gassign): Delete.
6679         (region_model::add_any_constraints_from_gcall): Delete.
6680         (region_model::add_constraint): Add overload decl.
6681         (region_model::add_constraints_from_binop): New decl.
6682         (region_model_context::on_condition): Convert params from tree to
6683         const svalue *.
6684         (noop_region_model_context::on_condition): Likewise.
6685         * sm-file.cc (fileptr_state_machine::condition): Likewise.
6686         * sm-malloc.cc (malloc_state_machine::on_condition): Likewise.
6687         * sm-pattern-test.cc: Include tristate.h, selftest.h,
6688         analyzer/call-string.h, analyzer/program-point.h,
6689         analyzer/store.h, and analyzer/region-model.h.
6690         (pattern_test_state_machine::on_condition): Convert params from tree to
6691         const svalue *.
6692         * sm-sensitive.cc (sensitive_state_machine::on_condition): Delete.
6693         * sm-signal.cc (signal_state_machine::on_condition): Delete.
6694         * sm-taint.cc (taint_state_machine::on_condition): Convert params
6695         from tree to const svalue *.
6696         * sm.cc: Include tristate.h, selftest.h, analyzer/call-string.h,
6697         analyzer/program-point.h, analyzer/store.h, and
6698         analyzer/region-model.h.
6699         (any_pointer_p): Add overload taking const svalue *sval.
6700         * sm.h (any_pointer_p): Add overload taking const svalue *sval.
6701         (state_machine::on_condition): Convert params from tree to
6702         const svalue *.  Provide no-op default implementation.
6703         (sm_context::get_state): Add overload taking const svalue *sval.
6704         (sm_context::set_next_state): Likewise.
6705         (sm_context::on_transition): Likewise.
6706         (sm_context::get_diagnostic_tree): Likewise.
6707         * svalue.cc (svalue::all_zeroes_p): New.
6708         (constant_svalue::all_zeroes_p): New.
6709         (repeated_svalue::all_zeroes_p): Convert to vfunc.
6710         * svalue.h (svalue::all_zeroes_p): New decl.
6711         (constant_svalue::all_zeroes_p): New decl.
6712         (repeated_svalue::all_zeroes_p): Convert decl to vfunc.
6713
6714 2021-06-30  David Malcolm  <dmalcolm@redhat.com>
6715
6716         PR analyzer/95006
6717         * analyzer.h (class repeated_svalue): New forward decl.
6718         (class bits_within_svalue): New forward decl.
6719         (class sized_region): New forward decl.
6720         (get_field_at_bit_offset): New forward decl.
6721         * engine.cc (exploded_graph::get_or_create_node): Validate the
6722         merged state.
6723         (exploded_graph::maybe_process_run_of_before_supernode_enodes):
6724         Validate the states at each stage.
6725         * program-state.cc (program_state::validate): Validate
6726         m_region_model.
6727         * region-model-impl-calls.cc (region_model::impl_call_memset):
6728         Replace special-case logic for handling constant sizes with
6729         a call to fill_region of a sized_region with the given fill value.
6730         * region-model-manager.cc (maybe_undo_optimize_bit_field_compare):
6731         Drop DK_direct.
6732         (region_model_manager::maybe_fold_sub_svalue):  Fold element-based
6733         subregions of an initial value into initial values of an element.
6734         Fold subvalues of repeated svalues.
6735         (region_model_manager::maybe_fold_repeated_svalue): New.
6736         (region_model_manager::get_or_create_repeated_svalue): New.
6737         (get_bit_range_for_field): New.
6738         (get_byte_range_for_field): New.
6739         (get_field_at_byte_range): New.
6740         (region_model_manager::maybe_fold_bits_within_svalue): New.
6741         (region_model_manager::get_or_create_bits_within): New.
6742         (region_model_manager::get_sized_region): New.
6743         (region_model_manager::log_stats): Update for addition of
6744         m_repeated_values_map, m_bits_within_values_map, and
6745         m_sized_regions.
6746         * region-model.cc (region_model::validate): New.
6747         (region_model::on_assignment): Drop enum binding_kind.
6748         (region_model::get_initial_value_for_global): Likewise.
6749         (region_model::get_rvalue_for_bits): Replace body with call to
6750         get_or_create_bits_within.
6751         (region_model::get_capacity): Handle RK_SIZED.
6752         (region_model::set_value): Drop enum binding_kind.
6753         (region_model::fill_region): New.
6754         (region_model::get_representative_path_var_1): Handle RK_SIZED.
6755         * region-model.h (visitor::visit_repeated_svalue): New.
6756         (visitor::visit_bits_within_svalue): New.
6757         (region_model_manager::get_or_create_repeated_svalue): New decl.
6758         (region_model_manager::get_or_create_bits_within): New decl.
6759         (region_model_manager::get_sized_region): New decl.
6760         (region_model_manager::maybe_fold_repeated_svalue): New decl.
6761         (region_model_manager::maybe_fold_bits_within_svalue): New decl.
6762         (region_model_manager::repeated_values_map_t): New typedef.
6763         (region_model_manager::m_repeated_values_map): New field.
6764         (region_model_manager::bits_within_values_map_t): New typedef.
6765         (region_model_manager::m_bits_within_values_map): New field.
6766         (region_model_manager::m_sized_regions): New field.
6767         (region_model::fill_region): New decl.
6768         * region.cc (region::get_base_region): Handle RK_SIZED.
6769         (region::base_region_p): Likewise.
6770         (region::get_byte_size_sval): New.
6771         (get_field_at_bit_offset): Make non-static.
6772         (region::calc_offset): Move implementation of cases to
6773         get_relative_concrete_offset vfunc implementations.  Handle
6774         RK_SIZED.
6775         (region::get_relative_concrete_offset): New.
6776         (decl_region::get_svalue_for_initializer): Drop enum binding_kind.
6777         (field_region::get_relative_concrete_offset): New, from
6778         region::calc_offset.
6779         (element_region::get_relative_concrete_offset): Likewise.
6780         (offset_region::get_relative_concrete_offset): Likewise.
6781         (sized_region::accept): New.
6782         (sized_region::dump_to_pp): New.
6783         (sized_region::get_byte_size): New.
6784         (sized_region::get_bit_size): New.
6785         * region.h (enum region_kind): Add RK_SIZED.
6786         (region::dyn_cast_sized_region): New.
6787         (region::get_byte_size): Make virtual.
6788         (region::get_bit_size): Likewise.
6789         (region::get_byte_size_sval): New decl.
6790         (region::get_relative_concrete_offset): New decl.
6791         (field_region::get_relative_concrete_offset): New decl.
6792         (element_region::get_relative_concrete_offset): Likewise.
6793         (offset_region::get_relative_concrete_offset): Likewise.
6794         (class sized_region): New.
6795         * store.cc (binding_kind_to_string): Delete.
6796         (binding_key::make): Drop enum binding_kind.
6797         (binding_key::dump_to_pp): Delete.
6798         (binding_key::cmp_ptrs): Drop enum binding_kind.
6799         (bit_range::contains_p): New.
6800         (byte_range::dump): New.
6801         (byte_range::contains_p): New.
6802         (byte_range::cmp): New.
6803         (concrete_binding::dump_to_pp): Drop enum binding_kind.
6804         (concrete_binding::cmp_ptr_ptr): Likewise.
6805         (symbolic_binding::dump_to_pp): Likewise.
6806         (symbolic_binding::cmp_ptr_ptr): Likewise.
6807         (binding_map::apply_ctor_val_to_range): Likewise.
6808         (binding_map::apply_ctor_pair_to_child_region): Likewise.
6809         (binding_map::get_overlapping_bindings): New.
6810         (binding_map::remove_overlapping_bindings): New.
6811         (binding_cluster::validate): New.
6812         (binding_cluster::bind): Drop enum binding_kind.
6813         (binding_cluster::bind_compound_sval): Likewise.
6814         (binding_cluster::purge_region): Likewise.
6815         (binding_cluster::zero_fill_region): Reimplement in terms of...
6816         (binding_cluster::fill_region): New.
6817         (binding_cluster::mark_region_as_unknown): Drop enum binding_kind.
6818         (binding_cluster::get_binding): Likewise.
6819         (binding_cluster::get_binding_recursive): Likewise.
6820         (binding_cluster::get_any_binding): Likewise.
6821         (binding_cluster::maybe_get_compound_binding): Reimplement.
6822         (binding_cluster::get_overlapping_bindings): Delete.
6823         (binding_cluster::remove_overlapping_bindings): Reimplement in
6824         terms of binding_map::remove_overlapping_bindings.
6825         (binding_cluster::can_merge_p): Update for removal of
6826         enum binding_kind.
6827         (binding_cluster::on_unknown_fncall): Drop enum binding_kind.
6828         (binding_cluster::maybe_get_simple_value): Likewise.
6829         (store_manager::get_concrete_binding): Likewise.
6830         (store_manager::get_symbolic_binding): Likewise.
6831         (store::validate): New.
6832         (store::set_value): Drop enum binding_kind.
6833         (store::zero_fill_region): Reimplement in terms of...
6834         (store::fill_region): New.
6835         (selftest::test_binding_key_overlap): Drop enum binding_kind.
6836         * store.h (enum binding_kind): Delete.
6837         (binding_kind_to_string): Delete decl.
6838         (binding_key::make): Drop enum binding_kind.
6839         (binding_key::dump_to_pp): Make pure virtual.
6840         (binding_key::get_kind): Delete.
6841         (binding_key::mark_deleted): Delete.
6842         (binding_key::mark_empty): Delete.
6843         (binding_key::is_deleted): Delete.
6844         (binding_key::is_empty): Delete.
6845         (binding_key::binding_key): Delete.
6846         (binding_key::impl_hash): Delete.
6847         (binding_key::impl_eq): Delete.
6848         (binding_key::m_kind): Delete.
6849         (bit_range::get_last_bit_offset): New.
6850         (bit_range::contains_p): New.
6851         (byte_range::contains_p): New.
6852         (byte_range::operator==): New.
6853         (byte_range::get_start_byte_offset): New.
6854         (byte_range::get_next_byte_offset): New.
6855         (byte_range::get_last_byte_offset): New.
6856         (byte_range::as_bit_range): New.
6857         (byte_range::cmp): New.
6858         (concrete_binding::concrete_binding): Drop enum binding_kind.
6859         (concrete_binding::hash): Likewise.
6860         (concrete_binding::operator==): Likewise.
6861         (concrete_binding::mark_deleted): New.
6862         (concrete_binding::mark_empty): New.
6863         (concrete_binding::is_deleted): New.
6864         (concrete_binding::is_empty): New.
6865         (default_hash_traits<ana::concrete_binding>::empty_zero_p): Make false.
6866         (symbolic_binding::symbolic_binding): Drop enum binding_kind.
6867         (symbolic_binding::hash): Likewise.
6868         (symbolic_binding::operator==): Likewise.
6869         (symbolic_binding::mark_deleted): New.
6870         (symbolic_binding::mark_empty): New.
6871         (symbolic_binding::is_deleted): New.
6872         (symbolic_binding::is_empty): New.
6873         (binding_map::remove_overlapping_bindings): New decl.
6874         (binding_map::get_overlapping_bindings): New decl.
6875         (binding_cluster::validate): New decl.
6876         (binding_cluster::bind): Drop enum binding_kind.
6877         (binding_cluster::fill_region): New decl.
6878         (binding_cluster::get_binding): Drop enum binding_kind.
6879         (binding_cluster::get_binding_recursive): Likewise.
6880         (binding_cluster::get_overlapping_bindings): Delete.
6881         (store::validate): New decl.
6882         (store::set_value): Drop enum binding_kind.
6883         (store::fill_region): New decl.
6884         (store_manager::get_concrete_binding): Drop enum binding_kind.
6885         (store_manager::get_symbolic_binding): Likewise.
6886         * svalue.cc (svalue::cmp_ptr): Handle SK_REPEATED and
6887         SK_BITS_WITHIN.
6888         (svalue::extract_bit_range): New.
6889         (svalue::maybe_fold_bits_within): New.
6890         (constant_svalue::maybe_fold_bits_within): New.
6891         (unknown_svalue::maybe_fold_bits_within): New.
6892         (unaryop_svalue::maybe_fold_bits_within): New.
6893         (repeated_svalue::repeated_svalue): New.
6894         (repeated_svalue::dump_to_pp): New.
6895         (repeated_svalue::accept): New.
6896         (repeated_svalue::all_zeroes_p): New.
6897         (repeated_svalue::maybe_fold_bits_within): New.
6898         (bits_within_svalue::bits_within_svalue): New.
6899         (bits_within_svalue::dump_to_pp): New.
6900         (bits_within_svalue::maybe_fold_bits_within): New.
6901         (bits_within_svalue::accept): New.
6902         (bits_within_svalue::implicitly_live_p): New.
6903         (compound_svalue::maybe_fold_bits_within): New.
6904         * svalue.h (enum svalue_kind): Add SK_REPEATED and SK_BITS_WITHIN.
6905         (svalue::dyn_cast_repeated_svalue): New.
6906         (svalue::dyn_cast_bits_within_svalue): New.
6907         (svalue::extract_bit_range): New decl.
6908         (svalue::maybe_fold_bits_within): New vfunc decl.
6909         (region_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
6910         (region_svalue::key_t::is_empty): Likewise.
6911         (default_hash_traits<region_svalue::key_t>::empty_zero_p): Make false.
6912         (constant_svalue::maybe_fold_bits_within): New.
6913         (unknown_svalue::maybe_fold_bits_within): New.
6914         (poisoned_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
6915         (poisoned_svalue::key_t::is_empty): Likewise.
6916         (default_hash_traits<poisoned_svalue::key_t>::empty_zero_p): Make
6917         false.
6918         (setjmp_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
6919         (setjmp_svalue::key_t::is_empty): Likewise.
6920         (default_hash_traits<setjmp_svalue::key_t>::empty_zero_p): Make
6921         false.
6922         (unaryop_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
6923         (unaryop_svalue::key_t::is_empty): Likewise.
6924         (unaryop_svalue::maybe_fold_bits_within): New.
6925         (default_hash_traits<unaryop_svalue::key_t>::empty_zero_p): Make
6926         false.
6927         (binop_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
6928         (binop_svalue::key_t::is_empty): Likewise.
6929         (default_hash_traits<binop_svalue::key_t>::empty_zero_p): Make
6930         false.
6931         (sub_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
6932         (sub_svalue::key_t::is_empty): Likewise.
6933         (default_hash_traits<sub_svalue::key_t>::empty_zero_p): Make
6934         false.
6935         (class repeated_svalue): New.
6936         (is_a_helper <const repeated_svalue *>::test): New.
6937         (struct default_hash_traits<repeated_svalue::key_t>): New.
6938         (class bits_within_svalue): New.
6939         (is_a_helper <const bits_within_svalue *>::test): New.
6940         (struct default_hash_traits<bits_within_svalue::key_t>): New.
6941         (widening_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
6942         (widening_svalue::key_t::is_empty): Likewise.
6943         (default_hash_traits<widening_svalue::key_t>::empty_zero_p): Make
6944         false.
6945         (compound_svalue::key_t::mark_empty): Use 2 rather than NULL_TREE.
6946         (compound_svalue::key_t::is_empty): Likewise.
6947         (compound_svalue::maybe_fold_bits_within): New.
6948         (default_hash_traits<compound_svalue::key_t>::empty_zero_p): Make
6949         false.
6950
6951 2021-06-28  David Malcolm  <dmalcolm@redhat.com>
6952
6953         * analyzer.h (byte_offset_t): New typedef.
6954         * store.cc (bit_range::dump_to_pp): Dump as a byte range if
6955         possible.
6956         (bit_range::as_byte_range): New.
6957         (byte_range::dump_to_pp): New.
6958         * store.h (class byte_range): New forward decl.
6959         (struct bit_range): Add comment.
6960         (bit_range::as_byte_range): New decl.
6961         (struct byte_range): New.
6962
6963 2021-06-22  David Malcolm  <dmalcolm@redhat.com>
6964
6965         PR analyzer/101143
6966         * region-model.cc (compat_types_p): New function.
6967         (region_model::create_region_for_heap_alloc): Convert assertion to
6968         an error check.
6969         (region_model::create_region_for_alloca): Likewise.
6970
6971 2021-06-18  David Malcolm  <dmalcolm@redhat.com>
6972
6973         * store.cc (binding_cluster::get_any_binding): Make symbolic reads
6974         from a cluster with concrete bindings return unknown.
6975
6976 2021-06-18  David Malcolm  <dmalcolm@redhat.com>
6977
6978         * region-model-manager.cc
6979         (region_model_manager::get_or_create_int_cst): New.
6980         (region_model_manager::maybe_undo_optimize_bit_field_compare): Use
6981         it to simplify away a local tree.
6982         * region-model.cc (region_model::on_setjmp): Likewise.
6983         (region_model::on_longjmp): Likewise.
6984         * region-model.h (region_model_manager::get_or_create_int_cst):
6985         New decl.
6986         * store.cc (binding_cluster::zero_fill_region): Use it to simplify
6987         away a local tree.
6988
6989 2021-06-18  David Malcolm  <dmalcolm@redhat.com>
6990
6991         * checker-path.cc (class custom_event): Make abstract to allow for
6992         custom vfuncs, splitting existing implementation into...
6993         (class precanned_custom_event): New subclass.
6994         (custom_event::get_desc): Move to...
6995         (precanned_custom_event::get_desc): ...subclass.
6996         * checker-path.h (class custom_event): Make abstract to allow for
6997         custom vfuncs, splitting existing implementation into...
6998         (class precanned_custom_event): New subclass.
6999         * diagnostic-manager.cc (diagnostic_manager::add_events_for_eedge):
7000         Use precanned_custom_event.
7001         * engine.cc
7002         (stale_jmp_buf::maybe_add_custom_events_for_superedge): Likewise.
7003         * sm-signal.cc (signal_delivery_edge_info_t::add_events_to_path):
7004         Likewise.
7005
7006 2021-06-15  David Malcolm  <dmalcolm@redhat.com>
7007
7008         PR analyzer/99212
7009         PR analyzer/101082
7010         * engine.cc: Include "target.h".
7011         (impl_run_checkers): Log BITS_BIG_ENDIAN, BYTES_BIG_ENDIAN, and
7012         WORDS_BIG_ENDIAN.
7013         * region-model-manager.cc
7014         (region_model_manager::maybe_fold_binop): Move support for masking
7015         via ARG0 & CST into...
7016         (region_model_manager::maybe_undo_optimize_bit_field_compare):
7017         ...this new function.  Flatten by converting from nested
7018         conditionals to a series of early return statements to reject
7019         failures.  Reject if type is not unsigned_char_type_node.
7020         Handle BYTES_BIG_ENDIAN when determining which bits are bound
7021         in the binding_map.
7022         * region-model.h
7023         (region_model_manager::maybe_undo_optimize_bit_field_compare):
7024         New decl.
7025         * store.cc (bit_range::dump): New function.
7026         * store.h (bit_range::dump): New decl.
7027
7028 2021-06-15  David Malcolm  <dmalcolm@redhat.com>
7029
7030         * engine.cc (exploded_node::on_stmt): Handle __analyzer_dump_capacity.
7031         (exploded_node::on_stmt): Drop m_sm_changes from on_stmt_flags.
7032         (state_change_requires_new_enode_p): New function...
7033         (exploded_graph::process_node): Call it, rather than querying
7034         flags.m_sm_changes, so that dynamic-extent differences can also
7035         trigger the splitting of nodes.
7036         * exploded-graph.h (struct on_stmt_flags): Drop field m_sm_changes.
7037         * program-state.cc (program_state::detect_leaks): Purge dead
7038         heap-allocated regions from dynamic extents.
7039         (selftest::test_program_state_1): Fix type of "size_in_bytes".
7040         (selftest::test_program_state_merging): Likewise.
7041         * region-model-impl-calls.cc
7042         (region_model::impl_call_analyzer_dump_capacity): New.
7043         (region_model::impl_call_free): Remove dynamic extents from the
7044         freed region.
7045         * region-model-reachability.h
7046         (reachable_regions::begin_mutable_base_regs): New.
7047         (reachable_regions::end_mutable_base_regs): New.
7048         * region-model.cc: Include "tree-object-size.h".
7049         (region_model::region_model): Support new field m_dynamic_extents.
7050         (region_model::operator=): Likewise.
7051         (region_model::operator==): Likewise.
7052         (region_model::dump_to_pp): Dump sizes of dynamic regions.
7053         (region_model::handle_unrecognized_call): Purge dynamic extents
7054         from any regions that have escaped mutably:.
7055         (region_model::get_capacity): New function.
7056         (region_model::add_constraint): Unset dynamic extents when a
7057         heap-allocated region's address is NULL.
7058         (region_model::unbind_region_and_descendents): Purge dynamic
7059         extents of unbound regions.
7060         (region_model::can_merge_with_p): Call
7061         m_dynamic_extents.can_merge_with_p.
7062         (region_model::create_region_for_heap_alloc): Assert that
7063         size_in_bytes's type is compatible with size_type_node.  Update
7064         for renaming of record_dynamic_extents to set_dynamic_extents.
7065         (region_model::create_region_for_alloca): Likewise.
7066         (region_model::record_dynamic_extents): Rename to...
7067         (region_model::set_dynamic_extents): ...this.  Assert that
7068         size_in_bytes's type is compatible with size_type_node.  Add it
7069         to the m_dynamic_extents map.
7070         (region_model::get_dynamic_extents): New.
7071         (region_model::unset_dynamic_extents): New.
7072         (selftest::test_state_merging): Fix type of "size".
7073         (selftest::test_malloc_constraints): Likewise.
7074         (selftest::test_malloc): Verify dynamic extents.
7075         (selftest::test_alloca): Likewise.
7076         * region-model.h (region_to_value_map::is_empty): New.
7077         (region_model::dynamic_extents_t): New typedef.
7078         (region_model::impl_call_analyzer_dump_capacity): New decl.
7079         (region_model::get_dynamic_extents): New function.
7080         (region_model::get_dynamic_extents): New decl.
7081         (region_model::set_dynamic_extents): New decl.
7082         (region_model::unset_dynamic_extents): New decl.
7083         (region_model::get_capacity): New decl.
7084         (region_model::record_dynamic_extents): Rename to set_dynamic_extents.
7085         (region_model::m_dynamic_extents): New field.
7086
7087 2021-06-15  David Malcolm  <dmalcolm@redhat.com>
7088
7089         * region-model.cc (region_to_value_map::operator=): New.
7090         (region_to_value_map::operator==): New.
7091         (region_to_value_map::dump_to_pp): New.
7092         (region_to_value_map::dump): New.
7093         (region_to_value_map::can_merge_with_p): New.
7094         * region-model.h (class region_to_value_map): New class.
7095
7096 2021-06-13  Trevor Saunders  <tbsaunde@tbsaunde.org>
7097
7098         * call-string.cc (call_string::call_string): Use range based for
7099         to iterate over vec<>.
7100         (call_string::to_json): Likewise.
7101         (call_string::hash): Likewise.
7102         (call_string::calc_recursion_depth): Likewise.
7103         * checker-path.cc (checker_path::fixup_locations): Likewise.
7104         * constraint-manager.cc (equiv_class::equiv_class): Likewise.
7105         (equiv_class::to_json): Likewise.
7106         (equiv_class::hash): Likewise.
7107         (constraint_manager::to_json): Likewise.
7108         * engine.cc (impl_region_model_context::on_svalue_leak):
7109         Likewise.
7110         (on_liveness_change): Likewise.
7111         (impl_region_model_context::on_unknown_change): Likewise.
7112         * program-state.cc (sm_state_map::set_state): Likewise.
7113         * region-model.cc (test_canonicalization_4): Likewise.
7114
7115 2021-06-11  David Malcolm  <dmalcolm@redhat.com>
7116
7117         * engine.cc (worklist::key_t::cmp): Move sort by call_string to
7118         before SCC.
7119
7120 2021-06-09  David Malcolm  <dmalcolm@redhat.com>
7121
7122         * region-model.cc (region_model::get_lvalue_1): Make const.
7123         (region_model::get_lvalue): Likewise.
7124         (region_model::get_rvalue_1): Likewise.
7125         (region_model::get_rvalue): Likewise.
7126         (region_model::deref_rvalue): Likewise.
7127         (region_model::get_rvalue_for_bits): Likewise.
7128         * region-model.h (region_model::get_lvalue): Likewise.
7129         (region_model::get_rvalue): Likewise.
7130         (region_model::deref_rvalue): Likewise.
7131         (region_model::get_rvalue_for_bits): Likewise.
7132         (region_model::get_lvalue_1): Likewise.
7133         (region_model::get_rvalue_1): Likewise.
7134
7135 2021-06-08  David Malcolm  <dmalcolm@redhat.com>
7136
7137         PR analyzer/99212
7138         * region-model-manager.cc
7139         (region_model_manager::maybe_fold_binop): Add support for folding
7140         BIT_AND_EXPR of compound_svalue and a mask constant.
7141         * region-model.cc (region_model::get_rvalue_1): Implement
7142         BIT_FIELD_REF in terms of...
7143         (region_model::get_rvalue_for_bits): New function.
7144         * region-model.h (region_model::get_rvalue_for_bits): New decl.
7145         * store.cc (bit_range::from_mask): New function.
7146         (selftest::test_bit_range_intersects_p): New selftest.
7147         (selftest::assert_bit_range_from_mask_eq): New.
7148         (ASSERT_BIT_RANGE_FROM_MASK_EQ): New macro.
7149         (selftest::assert_no_bit_range_from_mask_eq): New.
7150         (ASSERT_NO_BIT_RANGE_FROM_MASK): New macro.
7151         (selftest::test_bit_range_from_mask): New selftest.
7152         (selftest::analyzer_store_cc_tests): Call the new selftests.
7153         * store.h (bit_range::intersects_p): New.
7154         (bit_range::from_mask): New decl.
7155         (concrete_binding::get_bit_range): New accessor.
7156         (store_manager::get_concrete_binding): New overload taking
7157         const bit_range &.
7158
7159 2021-06-08  David Malcolm  <dmalcolm@redhat.com>
7160
7161         * analyzer.h (int_size_in_bits): New decl.
7162         * region.cc (int_size_in_bits): New function.
7163         (region::get_bit_size): Reimplement in terms of the above.
7164
7165 2021-06-08  David Malcolm  <dmalcolm@redhat.com>
7166
7167         * store.cc (concrete_binding::dump_to_pp): Move bulk of
7168         implementation to...
7169         (bit_range::dump_to_pp): ...this new function.
7170         (bit_range::cmp): New.
7171         (concrete_binding::overlaps_p): Update for use of bit_range.
7172         (concrete_binding::cmp_ptr_ptr): Likewise.
7173         * store.h (struct bit_range): New.
7174         (class concrete_binding): Replace fields m_start_bit_offset and
7175         m_size_in_bits with new field m_bit_range.
7176
7177 2021-06-08  David Malcolm  <dmalcolm@redhat.com>
7178
7179         * svalue.h (conjured_svalue::iterator_t): Delete.
7180
7181 2021-06-03  David Malcolm  <dmalcolm@redhat.com>
7182
7183         * store.h (store::get_direct_binding): Remove unused decl.
7184         (store::get_default_binding): Likewise.
7185
7186 2021-06-03  David Malcolm  <dmalcolm@redhat.com>
7187
7188         * svalue.cc (poisoned_svalue::dump_to_pp): Dump type.
7189         (compound_svalue::dump_to_pp): Dump any type.
7190
7191 2021-05-18  David Malcolm  <dmalcolm@redhat.com>
7192
7193         PR analyzer/100615
7194         * sm-malloc.cc: Include "analyzer/function-set.h".
7195         (malloc_state_machine::on_stmt): Call unaffected_by_call_p and
7196         bail on the functions it recognizes.
7197         (malloc_state_machine::unaffected_by_call_p): New.
7198
7199 2021-05-10  Martin Liska  <mliska@suse.cz>
7200
7201         * sm-file.cc (is_file_using_fn_p): Use startswith
7202         function instead of strncmp.
7203
7204 2021-05-10  Martin Liska  <mliska@suse.cz>
7205
7206         * program-state.cc (program_state::operator=): Remove
7207         __cplusplus >= 201103.
7208         (program_state::program_state): Likewise.
7209         * program-state.h: Likewise.
7210         * region-model.h (class region_model): Remove dead code.
7211
7212 2021-04-24  David Malcolm  <dmalcolm@redhat.com>
7213
7214         PR analyzer/100244
7215         * sm-malloc.cc (free_of_non_heap::describe_state_change):
7216         Bulletproof against change.m_expr being NULL.
7217
7218 2021-04-13  David Malcolm  <dmalcolm@redhat.com>
7219
7220         PR analyzer/98599
7221         * supergraph.cc (saved_uids::make_uid_unique): New.
7222         (saved_uids::restore_uids): New.
7223         (supergraph::supergraph): Replace assignments to stmt->uid with
7224         calls to m_stmt_uids.make_uid_unique.
7225         (supergraph::~supergraph): New.
7226         * supergraph.h (class saved_uids): New.
7227         (supergraph::~supergraph): New decl.
7228         (supergraph::m_stmt_uids): New field.
7229
7230 2021-04-10  David Malcolm  <dmalcolm@redhat.com>
7231
7232         PR analyzer/100011
7233         * region-model.cc (region_model::on_assignment): Avoid NULL
7234         dereference if ctxt is NULL when assigning from a STRING_CST.
7235
7236 2021-04-08  David Malcolm  <dmalcolm@redhat.com>
7237
7238         PR analyzer/99042
7239         PR analyzer/99774
7240         * engine.cc
7241         (impl_region_model_context::impl_region_model_context): Add
7242         uncertainty param and use it to initialize m_uncertainty.
7243         (impl_region_model_context::get_uncertainty): New.
7244         (impl_sm_context::get_fndecl_for_call): Add NULL for new
7245         uncertainty param when constructing impl_region_model_context.
7246         (impl_sm_context::get_state): Likewise.
7247         (impl_sm_context::set_next_state): Likewise.
7248         (impl_sm_context::warn): Likewise.
7249         (exploded_node::on_stmt): Add uncertainty param
7250         and use it when constructing impl_region_model_context.
7251         (exploded_node::on_edge): Add uncertainty param and pass
7252         to on_edge call.
7253         (exploded_node::detect_leaks): Create uncertainty_t and pass to
7254         impl_region_model_context.
7255         (exploded_graph::get_or_create_node): Create uncertainty_t and
7256         pass to prune_for_point.
7257         (maybe_process_run_of_before_supernode_enodes): Create
7258         uncertainty_t and pass to impl_region_model_context.
7259         (exploded_graph::process_node): Create uncertainty_t instances and
7260         pass around as needed.
7261         * exploded-graph.h
7262         (impl_region_model_context::impl_region_model_context): Add
7263         uncertainty param.
7264         (impl_region_model_context::get_uncertainty): New decl.
7265         (impl_region_model_context::m_uncertainty): New field.
7266         (exploded_node::on_stmt): Add uncertainty param.
7267         (exploded_node::on_edge): Likewise.
7268         * program-state.cc (sm_state_map::on_liveness_change): Get
7269         uncertainty from context and use it to unset sm-state from
7270         svalues as appropriate.
7271         (program_state::on_edge): Add uncertainty param and use it when
7272         constructing impl_region_model_context.  Fix indentation.
7273         (program_state::prune_for_point): Add uncertainty param and use it
7274         when constructing impl_region_model_context.
7275         (program_state::detect_leaks): Get any uncertainty from ctxt and
7276         use it to get maybe-live svalues for dest_state, rather than
7277         definitely-live ones; use this when determining which svalues
7278         have leaked.
7279         (selftest::test_program_state_merging): Create uncertainty_t and
7280         pass to impl_region_model_context.
7281         * program-state.h (program_state::on_edge): Add uncertainty param.
7282         (program_state::prune_for_point): Likewise.
7283         * region-model-impl-calls.cc (call_details::get_uncertainty): New.
7284         (region_model::impl_call_memcpy): Pass uncertainty to
7285         mark_region_as_unknown call.
7286         (region_model::impl_call_memset): Likewise.
7287         (region_model::impl_call_strcpy): Likewise.
7288         * region-model-reachability.cc (reachable_regions::handle_sval):
7289         Also add sval to m_mutable_svals.
7290         * region-model.cc (region_model::on_assignment): Pass any
7291         uncertainty from ctxt to the store::set_value call.
7292         (region_model::handle_unrecognized_call): Get any uncertainty from
7293         ctxt and use it to record mutable svalues at the unknown call.
7294         (region_model::get_reachable_svalues): Add uncertainty param and
7295         use it to mark any maybe-bound svalues as being reachable.
7296         (region_model::set_value): Pass any uncertainty from ctxt to the
7297         store::set_value call.
7298         (region_model::mark_region_as_unknown): Add uncertainty param and
7299         pass it on to the store::mark_region_as_unknown call.
7300         (region_model::update_for_call_summary): Add uncertainty param and
7301         pass it on to the region_model::mark_region_as_unknown call.
7302         * region-model.h (call_details::get_uncertainty): New decl.
7303         (region_model::get_reachable_svalues): Add uncertainty param.
7304         (region_model::mark_region_as_unknown): Add uncertainty param.
7305         (region_model_context::get_uncertainty): New vfunc.
7306         (noop_region_model_context::get_uncertainty): New vfunc
7307         implementation.
7308         * store.cc (dump_svalue_set): New.
7309         (uncertainty_t::dump_to_pp): New.
7310         (uncertainty_t::dump): New.
7311         (binding_cluster::clobber_region): Pass NULL for uncertainty to
7312         remove_overlapping_bindings.
7313         (binding_cluster::mark_region_as_unknown): Add uncertainty param
7314         and pass it to remove_overlapping_bindings.
7315         (binding_cluster::remove_overlapping_bindings): Add uncertainty param.
7316         Use it to record any svalues that were in clobbered bindings.
7317         (store::set_value): Add uncertainty param.  Pass it to
7318         binding_cluster::mark_region_as_unknown when handling symbolic
7319         regions.
7320         (store::mark_region_as_unknown): Add uncertainty param and pass it
7321         to binding_cluster::mark_region_as_unknown.
7322         (store::remove_overlapping_bindings): Add uncertainty param and
7323         pass it to binding_cluster::remove_overlapping_bindings.
7324         * store.h (binding_cluster::mark_region_as_unknown): Add
7325         uncertainty param.
7326         (binding_cluster::remove_overlapping_bindings): Likewise.
7327         (store::set_value): Likewise.
7328         (store::mark_region_as_unknown): Likewise.
7329
7330 2021-04-05  David Malcolm  <dmalcolm@redhat.com>
7331
7332         PR analyzer/99906
7333         * analyzer.cc (maybe_reconstruct_from_def_stmt): Fix NULL
7334         dereference on calls with zero arguments.
7335         * sm-malloc.cc (malloc_state_machine::on_stmt): When handling
7336         __attribute__((nonnull)), only call get_diagnostic_tree if the
7337         result will be used.
7338
7339 2021-04-05  David Malcolm  <dmalcolm@redhat.com>
7340
7341         PR analyzer/99886
7342         * diagnostic-manager.cc
7343         (diagnostic_manager::prune_interproc_events): Use signed integers
7344         when subtracting one from path->num_events ().
7345         (diagnostic_manager::consolidate_conditions): Likewise.  Convert
7346         next_idx to a signed int.
7347
7348 2021-04-01  David Malcolm  <dmalcolm@redhat.com>
7349
7350         * diagnostic-manager.cc (diagnostic_manager::add_diagnostic): Make
7351         enode param non-constant, and call add_diagnostic on it.  Add
7352         enode index to log message.
7353         (diagnostic_manager::add_diagnostic): Make enode param
7354         non-constant.
7355         * diagnostic-manager.h (diagnostic_manager::add_diagnostic):
7356         Likewise for both decls.
7357         * engine.cc
7358         (impl_region_model_context::impl_region_model_context): Likewise
7359         for enode_for_diag.
7360         (impl_sm_context::impl_sm_context): Likewise.
7361         (impl_sm_context::m_enode_for_diag): Likewise.
7362         (exploded_node::dump_dot): Don't pass the diagnostic manager
7363         to dump_saved_diagnostics.
7364         (exploded_node::dump_saved_diagnostics): Drop param.  Iterate
7365         directly through all saved diagnostics for the enode, rather
7366         than all saved diagnostics in the diagnostic_manager and
7367         filtering.
7368         (exploded_node::on_stmt): Make non-const.
7369         (exploded_node::on_edge): Likewise.
7370         (exploded_node::on_longjmp): Likewise.
7371         (exploded_node::detect_leaks): Likewise.
7372         (exploded_graph::get_or_create_node): Make enode_for_diag param
7373         non-const.
7374         (exploded_graph_annotator::print_enode): Iterate
7375         directly through all saved diagnostics for the enode, rather
7376         than all saved diagnostics in the diagnostic_manager and
7377         filtering.
7378         * exploded-graph.h
7379         (impl_region_model_context::impl_region_model_context): Make
7380         enode_for_diag param non-constant.
7381         (impl_region_model_context::m_enode_for_diag): Likewise.
7382         (exploded_node::dump_saved_diagnostics): Drop param.
7383         (exploded_node::on_stmt): Make non-const.
7384         (exploded_node::on_edge): Likewise.
7385         (exploded_node::on_longjmp): Likewise.
7386         (exploded_node::detect_leaks): Likewise.
7387         (exploded_node::add_diagnostic): New.
7388         (exploded_node::get_num_diagnostics): New.
7389         (exploded_node::get_saved_diagnostic): New.
7390         (exploded_node::m_saved_diagnostics): New.
7391         (exploded_graph::get_or_create_node): Make enode_for_diag param
7392         non-constant.
7393         * feasible-graph.cc (feasible_node::dump_dot): Drop
7394         diagnostic_manager from call to dump_saved_diagnostics.
7395         * program-state.cc (program_state::on_edge): Convert enode param
7396         to non-const pointer.
7397         (program_state::prune_for_point): Likewise for enode_for_diag
7398         param.
7399         * program-state.h (program_state::on_edge): Convert enode param
7400         to non-const pointer.
7401         (program_state::prune_for_point): Likewise for enode_for_diag
7402         param.
7403
7404 2021-03-31  David Malcolm  <dmalcolm@redhat.com>
7405
7406         PR analyzer/99771
7407         * analyzer.cc (maybe_reconstruct_from_def_stmt): New.
7408         (fixup_tree_for_diagnostic_1): New.
7409         (fixup_tree_for_diagnostic): New.
7410         * analyzer.h (fixup_tree_for_diagnostic): New decl.
7411         * checker-path.cc (call_event::get_desc): Call
7412         fixup_tree_for_diagnostic and use it for the call_with_state call.
7413         (warning_event::get_desc): Likewise for the final_event and
7414         make_label_text calls.
7415         * engine.cc (impl_region_model_context::on_state_leak): Likewise
7416         for the on_leak and add_diagnostic calls.
7417         * region-model.cc (region_model::get_representative_tree):
7418         Likewise for the result.
7419
7420 2021-03-30  David Malcolm  <dmalcolm@redhat.com>
7421
7422         * region.h (region::dump_to_pp): Remove old decl.
7423
7424 2021-03-30  David Malcolm  <dmalcolm@redhat.com>
7425
7426         * sm-file.cc (fileptr_state_machine::on_stmt): Only call
7427         get_diagnostic_tree if the result will be used.
7428         * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise.
7429         (malloc_state_machine::on_deallocator_call): Likewise.
7430         (malloc_state_machine::on_realloc_call): Likewise.
7431         (malloc_state_machine::on_realloc_call): Likewise.
7432         * sm-sensitive.cc
7433         (sensitive_state_machine::warn_for_any_exposure): Likewise.
7434         * sm-taint.cc (taint_state_machine::on_stmt): Likewise.
7435
7436 2021-03-25  David Malcolm  <dmalcolm@redhat.com>
7437
7438         PR analyzer/93695
7439         PR analyzer/99044
7440         PR analyzer/99716
7441         * engine.cc (exploded_node::on_stmt): Clear sm-state involving
7442         an SSA name at the def-stmt of that SSA name.
7443         * program-state.cc (sm_state_map::purge_state_involving): New.
7444         * program-state.h (sm_state_map::purge_state_involving): New decl.
7445         * region-model.cc (selftest::test_involves_p): New.
7446         (selftest::analyzer_region_model_cc_tests): Call it.
7447         * svalue.cc (class involvement_visitor): New class
7448         (svalue::involves_p): New.
7449         * svalue.h (svalue::involves_p): New decl.
7450
7451 2021-03-19  David Malcolm  <dmalcolm@redhat.com>
7452
7453         PR analyzer/99614
7454         * diagnostic-manager.cc (class epath_finder): Add
7455         DISABLE_COPY_AND_ASSIGN.
7456
7457 2021-03-15  Martin Liska  <mliska@suse.cz>
7458
7459         * sm-file.cc (get_file_using_fns): Add missing comma in initializer.
7460
7461 2021-03-11  David Malcolm  <dmalcolm@redhat.com>
7462
7463         PR analyzer/96374
7464         * analyzer.opt (-param=analyzer-max-infeasible-edges=): New param.
7465         (fdump-analyzer-feasibility): New flag.
7466         * diagnostic-manager.cc: Include "analyzer/trimmed-graph.h" and
7467         "analyzer/feasible-graph.h".
7468         (epath_finder::epath_finder): Convert m_sep to a pointer and
7469         only create it if !flag_analyzer_feasibility.
7470         (epath_finder::~epath_finder): New.
7471         (epath_finder::m_sep): Convert to a pointer.
7472         (epath_finder::get_best_epath): Add param "diag_idx" and use it
7473         when logging.  Rather than finding the shortest path and then
7474         checking feasibility, instead use explore_feasible_paths unless
7475         !flag_analyzer_feasibility, in which case simply use the shortest
7476         path, and note if it is infeasible.  Update for m_sep becoming a
7477         pointer.
7478         (class feasible_worklist): New.
7479         (epath_finder::explore_feasible_paths): New.
7480         (epath_finder::process_worklist_item): New.
7481         (class dump_eg_with_shortest_path): New.
7482         (epath_finder::dump_trimmed_graph): New.
7483         (epath_finder::dump_feasible_graph): New.
7484         (saved_diagnostic::saved_diagnostic): Add "idx" param, using it
7485         on new field m_idx.
7486         (saved_diagnostic::to_json): Dump m_idx.
7487         (saved_diagnostic::calc_best_epath): Pass m_idx to get_best_epath.
7488         Remove assertion that m_problem was set when m_best_epath is NULL.
7489         (diagnostic_manager::add_diagnostic): Pass an index when created
7490         saved_diagnostic instances.
7491         * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Add
7492         "idx" param.
7493         (saved_diagnostic::get_index): New accessor.
7494         (saved_diagnostic::m_idx): New field.
7495         * engine.cc (exploded_node::dump_dot): Call args.dump_extra_info.
7496         Move code to...
7497         (exploded_node::dump_processed_stmts): ...this new function and...
7498         (exploded_node::dump_saved_diagnostics): ...this new function.
7499         Add index of each diagnostic.
7500         (exploded_edge::dump_dot):  Move bulk of code to...
7501         (exploded_edge::dump_dot_label): ...this new function.
7502         * exploded-graph.h (eg_traits::dump_args_t::dump_extra_info): New
7503         vfunc.
7504         (exploded_node::dump_processed_stmts): New decl.
7505         (exploded_node::dump_saved_diagnostics): New decl.
7506         (exploded_edge::dump_dot_label): New decl.
7507         * feasible-graph.cc: New file.
7508         * feasible-graph.h: New file.
7509         * trimmed-graph.cc: New file.
7510         * trimmed-graph.h: New file.
7511
7512 2021-03-11  David Malcolm  <dmalcolm@redhat.com>
7513
7514         * diagnostic-manager.cc (epath_finder::epath_finder):
7515         Update shortest_paths init for new param.
7516
7517 2021-03-10  David Malcolm  <dmalcolm@redhat.com>
7518
7519         PR analyzer/96374
7520         * engine.cc (exploded_path::feasible_p): Move "snodes_visited" and
7521         "model" locals into a new class feasibility_state.  Move heart
7522         of per-edge processing into
7523         feasibility_state::maybe_update_for_edge.
7524         (feasibility_state::feasibility_state): New.
7525         (feasibility_state::maybe_update_for_edge): New, based on loop
7526         body in exploded_path::feasible_p.
7527         * exploded-graph.h (class feasibility_state): New.
7528
7529 2021-03-10  David Malcolm  <dmalcolm@redhat.com>
7530
7531         * supergraph.h
7532         (callgraph_superedge::dyn_cast_callgraph_superedge): New.
7533         (call_superedge::dyn_cast_callgraph_superedge): Delete.
7534         (return_superedge::dyn_cast_callgraph_superedge): Delete.
7535
7536 2021-03-02  Martin Liska  <mliska@suse.cz>
7537
7538         * diagnostic-manager.cc (diagnostic_manager::emit_saved_diagnostics):
7539         Do not pass engine.
7540
7541 2021-02-26  David Malcolm  <dmalcolm@redhat.com>
7542
7543         * engine.cc (exploded_path::exploded_path): New copy-ctor.
7544         * exploded-graph.h (exploded_path::operator=): Drop decl.
7545
7546 2021-02-26  David Malcolm  <dmalcolm@redhat.com>
7547
7548         PR analyzer/96374
7549         * diagnostic-manager.cc (class epath_finder): New.
7550         (epath_finder::get_best_epath): New.
7551         (saved_diagnostic::saved_diagnostic): Update for replacement of
7552         m_state and m_epath_length with m_best_epath.
7553         (saved_diagnostic::~saved_diagnostic): Delete m_best_epath.
7554         (saved_diagnostic::to_json): Update "path_length" to be optional.
7555         (saved_diagnostic::calc_best_epath): New, based on
7556         dedupe_winners::add and parts of dedupe_key::dedupe_key.
7557         (saved_diagnostic::get_epath_length): New.
7558         (saved_diagnostic::add_duplicate): New.
7559         (dedupe_key::dedupe_key): Drop epath param.  Move invocation of
7560         stmt_finder to saved_diagnostic::calc_best_epath.
7561         (class dedupe_candidate): Delete.
7562         (class dedupe_hash_map_traits): Update to use saved_diagnotic *
7563         rather than dedupe_candidate * as the value_type/compare_type.
7564         (dedupe_winners::~dedupe_winners): Don't delete the values.
7565         (dedupe_winners::add): Convert param from shortest_exploded_paths to
7566         epath_finder.  Drop "eg" param.  Drop dedupe_candidate, moving
7567         path generation and feasiblity checking to
7568         epath_finder::get_best_epath.  Update winner-selection for move
7569         of epaths from dedupe_candidate to saved_diagnostic.
7570         (dedupe_winners::emit_best):  Update for removal of class
7571         dedupe_candidate.
7572         (dedupe_winners::map_t): Update to use saved_diagnotic * rather
7573         than dedupe_candidate * as the value_type/compare_type.
7574         (diagnostic_manager::emit_saved_diagnostics): Move
7575         shortest_exploded_paths instance into epath_finder and pass that
7576         around instead.
7577         (diagnostic_manager::emit_saved_diagnostic): Drop epath, stmt
7578         and num_dupes params, instead getting these from the
7579         saved_diagnostic.  Use correct location in inform_n call.
7580         * diagnostic-manager.h (class epath_finder): New forward decl.
7581         (saved_diagnostic::status): Drop enum.
7582         (saved_diagnostic::set_feasible): Drop.
7583         (saved_diagnostic::set_infeasible): Drop.
7584         (saved_diagnostic::get_status): Drop.
7585         (saved_diagnostic::calc_best_epath): New decl.
7586         (saved_diagnostic::get_best_epath): New decl.
7587         (saved_diagnostic::get_epath_length): New decl.
7588         (saved_diagnostic::set_epath_length): Drop.
7589         (saved_diagnostic::get_epath_length): Drop inline implementation.
7590         (saved_diagnostic::add_duplicate): New.
7591         (saved_diagnostic::get_num_dupes): New.
7592         (saved_diagnostic::m_d): Document ownership.
7593         (saved_diagnostic::m_trailing_eedge): Make const.
7594         (saved_diagnostic::m_status): Drop field.
7595         (saved_diagnostic::m_epath_length): Drop field.
7596         (saved_diagnostic::m_best_epath): New field.
7597         (saved_diagnostic::m_problem): Document ownership.
7598         (saved_diagnostic::m_duplicates): New field.
7599         (diagnostic_manager::emit_saved_diagnostic): Drop params epath,
7600         stmt, and num_dupes.
7601         * engine.cc (exploded_graph_annotator::print_saved_diagnostic):
7602         Update for changes to saved_diagnostic class.
7603         * exploded-graph.h (exploded_path::feasible_p): Drop unused
7604         overloaded decl.
7605
7606 2021-02-25  David Malcolm  <dmalcolm@redhat.com>
7607
7608         PR analyzer/99193
7609         * region-model-impl-calls.cc (region_model::impl_call_realloc): New.
7610         * region-model.cc (region_model::on_call_pre): Call it.
7611         * region-model.h (region_model::impl_call_realloc): New decl.
7612         * sm-malloc.cc (enum wording): Add WORDING_REALLOCATED.
7613         (malloc_state_machine::m_realloc): New field.
7614         (use_after_free::describe_state_change): Add case for
7615         WORDING_REALLOCATED.
7616         (use_after_free::describe_final_event): Likewise.
7617         (malloc_state_machine::malloc_state_machine): Initialize
7618         m_realloc.
7619         (malloc_state_machine::on_stmt): Handle realloc by calling...
7620         (malloc_state_machine::on_realloc_call): New.
7621
7622 2021-02-22  David Malcolm  <dmalcolm@redhat.com>
7623
7624         PR analyzer/99196
7625         * engine.cc (exploded_node::on_stmt): Provide terminate_path
7626         flag as a way for on_call_pre to terminate the current analysis
7627         path.
7628         * region-model-impl-calls.cc (call_details::num_args): New.
7629         (region_model::impl_call_error): New.
7630         * region-model.cc (region_model::on_call_pre): Add param
7631         "out_terminate_path".  Handle "error" and "error_at_line".
7632         * region-model.h (call_details::num_args): New decl.
7633         (region_model::on_call_pre): Add param "out_terminate_path".
7634         (region_model::impl_call_error): New decl.
7635
7636 2021-02-17  David Malcolm  <dmalcolm@redhat.com>
7637
7638         PR analyzer/98969
7639         * constraint-manager.cc (dead_svalue_purger::should_purge_p):
7640         Update for change to svalue::live_p.
7641         * program-state.cc (sm_state_map::on_liveness_change): Likewise.
7642         (program_state::detect_leaks): Likewise.
7643         * region-model-reachability.cc (reachable_regions::init_cluster):
7644         When dealing with a symbolic region, if the underlying pointer is
7645         implicitly live, add the region to the reachable regions.
7646         * region-model.cc (region_model::compare_initial_and_pointer):
7647         Move logic for detecting initial values of params to
7648         initial_svalue::initial_value_of_param_p.
7649         * svalue.cc (svalue::live_p): Convert "live_svalues" from a
7650         reference to a pointer; support it being NULL.
7651         (svalue::implicitly_live_p): Convert first param from a
7652         refererence to a pointer.
7653         (region_svalue::implicitly_live_p): Likewise.
7654         (constant_svalue::implicitly_live_p): Likewise.
7655         (initial_svalue::implicitly_live_p): Likewise.  Treat the initial
7656         values of params for the top level frame as still live.
7657         (initial_svalue::initial_value_of_param_p): New function, taken
7658         from a test in region_model::compare_initial_and_pointer.
7659         (unaryop_svalue::implicitly_live_p): Convert first param from a
7660         refererence to a pointer.
7661         (binop_svalue::implicitly_live_p): Likewise.
7662         (sub_svalue::implicitly_live_p): Likewise.
7663         (unmergeable_svalue::implicitly_live_p): Likewise.
7664         * svalue.h (svalue::live_p): Likewise.
7665         (svalue::implicitly_live_p): Likewise.
7666         (region_svalue::implicitly_live_p): Likewise.
7667         (constant_svalue::implicitly_live_p): Likewise.
7668         (initial_svalue::implicitly_live_p): Likewise.
7669         (initial_svalue::initial_value_of_param_p): New decl.
7670         (unaryop_svalue::implicitly_live_p): Convert first param from a
7671         refererence to a pointer.
7672         (binop_svalue::implicitly_live_p): Likewise.
7673         (sub_svalue::implicitly_live_p): Likewise.
7674         (unmergeable_svalue::implicitly_live_p): Likewise.
7675
7676 2021-02-12  David Malcolm  <dmalcolm@redhat.com>
7677
7678         PR analyzer/98969
7679         * engine.cc (readability): Add names for the various arbitrary
7680         values.  Handle NOP_EXPR and INTEGER_CST.
7681         (readability_comparator): Combine the readability tests for
7682         tree and stack depth, rather than performing them sequentially.
7683         (impl_region_model_context::on_state_leak): Strip off top-level
7684         casts.
7685         * region-model.cc (region_model::get_representative_path_var): Add
7686         type-checking, moving the bulk of the implementation to...
7687         (region_model::get_representative_path_var_1): ...here.  Respect
7688         types in casts by recursing and re-adding the cast, rather than
7689         merely stripping them off.  Use the correct type when handling
7690         region_svalue.
7691         (region_model::get_representative_tree): Strip off any top-level
7692         cast.
7693         (region_model::get_representative_path_var): Add type-checking,
7694         moving the bulk of the implementation to...
7695         (region_model::get_representative_path_var_1): ...here.
7696         * region-model.h (region_model::get_representative_path_var_1):
7697         New decl
7698         (region_model::get_representative_path_var_1): New decl.
7699         * store.cc (append_pathvar_with_type): New.
7700         (binding_cluster::get_representative_path_vars): Cast path_vars
7701         to the correct type when adding them to *OUT_PVS.
7702
7703 2021-02-09  David Malcolm  <dmalcolm@redhat.com>
7704
7705         PR analyzer/98575
7706         * sm-file.cc (is_file_using_fn_p): Support "_IO_"-prefixed
7707         variants.
7708
7709 2021-02-09  David Malcolm  <dmalcolm@redhat.com>
7710
7711         PR analyzer/98575
7712         * store.cc (store::set_value): Treat a pointer written to *UNKNOWN
7713         as having escaped.
7714
7715 2021-02-02  David Malcolm  <dmalcolm@redhat.com>
7716
7717         PR analyzer/93355
7718         PR analyzer/96374
7719         * engine.cc (toplevel_function_p): Simplify so that
7720         we only reject functions with a "__analyzer_" prefix.
7721         (add_any_callbacks): Delete.
7722         (exploded_graph::build_initial_worklist): Update for
7723         dropped param of toplevel_function_p.
7724         (exploded_graph::build_initial_worklist): Don't bother
7725         looking for callbacks that are reachable from global
7726         initializers.
7727
7728 2021-02-01  David Malcolm  <dmalcolm@redhat.com>
7729
7730         PR analyzer/98918
7731         * region-model-manager.cc
7732         (region_model_manager::get_or_create_initial_value):
7733         Fold the initial value of *UNKNOWN_PTR to an UNKNOWN value.
7734         (region_model_manager::get_field_region): Fold the value
7735         of UNKNOWN_PTR->FIELD to *UNKNOWN_PTR_OF_&FIELD_TYPE.
7736
7737 2021-01-29  David Malcolm  <dmalcolm@redhat.com>
7738
7739         * checker-path.cc (event_kind_to_string): Handle
7740         EK_START_CONSOLIDATED_CFG_EDGES and
7741         EK_END_CONSOLIDATED_CFG_EDGES.
7742         (start_consolidated_cfg_edges_event::get_desc): New.
7743         (checker_path::cfg_edge_pair_at_p): New.
7744         * checker-path.h (enum event_kind): Add
7745         EK_START_CONSOLIDATED_CFG_EDGES and
7746         EK_END_CONSOLIDATED_CFG_EDGES.
7747         (class start_consolidated_cfg_edges_event): New class.
7748         (class end_consolidated_cfg_edges_event): New class.
7749         (checker_path::delete_events): New.
7750         (checker_path::replace_event): New.
7751         (checker_path::cfg_edge_pair_at_p): New decl.
7752         * diagnostic-manager.cc (diagnostic_manager::prune_path): Call
7753         consolidate_conditions.
7754         (same_line_as_p): New.
7755         (diagnostic_manager::consolidate_conditions): New.
7756         * diagnostic-manager.h
7757         (diagnostic_manager::consolidate_conditions): New decl.
7758
7759 2021-01-18  David Malcolm  <dmalcolm@redhat.com>
7760
7761         * analyzer.h (is_std_named_call_p): New decl.
7762         * diagnostic-manager.cc (path_builder::get_sm): New.
7763         (state_change_event_creator::state_change_event_creator): Add "pb"
7764         param.
7765         (state_change_event_creator::on_global_state_change): Don't consider
7766         state changes affecting other state_machines.
7767         (state_change_event_creator::on_state_change): Likewise.
7768         (state_change_event_creator::m_pb): New field.
7769         (diagnostic_manager::add_events_for_eedge): Pass pb to visitor
7770         ctor.
7771         * region-model-impl-calls.cc
7772         (region_model::impl_deallocation_call): New.
7773         * region-model.cc: Include "attribs.h".
7774         (region_model::on_call_post): Handle fndecls referenced by
7775         __attribute__((deallocated_by(FOO))).
7776         * region-model.h (region_model::impl_deallocation_call): New decl.
7777         * sm-malloc.cc: Include "stringpool.h" and "attribs.h".  Add
7778         leading comment.
7779         (class api): Delete.
7780         (enum resource_state): Update comment for change from api to
7781         deallocator and deallocator_set.
7782         (allocation_state::allocation_state): Drop api param.  Add
7783         "deallocators" and "deallocator".
7784         (allocation_state::m_api): Drop field in favor of...
7785         (allocation_state::m_deallocators): New field.
7786         (allocation_state::m_deallocator): New field.
7787         (enum wording): Add WORDING_DEALLOCATED.
7788         (struct deallocator): New.
7789         (struct standard_deallocator): New.
7790         (struct custom_deallocator): New.
7791         (struct deallocator_set): New.
7792         (struct custom_deallocator_set): New.
7793         (struct standard_deallocator_set): New.
7794         (struct deallocator_set_map_traits): New.
7795         (malloc_state_machine::m_malloc): Drop field
7796         (malloc_state_machine::m_scalar_new): Likewise.
7797         (malloc_state_machine::m_vector_new): Likewise.
7798         (malloc_state_machine::m_free): New field
7799         (malloc_state_machine::m_scalar_delete): Likewise.
7800         (malloc_state_machine::m_vector_delete): Likewise.
7801         (malloc_state_machine::deallocator_map_t): New typedef.
7802         (malloc_state_machine::m_deallocator_map): New field.
7803         (malloc_state_machine::deallocator_set_cache_t): New typedef.
7804         (malloc_state_machine::m_custom_deallocator_set_cache): New field.
7805         (malloc_state_machine::custom_deallocator_set_map_t): New typedef.
7806         (malloc_state_machine::m_custom_deallocator_set_map): New field.
7807         (malloc_state_machine::m_dynamic_sets): New field.
7808         (malloc_state_machine::m_dynamic_deallocators): New field.
7809         (api::api): Delete.
7810         (deallocator::deallocator): New ctor.
7811         (deallocator::hash): New.
7812         (deallocator::dump_to_pp): New.
7813         (deallocator::cmp): New.
7814         (deallocator::cmp_ptr_ptr): New.
7815         (standard_deallocator::standard_deallocator): New ctor.
7816         (deallocator_set::deallocator_set): New ctor.
7817         (deallocator_set::dump): New.
7818         (custom_deallocator_set::custom_deallocator_set): New ctor.
7819         (custom_deallocator_set::contains_p): New.
7820         (custom_deallocator_set::maybe_get_single): New.
7821         (custom_deallocator_set::dump_to_pp): New.
7822         (standard_deallocator_set::standard_deallocator_set): New ctor.
7823         (standard_deallocator_set::contains_p): New.
7824         (standard_deallocator_set::maybe_get_single): New.
7825         (standard_deallocator_set::dump_to_pp): New.
7826         (start_p): New.
7827         (class mismatching_deallocation): Update for conversion from api
7828         to deallocator_set and deallocator.
7829         (double_free::emit): Use %qs.
7830         (class use_after_free): Update for conversion from api to
7831         deallocator_set and deallocator.
7832         (malloc_leak::describe_state_change): Only emit "allocated here" on
7833         a start->nonnull transition, rather than on other transitions to
7834         nonnull.
7835         (allocation_state::dump_to_pp): Update for conversion from api to
7836         deallocator_set.
7837         (allocation_state::get_nonnull): Likewise.
7838         (malloc_state_machine::malloc_state_machine): Likewise.
7839         (malloc_state_machine::~malloc_state_machine): New.
7840         (malloc_state_machine::add_state): Update for conversion from api
7841         to deallocator_set.
7842         (malloc_state_machine::get_or_create_custom_deallocator_set): New.
7843         (malloc_state_machine::maybe_create_custom_deallocator_set): New.
7844         (malloc_state_machine::get_or_create_deallocator): New.
7845         (malloc_state_machine::on_stmt): Update for conversion from api
7846         to deallocator_set.  Handle "__attribute__((malloc(FOO)))", and
7847         the special attribute set on FOO.
7848         (malloc_state_machine::on_allocator_call): Update for conversion
7849         from api to deallocator_set.  Add "returns_nonnull" param and use
7850         it to affect which state to transition to.
7851         (malloc_state_machine::on_deallocator_call): Update for conversion
7852         from api to deallocator_set.
7853
7854 2021-01-14  David Malcolm  <dmalcolm@redhat.com>
7855
7856         * engine.cc (strongly_connected_components::to_json): New.
7857         (worklist::to_json): New.
7858         (exploded_graph::to_json): JSON-ify the worklist.
7859         * exploded-graph.h (strongly_connected_components::to_json): New
7860         decl.
7861         (worklist::to_json): New decl.
7862         * store.cc (store::to_json): Fix comment.
7863         * supergraph.cc (supernode::to_json): Fix reference to
7864         "returning_call" in comment.  Add optional "fun" to JSON.
7865         (edge_kind_to_string): New.
7866         (superedge::to_json): Add "kind" to JSON.
7867
7868 2021-01-14  David Malcolm  <dmalcolm@redhat.com>
7869
7870         PR analyzer/98679
7871         * analyzer.h (region_offset::operator==): Make const.
7872         * pending-diagnostic.h (pending_diagnostic::equal_p): Likewise.
7873         * store.h (binding_cluster::for_each_value): Likewise.
7874         (binding_cluster::for_each_binding): Likewise.
7875
7876 2021-01-12  David Malcolm  <dmalcolm@redhat.com>
7877
7878         PR analyzer/98628
7879         * store.cc (binding_cluster::make_unknown_relative_to): Don't mark
7880         dereferenced unknown pointers as having escaped.
7881
7882 2021-01-07  David Malcolm  <dmalcolm@redhat.com>
7883
7884         PR analyzer/98580
7885         * region.cc (decl_region::get_svalue_for_initializer): Gracefully
7886         handle when LTO writes out DECL_INITIAL as error_mark_node.
7887
7888 2021-01-07  David Malcolm  <dmalcolm@redhat.com>
7889
7890         PR analyzer/97074
7891         * store.cc (binding_cluster::can_merge_p): Add "out_store" param
7892         and pass to calls to binding_cluster::make_unknown_relative_to.
7893         (binding_cluster::make_unknown_relative_to): Add "out_store"
7894         param.  Use it to mark base regions that are pointed to by
7895         pointers that become unknown as having escaped.
7896         (store::can_merge_p): Pass out_store to
7897         binding_cluster::can_merge_p.
7898         * store.h (binding_cluster::can_merge_p): Add "out_store" param.
7899         (binding_cluster::make_unknown_relative_to): Likewise.
7900         * svalue.cc (region_svalue::implicitly_live_p): New vfunc.
7901         * svalue.h (region_svalue::implicitly_live_p): New vfunc decl.
7902
7903 2021-01-07  David Malcolm  <dmalcolm@redhat.com>
7904
7905         PR analyzer/98564
7906         * engine.cc (exploded_path::feasible_p): Add missing call to
7907         bitmap_clear.
7908
7909 2021-01-06  David Malcolm  <dmalcolm@redhat.com>
7910
7911         PR analyzer/97072
7912         * region-model-reachability.cc (reachable_regions::init_cluster):
7913         Convert symbolic region handling to a switch statement.  Add cases
7914         to handle SK_UNKNOWN and SK_CONJURED.
7915
7916 2021-01-05  David Malcolm  <dmalcolm@redhat.com>
7917
7918         PR analyzer/98293
7919         * store.cc (binding_map::apply_ctor_to_region): When "index" is
7920         NULL, iterate through the fields for RECORD_TYPEs, rather than
7921         creating an INTEGER_CST index.
7922
7923 2020-11-30  David Malcolm  <dmalcolm@redhat.com>
7924
7925         * analyzer-pass.cc: Include "analyzer/analyzer.h" for the
7926         declaration of sorry_no_analyzer; include "tree.h" and
7927         "function.h" as these are needed by it.
7928
7929 2020-11-30  David Malcolm  <dmalcolm@redhat.com>
7930
7931         * analyzer-pass.cc (pass_analyzer::execute): Move sorry call to...
7932         (sorry_no_analyzer): New.
7933         * analyzer.h (class state_machine): New forward decl.
7934         (class logger): New forward decl.
7935         (class plugin_analyzer_init_iface): New.
7936         (sorry_no_analyzer): New decl.
7937         * checker-path.cc (checker_path::fixup_locations): New.
7938         * checker-path.h (checker_event::set_location): New.
7939         (checker_path::fixup_locations): New decl.
7940         * diagnostic-manager.cc
7941         (diagnostic_manager::emit_saved_diagnostic): Call
7942         checker_path::fixup_locations, and call fixup_location
7943         on the primary location.
7944         * engine.cc: Include "plugin.h".
7945         (class plugin_analyzer_init_impl): New.
7946         (impl_run_checkers): Invoke PLUGIN_ANALYZER_INIT callbacks.
7947         * pending-diagnostic.h (pending_diagnostic::fixup_location): New
7948         vfunc.
7949
7950 2020-11-18  David Malcolm  <dmalcolm@redhat.com>
7951
7952         PR analyzer/97893
7953         * sm-malloc.cc (null_deref::emit): Use CWE-476 rather than
7954         CWE-690, as this isn't due to an unchecked return value.
7955         (null_arg::emit): Likewise.
7956
7957 2020-11-12  David Malcolm  <dmalcolm@redhat.com>
7958
7959         * checker-path.h (checker_event::get_id_ptr): New.
7960         * diagnostic-manager.cc (path_builder::path_builder): Add "sd"
7961         param and use it to initialize new field "m_sd".
7962         (path_builder::get_pending_diagnostic): New.
7963         (path_builder::m_sd): New field.
7964         (diagnostic_manager::emit_saved_diagnostic): Pass sd to
7965         path_builder ctor.
7966         (diagnostic_manager::add_events_for_superedge): Call new
7967         maybe_add_custom_events_for_superedge vfunc.
7968         * engine.cc (stale_jmp_buf::stale_jmp_buf): Add "setjmp_point"
7969         param and use it to initialize new field "m_setjmp_point".
7970         Initialize new field "m_stack_pop_event".
7971         (stale_jmp_buf::maybe_add_custom_events_for_superedge): New vfunc
7972         implementation.
7973         (stale_jmp_buf::describe_final_event): New vfunc implementation.
7974         (stale_jmp_buf::m_setjmp_point): New field.
7975         (stale_jmp_buf::m_stack_pop_event): New field.
7976         (exploded_node::on_longjmp): Pass setjmp_point to stale_jmp_buf
7977         ctor.
7978         * pending-diagnostic.h
7979         (pending_diagnostic::maybe_add_custom_events_for_superedge): New
7980         vfunc.
7981
7982 2020-11-12  David Malcolm  <dmalcolm@redhat.com>
7983
7984         PR tree-optimization/97424
7985         * analyzer.opt (Wanalyzer-shift-count-negative): New.
7986         (Wanalyzer-shift-count-overflow): New.
7987         * region-model.cc (class shift_count_negative_diagnostic): New.
7988         (class shift_count_overflow_diagnostic): New.
7989         (region_model::get_gassign_result): Complain about shift counts that
7990         are negative or are >= the operand's type's width.
7991
7992 2020-11-10  Martin Liska  <mliska@suse.cz>
7993
7994         * constraint-manager.cc (constraint_manager::merge): Remove
7995         unused code.
7996         * constraint-manager.h: Likewise.
7997         * program-state.cc (sm_state_map::sm_state_map): Likewise.
7998         (program_state::program_state): Likewise.
7999         (test_sm_state_map): Likewise.
8000         * program-state.h: Likewise.
8001         * region-model-reachability.cc (reachable_regions::reachable_regions): Likewise.
8002         * region-model-reachability.h: Likewise.
8003         * region-model.cc (region_model::handle_unrecognized_call): Likewise.
8004         (region_model::get_reachable_svalues): Likewise.
8005         (region_model::can_merge_with_p): Likewise.
8006
8007 2020-11-05  David Malcolm  <dmalcolm@redhat.com>
8008
8009         PR analyzer/97668
8010         * svalue.cc (cmp_cst): Handle COMPLEX_CST.
8011
8012 2020-10-29  David Malcolm  <dmalcolm@redhat.com>
8013
8014         * program-state.cc (sm_state_map::on_liveness_change): Sort the
8015         leaking svalues before calling on_state_leak.
8016         (program_state::detect_leaks): Likewise when calling
8017         on_svalue_leak.
8018         * region-model-reachability.cc
8019         (reachable_regions::mark_escaped_clusters): Likewise when
8020         calling on_escaped_function.
8021
8022 2020-10-29  David Malcolm  <dmalcolm@redhat.com>
8023
8024         PR analyzer/97608
8025         * region-model-reachability.cc (reachable_regions::handle_sval):
8026         Operands of reachable reversible operations are reachable.
8027
8028 2020-10-29  David Malcolm  <dmalcolm@redhat.com>
8029
8030         * analyzer.h (class state_machine): New forward decl.
8031         (class logger): Likewise.
8032         (class visitor): Likewise.
8033         * complexity.cc: New file, taken from svalue.cc.
8034         * complexity.h: New file, taken from region-model.h.
8035         * region-model.h: Include "analyzer/svalue.h" and
8036         "analyzer/region.h".  Move struct complexity to complexity.h.
8037         Move svalue, its subclasses and supporting decls to svalue.h.
8038         Move region, its subclasses and supporting decls to region.h.
8039         * region.cc: Include "analyzer/region.h".
8040         (symbolic_region::symbolic_region): Move here from region-model.h.
8041         * region.h: New file, based on material from region-model.h.
8042         * svalue.cc: Include "analyzer/svalue.h".
8043         (complexity::complexity): Move to complexity.cc.
8044         (complexity::from_pair): Likewise.
8045         * svalue.h: New file, based on material from region-model.h.
8046
8047 2020-10-29  David Malcolm  <dmalcolm@redhat.com>
8048
8049         * program-state.cc (sm_state_map::print): Guard the printing of
8050         the origin pointer with !flag_dump_noaddr.
8051         * region.cc (string_region::dump_to_pp): Likewise for
8052         m_string_cst.
8053
8054 2020-10-27  David Malcolm  <dmalcolm@redhat.com>
8055
8056         PR analyzer/97568
8057         * region-model.cc (region_model::get_initial_value_for_global):
8058         Move check that !DECL_EXTERNAL from here to...
8059         * region.cc (decl_region::get_svalue_for_initializer): ...here,
8060         using it to reject zero initialization.
8061
8062 2020-10-27  Markus Böck  <markus.boeck02@gmail.com>
8063
8064         PR analyzer/96608
8065         * store.h (hash): Cast to intptr_t instead of long
8066
8067 2020-10-27  David Malcolm  <dmalcolm@redhat.com>
8068
8069         * constraint-manager.cc (svalue_cmp_by_ptr): Delete.
8070         (equiv_class::canonicalize): Use svalue::cmp_ptr_ptr instead.
8071         (equiv_class_cmp): Eliminate pointer comparison.
8072         * diagnostic-manager.cc (dedupe_key::comparator): If they are at
8073         the same location, also compare epath ength and pending_diagnostic
8074         kind.
8075         * engine.cc (readability_comparator): If two path_vars have the
8076         same readability, then impose an arbitrary ordering on them.
8077         (worklist::key_t::cmp): If two points have the same plan ordering,
8078         continue the comparison.  Call sm_state_map::cmp rather than
8079         comparing hash values.
8080         * program-state.cc (sm_state_map::entry_t::cmp): New.
8081         (sm_state_map::cmp): New.
8082         * program-state.h (sm_state_map::entry_t::cmp): New decl.
8083         (sm_state_map::elements): New.
8084         (sm_state_map::cmp): New.
8085
8086 2020-10-27  David Malcolm  <dmalcolm@redhat.com>
8087
8088         * engine.cc (setjmp_record::cmp): New.
8089         (supernode_cluster::dump_dot): Avoid embedding pointer in cluster
8090         name.
8091         (supernode_cluster::cmp_ptr_ptr): New.
8092         (function_call_string_cluster::dump_dot): Avoid embedding pointer
8093         in cluster name.  Sort m_map when dumping child clusters.
8094         (function_call_string_cluster::cmp_ptr_ptr): New.
8095         (root_cluster::dump_dot): Sort m_map when dumping child clusters.
8096         * program-point.cc (function_point::cmp): New.
8097         (function_point::cmp_ptr): New.
8098         * program-point.h (function_point::cmp): New decl.
8099         (function_point::cmp_ptr): New decl.
8100         * program-state.cc (sm_state_map::print): Sort the values.  Guard
8101         the printing of pointers with !flag_dump_noaddr.
8102         (program_state::prune_for_point): Sort the regions.
8103         (log_set_of_svalues): Sort the values.  Guard the printing of
8104         pointers with !flag_dump_noaddr.
8105         * region-model-manager.cc (log_uniq_map): Sort the values.
8106         * region-model-reachability.cc (dump_set): New function template.
8107         (reachable_regions::dump_to_pp): Use it.
8108         * region-model.h (svalue::cmp_ptr): New decl.
8109         (svalue::cmp_ptr_ptr): New decl.
8110         (setjmp_record::cmp): New decl.
8111         (placeholder_svalue::get_name): New accessor.
8112         (widening_svalue::get_point): New accessor.
8113         (compound_svalue::get_map): New accessor.
8114         (conjured_svalue::get_stmt): New accessor.
8115         (conjured_svalue::get_id_region): New accessor.
8116         (region::cmp_ptrs): Rename to...
8117         (region::cmp_ptr_ptr): ...this.
8118         * region.cc (region::cmp_ptrs): Rename to...
8119         (region::cmp_ptr_ptr): ...this.
8120         * state-purge.cc
8121         (state_purge_per_ssa_name::state_purge_per_ssa_name): Sort
8122         m_points_needing_name when dumping.
8123         * store.cc (concrete_binding::cmp_ptr_ptr): New.
8124         (symbolic_binding::cmp_ptr_ptr): New.
8125         (binding_map::cmp): New.
8126         (get_sorted_parent_regions): Update for renaming of
8127         region::cmp_ptrs to region::cmp_ptr_ptr.
8128         (store::dump_to_pp): Likewise.
8129         (store::to_json): Likewise.
8130         (store::can_merge_p): Sort the base regions before considering
8131         them.
8132         * store.h (concrete_binding::cmp_ptr_ptr): New decl.
8133         (symbolic_binding::cmp_ptr_ptr): New decl.
8134         (binding_map::cmp): New decl.
8135         * supergraph.cc (supergraph::supergraph): Assign UIDs to the
8136         gimple stmts.
8137         * svalue.cc (cmp_cst): New.
8138         (svalue::cmp_ptr): New.
8139         (svalue::cmp_ptr_ptr): New.
8140
8141 2020-10-27  David Malcolm  <dmalcolm@redhat.com>
8142
8143         * engine.cc (exploded_graph::get_or_create_node): Fix off-by-one
8144         when imposing param_analyzer_max_enodes_per_program_point limit.
8145
8146 2020-10-27  David Malcolm  <dmalcolm@redhat.com>
8147
8148         * region-model.cc (region_model::get_representative_path_var):
8149         Implement case RK_LABEL.
8150         * region-model.h (label_region::get_label): New accessor.
8151
8152 2020-10-22  David Malcolm  <dmalcolm@redhat.com>
8153
8154         PR analyzer/97514
8155         * engine.cc (exploded_graph::add_function_entry): Handle failure
8156         to create an enode, rather than asserting.
8157
8158 2020-10-22  David Malcolm  <dmalcolm@redhat.com>
8159
8160         PR analyzer/97489
8161         * engine.cc (exploded_graph::add_function_entry): Assert that we
8162         have a function body.
8163         (exploded_graph::on_escaped_function): Reject fndecls that don't
8164         have a function body.
8165
8166 2020-10-14  David Malcolm  <dmalcolm@redhat.com>
8167
8168         PR analyzer/93388
8169         * region-model.cc (region_model::get_initial_value_for_global):
8170         Fall back to returning an initial_svalue if
8171         decl_region::get_svalue_for_initializer fails.
8172         * region.cc (decl_region::get_svalue_for_initializer): Don't
8173         attempt to create a compound_svalue if the region has an unknown
8174         size.
8175
8176 2020-10-14  David Malcolm  <dmalcolm@redhat.com>
8177
8178         PR analyzer/93723
8179         * store.cc (binding_map::apply_ctor_to_region): Remove redundant
8180         assertion.
8181
8182 2020-10-12  David Malcolm  <dmalcolm@redhat.com>
8183
8184         PR analyzer/97258
8185         * engine.cc (impl_region_model_context::on_escaped_function): New
8186         vfunc.
8187         (exploded_graph::add_function_entry): Use m_functions_with_enodes
8188         to implement idempotency.
8189         (add_any_callbacks): New.
8190         (exploded_graph::build_initial_worklist): Use the above to find
8191         callbacks that are reachable from global initializers.
8192         (exploded_graph::on_escaped_function): New.
8193         * exploded-graph.h
8194         (impl_region_model_context::on_escaped_function): New decl.
8195         (exploded_graph::on_escaped_function): New decl.
8196         (exploded_graph::m_functions_with_enodes): New field.
8197         * region-model-reachability.cc
8198         (reachable_regions::reachable_regions): Replace "store" param with
8199         "model" param; use it to initialize m_model.
8200         (reachable_regions::add): When getting the svalue for the region,
8201         call get_store_value on the model rather than using an initial
8202         value.
8203         (reachable_regions::mark_escaped_clusters): Add ctxt param and
8204         use it to call on_escaped_function when a function_region escapes.
8205         * region-model-reachability.h
8206         (reachable_regions::reachable_regions): Replace "store" param with
8207         "model" param.
8208         (reachable_regions::mark_escaped_clusters): Add ctxt param.
8209         (reachable_regions::m_model): New field.
8210         * region-model.cc (region_model::handle_unrecognized_call): Update
8211         for change in reachable_regions ctor.
8212         (region_model::handle_unrecognized_call): Pass ctxt to
8213         mark_escaped_clusters.
8214         (region_model::get_reachable_svalues): Update for change in
8215         reachable_regions ctor.
8216         (region_model::get_initial_value_for_global): Read-only variables
8217         keep their initial values.
8218         * region-model.h (region_model_context::on_escaped_function): New
8219         vfunc.
8220         (noop_region_model_context::on_escaped_function): New.
8221
8222 2020-10-12  David Malcolm  <dmalcolm@redhat.com>
8223
8224         * analyzer.opt (Wanalyzer-write-to-const): New.
8225         (Wanalyzer-write-to-string-literal): New.
8226         * region-model-impl-calls.cc (region_model::impl_call_memcpy):
8227         Call check_for_writable_region.
8228         (region_model::impl_call_memset): Likewise.
8229         (region_model::impl_call_strcpy): Likewise.
8230         * region-model.cc (class write_to_const_diagnostic): New.
8231         (class write_to_string_literal_diagnostic): New.
8232         (region_model::check_for_writable_region): New.
8233         (region_model::set_value): Call check_for_writable_region.
8234         * region-model.h (region_model::check_for_writable_region): New
8235         decl.
8236
8237 2020-10-07  David Malcolm  <dmalcolm@redhat.com>
8238
8239         PR analyzer/97116
8240         * sm-malloc.cc (method_p): New.
8241         (describe_argument_index): New.
8242         (inform_nonnull_attribute): Use describe_argument_index.
8243         (possible_null_arg::describe_final_event): Likewise.
8244         (null_arg::describe_final_event): Likewise.
8245
8246 2020-09-29  David Malcolm  <dmalcolm@redhat.com>
8247
8248         PR analyzer/95188
8249         * engine.cc (stmt_requires_new_enode_p): Split enodes before
8250         "signal" calls.
8251
8252 2020-09-29  David Malcolm  <dmalcolm@redhat.com>
8253
8254         * constraint-manager.cc
8255         (constraint_manager::add_constraint_internal): Whitespace fixes.
8256         Silence -Wsign-compare warning.
8257         * engine.cc (maybe_process_run_of_before_supernode_enodes):
8258         Silence -Wsign-compare warning.
8259
8260 2020-09-28  David Malcolm  <dmalcolm@redhat.com>
8261
8262         * region-model.h (binop_svalue::dyn_cast_binop_svalue): Remove
8263         redundant "virtual".  Add FINAL OVERRIDE.
8264         (widening_svalue::dyn_cast_widening_svalue): Add FINAL OVERRIDE.
8265         (compound_svalue::dyn_cast_compound_svalue): Likewise.
8266         (conjured_svalue::dyn_cast_conjured_svalue): Likewise.
8267
8268 2020-09-28  David Malcolm  <dmalcolm@redhat.com>
8269
8270         * diagnostic-manager.cc (null_assignment_sm_context::m_visitor):
8271         Remove unused field.
8272
8273 2020-09-28  David Malcolm  <dmalcolm@redhat.com>
8274
8275         PR analyzer/97233
8276         * analyzer.cc (is_longjmp_call_p): Require the initial argument
8277         to be a pointer.
8278         * engine.cc (exploded_node::on_longjmp): Likewise.
8279
8280 2020-09-28  David Malcolm  <dmalcolm@redhat.com>
8281
8282         * program-state.cc (sm_state_map::print): Update check
8283         for m_global_state being the start state.
8284
8285 2020-09-26  David Malcolm  <dmalcolm@redhat.com>
8286
8287         PR analyzer/96646
8288         PR analyzer/96841
8289         * region-model.cc (region_model::get_representative_path_var):
8290         When handling offset_region, wrap the MEM_REF's first argument in
8291         an ADDR_EXPR of pointer type, rather than simply using the tree
8292         for the parent region.  Require the MEM_REF's second argument to
8293         be an integer constant.
8294
8295 2020-09-24  David Malcolm  <dmalcolm@redhat.com>
8296
8297         * analyzer.h (struct rejected_constraint): New decl.
8298         * analyzer.opt (fanalyzer-feasibility): New option.
8299         * diagnostic-manager.cc (path_builder::path_builder): Add
8300         "problem" param and use it to initialize new field.
8301         (path_builder::get_feasibility_problem): New accessor.
8302         (path_builder::m_feasibility_problem): New field.
8303         (dedupe_winners::add): Remove inversion of logic in "if" clause,
8304         swapping if/else suites.  In the !feasible_p suite, inspect
8305         flag_analyzer_feasibility and add code to handle when this
8306         is off, accepting the infeasible path, but recording the
8307         feasibility_problem.
8308         (diagnostic_manager::emit_saved_diagnostic): Pass the
8309         feasibility_problem to the path_builder.
8310         (diagnostic_manager::add_events_for_eedge): If we have
8311         a feasibility_problem at this edge, use it to add a custom event.
8312         * engine.cc (exploded_path::feasible_p): Pass a
8313         rejected_constraint ** to model.maybe_update_for_edge and transfer
8314         ownership of any created instance to any feasibility_problem.
8315         (feasibility_problem::dump_to_pp): New.
8316         * exploded-graph.h (feasibility_problem::feasibility_problem):
8317         Drop "model" param; add rejected_constraint * param.
8318         (feasibility_problem::~feasibility_problem): New.
8319         (feasibility_problem::dump_to_pp): New decl.
8320         (feasibility_problem::m_model): Drop field.
8321         (feasibility_problem::m_rc): New field.
8322         * program-point.cc (function_point::get_location): Handle
8323         PK_BEFORE_SUPERNODE and PK_AFTER_SUPERNODE.
8324         * program-state.cc (program_state::on_edge): Pass NULL to new
8325         param of region_model::maybe_update_for_edge.
8326         * region-model.cc (region_model::add_constraint): New overload
8327         adding a rejected_constraint ** param.
8328         (region_model::maybe_update_for_edge): Add rejected_constraint **
8329         param and pass it to the various apply_constraints_for_ calls.
8330         (region_model::apply_constraints_for_gcond): Add
8331         rejected_constraint ** param and pass it to add_constraint calls.
8332         (region_model::apply_constraints_for_gswitch): Likewise.
8333         (region_model::apply_constraints_for_exception): Likewise.
8334         (rejected_constraint::dump_to_pp): New.
8335         * region-model.h (region_model::maybe_update_for_edge):
8336         Add rejected_constraint ** param.
8337         (region_model::add_constraint): New overload adding a
8338         rejected_constraint ** param.
8339         (region_model::apply_constraints_for_gcond): Add
8340         rejected_constraint ** param.
8341         (region_model::apply_constraints_for_gswitch): Likewise.
8342         (region_model::apply_constraints_for_exception): Likewise.
8343         (struct rejected_constraint): New.
8344
8345 2020-09-23  David Malcolm  <dmalcolm@redhat.com>
8346
8347         PR analyzer/97178
8348         * engine.cc (impl_run_checkers): Update for change to ext_state
8349         ctor.
8350         * program-state.cc (selftest::test_sm_state_map): Pass an engine
8351         instance to ext_state ctor.
8352         (selftest::test_program_state_1): Likewise.
8353         (selftest::test_program_state_2): Likewise.
8354         (selftest::test_program_state_merging): Likewise.
8355         (selftest::test_program_state_merging_2): Likewise.
8356         * program-state.h (extrinsic_state::extrinsic_state): Remove NULL
8357         default value for "eng" param.
8358
8359 2020-09-23  Tobias Burnus  <tobias@codesourcery.com>
8360
8361         * analyzer-logging.cc: Guard '#pragma ... ignored "-Wformat-diag"'
8362         by '#if __GNUC__ >= 10'
8363         * analyzer.h: Likewise.
8364         * call-string.cc: Likewise.
8365
8366 2020-09-23  David Malcolm  <dmalcolm@redhat.com>
8367
8368         * engine.cc (exploded_node::on_stmt): Replace sequence of dyn_cast
8369         with switch.
8370
8371 2020-09-22  David Malcolm  <dmalcolm@redhat.com>
8372
8373         * analysis-plan.cc: Include "json.h".
8374         * analyzer.opt (fdump-analyzer-json): New.
8375         * call-string.cc: Include "json.h".
8376         (call_string::to_json): New.
8377         * call-string.h (call_string::to_json): New decl.
8378         * checker-path.cc: Include "json.h".
8379         * constraint-manager.cc: Include "json.h".
8380         (equiv_class::to_json): New.
8381         (constraint::to_json): New.
8382         (constraint_manager::to_json): New.
8383         * constraint-manager.h (equiv_class::to_json): New decl.
8384         (constraint::to_json): New decl.
8385         (constraint_manager::to_json): New decl.
8386         * diagnostic-manager.cc: Include "json.h".
8387         (saved_diagnostic::to_json): New.
8388         (diagnostic_manager::to_json): New.
8389         * diagnostic-manager.h (saved_diagnostic::to_json): New decl.
8390         (diagnostic_manager::to_json): New decl.
8391         * engine.cc: Include "json.h", <zlib.h>.
8392         (exploded_node::status_to_str): New.
8393         (exploded_node::to_json): New.
8394         (exploded_edge::to_json): New.
8395         (exploded_graph::to_json): New.
8396         (dump_analyzer_json): New.
8397         (impl_run_checkers): Call it.
8398         * exploded-graph.h (exploded_node::status_to_str): New decl.
8399         (exploded_node::to_json): New.
8400         (exploded_edge::to_json): New.
8401         (exploded_graph::to_json): New.
8402         * pending-diagnostic.cc: Include "json.h".
8403         * program-point.cc: Include "json.h".
8404         (program_point::to_json): New.
8405         * program-point.h (program_point::to_json): New decl.
8406         * program-state.cc: Include "json.h".
8407         (extrinsic_state::to_json): New.
8408         (sm_state_map::to_json): New.
8409         (program_state::to_json): New.
8410         * program-state.h (extrinsic_state::to_json): New decl.
8411         (sm_state_map::to_json): New decl.
8412         (program_state::to_json): New decl.
8413         * region-model-impl-calls.cc: Include "json.h".
8414         * region-model-manager.cc: Include "json.h".
8415         * region-model-reachability.cc: Include "json.h".
8416         * region-model.cc: Include "json.h".
8417         * region-model.h (svalue::to_json): New decl.
8418         (region::to_json): New decl.
8419         * region.cc: Include "json.h".
8420         (region::to_json: New.
8421         * sm-file.cc: Include "json.h".
8422         * sm-malloc.cc: Include "json.h".
8423         * sm-pattern-test.cc: Include "json.h".
8424         * sm-sensitive.cc: Include "json.h".
8425         * sm-signal.cc: Include "json.h".
8426         (signal_delivery_edge_info_t::to_json): New.
8427         * sm-taint.cc: Include "json.h".
8428         * sm.cc: Include "diagnostic.h", "tree-diagnostic.h", and
8429         "json.h".
8430         (state_machine::state::to_json): New.
8431         (state_machine::to_json): New.
8432         * sm.h (state_machine::state::to_json): New.
8433         (state_machine::to_json): New.
8434         * state-purge.cc: Include "json.h".
8435         * store.cc: Include "json.h".
8436         (binding_key::get_desc): New.
8437         (binding_map::to_json): New.
8438         (binding_cluster::to_json): New.
8439         (store::to_json): New.
8440         * store.h (binding_key::get_desc): New decl.
8441         (binding_map::to_json): New decl.
8442         (binding_cluster::to_json): New decl.
8443         (store::to_json): New decl.
8444         * supergraph.cc: Include "json.h".
8445         (supergraph::to_json): New.
8446         (supernode::to_json): New.
8447         (superedge::to_json): New.
8448         * supergraph.h (supergraph::to_json): New decl.
8449         (supernode::to_json): New decl.
8450         (superedge::to_json): New decl.
8451         * svalue.cc: Include "json.h".
8452         (svalue::to_json): New.
8453
8454 2020-09-21  David Malcolm  <dmalcolm@redhat.com>
8455
8456         PR analyzer/97130
8457         * region-model-impl-calls.cc (call_details::get_arg_type): New.
8458         * region-model.cc (region_model::on_call_pre): Check that the
8459         initial arg is a pointer before calling impl_call_memset and
8460         impl_call_strlen.
8461         * region-model.h (call_details::get_arg_type): New decl.
8462
8463 2020-09-21  David Malcolm  <dmalcolm@redhat.com>
8464
8465         PR analyzer/93355
8466         * sm-malloc.cc (malloc_state_machine::get_default_state): Look at
8467         the base region when considering pointers.  Treat pointers to
8468         decls as being non-heap.
8469
8470 2020-09-18  David Malcolm  <dmalcolm@redhat.com>
8471
8472         * checker-path.cc (warning_event::get_desc): Handle global state
8473         changes.
8474
8475 2020-09-18  David Malcolm  <dmalcolm@redhat.com>
8476
8477         * sm-malloc.cc (malloc_state_machine::on_stmt): Handle strdup and
8478         strndup as being malloc-like allocators.
8479
8480 2020-09-16  David Malcolm  <dmalcolm@redhat.com>
8481
8482         * engine.cc (strongly_connected_components::strong_connect): Only
8483         consider intraprocedural edges when creating SCCs.
8484         (worklist::key_t::cmp): Add comment.  Treat call_string
8485         differences as more important than differences of program_point
8486         within a supernode.
8487
8488 2020-09-16  David Malcolm  <dmalcolm@redhat.com>
8489
8490         * engine.cc (supernode_cluster::dump_dot): Show the SCC id
8491         in the per-supernode clusters in FILENAME.eg.dot output.
8492         (exploded_graph_annotator::add_node_annotations):
8493         Show the SCC of the supernode in FILENAME.supernode.eg.dot output.
8494         * exploded-graph.h (worklist::scc_id): New.
8495         (exploded_graph::get_scc_id): New.
8496
8497 2020-09-16  David Malcolm  <dmalcolm@redhat.com>
8498
8499         * engine.cc (exploded_node::dump_dot): Show STATUS_BULK_MERGED.
8500         (exploded_graph::process_worklist): Call
8501         maybe_process_run_of_before_supernode_enodes.
8502         (exploded_graph::maybe_process_run_of_before_supernode_enodes):
8503         New.
8504         (exploded_graph_annotator::print_enode): Show STATUS_BULK_MERGED.
8505         * exploded-graph.h (enum exploded_node::status): Add
8506         STATUS_BULK_MERGED.
8507
8508 2020-09-16  David Malcolm  <dmalcolm@redhat.com>
8509
8510         * engine.cc
8511         (exploded_graph::process_node) <case PK_BEFORE_SUPERNODE>:
8512         Simplify by using program_point::get_next.
8513         * program-point.cc (program_point::get_next): New.
8514         * program-point.h (program_point::get_next): New decl.
8515
8516 2020-09-16  David Malcolm  <dmalcolm@redhat.com>
8517
8518         * engine.cc (exploded_graph::get_or_create_node): Show the
8519         program point when issuing -Wanalyzer-too-complex due to hitting
8520         the per-program-point limit.
8521
8522 2020-09-16  David Malcolm  <dmalcolm@redhat.com>
8523
8524         * region-model.cc (region_model::on_call_pre): Treat getchar as
8525         having no side-effects.
8526
8527 2020-09-15  David Malcolm  <dmalcolm@redhat.com>
8528
8529         PR analyzer/96650
8530         * constraint-manager.cc (merger_fact_visitor::on_fact): Replace
8531         assertion that add_constraint succeeded with an assertion that
8532         if it fails, -fanalyzer-transitivity is off.
8533
8534 2020-09-14  David Malcolm  <dmalcolm@redhat.com>
8535
8536         * analyzer.opt (-param=analyzer-max-constraints=): New param.
8537         * constraint-manager.cc
8538         (constraint_manager::add_constraint_internal): Silently reject
8539         attempts to add constraints when the above limit is reached.
8540
8541 2020-09-14  David Malcolm  <dmalcolm@redhat.com>
8542
8543         PR analyzer/96653
8544         * constraint-manager.cc
8545         (constraint_manager::get_or_add_equiv_class): Don't accumulate
8546         transitive closure of all constraints on constants.
8547
8548 2020-09-14  David Malcolm  <dmalcolm@redhat.com>
8549
8550         PR analyzer/97029
8551         * analyzer.cc (is_setjmp_call_p): Require the initial arg to be a
8552         pointer.
8553         * region-model.cc (region_model::deref_rvalue): Assert that the
8554         svalue is of pointer type.
8555
8556 2020-09-11  David Malcolm  <dmalcolm@redhat.com>
8557
8558         PR analyzer/96798
8559         * region-model-impl-calls.cc (region_model::impl_call_memcpy):
8560         New.
8561         (region_model::impl_call_strcpy): New.
8562         * region-model.cc (region_model::on_call_pre): Flag unhandled
8563         builtins that are non-pure as having unknown side-effects.
8564         Implement BUILT_IN_MEMCPY, BUILT_IN_MEMCPY_CHK, BUILT_IN_STRCPY,
8565         BUILT_IN_STRCPY_CHK, BUILT_IN_FPRINTF, BUILT_IN_FPRINTF_UNLOCKED,
8566         BUILT_IN_PUTC, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_FPUTC,
8567         BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
8568         BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
8569         BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTCHAR,
8570         BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTS, BUILT_IN_PUTS_UNLOCKED,
8571         BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF.
8572         * region-model.h (region_model::impl_call_memcpy): New decl.
8573         (region_model::impl_call_strcpy): New decl.
8574
8575 2020-09-09  David Malcolm  <dmalcolm@redhat.com>
8576
8577         PR analyzer/94355
8578         * analyzer.opt (Wanalyzer-mismatching-deallocation): New warning.
8579         * region-model-impl-calls.cc
8580         (region_model::impl_call_operator_new): New.
8581         (region_model::impl_call_operator_delete): New.
8582         * region-model.cc (region_model::on_call_pre): Detect operator new
8583         and operator delete.
8584         (region_model::on_call_post): Likewise.
8585         (region_model::maybe_update_for_edge): Detect EH edges and call...
8586         (region_model::apply_constraints_for_exception): New function.
8587         * region-model.h (region_model::impl_call_operator_new): New decl.
8588         (region_model::impl_call_operator_delete): New decl.
8589         (region_model::apply_constraints_for_exception): New decl.
8590         * sm-malloc.cc (enum resource_state): New.
8591         (struct allocation_state): New state subclass.
8592         (enum wording): New.
8593         (struct api): New.
8594         (malloc_state_machine::custom_data_t): New typedef.
8595         (malloc_state_machine::add_state): New decl.
8596         (malloc_state_machine::m_unchecked)
8597         (malloc_state_machine::m_nonnull)
8598         (malloc_state_machine::m_freed): Delete these states in favor
8599         of...
8600         (malloc_state_machine::m_malloc)
8601         (malloc_state_machine::m_scalar_new)
8602         (malloc_state_machine::m_vector_new): ...this new api instances,
8603         which own their own versions of these states.
8604         (malloc_state_machine::on_allocator_call): New decl.
8605         (malloc_state_machine::on_deallocator_call): New decl.
8606         (api::api): New ctor.
8607         (dyn_cast_allocation_state): New.
8608         (as_a_allocation_state): New.
8609         (get_rs): New.
8610         (unchecked_p): New.
8611         (nonnull_p): New.
8612         (freed_p): New.
8613         (malloc_diagnostic::describe_state_change): Use unchecked_p and
8614         nonnull_p.
8615         (class mismatching_deallocation): New.
8616         (double_free::double_free): Add funcname param for initializing
8617         m_funcname.
8618         (double_free::emit): Use m_funcname in warning message rather
8619         than hardcoding "free".
8620         (double_free::describe_state_change): Likewise.  Use freed_p.
8621         (double_free::describe_call_with_state): Use freed_p.
8622         (double_free::describe_final_event): Use m_funcname in message
8623         rather than hardcoding "free".
8624         (double_free::m_funcname): New field.
8625         (possible_null::describe_state_change): Use unchecked_p.
8626         (possible_null::describe_return_of_state): Likewise.
8627         (use_after_free::use_after_free): Add param for initializing m_api.
8628         (use_after_free::emit): Use m_api->m_dealloc_funcname in message
8629         rather than hardcoding "free".
8630         (use_after_free::describe_state_change): Use freed_p.  Change the
8631         wording of the message based on the API.
8632         (use_after_free::describe_final_event): Use
8633         m_api->m_dealloc_funcname in message rather than hardcoding
8634         "free".  Change the wording of the message based on the API.
8635         (use_after_free::m_api): New field.
8636         (malloc_leak::describe_state_change): Use unchecked_p.  Update
8637         for renaming of m_malloc_event to m_alloc_event.
8638         (malloc_leak::describe_final_event): Update for renaming of
8639         m_malloc_event to m_alloc_event.
8640         (malloc_leak::m_malloc_event): Rename...
8641         (malloc_leak::m_alloc_event): ...to this.
8642         (free_of_non_heap::free_of_non_heap): Add param for initializing
8643         m_funcname.
8644         (free_of_non_heap::emit): Use m_funcname in message rather than
8645         hardcoding "free".
8646         (free_of_non_heap::describe_final_event): Likewise.
8647         (free_of_non_heap::m_funcname): New field.
8648         (allocation_state::dump_to_pp): New.
8649         (allocation_state::get_nonnull): New.
8650         (malloc_state_machine::malloc_state_machine): Update for changes
8651         to state fields and new api fields.
8652         (malloc_state_machine::add_state): New.
8653         (malloc_state_machine::on_stmt): Move malloc/calloc handling to
8654         on_allocator_call and call it, passing in the API pointer.
8655         Likewise for free, moving it to on_deallocator_call.  Handle calls
8656         to operator new and delete in an analogous way.  Use unchecked_p
8657         when testing for possibly-null-arg and possibly-null-deref, and
8658         transition to the non-null for the correct API.  Remove redundant
8659         node param from call to on_zero_assignment.  Use freed_p for
8660         use-after-free check, and pass in API.
8661         (malloc_state_machine::on_allocator_call): New, based on code in
8662         on_stmt.
8663         (malloc_state_machine::on_deallocator_call): Likewise.
8664         (malloc_state_machine::on_phi): Mark node param with
8665         ATTRIBUTE_UNUSED; don't pass it to on_zero_assignment.
8666         (malloc_state_machine::on_condition): Mark node param with
8667         ATTRIBUTE_UNUSED.  Replace on_transition calls with get_state and
8668         set_next_state pairs, transitioning to the non-null state for the
8669         appropriate API.
8670         (malloc_state_machine::can_purge_p): Port to new state approach.
8671         (malloc_state_machine::on_zero_assignment): Replace on_transition
8672         calls with get_state and set_next_state pairs.  Drop redundant
8673         node param.
8674         * sm.h (state_machine::add_custom_state): New.
8675
8676 2020-09-09  David Malcolm  <dmalcolm@redhat.com>
8677
8678         * diagnostic-manager.cc
8679         (null_assignment_sm_context::warn_for_state): Replace with...
8680         (null_assignment_sm_context::warn): ...this.
8681         * engine.cc (impl_sm_context::warn_for_state): Replace with...
8682         (impl_sm_context::warn): ...this.
8683         * sm-file.cc (fileptr_state_machine::on_stmt): Replace
8684         warn_for_state and on_transition calls with a get_state
8685         test guarding warn and set_next_state calls.
8686         * sm-malloc.cc (malloc_state_machine::on_stmt): Likewise.
8687         * sm-pattern-test.cc (pattern_test_state_machine::on_condition):
8688         Replace warn_for_state call with warn call.
8689         * sm-sensitive.cc
8690         (sensitive_state_machine::warn_for_any_exposure): Replace
8691         warn_for_state call with a get_state test guarding a warn call.
8692         * sm-signal.cc (signal_state_machine::on_stmt): Likewise.
8693         * sm-taint.cc (taint_state_machine::on_stmt):  Replace
8694         warn_for_state and on_transition calls with a get_state
8695         test guarding warn and set_next_state calls.
8696         * sm.h (sm_context::warn_for_state): Replace with...
8697         (sm_context::warn): ...this.
8698
8699 2020-09-09  David Malcolm  <dmalcolm@redhat.com>
8700
8701         * diagnostic-manager.cc
8702         (null_assignment_sm_context::null_assignment_sm_context): Add old_state
8703         and ext_state params, initializing m_old_state and m_ext_state.
8704         (null_assignment_sm_context::on_transition): Split into...
8705         (null_assignment_sm_context::get_state): ...this new vfunc
8706         implementation and...
8707         (null_assignment_sm_context::set_next_state): ...this new vfunc
8708         implementation.
8709         (null_assignment_sm_context::m_old_state): New field.
8710         (null_assignment_sm_context::m_ext_state): New field.
8711         (diagnostic_manager::add_events_for_eedge): Pass in old state and
8712         ext_state when creating sm_ctxt.
8713         * engine.cc (impl_sm_context::on_transition): Split into...
8714         (impl_sm_context::get_state): ...this new vfunc
8715         implementation and...
8716         (impl_sm_context::set_next_state): ...this new vfunc
8717         implementation.
8718         * sm.h (sm_context::get_state): New pure virtual function.
8719         (sm_context::set_next_state): Likewise.
8720         (sm_context::on_transition): Convert from a pure virtual function
8721         to a regular function implemented in terms of get_state and
8722         set_next_state.
8723
8724 2020-09-09  David Malcolm  <dmalcolm@redhat.com>
8725
8726         * checker-path.cc (state_change_event::get_desc): Update
8727         state_machine::get_state_name calls to state::get_name.
8728         (warning_event::get_desc): Likewise.
8729         * diagnostic-manager.cc
8730         (null_assignment_sm_context::on_transition): Update comparison
8731         against 0 with comparison with m_sm.get_start_state.
8732         (diagnostic_manager::prune_for_sm_diagnostic): Update
8733         state_machine::get_state_name calls to state::get_name.
8734         * engine.cc (impl_sm_context::on_transition): Likewise.
8735         (exploded_node::get_dot_fillcolor): Use get_id when summing
8736         the sm states.
8737         * program-state.cc (sm_state_map::sm_state_map): Don't hardcode
8738         0 as the start state when initializing m_global_state.
8739         (sm_state_map::print): Use dump_to_pp rather than get_state_name
8740         when dumping states.
8741         (sm_state_map::is_empty_p): Don't hardcode 0 as the start state
8742         when examining m_global_state.
8743         (sm_state_map::hash): Use get_id when hashing states.
8744         (selftest::test_sm_state_map): Use state objects rather than
8745         arbitrary hardcoded integers.
8746         (selftest::test_program_state_merging): Likewise.
8747         (selftest::test_program_state_merging_2): Likewise.
8748         * sm-file.cc (fileptr_state_machine::m_start): Move to base class.
8749         (file_diagnostic::describe_state_change): Use get_start_state.
8750         (fileptr_state_machine::fileptr_state_machine): Drop m_start
8751         initialization.
8752         * sm-malloc.cc (malloc_state_machine::m_start): Move to base
8753         class.
8754         (malloc_diagnostic::describe_state_change): Use get_start_state.
8755         (possible_null::describe_state_change): Likewise.
8756         (malloc_state_machine::malloc_state_machine): Drop m_start
8757         initialization.
8758         * sm-pattern-test.cc (pattern_test_state_machine::m_start): Move
8759         to base class.
8760         (pattern_test_state_machine::pattern_test_state_machine): Drop
8761         m_start initialization.
8762         * sm-sensitive.cc (sensitive_state_machine::m_start): Move to base
8763         class.
8764         (sensitive_state_machine::sensitive_state_machine): Drop m_start
8765         initialization.
8766         * sm-signal.cc (signal_state_machine::m_start): Move to base
8767         class.
8768         (signal_state_machine::signal_state_machine): Drop m_start
8769         initialization.
8770         * sm-taint.cc (taint_state_machine::m_start): Move to base class.
8771         (taint_state_machine::taint_state_machine): Drop m_start
8772         initialization.
8773         * sm.cc (state_machine::state::dump_to_pp): New.
8774         (state_machine::state_machine): Move here from sm.h.  Initialize
8775         m_next_state_id and m_start.
8776         (state_machine::add_state): Reimplement in terms of state objects.
8777         (state_machine::get_state_name): Delete.
8778         (state_machine::get_state_by_name): Reimplement in terms of state
8779         objects.  Make const.
8780         (state_machine::validate): Delete.
8781         (state_machine::dump_to_pp): Reimplement in terms of state
8782         objects.
8783         * sm.h (state_machine::state): New class.
8784         (state_machine::state_t): Convert typedef from "unsigned" to
8785         "const state_machine::state *".
8786         (state_machine::state_machine): Move to sm.cc.
8787         (state_machine::get_default_state): Use m_start rather than
8788         hardcoding 0.
8789         (state_machine::get_state_name): Delete.
8790         (state_machine::get_state_by_name): Make const.
8791         (state_machine::get_start_state): New accessor.
8792         (state_machine::alloc_state_id): New.
8793         (state_machine::m_state_names): Drop in favor of...
8794         (state_machine::m_states): New field
8795         (state_machine::m_start): New field
8796         (start_start_p): Delete.
8797
8798 2020-09-08  David Malcolm  <dmalcolm@redhat.com>
8799
8800         PR analyzer/96949
8801         * store.cc (binding_map::apply_ctor_val_to_range): Add
8802         error-handling for the cases where we have symbolic offsets.
8803
8804 2020-09-08  David Malcolm  <dmalcolm@redhat.com>
8805
8806         PR analyzer/96950
8807         * store.cc (binding_map::apply_ctor_to_region): Handle RANGE_EXPR
8808         where min_index == max_index.
8809         (binding_map::apply_ctor_val_to_range): Replace assertion that we
8810         don't have a CONSTRUCTOR value with error-handling.
8811
8812 2020-09-08  David Malcolm  <dmalcolm@redhat.com>
8813
8814         PR analyzer/96962
8815         * region-model.cc (region_model::on_call_pre): Fix guard on switch
8816         on built-ins to only consider BUILT_IN_NORMAL, rather than other
8817         kinds of build-ins.
8818
8819 2020-09-01  David Malcolm  <dmalcolm@redhat.com>
8820
8821         PR analyzer/96792
8822         * region-model.cc (region_model::deref_rvalue): Add the constraint
8823         that PTR_SVAL is non-NULL.
8824
8825 2020-08-31  David Malcolm  <dmalcolm@redhat.com>
8826
8827         PR analyzer/96798
8828         * region-model.cc (region_model::on_call_pre): Handle
8829         BUILT_IN_MEMSET_CHK.
8830
8831 2020-08-31  David Malcolm  <dmalcolm@redhat.com>
8832
8833         * region-model.cc (region_model::on_call_pre): Gather handling of
8834         builtins and of internal fns into switch statements.  Handle
8835         "alloca" and BUILT_IN_ALLOCA_WITH_ALIGN.
8836
8837 2020-08-31  David Malcolm  <dmalcolm@redhat.com>
8838
8839         PR analyzer/96860
8840         * region.cc (decl_region::get_svalue_for_constructor): Support
8841         apply_ctor_to_region failing.
8842         * store.cc (binding_map::apply_ctor_to_region): Add failure
8843         handling.
8844         (binding_map::apply_ctor_val_to_range): Likewise.
8845         (binding_map::apply_ctor_pair_to_child_region): Likewise.  Replace
8846         assertion that child_base_offset is not symbolic with error
8847         handling.
8848         * store.h (binding_map::apply_ctor_to_region): Convert return type
8849         from void to bool.
8850         (binding_map::apply_ctor_val_to_range): Likewise.
8851         (binding_map::apply_ctor_pair_to_child_region): Likewise.
8852
8853 2020-08-31  David Malcolm  <dmalcolm@redhat.com>
8854
8855         PR analyzer/96763
8856         * store.cc (binding_map::apply_ctor_to_region): Handle RANGE_EXPR
8857         by calling a new binding_map::apply_ctor_val_to_range subroutine.
8858         Split out the existing non-CONSTRUCTOR-handling code to a new
8859         apply_ctor_pair_to_child_region subroutine.
8860         (binding_map::apply_ctor_val_to_range): New.
8861         (binding_map::apply_ctor_pair_to_child_region): New, split out
8862         from binding_map::apply_ctor_to_region as noted above.
8863         * store.h (binding_map::apply_ctor_val_to_range): New decl.
8864         (binding_map::apply_ctor_pair_to_child_region): New decl.
8865
8866 2020-08-31  David Malcolm  <dmalcolm@redhat.com>
8867
8868         PR analyzer/96764
8869         * region-model-manager.cc
8870         (region_model_manager::maybe_fold_unaryop): Handle VIEW_CONVERT_EXPR.
8871         (region_model_manager::get_or_create_cast): Move logic for
8872         real->integer casting to...
8873         (get_code_for_cast): ...this new function, and add logic for
8874         real->non-integer casts.
8875         (region_model_manager::maybe_fold_sub_svalue): Handle
8876         VIEW_CONVERT_EXPR.
8877         * region-model.cc
8878         (region_model::add_any_constraints_from_gassign): Likewise.
8879         * svalue.cc (svalue::maybe_undo_cast): Likewise.
8880         (unaryop_svalue::dump_to_pp): Likewise.
8881
8882 2020-08-26  David Malcolm  <dmalcolm@redhat.com>
8883
8884         PR analyzer/94858
8885         * region-model-manager.cc
8886         (region_model_manager::get_or_create_widening_svalue): Assert that
8887         neither of the inputs are themselves widenings.
8888         * store.cc (store::eval_alias_1): The initial value of a pointer
8889         can't point to a region that was allocated on the heap after the
8890         beginning of the path.  A widened pointer value can't alias anything
8891         that the initial pointer value can't alias.
8892         * svalue.cc (svalue::can_merge_p): Merge BINOP (X, OP, CST) with X
8893         to a widening svalue.  Merge
8894         BINOP(WIDENING(BASE, BINOP(BASE, X)), X) and BINOP(BASE, X) to
8895         to the LHS of the first BINOP.
8896
8897 2020-08-26  David Malcolm  <dmalcolm@redhat.com>
8898
8899         PR analyzer/96777
8900         * region-model.h (class compound_svalue): Document that all keys
8901         must be concrete.
8902         (compound_svalue::compound_svalue): Move definition to svalue.cc.
8903         * store.cc (binding_map::apply_ctor_to_region): Handle
8904         initializers for trailing arrays with incomplete size.
8905         * svalue.cc (compound_svalue::compound_svalue): Move definition
8906         here from region-model.h.  Add assertion that all keys are
8907         concrete.
8908
8909 2020-08-22  David Malcolm  <dmalcolm@redhat.com>
8910
8911         PR analyzer/94851
8912         * region-model-manager.cc
8913         (region_model_manager::maybe_fold_binop): Fold bitwise "& 0" to 0.
8914
8915 2020-08-22  David Malcolm  <dmalcolm@redhat.com>
8916
8917         * store.cc (store::eval_alias): Make const.  Split out 2nd half
8918         into store::eval_alias_1 and call it twice for symmetry, avoiding
8919         test duplication.
8920         (store::eval_alias_1): New function, split out from the above.
8921         * store.h (store::eval_alias): Make const.
8922         (store::eval_alias_1): New decl.
8923
8924 2020-08-22  David Malcolm  <dmalcolm@redhat.com>
8925
8926         * region-model.cc (region_model::push_frame): Bind the default
8927         SSA name for each parm if it exists, falling back to the parm
8928         itself otherwise, rather than doing both.
8929
8930 2020-08-20  David Malcolm  <dmalcolm@redhat.com>
8931
8932         PR analyzer/96723
8933         * region-model-manager.cc
8934         (region_model_manager::get_field_region): Assert that field is a
8935         FIELD_DECL.
8936         * region.cc (region::get_subregions_for_binding): In
8937         union-handling, filter the TYPE_FIELDS traversal to just FIELD_DECLs.
8938
8939 2020-08-20  David Malcolm  <dmalcolm@redhat.com>
8940
8941         PR analyzer/96713
8942         * region-model.cc (region_model::get_gassign_result): For
8943         comparisons, only use eval_condition when the lhs has boolean
8944         type, and use get_or_create_constant_svalue on the boolean
8945         constants directly rather than via get_rvalue.
8946
8947 2020-08-19  David Malcolm  <dmalcolm@redhat.com>
8948
8949         PR analyzer/96643
8950         * region-model.cc (region_model::deref_rvalue): Rather than
8951         attempting to handle all svalue kinds in the switch, only cover
8952         the special cases, and move symbolic-region handling to after
8953         the switch, thus implicitly handling the missing case SK_COMPOUND.
8954
8955 2020-08-19  David Malcolm  <dmalcolm@redhat.com>
8956
8957         PR analyzer/96705
8958         * region-model-manager.cc
8959         (region_model_manager::maybe_fold_binop): Check that we have an
8960         integral type before calling build_int_cst.
8961
8962 2020-08-19  David Malcolm  <dmalcolm@redhat.com>
8963
8964         PR analyzer/96699
8965         * region-model-manager.cc
8966         (region_model_manager::get_or_create_cast): Use FIX_TRUNC_EXPR for
8967         casting from REAL_TYPE to INTEGER_TYPE.
8968
8969 2020-08-19  David Malcolm  <dmalcolm@redhat.com>
8970
8971         PR analyzer/96651
8972         * region-model.cc (region_model::called_from_main_p): New.
8973         (region_model::get_store_value): Move handling for globals into...
8974         (region_model::get_initial_value_for_global): ...this new
8975         function, and add logic for extracting values from decl
8976         initializers.
8977         * region-model.h (decl_region::get_svalue_for_constructor): New
8978         decl.
8979         (decl_region::get_svalue_for_initializer): New decl.
8980         (region_model::called_from_main_p): New decl.
8981         (region_model::get_initial_value_for_global): New.
8982         * region.cc (decl_region::maybe_get_constant_value): Move logic
8983         for getting an svalue from a CONSTRUCTOR node to...
8984         (decl_region::get_svalue_for_constructor): ...this new function.
8985         (decl_region::get_svalue_for_initializer): New.
8986         * store.cc (get_svalue_for_ctor_val): Rewrite in terms of
8987         region_model::get_rvalue.
8988         * store.h (binding_cluster::get_map): New accessor.
8989
8990 2020-08-19  David Malcolm  <dmalcolm@redhat.com>
8991
8992         PR analyzer/96648
8993         * region.cc (get_field_at_bit_offset): Gracefully handle negative
8994         values for bit_offset.
8995
8996 2020-08-18  David Malcolm  <dmalcolm@redhat.com>
8997
8998         * region-model.cc (region_model::get_rvalue_1): Fix name of local.
8999
9000 2020-08-18  David Malcolm  <dmalcolm@redhat.com>
9001
9002         PR analyzer/96641
9003         * region-model.cc (region_model::get_rvalue_1): Handle
9004         unrecognized tree codes by returning "UNKNOWN.
9005
9006 2020-08-18  David Malcolm  <dmalcolm@redhat.com>
9007
9008         PR analyzer/96640
9009         * region-model.cc (region_model::get_gassign_result): Handle various
9010         VEC_* tree codes by returning UNKNOWN.
9011         (region_model::on_assignment): Handle unrecognized tree codes by
9012         setting lhs to an unknown value, rather than issuing a "sorry" and
9013         asserting.
9014
9015 2020-08-17  David Malcolm  <dmalcolm@redhat.com>
9016
9017         PR analyzer/96644
9018         * region-model-manager.cc (get_region_for_unexpected_tree_code):
9019         Handle ctxt being NULL.
9020
9021 2020-08-17  David Malcolm  <dmalcolm@redhat.com>
9022
9023         PR analyzer/96639
9024         * region.cc (region::get_subregions_for_binding): Check for "type"
9025         being NULL.
9026
9027 2020-08-17  David Malcolm  <dmalcolm@redhat.com>
9028
9029         PR analyzer/96642
9030         * store.cc (get_svalue_for_ctor_val): New.
9031         (binding_map::apply_ctor_to_region): Call it.
9032
9033 2020-08-14  David Malcolm  <dmalcolm@redhat.com>
9034
9035         PR testsuite/96609
9036         PR analyzer/96616
9037         * region-model.cc (region_model::get_store_value): Call
9038         maybe_get_constant_value on decl_regions first.
9039         * region-model.h (decl_region::maybe_get_constant_value): New decl.
9040         * region.cc (decl_region::get_stack_depth): Likewise.
9041         (decl_region::maybe_get_constant_value): New.
9042         * store.cc (get_subregion_within_ctor): New.
9043         (binding_map::apply_ctor_to_region): New.
9044         * store.h (binding_map::apply_ctor_to_region): New decl.
9045
9046 2020-08-14  David Malcolm  <dmalcolm@redhat.com>
9047
9048         PR analyzer/96611
9049         * store.cc (store::mark_as_escaped): Reject attempts to
9050         get a cluster for an unknown pointer.
9051
9052 2020-08-13  David Malcolm  <dmalcolm@redhat.com>
9053
9054         PR analyzer/93032
9055         PR analyzer/93938
9056         PR analyzer/94011
9057         PR analyzer/94099
9058         PR analyzer/94399
9059         PR analyzer/94458
9060         PR analyzer/94503
9061         PR analyzer/94640
9062         PR analyzer/94688
9063         PR analyzer/94689
9064         PR analyzer/94839
9065         PR analyzer/95026
9066         PR analyzer/95042
9067         PR analyzer/95240
9068         * analyzer-logging.cc: Ignore "-Wformat-diag".
9069         (logger::enter_scope): Use inc_indent in both overloads.
9070         (logger::exit_scope): Use dec_indent.
9071         * analyzer-logging.h (logger::inc_indent): New.
9072         (logger::dec_indent): New.
9073         * analyzer-selftests.cc (run_analyzer_selftests): Call
9074         analyzer_store_cc_tests.
9075         * analyzer-selftests.h (analyzer_store_cc_tests): New decl.
9076         * analyzer.cc (get_stmt_location): New function.
9077         * analyzer.h (class initial_svalue): New forward decl.
9078         (class unaryop_svalue): New forward decl.
9079         (class binop_svalue): New forward decl.
9080         (class sub_svalue): New forward decl.
9081         (class unmergeable_svalue): New forward decl.
9082         (class placeholder_svalue): New forward decl.
9083         (class widening_svalue): New forward decl.
9084         (class compound_svalue): New forward decl.
9085         (class conjured_svalue): New forward decl.
9086         (svalue_set): New typedef.
9087         (class map_region): Delete.
9088         (class array_region): Delete.
9089         (class frame_region): New forward decl.
9090         (class function_region): New forward decl.
9091         (class label_region): New forward decl.
9092         (class decl_region): New forward decl.
9093         (class element_region): New forward decl.
9094         (class offset_region): New forward decl.
9095         (class cast_region): New forward decl.
9096         (class field_region): New forward decl.
9097         (class string_region): New forward decl.
9098         (class region_model_manager): New forward decl.
9099         (class store_manager): New forward decl.
9100         (class store): New forward decl.
9101         (class call_details): New forward decl.
9102         (struct svalue_id_merger_mapping): Delete.
9103         (struct canonicalization): Delete.
9104         (class function_point): New forward decl.
9105         (class engine): New forward decl.
9106         (dump_tree): New function decl.
9107         (print_quoted_type): New function decl.
9108         (readability_comparator): New function decl.
9109         (tree_cmp): New function decl.
9110         (class path_var): Move here from region-model.h
9111         (bit_offset_t, bit_size_t, byte_size_t): New typedefs.
9112         (class region_offset): New class.
9113         (get_stmt_location): New decl.
9114         (struct member_function_hash_traits): New struct.
9115         (class consolidation_map): New class.
9116         Ignore "-Wformat-diag".
9117         * analyzer.opt (-param=analyzer-max-svalue-depth=): New param.
9118         (-param=analyzer-max-enodes-for-full-dump=): New param.
9119         * call-string.cc: Ignore -Wformat-diag.
9120         * checker-path.cc: Move includes of "analyzer/call-string.h" and
9121         "analyzer/program-point.h" to before "analyzer/region-model.h",
9122         and also include "analyzer/store.h" before it.
9123         (state_change_event::state_change_event): Replace "tree var" param
9124         with "const svalue *sval".  Convert "origin" param from tree to
9125         "const svalue *".
9126         (state_change_event::get_desc): Call get_representative_tree to
9127         convert the var and origin from const svalue * to tree.  Use
9128         svalue::get_desc rather than %qE when describing state changes.
9129         (checker_path::add_final_event): Use get_stmt_location.
9130         * checker-path.h (state_change_event::state_change_event): Port
9131         from tree to const svalue *.
9132         (state_change_event::get_lvalue): Delete.
9133         (state_change_event::get_dest_function): New.
9134         (state_change_event::m_var): Replace with...
9135         (state_change_event::m_sval): ...this.
9136         (state_change_event::m_origin): Convert from tree to
9137         const svalue *.
9138         * constraint-manager.cc: Include "analyzer/call-string.h",
9139         "analyzer/program-point.h", and "analyzer/store.h" before
9140         "analyzer/region-model.h".
9141         (struct bound, struct range): Move to constraint-manager.h.
9142         (compare_constants): New function.
9143         (range::dump): Rename to...
9144         (range::dump_to_pp): ...this.  Support NULL constants.
9145         (range::dump): Reintroduce for dumping to stderr.
9146         (range::constrained_to_single_element): Return result, rather than
9147         writing to *OUT.
9148         (range::eval_condition): New.
9149         (range::below_lower_bound): New.
9150         (range::above_upper_bound): New.
9151         (equiv_class::equiv_class): Port from svalue_id to const svalue *.
9152         (equiv_class::print): Likewise.
9153         (equiv_class::hash): Likewise.
9154         (equiv_class::operator==): Port from svalue_id to const svalue *.
9155         (equiv_class::add): Port from svalue_id to const svalue *. Drop
9156         "cm" param.
9157         (equiv_class::del): Port from svalue_id to const svalue *.
9158         (equiv_class::get_representative): Likewise.
9159         (equiv_class::remap_svalue_ids): Delete.
9160         (svalue_id_cmp_by_id): Rename to...
9161         (svalue_cmp_by_ptr): ...this, porting from svalue_id to
9162         const svalue *.
9163         (equiv_class::canonicalize): Update qsort comparator.
9164         (constraint::implied_by): New.
9165         (constraint_manager::constraint_manager): Copy m_mgr in copy ctor.
9166         (constraint_manager::dump_to_pp): Add "multiline" param
9167         (constraint_manager::dump): Pass "true" for "multiline".
9168         (constraint_manager::add_constraint): Port from svalue_id to
9169         const svalue *.  Split out second part into...
9170         (constraint_manager::add_unknown_constraint): ...this new
9171         function.  Remove self-constraints when merging equivalence
9172         classes.
9173         (constraint_manager::add_constraint_internal): Remove constraints
9174         that would be implied by the new constraint.  Port from svalue_id
9175         to const svalue *.
9176         (constraint_manager::get_equiv_class_by_sid): Rename to...
9177         (constraint_manager::get_equiv_class_by_svalue): ...this, porting
9178         from svalue_id to const svalue *.
9179         (constraint_manager::get_or_add_equiv_class): Port from svalue_id
9180         to const svalue *.
9181         (constraint_manager::eval_condition): Make const.  Call
9182         compare_constants and return early if it provides a known result.
9183         (constraint_manager::get_ec_bounds): New.
9184         (constraint_manager::eval_condition): New overloads.  Make
9185         existing one const, and use compare_constants.
9186         (constraint_manager::purge): Convert "p" param to a template
9187         rather that an abstract base class.  Port from svalue_id to
9188         const svalue *.
9189         (class dead_svalue_purger): New class.
9190         (constraint_manager::remap_svalue_ids): Delete.
9191         (constraint_manager::on_liveness_change): New.
9192         (equiv_class_cmp): Port from svalue_id to const svalue *.
9193         (constraint_manager::canonicalize): Likewise.  Combine with
9194         purging of redundant equivalence classes and constraints.
9195         (class cleaned_constraint_manager): Delete.
9196         (class merger_fact_visitor): Make "m_cm_b" const.  Add "m_merger"
9197         field.
9198         (merger_fact_visitor::fact): Port from svalue_id to const svalue *.
9199         Add special case for widening.
9200         (constraint_manager::merge): Port from svalue_id to const svalue *.
9201         (constraint_manager::clean_merger_input): Delete.
9202         (constraint_manager::for_each_fact): Port from svalue_id to
9203         const svalue *.
9204         (constraint_manager::validate): Likewise.
9205         (selftest::test_constraint_conditions): Provide a
9206         region_model_manager when creating region_model instances.
9207         Add test for self-equality not creating equivalence classes.
9208         (selftest::test_transitivity): Provide a region_model_manager when
9209         creating region_model instances.  Verify that EC-merging happens
9210         when constraints are implied.
9211         (selftest::test_constant_comparisons):  Provide a
9212         region_model_manager when creating region_model instances.
9213         (selftest::test_constraint_impl): Likewise.  Remove over-specified
9214         assertions.
9215         (selftest::test_equality): Provide a region_model_manager when
9216         creating region_model instances.
9217         (selftest::test_many_constants): Likewise.  Provide a
9218         program_point when testing merging.
9219         (selftest::run_constraint_manager_tests): Move call to
9220         test_constant_comparisons to outside the transitivity guard.
9221         * constraint-manager.h (struct bound): Move here from
9222         constraint-manager.cc.
9223         (struct range): Likewise.
9224         (struct::eval_condition): New decl.
9225         (struct::below_lower_bound): New decl.
9226         (struct::above_upper_bound): New decl.
9227         (equiv_class::add): Port from svalue_id to const svalue *.
9228         (equiv_class::del): Likewise.
9229         (equiv_class::get_representative): Likewise.
9230         (equiv_class::remap_svalue_ids): Drop.
9231         (equiv_class::m_cst_sid): Convert to..
9232         (equiv_class::m_cst_sval): ...this.
9233         (equiv_class::m_vars): Port from svalue_id to const svalue *.
9234         (constraint::bool implied_by): New decl.
9235         (fact_visitor::on_fact): Port from svalue_id to const svalue *.
9236         (constraint_manager::constraint_manager): Add mgr param.
9237         (constraint_manager::clone): Delete.
9238         (constraint_manager::maybe_get_constant): Delete.
9239         (constraint_manager::get_sid_for_constant): Delete.
9240         (constraint_manager::get_num_svalues): Delete.
9241         (constraint_manager::dump_to_pp): Add "multiline" param.
9242         (constraint_manager::get_equiv_class): Port from svalue_id to
9243         const svalue *.
9244         (constraint_manager::add_constraint):  Likewise.
9245         (constraint_manager::get_equiv_class_by_sid): Rename to...
9246         (constraint_manager::get_equiv_class_by_svalue): ...this, porting
9247         from svalue_id to const svalue *.
9248         (constraint_manager::add_unknown_constraint): New decl.
9249         (constraint_manager::get_or_add_equiv_class): Port from svalue_id
9250         to const svalue *.
9251         (constraint_manager::eval_condition): Likewise.  Add overloads.
9252         (constraint_manager::get_ec_bounds): New decl.
9253         (constraint_manager::purge): Convert to template.
9254         (constraint_manager::remap_svalue_ids): Delete.
9255         (constraint_manager::on_liveness_change): New decl.
9256         (constraint_manager::canonicalize): Drop param.
9257         (constraint_manager::clean_merger_input): Delete.
9258         (constraint_manager::m_mgr): New field.
9259         * diagnostic-manager.cc: Move includes of
9260         "analyzer/call-string.h" and "analyzer/program-point.h" to before
9261         "analyzer/region-model.h", and also include "analyzer/store.h"
9262         before it.
9263         (saved_diagnostic::saved_diagnostic): Add "sval" param.
9264         (diagnostic_manager::diagnostic_manager): Add engine param.
9265         (diagnostic_manager::add_diagnostic): Add "sval" param, passing it
9266         to saved_diagnostic ctor.  Update overload to pass NULL for it.
9267         (dedupe_winners::dedupe_winners): Add engine param.
9268         (dedupe_winners::add): Add "eg" param.  Pass m_engine to
9269         feasible_p.
9270         (dedupe_winner::m_engine): New field.
9271         (diagnostic_manager::emit_saved_diagnostics): Pass engine to
9272         dedupe_winners.  Pass &eg when adding candidates.  Pass svalue
9273         rather than tree to prune_path.  Use get_stmt_location to get
9274         primary location of diagnostic.
9275         (diagnostic_manager::emit_saved_diagnostic): Likewise.
9276         (get_any_origin): Drop.
9277         (state_change_event_creator::on_global_state_change): Pass NULL
9278         const svalue * rather than NULL_TREE trees to state_change_event
9279         ctor.
9280         (state_change_event_creator::on_state_change): Port from tree and
9281         svalue_id to const svalue *.
9282         (for_each_state_change): Port from svalue_id to const svalue *.
9283         (struct null_assignment_sm_context): New.
9284         (diagnostic_manager::add_events_for_eedge):  Add state change
9285         events for assignment to NULL.
9286         (diagnostic_manager::prune_path): Update param from tree to
9287         const svalue *.
9288         (diagnostic_manager::prune_for_sm_diagnostic): Port from tracking
9289         by tree to by const svalue *.
9290         * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Add sval
9291         param.
9292         (saved_diagnostic::m_sval): New field.
9293         (diagnostic_manager::diagnostic_manager): Add engine param.
9294         (diagnostic_manager::get_engine): New.
9295         (diagnostic_manager::add_diagnostic): Add "sval" param.
9296         (diagnostic_manager::prune_path): Likewise.
9297         (diagnostic_manager::prune_for_sm_diagnostic): New overload.
9298         (diagnostic_manager::m_eng): New field.
9299         * engine.cc: Move includes of "analyzer/call-string.h" and
9300         "analyzer/program-point.h" to before "analyzer/region-model.h",
9301         and also include "analyzer/store.h" before it.
9302         (impl_region_model_context::impl_region_model_context): Update for
9303         removal of m_change field.
9304         (impl_region_model_context::remap_svalue_ids): Delete.
9305         (impl_region_model_context::on_svalue_leak): New.
9306         (impl_region_model_context::on_svalue_purge): Delete.
9307         (impl_region_model_context::on_liveness_change): New.
9308         (impl_region_model_context::on_unknown_change): Update param
9309         from svalue_id to const svalue *.  Add is_mutable param.
9310         (setjmp_svalue::compare_fields): Delete.
9311         (setjmp_svalue::accept): New.
9312         (setjmp_svalue::add_to_hash): Delete.
9313         (setjmp_svalue::dump_to_pp): New.
9314         (setjmp_svalue::print_details): Delete.
9315         (impl_sm_context::impl_sm_context): Drop "change" param.
9316         (impl_sm_context::get_fndecl_for_call): Drop "m_change".
9317         (impl_sm_context::on_transition): Drop ATTRIBUTE_UNUSED from
9318         "stmt" param.  Drop m_change.  Port from svalue_id to
9319         const svalue *.
9320         (impl_sm_context::warn_for_state): Drop m_change.  Port from
9321         svalue_id to const svalue *.
9322         (impl_sm_context::get_readable_tree): Rename to...
9323         (impl_sm_context::get_diagnostic_tree): ...this.  Port from
9324         svalue_id to const svalue *.
9325         (impl_sm_context::is_zero_assignment): New.
9326         (impl_sm_context::m_change): Delete field.
9327         (leak_stmt_finder::find_stmt): Handle m_var being NULL.
9328         (readability):  Increase penalty for MEM_REF.  For SSA_NAMEs,
9329         slightly favor the underlying var over the SSA name.  Heavily
9330         penalize temporaries.  Handle RESULT_DECL.
9331         (readability_comparator): Make non-static.  Consider stack depths.
9332         (impl_region_model_context::on_state_leak): Convert from svalue_id
9333         to const svalue *, updating for region_model changes.  Use
9334         id_equal.
9335         (impl_region_model_context::on_inherited_svalue): Delete.
9336         (impl_region_model_context::on_cast): Delete.
9337         (impl_region_model_context::on_condition):  Drop m_change.
9338         (impl_region_model_context::on_phi): Likewise.
9339         (impl_region_model_context::on_unexpected_tree_code): Handle t
9340         being NULL.
9341         (point_and_state::validate): Update stack checking for
9342         region_model changes.
9343         (eg_traits::dump_args_t::show_enode_details_p): New.
9344         (exploded_node::exploded_node): Initialize m_num_processed_stmts.
9345         (exploded_node::get_processed_stmt): New function.
9346         (exploded_node::get_dot_fillcolor): Add more colors.
9347         (exploded_node::dump_dot): Guard the printing of the point and
9348         state with show_enode_details_p.  Print the processed stmts for
9349         this enode after the initial state.
9350         (exploded_node::dump_to_pp): Pass true for new multiline param
9351         of program_state::dump_to_pp.
9352         (exploded_node::on_stmt): Drop "change" param.  Log the stmt.
9353         Set input_location.  Implement __analyzer_describe.  Update
9354         implementation of __analyzer_dump and __analyzer_eval.
9355         Remove purging of sm-state for unknown fncalls from here.
9356         (exploded_node::on_edge): Drop "change" param.
9357         (exploded_node::on_longjmp): Port from region_id/svalue_id to
9358         const region */const svalue *.  Call program_state::detect_leaks.
9359         Drop state_change.
9360         (exploded_node::detect_leaks): Update for changes to region_model.
9361         Call program_state::detect_leaks.
9362         (exploded_edge::exploded_edge): Drop ext_state and change params.
9363         (exploded_edge::dump_dot): "args" is no longer used.  Drop dumping
9364         of m_change.
9365         (exploded_graph::exploded_graph): Pass engine to
9366         m_diagnostic_manager ctor.  Use program_point::origin.
9367         (exploded_graph::add_function_entry):  Drop ctxt.  Use
9368         program_state::push_frame.  Drop state_change.
9369         (exploded_graph::get_or_create_node): Drop "change" param.  Add
9370         "enode_for_diag" param.  Update dumping calls for API changes.
9371         Pass point to can_merge_with_p.  Show enode indices
9372         within -Wanalyzer-too-complex diagnostic for hitting the per-point
9373         limit.
9374         (exploded_graph::add_edge): Drop "change" param.  Log which nodes
9375         are being connected.  Update for changes to exploded_edge ctor.
9376         (exploded_graph::get_per_program_point_data): New.
9377         (exploded_graph::process_worklist): Pass point to
9378         can_merge_with_p.  Drop state_change.  Update dumping call for API
9379         change.
9380         (exploded_graph::process_node):  Drop state_change.  Split the
9381         node in-place if an sm-state-change occurs.  Update
9382         m_num_processed_stmts.  Update dumping calls for API change.
9383         (exploded_graph::log_stats): Call engine::log_stats.
9384         (exploded_graph::dump_states_for_supernode): Update dumping
9385         call.
9386         (exploded_path::feasible_p): Add "eng" and "eg" params.
9387         Rename "i" to "end_idx".  Pass the manager to the region_model
9388         ctor.  Update for every processed stmt in the enode, not just the
9389         first.  Keep track of which snodes have been visited, and call
9390         loop_replay_fixup when revisiting one.
9391         (enode_label::get_text): Update dump call for new param.
9392         (exploded_graph::dump_exploded_nodes): Likewise.
9393         (exploded_graph::get_node_by_index): New.
9394         (impl_run_checkers): Create engine instance and pass its address
9395         to extrinsic_state ctor.
9396         * exploded-graph.h
9397         (impl_region_model_context::impl_region_model_context): Drop
9398         "change" params.
9399         (impl_region_model_context::void remap_svalue_ids): Delete.
9400         (impl_region_model_context::on_svalue_purge): Delete.
9401         (impl_region_model_context::on_svalue_leak): New.
9402         (impl_region_model_context::on_liveness_change): New.
9403         (impl_region_model_context::on_state_leak): Update signature.
9404         (impl_region_model_context::on_inherited_svalue): Delete.
9405         (impl_region_model_context::on_cast): Delete.
9406         (impl_region_model_context::on_unknown_change): Update signature.
9407         (impl_region_model_context::m_change): Delete.
9408         (eg_traits::dump_args_t::show_enode_details_p): New.
9409         (exploded_node::on_stmt): Drop "change" param.
9410         (exploded_node::on_edge): Likewise.
9411         (exploded_node::get_processed_stmt): New decl.
9412         (exploded_node::m_num_processed_stmts): New field.
9413         (exploded_edge::exploded_edge): Drop ext_state and change params.
9414         (exploded_edge::m_change): Delete.
9415         (exploded_graph::get_engine): New accessor.
9416         (exploded_graph::get_or_create_node): Drop "change" param.  Add
9417         "enode_for_diag" param.
9418         (exploded_graph::add_edge): Drop "change" param.
9419         (exploded_graph::get_per_program_point_data): New decl.
9420         (exploded_graph::get_node_by_index): New decl.
9421         (exploded_path::feasible_p): Add "eng" and "eg" params.
9422         * program-point.cc: Include "analyzer/store.h" before including
9423         "analyzer/region-model.h".
9424         (function_point::function_point): Move here from
9425         program-point.h.
9426         (function_point::get_function): Likewise.
9427         (function_point::from_function_entry): Likewise.
9428         (function_point::before_supernode): Likewise.
9429         (function_point::next_stmt): New function.
9430         * program-point.h (function_point::function_point): Move
9431         implementation from here to program-point.cc.
9432         (function_point::get_function): Likewise.
9433         (function_point::from_function_entry): Likewise.
9434         (function_point::before_supernode): Likewise.
9435         (function_point::next_stmt): New decl.
9436         (program_point::operator!=): New.
9437         (program_point::origin): New.
9438         (program_point::next_stmt): New.
9439         (program_point::m_function_point): Make non-const.
9440         * program-state.cc: Move includes of "analyzer/call-string.h" and
9441         "analyzer/program-point.h" to before "analyzer/region-model.h",
9442         and also include "analyzer/store.h" before it.
9443         (extrinsic_state::get_model_manager): New.
9444         (sm_state_map::sm_state_map): Pass in sm and sm_idx to ctor,
9445         rather than pass the around.
9446         (sm_state_map::clone_with_remapping): Delete.
9447         (sm_state_map::print): Remove "sm" param in favor of "m_sm".  Add
9448         "simple" and "multiline" params and support multiline vs single
9449         line dumping.
9450         (sm_state_map::dump): Remove "sm" param in favor of "m_sm".  Add
9451         "simple" param.
9452         (sm_state_map::hash): Port from svalue_id to const svalue *.
9453         (sm_state_map::operator==): Likewise.
9454         (sm_state_map::get_state): Likewise.  Call canonicalize_svalue on
9455         input.  Handle inheritance of sm-state.  Call get_default_state.
9456         (sm_state_map::get_origin): Port from svalue_id to const svalue *.
9457         (sm_state_map::set_state): Likewise.  Pass in ext_state.  Reject
9458         attempts to set state on UNKNOWN.
9459         (sm_state_map::impl_set_state): Port from svalue_id to
9460         const svalue *.  Pass in ext_state.  Call canonicalize_svalue on
9461         input.
9462         (sm_state_map::purge_for_unknown_fncall): Delete.
9463         (sm_state_map::on_svalue_leak): New.
9464         (sm_state_map::remap_svalue_ids): Delete.
9465         (sm_state_map::on_liveness_change): New.
9466         (sm_state_map::on_unknown_change): Reimplement.
9467         (sm_state_map::on_svalue_purge): Delete.
9468         (sm_state_map::on_inherited_svalue): Delete.
9469         (sm_state_map::on_cast): Delete.
9470         (sm_state_map::validate): Delete.
9471         (sm_state_map::canonicalize_svalue): New.
9472         (program_state::program_state): Update to pass manager to
9473         region_model's ctor.  Constify num_states and pass state machine
9474         and index to sm_state_map ctor.
9475         (program_state::print): Update for changes to dump API.
9476         (program_state::dump_to_pp): Ignore the summarize param.  Add
9477         "multiline" param.
9478         (program_state::dump_to_file): Add "multiline" param.
9479         (program_state::dump): Pass "true" for new "multiline" param.
9480         (program_state::push_frame): New.
9481         (program_state::on_edge): Drop "change" param.  Call
9482         program_state::detect_leaks.
9483         (program_state::prune_for_point): Add enode_for_diag param.
9484         Reimplement based on store class.  Call detect_leaks
9485         (program_state::remap_svalue_ids): Delete.
9486         (program_state::get_representative_tree): Port from svalue_id to
9487         const svalue *.
9488         (program_state::can_merge_with_p): Add "point" param.  Add early
9489         reject for sm-differences.  Drop id remapping.
9490         (program_state::validate): Drop region model and sm_state_map
9491         validation.
9492         (state_change::sm_change::dump): Delete.
9493         (state_change::sm_change::remap_svalue_ids): Delete.
9494         (state_change::sm_change::on_svalue_purge): Delete.
9495         (log_set_of_svalues): New.
9496         (state_change::sm_change::validate): Delete.
9497         (state_change::state_change): Delete.
9498         (state_change::add_sm_change): Delete.
9499         (state_change::affects_p): Delete.
9500         (state_change::dump): Delete.
9501         (state_change::remap_svalue_ids): Delete.
9502         (state_change::on_svalue_purge): Delete.
9503         (state_change::validate): Delete.
9504         (selftest::assert_dump_eq): Delete.
9505         (ASSERT_DUMP_EQ): Delete.
9506         (selftest::test_sm_state_map): Update for changes to region_model
9507         and sm_state_map, porting from svalue_id to const svalue *.
9508         (selftest::test_program_state_dumping): Likewise.  Drop test of
9509         dumping, renaming to...
9510         (selftest::test_program_state_1): ...this.
9511         (selftest::test_program_state_dumping_2): Likewise, renaming to...
9512         (selftest::test_program_state_2): ...this.
9513         (selftest::test_program_state_merging): Update for changes to
9514         region_model.
9515         (selftest::test_program_state_merging_2): Likewise.
9516         (selftest::analyzer_program_state_cc_tests): Update for renamed
9517         tests.
9518         * program-state.h (extrinsic_state::extrinsic_state): Add logger
9519         and engine params.
9520         (extrinsic_state::get_logger): New accessor.
9521         (extrinsic_state::get_engine): New accessor.
9522         (extrinsic_state::get_model_manager): New accessor.
9523         (extrinsic_state::m_logger): New field.
9524         (extrinsic_state::m_engine): New field.
9525         (struct default_hash_traits<svalue_id>): Delete.
9526         (pod_hash_traits<svalue_id>::hash): Delete.
9527         (pod_hash_traits<svalue_id>::equal): Delete.
9528         (pod_hash_traits<svalue_id>::mark_deleted): Delete.
9529         (pod_hash_traits<svalue_id>::mark_empty): Delete.
9530         (pod_hash_traits<svalue_id>::is_deleted): Delete.
9531         (pod_hash_traits<svalue_id>::is_empty): Delete.
9532         (sm_state_map::entry_t::entry_t): Port from svalue_id to
9533         const svalue *.
9534         (sm_state_map::entry_t::m_origin): Likewise.
9535         (sm_state_map::map_t): Likewise.
9536         (sm_state_map::sm_state_map): Add state_machine and index params.
9537         (sm_state_map::clone_with_remapping): Delete.
9538         (sm_state_map::print):  Drop sm param; add simple and multiline
9539         params.
9540         (sm_state_map::dump): Drop sm param; add simple param.
9541         (sm_state_map::get_state): Port from svalue_id to const svalue *.
9542         Add ext_state param.
9543         (sm_state_map::get_origin): Likewise.
9544         (sm_state_map::set_state): Likewise.
9545         (sm_state_map::impl_set_state): Likewise.
9546         (sm_state_map::purge_for_unknown_fncall): Delete.
9547         (sm_state_map::remap_svalue_ids): Delete.
9548         (sm_state_map::on_svalue_purge): Delete.
9549         (sm_state_map::on_svalue_leak): New.
9550         (sm_state_map::on_liveness_change): New.
9551         (sm_state_map::on_inherited_svalue): Delete.
9552         (sm_state_map::on_cast): Delete.
9553         (sm_state_map::validate): Delete.
9554         (sm_state_map::on_unknown_change): Port from svalue_id to
9555         const svalue *.  Add is_mutable and ext_state params.
9556         (sm_state_map::canonicalize_svalue): New.
9557         (sm_state_map::m_sm): New field.
9558         (sm_state_map::m_sm_idx): New field.
9559         (program_state::operator=): Delete.
9560         (program_state::dump_to_pp): Drop "summarize" param, adding
9561         "simple" and "multiline".
9562         (program_state::dump_to_file): Likewise.
9563         (program_state::dump): Rename "summarize" to "simple".
9564         (program_state::push_frame): New.
9565         (program_state::get_current_function): New.
9566         (program_state::on_edge): Drop "change" param.
9567         (program_state::prune_for_point): Likewise.  Add enode_for_diag
9568         param.
9569         (program_state::remap_svalue_ids): Delete.
9570         (program_state::get_representative_tree): Port from svalue_id to
9571         const svalue *.
9572         (program_state::can_purge_p): Likewise.  Pass ext_state to get_state.
9573         (program_state::can_merge_with_p): Add point param.
9574         (program_state::detect_leaks): New.
9575         (state_change_visitor::on_state_change): Port from tree and
9576         svalue_id to a pair of const svalue *.
9577         (class state_change): Delete.
9578         * region.cc: New file.
9579         * region-model-impl-calls.cc: New file.
9580         * region-model-manager.cc: New file.
9581         * region-model-reachability.cc: New file.
9582         * region-model-reachability.h: New file.
9583         * region-model.cc: Include "analyzer/call-string.h",
9584         "analyzer/program-point.h", and "analyzer/store.h" before
9585         "analyzer/region-model.h".  Include
9586         "analyzer/region-model-reachability.h".
9587         (dump_tree): Make non-static.
9588         (dump_quoted_tree): Make non-static.
9589         (print_quoted_type): Make non-static.
9590         (path_var::dump): Delete.
9591         (dump_separator): Delete.
9592         (class impl_constraint_manager): Delete.
9593         (svalue_id::print): Delete.
9594         (svalue_id::dump_node_name_to_pp): Delete.
9595         (svalue_id::validate): Delete.
9596         (region_id::print): Delete.
9597         (region_id::dump_node_name_to_pp): Delete.
9598         (region_id::validate): Delete.
9599         (region_id_set::region_id_set): Delete.
9600         (svalue_id_set::svalue_id_set): Delete.
9601         (svalue::operator==): Delete.
9602         (svalue::hash): Delete.
9603         (svalue::print): Delete.
9604         (svalue::dump_dot_to_pp): Delete.
9605         (svalue::remap_region_ids): Delete.
9606         (svalue::walk_for_canonicalization): Delete.
9607         (svalue::get_child_sid): Delete.
9608         (svalue::maybe_get_constant): Delete.
9609         (region_svalue::compare_fields): Delete.
9610         (region_svalue::add_to_hash): Delete.
9611         (region_svalue::print_details): Delete.
9612         (region_svalue::dump_dot_to_pp): Delete.
9613         (region_svalue::remap_region_ids): Delete.
9614         (region_svalue::merge_values): Delete.
9615         (region_svalue::walk_for_canonicalization): Delete.
9616         (region_svalue::eval_condition): Delete.
9617         (constant_svalue::compare_fields): Delete.
9618         (constant_svalue::add_to_hash): Delete.
9619         (constant_svalue::merge_values): Delete.
9620         (constant_svalue::eval_condition): Move to svalue.cc.
9621         (constant_svalue::print_details): Delete.
9622         (constant_svalue::get_child_sid): Delete.
9623         (unknown_svalue::compare_fields): Delete.
9624         (unknown_svalue::add_to_hash): Delete.
9625         (unknown_svalue::print_details): Delete.
9626         (poison_kind_to_str): Move to svalue.cc.
9627         (poisoned_svalue::compare_fields): Delete.
9628         (poisoned_svalue::add_to_hash): Delete.
9629         (poisoned_svalue::print_details): Delete.
9630         (region_kind_to_str): Move to region.cc and reimplement.
9631         (region::operator==): Delete.
9632         (region::get_parent_region): Delete.
9633         (region::set_value): Delete.
9634         (region::become_active_view): Delete.
9635         (region::deactivate_any_active_view): Delete.
9636         (region::deactivate_view): Delete.
9637         (region::get_value): Delete.
9638         (region::get_inherited_child_sid): Delete.
9639         (region_model::copy_region): Delete.
9640         (region_model::copy_struct_region): Delete.
9641         (region_model::copy_union_region): Delete.
9642         (region_model::copy_array_region): Delete.
9643         (region::hash): Delete.
9644         (region::print): Delete.
9645         (region::dump_dot_to_pp): Delete.
9646         (region::dump_to_pp): Delete.
9647         (region::dump_child_label): Delete.
9648         (region::validate): Delete.
9649         (region::remap_svalue_ids): Delete.
9650         (region::remap_region_ids): Delete.
9651         (region::add_view): Delete.
9652         (region::get_view): Delete.
9653         (region::region): Move to region.cc.
9654         (region::add_to_hash): Delete.
9655         (region::print_fields): Delete.
9656         (region::non_null_p): Delete.
9657         (primitive_region::clone): Delete.
9658         (primitive_region::walk_for_canonicalization): Delete.
9659         (map_region::map_region): Delete.
9660         (map_region::compare_fields): Delete.
9661         (map_region::print_fields): Delete.
9662         (map_region::validate): Delete.
9663         (map_region::dump_dot_to_pp): Delete.
9664         (map_region::dump_child_label): Delete.
9665         (map_region::get_or_create): Delete.
9666         (map_region::get): Delete.
9667         (map_region::add_to_hash): Delete.
9668         (map_region::remap_region_ids): Delete.
9669         (map_region::unbind): Delete.
9670         (map_region::get_tree_for_child_region): Delete.
9671         (map_region::get_tree_for_child_region): Delete.
9672         (tree_cmp): Move to region.cc.
9673         (map_region::can_merge_p): Delete.
9674         (map_region::walk_for_canonicalization): Delete.
9675         (map_region::get_value_by_name): Delete.
9676         (struct_or_union_region::valid_key_p): Delete.
9677         (struct_or_union_region::compare_fields): Delete.
9678         (struct_region::clone): Delete.
9679         (struct_region::compare_fields): Delete.
9680         (union_region::clone): Delete.
9681         (union_region::compare_fields): Delete.
9682         (frame_region::compare_fields): Delete.
9683         (frame_region::clone): Delete.
9684         (frame_region::valid_key_p): Delete.
9685         (frame_region::print_fields): Delete.
9686         (frame_region::add_to_hash): Delete.
9687         (globals_region::compare_fields): Delete.
9688         (globals_region::clone): Delete.
9689         (globals_region::valid_key_p): Delete.
9690         (code_region::compare_fields): Delete.
9691         (code_region::clone): Delete.
9692         (code_region::valid_key_p): Delete.
9693         (array_region::array_region): Delete.
9694         (array_region::get_element): Delete.
9695         (array_region::clone): Delete.
9696         (array_region::compare_fields): Delete.
9697         (array_region::print_fields): Delete.
9698         (array_region::validate): Delete.
9699         (array_region::dump_dot_to_pp): Delete.
9700         (array_region::dump_child_label): Delete.
9701         (array_region::get_or_create): Delete.
9702         (array_region::get): Delete.
9703         (array_region::add_to_hash): Delete.
9704         (array_region::remap_region_ids): Delete.
9705         (array_region::get_key_for_child_region): Delete.
9706         (array_region::key_cmp): Delete.
9707         (array_region::walk_for_canonicalization): Delete.
9708         (array_region::key_from_constant): Delete.
9709         (array_region::constant_from_key): Delete.
9710         (function_region::compare_fields): Delete.
9711         (function_region::clone): Delete.
9712         (function_region::valid_key_p): Delete.
9713         (stack_region::stack_region): Delete.
9714         (stack_region::compare_fields): Delete.
9715         (stack_region::clone): Delete.
9716         (stack_region::print_fields): Delete.
9717         (stack_region::dump_child_label): Delete.
9718         (stack_region::validate): Delete.
9719         (stack_region::push_frame): Delete.
9720         (stack_region::get_current_frame_id): Delete.
9721         (stack_region::pop_frame): Delete.
9722         (stack_region::add_to_hash): Delete.
9723         (stack_region::remap_region_ids): Delete.
9724         (stack_region::can_merge_p): Delete.
9725         (stack_region::walk_for_canonicalization): Delete.
9726         (stack_region::get_value_by_name): Delete.
9727         (heap_region::heap_region): Delete.
9728         (heap_region::compare_fields): Delete.
9729         (heap_region::clone): Delete.
9730         (heap_region::walk_for_canonicalization): Delete.
9731         (root_region::root_region): Delete.
9732         (root_region::compare_fields): Delete.
9733         (root_region::clone): Delete.
9734         (root_region::print_fields): Delete.
9735         (root_region::validate): Delete.
9736         (root_region::dump_child_label): Delete.
9737         (root_region::push_frame): Delete.
9738         (root_region::get_current_frame_id): Delete.
9739         (root_region::pop_frame): Delete.
9740         (root_region::ensure_stack_region): Delete.
9741         (root_region::get_stack_region): Delete.
9742         (root_region::ensure_globals_region): Delete.
9743         (root_region::get_code_region): Delete.
9744         (root_region::ensure_code_region): Delete.
9745         (root_region::get_globals_region): Delete.
9746         (root_region::ensure_heap_region): Delete.
9747         (root_region::get_heap_region): Delete.
9748         (root_region::remap_region_ids): Delete.
9749         (root_region::can_merge_p): Delete.
9750         (root_region::add_to_hash): Delete.
9751         (root_region::walk_for_canonicalization): Delete.
9752         (root_region::get_value_by_name): Delete.
9753         (symbolic_region::symbolic_region): Delete.
9754         (symbolic_region::compare_fields): Delete.
9755         (symbolic_region::clone): Delete.
9756         (symbolic_region::walk_for_canonicalization): Delete.
9757         (symbolic_region::print_fields): Delete.
9758         (region_model::region_model): Add region_model_manager * param.
9759         Reimplement in terms of store, dropping impl_constraint_manager
9760         subclass.
9761         (region_model::operator=): Reimplement in terms of store
9762         (region_model::operator==): Likewise.
9763         (region_model::hash): Likewise.
9764         (region_model::print): Delete.
9765         (region_model::print_svalue): Delete.
9766         (region_model::dump_dot_to_pp): Delete.
9767         (region_model::dump_dot_to_file): Delete.
9768         (region_model::dump_dot): Delete.
9769         (region_model::dump_to_pp): Replace "summarize" param with
9770         "simple" and "multiline".  Port to store-based implementation.
9771         (region_model::dump): Replace "summarize" param with "simple" and
9772         "multiline".
9773         (dump_vec_of_tree): Delete.
9774         (region_model::dump_summary_of_rep_path_vars): Delete.
9775         (region_model::validate): Delete.
9776         (svalue_id_cmp_by_constant_svalue_model): Delete.
9777         (svalue_id_cmp_by_constant_svalue): Delete.
9778         (region_model::canonicalize): Drop "ctxt" param.  Reimplement in
9779         terms of store and constraints.
9780         (region_model::canonicalized_p): Remove NULL arg to canonicalize.
9781         (region_model::loop_replay_fixup): New.
9782         (poisoned_value_diagnostic::emit): Tweak wording of warnings.
9783         (region_model::check_for_poison): Delete.
9784         (region_model::get_gassign_result): New.
9785         (region_model::on_assignment): Port to store-based implementation.
9786         (region_model::on_call_pre): Delete calls to check_for_poison.
9787         Move implementations to region-model-impl-calls.c and port to
9788         store-based implementation.
9789         (region_model::on_call_post): Likewise.
9790         (class reachable_regions): Move to region-model-reachability.h/cc
9791         and port to store-based implementation.
9792         (region_model::handle_unrecognized_call): Port to store-based
9793         implementation.
9794         (region_model::get_reachable_svalues): New.
9795         (region_model::on_setjmp): Port to store-based implementation.
9796         (region_model::on_longjmp): Likewise.
9797         (region_model::handle_phi): Drop is_back_edge param and the logic
9798         using it.
9799         (region_model::get_lvalue_1): Port from region_id to const region *.
9800         (region_model::make_region_for_unexpected_tree_code): Delete.
9801         (assert_compat_types): If the check fails, use internal_error to
9802         show the types.
9803         (region_model::get_lvalue): Port from region_id to const region *.
9804         (region_model::get_rvalue_1): Port from svalue_id to const svalue *.
9805         (region_model::get_rvalue): Likewise.
9806         (region_model::get_or_create_ptr_svalue): Delete.
9807         (region_model::get_or_create_constant_svalue): Delete.
9808         (region_model::get_svalue_for_fndecl): Delete.
9809         (region_model::get_region_for_fndecl): Delete.
9810         (region_model::get_svalue_for_label): Delete.
9811         (region_model::get_region_for_label): Delete.
9812         (build_cast): Delete.
9813         (region_model::maybe_cast_1): Delete.
9814         (region_model::maybe_cast): Delete.
9815         (region_model::get_field_region): Delete.
9816         (region_model::get_store_value): New.
9817         (region_model::region_exists_p): New.
9818         (region_model::deref_rvalue): Port from svalue_id to const svalue *.
9819         (region_model::set_value): Likewise.
9820         (region_model::clobber_region): New.
9821         (region_model::purge_region): New.
9822         (region_model::zero_fill_region): New.
9823         (region_model::mark_region_as_unknown): New.
9824         (region_model::eval_condition): Port from svalue_id to
9825         const svalue *.
9826         (region_model::eval_condition_without_cm): Likewise.
9827         (region_model::compare_initial_and_pointer): New.
9828         (region_model::add_constraint): Port from svalue_id to
9829         const svalue *.
9830         (region_model::maybe_get_constant): Delete.
9831         (region_model::get_representative_path_var): New.
9832         (region_model::add_new_malloc_region): Delete.
9833         (region_model::get_representative_tree): Port to const svalue *.
9834         (region_model::get_representative_path_var): Port to
9835         const region *.
9836         (region_model::get_path_vars_for_svalue): Delete.
9837         (region_model::set_to_new_unknown_value): Delete.
9838         (region_model::update_for_phis): Don't pass is_back_edge to handle_phi.
9839         (region_model::update_for_call_superedge): Port from svalue_id to
9840         const svalue *.
9841         (region_model::update_for_return_superedge): Port to store-based
9842         implementation.
9843         (region_model::update_for_call_summary): Replace
9844         set_to_new_unknown_value with mark_region_as_unknown.
9845         (region_model::get_root_region): Delete.
9846         (region_model::get_stack_region_id): Delete.
9847         (region_model::push_frame): Delete.
9848         (region_model::get_current_frame_id): Delete.
9849         (region_model::get_current_function): Delete.
9850         (region_model::pop_frame): Delete.
9851         (region_model::on_top_level_param): New.
9852         (region_model::get_stack_depth): Delete.
9853         (region_model::get_function_at_depth): Delete.
9854         (region_model::get_globals_region_id): Delete.
9855         (region_model::add_svalue): Delete.
9856         (region_model::replace_svalue): Delete.
9857         (region_model::add_region): Delete.
9858         (region_model::get_svalue): Delete.
9859         (region_model::get_region): Delete.
9860         (make_region_for_type): Delete.
9861         (region_model::add_region_for_type): Delete.
9862         (region_model::on_top_level_param): New.
9863         (class restrict_to_used_svalues): Delete.
9864         (region_model::purge_unused_svalues): Delete.
9865         (region_model::push_frame): New.
9866         (region_model::remap_svalue_ids): Delete.
9867         (region_model::remap_region_ids): Delete.
9868         (region_model::purge_regions): Delete.
9869         (region_model::get_descendents): Delete.
9870         (region_model::delete_region_and_descendents): Delete.
9871         (region_model::poison_any_pointers_to_bad_regions): Delete.
9872         (region_model::can_merge_with_p): Delete.
9873         (region_model::get_current_function): New.
9874         (region_model::get_value_by_name): Delete.
9875         (region_model::convert_byte_offset_to_array_index): Delete.
9876         (region_model::pop_frame): New.
9877         (region_model::get_or_create_mem_ref): Delete.
9878         (region_model::get_stack_depth): New.
9879         (region_model::get_frame_at_index): New.
9880         (region_model::unbind_region_and_descendents): New.
9881         (struct bad_pointer_finder): New.
9882         (region_model::get_or_create_pointer_plus_expr): Delete.
9883         (region_model::poison_any_pointers_to_descendents): New.
9884         (region_model::get_or_create_view): Delete.
9885         (region_model::can_merge_with_p): New.
9886         (region_model::get_fndecl_for_call):  Port from svalue_id to
9887         const svalue *.
9888         (struct append_ssa_names_cb_data): New.
9889         (get_ssa_name_regions_for_current_frame): New.
9890         (region_model::append_ssa_names_cb): New.
9891         (model_merger::dump_to_pp): Add "simple" param.  Drop dumping of
9892         remappings.
9893         (model_merger::dump): Add "simple" param to both overloads.
9894         (model_merger::can_merge_values_p): Delete.
9895         (model_merger::record_regions): Delete.
9896         (model_merger::record_svalues): Delete.
9897         (svalue_id_merger_mapping::svalue_id_merger_mapping): Delete.
9898         (svalue_id_merger_mapping::dump_to_pp): Delete.
9899         (svalue_id_merger_mapping::dump): Delete.
9900         (region_model::create_region_for_heap_alloc): New.
9901         (region_model::create_region_for_alloca): New.
9902         (region_model::record_dynamic_extents): New.
9903         (canonicalization::canonicalization): Delete.
9904         (canonicalization::walk_rid): Delete.
9905         (canonicalization::walk_sid): Delete.
9906         (canonicalization::dump_to_pp): Delete.
9907         (canonicalization::dump): Delete.
9908         (inchash::add): Delete overloads for svalue_id and region_id.
9909         (engine::log_stats): New.
9910         (assert_condition): Add overload comparing svalues.
9911         (assert_dump_eq): Pass "true" for multiline.
9912         (selftest::test_dump): Update for rewrite of region_model.
9913         (selftest::test_dump_2): Rename to...
9914         (selftest::test_struct): ...this.  Provide a region_model_manager
9915         when creating region_model instance.  Remove dump test.  Add
9916         checks for get_offset.
9917         (selftest::test_dump_3): Rename to...
9918         (selftest::test_array_1): ...this.  Provide a region_model_manager
9919         when creating region_model instance.  Remove dump test.
9920         (selftest::test_get_representative_tree): Port from svalue_id to
9921         new API.  Add test coverage for various expressions.
9922         (selftest::test_unique_constants): Provide a region_model_manager
9923         for the region_model.  Add test coverage for comparing const vs
9924         non-const.
9925         (selftest::test_svalue_equality): Delete.
9926         (selftest::test_region_equality): Delete.
9927         (selftest::test_unique_unknowns): New.
9928         (class purge_all_svalue_ids): Delete.
9929         (class purge_one_svalue_id): Delete.
9930         (selftest::test_purging_by_criteria): Delete.
9931         (selftest::test_initial_svalue_folding): New.
9932         (selftest::test_unaryop_svalue_folding): New.
9933         (selftest::test_binop_svalue_folding): New.
9934         (selftest::test_sub_svalue_folding): New.
9935         (selftest::test_purge_unused_svalues): Delete.
9936         (selftest::test_descendent_of_p): New.
9937         (selftest::test_assignment): Provide a region_model_manager for
9938         the region_model.  Drop the dump test.
9939         (selftest::test_compound_assignment): Likewise.
9940         (selftest::test_stack_frames): Port to new implementation.
9941         (selftest::test_get_representative_path_var): Likewise.
9942         (selftest::test_canonicalization_1): Rename to...
9943         (selftest::test_equality_1): ...this.  Port to new API, and add
9944         (selftest::test_canonicalization_2): Provide a
9945         region_model_manager when creating region_model instances.
9946         Remove redundant canicalization.
9947         (selftest::test_canonicalization_3): Provide a
9948         region_model_manager when creating region_model instances.
9949         Remove param from calls to region_model::canonicalize.
9950         (selftest::test_canonicalization_4): Likewise.
9951         (selftest::assert_region_models_merge): Constify
9952         out_merged_svalue.  Port to new API.
9953         (selftest::test_state_merging): Provide a
9954         region_model_manager when creating region_model instances.
9955         Provide a program_point point when merging them.  Replace
9956         set_to_new_unknown_value with usage of placeholder_svalues.
9957         Drop get_value_by_name.  Port from svalue_id to const svalue *.
9958         Add test of heap allocation.
9959         (selftest::test_constraint_merging):  Provide a
9960         region_model_manager when creating region_model instances.
9961         Provide a program_point point when merging them.  Eliminate use
9962         of set_to_new_unknown_value.
9963         (selftest::test_widening_constraints): New.
9964         (selftest::test_iteration_1): New.
9965         (selftest::test_malloc_constraints): Port to store-based
9966         implementation.
9967         (selftest::test_var): New test.
9968         (selftest::test_array_2): New test.
9969         (selftest::test_mem_ref): New test.
9970         (selftest::test_POINTER_PLUS_EXPR_then_MEM_REF): New.
9971         (selftest::test_malloc): New.
9972         (selftest::test_alloca): New.
9973         (selftest::analyzer_region_model_cc_tests): Update for renamings.
9974         Call new functions.
9975         * region-model.h (class path_var): Move to analyzer.h.
9976         (class svalue_id): Delete.
9977         (class region_id): Delete.
9978         (class id_map): Delete.
9979         (svalue_id_map): Delete.
9980         (region_id_map): Delete.
9981         (id_map<T>::id_map): Delete.
9982         (id_map<T>::put): Delete.
9983         (id_map<T>::get_dst_for_src): Delete.
9984         (id_map<T>::get_src_for_dst): Delete.
9985         (id_map<T>::dump_to_pp): Delete.
9986         (id_map<T>::dump): Delete.
9987         (id_map<T>::update): Delete.
9988         (one_way_svalue_id_map): Delete.
9989         (one_way_region_id_map): Delete.
9990         (class region_id_set): Delete.
9991         (class svalue_id_set): Delete.
9992         (struct complexity): New.
9993         (class visitor): New.
9994         (enum svalue_kind): Add SK_SETJMP, SK_INITIAL, SK_UNARYOP,
9995         SK_BINOP, SK_SUB,SK_UNMERGEABLE, SK_PLACEHOLDER, SK_WIDENING,
9996         SK_COMPOUND, and SK_CONJURED.
9997         (svalue::operator==): Delete.
9998         (svalue::operator!=): Delete.
9999         (svalue::clone): Delete.
10000         (svalue::hash): Delete.
10001         (svalue::dump_dot_to_pp): Delete.
10002         (svalue::dump_to_pp): New.
10003         (svalue::dump): New.
10004         (svalue::get_desc): New.
10005         (svalue::dyn_cast_initial_svalue): New.
10006         (svalue::dyn_cast_unaryop_svalue): New.
10007         (svalue::dyn_cast_binop_svalue): New.
10008         (svalue::dyn_cast_sub_svalue): New.
10009         (svalue::dyn_cast_unmergeable_svalue): New.
10010         (svalue::dyn_cast_widening_svalue): New.
10011         (svalue::dyn_cast_compound_svalue): New.
10012         (svalue::dyn_cast_conjured_svalue): New.
10013         (svalue::maybe_undo_cast): New.
10014         (svalue::unwrap_any_unmergeable): New.
10015         (svalue::remap_region_ids): Delete
10016         (svalue::can_merge_p): New.
10017         (svalue::walk_for_canonicalization): Delete
10018         (svalue::get_complexity): New.
10019         (svalue::get_child_sid): Delete
10020         (svalue::accept): New.
10021         (svalue::live_p): New.
10022         (svalue::implicitly_live_p): New.
10023         (svalue::svalue): Add complexity param.
10024         (svalue::add_to_hash): Delete
10025         (svalue::print_details): Delete
10026         (svalue::m_complexity): New field.
10027         (region_svalue::key_t): New struct.
10028         (region_svalue::region_svalue): Port from region_id to
10029         const region_id *.  Add complexity.
10030         (region_svalue::compare_fields): Delete.
10031         (region_svalue::clone): Delete.
10032         (region_svalue::dump_dot_to_pp): Delete.
10033         (region_svalue::get_pointee): Port from region_id to
10034         const region_id *.
10035         (region_svalue::remap_region_ids): Delete.
10036         (region_svalue::merge_values): Delete.
10037         (region_svalue::dump_to_pp): New.
10038         (region_svalue::accept): New.
10039         (region_svalue::walk_for_canonicalization): Delete.
10040         (region_svalue::eval_condition): Make params const.
10041         (region_svalue::add_to_hash): Delete.
10042         (region_svalue::print_details): Delete.
10043         (region_svalue::m_rid): Replace with...
10044         (region_svalue::m_reg): ...this.
10045         (is_a_helper <region_svalue *>::test): Convert to...
10046         (is_a_helper <const region_svalue *>::test): ...this.
10047         (template <> struct default_hash_traits<region_svalue::key_t>):
10048         New.
10049         (constant_svalue::constant_svalue): Add complexity.
10050         (constant_svalue::compare_fields): Delete.
10051         (constant_svalue::clone): Delete.
10052         (constant_svalue::add_to_hash): Delete.
10053         (constant_svalue::dump_to_pp): New.
10054         (constant_svalue::accept): New.
10055         (constant_svalue::implicitly_live_p): New.
10056         (constant_svalue::merge_values): Delete.
10057         (constant_svalue::eval_condition): Make params const.
10058         (constant_svalue::get_child_sid): Delete.
10059         (constant_svalue::print_details): Delete.
10060         (is_a_helper <constant_svalue *>::test): Convert to...
10061         (is_a_helper <const constant_svalue *>::test): ...this.
10062         (class unknown_svalue): Update leading comment.
10063         (unknown_svalue::unknown_svalue): Add complexity.
10064         (unknown_svalue::compare_fields): Delete.
10065         (unknown_svalue::add_to_hash): Delete.
10066         (unknown_svalue::dyn_cast_unknown_svalue): Delete.
10067         (unknown_svalue::print_details): Delete.
10068         (unknown_svalue::dump_to_pp): New.
10069         (unknown_svalue::accept): New.
10070         (poisoned_svalue::key_t): New struct.
10071         (poisoned_svalue::poisoned_svalue): Add complexity.
10072         (poisoned_svalue::compare_fields): Delete.
10073         (poisoned_svalue::clone): Delete.
10074         (poisoned_svalue::add_to_hash): Delete.
10075         (poisoned_svalue::dump_to_pp): New.
10076         (poisoned_svalue::accept): New.
10077         (poisoned_svalue::print_details): Delete.
10078         (is_a_helper <poisoned_svalue *>::test): Convert to...
10079         (is_a_helper <const poisoned_svalue *>::test): ...this.
10080         (template <> struct default_hash_traits<poisoned_svalue::key_t>):
10081         New.
10082         (setjmp_record::add_to_hash): New.
10083         (setjmp_svalue::key_t): New struct.
10084         (setjmp_svalue::compare_fields): Delete.
10085         (setjmp_svalue::clone): Delete.
10086         (setjmp_svalue::add_to_hash): Delete.
10087         (setjmp_svalue::setjmp_svalue): Add complexity.
10088         (setjmp_svalue::dump_to_pp): New.
10089         (setjmp_svalue::accept): New.
10090         (setjmp_svalue::void print_details): Delete.
10091         (is_a_helper <const setjmp_svalue *>::test): New.
10092         (template <> struct default_hash_traits<setjmp_svalue::key_t>): New.
10093         (class initial_svalue : public svalue): New.
10094         (is_a_helper <const initial_svalue *>::test): New.
10095         (class unaryop_svalue): New.
10096         (is_a_helper <const unaryop_svalue *>::test): New.
10097         (template <> struct default_hash_traits<unaryop_svalue::key_t>): New.
10098         (class binop_svalue): New.
10099         (is_a_helper <const binop_svalue *>::test): New.
10100         (template <> struct default_hash_traits<binop_svalue::key_t>): New.
10101         (class sub_svalue): New.
10102         (is_a_helper <const sub_svalue *>::test): New.
10103         (template <> struct default_hash_traits<sub_svalue::key_t>): New.
10104         (class unmergeable_svalue): New.
10105         (is_a_helper <const unmergeable_svalue *>::test): New.
10106         (class placeholder_svalue): New.
10107         (is_a_helper <placeholder_svalue *>::test): New.
10108         (class widening_svalue): New.
10109         (is_a_helper <widening_svalue *>::test): New.
10110         (template <> struct default_hash_traits<widening_svalue::key_t>): New.
10111         (class compound_svalue): New.
10112         (is_a_helper <compound_svalue *>::test): New.
10113         (template <> struct default_hash_traits<compound_svalue::key_t>): New.
10114         (class conjured_svalue): New.
10115         (is_a_helper <conjured_svalue *>::test): New.
10116         (template <> struct default_hash_traits<conjured_svalue::key_t>): New.
10117         (enum region_kind): Delete RK_PRIMITIVE, RK_STRUCT, RK_UNION, and
10118         RK_ARRAY.  Add RK_LABEL, RK_DECL, RK_FIELD, RK_ELEMENT, RK_OFFSET,
10119         RK_CAST, RK_HEAP_ALLOCATED, RK_ALLOCA, RK_STRING, and RK_UNKNOWN.
10120         (region_kind_to_str): Delete.
10121         (region::~region): Move implementation to region.cc.
10122         (region::operator==): Delete.
10123         (region::operator!=): Delete.
10124         (region::clone): Delete.
10125         (region::get_id): New.
10126         (region::cmp_ids): New.
10127         (region::dyn_cast_map_region): Delete.
10128         (region::dyn_cast_array_region): Delete.
10129         (region::region_id get_parent): Delete.
10130         (region::get_parent_region): Convert to a simple accessor.
10131         (region::void set_value): Delete.
10132         (region::svalue_id get_value): Delete.
10133         (region::svalue_id get_value_direct): Delete.
10134         (region::svalue_id get_inherited_child_sid): Delete.
10135         (region::dyn_cast_frame_region): New.
10136         (region::dyn_cast_function_region): New.
10137         (region::dyn_cast_decl_region): New.
10138         (region::dyn_cast_field_region): New.
10139         (region::dyn_cast_element_region): New.
10140         (region::dyn_cast_offset_region): New.
10141         (region::dyn_cast_cast_region): New.
10142         (region::dyn_cast_string_region): New.
10143         (region::accept): New.
10144         (region::get_base_region): New.
10145         (region::base_region_p): New.
10146         (region::descendent_of_p): New.
10147         (region::maybe_get_frame_region): New.
10148         (region::maybe_get_decl): New.
10149         (region::hash): Delete.
10150         (region::rint): Delete.
10151         (region::dump_dot_to_pp): Delete.
10152         (region::get_desc): New.
10153         (region::dump_to_pp): Convert to vfunc, changing signature.
10154         (region::dump_child_label): Delete.
10155         (region::remap_svalue_ids): Delete.
10156         (region::remap_region_ids): Delete.
10157         (region::dump): New.
10158         (region::walk_for_canonicalization): Delete.
10159         (region::non_null_p): Drop region_model param.
10160         (region::add_view): Delete.
10161         (region::get_view): Delete.
10162         (region::get_active_view): Delete.
10163         (region::is_view_p): Delete.
10164         (region::cmp_ptrs): New.
10165         (region::validate): Delete.
10166         (region::get_offset): New.
10167         (region::get_byte_size): New.
10168         (region::get_bit_size): New.
10169         (region::get_subregions_for_binding): New.
10170         (region::region): Add complexity param.  Convert parent from
10171         region_id to const region *.  Drop svalue_id.  Drop copy ctor.
10172         (region::symbolic_for_unknown_ptr_p): New.
10173         (region::add_to_hash): Delete.
10174         (region::print_fields): Delete.
10175         (region::get_complexity): New accessor.
10176         (region::become_active_view): Delete.
10177         (region::deactivate_any_active_view): Delete.
10178         (region::deactivate_view): Delete.
10179         (region::calc_offset): New.
10180         (region::m_parent_rid): Delete.
10181         (region::m_sval_id): Delete.
10182         (region::m_complexity): New.
10183         (region::m_id): New.
10184         (region::m_parent): New.
10185         (region::m_view_rids): Delete.
10186         (region::m_is_view): Delete.
10187         (region::m_active_view_rid): Delete.
10188         (region::m_cached_offset): New.
10189         (is_a_helper <region *>::test): Convert to...
10190         (is_a_helper <const region *>::test): ... this.
10191         (class primitive_region): Delete.
10192         (class space_region): New.
10193         (class map_region): Delete.
10194         (is_a_helper <map_region *>::test): Delete.
10195         (class frame_region): Reimplement.
10196         (template <> struct default_hash_traits<frame_region::key_t>):
10197         New.
10198         (class globals_region): Reimplement.
10199         (is_a_helper <globals_region *>::test): Convert to...
10200         (is_a_helper <const globals_region *>::test): ...this.
10201         (class struct_or_union_region): Delete.
10202         (is_a_helper <struct_or_union_region *>::test): Delete.
10203         (class code_region): Reimplement.
10204         (is_a_helper <const code_region *>::test): New.
10205         (class struct_region): Delete.
10206         (is_a_helper <struct_region *>::test): Delete.
10207         (class function_region): Reimplement.
10208         (is_a_helper <function_region *>::test): Convert to...
10209         (is_a_helper <const function_region *>::test): ...this.
10210         (class union_region): Delete.
10211         (is_a_helper <union_region *>::test): Delete.
10212         (class label_region): New.
10213         (is_a_helper <const label_region *>::test): New.
10214         (class scope_region): Delete.
10215         (class stack_region): Reimplement.
10216         (is_a_helper <stack_region *>::test): Convert to...
10217         (is_a_helper <const stack_region *>::test): ...this.
10218         (class heap_region): Reimplement.
10219         (is_a_helper <heap_region *>::test): Convert to...
10220         (is_a_helper <const heap_region *>::test): ...this.
10221         (class root_region): Reimplement.
10222         (is_a_helper <root_region *>::test): Convert to...
10223         (is_a_helper <const root_region *>::test): ...this.
10224         (class symbolic_region): Reimplement.
10225         (is_a_helper <const symbolic_region *>::test): New.
10226         (template <> struct default_hash_traits<symbolic_region::key_t>):
10227         New.
10228         (class decl_region): New.
10229         (is_a_helper <const decl_region *>::test): New.
10230         (class field_region): New.
10231         (template <> struct default_hash_traits<field_region::key_t>): New.
10232         (class array_region): Delete.
10233         (class element_region): New.
10234         (is_a_helper <array_region *>::test): Delete.
10235         (is_a_helper <const element_region *>::test): New.
10236         (template <> struct default_hash_traits<element_region::key_t>):
10237         New.
10238         (class offset_region): New.
10239         (is_a_helper <const offset_region *>::test): New.
10240         (template <> struct default_hash_traits<offset_region::key_t>):
10241         New.
10242         (class cast_region): New.
10243         (is_a_helper <const cast_region *>::test): New.
10244         (template <> struct default_hash_traits<cast_region::key_t>): New.
10245         (class heap_allocated_region): New.
10246         (class alloca_region): New.
10247         (class string_region): New.
10248         (is_a_helper <const string_region *>::test): New.
10249         (class unknown_region): New.
10250         (class region_model_manager): New.
10251         (struct append_ssa_names_cb_data): New.
10252         (class call_details): New.
10253         (region_model::region_model): Add region_model_manager param.
10254         (region_model::print_svalue): Delete.
10255         (region_model::dump_dot_to_pp): Delete.
10256         (region_model::dump_dot_to_file): Delete.
10257         (region_model::dump_dot): Delete.
10258         (region_model::dump_to_pp): Drop summarize param in favor of
10259         simple and multiline.
10260         (region_model::dump): Likewise.
10261         (region_model::summarize_to_pp): Delete.
10262         (region_model::summarize): Delete.
10263         (region_model::void canonicalize): Drop ctxt param.
10264         (region_model::void check_for_poison): Delete.
10265         (region_model::get_gassign_result): New.
10266         (region_model::impl_call_alloca): New.
10267         (region_model::impl_call_analyzer_describe): New.
10268         (region_model::impl_call_analyzer_eval): New.
10269         (region_model::impl_call_builtin_expect): New.
10270         (region_model::impl_call_calloc): New.
10271         (region_model::impl_call_free): New.
10272         (region_model::impl_call_malloc): New.
10273         (region_model::impl_call_memset): New.
10274         (region_model::impl_call_strlen): New.
10275         (region_model::get_reachable_svalues): New.
10276         (region_model::handle_phi): Drop is_back_edge param.
10277         (region_model::region_id get_root_rid): Delete.
10278         (region_model::root_region *get_root_region): Delete.
10279         (region_model::region_id get_stack_region_id): Delete.
10280         (region_model::push_frame): Convert from region_id and svalue_id
10281         to const region * and const svalue *.
10282         (region_model::get_current_frame_id): Replace with...
10283         (region_model::get_current_frame): ...this.
10284         (region_model::pop_frame): Convert from region_id to
10285         const region *.  Drop purge and stats param.  Add out_result.
10286         (region_model::function *get_function_at_depth): Delete.
10287         (region_model::get_globals_region_id): Delete.
10288         (region_model::add_svalue): Delete.
10289         (region_model::replace_svalue): Delete.
10290         (region_model::add_region): Delete.
10291         (region_model::add_region_for_type): Delete.
10292         (region_model::get_svalue): Delete.
10293         (region_model::get_region): Delete.
10294         (region_model::get_lvalue): Convert from region_id to
10295         const region *.
10296         (region_model::get_rvalue): Convert from svalue_id to
10297         const svalue *.
10298         (region_model::get_or_create_ptr_svalue): Delete.
10299         (region_model::get_or_create_constant_svalue): Delete.
10300         (region_model::get_svalue_for_fndecl): Delete.
10301         (region_model::get_svalue_for_label): Delete.
10302         (region_model::get_region_for_fndecl): Delete.
10303         (region_model::get_region_for_label): Delete.
10304         (region_model::get_frame_at_index (int index) const;): New.
10305         (region_model::maybe_cast): Delete.
10306         (region_model::maybe_cast_1): Delete.
10307         (region_model::get_field_region): Delete.
10308         (region_model::id deref_rvalue): Convert from region_id and
10309         svalue_id to const region * and const svalue *.  Drop overload,
10310         passing in both a tree and an svalue.
10311         (region_model::set_value): Convert from region_id and svalue_id to
10312         const region * and const svalue *.
10313         (region_model::set_to_new_unknown_value): Delete.
10314         (region_model::clobber_region (const region *reg);): New.
10315         (region_model::purge_region (const region *reg);): New.
10316         (region_model::zero_fill_region (const region *reg);): New.
10317         (region_model::mark_region_as_unknown (const region *reg);): New.
10318         (region_model::copy_region): Convert from region_id to
10319         const region *.
10320         (region_model::eval_condition): Convert from svalue_id to
10321         const svalue *.
10322         (region_model::eval_condition_without_cm): Likewise.
10323         (region_model::compare_initial_and_pointer): New.
10324         (region_model:maybe_get_constant): Delete.
10325         (region_model::add_new_malloc_region): Delete.
10326         (region_model::get_representative_tree): Convert from svalue_id to
10327         const svalue *.
10328         (region_model::get_representative_path_var): Delete decl taking a
10329         region_id in favor of two decls, for svalue vs region, with an
10330         svalue_set to ensure termination.
10331         (region_model::get_path_vars_for_svalue): Delete.
10332         (region_model::create_region_for_heap_alloc): New.
10333         (region_model::create_region_for_alloca): New.
10334         (region_model::purge_unused_svalues): Delete.
10335         (region_model::remap_svalue_ids): Delete.
10336         (region_model::remap_region_ids): Delete.
10337         (region_model::purge_regions): Delete.
10338         (region_model::get_num_svalues): Delete.
10339         (region_model::get_num_regions): Delete.
10340         (region_model::get_descendents): Delete.
10341         (region_model::get_store): New.
10342         (region_model::delete_region_and_descendents): Delete.
10343         (region_model::get_manager): New.
10344         (region_model::unbind_region_and_descendents): New.
10345         (region_model::can_merge_with_p): Add point param.  Drop
10346         svalue_id_merger_mapping.
10347         (region_model::get_value_by_name): Delete.
10348         (region_model::convert_byte_offset_to_array_index): Delete.
10349         (region_model::get_or_create_mem_ref): Delete.
10350         (region_model::get_or_create_pointer_plus_expr): Delete.
10351         (region_model::get_or_create_view): Delete.
10352         (region_model::get_lvalue_1): Convert from region_id to
10353         const region *.
10354         (region_model::get_rvalue_1): Convert from svalue_id to
10355         const svalue *.
10356         (region_model::get_ssa_name_regions_for_current_frame): New.
10357         (region_model::append_ssa_names_cb): New.
10358         (region_model::get_store_value): New.
10359         (region_model::copy_struct_region): Delete.
10360         (region_model::copy_union_region): Delete.
10361         (region_model::copy_array_region): Delete.
10362         (region_model::region_exists_p): New.
10363         (region_model::make_region_for_unexpected_tree_code): Delete.
10364         (region_model::loop_replay_fixup): New.
10365         (region_model::poison_any_pointers_to_bad_regions): Delete.
10366         (region_model::poison_any_pointers_to_descendents): New.
10367         (region_model::dump_summary_of_rep_path_vars): Delete.
10368         (region_model::on_top_level_param): New.
10369         (region_model::record_dynamic_extents): New.
10370         (region_model::m_mgr;): New.
10371         (region_model::m_store;): New.
10372         (region_model::m_svalues;): Delete.
10373         (region_model::m_regions;): Delete.
10374         (region_model::m_root_rid;): Delete.
10375         (region_model::m_current_frame;): New.
10376         (region_model_context::remap_svalue_ids): Delete.
10377         (region_model_context::can_purge_p): Delete.
10378         (region_model_context::on_svalue_leak): New.
10379         (region_model_context::on_svalue_purge): Delete.
10380         (region_model_context::on_liveness_change): New.
10381         (region_model_context::on_inherited_svalue): Delete.
10382         (region_model_context::on_cast): Delete.
10383         (region_model_context::on_unknown_change): Convert from svalue_id to
10384         const svalue * and add is_mutable.
10385         (class noop_region_model_context): Update for region_model_context
10386         changes.
10387         (model_merger::model_merger): Add program_point.  Drop
10388         svalue_id_merger_mapping.
10389         (model_merger::dump_to_pp): Add "simple" param.
10390         (model_merger::dump): Likewise.
10391         (model_merger::get_region_a): Delete.
10392         (model_merger::get_region_b): Delete.
10393         (model_merger::can_merge_values_p): Delete.
10394         (model_merger::record_regions): Delete.
10395         (model_merger::record_svalues): Delete.
10396         (model_merger::m_point): New field.
10397         (model_merger::m_map_regions_from_a_to_m): Delete.
10398         (model_merger::m_map_regions_from_b_to_m): Delete.
10399         (model_merger::m_sid_mapping): Delete.
10400         (struct svalue_id_merger_mapping): Delete.
10401         (class engine): New.
10402         (struct canonicalization): Delete.
10403         (inchash::add): Delete decls for hashing svalue_id and region_id.
10404         (test_region_model_context::on_unexpected_tree_code): Require t to
10405         be non-NULL.
10406         (selftest::assert_condition): Add overload comparing a pair of
10407         const svalue *.
10408         * sm-file.cc: Include "tristate.h", "selftest.h",
10409         "analyzer/call-string.h", "analyzer/program-point.h",
10410         "analyzer/store.h", and "analyzer/region-model.h".
10411         (fileptr_state_machine::get_default_state): New.
10412         (fileptr_state_machine::on_stmt): Remove calls to
10413         get_readable_tree in favor of get_diagnostic_tree.
10414         * sm-malloc.cc: Include "tristate.h", "selftest.h",
10415         "analyzer/call-string.h", "analyzer/program-point.h",
10416         "analyzer/store.h", and "analyzer/region-model.h".
10417         (malloc_state_machine::get_default_state): New.
10418         (malloc_state_machine::reset_when_passed_to_unknown_fn_p): New.
10419         (malloc_diagnostic::describe_state_change): Handle change.m_expr
10420         being NULL.
10421         (null_arg::emit): Avoid printing "NULL '0'".
10422         (null_arg::describe_final_event): Avoid printing "(0) NULL".
10423         (malloc_leak::emit): Handle m_arg being NULL.
10424         (malloc_leak::describe_final_event): Handle ev.m_expr being NULL.
10425         (malloc_state_machine::on_stmt): Don't call get_readable_tree.
10426         Call get_diagnostic_tree when creating pending diagnostics.
10427         Update for is_zero_assignment becoming a member function of
10428         sm_ctxt.
10429         Don't transition to m_non_heap for ADDR_EXPR(MEM_REF()).
10430         (malloc_state_machine::reset_when_passed_to_unknown_fn_p): New
10431         vfunc implementation.
10432         * sm-sensitive.cc (sensitive_state_machine::warn_for_any_exposure): Call
10433         get_diagnostic_tree and pass the result to warn_for_state.
10434         * sm-signal.cc: Move includes of "analyzer/call-string.h" and
10435         "analyzer/program-point.h" to before "analyzer/region-model.h",
10436         and also include "analyzer/store.h" before it.
10437         (signal_unsafe_call::describe_state_change): Use
10438         get_dest_function to get handler.
10439         (update_model_for_signal_handler): Pass manager to region_model
10440         ctor.
10441         (register_signal_handler::impl_transition): Update for changes to
10442         get_or_create_node and add_edge.
10443         * sm-taint.cc (taint_state_machine::on_stmt): Remove calls to
10444         get_readable_tree, replacing them when calling warn_for_state with
10445         calls to get_diagnostic_tree.
10446         * sm.cc (is_zero_assignment): Delete.
10447         (any_pointer_p): Move to within namespace ana.
10448         * sm.h (is_zero_assignment): Remove decl.
10449         (any_pointer_p): Move decl to within namespace ana.
10450         (state_machine::get_default_state): New vfunc.
10451         (state_machine::reset_when_passed_to_unknown_fn_p): New vfunc.
10452         (sm_context::get_readable_tree): Rename to...
10453         (sm_context::get_diagnostic_tree): ...this.
10454         (sm_context::is_zero_assignment): New vfunc.
10455         * store.cc: New file.
10456         * store.h: New file.
10457         * svalue.cc: New file.
10458
10459 2020-05-22  Mark Wielaard  <mark@klomp.org>
10460
10461         * sm-signal.cc(signal_unsafe_call::emit): Possibly add
10462         gcc_rich_location note for replacement.
10463         (signal_unsafe_call::get_replacement_fn): New private function.
10464         (get_async_signal_unsafe_fns): Add "exit".
10465
10466 2020-04-28  David Malcolm  <dmalcolm@redhat.com>
10467
10468         PR analyzer/94816
10469         * engine.cc (impl_region_model_context::on_unexpected_tree_code):
10470         Handle NULL tree.
10471         * region-model.cc (region_model::add_region_for_type): Handle
10472         NULL type.
10473         * region-model.h
10474         (test_region_model_context::on_unexpected_tree_code): Handle NULL
10475         tree.
10476
10477 2020-04-28  David Malcolm  <dmalcolm@redhat.com>
10478
10479         PR analyzer/94447
10480         PR analyzer/94639
10481         PR analyzer/94732
10482         PR analyzer/94754
10483         * analyzer.opt (Wanalyzer-use-of-uninitialized-value): Delete.
10484         * program-state.cc (selftest::test_program_state_dumping): Update
10485         expected dump result for removal of "uninit".
10486         * region-model.cc (poison_kind_to_str): Delete POISON_KIND_UNINIT
10487         case.
10488         (root_region::ensure_stack_region): Initialize stack with null
10489         svalue_id rather than with a typeless POISON_KIND_UNINIT value.
10490         (root_region::ensure_heap_region): Likewise for the heap.
10491         (region_model::dump_summary_of_rep_path_vars): Remove
10492         summarization of uninit values.
10493         (region_model::validate): Remove check that the stack has a
10494         POISON_KIND_UNINIT value.
10495         (poisoned_value_diagnostic::emit): Remove POISON_KIND_UNINIT
10496         case.
10497         (poisoned_value_diagnostic::describe_final_event): Likewise.
10498         (selftest::test_dump): Update expected dump result for removal of
10499         "uninit".
10500         (selftest::test_svalue_equality): Remove "uninit" and "freed".
10501         * region-model.h (enum poison_kind): Remove POISON_KIND_UNINIT.
10502
10503 2020-04-01  David Malcolm  <dmalcolm@redhat.com>
10504
10505         PR analyzer/94378
10506         * checker-path.cc: Include "bitmap.h".
10507         * constraint-manager.cc: Likewise.
10508         * diagnostic-manager.cc: Likewise.
10509         * engine.cc: Likewise.
10510         (exploded_node::detect_leaks): Pass null region_id to pop_frame.
10511         * program-point.cc: Include "bitmap.h".
10512         * program-state.cc: Likewise.
10513         * region-model.cc (id_set<region_id>::id_set): Convert to...
10514         (region_id_set::region_id_set): ...this.
10515         (svalue_id_set::svalue_id_set): New ctor.
10516         (region_model::copy_region): New function.
10517         (region_model::copy_struct_region): New function.
10518         (region_model::copy_union_region): New function.
10519         (region_model::copy_array_region): New function.
10520         (stack_region::pop_frame): Drop return value.  Add
10521         "result_dst_rid" param; if it is non-null, use copy_region to copy
10522         the result to it.  Rather than capture and pass a single "known
10523         used" return value to be used by purge_unused_values, instead
10524         gather and pass a set of known used return values.
10525         (root_region::pop_frame): Drop return value.  Add "result_dst_rid"
10526         param.
10527         (region_model::on_assignment): Use copy_region.
10528         (region_model::on_return): Likewise for the result.
10529         (region_model::on_longjmp): Pass null for pop_frame's
10530         result_dst_rid.
10531         (region_model::update_for_return_superedge): Pass the region for the
10532         return value of the call, if any, to pop_frame, rather than setting
10533         the lvalue for the lhs of the result.
10534         (region_model::pop_frame): Drop return value.  Add
10535         "result_dst_rid" param.
10536         (region_model::purge_unused_svalues): Convert third param from an
10537         svalue_id * to an svalue_id_set *, updating the initial populating
10538         of the "used" bitmap accordingly.  Don't remap it when done.
10539         (struct selftest::coord_test): New selftest fixture, extracted from...
10540         (selftest::test_dump_2): ...here.
10541         (selftest::test_compound_assignment): New selftest.
10542         (selftest::test_stack_frames): Pass null to new param of pop_frame.
10543         (selftest::analyzer_region_model_cc_tests): Call the new selftest.
10544         * region-model.h (class id_set): Delete template.
10545         (class region_id_set): Reimplement, using old id_set implementation.
10546         (class svalue_id_set): Likewise.  Convert from auto_sbitmap to
10547         auto_bitmap.
10548         (region::get_active_view): New accessor.
10549         (stack_region::pop_frame): Drop return value.  Add
10550         "result_dst_rid" param.
10551         (root_region::pop_frame): Likewise.
10552         (region_model::pop_frame): Likewise.
10553         (region_model::copy_region): New decl.
10554         (region_model::purge_unused_svalues): Convert third param from an
10555         svalue_id * to an svalue_id_set *.
10556         (region_model::copy_struct_region): New decl.
10557         (region_model::copy_union_region): New decl.
10558         (region_model::copy_array_region): New decl.
10559
10560 2020-03-27  David Malcolm  <dmalcolm@redhat.com>
10561
10562         * program-state.cc (selftest::test_program_state_dumping): Update
10563         expected dump to include symbolic_region's possibly_null field.
10564         * region-model.cc (symbolic_region::print_fields): New vfunc
10565         implementation.
10566         (region_model::add_constraint): Clear m_possibly_null from
10567         symbolic_regions now known to be non-NULL.
10568         (selftest::test_malloc_constraints): New selftest.
10569         (selftest::analyzer_region_model_cc_tests): Call it.
10570         * region-model.h (region::dyn_cast_symbolic_region): Add non-const
10571         overload.
10572         (symbolic_region::dyn_cast_symbolic_region): Implement it.
10573         (symbolic_region::print_fields): New vfunc override decl.
10574
10575 2020-03-27  David Malcolm  <dmalcolm@redhat.com>
10576
10577         * analyzer.h (class feasibility_problem): New forward decl.
10578         * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic):
10579         Initialize new fields m_status, m_epath_length, and m_problem.
10580         (saved_diagnostic::~saved_diagnostic): Delete m_problem.
10581         (dedupe_candidate::dedupe_candidate): Convert "sd" param from a
10582         const ref to a mutable ptr.
10583         (dedupe_winners::add): Convert "sd" param from a const ref to a
10584         mutable ptr.  Record the length of the exploded_path.  Record the
10585         feasibility/infeasibility of sd into sd, capturing a
10586         feasibility_problem when feasible_p fails, and storing it in sd.
10587         (diagnostic_manager::emit_saved_diagnostics): Update for pass by
10588         ptr rather than by const ref.
10589         * diagnostic-manager.h (class saved_diagnostic): Add new enum
10590         status.  Add fields m_status, m_epath_length and m_problem.
10591         (saved_diagnostic::set_feasible): New member function.
10592         (saved_diagnostic::set_infeasible): New member function.
10593         (saved_diagnostic::get_feasibility_problem): New accessor.
10594         (saved_diagnostic::get_status): New accessor.
10595         (saved_diagnostic::set_epath_length): New member function.
10596         (saved_diagnostic::get_epath_length): New accessor.
10597         * engine.cc: Include "gimple-pretty-print.h".
10598         (exploded_path::feasible_p): Add OUT param and, if non-NULL, write
10599         a new feasibility_problem to it on failure.
10600         (viz_callgraph_node::dump_dot): Convert begin_tr calls to
10601         begin_trtd.  Convert end_tr calls to end_tdtr.
10602         (class exploded_graph_annotator): New subclass of dot_annotator.
10603         (impl_run_checkers): Add a second -fdump-analyzer-supergraph dump
10604         after the analysis runs, using exploded_graph_annotator. dumping
10605         to DUMP_BASE_NAME.supergraph-eg.dot.
10606         * exploded-graph.h (exploded_node::get_dot_fillcolor): Make
10607         public.
10608         (exploded_path::feasible_p): Add OUT param.
10609         (class feasibility_problem): New class.
10610         * state-purge.cc (state_purge_annotator::add_node_annotations):
10611         Return a bool, add a "within_table" param.
10612         (print_vec_of_names): Convert begin_tr calls to begin_trtd.
10613         Convert end_tr calls to end_tdtr.
10614         (state_purge_annotator::add_stmt_annotations): Add "within_row"
10615         param.
10616         * state-purge.h ((state_purge_annotator::add_node_annotations):
10617         Return a bool, add a "within_table" param.
10618         (state_purge_annotator::add_stmt_annotations): Add "within_row"
10619         param.
10620         * supergraph.cc (supernode::dump_dot): Call add_node_annotations
10621         twice: as before, passing false for "within_table", then again
10622         with true when within the TABLE element.  Convert some begin_tr
10623         calls to begin_trtd, and some end_tr calls to end_tdtr.
10624         Repeat each add_stmt_annotations call, distinguishing between
10625         calls that add TRs and those that add TDs to an existing TR.
10626         Add a call to add_after_node_annotations.
10627         * supergraph.h (dot_annotator::add_node_annotations): Add a
10628         "within_table" param.
10629         (dot_annotator::add_stmt_annotations): Add a "within_row" param.
10630         (dot_annotator::add_after_node_annotations): New vfunc.
10631
10632 2020-03-27  David Malcolm  <dmalcolm@redhat.com>
10633
10634         * diagnostic-manager.cc (dedupe_winners::add): Show the
10635         exploded_node index in the log messages.
10636         (diagnostic_manager::emit_saved_diagnostics): Log a summary of
10637         m_saved_diagnostics at entry.
10638
10639 2020-03-27  David Malcolm  <dmalcolm@redhat.com>
10640
10641         * supergraph.cc (superedge::dump): Add space before description;
10642         move newline to non-pretty_printer overload.
10643
10644 2020-03-18  David Malcolm  <dmalcolm@redhat.com>
10645
10646         * region-model.cc: Include "stor-layout.h".
10647         (region_model::dump_to_pp): Rather than calling
10648         dump_summary_of_map on each of the current frame and the globals,
10649         instead get a vec of representative path_vars for all regions,
10650         and then dump a summary of all of them.
10651         (region_model::dump_summary_of_map): Delete, rewriting into...
10652         (region_model::dump_summary_of_rep_path_vars): ...this new
10653         function, working on a vec of path_vars.
10654         (region_model::set_value): New overload.
10655         (region_model::get_representative_path_var): Rename
10656         "parent_region" local to "parent_reg" and consolidate with other
10657         local.  Guard test for grandparent being stack on parent_reg being
10658         non-NULL.  Move handling for parent being an array_region to
10659         within guard for parent_reg being non-NULL.
10660         (selftest::make_test_compound_type): New function.
10661         (selftest::test_dump_2): New selftest.
10662         (selftest::test_dump_3): New selftest.
10663         (selftest::test_stack_frames): Update expected output from
10664         simplified dump to show "a" and "b" from parent frame and "y" in
10665         child frame.
10666         (selftest::analyzer_region_model_cc_tests): Call test_dump_2 and
10667         test_dump_3.
10668         * region-model.h (region_model::set_value): New overload decl.
10669         (region_model::dump_summary_of_map): Delete.
10670         (region_model::dump_summary_of_rep_path_vars): New.
10671
10672 2020-03-18  David Malcolm  <dmalcolm@redhat.com>
10673
10674         * region-model.h (class noop_region_model_context): New subclass
10675         of region_model_context.
10676         (class tentative_region_model_context): Inherit from
10677         noop_region_model_context rather than from region_model_context;
10678         drop redundant vfunc implementations.
10679         (class test_region_model_context): Likewise.
10680
10681 2020-03-18  David Malcolm  <dmalcolm@redhat.com>
10682
10683         * engine.cc (exploded_node::exploded_node): Move implementation
10684         here from header; accept point_and_state by const reference rather
10685         than by value.
10686         * exploded-graph.h (exploded_node::exploded_node): Pass
10687         point_and_state by const reference rather than by value.  Move
10688         body to engine.cc.
10689
10690 2020-03-18  Jakub Jelinek  <jakub@redhat.com>
10691
10692         * sm-malloc.cc (malloc_state_machine::on_stmt): Fix up duplicated word
10693         issue in a comment.
10694         * region-model.cc (region_model::make_region_for_unexpected_tree_code,
10695         region_model::delete_region_and_descendents): Likewise.
10696         * engine.cc (class exploded_cluster): Likewise.
10697         * diagnostic-manager.cc (class path_builder): Likewise.
10698
10699 2020-03-13  David Malcolm  <dmalcolm@redhat.com>
10700
10701         PR analyzer/94099
10702         PR analyzer/94105
10703         * diagnostic-manager.cc (for_each_state_change): Bulletproof
10704         against errors in get_rvalue by passing a
10705         tentative_region_model_context and rejecting if there's an error.
10706         * region-model.cc (region_model::get_lvalue_1): When handling
10707         ARRAY_REF, handle results of error-handling.  Handle NOP_EXPR.
10708
10709 2020-03-06  David Malcolm  <dmalcolm@redhat.com>
10710
10711         * analyzer.h (class array_region): New forward decl.
10712         * program-state.cc (selftest::test_program_state_dumping_2): New.
10713         (selftest::analyzer_program_state_cc_tests): Call it.
10714         * region-model.cc (array_region::constant_from_key): New.
10715         (region_model::get_representative_tree): Handle region_svalue by
10716         generating an ADDR_EXPR.
10717         (region_model::get_representative_path_var): In view handling,
10718         remove erroneous TREE_TYPE when determining the type of the tree.
10719         Handle array regions and STRING_CST.
10720         (selftest::assert_dump_tree_eq): New.
10721         (ASSERT_DUMP_TREE_EQ): New macro.
10722         (selftest::test_get_representative_tree): New selftest.
10723         (selftest::analyzer_region_model_cc_tests): Call it.
10724         * region-model.h (region::dyn_cast_array_region): New vfunc.
10725         (array_region::dyn_cast_array_region): New vfunc implementation.
10726         (array_region::constant_from_key): New decl.
10727
10728 2020-03-06  David Malcolm  <dmalcolm@redhat.com>
10729
10730         * analyzer.h (dump_quoted_tree): New decl.
10731         * engine.cc (exploded_node::dump_dot): Pass region model to
10732         sm_state_map::print.
10733         * program-state.cc: Include diagnostic-core.h.
10734         (sm_state_map::print): Add "model" param and use it to print
10735         representative trees.  Only print origin information if non-null.
10736         (sm_state_map::dump): Pass NULL for model to print call.
10737         (program_state::print): Pass region model to sm_state_map::print.
10738         (program_state::dump_to_pp): Use spaces rather than newlines when
10739         summarizing.  Pass region_model to sm_state_map::print.
10740         (ana::selftest::assert_dump_eq): New function.
10741         (ASSERT_DUMP_EQ): New macro.
10742         (ana::selftest::test_program_state_dumping): New function.
10743         (ana::selftest::analyzer_program_state_cc_tests): Call it.
10744         * program-state.h (program_state::print): Add model param.
10745         * region-model.cc (dump_quoted_tree): New function.
10746         (map_region::print_fields): Use dump_quoted_tree rather than
10747         %qE to avoid lang-dependent output.
10748         (map_region::dump_child_label): Likewise.
10749         (region_model::dump_summary_of_map): For SK_REGION, when
10750         get_representative_path_var fails, print the region id rather than
10751         erroneously printing NULL.
10752         * sm.cc (state_machine::get_state_by_name): New function.
10753         * sm.h (state_machine::get_state_by_name): New decl.
10754
10755 2020-03-04  David Malcolm  <dmalcolm@redhat.com>
10756
10757         * region-model.cc (region::validate): Convert model param from ptr
10758         to reference.  Update comment to reflect that it's now a vfunc.
10759         (map_region::validate): New vfunc implementation.
10760         (array_region::validate): New vfunc implementation.
10761         (stack_region::validate): New vfunc implementation.
10762         (root_region::validate): New vfunc implementation.
10763         (region_model::validate): Pass a reference rather than a pointer
10764         to the region::validate vfunc.
10765         * region-model.h (region::validate): Make virtual.  Convert model
10766         param from ptr to reference.
10767         (map_region::validate): New vfunc decl.
10768         (array_region::validate): New vfunc decl.
10769         (stack_region::validate): New vfunc decl.
10770         (root_region::validate): New vfunc decl.
10771
10772 2020-03-04  David Malcolm  <dmalcolm@redhat.com>
10773
10774         PR analyzer/93993
10775         * region-model.cc (region_model::on_call_pre): Handle
10776         BUILT_IN_EXPECT and its variants.
10777         (region_model::add_any_constraints_from_ssa_def_stmt): Split out
10778         gassign handling into add_any_constraints_from_gassign; add gcall
10779         handling.
10780         (region_model::add_any_constraints_from_gassign): New function,
10781         based on the above.  Add handling for NOP_EXPR.
10782         (region_model::add_any_constraints_from_gcall): New function.
10783         (region_model::get_representative_path_var): Handle views.
10784         * region-model.h
10785         (region_model::add_any_constraints_from_ssa_def_stmt): New decl.
10786         (region_model::add_any_constraints_from_gassign): New decl.
10787
10788 2020-03-04  David Malcolm  <dmalcolm@redhat.com>
10789
10790         PR analyzer/93993
10791         * checker-path.h (state_change_event::get_lvalue): Add ctxt param
10792         and pass it to region_model::get_value call.
10793         * diagnostic-manager.cc (get_any_origin): Pass a
10794         tentative_region_model_context to the calls to get_lvalue and reject
10795         the comparison if errors occur.
10796         (can_be_expr_of_interest_p): New function.
10797         (diagnostic_manager::prune_for_sm_diagnostic): Replace checks for
10798         CONSTANT_CLASS_P with calls to update_for_unsuitable_sm_exprs.
10799         Pass a tentative_region_model_context to the calls to
10800         state_change_event::get_lvalue and reject the comparison if errors
10801         occur.
10802         (diagnostic_manager::update_for_unsuitable_sm_exprs): New.
10803         * diagnostic-manager.h
10804         (diagnostic_manager::update_for_unsuitable_sm_exprs): New decl.
10805         * region-model.h (class tentative_region_model_context): New class.
10806
10807 2020-03-04  David Malcolm  <dmalcolm@redhat.com>
10808
10809         * engine.cc (worklist::worklist): Remove unused field m_eg.
10810         (class viz_callgraph_edge): Remove unused field m_call_sedge.
10811         (class viz_callgraph): Remove unused field m_sg.
10812         * exploded-graph.h (worklist::::m_eg): Remove unused field.
10813
10814 2020-03-02  David Malcolm  <dmalcolm@redhat.com>
10815
10816         * analyzer.opt (fanalyzer-show-duplicate-count): New option.
10817         * diagnostic-manager.cc
10818         (diagnostic_manager::emit_saved_diagnostic): Use the above to
10819         guard the printing of the duplicate count.
10820
10821 2020-03-02  David Malcolm  <dmalcolm@redhat.com>
10822
10823         PR analyzer/93959
10824         * analyzer.cc (is_std_function_p): New function.
10825         (is_std_named_call_p): New functions.
10826         * analyzer.h (is_std_named_call_p): New decl.
10827         * sm-malloc.cc (malloc_state_machine::on_stmt): Check for "std::"
10828         variants when checking for malloc, calloc and free.
10829
10830 2020-02-26  David Malcolm  <dmalcolm@redhat.com>
10831
10832         PR analyzer/93950
10833         * diagnostic-manager.cc
10834         (diagnostic_manager::prune_for_sm_diagnostic): Assert that var is
10835         either NULL or not a constant.  When updating var, bulletproof
10836         against constant values.
10837
10838 2020-02-26  David Malcolm  <dmalcolm@redhat.com>
10839
10840         PR analyzer/93947
10841         * region-model.cc (region_model::get_fndecl_for_call): Gracefully
10842         fail for fn_decls that don't have a cgraph_node.
10843
10844 2020-02-26  David Malcolm  <dmalcolm@redhat.com>
10845
10846         * bar-chart.cc: New file.
10847         * bar-chart.h: New file.
10848         * engine.cc: Include "analyzer/bar-chart.h".
10849         (stats::log): Only log the m_num_nodes kinds that are non-zero.
10850         (stats::dump): Likewise when dumping.
10851         (stats::get_total_enodes): New.
10852         (exploded_graph::get_or_create_node): Increment the per-point-data
10853         m_excess_enodes when hitting the per-program-point limit on
10854         enodes.
10855         (exploded_graph::print_bar_charts): New.
10856         (exploded_graph::log_stats): Log the number of unprocessed enodes
10857         in the worklist.  Call print_bar_charts.
10858         (exploded_graph::dump_stats): Print the number of unprocessed
10859         enodes in the worklist.
10860         * exploded-graph.h (stats::get_total_enodes): New decl.
10861         (struct per_program_point_data): Add field m_excess_enodes.
10862         (exploded_graph::print_bar_charts): New decl.
10863         * supergraph.cc (superedge::dump): New.
10864         (superedge::dump): New.
10865         * supergraph.h (supernode::get_function): New.
10866         (superedge::dump): New decl.
10867         (superedge::dump): New decl.
10868
10869 2020-02-24  David Malcolm  <dmalcolm@redhat.com>
10870
10871         * engine.cc (exploded_graph::get_or_create_node): Dump the
10872         program_state to the pp, rather than to stderr.
10873
10874 2020-02-24  David Malcolm  <dmalcolm@redhat.com>
10875
10876         PR analyzer/93032
10877         * sm.cc (make_checkers): Require the "taint" checker to be
10878         explicitly enabled.
10879
10880 2020-02-24  David Malcolm  <dmalcolm@redhat.com>
10881
10882         PR analyzer/93899
10883         * engine.cc
10884         (impl_region_model_context::impl_region_model_context): Add logger
10885         param.
10886         * engine.cc (exploded_graph::add_function_entry): Create an
10887         impl_region_model_context and pass it to the push_frame call.
10888         Bail if the resulting state is invalid.
10889         (exploded_graph::build_initial_worklist): Likewise.
10890         (exploded_graph::build_initial_worklist): Handle the case where
10891         add_function_entry fails.
10892         * exploded-graph.h
10893         (impl_region_model_context::impl_region_model_context): Add logger
10894         param.
10895         * region-model.cc (map_region::get_or_create): Add ctxt param and
10896         pass it to add_region_for_type.
10897         (map_region::can_merge_p): Pass NULL as a ctxt to call to
10898         get_or_create.
10899         (array_region::get_element): Pass ctxt to call to get_or_create.
10900         (array_region::get_or_create): Add ctxt param and pass it to
10901         add_region_for_type.
10902         (root_region::push_frame): Pass ctxt to get_or_create calls.
10903         (region_model::get_lvalue_1): Likewise.
10904         (region_model::make_region_for_unexpected_tree_code): Assert that
10905         ctxt is non-NULL.
10906         (region_model::get_rvalue_1): Pass ctxt to get_svalue_for_fndecl
10907         and get_svalue_for_label calls.
10908         (region_model::get_svalue_for_fndecl): Add ctxt param and pass it
10909         to get_region_for_fndecl.
10910         (region_model::get_region_for_fndecl): Add ctxt param and pass it
10911         to get_or_create.
10912         (region_model::get_svalue_for_label): Add ctxt param and pass it
10913         to get_region_for_label.
10914         (region_model::get_region_for_label): Add ctxt param and pass it
10915         to get_region_for_fndecl and get_or_create.
10916         (region_model::get_field_region): Add ctxt param and pass it to
10917         get_or_create_view and get_or_create.
10918         (make_region_for_type): Replace gcc_unreachable with return NULL.
10919         (region_model::add_region_for_type): Add ctxt param.  Handle a
10920         return of NULL from make_region_for_type by calling
10921         make_region_for_unexpected_tree_code.
10922         (region_model::get_or_create_mem_ref): Pass ctxt to calls to
10923         get_or_create_view.
10924         (region_model::get_or_create_view): Add ctxt param and pass it to
10925         add_region_for_type.
10926         (selftest::test_state_merging): Pass ctxt to get_or_create_view.
10927         * region-model.h (region_model::get_or_create): Add ctxt param.
10928         (region_model::add_region_for_type): Likewise.
10929         (region_model::get_svalue_for_fndecl): Likewise.
10930         (region_model::get_svalue_for_label): Likewise.
10931         (region_model::get_region_for_fndecl): Likewise.
10932         (region_model::get_region_for_label): Likewise.
10933         (region_model::get_field_region): Likewise.
10934         (region_model::get_or_create_view): Likewise.
10935
10936 2020-02-24  David Malcolm  <dmalcolm@redhat.com>
10937
10938         * checker-path.cc (superedge_event::should_filter_p): Update
10939         filter for empty descriptions to cover verbosity level 3 as well
10940         as 2.
10941         * diagnostic-manager.cc: Include "analyzer/reachability.h".
10942         (class path_builder): New class.
10943         (diagnostic_manager::emit_saved_diagnostic): Create a path_builder
10944         and pass it to build_emission_path, rather passing eg; similarly
10945         for add_events_for_eedge and ext_state.
10946         (diagnostic_manager::build_emission_path): Replace "eg" param
10947         with a path_builder, pass it to add_events_for_eedge.
10948         (diagnostic_manager::add_events_for_eedge): Replace ext_state
10949         param with path_builder; pass it to add_events_for_superedge.
10950         (diagnostic_manager::significant_edge_p): New.
10951         (diagnostic_manager::add_events_for_superedge): Add path_builder
10952         param.  Reject insignificant edges at verbosity levels below 3.
10953         (diagnostic_manager::prune_for_sm_diagnostic): Update highest
10954         verbosity level to 4.
10955         * diagnostic-manager.h (class path_builder): New forward decl.
10956         (diagnostic_manager::build_emission_path): Replace "eg" param
10957         with a path_builder.
10958         (diagnostic_manager::add_events_for_eedge): Replace ext_state
10959         param with path_builder.
10960         (diagnostic_manager::significant_edge_p): New.
10961         (diagnostic_manager::add_events_for_superedge): Add path_builder
10962         param.
10963         * reachability.h: New file.
10964
10965 2020-02-18  David Malcolm  <dmalcolm@redhat.com>
10966
10967         PR analyzer/93692
10968         * analyzer.opt (fdump-analyzer-callgraph): Rewrite description.
10969
10970 2020-02-18  David Malcolm  <dmalcolm@redhat.com>
10971
10972         PR analyzer/93777
10973         * region-model.cc (region_model::maybe_cast_1): Replace assertion
10974         that build_cast returns non-NULL with a conditional, falling
10975         through to the logic which returns a new unknown value of the
10976         desired type if it fails.
10977
10978 2020-02-18  David Malcolm  <dmalcolm@redhat.com>
10979
10980         PR analyzer/93778
10981         * engine.cc (impl_region_model_context::on_unknown_tree_code):
10982         Rename to...
10983         (impl_region_model_context::on_unexpected_tree_code): ...this and
10984         convert first argument from path_var to tree.
10985         (exploded_node::on_stmt): Pass ctxt to purge_for_unknown_fncall.
10986         * exploded-graph.h (region_model_context::on_unknown_tree_code):
10987         Rename to...
10988         (region_model_context::on_unexpected_tree_code): ...this and
10989         convert first argument from path_var to tree.
10990         * program-state.cc (sm_state_map::purge_for_unknown_fncall): Add
10991         ctxt param and pass on to calls to get_rvalue.
10992         * program-state.h (sm_state_map::purge_for_unknown_fncall): Add
10993         ctxt param.
10994         * region-model.cc (region_model::handle_unrecognized_call): Pass
10995         ctxt on to call to get_rvalue.
10996         (region_model::get_lvalue_1): Move body of default case to
10997         region_model::make_region_for_unexpected_tree_code and call it.
10998         Within COMPONENT_REF case, reject attempts to handle types other
10999         than RECORD_TYPE and UNION_TYPE.
11000         (region_model::make_region_for_unexpected_tree_code): New
11001         function, based on default case of region_model::get_lvalue_1.
11002         * region-model.h
11003         (region_model::make_region_for_unexpected_tree_code): New decl.
11004         (region_model::on_unknown_tree_code): Rename to...
11005         (region_model::on_unexpected_tree_code): ...this and convert first
11006         argument from path_var to tree.
11007         (class test_region_model_context): Update vfunc implementation for
11008         above change.
11009
11010 2020-02-18  David Malcolm  <dmalcolm@redhat.com>
11011
11012         PR analyzer/93774
11013         * region-model.cc
11014         (region_model::convert_byte_offset_to_array_index): Use
11015         int_size_in_bytes before calling size_in_bytes, to gracefully fail
11016         on incomplete types.
11017
11018 2020-02-17  David Malcolm  <dmalcolm@redhat.com>
11019
11020         PR analyzer/93775
11021         * region-model.cc (region_model::get_fndecl_for_call): Handle the
11022         case where the code_region's get_tree_for_child_region returns
11023         NULL.
11024
11025 2020-02-17  David Malcolm  <dmalcolm@redhat.com>
11026
11027         PR analyzer/93388
11028         * engine.cc (impl_region_model_context::on_unknown_tree_code):
11029         New.
11030         (exploded_graph::get_or_create_node): Reject invalid states.
11031         * exploded-graph.h
11032         (impl_region_model_context::on_unknown_tree_code): New decl.
11033         (point_and_state::point_and_state): Assert that the state is
11034         valid.
11035         * program-state.cc (program_state::program_state): Initialize
11036         m_valid to true.
11037         (program_state::operator=): Copy m_valid.
11038         (program_state::program_state): Likewise for move constructor.
11039         (program_state::print): Print m_valid.
11040         (program_state::dump_to_pp): Likewise.
11041         * program-state.h (program_state::m_valid): New field.
11042         * region-model.cc (region_model::get_lvalue_1): Implement the
11043         default case by returning a new symbolic region and calling
11044         the context's on_unknown_tree_code, rather than issuing an
11045         internal_error.  Implement VIEW_CONVERT_EXPR.
11046         * region-model.h (region_model_context::on_unknown_tree_code): New
11047         vfunc.
11048         (test_region_model_context::on_unknown_tree_code): New.
11049
11050 2020-02-17  David Malcolm  <dmalcolm@redhat.com>
11051
11052         * sm-malloc.cc (malloc_diagnostic::describe_state_change): For
11053         transition to the "null" state, only say "assuming" when
11054         transitioning from the "unchecked" state.
11055
11056 2020-02-17  David Malcolm  <dmalcolm@redhat.com>
11057
11058         * diagnostic-manager.h (diagnostic_manager::get_saved_diagnostic):
11059         Add const overload.
11060         * engine.cc (exploded_node::dump_dot): Dump saved_diagnostics.
11061         * exploded-graph.h (exploded_graph::get_diagnostic_manager): Add
11062         const overload.
11063
11064 2020-02-11  David Malcolm  <dmalcolm@redhat.com>
11065
11066         PR analyzer/93288
11067         * analysis-plan.cc (analysis_plan::use_summary_p): Look through
11068         the ultimate_alias_target when getting the called function.
11069         * engine.cc (exploded_node::on_stmt): Rename second "ctxt" to
11070         "sm_ctxt".  Use the region_model's get_fndecl_for_call rather than
11071         gimple_call_fndecl.
11072         * region-model.cc (region_model::get_fndecl_for_call): Use
11073         ultimate_alias_target on fndecl.
11074         * supergraph.cc (get_ultimate_function_for_cgraph_edge): New
11075         function.
11076         (supergraph_call_edge): Use it when rejecting edges without
11077         functions.
11078         (supergraph::supergraph): Use it to get the function for the
11079         cgraph_edge when building interprocedural superedges.
11080         (callgraph_superedge::get_callee_function):  Use it.
11081         * supergraph.h (supergraph::get_num_snodes): Make param const.
11082         (supergraph::function_to_num_snodes_t): Make first type param
11083         const.
11084
11085 2020-02-11  David Malcolm  <dmalcolm@redhat.com>
11086
11087         PR analyzer/93374
11088         * engine.cc (exploded_edge::exploded_edge): Add ext_state param
11089         and pass it to change.validate.
11090         (exploded_graph::get_or_create_node): Move purging of change
11091         svalues to also cover the case of reusing an existing enode.
11092         (exploded_graph::add_edge): Pass m_ext_state to exploded_edge's
11093         ctor.
11094         * exploded-graph.h (exploded_edge::exploded_edge): Add ext_state
11095         param.
11096         * program-state.cc (state_change::sm_change::validate): Likewise.
11097         Assert that m_sm_idx is sane.  Use ext_state to validate
11098         m_old_state and m_new_state.
11099         (state_change::validate): Add ext_state param and pass it to
11100         the sm_change validate calls.
11101         * program-state.h (state_change::sm_change::validate): Add
11102         ext_state param.
11103         (state_change::validate): Likewise.
11104
11105 2020-02-11  David Malcolm  <dmalcolm@redhat.com>
11106
11107         PR analyzer/93669
11108         * engine.cc (exploded_graph::dump_exploded_nodes): Handle missing
11109         case of STATUS_WORKLIST in implementation of
11110         "__analyzer_dump_exploded_nodes".
11111
11112 2020-02-11  David Malcolm  <dmalcolm@redhat.com>
11113
11114         PR analyzer/93649
11115         * constraint-manager.cc (constraint_manager::add_constraint): When
11116         merging equivalence classes and updating m_constant, also update
11117         m_cst_sid.
11118         (constraint_manager::validate): If m_constant is non-NULL assert
11119         that m_cst_sid is non-null and is valid.
11120
11121 2020-02-11  David Malcolm  <dmalcolm@redhat.com>
11122
11123         PR analyzer/93657
11124         * analyzer.opt (fdump-analyzer): Reword description.
11125         (fdump-analyzer-stderr): Likewise.
11126
11127 2020-02-11  David Malcolm  <dmalcolm@redhat.com>
11128
11129         * region-model.cc (print_quoted_type): New function.
11130         (svalue::print): Use it to replace %qT.
11131         (region::dump_to_pp): Likewise.
11132         (region::dump_child_label): Likewise.
11133         (region::print_fields): Likewise.
11134
11135 2020-02-10  David Malcolm  <dmalcolm@redhat.com>
11136
11137         PR analyzer/93659
11138         * analyzer.opt (-param=analyzer-max-recursion-depth=): Fix "tha"
11139         -> "that" typo.
11140         (Wanalyzer-use-of-uninitialized-value): Fix "initialized" ->
11141         "uninitialized" typo.
11142
11143 2020-02-10  David Malcolm  <dmalcolm@redhat.com>
11144
11145         PR analyzer/93350
11146         * region-model.cc (region_model::get_lvalue_1):
11147         Handle BIT_FIELD_REF.
11148         (make_region_for_type): Handle VECTOR_TYPE.
11149
11150 2020-02-10  David Malcolm  <dmalcolm@redhat.com>
11151
11152         PR analyzer/93647
11153         * diagnostic-manager.cc
11154         (diagnostic_manager::prune_for_sm_diagnostic): Bulletproof against
11155         VAR being constant.
11156         * region-model.cc (region_model::get_lvalue_1): Provide a better
11157         error message when encountering an unhandled tree code.
11158
11159 2020-02-10  David Malcolm  <dmalcolm@redhat.com>
11160
11161         PR analyzer/93405
11162         * region-model.cc (region_model::get_lvalue_1): Implement
11163         CONST_DECL.
11164
11165 2020-02-06  David Malcolm  <dmalcolm@redhat.com>
11166
11167         * region-model.cc (region_model::maybe_cast_1): Attempt to provide
11168         a region_svalue if either type is a pointer, rather than if both
11169         types are pointers.
11170
11171 2020-02-05  David Malcolm  <dmalcolm@redhat.com>
11172
11173         * engine.cc (exploded_node::dump_dot): Show merger enodes.
11174         (worklist::add_node): Assert that the node's m_status is
11175         STATUS_WORKLIST.
11176         (exploded_graph::process_worklist): Likewise for nodes from the
11177         worklist.  Set status of merged nodes to STATUS_MERGER.
11178         (exploded_graph::process_node): Set status of node to
11179         STATUS_PROCESSED.
11180         (exploded_graph::dump_exploded_nodes): Rework handling of
11181         "__analyzer_dump_exploded_nodes", splitting enodes by status into
11182         "processed" and "merger", showing the count of just the processed
11183         enodes at the call, rather than the count of all enodes.
11184         * exploded-graph.h (exploded_node::status): New enum.
11185         (exploded_node::exploded_node): Initialize m_status to
11186         STATUS_WORKLIST.
11187         (exploded_node::get_status): New getter.
11188         (exploded_node::set_status): New setter.
11189
11190 2020-02-04  David Malcolm  <dmalcolm@redhat.com>
11191
11192         PR analyzer/93543
11193         * engine.cc (pod_hash_traits<function_call_string>::mark_empty):
11194         Eliminate reinterpret_cast.
11195         (pod_hash_traits<function_call_string>::is_empty): Likewise.
11196
11197 2020-02-03  David Malcolm  <dmalcolm@redhat.com>
11198
11199         * constraint-manager.cc (range::constrained_to_single_element):
11200         Replace fold_build2 with fold_binary.  Remove unnecessary newline.
11201         (constraint_manager::get_or_add_equiv_class): Replace fold_build2
11202         with fold_binary in two places, and remove out-of-date comment.
11203         (constraint_manager::eval_condition): Replace fold_build2 with
11204         fold_binary.
11205         * region-model.cc (constant_svalue::eval_condition): Likewise.
11206         (region_model::on_assignment): Likewise.
11207
11208 2020-02-03  David Malcolm  <dmalcolm@redhat.com>
11209
11210         PR analyzer/93544
11211         * diagnostic-manager.cc
11212         (diagnostic_manager::prune_for_sm_diagnostic): Bulletproof
11213         against bad choices due to bad paths.
11214         * engine.cc (impl_region_model_context::on_phi): New.
11215         * exploded-graph.h (impl_region_model_context::on_phi): New decl.
11216         * region-model.cc (region_model::on_longjmp): Likewise.
11217         (region_model::handle_phi): Add phi param.  Call the ctxt's on_phi
11218         vfunc.
11219         (region_model::update_for_phis): Pass phi to handle_phi.
11220         * region-model.h (region_model::handle_phi): Add phi param.
11221         (region_model_context::on_phi): New vfunc.
11222         (test_region_model_context::on_phi): New.
11223         * sm-malloc.cc (malloc_state_machine::on_phi): New.
11224         (malloc_state_machine::on_zero_assignment): New.
11225         * sm.h (state_machine::on_phi): New vfunc.
11226
11227 2020-02-03  David Malcolm  <dmalcolm@redhat.com>
11228
11229         * engine.cc (supernode_cluster::dump_dot): Show BB index as
11230         well as SN index.
11231         * supergraph.cc (supernode::dump_dot): Likewise.
11232
11233 2020-02-03  David Malcolm  <dmalcolm@redhat.com>
11234
11235         PR analyzer/93546
11236         * region-model.cc (region_model::on_call_pre): Update for new
11237         param of symbolic_region ctor.
11238         (region_model::deref_rvalue): Likewise.
11239         (region_model::add_new_malloc_region): Likewise.
11240         (make_region_for_type): Likewise, preserving type.
11241         * region-model.h (symbolic_region::symbolic_region): Add "type"
11242         param and pass it to base class ctor.
11243
11244 2020-02-03  David Malcolm  <dmalcolm@redhat.com>
11245
11246         PR analyzer/93547
11247         * constraint-manager.cc
11248         (constraint_manager::get_or_add_equiv_class): Ensure types are
11249         compatible before comparing constants.
11250
11251 2020-01-31  David Malcolm  <dmalcolm@redhat.com>
11252
11253         PR analyzer/93457
11254         * region-model.cc (make_region_for_type): Use VOID_TYPE_P rather
11255         than checking against void_type_node.
11256
11257 2020-01-31  David Malcolm  <dmalcolm@redhat.com>
11258
11259         PR analyzer/93373
11260         * region-model.cc (ASSERT_COMPAT_TYPES): Convert to...
11261         (assert_compat_types): ...this, and bail when either type is NULL,
11262         or when VOID_TYPE_P (dst_type).
11263         (region_model::get_lvalue): Update for above conversion.
11264         (region_model::get_rvalue): Likewise.
11265
11266 2020-01-31  David Malcolm  <dmalcolm@redhat.com>
11267
11268         PR analyzer/93379
11269         * region-model.cc (region_model::update_for_return_superedge):
11270         Move check for null result so that it also guards setting the
11271         lhs.
11272
11273 2020-01-31  David Malcolm  <dmalcolm@redhat.com>
11274
11275         PR analyzer/93438
11276         * region-model.cc (stack_region::can_merge_p): Split into a two
11277         pass approach, creating all stack regions first, then populating
11278         them.
11279         (selftest::test_state_merging): Add test coverage for (a) the case
11280         of self-merging a model in which a local in an older stack frame
11281         points to a local in a more recent stack frame (which previously
11282         would ICE), and (b) the case of self-merging a model in which a
11283         local points to a global (which previously worked OK).
11284
11285 2020-01-31  David Malcolm  <dmalcolm@redhat.com>
11286
11287         * analyzer.cc (is_named_call_p): Replace tests for fndecl being
11288         extern at file scope and having a non-NULL DECL_NAME with a call
11289         to maybe_special_function_p.
11290         * function-set.cc (function_set::contains_decl_p): Add call to
11291         maybe_special_function_p.
11292
11293 2020-01-31  David Malcolm  <dmalcolm@redhat.com>
11294
11295         PR analyzer/93450
11296         * constraint-manager.cc
11297         (constraint_manager::get_or_add_equiv_class): Only compare constants
11298         if their types are compatible.
11299         * region-model.cc (constant_svalue::eval_condition): Replace check
11300         for identical types with call to types_compatible_p.
11301
11302 2020-01-30  David Malcolm  <dmalcolm@redhat.com>
11303
11304         * program-state.cc (extrinsic_state::dump_to_pp): New.
11305         (extrinsic_state::dump_to_file): New.
11306         (extrinsic_state::dump): New.
11307         * program-state.h (extrinsic_state::dump_to_pp): New decl.
11308         (extrinsic_state::dump_to_file): New decl.
11309         (extrinsic_state::dump): New decl.
11310         * sm.cc: Include "pretty-print.h".
11311         (state_machine::dump_to_pp): New.
11312         * sm.h (state_machine::dump_to_pp): New decl.
11313
11314 2020-01-30  David Malcolm  <dmalcolm@redhat.com>
11315
11316         * diagnostic-manager.cc (for_each_state_change): Use
11317         extrinsic_state::get_num_checkers rather than accessing m_checkers
11318         directly.
11319         * program-state.cc (program_state::program_state): Likewise.
11320         * program-state.h (extrinsic_state::m_checkers): Make private.
11321
11322 2020-01-30  David Malcolm  <dmalcolm@redhat.com>
11323
11324         PR analyzer/93356
11325         * region-model.cc (region_model::eval_condition): In both
11326         overloads, bail out immediately on floating-point types.
11327         (region_model::eval_condition_without_cm): Likewise.
11328         (region_model::add_constraint): Likewise.
11329
11330 2020-01-30  David Malcolm  <dmalcolm@redhat.com>
11331
11332         PR analyzer/93450
11333         * program-state.cc (sm_state_map::set_state): For the overload
11334         taking an svalue_id, bail out if the set_state on the ec does
11335         nothing.  Convert the latter's return type from void to bool,
11336         returning true if anything changed.
11337         (sm_state_map::impl_set_state): Convert the return type from void
11338         to bool, returning true if the state changed.
11339         * program-state.h (sm_state_map::set_state): Convert return type
11340         from void to bool.
11341         (sm_state_map::impl_set_state): Likewise.
11342         * region-model.cc (constant_svalue::eval_condition): Only call
11343         fold_build2 if the types are the same.
11344
11345 2020-01-29  Jakub Jelinek  <jakub@redhat.com>
11346
11347         * analyzer.h (PUSH_IGNORE_WFORMAT, POP_IGNORE_WFORMAT): Remove.
11348         * constraint-manager.cc: Include diagnostic-core.h before graphviz.h.
11349         (range::dump, equiv_class::print): Don't use PUSH_IGNORE_WFORMAT or
11350         POP_IGNORE_WFORMAT.
11351         * state-purge.cc: Include diagnostic-core.h before
11352         gimple-pretty-print.h.
11353         (state_purge_annotator::add_node_annotations, print_vec_of_names):
11354         Don't use PUSH_IGNORE_WFORMAT or POP_IGNORE_WFORMAT.
11355         * region-model.cc: Move diagnostic-core.h include before graphviz.h.
11356         (path_var::dump, svalue::print, constant_svalue::print_details,
11357         region::dump_to_pp, region::dump_child_label, region::print_fields,
11358         map_region::print_fields, map_region::dump_dot_to_pp,
11359         map_region::dump_child_label, array_region::print_fields,
11360         array_region::dump_dot_to_pp): Don't use PUSH_IGNORE_WFORMAT or
11361         POP_IGNORE_WFORMAT.
11362
11363 2020-01-28  David Malcolm  <dmalcolm@redhat.com>
11364
11365         PR analyzer/93316
11366         * engine.cc (rewind_info_t::update_model): Get the longjmp call
11367         stmt via get_longjmp_call () rather than assuming it is the last
11368         stmt in the longjmp's supernode.
11369         (rewind_info_t::add_events_to_path): Get the location_t for the
11370         rewind_from_longjmp_event via get_longjmp_call () rather than from
11371         the supernode's get_end_location ().
11372
11373 2020-01-28  David Malcolm  <dmalcolm@redhat.com>
11374
11375         * region-model.cc (poisoned_value_diagnostic::emit): Update for
11376         renaming of warning_at overload to warning_meta.
11377         * sm-file.cc (file_leak::emit): Likewise.
11378         * sm-malloc.cc (double_free::emit): Likewise.
11379         (possible_null_deref::emit): Likewise.
11380         (possible_null_arg::emit): Likewise.
11381         (null_deref::emit): Likewise.
11382         (null_arg::emit): Likewise.
11383         (use_after_free::emit): Likewise.
11384         (malloc_leak::emit): Likewise.
11385         (free_of_non_heap::emit): Likewise.
11386         * sm-sensitive.cc (exposure_through_output_file::emit): Likewise.
11387         * sm-signal.cc (signal_unsafe_call::emit): Likewise.
11388         * sm-taint.cc (tainted_array_index::emit): Likewise.
11389
11390 2020-01-27  David Malcolm  <dmalcolm@redhat.com>
11391
11392         PR analyzer/93451
11393         * region-model.cc (tree_cmp): For the REAL_CST case, impose an
11394         arbitrary order on NaNs relative to other NaNs and to non-NaNs;
11395         const-correctness tweak.
11396         (ana::selftests::build_real_cst_from_string): New function.
11397         (ana::selftests::append_interesting_constants): New function.
11398         (ana::selftests::test_tree_cmp_on_constants): New test.
11399         (ana::selftests::test_canonicalization_4): New test.
11400         (ana::selftests::analyzer_region_model_cc_tests): Call the new
11401         tests.
11402
11403 2020-01-27  David Malcolm  <dmalcolm@redhat.com>
11404
11405         PR analyzer/93349
11406         * engine.cc (run_checkers): Save and restore input_location.
11407
11408 2020-01-27  David Malcolm  <dmalcolm@redhat.com>
11409
11410         * call-string.cc (call_string::cmp_1): Delete, moving body to...
11411         (call_string::cmp): ...here.
11412         * call-string.h (call_string::cmp_1): Delete decl.
11413         * engine.cc (worklist::key_t::cmp_1): Delete, moving body to...
11414         (worklist::key_t::cmp): ...here.  Implement hash comparisons
11415         via comparison rather than subtraction to avoid overflow issues.
11416         * exploded-graph.h (worklist::key_t::cmp_1): Delete decl.
11417         * region-model.cc (tree_cmp): Eliminate buggy checking for
11418         symmetry.
11419
11420 2020-01-27  David Malcolm  <dmalcolm@redhat.com>
11421
11422         * analyzer.cc  (is_named_call_p): Check that fndecl is "extern"
11423         and at file scope.  Potentially disregard prefix _ or __ in
11424         fndecl's name.  Bail if the identifier is NULL.
11425         (is_setjmp_call_p): Expect a gcall rather than plain gimple.
11426         Remove special-case check for leading prefix, and also check for
11427         sigsetjmp.
11428         (is_longjmp_call_p): Also check for siglongjmp.
11429         (get_user_facing_name): New function.
11430         * analyzer.h (is_setjmp_call_p): Expect a gcall rather than plain
11431         gimple.
11432         (get_user_facing_name): New decl.
11433         * checker-path.cc (setjmp_event::get_desc): Use
11434         get_user_facing_name to avoid hardcoding the function name.
11435         (rewind_event::rewind_event): Add rewind_info param, using it to
11436         initialize new m_rewind_info field, and strengthen the assertion.
11437         (rewind_from_longjmp_event::get_desc): Use get_user_facing_name to
11438         avoid hardcoding the function name.
11439         (rewind_to_setjmp_event::get_desc): Likewise.
11440         * checker-path.h (setjmp_event::setjmp_event): Add setjmp_call
11441         param and use it to initialize...
11442         (setjmp_event::m_setjmp_call): New field.
11443         (rewind_event::rewind_event): Add rewind_info param.
11444         (rewind_event::m_rewind_info): New protected field.
11445         (rewind_from_longjmp_event::rewind_from_longjmp_event): Add
11446         rewind_info param.
11447         (class rewind_to_setjmp_event): Move rewind_info field to parent
11448         class.
11449         * diagnostic-manager.cc (diagnostic_manager::add_events_for_eedge):
11450         Update setjmp-handling for is_setjmp_call_p requiring a gcall;
11451         pass the call to the new setjmp_event.
11452         * engine.cc (exploded_node::on_stmt): Update for is_setjmp_call_p
11453         requiring a gcall.
11454         (stale_jmp_buf::emit): Use get_user_facing_name to avoid
11455         hardcoding the function names.
11456         (exploded_node::on_longjmp): Pass the longjmp_call when
11457         constructing rewind_info.
11458         (rewind_info_t::add_events_to_path): Pass the rewind_info_t to the
11459         rewind_from_longjmp_event's ctor.
11460         * exploded-graph.h (rewind_info_t::rewind_info_t): Add
11461         longjmp_call param.
11462         (rewind_info_t::get_longjmp_call): New.
11463         (rewind_info_t::m_longjmp_call): New.
11464         * region-model.cc (region_model::on_setjmp): Update comment to
11465         indicate this is also for sigsetjmp.
11466         * region-model.h (struct setjmp_record): Likewise.
11467         (class setjmp_svalue): Likewise.
11468
11469 2020-01-27  David Malcolm  <dmalcolm@redhat.com>
11470
11471         PR analyzer/93276
11472         * analyzer.h (PUSH_IGNORE_WFORMAT, POP_IGNORE_WFORMAT): Guard these
11473         macros with GCC_VERSION >= 4006, making them no-op otherwise.
11474         * engine.cc (exploded_edge::exploded_edge): Specify template for
11475         base class initializer.
11476         (exploded_graph::add_edge): Specify template when chaining up to
11477         base class add_edge implementation.
11478         (viz_callgraph_node::dump_dot): Drop redundant "typename".
11479         (viz_callgraph_edge::viz_callgraph_edge): Specify template for
11480         base class initializer.
11481         * program-state.cc (sm_state_map::clone_with_remapping): Drop
11482         redundant "typename".
11483         (sm_state_map::print): Likewise.
11484         (sm_state_map::hash): Likewise.
11485         (sm_state_map::operator==): Likewise.
11486         (sm_state_map::remap_svalue_ids): Likewise.
11487         (sm_state_map::on_svalue_purge): Likewise.
11488         (sm_state_map::validate): Likewise.
11489         * program-state.h (sm_state_map::iterator_t): Likewise.
11490         * supergraph.h (superedge::superedge): Specify template for base
11491         class initializer.
11492
11493 2020-01-23  David Malcolm  <dmalcolm@redhat.com>
11494
11495         PR analyzer/93375
11496         * supergraph.cc (callgraph_superedge::get_arg_for_parm): Fail
11497         gracefully is the number of parameters at the callee exceeds the
11498         number of arguments at the call stmt.
11499         (callgraph_superedge::get_parm_for_arg): Likewise.
11500
11501 2020-01-22  David Malcolm  <dmalcolm@redhat.com>
11502
11503         PR analyzer/93382
11504         * program-state.cc (sm_state_map::on_svalue_purge): If the
11505         entry survives, but the origin is being purged, then reset the
11506         origin to null.
11507
11508 2020-01-22  David Malcolm  <dmalcolm@redhat.com>
11509
11510         * sm-signal.cc: Fix nesting of CHECKING_P and namespace ana.
11511
11512 2020-01-22  David Malcolm  <dmalcolm@redhat.com>
11513
11514         PR analyzer/93378
11515         * engine.cc (setjmp_svalue::compare_fields): Update for
11516         replacement of m_enode with m_setjmp_record.
11517         (setjmp_svalue::add_to_hash): Likewise.
11518         (setjmp_svalue::get_index): Rename...
11519         (setjmp_svalue::get_enode_index): ...to this.
11520         (setjmp_svalue::print_details): Update for replacement of m_enode
11521         with m_setjmp_record.
11522         (exploded_node::on_longjmp): Likewise.
11523         * exploded-graph.h (rewind_info_t::m_enode_origin): Replace...
11524         (rewind_info_t::m_setjmp_record): ...with this.
11525         (rewind_info_t::rewind_info_t): Update for replacement of m_enode
11526         with m_setjmp_record.
11527         (rewind_info_t::get_setjmp_point): Likewise.
11528         (rewind_info_t::get_setjmp_call): Likewise.
11529         * region-model.cc (region_model::dump_summary_of_map): Likewise.
11530         (region_model::on_setjmp): Likewise.
11531         * region-model.h (struct setjmp_record): New struct.
11532         (setjmp_svalue::m_enode): Replace...
11533         (setjmp_svalue::m_setjmp_record): ...with this.
11534         (setjmp_svalue::setjmp_svalue): Update for replacement of m_enode
11535         with m_setjmp_record.
11536         (setjmp_svalue::clone): Likewise.
11537         (setjmp_svalue::get_index): Rename...
11538         (setjmp_svalue::get_enode_index): ...to this.
11539         (setjmp_svalue::get_exploded_node): Replace...
11540         (setjmp_svalue::get_setjmp_record): ...with this.
11541
11542 2020-01-22  David Malcolm  <dmalcolm@redhat.com>
11543
11544         PR analyzer/93316
11545         * analyzer.cc (is_setjmp_call_p): Check for "setjmp" as well as
11546         "_setjmp".
11547
11548 2020-01-22  David Malcolm  <dmalcolm@redhat.com>
11549
11550         PR analyzer/93307
11551         * analysis-plan.h: Wrap everything namespace "ana".
11552         * analyzer-logging.cc: Likewise.
11553         * analyzer-logging.h: Likewise.
11554         * analyzer-pass.cc (pass_analyzer::execute): Update for "ana"
11555         namespace.
11556         * analyzer-selftests.cc: Wrap everything namespace "ana".
11557         * analyzer-selftests.h: Likewise.
11558         * analyzer.h: Likewise for forward decls of types.
11559         * call-string.h: Likewise.
11560         * checker-path.cc: Likewise.
11561         * checker-path.h: Likewise.
11562         * constraint-manager.cc: Likewise.
11563         * constraint-manager.h: Likewise.
11564         * diagnostic-manager.cc: Likewise.
11565         * diagnostic-manager.h: Likewise.
11566         * engine.cc: Likewise.
11567         * engine.h: Likewise.
11568         * exploded-graph.h: Likewise.
11569         * function-set.cc: Likewise.
11570         * function-set.h: Likewise.
11571         * pending-diagnostic.cc: Likewise.
11572         * pending-diagnostic.h: Likewise.
11573         * program-point.cc: Likewise.
11574         * program-point.h: Likewise.
11575         * program-state.cc: Likewise.
11576         * program-state.h: Likewise.
11577         * region-model.cc: Likewise.
11578         * region-model.h: Likewise.
11579         * sm-file.cc: Likewise.
11580         * sm-malloc.cc: Likewise.
11581         * sm-pattern-test.cc: Likewise.
11582         * sm-sensitive.cc: Likewise.
11583         * sm-signal.cc: Likewise.
11584         * sm-taint.cc: Likewise.
11585         * sm.cc: Likewise.
11586         * sm.h: Likewise.
11587         * state-purge.h: Likewise.
11588         * supergraph.cc: Likewise.
11589         * supergraph.h: Likewise.
11590
11591 2020-01-21  David Malcolm  <dmalcolm@redhat.com>
11592
11593         PR analyzer/93352
11594         * region-model.cc (int_cmp): Rename to...
11595         (array_region::key_cmp): ...this, using key_t rather than int.
11596         Rewrite in terms of comparisons rather than subtraction to
11597         ensure qsort is anti-symmetric when handling extreme values.
11598         (array_region::walk_for_canonicalization): Update for above
11599         renaming.
11600         * region-model.h (array_region::key_cmp): New decl.
11601
11602 2020-01-17  David Malcolm  <dmalcolm@redhat.com>
11603
11604         PR analyzer/93290
11605         * region-model.cc (region_model::eval_condition_without_cm): Avoid
11606         gcc_unreachable for unexpected operations for the case where
11607         we're comparing an svalue against itself.
11608
11609 2020-01-17  David Malcolm  <dmalcolm@redhat.com>
11610
11611         PR analyzer/93281
11612         * region-model.cc
11613         (region_model::convert_byte_offset_to_array_index): Convert to
11614         ssizetype before dividing by byte_size.  Use fold_binary rather
11615         than fold_build2 to avoid needlessly constructing a tree for the
11616         non-const case.
11617
11618 2020-01-15  David Malcolm  <dmalcolm@redhat.com>
11619
11620         * engine.cc (class impl_region_model_context): Fix comment.
11621
11622 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
11623
11624         PR analyzer/93212
11625         * region-model.cc (make_region_for_type): Use
11626         FUNC_OR_METHOD_TYPE_P rather than comparing against FUNCTION_TYPE.
11627         * region-model.h (function_region::function_region): Likewise.
11628
11629 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
11630
11631         * program-state.cc (sm_state_map::clone_with_remapping): Copy
11632         m_global_state.
11633         (selftest::test_program_state_merging_2): New selftest.
11634         (selftest::analyzer_program_state_cc_tests): Call it.
11635
11636 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
11637
11638         * checker-path.h (checker_path::get_checker_event): New function.
11639         (checker_path): Add DISABLE_COPY_AND_ASSIGN; make fields private.
11640         * diagnostic-manager.cc
11641         (diagnostic_manager::prune_for_sm_diagnostic): Replace direct
11642         access to checker_path::m_events with accessor functions.  Fix
11643         overlong line.
11644         (diagnostic_manager::prune_interproc_events): Replace direct
11645         access to checker_path::m_events with accessor functions.
11646         (diagnostic_manager::finish_pruning): Likewise.
11647
11648 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
11649
11650         * checker-path.h (checker_event::clone): Delete vfunc decl.
11651         (debug_event::clone): Delete vfunc impl.
11652         (custom_event::clone): Delete vfunc impl.
11653         (statement_event::clone): Delete vfunc impl.
11654         (function_entry_event::clone): Delete vfunc impl.
11655         (state_change_event::clone): Delete vfunc impl.
11656         (start_cfg_edge_event::clone): Delete vfunc impl.
11657         (end_cfg_edge_event::clone): Delete vfunc impl.
11658         (call_event::clone): Delete vfunc impl.
11659         (return_event::clone): Delete vfunc impl.
11660         (setjmp_event::clone): Delete vfunc impl.
11661         (rewind_from_longjmp_event::clone): Delete vfunc impl.
11662         (rewind_to_setjmp_event::clone): Delete vfunc impl.
11663         (warning_event::clone): Delete vfunc impl.
11664
11665 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
11666
11667         * supergraph.cc (supernode::dump_dot): Ensure that the TABLE
11668         element has at least one TR.
11669
11670 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
11671
11672         PR analyzer/58237
11673         * engine.cc (leak_stmt_finder::find_stmt): Use get_pure_location
11674         when comparing against UNKNOWN_LOCATION.
11675         (stmt_requires_new_enode_p): Likewise.
11676         (exploded_graph::dump_exploded_nodes): Likewise.
11677         * supergraph.cc (supernode::get_start_location): Likewise.
11678         (supernode::get_end_location): Likewise.
11679
11680 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
11681
11682         PR analyzer/58237
11683         * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
11684         selftest::analyzer_sm_file_cc_tests.
11685         * analyzer-selftests.h (selftest::analyzer_sm_file_cc_tests): New
11686         decl.
11687         * sm-file.cc: Include "analyzer/function-set.h" and
11688         "analyzer/analyzer-selftests.h".
11689         (get_file_using_fns): New function.
11690         (is_file_using_fn_p): New function.
11691         (fileptr_state_machine::on_stmt): Return true for known functions.
11692         (selftest::analyzer_sm_file_cc_tests): New function.
11693
11694 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
11695
11696         * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
11697         selftest::analyzer_sm_signal_cc_tests.
11698         * analyzer-selftests.h (selftest::analyzer_sm_signal_cc_tests):
11699         New decl.
11700         * sm-signal.cc: Include "analyzer/function-set.h" and
11701         "analyzer/analyzer-selftests.h".
11702         (get_async_signal_unsafe_fns): New function.
11703         (signal_unsafe_p): Reimplement in terms of the above.
11704         (selftest::analyzer_sm_signal_cc_tests): New function.
11705
11706 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
11707
11708         * analyzer-selftests.cc (selftest::run_analyzer_selftests): Call
11709         selftest::analyzer_function_set_cc_tests.
11710         * analyzer-selftests.h (selftest::analyzer_function_set_cc_tests):
11711         New decl.
11712         * function-set.cc: New file.
11713         * function-set.h: New file.
11714
11715 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
11716
11717         * analyzer.h (fndecl_has_gimple_body_p): New decl.
11718         * engine.cc (impl_region_model_context::on_unknown_change): New
11719         function.
11720         (fndecl_has_gimple_body_p): Make non-static.
11721         (exploded_node::on_stmt): Treat __analyzer_dump_exploded_nodes as
11722         known.  Track whether we have a call with unknown side-effects and
11723         pass it to on_call_post.
11724         * exploded-graph.h (impl_region_model_context::on_unknown_change):
11725         New decl.
11726         * program-state.cc (sm_state_map::on_unknown_change): New function.
11727         * program-state.h (sm_state_map::on_unknown_change): New decl.
11728         * region-model.cc: Include "bitmap.h".
11729         (region_model::on_call_pre): Return a bool, capturing whether the
11730         call has unknown side effects.
11731         (region_model::on_call_post): Add arg "bool unknown_side_effects"
11732         and if true, call handle_unrecognized_call.
11733         (class reachable_regions): New class.
11734         (region_model::handle_unrecognized_call): New function.
11735         * region-model.h (region_model::on_call_pre): Return a bool.
11736         (region_model::on_call_post): Add arg "bool unknown_side_effects".
11737         (region_model::handle_unrecognized_call): New decl.
11738         (region_model_context::on_unknown_change): New vfunc.
11739         (test_region_model_context::on_unknown_change): New function.
11740
11741 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
11742
11743         * diagnostic-manager.cc (saved_diagnostic::operator==): Move here
11744         from header.  Replace pointer equality test on m_var with call to
11745         pending_diagnostic::same_tree_p.
11746         * diagnostic-manager.h (saved_diagnostic::operator==): Move to
11747         diagnostic-manager.cc.
11748         * pending-diagnostic.cc (pending_diagnostic::same_tree_p): New.
11749         * pending-diagnostic.h (pending_diagnostic::same_tree_p): New.
11750         * sm-file.cc (file_diagnostic::subclass_equal_p): Replace pointer
11751         equality on m_arg with call to pending_diagnostic::same_tree_p.
11752         * sm-malloc.cc (malloc_diagnostic::subclass_equal_p): Likewise.
11753         (possible_null_arg::subclass_equal_p): Likewise.
11754         (null_arg::subclass_equal_p): Likewise.
11755         (free_of_non_heap::subclass_equal_p): Likewise.
11756         * sm-pattern-test.cc (pattern_match::operator==): Likewise.
11757         * sm-sensitive.cc (exposure_through_output_file::operator==):
11758         Likewise.
11759         * sm-taint.cc (tainted_array_index::operator==): Likewise.
11760
11761 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
11762
11763         * diagnostic-manager.cc (dedupe_winners::add): Add logging
11764         of deduplication decisions made.
11765
11766 2020-01-14  David Malcolm  <dmalcolm@redhat.com>
11767
11768         * ChangeLog: New file.
11769         * analyzer-selftests.cc: New file.
11770         * analyzer-selftests.h: New file.
11771         * analyzer.opt: New file.
11772         * analysis-plan.cc: New file.
11773         * analysis-plan.h: New file.
11774         * analyzer-logging.cc: New file.
11775         * analyzer-logging.h: New file.
11776         * analyzer-pass.cc: New file.
11777         * analyzer.cc: New file.
11778         * analyzer.h: New file.
11779         * call-string.cc: New file.
11780         * call-string.h: New file.
11781         * checker-path.cc: New file.
11782         * checker-path.h: New file.
11783         * constraint-manager.cc: New file.
11784         * constraint-manager.h: New file.
11785         * diagnostic-manager.cc: New file.
11786         * diagnostic-manager.h: New file.
11787         * engine.cc: New file.
11788         * engine.h: New file.
11789         * exploded-graph.h: New file.
11790         * pending-diagnostic.cc: New file.
11791         * pending-diagnostic.h: New file.
11792         * program-point.cc: New file.
11793         * program-point.h: New file.
11794         * program-state.cc: New file.
11795         * program-state.h: New file.
11796         * region-model.cc: New file.
11797         * region-model.h: New file.
11798         * sm-file.cc: New file.
11799         * sm-malloc.cc: New file.
11800         * sm-malloc.dot: New file.
11801         * sm-pattern-test.cc: New file.
11802         * sm-sensitive.cc: New file.
11803         * sm-signal.cc: New file.
11804         * sm-taint.cc: New file.
11805         * sm.cc: New file.
11806         * sm.h: New file.
11807         * state-purge.cc: New file.
11808         * state-purge.h: New file.
11809         * supergraph.cc: New file.
11810         * supergraph.h: New file.
11811
11812 2019-12-13  David Malcolm  <dmalcolm@redhat.com>
11813
11814         * Initial creation
11815
11816 \f
11817 Copyright (C) 2019-2024 Free Software Foundation, Inc.
11818
11819 Copying and distribution of this file, with or without modification,
11820 are permitted in any medium without royalty provided the copyright
11821 notice and this notice are preserved.